--- /dev/null
+From b983c56426383e4a06fa5970c4e33cee879b1482 Mon Sep 17 00:00:00 2001
+From: Farhad Alemi <farhad.alemi@berkeley.edu>
+Date: Mon, 6 Jul 2026 10:20:23 +0200
+Subject: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Farhad Alemi <farhad.alemi@berkeley.edu>
+
+commit b983c56426383e4a06fa5970c4e33cee879b1482 upstream.
+
+Creating a child cpuset where cpuset.mems is never set leads to a div/0
+when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a
+CPU hotplug event.
+
+Reproduction steps:
+ 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems)
+ 2) Move the task into the child cpuset
+ 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES
+ 4) unplug and hotplug a cpu
+ echo 0 > /sys/devices/system/cpu/cpu1/online
+ echo 1 > /sys/devices/system/cpu/cpu1/online
+ 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the
+ call to __nodes_fold()
+
+The cpuset code passes (cs->mems_allowed) which is not guaranteed to have
+nodes to the rebind routine. Use cs->effective_mems instead, which is
+guaranteed to have a non-empty nodemask once we reach that code path.
+
+Link: https://lore.kernel.org/all/CA+0ovCiEz6SP_sn3kN4Tb+_oC=eHMXy_Ffj=usV3wREdQrUtww@mail.gmail.com/
+Fixes: ae1c802382f7 ("cpuset: apply cs->effective_{cpus,mems}")
+Closes: https://lore.kernel.org/linux-mm/CA+0ovCgxbZkXa+OU8w3s84R3KNPNxxRfmsNR-udh+afQBbGNmw@mail.gmail.com/
+Suggested-by: Gregory Price <gourry@gourry.net>
+Suggested-by: Waiman Long <longman@redhat.com>
+Acked-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alistair Popple <apopple@nvidia.com>
+Cc: Byungchul Park <byungchul@sk.com>
+Cc: Gregory Price <gourry@gourry.net>
+Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
+Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Rakie Kim <rakie.kim@sk.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Zi Yan <ziy@nvidia.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Ridong Chen <ridong.chen@linux.dev>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: "Michal Koutný" <mkoutny@suse.com>
+Cc: <stable@vger.kernel.org>
+[ david: add a comment, slightly rephrase description ]
+Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cgroup/cpuset.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1768,7 +1768,12 @@ static void update_tasks_nodemask(struct
+
+ migrate = is_memory_migrate(cs);
+
+- mpol_rebind_mm(mm, &cs->mems_allowed);
++ /*
++ * For v1 we can have empty effective_mems, but we cannot
++ * attach any tasks (see cpuset_can_attach_check()). For v2,
++ * effective_mems is guaranteed to not be empty.
++ */
++ mpol_rebind_mm(mm, &cs->effective_mems);
+ if (migrate)
+ cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems);
+ else
--- /dev/null
+From bd910a7660d280595ef94cb6d193951d855d330f Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Thu, 9 Jul 2026 22:28:37 -0400
+Subject: drbd: reject data replies with an out-of-range payload size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit bd910a7660d280595ef94cb6d193951d855d330f upstream.
+
+recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an
+outstanding read request. The peer-supplied payload length reaches it as
+the signed int data_size, and two peer-controlled inputs can make it
+negative. With a negotiated data-integrity-alg the digest length is
+subtracted first, so a reply whose payload is smaller than the digest
+underflows data_size. With no integrity algorithm (the default) data_size
+is assigned from the unsigned h95/h100 wire length and drbdd() never
+bounds it for a payload-carrying command, so a length above INT_MAX casts
+it negative; this path needs no non-default feature. The bio receive loop
+then computes expect = min_t(int, data_size, bv_len), which is negative,
+and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX
+into the first mapped page.
+
+The sibling receive path read_in_block() is not affected: it uses an
+unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.
+Reject a data reply whose size is negative after the optional digest
+subtraction, covering both triggers.
+
+Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen
+bytes past a bio page in the receiver, corrupting kernel memory. A node
+that reads from its peer (a diskless node, or read-balancing to the peer)
+is exposed in the default configuration; data-integrity-alg is not
+required.
+
+Fixes: b411b3637fa7 ("The DRBD driver")
+Cc: stable@vger.kernel.org
+Assisted-by: Codex:gpt-5-5-xhigh
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Link: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/drbd/drbd_receiver.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -2025,6 +2025,11 @@ static int recv_dless_read(struct drbd_p
+ data_size -= digest_size;
+ }
+
++ if (data_size < 0) {
++ drbd_err(peer_device, "Invalid data reply size\n");
++ return -EIO;
++ }
++
+ /* optimistically update recv_cnt. if receiving fails below,
+ * we disconnect anyways, and counters will be reset. */
+ peer_device->device->recv_cnt += data_size>>9;
--- /dev/null
+From 2975324d164c552b028632f107b567302863b7f6 Mon Sep 17 00:00:00 2001
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Date: Thu, 2 Jul 2026 19:28:36 +0800
+Subject: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
+
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+
+commit 2975324d164c552b028632f107b567302863b7f6 upstream.
+
+Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in
+ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn
+object with kmem_cache_alloc(). The function then initializes many
+fields explicitly, but only resets in_seq.delta and out_seq.delta in the
+two struct ip_vs_seq members.
+
+That leaves init_seq and previous_delta uninitialized. This is normally
+harmless while the corresponding IP_VS_CONN_F_IN_SEQ or
+IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync
+message, however, ip_vs_proc_conn() preserves those flags from
+IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits
+IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with
+SEQ flags set but with the rest of in_seq/out_seq still containing stale
+slab data.
+
+When a packet for such a connection is later handled by an IPVS
+application helper, vs_fix_seq() and vs_fix_ack_seq() use
+previous_delta and init_seq to rewrite TCP sequence numbers. A malformed
+sync message can therefore make forwarded packets carry stale slab bytes
+in their TCP seq/ack numbers, and can also corrupt the forwarded TCP
+flow.
+
+Reset both struct ip_vs_seq members completely before publishing the
+connection. This matches the existing "reset struct ip_vs_seq" comment
+and keeps the sequence-adjustment gates inactive unless valid sequence
+data is installed later.
+
+Fixes: 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new")
+Cc: stable@vger.kernel.org
+Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Reported-by: Ao Wang <wangao@seu.edu.cn>
+Reported-by: Xuewei Feng <fengxw06@126.com>
+Reported-by: Qi Li <qli01@tsinghua.edu.cn>
+Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
+Assisted-by: Claude-Code:GLM-5.2
+Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -996,8 +996,8 @@ ip_vs_conn_new(const struct ip_vs_conn_p
+ cp->app = NULL;
+ cp->app_data = NULL;
+ /* reset struct ip_vs_seq */
+- cp->in_seq.delta = 0;
+- cp->out_seq.delta = 0;
++ memset(&cp->in_seq, 0, sizeof(cp->in_seq));
++ memset(&cp->out_seq, 0, sizeof(cp->out_seq));
+
+ atomic_inc(&ipvs->conn_count);
+ if (flags & IP_VS_CONN_F_NO_CPORT)
--- /dev/null
+From 2f75c0faa3361b28e36cc0512b3299e163e25789 Mon Sep 17 00:00:00 2001
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Date: Mon, 6 Jul 2026 18:16:24 +0800
+Subject: ipvs: use parsed transport offset in SCTP state lookup
+
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+
+commit 2f75c0faa3361b28e36cc0512b3299e163e25789 upstream.
+
+set_sctp_state() reads the SCTP chunk header again in order to drive the
+IPVS SCTP state table. For IPv6 it computes the offset with
+sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from
+ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped
+extension headers and found the real transport header.
+
+This makes the state machine read from the wrong offset for IPv6 SCTP
+packets that carry extension headers. For example, an INIT packet with an
+8-byte destination options header can be scheduled correctly by
+sctp_conn_schedule(), but set_sctp_state() reads the first byte of the
+SCTP verification tag as a DATA chunk type. The connection then moves
+from NONE to ESTABLISHED instead of INIT1, gets the longer established
+timeout, and updates the active/inactive destination counters
+incorrectly. This happens even though the SCTP handshake has not
+completed.
+
+Use the parsed transport offset passed down from ip_vs_set_state() for
+the SCTP chunk-header lookup. For IPv4 and IPv6 packets without
+extension headers this preserves the existing offset.
+
+Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/
+Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Reported-by: Ao Wang <wangao@seu.edu.cn>
+Reported-by: Xuewei Feng <fengxw06@126.com>
+Reported-by: Qi Li <qli01@tsinghua.edu.cn>
+Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
+Assisted-by: Claude Code:GLM-5.2
+Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
+@@ -372,20 +372,15 @@ static const char *sctp_state_name(int s
+
+ static inline void
+ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
+- int direction, const struct sk_buff *skb)
++ int direction, const struct sk_buff *skb,
++ unsigned int iph_len)
+ {
+ struct sctp_chunkhdr _sctpch, *sch;
+ unsigned char chunk_type;
+ int event, next_state;
+- int ihl, cofs;
+-
+-#ifdef CONFIG_IP_VS_IPV6
+- ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
+-#else
+- ihl = ip_hdrlen(skb);
+-#endif
++ int cofs;
+
+- cofs = ihl + sizeof(struct sctphdr);
++ cofs = iph_len + sizeof(struct sctphdr);
+ sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch);
+ if (sch == NULL)
+ return;
+@@ -472,7 +467,7 @@ sctp_state_transition(struct ip_vs_conn
+ unsigned int iph_len)
+ {
+ spin_lock_bh(&cp->lock);
+- set_sctp_state(pd, cp, direction, skb);
++ set_sctp_state(pd, cp, direction, skb, iph_len);
+ spin_unlock_bh(&cp->lock);
+ }
+
--- /dev/null
+From 660667cd406648bbaffbd5c0d897c2263a852f11 Mon Sep 17 00:00:00 2001
+From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
+Date: Tue, 30 Jun 2026 15:48:56 -0400
+Subject: llc: fix SAP refcount leak in llc_ui_autobind()
+
+From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
+
+commit 660667cd406648bbaffbd5c0d897c2263a852f11 upstream.
+
+llc_ui_autobind() opens a SAP after choosing a dynamic LSAP.
+llc_sap_open() returns a reference owned by the caller, and
+llc_sap_add_socket() takes a second reference for the socket's
+membership in the SAP hash tables.
+
+llc_ui_bind() drops the caller's reference after adding the socket,
+but llc_ui_autobind() keeps it. When the socket is closed,
+llc_sap_remove_socket() releases only the socket reference, leaving
+the SAP on llc_sap_list with sk_count == 0.
+
+This is user-visible because repeated autobind and close cycles can consume
+all dynamic SAP values and make later autobinds fail with -EUSERS.
+
+Drop the caller's reference after a successful autobind, matching
+llc_ui_bind()'s ownership model.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
+Link: https://patch.msgid.link/20260630194856.1036497-1-shuangpeng.kernel@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/llc/af_llc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -317,6 +317,7 @@ static int llc_ui_autobind(struct socket
+ /* assign new connection to its SAP */
+ llc_sap_add_socket(sap, sk);
+ sock_reset_flag(sk, SOCK_ZAPPED);
++ llc_sap_put(sap);
+ rc = 0;
+ out:
+ dev_put(dev);
--- /dev/null
+From 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 Mon Sep 17 00:00:00 2001
+From: Yousef Alhouseen <alhouseenyousef@gmail.com>
+Date: Wed, 1 Jul 2026 18:42:22 +0200
+Subject: mac802154: remove interfaces with RCU list deletion
+
+From: Yousef Alhouseen <alhouseenyousef@gmail.com>
+
+commit 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 upstream.
+
+Queue wake, stop, and disable paths walk local->interfaces under RCU.
+The bulk hardware teardown path removes entries with list_del(), so an
+asynchronous transmit completion can follow a poisoned list node in
+ieee802154_wake_queue().
+
+Use list_del_rcu() as in the single-interface removal path. The following
+unregister_netdevice() waits for in-flight RCU readers before freeing the
+netdevice, so no separate grace-period wait is needed.
+
+Fixes: 592dfbfc72f5 ("mac820154: move interface unregistration into iface")
+Reported-by: syzbot+36256deb69a588e9290e@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=36256deb69a588e9290e
+Cc: stable@vger.kernel.org
+Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20260701164222.9094-1-alhouseenyousef@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac802154/iface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac802154/iface.c
++++ b/net/mac802154/iface.c
+@@ -705,7 +705,7 @@ void ieee802154_remove_interfaces(struct
+
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+- list_del(&sdata->list);
++ list_del_rcu(&sdata->list);
+
+ unregister_netdevice(sdata->dev);
+ }
--- /dev/null
+From 2995ccec260caa9e85b3301a4aba1e66ed80ad74 Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Date: Tue, 23 Jun 2026 19:44:06 +0200
+Subject: s390/monwriter: Reject buffer reuse with different data length
+
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+
+commit 2995ccec260caa9e85b3301a4aba1e66ed80ad74 upstream.
+
+When data buffers are reused, e.g. for interval sample records, the
+first record determines the data length, and the size of the buffer for
+user copy. Current monwriter code does not check if the data length was
+changed for subsequent records, which also would never happen for valid
+user programs.
+
+However, a malicious user could change the data length, resulting in out
+of bounds user copy to the kernel buffer, and memory corruption. By
+default, the monwriter misc device is created with root-only permissions,
+so practical impact is typically low.
+
+Fix this by checking for changed data length and rejecting such records.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/char/monwriter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/s390/char/monwriter.c
++++ b/drivers/s390/char/monwriter.c
+@@ -126,6 +126,9 @@ static int monwrite_new_hdr(struct mon_p
+ kfree(monbuf->data);
+ kfree(monbuf);
+ monbuf = NULL;
++ } else if (monbuf->hdr.datalen != monhdr->datalen) {
++ /* Data with buffer reuse must not change its length */
++ return -EINVAL;
+ }
+ } else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) {
+ if (mon_buf_count >= mon_max_bufs)
orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch
ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch
hwmon-asus_atk0110-check-package-count-before-accessing-element.patch
+s390-monwriter-reject-buffer-reuse-with-different-data-length.patch
+mac802154-remove-interfaces-with-rcu-list-deletion.patch
+llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch
+ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch
+ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch
+drbd-reject-data-replies-with-an-out-of-range-payload-size.patch
+cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
