--- /dev/null
+From stable+bounces-268661-greg=kroah.com@vger.kernel.org Thu Jun 25 20:42:41 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 14:42:10 -0400
+Subject: crypto: qat - remove unused character device and IOCTLs
+To: stable@vger.kernel.org
+Cc: Giovanni Cabiddu <giovanni.cabiddu@intel.com>, Zhi Wang <wangzhi@stu.xidian.edu.cn>, Bin Yu <byu@xidian.edu.cn>, MingYu Wang <w15303746062@163.com>, Ahsan Atta <ahsan.atta@intel.com>, Herbert Xu <herbert@gondor.apana.org.au>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625184210.2600469-4-sashal@kernel.org>
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit d237230728c567297f2f98b425d63156ab2ed17f ]
+
+The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
+for device configuration, start, stop, status query and enumeration.
+These IOCTLs are not part of any public uAPI header and have no known
+in-tree or out-of-tree users. Device lifecycle is already managed via
+sysfs.
+
+The ioctl interface also increases the attack surface and is the
+subject of a number of bug reports.
+
+Remove the character device, the IOCTL definitions, and the related
+data structures (adf_dev_status_info, adf_user_cfg_key_val,
+adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
+adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
+module_init/module_exit hooks for workqueue, AER, and crypto/compression
+algorithm registration.
+
+Clean up leftover dead code that was only reachable from the removed
+IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
+adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
+adf_get_vf_real_id() and the unused ADF_CFG macros.
+
+Additionally, drop the entry associated to QAT IOCTLs in
+ioctl-number.rst.
+
+Cc: stable@vger.kernel.org
+Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework")
+Reported-by: Zhi Wang <wangzhi@stu.xidian.edu.cn>
+Reported-by: Bin Yu <byu@xidian.edu.cn>
+Reported-by: MingYu Wang <w15303746062@163.com>
+Closes: https://lore.kernel.org/all/61d6d499.ab89.19b9b7f3186.Coremail.wangzhi_xd@stu.xidian.edu.cn/
+Link: https://lore.kernel.org/all/20260508034841.256794-1-w15303746062@163.com/
+Link: https://lore.kernel.org/all/20260508023542.256299-1-w15303746062@163.com/
+Link: https://lore.kernel.org/all/20260504025120.98242-1-w15303746062@163.com/
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/userspace-api/ioctl/ioctl-number.rst | 1
+ drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -
+ drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -
+ drivers/crypto/qat/qat_common/adf_common_drv.h | 3
+ drivers/crypto/qat/qat_common/adf_ctl_drv.c | 409 ---------------------
+ drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---
+ 6 files changed, 3 insertions(+), 550 deletions(-)
+ delete mode 100644 drivers/crypto/qat/qat_common/adf_cfg_user.h
+
+--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
+@@ -214,7 +214,6 @@ Code Seq# Include File
+ <mailto:gregkh@linuxfoundation.org>
+ 'a' all linux/atm*.h, linux/sonet.h ATM on linux
+ <http://lrcwww.epfl.ch/>
+-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver
+ 'b' 00-FF conflict! bit3 vme host bridge
+ <mailto:natalia@nikhefk.nikhef.nl>
+ 'c' all linux/cm4000_cs.h conflict!
+--- a/drivers/crypto/qat/qat_common/adf_cfg_common.h
++++ b/drivers/crypto/qat/qat_common/adf_cfg_common.h
+@@ -4,18 +4,11 @@
+ #define ADF_CFG_COMMON_H_
+
+ #include <linux/types.h>
+-#include <linux/ioctl.h>
+
+ #define ADF_CFG_MAX_STR_LEN 64
+ #define ADF_CFG_MAX_KEY_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
+ #define ADF_CFG_MAX_VAL_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
+ #define ADF_CFG_MAX_SECTION_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
+-#define ADF_CFG_BASE_DEC 10
+-#define ADF_CFG_BASE_HEX 16
+-#define ADF_CFG_ALL_DEVICES 0xFE
+-#define ADF_CFG_NO_DEVICE 0xFF
+-#define ADF_CFG_AFFINITY_WHATEVER 0xFF
+-#define MAX_DEVICE_NAME_SIZE 32
+ #define ADF_MAX_DEVICES (32 * 32)
+ #define ADF_DEVS_ARRAY_SIZE BITS_TO_LONGS(ADF_MAX_DEVICES)
+
+@@ -35,29 +28,4 @@ enum adf_device_type {
+ DEV_C3XXXVF,
+ DEV_4XXX,
+ };
+-
+-struct adf_dev_status_info {
+- enum adf_device_type type;
+- __u32 accel_id;
+- __u32 instance_id;
+- __u8 num_ae;
+- __u8 num_accel;
+- __u8 num_logical_accel;
+- __u8 banks_per_accel;
+- __u8 state;
+- __u8 bus;
+- __u8 dev;
+- __u8 fun;
+- char name[MAX_DEVICE_NAME_SIZE];
+-};
+-
+-#define ADF_CTL_IOC_MAGIC 'a'
+-#define IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS _IOW(ADF_CTL_IOC_MAGIC, 0, \
+- struct adf_user_cfg_ctl_data)
+-#define IOCTL_STOP_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 1, \
+- struct adf_user_cfg_ctl_data)
+-#define IOCTL_START_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 2, \
+- struct adf_user_cfg_ctl_data)
+-#define IOCTL_STATUS_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 3, __u32)
+-#define IOCTL_GET_NUM_DEVICES _IOW(ADF_CTL_IOC_MAGIC, 4, __s32)
+ #endif
+--- a/drivers/crypto/qat/qat_common/adf_cfg_user.h
++++ /dev/null
+@@ -1,38 +0,0 @@
+-/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) */
+-/* Copyright(c) 2014 - 2020 Intel Corporation */
+-#ifndef ADF_CFG_USER_H_
+-#define ADF_CFG_USER_H_
+-
+-#include "adf_cfg_common.h"
+-#include "adf_cfg_strings.h"
+-
+-struct adf_user_cfg_key_val {
+- char key[ADF_CFG_MAX_KEY_LEN_IN_BYTES];
+- char val[ADF_CFG_MAX_VAL_LEN_IN_BYTES];
+- union {
+- struct adf_user_cfg_key_val *next;
+- __u64 padding3;
+- };
+- enum adf_cfg_val_type type;
+-} __packed;
+-
+-struct adf_user_cfg_section {
+- char name[ADF_CFG_MAX_SECTION_LEN_IN_BYTES];
+- union {
+- struct adf_user_cfg_key_val *params;
+- __u64 padding1;
+- };
+- union {
+- struct adf_user_cfg_section *next;
+- __u64 padding3;
+- };
+-} __packed;
+-
+-struct adf_user_cfg_ctl_data {
+- union {
+- struct adf_user_cfg_section *config_section;
+- __u64 padding;
+- };
+- __u8 device_id;
+-} __packed;
+-#endif
+--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
+@@ -74,11 +74,8 @@ int adf_devmgr_add_dev(struct adf_accel_
+ void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
+ struct adf_accel_dev *pf);
+ struct list_head *adf_devmgr_get_head(void);
+-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id);
+ struct adf_accel_dev *adf_devmgr_get_first(void);
+ struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev);
+-int adf_devmgr_verify_id(u32 id);
+-void adf_devmgr_get_num_dev(u32 *num);
+ int adf_devmgr_in_reset(struct adf_accel_dev *accel_dev);
+ int adf_dev_started(struct adf_accel_dev *accel_dev);
+ int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev);
+--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c
++++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
+@@ -1,412 +1,14 @@
+ // SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only)
+ /* Copyright(c) 2014 - 2020 Intel Corporation */
++
++#include <crypto/algapi.h>
++#include <linux/errno.h>
+ #include <linux/module.h>
+-#include <linux/mutex.h>
+-#include <linux/slab.h>
+-#include <linux/fs.h>
+-#include <linux/bitops.h>
+-#include <linux/pci.h>
+-#include <linux/cdev.h>
+-#include <linux/uaccess.h>
+-#include <linux/crypto.h>
+
+-#include "adf_accel_devices.h"
+ #include "adf_common_drv.h"
+-#include "adf_cfg.h"
+-#include "adf_cfg_common.h"
+-#include "adf_cfg_user.h"
+-
+-#define DEVICE_NAME "qat_adf_ctl"
+-
+-static DEFINE_MUTEX(adf_ctl_lock);
+-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg);
+-
+-static const struct file_operations adf_ctl_ops = {
+- .owner = THIS_MODULE,
+- .unlocked_ioctl = adf_ctl_ioctl,
+- .compat_ioctl = compat_ptr_ioctl,
+-};
+-
+-struct adf_ctl_drv_info {
+- unsigned int major;
+- struct cdev drv_cdev;
+- struct class *drv_class;
+-};
+-
+-static struct adf_ctl_drv_info adf_ctl_drv;
+-
+-static void adf_chr_drv_destroy(void)
+-{
+- device_destroy(adf_ctl_drv.drv_class, MKDEV(adf_ctl_drv.major, 0));
+- cdev_del(&adf_ctl_drv.drv_cdev);
+- class_destroy(adf_ctl_drv.drv_class);
+- unregister_chrdev_region(MKDEV(adf_ctl_drv.major, 0), 1);
+-}
+-
+-static int adf_chr_drv_create(void)
+-{
+- dev_t dev_id;
+- struct device *drv_device;
+-
+- if (alloc_chrdev_region(&dev_id, 0, 1, DEVICE_NAME)) {
+- pr_err("QAT: unable to allocate chrdev region\n");
+- return -EFAULT;
+- }
+-
+- adf_ctl_drv.drv_class = class_create(THIS_MODULE, DEVICE_NAME);
+- if (IS_ERR(adf_ctl_drv.drv_class)) {
+- pr_err("QAT: class_create failed for adf_ctl\n");
+- goto err_chrdev_unreg;
+- }
+- adf_ctl_drv.major = MAJOR(dev_id);
+- cdev_init(&adf_ctl_drv.drv_cdev, &adf_ctl_ops);
+- if (cdev_add(&adf_ctl_drv.drv_cdev, dev_id, 1)) {
+- pr_err("QAT: cdev add failed\n");
+- goto err_class_destr;
+- }
+-
+- drv_device = device_create(adf_ctl_drv.drv_class, NULL,
+- MKDEV(adf_ctl_drv.major, 0),
+- NULL, DEVICE_NAME);
+- if (IS_ERR(drv_device)) {
+- pr_err("QAT: failed to create device\n");
+- goto err_cdev_del;
+- }
+- return 0;
+-err_cdev_del:
+- cdev_del(&adf_ctl_drv.drv_cdev);
+-err_class_destr:
+- class_destroy(adf_ctl_drv.drv_class);
+-err_chrdev_unreg:
+- unregister_chrdev_region(dev_id, 1);
+- return -EFAULT;
+-}
+-
+-static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg)
+-{
+- struct adf_user_cfg_ctl_data *cfg_data;
+-
+- cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));
+- if (IS_ERR(cfg_data))
+- pr_err("QAT: failed to copy from user cfg_data.\n");
+- return cfg_data;
+-}
+-
+-static int adf_add_key_value_data(struct adf_accel_dev *accel_dev,
+- const char *section,
+- const struct adf_user_cfg_key_val *key_val)
+-{
+- if (key_val->type == ADF_HEX) {
+- long *ptr = (long *)key_val->val;
+- long val = *ptr;
+-
+- if (adf_cfg_add_key_value_param(accel_dev, section,
+- key_val->key, (void *)val,
+- key_val->type)) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to add hex keyvalue.\n");
+- return -EFAULT;
+- }
+- } else {
+- if (adf_cfg_add_key_value_param(accel_dev, section,
+- key_val->key, key_val->val,
+- key_val->type)) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to add keyvalue.\n");
+- return -EFAULT;
+- }
+- }
+- return 0;
+-}
+-
+-static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev,
+- struct adf_user_cfg_ctl_data *ctl_data)
+-{
+- struct adf_user_cfg_key_val key_val;
+- struct adf_user_cfg_key_val *params_head;
+- struct adf_user_cfg_section section, *section_head;
+-
+- section_head = ctl_data->config_section;
+-
+- while (section_head) {
+- if (copy_from_user(§ion, (void __user *)section_head,
+- sizeof(*section_head))) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to copy section info\n");
+- goto out_err;
+- }
+-
+- if (adf_cfg_section_add(accel_dev, section.name)) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to add section.\n");
+- goto out_err;
+- }
+-
+- params_head = section.params;
+-
+- while (params_head) {
+- if (copy_from_user(&key_val, (void __user *)params_head,
+- sizeof(key_val))) {
+- dev_err(&GET_DEV(accel_dev),
+- "Failed to copy keyvalue.\n");
+- goto out_err;
+- }
+- if (adf_add_key_value_data(accel_dev, section.name,
+- &key_val)) {
+- goto out_err;
+- }
+- params_head = key_val.next;
+- }
+- section_head = section.next;
+- }
+- return 0;
+-out_err:
+- adf_cfg_del_all(accel_dev);
+- return -EFAULT;
+-}
+-
+-static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- struct adf_user_cfg_ctl_data *ctl_data;
+- struct adf_accel_dev *accel_dev;
+- int ret = 0;
+-
+- ctl_data = adf_ctl_alloc_resources(arg);
+- if (IS_ERR(ctl_data))
+- return PTR_ERR(ctl_data);
+-
+- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+- if (!accel_dev) {
+- ret = -EFAULT;
+- goto out;
+- }
+-
+- if (adf_dev_started(accel_dev)) {
+- ret = -EFAULT;
+- goto out;
+- }
+-
+- if (adf_copy_key_value_data(accel_dev, ctl_data)) {
+- ret = -EFAULT;
+- goto out;
+- }
+- set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status);
+-out:
+- kfree(ctl_data);
+- return ret;
+-}
+-
+-static int adf_ctl_is_device_in_use(int id)
+-{
+- struct adf_accel_dev *dev;
+-
+- list_for_each_entry(dev, adf_devmgr_get_head(), list) {
+- if (id == dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
+- if (adf_devmgr_in_reset(dev) || adf_dev_in_use(dev)) {
+- dev_info(&GET_DEV(dev),
+- "device qat_dev%d is busy\n",
+- dev->accel_id);
+- return -EBUSY;
+- }
+- }
+- }
+- return 0;
+-}
+-
+-static void adf_ctl_stop_devices(u32 id)
+-{
+- struct adf_accel_dev *accel_dev;
+-
+- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) {
+- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
+- if (!adf_dev_started(accel_dev))
+- continue;
+-
+- /* First stop all VFs */
+- if (!accel_dev->is_vf)
+- continue;
+-
+- adf_dev_stop(accel_dev);
+- adf_dev_shutdown(accel_dev);
+- }
+- }
+-
+- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) {
+- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
+- if (!adf_dev_started(accel_dev))
+- continue;
+-
+- adf_dev_stop(accel_dev);
+- adf_dev_shutdown(accel_dev);
+- }
+- }
+-}
+-
+-static int adf_ctl_ioctl_dev_stop(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- int ret;
+- struct adf_user_cfg_ctl_data *ctl_data;
+-
+- ctl_data = adf_ctl_alloc_resources(arg);
+- if (IS_ERR(ctl_data))
+- return PTR_ERR(ctl_data);
+-
+- if (adf_devmgr_verify_id(ctl_data->device_id)) {
+- pr_err("QAT: Device %d not found\n", ctl_data->device_id);
+- ret = -ENODEV;
+- goto out;
+- }
+-
+- ret = adf_ctl_is_device_in_use(ctl_data->device_id);
+- if (ret)
+- goto out;
+-
+- if (ctl_data->device_id == ADF_CFG_ALL_DEVICES)
+- pr_info("QAT: Stopping all acceleration devices.\n");
+- else
+- pr_info("QAT: Stopping acceleration device qat_dev%d.\n",
+- ctl_data->device_id);
+-
+- adf_ctl_stop_devices(ctl_data->device_id);
+-
+-out:
+- kfree(ctl_data);
+- return ret;
+-}
+-
+-static int adf_ctl_ioctl_dev_start(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- int ret;
+- struct adf_user_cfg_ctl_data *ctl_data;
+- struct adf_accel_dev *accel_dev;
+-
+- ctl_data = adf_ctl_alloc_resources(arg);
+- if (IS_ERR(ctl_data))
+- return PTR_ERR(ctl_data);
+-
+- ret = -ENODEV;
+- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+- if (!accel_dev)
+- goto out;
+-
+- if (!adf_dev_started(accel_dev)) {
+- dev_info(&GET_DEV(accel_dev),
+- "Starting acceleration device qat_dev%d.\n",
+- ctl_data->device_id);
+- ret = adf_dev_init(accel_dev);
+- if (!ret)
+- ret = adf_dev_start(accel_dev);
+- } else {
+- dev_info(&GET_DEV(accel_dev),
+- "Acceleration device qat_dev%d already started.\n",
+- ctl_data->device_id);
+- }
+- if (ret) {
+- dev_err(&GET_DEV(accel_dev), "Failed to start qat_dev%d\n",
+- ctl_data->device_id);
+- adf_dev_stop(accel_dev);
+- adf_dev_shutdown(accel_dev);
+- }
+-out:
+- kfree(ctl_data);
+- return ret;
+-}
+-
+-static int adf_ctl_ioctl_get_num_devices(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- u32 num_devices = 0;
+-
+- adf_devmgr_get_num_dev(&num_devices);
+- if (copy_to_user((void __user *)arg, &num_devices, sizeof(num_devices)))
+- return -EFAULT;
+-
+- return 0;
+-}
+-
+-static int adf_ctl_ioctl_get_status(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- struct adf_hw_device_data *hw_data;
+- struct adf_dev_status_info dev_info;
+- struct adf_accel_dev *accel_dev;
+-
+- if (copy_from_user(&dev_info, (void __user *)arg,
+- sizeof(struct adf_dev_status_info))) {
+- pr_err("QAT: failed to copy from user.\n");
+- return -EFAULT;
+- }
+-
+- accel_dev = adf_devmgr_get_dev_by_id(dev_info.accel_id);
+- if (!accel_dev)
+- return -ENODEV;
+-
+- hw_data = accel_dev->hw_device;
+- dev_info.state = adf_dev_started(accel_dev) ? DEV_UP : DEV_DOWN;
+- dev_info.num_ae = hw_data->get_num_aes(hw_data);
+- dev_info.num_accel = hw_data->get_num_accels(hw_data);
+- dev_info.num_logical_accel = hw_data->num_logical_accel;
+- dev_info.banks_per_accel = hw_data->num_banks
+- / hw_data->num_logical_accel;
+- strlcpy(dev_info.name, hw_data->dev_class->name, sizeof(dev_info.name));
+- dev_info.instance_id = hw_data->instance_id;
+- dev_info.type = hw_data->dev_class->type;
+- dev_info.bus = accel_to_pci_dev(accel_dev)->bus->number;
+- dev_info.dev = PCI_SLOT(accel_to_pci_dev(accel_dev)->devfn);
+- dev_info.fun = PCI_FUNC(accel_to_pci_dev(accel_dev)->devfn);
+-
+- if (copy_to_user((void __user *)arg, &dev_info,
+- sizeof(struct adf_dev_status_info))) {
+- dev_err(&GET_DEV(accel_dev), "failed to copy status.\n");
+- return -EFAULT;
+- }
+- return 0;
+-}
+-
+-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
+-{
+- int ret;
+-
+- if (mutex_lock_interruptible(&adf_ctl_lock))
+- return -EFAULT;
+-
+- switch (cmd) {
+- case IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS:
+- ret = adf_ctl_ioctl_dev_config(fp, cmd, arg);
+- break;
+-
+- case IOCTL_STOP_ACCEL_DEV:
+- ret = adf_ctl_ioctl_dev_stop(fp, cmd, arg);
+- break;
+-
+- case IOCTL_START_ACCEL_DEV:
+- ret = adf_ctl_ioctl_dev_start(fp, cmd, arg);
+- break;
+-
+- case IOCTL_GET_NUM_DEVICES:
+- ret = adf_ctl_ioctl_get_num_devices(fp, cmd, arg);
+- break;
+-
+- case IOCTL_STATUS_ACCEL_DEV:
+- ret = adf_ctl_ioctl_get_status(fp, cmd, arg);
+- break;
+- default:
+- pr_err_ratelimited("QAT: Invalid ioctl %d\n", cmd);
+- ret = -EFAULT;
+- break;
+- }
+- mutex_unlock(&adf_ctl_lock);
+- return ret;
+-}
+
+ static int __init adf_register_ctl_device_driver(void)
+ {
+- if (adf_chr_drv_create())
+- goto err_chr_dev;
+-
+ if (adf_init_aer())
+ goto err_aer;
+
+@@ -428,21 +30,16 @@ err_vf_wq:
+ err_pf_wq:
+ adf_exit_aer();
+ err_aer:
+- adf_chr_drv_destroy();
+-err_chr_dev:
+- mutex_destroy(&adf_ctl_lock);
+ return -EFAULT;
+ }
+
+ static void __exit adf_unregister_ctl_device_driver(void)
+ {
+- adf_chr_drv_destroy();
+ adf_exit_aer();
+ adf_exit_vf_wq();
+ adf_exit_pf_wq();
+ qat_crypto_unregister();
+ adf_clean_vf_map(false);
+- mutex_destroy(&adf_ctl_lock);
+ }
+
+ module_init(adf_register_ctl_device_driver);
+--- a/drivers/crypto/qat/qat_common/adf_dev_mgr.c
++++ b/drivers/crypto/qat/qat_common/adf_dev_mgr.c
+@@ -45,19 +45,6 @@ static struct vf_id_map *adf_find_vf(u32
+ return NULL;
+ }
+
+-static int adf_get_vf_real_id(u32 fake)
+-{
+- struct list_head *itr;
+-
+- list_for_each(itr, &vfs_table) {
+- struct vf_id_map *ptr =
+- list_entry(itr, struct vf_id_map, list);
+- if (ptr->fake_id == fake)
+- return ptr->id;
+- }
+- return -1;
+-}
+-
+ /**
+ * adf_clean_vf_map() - Cleans VF id mapings
+ *
+@@ -312,63 +299,6 @@ struct adf_accel_dev *adf_devmgr_pci_to_
+ }
+ EXPORT_SYMBOL_GPL(adf_devmgr_pci_to_accel_dev);
+
+-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id)
+-{
+- struct list_head *itr;
+- int real_id;
+-
+- mutex_lock(&table_lock);
+- real_id = adf_get_vf_real_id(id);
+- if (real_id < 0)
+- goto unlock;
+-
+- id = real_id;
+-
+- list_for_each(itr, &accel_table) {
+- struct adf_accel_dev *ptr =
+- list_entry(itr, struct adf_accel_dev, list);
+- if (ptr->accel_id == id) {
+- mutex_unlock(&table_lock);
+- return ptr;
+- }
+- }
+-unlock:
+- mutex_unlock(&table_lock);
+- return NULL;
+-}
+-
+-int adf_devmgr_verify_id(u32 id)
+-{
+- if (id == ADF_CFG_ALL_DEVICES)
+- return 0;
+-
+- if (adf_devmgr_get_dev_by_id(id))
+- return 0;
+-
+- return -ENODEV;
+-}
+-
+-static int adf_get_num_dettached_vfs(void)
+-{
+- struct list_head *itr;
+- int vfs = 0;
+-
+- mutex_lock(&table_lock);
+- list_for_each(itr, &vfs_table) {
+- struct vf_id_map *ptr =
+- list_entry(itr, struct vf_id_map, list);
+- if (ptr->bdf != ~0 && !ptr->attached)
+- vfs++;
+- }
+- mutex_unlock(&table_lock);
+- return vfs;
+-}
+-
+-void adf_devmgr_get_num_dev(u32 *num)
+-{
+- *num = num_devices - adf_get_num_dettached_vfs();
+-}
+-
+ /**
+ * adf_dev_in_use() - Check whether accel_dev is currently in use
+ * @accel_dev: Pointer to acceleration device.
--- /dev/null
+From stable+bounces-268658-greg=kroah.com@vger.kernel.org Thu Jun 25 20:42:29 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 14:42:08 -0400
+Subject: crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()
+To: stable@vger.kernel.org
+Cc: Thorsten Blum <thorsten.blum@linux.dev>, Herbert Xu <herbert@gondor.apana.org.au>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625184210.2600469-2-sashal@kernel.org>
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit 1e26339703e2afd397037defa798682b2b93dcc0 ]
+
+Replace kzalloc() followed by copy_from_user() with memdup_user() to
+improve and simplify adf_ctl_alloc_resources(). memdup_user() returns
+either -ENOMEM or -EFAULT (instead of -EIO) if an error occurs.
+
+Remove the unnecessary device id initialization, since memdup_user()
+(like copy_from_user()) immediately overwrites it.
+
+No functional changes intended other than returning the more idiomatic
+error code -EFAULT.
+
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/qat/qat_common/adf_ctl_drv.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c
++++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
+@@ -87,17 +87,10 @@ static int adf_ctl_alloc_resources(struc
+ {
+ struct adf_user_cfg_ctl_data *cfg_data;
+
+- cfg_data = kzalloc(sizeof(*cfg_data), GFP_KERNEL);
+- if (!cfg_data)
+- return -ENOMEM;
+-
+- /* Initialize device id to NO DEVICE as 0 is a valid device id */
+- cfg_data->device_id = ADF_CFG_NO_DEVICE;
+-
+- if (copy_from_user(cfg_data, (void __user *)arg, sizeof(*cfg_data))) {
++ cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));
++ if (IS_ERR(cfg_data)) {
+ pr_err("QAT: failed to copy from user cfg_data.\n");
+- kfree(cfg_data);
+- return -EIO;
++ return PTR_ERR(cfg_data);
+ }
+
+ *ctl_data = cfg_data;
--- /dev/null
+From stable+bounces-268659-greg=kroah.com@vger.kernel.org Thu Jun 25 20:42:31 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 14:42:09 -0400
+Subject: crypto: qat - Return pointer directly in adf_ctl_alloc_resources
+To: stable@vger.kernel.org
+Cc: Herbert Xu <herbert@gondor.apana.org.au>, Thorsten Blum <thorsten.blum@linux.dev>, Giovanni Cabiddu <giovanni.cabiddu@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625184210.2600469-3-sashal@kernel.org>
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 5ce9891ea928208a915411ce8227f8c3e37e5ad9 ]
+
+Returning values through arguments is confusing and that has
+upset the compiler with the recent change to memdup_user:
+
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:308:26: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized]
+ 308 | ctl_data->device_id);
+ | ^~
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:294:39: note: ‘ctl_data’ was declared here
+ 294 | struct adf_user_cfg_ctl_data *ctl_data;
+ | ^~~~~~~~
+In function ‘adf_ctl_ioctl_dev_stop’,
+ inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:386:9:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:273:48: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized]
+ 273 | ret = adf_ctl_is_device_in_use(ctl_data->device_id);
+ | ~~~~~~~~^~~~~~~~~~~
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:261:39: note: ‘ctl_data’ was declared here
+ 261 | struct adf_user_cfg_ctl_data *ctl_data;
+ | ^~~~~~~~
+In function ‘adf_ctl_ioctl_dev_config’,
+ inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:382:9:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:192:54: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized]
+ 192 | accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+ | ~~~~~~~~^~~~~~~~~~~
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:185:39: note: ‘ctl_data’ was declared here
+ 185 | struct adf_user_cfg_ctl_data *ctl_data;
+ | ^~~~~~~~
+
+Fix this by returning the pointer directly.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Thorsten Blum <thorsten.blum@linux.dev>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/qat/qat_common/adf_ctl_drv.c | 31 +++++++++++-----------------
+ 1 file changed, 13 insertions(+), 18 deletions(-)
+
+--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c
++++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
+@@ -82,19 +82,14 @@ err_chrdev_unreg:
+ return -EFAULT;
+ }
+
+-static int adf_ctl_alloc_resources(struct adf_user_cfg_ctl_data **ctl_data,
+- unsigned long arg)
++static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg)
+ {
+ struct adf_user_cfg_ctl_data *cfg_data;
+
+ cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));
+- if (IS_ERR(cfg_data)) {
++ if (IS_ERR(cfg_data))
+ pr_err("QAT: failed to copy from user cfg_data.\n");
+- return PTR_ERR(cfg_data);
+- }
+-
+- *ctl_data = cfg_data;
+- return 0;
++ return cfg_data;
+ }
+
+ static int adf_add_key_value_data(struct adf_accel_dev *accel_dev,
+@@ -173,13 +168,13 @@ out_err:
+ static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd,
+ unsigned long arg)
+ {
+- int ret;
+ struct adf_user_cfg_ctl_data *ctl_data;
+ struct adf_accel_dev *accel_dev;
++ int ret = 0;
+
+- ret = adf_ctl_alloc_resources(&ctl_data, arg);
+- if (ret)
+- return ret;
++ ctl_data = adf_ctl_alloc_resources(arg);
++ if (IS_ERR(ctl_data))
++ return PTR_ERR(ctl_data);
+
+ accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+ if (!accel_dev) {
+@@ -254,9 +249,9 @@ static int adf_ctl_ioctl_dev_stop(struct
+ int ret;
+ struct adf_user_cfg_ctl_data *ctl_data;
+
+- ret = adf_ctl_alloc_resources(&ctl_data, arg);
+- if (ret)
+- return ret;
++ ctl_data = adf_ctl_alloc_resources(arg);
++ if (IS_ERR(ctl_data))
++ return PTR_ERR(ctl_data);
+
+ if (adf_devmgr_verify_id(ctl_data->device_id)) {
+ pr_err("QAT: Device %d not found\n", ctl_data->device_id);
+@@ -288,9 +283,9 @@ static int adf_ctl_ioctl_dev_start(struc
+ struct adf_user_cfg_ctl_data *ctl_data;
+ struct adf_accel_dev *accel_dev;
+
+- ret = adf_ctl_alloc_resources(&ctl_data, arg);
+- if (ret)
+- return ret;
++ ctl_data = adf_ctl_alloc_resources(arg);
++ if (IS_ERR(ctl_data))
++ return PTR_ERR(ctl_data);
+
+ ret = -ENODEV;
+ accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
--- /dev/null
+From 8e2bad543eca5c25cd02cbc63d72557934d45f13 Mon Sep 17 00:00:00 2001
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Date: Mon, 10 Feb 2025 13:16:22 -0600
+Subject: dlm: prevent NPD when writing a positive value to event_done
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+commit 8e2bad543eca5c25cd02cbc63d72557934d45f13 upstream.
+
+do_uevent returns the value written to event_done. In case it is a
+positive value, new_lockspace would undo all the work, and lockspace
+would not be set. __dlm_new_lockspace, however, would treat that
+positive value as a success due to commit 8511a2728ab8 ("dlm: fix use
+count with multiple joins").
+
+Down the line, device_create_lockspace would pass that NULL lockspace to
+dlm_find_lockspace_local, leading to a NULL pointer dereference.
+
+Treating such positive values as successes prevents the problem. Given
+this has been broken for so long, this is unlikely to break userspace
+expectations.
+
+Fixes: 8511a2728ab8 ("dlm: fix use count with multiple joins")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Nazar Kalashnikov <nazarkalashnikov0@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/dlm/lockspace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -638,7 +638,7 @@ static int new_lockspace(const char *nam
+ lockspace to start running (via sysfs) in dlm_ls_start(). */
+
+ error = do_uevent(ls, 1);
+- if (error)
++ if (error < 0)
+ goto out_recoverd;
+
+ wait_for_completion(&ls->ls_members_done);
--- /dev/null
+From stable+bounces-268660-greg=kroah.com@vger.kernel.org Thu Jun 25 20:42:37 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 14:42:07 -0400
+Subject: Documentation: ioctl-number: Extend "Include File" column width
+To: stable@vger.kernel.org
+Cc: Bagas Sanjaya <bagasdotme@gmail.com>, Haren Myneni <haren@linux.ibm.com>, Madhavan Srinivasan <maddy@linux.ibm.com>, Jonathan Corbet <corbet@lwn.net>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625184210.2600469-1-sashal@kernel.org>
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 15afd5def819e4df2a29cef6fcfa6ae7ba167c0f ]
+
+Extend width of "Include File" column to fit full path to
+papr-physical-attestation.h in later commit.
+
+Reviewed-by: Haren Myneni <haren@linux.ibm.com>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Link: https://lore.kernel.org/r/20250714015711.14525-3-bagasdotme@gmail.com
+Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/userspace-api/ioctl/ioctl-number.rst | 448 ++++++++++-----------
+ 1 file changed, 224 insertions(+), 224 deletions(-)
+
+--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
+@@ -66,17 +66,17 @@ This table lists ioctls visible from use
+ most drivers up to 2.6.31, but I know I am missing some. There has been
+ no attempt to list non-X86 architectures or ioctls from drivers/staging/.
+
+-==== ===== ======================================================= ================================================================
+-Code Seq# Include File Comments
++==== ===== ========================================================= ================================================================
++Code Seq# Include File Comments
+ (hex)
+-==== ===== ======================================================= ================================================================
+-0x00 00-1F linux/fs.h conflict!
+-0x00 00-1F scsi/scsi_ioctl.h conflict!
+-0x00 00-1F linux/fb.h conflict!
+-0x00 00-1F linux/wavefront.h conflict!
++==== ===== ========================================================= ================================================================
++0x00 00-1F linux/fs.h conflict!
++0x00 00-1F scsi/scsi_ioctl.h conflict!
++0x00 00-1F linux/fb.h conflict!
++0x00 00-1F linux/wavefront.h conflict!
+ 0x02 all linux/fd.h
+ 0x03 all linux/hdreg.h
+-0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these.
++0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these.
+ 0x06 all linux/lp.h
+ 0x09 all linux/raid/md_u.h
+ 0x10 00-0F drivers/char/s390/vmcp.h
+@@ -84,291 +84,291 @@ Code Seq# Include File
+ 0x10 20-2F arch/s390/include/uapi/asm/hypfs.h
+ 0x12 all linux/fs.h
+ linux/blkpg.h
+-0x1b all InfiniBand Subsystem
+- <http://infiniband.sourceforge.net/>
++0x1b all InfiniBand Subsystem
++ <http://infiniband.sourceforge.net/>
+ 0x20 all drivers/cdrom/cm206.h
+ 0x22 all scsi/sg.h
+ '!' 00-1F uapi/linux/seccomp.h
+-'#' 00-3F IEEE 1394 Subsystem
+- Block for the entire subsystem
++'#' 00-3F IEEE 1394 Subsystem
++ Block for the entire subsystem
+ '$' 00-0F linux/perf_counter.h, linux/perf_event.h
+-'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem
+- <mailto:alexander.shishkin@linux.intel.com>
++'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem
++ <mailto:alexander.shishkin@linux.intel.com>
+ '&' 00-07 drivers/firewire/nosy-user.h
+-'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl
+- <ftp://ftp.de.kernel.org/pub/linux/daemons/ntp/PPS/>
++'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl
++ <ftp://ftp.de.kernel.org/pub/linux/daemons/ntp/PPS/>
+ '2' 01-04 linux/i2o.h
+-'3' 00-0F drivers/s390/char/raw3270.h conflict!
+-'3' 00-1F linux/suspend_ioctls.h, conflict!
++'3' 00-0F drivers/s390/char/raw3270.h conflict!
++'3' 00-1F linux/suspend_ioctls.h, conflict!
+ kernel/power/user.c
+-'8' all SNP8023 advanced NIC card
+- <mailto:mcr@solidum.com>
++'8' all SNP8023 advanced NIC card
++ <mailto:mcr@solidum.com>
+ ';' 64-7F linux/vfio.h
+-'=' 00-3f uapi/linux/ptp_clock.h <mailto:richardcochran@gmail.com>
+-'@' 00-0F linux/radeonfb.h conflict!
+-'@' 00-0F drivers/video/aty/aty128fb.c conflict!
+-'A' 00-1F linux/apm_bios.h conflict!
+-'A' 00-0F linux/agpgart.h, conflict!
++'=' 00-3f uapi/linux/ptp_clock.h <mailto:richardcochran@gmail.com>
++'@' 00-0F linux/radeonfb.h conflict!
++'@' 00-0F drivers/video/aty/aty128fb.c conflict!
++'A' 00-1F linux/apm_bios.h conflict!
++'A' 00-0F linux/agpgart.h, conflict!
+ drivers/char/agp/compat_ioctl.h
+-'A' 00-7F sound/asound.h conflict!
+-'B' 00-1F linux/cciss_ioctl.h conflict!
+-'B' 00-0F include/linux/pmu.h conflict!
+-'B' C0-FF advanced bbus <mailto:maassen@uni-freiburg.de>
+-'C' all linux/soundcard.h conflict!
+-'C' 01-2F linux/capi.h conflict!
+-'C' F0-FF drivers/net/wan/cosa.h conflict!
++'A' 00-7F sound/asound.h conflict!
++'B' 00-1F linux/cciss_ioctl.h conflict!
++'B' 00-0F include/linux/pmu.h conflict!
++'B' C0-FF advanced bbus <mailto:maassen@uni-freiburg.de>
++'C' all linux/soundcard.h conflict!
++'C' 01-2F linux/capi.h conflict!
++'C' F0-FF drivers/net/wan/cosa.h conflict!
+ 'D' all arch/s390/include/asm/dasd.h
+ 'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h
+ 'D' 05 drivers/scsi/pmcraid.h
+-'E' all linux/input.h conflict!
+-'E' 00-0F xen/evtchn.h conflict!
+-'F' all linux/fb.h conflict!
+-'F' 01-02 drivers/scsi/pmcraid.h conflict!
+-'F' 20 drivers/video/fsl-diu-fb.h conflict!
+-'F' 20 drivers/video/intelfb/intelfb.h conflict!
+-'F' 20 linux/ivtvfb.h conflict!
+-'F' 20 linux/matroxfb.h conflict!
+-'F' 20 drivers/video/aty/atyfb_base.c conflict!
+-'F' 00-0F video/da8xx-fb.h conflict!
+-'F' 80-8F linux/arcfb.h conflict!
+-'F' DD video/sstfb.h conflict!
+-'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict!
+-'H' 00-7F linux/hiddev.h conflict!
+-'H' 00-0F linux/hidraw.h conflict!
+-'H' 01 linux/mei.h conflict!
+-'H' 02 linux/mei.h conflict!
+-'H' 03 linux/mei.h conflict!
+-'H' 00-0F sound/asound.h conflict!
+-'H' 20-40 sound/asound_fm.h conflict!
+-'H' 80-8F sound/sfnt_info.h conflict!
+-'H' 10-8F sound/emu10k1.h conflict!
+-'H' 10-1F sound/sb16_csp.h conflict!
+-'H' 10-1F sound/hda_hwdep.h conflict!
+-'H' 40-4F sound/hdspm.h conflict!
+-'H' 40-4F sound/hdsp.h conflict!
++'E' all linux/input.h conflict!
++'E' 00-0F xen/evtchn.h conflict!
++'F' all linux/fb.h conflict!
++'F' 01-02 drivers/scsi/pmcraid.h conflict!
++'F' 20 drivers/video/fsl-diu-fb.h conflict!
++'F' 20 drivers/video/intelfb/intelfb.h conflict!
++'F' 20 linux/ivtvfb.h conflict!
++'F' 20 linux/matroxfb.h conflict!
++'F' 20 drivers/video/aty/atyfb_base.c conflict!
++'F' 00-0F video/da8xx-fb.h conflict!
++'F' 80-8F linux/arcfb.h conflict!
++'F' DD video/sstfb.h conflict!
++'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict!
++'H' 00-7F linux/hiddev.h conflict!
++'H' 00-0F linux/hidraw.h conflict!
++'H' 01 linux/mei.h conflict!
++'H' 02 linux/mei.h conflict!
++'H' 03 linux/mei.h conflict!
++'H' 00-0F sound/asound.h conflict!
++'H' 20-40 sound/asound_fm.h conflict!
++'H' 80-8F sound/sfnt_info.h conflict!
++'H' 10-8F sound/emu10k1.h conflict!
++'H' 10-1F sound/sb16_csp.h conflict!
++'H' 10-1F sound/hda_hwdep.h conflict!
++'H' 40-4F sound/hdspm.h conflict!
++'H' 40-4F sound/hdsp.h conflict!
+ 'H' 90 sound/usb/usx2y/usb_stream.h
+-'H' 00-0F uapi/misc/habanalabs.h conflict!
++'H' 00-0F uapi/misc/habanalabs.h conflict!
+ 'H' A0 uapi/linux/usb/cdc-wdm.h
+-'H' C0-F0 net/bluetooth/hci.h conflict!
+-'H' C0-DF net/bluetooth/hidp/hidp.h conflict!
+-'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict!
+-'H' C0-DF net/bluetooth/bnep/bnep.h conflict!
+-'H' F1 linux/hid-roccat.h <mailto:erazor_de@users.sourceforge.net>
++'H' C0-F0 net/bluetooth/hci.h conflict!
++'H' C0-DF net/bluetooth/hidp/hidp.h conflict!
++'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict!
++'H' C0-DF net/bluetooth/bnep/bnep.h conflict!
++'H' F1 linux/hid-roccat.h <mailto:erazor_de@users.sourceforge.net>
+ 'H' F8-FA sound/firewire.h
+-'I' all linux/isdn.h conflict!
+-'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict!
+-'I' 40-4F linux/mISDNif.h conflict!
++'I' all linux/isdn.h conflict!
++'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict!
++'I' 40-4F linux/mISDNif.h conflict!
+ 'K' all linux/kd.h
+-'L' 00-1F linux/loop.h conflict!
+-'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict!
+-'L' E0-FF linux/ppdd.h encrypted disk device driver
+- <http://linux01.gwdg.de/~alatham/ppdd.html>
+-'M' all linux/soundcard.h conflict!
+-'M' 01-16 mtd/mtd-abi.h conflict!
++'L' 00-1F linux/loop.h conflict!
++'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict!
++'L' E0-FF linux/ppdd.h encrypted disk device driver
++ <http://linux01.gwdg.de/~alatham/ppdd.html>
++'M' all linux/soundcard.h conflict!
++'M' 01-16 mtd/mtd-abi.h conflict!
+ and drivers/mtd/mtdchar.c
+ 'M' 01-03 drivers/scsi/megaraid/megaraid_sas.h
+-'M' 00-0F drivers/video/fsl-diu-fb.h conflict!
++'M' 00-0F drivers/video/fsl-diu-fb.h conflict!
+ 'N' 00-1F drivers/usb/scanner.h
+ 'N' 40-7F drivers/block/nvme.c
+-'O' 00-06 mtd/ubi-user.h UBI
+-'P' all linux/soundcard.h conflict!
+-'P' 60-6F sound/sscape_ioctl.h conflict!
+-'P' 00-0F drivers/usb/class/usblp.c conflict!
+-'P' 01-09 drivers/misc/pci_endpoint_test.c conflict!
++'O' 00-06 mtd/ubi-user.h UBI
++'P' all linux/soundcard.h conflict!
++'P' 60-6F sound/sscape_ioctl.h conflict!
++'P' 00-0F drivers/usb/class/usblp.c conflict!
++'P' 01-09 drivers/misc/pci_endpoint_test.c conflict!
+ 'Q' all linux/soundcard.h
+-'R' 00-1F linux/random.h conflict!
+-'R' 01 linux/rfkill.h conflict!
++'R' 00-1F linux/random.h conflict!
++'R' 01 linux/rfkill.h conflict!
+ 'R' C0-DF net/bluetooth/rfcomm.h
+ 'R' E0 uapi/linux/fsl_mc.h
+-'S' all linux/cdrom.h conflict!
+-'S' 80-81 scsi/scsi_ioctl.h conflict!
+-'S' 82-FF scsi/scsi.h conflict!
+-'S' 00-7F sound/asequencer.h conflict!
+-'T' all linux/soundcard.h conflict!
+-'T' 00-AF sound/asound.h conflict!
+-'T' all arch/x86/include/asm/ioctls.h conflict!
+-'T' C0-DF linux/if_tun.h conflict!
+-'U' all sound/asound.h conflict!
+-'U' 00-CF linux/uinput.h conflict!
++'S' all linux/cdrom.h conflict!
++'S' 80-81 scsi/scsi_ioctl.h conflict!
++'S' 82-FF scsi/scsi.h conflict!
++'S' 00-7F sound/asequencer.h conflict!
++'T' all linux/soundcard.h conflict!
++'T' 00-AF sound/asound.h conflict!
++'T' all arch/x86/include/asm/ioctls.h conflict!
++'T' C0-DF linux/if_tun.h conflict!
++'U' all sound/asound.h conflict!
++'U' 00-CF linux/uinput.h conflict!
+ 'U' 00-EF linux/usbdevice_fs.h
+ 'U' C0-CF drivers/bluetooth/hci_uart.h
+-'V' all linux/vt.h conflict!
+-'V' all linux/videodev2.h conflict!
+-'V' C0 linux/ivtvfb.h conflict!
+-'V' C0 linux/ivtv.h conflict!
+-'V' C0 media/davinci/vpfe_capture.h conflict!
+-'V' C0 media/si4713.h conflict!
+-'W' 00-1F linux/watchdog.h conflict!
+-'W' 00-1F linux/wanrouter.h conflict! (pre 3.9)
+-'W' 00-3F sound/asound.h conflict!
++'V' all linux/vt.h conflict!
++'V' all linux/videodev2.h conflict!
++'V' C0 linux/ivtvfb.h conflict!
++'V' C0 linux/ivtv.h conflict!
++'V' C0 media/davinci/vpfe_capture.h conflict!
++'V' C0 media/si4713.h conflict!
++'W' 00-1F linux/watchdog.h conflict!
++'W' 00-1F linux/wanrouter.h conflict! (pre 3.9)
++'W' 00-3F sound/asound.h conflict!
+ 'W' 40-5F drivers/pci/switch/switchtec.c
+ 'W' 60-61 linux/watch_queue.h
+-'X' all fs/xfs/xfs_fs.h, conflict!
++'X' all fs/xfs/xfs_fs.h, conflict!
+ fs/xfs/linux-2.6/xfs_ioctl32.h,
+ include/linux/falloc.h,
+ linux/fs.h,
+-'X' all fs/ocfs2/ocfs_fs.h conflict!
+-'X' 01 linux/pktcdvd.h conflict!
++'X' all fs/ocfs2/ocfs_fs.h conflict!
++'X' 01 linux/pktcdvd.h conflict!
+ 'Z' 14-15 drivers/message/fusion/mptctl.h
+-'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices
+- <mailto:gregkh@linuxfoundation.org>
+-'a' all linux/atm*.h, linux/sonet.h ATM on linux
+- <http://lrcwww.epfl.ch/>
+-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver
+-'b' 00-FF conflict! bit3 vme host bridge
+- <mailto:natalia@nikhefk.nikhef.nl>
+-'c' all linux/cm4000_cs.h conflict!
+-'c' 00-7F linux/comstats.h conflict!
+-'c' 00-7F linux/coda.h conflict!
+-'c' 00-1F linux/chio.h conflict!
+-'c' 80-9F arch/s390/include/asm/chsc.h conflict!
++'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices
++ <mailto:gregkh@linuxfoundation.org>
++'a' all linux/atm*.h, linux/sonet.h ATM on linux
++ <http://lrcwww.epfl.ch/>
++'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver
++'b' 00-FF conflict! bit3 vme host bridge
++ <mailto:natalia@nikhefk.nikhef.nl>
++'c' all linux/cm4000_cs.h conflict!
++'c' 00-7F linux/comstats.h conflict!
++'c' 00-7F linux/coda.h conflict!
++'c' 00-1F linux/chio.h conflict!
++'c' 80-9F arch/s390/include/asm/chsc.h conflict!
+ 'c' A0-AF arch/x86/include/asm/msr.h conflict!
+-'d' 00-FF linux/char/drm/drm.h conflict!
+-'d' 02-40 pcmcia/ds.h conflict!
++'d' 00-FF linux/char/drm/drm.h conflict!
++'d' 02-40 pcmcia/ds.h conflict!
+ 'd' F0-FF linux/digi1.h
+-'e' all linux/digi1.h conflict!
+-'f' 00-1F linux/ext2_fs.h conflict!
+-'f' 00-1F linux/ext3_fs.h conflict!
+-'f' 00-0F fs/jfs/jfs_dinode.h conflict!
+-'f' 00-0F fs/ext4/ext4.h conflict!
+-'f' 00-0F linux/fs.h conflict!
+-'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict!
++'e' all linux/digi1.h conflict!
++'f' 00-1F linux/ext2_fs.h conflict!
++'f' 00-1F linux/ext3_fs.h conflict!
++'f' 00-0F fs/jfs/jfs_dinode.h conflict!
++'f' 00-0F fs/ext4/ext4.h conflict!
++'f' 00-0F linux/fs.h conflict!
++'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict!
+ 'f' 13-27 linux/fscrypt.h
+ 'f' 81-8F linux/fsverity.h
+ 'g' 00-0F linux/usb/gadgetfs.h
+ 'g' 20-2F linux/usb/g_printer.h
+-'h' 00-7F conflict! Charon filesystem
+- <mailto:zapman@interlan.net>
+-'h' 00-1F linux/hpet.h conflict!
++'h' 00-7F conflict! Charon filesystem
++ <mailto:zapman@interlan.net>
++'h' 00-1F linux/hpet.h conflict!
+ 'h' 80-8F fs/hfsplus/ioctl.c
+-'i' 00-3F linux/i2o-dev.h conflict!
+-'i' 0B-1F linux/ipmi.h conflict!
++'i' 00-3F linux/i2o-dev.h conflict!
++'i' 0B-1F linux/ipmi.h conflict!
+ 'i' 80-8F linux/i8k.h
+-'i' 90-9F `linux/iio/*.h` IIO
++'i' 90-9F `linux/iio/*.h` IIO
+ 'j' 00-3F linux/joystick.h
+-'k' 00-0F linux/spi/spidev.h conflict!
+-'k' 00-05 video/kyro.h conflict!
+-'k' 10-17 linux/hsi/hsi_char.h HSI character device
+-'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system
+- <http://web.archive.org/web/%2A/http://mikonos.dia.unisa.it/tcfs>
+-'l' 40-7F linux/udf_fs_i.h in development:
+- <http://sourceforge.net/projects/linux-udf/>
+-'m' 00-09 linux/mmtimer.h conflict!
+-'m' all linux/mtio.h conflict!
+-'m' all linux/soundcard.h conflict!
+-'m' all linux/synclink.h conflict!
+-'m' 00-19 drivers/message/fusion/mptctl.h conflict!
+-'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict!
++'k' 00-0F linux/spi/spidev.h conflict!
++'k' 00-05 video/kyro.h conflict!
++'k' 10-17 linux/hsi/hsi_char.h HSI character device
++'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system
++ <http://web.archive.org/web/%2A/http://mikonos.dia.unisa.it/tcfs>
++'l' 40-7F linux/udf_fs_i.h in development:
++ <http://sourceforge.net/projects/linux-udf/>
++'m' 00-09 linux/mmtimer.h conflict!
++'m' all linux/mtio.h conflict!
++'m' all linux/soundcard.h conflict!
++'m' all linux/synclink.h conflict!
++'m' 00-19 drivers/message/fusion/mptctl.h conflict!
++'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict!
+ 'n' 00-7F linux/ncp_fs.h and fs/ncpfs/ioctl.c
+-'n' 80-8F uapi/linux/nilfs2_api.h NILFS2
+-'n' E0-FF linux/matroxfb.h matroxfb
+-'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2
+-'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps)
+-'o' 40-41 mtd/ubi-user.h UBI
+-'o' 01-A1 `linux/dvb/*.h` DVB
+-'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this)
+-'p' 00-1F linux/rtc.h conflict!
++'n' 80-8F uapi/linux/nilfs2_api.h NILFS2
++'n' E0-FF linux/matroxfb.h matroxfb
++'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2
++'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps)
++'o' 40-41 mtd/ubi-user.h UBI
++'o' 01-A1 `linux/dvb/*.h` DVB
++'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this)
++'p' 00-1F linux/rtc.h conflict!
+ 'p' 40-7F linux/nvram.h
+-'p' 80-9F linux/ppdev.h user-space parport
+- <mailto:tim@cyberelk.net>
+-'p' A1-A5 linux/pps.h LinuxPPS
+- <mailto:giometti@linux.it>
++'p' 80-9F linux/ppdev.h user-space parport
++ <mailto:tim@cyberelk.net>
++'p' A1-A5 linux/pps.h LinuxPPS
++ <mailto:giometti@linux.it>
+ 'q' 00-1F linux/serio.h
+-'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK
+- linux/ixjuser.h <http://web.archive.org/web/%2A/http://www.quicknet.net>
++'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK
++ linux/ixjuser.h <http://web.archive.org/web/%2A/http://www.quicknet.net>
+ 'r' 00-1F linux/msdos_fs.h and fs/fat/dir.c
+ 's' all linux/cdk.h
+ 't' 00-7F linux/ppp-ioctl.h
+ 't' 80-8F linux/isdn_ppp.h
+-'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM
+-'u' 00-1F linux/smb_fs.h gone
+-'u' 20-3F linux/uvcvideo.h USB video class host driver
+-'u' 40-4f linux/udmabuf.h userspace dma-buf misc device
+-'v' 00-1F linux/ext2_fs.h conflict!
+-'v' 00-1F linux/fs.h conflict!
+-'v' 00-0F linux/sonypi.h conflict!
+-'v' 00-0F media/v4l2-subdev.h conflict!
+-'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API
+-'v' C0-FF linux/meye.h conflict!
+-'w' all CERN SCI driver
+-'y' 00-1F packet based user level communications
+- <mailto:zapman@interlan.net>
+-'z' 00-3F CAN bus card conflict!
+- <mailto:hdstich@connectu.ulm.circular.de>
+-'z' 40-7F CAN bus card conflict!
+- <mailto:oe@port.de>
+-'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict!
++'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM
++'u' 00-1F linux/smb_fs.h gone
++'u' 20-3F linux/uvcvideo.h USB video class host driver
++'u' 40-4f linux/udmabuf.h userspace dma-buf misc device
++'v' 00-1F linux/ext2_fs.h conflict!
++'v' 00-1F linux/fs.h conflict!
++'v' 00-0F linux/sonypi.h conflict!
++'v' 00-0F media/v4l2-subdev.h conflict!
++'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API
++'v' C0-FF linux/meye.h conflict!
++'w' all CERN SCI driver
++'y' 00-1F packet based user level communications
++ <mailto:zapman@interlan.net>
++'z' 00-3F CAN bus card conflict!
++ <mailto:hdstich@connectu.ulm.circular.de>
++'z' 40-7F CAN bus card conflict!
++ <mailto:oe@port.de>
++'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict!
+ '|' 00-7F linux/media.h
+ 0x80 00-1F linux/fb.h
+ 0x81 00-1F linux/vduse.h
+ 0x89 00-06 arch/x86/include/asm/sockios.h
+ 0x89 0B-DF linux/sockios.h
+-0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range
+-0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range
++0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range
++0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range
+ 0x8B all linux/wireless.h
+-0x8C 00-3F WiNRADiO driver
+- <http://www.winradio.com.au/>
++0x8C 00-3F WiNRADiO driver
++ <http://www.winradio.com.au/>
+ 0x90 00 drivers/cdrom/sbpcd.h
+ 0x92 00-0F drivers/usb/mon/mon_bin.c
+ 0x93 60-7F linux/auto_fs.h
+-0x94 all fs/btrfs/ioctl.h Btrfs filesystem
+- and linux/fs.h some lifted to vfs/generic
+-0x97 00-7F fs/ceph/ioctl.h Ceph file system
+-0x99 00-0F 537-Addinboard driver
+- <mailto:buk@buks.ipn.de>
+-0xA0 all linux/sdp/sdp.h Industrial Device Project
+- <mailto:kenji@bitgate.com>
+-0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver
+-0xA2 all uapi/linux/acrn.h ACRN hypervisor
+-0xA3 80-8F Port ACL in development:
+- <mailto:tlewis@mindspring.com>
++0x94 all fs/btrfs/ioctl.h Btrfs filesystem
++ and linux/fs.h some lifted to vfs/generic
++0x97 00-7F fs/ceph/ioctl.h Ceph file system
++0x99 00-0F 537-Addinboard driver
++ <mailto:buk@buks.ipn.de>
++0xA0 all linux/sdp/sdp.h Industrial Device Project
++ <mailto:kenji@bitgate.com>
++0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver
++0xA2 all uapi/linux/acrn.h ACRN hypervisor
++0xA3 80-8F Port ACL in development:
++ <mailto:tlewis@mindspring.com>
+ 0xA3 90-9F linux/dtlk.h
+-0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
+-0xA4 00-1F uapi/asm/sgx.h <mailto:linux-sgx@vger.kernel.org>
+-0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator
+- <mailto:luzmaximilian@gmail.com>
+-0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver
+- <mailto:luzmaximilian@gmail.com>
++0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
++0xA4 00-1F uapi/asm/sgx.h <mailto:linux-sgx@vger.kernel.org>
++0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator
++ <mailto:luzmaximilian@gmail.com>
++0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver
++ <mailto:luzmaximilian@gmail.com>
+ 0xAA 00-3F linux/uapi/linux/userfaultfd.h
+ 0xAB 00-1F linux/nbd.h
+ 0xAC 00-1F linux/raw.h
+-0xAD 00 Netfilter device in development:
+- <mailto:rusty@rustcorp.com.au>
+-0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine
+- <mailto:kvm@vger.kernel.org>
+-0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine
+- <mailto:kvm@vger.kernel.org>
+-0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves
+-0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor
+-0xB0 all RATIO devices in development:
+- <mailto:vgo@ratio.de>
+-0xB1 00-1F PPPoX
+- <mailto:mostrows@styx.uwaterloo.ca>
++0xAD 00 Netfilter device in development:
++ <mailto:rusty@rustcorp.com.au>
++0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine
++ <mailto:kvm@vger.kernel.org>
++0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine
++ <mailto:kvm@vger.kernel.org>
++0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves
++0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor
++0xB0 all RATIO devices in development:
++ <mailto:vgo@ratio.de>
++0xB1 00-1F PPPoX
++ <mailto:mostrows@styx.uwaterloo.ca>
+ 0xB3 00 linux/mmc/ioctl.h
+-0xB4 00-0F linux/gpio.h <mailto:linux-gpio@vger.kernel.org>
+-0xB5 00-0F uapi/linux/rpmsg.h <mailto:linux-remoteproc@vger.kernel.org>
++0xB4 00-0F linux/gpio.h <mailto:linux-gpio@vger.kernel.org>
++0xB5 00-0F uapi/linux/rpmsg.h <mailto:linux-remoteproc@vger.kernel.org>
+ 0xB6 all linux/fpga-dfl.h
+-0xB7 all uapi/linux/remoteproc_cdev.h <mailto:linux-remoteproc@vger.kernel.org>
+-0xB7 all uapi/linux/nsfs.h <mailto:Andrei Vagin <avagin@openvz.org>>
++0xB7 all uapi/linux/remoteproc_cdev.h <mailto:linux-remoteproc@vger.kernel.org>
++0xB7 all uapi/linux/nsfs.h <mailto:Andrei Vagin <avagin@openvz.org>>
+ 0xC0 00-0F linux/usb/iowarrior.h
+ 0xCA 00-0F uapi/misc/cxl.h
+ 0xCA 10-2F uapi/misc/ocxl.h
+ 0xCA 80-BF uapi/scsi/cxlflash_ioctl.h
+-0xCB 00-1F CBM serial IEC bus in development:
+- <mailto:michael.klein@puffin.lb.shuttle.de>
+-0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver
++0xCB 00-1F CBM serial IEC bus in development:
++ <mailto:michael.klein@puffin.lb.shuttle.de>
++0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver
+ 0xCD 01 linux/reiserfs_fs.h
+-0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices
++0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices
+ 0xCF 02 fs/cifs/ioctl.c
+ 0xDB 00-0F drivers/char/mwave/mwavepub.h
+-0xDD 00-3F ZFCP device driver see drivers/s390/scsi/
+- <mailto:aherrman@de.ibm.com>
++0xDD 00-3F ZFCP device driver see drivers/s390/scsi/
++ <mailto:aherrman@de.ibm.com>
+ 0xE5 00-3F linux/fuse.h
+-0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver
+-0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development)
+- <mailto:thomas@winischhofer.net>
+-0xF6 all LTTng Linux Trace Toolkit Next Generation
+- <mailto:mathieu.desnoyers@efficios.com>
++0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver
++0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development)
++ <mailto:thomas@winischhofer.net>
++0xF6 all LTTng Linux Trace Toolkit Next Generation
++ <mailto:mathieu.desnoyers@efficios.com>
+ 0xFD all linux/dm-ioctl.h
+ 0xFE all linux/isst_if.h
+-==== ===== ======================================================= ================================================================
++==== ===== ========================================================= ================================================================
--- /dev/null
+From stable+bounces-266613-greg=kroah.com@vger.kernel.org Wed Jun 17 03:48:08 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2026 21:48:01 -0400
+Subject: Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
+To: stable@vger.kernel.org
+Cc: Dexuan Cui <decui@microsoft.com>, Michael Kelley <mhklinux@outlook.com>, Krister Johansen <kjlx@templeofstupid.com>, Matthew Ruffell <matthew.ruffell@canonical.com>, Wei Liu <wei.liu@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260617014801.3672943-1-sashal@kernel.org>
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 016a25e4b0df4d77e7c258edee4aaf982e4ee809 ]
+
+If vmbus_reserve_fb() in the kdump/kexec kernel fails to properly reserve
+the framebuffer MMIO range (which is below 4GB) due to a Gen2 VM's
+screen.lfb_base being zero [1], there is an MMIO conflict between the
+drivers hyperv-drm and pci-hyperv: when the driver pci-hyperv's
+hv_allocate_config_window() calls vmbus_allocate_mmio() to get an
+MMIO range, typically it gets a 32-bit MMIO range that overlaps with the
+framebuffer MMIO range, and later hv_pci_enter_d0() fails with an
+error message "PCI Pass-through VSP failed D0 Entry with status" since
+the host thinks that PCI devices must not use MMIO space that the
+host has assigned to the framebuffer.
+
+This is especially an issue if pci-hyperv is built-in and hyperv-drm is
+built as a module. Consequently, the kdump/kexec kernel fails to detect
+PCI devices via pci-hyperv, and may fail to mount the root file system,
+which may reside in a NVMe disk. The issue described here has existed
+for SR-IOV VF NICs since day one of the pci-hyperv driver, and has been
+worked around on x64 when possible. With the recent introduction of
+ARM64 VMs that boot from NVMe, there is no workaround, so we need a
+formal fix.
+
+On Gen2 VMs, if the screen.lfb_base is 0 in the kdump/kexec kernel [1],
+fall back to the low MMIO base, which should be equal to the framebuffer
+MMIO base [2] (the statement is true according to my testing on x64
+Windows Server 2016, and on x64 and ARM64 Windows Server 2025 and on
+Azure. I checked with the Hyper-V team and they said the statement should
+continue to be true for Gen2 VMs). In the first kernel, screen.lfb_base
+is not 0; if the user specifies a very high resolution, it's not enough
+to only reserve 8MB: let's always reserve half of the space below 4GB,
+but cap the reservation to 128MB, which is the required framebuffer size
+of the highest resolution 7680*4320 supported by Hyper-V.
+
+While at it, fix the comparison "end > VTPM_BASE_ADDRESS" by changing
+the > to >=. Here the 'end' is an inclusive end (typically, it's
+0xFFFF_FFFF for the low MMIO range).
+
+Note: vmbus_reserve_fb() now also reserves an MMIO range at the beginning
+of the low MMIO range on CVMs, which have no framebuffers (the
+'screen.lfb_base' in vmbus_reserve_fb() is 0 for CVMs), just in case the
+host might treat the beginning of the low MMIO range specially [3]. BTW,
+the OpenHCL kernel is not affected by the change, because that kernel
+boots with DeviceTree rather than ACPI (so vmbus_reserve_fb() won't run
+there), and there is no framebuffer device for that kernel.
+
+Note: normally Gen1 VMs don't have the MMIO conflict issue because the
+framebuffer MMIO range (which is hardcoded to base=4GB-128MB and
+size=64MB for Gen1 VMs by the host) is always reported via the legacy PCI
+graphics device's BAR, so the kdump/kexec kernel can reserve the 64MB
+MMIO range; however, if the VM is configured to use a very high resolution
+and the required framebuffer size exceeds 64MB (AFAIK, in practice, this
+isn't a typical configuration by users), the hyperv-drm driver may need to
+allocate an MMIO range above 4GB and change the framebuffer MMIO location
+to the allocated MMIO range -- in this case, there can still be issues [4]
+which can't be easily fixed: any possible affected Gen1 users would have
+to use a resolution whose framebuffer size is <= 64MB, or switch to Gen2
+VMs.
+
+[1] https://lore.kernel.org/all/SA1PR21MB692176C1BC53BFC9EAE5CF8EBF51A@SA1PR21MB6921.namprd21.prod.outlook.com/
+[2] https://lore.kernel.org/all/SA1PR21MB69218F955B62DFF62E3E88D2BF222@SA1PR21MB6921.namprd21.prod.outlook.com/
+[3] https://lore.kernel.org/all/SN6PR02MB415726B17D5A6027CD1717E8D4342@SN6PR02MB4157.namprd02.prod.outlook.com/
+[4] https://lore.kernel.org/all/SA1PR21MB69213486F821CA5A2C793C81BF342@SA1PR21MB6921.namprd21.prod.outlook.com/
+
+Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs")
+CC: stable@vger.kernel.org
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Tested-by: Krister Johansen <kjlx@templeofstupid.com>
+Tested-by: Matthew Ruffell <matthew.ruffell@canonical.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hv/vmbus_drv.c | 56 +++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 41 insertions(+), 15 deletions(-)
+
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -2222,8 +2222,8 @@ static acpi_status vmbus_walk_resources(
+ return AE_NO_MEMORY;
+
+ /* If this range overlaps the virtual TPM, truncate it. */
+- if (end > VTPM_BASE_ADDRESS && start < VTPM_BASE_ADDRESS)
+- end = VTPM_BASE_ADDRESS;
++ if (end >= VTPM_BASE_ADDRESS && start < VTPM_BASE_ADDRESS)
++ end = VTPM_BASE_ADDRESS - 1;
+
+ new_res->name = "hyperv mmio";
+ new_res->flags = IORESOURCE_MEM;
+@@ -2290,26 +2290,52 @@ static int vmbus_acpi_remove(struct acpi
+
+ static void vmbus_reserve_fb(void)
+ {
+- int size;
++ resource_size_t start = 0, size;
++ resource_size_t low_mmio_base;
++
++ if (efi_enabled(EFI_BOOT)) {
++ /* Gen2 VM: get FB base from EFI framebuffer */
++ start = screen_info.lfb_base;
++ size = max_t(__u32, screen_info.lfb_size, 0x800000);
++
++ low_mmio_base = hyperv_mmio->start;
++ if (!low_mmio_base || upper_32_bits(low_mmio_base) ||
++ (start && start < low_mmio_base)) {
++ pr_warn("Unexpected low mmio base %pa\n", &low_mmio_base);
++ } else {
++ /*
++ * If the kdump/kexec or CVM kernel's lfb_base
++ * is 0, fall back to the low mmio base.
++ */
++ if (!start)
++ start = low_mmio_base;
++ /*
++ * Reserve half of the space below 4GB for high
++ * resolutions, but cap the reservation to 128MB.
++ */
++ size = min((SZ_4G - start) / 2, SZ_128M);
++ }
++ } else {
++ /* Gen1 VM: get FB base from screen_info */
++ start = screen_info.lfb_base;
++ size = max_t(__u32, screen_info.lfb_size, 0x4000000);
++ }
++
++ if (!start) {
++ pr_warn("Unexpected framebuffer mmio base of zero\n");
++ return;
++ }
++
+ /*
+ * Make a claim for the frame buffer in the resource tree under the
+ * first node, which will be the one below 4GB. The length seems to
+ * be underreported, particularly in a Generation 1 VM. So start out
+ * reserving a larger area and make it smaller until it succeeds.
+ */
++ for (; !fb_mmio && (size >= 0x100000); size >>= 1)
++ fb_mmio = __request_region(hyperv_mmio, start, size, fb_mmio_name, 0);
+
+- if (screen_info.lfb_base) {
+- if (efi_enabled(EFI_BOOT))
+- size = max_t(__u32, screen_info.lfb_size, 0x800000);
+- else
+- size = max_t(__u32, screen_info.lfb_size, 0x4000000);
+-
+- for (; !fb_mmio && (size >= 0x100000); size >>= 1) {
+- fb_mmio = __request_region(hyperv_mmio,
+- screen_info.lfb_base, size,
+- fb_mmio_name, 0);
+- }
+- }
++ pr_info("hv_mmio=%pR,%pR fb=%pR\n", hyperv_mmio, hyperv_mmio->sibling, fb_mmio);
+ }
+
+ /**
--- /dev/null
+From stable+bounces-268015-greg=kroah.com@vger.kernel.org Tue Jun 23 21:52:46 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2026 15:52:40 -0400
+Subject: fuse: re-lock request before replacing page cache folio
+To: stable@vger.kernel.org
+Cc: Joanne Koong <joannelkoong@gmail.com>, Lei Lu <llfamsec@gmail.com>, Miklos Szeredi <mszeredi@redhat.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260623195240.1378610-1-sashal@kernel.org>
+
+From: Joanne Koong <joannelkoong@gmail.com>
+
+[ Upstream commit a078484921052d0badd827fcc2770b5cfc1d4120 ]
+
+fuse_try_move_folio() unlocks the request on entry but does not
+re-lock it on the success path. This means fuse_chan_abort() can end the
+request and free the fuse_io_args (eg fuse_readpages_end()) while the
+subsequent copy chain logic after fuse_try_move_folio() accesses the
+fuse_io_args, leading to use-after-free issues.
+
+Fix this by calling lock_request() before replace_page_cache_folio().
+This ensures the request is locked on the success path which will
+prevent the fuse_io_args from being freed while the later copying logic
+runs, and also ensures that the ap->folios[i]->mapping is never null
+since ap->folios[i] will always point to the newfolio after
+replace_page_cache_folio().
+
+Fixes: ce534fb05292 ("fuse: allow splice to move pages")
+Cc: stable@vger.kernel.org
+Reported-by: Lei Lu <llfamsec@gmail.com>
+Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fuse/dev.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -845,6 +845,10 @@ static int fuse_try_move_page(struct fus
+ if (WARN_ON(PageMlocked(oldpage)))
+ goto out_fallback_unlock;
+
++ err = lock_request(cs->req);
++ if (err)
++ goto out_fallback_unlock;
++
+ replace_page_cache_page(oldpage, newpage);
+
+ get_page(newpage);
+@@ -858,20 +862,7 @@ static int fuse_try_move_page(struct fus
+ */
+ pipe_buf_release(cs->pipe, buf);
+
+- err = 0;
+- spin_lock(&cs->req->waitq.lock);
+- if (test_bit(FR_ABORTED, &cs->req->flags))
+- err = -ENOENT;
+- else
+- *pagep = newpage;
+- spin_unlock(&cs->req->waitq.lock);
+-
+- if (err) {
+- unlock_page(newpage);
+- put_page(newpage);
+- goto out_put_old;
+- }
+-
++ *pagep = newpage;
+ unlock_page(oldpage);
+ /* Drop ref for ap->pages[] array */
+ put_page(oldpage);
--- /dev/null
+From stable+bounces-265468-greg=kroah.com@vger.kernel.org Tue Jun 16 19:42:06 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2026 13:35:50 -0400
+Subject: hv: utils: handle and propagate errors in kvp_register
+To: stable@vger.kernel.org
+Cc: Thorsten Blum <thorsten.blum@linux.dev>, Long Li <longli@microsoft.com>, Wei Liu <wei.liu@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260616173550.3401658-1-sashal@kernel.org>
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit 3fcf923302a8f5c0dc3af3d2ca2657cb5fae4297 ]
+
+Make kvp_register() return an error code instead of silently ignoring
+failures, and propagate the error from kvp_handle_handshake() instead of
+returning success.
+
+This propagates both kzalloc_obj() and hvutil_transport_send() failures
+to kvp_handle_handshake() and thus to kvp_on_msg().
+
+Fixes: 245ba56a52a3 ("Staging: hv: Implement key/value pair (KVP)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Reviewed-by: Long Li <longli@microsoft.com>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hv/hv_kvp.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+--- a/drivers/hv/hv_kvp.c
++++ b/drivers/hv/hv_kvp.c
+@@ -93,7 +93,7 @@ static void kvp_send_key(struct work_str
+ static void kvp_respond_to_host(struct hv_kvp_msg *msg, int error);
+ static void kvp_timeout_func(struct work_struct *dummy);
+ static void kvp_host_handshake_func(struct work_struct *dummy);
+-static void kvp_register(int);
++static int kvp_register(int);
+
+ static DECLARE_DELAYED_WORK(kvp_timeout_work, kvp_timeout_func);
+ static DECLARE_DELAYED_WORK(kvp_host_handshake_work, kvp_host_handshake_func);
+@@ -127,24 +127,26 @@ static void kvp_register_done(void)
+ hv_poll_channel(kvp_transaction.recv_channel, kvp_poll_wrapper);
+ }
+
+-static void
++static int
+ kvp_register(int reg_value)
+ {
+
+ struct hv_kvp_msg *kvp_msg;
+ char *version;
++ int ret;
+
+ kvp_msg = kzalloc(sizeof(*kvp_msg), GFP_KERNEL);
++ if (!kvp_msg)
++ return -ENOMEM;
+
+- if (kvp_msg) {
+- version = kvp_msg->body.kvp_register.version;
+- kvp_msg->kvp_hdr.operation = reg_value;
+- strcpy(version, HV_DRV_VERSION);
+-
+- hvutil_transport_send(hvt, kvp_msg, sizeof(*kvp_msg),
+- kvp_register_done);
+- kfree(kvp_msg);
+- }
++ version = kvp_msg->body.kvp_register.version;
++ kvp_msg->kvp_hdr.operation = reg_value;
++ strcpy(version, HV_DRV_VERSION);
++
++ ret = hvutil_transport_send(hvt, kvp_msg, sizeof(*kvp_msg),
++ kvp_register_done);
++ kfree(kvp_msg);
++ return ret;
+ }
+
+ static void kvp_timeout_func(struct work_struct *dummy)
+@@ -186,9 +188,8 @@ static int kvp_handle_handshake(struct h
+ */
+ pr_debug("KVP: userspace daemon ver. %d connected\n",
+ msg->kvp_hdr.operation);
+- kvp_register(dm_reg_value);
+
+- return 0;
++ return kvp_register(dm_reg_value);
+ }
+
+
--- /dev/null
+From stable+bounces-268624-greg=kroah.com@vger.kernel.org Thu Jun 25 18:29:01 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 12:25:13 -0400
+Subject: ksmbd: reject non-VALID session in compound request branch
+To: stable@vger.kernel.org
+Cc: Gil Portnoy <dddhkts1@gmail.com>, Namjae Jeon <linkinjeon@kernel.org>, Steve French <stfrench@microsoft.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625162513.2501233-1-sashal@kernel.org>
+
+From: Gil Portnoy <dddhkts1@gmail.com>
+
+[ Upstream commit 609ca17d869d04ba249e32cdcbf13c0b1c66f43c ]
+
+smb2_check_user_session() takes a shortcut for any operation that is not
+the first in a COMPOUND request: it reuses work->sess (the session bound by
+the first operation) and validates only the SessionId, then returns
+"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
+SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
+value) skips even the id comparison. The standalone path
+(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
+enforce the VALID state; the compound branch bypasses all of it.
+
+A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
+a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL
+(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of
+a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,
+\\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and
+reaches ksmbd_ipc_tree_connect_request(), which dereferences
+user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704)
+-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
+worker for all clients.
+
+Reject any non-first compound operation that lands on a session which is
+not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path
+enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,
+but it is never carried as a non-first compound operation, so multi-leg
+authentication is unaffected by this check.
+
+Fixes: 5005bcb42191 ("ksmbd: validate session id and tree id in the compound request")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ksmbd/smb2pdu.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/ksmbd/smb2pdu.c
++++ b/fs/ksmbd/smb2pdu.c
+@@ -606,6 +606,11 @@ int smb2_check_user_session(struct ksmbd
+ sess_id, work->sess->id);
+ return -EINVAL;
+ }
++ if (work->sess->state != SMB2_SESSION_VALID) {
++ pr_err("compound request on a non-valid session (state %d)\n",
++ work->sess->state);
++ return -EINVAL;
++ }
+ return 1;
+ }
+
--- /dev/null
+From stable+bounces-266565-greg=kroah.com@vger.kernel.org Tue Jun 16 21:53:29 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2026 15:53:01 -0400
+Subject: misc: fastrpc: Add dma_mask to fastrpc_channel_ctx
+To: stable@vger.kernel.org
+Cc: Abel Vesa <abel.vesa@linaro.org>, Srinivas Kandagatla <srinivas.kandagatla@linaro.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260616195302.3526937-1-sashal@kernel.org>
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 9bde43a0e2f469961e18d0a3496a9a74379c22bf ]
+
+dma_set_mask_and_coherent only updates the mask to which the device
+dma_mask pointer points to. Add a dma_mask to the channel ctx and set
+the device dma_mask to point to that, otherwise the dma_set_mask will
+return an error and the dma_set_coherent_mask will be skipped too.
+
+Co-developed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20221125071405.148786-11-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 5401fb4fe10f ("misc: fastrpc: Fix NULL pointer dereference in rpmsg callback")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/fastrpc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -214,6 +214,7 @@ struct fastrpc_channel_ctx {
+ struct list_head users;
+ struct miscdevice miscdev;
+ struct kref refcount;
++ u64 dma_mask;
+ };
+
+ struct fastrpc_user {
+@@ -1691,6 +1692,7 @@ static int fastrpc_rpmsg_probe(struct rp
+ kref_init(&data->refcount);
+
+ dev_set_drvdata(&rpdev->dev, data);
++ rdev->dma_mask = &data->dma_mask;
+ dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32));
+ INIT_LIST_HEAD(&data->users);
+ spin_lock_init(&data->lock);
--- /dev/null
+From stable+bounces-266566-greg=kroah.com@vger.kernel.org Tue Jun 16 21:53:31 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2026 15:53:02 -0400
+Subject: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
+To: stable@vger.kernel.org
+Cc: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>, Bjorn Andersson <andersson@kernel.org>, Srinivas Kandagatla <srini@kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260616195302.3526937-2-sashal@kernel.org>
+
+From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+
+[ Upstream commit 5401fb4fe10fac6134c308495df18ed74aebb9c4 ]
+
+A NULL pointer dereference was observed on Hawi at boot when the DSP
+sends a glink message before fastrpc_rpmsg_probe() has completed
+initialization:
+
+ Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178
+ pc : _raw_spin_lock_irqsave+0x34/0x8c
+ lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
+ ...
+ Call trace:
+ _raw_spin_lock_irqsave+0x34/0x8c (P)
+ fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
+ qcom_glink_native_rx+0x538/0x6a4
+ qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem]
+
+The faulting address 0x178 corresponds to the lock variable inside
+struct fastrpc_channel_ctx, confirming that cctx is NULL when
+fastrpc_rpmsg_callback() attempts to take the spinlock.
+
+There are two issues here. First, dev_set_drvdata() is called before
+spin_lock_init() and idr_init(), leaving a window where the callback
+can retrieve a valid cctx pointer but operate on an uninitialized
+spinlock. Second, the rpmsg channel becomes live as soon as the driver
+is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata()
+is called at all, resulting in dev_get_drvdata() returning NULL.
+
+Fix both issues by moving all cctx initialization ahead of
+dev_set_drvdata() so the structure is fully initialized before it
+becomes visible to the callback, and add a NULL check in
+fastrpc_rpmsg_callback() as a guard against any remaining window.
+
+Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204528.116920-4-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/fastrpc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -1691,7 +1691,6 @@ static int fastrpc_rpmsg_probe(struct rp
+
+ kref_init(&data->refcount);
+
+- dev_set_drvdata(&rpdev->dev, data);
+ rdev->dma_mask = &data->dma_mask;
+ dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32));
+ INIT_LIST_HEAD(&data->users);
+@@ -1699,6 +1698,7 @@ static int fastrpc_rpmsg_probe(struct rp
+ idr_init(&data->ctx_idr);
+ data->domain_id = domain_id;
+ data->rpdev = rpdev;
++ dev_set_drvdata(&rpdev->dev, data);
+
+ return of_platform_populate(rdev->of_node, NULL, NULL, rdev);
+ }
+@@ -1746,6 +1746,9 @@ static int fastrpc_rpmsg_callback(struct
+ if (len < sizeof(*rsp))
+ return -EINVAL;
+
++ if (!cctx)
++ return -ENODEV;
++
+ ctxid = ((rsp->ctx & FASTRPC_CTXID_MASK) >> 4);
+
+ spin_lock_irqsave(&cctx->lock, flags);
--- /dev/null
+From stable+bounces-264708-greg=kroah.com@vger.kernel.org Tue Jun 16 18:30:48 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2026 12:30:39 -0400
+Subject: mptcp: fix missing wakeups in edge scenarios
+To: stable@vger.kernel.org
+Cc: Paolo Abeni <pabeni@redhat.com>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260616163040.3345031-1-sashal@kernel.org>
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 9d8d28738f24b75616d6ca7a27cb4aed88520343 ]
+
+The mptcp_recvmsg() can fill MPTCP socket receive queue via
+mptcp_move_skbs(), but currently does not try to wakeup any listener,
+because the same process is going to check the receive queue soon.
+
+When multiple threads are reading from the same fd, the above can
+cause stall. Add the missing wakeup.
+
+Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -2119,8 +2119,10 @@ static bool __mptcp_move_skbs(struct mpt
+ __mptcp_splice_receive_queue(sk);
+ mptcp_data_unlock(sk);
+ }
+- if (ret)
++ if (ret) {
+ mptcp_check_data_fin((struct sock *)msk);
++ sk->sk_data_ready(sk);
++ }
+ return !skb_queue_empty(&msk->receive_queue);
+ }
+
--- /dev/null
+From stable+bounces-266810-greg=kroah.com@vger.kernel.org Wed Jun 17 16:55:27 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2026 10:49:18 -0400
+Subject: net: phonet: free phonet_device after RCU grace period
+To: stable@vger.kernel.org
+Cc: "Santosh Kalluri" <santosh.kalluri129@gmail.com>, "Rémi Denis-Courmont" <remi@remlab.net>, "Simon Horman" <horms@kernel.org>, "Jakub Kicinski" <kuba@kernel.org>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20260617144918.39042-3-sashal@kernel.org>
+
+From: Santosh Kalluri <santosh.kalluri129@gmail.com>
+
+[ Upstream commit 71de0177b28da751f407581a4515cf4d762f6296 ]
+
+phonet_device_destroy() removes a phonet_device from the per-net device
+list with list_del_rcu(), but frees it immediately. RCU readers walking
+the same list can still hold a pointer to the object after it has been
+removed, leading to a slab-use-after-free.
+
+Use kfree_rcu(), matching the lifetime rule already used by
+phonet_address_del() for the same object type.
+
+Fixes: eeb74a9d45f7 ("Phonet: convert devices list to RCU")
+Cc: stable@vger.kernel.org
+Signed-off-by: Santosh Kalluri <santosh.kalluri129@gmail.com>
+Acked-by: Rémi Denis-Courmont <remi@remlab.net>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/phonet/pn_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/phonet/pn_dev.c
++++ b/net/phonet/pn_dev.c
+@@ -105,7 +105,7 @@ static void phonet_device_destroy(struct
+ for_each_set_bit(addr, pnd->addrs, 64)
+ phonet_address_notify(net, RTM_DELADDR, ifindex, addr);
+
+- kfree(pnd);
++ kfree_rcu(pnd, rcu);
+ }
+ }
+
--- /dev/null
+From stable+bounces-266808-greg=kroah.com@vger.kernel.org Wed Jun 17 16:55:26 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2026 10:49:16 -0400
+Subject: phonet: Pass ifindex to fill_addr().
+To: stable@vger.kernel.org
+Cc: Kuniyuki Iwashima <kuniyu@amazon.com>, Eric Dumazet <edumazet@google.com>, Paolo Abeni <pabeni@redhat.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260617144918.39042-1-sashal@kernel.org>
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 08a9572be36819b5d9011604edfa5db6c5062a7a ]
+
+We will convert addr_doit() and getaddr_dumpit() to RCU, both
+of which call fill_addr().
+
+The former will call phonet_address_notify() outside of RCU
+due to GFP_KERNEL, so dev will not be available in fill_addr().
+
+Let's pass ifindex directly to fill_addr().
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: 71de0177b28d ("net: phonet: free phonet_device after RCU grace period")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/phonet/pn_netlink.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/net/phonet/pn_netlink.c
++++ b/net/phonet/pn_netlink.c
+@@ -19,7 +19,7 @@
+
+ /* Device address handling */
+
+-static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
++static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr,
+ u32 portid, u32 seq, int event);
+
+ void phonet_address_notify(int event, struct net_device *dev, u8 addr)
+@@ -31,7 +31,8 @@ void phonet_address_notify(int event, st
+ nla_total_size(1), GFP_KERNEL);
+ if (skb == NULL)
+ goto errout;
+- err = fill_addr(skb, dev, addr, 0, 0, event);
++
++ err = fill_addr(skb, dev->ifindex, addr, 0, 0, event);
+ if (err < 0) {
+ WARN_ON(err == -EMSGSIZE);
+ kfree_skb(skb);
+@@ -92,8 +93,8 @@ static int addr_doit(struct sk_buff *skb
+ return err;
+ }
+
+-static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
+- u32 portid, u32 seq, int event)
++static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr,
++ u32 portid, u32 seq, int event)
+ {
+ struct ifaddrmsg *ifm;
+ struct nlmsghdr *nlh;
+@@ -107,7 +108,7 @@ static int fill_addr(struct sk_buff *skb
+ ifm->ifa_prefixlen = 0;
+ ifm->ifa_flags = IFA_F_PERMANENT;
+ ifm->ifa_scope = RT_SCOPE_LINK;
+- ifm->ifa_index = dev->ifindex;
++ ifm->ifa_index = ifindex;
+ if (nla_put_u8(skb, IFA_LOCAL, addr))
+ goto nla_put_failure;
+ nlmsg_end(skb, nlh);
+@@ -140,7 +141,7 @@ static int getaddr_dumpit(struct sk_buff
+ if (addr_idx++ < addr_start_idx)
+ continue;
+
+- if (fill_addr(skb, pnd->netdev, addr << 2,
++ if (fill_addr(skb, pnd->netdev->ifindex, addr << 2,
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, RTM_NEWADDR) < 0)
+ goto out;
--- /dev/null
+From stable+bounces-266809-greg=kroah.com@vger.kernel.org Wed Jun 17 16:55:28 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2026 10:49:17 -0400
+Subject: phonet: Pass net and ifindex to phonet_address_notify().
+To: stable@vger.kernel.org
+Cc: Kuniyuki Iwashima <kuniyu@amazon.com>, Eric Dumazet <edumazet@google.com>, Paolo Abeni <pabeni@redhat.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260617144918.39042-2-sashal@kernel.org>
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 68ed5c38b512b734caf3da1f87db4a99fcfe3002 ]
+
+Currently, phonet_address_notify() fetches netns and ifindex from dev.
+
+Once addr_doit() is converted to RCU, phonet_address_notify() will be
+called outside of RCU due to GFP_KERNEL, and dev will be unavailable
+there.
+
+Let's pass net and ifindex to phonet_address_notify().
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: 71de0177b28d ("net: phonet: free phonet_device after RCU grace period")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/phonet/pn_dev.h | 2 +-
+ net/phonet/pn_dev.c | 10 +++++++---
+ net/phonet/pn_netlink.c | 12 ++++++------
+ 3 files changed, 14 insertions(+), 10 deletions(-)
+
+--- a/include/net/phonet/pn_dev.h
++++ b/include/net/phonet/pn_dev.h
+@@ -33,7 +33,7 @@ int phonet_address_add(struct net_device
+ int phonet_address_del(struct net_device *dev, u8 addr);
+ u8 phonet_address_get(struct net_device *dev, u8 addr);
+ int phonet_address_lookup(struct net *net, u8 addr);
+-void phonet_address_notify(int event, struct net_device *dev, u8 addr);
++void phonet_address_notify(struct net *net, int event, u32 ifindex, u8 addr);
+
+ int phonet_route_add(struct net_device *dev, u8 daddr);
+ int phonet_route_del(struct net_device *dev, u8 daddr);
+--- a/net/phonet/pn_dev.c
++++ b/net/phonet/pn_dev.c
+@@ -98,10 +98,13 @@ static void phonet_device_destroy(struct
+ mutex_unlock(&pndevs->lock);
+
+ if (pnd) {
++ struct net *net = dev_net(dev);
++ u32 ifindex = dev->ifindex;
+ u8 addr;
+
+ for_each_set_bit(addr, pnd->addrs, 64)
+- phonet_address_notify(RTM_DELADDR, dev, addr);
++ phonet_address_notify(net, RTM_DELADDR, ifindex, addr);
++
+ kfree(pnd);
+ }
+ }
+@@ -244,8 +247,9 @@ static int phonet_device_autoconf(struct
+ ret = phonet_address_add(dev, req.ifr_phonet_autoconf.device);
+ if (ret)
+ return ret;
+- phonet_address_notify(RTM_NEWADDR, dev,
+- req.ifr_phonet_autoconf.device);
++
++ phonet_address_notify(dev_net(dev), RTM_NEWADDR, dev->ifindex,
++ req.ifr_phonet_autoconf.device);
+ return 0;
+ }
+
+--- a/net/phonet/pn_netlink.c
++++ b/net/phonet/pn_netlink.c
+@@ -22,7 +22,7 @@
+ static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr,
+ u32 portid, u32 seq, int event);
+
+-void phonet_address_notify(int event, struct net_device *dev, u8 addr)
++void phonet_address_notify(struct net *net, int event, u32 ifindex, u8 addr)
+ {
+ struct sk_buff *skb;
+ int err = -ENOBUFS;
+@@ -32,17 +32,17 @@ void phonet_address_notify(int event, st
+ if (skb == NULL)
+ goto errout;
+
+- err = fill_addr(skb, dev->ifindex, addr, 0, 0, event);
++ err = fill_addr(skb, ifindex, addr, 0, 0, event);
+ if (err < 0) {
+ WARN_ON(err == -EMSGSIZE);
+ kfree_skb(skb);
+ goto errout;
+ }
+- rtnl_notify(skb, dev_net(dev), 0,
+- RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL);
++
++ rtnl_notify(skb, net, 0, RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL);
+ return;
+ errout:
+- rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err);
++ rtnl_set_sk_err(net, RTNLGRP_PHONET_IFADDR, err);
+ }
+
+ static const struct nla_policy ifa_phonet_policy[IFA_MAX+1] = {
+@@ -89,7 +89,7 @@ static int addr_doit(struct sk_buff *skb
+ else
+ err = phonet_address_del(dev, pnaddr);
+ if (!err)
+- phonet_address_notify(nlh->nlmsg_type, dev, pnaddr);
++ phonet_address_notify(net, nlh->nlmsg_type, ifm->ifa_index, pnaddr);
+ return err;
+ }
+
nfsd-fix-posix_acl-leak-on-setacl-decode-failure.patch
nfsd-check-get_user-return-when-reading-princhashlen.patch
nfsv4-pnfs-reject-zero-length-r_addr-in-nfs4_decode_mp_ds_addr.patch
+mptcp-fix-missing-wakeups-in-edge-scenarios.patch
+hv-utils-handle-and-propagate-errors-in-kvp_register.patch
+misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch
+misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch
+drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch
+phonet-pass-ifindex-to-fill_addr.patch
+phonet-pass-net-and-ifindex-to-phonet_address_notify.patch
+net-phonet-free-phonet_device-after-rcu-grace-period.patch
+fuse-re-lock-request-before-replacing-page-cache-folio.patch
+ksmbd-reject-non-valid-session-in-compound-request-branch.patch
+documentation-ioctl-number-extend-include-file-column-width.patch
+crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch
+crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch
+crypto-qat-remove-unused-character-device-and-ioctls.patch
+dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
