--- /dev/null
+From 18a4e5cf633fad5c40ac9d936c51bf38db68796d Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Wed, 10 Jun 2026 15:52:01 +0800
+Subject: arm64: smp: Fix hot-unplug tearing by forcing unregistration
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 18a4e5cf633fad5c40ac9d936c51bf38db68796d upstream.
+
+Sashiko review pointed out the following issue[1].
+
+Commit eba4675008a6 ("arm64: arch_register_cpu() variant to check if
+an ACPI handle is now available.") introduced architectural safety
+blocks inside arch_unregister_cpu(). If a hot-unplug operation is
+determined to be a physical hardware removal (where _STA evaluates to
+!ACPI_STA_DEVICE_PRESENT), or if firmware evaluation fails, it aborts
+the unregistration transaction early to protect unreadied arm64
+infrastructure.
+
+However, returning early from arch_unregister_cpu() causes a catastrophic
+state tearing because the generic ACPI layer (acpi_processor_post_eject())
+unconditionally continues its cleanup flow. This leaves the stale sysfs
+device leaked in the memory, deadlocking any subsequent hot-add attempts
+on the same CPU.
+
+Fix it by simplifying arch_unregister_cpu() to always proceed with
+the unregistration, as a pr_err_once() warning is sufficient to make
+it more visible for currently not supported physical CPU removal.
+Also remove the redundant NULL check on acpi_handle as it cannot be
+NULL when calling arch_unregister_cpu().
+
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Jonathan Cameron <jic23@kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: stable@vger.kernel.org
+Link: https://sashiko.dev/#/patchset/20260520022023.126670-1-ruanjinjie@huawei.com [1]
+Fixes: eba4675008a6 ("arm64: arch_register_cpu() variant to check if an ACPI handle is now available.")
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/smp.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -543,23 +543,13 @@ void arch_unregister_cpu(int cpu)
+ {
+ acpi_handle acpi_handle = acpi_get_processor_handle(cpu);
+ struct cpu *c = &per_cpu(cpu_devices, cpu);
+- acpi_status status;
+ unsigned long long sta;
+-
+- if (!acpi_handle) {
+- pr_err_once("Removing a CPU without associated ACPI handle\n");
+- return;
+- }
++ acpi_status status;
+
+ status = acpi_evaluate_integer(acpi_handle, "_STA", NULL, &sta);
+- if (ACPI_FAILURE(status))
+- return;
+-
+- /* For now do not allow anything that looks like physical CPU HP */
+- if (cpu_present(cpu) && !(sta & ACPI_STA_DEVICE_PRESENT)) {
++ if (!ACPI_FAILURE(status) &&
++ cpu_present(cpu) && !(sta & ACPI_STA_DEVICE_PRESENT))
+ pr_err_once("Changing CPU present bit is not supported\n");
+- return;
+- }
+
+ unregister_cpu(c);
+ }
--- /dev/null
+From 917d0a4b95ea7ba01ed6296fb808f752d5d81107 Mon Sep 17 00:00:00 2001
+From: TJ Adams <tadamsjr@google.com>
+Date: Mon, 6 Jul 2026 14:00:53 -0700
+Subject: ata: libata-core: Skip HPA resize for locked drives
+
+From: TJ Adams <tadamsjr@google.com>
+
+commit 917d0a4b95ea7ba01ed6296fb808f752d5d81107 upstream.
+
+Skip HPA resize in ata_hpa_resize() if the drive is security locked.
+If the drive is locked, the command to read the native max address
+fails with -EACCES, which currently causes the sticky quirk
+ATA_QUIRK_BROKEN_HPA to be set on the device.
+
+Setting this sticky quirk causes subsequent revalidations (after the
+drive is unlocked) to bypass HPA checks, preventing the unlocked drive
+from exposing its full native capacity without a reboot or device removal.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Terrence Adams <tadamsjr@google.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -1324,7 +1324,7 @@ static int ata_hpa_resize(struct ata_dev
+ /* do we need to do it? */
+ if ((dev->class != ATA_DEV_ATA && dev->class != ATA_DEV_ZAC) ||
+ !ata_id_has_lba(dev->id) || !ata_id_hpa_enabled(dev->id) ||
+- (dev->quirks & ATA_QUIRK_BROKEN_HPA))
++ (dev->quirks & ATA_QUIRK_BROKEN_HPA) || ata_id_is_locked(dev->id))
+ return 0;
+
+ /* read native max address */
--- /dev/null
+From b983c56426383e4a06fa5970c4e33cee879b1482 Mon Sep 17 00:00:00 2001
+From: Farhad Alemi <farhad.alemi@berkeley.edu>
+Date: Mon, 6 Jul 2026 10:20:23 +0200
+Subject: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Farhad Alemi <farhad.alemi@berkeley.edu>
+
+commit b983c56426383e4a06fa5970c4e33cee879b1482 upstream.
+
+Creating a child cpuset where cpuset.mems is never set leads to a div/0
+when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a
+CPU hotplug event.
+
+Reproduction steps:
+ 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems)
+ 2) Move the task into the child cpuset
+ 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES
+ 4) unplug and hotplug a cpu
+ echo 0 > /sys/devices/system/cpu/cpu1/online
+ echo 1 > /sys/devices/system/cpu/cpu1/online
+ 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the
+ call to __nodes_fold()
+
+The cpuset code passes (cs->mems_allowed) which is not guaranteed to have
+nodes to the rebind routine. Use cs->effective_mems instead, which is
+guaranteed to have a non-empty nodemask once we reach that code path.
+
+Link: https://lore.kernel.org/all/CA+0ovCiEz6SP_sn3kN4Tb+_oC=eHMXy_Ffj=usV3wREdQrUtww@mail.gmail.com/
+Fixes: ae1c802382f7 ("cpuset: apply cs->effective_{cpus,mems}")
+Closes: https://lore.kernel.org/linux-mm/CA+0ovCgxbZkXa+OU8w3s84R3KNPNxxRfmsNR-udh+afQBbGNmw@mail.gmail.com/
+Suggested-by: Gregory Price <gourry@gourry.net>
+Suggested-by: Waiman Long <longman@redhat.com>
+Acked-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alistair Popple <apopple@nvidia.com>
+Cc: Byungchul Park <byungchul@sk.com>
+Cc: Gregory Price <gourry@gourry.net>
+Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
+Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Rakie Kim <rakie.kim@sk.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Zi Yan <ziy@nvidia.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Ridong Chen <ridong.chen@linux.dev>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: "Michal Koutný" <mkoutny@suse.com>
+Cc: <stable@vger.kernel.org>
+[ david: add a comment, slightly rephrase description ]
+Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cgroup/cpuset.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -2586,7 +2586,12 @@ void cpuset_update_tasks_nodemask(struct
+
+ migrate = is_memory_migrate(cs);
+
+- mpol_rebind_mm(mm, &cs->mems_allowed);
++ /*
++ * For v1 we can have empty effective_mems, but we cannot
++ * attach any tasks (see cpuset_can_attach_check()). For v2,
++ * effective_mems is guaranteed to not be empty.
++ */
++ mpol_rebind_mm(mm, &cs->effective_mems);
+ if (migrate)
+ cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems);
+ else
--- /dev/null
+From bd910a7660d280595ef94cb6d193951d855d330f Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Thu, 9 Jul 2026 22:28:37 -0400
+Subject: drbd: reject data replies with an out-of-range payload size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit bd910a7660d280595ef94cb6d193951d855d330f upstream.
+
+recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an
+outstanding read request. The peer-supplied payload length reaches it as
+the signed int data_size, and two peer-controlled inputs can make it
+negative. With a negotiated data-integrity-alg the digest length is
+subtracted first, so a reply whose payload is smaller than the digest
+underflows data_size. With no integrity algorithm (the default) data_size
+is assigned from the unsigned h95/h100 wire length and drbdd() never
+bounds it for a payload-carrying command, so a length above INT_MAX casts
+it negative; this path needs no non-default feature. The bio receive loop
+then computes expect = min_t(int, data_size, bv_len), which is negative,
+and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX
+into the first mapped page.
+
+The sibling receive path read_in_block() is not affected: it uses an
+unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.
+Reject a data reply whose size is negative after the optional digest
+subtraction, covering both triggers.
+
+Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen
+bytes past a bio page in the receiver, corrupting kernel memory. A node
+that reads from its peer (a diskless node, or read-balancing to the peer)
+is exposed in the default configuration; data-integrity-alg is not
+required.
+
+Fixes: b411b3637fa7 ("The DRBD driver")
+Cc: stable@vger.kernel.org
+Assisted-by: Codex:gpt-5-5-xhigh
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Link: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/drbd/drbd_receiver.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -1998,6 +1998,11 @@ static int recv_dless_read(struct drbd_p
+ data_size -= digest_size;
+ }
+
++ if (data_size < 0) {
++ drbd_err(peer_device, "Invalid data reply size\n");
++ return -EIO;
++ }
++
+ /* optimistically update recv_cnt. if receiving fails below,
+ * we disconnect anyways, and counters will be reset. */
+ peer_device->device->recv_cnt += data_size>>9;
--- /dev/null
+From 2975324d164c552b028632f107b567302863b7f6 Mon Sep 17 00:00:00 2001
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Date: Thu, 2 Jul 2026 19:28:36 +0800
+Subject: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
+
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+
+commit 2975324d164c552b028632f107b567302863b7f6 upstream.
+
+Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in
+ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn
+object with kmem_cache_alloc(). The function then initializes many
+fields explicitly, but only resets in_seq.delta and out_seq.delta in the
+two struct ip_vs_seq members.
+
+That leaves init_seq and previous_delta uninitialized. This is normally
+harmless while the corresponding IP_VS_CONN_F_IN_SEQ or
+IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync
+message, however, ip_vs_proc_conn() preserves those flags from
+IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits
+IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with
+SEQ flags set but with the rest of in_seq/out_seq still containing stale
+slab data.
+
+When a packet for such a connection is later handled by an IPVS
+application helper, vs_fix_seq() and vs_fix_ack_seq() use
+previous_delta and init_seq to rewrite TCP sequence numbers. A malformed
+sync message can therefore make forwarded packets carry stale slab bytes
+in their TCP seq/ack numbers, and can also corrupt the forwarded TCP
+flow.
+
+Reset both struct ip_vs_seq members completely before publishing the
+connection. This matches the existing "reset struct ip_vs_seq" comment
+and keeps the sequence-adjustment gates inactive unless valid sequence
+data is installed later.
+
+Fixes: 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new")
+Cc: stable@vger.kernel.org
+Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Reported-by: Ao Wang <wangao@seu.edu.cn>
+Reported-by: Xuewei Feng <fengxw06@126.com>
+Reported-by: Qi Li <qli01@tsinghua.edu.cn>
+Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
+Assisted-by: Claude-Code:GLM-5.2
+Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -996,8 +996,8 @@ ip_vs_conn_new(const struct ip_vs_conn_p
+ cp->app = NULL;
+ cp->app_data = NULL;
+ /* reset struct ip_vs_seq */
+- cp->in_seq.delta = 0;
+- cp->out_seq.delta = 0;
++ memset(&cp->in_seq, 0, sizeof(cp->in_seq));
++ memset(&cp->out_seq, 0, sizeof(cp->out_seq));
+
+ atomic_inc(&ipvs->conn_count);
+ if (flags & IP_VS_CONN_F_NO_CPORT)
--- /dev/null
+From 2f75c0faa3361b28e36cc0512b3299e163e25789 Mon Sep 17 00:00:00 2001
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Date: Mon, 6 Jul 2026 18:16:24 +0800
+Subject: ipvs: use parsed transport offset in SCTP state lookup
+
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+
+commit 2f75c0faa3361b28e36cc0512b3299e163e25789 upstream.
+
+set_sctp_state() reads the SCTP chunk header again in order to drive the
+IPVS SCTP state table. For IPv6 it computes the offset with
+sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from
+ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped
+extension headers and found the real transport header.
+
+This makes the state machine read from the wrong offset for IPv6 SCTP
+packets that carry extension headers. For example, an INIT packet with an
+8-byte destination options header can be scheduled correctly by
+sctp_conn_schedule(), but set_sctp_state() reads the first byte of the
+SCTP verification tag as a DATA chunk type. The connection then moves
+from NONE to ESTABLISHED instead of INIT1, gets the longer established
+timeout, and updates the active/inactive destination counters
+incorrectly. This happens even though the SCTP handshake has not
+completed.
+
+Use the parsed transport offset passed down from ip_vs_set_state() for
+the SCTP chunk-header lookup. For IPv4 and IPv6 packets without
+extension headers this preserves the existing offset.
+
+Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/
+Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Reported-by: Ao Wang <wangao@seu.edu.cn>
+Reported-by: Xuewei Feng <fengxw06@126.com>
+Reported-by: Qi Li <qli01@tsinghua.edu.cn>
+Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
+Assisted-by: Claude Code:GLM-5.2
+Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
+@@ -372,20 +372,15 @@ static const char *sctp_state_name(int s
+
+ static inline void
+ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
+- int direction, const struct sk_buff *skb)
++ int direction, const struct sk_buff *skb,
++ unsigned int iph_len)
+ {
+ struct sctp_chunkhdr _sctpch, *sch;
+ unsigned char chunk_type;
+ int event, next_state;
+- int ihl, cofs;
+-
+-#ifdef CONFIG_IP_VS_IPV6
+- ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
+-#else
+- ihl = ip_hdrlen(skb);
+-#endif
++ int cofs;
+
+- cofs = ihl + sizeof(struct sctphdr);
++ cofs = iph_len + sizeof(struct sctphdr);
+ sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch);
+ if (sch == NULL)
+ return;
+@@ -472,7 +467,7 @@ sctp_state_transition(struct ip_vs_conn
+ unsigned int iph_len)
+ {
+ spin_lock_bh(&cp->lock);
+- set_sctp_state(pd, cp, direction, skb);
++ set_sctp_state(pd, cp, direction, skb, iph_len);
+ spin_unlock_bh(&cp->lock);
+ }
+
--- /dev/null
+From 1358126fbed104e5657955d3ba029b283687ba02 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Tue, 23 Jun 2026 15:37:44 +0800
+Subject: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 1358126fbed104e5657955d3ba029b283687ba02 upstream.
+
+imsic_early_acpi_init() allocates a firmware node before setting up the
+IMSIC state. If imsic_setup_state() fails, the function returns without
+freeing the allocated fwnode.
+
+Free the fwnode and clear the global pointer on this error path, matching
+the cleanup already done when imsic_early_probe() fails.
+
+[ tglx: Use a common cleanup path instead of copying code around ]
+
+Fixes: fbe826b1c106 ("irqchip/riscv-imsic: Add ACPI support")
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260623073744.2009137-1-haoxiang_li2024@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-riscv-imsic-early.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/irqchip/irq-riscv-imsic-early.c
++++ b/drivers/irqchip/irq-riscv-imsic-early.c
+@@ -236,16 +236,13 @@ static int __init imsic_early_acpi_init(
+ rc = imsic_setup_state(imsic_acpi_fwnode, imsic);
+ if (rc) {
+ pr_err("%pfwP: failed to setup state (error %d)\n", imsic_acpi_fwnode, rc);
+- return rc;
++ goto cleanup;
+ }
+
+ /* Do early setup of IMSIC state and IPIs */
+ rc = imsic_early_probe(imsic_acpi_fwnode);
+- if (rc) {
+- irq_domain_free_fwnode(imsic_acpi_fwnode);
+- imsic_acpi_fwnode = NULL;
+- return rc;
+- }
++ if (rc)
++ goto cleanup;
+
+ rc = imsic_platform_acpi_probe(imsic_acpi_fwnode);
+
+@@ -264,8 +261,12 @@ static int __init imsic_early_acpi_init(
+ * DT where IPI works but MSI probe fails for some reason.
+ */
+ return 0;
+-}
+
++cleanup:
++ irq_domain_free_fwnode(imsic_acpi_fwnode);
++ imsic_acpi_fwnode = NULL;
++ return rc;
++}
+ IRQCHIP_ACPI_DECLARE(riscv_imsic, ACPI_MADT_TYPE_IMSIC, NULL,
+ 1, imsic_early_acpi_init);
+ #endif
--- /dev/null
+From 660667cd406648bbaffbd5c0d897c2263a852f11 Mon Sep 17 00:00:00 2001
+From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
+Date: Tue, 30 Jun 2026 15:48:56 -0400
+Subject: llc: fix SAP refcount leak in llc_ui_autobind()
+
+From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
+
+commit 660667cd406648bbaffbd5c0d897c2263a852f11 upstream.
+
+llc_ui_autobind() opens a SAP after choosing a dynamic LSAP.
+llc_sap_open() returns a reference owned by the caller, and
+llc_sap_add_socket() takes a second reference for the socket's
+membership in the SAP hash tables.
+
+llc_ui_bind() drops the caller's reference after adding the socket,
+but llc_ui_autobind() keeps it. When the socket is closed,
+llc_sap_remove_socket() releases only the socket reference, leaving
+the SAP on llc_sap_list with sk_count == 0.
+
+This is user-visible because repeated autobind and close cycles can consume
+all dynamic SAP values and make later autobinds fail with -EUSERS.
+
+Drop the caller's reference after a successful autobind, matching
+llc_ui_bind()'s ownership model.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
+Link: https://patch.msgid.link/20260630194856.1036497-1-shuangpeng.kernel@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/llc/af_llc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -317,6 +317,7 @@ static int llc_ui_autobind(struct socket
+ /* assign new connection to its SAP */
+ llc_sap_add_socket(sap, sk);
+ sock_reset_flag(sk, SOCK_ZAPPED);
++ llc_sap_put(sap);
+ rc = 0;
+ out:
+ dev_put(dev);
--- /dev/null
+From 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 Mon Sep 17 00:00:00 2001
+From: Yousef Alhouseen <alhouseenyousef@gmail.com>
+Date: Wed, 1 Jul 2026 18:42:22 +0200
+Subject: mac802154: remove interfaces with RCU list deletion
+
+From: Yousef Alhouseen <alhouseenyousef@gmail.com>
+
+commit 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 upstream.
+
+Queue wake, stop, and disable paths walk local->interfaces under RCU.
+The bulk hardware teardown path removes entries with list_del(), so an
+asynchronous transmit completion can follow a poisoned list node in
+ieee802154_wake_queue().
+
+Use list_del_rcu() as in the single-interface removal path. The following
+unregister_netdevice() waits for in-flight RCU readers before freeing the
+netdevice, so no separate grace-period wait is needed.
+
+Fixes: 592dfbfc72f5 ("mac820154: move interface unregistration into iface")
+Reported-by: syzbot+36256deb69a588e9290e@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=36256deb69a588e9290e
+Cc: stable@vger.kernel.org
+Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20260701164222.9094-1-alhouseenyousef@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac802154/iface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac802154/iface.c
++++ b/net/mac802154/iface.c
+@@ -703,7 +703,7 @@ void ieee802154_remove_interfaces(struct
+
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+- list_del(&sdata->list);
++ list_del_rcu(&sdata->list);
+
+ unregister_netdevice(sdata->dev);
+ }
--- /dev/null
+From f5089008f90c0a7c5520dff3934e0af00adf322d Mon Sep 17 00:00:00 2001
+From: Daehyeon Ko <4ncienth@gmail.com>
+Date: Fri, 3 Jul 2026 17:36:33 +0900
+Subject: macsec: don't read an unset MAC header in macsec_encrypt()
+
+From: Daehyeon Ko <4ncienth@gmail.com>
+
+commit f5089008f90c0a7c5520dff3934e0af00adf322d upstream.
+
+macsec_encrypt() reads the Ethernet header via eth_hdr(skb)
+(skb->head + skb->mac_header) to memmove() the 12 source/destination MAC
+bytes forward and make room for the SecTAG.
+
+On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb
+reaches the macsec ndo_start_xmit() with the MAC header unset, so
+eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of
+bounds: a 12-byte heap over-read that is also emitted on the wire as the
+frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds
+read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET
+build flags it as an unset mac header in skb_mac_header().
+
+On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added
+by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in
+macvlan_broadcast()") for exactly this purpose.
+
+Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/20260703083634.2035145-1-4ncienth@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/macsec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -641,7 +641,7 @@ static struct sk_buff *macsec_encrypt(st
+ }
+
+ unprotected_len = skb->len;
+- eth = eth_hdr(skb);
++ eth = skb_eth_hdr(skb);
+ sci_present = macsec_send_sci(secy);
+ hh = skb_push(skb, macsec_extra_len(sci_present));
+ memmove(hh, eth, 2 * ETH_ALEN);
--- /dev/null
+From 7da7d599b8a83271c464adfd5ef160202b470570 Mon Sep 17 00:00:00 2001
+From: Zi Yan <ziy@nvidia.com>
+Date: Mon, 22 Jun 2026 11:30:42 -0400
+Subject: mm/compaction: handle free_pages_prepare() properly in compaction_free()
+
+From: Zi Yan <ziy@nvidia.com>
+
+commit 7da7d599b8a83271c464adfd5ef160202b470570 upstream.
+
+free_pages_prepare() can fail but compaction_free() does not handle the
+failure case. Failed pages should not be added back to cc->freepages for
+future use, since they can be either PageHWPoison or free_page_is_bad()
+and might cause data corruption.
+
+Link: https://lore.kernel.org/20260622-handle_free_pages_prepare_in_compaction_free-v1-1-fcf3b14abcf7@nvidia.com
+Fixes: 733aea0b3a7b ("mm/compaction: add support for >0 order folio memory compaction.")
+Signed-off-by: Zi Yan <ziy@nvidia.com>
+Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Lance Yang <lance.yang@linux.dev>
+Cc: Brendan Jackman <jackmanb@google.com>
+Cc: Jiaqi Yan <jiaqiyan@google.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/compaction.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -1894,15 +1894,14 @@ static void compaction_free(struct folio
+ int order = folio_order(dst);
+ struct page *page = &dst->page;
+
+- if (folio_put_testzero(dst)) {
+- free_pages_prepare(page, order);
++ if (folio_put_testzero(dst) && free_pages_prepare(page, order)) {
+ list_add(&dst->lru, &cc->freepages[order]);
+ cc->nr_freepages += 1 << order;
+ }
+ cc->nr_migratepages += 1 << order;
+ /*
+- * someone else has referenced the page, we cannot take it back to our
+- * free list.
++ * someone else has referenced the page or free_pages_prepare() fails,
++ * we cannot take it back to our free list.
+ */
+ }
+
--- /dev/null
+From 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f Mon Sep 17 00:00:00 2001
+From: Tao Liu <ltao@redhat.com>
+Date: Mon, 6 Jul 2026 11:27:07 +1200
+Subject: riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
+
+From: Tao Liu <ltao@redhat.com>
+
+commit 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f upstream.
+
+A NULL pointer dereference issue is noticed in riscv's
+machine_kexec_prepare(), where image->segment[i].buf might be NULL and
+copied unchecked.
+
+The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by
+kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without
+a check in machine_kexec_prepare():
+
+ kexec_file_load
+ -> kimage_file_alloc_init()
+ -> kimage_file_prepare_segments()
+ -> ima_add_kexec_buffer()
+ -> kexec_add_buffer()
+ -> machine_kexec_prepare()
+ -> memcpy()
+
+Address this by adding a check before the data copy attempt.
+
+Fixes: b7fb4d78a6ad ("RISC-V: use memcpy for kexec_file mode")
+Cc: stable@vger.kernel.org
+Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/
+Acked-by: Baoquan He <bhe@redhat.com>
+Acked-by: Pratyush Yadav <pratyush@kernel.org>
+Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
+Signed-off-by: Tao Liu <ltao@redhat.com>
+Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/machine_kexec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/riscv/kernel/machine_kexec.c
++++ b/arch/riscv/kernel/machine_kexec.c
+@@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *ima
+ if (image->segment[i].memsz <= sizeof(fdt))
+ continue;
+
++ if (!image->segment[i].buf)
++ continue;
++
+ if (image->file_mode)
+ memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
+ else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
--- /dev/null
+From ec84aad4c3594307d103af563991b4415ac5c8ab Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Date: Tue, 30 Jun 2026 19:32:14 +0200
+Subject: s390/mm: Fix type mismatch in get_align_mask().
+
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+
+commit ec84aad4c3594307d103af563991b4415ac5c8ab upstream.
+
+Commit 86f48f922ba79 ("s390/mmap: disable mmap alignment when
+randomize_va_space = 0") introduced get_align_mask() with return type of
+'int', while the target field 'info.align_mask' in struct
+vm_unmapped_area_info is 'unsigned long'.
+
+With currently used masks, this should not cause truncation issues, but
+fix it and return 'unsigned long' to avoid future problems.
+
+Fixes: 86f48f922ba79 ("s390/mmap: disable mmap alignment when randomize_va_space = 0")
+Cc: stable@vger.kernel.org # v6.9+
+Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/mm/mmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/mm/mmap.c
++++ b/arch/s390/mm/mmap.c
+@@ -71,7 +71,7 @@ static inline unsigned long mmap_base(un
+ return PAGE_ALIGN(STACK_TOP - gap - rnd);
+ }
+
+-static int get_align_mask(struct file *filp, unsigned long flags)
++static unsigned long get_align_mask(struct file *filp, unsigned long flags)
+ {
+ if (!(current->flags & PF_RANDOMIZE))
+ return 0;
--- /dev/null
+From 2995ccec260caa9e85b3301a4aba1e66ed80ad74 Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Date: Tue, 23 Jun 2026 19:44:06 +0200
+Subject: s390/monwriter: Reject buffer reuse with different data length
+
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+
+commit 2995ccec260caa9e85b3301a4aba1e66ed80ad74 upstream.
+
+When data buffers are reused, e.g. for interval sample records, the
+first record determines the data length, and the size of the buffer for
+user copy. Current monwriter code does not check if the data length was
+changed for subsequent records, which also would never happen for valid
+user programs.
+
+However, a malicious user could change the data length, resulting in out
+of bounds user copy to the kernel buffer, and memory corruption. By
+default, the monwriter misc device is created with root-only permissions,
+so practical impact is typically low.
+
+Fix this by checking for changed data length and rejecting such records.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/char/monwriter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/s390/char/monwriter.c
++++ b/drivers/s390/char/monwriter.c
+@@ -122,6 +122,9 @@ static int monwrite_new_hdr(struct mon_p
+ kfree(monbuf->data);
+ kfree(monbuf);
+ monbuf = NULL;
++ } else if (monbuf->hdr.datalen != monhdr->datalen) {
++ /* Data with buffer reuse must not change its length */
++ return -EINVAL;
+ }
+ } else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) {
+ if (mon_buf_count >= mon_max_bufs)
--- /dev/null
+From dd6a23bac306b7aa322e0aaccb60c6e32a198fb3 Mon Sep 17 00:00:00 2001
+From: Nirmoy Das <nirmoyd@nvidia.com>
+Date: Tue, 30 Jun 2026 09:51:57 -0700
+Subject: selftests: net: make busywait timeout clock portable
+
+From: Nirmoy Das <nirmoyd@nvidia.com>
+
+commit dd6a23bac306b7aa322e0aaccb60c6e32a198fb3 upstream.
+
+loopy_wait() expects millisecond timestamps. However, Ubuntu Resolute
+can use uutils date, where `date -u +%s%3N` returns seconds plus full
+nanoseconds instead of a 3-digit millisecond field. This makes
+busywait expire too early and can make vlan_bridge_binding.sh read a
+stale operstate.
+
+Fixes: 25ae948b4478 ("selftests/net: add lib.sh")
+Cc: stable@vger.kernel.org # 6.8+
+Link: https://github.com/uutils/coreutils/issues/11658
+Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
+Link: https://patch.msgid.link/20260630165157.3814871-1-nirmoyd@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/lib.sh | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -67,12 +67,33 @@ ksft_exit_status_merge()
+ $ksft_xfail $ksft_pass $ksft_skip $ksft_fail
+ }
+
++timestamp_ms()
++{
++ local now
++ local seconds
++ local nanoseconds
++
++ now=$(date -u +%s:%N) || return
++ seconds=${now%:*}
++ nanoseconds=${now#*:}
++
++ if [[ $nanoseconds =~ ^[0-9]+$ ]]; then
++ nanoseconds=${nanoseconds:0:9}
++ else
++ nanoseconds=0
++ fi
++
++ echo $((seconds * 1000 + 10#$nanoseconds / 1000000))
++}
++
+ loopy_wait()
+ {
+ local sleep_cmd=$1; shift
+ local timeout_ms=$1; shift
++ local start_time
++ local current_time
+
+- local start_time="$(date -u +%s%3N)"
++ start_time=$(timestamp_ms) || return
+ while true
+ do
+ local out
+@@ -81,7 +102,7 @@ loopy_wait()
+ return 0
+ fi
+
+- local current_time="$(date -u +%s%3N)"
++ current_time=$(timestamp_ms) || return
+ if ((current_time - start_time > timeout_ms)); then
+ echo -n "$out"
+ return 1
net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch
hwmon-asus_atk0110-check-package-count-before-accessing-element.patch
riscv-probes-save-original-sp-in-rethook-trampoline.patch
+mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch
+irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch
+s390-monwriter-reject-buffer-reuse-with-different-data-length.patch
+mac802154-remove-interfaces-with-rcu-list-deletion.patch
+selftests-net-make-busywait-timeout-clock-portable.patch
+llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch
+ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch
+ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch
+macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch
+arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch
+ata-libata-core-skip-hpa-resize-for-locked-drives.patch
+drbd-reject-data-replies-with-an-out-of-range-payload-size.patch
+riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch
+tracing-osnoise-call-synchronize_rcu-when-unregistering.patch
+s390-mm-fix-type-mismatch-in-get_align_mask.patch
+cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch
--- /dev/null
+From fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a Mon Sep 17 00:00:00 2001
+From: Crystal Wood <crwood@redhat.com>
+Date: Mon, 8 Jun 2026 23:54:30 -0500
+Subject: tracing/osnoise: Call synchronize_rcu() when unregistering
+
+From: Crystal Wood <crwood@redhat.com>
+
+commit fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a upstream.
+
+This ensures that any RCU readers traversing the instance list
+have finished, before releasing the reference on the tracer that
+the instance points to.
+
+Cc: stable@vger.kernel.org
+Fixes: a6ed2aee54644 ("tracing: Switch to kvfree_rcu() API")
+Link: https://patch.msgid.link/20260609045430.1589786-1-crwood@redhat.com
+Suggested-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Crystal Wood <crwood@redhat.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_osnoise.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_osnoise.c
++++ b/kernel/trace/trace_osnoise.c
+@@ -159,7 +159,9 @@ static void osnoise_unregister_instance(
+ if (!found)
+ return;
+
+- kvfree_rcu_mightsleep(inst);
++ /* Do a full sync to ensure that tr remains valid, not just inst */
++ synchronize_rcu();
++ kvfree(inst);
+ }
+
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
