--- /dev/null
+From 837b7bf400627d8dcfd5cd44f7631b2347e5d25f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 15:12:17 +0200
+Subject: s390/zcrypt: Fix missing mem scrub at clear key import in
+ cca_clr2cipherkey()
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ]
+
+The helper function _ip_cprb_helper() uses internal buffer memory for
+building and processing CPRBs. After use this buffer was never
+scrubbed which could lead to leaving for example clear key material in
+memory which could be exposed via tricky reuse of this same memory.
+
+Extend the _ip_cprb_helper() function with another parameter 'scrub'
+used to steer scrubbing of this buffer. So now the caller has the
+opportunity to decide if scrubbing is needed or not.
+
+Extend the clear key to secure key token import process in function
+cca_clr2cipherkey() to tell the helper function from above to scrub
+the cprb buffer when the clear key value is part of the request data.
+
+Add explicit scrubbing on return from function cca_clr2cipherkey() for
+the random EXOR buffer and the cprb buffer.
+
+Overall this cleans the internal used buffer in case of clear key
+import to prevent sensitive data to get exposed.
+
+Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys")
+Cc: stable@vger.kernel.org
+Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
+index 7af5176623bc1..7875519491dbd 100644
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -943,7 +943,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ const u8 *clr_key_value,
+ int clr_key_bit_size,
+ u8 *key_token,
+- int *key_token_size)
++ int *key_token_size,
++ bool scrub)
+ {
+ int rc, n;
+ u8 *mem, *ptr;
+@@ -1084,7 +1085,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ *key_token_size = t->len;
+
+ out:
+- free_cprbmem(mem, PARMBSIZE, 0);
++ free_cprbmem(mem, PARMBSIZE, scrub);
+ return rc;
+ }
+
+@@ -1127,7 +1128,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ * 4/4 COMPLETE the secure cipher key import
+ */
+ rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART",
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1135,7 +1137,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- clrkey, keybitsize, token, &tokensize);
++ clrkey, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1143,7 +1146,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1151,7 +1155,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL,
+- NULL, keybitsize, token, &tokensize);
++ NULL, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1169,7 +1174,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ *keybufsize = tokensize;
+
+ out:
+- kfree(token);
++ memzero_explicit(exorbuf, sizeof(exorbuf));
++ kfree_sensitive(token);
+ return rc;
+ }
+ EXPORT_SYMBOL(cca_clr2cipherkey);
+--
+2.53.0
+
firmware-stratix10-svc-fix-memory-leaks-and-list-cor.patch
gpio-pch-use-raw_spinlock_t-for-the-register-lock.patch
mount-honour-sb_nouser-in-the-new-mount-api.patch
+s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch
--- /dev/null
+From 963edb2367f3e82d6533829b1d39e4a0609fc3a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 15:40:12 +0200
+Subject: s390/zcrypt: Fix missing mem scrub at clear key import in
+ cca_clr2cipherkey()
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ]
+
+The helper function _ip_cprb_helper() uses internal buffer memory for
+building and processing CPRBs. After use this buffer was never
+scrubbed which could lead to leaving for example clear key material in
+memory which could be exposed via tricky reuse of this same memory.
+
+Extend the _ip_cprb_helper() function with another parameter 'scrub'
+used to steer scrubbing of this buffer. So now the caller has the
+opportunity to decide if scrubbing is needed or not.
+
+Extend the clear key to secure key token import process in function
+cca_clr2cipherkey() to tell the helper function from above to scrub
+the cprb buffer when the clear key value is part of the request data.
+
+Add explicit scrubbing on return from function cca_clr2cipherkey() for
+the random EXOR buffer and the cprb buffer.
+
+Overall this cleans the internal used buffer in case of clear key
+import to prevent sensitive data to get exposed.
+
+Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys")
+Cc: stable@vger.kernel.org
+Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
+index e73645d72f2c4..cbd7c96ceb0ca 100644
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -946,7 +946,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ const u8 *clr_key_value,
+ int clr_key_bit_size,
+ u8 *key_token,
+- int *key_token_size)
++ int *key_token_size,
++ bool scrub)
+ {
+ int rc, n;
+ u8 *mem, *ptr;
+@@ -1087,7 +1088,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ *key_token_size = t->len;
+
+ out:
+- free_cprbmem(mem, PARMBSIZE, 0);
++ free_cprbmem(mem, PARMBSIZE, scrub);
+ return rc;
+ }
+
+@@ -1130,7 +1131,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ * 4/4 COMPLETE the secure cipher key import
+ */
+ rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART",
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1138,7 +1140,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- clrkey, keybitsize, token, &tokensize);
++ clrkey, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1146,7 +1149,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1154,7 +1158,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL,
+- NULL, keybitsize, token, &tokensize);
++ NULL, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1172,7 +1177,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ *keybufsize = tokensize;
+
+ out:
+- kfree(token);
++ memzero_explicit(exorbuf, sizeof(exorbuf));
++ kfree_sensitive(token);
+ return rc;
+ }
+ EXPORT_SYMBOL(cca_clr2cipherkey);
+--
+2.53.0
+
firmware-stratix10-svc-fix-memory-leaks-and-list-cor.patch
gpio-pch-use-raw_spinlock_t-for-the-register-lock.patch
mount-honour-sb_nouser-in-the-new-mount-api.patch
+s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch
--- /dev/null
+From 305d9708bd7f0c23852607e72968243ba69f6e35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 16:00:30 +0200
+Subject: s390/zcrypt: Fix missing mem scrub at clear key import in
+ cca_clr2cipherkey()
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ]
+
+The helper function _ip_cprb_helper() uses internal buffer memory for
+building and processing CPRBs. After use this buffer was never
+scrubbed which could lead to leaving for example clear key material in
+memory which could be exposed via tricky reuse of this same memory.
+
+Extend the _ip_cprb_helper() function with another parameter 'scrub'
+used to steer scrubbing of this buffer. So now the caller has the
+opportunity to decide if scrubbing is needed or not.
+
+Extend the clear key to secure key token import process in function
+cca_clr2cipherkey() to tell the helper function from above to scrub
+the cprb buffer when the clear key value is part of the request data.
+
+Add explicit scrubbing on return from function cca_clr2cipherkey() for
+the random EXOR buffer and the cprb buffer.
+
+Overall this cleans the internal used buffer in case of clear key
+import to prevent sensitive data to get exposed.
+
+Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys")
+Cc: stable@vger.kernel.org
+Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
+index 59323c8ca2856..622d960098ad3 100644
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -946,7 +946,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ const u8 *clr_key_value,
+ int clr_key_bit_size,
+ u8 *key_token,
+- int *key_token_size)
++ int *key_token_size,
++ bool scrub)
+ {
+ int rc, n;
+ u8 *mem, *ptr;
+@@ -1087,7 +1088,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ *key_token_size = t->len;
+
+ out:
+- free_cprbmem(mem, PARMBSIZE, 0);
++ free_cprbmem(mem, PARMBSIZE, scrub);
+ return rc;
+ }
+
+@@ -1130,7 +1131,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ * 4/4 COMPLETE the secure cipher key import
+ */
+ rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART",
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1138,7 +1140,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- clrkey, keybitsize, token, &tokensize);
++ clrkey, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1146,7 +1149,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1154,7 +1158,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL,
+- NULL, keybitsize, token, &tokensize);
++ NULL, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1172,7 +1177,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ *keybufsize = tokensize;
+
+ out:
+- kfree(token);
++ memzero_explicit(exorbuf, sizeof(exorbuf));
++ kfree_sensitive(token);
+ return rc;
+ }
+ EXPORT_SYMBOL(cca_clr2cipherkey);
+--
+2.53.0
+
bluetooth-6lowpan-fix-using-chan-conn-as-indication-.patch
bluetooth-hci_conn-fix-potential-uaf-in-create_big_s.patch
mount-honour-sb_nouser-in-the-new-mount-api.patch
+s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch
--- /dev/null
+From 2b60f3cfc54ed969de5c250038f680022413992c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 16:37:19 +0200
+Subject: s390/zcrypt: Fix missing mem scrub at clear key import in
+ cca_clr2cipherkey()
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ]
+
+The helper function _ip_cprb_helper() uses internal buffer memory for
+building and processing CPRBs. After use this buffer was never
+scrubbed which could lead to leaving for example clear key material in
+memory which could be exposed via tricky reuse of this same memory.
+
+Extend the _ip_cprb_helper() function with another parameter 'scrub'
+used to steer scrubbing of this buffer. So now the caller has the
+opportunity to decide if scrubbing is needed or not.
+
+Extend the clear key to secure key token import process in function
+cca_clr2cipherkey() to tell the helper function from above to scrub
+the cprb buffer when the clear key value is part of the request data.
+
+Add explicit scrubbing on return from function cca_clr2cipherkey() for
+the random EXOR buffer and the cprb buffer.
+
+Overall this cleans the internal used buffer in case of clear key
+import to prevent sensitive data to get exposed.
+
+Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys")
+Cc: stable@vger.kernel.org
+Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
+index 6790afd517ec6..48d36d5a87118 100644
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -938,7 +938,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ const u8 *clr_key_value,
+ int clr_key_bit_size,
+ u8 *key_token,
+- int *key_token_size)
++ int *key_token_size,
++ bool scrub)
+ {
+ int rc, n;
+ u8 *mem, *ptr;
+@@ -1077,7 +1078,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ *key_token_size = t->len;
+
+ out:
+- free_cprbmem(mem, PARMBSIZE, 0);
++ free_cprbmem(mem, PARMBSIZE, scrub);
+ return rc;
+ }
+
+@@ -1120,28 +1121,32 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ * 4/4 COMPLETE the secure cipher key import
+ */
+ rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART",
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ ZCRYPT_DBF_ERR("%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
+ __func__, rc);
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- clrkey, keybitsize, token, &tokensize);
++ clrkey, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ ZCRYPT_DBF_ERR("%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
+ __func__, rc);
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ ZCRYPT_DBF_ERR("%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
+ __func__, rc);
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL,
+- NULL, keybitsize, token, &tokensize);
++ NULL, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ ZCRYPT_DBF_ERR("%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
+ __func__, rc);
+@@ -1158,7 +1163,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ *keybufsize = tokensize;
+
+ out:
+- kfree(token);
++ memzero_explicit(exorbuf, sizeof(exorbuf));
++ kfree_sensitive(token);
+ return rc;
+ }
+ EXPORT_SYMBOL(cca_clr2cipherkey);
+--
+2.53.0
+
selftests-bpf-fail-unbound-udp-on-sockmap-update.patch
drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch
drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch
+s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch
--- /dev/null
+From c67a94c3ff8ce39425f6b2d0cdc77a1a97e8080b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Nov 2025 05:31:28 +0100
+Subject: sched/fair: Separate se->vlag from se->vprot
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit 80390ead2080071cbd6f427ff8deb94d10a4a50f ]
+
+There's no real space concerns here and keeping these fields
+in a union makes reading (and tracing) the scheduler code harder.
+
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 5dea369fcfc96..fa02b2254905c 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -587,15 +587,10 @@ struct sched_entity {
+ u64 sum_exec_runtime;
+ u64 prev_sum_exec_runtime;
+ u64 vruntime;
+- union {
+- /*
+- * When !@on_rq this field is vlag.
+- * When cfs_rq->curr == se (which implies @on_rq)
+- * this field is vprot. See protect_slice().
+- */
+- s64 vlag;
+- u64 vprot;
+- };
++ /* Approximated virtual lag: */
++ s64 vlag;
++ /* 'Protected' deadline, to give out minimum quantums: */
++ u64 vprot;
+ u64 slice;
+
+ u64 nr_migrations;
+--
+2.53.0
+
selftests-bpf-fail-unbound-udp-on-sockmap-update.patch
drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch
drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch
+sched-fair-separate-se-vlag-from-se-vprot.patch
--- /dev/null
+From 0d851f1dedc3e657baeed5e404539a181b2e1810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 16:17:13 +0200
+Subject: s390/zcrypt: Fix missing mem scrub at clear key import in
+ cca_clr2cipherkey()
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 01476391aecef36a3b789ee844357b22fbc90665 ]
+
+The helper function _ip_cprb_helper() uses internal buffer memory for
+building and processing CPRBs. After use this buffer was never
+scrubbed which could lead to leaving for example clear key material in
+memory which could be exposed via tricky reuse of this same memory.
+
+Extend the _ip_cprb_helper() function with another parameter 'scrub'
+used to steer scrubbing of this buffer. So now the caller has the
+opportunity to decide if scrubbing is needed or not.
+
+Extend the clear key to secure key token import process in function
+cca_clr2cipherkey() to tell the helper function from above to scrub
+the cprb buffer when the clear key value is part of the request data.
+
+Add explicit scrubbing on return from function cca_clr2cipherkey() for
+the random EXOR buffer and the cprb buffer.
+
+Overall this cleans the internal used buffer in case of clear key
+import to prevent sensitive data to get exposed.
+
+Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys")
+Cc: stable@vger.kernel.org
+Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
+index c3e3f3a3d8f96..b8526219ecebe 100644
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -946,7 +946,8 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ const u8 *clr_key_value,
+ int clr_key_bit_size,
+ u8 *key_token,
+- int *key_token_size)
++ int *key_token_size,
++ bool scrub)
+ {
+ int rc, n;
+ u8 *mem, *ptr;
+@@ -1087,7 +1088,7 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
+ *key_token_size = t->len;
+
+ out:
+- free_cprbmem(mem, PARMBSIZE, 0);
++ free_cprbmem(mem, PARMBSIZE, scrub);
+ return rc;
+ }
+
+@@ -1130,7 +1131,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ * 4/4 COMPLETE the secure cipher key import
+ */
+ rc = _ip_cprb_helper(card, dom, "AES ", "FIRST ", "MIN3PART",
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 1/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1138,7 +1140,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- clrkey, keybitsize, token, &tokensize);
++ clrkey, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 2/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1146,7 +1149,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "ADD-PART", NULL,
+- exorbuf, keybitsize, token, &tokensize);
++ exorbuf, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 3/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1154,7 +1158,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ goto out;
+ }
+ rc = _ip_cprb_helper(card, dom, "AES ", "COMPLETE", NULL,
+- NULL, keybitsize, token, &tokensize);
++ NULL, keybitsize, token, &tokensize,
++ true);
+ if (rc) {
+ DEBUG_ERR(
+ "%s clear key import 4/4 with CSNBKPI2 failed, rc=%d\n",
+@@ -1172,7 +1177,8 @@ int cca_clr2cipherkey(u16 card, u16 dom, u32 keybitsize, u32 keygenflags,
+ *keybufsize = tokensize;
+
+ out:
+- kfree(token);
++ memzero_explicit(exorbuf, sizeof(exorbuf));
++ kfree_sensitive(token);
+ return rc;
+ }
+ EXPORT_SYMBOL(cca_clr2cipherkey);
+--
+2.53.0
+
mount-honour-sb_nouser-in-the-new-mount-api.patch
selftests-bpf-fail-unbound-udp-on-sockmap-update.patch
+s390-zcrypt-fix-missing-mem-scrub-at-clear-key-impor.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
