--- /dev/null
+From c268f949e219f9e179558e836f457f6c5fbec416 Mon Sep 17 00:00:00 2001
+From: Terry Bowman <terry.bowman@amd.com>
+Date: Fri, 5 Jun 2026 13:06:10 -0500
+Subject: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
+
+From: Terry Bowman <terry.bowman@amd.com>
+
+commit c268f949e219f9e179558e836f457f6c5fbec416 upstream.
+
+The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58
+bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing
+64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512,
+eight times the actual on-device size.
+
+header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the
+RAS capability iomap, overrunning the 88-byte mapping by 448 bytes.
+The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE
+(512) bytes from its source. For the CPER caller the source is
+struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a
+stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes
+of kernel stack into the trace event ring buffer where userspace can
+read it via tracefs.
+
+Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it,
+bringing all iomap readers into agreement on 16 dwords. Userspace tools
+such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32)
+header_log layout in the cxl_aer_uncorrectable_error trace event. Add
+CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event
+__array and its memcpy to preserve that ABI. Both callers now pass a
+zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only
+the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware;
+the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring
+buffer layout intact.
+
+[ dj: Replaced 64 with SZ_64 per RichardC ]
+
+Fixes: 36f257e3b0ba ("acpi/ghes, cxl/pci: Process CXL CPER Protocol Errors")
+Fixes: 2905cb5236cb ("cxl/pci: Add (hopeful) error handling support")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko
+Signed-off-by: Terry Bowman <terry.bowman@amd.com>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
+Reviewed-by: Richard Cheng <icheng@nvidia.com>
+Link: https://patch.msgid.link/20260605180610.2249458-1-terry.bowman@amd.com
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/core/ras.c | 27 ++++++++++++++++++++-------
+ drivers/cxl/core/trace.h | 24 ++++++++++++++++--------
+ drivers/cxl/cxl.h | 14 ++++++++++++--
+ 3 files changed, 48 insertions(+), 17 deletions(-)
+
+--- a/drivers/cxl/core/ras.c
++++ b/drivers/cxl/core/ras.c
+@@ -8,6 +8,10 @@
+ #include <cxlpci.h>
+ #include "trace.h"
+
++/* Check that UCE header definition is maintained to keep ABI intact */
++static_assert(CXL_HEADERLOG_TRACE_SIZE_U32 == 128,
++ "rasdaemon ABI requires exactly 128 u32s");
++
+ static void cxl_cper_trace_corr_port_prot_err(struct pci_dev *pdev,
+ struct cxl_ras_capability_regs ras_cap)
+ {
+@@ -19,6 +23,7 @@ static void cxl_cper_trace_corr_port_pro
+ static void cxl_cper_trace_uncorr_port_prot_err(struct pci_dev *pdev,
+ struct cxl_ras_capability_regs ras_cap)
+ {
++ u32 hl[CXL_HEADERLOG_TRACE_SIZE_U32] = {};
+ u32 status = ras_cap.uncor_status & ~ras_cap.uncor_mask;
+ u32 fe;
+
+@@ -28,8 +33,8 @@ static void cxl_cper_trace_uncorr_port_p
+ else
+ fe = status;
+
+- trace_cxl_port_aer_uncorrectable_error(&pdev->dev, status, fe,
+- ras_cap.header_log);
++ memcpy(hl, ras_cap.header_log, CXL_HEADERLOG_SIZE);
++ trace_cxl_port_aer_uncorrectable_error(&pdev->dev, status, fe, hl);
+ }
+
+ static void cxl_cper_trace_corr_prot_err(struct cxl_memdev *cxlmd,
+@@ -44,6 +49,7 @@ static void
+ cxl_cper_trace_uncorr_prot_err(struct cxl_memdev *cxlmd,
+ struct cxl_ras_capability_regs ras_cap)
+ {
++ u32 hl[CXL_HEADERLOG_TRACE_SIZE_U32] = {};
+ u32 status = ras_cap.uncor_status & ~ras_cap.uncor_mask;
+ u32 fe;
+
+@@ -53,8 +59,15 @@ cxl_cper_trace_uncorr_prot_err(struct cx
+ else
+ fe = status;
+
+- trace_cxl_aer_uncorrectable_error(cxlmd, status, fe,
+- ras_cap.header_log);
++ /*
++ * ras_cap.header_log[] holds CXL_HEADERLOG_SIZE_U32 (16) hardware
++ * dwords. Copy them into the front of a zero-filled
++ * CXL_HEADERLOG_TRACE_SIZE_U32 (128) u32 staging buffer so the trace
++ * event memcpy sees a full 512-byte source and the userspace ABI
++ * (rasdaemon) is preserved.
++ */
++ memcpy(hl, ras_cap.header_log, CXL_HEADERLOG_SIZE);
++ trace_cxl_aer_uncorrectable_error(cxlmd, status, fe, hl);
+ }
+
+ static int match_memdev_by_parent(struct device *dev, const void *uport)
+@@ -204,12 +217,12 @@ static void header_log_copy(void __iomem
+ {
+ void __iomem *addr;
+ u32 *log_addr;
+- int i, log_u32_size = CXL_HEADERLOG_SIZE / sizeof(u32);
++ int i;
+
+ addr = ras_base + CXL_RAS_HEADER_LOG_OFFSET;
+ log_addr = log;
+
+- for (i = 0; i < log_u32_size; i++) {
++ for (i = 0; i < CXL_HEADERLOG_SIZE_U32; i++) {
+ *log_addr = readl(addr);
+ log_addr++;
+ addr += sizeof(u32);
+@@ -222,7 +235,7 @@ static void header_log_copy(void __iomem
+ */
+ bool cxl_handle_ras(struct device *dev, void __iomem *ras_base)
+ {
+- u32 hl[CXL_HEADERLOG_SIZE_U32];
++ u32 hl[CXL_HEADERLOG_TRACE_SIZE_U32] = {};
+ void __iomem *addr;
+ u32 status;
+ u32 fe;
+--- a/drivers/cxl/core/trace.h
++++ b/drivers/cxl/core/trace.h
+@@ -56,7 +56,7 @@ TRACE_EVENT(cxl_port_aer_uncorrectable_e
+ __string(host, dev_name(dev->parent))
+ __field(u32, status)
+ __field(u32, first_error)
+- __array(u32, header_log, CXL_HEADERLOG_SIZE_U32)
++ __array(u32, header_log, CXL_HEADERLOG_TRACE_SIZE_U32)
+ ),
+ TP_fast_assign(
+ __assign_str(device);
+@@ -64,10 +64,14 @@ TRACE_EVENT(cxl_port_aer_uncorrectable_e
+ __entry->status = status;
+ __entry->first_error = fe;
+ /*
+- * Embed the 512B headerlog data for user app retrieval and
+- * parsing, but no need to print this in the trace buffer.
++ * Embed headerlog data for user app retrieval and parsing,
++ * but no need to print in the trace buffer. Only
++ * CXL_HEADERLOG_SIZE_U32 (16) dwords are hardware data;
++ * the remaining entries preserve the 512-byte ABI layout
++ * rasdaemon depends on and are zero-filled by the caller.
+ */
+- memcpy(__entry->header_log, hl, CXL_HEADERLOG_SIZE);
++ memcpy(__entry->header_log, hl,
++ CXL_HEADERLOG_TRACE_SIZE_U32 * sizeof(u32));
+ ),
+ TP_printk("device=%s host=%s status: '%s' first_error: '%s'",
+ __get_str(device), __get_str(host),
+@@ -85,7 +89,7 @@ TRACE_EVENT(cxl_aer_uncorrectable_error,
+ __field(u64, serial)
+ __field(u32, status)
+ __field(u32, first_error)
+- __array(u32, header_log, CXL_HEADERLOG_SIZE_U32)
++ __array(u32, header_log, CXL_HEADERLOG_TRACE_SIZE_U32)
+ ),
+ TP_fast_assign(
+ __assign_str(memdev);
+@@ -94,10 +98,14 @@ TRACE_EVENT(cxl_aer_uncorrectable_error,
+ __entry->status = status;
+ __entry->first_error = fe;
+ /*
+- * Embed the 512B headerlog data for user app retrieval and
+- * parsing, but no need to print this in the trace buffer.
++ * Embed headerlog data for user app retrieval and parsing,
++ * but no need to print in the trace buffer. Only
++ * CXL_HEADERLOG_SIZE_U32 (16) dwords are hardware data;
++ * the remaining entries preserve the 512-byte ABI layout
++ * rasdaemon depends on and are zero-filled by the caller.
+ */
+- memcpy(__entry->header_log, hl, CXL_HEADERLOG_SIZE);
++ memcpy(__entry->header_log, hl,
++ CXL_HEADERLOG_TRACE_SIZE_U32 * sizeof(u32));
+ ),
+ TP_printk("memdev=%s host=%s serial=%lld: status: '%s' first_error: '%s'",
+ __get_str(memdev), __get_str(host), __entry->serial,
+--- a/drivers/cxl/cxl.h
++++ b/drivers/cxl/cxl.h
+@@ -158,8 +158,18 @@ static inline int ways_to_eiw(unsigned i
+ #define CXL_RAS_CAP_CONTROL_FE_MASK GENMASK(5, 0)
+ #define CXL_RAS_HEADER_LOG_OFFSET 0x18
+ #define CXL_RAS_CAPABILITY_LENGTH 0x58
+-#define CXL_HEADERLOG_SIZE SZ_512
+-#define CXL_HEADERLOG_SIZE_U32 SZ_512 / sizeof(u32)
++#define CXL_HEADERLOG_SIZE SZ_64
++#define CXL_HEADERLOG_SIZE_U32 (CXL_HEADERLOG_SIZE / sizeof(u32))
++
++/*
++ * The RAS UCE trace event header array was originally sized at SZ_512/sizeof(u32)
++ * = 128 u32s due to a bug. Userspace tools (rasdaemon) have grown a dependency
++ * on that 512-byte layout. Keep the trace array at 128 u32s to preserve the
++ * ABI; only CXL_HEADERLOG_SIZE_U32 (16) dwords are valid hardware data, the
++ * remainder are zero-filled.
++ */
++#define CXL_HEADERLOG_TRACE_SIZE SZ_512
++#define CXL_HEADERLOG_TRACE_SIZE_U32 (CXL_HEADERLOG_TRACE_SIZE / sizeof(u32))
+
+ /* CXL 2.0 8.2.8.1 Device Capabilities Array Register */
+ #define CXLDEV_CAP_ARRAY_OFFSET 0x0
--- /dev/null
+From 289a2ca0c9b7eae74f93fc213b0b971669b8683d Mon Sep 17 00:00:00 2001
+From: Junrui Luo <moonafterrain@outlook.com>
+Date: Wed, 13 May 2026 17:28:40 +0800
+Subject: jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
+
+From: Junrui Luo <moonafterrain@outlook.com>
+
+commit 289a2ca0c9b7eae74f93fc213b0b971669b8683d upstream.
+
+jbd2_journal_initialize_fast_commit() validates journal capacity by
+checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS).
+Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds
+j_last the subtraction wraps to a large value, bypassing the bounds
+check.
+
+The resulting underflow corrupts j_last, j_fc_first, and j_free,
+leading to journal abort.
+
+Fix by checking num_fc_blks against j_last before the subtraction,
+returning -EFSCORRUPTED.
+
+Fixes: 6866d7b3f2bb ("ext4 / jbd2: add fast commit initialization")
+Reported-by: Yuhao Jiang <danisjiang@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
+Fixes: e029c5f27987 ("ext4: make num of fast commit blocks configurable")
+Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
+Fixes: e029c5f279872 ("ext4: make num of fast commit blocks configurable")
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/SYBPR01MB7881663C927DE9D7BBF4D1DFAF062@SYBPR01MB7881.ausprd01.prod.outlook.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/jbd2/journal.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2263,6 +2263,8 @@ jbd2_journal_initialize_fast_commit(jour
+ unsigned long long num_fc_blks;
+
+ num_fc_blks = jbd2_journal_get_num_fc_blks(sb);
++ if (num_fc_blks > journal->j_last)
++ return -EFSCORRUPTED;
+ if (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS)
+ return -ENOSPC;
+
--- /dev/null
+From f16a1513452edb532fec81e591c64c320866719c Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Thu, 14 May 2026 16:56:04 -0400
+Subject: lockd: Plug nlm_file leak when nlm_do_fopen() fails
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit f16a1513452edb532fec81e591c64c320866719c upstream.
+
+A client can repeatedly drive nlm_do_fopen() failures by presenting
+file handles that the underlying export rejects. After kzalloc_obj()
+succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not
+yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps
+to out_unlock, which releases nlm_file_mutex and returns without
+freeing the allocation, so each failure leaks one nlm_file.
+
+Route the failure through out_free so kfree() runs before the
+function returns.
+
+Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/lockd/svcsubs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/lockd/svcsubs.c
++++ b/fs/lockd/svcsubs.c
+@@ -165,7 +165,7 @@ nlm_lookup_file(struct svc_rqst *rqstp,
+
+ nfserr = nlm_do_fopen(rqstp, file, mode);
+ if (nfserr)
+- goto out_unlock;
++ goto out_free;
+
+ hlist_add_head(&file->f_list, &nlm_files[hash]);
+
--- /dev/null
+From 70a38f87bed7f0694fd07988b47b2db1e10d8df3 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Thu, 14 May 2026 16:56:06 -0400
+Subject: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 70a38f87bed7f0694fd07988b47b2db1e10d8df3 upstream.
+
+The cached-file path in nlm_lookup_file() reaches the found: label
+unconditionally, even when nlm_do_fopen() fails. At that label
+*result and file->f_count are updated before the error is returned.
+The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then
+bail out of their switch without copying *result back to their
+caller, so the proc handler's local nlm_file pointer remains NULL
+and the cleanup path skips nlm_release_file(). The f_count
+increment is never released, and nlm_traverse_files() can no
+longer reap the file because its refcount never returns to zero
+between requests.
+
+Short-circuit the cached path so neither *result nor f_count is
+touched when nlm_do_fopen() fails on a hashed nlm_file.
+
+Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/lockd/svcsubs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/lockd/svcsubs.c
++++ b/fs/lockd/svcsubs.c
+@@ -149,6 +149,8 @@ nlm_lookup_file(struct svc_rqst *rqstp,
+ mutex_lock(&file->f_mutex);
+ nfserr = nlm_do_fopen(rqstp, file, mode);
+ mutex_unlock(&file->f_mutex);
++ if (nfserr)
++ goto out_unlock;
+ goto found;
+ }
+ nlm_debug_print_fh("creating file for", &lock->fh);
--- /dev/null
+From 13fe4cd9ddd0aacb7777812328be525a11ea3fea Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Tue, 19 May 2026 11:20:12 +0530
+Subject: nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 13fe4cd9ddd0aacb7777812328be525a11ea3fea upstream.
+
+Memory allocated by btt_freelist_init(), btt_rtt_init(), and
+btt_maplocks_init() is not freed on some discover_arenas() error
+paths. This leaks memory when arena discovery fails.
+
+Add the missing kfree() calls to release the allocations before
+returning an error.
+
+[ as: commit message and log edits ]
+
+Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-1-592300fb7a43@cse.iitm.ac.in
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvdimm/btt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -919,6 +919,9 @@ static int discover_arenas(struct btt *b
+ return ret;
+
+ out:
++ kfree(arena->freelist);
++ kfree(arena->rtt);
++ kfree(arena->map_locks);
+ kfree(arena);
+ free_arenas(btt);
+ return ret;
--- /dev/null
+From 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Tue, 19 May 2026 11:20:13 +0530
+Subject: nvdimm/btt: Free arenas on btt_init() error paths
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 upstream.
+
+The arenas allocated by discover_arenas() or create_arenas() are not
+freed on some error paths in btt_init(). This leaks memory when BTT
+initialization fails.
+
+Call free_arenas() from the affected error paths to release the
+allocations.
+
+[ as: commit message and log edits ]
+
+Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-2-592300fb7a43@cse.iitm.ac.in
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvdimm/btt.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -1589,7 +1589,7 @@ static struct btt *btt_init(struct nd_bt
+ if (btt->init_state != INIT_READY && nd_region->ro) {
+ dev_warn(dev, "%s is read-only, unable to init btt metadata\n",
+ dev_name(&nd_region->dev));
+- return NULL;
++ goto err;
+ } else if (btt->init_state != INIT_READY) {
+ btt->num_arenas = (rawsize / ARENA_MAX_SIZE) +
+ ((rawsize % ARENA_MAX_SIZE) ? 1 : 0);
+@@ -1599,25 +1599,28 @@ static struct btt *btt_init(struct nd_bt
+ ret = create_arenas(btt);
+ if (ret) {
+ dev_info(dev, "init: create_arenas: %d\n", ret);
+- return NULL;
++ goto err;
+ }
+
+ ret = btt_meta_init(btt);
+ if (ret) {
+ dev_err(dev, "init: error in meta_init: %d\n", ret);
+- return NULL;
++ goto err;
+ }
+ }
+
+ ret = btt_blk_init(btt);
+ if (ret) {
+ dev_err(dev, "init: error in blk_init: %d\n", ret);
+- return NULL;
++ goto err;
+ }
+
+ btt_debugfs_init(btt);
+
+ return btt;
++err:
++ free_arenas(btt);
++ return NULL;
+ }
+
+ /**
--- /dev/null
+From c1492da3939c89372929e062d731f328f7693f1e Mon Sep 17 00:00:00 2001
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Date: Fri, 15 May 2026 15:40:07 +0300
+Subject: pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+commit c1492da3939c89372929e062d731f328f7693f1e upstream.
+
+The pinctrl and GPIO core code make exceptions for the -ENOTSUPP error
+code. One such example is gpio_set_config_with_argument_optional(),
+which returns success when gpio_set_config_with_argument() returns
+-ENOTSUPP, but reports failure for all other error codes.
+
+Returning -EOPNOTSUPP from the pinctrl driver on the unsupported pinctrl
+operation may lead to boot failures when pinctrl drivers implements
+struct gpio_chip::set_config, the system uses GPIO hogs, and the
+struct gpio_chip::set_config implementation returns -EOPNOTSUPP for the
+unsupported operations.
+
+Return -ENOTSUPP for the unsupported pinctrl operation.
+
+Fixes: 560c633d378a ("pinctrl: renesas: rzg2l: Drop oen_read and oen_write callbacks")
+Fixes: c4c4637eb57f ("pinctrl: renesas: Add RZ/G2L pin and gpio controller driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20260515124008.2947838-2-claudiu.beznea@kernel.org
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -1103,7 +1103,7 @@ static int rzg2l_read_oen(struct rzg2l_p
+ int bit;
+
+ if (!pctrl->data->pin_to_oen_bit)
+- return -EOPNOTSUPP;
++ return -ENOTSUPP;
+
+ bit = pctrl->data->pin_to_oen_bit(pctrl, _pin);
+ if (bit < 0)
+@@ -1145,7 +1145,7 @@ static int rzg2l_write_oen(struct rzg2l_
+ u8 val;
+
+ if (!pctrl->data->pin_to_oen_bit)
+- return -EOPNOTSUPP;
++ return -ENOTSUPP;
+
+ bit = pctrl->data->pin_to_oen_bit(pctrl, _pin);
+ if (bit < 0)
+@@ -1576,7 +1576,7 @@ static int rzg2l_pinctrl_pinconf_set(str
+ break;
+
+ default:
+- return -EOPNOTSUPP;
++ return -ENOTSUPP;
+ }
+ }
+
+@@ -1658,7 +1658,7 @@ static int rzg2l_pinctrl_pinconf_group_g
+
+ /* Check config matching between to pin */
+ if (i && prev_config != *config)
+- return -EOPNOTSUPP;
++ return -ENOTSUPP;
+
+ prev_config = *config;
+ }
cifs-invalidate-cfid-on-unlink-rename-rmdir.patch
mfd-tps6586x-fix-of-node-refcount.patch
backlight-ktd2801-enable-bl_core_suspendresume.patch
+cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch
+jbd2-fix-integer-underflow-in-jbd2_journal_initialize_fast_commit.patch
+nvdimm-btt-free-arenas-on-btt_init-error-paths.patch
+nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch
+pinctrl-renesas-rzg2l-use-enotsupp-instead-of-eopnotsupp.patch
+sunrpc-pin-svc_xprt-across-the-asynchronous-tls-handshake-callback.patch
+sunrpc-wait-for-in-flight-tls-handshake-callback-when-cancel-loses-race.patch
+sunrpc-harden-rq_procinfo-lifecycle-to-prevent-double-free.patch
+lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch
+lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch
+sunrpc-bound-check-xdr_buf_to_bvec-stores-before-writing.patch
--- /dev/null
+From 42f5b80dda6b86e424054baf1475df686c403d5c Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Tue, 19 May 2026 09:34:21 -0400
+Subject: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 42f5b80dda6b86e424054baf1475df686c403d5c upstream.
+
+xdr_buf_to_bvec() writes a bio_vec into the caller's array before
+testing whether that slot is in range, and the head branch performs
+the store with no check at all. When the caller's budget is exactly
+used up, the next store lands one element past the end of the array.
+The overflow label returns count - 1, which masks the surplus store
+but cannot undo it.
+
+rq_bvec, the array passed by nfsd_vfs_write(), is allocated to
+exactly rq_maxpages entries with no slack. The OOB store can land in
+adjacent slab memory; the bv_len and bv_offset fields written there
+are derived from client-supplied RPC payload sizes.
+
+Move the in-range check ahead of the store in the head, page-loop,
+and tail branches. With the check at the top of each sequence, count
+is incremented only after a successful store, so the overflow label
+can return count directly.
+
+Reported-by: Chris Mason <clm@meta.com>
+Fixes: 2eb2b9358181 ("SUNRPC: Convert svc_tcp_sendmsg to use bio_vecs directly")
+Cc: stable@vger.kernel.org
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/xdr.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -152,6 +152,8 @@ unsigned int xdr_buf_to_bvec(struct bio_
+ unsigned int count = 0;
+
+ if (head->iov_len) {
++ if (unlikely(count >= bvec_size))
++ goto bvec_overflow;
+ bvec_set_virt(bvec++, head->iov_base, head->iov_len);
+ ++count;
+ }
+@@ -165,25 +167,27 @@ unsigned int xdr_buf_to_bvec(struct bio_
+ while (remaining > 0) {
+ len = min_t(unsigned int, remaining,
+ PAGE_SIZE - offset);
++ if (unlikely(count >= bvec_size))
++ goto bvec_overflow;
+ bvec_set_page(bvec++, *pages++, len, offset);
+ remaining -= len;
+ offset = 0;
+- if (unlikely(++count > bvec_size))
+- goto bvec_overflow;
++ ++count;
+ }
+ }
+
+ if (tail->iov_len) {
+- bvec_set_virt(bvec, tail->iov_base, tail->iov_len);
+- if (unlikely(++count > bvec_size))
++ if (unlikely(count >= bvec_size))
+ goto bvec_overflow;
++ bvec_set_virt(bvec, tail->iov_base, tail->iov_len);
++ ++count;
+ }
+
+ return count;
+
+ bvec_overflow:
+ pr_warn_once("%s: bio_vec array overflow\n", __func__);
+- return count - 1;
++ return count;
+ }
+ EXPORT_SYMBOL_GPL(xdr_buf_to_bvec);
+
--- /dev/null
+From 18d216788bef06332ff8901670ecf1ed8f6eb614 Mon Sep 17 00:00:00 2001
+From: Luxiao Xu <rakukuip@gmail.com>
+Date: Thu, 21 May 2026 15:06:32 +0800
+Subject: sunrpc: harden rq_procinfo lifecycle to prevent double-free
+
+From: Luxiao Xu <rakukuip@gmail.com>
+
+commit 18d216788bef06332ff8901670ecf1ed8f6eb614 upstream.
+
+The svc_release_rqst() function executes the callback inside
+rqstp->rq_procinfo->pc_release. However, if a worker thread begins
+processing a new request and encounters an early error path (e.g.,
+unsupported protocol, short frame, or bad auth) before a valid
+rq_procinfo is installed, a stale release hook can be re-triggered
+against reused state from the previous RPC, resulting in a double-free
+or use-after-free vulnerability.
+
+Harden the lifecycle of rq_procinfo by:
+1. Ensuring svc_release_rqst() always clears rq_procinfo after the
+ optional pc_release() call, regardless of whether the hook exists.
+2. Explicitly clearing rq_procinfo at request entry in svc_process()
+ before any early decode or drop paths.
+3. Ensuring svc_process_bc() does the same at backchannel entry.
+
+This guarantees that error flows will not encounter a non-NULL stale
+rq_procinfo pointer when there is nothing to release.
+
+Fixes: d9adbb6e10bf ("sunrpc: delay pc_release callback until after the reply is sent")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Suggested-by: Chuck Lever <cel@kernel.org>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/svc.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1598,6 +1598,12 @@ static void svc_release_rqst(struct svc_
+
+ if (procp && procp->pc_release)
+ procp->pc_release(rqstp);
++
++ /*
++ * A subsequent svc_release_rqst() on this rqstp must not
++ * re-invoke pc_release against released state.
++ */
++ rqstp->rq_procinfo = NULL;
+ }
+
+ /**
+@@ -1616,6 +1622,9 @@ void svc_process(struct svc_rqst *rqstp)
+ svc_xprt_deferred_close(rqstp->rq_xprt);
+ #endif
+
++ /* Discard a stale release hook from a previous RPC. */
++ rqstp->rq_procinfo = NULL;
++
+ /*
+ * Setup response xdr_buf.
+ * Initially it has just one page
+@@ -1672,6 +1681,7 @@ void svc_process_bc(struct rpc_rqst *req
+ int proc_error;
+
+ /* Build the svc_rqst used by the common processing routine */
++ rqstp->rq_procinfo = NULL;
+ rqstp->rq_xid = req->rq_xid;
+ rqstp->rq_prot = req->rq_xprt->prot;
+ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
--- /dev/null
+From 4f988f3a2808fb659f3880c282041ff067acad78 Mon Sep 17 00:00:00 2001
+From: Chris Mason <clm@meta.com>
+Date: Fri, 22 May 2026 09:39:06 -0400
+Subject: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
+
+From: Chris Mason <clm@meta.com>
+
+commit 4f988f3a2808fb659f3880c282041ff067acad78 upstream.
+
+svc_tcp_handshake() stores the raw svc_xprt pointer in
+tls_handshake_args.ta_data and submits the request through
+tls_server_hello_x509(). The handshake core takes only
+sock_hold(req->hr_sk); nothing references the embedding struct
+svc_sock that svc_tcp_handshake_done() reaches via container_of().
+
+Two close races leave the in-flight callback writing through a freed
+svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards
+its return value: a false return means handshake_complete() has
+already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have
+finished, yet svc_sock_free() proceeds to kfree(svsk). The
+cancel-loser fall-through inside svc_tcp_handshake() itself produces
+the same window: when wait_for_completion_interruptible_timeout()
+returns <= 0 (timeout or signal) and tls_handshake_cancel() returns
+false, the function does not drain, returns, and svc_handle_xprt()
+calls svc_xprt_received(), which clears XPT_BUSY and can drop the
+last reference. A concurrent close then runs svc_sock_free() while
+svc_tcp_handshake_done() is still updating xpt_flags and walking
+svsk->sk_handshake_done.
+
+The corruption surfaces as set_bit/clear_bit RMW into the freed
+xpt_flags slab slot and as complete_all() walking and writing the
+freed wait_queue_head_t list embedded in sk_handshake_done -- a
+slab-corruption primitive, not a benign read. The path is reachable
+on any TLS-enabled NFS server whenever a connection close overlaps
+the tlshd downcall delivery window; the interruptible wait means
+signal delivery suffices, not just SVC_HANDSHAKE_TO expiry.
+
+Take svc_xprt_get(xprt) immediately before tls_server_hello_x509()
+so the in-flight callback owns its own reference. Release it on the
+two edges where the callback is guaranteed not to fire -- submission
+failure from tls_server_hello_x509() and a successful
+tls_handshake_cancel() -- and at the tail of
+svc_tcp_handshake_done() after complete_all().
+
+Fixes: b3cbf98e2fdf ("SUNRPC: Support TLS handshake in the server-side TCP socket code")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chris Mason <clm@meta.com>
+Assisted-by: kres (claude-opus-4-7)
+[cel: rewrote commit message to describe the actual change]
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/svcsock.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -471,6 +471,7 @@ static void svc_tcp_handshake_done(void
+ }
+ clear_bit(XPT_HANDSHAKE, &xprt->xpt_flags);
+ complete_all(&svsk->sk_handshake_done);
++ svc_xprt_put(xprt);
+ }
+
+ /**
+@@ -494,9 +495,13 @@ static void svc_tcp_handshake(struct svc
+ clear_bit(XPT_TLS_SESSION, &xprt->xpt_flags);
+ init_completion(&svsk->sk_handshake_done);
+
++ /* Pin the transport across the asynchronous handshake callback. */
++ svc_xprt_get(xprt);
++
+ ret = tls_server_hello_x509(&args, GFP_KERNEL);
+ if (ret) {
+ trace_svc_tls_not_started(xprt);
++ svc_xprt_put(xprt);
+ goto out_failed;
+ }
+
+@@ -505,6 +510,7 @@ static void svc_tcp_handshake(struct svc
+ if (ret <= 0) {
+ if (tls_handshake_cancel(sk)) {
+ trace_svc_tls_timed_out(xprt);
++ svc_xprt_put(xprt);
+ goto out_close;
+ }
+ }
--- /dev/null
+From d00e32f84ca1a77cb67a3fbf59f58dada95f5a21 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Fri, 22 May 2026 09:39:07 -0400
+Subject: sunrpc: wait for in-flight TLS handshake callback when cancel loses race
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit d00e32f84ca1a77cb67a3fbf59f58dada95f5a21 upstream.
+
+When wait_for_completion_interruptible_timeout() in
+svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
+tls_handshake_cancel() then returns false, handshake_complete() has
+won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and
+is about to invoke svc_tcp_handshake_done(), but the callback's
+side effects on xpt_flags and on svsk->sk_handshake_done have not
+yet committed.
+
+The current code reads xpt_flags immediately to decide whether the
+session succeeded. Two races result.
+
+If the callback has executed set_bit(XPT_TLS_SESSION) but not yet
+clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,
+enqueues the transport, and returns. svc_xprt_received() then
+clears XPT_BUSY, a worker thread picks the transport up, the
+dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,
+and xpo_handshake is invoked a second time. That svc_tcp_handshake()
+calls init_completion(&svsk->sk_handshake_done) while the original
+callback concurrently calls complete_all() on it, corrupting the
+embedded swait_queue.
+
+If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet
+entered svc_tcp_handshake_done(), svc_tcp_handshake() reads
+XPT_TLS_SESSION as clear and tears the connection down even though
+the handshake is about to succeed.
+
+Wait for the callback to commit before inspecting xpt_flags. The
+completion is guaranteed to fire because handshake_complete()
+invokes svc_tcp_handshake_done() unconditionally once it has set
+HANDSHAKE_F_REQ_COMPLETED.
+
+Fixes: b3cbf98e2fdf ("SUNRPC: Support TLS handshake in the server-side TCP socket code")
+Cc: stable@vger.kernel.org
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/svcsock.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -513,6 +513,10 @@ static void svc_tcp_handshake(struct svc
+ svc_xprt_put(xprt);
+ goto out_close;
+ }
++ /* Cancellation lost to handshake_complete(): the
++ * callback is in flight and should finish quickly.
++ */
++ wait_for_completion(&svsk->sk_handshake_done);
+ }
+
+ if (!test_bit(XPT_TLS_SESSION, &xprt->xpt_flags)) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
