--- /dev/null
+From ddb44baed257560f192b145ed36cf8c0a412de47 Mon Sep 17 00:00:00 2001
+From: Jhonraushan <raushan.jhon@gmail.com>
+Date: Wed, 15 Jul 2026 13:12:06 +0530
+Subject: accel/ivpu: Reject firmware log with size smaller than header
+
+From: Jhonraushan <raushan.jhon@gmail.com>
+
+commit ddb44baed257560f192b145ed36cf8c0a412de47 upstream.
+
+fw_log_from_bo() validates the tracing buffer header_size and that the
+log fits within the BO, but never checks that log->size is at least
+log->header_size. fw_log_print_buffer() then computes:
+
+ u32 data_size = log->size - log->header_size;
+
+which underflows to a near-U32_MAX value when firmware reports a log whose
+size is smaller than its header. That huge data_size defeats the
+log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu:
+Add bounds checks for firmware log indices"), so fw_log_print_lines() reads
+far past the small real data region of the BO. A size of 0 also makes
+fw_log_from_bo() advance the offset by 0, causing the callers to loop
+forever on the same header.
+
+Reject logs whose size is smaller than the header (which also rejects
+size == 0).
+
+Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jhonraushan <raushan.jhon@gmail.com>
+Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
+Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
+Link: https://patch.msgid.link/20260715074206.867712-1-raushan.jhon@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accel/ivpu/ivpu_fw_log.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/accel/ivpu/ivpu_fw_log.c
++++ b/drivers/accel/ivpu/ivpu_fw_log.c
+@@ -43,6 +43,10 @@ static int fw_log_from_bo(struct ivpu_de
+ ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log->header_size);
+ return -EINVAL;
+ }
++ if (log->size < log->header_size) {
++ ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
++ return -EINVAL;
++ }
+ if ((char *)log + log->size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo)) {
+ ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
+ return -EINVAL;
--- /dev/null
+From 691b052139c94ee6640ac39e0b764dd3867897c0 Mon Sep 17 00:00:00 2001
+From: Mike Waychison <mike@waychison.com>
+Date: Wed, 15 Jul 2026 15:29:50 -0400
+Subject: block: fix race in blk_time_get_ns() returning 0
+
+From: Mike Waychison <mike@waychison.com>
+
+commit 691b052139c94ee6640ac39e0b764dd3867897c0 upstream.
+
+blk_time_get_ns() populates the per-plug cached timestamp and then
+returns it by re-reading the field:
+
+ if (!plug->cur_ktime) {
+ plug->cur_ktime = ktime_get_ns();
+ current->flags |= PF_BLOCK_TS;
+ }
+ return plug->cur_ktime;
+
+This is problematic when the compiler emits the final
+"return plug->cur_ktime" as a reload from memory, after PF_BLOCK_TS has
+already been set.
+
+Since the cached timestamp is now invalidated from finish_task_switch()
+(fad156c2af22 "block: invalidate cached plug timestamp after task
+switch"), a task preempted between setting PF_BLOCK_TS and that reload
+has plug->cur_ktime zeroed by blk_plug_invalidate_ts() when it is
+scheduled back in. The reload then returns 0.
+
+A 0 handed back here is stored as a start timestamp -- e.g.
+blk_account_io_start() writes it to rq->start_time_ns -- and later
+subtracted from "now". blk_account_io_done() then adds (now - 0), i.e.
+roughly the system uptime, to the per-group nsecs[] counters. On an
+otherwise idle, healthy device this appears as sudden ~uptime-sized jumps
+in the diskstats time fields (write_ticks/discard_ticks/time_in_queue).
+
+The solution is to be explicit in our reads and writes to this field
+that is preemption volatile. We also add a barrier() to ensure that any
+setting of PF_BLOCK_TS is ordered to happen after the cur_ktime update.
+
+This issue was discovered using AI-assisted kprobes looking for paths
+that were leaking zeroed timestamps in a live system, based on the
+observation that we were sometimes seeing uptime-sized jumps in kernel
+exported counters. This was flagged by NodeDiskIOSaturation
+prometheus alerts that started firing on all hosts post 7.1.3 kernel
+upgrade, due to node-exporter now exporting a nonsensical
+node_disk_io_time_weighted_seconds_total.
+
+Fixes: fad156c2af22 ("block: invalidate cached plug timestamp after task switch")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mike Waychison <mike@waychison.com>
+Assisted-by: Claude:claude-opus-4.8
+Link: https://patch.msgid.link/20260715192950.2488921-1-mike@waychison.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk.h | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -698,6 +698,7 @@ static inline int req_ref_read(struct re
+ static inline u64 blk_time_get_ns(void)
+ {
+ struct blk_plug *plug = current->plug;
++ u64 now;
+
+ if (!plug || !in_task())
+ return ktime_get_ns();
+@@ -706,12 +707,18 @@ static inline u64 blk_time_get_ns(void)
+ * 0 could very well be a valid time, but rather than flag "this is
+ * a valid timestamp" separately, just accept that we'll do an extra
+ * ktime_get_ns() if we just happen to get 0 as the current time.
++ *
++ * cur_ktime can be zeroed by pre-emption the moment PF_BLOCK_TS is set.
+ */
+- if (!plug->cur_ktime) {
+- plug->cur_ktime = ktime_get_ns();
++ now = READ_ONCE(plug->cur_ktime);
++ if (!now) {
++ now = ktime_get_ns();
++ WRITE_ONCE(plug->cur_ktime, now);
++ /* Ensure PF_BLOCK_TS is set after cur_ktime. */
++ barrier();
+ current->flags |= PF_BLOCK_TS;
+ }
+- return plug->cur_ktime;
++ return now;
+ }
+
+ static inline ktime_t blk_time_get(void)
--- /dev/null
+From d5dc200c3a3f217de072af269dd90adddf90e48d Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Tue, 16 Jun 2026 10:30:56 +0200
+Subject: bpf: Add missing access_ok call to copy_user_syms
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+commit d5dc200c3a3f217de072af269dd90adddf90e48d upstream.
+
+As reported by sashiko we use __get_user without prior access_ok call on the
+user space pointer. Adding the missing call for the whole pointer array.
+
+Plus removing the err check in the error path, because it's not needed and
+also we can return -ENOMEM directly from the first kvmalloc_array fail path.
+
+Cc: stable@vger.kernel.org
+[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
+Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Closes: https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
+Link: https://lore.kernel.org/r/20260616083056.405652-1-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/bpf_trace.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2559,9 +2559,12 @@ static int copy_user_syms(struct user_sy
+ int err = -ENOMEM;
+ unsigned int i;
+
++ if (!access_ok(usyms, cnt * sizeof(*usyms)))
++ return -EFAULT;
++
+ syms = kvmalloc_array(cnt, sizeof(*syms), GFP_KERNEL);
+ if (!syms)
+- goto error;
++ return -ENOMEM;
+
+ buf = kvmalloc_array(cnt, KSYM_NAME_LEN, GFP_KERNEL);
+ if (!buf)
+@@ -2586,10 +2589,8 @@ static int copy_user_syms(struct user_sy
+ return 0;
+
+ error:
+- if (err) {
+- kvfree(syms);
+- kvfree(buf);
+- }
++ kvfree(syms);
++ kvfree(buf);
+ return err;
+ }
+
--- /dev/null
+From 9b51a6155d14389876916726430da30eabb1d4ed Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Fri, 26 Jun 2026 17:52:52 +0200
+Subject: bpf,fork: wipe ->bpf_storage before bailouts that access it
+
+From: Jann Horn <jannh@google.com>
+
+commit 9b51a6155d14389876916726430da30eabb1d4ed upstream.
+
+Currently, copy_process() can bail out to free_task() before p->bpf_storage
+has been initialized, with this call graph (shown here for the
+!CONFIG_MEMCG case):
+
+copy_process
+ dup_task_struct
+ arch_dup_task_struct
+ [copies the entire task_struct, including ->bpf_storage member]
+ [RLIMIT_NPROC check fails]
+ delayed_free_task
+ free_task
+ bpf_task_storage_free
+ rcu_dereference(task->bpf_storage)
+ bpf_local_storage_destroy
+
+In this case, the nascent task's ->bpf_storage member that
+bpf_local_storage_destroy() operates on is a plain copy of the parent's
+->bpf_storage pointer, not a real initialized pointer.
+This leads to badness (kernel hangs, UAF).
+
+This is reachable as long as the process calling fork() has been inserted
+into a task storage map.
+
+Cc: stable@kernel.org
+Fixes: a10787e6d58c ("bpf: Enable task local storage for tracing programs")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/fork.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1213,6 +1213,11 @@ static struct task_struct *dup_task_stru
+ tsk->mm_cid_active = 0;
+ tsk->migrate_from_cpu = -1;
+ #endif
++
++#ifdef CONFIG_BPF_SYSCALL
++ RCU_INIT_POINTER(tsk->bpf_storage, NULL);
++ tsk->bpf_ctx = NULL;
++#endif
+ return tsk;
+
+ free_stack:
+@@ -2368,10 +2373,6 @@ __latent_entropy struct task_struct *cop
+ p->sequential_io = 0;
+ p->sequential_io_avg = 0;
+ #endif
+-#ifdef CONFIG_BPF_SYSCALL
+- RCU_INIT_POINTER(p->bpf_storage, NULL);
+- p->bpf_ctx = NULL;
+-#endif
+
+ /* Perform scheduler related setup. Assign this task to a CPU. */
+ retval = sched_fork(clone_flags, p);
--- /dev/null
+From 519ddf194b158b91439319f6b977b8a465fda0fb Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Date: Mon, 2 Mar 2026 14:26:12 +0530
+Subject: bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+commit 519ddf194b158b91439319f6b977b8a465fda0fb upstream.
+
+All the callers of mhi_ep_handle_syserr() except mhi_ep_process_cmd_ring()
+are holding the 'state_lock' to avoid the race in setting the MHI state. So
+do the same in mhi_ep_process_cmd_ring() for sanity.
+
+Fixes: e827569062a8 ("bus: mhi: ep: Add support for processing command rings")
+Cc: stable@vger.kernel.org # 5.18
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260302085612.18725-1-manivannan.sadhasivam@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/ep/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bus/mhi/ep/main.c
++++ b/drivers/bus/mhi/ep/main.c
+@@ -232,7 +232,9 @@ static int mhi_ep_process_cmd_ring(struc
+ ret = mhi_ep_create_device(mhi_cntrl, ch_id);
+ if (ret) {
+ dev_err(dev, "Error creating device for channel (%u)\n", ch_id);
++ mutex_lock(&mhi_cntrl->state_lock);
+ mhi_ep_handle_syserr(mhi_cntrl);
++ mutex_unlock(&mhi_cntrl->state_lock);
+ return ret;
+ }
+ }
--- /dev/null
+From 7b2c3eabc4dafc062a25e10711154f2107526a78 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Tue, 14 Jul 2026 18:55:27 +0200
+Subject: can: bcm: add missing rcu list annotations and operations
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit 7b2c3eabc4dafc062a25e10711154f2107526a78 upstream.
+
+sashiko-bot remarked the missing use of list_add_rcu() in
+bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure
+when bcm_proc_show() traverses the bcm_op's under rcu_read_lock().
+
+To cover all initial settings of the bcm_op's the list_add_rcu() calls
+are moved to the end of the setup code.
+
+While at it, also fix the mirroring removal side: bcm_release() called
+bcm_remove_op() - which frees the op via call_rcu() - on ops that were
+still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first.
+Unlink each op with list_del_rcu() before handing it to bcm_remove_op(),
+matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op().
+
+Reported-by: sashiko-reviews@lists.linux.dev
+Closes: https://lore.kernel.org/linux-can/20260610094654.A1FFE1F00893@smtp.kernel.org/
+Fixes: dac5e6249159 ("can: bcm: add missing rcu read protection for procfs content")
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://patch.msgid.link/20260714-bcm_fixes-v15-5-562f7e3e42da@hartkopp.net
+Cc: stable@kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/bcm.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -260,7 +260,7 @@ static int bcm_proc_show(struct seq_file
+ (reduction == 100) ? "near " : "", reduction);
+ }
+
+- list_for_each_entry(op, &bo->tx_ops, list) {
++ list_for_each_entry_rcu(op, &bo->tx_ops, list) {
+
+ seq_printf(m, "tx_op: %03X %s ", op->can_id,
+ bcm_proc_getifname(net, ifname, op->ifindex));
+@@ -945,6 +945,7 @@ static int bcm_tx_setup(struct bcm_msg_h
+ struct bcm_sock *bo = bcm_sk(sk);
+ struct bcm_op *op;
+ struct canfd_frame *cf;
++ bool add_op_to_list = false;
+ unsigned int i;
+ int err;
+
+@@ -1087,8 +1088,7 @@ static int bcm_tx_setup(struct bcm_msg_h
+ hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC,
+ HRTIMER_MODE_REL_SOFT);
+
+- /* add this bcm_op to the list of the tx_ops */
+- list_add(&op->list, &bo->tx_ops);
++ add_op_to_list = true;
+
+ } /* if ((op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex))) */
+
+@@ -1110,6 +1110,10 @@ static int bcm_tx_setup(struct bcm_msg_h
+ op->flags |= TX_ANNOUNCE;
+ }
+
++ /* add this bcm_op to the list of the tx_ops? */
++ if (add_op_to_list)
++ list_add_rcu(&op->list, &bo->tx_ops);
++
+ if (op->flags & TX_ANNOUNCE)
+ bcm_can_tx(op);
+
+@@ -1253,9 +1257,6 @@ static int bcm_rx_setup(struct bcm_msg_h
+ HRTIMER_MODE_REL_SOFT);
+ op->thrtimer.function = bcm_rx_thr_handler;
+
+- /* add this bcm_op to the list of the rx_ops */
+- list_add(&op->list, &bo->rx_ops);
+-
+ /* call can_rx_register() */
+ do_rx_register = 1;
+
+@@ -1334,10 +1335,12 @@ static int bcm_rx_setup(struct bcm_msg_h
+ bcm_rx_handler, op, "bcm", sk);
+ if (err) {
+ /* this bcm rx op is broken -> remove it */
+- list_del_rcu(&op->list);
+ bcm_remove_op(op);
+ return err;
+ }
++
++ /* add this bcm_op to the list of the rx_ops */
++ list_add_rcu(&op->list, &bo->rx_ops);
+ }
+
+ return msg_head->nframes * op->cfsiz + MHSIZ;
+@@ -1667,8 +1670,10 @@ static int bcm_release(struct socket *so
+ remove_proc_entry(bo->procname, net->can.bcmproc_dir);
+ #endif /* CONFIG_PROC_FS */
+
+- list_for_each_entry_safe(op, next, &bo->tx_ops, list)
++ list_for_each_entry_safe(op, next, &bo->tx_ops, list) {
++ list_del_rcu(&op->list);
+ bcm_remove_op(op);
++ }
+
+ list_for_each_entry_safe(op, next, &bo->rx_ops, list) {
+ /*
+@@ -1699,8 +1704,10 @@ static int bcm_release(struct socket *so
+
+ synchronize_rcu();
+
+- list_for_each_entry_safe(op, next, &bo->rx_ops, list)
++ list_for_each_entry_safe(op, next, &bo->rx_ops, list) {
++ list_del_rcu(&op->list);
+ bcm_remove_op(op);
++ }
+
+ /* remove device reference */
+ if (bo->bound) {
--- /dev/null
+From 68973f9db76144825e4f35dfdc80fb8279eb2d57 Mon Sep 17 00:00:00 2001
+From: Lee Jones <lee@kernel.org>
+Date: Tue, 14 Jul 2026 18:55:23 +0200
+Subject: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
+
+From: Lee Jones <lee@kernel.org>
+
+commit 68973f9db76144825e4f35dfdc80fb8279eb2d57 upstream.
+
+Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
+synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op()
+with call_rcu() and introduced the RX_NO_AUTOTIMER flag.
+
+However, this flag check was omitted for thrtimer in the packet rx
+fast-path. During BCM RX operation teardown, a concurrent RCU reader
+(bcm_rx_handler) can race and re-arm thrtimer via
+bcm_rx_update_and_send() after call_rcu() has been scheduled. Once
+the RCU grace period elapses, bcm_op is freed. The subsequently
+firing thrtimer then dereferences the deallocated op, causing a UAF.
+
+Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not
+fully close the TOCTOU race and introduces latency for every CAN frame.
+Conversely, calling hrtimer_cancel() directly inside the RCU callback
+(softirq context) is fatal as hrtimer_cancel() can sleep, triggering
+a "scheduling while atomic" panic.
+
+Resolve this by deferring the timer cancellation and memory free to a
+dedicated unbound workqueue (bcm_wq). The RCU callback now queues a
+work item to bcm_wq, which safely cancels both timers and deallocates
+memory in sleepable process context. A dedicated workqueue is used to
+prevent system-wide WQ saturation and is cleanly flushed/destroyed
+on module unload to avoid rmmod page faults.
+
+Since the deferred work can now outlive the calling context by an
+unbounded amount, also take a reference on op->sk when it is assigned
+and drop it only once the deferred work has cancelled both timers, so a
+socket can no longer be freed out from under a still-armed timer whose
+callback (bcm_send_to_user()) dereferences op->sk.
+
+Fixes: f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()")
+Tested-by: Feng Xue <feng.xue@outlook.com>
+Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://patch.msgid.link/20260714-bcm_fixes-v15-1-562f7e3e42da@hartkopp.net
+Cc: stable@kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/bcm.c | 37 ++++++++++++++++++++++++++++++++++---
+ 1 file changed, 34 insertions(+), 3 deletions(-)
+
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -58,6 +58,7 @@
+ #include <linux/can/skb.h>
+ #include <linux/can/bcm.h>
+ #include <linux/slab.h>
++#include <linux/workqueue.h>
+ #include <linux/spinlock.h>
+ #include <net/sock.h>
+ #include <net/net_namespace.h>
+@@ -91,6 +92,8 @@ MODULE_ALIAS("can-proto-2");
+
+ #define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
+
++static struct workqueue_struct *bcm_wq;
++
+ /*
+ * easy access to the first 64 bit of can(fd)_frame payload. cp->data is
+ * 64 bit aligned so the offset has to be multiples of 8 which is ensured
+@@ -104,6 +107,7 @@ static inline u64 get_u64(const struct c
+ struct bcm_op {
+ struct list_head list;
+ struct rcu_head rcu;
++ struct work_struct work;
+ int ifindex;
+ canid_t can_id;
+ u32 flags;
+@@ -787,9 +791,12 @@ static struct bcm_op *bcm_find_op(struct
+ return NULL;
+ }
+
+-static void bcm_free_op_rcu(struct rcu_head *rcu_head)
++static void bcm_free_op_work(struct work_struct *work)
+ {
+- struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
++ struct bcm_op *op = container_of(work, struct bcm_op, work);
++
++ hrtimer_cancel(&op->timer);
++ hrtimer_cancel(&op->thrtimer);
+
+ if ((op->frames) && (op->frames != &op->sframe))
+ kfree(op->frames);
+@@ -797,9 +804,23 @@ static void bcm_free_op_rcu(struct rcu_h
+ if ((op->last_frames) && (op->last_frames != &op->last_sframe))
+ kfree(op->last_frames);
+
++ /* the last possible access to op->timer/op->thrtimer has now
++ * happened above via hrtimer_cancel() - op->sk is no longer
++ * needed by any pending timer callback, so drop our reference
++ */
++ sock_put(op->sk);
++
+ kfree(op);
+ }
+
++static void bcm_free_op_rcu(struct rcu_head *rcu_head)
++{
++ struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
++
++ INIT_WORK(&op->work, bcm_free_op_work);
++ queue_work(bcm_wq, &op->work);
++}
++
+ static void bcm_remove_op(struct bcm_op *op)
+ {
+ hrtimer_cancel(&op->timer);
+@@ -1054,6 +1075,7 @@ static int bcm_tx_setup(struct bcm_msg_h
+
+ /* bcm_can_tx / bcm_tx_timeout_handler needs this */
+ op->sk = sk;
++ sock_hold(sk);
+ op->ifindex = ifindex;
+
+ /* initialize uninitialized (kzalloc) structure */
+@@ -1216,6 +1238,7 @@ static int bcm_rx_setup(struct bcm_msg_h
+
+ /* bcm_can_tx / bcm_tx_timeout_handler needs this */
+ op->sk = sk;
++ sock_hold(sk);
+ op->ifindex = ifindex;
+
+ /* ifindex for timeout events w/o previous frame reception */
+@@ -1832,11 +1855,15 @@ static int __init bcm_module_init(void)
+ {
+ int err;
+
++ bcm_wq = alloc_workqueue("can-bcm-wq", WQ_UNBOUND, 0);
++ if (!bcm_wq)
++ return -ENOMEM;
++
+ pr_info("can: broadcast manager protocol\n");
+
+ err = register_pernet_subsys(&canbcm_pernet_ops);
+ if (err)
+- return err;
++ goto register_pernet_failed;
+
+ err = register_netdevice_notifier(&canbcm_notifier);
+ if (err)
+@@ -1854,6 +1881,8 @@ register_proto_failed:
+ unregister_netdevice_notifier(&canbcm_notifier);
+ register_notifier_failed:
+ unregister_pernet_subsys(&canbcm_pernet_ops);
++register_pernet_failed:
++ destroy_workqueue(bcm_wq);
+ return err;
+ }
+
+@@ -1862,6 +1891,8 @@ static void __exit bcm_module_exit(void)
+ can_proto_unregister(&bcm_can_proto);
+ unregister_netdevice_notifier(&canbcm_notifier);
+ unregister_pernet_subsys(&canbcm_pernet_ops);
++ rcu_barrier();
++ destroy_workqueue(bcm_wq);
+ }
+
+ module_init(bcm_module_init);
--- /dev/null
+From d9b091d9d22fee81ec53fb55d2032951993ceadb Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Tue, 14 Jul 2026 18:55:24 +0200
+Subject: can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit d9b091d9d22fee81ec53fb55d2032951993ceadb upstream.
+
+bcm_sendmsg() reads bo->ifindex and checks bo->bound before taking
+lock_sock(), while bcm_notify(), bcm_connect() and bcm_release() all
+mutate both fields under that same lock. Because the lockless reads
+and the locked writes are unordered with respect to each other, a
+racing bcm_notify() (device unregister) or bcm_connect() (concurrent
+bind on another thread sharing the socket) can make bcm_sendmsg()
+observe an inconsistent combination, e.g. a stale bound=1 together
+with the now-cleared ifindex=0, silently turning a socket bound to a
+specific CAN interface into one that also matches "any" interface.
+
+Keep the lockless bo->bound check purely as a fast-path reject, and
+move the ifindex read (and a bo->bound re-check) into the locked
+section, where every writer already serializes. This removes the
+possibility of observing the two fields torn against each other,
+rather than trying to fix it with more READ_ONCE()/WRITE_ONCE() pairs
+on two independently updated fields. Annotate the now-purely-lockless
+bo->bound accesses consistently across all its write sites.
+
+Also fix bcm_rx_setup() silently returning success when the target
+device disappears concurrently instead of reporting -ENODEV, so a
+broken RX op is no longer left registered as if it had succeeded.
+
+Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
+Reported-by: Ginger <ginger.jzllee@gmail.com>
+Closes: https://lore.kernel.org/linux-can/CAGp+u1aBK8QVjsvAxM2Ldzep4rEbsP9x_pV3At4g=h1kVEtyhA@mail.gmail.com/
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://patch.msgid.link/20260714-bcm_fixes-v15-2-562f7e3e42da@hartkopp.net
+Cc: stable@kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/bcm.c | 65 +++++++++++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 51 insertions(+), 14 deletions(-)
+
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -1321,6 +1321,11 @@ static int bcm_rx_setup(struct bcm_msg_h
+
+ op->rx_reg_dev = dev;
+ dev_put(dev);
++ } else {
++ /* the requested device is gone - do not
++ * silently succeed without registering
++ */
++ err = -ENODEV;
+ }
+
+ } else
+@@ -1390,12 +1395,13 @@ static int bcm_sendmsg(struct socket *so
+ {
+ struct sock *sk = sock->sk;
+ struct bcm_sock *bo = bcm_sk(sk);
+- int ifindex = bo->ifindex; /* default ifindex for this bcm_op */
++ int ifindex;
+ struct bcm_msg_head msg_head;
+ int cfsiz;
+ int ret; /* read bytes or error codes as return value */
+
+- if (!bo->bound)
++ /* Lockless fast-path check for bound socket */
++ if (!READ_ONCE(bo->bound))
+ return -ENOTCONN;
+
+ /* check for valid message length from userspace */
+@@ -1411,17 +1417,38 @@ static int bcm_sendmsg(struct socket *so
+ if ((size - MHSIZ) % cfsiz)
+ return -EINVAL;
+
++ lock_sock(sk);
++
++ /* Re-validate under the socket lock: a concurrent bcm_notify()
++ * may have unbound this socket (device removal) after the
++ * lockless fast-path check above. bo->ifindex is only ever
++ * mutated under lock_sock(), so reading it here - instead of
++ * before taking the lock - guarantees it can't be observed
++ * torn against bo->bound.
++ */
++ if (!bo->bound) {
++ ret = -ENOTCONN;
++ goto out_release;
++ }
++
++ /* default ifindex for this bcm_op */
++ ifindex = bo->ifindex;
++
+ /* check for alternative ifindex for this bcm_op */
+
+ if (!ifindex && msg->msg_name) {
+ /* no bound device as default => check msg_name */
+ DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
+
+- if (msg->msg_namelen < BCM_MIN_NAMELEN)
+- return -EINVAL;
++ if (msg->msg_namelen < BCM_MIN_NAMELEN) {
++ ret = -EINVAL;
++ goto out_release;
++ }
+
+- if (addr->can_family != AF_CAN)
+- return -EINVAL;
++ if (addr->can_family != AF_CAN) {
++ ret = -EINVAL;
++ goto out_release;
++ }
+
+ /* ifindex from sendto() */
+ ifindex = addr->can_ifindex;
+@@ -1430,20 +1457,21 @@ static int bcm_sendmsg(struct socket *so
+ struct net_device *dev;
+
+ dev = dev_get_by_index(sock_net(sk), ifindex);
+- if (!dev)
+- return -ENODEV;
++ if (!dev) {
++ ret = -ENODEV;
++ goto out_release;
++ }
+
+ if (dev->type != ARPHRD_CAN) {
+ dev_put(dev);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out_release;
+ }
+
+ dev_put(dev);
+ }
+ }
+
+- lock_sock(sk);
+-
+ switch (msg_head.opcode) {
+
+ case TX_SETUP:
+@@ -1493,6 +1521,7 @@ static int bcm_sendmsg(struct socket *so
+ break;
+ }
+
++out_release:
+ release_sock(sk);
+
+ return ret;
+@@ -1529,7 +1558,12 @@ static void bcm_notify(struct bcm_sock *
+ bo->bcm_proc_read = NULL;
+ }
+ #endif
+- bo->bound = 0;
++ /* Paired with the lockless fast-path check in
++ * bcm_sendmsg(); bo->ifindex itself is only ever
++ * accessed under lock_sock() so it needs no
++ * annotation.
++ */
++ WRITE_ONCE(bo->bound, 0);
+ bo->ifindex = 0;
+ notify_enodev = 1;
+ }
+@@ -1670,7 +1704,7 @@ static int bcm_release(struct socket *so
+
+ /* remove device reference */
+ if (bo->bound) {
+- bo->bound = 0;
++ WRITE_ONCE(bo->bound, 0);
+ bo->ifindex = 0;
+ }
+
+@@ -1739,7 +1773,10 @@ static int bcm_connect(struct socket *so
+ }
+ #endif /* CONFIG_PROC_FS */
+
+- bo->bound = 1;
++ /* bo->ifindex above is fully assigned before this point; pairs
++ * with the lockless fast-path check in bcm_sendmsg()
++ */
++ WRITE_ONCE(bo->bound, 1);
+
+ fail:
+ release_sock(sk);
--- /dev/null
+From c43122fef328a70045fe7621c06de6b2b8e19264 Mon Sep 17 00:00:00 2001
+From: Fan Wu <fanwu01@zju.edu.cn>
+Date: Thu, 9 Jul 2026 16:41:59 +0000
+Subject: can: esd_usb: kill anchored URBs before freeing netdevs
+
+From: Fan Wu <fanwu01@zju.edu.cn>
+
+commit c43122fef328a70045fe7621c06de6b2b8e19264 upstream.
+
+esd_usb_disconnect() frees each CAN netdev with free_candev() inside
+its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.
+The per-netdev private data (struct esd_usb_net_priv) is embedded in
+the net_device allocation returned by alloc_candev(), so once
+free_candev() has run, dev->nets[i] points to freed memory.
+unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the
+per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),
+clear active_tx_jobs, and reset priv->tx_contexts[].
+
+Reorder the teardown so the anchored URBs are killed before the netdevs
+are freed, matching other CAN/USB drivers in the same directory such as
+ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then
+free: unregister the netdevs first (which stops their TX queues), call
+unlink_all_urbs(dev) once, then free the netdevs.
+
+This issue was found by an in-house static analysis tool.
+
+Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
+Cc: stable@vger.kernel.org
+Assisted-by: Codex:gpt-5.5
+Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
+Link: https://patch.msgid.link/20260709164159.497640-1-fanwu01@zju.edu.cn
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/esd_usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/esd_usb.c
++++ b/drivers/net/can/usb/esd_usb.c
+@@ -1365,10 +1365,13 @@ static void esd_usb_disconnect(struct us
+ if (dev->nets[i]) {
+ netdev = dev->nets[i]->netdev;
+ unregister_netdev(netdev);
+- free_candev(netdev);
+ }
+ }
+ unlink_all_urbs(dev);
++ for (i = 0; i < dev->net_count; i++) {
++ if (dev->nets[i])
++ free_candev(dev->nets[i]->netdev);
++ }
+ kfree(dev);
+ }
+ }
--- /dev/null
+From 9b1a02e0d980ac6b0e36a90378f847062f81d7e4 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Sun, 12 Jul 2026 19:59:41 +0200
+Subject: can: isotp: use unconditional synchronize_rcu() in isotp_release()
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit 9b1a02e0d980ac6b0e36a90378f847062f81d7e4 upstream.
+
+isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()
+and clears so->bound without waiting for a grace period. isotp_release()
+uses so->bound to decide whether it needs to call synchronize_rcu()
+before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it
+skips that synchronize_rcu() and can cancel the timer while an
+in-flight isotp_rcv() is still executing and about to re-arm it via
+isotp_send_fc(), leading to a use-after-free timer callback on the
+freed socket.
+
+sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),
+therefore make isotp_release() always call synchronize_rcu() before
+cancelling the timers, regardless of so->bound. This still closes the
+original race (isotp_notify() clearing so->bound without waiting for
+in-flight isotp_rcv() callers before isotp_release() cancels the RX
+timer) without adding any RCU wait to the netdevice notifier path.
+
+Fixes: 14a4696bc311 ("can: isotp: isotp_release(): omit unintended hrtimer restart on socket release")
+Closes: https://lore.kernel.org/linux-can/20260707085210.6B6C01F000E9@smtp.kernel.org/
+Reported-by: Nico Yip <zdi-disclosures@trendmicro.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://patch.msgid.link/20260712-isotp-fixes-v10-1-793a1b1ce17f@hartkopp.net
+Cc: stable@kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/isotp.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/net/can/isotp.c
++++ b/net/can/isotp.c
+@@ -1217,11 +1217,18 @@ static int isotp_release(struct socket *
+ SINGLE_MASK(so->txid),
+ isotp_rcv_echo, sk);
+ dev_put(dev);
+- synchronize_rcu();
+ }
+ }
+ }
+
++ /* Always wait for a grace period before touching the timers below.
++ * A concurrent NETDEV_UNREGISTER may have already unregistered our
++ * filters and cleared so->bound in isotp_notify() without waiting
++ * for in-flight isotp_rcv() callers to finish, so this call must not
++ * be skipped just because so->bound is already 0 here.
++ */
++ synchronize_rcu();
++
+ hrtimer_cancel(&so->txfrtimer);
+ hrtimer_cancel(&so->txtimer);
+ hrtimer_cancel(&so->rxtimer);
--- /dev/null
+From 422f1d4f141eaa3a6e4199ceec86cc6b9bf26570 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 10 Jul 2026 18:32:49 +0200
+Subject: dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 422f1d4f141eaa3a6e4199ceec86cc6b9bf26570 upstream.
+
+block_to_sector converts a block number to a sector number and adds
+c->start to the result. It is inappropriate to use this function for
+converting the number of blocks to a number to sectors because c->start
+would be incorrectly added to the result.
+
+Luckily, the only target that uses dm_bufio_issue_discard is dm-ebs,
+which sets c->start to 0, so this bug is latent.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4-6
+Fixes: 6fbeb0048e6b ("dm bufio: implement discard")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-bufio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -2216,7 +2216,9 @@ int dm_bufio_issue_discard(struct dm_buf
+ struct dm_io_region io_reg = {
+ .bdev = c->bdev,
+ .sector = block_to_sector(c, block),
+- .count = block_to_sector(c, count),
++ .count = likely(c->sectors_per_block_bits >= 0) ?
++ count << c->sectors_per_block_bits :
++ count * (c->block_size >> SECTOR_SHIFT),
+ };
+
+ if (WARN_ON_ONCE(dm_bufio_in_request()))
--- /dev/null
+From a868196f03c2b19418ae3d2b69e195d668a271e5 Mon Sep 17 00:00:00 2001
+From: Samuel Moelius <sam.moelius@trailofbits.com>
+Date: Thu, 2 Jul 2026 00:27:35 +0000
+Subject: dm era: fix out-of-bounds memory access for non-zero start sector
+
+From: Samuel Moelius <sam.moelius@trailofbits.com>
+
+commit a868196f03c2b19418ae3d2b69e195d668a271e5 upstream.
+
+dm-era tracks writes in target-relative blocks, but era_map() calculates
+the writeset block before applying the target offset. Tables with a
+non-zero start sector can therefore pass an absolute mapped-device block
+to metadata_current_marked().
+
+If the absolute block is beyond the current writeset size,
+writeset_marked() tests past the end of the in-core bitset. KASAN reports
+this as a vmalloc-out-of-bounds access.
+
+Apply the target offset before calculating the era block so writeset
+lookups use the target-relative block number.
+
+Assisted-by: Codex:gpt-5.5-cyber-preview
+Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
+Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: eec40579d848 ("dm: add era target")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-era-target.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-era-target.c
++++ b/drivers/md/dm-era-target.c
+@@ -1231,6 +1231,7 @@ static dm_block_t get_block(struct era *
+ static void remap_to_origin(struct era *era, struct bio *bio)
+ {
+ bio_set_dev(bio, era->origin_dev->bdev);
++ bio->bi_iter.bi_sector = dm_target_offset(era->ti, bio->bi_iter.bi_sector);
+ }
+
+ /*
+@@ -1562,7 +1563,7 @@ static void era_dtr(struct dm_target *ti
+ static int era_map(struct dm_target *ti, struct bio *bio)
+ {
+ struct era *era = ti->private;
+- dm_block_t block = get_block(era, bio);
++ dm_block_t block;
+
+ /*
+ * All bios get remapped to the origin device. We do this now, but
+@@ -1570,6 +1571,7 @@ static int era_map(struct dm_target *ti,
+ * block is marked in this era.
+ */
+ remap_to_origin(era, bio);
++ block = get_block(era, bio);
+
+ /*
+ * REQ_PREFLUSH bios carry no data, so we're not interested in them.
--- /dev/null
+From edf025f083854f80032b73a1aad69a3c90db236f Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:24:09 +0200
+Subject: dm-integrity: don't increment hash_offset twice
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit edf025f083854f80032b73a1aad69a3c90db236f upstream.
+
+hash_offset is already incremented in the loop "for (i = 0; i < to_copy;
+i++, ts--)". Do not increment it again.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4.6
+Fixes: 84597a44a9d8 ("dm-integrity: dm integrity: add optional discard support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-integrity.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -1470,9 +1470,6 @@ thorough_test:
+ *metadata_offset = 0;
+ }
+
+- if (unlikely(!is_power_of_2(ic->tag_size)))
+- hash_offset = (hash_offset + to_copy) % ic->tag_size;
+-
+ total_size -= to_copy;
+ } while (unlikely(total_size));
+
--- /dev/null
+From 5a266764fadaff8b5c1fe37a186ebf9b09cb953e Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:25:39 +0200
+Subject: dm-integrity: fix a bug if the bio is out of limits
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 5a266764fadaff8b5c1fe37a186ebf9b09cb953e upstream.
+
+If dm_integrity_check_limits fails, the code would exit with
+DM_MAPIO_KILL. However, the range would be already locked at this point,
+and it wouldn't be unlocked, resulting in a deadlock. Let's move the
+limit check up, so that when it exits, no resources are leaked.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4.6
+Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-integrity.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -2423,6 +2423,9 @@ static int dm_integrity_map_inline(struc
+ if (unlikely((bio->bi_opf & REQ_PREFLUSH) != 0))
+ return DM_MAPIO_REMAPPED;
+
++ if (unlikely(!dm_integrity_check_limits(ic, bio->bi_iter.bi_sector, bio)))
++ return DM_MAPIO_KILL;
++
+ retry:
+ if (!dio->integrity_payload) {
+ unsigned digest_size, extra_size;
+@@ -2487,10 +2490,6 @@ skip_spinlock:
+
+ dio->bio_details.bi_iter = bio->bi_iter;
+
+- if (unlikely(!dm_integrity_check_limits(ic, bio->bi_iter.bi_sector, bio))) {
+- return DM_MAPIO_KILL;
+- }
+-
+ bio->bi_iter.bi_sector += ic->start + SB_SECTORS;
+
+ bip = bio_integrity_alloc(bio, GFP_NOIO, 1);
--- /dev/null
+From 76c6f845dc0c614304a6e6ee619b552f97cf24b3 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:31:47 +0200
+Subject: dm-ioctl: fix a possible overflow in list_version_get_info
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 76c6f845dc0c614304a6e6ee619b552f97cf24b3 upstream.
+
+sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the
+output buffer - info->vers->version[0], info->vers->version[1],
+info->vers->version[2] and info->vers->next. This can cause buffer
+overflow.
+
+Fix this buffer overflow by replacing "sizeof(tt->version)" with
+"sizeof(struct dm_target_versions)".
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4.6
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -683,7 +683,7 @@ static void list_version_get_info(struct
+ struct vers_iter *info = param;
+
+ /* Check space - it might have changed since the first iteration */
+- if ((char *)info->vers + sizeof(tt->version) + strlen(tt->name) + 1 > info->end) {
++ if ((char *)info->vers + sizeof(struct dm_target_versions) + strlen(tt->name) + 1 > info->end) {
+ info->flags = DM_BUFFER_FULL_FLAG;
+ return;
+ }
--- /dev/null
+From 9743132a41f4d9d0e54c5f2adcb821b04796bab1 Mon Sep 17 00:00:00 2001
+From: Benjamin Marzinski <bmarzins@redhat.com>
+Date: Thu, 2 Jul 2026 21:43:39 -0400
+Subject: dm-log: fix a bitset_size overflow on 32bit machines
+
+From: Benjamin Marzinski <bmarzins@redhat.com>
+
+commit 9743132a41f4d9d0e54c5f2adcb821b04796bab1 upstream.
+
+Commit c20e36b7631d ("dm log: fix out-of-bounds write due to
+region_count overflow") made sure that region_count could fit in an
+unsigned int. But the bitmap memory isn't allocated based on
+region_count. It uses bitset_size (a size_t variable). The first step of
+calculating bitset_size is to set it to region_count, rounded up to a
+multiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG
+smaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit
+architecture, this will make bitset_size wrap around to 0 and fail,
+despite region_count being valid.
+
+Since bitset_size gets divided by 8, it can hold any valid region_count.
+It just needs a special case to handle the rollover. If it is 0, the
+value rolled over, and bitset size should be set to the number of bytes
+needed to hold 2^32 bits.
+
+Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Fixes: c20e36b7631d ("dm log: fix out-of-bounds write due to region_count overflow")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-log.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/dm-log.c
++++ b/drivers/md/dm-log.c
+@@ -425,6 +425,9 @@ static int create_log_context(struct dm_
+ */
+ bitset_size = dm_round_up(region_count, BITS_PER_LONG);
+ bitset_size >>= BYTE_SHIFT;
++ /* Handle dm_round_up rollover on 32-bit systems */
++ if (!bitset_size)
++ bitset_size = 1UL << (BITS_PER_LONG - BYTE_SHIFT);
+
+ lc->bitset_uint32_count = bitset_size / sizeof(*lc->clean_bits);
+
--- /dev/null
+From 386df1a57b631c456d14f857cb0c0c2e11c16bef Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 10 Jul 2026 18:37:15 +0200
+Subject: dm-stats: fix dm_jiffies_to_msec64
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 386df1a57b631c456d14f857cb0c0c2e11c16bef upstream.
+
+There were wrong calculations in dm_jiffies_to_msec64 that produced
+incorrect output when HZ was different from 1000. This commit fixes them.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4-6
+Fixes: fd2ed4d25270 ("dm: add statistics support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-stats.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-stats.c
++++ b/drivers/md/dm-stats.c
+@@ -842,10 +842,10 @@ static unsigned long long dm_jiffies_to_
+ result = jiffies_to_msecs(j & 0x3fffff);
+ if (j >= 1 << 22) {
+ mult = jiffies_to_msecs(1 << 22);
+- result += (unsigned long long)mult * (unsigned long long)jiffies_to_msecs((j >> 22) & 0x3fffff);
++ result += (unsigned long long)mult * ((j >> 22) & 0x3fffff);
+ }
+ if (j >= 1ULL << 44)
+- result += (unsigned long long)mult * (unsigned long long)mult * (unsigned long long)jiffies_to_msecs(j >> 44);
++ result += (unsigned long long)mult * (unsigned long long)(1 << 22) * (j >> 44);
+
+ return result;
+ }
--- /dev/null
+From 1917eb2db750ecbdf710f79a8042eaa545a063c7 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 10 Jul 2026 18:35:49 +0200
+Subject: dm-stats: fix merge accounting
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 1917eb2db750ecbdf710f79a8042eaa545a063c7 upstream.
+
+There were wrong parentheses when setting stats_aux->merged, so that
+merging was never properly accounted. This commit fixes it.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4-6
+Fixes: fd2ed4d25270 ("dm: add statistics support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-stats.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm-stats.c
++++ b/drivers/md/dm-stats.c
+@@ -692,10 +692,8 @@ void dm_stats_account_io(struct dm_stats
+ */
+ last = raw_cpu_ptr(stats->last);
+ stats_aux->merged =
+- (bi_sector == (READ_ONCE(last->last_sector) &&
+- ((bi_rw == WRITE) ==
+- (READ_ONCE(last->last_rw) == WRITE))
+- ));
++ bi_sector == READ_ONCE(last->last_sector) &&
++ (bi_rw == WRITE) == (READ_ONCE(last->last_rw) == WRITE);
+ WRITE_ONCE(last->last_sector, end_sector);
+ WRITE_ONCE(last->last_rw, bi_rw);
+ } else
--- /dev/null
+From 5bcd4d3058ebaf46ad2e163829d87dd4870c7a45 Mon Sep 17 00:00:00 2001
+From: Ming-Hung Tsai <mtsai@redhat.com>
+Date: Tue, 30 Jun 2026 20:17:44 +0800
+Subject: dm thin metadata: fix metadata snapshot consistency on commit failure
+
+From: Ming-Hung Tsai <mtsai@redhat.com>
+
+commit 5bcd4d3058ebaf46ad2e163829d87dd4870c7a45 upstream.
+
+__reserve_metadata_snap() and __release_metadata_snap() modify the
+superblock's held_root directly in the block_manager's buffer. If the
+subsequent metadata commit fails, the held_root gets flushed to disk
+through the abort_transaction path, resulting in inconsistent metadata.
+
+Reproducer 1: __reserve_metadata_snap()
+
+1. Create a 2 MiB metadata device and make the region after the 14th
+ block inaccessible, to trigger metadata commit failure in the
+ subsequent reserve_metadata_snap operation. The 14th block will be
+ the shadow destination for the index block.
+
+dmsetup create tmeta --table "0 112 linear /dev/sdc 0
+112 3984 error"
+
+2. Create a 16 MiB thin-pool
+
+dmsetup create tdata --table "0 32768 zero"
+dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1
+dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \
+/dev/mapper/tdata 128 0 1 skip_block_zeroing"
+
+3. Take a metadata snapshot to trigger metadata commit failure and
+ transaction abort. However, the held_root is written to disk,
+ breaking metadata consistency.
+
+dmsetup message tpool 0 "reserve_metadata_snap"
+
+thin_check v1.2.2 result:
+
+Bad reference count for metadata block 6. Expected 2, but space map contains 1.
+Bad reference count for metadata block 7. Expected 2, but space map contains 1.
+Bad reference count for metadata block 13. Expected 1, but space map contains 0.
+
+Reproducer 2: __release_metadata_snap()
+
+1. Create a 2 MiB metadata device and make the region after the 16th
+ block inaccessible, to trigger metadata commit failure in the
+ subsequent release_metadata_snap operation. The 16th block will be
+ the shadow destination for the index block.
+
+dmsetup create tmeta --table "0 128 linear /dev/sdc 0
+128 3968 error"
+
+2. Create a 16 MiB thin-pool
+
+dmsetup create tdata --table "0 32768 zero"
+dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1
+dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \
+/dev/mapper/tdata 128 0 1 skip_block_zeroing"
+
+3. Reserve then release the metadata snapshot, to trigger metadata
+ commit failure and transaction abort. The held_root gets removed
+ from the on-disk superblock, causing inconsistent metadata.
+
+dmsetup message tpool 0 "reserve_metadata_snap"
+dmsetup message tpool 0 "release_metadata_snap"
+
+thin_check v1.2.2 result:
+
+Bad reference count for metadata block 6. Expected 1, but space map contains 2.
+Bad reference count for metadata block 7. Expected 1, but space map contains 2.
+1 metadata blocks have leaked.
+
+Fix by deferring the held_root update to commit time.
+
+Additionally, move the existing-snapshot check in __reserve_metadata_snap
+before the shadow operation to avoid unnecessary work. In
+__release_metadata_snap, clear pmd->held_root before btree deletion so
+partial failure leaks blocks rather than leaving a stale reference, and
+unlock the snapshot block before decrementing its refcount.
+
+Fixes: 991d9fa02da0 ("dm: add thin provisioning target")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ming-Hung Tsai <mtsai@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-thin-metadata.c | 63 ++++++++++++------------------------------
+ 1 file changed, 18 insertions(+), 45 deletions(-)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -186,6 +186,7 @@ struct dm_pool_metadata {
+ uint32_t time;
+ dm_block_t root;
+ dm_block_t details_root;
++ dm_block_t held_root;
+ struct list_head thin_devices;
+ uint64_t trans_id;
+ unsigned long flags;
+@@ -748,6 +749,7 @@ static int __open_metadata(struct dm_poo
+ */
+ pmd->root = le64_to_cpu(disk_super->data_mapping_root);
+ pmd->details_root = le64_to_cpu(disk_super->device_details_root);
++ pmd->held_root = le64_to_cpu(disk_super->held_root);
+
+ __setup_btree_details(pmd);
+ dm_bm_unlock(sblock);
+@@ -838,6 +840,7 @@ static int __begin_transaction(struct dm
+ pmd->time = le32_to_cpu(disk_super->time);
+ pmd->root = le64_to_cpu(disk_super->data_mapping_root);
+ pmd->details_root = le64_to_cpu(disk_super->device_details_root);
++ pmd->held_root = le64_to_cpu(disk_super->held_root);
+ pmd->trans_id = le64_to_cpu(disk_super->trans_id);
+ pmd->flags = le32_to_cpu(disk_super->flags);
+ pmd->data_block_size = le32_to_cpu(disk_super->data_block_size);
+@@ -928,6 +931,7 @@ static int __commit_transaction(struct d
+ disk_super->time = cpu_to_le32(pmd->time);
+ disk_super->data_mapping_root = cpu_to_le64(pmd->root);
+ disk_super->device_details_root = cpu_to_le64(pmd->details_root);
++ disk_super->held_root = cpu_to_le64(pmd->held_root);
+ disk_super->trans_id = cpu_to_le64(pmd->trans_id);
+ disk_super->flags = cpu_to_le32(pmd->flags);
+
+@@ -1333,9 +1337,14 @@ static int __reserve_metadata_snap(struc
+ {
+ int r, inc;
+ struct thin_disk_superblock *disk_super;
+- struct dm_block *copy, *sblock;
++ struct dm_block *copy;
+ dm_block_t held_root;
+
++ if (pmd->held_root) {
++ DMWARN("Pool metadata snapshot already exists: release this before taking another.");
++ return -EBUSY;
++ }
++
+ /*
+ * We commit to ensure the btree roots which we increment in a
+ * moment are up to date.
+@@ -1363,14 +1372,6 @@ static int __reserve_metadata_snap(struc
+ held_root = dm_block_location(copy);
+ disk_super = dm_block_data(copy);
+
+- if (le64_to_cpu(disk_super->held_root)) {
+- DMWARN("Pool metadata snapshot already exists: release this before taking another.");
+-
+- dm_tm_dec(pmd->tm, held_root);
+- dm_tm_unlock(pmd->tm, copy);
+- return -EBUSY;
+- }
+-
+ /*
+ * Wipe the spacemap since we're not publishing this.
+ */
+@@ -1386,18 +1387,8 @@ static int __reserve_metadata_snap(struc
+ dm_tm_inc(pmd->tm, le64_to_cpu(disk_super->device_details_root));
+ dm_tm_unlock(pmd->tm, copy);
+
+- /*
+- * Write the held root into the superblock.
+- */
+- r = superblock_lock(pmd, &sblock);
+- if (r) {
+- dm_tm_dec(pmd->tm, held_root);
+- return r;
+- }
++ pmd->held_root = held_root;
+
+- disk_super = dm_block_data(sblock);
+- disk_super->held_root = cpu_to_le64(held_root);
+- dm_bm_unlock(sblock);
+ return 0;
+ }
+
+@@ -1417,18 +1408,10 @@ static int __release_metadata_snap(struc
+ {
+ int r;
+ struct thin_disk_superblock *disk_super;
+- struct dm_block *sblock, *copy;
++ struct dm_block *copy;
+ dm_block_t held_root;
+
+- r = superblock_lock(pmd, &sblock);
+- if (r)
+- return r;
+-
+- disk_super = dm_block_data(sblock);
+- held_root = le64_to_cpu(disk_super->held_root);
+- disk_super->held_root = cpu_to_le64(0);
+-
+- dm_bm_unlock(sblock);
++ held_root = pmd->held_root;
+
+ if (!held_root) {
+ DMWARN("No pool metadata snapshot found: nothing to release.");
+@@ -1439,13 +1422,15 @@ static int __release_metadata_snap(struc
+ if (r)
+ return r;
+
++ pmd->held_root = 0;
++
+ disk_super = dm_block_data(copy);
+ dm_btree_del(&pmd->info, le64_to_cpu(disk_super->data_mapping_root));
+ dm_btree_del(&pmd->details_info, le64_to_cpu(disk_super->device_details_root));
+- dm_sm_dec_block(pmd->metadata_sm, held_root);
+-
+ dm_tm_unlock(pmd->tm, copy);
+
++ dm_sm_dec_block(pmd->metadata_sm, held_root);
++
+ return 0;
+ }
+
+@@ -1464,19 +1449,7 @@ int dm_pool_release_metadata_snap(struct
+ static int __get_metadata_snap(struct dm_pool_metadata *pmd,
+ dm_block_t *result)
+ {
+- int r;
+- struct thin_disk_superblock *disk_super;
+- struct dm_block *sblock;
+-
+- r = dm_bm_read_lock(pmd->bm, THIN_SUPERBLOCK_LOCATION,
+- &sb_validator, &sblock);
+- if (r)
+- return r;
+-
+- disk_super = dm_block_data(sblock);
+- *result = le64_to_cpu(disk_super->held_root);
+-
+- dm_bm_unlock(sblock);
++ *result = pmd->held_root;
+
+ return 0;
+ }
--- /dev/null
+From 4b22d0801fadfcae2e106e6ba32e49439c7c7ebf Mon Sep 17 00:00:00 2001
+From: Genjian Zhang <zhanggenjian@kylinos.cn>
+Date: Sat, 11 Jul 2026 18:05:26 +0800
+Subject: dm thin metadata: fix superblock refcount leak on snapshot shadow failure
+
+From: Genjian Zhang <zhanggenjian@kylinos.cn>
+
+commit 4b22d0801fadfcae2e106e6ba32e49439c7c7ebf upstream.
+
+__reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the
+metadata space map before shadowing it. When dm_tm_shadow_block()
+fails, a reference is leaked in the metadata space map.
+
+Fix by adding the missing dm_sm_dec_block().
+
+Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Fixes: cc8394d86f04 ("dm thin: provide userspace access to pool metadata")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-thin-metadata.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -1353,8 +1353,10 @@ static int __reserve_metadata_snap(struc
+ dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
+ r = dm_tm_shadow_block(pmd->tm, THIN_SUPERBLOCK_LOCATION,
+ &sb_validator, ©, &inc);
+- if (r)
++ if (r) {
++ dm_sm_dec_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
+ return r;
++ }
+
+ BUG_ON(!inc);
+
--- /dev/null
+From 72e9ec2fe32b00994f41719cf77423fca67d48b2 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:33:16 +0200
+Subject: dm-verity: avoid double increment of &use_bh_wq_enabled
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 72e9ec2fe32b00994f41719cf77423fca67d48b2 upstream.
+
+verity_parse_opt_args is called twice, first with the only_modifier_opts,
+first with only_modifier_opts == true and then with only_modifier_opts ==
+false. Thus, the static branch &use_bh_wq_enabled was incremented twice
+and the destructor verity_dtr would only decrement it once.
+
+Fix tihs bug by only incrementing it on the first call, on the second
+call, when v->use_bh_wq is true, do nothing.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4-6
+Cc: stable@vger.kernel.org
+Fixes: df326e7a0699 ("dm verity: allow optional args to alter primary args handling")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-verity-target.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -1238,6 +1238,8 @@ static int verity_parse_opt_args(struct
+ continue;
+
+ } else if (!strcasecmp(arg_name, DM_VERITY_OPT_TASKLET_VERIFY)) {
++ if (v->use_bh_wq)
++ continue;
+ v->use_bh_wq = true;
+ static_branch_inc(&use_bh_wq_enabled);
+ continue;
--- /dev/null
+From e72b793ae440f6900fb17a4b8518c707b5cd3e17 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:35:06 +0200
+Subject: dm-verity: fix a possible NULL pointer dereference
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit e72b793ae440f6900fb17a4b8518c707b5cd3e17 upstream.
+
+Fix a possible NULL pointer dereference dm_verity_loadpin_is_bdev_trusted
+if the device has no table.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4-6
+Fixes: b6c1c5745ccc ("dm: Add verity helpers for LoadPin")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-verity-loadpin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-verity-loadpin.c
++++ b/drivers/md/dm-verity-loadpin.c
+@@ -70,7 +70,7 @@ bool dm_verity_loadpin_is_bdev_trusted(s
+
+ table = dm_get_live_table(md, &srcu_idx);
+
+- if (table->num_targets != 1)
++ if (!table || table->num_targets != 1)
+ goto out;
+
+ ti = dm_table_get_target(table, 0);
--- /dev/null
+From 88dd117c92a142253fb7a17e791773902b3babc6 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:36:01 +0200
+Subject: dm-verity: increase sprintf buffer size
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 88dd117c92a142253fb7a17e791773902b3babc6 upstream.
+
+The prefix "DM_VERITY_ERR_BLOCK_NR" is 22 chars. Add '=', one digit for
+type, ',', up to 20 digits for a u64 block number, and a NUL terminator:
+that's 46 bytes. The buffer is 42 bytes. For block numbers >= 16 decimal
+digits (devices larger than ~16 EB with 4K blocks), snprintf silently
+truncates the uevent environment variable.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4.6
+Fixes: 65ff5b7ddf05 ("dm verity: add error handling modes for corrupted blocks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-verity-target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -26,7 +26,7 @@
+
+ #define DM_MSG_PREFIX "verity"
+
+-#define DM_VERITY_ENV_LENGTH 42
++#define DM_VERITY_ENV_LENGTH 46
+ #define DM_VERITY_ENV_VAR_NAME "DM_VERITY_ERR_BLOCK_NR"
+
+ #define DM_VERITY_DEFAULT_PREFETCH_SIZE 262144
--- /dev/null
+From 8ec4d9c5a5cf4b61fc087f871465b1f79b393325 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:37:38 +0200
+Subject: dm-verity: make error counter atomic
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 8ec4d9c5a5cf4b61fc087f871465b1f79b393325 upstream.
+
+The error counter "v->corrupted_errs" was not atomic, thus it could be
+subject to race conditions. The call to
+dm_audit_log_target("max-corrupted-errors") may be skipped due to the
+races.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4.6
+Fixes: 65ff5b7ddf05 ("dm verity: add error handling modes for corrupted blocks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-verity-target.c | 12 +++++++-----
+ drivers/md/dm-verity.h | 2 +-
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -238,14 +238,16 @@ static int verity_handle_err(struct dm_v
+ char *envp[] = { verity_env, NULL };
+ const char *type_str = "";
+ struct mapped_device *md = dm_table_get_md(v->ti->table);
++ int ce;
+
+ /* Corruption should be visible in device status in all modes */
+ v->hash_failed = true;
+
+- if (v->corrupted_errs >= DM_VERITY_MAX_CORRUPTED_ERRS)
+- goto out;
+-
+- v->corrupted_errs++;
++ ce = atomic_read(&v->corrupted_errs);
++ do {
++ if (ce >= DM_VERITY_MAX_CORRUPTED_ERRS)
++ goto out;
++ } while (!atomic_try_cmpxchg(&v->corrupted_errs, &ce, ce + 1));
+
+ switch (type) {
+ case DM_VERITY_BLOCK_TYPE_DATA:
+@@ -261,7 +263,7 @@ static int verity_handle_err(struct dm_v
+ DMERR_LIMIT("%s: %s block %llu is corrupted", v->data_dev->name,
+ type_str, block);
+
+- if (v->corrupted_errs == DM_VERITY_MAX_CORRUPTED_ERRS) {
++ if (ce + 1 == DM_VERITY_MAX_CORRUPTED_ERRS) {
+ DMERR("%s: reached maximum errors", v->data_dev->name);
+ dm_audit_log_target(DM_MSG_PREFIX, "max-corrupted-errors", v->ti, 0);
+ }
+--- a/drivers/md/dm-verity.h
++++ b/drivers/md/dm-verity.h
+@@ -65,7 +65,7 @@ struct dm_verity {
+ unsigned int hash_reqsize; /* the size of temporary space for crypto */
+ enum verity_mode mode; /* mode for handling verification errors */
+ enum verity_mode error_mode;/* mode for handling I/O errors */
+- unsigned int corrupted_errs;/* Number of errors for corrupted blocks */
++ atomic_t corrupted_errs;/* Number of errors for corrupted blocks */
+
+ struct workqueue_struct *verify_wq;
+
--- /dev/null
+From 366665416f20527ff7cad548a32d1ddf23195740 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 9 Jul 2026 21:29:11 +0200
+Subject: dm_early_create: fix freeing used table on dm_resume failure
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 366665416f20527ff7cad548a32d1ddf23195740 upstream.
+
+If dm_resume fails, the kernel attempts to free table with
+dm_table_destroy, but the table was already instantiated with
+dm_swap_table. This commit skips the call to dm_table_destroy in this
+case.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Assisted-by: Claude:claude-opus-4.6
+Fixes: 6bbc923dfcf5 ("dm: add support to directly boot to a mapped device")
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -2340,7 +2340,7 @@ int __init dm_early_create(struct dm_ioc
+ /* resume device */
+ r = dm_resume(md);
+ if (r)
+- goto err_destroy_table;
++ goto err_hash_remove;
+
+ DMINFO("%s (%s) is ready", md->disk->disk_name, dmi->name);
+ dm_put(md);
--- /dev/null
+From 8ffba0171c6bbce5f093c6dba5a02c0805b31203 Mon Sep 17 00:00:00 2001
+From: Frank Li <Frank.Li@nxp.com>
+Date: Thu, 21 May 2026 23:21:53 +0900
+Subject: dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
+
+From: Frank Li <Frank.Li@nxp.com>
+
+commit 8ffba0171c6bbce5f093c6dba5a02c0805b31203 upstream.
+
+The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA
+channels, and modifying them requires a read-modify-write sequence.
+Because this operation is not atomic, concurrent calls to
+dw_edma_v0_core_start() can introduce race conditions if two channels
+update these registers simultaneously.
+
+Add a spinlock to serialize access to these registers and prevent race
+conditions.
+
+Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+[den: update dw_edma.lock comment]
+Link: https://lore.kernel.org/dmaengine/20260109-edma_ll-v2-1-5c0b27b2c664@nxp.com/
+Signed-off-by: Koichiro Den <den@valinux.co.jp>
+Link: https://patch.msgid.link/20260521142153.2957432-5-den@valinux.co.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.h | 2 +-
+ drivers/dma/dw-edma/dw-edma-v0-core.c | 6 ++++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dw-edma/dw-edma-core.h
++++ b/drivers/dma/dw-edma/dw-edma-core.h
+@@ -108,7 +108,7 @@ struct dw_edma {
+
+ struct dw_edma_chan *chan;
+
+- raw_spinlock_t lock; /* Only for legacy */
++ raw_spinlock_t lock; /* Protect v0 shared registers */
+
+ struct dw_edma_chip *chip;
+
+--- a/drivers/dma/dw-edma/dw-edma-v0-core.c
++++ b/drivers/dma/dw-edma/dw-edma-v0-core.c
+@@ -364,6 +364,7 @@ static void dw_edma_v0_core_start(struct
+ {
+ struct dw_edma_chan *chan = chunk->chan;
+ struct dw_edma *dw = chan->dw;
++ unsigned long flags;
+ u32 tmp;
+
+ dw_edma_v0_core_write_chunk(chunk);
+@@ -408,6 +409,8 @@ static void dw_edma_v0_core_start(struct
+ }
+ }
+ /* Interrupt unmask - done, abort */
++ raw_spin_lock_irqsave(&dw->lock, flags);
++
+ tmp = GET_RW_32(dw, chan->dir, int_mask);
+ tmp &= ~FIELD_PREP(EDMA_V0_DONE_INT_MASK, BIT(chan->id));
+ tmp &= ~FIELD_PREP(EDMA_V0_ABORT_INT_MASK, BIT(chan->id));
+@@ -416,6 +419,9 @@ static void dw_edma_v0_core_start(struct
+ tmp = GET_RW_32(dw, chan->dir, linked_list_err_en);
+ tmp |= FIELD_PREP(EDMA_V0_LINKED_LIST_ERR_MASK, BIT(chan->id));
+ SET_RW_32(dw, chan->dir, linked_list_err_en, tmp);
++
++ raw_spin_unlock_irqrestore(&dw->lock, flags);
++
+ /* Channel control */
+ SET_CH_32(dw, chan->dir, chan->id, ch_control1,
+ (DW_EDMA_V0_CCS | DW_EDMA_V0_LLE));
--- /dev/null
+From 4651df83b6c796daead3447e8fd874322918ee4f Mon Sep 17 00:00:00 2001
+From: Kartik Rajput <kkartik@nvidia.com>
+Date: Wed, 22 Apr 2026 12:11:34 +0530
+Subject: dmaengine: tegra: Fix burst size calculation
+
+From: Kartik Rajput <kkartik@nvidia.com>
+
+commit 4651df83b6c796daead3447e8fd874322918ee4f upstream.
+
+Currently, the Tegra GPC DMA hardware requires the transfer length to
+be a multiple of the max burst size configured for the channel. When a
+client requests a transfer where the length is not evenly divisible by
+the configured max burst size, the DMA hangs with partial burst at
+the end.
+
+Fix this by reducing the burst size to the largest power-of-2 value
+that evenly divides the transfer length. For example, a 40-byte
+transfer with a 16-byte max burst will now use an 8-byte burst
+(40 / 8 = 5 complete bursts) instead of causing a hang.
+
+This issue was observed with the PL011 UART driver where TX DMA
+transfers of arbitrary lengths were stuck.
+
+Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://patch.msgid.link/20260422064134.1323610-1-kkartik@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/tegra186-gpc-dma.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/dma/tegra186-gpc-dma.c
++++ b/drivers/dma/tegra186-gpc-dma.c
+@@ -825,6 +825,13 @@ static unsigned int get_burst_size(struc
+ * len to calculate the optimum burst size
+ */
+ burst_byte = burst_size ? burst_size * slave_bw : len;
++
++ /*
++ * Find the largest burst size that evenly divides the transfer length.
++ * The hardware requires the transfer length to be a multiple of the
++ * burst size - partial bursts are not supported.
++ */
++ burst_byte = min(burst_byte, 1U << __ffs(len));
+ burst_mmio_width = burst_byte / 4;
+
+ if (burst_mmio_width < TEGRA_GPCDMA_MMIOSEQ_BURST_MIN)
--- /dev/null
+From 9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a Mon Sep 17 00:00:00 2001
+From: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Date: Mon, 18 May 2026 13:07:40 -0600
+Subject: fpga: dfl: add bounds check in dfh_get_param_size()
+
+From: Sebastian Alba Vives <sebasjosue84@gmail.com>
+
+commit 9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a upstream.
+
+dfh_get_param_size() can return a parameter size larger than the feature
+region because the loop bounds check is evaluated before incrementing
+size. If the EOP (End of Parameters) bit is set in the same iteration,
+the inflated size is returned without re-validation against max.
+
+This can cause create_feature_instance() to call memcpy_fromio() with a
+size exceeding the ioremap'd region when a malicious FPGA device provides
+crafted DFHv1 parameter headers.
+
+Add a bounds check after the size increment to ensure the accumulated
+size never exceeds the feature boundary.
+
+Fixes: 4747ab89b4a6 ("fpga: dfl: add basic support for DFHv1")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Reviewed-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20260518190742.61426-2-sebasjosue84@gmail.com
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/fpga/dfl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/fpga/dfl.c
++++ b/drivers/fpga/dfl.c
+@@ -1117,6 +1117,8 @@ static int dfh_get_param_size(void __iom
+ return -EINVAL;
+
+ size += next * sizeof(u64);
++ if (size > max)
++ return -EINVAL;
+
+ if (FIELD_GET(DFHv1_PARAM_HDR_NEXT_EOP, v))
+ return size;
--- /dev/null
+From 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 Mon Sep 17 00:00:00 2001
+From: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Date: Mon, 18 May 2026 13:07:42 -0600
+Subject: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
+
+From: Sebastian Alba Vives <sebasjosue84@gmail.com>
+
+commit 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 upstream.
+
+mpf_ops_parse_header() reads header_size from the bitstream at
+MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression
+*(buf + header_size - 1) reads one byte before the buffer start.
+
+Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core
+guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET.
+The only real gap is the zero header_size case, which cannot be
+resolved by providing a larger buffer, so return -EINVAL.
+
+Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Reviewed-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/fpga/microchip-spi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/fpga/microchip-spi.c
++++ b/drivers/fpga/microchip-spi.c
+@@ -116,6 +116,9 @@ static int mpf_ops_parse_header(struct f
+ }
+
+ header_size = *(buf + MPF_HEADER_SIZE_OFFSET);
++ if (!header_size)
++ return -EINVAL;
++
+ if (header_size > count) {
+ info->header_size = header_size;
+ return -EAGAIN;
--- /dev/null
+From a35a6f1b20100057c66b7be5a8f6864661c3945c Mon Sep 17 00:00:00 2001
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+Date: Mon, 29 Jun 2026 21:17:40 +0200
+Subject: hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
+
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+
+commit a35a6f1b20100057c66b7be5a8f6864661c3945c upstream.
+
+The Kconfig entry for the LTC2992 sensor doesn't contain a
+`select REGMAP_I2C` parameter, causing build failures if regmap
+isn't selected previously during the build process.
+
+Fixes: b0bd407e94b0 ("hwmon: (ltc2992) Add support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
+Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-2-8104df929b1a@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1014,6 +1014,7 @@ config SENSORS_LTC2992
+ tristate "Linear Technology LTC2992"
+ depends on I2C
+ depends on GPIOLIB
++ select REGMAP_I2C
+ help
+ If you say yes here you get support for Linear Technology LTC2992
+ I2C System Monitor. The LTC2992 measures current, voltage, and
--- /dev/null
+From ed576f2f4eef8cbe2c110da503825a8dc4717030 Mon Sep 17 00:00:00 2001
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+Date: Mon, 29 Jun 2026 21:17:41 +0200
+Subject: hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
+
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+
+commit ed576f2f4eef8cbe2c110da503825a8dc4717030 upstream.
+
+The Kconfig entry for the MAX6697 sensor doesn't contain a
+`select REGMAP_I2C` parameter, causing build failures if regmap
+isn't selected previously during the build process.
+
+Fixes: 3a2a8cc3fe24 ("hwmon: (max6697) Convert to use regmap")
+Cc: stable@vger.kernel.org
+Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
+Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-3-8104df929b1a@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1259,6 +1259,7 @@ config SENSORS_MAX6650
+ config SENSORS_MAX6697
+ tristate "Maxim MAX6697 and compatibles"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ If you say yes here you get support for MAX6581, MAX6602, MAX6622,
+ MAX6636, MAX6689, MAX6693, MAX6694, MAX6697, MAX6698, and MAX6699
--- /dev/null
+From deb35336b5bfed5db9231b5348bc1514db930797 Mon Sep 17 00:00:00 2001
+From: Roman Vivchar <rva333@protonmail.com>
+Date: Thu, 9 Jul 2026 16:31:29 +0300
+Subject: i2c: mediatek: fix WRRD for SoCs without auto_restart option
+
+From: Roman Vivchar <rva333@protonmail.com>
+
+commit deb35336b5bfed5db9231b5348bc1514db930797 upstream.
+
+MediaTek mt65xx family SoCs have no auto restart, however, they still
+support the WRRD mode in the hardware. Because auto_restart is set to 0,
+the WRRD mode will be never enabled, leading to read errors.
+
+Fix this by removing auto_restart check from the WRRD enable path.
+
+Fixes: b49218365280 ("i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD")
+Signed-off-by: Roman Vivchar <rva333@protonmail.com>
+Cc: <stable@vger.kernel.org> # v6.18+
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20260709-6572-6595-i2c-v2-1-b2fb8510d1d3@protonmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1253,7 +1253,7 @@ static int mtk_i2c_transfer(struct i2c_a
+ i2c->auto_restart = i2c->dev_comp->auto_restart;
+
+ /* checking if we can skip restart and optimize using WRRD mode */
+- if (i2c->auto_restart && num == 2) {
++ if (num == 2) {
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
--- /dev/null
+From 71356737a7a55c76fee847563e3d33f8e6dc6b6d Mon Sep 17 00:00:00 2001
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Date: Tue, 14 Jul 2026 23:08:08 +0800
+Subject: i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
+
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+
+commit 71356737a7a55c76fee847563e3d33f8e6dc6b6d upstream.
+
+If devm_platform_get_and_ioremap_resource() returns an error,
+mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io to
+get the error code. This results in a use-after-free.
+
+Save the error code before freeing tmp_res.
+
+Fixes: b5b5b32081cd ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
+Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Cc: <stable@vger.kernel.org> # v5.10+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20260714150808.85045-1-xuanqiang.luo@linux.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-mlxbf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-mlxbf.c
++++ b/drivers/i2c/busses/i2c-mlxbf.c
+@@ -1082,8 +1082,10 @@ static int mlxbf_i2c_init_resource(struc
+
+ tmp_res->io = devm_platform_get_and_ioremap_resource(pdev, type, &tmp_res->params);
+ if (IS_ERR(tmp_res->io)) {
++ int ret = PTR_ERR(tmp_res->io);
++
+ devm_kfree(dev, tmp_res);
+- return PTR_ERR(tmp_res->io);
++ return ret;
+ }
+
+ tmp_res->type = type;
--- /dev/null
+From eb509638686b0f8a98a0dd9c809f6a8db4d73a45 Mon Sep 17 00:00:00 2001
+From: Paul Greenwalt <paul.greenwalt@intel.com>
+Date: Wed, 8 Apr 2026 16:11:05 +0200
+Subject: ice: fix ice_init_link() error return preventing probe
+
+From: Paul Greenwalt <paul.greenwalt@intel.com>
+
+commit eb509638686b0f8a98a0dd9c809f6a8db4d73a45 upstream.
+
+ice_init_link() can return an error status from ice_update_link_info()
+or ice_init_phy_user_cfg(), causing probe to fail.
+
+An incorrect NVM update procedure can result in link/PHY errors, and
+the recommended resolution is to update the NVM using the correct
+procedure. If the driver fails probe due to link errors, the user
+cannot update the NVM to recover. The link/PHY errors logged are
+non-fatal: they are already annotated as 'not a fatal error if this
+fails'.
+
+Since none of the errors inside ice_init_link() should prevent probe
+from completing, convert it to void and remove the error check in the
+caller. All failures are already logged; callers have no meaningful
+recovery path for link init errors.
+
+Fixes: 5b246e533d01 ("ice: split probe into smaller functions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paul Greenwalt <paul.greenwalt@intel.com>
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Alexander Nowlin <alexander.nowlin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4943,16 +4943,14 @@ static void ice_init_wakeup(struct ice_p
+ device_set_wakeup_enable(ice_pf_to_dev(pf), false);
+ }
+
+-static int ice_init_link(struct ice_pf *pf)
++static void ice_init_link(struct ice_pf *pf)
+ {
+ struct device *dev = ice_pf_to_dev(pf);
+ int err;
+
+ err = ice_init_link_events(pf->hw.port_info);
+- if (err) {
++ if (err)
+ dev_err(dev, "ice_init_link_events failed: %d\n", err);
+- return err;
+- }
+
+ /* not a fatal error if this fails */
+ err = ice_init_nvm_phy_type(pf->hw.port_info);
+@@ -4986,8 +4984,6 @@ static int ice_init_link(struct ice_pf *
+ } else {
+ set_bit(ICE_FLAG_NO_MEDIA, pf->flags);
+ }
+-
+- return err;
+ }
+
+ static int ice_init_pf_sw(struct ice_pf *pf)
+@@ -5119,13 +5115,11 @@ static int ice_init(struct ice_pf *pf)
+
+ ice_init_wakeup(pf);
+
+- err = ice_init_link(pf);
+- if (err)
+- goto err_init_link;
++ ice_init_link(pf);
+
+ err = ice_send_version(pf);
+ if (err)
+- goto err_init_link;
++ goto err_deinit_pf_sw;
+
+ ice_verify_cacheline_size(pf);
+
+@@ -5144,7 +5138,7 @@ static int ice_init(struct ice_pf *pf)
+
+ return 0;
+
+-err_init_link:
++err_deinit_pf_sw:
+ ice_deinit_pf_sw(pf);
+ err_init_pf_sw:
+ ice_dealloc_vsis(pf);
--- /dev/null
+From 043db005a8d6932dc7d217c86307e9af0bc10ddc Mon Sep 17 00:00:00 2001
+From: Bhargav Joshi <j.bhargav.u@gmail.com>
+Date: Sat, 20 Jun 2026 17:39:16 +0530
+Subject: irqchip/crossbar: Use correct index in crossbar_domain_free()
+
+From: Bhargav Joshi <j.bhargav.u@gmail.com>
+
+commit 043db005a8d6932dc7d217c86307e9af0bc10ddc upstream.
+
+crossbar_domain_free() resets the domain data and then uses the nulled
+out irq_data->hwirq member as index to reset the irq_map[] entry and to
+write the relevant crossbar register with a safe entry. That means it
+never frees the correct index and keeps the crossbar register connection
+to the source interrupt active.
+
+If it would not reset the domain data, then this would be even worse as
+irq_data->hwirq holds the source interrupt number, but both the map and
+register index need the corresponding GIC SPI number and not the source
+interrupt number. This might even result in an out of bounds access as
+the source interrupt number can be higher than the maximal index space.
+
+Fix this by using the GIC SPI index from the parent domain's irq_data.
+
+Fixes: 783d31863fb82 ("irqchip: crossbar: Convert dra7 crossbar to stacked domains")
+Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260620-irq-crossbar-fix-v2-1-b8e8499f468a@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-crossbar.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/irqchip/irq-crossbar.c
++++ b/drivers/irqchip/irq-crossbar.c
+@@ -158,9 +158,14 @@ static void crossbar_domain_free(struct
+ for (i = 0; i < nr_irqs; i++) {
+ struct irq_data *d = irq_domain_get_irq_data(domain, virq + i);
+
++ /*
++ * irq_map[] is indexed by GIC SPI number. The parent domain's
++ * hwirq contains the GIC interrupt number (GIC SPI +
++ * GIC_IRQ_START).
++ */
++ cb->irq_map[d->parent_data->hwirq - GIC_IRQ_START] = IRQ_FREE;
++ cb->write(d->parent_data->hwirq - GIC_IRQ_START, cb->safe_map);
+ irq_domain_reset_irq_data(d);
+- cb->irq_map[d->hwirq] = IRQ_FREE;
+- cb->write(d->hwirq, cb->safe_map);
+ }
+ raw_spin_unlock(&cb->lock);
+ irq_domain_free_irqs_parent(domain, virq, nr_irqs);
--- /dev/null
+From 1c0ae3df692ea2a4ce992f786346154e75a3f0d5 Mon Sep 17 00:00:00 2001
+From: Ibrahim Hashimov <security@auditcode.ai>
+Date: Thu, 9 Jul 2026 17:05:30 +0200
+Subject: ksmbd: fix integer overflow in set_file_allocation_info()
+
+From: Ibrahim Hashimov <security@auditcode.ai>
+
+commit 1c0ae3df692ea2a4ce992f786346154e75a3f0d5 upstream.
+
+set_file_allocation_info() converts the client-supplied
+FILE_ALLOCATION_INFORMATION::AllocationSize into a 512-byte block
+count with:
+
+ alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9;
+
+AllocationSize is a fully client-controlled __le64 field; the only
+validation performed by the caller (smb2_set_info_file(), case
+FILE_ALLOCATION_INFORMATION) is that the fixed buffer is at least
+sizeof(struct smb2_file_alloc_info) == 8 bytes. The value itself is
+never range-checked before this arithmetic.
+
+When AllocationSize is close to U64_MAX (e.g. 0xffffffffffffffff),
+"AllocationSize + 511" wraps around mod 2^64 to a small number
+(0xffffffffffffffff + 511 = 510), so alloc_blks becomes 0. Since any
+existing regular file has stat.blocks > 0, the function then takes
+the "shrink" branch and calls:
+
+ ksmbd_vfs_truncate(work, fp, alloc_blks * 512); /* == 0 */
+
+silently truncating the file to size 0, even though the client asked
+to grow the allocation to (what looks like) the maximum possible
+size. The trailing "if (size < alloc_blks * 512) i_size_write(inode,
+size);" restore is guarded by a comparison that is never true once
+alloc_blks == 0, so the truncation is not undone. This lets an
+authenticated SMB client that already holds an open handle with
+FILE_WRITE_DATA on a file silently truncate that same file to size 0
+via a single crafted SET_INFO(FILE_ALLOCATION_INFORMATION) request
+advertising a near-U64_MAX AllocationSize, even though the request
+asks to grow the file's allocation rather than shrink it. This is a
+functional/data-loss bug, not a privilege-boundary
+violation: the same client could already truncate the file via
+FILE_END_OF_FILE_INFORMATION or a plain write.
+
+Fix it by validating AllocationSize against MAX_LFS_FILESIZE, the
+same upper bound the VFS itself uses to reject unrepresentable file
+sizes, before doing the "+511" rounding, and rejecting oversized
+values with -EINVAL. Bounding AllocationSize to
+MAX_LFS_FILESIZE - 511 guarantees the "+511" addition cannot wrap,
+and that the subsequent "alloc_blks * 512" values passed to
+vfs_fallocate() and ksmbd_vfs_truncate() stay within a representable
+loff_t as well.
+
+No legitimate SMB client asks for an allocation size anywhere near
+2^64 bytes, so this only rejects a value that was previously
+silently misinterpreted as zero.
+
+Runtime-verified on a v6.19 KASAN test stand: sending SET_INFO
+(FILE_ALLOCATION_INFORMATION) with AllocationSize = 0xffffffffffffffff
+against ksmbd now returns -EINVAL and leaves the target file's size
+unchanged, where the unpatched kernel truncated it from 4096 to 0
+bytes.
+
+Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
+Assisted-by: AuditCode-AI:2026.07
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/smb2pdu.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -6311,6 +6311,7 @@ static int set_file_allocation_info(stru
+ */
+
+ loff_t alloc_blks;
++ u64 alloc_size;
+ struct inode *inode;
+ struct kstat stat;
+ int rc;
+@@ -6323,7 +6324,19 @@ static int set_file_allocation_info(stru
+ if (rc)
+ return rc;
+
+- alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9;
++ /*
++ * AllocationSize is fully client-controlled (the caller only
++ * validates the fixed 8-byte buffer length). Reject values that
++ * would overflow the "round up to 512-byte blocks" conversion
++ * below instead of silently wrapping it to a tiny block count,
++ * which would truncate the file to a size the client never
++ * asked for.
++ */
++ alloc_size = le64_to_cpu(file_alloc_info->AllocationSize);
++ if (alloc_size > MAX_LFS_FILESIZE - 511)
++ return -EINVAL;
++
++ alloc_blks = (alloc_size + 511) >> 9;
+ inode = file_inode(fp->filp);
+
+ if (alloc_blks > stat.blocks) {
--- /dev/null
+From 357e3b8e3a8769ba36eb8ec5e053e4825f1a9329 Mon Sep 17 00:00:00 2001
+From: Florian Fuchs <fuchsfl@gmail.com>
+Date: Mon, 18 May 2026 13:45:21 +0200
+Subject: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
+
+From: Florian Fuchs <fuchsfl@gmail.com>
+
+commit 357e3b8e3a8769ba36eb8ec5e053e4825f1a9329 upstream.
+
+The mtd_info contains a struct device, which must be linked to its
+parent. Without this, the initialization of the MTD fails with a NULL
+pointer dereference.
+
+Fixes: 47a72688fae7 ("mtd: flash mapping support for Dreamcast VMU.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/maps/vmu-flash.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/maps/vmu-flash.c
++++ b/drivers/mtd/maps/vmu-flash.c
+@@ -547,6 +547,7 @@ static void vmu_queryblocks(struct maple
+ mpart->partition = card->partition;
+ mtd_cur->priv = mpart;
+ mtd_cur->owner = THIS_MODULE;
++ mtd_cur->dev.parent = &mdev->dev;
+
+ pcache = kzalloc(sizeof(struct vmu_cache), GFP_KERNEL);
+ if (!pcache)
--- /dev/null
+From 8e4531667d718e2e9b193928cf9b2497fa0d01ef Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Fri, 22 May 2026 11:17:39 +0200
+Subject: mtd: rawnand: Pause continuous reads at block boundaries
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 8e4531667d718e2e9b193928cf9b2497fa0d01ef upstream.
+
+Some chips do not support sequential cached reads past block
+boundaries, like Winbond. In practice when using UBI, this should very
+rarely happen, but let's make sure it never happens.
+
+Cc: stable@vger.kernel.org
+Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/nand_base.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/mtd/nand/raw/nand_base.c
++++ b/drivers/mtd/nand/raw/nand_base.c
+@@ -1215,32 +1215,32 @@ static int nand_lp_exec_read_page_op(str
+ return nand_exec_op(chip, &op);
+ }
+
+-static unsigned int rawnand_last_page_of_lun(unsigned int pages_per_lun, unsigned int lun)
++static unsigned int rawnand_last_page_of_block(unsigned int ppb, unsigned int block)
+ {
+- /* lun is expected to be very small */
+- return (lun * pages_per_lun) + pages_per_lun - 1;
++ /* block is expected to be very small */
++ return (block * ppb) + ppb - 1;
+ }
+
+ static void rawnand_cap_cont_reads(struct nand_chip *chip)
+ {
+ struct nand_memory_organization *memorg;
+- unsigned int ppl, first_lun, last_lun;
++ unsigned int ppb, first_block, last_block;
+
+ memorg = nanddev_get_memorg(&chip->base);
+- ppl = memorg->pages_per_eraseblock * memorg->eraseblocks_per_lun;
+- first_lun = chip->cont_read.first_page / ppl;
+- last_lun = chip->cont_read.last_page / ppl;
+-
+- /* Prevent sequential cache reads across LUN boundaries */
+- if (first_lun != last_lun)
+- chip->cont_read.pause_page = rawnand_last_page_of_lun(ppl, first_lun);
++ ppb = memorg->pages_per_eraseblock;
++ first_block = chip->cont_read.first_page / ppb;
++ last_block = chip->cont_read.last_page / ppb;
++
++ /* Prevent sequential cache reads across block boundaries */
++ if (first_block != last_block)
++ chip->cont_read.pause_page = rawnand_last_page_of_block(ppb, first_block);
+ else
+ chip->cont_read.pause_page = chip->cont_read.last_page;
+
+ if (chip->cont_read.first_page == chip->cont_read.pause_page) {
+ chip->cont_read.first_page++;
+ chip->cont_read.pause_page = min(chip->cont_read.last_page,
+- rawnand_last_page_of_lun(ppl, first_lun + 1));
++ rawnand_last_page_of_block(ppb, first_block + 1));
+ }
+
+ if (chip->cont_read.first_page >= chip->cont_read.last_page)
--- /dev/null
+From 306e443156b82a2a14a3f33da908c303be45529c Mon Sep 17 00:00:00 2001
+From: Takahiro Kuwano <takahiro.kuwano@infineon.com>
+Date: Wed, 27 May 2026 18:05:39 +0900
+Subject: mtd: spi-nor: spansion: use die erase for multi-die devices only
+
+From: Takahiro Kuwano <takahiro.kuwano@infineon.com>
+
+commit 306e443156b82a2a14a3f33da908c303be45529c upstream.
+
+Die erase opcode is supported in multi-die devices only. For single die
+devices, default chip erase opcode must be used.
+
+In s25hx_t_late_init(), die erase opcode is set only when the device is
+multi-die.
+
+Fixes: 461d0babb544 ("mtd: spi-nor: spansion: enable die erase for multi die flashes")
+Cc: stable@kernel.org
+Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Takahiro Kuwano <takahiro.kuwano@infineon.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/spansion.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/spansion.c
++++ b/drivers/mtd/spi-nor/spansion.c
+@@ -674,7 +674,9 @@ static int s25hx_t_late_init(struct spi_
+ params->ready = cypress_nor_sr_ready_and_clear;
+ cypress_nor_ecc_init(nor);
+
+- params->die_erase_opcode = SPINOR_OP_CYPRESS_DIE_ERASE;
++ if (params->n_dice > 1)
++ params->die_erase_opcode = SPINOR_OP_CYPRESS_DIE_ERASE;
++
+ return 0;
+ }
+
--- /dev/null
+From e1d456b26bf23e30db305a6184e8abd9ab68bbf2 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 26 May 2026 16:56:26 +0200
+Subject: mtd: spi-nor: swp: Improve locking user experience
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit e1d456b26bf23e30db305a6184e8abd9ab68bbf2 upstream.
+
+In the case of the first block being locked (or the few first blocks),
+if the user want to fully unlock the device it has two possibilities:
+- either it asks to unlock the entire device, and this works;
+- or it asks to unlock just the block(s) that are currently locked,
+ which fails.
+
+It fails because the conditions "can_be_top" and "can_be_bottom" are
+true. Indeed, in this case, we unlock everything, so the TB bit does not
+matter. However in the current implementation, use_top would be true (as
+this is the favourite option) and lock_len, which in practice should be
+reduced down to 0, is set to "nor->params->size - (ofs + len)" which is
+a positive number. This is wrong.
+
+An easy way is to simply add an extra condition. In the unlock() path,
+if we can achieve the same result from both sides, it means we unlock
+everything and lock_len must simply be 0. A comment is added to clarify
+that logic.
+
+Fixes: 3dd8012a8eeb ("mtd: spi-nor: add TB (Top/Bottom) protect support")
+Cc: stable@kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/swp.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/spi-nor/swp.c
++++ b/drivers/mtd/spi-nor/swp.c
+@@ -281,8 +281,15 @@ static int spi_nor_sr_unlock(struct spi_
+ /* Prefer top, if both are valid */
+ use_top = can_be_top;
+
+- /* lock_len: length of region that should remain locked */
+- if (use_top)
++ /*
++ * lock_len: length of region that should remain locked.
++ *
++ * When can_be_top and can_be_bottom booleans are true, both adjacent
++ * regions are unlocked, thus the entire flash can be unlocked.
++ */
++ if (can_be_top && can_be_bottom)
++ lock_len = 0;
++ else if (use_top)
+ lock_len = nor->params->size - (ofs + len);
+ else
+ lock_len = ofs;
--- /dev/null
+From 483be61b4a9a6df3b7cb277e8f189e082dee4cb8 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Tue, 23 Jun 2026 19:57:14 +0800
+Subject: net: sparx5: unregister blocking notifier on init failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 483be61b4a9a6df3b7cb277e8f189e082dee4cb8 upstream.
+
+sparx5_register_notifier_blocks() registers the switchdev blocking
+notifier before allocating the ordered workqueue. If the workqueue
+allocation fails, the error path unregisters the switchdev and netdevice
+notifiers, but leaves the blocking notifier registered.
+
+Add a separate error label for the workqueue allocation failure path and
+unregister the switchdev blocking notifier there.
+
+Fixes: d6fce5141929 ("net: sparx5: add switching support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260623115714.2192074-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c
+@@ -740,11 +740,13 @@ int sparx5_register_notifier_blocks(stru
+ sparx5_owq = alloc_ordered_workqueue("sparx5_order", 0);
+ if (!sparx5_owq) {
+ err = -ENOMEM;
+- goto err_switchdev_blocking_nb;
++ goto err_alloc_workqueue;
+ }
+
+ return 0;
+
++err_alloc_workqueue:
++ unregister_switchdev_blocking_notifier(&s5->switchdev_blocking_nb);
+ err_switchdev_blocking_nb:
+ unregister_switchdev_notifier(&s5->switchdev_nb);
+ err_switchdev_nb:
--- /dev/null
+From 55d9895f89970501fe126d1026b586b04a224c27 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Wed, 17 Jun 2026 01:38:41 +0800
+Subject: net: thunderbolt: Fix frags[] overflow by bounding frame_count
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 55d9895f89970501fe126d1026b586b04a224c27 upstream.
+
+tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The
+first frame goes into the skb linear area and every further frame is added as
+a page fragment.
+
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ page, hdr_size, frame_size,
+ TBNET_RX_PAGE_SIZE - hdr_size);
+
+A packet of frame_count frames therefore ends up with frame_count - 1
+fragments. tbnet_check_frame() only bounds the peer supplied frame_count to
+TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A
+peer that sends a packet of 19 or more small frames pushes nr_frags past
+MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and
+corrupts memory after the shared info.
+
+Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never
+produce more fragments than frags[] can hold. This matches the recent skb
+frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net:
+wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc
+("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").
+
+Fixes: e69b6c02b4c3 ("net: Add support for networking over Thunderbolt cable")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/178163152194.2486768.14724194232649760778@maoyixie.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/thunderbolt/main.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/thunderbolt/main.c
++++ b/drivers/net/thunderbolt/main.c
+@@ -786,8 +786,12 @@ static bool tbnet_check_frame(struct tbn
+ return true;
+ }
+
+- /* Start of packet, validate the frame header */
+- if (frame_count == 0 || frame_count > TBNET_RING_SIZE / 4) {
++ /* Start of packet, validate the frame header. tbnet_poll() puts the
++ * first frame in the skb linear area and every further frame in a page
++ * fragment, so a packet may not span more than MAX_SKB_FRAGS + 1 frames
++ * without overflowing skb_shinfo()->frags[].
++ */
++ if (frame_count == 0 || frame_count > MAX_SKB_FRAGS + 1) {
+ net->stats.rx_length_errors++;
+ return false;
+ }
--- /dev/null
+From 1f24c0d01db214c9e661915e9972404c96ca73c0 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Tue, 16 Jun 2026 01:17:36 +0800
+Subject: netdev-genl: report NAPI thread PID in the caller's pid namespace
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 1f24c0d01db214c9e661915e9972404c96ca73c0 upstream.
+
+netdev_nl_napi_fill_one() reports the NAPI kthread PID in NETDEV_A_NAPI_PID
+using task_pid_nr(), which returns the PID in the initial pid namespace.
+
+NETDEV_CMD_NAPI_GET does not have GENL_ADMIN_PERM and the netdev genl family
+is netnsok, so a caller in a child pid namespace can issue it. That caller
+then sees the kthread's global PID, even though the kthread is not visible
+in its pid namespace, where the value should be 0.
+
+Translate the PID through the caller's pid namespace, the same way commit
+3799c2570982 ("io_uring/fdinfo: translate SqThread PID through caller's
+pid_ns") did for the io_uring SQPOLL thread. The doit and dumpit paths both
+run synchronously in the caller's context, so task_active_pid_ns(current) is
+the caller's pid namespace.
+
+Fixes: db4704f4e4df ("netdev-genl: Add PID for the NAPI thread")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Joe Damato <joe@dama.to>
+Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
+Link: https://patch.msgid.link/20260615171736.1709318-1-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/netdev-genl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/core/netdev-genl.c
++++ b/net/core/netdev-genl.c
+@@ -2,6 +2,7 @@
+
+ #include <linux/netdevice.h>
+ #include <linux/notifier.h>
++#include <linux/pid_namespace.h>
+ #include <linux/rtnetlink.h>
+ #include <net/busy_poll.h>
+ #include <net/net_namespace.h>
+@@ -181,7 +182,8 @@ netdev_nl_napi_fill_one(struct sk_buff *
+ goto nla_put_failure;
+
+ if (napi->thread) {
+- pid = task_pid_nr(napi->thread);
++ pid = task_pid_nr_ns(napi->thread,
++ task_active_pid_ns(current));
+ if (nla_put_u32(rsp, NETDEV_A_NAPI_PID, pid))
+ goto nla_put_failure;
+ }
--- /dev/null
+From 27934d02cbeb8a957dd11c985a579e58d30c5270 Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <ben.coddington@hammerspace.com>
+Date: Tue, 7 Jul 2026 11:07:16 -0400
+Subject: NFS: Charge unstable writes by request size, not folio size
+
+From: Benjamin Coddington <ben.coddington@hammerspace.com>
+
+commit 27934d02cbeb8a957dd11c985a579e58d30c5270 upstream.
+
+nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge and
+uncharge NR_WRITEBACK/WB_WRITEBACK by folio_nr_pages(folio) once per
+*request* added to or removed from a commit list. This is correct only
+when a folio has a single associated request. When pg_test splits a
+folio into N sub-folio requests (e.g. pNFS flexfiles striping with a
+stripe unit smaller than the folio size, or plain wsize-limited
+splitting), each of the N requests independently charges the whole
+folio's page count, inflating the accounting by a factor of N per
+folio. With large folios and small stripe units this reaches multiple
+orders of magnitude: a 2 MiB folio split into 512 4 KiB requests can
+charge up to 512x its real size, pushing global dirty+writeback
+accounting past the system's dirty threshold and forcing every
+buffered writer on the host into the hard-throttle path, including
+unrelated in-kernel NFS server threads sharing the box.
+
+Charge each request only for the pages it actually covers.
+
+Fixes: 0c493b5cf16e ("NFS: Convert buffered writes to use folios")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
+Assisted-By: Claude Sonnet 5 <noreply@anthropic.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/internal.h | 12 +++++++-----
+ fs/nfs/pnfs_nfs.c | 2 +-
+ fs/nfs/write.c | 14 ++++++++------
+ 3 files changed, 16 insertions(+), 12 deletions(-)
+
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -839,17 +839,19 @@ void nfs_super_set_maxbytes(struct super
+ }
+
+ /*
+- * Record the page as unstable (an extra writeback period) and mark its
+- * inode as dirty.
++ * Record the request's range as unstable (an extra writeback period) and
++ * mark its inode as dirty.
+ */
+-static inline void nfs_folio_mark_unstable(struct folio *folio,
++static inline void nfs_folio_mark_unstable(struct nfs_page *req,
+ struct nfs_commit_info *cinfo)
+ {
++ struct folio *folio = nfs_page_to_folio(req);
++
+ if (folio && !cinfo->dreq) {
+ struct inode *inode = folio->mapping->host;
+- long nr = folio_nr_pages(folio);
++ long nr = DIV_ROUND_UP(req->wb_bytes, PAGE_SIZE);
+
+- /* This page is really still in write-back - just that the
++ /* This range is really still in write-back - just that the
+ * writeback is happening on the server now.
+ */
+ node_stat_mod_folio(folio, NR_WRITEBACK, nr);
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -1179,7 +1179,7 @@ pnfs_layout_mark_request_commit(struct n
+
+ nfs_request_add_commit_list_locked(req, list, cinfo);
+ mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+- nfs_folio_mark_unstable(nfs_page_to_folio(req), cinfo);
++ nfs_folio_mark_unstable(req, cinfo);
+ return;
+ out_resched:
+ mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -858,7 +858,7 @@ nfs_request_add_commit_list(struct nfs_p
+ mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+ nfs_request_add_commit_list_locked(req, &cinfo->mds->list, cinfo);
+ mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+- nfs_folio_mark_unstable(nfs_page_to_folio(req), cinfo);
++ nfs_folio_mark_unstable(req, cinfo);
+ }
+ EXPORT_SYMBOL_GPL(nfs_request_add_commit_list);
+
+@@ -917,10 +917,12 @@ nfs_mark_request_commit(struct nfs_page
+ nfs_request_add_commit_list(req, cinfo);
+ }
+
+-static void nfs_folio_clear_commit(struct folio *folio)
++static void nfs_folio_clear_commit(struct nfs_page *req)
+ {
++ struct folio *folio = nfs_page_to_folio(req);
++
+ if (folio) {
+- long nr = folio_nr_pages(folio);
++ long nr = DIV_ROUND_UP(req->wb_bytes, PAGE_SIZE);
+
+ node_stat_mod_folio(folio, NR_WRITEBACK, -nr);
+ wb_stat_mod(&inode_to_bdi(folio->mapping->host)->wb,
+@@ -941,7 +943,7 @@ static void nfs_clear_request_commit(str
+ nfs_request_remove_commit_list(req, cinfo);
+ }
+ mutex_unlock(&NFS_I(inode)->commit_mutex);
+- nfs_folio_clear_commit(nfs_page_to_folio(req));
++ nfs_folio_clear_commit(req);
+ }
+ }
+
+@@ -1777,7 +1779,7 @@ void nfs_retry_commit(struct list_head *
+ req = nfs_list_entry(page_list->next);
+ nfs_list_remove_request(req);
+ nfs_mark_request_commit(req, lseg, cinfo, ds_commit_idx);
+- nfs_folio_clear_commit(nfs_page_to_folio(req));
++ nfs_folio_clear_commit(req);
+ nfs_unlock_and_release_request(req);
+ }
+ }
+@@ -1848,7 +1850,7 @@ static void nfs_commit_release_pages(str
+ req = nfs_list_entry(data->pages.next);
+ nfs_list_remove_request(req);
+ folio = nfs_page_to_folio(req);
+- nfs_folio_clear_commit(folio);
++ nfs_folio_clear_commit(req);
+
+ dprintk("NFS: commit (%s/%llu %d@%lld)",
+ nfs_req_openctx(req)->dentry->d_sb->s_id,
--- /dev/null
+From 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Thu, 4 Jun 2026 19:36:54 +0000
+Subject: nvmet-rdma: handle inline data with a nonzero offset
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 upstream.
+
+nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset
+into the per-command inline scatterlist. The bounds check admits any
+offset with off + len <= inline_data_size, but the mapping still assumes
+the data begins in the first inline page:
+
+ sg->offset = off;
+ sg->length = min_t(int, len, PAGE_SIZE - off);
+
+When a port is configured with inline_data_size > PAGE_SIZE (settable up
+to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]
+makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and
+the block backend reads far past the first inline page. num_pages(len)
+also ignores the offset, so an in-bounds offset whose [off, off+len)
+span crosses a page boundary under-counts the scatterlist.
+
+Map the offset properly: split it into a page index and an in-page
+offset, start the scatterlist at that page, and size the page count from
+page_off + len. Because the request scatterlist may now start at
+inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL
+identity test in nvmet_rdma_release_rsp() to a range test; otherwise the
+persistent inline scatterlist is mistaken for an allocated one and
+nvmet_req_free_sgls() frees an inline page (and warns in
+free_large_kmalloc()).
+
+Fixes: 0d5ee2b2ab4f ("nvmet-rdma: support max(16KB, PAGE_SIZE) inline data")
+Cc: stable@vger.kernel.org
+Suggested-by: Keith Busch <kbusch@kernel.org>
+Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/rdma.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -667,7 +667,8 @@ static void nvmet_rdma_release_rsp(struc
+ if (rsp->n_rdma)
+ nvmet_rdma_rw_ctx_destroy(rsp);
+
+- if (rsp->req.sg != rsp->cmd->inline_sg)
++ if (rsp->req.sg < rsp->cmd->inline_sg ||
++ rsp->req.sg >= rsp->cmd->inline_sg + queue->dev->inline_page_count)
+ nvmet_req_free_sgls(&rsp->req);
+
+ if (unlikely(!list_empty_careful(&queue->rsp_wr_wait_list)))
+@@ -822,24 +823,25 @@ static void nvmet_rdma_write_data_done(s
+ static void nvmet_rdma_use_inline_sg(struct nvmet_rdma_rsp *rsp, u32 len,
+ u64 off)
+ {
+- int sg_count = num_pages(len);
++ u64 page_off = off % PAGE_SIZE;
++ u64 page_idx = off / PAGE_SIZE;
++ int sg_count = num_pages(page_off + len);
+ struct scatterlist *sg;
+ int i;
+
+- sg = rsp->cmd->inline_sg;
++ sg = &rsp->cmd->inline_sg[page_idx];
+ for (i = 0; i < sg_count; i++, sg++) {
+ if (i < sg_count - 1)
+ sg_unmark_end(sg);
+ else
+ sg_mark_end(sg);
+- sg->offset = off;
+- sg->length = min_t(int, len, PAGE_SIZE - off);
++ sg->offset = page_off;
++ sg->length = min_t(u64, len, PAGE_SIZE - page_off);
+ len -= sg->length;
+- if (!i)
+- off = 0;
++ page_off = 0;
+ }
+
+- rsp->req.sg = rsp->cmd->inline_sg;
++ rsp->req.sg = &rsp->cmd->inline_sg[page_idx];
+ rsp->req.sg_cnt = sg_count;
+ }
+
--- /dev/null
+From 754e9e49b76fd5be339172aa98544182ed3ca75e Mon Sep 17 00:00:00 2001
+From: Holger Dengler <dengler@linux.ibm.com>
+Date: Tue, 23 Jun 2026 16:20:31 +0200
+Subject: pkey: Move keytype check from pkey api to handler
+
+From: Holger Dengler <dengler@linux.ibm.com>
+
+commit 754e9e49b76fd5be339172aa98544182ed3ca75e upstream.
+
+The PKEY_VERIFYPROTK ioctl takes data from user-space and verifies the
+contained protected key. While checking the integrity of the ioctl
+request structure is the responsibility of the generic pkey_api code,
+the verification of the contained protected key is the responsibility
+of the pkey handler.
+
+The keytype verification (based on the calculated bitsize of the key)
+is part of the protected key verification and therefore the
+responsibility of the pkey handler (which already verifies
+it). Therefore the keytype verification is removed from the generic
+pkey_api code.
+
+As the calculation of the key bitsize is currently wrong, the removal
+of the keytype check in pkey_api also removes this wrong
+calculation. For this reason, the commit is flagged with the Fixes:
+tag.
+
+Cc: stable@kernel.org # 6.12+
+Fixes: 8fcc231ce3be ("s390/pkey: Introduce pkey base with handler registry and handler modules")
+Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/crypto/pkey_api.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/drivers/s390/crypto/pkey_api.c
++++ b/drivers/s390/crypto/pkey_api.c
+@@ -325,7 +325,6 @@ static int pkey_ioctl_verifyprotk(struct
+ {
+ struct pkey_verifyprotk kvp;
+ struct protaeskeytoken *t;
+- u32 keytype;
+ u8 *tmpbuf;
+ int rc;
+
+@@ -339,14 +338,6 @@ static int pkey_ioctl_verifyprotk(struct
+ return -EINVAL;
+ }
+
+- keytype = pkey_aes_bitsize_to_keytype(8 * kvp.protkey.len);
+- if (!keytype) {
+- PKEY_DBF_ERR("%s unknown/unsupported protkey length %u\n",
+- __func__, kvp.protkey.len);
+- memzero_explicit(&kvp, sizeof(kvp));
+- return -EINVAL;
+- }
+-
+ /* build a 'protected key token' from the raw protected key */
+ tmpbuf = kzalloc(sizeof(*t), GFP_KERNEL);
+ if (!tmpbuf) {
+@@ -356,7 +347,7 @@ static int pkey_ioctl_verifyprotk(struct
+ t = (struct protaeskeytoken *)tmpbuf;
+ t->type = TOKTYPE_NON_CCA;
+ t->version = TOKVER_PROTECTED_KEY;
+- t->keytype = keytype;
++ t->keytype = kvp.protkey.type;
+ t->len = kvp.protkey.len;
+ memcpy(t->protkey, kvp.protkey.protkey, kvp.protkey.len);
+
--- /dev/null
+From 428b9fd2dce50b4dc5cd9ade10b92efcf57ce7aa Mon Sep 17 00:00:00 2001
+From: Daniel Gibson <daniel@gibson.sh>
+Date: Thu, 11 Jun 2026 17:04:25 +0200
+Subject: platform/x86/amd/pmc: Add delay_suspend module parameter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Gibson <daniel@gibson.sh>
+
+commit 428b9fd2dce50b4dc5cd9ade10b92efcf57ce7aa upstream.
+
+Enabling the new delay_suspend module parameter delays suspend for
+2.5 seconds which is known to help for some AMD-based Lenovo Laptops
+that otherwise failed to send/receive events for key presses or the
+lid switch after s2idle. Apparently the EC needs to do some things
+in the background before suspend or it gets into a bad state.
+
+There are many reports of AMD-based laptops (mostly but not exclusively
+IdeaPads) about similar issues on the web; this parameter gives
+affected users an easy way to try out if their issues have the same
+root cause and to work around them until their specific device is added
+to the quirks list.
+
+The parameter description has a note encouraging users to report
+their device so it can be added to the quirks list, inspired by a
+similar request in parameter descriptions of the ideapad-laptop module.
+
+The module parameter can be set to "1" to explicitly enable it,
+"0" to disable it even on devices that are assumed to be affected,
+or -1 (the default) to enable it if the device is assumed to be affected
+(according to fwbug_list[])
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221383
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Daniel Gibson <daniel@gibson.sh>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260611150426.3683372-4-daniel@gibson.sh
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -16,6 +16,7 @@
+ #include <linux/bits.h>
+ #include <linux/debugfs.h>
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+ #include <linux/io.h>
+ #include <linux/iopoll.h>
+ #include <linux/limits.h>
+@@ -161,6 +162,11 @@ static bool dump_custom_stb;
+ module_param(dump_custom_stb, bool, 0644);
+ MODULE_PARM_DESC(dump_custom_stb, "Enable to dump full STB buffer");
+
++static int delay_suspend = -1;
++module_param(delay_suspend, int, 0644);
++MODULE_PARM_DESC(delay_suspend,
++ "Delays s2idle by 2.5 seconds to work around buggy ECs, often causing keyboard issues after suspend. 0: don't delay, 1: do delay, -1 (default): let amd_pmc decide. If you need this please report this to: platform-driver-x86@vger.kernel.org");
++
+ static struct amd_pmc_dev pmc;
+ static int amd_pmc_send_cmd(struct amd_pmc_dev *dev, u32 arg, u32 *data, u8 msg, bool ret);
+ static int amd_pmc_read_stb(struct amd_pmc_dev *dev, u32 *buf);
+@@ -886,8 +892,23 @@ static bool amd_pmc_want_suspend_delay(s
+ *
+ * See https://bugzilla.kernel.org/show_bug.cgi?id=221383
+ */
+- if (!disable_workarounds && amd_pmc_quirk_need_suspend_delay(pdev)) {
+- dev_info(pdev->dev, "Delaying suspend by 2.5s to avoid platform bug\n");
++ if (amd_pmc_quirk_need_suspend_delay(pdev)) {
++ /*
++ * delay_suspend=1 force-enables this, otherwise it can be
++ * disabled with disable_workarounds or delay_suspend=0
++ */
++ if (delay_suspend == 1 || (delay_suspend == -1 && !disable_workarounds)) {
++ dev_info(pdev->dev, "Delaying suspend by 2.5s to avoid platform bug\n");
++ return true;
++ }
++ dev_info(pdev->dev, "Not delaying suspend because of module parameter, even though your device is assumed to need it!\n");
++ } else if (delay_suspend == 1) {
++ dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
++ dmi_get_system_info(DMI_SYS_VENDOR),
++ dmi_get_system_info(DMI_PRODUCT_NAME),
++ dmi_get_system_info(DMI_PRODUCT_FAMILY),
++ dmi_get_system_info(DMI_BOARD_VENDOR),
++ dmi_get_system_info(DMI_BOARD_NAME));
+ return true;
+ }
+ return false;
--- /dev/null
+From 3bdd6fc11fbfa8249483f4b716ead51e43e3a0cd Mon Sep 17 00:00:00 2001
+From: Daniel Gibson <daniel@gibson.sh>
+Date: Thu, 11 Jun 2026 17:04:23 +0200
+Subject: platform/x86/amd/pmc: Check for intermediate wakeup in function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Gibson <daniel@gibson.sh>
+
+commit 3bdd6fc11fbfa8249483f4b716ead51e43e3a0cd upstream.
+
+Refactor code introduced by commit 9f5595d5f03f ("pmc: Require at
+least 2.5 seconds between HW sleep cycles") to allow adding different
+conditions for that delay in an upcoming change.
+
+Signed-off-by: Daniel Gibson <daniel@gibson.sh>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260611150426.3683372-2-daniel@gibson.sh
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -859,6 +859,19 @@ static int amd_pmc_verify_czn_rtc(struct
+ return rc;
+ }
+
++static bool amd_pmc_intermediate_wakeup_need_delay(struct amd_pmc_dev *pdev)
++{
++ /*
++ * Starting a new HW sleep cycle right after waking from one
++ * can cause electrical problems triggering the over voltage protection.
++ * That is avoided by delaying the next suspend a bit, see also
++ * https://lore.kernel.org/all/20250414162446.3853194-1-superm1@kernel.org/
++ */
++ struct smu_metrics table;
++
++ return get_metrics_table(pdev, &table) == 0 && table.s0i3_last_entry_status;
++}
++
+ static void amd_pmc_s2idle_prepare(void)
+ {
+ struct amd_pmc_dev *pdev = &pmc;
+@@ -893,11 +906,9 @@ static void amd_pmc_s2idle_prepare(void)
+ static void amd_pmc_s2idle_check(void)
+ {
+ struct amd_pmc_dev *pdev = &pmc;
+- struct smu_metrics table;
+ int rc;
+
+- /* Avoid triggering OVP */
+- if (!get_metrics_table(pdev, &table) && table.s0i3_last_entry_status)
++ if (amd_pmc_intermediate_wakeup_need_delay(pdev))
+ msleep(2500);
+
+ /* Dump the IdleMask before we add to the STB */
--- /dev/null
+From 9b9e60dd31da054a37d601e9fcabdfd8a2bff354 Mon Sep 17 00:00:00 2001
+From: Daniel Gibson <daniel@gibson.sh>
+Date: Thu, 11 Jun 2026 17:04:24 +0200
+Subject: platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Gibson <daniel@gibson.sh>
+
+commit 9b9e60dd31da054a37d601e9fcabdfd8a2bff354 upstream.
+
+Some IdeaPad Slim 3 devices and similar with AMD CPUs have a
+nonfunctional keyboard and lid switch after s2idle.
+
+It helps to delay suspend by 2.5 seconds so the EC has some time
+to do whatever it needs to get done before suspend - unfortunately
+at least on my 16ABR8 waking it with a timer (wakealarm) still
+triggers the issue, but at least normal resume via keypress or
+lid works fine. On the 14ARP10 wakealarm has been reported to also
+work fine with this patch.
+
+This issue has been reported for many different devices, this patch
+has been tested with the Zen3-based IdeaPad Slim 3 16ABR8 (82XR)
+and the Zen3+-based IdeaPad Slim 3 14ARP10 (83K6) and IdeaPad Slim 3
+15ARP10 (83MM).
+
+Reported-by: Sindre Henriksen <sindrehenriksen93@gmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221383
+Tested-by: Sindre Henriksen <sindrehenriksen93@gmail.com>
+Suggested-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Daniel Gibson <daniel@gibson.sh>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260611150426.3683372-3-daniel@gibson.sh
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 39 ++++++++++++++++++++++++++++++
+ drivers/platform/x86/amd/pmc/pmc.c | 24 +++++++++++++++++-
+ drivers/platform/x86/amd/pmc/pmc.h | 1
+ 3 files changed, 63 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -17,6 +17,7 @@
+ struct quirk_entry {
+ u32 s2idle_bug_mmio;
+ bool spurious_8042;
++ bool need_suspend_delay;
+ };
+
+ static struct quirk_entry quirk_s2idle_bug = {
+@@ -27,6 +28,10 @@ static struct quirk_entry quirk_spurious
+ .spurious_8042 = true,
+ };
+
++static struct quirk_entry quirk_s2idle_need_suspend_delay = {
++ .need_suspend_delay = true,
++};
++
+ static const struct dmi_system_id fwbug_list[] = {
+ {
+ .ident = "L14 Gen2 AMD",
+@@ -197,6 +202,35 @@ static const struct dmi_system_id fwbug_
+ DMI_MATCH(DMI_PRODUCT_NAME, "82XQ"),
+ }
+ },
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=221383 */
++ {
++ .ident = "Zen3-based IdeaPad Slim and similar",
++ .driver_data = &quirk_s2idle_need_suspend_delay,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ /*
++ * Note: there are also some Zen2-based 82X* devices that
++ * need different quirks, they're already handled above
++ */
++ DMI_MATCH(DMI_PRODUCT_NAME, "82X"),
++ }
++ },
++ {
++ .ident = "Zen3+-based IdeaPad Slim and similar",
++ .driver_data = &quirk_s2idle_need_suspend_delay,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83K"),
++ }
++ },
++ {
++ .ident = "IdeaPad Slim 3 15ARP10 (83MM)",
++ .driver_data = &quirk_s2idle_need_suspend_delay,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83MM"),
++ }
++ },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=221273 */
+ {
+ .ident = "Thinkpad L14 Gen3",
+@@ -350,6 +384,11 @@ void amd_pmc_process_restore_quirks(stru
+ amd_pmc_skip_nvme_smi_handler(dev->quirks->s2idle_bug_mmio);
+ }
+
++bool amd_pmc_quirk_need_suspend_delay(struct amd_pmc_dev *dev)
++{
++ return dev->quirks && dev->quirks->need_suspend_delay;
++}
++
+ void amd_pmc_quirks_init(struct amd_pmc_dev *dev)
+ {
+ const struct dmi_system_id *dmi_id;
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -872,6 +872,27 @@ static bool amd_pmc_intermediate_wakeup_
+ return get_metrics_table(pdev, &table) == 0 && table.s0i3_last_entry_status;
+ }
+
++static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
++{
++ /*
++ * Some Lenovo Laptops (like different IdeaPad 3 Slims) need some
++ * me-time before sleeping or they get uncooperative after waking
++ * up and don't send events for keyboard and lid switch anymore.
++ *
++ * Unfortunately this doesn't entirely fix the problem: It can still
++ * happen when resuming with a timer (wakealarm), but at least the
++ * more common usecases (wakeup by opening lid or pressing a key)
++ * work fine with this workaround.
++ *
++ * See https://bugzilla.kernel.org/show_bug.cgi?id=221383
++ */
++ if (!disable_workarounds && amd_pmc_quirk_need_suspend_delay(pdev)) {
++ dev_info(pdev->dev, "Delaying suspend by 2.5s to avoid platform bug\n");
++ return true;
++ }
++ return false;
++}
++
+ static void amd_pmc_s2idle_prepare(void)
+ {
+ struct amd_pmc_dev *pdev = &pmc;
+@@ -908,7 +929,8 @@ static void amd_pmc_s2idle_check(void)
+ struct amd_pmc_dev *pdev = &pmc;
+ int rc;
+
+- if (amd_pmc_intermediate_wakeup_need_delay(pdev))
++ if (amd_pmc_intermediate_wakeup_need_delay(pdev) ||
++ amd_pmc_want_suspend_delay(pdev))
+ msleep(2500);
+
+ /* Dump the IdleMask before we add to the STB */
+--- a/drivers/platform/x86/amd/pmc/pmc.h
++++ b/drivers/platform/x86/amd/pmc/pmc.h
+@@ -53,6 +53,7 @@ struct amd_pmc_dev {
+ };
+
+ void amd_pmc_process_restore_quirks(struct amd_pmc_dev *dev);
++bool amd_pmc_quirk_need_suspend_delay(struct amd_pmc_dev *dev);
+ void amd_pmc_quirks_init(struct amd_pmc_dev *dev);
+ void amd_mp2_stb_init(struct amd_pmc_dev *dev);
+ void amd_mp2_stb_deinit(struct amd_pmc_dev *dev);
--- /dev/null
+From 037f0b03c663a247366673a807834389107995b7 Mon Sep 17 00:00:00 2001
+From: Daniel Gibson <daniel@gibson.sh>
+Date: Thu, 11 Jun 2026 17:04:26 +0200
+Subject: platform/x86/amd/pmc: Don't log during intermediate wakeups
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Gibson <daniel@gibson.sh>
+
+commit 037f0b03c663a247366673a807834389107995b7 upstream.
+
+The ECs in the IdeaPads that need the delay_suspend quirk send lots
+of messages when charging, which not only causes intermediate wakeups
+when suspended, but also prevents the device from reaching the deepest
+suspend state.
+
+Because of this amd_pmc_intermediate_wakeup_need_delay() returns false
+during intermediate wakeups and amd_pmc_want_suspend_delay() is called.
+So far it always logged its "Delaying suspend by 2.5s ..." messages
+then, which spams dmesg. This commit makes sure that those messages are
+only logged once per suspend.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221383
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Daniel Gibson <daniel@gibson.sh>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260611150426.3683372-5-daniel@gibson.sh
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 39 +++++++++++++++++++++++++++++--------
+ drivers/platform/x86/amd/pmc/pmc.h | 1
+ 2 files changed, 32 insertions(+), 8 deletions(-)
+
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -881,6 +881,20 @@ static bool amd_pmc_intermediate_wakeup_
+ static bool amd_pmc_want_suspend_delay(struct amd_pmc_dev *pdev)
+ {
+ /*
++ * intermediate_wakeup implies that the machine didn't get to deepest sleep
++ * state before - otherwise this function isn't called in amd_pmc_s2idle_check()
++ * because amd_pmc_intermediate_wakeup_need_delay() returns true first.
++ * On some IdeaPads that happens when charging, because the EC seems
++ * to send lots of messages then that wake the machine.
++ *
++ * But even in that case, the sleep here is necessary (on those IdeaPads),
++ * otherwise they wake up completely (resume) after a few seconds.
++ * So this variable is only used to avoid spamming dmesg on each
++ * intermediate wakeup.
++ */
++ bool intermediate_wakeup = !pdev->is_first_check_after_suspend;
++
++ /*
+ * Some Lenovo Laptops (like different IdeaPad 3 Slims) need some
+ * me-time before sleeping or they get uncooperative after waking
+ * up and don't send events for keyboard and lid switch anymore.
+@@ -898,17 +912,20 @@ static bool amd_pmc_want_suspend_delay(s
+ * disabled with disable_workarounds or delay_suspend=0
+ */
+ if (delay_suspend == 1 || (delay_suspend == -1 && !disable_workarounds)) {
+- dev_info(pdev->dev, "Delaying suspend by 2.5s to avoid platform bug\n");
++ if (!intermediate_wakeup)
++ dev_info(pdev->dev, "Delaying suspend by 2.5s to avoid platform bug\n");
+ return true;
+ }
+- dev_info(pdev->dev, "Not delaying suspend because of module parameter, even though your device is assumed to need it!\n");
++ if (!intermediate_wakeup)
++ dev_info(pdev->dev, "Not delaying suspend because of module parameter, even though your device is assumed to need it!\n");
+ } else if (delay_suspend == 1) {
+- dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
+- dmi_get_system_info(DMI_SYS_VENDOR),
+- dmi_get_system_info(DMI_PRODUCT_NAME),
+- dmi_get_system_info(DMI_PRODUCT_FAMILY),
+- dmi_get_system_info(DMI_BOARD_VENDOR),
+- dmi_get_system_info(DMI_BOARD_NAME));
++ if (!intermediate_wakeup)
++ dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
++ dmi_get_system_info(DMI_SYS_VENDOR),
++ dmi_get_system_info(DMI_PRODUCT_NAME),
++ dmi_get_system_info(DMI_PRODUCT_FAMILY),
++ dmi_get_system_info(DMI_BOARD_VENDOR),
++ dmi_get_system_info(DMI_BOARD_NAME));
+ return true;
+ }
+ return false;
+@@ -921,6 +938,9 @@ static void amd_pmc_s2idle_prepare(void)
+ u8 msg;
+ u32 arg = 1;
+
++ /* Reset this variable because this is a fresh suspend */
++ pdev->is_first_check_after_suspend = true;
++
+ /* Reset and Start SMU logging - to monitor the s0i3 stats */
+ amd_pmc_setup_smu_logging(pdev);
+
+@@ -960,6 +980,9 @@ static void amd_pmc_s2idle_check(void)
+ rc = amd_pmc_write_stb(pdev, AMD_PMC_STB_S2IDLE_CHECK);
+ if (rc)
+ dev_err(pdev->dev, "error writing to STB: %d\n", rc);
++
++ /* remember that first check after suspend is done (until next prepare) */
++ pdev->is_first_check_after_suspend = false;
+ }
+
+ static int amd_pmc_dump_data(struct amd_pmc_dev *pdev)
+--- a/drivers/platform/x86/amd/pmc/pmc.h
++++ b/drivers/platform/x86/amd/pmc/pmc.h
+@@ -49,6 +49,7 @@ struct amd_pmc_dev {
+ struct dentry *dbgfs_dir;
+ struct quirk_entry *quirks;
+ bool disable_8042_wakeup;
++ bool is_first_check_after_suspend;
+ struct amd_mp2_dev *mp2;
+ };
+
--- /dev/null
+From 6e9cab2247e5b243ae2d907ce7c948a8a9c8d61a Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Tue, 9 Jun 2026 16:14:19 +0800
+Subject: platform/x86: dell-laptop: fix missing cleanups in init error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 6e9cab2247e5b243ae2d907ce7c948a8a9c8d61a upstream.
+
+dell_init() initializes several resources after dell_setup_rfkill(),
+including the optional touchpad LED, keyboard backlight LED, battery
+hook, debugfs directory and dell-laptop notifier.
+
+If a later LED or backlight registration fails, the error path only
+tears down the battery hook and rfkill resources. This leaves the
+notifier, debugfs directory, keyboard backlight LED and optional
+touchpad LED registered after dell_init() returns an error.
+
+Add the missing cleanup calls before tearing down rfkill.
+
+Fixes: 9c656b07997f ("platform/x86: dell-*: Call new led hw_changed API on kbd brightness change")
+Fixes: 037accfa14b2 ("dell-laptop: Add debugfs support")
+Fixes: 2d8b90be4f1c ("dell-laptop: support Synaptics/Alps touchpad led")
+Fixes: 6cff8d60aa0a ("platform: x86: dell-laptop: Add support for keyboard backlight")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Link: https://patch.msgid.link/20260609081419.1995169-1-lihaoxiang@isrc.iscas.ac.cn
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/dell/dell-laptop.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/platform/x86/dell/dell-laptop.c
++++ b/drivers/platform/x86/dell/dell-laptop.c
+@@ -2555,7 +2555,12 @@ fail_backlight:
+ if (mute_led_registered)
+ led_classdev_unregister(&mute_led_cdev);
+ fail_led:
++ dell_laptop_unregister_notifier(&dell_laptop_notifier);
++ debugfs_remove_recursive(dell_laptop_dir);
+ dell_battery_exit();
++ kbd_led_exit();
++ if (quirks && quirks->touchpad_led)
++ touchpad_led_exit();
+ dell_cleanup_rfkill();
+ fail_rfkill:
+ platform_device_del(platform_device);
--- /dev/null
+From 1ac287e2af9a9112fe271427ef45eceb26bce8b4 Mon Sep 17 00:00:00 2001
+From: Holger Dengler <dengler@linux.ibm.com>
+Date: Wed, 17 Jun 2026 19:06:39 +0200
+Subject: s390/pkey: Check length in pkey_pckmo handler implementation
+
+From: Holger Dengler <dengler@linux.ibm.com>
+
+commit 1ac287e2af9a9112fe271427ef45eceb26bce8b4 upstream.
+
+Explicitly check the length of the target buffer in the pkey_pckmo
+implementation of the key_to_protkey() handler function. The handler
+function fails, if the generated output data exceeds the length of the
+provided target buffer.
+
+Cc: stable@vger.kernel.org
+Fixes: 8fcc231ce3be ("s390/pkey: Introduce pkey base with handler registry and handler modules")
+Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/crypto/pkey_pckmo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/s390/crypto/pkey_pckmo.c
++++ b/drivers/s390/crypto/pkey_pckmo.c
+@@ -321,6 +321,10 @@ static int pckmo_key2protkey(const u8 *k
+ __func__, t->keytype);
+ goto out;
+ }
++ if (t->len > *protkeylen) {
++ rc = -EINVAL;
++ goto out;
++ }
+ memcpy(protkey, t->protkey, t->len);
+ *protkeylen = t->len;
+ *protkeytype = t->keytype;
--- /dev/null
+From b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970 Mon Sep 17 00:00:00 2001
+From: Holger Dengler <dengler@linux.ibm.com>
+Date: Mon, 15 Jun 2026 17:39:12 +0200
+Subject: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
+
+From: Holger Dengler <dengler@linux.ibm.com>
+
+commit b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970 upstream.
+
+Explicitly check the buffer length request structure provided by
+user-space and fail, if it exceeds the buffer size.
+
+Cc: stable@vger.kernel.org
+Fixes: 8fcc231ce3be ("s390/pkey: Introduce pkey base with handler registry and handler modules")
+Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/crypto/pkey_api.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/s390/crypto/pkey_api.c
++++ b/drivers/s390/crypto/pkey_api.c
+@@ -332,6 +332,13 @@ static int pkey_ioctl_verifyprotk(struct
+ if (copy_from_user(&kvp, uvp, sizeof(kvp)))
+ return -EFAULT;
+
++ if (kvp.protkey.len > sizeof(kvp.protkey.protkey)) {
++ PKEY_DBF_ERR("%s protkey length %u exceeds protkey buffer size\n",
++ __func__, kvp.protkey.len);
++ memzero_explicit(&kvp, sizeof(kvp));
++ return -EINVAL;
++ }
++
+ keytype = pkey_aes_bitsize_to_keytype(8 * kvp.protkey.len);
+ if (!keytype) {
+ PKEY_DBF_ERR("%s unknown/unsupported protkey length %u\n",
--- /dev/null
+From 9cb2d5291dbfe7bed565ead3337047dee9ed1064 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Mon, 22 Jun 2026 15:58:44 +0800
+Subject: scsi: elx: efct: Fix I/O leak on unsupported additional CDB
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 9cb2d5291dbfe7bed565ead3337047dee9ed1064 upstream.
+
+efct_dispatch_fcp_cmd() allocates an efct_io before dispatching an
+unsolicited FCP command. If the command has an unsupported additional
+CDB, the function returns -EIO before handing the IO to the SCSI layer.
+
+Free the allocated IO before returning from this error path.
+
+Fixes: f45ae6aac0a0 ("scsi: elx: efct: Unsolicited FC frame processing routines")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Link: https://patch.msgid.link/20260622075844.832871-1-haoxiang_li2024@163.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/elx/efct/efct_unsol.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/elx/efct/efct_unsol.c
++++ b/drivers/scsi/elx/efct/efct_unsol.c
+@@ -385,6 +385,7 @@ efct_dispatch_fcp_cmd(struct efct_node *
+
+ if (cmnd->fc_flags & FCP_CFL_LEN_MASK) {
+ efc_log_err(efct, "Additional CDB not supported\n");
++ efct_scsi_io_free(io);
+ return -EIO;
+ }
+ /*
--- /dev/null
+From 2c007acf7b31c39c08ce4959451ad00b19be4c1f Mon Sep 17 00:00:00 2001
+From: WenTao Liang <vulab@iscas.ac.cn>
+Date: Thu, 11 Jun 2026 13:30:37 +0800
+Subject: scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
+
+From: WenTao Liang <vulab@iscas.ac.cn>
+
+commit 2c007acf7b31c39c08ce4959451ad00b19be4c1f upstream.
+
+When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path
+returns -ENOSPC without releasing the reference obtained via
+kref_get_unless_zero() earlier in the function. All other error paths
+correctly drop the reference. This causes a permanent reference leak on the
+io_to_abort object.
+
+Additionally, the abort_in_progress flag is left set to true on this path,
+which means future abort attempts for the same I/O will immediately return
+-EINPROGRESS even though the abort was never submitted, effectively
+blocking recovery.
+
+Fix this by adding the missing kref_put() call and reset abort_in_progress
+to false, matching the cleanup done in the efct_hw_wq_write() failure path
+below.
+
+Cc: stable@vger.kernel.org
+Fixes: 63de51327a64 ("scsi: elx: efct: Hardware I/O and SGL initialization")
+Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Link: https://patch.msgid.link/20260611053037.63756-1-vulab@iscas.ac.cn
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/elx/efct/efct_hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/elx/efct/efct_hw.c
++++ b/drivers/scsi/elx/efct/efct_hw.c
+@@ -1998,6 +1998,8 @@ efct_hw_io_abort(struct efct_hw *hw, str
+ wqcb = efct_hw_reqtag_alloc(hw, efct_hw_wq_process_abort, io_to_abort);
+ if (!wqcb) {
+ efc_log_err(hw->os, "can't allocate request tag\n");
++ io_to_abort->abort_in_progress = false;
++ kref_put(&io_to_abort->ref, io_to_abort->release);
+ return -ENOSPC;
+ }
+
--- /dev/null
+From e166bafc483e927150cb9b5f286c9191ea0df84e Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Tue, 23 Jun 2026 00:00:28 +0800
+Subject: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit e166bafc483e927150cb9b5f286c9191ea0df84e upstream.
+
+If phys_disk->in_reset is set, the function returns directly without
+undoing the resources acquired for the command. Add the missing error
+cleanup by unmapping the IOACCEL2 SG chain block when needed, unmapping
+the SCSI command, and dropping the outstanding IOACCEL command count
+before returning.
+
+Fixes: c5dfd106414f ("scsi: hpsa: correct device resets")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Acked-by: Don Brace <don.brace@microchip.com>
+Link: https://patch.msgid.link/20260622160028.1240496-1-haoxiang_li2024@163.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/hpsa.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -5031,6 +5031,10 @@ static int hpsa_scsi_ioaccel2_queue_comm
+
+ if (phys_disk->in_reset) {
+ cmd->result = DID_RESET << 16;
++ atomic_dec(&phys_disk->ioaccel_cmds_out);
++ scsi_dma_unmap(cmd);
++ if (use_sg > h->ioaccel_maxsg)
++ hpsa_unmap_ioaccel2_sg_chain_block(h, cp);
+ return -1;
+ }
+
--- /dev/null
+From 1bd28625e25be549ee7c47532e7c3ef91c682410 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Tue, 7 Jul 2026 12:23:02 +0530
+Subject: scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 1bd28625e25be549ee7c47532e7c3ef91c682410 upstream.
+
+The memory allocated for mboxq using mempool_alloc() is not freed in
+some of the early exit error paths. Fix that by moving the
+mempool_free() call to an earlier point after last use.
+
+Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://patch.msgid.link/20260707065304.949135-1-nihaal@cse.iitm.ac.in
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -8192,6 +8192,7 @@ lpfc_sli4_driver_resource_setup(struct l
+ goto out_free_bsmbx;
+ }
+ }
++ mempool_free(mboxq, phba->mbox_mem_pool);
+
+ /*
+ * 1 for cmd, 1 for rsp, NVME adds an extra one
+@@ -8317,8 +8318,6 @@ lpfc_sli4_driver_resource_setup(struct l
+ goto out_free_sg_dma_buf;
+ }
+
+- mempool_free(mboxq, phba->mbox_mem_pool);
+-
+ /* Verify OAS is supported */
+ lpfc_sli4_oas_verify(phba);
+
--- /dev/null
+From 1d3a742afeb761eaead774691bde1ced699e9a5d Mon Sep 17 00:00:00 2001
+From: Xu Rao <raoxu@uniontech.com>
+Date: Tue, 7 Jul 2026 11:08:45 +0800
+Subject: scsi: sg: Report request-table problems when any status is set
+
+From: Xu Rao <raoxu@uniontech.com>
+
+commit 1d3a742afeb761eaead774691bde1ced699e9a5d upstream.
+
+SG_GET_REQUEST_TABLE reports per-request diagnostic state through
+sg_req_info::problem. The field is meant to indicate whether there is an
+error to report for a completed request.
+
+sg_fill_request_table() currently combines masked_status, host_status
+and driver_status with bitwise AND. This only reports a problem when all
+three status fields are non-zero at the same time. A normal target check
+condition, for example, has masked_status set while host_status and
+driver_status may both be zero, so the request is incorrectly reported
+as clean.
+
+Use the same condition as sg_new_read(), which sets SG_INFO_CHECK when
+any of the three status fields is non-zero.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/54B60C19F7DB8889+20260707030845.970018-1-raoxu@uniontech.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sg.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -862,10 +862,9 @@ sg_fill_request_table(Sg_fd *sfp, sg_req
+ if (val >= SG_MAX_QUEUE)
+ break;
+ rinfo[val].req_state = srp->done + 1;
+- rinfo[val].problem =
+- srp->header.masked_status &
+- srp->header.host_status &
+- srp->header.driver_status;
++ rinfo[val].problem = srp->header.masked_status ||
++ srp->header.host_status ||
++ srp->header.driver_status;
+ if (srp->done)
+ rinfo[val].duration =
+ srp->header.duration;
--- /dev/null
+From d04a179085c262c9ed577d0a4cbc6482ff1fd9a3 Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Thu, 11 Jun 2026 13:42:26 -0500
+Subject: scsi: target: Bound PR-OUT TransportID parsing to the received buffer
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit d04a179085c262c9ed577d0a4cbc6482ff1fd9a3 upstream.
+
+core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move()
+hand the raw PERSISTENT RESERVE OUT parameter buffer to
+target_parse_pr_out_transport_id() without telling it how many bytes are
+valid. For an iSCSI TransportID (FORMAT CODE 01b),
+iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with
+an unbounded strstr() (and on the error path prints the name with a further
+unbounded "%s"). An initiator can submit a TransportID whose iSCSI name
+contains neither a ",i,0x" substring nor a NUL terminator, filling the
+parameter list to its end, so the scan runs off the end of the buffer.
+
+When the parameter list spans more than one page the buffer is a multi-page
+vmap (transport_kmap_data_sg()), so the over-read walks into the trailing
+vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr). It
+is reachable by any fabric that delivers a PR OUT to a device exported
+through an iSCSI TPG, including a guest via vhost-scsi.
+
+Pass the number of received bytes down to the parser and validate the iSCSI
+TransportID's own self-described length (ADDITIONAL LENGTH + 4) once, up
+front: reject it if it is below the spc4r17 minimum or larger than the
+received buffer, then bound the separator search, the ISID walk and the
+name copy by that length. This is the length check the callers already
+perform after the parse (core_scsi3_decode_spec_i_port() compares tid_len
+against tpdl, core_scsi3_emulate_register_and_move() validates it against
+data_length), moved ahead of the scan. Also drop the unbounded "%s" of the
+unterminated name.
+
+Add per-format explicit name-length checks before copying into i_str,
+rather than silently truncating with min_t: for FORMAT CODE 00b reject if
+the descriptor body (tid_len - 4 bytes) cannot fit in
+i_str[TRANSPORT_IQN_LEN]; for FORMAT CODE 01b reject if the name portion
+(from &buf[4] up to the separator) cannot fit. Both checks make the bounds
+intent explicit at each format branch.
+
+While here, also reject a FORMAT CODE 01b TransportID whose ",i,0x"
+separator sits at the very end of the descriptor: that leaves an empty ISID
+and points the returned port nexus pointer at buf + tid_len, one past the
+descriptor, which the registration code (__core_scsi3_locate_pr_reg(),
+__core_scsi3_alloc_registration()) then dereferences as the ISID string --
+the same over-read of the parameter buffer for a malformed descriptor.
+
+Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Link: https://patch.msgid.link/20260611-b4-disp-9f20739e-v6-1-f6630e2aae44@proton.me
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_fabric_lib.c | 89 ++++++++++++++++++++++++--------
+ drivers/target/target_core_internal.h | 3 -
+ drivers/target/target_core_pr.c | 4 -
+ 3 files changed, 73 insertions(+), 23 deletions(-)
+
+--- a/drivers/target/target_core_fabric_lib.c
++++ b/drivers/target/target_core_fabric_lib.c
+@@ -289,13 +289,24 @@ static void sbp_parse_pr_out_transport_i
+ static bool iscsi_parse_pr_out_transport_id(
+ struct se_portal_group *se_tpg,
+ char *buf,
++ u32 buf_len,
+ u32 *out_tid_len,
+ char **port_nexus_ptr,
+ char *i_str)
+ {
+ char *p;
++ u32 tid_len;
+ int i;
+- u8 format_code = (buf[0] & 0xc0);
++ u8 format_code;
++
++ /*
++ * The 4-byte iSCSI TransportID header (FORMAT CODE + 2-byte ADDITIONAL
++ * LENGTH) must be present before any of it can be parsed.
++ */
++ if (buf_len < 4)
++ return false;
++
++ format_code = buf[0] & 0xc0;
+ /*
+ * Check for FORMAT CODE 00b or 01b from spc4r17, section 7.5.4.6:
+ *
+@@ -315,15 +326,17 @@ static bool iscsi_parse_pr_out_transport
+ return false;
+ }
+ /*
+- * If the caller wants the TransportID Length, we set that value for the
+- * entire iSCSI Tarnsport ID now.
++ * Reconstruct the self-described TransportID length from the ADDITIONAL
++ * LENGTH field plus the 4-byte header. Reject it if it is below the
++ * spc4r17 section 7.5.4.6 minimum (ADDITIONAL LENGTH shall be at least
++ * 20) or if it runs past the bytes actually received, so that every
++ * access below stays inside the TransportID.
+ */
+- if (out_tid_len) {
+- /* The shift works thanks to integer promotion rules */
+- *out_tid_len = get_unaligned_be16(&buf[2]);
+- /* Add four bytes for iSCSI Transport ID header */
+- *out_tid_len += 4;
+- }
++ tid_len = get_unaligned_be16(&buf[2]) + 4;
++ if (tid_len < 24 || tid_len > buf_len)
++ return false;
++ if (out_tid_len)
++ *out_tid_len = tid_len;
+
+ /*
+ * Check for ',i,0x' separator between iSCSI Name and iSCSI Initiator
+@@ -331,16 +344,32 @@ static bool iscsi_parse_pr_out_transport
+ * format.
+ */
+ if (format_code == 0x40) {
+- p = strstr(&buf[4], ",i,0x");
++ p = strnstr(&buf[4], ",i,0x", tid_len - 4);
+ if (!p) {
+- pr_err("Unable to locate \",i,0x\" separator"
+- " for Initiator port identifier: %s\n",
+- &buf[4]);
++ pr_err("Unable to locate \",i,0x\" separator in iSCSI TransportID\n");
++ return false;
++ }
++ /*
++ * The iSCSI name runs from &buf[4] up to the separator; reject it
++ * if it cannot fit in i_str[TRANSPORT_IQN_LEN].
++ */
++ if (p - &buf[4] >= TRANSPORT_IQN_LEN) {
++ pr_err("iSCSI Initiator port name too long in TransportID\n");
+ return false;
+ }
+ *p = '\0'; /* Terminate iSCSI Name */
+ p += 5; /* Skip over ",i,0x" separator */
+
++ /*
++ * The ISID must follow the separator. A ",i,0x" sitting at the
++ * very end of the TransportID leaves no ISID and would point the
++ * port nexus at buf + tid_len, i.e. past the descriptor, which
++ * the registration code then reads as the ISID string.
++ */
++ if (p >= buf + tid_len) {
++ pr_err("Missing ISID in iSCSI Initiator port TransportID\n");
++ return false;
++ }
+ *port_nexus_ptr = p;
+ /*
+ * Go ahead and do the lower case conversion of the received
+@@ -348,7 +377,7 @@ static bool iscsi_parse_pr_out_transport
+ * for comparison against the running iSCSI session's ISID from
+ * iscsi_target.c:lio_sess_get_initiator_sid()
+ */
+- for (i = 0; i < 12; i++) {
++ for (i = 0; i < 12 && p < buf + tid_len; i++) {
+ /*
+ * The first ISCSI INITIATOR SESSION ID field byte
+ * containing an ASCII null character terminates the
+@@ -366,10 +395,22 @@ static bool iscsi_parse_pr_out_transport
+ *p = tolower(*p);
+ p++;
+ }
+- } else
++ strscpy(i_str, &buf[4], TRANSPORT_IQN_LEN);
++ } else {
+ *port_nexus_ptr = NULL;
+-
+- strscpy(i_str, &buf[4], TRANSPORT_IQN_LEN);
++ /*
++ * FORMAT CODE 00b: the name occupies buf[4..tid_len-1]. The
++ * declared length tid_len - 4 must fit in i_str[TRANSPORT_IQN_LEN].
++ * (For 01b the same tid_len bound would be over-restrictive: the
++ * descriptor also carries the separator and ISID, so a legal
++ * <=223-byte name gives tid_len up to 244.)
++ */
++ if (tid_len - 4 >= TRANSPORT_IQN_LEN) {
++ pr_err("iSCSI Initiator port name too long in TransportID\n");
++ return false;
++ }
++ strscpy(i_str, &buf[4], tid_len - 4);
++ }
+ return true;
+ }
+
+@@ -419,8 +460,16 @@ int target_get_pr_transport_id(struct se
+ }
+
+ bool target_parse_pr_out_transport_id(struct se_portal_group *tpg,
+- char *buf, u32 *out_tid_len, char **port_nexus_ptr, char *i_str)
++ char *buf, u32 buf_len, u32 *out_tid_len,
++ char **port_nexus_ptr, char *i_str)
+ {
++ /*
++ * The fixed-length SAS/SRP/FCP/SBP TransportIDs are 24 bytes; the iSCSI
++ * format is variable and bounds itself against buf_len below.
++ */
++ if (tpg->proto_id != SCSI_PROTOCOL_ISCSI && buf_len < 24)
++ return false;
++
+ switch (tpg->proto_id) {
+ case SCSI_PROTOCOL_SAS:
+ /*
+@@ -439,8 +488,8 @@ bool target_parse_pr_out_transport_id(st
+ sbp_parse_pr_out_transport_id(buf, i_str);
+ break;
+ case SCSI_PROTOCOL_ISCSI:
+- return iscsi_parse_pr_out_transport_id(tpg, buf, out_tid_len,
+- port_nexus_ptr, i_str);
++ return iscsi_parse_pr_out_transport_id(tpg, buf, buf_len,
++ out_tid_len, port_nexus_ptr, i_str);
+ default:
+ pr_err("Unknown proto_id: 0x%02x\n", tpg->proto_id);
+ return false;
+--- a/drivers/target/target_core_internal.h
++++ b/drivers/target/target_core_internal.h
+@@ -104,7 +104,8 @@ int target_get_pr_transport_id(struct se
+ struct t10_pr_registration *pr_reg, int *format_code,
+ unsigned char *buf);
+ bool target_parse_pr_out_transport_id(struct se_portal_group *tpg,
+- char *buf, u32 *out_tid_len, char **port_nexus_ptr, char *i_str);
++ char *buf, u32 buf_len, u32 *out_tid_len,
++ char **port_nexus_ptr, char *i_str);
+
+ /* target_core_hba.c */
+ struct se_hba *core_alloc_hba(const char *, u32, u32);
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -1573,7 +1573,7 @@ core_scsi3_decode_spec_i_port(
+
+ iport_ptr = NULL;
+ tid_found = target_parse_pr_out_transport_id(tmp_tpg,
+- ptr, &tid_len, &iport_ptr, i_str);
++ ptr, tpdl, &tid_len, &iport_ptr, i_str);
+ if (!tid_found)
+ continue;
+ /*
+@@ -3281,7 +3281,7 @@ core_scsi3_emulate_pro_register_and_move
+ goto out;
+ }
+ tid_found = target_parse_pr_out_transport_id(dest_se_tpg,
+- &buf[24], &tmp_tid_len, &iport_ptr, initiator_str);
++ &buf[24], tid_len, &tmp_tid_len, &iport_ptr, initiator_str);
+ if (!tid_found) {
+ pr_err("SPC-3 PR REGISTER_AND_MOVE: Unable to locate"
+ " initiator_str from Transport ID\n");
--- /dev/null
+From fda6a1f3c3d7047b5ce5654487649c2daa738bfc Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Wed, 10 Jun 2026 04:22:48 +0000
+Subject: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit fda6a1f3c3d7047b5ce5654487649c2daa738bfc upstream.
+
+core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
+parameter list with transport_kmap_data_sg() and parses the destination
+TransportID with target_parse_pr_out_transport_id(). For an iSCSI
+TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns
+the ISID in iport_ptr as a raw pointer into that mapped buffer.
+
+The function then unmaps the buffer with transport_kunmap_data_sg() before
+dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and
+core_scsi3_alloc_registration(). When the parameter list spans more than
+one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses
+vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual
+address backing iport_ptr is torn down and every subsequent dereference is
+a use-after-free read of the unmapped region.
+
+Keep the parameter list mapped until iport_ptr is no longer needed: drop
+the early transport_kunmap_data_sg() and unmap once on the success path,
+right before returning. The error paths already unmap through the existing
+"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs
+on every post-map error exit because buf is no longer cleared early. Only
+reads of the mapping happen while spinlocks are held; the map and unmap
+calls remain outside any lock. The sibling caller
+core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it
+and is left unchanged.
+
+Fixes: 4949314c7283 ("target: Allow control CDBs with data > 1 page")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Link: https://patch.msgid.link/20260610042245.35473-1-hexlabsecurity@proton.me
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_pr.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -3289,9 +3289,6 @@ core_scsi3_emulate_pro_register_and_move
+ goto out;
+ }
+
+- transport_kunmap_data_sg(cmd);
+- buf = NULL;
+-
+ pr_debug("SPC-3 PR [%s] Extracted initiator %s identifier: %s"
+ " %s\n", dest_tf_ops->fabric_name, (iport_ptr != NULL) ?
+ "port" : "device", initiator_str, (iport_ptr != NULL) ?
+@@ -3528,6 +3525,11 @@ after_iport_check:
+ core_scsi3_update_and_write_aptpl(cmd->se_dev, aptpl);
+
+ core_scsi3_put_pr_reg(dest_pr_reg);
++ /*
++ * iport_ptr aliases the PR-OUT parameter list mapped above, so the
++ * buffer is unmapped only here on success (and at out: on error).
++ */
++ transport_kunmap_data_sg(cmd);
+ return 0;
+ out:
+ if (buf)
--- /dev/null
+From 66aefc277ebb796ec285d550305535dc3fc0179f Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Thu, 11 Jun 2026 08:30:46 -0400
+Subject: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit 66aefc277ebb796ec285d550305535dc3fc0179f upstream.
+
+scsiback_device_action() obtains a command tag in
+scsiback_get_pend_req() and submits a task-management request with
+target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and
+scsiback jumps to the err: label, which sends a response but frees
+nothing, leaking the tag.
+
+Impact: a pvSCSI guest can leak the command tags of a LUN's session,
+stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests
+whenever target_submit_tmr() fails.
+
+transport_generic_free_cmd() cannot be used here. By the time
+target_submit_tmr() returns an error it has already run
+__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its
+target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via
+core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the
+pointer dangling. Letting the command release run target_free_cmd_mem()
+would then double-free se_tmr_req.
+
+Use the same helper, which returns just the tag, on this path too.
+
+Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Link: https://patch.msgid.link/20260611123046.2323342-3-michael.bommarito@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/xen-scsiback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -640,7 +640,7 @@ static void scsiback_device_action(struc
+ return;
+
+ err:
+- scsiback_do_resp_with_sense(NULL, err, 0, pending_req);
++ scsiback_resp_and_free(pending_req, err);
+ }
+
+ /*
--- /dev/null
+From ca978f8a93d4d36841839bf2847d29b88c2591d6 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Thu, 11 Jun 2026 08:30:45 -0400
+Subject: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit ca978f8a93d4d36841839bf2847d29b88c2591d6 upstream.
+
+scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend
+whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;
+the se_cmd is initialised (kref_init() via target_init_cmd()) only
+later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB
+path. The two error paths in scsiback_do_cmd_fn() taken before the
+command is submitted -- a failed scsiback_gnttab_data_map() and an
+unknown ring_req.act -- call
+transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a
+refcount of 0. That underflows it ("refcount_t: underflow;
+use-after-free") and, as the release function is not run, leaks the
+command tag.
+
+Impact: a pvSCSI guest can leak every command tag of a LUN's session,
+stopping the LUN, by submitting requests with a bad grant reference or
+an unknown request type; under panic_on_warn the refcount underflow
+panics the host.
+
+Add a helper that just returns the tag with target_free_tag() and sends
+the error response. It frees the tag while the v2p reference still pins
+the session, and snapshots the response fields beforehand because
+freeing the tag can let another ring reuse the pending_req slot.
+
+Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Link: https://patch.msgid.link/20260611123046.2323342-2-michael.bommarito@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/xen-scsiback.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -612,6 +612,25 @@ static void scsiback_disconnect(struct v
+ xenbus_unmap_ring_vfree(info->dev, info->ring.sring);
+ }
+
++/*
++ * Send the error response for a request that did not reach the target core
++ * and return its tag. Free the tag before the response drops the v2p
++ * reference that keeps the session alive, and snapshot what the response
++ * needs since returning the tag can let the slot be reused.
++ */
++static void scsiback_resp_and_free(struct vscsibk_pend *pending_req,
++ int32_t result)
++{
++ struct vscsibk_info *info = pending_req->info;
++ struct v2p_entry *v2p = pending_req->v2p;
++ struct se_session *se_sess = v2p->tpg->tpg_nexus->tvn_se_sess;
++ u16 rqid = pending_req->rqid;
++
++ target_free_tag(se_sess, &pending_req->se_cmd);
++ scsiback_send_response(info, NULL, result, 0, rqid);
++ kref_put(&v2p->kref, scsiback_free_translation_entry);
++}
++
+ static void scsiback_device_action(struct vscsibk_pend *pending_req,
+ enum tcm_tmreq_table act, int tag)
+ {
+@@ -793,9 +812,8 @@ static int scsiback_do_cmd_fn(struct vsc
+ case VSCSIIF_ACT_SCSI_CDB:
+ if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
+ scsiback_fast_flush_area(pending_req);
+- scsiback_do_resp_with_sense(NULL,
+- DID_ERROR << 16, 0, pending_req);
+- transport_generic_free_cmd(&pending_req->se_cmd, 0);
++ scsiback_resp_and_free(pending_req,
++ DID_ERROR << 16);
+ } else {
+ scsiback_cmd_exec(pending_req);
+ }
+@@ -809,9 +827,7 @@ static int scsiback_do_cmd_fn(struct vsc
+ break;
+ default:
+ pr_err_ratelimited("invalid request\n");
+- scsiback_do_resp_with_sense(NULL, DID_ERROR << 16, 0,
+- pending_req);
+- transport_generic_free_cmd(&pending_req->se_cmd, 0);
++ scsiback_resp_and_free(pending_req, DID_ERROR << 16);
+ break;
+ }
+
--- /dev/null
+From 1cd23ca80784223fa2204e16203f754da4e821f8 Mon Sep 17 00:00:00 2001
+From: Weiming Shi <bestswngs@gmail.com>
+Date: Fri, 3 Jul 2026 20:35:46 -0700
+Subject: sctp: validate STALE_COOKIE cause length before reading staleness
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+commit 1cd23ca80784223fa2204e16203f754da4e821f8 upstream.
+
+When an ERROR chunk with a STALE_COOKIE cause is received in the
+COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure
+of Staleness that follows the cause header:
+
+ err = (struct sctp_errhdr *)(chunk->skb->data);
+ stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
+
+err is the first cause in the chunk, not the STALE_COOKIE cause that
+caused the dispatch, and nothing guarantees the staleness field is
+present. sctp_walk_errors() only requires a cause to be as long as the
+4-byte header, so for a STALE_COOKIE cause of length 4 the read runs
+past the cause, and for a minimal ERROR chunk past skb->tail. The value
+is echoed to the peer in the Cookie Preservative of the reply INIT,
+leaking uninitialized memory.
+
+sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so
+check its length there and pass it to sctp_sf_do_5_2_6_stale(), which
+reads that cause instead of the first one. A STALE_COOKIE cause too
+short to hold the staleness field is discarded.
+
+The read is reachable by any peer that can drive an association into
+COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket
+in a user and network namespace.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Xiang Mei <xmei5@asu.edu>
+Assisted-by: Claude:claude-opus-4-8
+Cc: stable@vger.kernel.org
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/20260704033545.2438373-2-bestswngs@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/sm_statefuns.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -74,7 +74,8 @@ static enum sctp_disposition sctp_sf_do_
+ const struct sctp_association *asoc,
+ const union sctp_subtype type,
+ void *arg,
+- struct sctp_cmd_seq *commands);
++ struct sctp_cmd_seq *commands,
++ struct sctp_errhdr *err);
+ static enum sctp_disposition sctp_sf_shut_8_4_5(
+ struct net *net,
+ const struct sctp_endpoint *ep,
+@@ -2494,9 +2495,15 @@ enum sctp_disposition sctp_sf_cookie_ech
+ * errors.
+ */
+ sctp_walk_errors(err, chunk->chunk_hdr) {
+- if (SCTP_ERROR_STALE_COOKIE == err->cause)
+- return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
+- arg, commands);
++ if (err->cause != SCTP_ERROR_STALE_COOKIE)
++ continue;
++ /* The staleness is only meaningful if the cause is long
++ * enough to hold it; a shorter one is malformed.
++ */
++ if (ntohs(err->length) < sizeof(*err) + sizeof(__be32))
++ break;
++ return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
++ arg, commands, err);
+ }
+
+ /* It is possible to have malformed error causes, and that
+@@ -2538,13 +2545,13 @@ static enum sctp_disposition sctp_sf_do_
+ const struct sctp_association *asoc,
+ const union sctp_subtype type,
+ void *arg,
+- struct sctp_cmd_seq *commands)
++ struct sctp_cmd_seq *commands,
++ struct sctp_errhdr *err)
+ {
+ int attempts = asoc->init_err_counter + 1;
+- struct sctp_chunk *chunk = arg, *reply;
+ struct sctp_cookie_preserve_param bht;
+ struct sctp_bind_addr *bp;
+- struct sctp_errhdr *err;
++ struct sctp_chunk *reply;
+ u32 stale;
+
+ if (attempts > asoc->max_init_attempts) {
+@@ -2555,8 +2562,6 @@ static enum sctp_disposition sctp_sf_do_
+ return SCTP_DISPOSITION_DELETE_TCB;
+ }
+
+- err = (struct sctp_errhdr *)(chunk->skb->data);
+-
+ /* When calculating the time extension, an implementation
+ * SHOULD use the RTT information measured based on the
+ * previous COOKIE ECHO / ERROR exchange, and should add no
ocfs2-reject-dinodes-with-non-canonical-i_mode-type.patch
ocfs2-reject-dinodes-whose-i_rdev-disagrees-with-the-file-type.patch
ocfs2-reject-non-inline-dinodes-with-i_size-and-zero-i_clusters.patch
+fpga-dfl-add-bounds-check-in-dfh_get_param_size.patch
+bus-mhi-ep-protect-mhi_ep_handle_syserr-in-the-error-path.patch
+net-thunderbolt-fix-frags-overflow-by-bounding-frame_count.patch
+fpga-microchip-spi-fix-zero-header_size-oob-read-in-mpf_ops_parse_header.patch
+s390-pkey-check-length-in-pkey_verifyprotk-ioctl.patch
+s390-pkey-check-length-in-pkey_pckmo-handler-implementation.patch
+mtd-spi-nor-swp-improve-locking-user-experience.patch
+mtd-spi-nor-spansion-use-die-erase-for-multi-die-devices-only.patch
+mtd-rawnand-pause-continuous-reads-at-block-boundaries.patch
+mtd-maps-vmu-flash-fix-null-pointer-dereference-in-initialization.patch
+taskstats-retain-dead-thread-stats-in-tgid-queries.patch
+irqchip-crossbar-use-correct-index-in-crossbar_domain_free.patch
+tpm-tpm_tis_spi-use-wait_woken-in-wait_for_tmp_stat.patch
+tpm-tpm2-sessions-wait-for-async-kpp-completion-in-tpm_buf_append_salt.patch
+dmaengine-tegra-fix-burst-size-calculation.patch
+dmaengine-dw-edma-add-spinlock-to-protect-done_int_mask-and-abort_int_mask.patch
+platform-x86-dell-laptop-fix-missing-cleanups-in-init-error-path.patch
+platform-x86-amd-pmc-check-for-intermediate-wakeup-in-function.patch
+platform-x86-amd-pmc-delay-suspend-for-some-lenovo-laptops.patch
+platform-x86-amd-pmc-add-delay_suspend-module-parameter.patch
+platform-x86-amd-pmc-don-t-log-during-intermediate-wakeups.patch
+pkey-move-keytype-check-from-pkey-api-to-handler.patch
+smb-client-use-kvzalloc-for-megabyte-buffer-in-simple-fallocate.patch
+ksmbd-fix-integer-overflow-in-set_file_allocation_info.patch
+hwmon-ltc2992-add-missing-select-regmap_i2c-to-kconfig.patch
+hwmon-max6697-add-missing-select-regmap_i2c-to-kconfig.patch
+i2c-mediatek-fix-wrrd-for-socs-without-auto_restart-option.patch
+i2c-mlxbf-fix-use-after-free-in-mlxbf_i2c_init_resource.patch
+ice-fix-ice_init_link-error-return-preventing-probe.patch
+xen-gntdev-fix-error-handling-in-ioctl.patch
+xfrm-use-compat-translator-only-for-u64-alignment-mismatch.patch
+xfrm-xfrm_interface-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+tpm-fix-event_size-output-in-tpm1_binary_bios_measurements_show.patch
+tpm-make-the-tpm-character-devices-non-seekable.patch
+time-fix-off-by-one-in-compat-settimeofday-usec-validation.patch
+spi-uniphier-fix-completion-initialization-order-before-devm_request_irq.patch
+sctp-validate-stale_cookie-cause-length-before-reading-staleness.patch
+nfs-charge-unstable-writes-by-request-size-not-folio-size.patch
+nvmet-rdma-handle-inline-data-with-a-nonzero-offset.patch
+netdev-genl-report-napi-thread-pid-in-the-caller-s-pid-namespace.patch
+can-esd_usb-kill-anchored-urbs-before-freeing-netdevs.patch
+can-isotp-use-unconditional-synchronize_rcu-in-isotp_release.patch
+can-bcm-defer-rx_op-deallocation-to-workqueue-to-fix-thrtimer-uaf.patch
+can-bcm-fix-lockless-bound-ifindex-race-and-silent-rx_setup-failure.patch
+can-bcm-add-missing-rcu-list-annotations-and-operations.patch
+bpf-fork-wipe-bpf_storage-before-bailouts-that-access-it.patch
+bpf-add-missing-access_ok-call-to-copy_user_syms.patch
+block-fix-race-in-blk_time_get_ns-returning-0.patch
+net-sparx5-unregister-blocking-notifier-on-init-failure.patch
+dm-thin-metadata-fix-superblock-refcount-leak-on-snapshot-shadow-failure.patch
+dm-thin-metadata-fix-metadata-snapshot-consistency-on-commit-failure.patch
+dm-era-fix-out-of-bounds-memory-access-for-non-zero-start-sector.patch
+dm-bufio-fix-wrong-count-calculation-in-dm_bufio_issue_discard.patch
+dm-ioctl-fix-a-possible-overflow-in-list_version_get_info.patch
+dm-log-fix-a-bitset_size-overflow-on-32bit-machines.patch
+dm-stats-fix-dm_jiffies_to_msec64.patch
+dm-stats-fix-merge-accounting.patch
+dm_early_create-fix-freeing-used-table-on-dm_resume-failure.patch
+dm-integrity-fix-a-bug-if-the-bio-is-out-of-limits.patch
+dm-integrity-don-t-increment-hash_offset-twice.patch
+dm-verity-avoid-double-increment-of-use_bh_wq_enabled.patch
+dm-verity-fix-a-possible-null-pointer-dereference.patch
+dm-verity-increase-sprintf-buffer-size.patch
+dm-verity-make-error-counter-atomic.patch
+accel-ivpu-reject-firmware-log-with-size-smaller-than-header.patch
+scsi-hpsa-fix-dma-mapping-leak-on-ioaccel2-reset-path.patch
+scsi-lpfc-fix-memory-leak-in-lpfc_sli4_driver_resource_setup.patch
+scsi-sg-report-request-table-problems-when-any-status-is-set.patch
+scsi-xen-scsiback-free-the-command-tag-on-the-tmr-submit-failure-path.patch
+scsi-xen-scsiback-free-unsubmitted-command-instead-of-double-putting-it.patch
+scsi-target-bound-pr-out-transportid-parsing-to-the-received-buffer.patch
+scsi-target-core-fix-iscsi-isid-use-after-free-in-register-and-move.patch
+scsi-elx-efct-fix-refcount-leak-in-efct_hw_io_abort.patch
+scsi-elx-efct-fix-i-o-leak-on-unsupported-additional-cdb.patch
--- /dev/null
+From 806c00c23e3ce8eae397a40ced536ef88ae4e012 Mon Sep 17 00:00:00 2001
+From: Fredric Cover <fredric.cover.lkernel@gmail.com>
+Date: Sat, 11 Jul 2026 19:54:02 -0700
+Subject: smb: client: use kvzalloc() for megabyte buffer in simple fallocate
+
+From: Fredric Cover <fredric.cover.lkernel@gmail.com>
+
+commit 806c00c23e3ce8eae397a40ced536ef88ae4e012 upstream.
+
+Currently in smb3_simple_fallocate_range(), a 1 MB buffer is allocated
+using kzalloc(). Under heavy memory fragmentation, a contiguous 1 MB block
+of physical memory (an order-8 allocation) may not be available,
+causing the allocation to fail.
+
+This failure was observed during xfstests generic/013 on a 4GB RAM
+test machine running fsstress:
+
+fsstress: page allocation failure: order:8,
+mode:0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP),
+nodemask=(null),cpuset=/,mems_allowed=0
+
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5d/0x80
+ warn_alloc+0x163/0x190
+ __alloc_pages_slowpath.constprop.0+0x71b/0x12f0
+ __alloc_frozen_pages_noprof+0x2f6/0x340
+ alloc_pages_mpol+0xb6/0x170
+ ___kmalloc_large_node+0xb3/0xd0
+ __kmalloc_large_noprof+0x1e/0xc0
+ smb3_simple_falloc.isra.0+0x62b/0x960
+ cifs_fallocate+0xed/0x180
+ vfs_fallocate+0x165/0x3c0
+ __x64_sys_fallocate+0x48/0xa0
+ do_syscall_64+0xe1/0x640
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Node 0 Normal: 3375*4kB ... 7*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB
+
+Since this scratch buffer does not require physically contiguous memory,
+switch the allocation to kvzalloc(). This retains the performance
+benefits of kmalloc() under normal conditions, while gracefully falling
+back to virtually contiguous memory when physical allocation fails.
+
+Fixes: 966a3cb7c7db ("cifs: improve fallocate emulation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
+Tested-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/smb2ops.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -3496,7 +3496,7 @@ static int smb3_simple_fallocate_range(u
+ if (rc)
+ goto out;
+
+- buf = kzalloc(1024 * 1024, GFP_KERNEL);
++ buf = kvzalloc(1024 * 1024, GFP_KERNEL);
+ if (buf == NULL) {
+ rc = -ENOMEM;
+ goto out;
+@@ -3553,7 +3553,7 @@ static int smb3_simple_fallocate_range(u
+
+ out:
+ kfree(out_data);
+- kfree(buf);
++ kvfree(buf);
+ return rc;
+ }
+
--- /dev/null
+From f3ad1c87d8201e54b66bd6072442f0b5d5a308ee Mon Sep 17 00:00:00 2001
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Date: Tue, 16 Jun 2026 10:12:23 +0900
+Subject: spi: uniphier: Fix completion initialization order before devm_request_irq()
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+commit f3ad1c87d8201e54b66bd6072442f0b5d5a308ee upstream.
+
+The driver calls devm_request_irq() before initializing the completion
+used by the interrupt handler. Because the interrupt may occur immediately
+after devm_request_irq(), the handler may execute before init_completion().
+
+This may result in calling complete() on an uninitialized completion,
+causing undefined behavior. This has been observed with KASAN.
+
+Fix this by initializing the completion before registering the IRQ.
+
+Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
+Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
+Fixes: 5ba155a4d4cc ("spi: add SPI controller driver for UniPhier SoC")
+Cc: stable@vger.kernel.org
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Link: https://patch.msgid.link/20260616011223.201357-1-hayashi.kunihiko@socionext.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-uniphier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-uniphier.c
++++ b/drivers/spi/spi-uniphier.c
+@@ -659,6 +659,8 @@ static int uniphier_spi_probe(struct pla
+ priv->host = host;
+ priv->is_save_param = false;
+
++ init_completion(&priv->xfer_done);
++
+ priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ if (IS_ERR(priv->base)) {
+ ret = PTR_ERR(priv->base);
+@@ -686,8 +688,6 @@ static int uniphier_spi_probe(struct pla
+ goto out_host_put;
+ }
+
+- init_completion(&priv->xfer_done);
+-
+ clk_rate = clk_get_rate(priv->clk);
+
+ host->max_speed_hz = DIV_ROUND_UP(clk_rate, SSI_MIN_CLK_DIVIDER);
--- /dev/null
+From b3e4fbb04220efc3bc022bcf31b5689d39c6b111 Mon Sep 17 00:00:00 2001
+From: Yiyang Chen <cyyzero16@gmail.com>
+Date: Mon, 13 Apr 2026 23:45:44 +0800
+Subject: taskstats: retain dead thread stats in TGID queries
+
+From: Yiyang Chen <cyyzero16@gmail.com>
+
+commit b3e4fbb04220efc3bc022bcf31b5689d39c6b111 upstream.
+
+Patch series "taskstats: fix TGID dead-thread stat retention", v3.
+
+This series fixes a taskstats TGID aggregation bug where fields added in
+the TGID query path were not preserved after thread exit, and adds a
+kselftest covering the regression.
+
+The first patch keeps the cached TGID aggregate used for dead threads in
+step with the fields already accumulated for live threads, and also fixes
+the final TGID exit notification emitted when group_dead is true.
+
+The second patch adds a kselftest that verifies TGID CPU stats do not
+regress after a worker thread exits and has been reaped.
+
+
+This patch (of 2):
+
+fill_stats_for_tgid() builds TGID stats from two sources: the cached
+aggregate in signal->stats and a scan of the live threads in the group.
+
+However, fill_tgid_exit() only accumulates delay accounting into
+signal->stats. This means that once a thread exits, TGID queries lose the
+fields that fill_stats_for_tgid() adds for live threads.
+
+This gap was introduced incrementally by two earlier changes that extended
+fill_stats_for_tgid() but did not make the corresponding update to
+fill_tgid_exit():
+
+- commit 8c733420bdd5 ("taskstats: add e/u/stime for TGID command")
+ added ac_etime, ac_utime, and ac_stime to the TGID query path.
+- commit b663a79c1915 ("taskstats: add context-switch counters")
+ added nvcsw and nivcsw to the TGID query path.
+
+As a result, those fields were accounted for live threads in TGID queries,
+but were dropped from the cached TGID aggregate after thread exit. The
+final TGID exit notification emitted when group_dead is true also copies
+that cached aggregate, so it loses the same fields.
+
+Factor the per-task TGID accumulation into tgid_stats_add_task() and use
+it in both fill_stats_for_tgid() and fill_tgid_exit(). This keeps the
+cached aggregate used for dead threads aligned with the live-thread
+accumulation used by TGID queries.
+
+Link: https://lore.kernel.org/cover.1776094300.git.cyyzero16@gmail.com
+Link: https://lore.kernel.org/abd2a15d33343636ab5ba43d540bcfe508bd66c7.1776094300.git.cyyzero16@gmail.com
+Fixes: 8c733420bdd5 ("taskstats: add e/u/stime for TGID command")
+Fixes: b663a79c1915 ("taskstats: add context-switch counters")
+Signed-off-by: Yiyang Chen <cyyzero16@gmail.com>
+Acked-by: Balbir Singh <balbirs@nvidia.com>
+Cc: Dr. Thomas Orgis <thomas.orgis@uni-hamburg.de>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Wang Yaxin <wang.yaxin@zte.com.cn>
+Cc: Yang Yang <yang.yang29@zte.com.cn>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/taskstats.c | 62 ++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 33 insertions(+), 29 deletions(-)
+
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -210,13 +210,39 @@ static int fill_stats_for_pid(pid_t pid,
+ return 0;
+ }
+
++static void tgid_stats_add_task(struct taskstats *stats,
++ struct task_struct *tsk, u64 now_ns)
++{
++ u64 delta, utime, stime;
++
++ /*
++ * Each accounting subsystem calls its functions here to
++ * accumulate its per-task stats for tsk, into the per-tgid structure
++ *
++ * per-task-foo(stats, tsk);
++ */
++ delayacct_add_tsk(stats, tsk);
++
++ /* calculate task elapsed time in nsec */
++ delta = now_ns - tsk->start_time;
++ /* Convert to micro seconds */
++ do_div(delta, NSEC_PER_USEC);
++ stats->ac_etime += delta;
++
++ task_cputime(tsk, &utime, &stime);
++ stats->ac_utime += div_u64(utime, NSEC_PER_USEC);
++ stats->ac_stime += div_u64(stime, NSEC_PER_USEC);
++
++ stats->nvcsw += tsk->nvcsw;
++ stats->nivcsw += tsk->nivcsw;
++}
++
+ static int fill_stats_for_tgid(pid_t tgid, struct taskstats *stats)
+ {
+ struct task_struct *tsk, *first;
+ unsigned long flags;
+ int rc = -ESRCH;
+- u64 delta, utime, stime;
+- u64 start_time;
++ u64 now_ns;
+
+ /*
+ * Add additional stats from live tasks except zombie thread group
+@@ -233,30 +259,12 @@ static int fill_stats_for_tgid(pid_t tgi
+ else
+ memset(stats, 0, sizeof(*stats));
+
+- start_time = ktime_get_ns();
++ now_ns = ktime_get_ns();
+ for_each_thread(first, tsk) {
+ if (tsk->exit_state)
+ continue;
+- /*
+- * Accounting subsystem can call its functions here to
+- * fill in relevant parts of struct taskstsats as follows
+- *
+- * per-task-foo(stats, tsk);
+- */
+- delayacct_add_tsk(stats, tsk);
+-
+- /* calculate task elapsed time in nsec */
+- delta = start_time - tsk->start_time;
+- /* Convert to micro seconds */
+- do_div(delta, NSEC_PER_USEC);
+- stats->ac_etime += delta;
+-
+- task_cputime(tsk, &utime, &stime);
+- stats->ac_utime += div_u64(utime, NSEC_PER_USEC);
+- stats->ac_stime += div_u64(stime, NSEC_PER_USEC);
+
+- stats->nvcsw += tsk->nvcsw;
+- stats->nivcsw += tsk->nivcsw;
++ tgid_stats_add_task(stats, tsk, now_ns);
+ }
+
+ unlock_task_sighand(first, &flags);
+@@ -275,18 +283,14 @@ out:
+ static void fill_tgid_exit(struct task_struct *tsk)
+ {
+ unsigned long flags;
++ u64 now_ns;
+
+ spin_lock_irqsave(&tsk->sighand->siglock, flags);
+ if (!tsk->signal->stats)
+ goto ret;
+
+- /*
+- * Each accounting subsystem calls its functions here to
+- * accumalate its per-task stats for tsk, into the per-tgid structure
+- *
+- * per-task-foo(tsk->signal->stats, tsk);
+- */
+- delayacct_add_tsk(tsk->signal->stats, tsk);
++ now_ns = ktime_get_ns();
++ tgid_stats_add_task(tsk->signal->stats, tsk, now_ns);
+ ret:
+ spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
+ return;
--- /dev/null
+From 269f2b43fae692d1f3988c9f888a6301aa537b82 Mon Sep 17 00:00:00 2001
+From: Wang Yan <wangyan01@kylinos.cn>
+Date: Mon, 22 Jun 2026 18:33:48 +0800
+Subject: time: Fix off-by-one in compat settimeofday() usec validation
+
+From: Wang Yan <wangyan01@kylinos.cn>
+
+commit 269f2b43fae692d1f3988c9f888a6301aa537b82 upstream.
+
+The compat version of settimeofday() uses '>' instead of '>=' when
+validating tv_usec against USEC_PER_SEC, allowing the value 1000000 to pass
+the check. After the subsequent conversion to nanoseconds (tv_nsec *=
+NSEC_PER_USEC), this results in tv_nsec == NSEC_PER_SEC, which violates the
+timespec invariant that tv_nsec must be strictly less than NSEC_PER_SEC.
+
+The native settimeofday() was already fixed in commit ce4abda5e126 ("time:
+Fix off-by-one in settimeofday() usec validation"), but the compat
+counterpart was missed.
+
+Fix it by using '>=' to reject tv_usec values outside the valid range [0,
+USEC_PER_SEC - 1].
+
+Fixes: 5e0fb1b57bea ("y2038: time: avoid timespec usage in settimeofday()")
+Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260622103348.120255-1-wangyan01@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -251,7 +251,7 @@ COMPAT_SYSCALL_DEFINE2(settimeofday, str
+ get_user(new_ts.tv_nsec, &tv->tv_usec))
+ return -EFAULT;
+
+- if (new_ts.tv_nsec > USEC_PER_SEC || new_ts.tv_nsec < 0)
++ if (new_ts.tv_nsec >= USEC_PER_SEC || new_ts.tv_nsec < 0)
+ return -EINVAL;
+
+ new_ts.tv_nsec *= NSEC_PER_USEC;
--- /dev/null
+From 1a58f6115bfb34eabcc7de8a3a9745b219179781 Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Mon, 15 Jun 2026 15:02:05 +0300
+Subject: tpm: fix event_size output in tpm1_binary_bios_measurements_show
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit 1a58f6115bfb34eabcc7de8a3a9745b219179781 upstream.
+
+Commit 186d124f07da ("tpm_eventlog.c: fix binary_bios_measurements")
+split the output to write the endian-converted event header first and
+then the variable-length event data.
+
+However, the split was at sizeof(struct tcpa_event) - 1, even though
+event_data was a zero-length array, and later a flexible array member,
+both of which already excluded the event data.
+
+Therefore, the current code writes the first three bytes of event_size
+from the endian-converted header and then the last byte from the raw
+header, which can emit a corrupted event_size on PPC64, where
+do_endian_conversion() maps to be32_to_cpu().
+
+Split one byte later to write the full endian-converted header first,
+followed by the variable-length event->event_data.
+
+Fixes: 186d124f07da ("tpm_eventlog.c: fix binary_bios_measurements")
+Cc: stable@vger.kernel.org # v5.10+
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/eventlog/tpm1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/tpm/eventlog/tpm1.c
++++ b/drivers/char/tpm/eventlog/tpm1.c
+@@ -236,12 +236,12 @@ static int tpm1_binary_bios_measurements
+
+ temp_ptr = (char *) &temp_event;
+
+- for (i = 0; i < (sizeof(struct tcpa_event) - 1) ; i++)
++ for (i = 0; i < sizeof(struct tcpa_event); i++)
+ seq_putc(m, temp_ptr[i]);
+
+ temp_ptr = (char *) v;
+
+- for (i = (sizeof(struct tcpa_event) - 1);
++ for (i = sizeof(struct tcpa_event);
+ i < (sizeof(struct tcpa_event) + temp_event.event_size); i++)
+ seq_putc(m, temp_ptr[i]);
+
--- /dev/null
+From f20d61c22bcaf172d6790b6500e3838e532e71c8 Mon Sep 17 00:00:00 2001
+From: Jaewon Yang <yong010301@gmail.com>
+Date: Mon, 13 Jul 2026 02:11:47 +0900
+Subject: tpm: Make the TPM character devices non-seekable
+
+From: Jaewon Yang <yong010301@gmail.com>
+
+commit f20d61c22bcaf172d6790b6500e3838e532e71c8 upstream.
+
+The TPM character devices expose a sequential command/response
+interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
+enabled.
+
+After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
+passes 0x1400 as *off to tpm_common_read(). The transfer length is
+bounded by response_length, but the offset is used unchecked when
+forming data_buffer + *off. A sufficiently large offset therefore causes
+an out-of-bounds heap read through copy_to_user() and, if the copy
+succeeds, an out-of-bounds zero-write through the following memset().
+
+Positional I/O does not provide coherent semantics for this interface.
+An arbitrary pread offset cannot represent how much of a response has
+been consumed sequentially. The write callback always stores a command
+at the start of data_buffer, while pwrite() does not update file->f_pos
+and can leave the sequential read cursor stale.
+
+Call nonseekable_open() from both open handlers. This removes
+FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
+fail with -ESPIPE before reaching the TPM callbacks, and explicitly
+marks the files non-seekable. Normal read() and write() continue to use
+the existing sequential f_pos cursor, leaving the response state machine
+unchanged.
+
+Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:
+
+ - sequential partial reads returned the complete response
+ - pread() and preadv() with offset 0x1400 returned -ESPIPE
+ - pwrite() and pwritev() with offset zero returned -ESPIPE
+ - the pending response remained intact after the rejected operations
+ - a subsequent normal command/response cycle completed normally
+ - no KASAN report was produced.
+
+Fixes: 9488585b21be ("tpm: add support for partial reads")
+Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Jaewon Yang <yong010301@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm-dev.c | 2 +-
+ drivers/char/tpm/tpmrm-dev.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/tpm/tpm-dev.c
++++ b/drivers/char/tpm/tpm-dev.c
+@@ -36,7 +36,7 @@ static int tpm_open(struct inode *inode,
+
+ tpm_common_open(file, chip, priv, NULL);
+
+- return 0;
++ return nonseekable_open(inode, file);
+
+ out:
+ clear_bit(0, &chip->is_open);
+--- a/drivers/char/tpm/tpmrm-dev.c
++++ b/drivers/char/tpm/tpmrm-dev.c
+@@ -29,7 +29,7 @@ static int tpmrm_open(struct inode *inod
+
+ tpm_common_open(file, chip, &priv->priv, &priv->space);
+
+- return 0;
++ return nonseekable_open(inode, file);
+ }
+
+ static int tpmrm_release(struct inode *inode, struct file *file)
--- /dev/null
+From 73851a7c43dfa52d2ed9415889b33daf85da0ed9 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Sun, 31 May 2026 08:44:28 -0400
+Subject: tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit 73851a7c43dfa52d2ed9415889b33daf85da0ed9 upstream.
+
+tpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls
+crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret()
+without installing a completion callback, discards both return values,
+and immediately frees the kpp_request via kpp_request_free(). When the
+resolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE,
+keembay-ocs), either operation returns -EINPROGRESS and the deferred
+completion worker dereferences the freed request.
+
+The path fires automatically from the hwrng_fillfn kernel thread via
+tpm_get_random -> tpm2_get_random -> tpm2_start_auth_session ->
+tpm_buf_append_salt on every entropy poll, without any userland action.
+
+Install crypto_req_done as the completion callback, wrap both KPP
+operations in crypto_wait_req(), and propagate errors to the caller.
+The wait is a no-op for synchronous backends.
+
+Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
+Cc: stable@vger.kernel.org # v6.10+
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Assisted-by: Claude:claude-opus-4-7
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm2-sessions.c | 45 +++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 11 deletions(-)
+
+--- a/drivers/char/tpm/tpm2-sessions.c
++++ b/drivers/char/tpm/tpm2-sessions.c
+@@ -534,15 +534,17 @@ static void tpm2_KDFe(u8 z[EC_PT_SZ], co
+ sha256_final(&sctx, out);
+ }
+
+-static void tpm_buf_append_salt(struct tpm_buf *buf, struct tpm_chip *chip,
+- struct tpm2_auth *auth)
++static int tpm_buf_append_salt(struct tpm_buf *buf, struct tpm_chip *chip,
++ struct tpm2_auth *auth)
+ {
+ struct crypto_kpp *kpp;
+ struct kpp_request *req;
++ DECLARE_CRYPTO_WAIT(wait);
+ struct scatterlist s[2], d[1];
+ struct ecdh p = {0};
+ u8 encoded_key[EC_PT_SZ], *x, *y;
+ unsigned int buf_len;
++ int rc;
+
+ /* secret is two sized points */
+ tpm_buf_append_u16(buf, (EC_PT_SZ + 2)*2);
+@@ -565,14 +567,15 @@ static void tpm_buf_append_salt(struct t
+ kpp = crypto_alloc_kpp("ecdh-nist-p256", CRYPTO_ALG_INTERNAL, 0);
+ if (IS_ERR(kpp)) {
+ dev_err(&chip->dev, "crypto ecdh allocation failed\n");
+- return;
++ return PTR_ERR(kpp);
+ }
+
+ buf_len = crypto_ecdh_key_len(&p);
+ if (sizeof(encoded_key) < buf_len) {
+ dev_err(&chip->dev, "salt buffer too small needs %d\n",
+ buf_len);
+- goto out;
++ rc = -EINVAL;
++ goto err_free_kpp;
+ }
+ crypto_ecdh_encode_key(encoded_key, buf_len, &p);
+ /* this generates a random private key */
+@@ -580,11 +583,17 @@ static void tpm_buf_append_salt(struct t
+
+ /* salt is now the public point of this private key */
+ req = kpp_request_alloc(kpp, GFP_KERNEL);
+- if (!req)
+- goto out;
++ if (!req) {
++ rc = -ENOMEM;
++ goto err_free_kpp;
++ }
++ kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
++ crypto_req_done, &wait);
+ kpp_request_set_input(req, NULL, 0);
+ kpp_request_set_output(req, s, EC_PT_SZ*2);
+- crypto_kpp_generate_public_key(req);
++ rc = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
++ if (rc)
++ goto err_free_req;
+ /*
+ * we're not done: now we have to compute the shared secret
+ * which is our private key multiplied by the tpm_key public
+@@ -596,8 +605,9 @@ static void tpm_buf_append_salt(struct t
+ kpp_request_set_input(req, s, EC_PT_SZ*2);
+ sg_init_one(d, auth->salt, EC_PT_SZ);
+ kpp_request_set_output(req, d, EC_PT_SZ);
+- crypto_kpp_compute_shared_secret(req);
+- kpp_request_free(req);
++ rc = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
++ if (rc)
++ goto err_free_req;
+
+ /*
+ * pass the shared secret through KDFe for salt. Note salt
+@@ -607,8 +617,16 @@ static void tpm_buf_append_salt(struct t
+ */
+ tpm2_KDFe(auth->salt, "SECRET", x, chip->null_ec_key_x, auth->salt);
+
+- out:
++ kpp_request_free(req);
+ crypto_free_kpp(kpp);
++ return 0;
++
++err_free_req:
++ kpp_request_free(req);
++
++err_free_kpp:
++ crypto_free_kpp(kpp);
++ return rc;
+ }
+
+ /**
+@@ -1061,7 +1079,12 @@ int tpm2_start_auth_session(struct tpm_c
+ tpm_buf_append(&buf, auth->our_nonce, sizeof(auth->our_nonce));
+
+ /* append encrypted salt and squirrel away unencrypted in auth */
+- tpm_buf_append_salt(&buf, chip, auth);
++ rc = tpm_buf_append_salt(&buf, chip, auth);
++ if (rc) {
++ tpm2_flush_context(chip, null_key);
++ tpm_buf_destroy(&buf);
++ goto out;
++ }
+ /* session type (HMAC, audit or policy) */
+ tpm_buf_append_u8(&buf, TPM2_SE_HMAC);
+
--- /dev/null
+From c0c9cfb3b75def8bf200a2d4db09015806acfeaf Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko@kernel.org>
+Date: Sat, 9 May 2026 21:51:07 +0300
+Subject: tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
+
+From: Jarkko Sakkinen <jarkko@kernel.org>
+
+commit c0c9cfb3b75def8bf200a2d4db09015806acfeaf upstream.
+
+wait_event_interruptible_timeout() evaluates its condition after setting
+the current task state to TASK_INTERRUPTIBLE.
+
+With CONFIG_DEBUG_ATOMIC_SLEEP this triggers a warning when the IRQ wait
+path is used:
+
+ tpm_tis_status()
+ tpm_tis_spi_read_bytes()
+ tpm_tis_spi_transfer_full()
+ spi_bus_lock()
+ mutex_lock()
+
+Address this with the following measures:
+
+1. Call wait_tpm_stat_cond() only while tasking is running.
+2. Use wait_woken() to wait for changes.
+
+Cc: stable@vger.kernel.org # v4.19+
+Cc: Linus Walleij <linusw@kernel.org>
+Reported-by: Stefan Wahren <wahrenst@gmx.net>
+Closes: https://lore.kernel.org/linux-integrity/6964bec7-3dbb-453b-89ef-9b990217a8b9@gmx.net/
+Fixes: 1a339b658d9d ("tpm_tis_spi: Pass the SPI IRQ down to the driver")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Tested-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 35 +++++++++++++++++++++--------------
+ 1 file changed, 21 insertions(+), 14 deletions(-)
+
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -66,8 +66,8 @@ static int wait_for_tpm_stat(struct tpm_
+ bool check_cancel)
+ {
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ unsigned long stop;
+- long rc;
+ u8 status;
+ bool canceled = false;
+ u8 sts_mask;
+@@ -87,23 +87,30 @@ static int wait_for_tpm_stat(struct tpm_
+ /* process status changes with irq support */
+ if (sts_mask) {
+ ret = -ETIME;
++ add_wait_queue(queue, &wait);
+ again:
++ if (wait_for_tpm_stat_cond(chip, sts_mask, check_cancel,
++ &canceled)) {
++ ret = canceled ? -ECANCELED : 0;
++ goto out;
++ }
++
+ timeout = stop - jiffies;
+ if ((long)timeout <= 0)
+- return -ETIME;
+- rc = wait_event_interruptible_timeout(*queue,
+- wait_for_tpm_stat_cond(chip, sts_mask, check_cancel,
+- &canceled),
+- timeout);
+- if (rc > 0) {
+- if (canceled)
+- return -ECANCELED;
+- ret = 0;
+- }
+- if (rc == -ERESTARTSYS && freezing(current)) {
+- clear_thread_flag(TIF_SIGPENDING);
+- goto again;
++ goto out;
++
++ if (signal_pending(current)) {
++ if (freezing(current)) {
++ clear_thread_flag(TIF_SIGPENDING);
++ goto again;
++ }
++ goto out;
+ }
++
++ wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
++ goto again;
++out:
++ remove_wait_queue(queue, &wait);
+ }
+
+ if (ret)
--- /dev/null
+From 45ca1afe2fd14c04e37227e79d3f8455831d8408 Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Mon, 22 Jun 2026 19:25:41 +0800
+Subject: xen/gntdev: fix error handling in ioctl
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit 45ca1afe2fd14c04e37227e79d3f8455831d8408 upstream.
+
+When gntdev_ioctl_map_grant_ref() fails to copy the operation result
+back to userspace after successfully adding the mapping to the list,
+the error path returns -EFAULT without releasing the reference
+acquired by gntdev_alloc_map(). The mapping remains in priv->maps
+with a refcount of 1, causing a memory leak and a dangling list
+entry.
+
+Additionally, gntdev_add_map() may modify map->index to avoid overlap
+with existing mappings. Therefore, the index returned to userspace
+must be obtained after gntdev_add_map() completes.
+
+Fix this by holding the mutex across gntdev_add_map(), retrieving
+the correct index, and copy_to_user(). If copy_to_user() fails,
+remove the mapping from the list and release the reference while
+still holding the lock.
+
+Cc: stable@vger.kernel.org
+
+Fix these issues by properly handling all error cases.
+
+Fixes: 1401c00e59ea ("xen/gntdev: convert priv->lock to a mutex")
+Fixes: 68b025c813c2 ("xen-gntdev: Add reference counting to maps")
+
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20260622112541.38194-1-vulab@iscas.ac.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/gntdev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -678,11 +678,15 @@ static long gntdev_ioctl_map_grant_ref(s
+ mutex_lock(&priv->lock);
+ gntdev_add_map(priv, map);
+ op.index = map->index << PAGE_SHIFT;
+- mutex_unlock(&priv->lock);
+
+- if (copy_to_user(u, &op, sizeof(op)) != 0)
++ if (copy_to_user(u, &op, sizeof(op)) != 0) {
++ list_del(&map->next);
++ mutex_unlock(&priv->lock);
++ gntdev_put_map(priv, map);
+ return -EFAULT;
++ }
+
++ mutex_unlock(&priv->lock);
+ return 0;
+ }
+
--- /dev/null
+From 355fbcbdc2539cca7890b0d0914d4ce0f985ad74 Mon Sep 17 00:00:00 2001
+From: Sanman Pradhan <psanman@juniper.net>
+Date: Sun, 7 Jun 2026 16:47:34 +0000
+Subject: xfrm: use compat translator only for u64 alignment mismatch
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+commit 355fbcbdc2539cca7890b0d0914d4ce0f985ad74 upstream.
+
+The XFRM compat layer (CONFIG_XFRM_USER_COMPAT) translates 32-bit xfrm
+netlink and setsockopt messages into the native 64-bit layout. It is
+only needed on architectures where the 32-bit and 64-bit ABIs disagree
+on u64 alignment, which the kernel encodes as COMPAT_FOR_U64_ALIGNMENT.
+
+That symbol is defined only by arch/x86. XFRM_USER_COMPAT depends on it,
+so the translator can never be built on any other architecture,
+including arm64, which still provides a 32-bit compat ABI (CONFIG_COMPAT)
+for AArch32 EL0 userspace. On arm64 the AArch32 EABI already aligns u64
+to 8 bytes, identical to the AArch64 ABI, so no translation is required
+and the native code path is correct for 32-bit tasks.
+
+However, xfrm_user_rcv_msg() and xfrm_user_policy() gate on
+in_compat_syscall() alone and then call xfrm_get_translator(), which
+returns NULL when no translator is registered. On arm64 that is always
+the case, so every xfrm netlink message and the XFRM_POLICY setsockopt
+issued by a 32-bit task returns -EOPNOTSUPP. A 32-bit userspace process
+on arm64 (and on any other arch with CONFIG_COMPAT but without
+COMPAT_FOR_U64_ALIGNMENT) therefore cannot configure XFRM state or
+policy through the XFRM_USER netlink API, and cannot use the XFRM_POLICY
+setsockopt path, because both fail before reaching the native parser.
+
+The translator series replaced the blanket compat rejection with a
+translator lookup. That made the path usable on x86 when the translator
+is available, but left architectures that cannot build the translator
+permanently rejected even when their compat layout already matches the
+native layout. Let those architectures use the native parser instead.
+
+Gate the translator requirement on COMPAT_FOR_U64_ALIGNMENT instead of
+on in_compat_syscall() alone. Gating on the ABI property rather than on
+CONFIG_XFRM_USER_COMPAT is deliberate: on x86 with IA32_EMULATION=y but
+XFRM_USER_COMPAT=n, a 32-bit task must still be rejected rather than
+routed through the native parser, which would misread genuinely
+4-byte-aligned x86-32 messages. COMPAT_FOR_U64_ALIGNMENT is the ABI
+property that makes the XFRM translator mandatory.
+
+Only the receive/input direction needs the guard. The send, dump and
+notification paths already call the translator as "if (xtr) { ... }"
+with no error on NULL, so on arches without a translator they no-op and
+the kernel emits native 64-bit-layout messages, which is what an AArch32
+task expects.
+
+Tested on Juniper SRX hardware: with the fix, 32-bit IPsec userspace
+netlink and XFRM_POLICY setsockopt operations that previously failed
+with -EOPNOTSUPP now succeed; x86 behaviour is unchanged by inspection.
+
+Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
+Fixes: 96392ee5a13b ("xfrm/compat: Translate 32-bit user_policy from sockptr")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_state.c | 2 +-
+ net/xfrm/xfrm_user.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -2892,7 +2892,7 @@ int xfrm_user_policy(struct sock *sk, in
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+
+- if (in_compat_syscall()) {
++ if (IS_ENABLED(CONFIG_COMPAT_FOR_U64_ALIGNMENT) && in_compat_syscall()) {
+ struct xfrm_translator *xtr = xfrm_get_translator();
+
+ if (!xtr) {
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -3364,7 +3364,7 @@ static int xfrm_user_rcv_msg(struct sk_b
+ if (!netlink_net_capable(skb, CAP_NET_ADMIN))
+ return -EPERM;
+
+- if (in_compat_syscall()) {
++ if (IS_ENABLED(CONFIG_COMPAT_FOR_U64_ALIGNMENT) && in_compat_syscall()) {
+ struct xfrm_translator *xtr = xfrm_get_translator();
+
+ if (!xtr)
--- /dev/null
+From 095515d89b19b6cc19dfcdc846f97403ed1ebce3 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:41 +0800
+Subject: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 095515d89b19b6cc19dfcdc846f97403ed1ebce3 upstream.
+
+xfrmi_changelink() operates on at most two netns, dev_net(dev) and the
+interface link netns xi->net. They differ once the device is created in
+or moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in xi->net can rewrite an interface that
+lives in xi->net.
+
+Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-8-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_interface_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/xfrm/xfrm_interface_core.c
++++ b/net/xfrm/xfrm_interface_core.c
+@@ -868,6 +868,9 @@ static int xfrmi_changelink(struct net_d
+ struct net *net = xi->net;
+ struct xfrm_if_parms p = {};
+
++ if (!rtnl_dev_link_net_capable(dev, net))
++ return -EPERM;
++
+ xfrmi_netlink_parms(data, &p);
+ if (!p.if_id) {
+ NL_SET_ERR_MSG(extack, "if_id must be non zero");
projects / thirdparty / kernel / stable-queue.git / commitdiff
