drop some stable patches on request

diff --git a/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
deleted file mode 100644 (file)
index 9a18eec..0000000
--- a/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From stable+bounces-266564-greg=kroah.com@vger.kernel.org Tue Jun 16 21:53:00 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Jun 2026 15:52:54 -0400
-Subject: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
-To: stable@vger.kernel.org
-Cc: Ji'an Zhou <eilaimemedsnaimel@gmail.com>, Thomas Gleixner <tglx@kernel.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20260616195254.3526787-1-sashal@kernel.org>
-
-From: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
-
-[ Upstream commit 74e144274af39935b0f410c0ee4d2b91c3730414 ]
-
-When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
-target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
-waiter->task.
-
-The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
-the NULL waiter->task, causing a kernel crash.
-
-Add a self-deadlock check for non-top waiters before calling
-rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
-futex_lock_pi_atomic().
-
-Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
-Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
-Signed-off-by: Thomas Gleixner <tglx@kernel.org>
-Cc: stable@vger.kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- kernel/futex/requeue.c |    6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/kernel/futex/requeue.c
-+++ b/kernel/futex/requeue.c
-@@ -629,6 +629,12 @@ retry_private:
-                       continue;
-               }
- 
-+              /* Self-deadlock: non-top waiter already owns the PI futex. */
-+              if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
-+                      ret = -EDEADLK;
-+                      break;
-+              }
-+
-               ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
-                                               this->rt_waiter,
-                                               this->task);

diff --git a/queue-6.1/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch b/queue-6.1/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch
deleted file mode 100644 (file)
index f0adb1f..0000000
--- a/queue-6.1/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From f2539c56c74691e7a88af6372ba2b48c06ed2fe4 Mon Sep 17 00:00:00 2001
-From: Huacai Chen <chenhuacai@loongson.cn>
-Date: Thu, 25 Jun 2026 13:03:49 +0800
-Subject: LoongArch: Report dying CPU to RCU in stop_this_cpu()
-
-From: Huacai Chen <chenhuacai@loongson.cn>
-
-commit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream.
-
-This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying
-CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary
-CPUs in stop_this_cpu(). And the function marks the CPU offline for the
-scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps
-expecting a quiescent state from CPUs that are now spinning forever with
-interrupts disabled.
-
-As long as nothing waits for an RCU grace period after smp_send_stop()
-this is harmless, which is why it went unnoticed. However, since commit
-91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on
-PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures
-without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt()
-returns false. Any irq_work_sync() issued in the reboot/shutdown/halt
-path after smp_send_stop() then blocks on a grace period that can never
-complete, hanging the reboot:
-
-  WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
-  ...
-  rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
-  rcu: Offline CPU 1 blocking current GP.
-  rcu: Offline CPU 2 blocking current GP.
-  rcu: Offline CPU 3 blocking current GP.
-
-This issue needs some hacks to reproduce, and it was not noticed on
-LoongArch because arch_irq_work_has_interrupt() usually returns true.
-
-Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring
-the generic CPU-hotplug offline path, so RCU stops waiting on the parked
-CPUs and grace periods can still complete. LoongArch shuts down all CPUs
-here without going through the CPU-hotplug mechanism, so this report is
-not otherwise issued.
-
-Cc: <stable@vger.kernel.org>
-Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT")
-Reviewed-by: Guo Ren <guoren@kernel.org>
-Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- arch/loongarch/kernel/smp.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/arch/loongarch/kernel/smp.c
-+++ b/arch/loongarch/kernel/smp.c
-@@ -517,6 +517,7 @@ static void stop_this_cpu(void *dummy)
-       set_cpu_online(smp_processor_id(), false);
-       calculate_cpu_foreign_map();
-       local_irq_disable();
-+      rcutree_report_cpu_dead();
-       while (true);
- }
- 

diff --git a/queue-6.1/series b/queue-6.1/series
index cf84113b6070ecf38986fda5215a0ed125da2ef1..38d545c20a41e6eae5ef884718edb6b93fbc2153 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -92,7 +92,6 @@ mips-dec-prevent-initial-console-buffer-from-landing-in-xkphys.patch
 exfat-fix-potential-use-after-free-in-exfat_find_dir_entry.patch
 hdlc_ppp-sync-per-proto-timers-before-freeing-hdlc-state.patch
 tipc-fix-slab-use-after-free-read-in-tipc_aead_decrypt_done.patch
-loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch
 pnfs-fix-use-after-free-in-pnfs_update_layout.patch
 irqchip-imgpdc-fix-resource-leak-add-missing-chained-handler-cleanup-on-remove.patch
 fpga-region-fix-use-after-free-in-child_regions_with_firmware.patch
@@ -114,7 +113,6 @@ mptcp-fix-missing-wakeups-in-edge-scenarios.patch
 hv-utils-handle-and-propagate-errors-in-kvp_register.patch
 misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch
 misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch
-futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
 drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch
 locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch
 phonet-pass-ifindex-to-fill_addr.patch

diff --git a/queue-6.12/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.12/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
deleted file mode 100644 (file)
index 2ca1ebb..0000000
--- a/queue-6.12/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From stable+bounces-266506-greg=kroah.com@vger.kernel.org Tue Jun 16 20:06:16 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Jun 2026 15:05:55 -0400
-Subject: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
-To: stable@vger.kernel.org
-Cc: Ji'an Zhou <eilaimemedsnaimel@gmail.com>, Thomas Gleixner <tglx@kernel.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20260616190556.3487341-1-sashal@kernel.org>
-
-From: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
-
-[ Upstream commit 74e144274af39935b0f410c0ee4d2b91c3730414 ]
-
-When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
-target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
-waiter->task.
-
-The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
-the NULL waiter->task, causing a kernel crash.
-
-Add a self-deadlock check for non-top waiters before calling
-rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
-futex_lock_pi_atomic().
-
-Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
-Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
-Signed-off-by: Thomas Gleixner <tglx@kernel.org>
-Cc: stable@vger.kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- kernel/futex/requeue.c |    6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/kernel/futex/requeue.c
-+++ b/kernel/futex/requeue.c
-@@ -633,6 +633,12 @@ retry_private:
-                       continue;
-               }
- 
-+              /* Self-deadlock: non-top waiter already owns the PI futex. */
-+              if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
-+                      ret = -EDEADLK;
-+                      break;
-+              }
-+
-               ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
-                                               this->rt_waiter,
-                                               this->task);

diff --git a/queue-6.12/series b/queue-6.12/series
index f66ae5ddb349adf629b99f73a4ea962054056546..3f1b986de280de0cd2c2fc191df9cc2e83c38312 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -46,7 +46,6 @@ staging-rtl8723bs-fix-buffer-over-read-in-rtw_update_protection.patch
 fhandle-fix-uaf-due-to-unlocked-mnt_ns-read-in-may_decode_fh.patch
 drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch
 hv-utils-handle-and-propagate-errors-in-kvp_register.patch
-futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
 locking-mutex-remove-wakeups-from-under-mutex-wait_lock.patch
 locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch
 phonet-pass-ifindex-to-fill_addr.patch

diff --git a/queue-6.6/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.6/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
deleted file mode 100644 (file)
index c9de29e..0000000
--- a/queue-6.6/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From stable+bounces-266562-greg=kroah.com@vger.kernel.org Tue Jun 16 20:21:34 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Jun 2026 15:21:28 -0400
-Subject: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
-To: stable@vger.kernel.org
-Cc: Ji'an Zhou <eilaimemedsnaimel@gmail.com>, Thomas Gleixner <tglx@kernel.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20260616192128.3499944-1-sashal@kernel.org>
-
-From: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
-
-[ Upstream commit 74e144274af39935b0f410c0ee4d2b91c3730414 ]
-
-When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
-target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
-waiter->task.
-
-The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
-the NULL waiter->task, causing a kernel crash.
-
-Add a self-deadlock check for non-top waiters before calling
-rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
-futex_lock_pi_atomic().
-
-Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
-Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
-Signed-off-by: Thomas Gleixner <tglx@kernel.org>
-Cc: stable@vger.kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- kernel/futex/requeue.c |    6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/kernel/futex/requeue.c
-+++ b/kernel/futex/requeue.c
-@@ -629,6 +629,12 @@ retry_private:
-                       continue;
-               }
- 
-+              /* Self-deadlock: non-top waiter already owns the PI futex. */
-+              if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
-+                      ret = -EDEADLK;
-+                      break;
-+              }
-+
-               ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
-                                               this->rt_waiter,
-                                               this->task);

diff --git a/queue-6.6/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch b/queue-6.6/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch
deleted file mode 100644 (file)
index 4d6a70b..0000000
--- a/queue-6.6/loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From f2539c56c74691e7a88af6372ba2b48c06ed2fe4 Mon Sep 17 00:00:00 2001
-From: Huacai Chen <chenhuacai@loongson.cn>
-Date: Thu, 25 Jun 2026 13:03:49 +0800
-Subject: LoongArch: Report dying CPU to RCU in stop_this_cpu()
-
-From: Huacai Chen <chenhuacai@loongson.cn>
-
-commit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream.
-
-This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying
-CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary
-CPUs in stop_this_cpu(). And the function marks the CPU offline for the
-scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps
-expecting a quiescent state from CPUs that are now spinning forever with
-interrupts disabled.
-
-As long as nothing waits for an RCU grace period after smp_send_stop()
-this is harmless, which is why it went unnoticed. However, since commit
-91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on
-PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures
-without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt()
-returns false. Any irq_work_sync() issued in the reboot/shutdown/halt
-path after smp_send_stop() then blocks on a grace period that can never
-complete, hanging the reboot:
-
-  WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
-  ...
-  rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
-  rcu: Offline CPU 1 blocking current GP.
-  rcu: Offline CPU 2 blocking current GP.
-  rcu: Offline CPU 3 blocking current GP.
-
-This issue needs some hacks to reproduce, and it was not noticed on
-LoongArch because arch_irq_work_has_interrupt() usually returns true.
-
-Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring
-the generic CPU-hotplug offline path, so RCU stops waiting on the parked
-CPUs and grace periods can still complete. LoongArch shuts down all CPUs
-here without going through the CPU-hotplug mechanism, so this report is
-not otherwise issued.
-
-Cc: <stable@vger.kernel.org>
-Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT")
-Reviewed-by: Guo Ren <guoren@kernel.org>
-Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- arch/loongarch/kernel/smp.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/arch/loongarch/kernel/smp.c
-+++ b/arch/loongarch/kernel/smp.c
-@@ -613,6 +613,7 @@ static void stop_this_cpu(void *dummy)
-       set_cpu_online(smp_processor_id(), false);
-       calculate_cpu_foreign_map();
-       local_irq_disable();
-+      rcutree_report_cpu_dead();
-       while (true);
- }
- 

diff --git a/queue-6.6/series b/queue-6.6/series
index 0c3cb0ccac844cd89863902c53761b468cd1b464..65942742a8226e5fb5fd878b7b2a1dcb021b69b7 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -31,7 +31,6 @@ dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch
 netfilter-nf_tables-always-walk-all-pending-catchall-elements.patch
 mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch
 hv-utils-handle-and-propagate-errors-in-kvp_register.patch
-futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
 drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch
 locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch
 phonet-pass-ifindex-to-fill_addr.patch
@@ -146,7 +145,6 @@ gfs2-fix-use-after-free-in-gfs2_qd_dealloc.patch
 hdlc_ppp-sync-per-proto-timers-before-freeing-hdlc-state.patch
 blk-cgroup-fix-uaf-in-__blkcg_rstat_flush.patch
 tipc-fix-slab-use-after-free-read-in-tipc_aead_decrypt_done.patch
-loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch
 pnfs-fix-use-after-free-in-pnfs_update_layout.patch
 irqchip-imgpdc-fix-resource-leak-add-missing-chained-handler-cleanup-on-remove.patch
 fpga-region-fix-use-after-free-in-child_regions_with_firmware.patch