From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 10:52:58 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a7c9286f673cd8eeb1b410d206c30bd47bb019bc;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch afs-fix-null-pointer-dereference-in-afs_get_tree.patch media-uvcvideo-avoid-partial-metadata-buffers.patch media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch serial-msm-disable-dma-for-kernel-console-uart.patch --- diff --git a/queue-5.10/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch b/queue-5.10/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch new file mode 100644 index 0000000000..592de5fbfc --- /dev/null +++ b/queue-5.10/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch @@ -0,0 +1,52 @@ +From 2daf8ac812c3d78c642fe7652f62e29df5e3da20 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:11 +0100 +Subject: afs: Fix further netns teardown to cancel the preallocation charger + +From: David Howells + +commit 2daf8ac812c3d78c642fe7652f62e29df5e3da20 upstream. + +When an afs network namespace is torn down, it cancels and waits for the +work item that keeps the preallocated rxrpc call/conn/peer queue charged +before disabling incoming (i.e. listen 0), but there's a small window in +which it can be requeued by an incoming call wending through the I/O +thread. + +Fix this by cancelling the charger work item again after reducing the +listen backlog to zero. + +Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger") +Reported-by: Jakub Kicinski +Signed-off-by: David Howells +Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com +cc: Li Daming +cc: Ren Wei +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/rxrpc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -108,8 +108,13 @@ void afs_close_socket(struct afs_net *ne + _enter(""); + + cancel_work_sync(&net->charge_preallocation_work); ++ /* Future work items should now see ->live is false. */ ++ + kernel_listen(net->socket, 0); ++ ++ /* Make sure work items are no longer running. */ + flush_workqueue(afs_async_calls); ++ cancel_work_sync(&net->charge_preallocation_work); + + if (net->spare_incoming_call) { + afs_put_call(net->spare_incoming_call); diff --git a/queue-5.10/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch b/queue-5.10/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch new file mode 100644 index 0000000000..c144181e4b --- /dev/null +++ b/queue-5.10/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch @@ -0,0 +1,64 @@ +From 47694fbc9d24ab6bf210f91e8efe06a10a478064 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 9 Jun 2026 15:09:08 +0100 +Subject: afs: Fix netns teardown to cancel the preallocation charger + +From: David Howells + +commit 47694fbc9d24ab6bf210f91e8efe06a10a478064 upstream. + +Fix the teardown of an afs network namespace to make sure it cancels the +work item that keeps the preallocated rxrpc call/conn/peer queue charged +before incoming calls are disabled (i.e. listen 0). + +Also, if net->live is false because the afs netns is being deleted, make +afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid +requeuing the charger. + +(This was found by AI review). + +Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests") +Reported-by: Simon Horman +Signed-off-by: David Howells +cc: Li Daming +cc: Ren Wei +cc: Marc Dionne +cc: Jeffrey Altman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260609140911.838677-5-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/rxrpc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -107,6 +107,7 @@ void afs_close_socket(struct afs_net *ne + { + _enter(""); + ++ cancel_work_sync(&net->charge_preallocation_work); + kernel_listen(net->socket, 0); + flush_workqueue(afs_async_calls); + +@@ -749,7 +750,7 @@ void afs_charge_preallocation(struct wor + container_of(work, struct afs_net, charge_preallocation_work); + struct afs_call *call = net->spare_incoming_call; + +- for (;;) { ++ while (READ_ONCE(net->live)) { + if (!call) { + call = afs_alloc_call(net, &afs_RXCMxxxx, GFP_KERNEL); + if (!call) +@@ -794,7 +795,8 @@ static void afs_rx_new_call(struct sock + { + struct afs_net *net = afs_sock2net(sk); + +- queue_work(afs_wq, &net->charge_preallocation_work); ++ if (net->live) ++ queue_work(afs_wq, &net->charge_preallocation_work); + } + + /* diff --git a/queue-5.10/afs-fix-null-pointer-dereference-in-afs_get_tree.patch b/queue-5.10/afs-fix-null-pointer-dereference-in-afs_get_tree.patch new file mode 100644 index 0000000000..98544b25c3 --- /dev/null +++ b/queue-5.10/afs-fix-null-pointer-dereference-in-afs_get_tree.patch @@ -0,0 +1,62 @@ +From 0b70716081c6462be9b2928ad736d0d527b09678 Mon Sep 17 00:00:00 2001 +From: Matvey Kovalev +Date: Mon, 22 Jun 2026 10:08:37 +0100 +Subject: afs: fix NULL pointer dereference in afs_get_tree() + +From: Matvey Kovalev + +commit 0b70716081c6462be9b2928ad736d0d527b09678 upstream. + +afs_alloc_sbi() uses kzalloc for memory allocation. And, if +ctx->dyn_root is not null, as->cell and as->volume are null. +In trace_afs_get_tree() they are dereferenced. + +KASAN error message: + +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 +04/01/2014 +RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550 +include/trace/events/afs.h:1365 + +Call Trace: +trace_afs_get_tree include/trace/events/afs.h:1365 [inline] +afs_get_tree+0x922/0x1350 fs/afs/super.c:599 +vfs_get_tree+0x8e/0x300 fs/super.c:1572 +do_new_mount fs/namespace.c:3011 [inline] +path_mount+0x14a5/0x2220 fs/namespace.c:3341 +do_mount fs/namespace.c:3354 [inline] +__do_sys_mount fs/namespace.c:3562 [inline] +__se_sys_mount fs/namespace.c:3539 [inline] +__x64_sys_mount+0x283/0x300 fs/namespace.c:3539 + do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46 +entry_SYSCALL_64_after_hwframe+0x67/0xd1 + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 80548b03991f5 ("afs: Add more tracepoints") +Cc: stable@vger.kernel.org +Signed-off-by: Matvey Kovalev +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260622090856.2746629-4-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -596,7 +596,8 @@ static int afs_get_tree(struct fs_contex + } + + fc->root = dget(sb->s_root); +- trace_afs_get_tree(as->cell, as->volume); ++ if (!ctx->dyn_root) ++ trace_afs_get_tree(as->cell, as->volume); + _leave(" = 0 [%p]", sb); + return 0; + diff --git a/queue-5.10/media-uvcvideo-avoid-partial-metadata-buffers.patch b/queue-5.10/media-uvcvideo-avoid-partial-metadata-buffers.patch new file mode 100644 index 0000000000..6103d4f039 --- /dev/null +++ b/queue-5.10/media-uvcvideo-avoid-partial-metadata-buffers.patch @@ -0,0 +1,82 @@ +From a15b773fe4ffa450b56347cc506b2d1405600f5d Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 17 Apr 2026 05:19:29 +0000 +Subject: media: uvcvideo: Avoid partial metadata buffers + +From: Ricardo Ribalda + +commit a15b773fe4ffa450b56347cc506b2d1405600f5d upstream. + +If the metadata queue that is empty receives a new buffer while we are +in the middle of processing a frame, the first metadata buffer will +contain partial information. + +Avoid this by tracking the state of the metadata buffer and making sure +that it is in sync with the data buffer. + +Now that we are at it, make sure that we skip buffers of size 1 or 0. +They are not allowed by the spec... but it is a simple check to add and +better be safe than sorry. + +Fixes: 088ead255245 ("media: uvcvideo: Add a metadata device node") +Cc: stable@vger.kernel.org +Signed-off-by: Ricardo Ribalda +Link: https://patch.msgid.link/20260417-uvc-meta-partial-v2-2-31d274af7d2d@chromium.org +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -1071,7 +1071,9 @@ static void uvc_video_stats_stop(struct + * uvc_video_decode_end will never be called with a NULL buffer. + */ + static int uvc_video_decode_start(struct uvc_streaming *stream, +- struct uvc_buffer *buf, const u8 *data, int len) ++ struct uvc_buffer *buf, ++ struct uvc_buffer *meta_buf, ++ const u8 *data, int len) + { + u8 fid; + +@@ -1138,6 +1140,8 @@ static int uvc_video_decode_start(struct + + /* TODO: Handle PTS and SCR. */ + buf->state = UVC_BUF_STATE_ACTIVE; ++ if (meta_buf) ++ meta_buf->state = UVC_BUF_STATE_ACTIVE; + } + + /* Mark the buffer as done if we're at the beginning of a new frame. +@@ -1306,7 +1310,7 @@ static void uvc_video_decode_meta(struct + ktime_t time; + const u8 *scr; + +- if (!meta_buf || length == 2) ++ if (length <= 2 || !meta_buf || meta_buf->state != UVC_BUF_STATE_ACTIVE) + return; + + has_pts = mem[1] & UVC_STREAM_PTS; +@@ -1422,7 +1426,7 @@ static void uvc_video_decode_isoc(struct + /* Decode the payload header. */ + mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset; + do { +- ret = uvc_video_decode_start(stream, buf, mem, ++ ret = uvc_video_decode_start(stream, buf, meta_buf, mem, + urb->iso_frame_desc[i].actual_length); + if (ret == -EAGAIN) + uvc_video_next_buffers(stream, &buf, &meta_buf); +@@ -1470,7 +1474,8 @@ static void uvc_video_decode_bulk(struct + */ + if (stream->bulk.header_size == 0 && !stream->bulk.skip_payload) { + do { +- ret = uvc_video_decode_start(stream, buf, mem, len); ++ ret = uvc_video_decode_start(stream, buf, meta_buf, mem, ++ len); + if (ret == -EAGAIN) + uvc_video_next_buffers(stream, &buf, &meta_buf); + } while (ret == -EAGAIN); diff --git a/queue-5.10/media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch b/queue-5.10/media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch new file mode 100644 index 0000000000..f605978b32 --- /dev/null +++ b/queue-5.10/media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch @@ -0,0 +1,67 @@ +From 2f24ac8dd87983a55f0498898f34a5f2b735b802 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 23 Mar 2026 09:53:53 +0000 +Subject: media: uvcvideo: Fix buffer sequence in frame gaps + +From: Ricardo Ribalda + +commit 2f24ac8dd87983a55f0498898f34a5f2b735b802 upstream. + +In UVC, the FID flips with every frame. For every FID flip, we increase +the stream sequence number. + +Now, if a FID flips multiple times and there is no data transferred between +the flips, the buffer sequence number will be set to the value of the +stream sequence number after the first flip. + +Userspace uses the buffer sequence number to determine if there have been +missing frames. With the current behaviour, userspace will think that the +gap is in the wrong location. + +This patch modifies uvc_video_decode_start() to provide the correct buffer +sequence number and timestamp. + +Cc: stable@kernel.org +Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -1096,6 +1096,19 @@ static int uvc_video_decode_start(struct + stream->sequence++; + if (stream->sequence) + uvc_video_stats_update(stream); ++ ++ /* ++ * On a FID flip initialize sequence number and timestamp. ++ * ++ * The driver already takes care of injecting FID flips for ++ * UVC_QUIRK_STREAM_NO_FID and UVC_QUIRK_MJPEG_NO_EOF. ++ */ ++ if (buf) { ++ buf->buf.field = V4L2_FIELD_NONE; ++ buf->buf.sequence = stream->sequence; ++ buf->buf.vb2_buf.timestamp = ++ ktime_to_ns(uvc_video_get_time()); ++ } + } + + uvc_video_clock_decode(stream, buf, data, len); +@@ -1134,10 +1147,6 @@ static int uvc_video_decode_start(struct + return -ENODATA; + } + +- buf->buf.field = V4L2_FIELD_NONE; +- buf->buf.sequence = stream->sequence; +- buf->buf.vb2_buf.timestamp = ktime_to_ns(uvc_video_get_time()); +- + /* TODO: Handle PTS and SCR. */ + buf->state = UVC_BUF_STATE_ACTIVE; + if (meta_buf) diff --git a/queue-5.10/serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch b/queue-5.10/serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch new file mode 100644 index 0000000000..f699979501 --- /dev/null +++ b/queue-5.10/serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch @@ -0,0 +1,50 @@ +From 061b627ba534230a18ec4d7251562af12325d06a Mon Sep 17 00:00:00 2001 +From: Matthias Feser +Date: Tue, 26 May 2026 07:35:09 +0000 +Subject: serial: 8250_omap: clear rx_running on zero-length DMA completes + +From: Matthias Feser + +commit 061b627ba534230a18ec4d7251562af12325d06a upstream. + +On AM33xx RX DMA only triggers when the FIFO reaches the +configured threshold (typically 48 bytes). For smaller bursts +no DMA request is issued and the FIFO is drained by RX timeout. + +In this case __dma_rx_do_complete() can legitimately see count == 0. + +The current code exits early in this case and does not clear +dma->rx_running, leaving the DMA state inconsistent. This can +prevent RX DMA from restarting and may cause +omap_8250_rx_dma_flush() to fail, marking DMA as broken. + +Fix this by clearing dma->rx_running once the DMA transfer has +completed or been terminated, even if no data was transferred. + +Fixes: a5fd8945a478 ("serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done") +Cc: stable +Signed-off-by: Matthias Feser +Reviewed-by: Moteen Shah +Link: https://patch.msgid.link/BE3P281MB55155F2F5795E411F5A65282EE0B2@BE3P281MB5515.DEUP281.PROD.OUTLOOK.COM +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_omap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -883,11 +883,12 @@ static void __dma_rx_do_complete(struct + dev_err(p->port.dev, "teardown incomplete\n"); + } + } ++ ++ dma->rx_running = 0; + if (!count) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + +- dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: diff --git a/queue-5.10/serial-msm-disable-dma-for-kernel-console-uart.patch b/queue-5.10/serial-msm-disable-dma-for-kernel-console-uart.patch new file mode 100644 index 0000000000..e91ff82963 --- /dev/null +++ b/queue-5.10/serial-msm-disable-dma-for-kernel-console-uart.patch @@ -0,0 +1,52 @@ +From 22dd2777e6c180e1c945b00f6d18550979436324 Mon Sep 17 00:00:00 2001 +From: Stephan Gerhold +Date: Mon, 6 Jul 2026 20:03:32 +0200 +Subject: serial: msm: Disable DMA for kernel console UART + +From: Stephan Gerhold + +commit 22dd2777e6c180e1c945b00f6d18550979436324 upstream. + +At the moment, concurrent writes from userspace and the kernel to the +console can trigger a race condition that results in an infinite loop of +the same messages printed over and over again. This is most likely to +happen during system startup or shutdown when the init system starts/stops +a large number of system services that interact with various kernel code. + +When userspace writes to the TTY device, the driver initiates an +asynchronous DMA transfer and releases the port lock. At the same moment, +the kernel printk path might grab the port lock and re-configure the UART +controller for PIO, without waiting for the DMA operation to complete. It +seems like this collision results in zero progress being reported for the +DMA engine, so the same text is printed to the console over and over again. + +For the kernel console, we want a reliable output path that will be +functional even during crashes etc. So rather than implementing complex +code to synchronize the kernel console write routines with the userspace +DMA write routines, simply disable DMA for the console UART instance. + +Similar checks exist in many other serial drivers, e.g. 8250_port.c, +imx.c, sh-sci.c etc. + +Cc: stable +Fixes: 3a878c430fd6 ("tty: serial: msm: Add TX DMA support") +Signed-off-by: Stephan Gerhold +Acked-by: Konrad Dybcio +Link: https://patch.msgid.link/20260706-serial-msm-console-dma-collision-v1-1-3179b8cb1d89@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/msm_serial.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -1216,7 +1216,8 @@ static int msm_startup(struct uart_port + data |= UART_MR1_AUTO_RFR_LEVEL0 & rfr_level; + msm_write(port, data, UART_MR1); + +- if (msm_port->is_uartdm) { ++ /* Disable DMA for console to prevent PIO/DMA collisions */ ++ if (msm_port->is_uartdm && !uart_console(port)) { + msm_request_tx_dma(msm_port, msm_port->uart.mapbase); + msm_request_rx_dma(msm_port, msm_port->uart.mapbase); + } diff --git a/queue-5.10/series b/queue-5.10/series index 78ab44c8e6..fa5aef228e 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -159,3 +159,10 @@ sched-fair-only-update-stats-for-allowed-cpus-when-l.patch crypto-algif_skcipher-force-synchronous-processing-o.patch tools-mm-slabinfo-fix-total_objects-attribute-name.patch crypto-af_alg-remove-zero-copy-support-from-skcipher.patch +media-uvcvideo-avoid-partial-metadata-buffers.patch +media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch +serial-msm-disable-dma-for-kernel-console-uart.patch +serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch +afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch +afs-fix-null-pointer-dereference-in-afs_get_tree.patch +afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch