From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:56:59 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5ceb6fdf0eb53ecd395ba46f6392b8b132bf92d0;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch bluetooth-btmtk-fix-btmtk.c-undefined-reference-build-error-harder.patch bluetooth-btmtk-remove-ifdef-around-declarations.patch bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch jiffies-define-secs_to_jiffies.patch ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch selftests-hid-ensure-cki-can-compile-our-new-tests-on-old-kernels.patch seqlock-fix-scoped_seqlock_read-kernel-doc.patch writeback-drop-now-unnecessary-rcu_barrier-in-cgroup_writeback_umount.patch writeback-fix-use-after-free-in-inode_switch_wbs_work_fn.patch xfs-fix-stupid-compiler-warning.patch --- diff --git a/queue-6.6/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch b/queue-6.6/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch new file mode 100644 index 0000000000..2e5806b24b --- /dev/null +++ b/queue-6.6/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch @@ -0,0 +1,62 @@ +From d38eaf611839b85ade3dd3db309dbc8aaaaf0095 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Fri, 12 Jun 2026 10:21:09 -0400 +Subject: Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev + +From: Luiz Augusto von Dentz + +commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 upstream. + +b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding +conn ref") don't reset the chan->conn to NULL anymore making the bt# +netdev not be remove once the last l2cap_chan_del is removed. + +Instead of restoring the original behavior this remove the logic of +keeping the interface after the last channel is removed because it +never worked as intended and the l2cap_chan_del always detach its +l2cap_conn which results in always removing the channel anyway. + +Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/6lowpan.c | 18 +++--------------- + 1 file changed, 3 insertions(+), 15 deletions(-) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -781,20 +781,10 @@ static void chan_close_cb(struct l2cap_c + struct lowpan_btle_dev *dev = NULL; + struct lowpan_peer *peer; + int err = -ENOENT; +- bool last = false, remove = true; ++ bool last = false; + + BT_DBG("chan %p conn %p", chan, chan->conn); + +- if (chan->conn && chan->conn->hcon) { +- if (!is_bt_6lowpan(chan->conn->hcon)) +- return; +- +- /* If conn is set, then the netdev is also there and we should +- * not remove it. +- */ +- remove = false; +- } +- + spin_lock(&devices_lock); + + list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { +@@ -821,10 +811,8 @@ static void chan_close_cb(struct l2cap_c + + ifdown(dev->netdev); + +- if (remove) { +- INIT_WORK(&entry->delete_netdev, delete_netdev); +- schedule_work(&entry->delete_netdev); +- } ++ INIT_WORK(&entry->delete_netdev, delete_netdev); ++ schedule_work(&entry->delete_netdev); + } else { + spin_unlock(&devices_lock); + } diff --git a/queue-6.6/bluetooth-btmtk-fix-btmtk.c-undefined-reference-build-error-harder.patch b/queue-6.6/bluetooth-btmtk-fix-btmtk.c-undefined-reference-build-error-harder.patch new file mode 100644 index 0000000000..9c29eab970 --- /dev/null +++ b/queue-6.6/bluetooth-btmtk-fix-btmtk.c-undefined-reference-build-error-harder.patch @@ -0,0 +1,50 @@ +From 61f7a8f975456d7be21100ee0936389142b95a81 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 22 Jul 2024 11:27:05 +0200 +Subject: Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder + +From: Arnd Bergmann + +commit 61f7a8f975456d7be21100ee0936389142b95a81 upstream. + +The previous fix was incomplete as the link failure still persists +with CONFIG_USB=m when the sdio or serial wrappers for btmtk.c +are build-in: + +btmtk.c:(.text+0x468): undefined reference to `usb_alloc_urb' +btmtk.c:(.text+0x488): undefined reference to `usb_free_urb' +btmtk.c:(.text+0x500): undefined reference to `usb_anchor_urb' +btmtk.c:(.text+0x50a): undefined reference to `usb_submit_urb' +btmtk.c:(.text+0x92c): undefined reference to `usb_control_msg' +btmtk.c:(.text+0xa92): undefined reference to `usb_unanchor_urb' +btmtk.c:(.text+0x11e4): undefined reference to `usb_set_interface' +btmtk.c:(.text+0x120a): undefined reference to `usb_kill_anchored_urbs' + +Disallow this configuration. + +Fixes: f0c83a23fcbb ("Bluetooth: btmtk: Fix btmtk.c undefined reference build error") +Signed-off-by: Arnd Bergmann +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/Kconfig ++++ b/drivers/bluetooth/Kconfig +@@ -412,6 +412,7 @@ config BT_ATH3K + config BT_MTKSDIO + tristate "MediaTek HCI SDIO driver" + depends on MMC ++ depends on USB || !BT_HCIBTUSB_MTK + select BT_MTK + help + MediaTek Bluetooth HCI SDIO driver. +@@ -424,6 +425,7 @@ config BT_MTKSDIO + config BT_MTKUART + tristate "MediaTek HCI UART driver" + depends on SERIAL_DEV_BUS ++ depends on USB || !BT_HCIBTUSB_MTK + select BT_MTK + help + MediaTek Bluetooth HCI UART driver. diff --git a/queue-6.6/bluetooth-btmtk-remove-ifdef-around-declarations.patch b/queue-6.6/bluetooth-btmtk-remove-ifdef-around-declarations.patch new file mode 100644 index 0000000000..ee01a744aa --- /dev/null +++ b/queue-6.6/bluetooth-btmtk-remove-ifdef-around-declarations.patch @@ -0,0 +1,50 @@ +From 7a8c6fb21a7c913ddb99785b14914dab2f934fbd Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 22 Jul 2024 11:27:06 +0200 +Subject: Bluetooth: btmtk: remove #ifdef around declarations + +From: Arnd Bergmann + +commit 7a8c6fb21a7c913ddb99785b14914dab2f934fbd upstream. + +The caller of these functions in btusb.c is guarded with an +if(IS_ENABLED()) style check, so dead code is left out, but the +declarations are still needed at compile time: + +drivers/bluetooth/btusb.c: In function 'btusb_mtk_reset': +drivers/bluetooth/btusb.c:2705:15: error: implicit declaration of function 'btmtk_usb_subsys_reset' [-Wimplicit-function-declaration] + 2705 | err = btmtk_usb_subsys_reset(hdev, btmtk_data->dev_id); + | ^~~~~~~~~~~~~~~~~~~~~~ +drivers/bluetooth/btusb.c: In function 'btusb_send_frame_mtk': +drivers/bluetooth/btusb.c:2720:23: error: implicit declaration of function 'alloc_mtk_intr_urb' [-Wimplicit-function-declaration] + 2720 | urb = alloc_mtk_intr_urb(hdev, skb, btusb_tx_complete); + | ^~~~~~~~~~~~~~~~~~ +drivers/bluetooth/btusb.c:2720:21: error: assignment to 'struct urb *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + 2720 | urb = alloc_mtk_intr_urb(hdev, skb, btusb_tx_complete); + | ^ + +Fixes: f0c83a23fcbb ("Bluetooth: btmtk: Fix btmtk.c undefined reference build error") +Signed-off-by: Arnd Bergmann +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btmtk.h | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/bluetooth/btmtk.h ++++ b/drivers/bluetooth/btmtk.h +@@ -189,13 +189,11 @@ int btmtk_process_coredump(struct hci_de + void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver, + u32 fw_flavor); + +-#if IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) + int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id); + + int btmtk_usb_setup(struct hci_dev *hdev); + + int btmtk_usb_shutdown(struct hci_dev *hdev); +-#endif + #else + + static inline int btmtk_set_bdaddr(struct hci_dev *hdev, diff --git a/queue-6.6/bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch b/queue-6.6/bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch new file mode 100644 index 0000000000..1f4f454dec --- /dev/null +++ b/queue-6.6/bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch @@ -0,0 +1,31 @@ +From 59710a26a289ad4e7ef227d22063e964930928b0 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Mon, 30 Jun 2025 15:37:46 -0400 +Subject: Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state + +From: Luiz Augusto von Dentz + +commit 59710a26a289ad4e7ef227d22063e964930928b0 upstream. + +The check for destination to be BDADDR_ANY is no longer necessary with +the introduction of BIS_LINK. + +Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + include/net/bluetooth/hci_core.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1339,8 +1339,7 @@ hci_conn_hash_lookup_big_state(struct hc + rcu_read_lock(); + + list_for_each_entry_rcu(c, &h->list, list) { +- if (c->type != BIS_LINK || bacmp(&c->dst, BDADDR_ANY) || +- c->state != state) ++ if (c->type != BIS_LINK || c->state != state) + continue; + + if (handle == c->iso_qos.bcast.big) { diff --git a/queue-6.6/bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch b/queue-6.6/bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch new file mode 100644 index 0000000000..d74a73db49 --- /dev/null +++ b/queue-6.6/bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch @@ -0,0 +1,30 @@ +From 314d30b1508682e27c8a324096262c66f23455d9 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Thu, 3 Jul 2025 09:45:08 -0400 +Subject: Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle + +From: Luiz Augusto von Dentz + +commit 314d30b1508682e27c8a324096262c66f23455d9 upstream. + +BIS/PA connections do have their own cleanup proceedure which are +performed by hci_conn_cleanup/bis_cleanup. + +Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_sync.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -5529,7 +5529,7 @@ static int hci_disconnect_sync(struct hc + { + struct hci_cp_disconnect cp; + +- if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) { ++ if (conn->type == BIS_LINK) { + /* This is a BIS connection, hci_conn_del will + * do the necessary cleanup. + */ diff --git a/queue-6.6/driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch b/queue-6.6/driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch new file mode 100644 index 0000000000..8124ac1243 --- /dev/null +++ b/queue-6.6/driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch @@ -0,0 +1,36 @@ +From f9e6da99fe49277979798a1c3b9790ae10aaa18a Mon Sep 17 00:00:00 2001 +From: Danilo Krummrich +Date: Mon, 25 May 2026 03:23:21 +0200 +Subject: driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() + +From: Danilo Krummrich + +commit f9e6da99fe49277979798a1c3b9790ae10aaa18a upstream. + +mod_delayed_work() takes jiffies, not seconds. Thus, restore the dropped +conversion. + +While at it, fix incorrect indentation. + +Fixes: 1137838865bf ("driver core: Use mod_delayed_work to prevent lost deferred probe work") +Tested-by: Biju Das +Tested-by: Geert Uytterhoeven +Reviewed-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260525012340.3860581-1-dakr@kernel.org +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/dd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -327,7 +327,7 @@ void deferred_probe_extend_timeout(void) + * start a new one. + */ + if (mod_delayed_work(system_wq, &deferred_probe_timeout_work, +- driver_deferred_probe_timeout)) ++ secs_to_jiffies(driver_deferred_probe_timeout))) + pr_debug("Extended deferred probe timeout by %d secs\n", + driver_deferred_probe_timeout); + } diff --git a/queue-6.6/driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch b/queue-6.6/driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch new file mode 100644 index 0000000000..20c3efa54b --- /dev/null +++ b/queue-6.6/driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch @@ -0,0 +1,40 @@ +From 557495bc879013c3d5e21d667e987e7ce3a514de Mon Sep 17 00:00:00 2001 +From: Danilo Krummrich +Date: Mon, 25 May 2026 03:23:22 +0200 +Subject: driver core: Guard deferred probe timeout extension with delayed_work_pending() + +From: Danilo Krummrich + +commit 557495bc879013c3d5e21d667e987e7ce3a514de upstream. + +mod_delayed_work() unconditionally queues the work even when it wasn't +previously pending, which can fire the timeout prematurely or restart it +after it already fired. Add a delayed_work_pending() guard to restore +the originally intended semantics. + +Premature firing calls fw_devlink_drivers_done() before all built-in +drivers have registered, causing fw_devlink to prematurely relax device +links for suppliers whose drivers haven't loaded yet. + +Fixes: 1137838865bf ("driver core: Use mod_delayed_work to prevent lost deferred probe work") +Tested-by: Geert Uytterhoeven +Reviewed-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/20260525012340.3860581-2-dakr@kernel.org +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/dd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -326,7 +326,8 @@ void deferred_probe_extend_timeout(void) + * If the work hasn't been queued yet or if the work expired, don't + * start a new one. + */ +- if (mod_delayed_work(system_wq, &deferred_probe_timeout_work, ++ if (delayed_work_pending(&deferred_probe_timeout_work) && ++ mod_delayed_work(system_wq, &deferred_probe_timeout_work, + secs_to_jiffies(driver_deferred_probe_timeout))) + pr_debug("Extended deferred probe timeout by %d secs\n", + driver_deferred_probe_timeout); diff --git a/queue-6.6/jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch b/queue-6.6/jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch new file mode 100644 index 0000000000..310c780105 --- /dev/null +++ b/queue-6.6/jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch @@ -0,0 +1,39 @@ +From bb2784d9ab49587ba4fbff37a319fff2924db289 Mon Sep 17 00:00:00 2001 +From: Easwar Hariharan +Date: Thu, 30 Jan 2025 19:26:58 +0000 +Subject: jiffies: Cast to unsigned long in secs_to_jiffies() conversion + +From: Easwar Hariharan + +commit bb2784d9ab49587ba4fbff37a319fff2924db289 upstream. + +While converting users of msecs_to_jiffies(), lkp reported that some range +checks would always be true because of the mismatch between the implied int +value of secs_to_jiffies() vs the unsigned long return value of the +msecs_to_jiffies() calls it was replacing. + +Fix this by casting the secs_to_jiffies() input value to unsigned long. + +Fixes: b35108a51cf7ba ("jiffies: Define secs_to_jiffies()") +Reported-by: kernel test robot +Signed-off-by: Easwar Hariharan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20250130192701.99626-1-eahariha@linux.microsoft.com +Closes: https://lore.kernel.org/oe-kbuild-all/202501301334.NB6NszQR-lkp@intel.com/ +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/jiffies.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -534,7 +534,7 @@ static __always_inline unsigned long mse + * + * Return: jiffies value + */ +-#define secs_to_jiffies(_secs) ((_secs) * HZ) ++#define secs_to_jiffies(_secs) (unsigned long)((_secs) * HZ) + + extern unsigned long __usecs_to_jiffies(const unsigned int u); + #if !(USEC_PER_SEC % HZ) diff --git a/queue-6.6/jiffies-define-secs_to_jiffies.patch b/queue-6.6/jiffies-define-secs_to_jiffies.patch new file mode 100644 index 0000000000..e1e5b87aa6 --- /dev/null +++ b/queue-6.6/jiffies-define-secs_to_jiffies.patch @@ -0,0 +1,65 @@ +From b35108a51cf7bab58d7eace1267d7965978bcdb8 Mon Sep 17 00:00:00 2001 +From: Easwar Hariharan +Date: Wed, 30 Oct 2024 17:47:35 +0000 +Subject: jiffies: Define secs_to_jiffies() + +From: Easwar Hariharan + +commit b35108a51cf7bab58d7eace1267d7965978bcdb8 upstream. + +secs_to_jiffies() is defined in hci_event.c and cannot be reused by +other call sites. Hoist it into the core code to allow conversion of the +~1150 usages of msecs_to_jiffies() that either: + + - use a multiplier value of 1000 or equivalently MSEC_PER_SEC, or + - have timeouts that are denominated in seconds (i.e. end in 000) + +It's implemented as a macro to allow usage in static initializers. + +This will also allow conversion of yet more sites that use (sec * HZ) +directly, and improve their readability. + +Suggested-by: Michael Kelley +Signed-off-by: Easwar Hariharan +Signed-off-by: Thomas Gleixner +Reviewed-by: Luiz Augusto von Dentz +Link: https://lore.kernel.org/all/20241030-open-coded-timeouts-v3-1-9ba123facf88@linux.microsoft.com +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/jiffies.h | 13 +++++++++++++ + net/bluetooth/hci_event.c | 2 -- + 2 files changed, 13 insertions(+), 2 deletions(-) + +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -523,6 +523,19 @@ static __always_inline unsigned long mse + } + } + ++/** ++ * secs_to_jiffies: - convert seconds to jiffies ++ * @_secs: time in seconds ++ * ++ * Conversion is done by simple multiplication with HZ ++ * ++ * secs_to_jiffies() is defined as a macro rather than a static inline ++ * function so it can be used in static initializers. ++ * ++ * Return: jiffies value ++ */ ++#define secs_to_jiffies(_secs) ((_secs) * HZ) ++ + extern unsigned long __usecs_to_jiffies(const unsigned int u); + #if !(USEC_PER_SEC % HZ) + static inline unsigned long _usecs_to_jiffies(const unsigned int u) +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -43,8 +43,6 @@ + #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00" + +-#define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000) +- + /* Handle HCI Event packets */ + + static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb, diff --git a/queue-6.6/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch b/queue-6.6/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch new file mode 100644 index 0000000000..9e5826519f --- /dev/null +++ b/queue-6.6/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch @@ -0,0 +1,86 @@ +From 7ce4fc40018de07f05f3035241122d992610dbfb Mon Sep 17 00:00:00 2001 +From: Gil Portnoy +Date: Thu, 28 May 2026 00:00:00 +0000 +Subject: ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd + +From: Gil Portnoy + +commit 7ce4fc40018de07f05f3035241122d992610dbfb upstream. + +Two concurrent same-user DHnC reconnects can both observe fp->conn == NULL +before either sets it. ksmbd_reopen_durable_fd() checks fp->conn to guard +against a handle already being reconnected, but the check and the binding +assignment are not atomic: both threads pass the guard, both call +ksmbd_conn_get() on the same fp, and both eventually reach +kfree(fp->owner.name) -- a double-free of the owner.name slab object. +The double-bound ksmbd_file also causes a write-UAF on the 344-byte +ksmbd_file_cache object when a concurrent smb2_close() spins on fp->f_lock +after the object has been freed by the losing reconnect path. + +KASAN on 7.1-rc5 (48-thread concurrent reconnect, 3000 cycles): + BUG: KASAN: double-free in ksmbd_reopen_durable_fd+0x268/0x308 + BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x150 + Write of size 4 at offset 24 into freed ksmbd_file_cache object +Five double-bind windows observed; 63 total KASAN reports triggered. + +Fix: validate and claim fp->conn under write_lock(&global_ft.lock) so the +check-and-claim is atomic. ksmbd_lookup_durable_fd() already treats +fp->conn != NULL as "in use" and skips such an fp; setting fp->conn before +dropping the lock closes the race. ksmbd_conn_get() is a non-sleeping +refcount increment, safe under the rwlock. The rollback path on __open_id() +failure also clears fp->conn/tcon under the lock so concurrent readers see +a consistent state. + +Fixes: b1f1e80620de ("ksmbd: centralize ksmbd_conn final release to plug transport leak") +Assisted-by: Henry (Claude):claude-opus-4 +Signed-off-by: Gil Portnoy +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/vfs_cache.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/fs/smb/server/vfs_cache.c ++++ b/fs/smb/server/vfs_cache.c +@@ -1191,19 +1191,19 @@ int ksmbd_reopen_durable_fd(struct ksmbd + struct ksmbd_lock *smb_lock; + unsigned int old_f_state; + ++ write_lock(&global_ft.lock); + if (!fp->is_durable || fp->conn || fp->tcon) { ++ write_unlock(&global_ft.lock); + pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon); + return -EBADF; + } + + if (has_file_id(fp->volatile_id)) { ++ write_unlock(&global_ft.lock); + pr_err("Still in use durable fd: %llu\n", fp->volatile_id); + return -EBADF; + } + +- old_f_state = fp->f_state; +- fp->f_state = FP_NEW; +- + /* + * Initialize fp's connection binding before publishing fp into the + * session's file table. If __open_id() is ordered first, a +@@ -1214,11 +1214,17 @@ int ksmbd_reopen_durable_fd(struct ksmbd + */ + fp->conn = ksmbd_conn_get(conn); + fp->tcon = work->tcon; ++ write_unlock(&global_ft.lock); ++ ++ old_f_state = fp->f_state; ++ fp->f_state = FP_NEW; + + __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID); + if (!has_file_id(fp->volatile_id)) { ++ write_lock(&global_ft.lock); + fp->conn = NULL; + fp->tcon = NULL; ++ write_unlock(&global_ft.lock); + ksmbd_conn_put(conn); + fp->f_state = old_f_state; + return -EBADF; diff --git a/queue-6.6/selftests-hid-ensure-cki-can-compile-our-new-tests-on-old-kernels.patch b/queue-6.6/selftests-hid-ensure-cki-can-compile-our-new-tests-on-old-kernels.patch new file mode 100644 index 0000000000..fb9cd6e857 --- /dev/null +++ b/queue-6.6/selftests-hid-ensure-cki-can-compile-our-new-tests-on-old-kernels.patch @@ -0,0 +1,65 @@ +From fcdf830ea634cf0ee6543b6cd6a4932f92464fc7 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Mon, 1 Jul 2024 14:39:49 +0200 +Subject: selftests/hid: ensure CKI can compile our new tests on old kernels + +From: Benjamin Tissoires + +commit fcdf830ea634cf0ee6543b6cd6a4932f92464fc7 upstream. + +In the same way than commit ae7487d112cf ("selftests/hid: ensure we can +compile the tests on kernels pre-6.3") we should expose struct hid_bpf_ops +when it's not available in vmlinux.h. + +So unexpose an eventual struct hid_bpf_ops, include vmlinux.h, and +re-export struct hid_bpf_ops. + +Fixes: d7696738d66b ("selftests/hid: convert the hid_bpf selftests with struct_ops") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202406270328.bscLN1IF-lkp@intel.com/ +Link: https://patch.msgid.link/20240701-fix-cki-v2-1-20564e2e1393@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/hid/progs/hid_bpf_helpers.h | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/tools/testing/selftests/hid/progs/hid_bpf_helpers.h ++++ b/tools/testing/selftests/hid/progs/hid_bpf_helpers.h +@@ -7,6 +7,7 @@ + + /* "undefine" structs and enums in vmlinux.h, because we "override" them below */ + #define hid_bpf_ctx hid_bpf_ctx___not_used ++#define hid_bpf_ops hid_bpf_ops___not_used + #define hid_report_type hid_report_type___not_used + #define hid_class_request hid_class_request___not_used + #define hid_bpf_attach_flags hid_bpf_attach_flags___not_used +@@ -24,6 +25,7 @@ + #include "vmlinux.h" + + #undef hid_bpf_ctx ++#undef hid_bpf_ops + #undef hid_report_type + #undef hid_class_request + #undef hid_bpf_attach_flags +@@ -68,6 +70,20 @@ enum hid_class_request { + HID_REQ_SET_PROTOCOL = 0x0B, + }; + ++struct hid_bpf_ops { ++ int hid_id; ++ u32 flags; ++ struct list_head list; ++ int (*hid_device_event)(struct hid_bpf_ctx *ctx, enum hid_report_type report_type, ++ u64 source); ++ int (*hid_rdesc_fixup)(struct hid_bpf_ctx *ctx); ++ int (*hid_hw_request)(struct hid_bpf_ctx *ctx, unsigned char reportnum, ++ enum hid_report_type rtype, enum hid_class_request reqtype, ++ u64 source); ++ int (*hid_hw_output_report)(struct hid_bpf_ctx *ctx, u64 source); ++ struct hid_device *hdev; ++}; ++ + #ifndef BPF_F_BEFORE + #define BPF_F_BEFORE (1U << 3) + #endif diff --git a/queue-6.6/seqlock-fix-scoped_seqlock_read-kernel-doc.patch b/queue-6.6/seqlock-fix-scoped_seqlock_read-kernel-doc.patch new file mode 100644 index 0000000000..079527bbb4 --- /dev/null +++ b/queue-6.6/seqlock-fix-scoped_seqlock_read-kernel-doc.patch @@ -0,0 +1,58 @@ +From f88a31308db6a856229150039b0f56d59696ed31 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Fri, 23 Jan 2026 10:37:49 -0800 +Subject: seqlock: fix scoped_seqlock_read kernel-doc + +From: Randy Dunlap + +commit f88a31308db6a856229150039b0f56d59696ed31 upstream. + +Eliminate all kernel-doc warnings in seqlock.h: + +- correct the macro to have "()" immediately following the macro name +- don't include the macro parameters in the short description (first line) +- make the parameter names in the comments match the actual macro + parameter names. +- use "::" for the Example + +WARNING: include/linux/seqlock.h:1341 This comment starts with '/**', but isn't a kernel-doc comment. + * scoped_seqlock_read (lock, ss_state) - execute the read side critical +Documentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING: + Definition list ends without a blank line; unexpected unindent. [docutils] +Warning: include/linux/seqlock.h:1357 function parameter '_seqlock' not described in 'scoped_seqlock_read' +Warning: include/linux/seqlock.h:1357 function parameter '_target' not described in 'scoped_seqlock_read' + +Fixes: cc39f3872c08 ("seqlock: Introduce scoped_seqlock_read()") +Signed-off-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Link: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/seqlock.h | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/include/linux/seqlock.h ++++ b/include/linux/seqlock.h +@@ -1357,15 +1357,14 @@ __scoped_seqlock_next(struct ss_tmp *sst + __scoped_seqlock_next(&_s, _seqlock, _target)) + + /** +- * scoped_seqlock_read (lock, ss_state) - execute the read side critical +- * section without manual sequence +- * counter handling or calls to other +- * helpers +- * @lock: pointer to seqlock_t protecting the data +- * @ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} indicating +- * the type of critical read section ++ * scoped_seqlock_read() - execute the read-side critical section ++ * without manual sequence counter handling ++ * or calls to other helpers ++ * @_seqlock: pointer to seqlock_t protecting the data ++ * @_target: an enum ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} ++ * indicating the type of critical read section + * +- * Example: ++ * Example:: + * + * scoped_seqlock_read (&lock, ss_lock) { + * // read-side critical section diff --git a/queue-6.6/series b/queue-6.6/series index 27c94f6707..98b72a6ae9 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1249,3 +1249,18 @@ bluetooth-separate-cis_link-and-bis_link-link-types.patch bluetooth-hci_sync-annotate-data-races-around-hdev-req_status.patch bluetooth-hci_conn-fix-null-ptr-deref-in-hci_abort_conn.patch kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch +seqlock-fix-scoped_seqlock_read-kernel-doc.patch +ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch +bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch +bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch +bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch +selftests-hid-ensure-cki-can-compile-our-new-tests-on-old-kernels.patch +bluetooth-btmtk-fix-btmtk.c-undefined-reference-build-error-harder.patch +bluetooth-btmtk-remove-ifdef-around-declarations.patch +xfs-fix-stupid-compiler-warning.patch +writeback-fix-use-after-free-in-inode_switch_wbs_work_fn.patch +writeback-drop-now-unnecessary-rcu_barrier-in-cgroup_writeback_umount.patch +jiffies-define-secs_to_jiffies.patch +jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch +driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch +driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch diff --git a/queue-6.6/writeback-drop-now-unnecessary-rcu_barrier-in-cgroup_writeback_umount.patch b/queue-6.6/writeback-drop-now-unnecessary-rcu_barrier-in-cgroup_writeback_umount.patch new file mode 100644 index 0000000000..3ea689350e --- /dev/null +++ b/queue-6.6/writeback-drop-now-unnecessary-rcu_barrier-in-cgroup_writeback_umount.patch @@ -0,0 +1,42 @@ +From e90a6d668e26e00a72df2d09c173b563468f09c9 Mon Sep 17 00:00:00 2001 +From: Baokun Li +Date: Thu, 21 May 2026 17:50:15 +0800 +Subject: writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() + +From: Baokun Li + +commit e90a6d668e26e00a72df2d09c173b563468f09c9 upstream. + +Commit e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when +switching inodes") replaced the queue_rcu_work() based scheduling of +inode wb switches with a plain queue_work(). Since then no switcher +goes through call_rcu(), so rcu_barrier() in cgroup_writeback_umount() +has no callbacks of its own to wait for. It still drains unrelated +call_rcu() callbacks from other subsystems on busy systems, which +incidentally slows umount down; drop it. + +Fixes: e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes") +Reviewed-by: Jan Kara +Signed-off-by: Baokun Li +Link: https://patch.msgid.link/20260521095016.2791354-3-libaokun@linux.alibaba.com +Acked-by: Tejun Heo +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/fs-writeback.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -1191,11 +1191,6 @@ void cgroup_writeback_umount(void) + * will then drain it. + */ + synchronize_rcu(); +- /* +- * Use rcu_barrier() to wait for all pending callbacks to +- * ensure that all in-flight wb switches are in the workqueue. +- */ +- rcu_barrier(); + flush_workqueue(isw_wq); + } + } diff --git a/queue-6.6/writeback-fix-use-after-free-in-inode_switch_wbs_work_fn.patch b/queue-6.6/writeback-fix-use-after-free-in-inode_switch_wbs_work_fn.patch new file mode 100644 index 0000000000..a447553506 --- /dev/null +++ b/queue-6.6/writeback-fix-use-after-free-in-inode_switch_wbs_work_fn.patch @@ -0,0 +1,104 @@ +From 6689f01d6740cf358932b3e97ee968c6099800d9 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 13 Apr 2026 11:36:19 +0200 +Subject: writeback: Fix use after free in inode_switch_wbs_work_fn() + +From: Jan Kara + +commit 6689f01d6740cf358932b3e97ee968c6099800d9 upstream. + +inode_switch_wbs_work_fn() has a loop like: + + wb_get(new_wb); + while (1) { + list = llist_del_all(&new_wb->switch_wbs_ctxs); + /* Nothing to do? */ + if (!list) + break; + ... process the items ... + } + +Now adding of items to the list looks like: + +wb_queue_isw() + if (llist_add(&isw->list, &wb->switch_wbs_ctxs)) + queue_work(isw_wq, &wb->switch_work); + +Because inode_switch_wbs_work_fn() loops when processing isw items, it +can happen that wb->switch_work is pending while wb->switch_wbs_ctxs is +empty. This is a problem because in that case wb can get freed (no isw +items -> no wb reference) while the work is still pending causing +use-after-free issues. + +We cannot just fix this by cancelling work when freeing wb because that +could still trigger problematic 0 -> 1 transitions on wb refcount due to +wb_get() in inode_switch_wbs_work_fn(). It could be all handled with +more careful code but that seems unnecessarily complex so let's avoid +that until it is proven that the looping actually brings practical +benefit. Just remove the loop from inode_switch_wbs_work_fn() instead. +That way when wb_queue_isw() queues work, we are guaranteed we have +added the first item to wb->switch_wbs_ctxs and nobody is going to +remove it (and drop the wb reference it holds) until the queued work +runs. + +Fixes: e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes") +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Link: https://patch.msgid.link/20260413093618.17244-2-jack@suse.cz +Acked-by: Tejun Heo +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/fs-writeback.c | 36 +++++++++++++++++++----------------- + 1 file changed, 19 insertions(+), 17 deletions(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -535,28 +535,30 @@ void inode_switch_wbs_work_fn(struct wor + struct inode_switch_wbs_context *isw, *next_isw; + struct llist_node *list; + ++ list = llist_del_all(&new_wb->switch_wbs_ctxs); + /* +- * Grab out reference to wb so that it cannot get freed under us ++ * Nothing to do? That would be a problem as references held by isw ++ * items protect wb from freeing... ++ */ ++ if (WARN_ON_ONCE(!list)) ++ return; ++ ++ /* ++ * Grab our reference to wb so that it cannot get freed under us + * after we process all the isw items. + */ + wb_get(new_wb); +- while (1) { +- list = llist_del_all(&new_wb->switch_wbs_ctxs); +- /* Nothing to do? */ +- if (!list) +- break; +- /* +- * In addition to synchronizing among switchers, I_WB_SWITCH +- * tells the RCU protected stat update paths to grab the i_page +- * lock so that stat transfer can synchronize against them. +- * Let's continue after I_WB_SWITCH is guaranteed to be +- * visible. +- */ +- synchronize_rcu(); ++ /* ++ * In addition to synchronizing among switchers, I_WB_SWITCH ++ * tells the RCU protected stat update paths to grab the i_page ++ * lock so that stat transfer can synchronize against them. ++ * Let's continue after I_WB_SWITCH is guaranteed to be ++ * visible. ++ */ ++ synchronize_rcu(); + +- llist_for_each_entry_safe(isw, next_isw, list, list) +- process_inode_switch_wbs(new_wb, isw); +- } ++ llist_for_each_entry_safe(isw, next_isw, list, list) ++ process_inode_switch_wbs(new_wb, isw); + wb_put(new_wb); + } + diff --git a/queue-6.6/xfs-fix-stupid-compiler-warning.patch b/queue-6.6/xfs-fix-stupid-compiler-warning.patch new file mode 100644 index 0000000000..58bf383f01 --- /dev/null +++ b/queue-6.6/xfs-fix-stupid-compiler-warning.patch @@ -0,0 +1,49 @@ +From f06725052098d7b1133ac3846d693c383dc427a2 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Thu, 4 Dec 2025 13:44:15 -0800 +Subject: xfs: fix stupid compiler warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Darrick J. Wong + +commit f06725052098d7b1133ac3846d693c383dc427a2 upstream. + +gcc 14.2 warns about: + +xfs_attr_item.c: In function ‘xfs_attr_recover_work’: +xfs_attr_item.c:785:9: warning: ‘ip’ may be used uninitialized [-Wmaybe-uninitialized] + 785 | xfs_trans_ijoin(tp, ip, 0); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~ +xfs_attr_item.c:740:42: note: ‘ip’ was declared here + 740 | struct xfs_inode *ip; + | ^~ + +I think this is bogus since xfs_attri_recover_work either returns a real +pointer having initialized ip or an ERR_PTR having not touched it, but +the tools are smarter than me so let's just null-init the variable +anyway. + +Cc: stable@vger.kernel.org # v6.8 +Fixes: e70fb328d52772 ("xfs: recreate work items when recovering intent items") +Signed-off-by: Darrick J. Wong +Reviewed-by: Carlos Maiolino +Reviewed-by: Christoph Hellwig +Signed-off-by: Carlos Maiolino +Signed-off-by: Greg Kroah-Hartman +--- + fs/xfs/xfs_attr_item.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/xfs/xfs_attr_item.c ++++ b/fs/xfs/xfs_attr_item.c +@@ -622,7 +622,7 @@ xfs_attr_recover_work( + struct xfs_attri_log_item *attrip = ATTRI_ITEM(lip); + struct xfs_attr_intent *attr; + struct xfs_mount *mp = lip->li_log->l_mp; +- struct xfs_inode *ip; ++ struct xfs_inode *ip = NULL; + struct xfs_da_args *args; + struct xfs_trans *tp; + struct xfs_trans_res resv;