--- /dev/null
+From 34ee5651129814db9e6a01ee857f7679641536a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:32:05 +0200
+Subject: batman-adv: ensure minimal ethernet header on TX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream.
+
+As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
+at least eth header len bytes"), it is possible by for a local user with
+eBPF TC hook access to attach a tc filter which truncates the packet and
+redirects to an batadv interface. But the code assumes that at least
+ETH_HLEN bytes are available and thus might read outside of the available
+buffer.
+
+The batadv_interface_tx() must therefore always check itself if enough data
+is available for the ethernet header and don't rely on min_header_len.
+
+Cc: stable@vger.kernel.org
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 8b4a8e80c0a320..c044d0d46bf808 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -210,6 +210,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+
++ if (!pskb_may_pull(skb, ETH_HLEN))
++ goto dropped;
++
+ /* reset control block to avoid left overs from previous users */
+ memset(skb->cb, 0, sizeof(struct batadv_skb_cb));
+
+--
+2.53.0
+
--- /dev/null
+From 30f900e8a012532110896a87b24c3d7a07a05480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:24:35 +0200
+Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 035e1fed892d3d06002a73ff73668f618a514644 upstream.
+
+pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
+the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+This was done correctly for the VLAN header but missed for the ethernet
+header which is later used for the TT and AP isolation handling.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index c8c62b0cd54c76..8b4a8e80c0a320 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -454,6 +454,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+ goto dropped;
+
++ ethhdr = eth_hdr(skb);
+ vhdr = skb_vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
+--
+2.53.0
+
--- /dev/null
+From 0c0510e0f1a6c3028e617cfdc5e68135d7e83398 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 09:54:15 -0400
+Subject: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error
+ path
+
+From: Shivam Kumar <kumar.shivam43666@gmail.com>
+
+commit 4606467a75cfc16721937272ed29462a750b60c8 upstream.
+
+In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
+nvmet_req_uninit() is called unconditionally. However, if the command
+arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
+had returned false and percpu_ref_tryget_live() was never executed. The
+unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
+refcount underflow, leading to a WARNING in
+percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
+eventually a permanent workqueue deadlock.
+
+Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
+nvmet_req_uninit(), matching the existing pattern in
+nvmet_tcp_execute_request().
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+[shivam: inlined nvmet_tcp_finish_cmd() at the fix site for 5.10.y]
+Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 4bd82e9b113ff5..3d9a830950ef26 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1227,7 +1227,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue)
+ queue->idx, cmd->req.cmd->common.command_id,
+ queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
+ le32_to_cpu(cmd->exp_ddgst));
+- nvmet_tcp_finish_cmd(cmd);
++ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
++ nvmet_req_uninit(&cmd->req);
++ nvmet_tcp_free_cmd_buffers(cmd);
+ nvmet_tcp_fatal_error(queue);
+ ret = -EPROTO;
+ goto out;
+--
+2.53.0
+
ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch
ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
+nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch
+batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch
+batman-adv-ensure-minimal-ethernet-header-on-tx.patch
--- /dev/null
+From f426a180a5cd9299c65f4372ce877d546eb374a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:49:54 +0200
+Subject: batman-adv: clean untagged VLAN on netdev registration failure
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream.
+
+When an mesh interface is registered, it creates an untagged struct
+batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in
+this process, another receiver of this notification can veto the
+registration. The netdev registration will be aborted because of this veto.
+
+The register_netdevice() call will try to clean up the net_device using
+unregister_netdevice_queue() - which only uses the .priv_destructor to
+free private resources. In this situation, .dellink will not be called.
+
+The cleanup of the untagged batadv_meshif_vlan must thefore be done in the
+destructor to avoid a leak of this object.
+
+Cc: stable@vger.kernel.org
+Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
+[ switch to old "mesh_iface" name "soft_iface" ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/main.c | 8 ++++++++
+ net/batman-adv/soft-interface.c | 13 ++-----------
+ net/batman-adv/soft-interface.h | 2 ++
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index 1074e4762a1e6b..1a65dfd0c4c5b6 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -258,6 +258,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ void batadv_mesh_free(struct net_device *soft_iface)
+ {
+ struct batadv_priv *bat_priv = netdev_priv(soft_iface);
++ struct batadv_softif_vlan *vlan;
+
+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+
+@@ -273,6 +274,13 @@ void batadv_mesh_free(struct net_device *soft_iface)
+
+ batadv_mcast_free(bat_priv);
+
++ /* destroy the "untagged" VLAN */
++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
++ if (vlan) {
++ batadv_softif_destroy_vlan(bat_priv, vlan);
++ batadv_softif_vlan_put(vlan);
++ }
++
+ /* Free the TT and the originator tables only after having terminated
+ * all the other depending components which may use these structures for
+ * their purposes.
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index bdd6dd7fa77588..ef67bac290e36e 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -605,8 +605,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
+ * @bat_priv: the bat priv with all the soft interface information
+ * @vlan: the object to remove
+ */
+-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
+- struct batadv_softif_vlan *vlan)
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan)
+ {
+ /* explicitly remove the associated TT local entry because it is marked
+ * with the NOPURGE flag
+@@ -1088,22 +1088,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev,
+ static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
+ struct list_head *head)
+ {
+- struct batadv_priv *bat_priv = netdev_priv(soft_iface);
+ struct batadv_hard_iface *hard_iface;
+- struct batadv_softif_vlan *vlan;
+
+ list_for_each_entry(hard_iface, &batadv_hardif_list, list) {
+ if (hard_iface->soft_iface == soft_iface)
+ batadv_hardif_disable_interface(hard_iface);
+ }
+
+- /* destroy the "untagged" VLAN */
+- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+- if (vlan) {
+- batadv_softif_destroy_vlan(bat_priv, vlan);
+- batadv_softif_vlan_put(vlan);
+- }
+-
+ unregister_netdevice_queue(soft_iface, head);
+ }
+
+diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
+index 9f2003f1a4972e..13709a5d23e3bf 100644
+--- a/net/batman-adv/soft-interface.h
++++ b/net/batman-adv/soft-interface.h
+@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ bool batadv_softif_is_valid(const struct net_device *net_dev);
+ extern struct rtnl_link_ops batadv_link_ops;
+ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid);
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan);
+ void batadv_softif_vlan_release(struct kref *ref);
+ struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv,
+ unsigned short vid);
+--
+2.53.0
+
--- /dev/null
+From 113ad00cf6af4bf0cad9fe1e06c1241f8dcb27ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:34:30 +0200
+Subject: batman-adv: ensure minimal ethernet header on TX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream.
+
+As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
+at least eth header len bytes"), it is possible by for a local user with
+eBPF TC hook access to attach a tc filter which truncates the packet and
+redirects to an batadv interface. But the code assumes that at least
+ETH_HLEN bytes are available and thus might read outside of the available
+buffer.
+
+The batadv_interface_tx() must therefore always check itself if enough data
+is available for the ethernet header and don't rely on min_header_len.
+
+Cc: stable@vger.kernel.org
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 21297af54e4ea7..bdd6dd7fa77588 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -208,6 +208,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+
++ if (!pskb_may_pull(skb, ETH_HLEN))
++ goto dropped;
++
+ /* reset control block to avoid left overs from previous users */
+ memset(skb->cb, 0, sizeof(struct batadv_skb_cb));
+
+--
+2.53.0
+
--- /dev/null
+From f8493ab8c4c76a0701a6028ba9c016af02e72105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:26:40 +0200
+Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 035e1fed892d3d06002a73ff73668f618a514644 upstream.
+
+pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
+the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+This was done correctly for the VLAN header but missed for the ethernet
+header which is later used for the TT and AP isolation handling.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index b46480ec7bd1d0..21297af54e4ea7 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -444,6 +444,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+ goto dropped;
+
++ ethhdr = eth_hdr(skb);
+ vhdr = skb_vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
+--
+2.53.0
+
--- /dev/null
+From da366bd14f5d4b6ff81b2c194415a927cbbd010e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 09:45:50 -0400
+Subject: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error
+ path
+
+From: Shivam Kumar <kumar.shivam43666@gmail.com>
+
+commit 4606467a75cfc16721937272ed29462a750b60c8 upstream.
+
+In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
+nvmet_req_uninit() is called unconditionally. However, if the command
+arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
+had returned false and percpu_ref_tryget_live() was never executed. The
+unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
+refcount underflow, leading to a WARNING in
+percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
+eventually a permanent workqueue deadlock.
+
+Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
+nvmet_req_uninit(), matching the existing pattern in
+nvmet_tcp_execute_request().
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+[shivam: inlined nvmet_tcp_finish_cmd() at the fix site for 5.15.y]
+Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 06cfcf0850076b..95081052dce78f 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1239,7 +1239,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue)
+ queue->idx, cmd->req.cmd->common.command_id,
+ queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
+ le32_to_cpu(cmd->exp_ddgst));
+- nvmet_tcp_finish_cmd(cmd);
++ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
++ nvmet_req_uninit(&cmd->req);
++ nvmet_tcp_free_cmd_buffers(cmd);
+ nvmet_tcp_fatal_error(queue);
+ ret = -EPROTO;
+ goto out;
+--
+2.53.0
+
ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch
ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
+nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch
+batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch
+batman-adv-ensure-minimal-ethernet-header-on-tx.patch
+batman-adv-clean-untagged-vlan-on-netdev-registratio.patch
--- /dev/null
+From 4765ada1d07816e0cce8cb24236b8015a00bcf75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:52:01 +0200
+Subject: batman-adv: clean untagged VLAN on netdev registration failure
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream.
+
+When an mesh interface is registered, it creates an untagged struct
+batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in
+this process, another receiver of this notification can veto the
+registration. The netdev registration will be aborted because of this veto.
+
+The register_netdevice() call will try to clean up the net_device using
+unregister_netdevice_queue() - which only uses the .priv_destructor to
+free private resources. In this situation, .dellink will not be called.
+
+The cleanup of the untagged batadv_meshif_vlan must thefore be done in the
+destructor to avoid a leak of this object.
+
+Cc: stable@vger.kernel.org
+Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
+[ switch to old "mesh_iface" name "soft_iface" ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/main.c | 8 ++++++++
+ net/batman-adv/soft-interface.c | 13 ++-----------
+ net/batman-adv/soft-interface.h | 2 ++
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index 28f616b8891a12..417de98c39a7be 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -258,6 +258,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ void batadv_mesh_free(struct net_device *soft_iface)
+ {
+ struct batadv_priv *bat_priv = netdev_priv(soft_iface);
++ struct batadv_softif_vlan *vlan;
+
+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+
+@@ -273,6 +274,13 @@ void batadv_mesh_free(struct net_device *soft_iface)
+
+ batadv_mcast_free(bat_priv);
+
++ /* destroy the "untagged" VLAN */
++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
++ if (vlan) {
++ batadv_softif_destroy_vlan(bat_priv, vlan);
++ batadv_softif_vlan_put(vlan);
++ }
++
+ /* Free the TT and the originator tables only after having terminated
+ * all the other depending components which may use these structures for
+ * their purposes.
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index a8239902b4428c..57962ed4285b3f 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -605,8 +605,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
+ * @bat_priv: the bat priv with all the soft interface information
+ * @vlan: the object to remove
+ */
+-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
+- struct batadv_softif_vlan *vlan)
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan)
+ {
+ /* explicitly remove the associated TT local entry because it is marked
+ * with the NOPURGE flag
+@@ -1088,22 +1088,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev,
+ static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
+ struct list_head *head)
+ {
+- struct batadv_priv *bat_priv = netdev_priv(soft_iface);
+ struct batadv_hard_iface *hard_iface;
+- struct batadv_softif_vlan *vlan;
+
+ list_for_each_entry(hard_iface, &batadv_hardif_list, list) {
+ if (hard_iface->soft_iface == soft_iface)
+ batadv_hardif_disable_interface(hard_iface);
+ }
+
+- /* destroy the "untagged" VLAN */
+- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+- if (vlan) {
+- batadv_softif_destroy_vlan(bat_priv, vlan);
+- batadv_softif_vlan_put(vlan);
+- }
+-
+ unregister_netdevice_queue(soft_iface, head);
+ }
+
+diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
+index 9f2003f1a4972e..13709a5d23e3bf 100644
+--- a/net/batman-adv/soft-interface.h
++++ b/net/batman-adv/soft-interface.h
+@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ bool batadv_softif_is_valid(const struct net_device *net_dev);
+ extern struct rtnl_link_ops batadv_link_ops;
+ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid);
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan);
+ void batadv_softif_vlan_release(struct kref *ref);
+ struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv,
+ unsigned short vid);
+--
+2.53.0
+
--- /dev/null
+From 0f3a32b1cd0ad0d88507a9a9adc8d833935dc21d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:36:57 +0200
+Subject: batman-adv: ensure minimal ethernet header on TX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream.
+
+As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
+at least eth header len bytes"), it is possible by for a local user with
+eBPF TC hook access to attach a tc filter which truncates the packet and
+redirects to an batadv interface. But the code assumes that at least
+ETH_HLEN bytes are available and thus might read outside of the available
+buffer.
+
+The batadv_interface_tx() must therefore always check itself if enough data
+is available for the ethernet header and don't rely on min_header_len.
+
+Cc: stable@vger.kernel.org
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 40354da5c5b555..a8239902b4428c 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -208,6 +208,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+
++ if (!pskb_may_pull(skb, ETH_HLEN))
++ goto dropped;
++
+ /* reset control block to avoid left overs from previous users */
+ memset(skb->cb, 0, sizeof(struct batadv_skb_cb));
+
+--
+2.53.0
+
--- /dev/null
+From ac38b597fd0a0b12b2cb5d5e21f816004966c76d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:18:32 +0200
+Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 035e1fed892d3d06002a73ff73668f618a514644 upstream.
+
+pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
+the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+This was done correctly for the VLAN header but missed for the ethernet
+header which is later used for the TT and AP isolation handling.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index c0549abcae7a64..40354da5c5b555 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -444,6 +444,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+ goto dropped;
+
++ ethhdr = eth_hdr(skb);
+ vhdr = skb_vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
+--
+2.53.0
+
--- /dev/null
+From df20ce7a1b9204bc1d17bf14e9897f96d05ab9c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 17:47:08 +0800
+Subject: mm/damon/reclaim: fix typo in damon_reclaim_timer_fn()
+
+From: Liew Rui Yan <aethernet65535@gmail.com>
+
+Commit 2f54908fae211 ("mm/damon/reclaim: detect and use fresh enabled
+and kdamond_pid values") introduced a typo in damon_reclaim_timer_fn()
+where '!=' was used instead of '==' (unlike damon_lru_sort_timer_fn()).
+This caused damon_reclaim to return early during the delayed work,
+breaking early boot parameter configuration like
+'damon_reclaim.enabled=Y'.
+
+Fix this by changing '!=' to '=='.
+
+Fixes: 2f54908fae21 ("mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values")
+Cc: <stable@vger.kernel.org> # 6.1.x
+Reported-by: Yikai Zhao <yikai@z1k.dev>
+Closes: https://lore.kernel.org/CANMyjpgq5n0Ekt4dgyLRHGb89_Ew0aOMZ3j32V_w0GjHkqH1FQ@mail.gmail.com
+Reviewed-by: SJ Park <sj@kernel.org>
+Signed-off-by: Liew Rui Yan <aethernet65535@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/damon/reclaim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c
+index 016cd8d83ca9de..bb4b705d842c1d 100644
+--- a/mm/damon/reclaim.c
++++ b/mm/damon/reclaim.c
+@@ -198,7 +198,7 @@ static void damon_reclaim_timer_fn(struct work_struct *work)
+ bool now_enabled;
+
+ now_enabled = enabled;
+- if (damon_reclaim_enabled() != now_enabled)
++ if (damon_reclaim_enabled() == now_enabled)
+ return;
+ damon_reclaim_turn(now_enabled);
+ }
+--
+2.53.0
+
ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
+mm-damon-reclaim-fix-typo-in-damon_reclaim_timer_fn.patch
+batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch
+batman-adv-ensure-minimal-ethernet-header-on-tx.patch
+batman-adv-clean-untagged-vlan-on-netdev-registratio.patch
--- /dev/null
+From 249a45f5f963290add20f5a60e5ff1221eb4c52e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:42:34 +0200
+Subject: batman-adv: clean untagged VLAN on netdev registration failure
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream.
+
+When an mesh interface is registered, it creates an untagged struct
+batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in
+this process, another receiver of this notification can veto the
+registration. The netdev registration will be aborted because of this veto.
+
+The register_netdevice() call will try to clean up the net_device using
+unregister_netdevice_queue() - which only uses the .priv_destructor to
+free private resources. In this situation, .dellink will not be called.
+
+The cleanup of the untagged batadv_meshif_vlan must thefore be done in the
+destructor to avoid a leak of this object.
+
+Cc: stable@vger.kernel.org
+Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
+[ switch to old "mesh_iface" name "soft_iface" ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/main.c | 8 ++++++++
+ net/batman-adv/soft-interface.c | 13 ++-----------
+ net/batman-adv/soft-interface.h | 2 ++
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index ac7fa70c09ca85..87f798701dabdc 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -259,6 +259,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ void batadv_mesh_free(struct net_device *soft_iface)
+ {
+ struct batadv_priv *bat_priv = netdev_priv(soft_iface);
++ struct batadv_softif_vlan *vlan;
+
+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+
+@@ -274,6 +275,13 @@ void batadv_mesh_free(struct net_device *soft_iface)
+
+ batadv_mcast_free(bat_priv);
+
++ /* destroy the "untagged" VLAN */
++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
++ if (vlan) {
++ batadv_softif_destroy_vlan(bat_priv, vlan);
++ batadv_softif_vlan_put(vlan);
++ }
++
+ /* Free the TT and the originator tables only after having terminated
+ * all the other depending components which may use these structures for
+ * their purposes.
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index bc72238e7a08c3..aaebe74c1bc0a9 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -606,8 +606,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
+ * @bat_priv: the bat priv with all the soft interface information
+ * @vlan: the object to remove
+ */
+-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
+- struct batadv_softif_vlan *vlan)
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan)
+ {
+ /* explicitly remove the associated TT local entry because it is marked
+ * with the NOPURGE flag
+@@ -1103,22 +1103,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev,
+ static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
+ struct list_head *head)
+ {
+- struct batadv_priv *bat_priv = netdev_priv(soft_iface);
+ struct batadv_hard_iface *hard_iface;
+- struct batadv_softif_vlan *vlan;
+
+ list_for_each_entry(hard_iface, &batadv_hardif_list, list) {
+ if (hard_iface->soft_iface == soft_iface)
+ batadv_hardif_disable_interface(hard_iface);
+ }
+
+- /* destroy the "untagged" VLAN */
+- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+- if (vlan) {
+- batadv_softif_destroy_vlan(bat_priv, vlan);
+- batadv_softif_vlan_put(vlan);
+- }
+-
+ unregister_netdevice_queue(soft_iface, head);
+ }
+
+diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
+index 9f2003f1a4972e..13709a5d23e3bf 100644
+--- a/net/batman-adv/soft-interface.h
++++ b/net/batman-adv/soft-interface.h
+@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ bool batadv_softif_is_valid(const struct net_device *net_dev);
+ extern struct rtnl_link_ops batadv_link_ops;
+ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid);
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan);
+ void batadv_softif_vlan_release(struct kref *ref);
+ struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv,
+ unsigned short vid);
+--
+2.53.0
+
--- /dev/null
+From 7c30877e2034ce21d3dcc3247a7fcb7f9a8b151e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:29:51 +0200
+Subject: batman-adv: ensure minimal ethernet header on TX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream.
+
+As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
+at least eth header len bytes"), it is possible by for a local user with
+eBPF TC hook access to attach a tc filter which truncates the packet and
+redirects to an batadv interface. But the code assumes that at least
+ETH_HLEN bytes are available and thus might read outside of the available
+buffer.
+
+The batadv_interface_tx() must therefore always check itself if enough data
+is available for the ethernet header and don't rely on min_header_len.
+
+Cc: stable@vger.kernel.org
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 42ad04d356904f..bc72238e7a08c3 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -206,6 +206,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+
++ if (!pskb_may_pull(skb, ETH_HLEN))
++ goto dropped;
++
+ /* reset control block to avoid left overs from previous users */
+ memset(skb->cb, 0, sizeof(struct batadv_skb_cb));
+
+--
+2.53.0
+
--- /dev/null
+From 568d4667764e12e5901eadb7f5bc7f7b45dd9629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:14:59 +0200
+Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 035e1fed892d3d06002a73ff73668f618a514644 upstream.
+
+pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
+the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+This was done correctly for the VLAN header but missed for the ethernet
+header which is later used for the TT and AP isolation handling.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index f46064333f3343..42ad04d356904f 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -445,6 +445,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+ goto dropped;
+
++ ethhdr = eth_hdr(skb);
+ vhdr = skb_vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
+--
+2.53.0
+
--- /dev/null
+From 90aa57c12d20338849eb75b59b5c1a60fc3affaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jul 2026 20:23:23 +0200
+Subject: rust: block: `allow(deprecated)` for `fetch_update` for Rust >=
+ 1.99.0
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+Starting with Rust 1.99.0 (expected 2026-10-01), the
+`Atomic*::fetch_update` method is deprecated, with the compiler suggesting
+the `try_update` alias instead:
+
+ error: use of deprecated method `core::sync::atomic::Atomic::<u64>::fetch_update`: renamed to `try_update` for consistency
+ --> rust/kernel/block/mq/request.rs:206:22
+ |
+ 206 | let old = target.fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x)));
+ | ^^^^^^^^^^^^
+ |
+ = note: `-D deprecated` implied by `-D warnings`
+ = help: to override `-D warnings` add `#[allow(deprecated)]`
+ help: replace the use of the deprecated method
+ |
+ 206 - let old = target.fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x)));
+ 206 + let old = target.try_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x)));
+ |
+
+The deprecation was added in Rust 1.95.0 [1], but only triggers starting
+with Rust 1.99.0.
+
+However, we cannot use the alias since our minimum in 6.12.y is Rust
+1.78.0 -- `try_update` was added in Rust 1.86.0 [2].
+
+Thus just allow the lint.
+
+Cc: Andreas Hindborg <a.hindborg@kernel.org>
+Cc: Boqun Feng <boqun@kernel.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Link: https://github.com/rust-lang/rust/pull/148590 [1]
+Link: https://github.com/rust-lang/rust/pull/133829 [2]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/block/mq/request.rs | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/rust/kernel/block/mq/request.rs b/rust/kernel/block/mq/request.rs
+index 7943f43b957532..1c793765354260 100644
+--- a/rust/kernel/block/mq/request.rs
++++ b/rust/kernel/block/mq/request.rs
+@@ -203,6 +203,7 @@ unsafe impl<T: Operations> Sync for Request<T> {}
+ /// Store the result of `op(target.load())` in target, returning new value of
+ /// target.
+ fn atomic_relaxed_op_return(target: &AtomicU64, op: impl Fn(u64) -> u64) -> u64 {
++ #[allow(deprecated)]
+ let old = target.fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x)));
+
+ // SAFETY: Because the operation passed to `fetch_update` above always
+@@ -215,6 +216,7 @@ fn atomic_relaxed_op_return(target: &AtomicU64, op: impl Fn(u64) -> u64) -> u64
+ /// Store the result of `op(target.load)` in `target` if `target.load() !=
+ /// pred`, returning [`true`] if the target was updated.
+ fn atomic_relaxed_op_unless(target: &AtomicU64, op: impl Fn(u64) -> u64, pred: u64) -> bool {
++ #[allow(deprecated)]
+ target
+ .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| {
+ if x == pred {
+--
+2.53.0
+
--- /dev/null
+From f7d28c7571b2147d4d74a248d19765a7d9202766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 14:20:44 +0200
+Subject: s390: Revert support for DCACHE_WORD_ACCESS
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+commit 37540b8c287fc817bdbd0c62bb75ad6eab0e5d03 upstream.
+
+load_unaligned_zeropad() reads eight bytes from unaligned addresses and may
+cross page boundaries. It handles exceptions which may happen if reading
+from the second page results in an exception.
+
+For pages which are donated to the Ultravisor for secure execution purposes
+the do_secure_storage_access() exception handler however does not handle
+such exceptions correctly. Such an exception may result in an endless
+exception loop which will never be resolved.
+
+An attempt to fix this [1] turned out to be not sufficient. For now revert
+load_unaligned_zeropad() until this problem has been resolved in a proper
+way.
+
+Note that the implementation of load_unaligned_zeropad() itself is
+correct. The revert is just a temporary workaround until there is complete
+fix for secure storage access exceptions.
+
+[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory")
+
+Fixes: 802ba53eefc5 ("s390: add support for DCACHE_WORD_ACCESS")
+Cc: stable@vger.kernel.org
+Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/Kconfig | 1 -
+ arch/s390/include/asm/asm-extable.h | 4 ----
+ arch/s390/include/asm/word-at-a-time.h | 22 ----------------------
+ arch/s390/mm/extable.c | 18 ------------------
+ 4 files changed, 45 deletions(-)
+
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index 5e6aebf1b739a6..28e900e5212ca1 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -137,7 +137,6 @@ config S390
+ select ARCH_WANT_LD_ORPHAN_WARN
+ select BUILDTIME_TABLE_SORT
+ select CLONE_BACKWARDS2
+- select DCACHE_WORD_ACCESS if !KMSAN
+ select DYNAMIC_FTRACE if FUNCTION_TRACER
+ select FUNCTION_ALIGNMENT_8B if CC_IS_GCC
+ select FUNCTION_ALIGNMENT_16B if !CC_IS_GCC
+diff --git a/arch/s390/include/asm/asm-extable.h b/arch/s390/include/asm/asm-extable.h
+index 00a67464c44534..f87e06ec86ac67 100644
+--- a/arch/s390/include/asm/asm-extable.h
++++ b/arch/s390/include/asm/asm-extable.h
+@@ -13,7 +13,6 @@
+ #define EX_TYPE_UA_LOAD_MEM 4
+ #define EX_TYPE_UA_LOAD_REG 5
+ #define EX_TYPE_UA_LOAD_REGPAIR 6
+-#define EX_TYPE_ZEROPAD 7
+ #define EX_TYPE_FPC 8
+
+ #define EX_DATA_REG_ERR_SHIFT 0
+@@ -82,9 +81,6 @@
+ #define EX_TABLE_UA_LOAD_REGPAIR(_fault, _target, _regerr, _regzero) \
+ __EX_TABLE(__ex_table, _fault, _target, EX_TYPE_UA_LOAD_REGPAIR, _regerr, _regzero, 0)
+
+-#define EX_TABLE_ZEROPAD(_fault, _target, _regdata, _regaddr) \
+- __EX_TABLE(__ex_table, _fault, _target, EX_TYPE_ZEROPAD, _regdata, _regaddr, 0)
+-
+ #define EX_TABLE_FPC(_fault, _target) \
+ __EX_TABLE(__ex_table, _fault, _target, EX_TYPE_FPC, __stringify(%%r0), __stringify(%%r0), 0)
+
+diff --git a/arch/s390/include/asm/word-at-a-time.h b/arch/s390/include/asm/word-at-a-time.h
+index 203acd6e431b12..e9287036392d08 100644
+--- a/arch/s390/include/asm/word-at-a-time.h
++++ b/arch/s390/include/asm/word-at-a-time.h
+@@ -4,7 +4,6 @@
+
+ #include <linux/bitops.h>
+ #include <linux/wordpart.h>
+-#include <asm/asm-extable.h>
+ #include <asm/bitsperlong.h>
+
+ struct word_at_a_time {
+@@ -41,25 +40,4 @@ static inline unsigned long zero_bytemask(unsigned long data)
+ return ~1UL << data;
+ }
+
+-/*
+- * Load an unaligned word from kernel space.
+- *
+- * In the (very unlikely) case of the word being a page-crosser
+- * and the next page not being mapped, take the exception and
+- * return zeroes in the non-existing part.
+- */
+-static inline unsigned long load_unaligned_zeropad(const void *addr)
+-{
+- unsigned long data;
+-
+- asm volatile(
+- "0: lg %[data],0(%[addr])\n"
+- "1: nopr %%r7\n"
+- EX_TABLE_ZEROPAD(0b, 1b, %[data], %[addr])
+- EX_TABLE_ZEROPAD(1b, 1b, %[data], %[addr])
+- : [data] "=d" (data)
+- : [addr] "a" (addr), "m" (*(unsigned long *)addr));
+- return data;
+-}
+-
+ #endif /* _ASM_WORD_AT_A_TIME_H */
+diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
+index 812ec5be129169..30e4b96be20727 100644
+--- a/arch/s390/mm/extable.c
++++ b/arch/s390/mm/extable.c
+@@ -61,22 +61,6 @@ static bool ex_handler_ua_load_reg(const struct exception_table_entry *ex,
+ return true;
+ }
+
+-static bool ex_handler_zeropad(const struct exception_table_entry *ex, struct pt_regs *regs)
+-{
+- unsigned int reg_addr = FIELD_GET(EX_DATA_REG_ADDR, ex->data);
+- unsigned int reg_data = FIELD_GET(EX_DATA_REG_ERR, ex->data);
+- unsigned long data, addr, offset;
+-
+- addr = regs->gprs[reg_addr];
+- offset = addr & (sizeof(unsigned long) - 1);
+- addr &= ~(sizeof(unsigned long) - 1);
+- data = *(unsigned long *)addr;
+- data <<= BITS_PER_BYTE * offset;
+- regs->gprs[reg_data] = data;
+- regs->psw.addr = extable_fixup(ex);
+- return true;
+-}
+-
+ static bool ex_handler_fpc(const struct exception_table_entry *ex, struct pt_regs *regs)
+ {
+ asm volatile("sfpc %[val]\n" : : [val] "d" (0));
+@@ -104,8 +88,6 @@ bool fixup_exception(struct pt_regs *regs)
+ return ex_handler_ua_load_reg(ex, false, regs);
+ case EX_TYPE_UA_LOAD_REGPAIR:
+ return ex_handler_ua_load_reg(ex, true, regs);
+- case EX_TYPE_ZEROPAD:
+- return ex_handler_zeropad(ex, regs);
+ case EX_TYPE_FPC:
+ return ex_handler_fpc(ex, regs);
+ }
+--
+2.53.0
+
ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch
net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
+s390-revert-support-for-dcache_word_access.patch
+batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch
+batman-adv-ensure-minimal-ethernet-header-on-tx.patch
+rust-block-allow-deprecated-for-fetch_update-for-rus.patch
+batman-adv-clean-untagged-vlan-on-netdev-registratio.patch
--- /dev/null
+From 15cff99a79fa8335b1bf35802f385ac0020d9326 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 11:03:29 +0800
+Subject: KVM: TDX: Account all non-transient page allocations for per-TD
+ structures
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit a8b2924676ec42d76597f849baba31acc3ba1bfc ]
+
+Account all non-transient allocations associated with a single TD (or its
+vCPUs), as KVM's ABI is that allocations that are active for the lifetime
+of a VM are accounted. Leave temporary allocations, i.e. allocations that
+are freed within a single function/ioctl, unaccounted, to again align with
+KVM's existing behavior, e.g. see commit dd103407ca31 ("KVM: X86: Remove
+unnecessary GFP_KERNEL_ACCOUNT for temporary variables").
+
+Fixes: 8d032b683c29 ("KVM: TDX: create/destroy VM structure")
+Fixes: a50f673f25e0 ("KVM: TDX: Do TDX specific vcpu initialization")
+Cc: stable@vger.kernel.org
+Reviewed-by: Kai Huang <kai.huang@intel.com>
+Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
+Link: https://patch.msgid.link/20260129011517.3545883-4-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+[ Binbin: Resolved conflicts in __tdx_td_init() due to lacking commits
+ eac90a5ba0aa and 69050f8d6d07, retain nr_configured_hkid increment and
+ kcalloc() call. ]
+Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx/tdx.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
+index d9ffc16dfefe61..7534397defa295 100644
+--- a/arch/x86/kvm/vmx/tdx.c
++++ b/arch/x86/kvm/vmx/tdx.c
+@@ -2474,7 +2474,7 @@ static int __tdx_td_init(struct kvm *kvm, struct td_params *td_params,
+
+ atomic_inc(&nr_configured_hkid);
+
+- tdr_page = alloc_page(GFP_KERNEL);
++ tdr_page = alloc_page(GFP_KERNEL_ACCOUNT);
+ if (!tdr_page)
+ goto free_hkid;
+
+@@ -2482,12 +2482,12 @@ static int __tdx_td_init(struct kvm *kvm, struct td_params *td_params,
+ /* TDVPS = TDVPR(4K page) + TDCX(multiple 4K pages), -1 for TDVPR. */
+ kvm_tdx->td.tdcx_nr_pages = tdx_sysinfo->td_ctrl.tdvps_base_size / PAGE_SIZE - 1;
+ tdcs_pages = kcalloc(kvm_tdx->td.tdcs_nr_pages, sizeof(*kvm_tdx->td.tdcs_pages),
+- GFP_KERNEL);
++ GFP_KERNEL_ACCOUNT);
+ if (!tdcs_pages)
+ goto free_tdr;
+
+ for (i = 0; i < kvm_tdx->td.tdcs_nr_pages; i++) {
+- tdcs_pages[i] = alloc_page(GFP_KERNEL);
++ tdcs_pages[i] = alloc_page(GFP_KERNEL_ACCOUNT);
+ if (!tdcs_pages[i])
+ goto free_tdcs;
+ }
+@@ -2937,7 +2937,7 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u64 vcpu_rcx)
+ int ret, i;
+ u64 err;
+
+- page = alloc_page(GFP_KERNEL);
++ page = alloc_page(GFP_KERNEL_ACCOUNT);
+ if (!page)
+ return -ENOMEM;
+ tdx->vp.tdvpr_page = page;
+@@ -2950,14 +2950,14 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u64 vcpu_rcx)
+ tdx->vp.tdvpr_pa = page_to_phys(tdx->vp.tdvpr_page);
+
+ tdx->vp.tdcx_pages = kcalloc(kvm_tdx->td.tdcx_nr_pages, sizeof(*tdx->vp.tdcx_pages),
+- GFP_KERNEL);
++ GFP_KERNEL_ACCOUNT);
+ if (!tdx->vp.tdcx_pages) {
+ ret = -ENOMEM;
+ goto free_tdvpr;
+ }
+
+ for (i = 0; i < kvm_tdx->td.tdcx_nr_pages; i++) {
+- page = alloc_page(GFP_KERNEL);
++ page = alloc_page(GFP_KERNEL_ACCOUNT);
+ if (!page) {
+ ret = -ENOMEM;
+ goto free_tdcx;
+--
+2.53.0
+
platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch
net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch
+kvm-tdx-account-all-non-transient-page-allocations-f.patch
--- /dev/null
+From 03fd3e09751161997a056e35a58832ddf0e57e31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:44:48 +0200
+Subject: batman-adv: clean untagged VLAN on netdev registration failure
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream.
+
+When an mesh interface is registered, it creates an untagged struct
+batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in
+this process, another receiver of this notification can veto the
+registration. The netdev registration will be aborted because of this veto.
+
+The register_netdevice() call will try to clean up the net_device using
+unregister_netdevice_queue() - which only uses the .priv_destructor to
+free private resources. In this situation, .dellink will not be called.
+
+The cleanup of the untagged batadv_meshif_vlan must thefore be done in the
+destructor to avoid a leak of this object.
+
+Cc: stable@vger.kernel.org
+Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
+[ switch to old "mesh_iface" name "soft_iface" ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/main.c | 8 ++++++++
+ net/batman-adv/soft-interface.c | 13 ++-----------
+ net/batman-adv/soft-interface.h | 2 ++
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index 28f616b8891a12..417de98c39a7be 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -258,6 +258,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ void batadv_mesh_free(struct net_device *soft_iface)
+ {
+ struct batadv_priv *bat_priv = netdev_priv(soft_iface);
++ struct batadv_softif_vlan *vlan;
+
+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+
+@@ -273,6 +274,13 @@ void batadv_mesh_free(struct net_device *soft_iface)
+
+ batadv_mcast_free(bat_priv);
+
++ /* destroy the "untagged" VLAN */
++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
++ if (vlan) {
++ batadv_softif_destroy_vlan(bat_priv, vlan);
++ batadv_softif_vlan_put(vlan);
++ }
++
+ /* Free the TT and the originator tables only after having terminated
+ * all the other depending components which may use these structures for
+ * their purposes.
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 9760ae08451ac9..97578973943be8 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -603,8 +603,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
+ * @bat_priv: the bat priv with all the soft interface information
+ * @vlan: the object to remove
+ */
+-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
+- struct batadv_softif_vlan *vlan)
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan)
+ {
+ /* explicitly remove the associated TT local entry because it is marked
+ * with the NOPURGE flag
+@@ -1086,22 +1086,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev,
+ static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
+ struct list_head *head)
+ {
+- struct batadv_priv *bat_priv = netdev_priv(soft_iface);
+ struct batadv_hard_iface *hard_iface;
+- struct batadv_softif_vlan *vlan;
+
+ list_for_each_entry(hard_iface, &batadv_hardif_list, list) {
+ if (hard_iface->soft_iface == soft_iface)
+ batadv_hardif_disable_interface(hard_iface);
+ }
+
+- /* destroy the "untagged" VLAN */
+- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+- if (vlan) {
+- batadv_softif_destroy_vlan(bat_priv, vlan);
+- batadv_softif_vlan_put(vlan);
+- }
+-
+ unregister_netdevice_queue(soft_iface, head);
+ }
+
+diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
+index 9f2003f1a4972e..13709a5d23e3bf 100644
+--- a/net/batman-adv/soft-interface.h
++++ b/net/batman-adv/soft-interface.h
+@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ bool batadv_softif_is_valid(const struct net_device *net_dev);
+ extern struct rtnl_link_ops batadv_link_ops;
+ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid);
++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_softif_vlan *vlan);
+ void batadv_softif_vlan_release(struct kref *ref);
+ struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv,
+ unsigned short vid);
+--
+2.53.0
+
--- /dev/null
+From 3b73fe808077c8e64dd1c2139c411238fe063d45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:39:41 +0200
+Subject: batman-adv: ensure minimal ethernet header on TX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream.
+
+As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
+at least eth header len bytes"), it is possible by for a local user with
+eBPF TC hook access to attach a tc filter which truncates the packet and
+redirects to an batadv interface. But the code assumes that at least
+ETH_HLEN bytes are available and thus might read outside of the available
+buffer.
+
+The batadv_interface_tx() must therefore always check itself if enough data
+is available for the ethernet header and don't rely on min_header_len.
+
+Cc: stable@vger.kernel.org
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index e4d302c93478b9..9760ae08451ac9 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -206,6 +206,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+
++ if (!pskb_may_pull(skb, ETH_HLEN))
++ goto dropped;
++
+ /* reset control block to avoid left overs from previous users */
+ memset(skb->cb, 0, sizeof(struct batadv_skb_cb));
+
+--
+2.53.0
+
--- /dev/null
+From 108d812cf10ce6d869eafd645fd97aaa27d79d64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2026 15:20:56 +0200
+Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 035e1fed892d3d06002a73ff73668f618a514644 upstream.
+
+pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
+the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+This was done correctly for the VLAN header but missed for the ethernet
+header which is later used for the TT and AP isolation handling.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
+[ move from mesh- to soft-interface.c ]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/soft-interface.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 680f729b3b0228..e4d302c93478b9 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -442,6 +442,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+ goto dropped;
+
++ ethhdr = eth_hdr(skb);
+ vhdr = skb_vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
+--
+2.53.0
+
ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
+batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch
+batman-adv-ensure-minimal-ethernet-header-on-tx.patch
+batman-adv-clean-untagged-vlan-on-netdev-registratio.patch
--- /dev/null
+From ed9f927e4d9462fac422c4bc8396bc4b2d6f2dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2026 08:30:50 +0200
+Subject: riscv: vdso: Always declare vdso_start symbols
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 499578e22ae0cc33d05803f22e5c71ffb7077b2f ]
+
+Make the declarations of vdso_start and its related symbols always
+visible. With that their users don't have to use ifdeffery but can
+use the better IS_ENABLED() compile-time checks.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20260504-riscv-cfi-vdso-alternative-v1-1-bcdf3d37f62e@linutronix.de
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/vdso.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/riscv/include/asm/vdso.h b/arch/riscv/include/asm/vdso.h
+index 35bf830a557612..f7998d9ad9b2d7 100644
+--- a/arch/riscv/include/asm/vdso.h
++++ b/arch/riscv/include/asm/vdso.h
+@@ -12,12 +12,15 @@
+ * All systems with an MMU have a VDSO, but systems without an MMU don't
+ * support shared libraries and therefore don't have one.
+ */
+-#ifdef CONFIG_MMU
+
+ #define __VDSO_PAGES 4
+
+ #ifndef __ASSEMBLER__
++
++#ifdef CONFIG_MMU
+ #include <generated/vdso-offsets.h>
++#endif
++
+ #ifdef CONFIG_RISCV_USER_CFI
+ #include <generated/vdso-cfi-offsets.h>
+ #endif
+@@ -38,15 +41,12 @@
+ #define COMPAT_VDSO_SYMBOL(base, name) \
+ (void __user *)((unsigned long)(base) + compat__vdso_##name##_offset)
+
+-extern char compat_vdso_start[], compat_vdso_end[];
+-
+ #endif /* CONFIG_COMPAT */
+
+ extern char vdso_start[], vdso_end[];
+ extern char vdso_cfi_start[], vdso_cfi_end[];
++extern char compat_vdso_start[], compat_vdso_end[];
+
+ #endif /* !__ASSEMBLER__ */
+
+-#endif /* CONFIG_MMU */
+-
+ #endif /* _ASM_RISCV_VDSO_H */
+--
+2.53.0
+
drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch
netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch
kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch
+riscv-vdso-always-declare-vdso_start-symbols.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
