--- /dev/null
+From f0334fbfd107682d0c95f3f71e25f6127038e2b9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 27 May 2026 10:41:49 -0300
+Subject: ASoC: mediatek: mt8183: Check runtime resume during probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit f0334fbfd107682d0c95f3f71e25f6127038e2b9 upstream.
+
+The MT8183 AFE probe uses pm_runtime_get_sync() before reading hardware
+defaults into the regmap cache, but does not check whether runtime resume
+failed. If regmap_reinit_cache() then fails, the temporary runtime PM
+usage count is also not released.
+
+Use pm_runtime_resume_and_get() so resume failures abort probe without
+leaking a usage count, and release the temporary reference before
+handling the regmap cache result.
+
+Fixes: a94aec035a12 ("ASoC: mediatek: mt8183: add platform driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260527-asoc-mt8183-probe-cleanup-v1-2-4f4f5593c8d1@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
++++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
+@@ -833,17 +833,21 @@ static int mt8183_afe_pcm_dev_probe(stru
+
+ /* enable clock for regcache get default value from hw */
+ afe_priv->pm_runtime_bypass_reg_ctl = true;
+- pm_runtime_get_sync(dev);
+-
+- ret = regmap_reinit_cache(afe->regmap, &mt8183_afe_regmap_config);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret) {
+- dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret);
++ afe_priv->pm_runtime_bypass_reg_ctl = false;
+ goto err_pm_disable;
+ }
+
++ ret = regmap_reinit_cache(afe->regmap, &mt8183_afe_regmap_config);
+ pm_runtime_put_sync(dev);
+ afe_priv->pm_runtime_bypass_reg_ctl = false;
+
++ if (ret) {
++ dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret);
++ goto err_pm_disable;
++ }
++
+ regcache_cache_only(afe->regmap, true);
+ regcache_mark_dirty(afe->regmap);
+
--- /dev/null
+From bee65e00c0924ebecf97718d95dcf4a05ee36471 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 27 May 2026 10:41:48 -0300
+Subject: ASoC: mediatek: mt8183: Release reserved memory on cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit bee65e00c0924ebecf97718d95dcf4a05ee36471 upstream.
+
+The MT8183 AFE probe can assign reserved memory with
+of_reserved_mem_device_init(), but the assignment is never released on
+driver removal or later probe failures.
+
+Register a devm cleanup action so the reserved memory assignment is
+released consistently, matching newer Mediatek AFE drivers.
+
+Fixes: ec4a10ca4a68 ("ASoC: mediatek: use reserved memory or enable buffer pre-allocation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260527-asoc-mt8183-probe-cleanup-v1-1-4f4f5593c8d1@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
++++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
+@@ -766,6 +766,11 @@ static const dai_register_cb dai_registe
+ mt8183_dai_memif_register,
+ };
+
++static void mt8183_afe_release_reserved_mem(void *data)
++{
++ of_reserved_mem_device_release(data);
++}
++
+ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ {
+ struct mtk_base_afe *afe;
+@@ -794,6 +799,12 @@ static int mt8183_afe_pcm_dev_probe(stru
+ if (ret) {
+ dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n");
+ afe->preallocate_buffers = true;
++ } else {
++ ret = devm_add_action_or_reset(dev,
++ mt8183_afe_release_reserved_mem,
++ dev);
++ if (ret)
++ return ret;
+ }
+
+ /* initial audio related clock */
--- /dev/null
+From e24d5dde56a50946020b134fa8448869093db76a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 27 May 2026 10:55:47 -0300
+Subject: ASoC: mediatek: mt8192: Check runtime resume during probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit e24d5dde56a50946020b134fa8448869093db76a upstream.
+
+The MT8192 AFE probe enables runtime PM temporarily while reinitializing
+the regmap cache from hardware, but it uses pm_runtime_get_sync()
+without checking the return value. If runtime resume fails, probe keeps
+going without the device necessarily being accessible, and
+pm_runtime_get_sync() may leave the PM usage count incremented.
+
+The regmap_reinit_cache() failure path also returns before dropping the
+temporary PM reference and before clearing pm_runtime_bypass_reg_ctl.
+
+Use pm_runtime_resume_and_get() so resume failures do not leak a usage
+count, and clear the temporary bypass flag after dropping the probe PM
+reference on all regmap_reinit_cache() outcomes.
+
+Fixes: 125ab5d588b0 ("ASoC: mediatek: mt8192: add platform driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260527-asoc-mt8192-probe-cleanup-v1-2-1bb834d05b72@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
++++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
+@@ -2218,15 +2218,19 @@ static int mt8192_afe_pcm_dev_probe(stru
+
+ /* enable clock for regcache get default value from hw */
+ afe_priv->pm_runtime_bypass_reg_ctl = true;
+- pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
++ if (ret) {
++ afe_priv->pm_runtime_bypass_reg_ctl = false;
++ return dev_err_probe(dev, ret, "failed to resume device\n");
++ }
+
+ ret = regmap_reinit_cache(afe->regmap, &mt8192_afe_regmap_config);
+- if (ret)
+- return dev_err_probe(dev, ret, "regmap_reinit_cache fail\n");
+-
+ pm_runtime_put_sync(dev);
+ afe_priv->pm_runtime_bypass_reg_ctl = false;
+
++ if (ret)
++ return dev_err_probe(dev, ret, "regmap_reinit_cache fail\n");
++
+ regcache_cache_only(afe->regmap, true);
+ regcache_mark_dirty(afe->regmap);
+
--- /dev/null
+From 965e17ae6751c5d3302430c8ebd650e72d45a85f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 27 May 2026 10:55:46 -0300
+Subject: ASoC: mediatek: mt8192: Release reserved memory on cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 965e17ae6751c5d3302430c8ebd650e72d45a85f upstream.
+
+The MT8192 AFE probe calls of_reserved_mem_device_init() and falls
+back to preallocated buffers when no reserved memory region is
+available. When the reserved memory assignment succeeds, however, the
+driver never releases it.
+
+Register a devm cleanup action after a successful reserved-memory
+assignment so the assignment is released on probe failure and driver
+unbind.
+
+Fixes: ec4a10ca4a68 ("ASoC: mediatek: use reserved memory or enable buffer pre-allocation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260527-asoc-mt8192-probe-cleanup-v1-1-1bb834d05b72@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
++++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
+@@ -2155,6 +2155,11 @@ static const dai_register_cb dai_registe
+ mt8192_dai_memif_register,
+ };
+
++static void mt8192_afe_release_reserved_mem(void *data)
++{
++ of_reserved_mem_device_release(data);
++}
++
+ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
+ {
+ struct mtk_base_afe *afe;
+@@ -2184,6 +2189,10 @@ static int mt8192_afe_pcm_dev_probe(stru
+ if (ret) {
+ dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n");
+ afe->preallocate_buffers = true;
++ } else {
++ ret = devm_add_action_or_reset(dev, mt8192_afe_release_reserved_mem, dev);
++ if (ret)
++ return ret;
+ }
+
+ /* init audio related clock */
--- /dev/null
+From 2e9261761b35f0b67b7487688cd1365f535be0b3 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Date: Tue, 16 Jun 2026 18:02:57 +0100
+Subject: ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
+
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+
+commit 2e9261761b35f0b67b7487688cd1365f535be0b3 upstream.
+
+When q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf
+and sets them to NULL under graph->lock. A late DSP buffer-done response
+can race with this: graph_callback() passes the !graph->ar_graph guard
+(not yet NULL), acquires the lock, but then dereferences a now-NULL buf
+pointer to read buf[token].phys, crashing at virtual address 0x10.
+
+Add a NULL check for buf inside the mutex-protected section in both the
+write-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and
+read-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail
+out cleanly if buffers have already been freed.
+
+This problem is only shown up recently while apr bus was updated to
+process the commands per service rather from single global queue.
+
+Fixes: 5477518b8a0e ("ASoC: qdsp6: audioreach: add q6apm support")
+Cc: Stable@vger.kernel.org
+Assisted-by: Claude:claude-4-6-sonnet
+Reported-by: Val Packett <val@packett.cool>
+Closes: https://lore.kernel.org/all/133ced18-1aa9-475d-80d8-6120678bdde4@packett.cool/
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260616170257.9381-1-srinivas.kandagatla@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6apm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/soc/qcom/qdsp6/q6apm.c
++++ b/sound/soc/qcom/qdsp6/q6apm.c
+@@ -549,6 +549,10 @@ static int graph_callback(const struct g
+ token = hdr->token & APM_WRITE_TOKEN_MASK;
+
+ done = data->payload;
++ if (!graph->rx_data.buf) {
++ mutex_unlock(&graph->lock);
++ break;
++ }
+ phys = graph->rx_data.buf[token].phys;
+ mutex_unlock(&graph->lock);
+ /* token numbering starts at 0 */
+@@ -571,6 +575,10 @@ static int graph_callback(const struct g
+ client_event = APM_CLIENT_EVENT_DATA_READ_DONE;
+ mutex_lock(&graph->lock);
+ rd_done = data->payload;
++ if (!graph->tx_data.buf) {
++ mutex_unlock(&graph->lock);
++ break;
++ }
+ phys = graph->tx_data.buf[hdr->token].phys;
+ mutex_unlock(&graph->lock);
+ /* token numbering starts at 0 */
--- /dev/null
+From fd46668d538993218eea19c6925c868ac0f2630c Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Tue, 9 Jun 2026 11:34:58 +0300
+Subject: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit fd46668d538993218eea19c6925c868ac0f2630c upstream.
+
+The ipc_control_data buffer is allocated as kzalloc(max_size), where
+max_size covers the entire struct sof_ipc_ctrl_data including its
+flexible array payload. However, the bounds checks in bytes_ext_put
+and _bytes_ext_get compared user data lengths against max_size
+directly, ignoring that cdata->data sits at an offset of
+sizeof(struct sof_ipc_ctrl_data) bytes into the allocation.
+
+This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past
+the end of the heap buffer from unprivileged userspace via the ALSA TLV
+kcontrol interface, and similarly allowed over-reading adjacent heap
+data on the get path.
+
+Fix all bounds checks to subtract sizeof(*cdata) from max_size so they
+reflect the actual space available at the cdata->data offset. Also fix
+the error-path restore in bytes_ext_put which wrote to cdata->data
+instead of cdata, causing the same overflow.
+
+Fixes: 67ec2a091630 ("ASoC: SOF: Add bytes_ext control IPC ops for IPC3")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20260609083458.31193-7-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/ipc3-control.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/sof/ipc3-control.c
++++ b/sound/soc/sof/ipc3-control.c
+@@ -398,9 +398,17 @@ static int sof_ipc3_bytes_ext_put(struct
+ }
+
+ /* be->max is coming from topology */
+- if (header.length > scontrol->max_size) {
+- dev_err_ratelimited(scomp->dev, "Bytes data size %d exceeds max %zu\n",
+- header.length, scontrol->max_size);
++ if (header.length > scontrol->max_size - sizeof(*cdata)) {
++ dev_err_ratelimited(scomp->dev, "Bytes data size %u exceeds max %zu\n",
++ header.length, scontrol->max_size - sizeof(*cdata));
++ return -EINVAL;
++ }
++
++ /* Ensure the data is large enough to contain the ABI header */
++ if (header.length < sizeof(struct sof_abi_hdr)) {
++ dev_err_ratelimited(scomp->dev,
++ "Bytes data size %u less than ABI header %zu\n",
++ header.length, sizeof(struct sof_abi_hdr));
+ return -EINVAL;
+ }
+
+@@ -436,7 +444,7 @@ static int sof_ipc3_bytes_ext_put(struct
+ }
+
+ /* be->max has been verified to be >= sizeof(struct sof_abi_hdr) */
+- if (cdata->data->size > scontrol->max_size - sizeof(struct sof_abi_hdr)) {
++ if (cdata->data->size > scontrol->max_size - sizeof(*cdata) - sizeof(struct sof_abi_hdr)) {
+ dev_err_ratelimited(scomp->dev, "Mismatch in ABI data size (truncated?)\n");
+ goto err_restore;
+ }
+@@ -452,7 +460,7 @@ static int sof_ipc3_bytes_ext_put(struct
+ err_restore:
+ /* If we have an issue, we restore the old, valid bytes control data */
+ if (scontrol->old_ipc_control_data) {
+- memcpy(cdata->data, scontrol->old_ipc_control_data, scontrol->max_size);
++ memcpy(cdata, scontrol->old_ipc_control_data, scontrol->max_size);
+ kfree(scontrol->old_ipc_control_data);
+ scontrol->old_ipc_control_data = NULL;
+ }
+@@ -491,10 +499,13 @@ static int _sof_ipc3_bytes_ext_get(struc
+ }
+
+ /* check data size doesn't exceed max coming from topology */
+- if (cdata->data->size > scontrol->max_size - sizeof(struct sof_abi_hdr)) {
+- dev_err_ratelimited(scomp->dev, "User data size %d exceeds max size %zu\n",
++ if (cdata->data->size > scontrol->max_size - sizeof(*cdata) -
++ sizeof(struct sof_abi_hdr)) {
++ dev_err_ratelimited(scomp->dev,
++ "User data size %u exceeds max size %zu\n",
+ cdata->data->size,
+- scontrol->max_size - sizeof(struct sof_abi_hdr));
++ scontrol->max_size - sizeof(*cdata) -
++ sizeof(struct sof_abi_hdr));
+ return -EINVAL;
+ }
+
--- /dev/null
+From 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Tue, 9 Jun 2026 11:34:56 +0300
+Subject: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e upstream.
+
+In snd_sof_update_control(), firmware-provided cdata->num_elems is
+checked against local_cdata->data->size but never against the actual
+allocation size. If local_cdata->data->size was previously set to an
+inconsistent value, the memcpy could write past the allocated buffer.
+
+Add a bounds check to ensure num_elems fits within the available space
+in the ipc_control_data allocation before copying.
+
+Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20260609083458.31193-5-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/ipc3-control.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/soc/sof/ipc3-control.c
++++ b/sound/soc/sof/ipc3-control.c
+@@ -555,6 +555,15 @@ static void snd_sof_update_control(struc
+ return;
+ }
+
++ /* Verify the size fits within the allocation */
++ if (cdata->num_elems > scontrol->max_size - sizeof(*local_cdata) -
++ sizeof(*local_cdata->data)) {
++ dev_err(scomp->dev,
++ "cdata binary size %u exceeds buffer\n",
++ cdata->num_elems);
++ return;
++ }
++
+ /* copy the new binary data */
+ memcpy(local_cdata->data, cdata->data, cdata->num_elems);
+ } else if (cdata->num_elems != scontrol->num_channels) {
--- /dev/null
+From d46f9f23897261da53ffbeb89d48a13982ba7d28 Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 10 Jun 2026 15:20:43 +0800
+Subject: ASoC: SOF: topology: fix memory leak in snd_sof_load_topology
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit d46f9f23897261da53ffbeb89d48a13982ba7d28 upstream.
+
+When the topology filename contains "dummy" and tplg_cnt is 0, the
+function returns -EINVAL directly without freeing the tplg_files
+allocated by kcalloc() at line 2497. This leaks memory on every
+such topology load attempt.
+
+Fix this by setting ret = -EINVAL and jumping to the out: label,
+which already handles the kfree(tplg_files) cleanup.
+
+Fixes: 99c159279c6d ("ASoC: SOF: don't check the existence of dummy topology")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/tencent_3EED6D778DC52C3703A2D1EE8119372E8E08@qq.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/topology.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/sof/topology.c
++++ b/sound/soc/sof/topology.c
+@@ -2537,6 +2537,8 @@ int snd_sof_load_topology(struct snd_soc
+ if (strstr(file, "dummy")) {
+ dev_err(scomp->dev,
+ "Function topology is required, please upgrade sof-firmware\n");
++
++ kfree(tplg_files);
+ return -EINVAL;
+ }
+ tplg_files[0] = file;
--- /dev/null
+From f37f5a2ac9d3737617c08f0dc7270b42e9cad907 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Duje=20Mihanovi=C4=87?= <duje@dujemihanovic.xyz>
+Date: Sat, 28 Mar 2026 21:42:16 +0100
+Subject: backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Duje Mihanović <duje@dujemihanovic.xyz>
+
+commit f37f5a2ac9d3737617c08f0dc7270b42e9cad907 upstream.
+
+Boards using this backlight chip do not power the backlight off on
+suspend. Enable BL_CORE_SUSPENDRESUME so the chip gets powered off by
+the backlight core on suspend.
+
+Tested on samsung,coreprimevelte.
+
+Cc: stable@vger.kernel.org # v6.19
+Signed-off-by: Duje Mihanović <duje@dujemihanovic.xyz>
+Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
+Link: https://patch.msgid.link/20260328-ktd2801-pm-fix-v1-1-007cb103faeb@dujemihanovic.xyz
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/backlight/ktd2801-backlight.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/backlight/ktd2801-backlight.c
++++ b/drivers/video/backlight/ktd2801-backlight.c
+@@ -53,6 +53,7 @@ static int ktd2801_update_status(struct
+ }
+
+ static const struct backlight_ops ktd2801_backlight_ops = {
++ .options = BL_CORE_SUSPENDRESUME,
+ .update_status = ktd2801_update_status,
+ };
+
--- /dev/null
+From 7141990add3f75436f2933cb310654cad3b1e3e9 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 28 Jun 2026 08:35:35 +0200
+Subject: batman-adv: access unicast_ttvn skb->data only after skb realloc
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 7141990add3f75436f2933cb310654cad3b1e3e9 upstream.
+
+The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
+behind the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+This was done correctly for the ethernet header but missed for the
+unicast_packet pointer.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/routing.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/batman-adv/routing.c
++++ b/net/batman-adv/routing.c
+@@ -855,8 +855,8 @@ static bool batadv_check_unicast_ttvn(st
+ if (skb_cow(skb, sizeof(*unicast_packet)) < 0)
+ return false;
+
+- unicast_packet = (struct batadv_unicast_packet *)skb->data;
+ vid = batadv_get_vid(skb, hdr_len);
++ unicast_packet = (struct batadv_unicast_packet *)skb->data;
+ ethhdr = (struct ethhdr *)(skb->data + hdr_len);
+
+ /* do not reroute multicast frames in a unicast header */
--- /dev/null
+From cdf3b5af2bc4431e58629e8ad2086b1e9185c761 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 28 Jun 2026 08:45:41 +0200
+Subject: batman-adv: bla: reacquire gw address after skb realloc
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit cdf3b5af2bc4431e58629e8ad2086b1e9185c761 upstream.
+
+The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
+the buffer behind the skb. Variables which were pointing to the old buffer
+need to be reassigned to avoid an use-after-free.
+
+Cc: stable@vger.kernel.org
+Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/routing.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/batman-adv/routing.c
++++ b/net/batman-adv/routing.c
+@@ -1029,6 +1029,7 @@ int batadv_recv_unicast_packet(struct sk
+ hdr_size);
+ batadv_orig_node_put(orig_node_gw);
+ if (is_gw) {
++ orig_addr_gw = eth_hdr(skb)->h_source;
+ batadv_dbg(BATADV_DBG_BLA, bat_priv,
+ "%s(): Dropped unicast pkt received from another backbone gw %pM.\n",
+ __func__, orig_addr_gw);
--- /dev/null
+From 8669a550c752d86baebc5fdc83b8ff35c4372c0e Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sat, 4 Jul 2026 09:46:09 +0200
+Subject: batman-adv: clean untagged VLAN on netdev registration failure
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream.
+
+When an mesh interface is registered, it creates an untagged struct
+batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in
+this process, another receiver of this notification can veto the
+registration. The netdev registration will be aborted because of this veto.
+
+The register_netdevice() call will try to clean up the net_device using
+unregister_netdevice_queue() - which only uses the .priv_destructor to
+free private resources. In this situation, .dellink will not be called.
+
+The cleanup of the untagged batadv_meshif_vlan must thefore be done in the
+destructor to avoid a leak of this object.
+
+Cc: stable@vger.kernel.org
+Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/main.c | 8 ++++++++
+ net/batman-adv/mesh-interface.c | 13 ++-----------
+ net/batman-adv/mesh-interface.h | 2 ++
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -245,6 +245,7 @@ err_orig:
+ void batadv_mesh_free(struct net_device *mesh_iface)
+ {
+ struct batadv_priv *bat_priv = netdev_priv(mesh_iface);
++ struct batadv_meshif_vlan *vlan;
+
+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+
+@@ -259,6 +260,13 @@ void batadv_mesh_free(struct net_device
+
+ batadv_mcast_free(bat_priv);
+
++ /* destroy the "untagged" VLAN */
++ vlan = batadv_meshif_vlan_get(bat_priv, BATADV_NO_FLAGS);
++ if (vlan) {
++ batadv_meshif_destroy_vlan(bat_priv, vlan);
++ batadv_meshif_vlan_put(vlan);
++ }
++
+ /* Free the TT and the originator tables only after having terminated
+ * all the other depending components which may use these structures for
+ * their purposes.
+--- a/net/batman-adv/mesh-interface.c
++++ b/net/batman-adv/mesh-interface.c
+@@ -593,8 +593,8 @@ int batadv_meshif_create_vlan(struct bat
+ * @bat_priv: the bat priv with all the mesh interface information
+ * @vlan: the object to remove
+ */
+-static void batadv_meshif_destroy_vlan(struct batadv_priv *bat_priv,
+- struct batadv_meshif_vlan *vlan)
++void batadv_meshif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_meshif_vlan *vlan)
+ {
+ /* explicitly remove the associated TT local entry because it is marked
+ * with the NOPURGE flag
+@@ -1089,22 +1089,13 @@ static int batadv_meshif_newlink(struct
+ static void batadv_meshif_destroy_netlink(struct net_device *mesh_iface,
+ struct list_head *head)
+ {
+- struct batadv_priv *bat_priv = netdev_priv(mesh_iface);
+ struct batadv_hard_iface *hard_iface;
+- struct batadv_meshif_vlan *vlan;
+
+ while (!list_empty(&mesh_iface->adj_list.lower)) {
+ hard_iface = netdev_adjacent_get_private(mesh_iface->adj_list.lower.next);
+ batadv_hardif_disable_interface(hard_iface);
+ }
+
+- /* destroy the "untagged" VLAN */
+- vlan = batadv_meshif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+- if (vlan) {
+- batadv_meshif_destroy_vlan(bat_priv, vlan);
+- batadv_meshif_vlan_put(vlan);
+- }
+-
+ unregister_netdevice_queue(mesh_iface, head);
+ }
+
+--- a/net/batman-adv/mesh-interface.h
++++ b/net/batman-adv/mesh-interface.h
+@@ -21,6 +21,8 @@ void batadv_interface_rx(struct net_devi
+ bool batadv_meshif_is_valid(const struct net_device *net_dev);
+ extern struct rtnl_link_ops batadv_link_ops;
+ int batadv_meshif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid);
++void batadv_meshif_destroy_vlan(struct batadv_priv *bat_priv,
++ struct batadv_meshif_vlan *vlan);
+ void batadv_meshif_vlan_release(struct kref *ref);
+ struct batadv_meshif_vlan *batadv_meshif_vlan_get(struct batadv_priv *bat_priv,
+ unsigned short vid);
--- /dev/null
+From 48067b2ae4504500a7093d9e1e16b42e70330480 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 28 Jun 2026 08:45:41 +0200
+Subject: batman-adv: dat: acquire ARP hw source only after skb realloc
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 48067b2ae4504500a7093d9e1e16b42e70330480 upstream.
+
+The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
+behind the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+Cc: stable@vger.kernel.org
+Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/distributed-arp-table.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -1746,6 +1746,7 @@ void batadv_dat_snoop_incoming_dhcp_ack(
+ struct ethhdr *ethhdr;
+ __be32 ip_src, yiaddr;
+ unsigned short vid;
++ int hdr_size_tmp;
+ __be16 proto;
+ u8 *hw_src;
+
+@@ -1762,8 +1763,10 @@ void batadv_dat_snoop_incoming_dhcp_ack(
+ if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
+ return;
+
++ hdr_size_tmp = hdr_size;
++ vid = batadv_dat_get_vid(skb, &hdr_size_tmp);
++ ethhdr = (struct ethhdr *)(skb->data + hdr_size);
+ hw_src = ethhdr->h_source;
+- vid = batadv_dat_get_vid(skb, &hdr_size);
+
+ batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
+ batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
--- /dev/null
+From 26560c4a03dc4d607331600c187f59ab2df5f341 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 28 Jun 2026 10:37:07 +0200
+Subject: batman-adv: dat: ensure accessible eth_hdr proto field
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 26560c4a03dc4d607331600c187f59ab2df5f341 upstream.
+
+When batadv_get_vid() accesses the proto field of the ethernet header, it
+is not checking if the data itself is accessible. The caller is responsible
+for it. But in contrast to other call sites, batadv_dat_get_vid() and its
+caller didn't make sure this is true. This could have caused an
+out-of-bounds access.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/distributed-arp-table.c | 23 +++++++++++++++++++++++
+ net/batman-adv/main.c | 3 +++
+ 2 files changed, 26 insertions(+)
+
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -1065,6 +1065,9 @@ out:
+ * @skb: the buffer containing the packet to extract the VID from
+ * @hdr_size: the size of the batman-adv header encapsulating the packet
+ *
++ * The caller must ensure that at least @hdr_size + ETH_HLEN bytes are
++ * accessible after skb->data.
++ *
+ * Return: If the packet embedded in the skb is vlan tagged this function
+ * returns the VID with the BATADV_VLAN_HAS_TAG flag. Otherwise BATADV_NO_FLAGS
+ * is returned.
+@@ -1147,6 +1150,10 @@ bool batadv_dat_snoop_outgoing_arp_reque
+ if (!atomic_read(&bat_priv->distributed_arp_table))
+ goto out;
+
++ /* first, find out the vid. */
++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
++ goto out;
++
+ vid = batadv_dat_get_vid(skb, &hdr_size);
+
+ type = batadv_arp_get_type(bat_priv, skb, hdr_size);
+@@ -1242,6 +1249,10 @@ bool batadv_dat_snoop_incoming_arp_reque
+ if (!atomic_read(&bat_priv->distributed_arp_table))
+ goto out;
+
++ /* first, find out the vid. */
++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
++ goto out;
++
+ vid = batadv_dat_get_vid(skb, &hdr_size);
+
+ type = batadv_arp_get_type(bat_priv, skb, hdr_size);
+@@ -1304,6 +1315,10 @@ void batadv_dat_snoop_outgoing_arp_reply
+ if (!atomic_read(&bat_priv->distributed_arp_table))
+ return;
+
++ /* first, find out the vid. */
++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
++ return;
++
+ vid = batadv_dat_get_vid(skb, &hdr_size);
+
+ type = batadv_arp_get_type(bat_priv, skb, hdr_size);
+@@ -1352,6 +1367,10 @@ bool batadv_dat_snoop_incoming_arp_reply
+ if (!atomic_read(&bat_priv->distributed_arp_table))
+ goto out;
+
++ /* first, find out the vid. */
++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
++ goto out;
++
+ vid = batadv_dat_get_vid(skb, &hdr_size);
+
+ type = batadv_arp_get_type(bat_priv, skb, hdr_size);
+@@ -1806,6 +1825,10 @@ bool batadv_dat_drop_broadcast_packet(st
+ if (batadv_forw_packet_is_rebroadcast(forw_packet))
+ goto out;
+
++ /* first, find out the vid. */
++ if (!pskb_may_pull(forw_packet->skb, hdr_size + ETH_HLEN))
++ goto out;
++
+ vid = batadv_dat_get_vid(forw_packet->skb, &hdr_size);
+
+ type = batadv_arp_get_type(bat_priv, forw_packet->skb, hdr_size);
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -566,6 +566,9 @@ void batadv_recv_handler_unregister(u8 p
+ * @skb: the buffer containing the packet
+ * @header_len: length of the batman header preceding the ethernet header
+ *
++ * The caller must ensure that at least @header_len + ETH_HLEN bytes are
++ * accessible after skb->data.
++ *
+ * Return: VID with the BATADV_VLAN_HAS_TAG flag when the packet embedded in the
+ * skb is vlan tagged. Otherwise BATADV_NO_FLAGS.
+ */
--- /dev/null
+From 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Thu, 2 Jul 2026 19:32:40 +0200
+Subject: batman-adv: dat: fix tie-break for candidate selection
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b upstream.
+
+The original version of the candidate selection for DAT attempted to
+compare both candidate and max_orig_node to identify which has the smaller
+MAC address. This comparison is required as tie-break when a hash collision
+happened.
+
+But the used function returned 0 when the function was not equal and a
+non-zero value when it was equal. As result, the actually selected
+node was dependent on the order of entries in the orig_hash and not
+actually on the mac addresses. The last originator in the hash collision
+would always win.
+
+To have a proper ordering, it must diff the actual MAC address bytes and
+reject the candidate when the diff is not smaller than 0.
+
+Cc: stable@vger.kernel.org
+Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/distributed-arp-table.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -545,7 +545,7 @@ static bool batadv_is_orig_node_eligible
+ * the one with the lowest address
+ */
+ if (tmp_max == max && max_orig_node &&
+- batadv_compare_eth(candidate->orig, max_orig_node->orig))
++ memcmp(candidate->orig, max_orig_node->orig, ETH_ALEN) >= 0)
+ goto out;
+
+ ret = true;
--- /dev/null
+From 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Thu, 2 Jul 2026 11:46:21 +0200
+Subject: batman-adv: ensure minimal ethernet header on TX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream.
+
+As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
+at least eth header len bytes"), it is possible by for a local user with
+eBPF TC hook access to attach a tc filter which truncates the packet and
+redirects to an batadv interface. But the code assumes that at least
+ETH_HLEN bytes are available and thus might read outside of the available
+buffer.
+
+The batadv_interface_tx() must therefore always check itself if enough data
+is available for the ethernet header and don't rely on min_header_len.
+
+Cc: stable@vger.kernel.org
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/mesh-interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/batman-adv/mesh-interface.c
++++ b/net/batman-adv/mesh-interface.c
+@@ -193,6 +193,9 @@ static netdev_tx_t batadv_interface_tx(s
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto dropped;
+
++ if (!pskb_may_pull(skb, ETH_HLEN))
++ goto dropped;
++
+ /* reset control block to avoid left overs from previous users */
+ memset(skb->cb, 0, sizeof(struct batadv_skb_cb));
+
--- /dev/null
+From fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Thu, 2 Jul 2026 20:45:24 +0200
+Subject: batman-adv: fix VLAN priority offset
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 upstream.
+
+The batadv_skb_set_priority() receives an SKB with the inner ethernet
+header at position "offset". When it tries to extract the IPv4 and IPv6
+header, it needs to skip the ethernet header to get access to the IP
+header.
+
+But for VLAN header, it performs the access with the struct vlan_ethhdr.
+This struct contains both both the ethernet header and the VLAN header. It
+is therefore incorrect to skip over the whole vlan_ethhdr size to get
+access to the vlan_ethhdr.
+
+Cc: stable@vger.kernel.org
+Fixes: c54f38c9aa22 ("batman-adv: set skb priority according to content")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -354,7 +354,7 @@ void batadv_skb_set_priority(struct sk_b
+
+ switch (ethhdr->h_proto) {
+ case htons(ETH_P_8021Q):
+- vhdr = skb_header_pointer(skb, offset + sizeof(*vhdr),
++ vhdr = skb_header_pointer(skb, offset,
+ sizeof(*vhdr), &vhdr_tmp);
+ if (!vhdr)
+ return;
--- /dev/null
+From 353d2c1d5492e53ae34f490a84494124dc3d3531 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 3 Jul 2026 21:04:03 +0200
+Subject: batman-adv: frag: fix primary_if leak on failed linearization
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 353d2c1d5492e53ae34f490a84494124dc3d3531 upstream.
+
+If the skb has a frag_list, it must be linearized before it can be split
+using skb_split(). But when this step failed, it must not only free the skb
+but also take care of the reference to the already found primary_if.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: a063f2fba3fa ("batman-adv: Don't skb_split skbuffs with frag_list")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/fragmentation.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -545,7 +545,7 @@ int batadv_frag_send_packet(struct sk_bu
+ */
+ if (skb_has_frag_list(skb) && __skb_linearize(skb)) {
+ ret = -ENOMEM;
+- goto free_skb;
++ goto put_primary_if;
+ }
+
+ /* Create one header to be copied to all fragments */
--- /dev/null
+From 6b628425aed49a1c7a4ffc997583840fc582d32b Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 3 Jul 2026 20:28:31 +0200
+Subject: batman-adv: frag: free unfragmentable packet
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 6b628425aed49a1c7a4ffc997583840fc582d32b upstream.
+
+The caller of batadv_frag_send_packet() assume that the skb provided to the
+function are always consumed. But the pre-check for an empty payload or the
+zero fragment size returned an error without any further actions.
+
+A failed pre-check must use the same error handling code as the rest of the
+function.
+
+Cc: stable@vger.kernel.org
+Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/fragmentation.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -516,8 +516,10 @@ int batadv_frag_send_packet(struct sk_bu
+ mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
+ max_fragment_size = mtu - header_size;
+
+- if (skb->len == 0 || max_fragment_size == 0)
+- return -EINVAL;
++ if (skb->len == 0 || max_fragment_size == 0) {
++ ret = -EINVAL;
++ goto free_skb;
++ }
+
+ num_fragments = (skb->len - 1) / max_fragment_size + 1;
+ max_fragment_size = (skb->len - 1) / num_fragments + 1;
--- /dev/null
+From 77880a3be88d378d60cc1e8f8ec70430e2ed0518 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 28 Jun 2026 08:45:41 +0200
+Subject: batman-adv: gw: acquire ethernet header only after skb realloc
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 77880a3be88d378d60cc1e8f8ec70430e2ed0518 upstream.
+
+The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
+behind the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+Cc: stable@vger.kernel.org
+Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/gateway_client.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -683,12 +683,13 @@ bool batadv_gw_out_of_range(struct batad
+ struct batadv_gw_node *gw_node = NULL;
+ struct batadv_gw_node *curr_gw = NULL;
+ struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo;
+- struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
++ struct ethhdr *ethhdr;
+ bool out_of_range = false;
+ u8 curr_tq_avg;
+ unsigned short vid;
+
+ vid = batadv_get_vid(skb, 0);
++ ethhdr = (struct ethhdr *)skb->data;
+
+ if (is_multicast_ether_addr(ethhdr->h_dest))
+ goto out;
--- /dev/null
+From 38eaed28e250895d56f4b7989bd65479a511c5c3 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 3 Jul 2026 20:47:45 +0200
+Subject: batman-adv: mcast: avoid OOB read of num_dests header
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 38eaed28e250895d56f4b7989bd65479a511c5c3 upstream.
+
+Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is
+attempted to check whether enough space is actually in the network header.
+But instead of using offsetofend() to check for the whole size (2) which
+must be accessible, offsetof() of is called. The latter is always returning
+0. The comparison with the network header length will always return that
+enough data is available - even when only 1 or 0 bytes are accessible.
+
+Instead of using offsetofend(), use the more common check for the whole
+header.
+
+Cc: stable@vger.kernel.org
+Fixes: 07afe1ba288c ("batman-adv: mcast: implement multicast packet reception and forwarding")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/multicast_forw.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/net/batman-adv/multicast_forw.c
++++ b/net/batman-adv/multicast_forw.c
+@@ -927,11 +927,11 @@ static int batadv_mcast_forw_packet(stru
+ {
+ struct batadv_tvlv_mcast_tracker *mcast_tracker;
+ struct batadv_neigh_node *neigh_node;
+- unsigned long offset, num_dests_off;
+ struct sk_buff *nexthop_skb;
+ unsigned char *skb_net_hdr;
+ bool local_recv = false;
+ unsigned int tvlv_len;
++ unsigned long offset;
+ bool xmitted = false;
+ u8 *dest, *next_dest;
+ u16 num_dests;
+@@ -940,9 +940,8 @@ static int batadv_mcast_forw_packet(stru
+ /* (at least) TVLV part needs to be linearized */
+ SKB_LINEAR_ASSERT(skb);
+
+- /* check if num_dests is within skb length */
+- num_dests_off = offsetof(struct batadv_tvlv_mcast_tracker, num_dests);
+- if (num_dests_off > skb_network_header_len(skb))
++ /* check if batadv_tvlv_mcast_tracker header is within skb length */
++ if (sizeof(*mcast_tracker) > skb_network_header_len(skb))
+ return -EINVAL;
+
+ skb_net_hdr = skb_network_header(skb);
--- /dev/null
+From 035e1fed892d3d06002a73ff73668f618a514644 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 28 Jun 2026 06:44:13 +0200
+Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 035e1fed892d3d06002a73ff73668f618a514644 upstream.
+
+pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
+the skb. Variables which were pointing to the old buffer need to be
+reassigned to avoid an use-after-free.
+
+This was done correctly for the VLAN header but missed for the ethernet
+header which is later used for the TT and AP isolation handling.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/mesh-interface.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/batman-adv/mesh-interface.c
++++ b/net/batman-adv/mesh-interface.c
+@@ -432,6 +432,7 @@ void batadv_interface_rx(struct net_devi
+ if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+ goto dropped;
+
++ ethhdr = eth_hdr(skb);
+ vhdr = skb_vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
--- /dev/null
+From 27c7d40008231ae4140d35501b60087a9de2d2c3 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Thu, 2 Jul 2026 21:06:23 +0200
+Subject: batman-adv: tt: avoid request storms during pending request
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 27c7d40008231ae4140d35501b60087a9de2d2c3 upstream.
+
+batadv_send_tt_request() allocates a tt_req_node when none exists for the
+destination originator node. This should prevent that a multiple TT
+requests are send at the same time to an originator.
+
+But if allocation of the send buffer failed, this request must be cleaned
+up again. But indicator for such a failure is "ret == false". But the
+actual implementation is checking for "ret == true".
+
+The check must be inverted to not loose the information about the TT
+request directly after it was attempted to be sent out. This should avoid
+potential request storms.
+
+Cc: stable@vger.kernel.org
+Fixes: 335fbe0f5d25 ("batman-adv: tvlv - convert tt query packet to use tvlv unicast packets")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/translation-table.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -2963,7 +2963,7 @@ static bool batadv_send_tt_request(struc
+ out:
+ batadv_hardif_put(primary_if);
+
+- if (ret && tt_req_node) {
++ if (!ret && tt_req_node) {
+ spin_lock_bh(&bat_priv->tt.req_list_lock);
+ if (!hlist_unhashed(&tt_req_node->list)) {
+ hlist_del_init(&tt_req_node->list);
--- /dev/null
+From 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 3 Jul 2026 22:27:13 +0200
+Subject: batman-adv: tt: prevent TVLV OOB check overflow
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b upstream.
+
+A TT unicast TVLV contains the number of VLANs stored in it. This number is
+an u16 and gets multiplied by the size of the struct
+batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16
+used to store the tt_vlan_len. All additional safety checks to prevent
+out-of-bounds access of the TVLV buffer are invalid due to this overflow.
+
+Using size_t prevents this overflow and ensures that the safety checks
+compare against the actual buffer requirements.
+
+Cc: stable@vger.kernel.org
+Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/translation-table.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -4025,7 +4025,8 @@ static int batadv_tt_tvlv_unicast_handle
+ u16 tvlv_value_len)
+ {
+ struct batadv_tvlv_tt_data *tt_data;
+- u16 tt_vlan_len, tt_num_entries;
++ u16 tt_num_entries;
++ size_t tt_vlan_len;
+ char tt_flag;
+ bool ret;
+
--- /dev/null
+From f71d68d2b473e47db260c27c98212829590d8bae Mon Sep 17 00:00:00 2001
+From: Shyam Prasad N <sprasad@microsoft.com>
+Date: Thu, 14 May 2026 23:38:07 +0530
+Subject: cifs: invalidate cfid on unlink/rename/rmdir
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+commit f71d68d2b473e47db260c27c98212829590d8bae upstream.
+
+Today we do not invalidate the cached_dirent or the entire
+parent cfid when a dentry in a dir has been removed/moved.
+
+This change invalidates the parent cfid so that we don't serve
+directory contents from the cache.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/inode.c | 30 +++++++++++++++++++++++++++++-
+ 1 file changed, 29 insertions(+), 1 deletion(-)
+
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -28,6 +28,23 @@
+ #include "cached_dir.h"
+ #include "reparse.h"
+
++static void cifs_invalidate_cached_dir(struct cifs_tcon *tcon,
++ struct dentry *parent)
++{
++ struct cached_fid *parent_cfid = NULL;
++
++ if (!tcon || !parent)
++ return;
++
++ if (!open_cached_dir_by_dentry(tcon, parent, &parent_cfid)) {
++ mutex_lock(&parent_cfid->dirents.de_mutex);
++ parent_cfid->dirents.is_valid = false;
++ parent_cfid->dirents.is_failed = true;
++ mutex_unlock(&parent_cfid->dirents.de_mutex);
++ close_cached_dir(parent_cfid);
++ }
++}
++
+ /*
+ * Set parameters for the netfs library
+ */
+@@ -2067,6 +2084,9 @@ psx_del_no_retry:
+ cifs_set_file_info(inode, attrs, xid, full_path, origattr);
+
+ out_reval:
++ if (!rc && dentry->d_parent)
++ cifs_invalidate_cached_dir(tcon, dentry->d_parent);
++
+ if (inode) {
+ cifs_inode = CIFS_I(inode);
+ cifs_inode->time = 0; /* will force revalidate to get info
+@@ -2378,7 +2398,6 @@ int cifs_rmdir(struct inode *inode, stru
+ }
+
+ rc = server->ops->rmdir(xid, tcon, full_path, cifs_sb);
+- cifs_put_tlink(tlink);
+
+ cifsInode = CIFS_I(d_inode(direntry));
+
+@@ -2388,6 +2407,8 @@ int cifs_rmdir(struct inode *inode, stru
+ i_size_write(d_inode(direntry), 0);
+ clear_nlink(d_inode(direntry));
+ spin_unlock(&d_inode(direntry)->i_lock);
++ if (direntry->d_parent)
++ cifs_invalidate_cached_dir(tcon, direntry->d_parent);
+ }
+
+ /* force revalidate to go get info when needed */
+@@ -2402,6 +2423,7 @@ int cifs_rmdir(struct inode *inode, stru
+
+ inode_set_ctime_current(d_inode(direntry));
+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
++ cifs_put_tlink(tlink);
+
+ rmdir_exit:
+ free_dentry_path(page);
+@@ -2668,6 +2690,12 @@ unlink_target:
+ }
+
+ /* force revalidate to go get info when needed */
++ if (!rc) {
++ cifs_invalidate_cached_dir(tcon, source_dentry->d_parent);
++ if (target_dentry->d_parent != source_dentry->d_parent)
++ cifs_invalidate_cached_dir(tcon, target_dentry->d_parent);
++ }
++
+ CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
+
+ cifs_rename_exit:
--- /dev/null
+From 27d80e0f8b8dff97503fc0061754b1d3800cb961 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 7 Jul 2026 19:19:55 +0200
+Subject: cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 27d80e0f8b8dff97503fc0061754b1d3800cb961 upstream.
+
+Setting cpu->capacity_perf to cpu->pstate.max_pstate_physical in the
+"no turbo" case is inconsistent with what happens elsewhere in the
+driver and causes arch_scale_cpu_capacity() to be incorrect. It also
+skews arch_scale_freq_capacity() which ends up differing from 1024 for
+the guaranteed P-state.
+
+Address that by setting capacity_perf to HWP_GUARANTEED_PERF() in the
+"no turbo" case.
+
+Fixes: 929ebc93ccaa ("cpufreq: intel_pstate: Set asymmetric CPU capacity on hybrid systems")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Tested-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Cc: All applicable <stable@vger.kernel.org>
+Link: https://patch.msgid.link/12928972.O9o76ZdvQC@rafael.j.wysocki
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/intel_pstate.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -1058,12 +1058,14 @@ static void hybrid_clear_cpu_capacity(un
+
+ static void hybrid_get_capacity_perf(struct cpudata *cpu)
+ {
++ u64 hwp_cap = READ_ONCE(cpu->hwp_cap_cached);
++
+ if (READ_ONCE(global.no_turbo)) {
+- cpu->capacity_perf = cpu->pstate.max_pstate_physical;
++ cpu->capacity_perf = HWP_GUARANTEED_PERF(hwp_cap);
+ return;
+ }
+
+- cpu->capacity_perf = HWP_HIGHEST_PERF(READ_ONCE(cpu->hwp_cap_cached));
++ cpu->capacity_perf = HWP_HIGHEST_PERF(hwp_cap);
+ }
+
+ static void hybrid_set_capacity_of_cpus(void)
--- /dev/null
+From 9ef450ca74e43dacf9a2a15db7a851052c78dcf0 Mon Sep 17 00:00:00 2001
+From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+Date: Tue, 16 Jun 2026 23:47:33 +0800
+Subject: cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf() path
+
+From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+
+commit 9ef450ca74e43dacf9a2a15db7a851052c78dcf0 upstream.
+
+The need_freq_update flag makes sugov_should_update_freq() return true
+regardless of the rate_limit_us throttling, and is cleared in
+sugov_update_next_freq(). sugov_update_single_freq() and
+sugov_update_shared() go through that helper, so the flag does not
+persist there.
+
+However, sugov_update_single_perf(), used by drivers implementing the
+.adjust_perf() callback (e.g. intel_pstate or amd-pstate in passive
+mode) calls cpufreq_driver_adjust_perf() directly and never goes through
+sugov_update_next_freq(), so the need_freq_update flag is not cleared in
+that path.
+
+Before commit 75da043d8f88 ("cpufreq/sched: Set need_freq_update in
+ignore_dl_rate_limit()"), this was effectively harmless because
+sugov_should_update_freq() still honored the rate limit even when
+need_freq_update was set. After that change, the flag forces
+sugov_should_update_freq() to always return true, so once set, it
+stays effective indefinitely on the .adjust_perf() path.
+
+As a result, cpufreq_driver_adjust_perf() gets called on every scheduler
+utilization update (with the runqueue lock held) rather than being
+throttled by rate_limit_us, even if the driver itself may skip redundant
+hardware updates.
+
+Clear need_freq_update at the end of the adjust_perf path as well.
+
+Fixes: 75da043d8f88 ("cpufreq/sched: Set need_freq_update in ignore_dl_rate_limit()")
+Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+Reviewed-by: Hongyan Xia <hongyan.xia@transsion.com>
+Reviewed-by: Christian Loehle <christian.loehle@arm.com>
+Cc: All applicable <stable@vger.kernel.org>
+[ rjw: Subject and changelog edits ]
+Link: https://patch.msgid.link/20260616154733.2405236-1-zhongqiu.han@oss.qualcomm.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/cpufreq_schedutil.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -486,6 +486,7 @@ static void sugov_update_single_perf(str
+ cpufreq_driver_adjust_perf(sg_policy->policy, sg_cpu->bw_min,
+ sg_cpu->util, max_cap);
+
++ sg_policy->need_freq_update = false;
+ sg_policy->last_freq_update_time = time;
+ }
+
--- /dev/null
+From 9d18a4e4234fd3ee0d0eed8ccbbb50cb76b2232c Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:31 +0530
+Subject: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 9d18a4e4234fd3ee0d0eed8ccbbb50cb76b2232c upstream.
+
+The memory allocated for pagerefs in fb_deferred_io_init() is not freed
+on the error path. Fix it by calling fb_deferred_io_cleanup().
+
+Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/broadsheetfb.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/broadsheetfb.c
++++ b/drivers/video/fbdev/broadsheetfb.c
+@@ -1072,12 +1072,14 @@ static int broadsheetfb_probe(struct pla
+ info->flags = FBINFO_VIRTFB;
+
+ info->fbdefio = &broadsheetfb_defio;
+- fb_deferred_io_init(info);
++ retval = fb_deferred_io_init(info);
++ if (retval)
++ goto err_vfree;
+
+ retval = fb_alloc_cmap(&info->cmap, 16, 0);
+ if (retval < 0) {
+ dev_err(&dev->dev, "Failed to allocate colormap\n");
+- goto err_vfree;
++ goto err_fbdefio;
+ }
+
+ /* set cmap */
+@@ -1121,6 +1123,8 @@ err_free_irq:
+ board->cleanup(par);
+ err_cmap:
+ fb_dealloc_cmap(&info->cmap);
++err_fbdefio:
++ fb_deferred_io_cleanup(info);
+ err_vfree:
+ vfree(videomemory);
+ err_fb_rel:
--- /dev/null
+From 6fcca16a2b19c37f60693c56cbc0c923364ff3ef Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:34 +0530
+Subject: fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 6fcca16a2b19c37f60693c56cbc0c923364ff3ef upstream.
+
+The memory allocated for modelist in fb_videomode_to_modelist() is not
+freed in the subsequent error path.
+Fix that by calling fb_destroy_modelist()
+
+Fixes: 2ece5f43b041 ("fbdev: add the carmine FB driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/carminefb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/carminefb.c
++++ b/drivers/video/fbdev/carminefb.c
+@@ -589,6 +589,7 @@ static int alloc_carmine_fb(void __iomem
+ return 0;
+
+ err_dealloc_cmap:
++ fb_destroy_modelist(&info->modelist);
+ fb_dealloc_cmap(&info->cmap);
+ err_free_fb:
+ framebuffer_release(info);
--- /dev/null
+From 9b6eaf101656958397a6012bf43f6e2e42c9e5cb Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:41 +0530
+Subject: fbdev: efifb: fix memory leak in efifb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 9b6eaf101656958397a6012bf43f6e2e42c9e5cb upstream.
+
+Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to
+caller; clarify ownership") the string returned from fb_get_options()
+is expected to be freed by the caller, but the string is not freed in
+efifb_probe(). Fix that by freeing the option string after setup.
+
+Fixes: 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/efifb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -377,6 +377,7 @@ static int efifb_probe(struct platform_d
+ if (fb_get_options("efifb", &option))
+ return -ENODEV;
+ efifb_setup(si, option);
++ kfree(option);
+
+ /* We don't get linelength from UGA Draw Protocol, only from
+ * EFI Graphics Protocol. So if it's not in DMI, and it's not
--- /dev/null
+From cbef2a305a8a72969b86f96b7c07b86edde61aff Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:30 +0530
+Subject: fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit cbef2a305a8a72969b86f96b7c07b86edde61aff upstream.
+
+The memory allocated for pagerefs in fb_deferred_io_init() is not freed
+on the error path. Fix it by calling fb_deferred_io_cleanup().
+
+Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/hecubafb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/hecubafb.c
++++ b/drivers/video/fbdev/hecubafb.c
+@@ -192,7 +192,9 @@ static int hecubafb_probe(struct platfor
+ info->flags = FBINFO_VIRTFB;
+
+ info->fbdefio = &hecubafb_defio;
+- fb_deferred_io_init(info);
++ retval = fb_deferred_io_init(info);
++ if (retval)
++ goto err_fbdefio;
+
+ retval = register_framebuffer(info);
+ if (retval < 0)
+@@ -209,6 +211,8 @@ static int hecubafb_probe(struct platfor
+
+ return 0;
+ err_fbreg:
++ fb_deferred_io_cleanup(info);
++err_fbdefio:
+ framebuffer_release(info);
+ err_fballoc:
+ vfree(videomemory);
--- /dev/null
+From 5936063409af230a2c88b8700c47b89a19fd70b5 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:35 +0530
+Subject: fbdev: i740fb: fix potential memory leak in i740fb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 5936063409af230a2c88b8700c47b89a19fd70b5 upstream.
+
+In i740fb_probe(), the memory allocated in fb_videomode_to_modelist()
+for modelist is not freed in the error paths. Fix that by calling
+fb_destroy_modelist().
+
+Fixes: 5350c65f4f15 ("Resurrect Intel740 driver: i740fb")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/i740fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/i740fb.c
++++ b/drivers/video/fbdev/i740fb.c
+@@ -1152,6 +1152,7 @@ err_reg_framebuffer:
+ fb_dealloc_cmap(&info->cmap);
+ err_alloc_cmap:
+ err_find_mode:
++ fb_destroy_modelist(&info->modelist);
+ if (par->ddc_registered)
+ i2c_del_adapter(&par->ddc_adapter);
+ pci_iounmap(dev, par->regs);
--- /dev/null
+From 894632b862a39b3fe1cb5de06fbae86225ea64de Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:32 +0530
+Subject: fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 894632b862a39b3fe1cb5de06fbae86225ea64de upstream.
+
+The memory allocated for pagerefs in fb_deferred_io_init() is not freed
+on the error path. Fix it by calling fb_deferred_io_cleanup().
+
+Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/metronomefb.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/metronomefb.c
++++ b/drivers/video/fbdev/metronomefb.c
+@@ -645,12 +645,14 @@ static int metronomefb_probe(struct plat
+ info->flags = FBINFO_VIRTFB;
+
+ info->fbdefio = &metronomefb_defio;
+- fb_deferred_io_init(info);
++ retval = fb_deferred_io_init(info);
++ if (retval)
++ goto err_free_irq;
+
+ retval = fb_alloc_cmap(&info->cmap, 8, 0);
+ if (retval < 0) {
+ dev_err(&dev->dev, "Failed to allocate colormap\n");
+- goto err_free_irq;
++ goto err_fbdefio;
+ }
+
+ /* set cmap */
+@@ -673,6 +675,8 @@ static int metronomefb_probe(struct plat
+
+ err_cmap:
+ fb_dealloc_cmap(&info->cmap);
++err_fbdefio:
++ fb_deferred_io_cleanup(info);
+ err_free_irq:
+ board->cleanup(par);
+ err_csum_table:
--- /dev/null
+From 85f5e38c162bdf9dbbe197275d416402712f3707 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:36 +0530
+Subject: fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 85f5e38c162bdf9dbbe197275d416402712f3707 upstream.
+
+In nvidiafb_probe(), the memory allocated for modelist in
+nvidia_set_fbinfo() is not freed in the subsequent error paths.
+Fix that by calling fb_destroy_modelist().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/nvidia/nvidia.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/nvidia/nvidia.c
++++ b/drivers/video/fbdev/nvidia/nvidia.c
+@@ -1421,6 +1421,7 @@ static int nvidiafb_probe(struct pci_dev
+
+ err_out_iounmap_fb:
+ iounmap(info->screen_base);
++ fb_destroy_modelist(&info->modelist);
+ err_out_free_base1:
+ fb_destroy_modedb(info->monspecs.modedb);
+ nvidia_delete_i2c_busses(par);
--- /dev/null
+From df8c1101c9a08859da612b5d0a08d55d475522c6 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:33 +0530
+Subject: fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit df8c1101c9a08859da612b5d0a08d55d475522c6 upstream.
+
+The function radeonfb_pci_register() allocates memory for modelist
+(by calling radeon_check_modes() which calls fb_add_videomode()).
+The memory is appended to info->modelist, but is not freed in subsequent
+error paths. Fix this by calling fb_destroy_modelist().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/aty/radeon_base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/aty/radeon_base.c
++++ b/drivers/video/fbdev/aty/radeon_base.c
+@@ -2476,6 +2476,7 @@ static int radeonfb_pci_register(struct
+ return 0;
+ err_unmap_fb:
+ iounmap(rinfo->fb_base);
++ fb_destroy_modelist(&info->modelist);
+ err_unmap_rom:
+ kfree(rinfo->mon1_EDID);
+ kfree(rinfo->mon2_EDID);
--- /dev/null
+From 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:37 +0530
+Subject: fbdev: s3fb: fix potential memory leak in s3_pci_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 upstream.
+
+In s3_pci_probe(), the memory allocated for modelist using
+fb_videomode_to_modelist() is not freed in subsequent error paths.
+Fix that by calling fb_destroy_modelist()
+
+Fixes: 86c0f043a737 ("s3fb: add DDC support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/s3fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/s3fb.c
++++ b/drivers/video/fbdev/s3fb.c
+@@ -1446,6 +1446,7 @@ err_reg_fb:
+ err_alloc_cmap:
+ err_find_mode:
+ #ifdef CONFIG_FB_S3_DDC
++ fb_destroy_modelist(&info->modelist);
+ if (par->ddc_registered)
+ i2c_del_adapter(&par->ddc_adapter);
+ if (par->mmio)
--- /dev/null
+From 5dbe5b65df0b0c0ec77492427c274b7b5011890e Mon Sep 17 00:00:00 2001
+From: Li RongQing <lirongqing@baidu.com>
+Date: Thu, 14 May 2026 21:02:02 -0400
+Subject: fbdev: sm712: Fix operator precedence in big_swap macro
+
+From: Li RongQing <lirongqing@baidu.com>
+
+commit 5dbe5b65df0b0c0ec77492427c274b7b5011890e upstream.
+
+The big_swap(p) macro was intended to swap bytes within 16-bit halves
+of a 32-bit value. However, because the bitwise shift operators (<<, >>)
+have higher precedence than the bitwise AND operator (&), the original
+code failed to perform any shifting on the masked bits.
+
+For example, 'p & 0xff00ff00 >> 8' was evaluated as 'p &
+(0xff00ff00 >> 8)', effectively neutralizing the intended swap.
+
+Fix this by adding parentheses to ensure the bitwise AND is performed
+before the shift, correctly implementing the byte swap logic.
+
+Fixes: 1461d66728648 ("staging: sm7xxfb: merge sm712fb with fbdev")
+Cc: stable@vger.kernel.org
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/sm712.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/sm712.h
++++ b/drivers/video/fbdev/sm712.h
+@@ -101,7 +101,7 @@ struct modeinit {
+ #define mmio_addr 0x00800000
+ #define seqw17() smtc_seqw(0x17, 0x30)
+ #define big_pixel_depth(p, d) {if (p == 24) {p = 32; d = 32; } }
+-#define big_swap(p) ((p & 0xff00ff00 >> 8) | (p & 0x00ff00ff << 8))
++#define big_swap(p) (((p & 0xff00ff00) >> 8) | ((p & 0x00ff00ff) << 8))
+ #else
+ #define pal_rgb(r, g, b, val) val
+ #define big_addr 0
--- /dev/null
+From bb019d755366cc3e777a12d4bf457ff289837370 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:38 +0530
+Subject: fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit bb019d755366cc3e777a12d4bf457ff289837370 upstream.
+
+In tdfxfb_probe(), the memory allocated for modelist using
+fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not
+freed in the subsequent error paths.
+Fix that by calling fb_destroy_modelist().
+
+Fixes: 215059d2421f ("tdfxfb: make use of DDC information about connected monitor")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/tdfxfb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/tdfxfb.c
++++ b/drivers/video/fbdev/tdfxfb.c
+@@ -1551,6 +1551,7 @@ static int tdfxfb_probe(struct pci_dev *
+
+ out_err_iobase:
+ #ifdef CONFIG_FB_3DFX_I2C
++ fb_destroy_modelist(&info->modelist);
+ tdfxfb_delete_i2c_busses(default_par);
+ #endif
+ arch_phys_wc_del(default_par->wc_cookie);
--- /dev/null
+From 7a35ec619d9af8ee128320975c1252b8ad65f1e8 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:39 +0530
+Subject: fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 7a35ec619d9af8ee128320975c1252b8ad65f1e8 upstream.
+
+In trident_pci_probe(), the memory allocated for modelist using
+fb_videomode_to_modelist() is not freed in subsequent error paths.
+Fix that by calling fb_destroy_modelist().
+
+Fixes: 6a5e3bd0c8bc ("tridentfb: Add DDC support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/tridentfb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/tridentfb.c
++++ b/drivers/video/fbdev/tridentfb.c
+@@ -1706,6 +1706,7 @@ static int trident_pci_probe(struct pci_
+ return 0;
+
+ out_unmap2:
++ fb_destroy_modelist(&info->modelist);
+ if (default_par->ddc_registered)
+ i2c_del_adapter(&default_par->ddc_adapter);
+ kfree(info->pixmap.addr);
--- /dev/null
+From 033e56fed09047ee63072e9f58789f40c1c7079d Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:40 +0530
+Subject: fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 033e56fed09047ee63072e9f58789f40c1c7079d upstream.
+
+Due to an incorrect goto label, memory allocated for modedb and modelist
+in uvesafb_vbe_init() is not freed in some error paths. Fix this by
+updating the goto label.
+
+Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/uvesafb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/uvesafb.c
++++ b/drivers/video/fbdev/uvesafb.c
+@@ -1694,14 +1694,14 @@ static int uvesafb_probe(struct platform
+ i = uvesafb_vbe_init_mode(info);
+ if (i < 0) {
+ err = -EINVAL;
+- goto out;
++ goto out_mode;
+ } else {
+ mode = &par->vbe_modes[i];
+ }
+
+ if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
+ err = -ENXIO;
+- goto out;
++ goto out_mode;
+ }
+
+ uvesafb_init_info(info, mode);
--- /dev/null
+From b15d708995c01bbffe7dcd634a31959f6805bed3 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 14 May 2026 13:54:42 +0530
+Subject: fbdev: vesafb: fix memory leak in vesafb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit b15d708995c01bbffe7dcd634a31959f6805bed3 upstream.
+
+Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to
+caller; clarify ownership") the string returned from fb_get_options()
+is expected to be freed by the caller. But the string is not freed in
+vesafb_probe(). Fix that by freeing the option string after setup.
+
+Fixes: 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/vesafb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/video/fbdev/vesafb.c
++++ b/drivers/video/fbdev/vesafb.c
+@@ -269,6 +269,7 @@ static int vesafb_probe(struct platform_
+ /* ignore error return of fb_get_options */
+ fb_get_options("vesafb", &option);
+ vesafb_setup(option);
++ kfree(option);
+
+ if (si->orig_video_isVGA != VIDEO_TYPE_VLFB)
+ return -ENODEV;
--- /dev/null
+From 56bc6384314fb9ae98975fb2af8b143097ede3dc Mon Sep 17 00:00:00 2001
+From: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+Date: Thu, 9 Jul 2026 18:40:50 +0530
+Subject: gpu/buddy: bail out of try_harder when alignment cannot be honoured
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+
+commit 56bc6384314fb9ae98975fb2af8b143097ede3dc upstream.
+
+The try_harder contiguous fallback could return a range whose start
+offset did not match the caller's min_block_size. When a candidate's
+start is misaligned, realign it: free the misaligned run and reallocate
+exactly @size at the next lower min_block_size boundary. This keeps the
+returned size unchanged with no surplus to trim, and rejects the request
+only when no aligned candidate fits.
+
+v2: align misaligned candidates down to min_block_size instead of
+ bailing out, for both the RHS and LHS paths (Matthew).
+
+Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation")
+Suggested-by: Christian König <christian.koenig@amd.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Timur Kristóf <timur.kristof@gmail.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Tested-by: John Olender <john.olender@gmail.com>
+Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+Link: https://patch.msgid.link/20260709131050.1022759-1-Arunpravin.PaneerSelvam@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/buddy.c | 65 ++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 45 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/buddy.c
++++ b/drivers/gpu/buddy.c
+@@ -1078,22 +1078,30 @@ static int __gpu_buddy_alloc_range(struc
+ blocks, total_allocated_on_err);
+ }
+
++static int __alloc_contig_aligned_retry(struct gpu_buddy *mm,
++ u64 unaligned_offset,
++ u64 size,
++ u64 min_block_size,
++ struct list_head *blocks)
++{
++ u64 aligned_offset = round_down(unaligned_offset, min_block_size);
++
++ return __gpu_buddy_alloc_range(mm, aligned_offset, size, NULL, blocks);
++}
++
+ static int __alloc_contig_try_harder(struct gpu_buddy *mm,
+ u64 size,
+ u64 min_block_size,
+ struct list_head *blocks)
+ {
+- u64 rhs_offset, lhs_offset, lhs_size, filled;
++ u64 rhs_offset, lhs_offset, filled;
+ struct gpu_buddy_block *block;
+ unsigned int tree, order;
+- LIST_HEAD(blocks_lhs);
+- unsigned long pages;
+ u64 modify_size;
+ int err;
+
+ modify_size = rounddown_pow_of_two(size);
+- pages = modify_size >> ilog2(mm->chunk_size);
+- order = fls(pages) - 1;
++ order = ilog2(modify_size) - ilog2(mm->chunk_size);
+ if (order == 0)
+ return -ENOSPC;
+
+@@ -1109,31 +1117,48 @@ static int __alloc_contig_try_harder(str
+ while (iter) {
+ block = rbtree_get_free_block(iter);
+
+- /* Allocate blocks traversing RHS */
+ rhs_offset = gpu_buddy_block_offset(block);
++
++ /* Allocate blocks traversing RHS */
+ err = __gpu_buddy_alloc_range(mm, rhs_offset, size,
+ &filled, blocks);
+- if (!err || err != -ENOSPC)
++ if (err && err != -ENOSPC)
+ return err;
+-
+- lhs_size = max((size - filled), min_block_size);
+- if (!IS_ALIGNED(lhs_size, min_block_size))
+- lhs_size = round_up(lhs_size, min_block_size);
+-
+- /* Allocate blocks traversing LHS */
+- lhs_offset = gpu_buddy_block_offset(block) - lhs_size;
+- err = __gpu_buddy_alloc_range(mm, lhs_offset, lhs_size,
+- NULL, &blocks_lhs);
++ if (!err && IS_ALIGNED(rhs_offset, min_block_size))
++ return 0;
+ if (!err) {
+- list_splice(&blocks_lhs, blocks);
++ /* Allocate the unaligned RHS offset using round_down */
++ gpu_buddy_free_list_internal(mm, blocks);
++ err = __alloc_contig_aligned_retry(mm, rhs_offset,
++ size,
++ min_block_size,
++ blocks);
++ if (!err)
++ return 0;
++ if (err != -ENOSPC) {
++ gpu_buddy_free_list_internal(mm, blocks);
++ return err;
++ }
++ goto next;
++ }
++
++ if (size - filled > rhs_offset)
++ goto next;
++
++ lhs_offset = rhs_offset - (size - filled);
++
++ /* Allocate the unaligned LHS offset using round_down */
++ gpu_buddy_free_list_internal(mm, blocks);
++ err = __alloc_contig_aligned_retry(mm, lhs_offset, size,
++ min_block_size, blocks);
++ if (!err)
+ return 0;
+- } else if (err != -ENOSPC) {
++ if (err != -ENOSPC) {
+ gpu_buddy_free_list_internal(mm, blocks);
+ return err;
+ }
+- /* Free blocks for the next iteration */
++next:
+ gpu_buddy_free_list_internal(mm, blocks);
+-
+ iter = rb_prev(iter);
+ }
+ }
--- /dev/null
+From e75717f9aec04355777be41070890c6a815c76df Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Mon, 13 Apr 2026 22:15:26 +0800
+Subject: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit e75717f9aec04355777be41070890c6a815c76df upstream.
+
+After device_initialize(), the embedded struct device in struct
+host1x_device should be released through the device core with
+put_device().
+
+In host1x_device_add(), if host1x_device_parse_dt() fails, the current
+error path frees the object directly with kfree(device). That bypasses
+the normal device lifetime handling and leaks the reference held on the
+embedded struct device.
+
+The issue was identified by a static analysis tool I developed and
+confirmed by manual review.
+
+Fix this by using put_device() in the host1x_device_parse_dt() failure
+path.
+
+Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type")
+Cc: stable@vger.kernel.org
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patch.msgid.link/20260413141526.2961841-1-lgs201920130244@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/host1x/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/host1x/bus.c
++++ b/drivers/gpu/host1x/bus.c
+@@ -485,7 +485,7 @@ static int host1x_device_add(struct host
+
+ err = host1x_device_parse_dt(device, driver);
+ if (err < 0) {
+- kfree(device);
++ put_device(&device->dev);
+ return err;
+ }
+
--- /dev/null
+From 16df3873c80388a71c4695909a51be0c809b889c Mon Sep 17 00:00:00 2001
+From: Eliot Courtney <ecourtney@nvidia.com>
+Date: Thu, 23 Apr 2026 16:11:44 +0900
+Subject: gpu: nova-core: simplify and_then with condition to filter
+
+From: Eliot Courtney <ecourtney@nvidia.com>
+
+commit 16df3873c80388a71c4695909a51be0c809b889c upstream.
+
+This code is more simply expressed using Option::filter instead of the
+and_then with conditional.
+
+This fixes the following warning with latest nightly Rust clippy build:
+
+warning: manual implementation of `Option::filter`
+ --> drivers/gpu/nova-core/firmware.rs:391:14
+ |
+391 | .and_then(|hdr| {
+ | ______________^
+392 | | if hdr.bin_magic == BIN_MAGIC {
+393 | | Some(hdr)
+394 | | } else {
+... |
+397 | | })
+ | |______________^ help: try: `filter(|hdr| hdr.bin_magic == BIN_MAGIC)`
+ |
+ = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_filter
+ = note: `-D clippy::manual-filter` implied by `-D warnings`
+ = help: to override `-D warnings` add `#[allow(clippy::manual_filter)]`
+
+Cc: stable@vger.kernel.org
+Fixes: d6cb7319e64e ("gpu: nova-core: firmware: add support for common firmware header")
+Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
+Acked-by: Danilo Krummrich <dakr@kernel.org>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Link: https://patch.msgid.link/20260423-fix-filter-v1-1-b3b197c65daf@nvidia.com
+[aliceryhl: add Fixes: tag and quote the warning it fixes]
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/nova-core/firmware.rs | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/gpu/nova-core/firmware.rs
++++ b/drivers/gpu/nova-core/firmware.rs
+@@ -388,13 +388,7 @@ impl<'a> BinFirmware<'a> {
+ // Extract header.
+ .and_then(BinHdr::from_bytes_copy)
+ // Validate header.
+- .and_then(|hdr| {
+- if hdr.bin_magic == BIN_MAGIC {
+- Some(hdr)
+- } else {
+- None
+- }
+- })
++ .filter(|hdr| hdr.bin_magic == BIN_MAGIC)
+ .map(|hdr| Self { hdr, fw })
+ .ok_or(EINVAL)
+ }
--- /dev/null
+From c19fe864f667afc49d1391d764e20b66555bcf7a Mon Sep 17 00:00:00 2001
+From: Armin Wolf <W_Armin@gmx.de>
+Date: Mon, 25 May 2026 01:55:53 +0200
+Subject: leds: uleds: Fix potential buffer overread
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+commit c19fe864f667afc49d1391d764e20b66555bcf7a upstream.
+
+The name string supplied by userspace is not guaranteed to be
+null-terminated, so using strchr() on it might result in a buffer
+overread. The same thing will happen when said string is used by
+the LED class device.
+
+Fix this by using strnchr() instead and explicitly check that
+the name string is properly null-terminated.
+
+Cc: stable@vger.kernel.org
+Fixes: e381322b0190 ("leds: Introduce userspace LED class driver")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20260524235553.189134-1-W_Armin@gmx.de
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/uleds.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/leds/uleds.c
++++ b/drivers/leds/uleds.c
+@@ -102,7 +102,8 @@ static ssize_t uleds_write(struct file *
+
+ name = udev->user_dev.name;
+ if (!name[0] || !strcmp(name, ".") || !strcmp(name, "..") ||
+- strchr(name, '/')) {
++ strnchr(name, sizeof(udev->user_dev.name), '/') ||
++ !strnchr(name, sizeof(udev->user_dev.name), '\0')) {
+ ret = -EINVAL;
+ goto out;
+ }
--- /dev/null
+From 8c2f0b42fc252e1bf1c7746447091a468e784ca1 Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Thu, 16 Apr 2026 00:26:27 +0800
+Subject: mfd: sm501: Fix reference leak on failed device registration
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit 8c2f0b42fc252e1bf1c7746447091a468e784ca1 upstream.
+
+When platform_device_register() fails in sm501_register_device(), the
+embedded struct device in pdev has already been initialized by
+device_initialize(), but the failure path only reports the error and
+returns without dropping the device reference for the current platform
+device:
+
+ sm501_register_device()
+ -> platform_device_register(pdev)
+ -> device_initialize(&pdev->dev)
+ -> setup_pdev_dma_masks(pdev)
+ -> platform_device_add(pdev)
+
+This leads to a reference leak when platform_device_register() fails.
+Fix this by calling platform_device_put() before returning the error.
+
+The issue was identified by a static analysis tool I developed and
+confirmed by manual review.
+
+Fixes: b6d6454fdb66f ("[PATCH] mfd: SM501 core driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Link: https://patch.msgid.link/20260415162627.3558789-1-lgs201920130244@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/sm501.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mfd/sm501.c
++++ b/drivers/mfd/sm501.c
+@@ -704,9 +704,11 @@ static int sm501_register_device(struct
+ if (ret >= 0) {
+ dev_dbg(sm->dev, "registered %s\n", pdev->name);
+ list_add_tail(&smdev->list, &sm->devices);
+- } else
++ } else {
+ dev_err(sm->dev, "error registering %s (%d)\n",
+ pdev->name, ret);
++ platform_device_put(pdev);
++ }
+
+ return ret;
+ }
--- /dev/null
+From 3001ed2b4e06da2276c42ace6551617065a5b1f9 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Date: Thu, 21 May 2026 10:36:24 +0200
+Subject: mfd: tps6586x: Fix OF node refcount
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+commit 3001ed2b4e06da2276c42ace6551617065a5b1f9 upstream.
+
+Platform devices created with platform_device_alloc() call
+platform_device_release() when the last reference to the device's
+kobject is dropped. This function calls of_node_put() unconditionally.
+This works fine for devices created with platform_device_register_full()
+but users of the split approach (platform_device_alloc() +
+platform_device_add()) must bump the reference of the of_node they
+assign manually. Add the missing call to of_node_get().
+
+Cc: stable@vger.kernel.org
+Fixes: 62f6b0879304 ("tps6586x: Add device tree support")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260521-pdev-fwnode-ref-v1-1-88c324a1b8d2@oss.qualcomm.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/tps6586x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mfd/tps6586x.c
++++ b/drivers/mfd/tps6586x.c
+@@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct t
+
+ pdev->dev.parent = tps6586x->dev;
+ pdev->dev.platform_data = subdev->platform_data;
+- pdev->dev.of_node = subdev->of_node;
++ pdev->dev.of_node = of_node_get(subdev->of_node);
+
+ ret = platform_device_add(pdev);
+ if (ret) {
--- /dev/null
+From 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d Mon Sep 17 00:00:00 2001
+From: "Xiang Mei (Microsoft)" <xmei5@asu.edu>
+Date: Wed, 8 Jul 2026 18:11:50 +0000
+Subject: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
+
+From: Xiang Mei (Microsoft) <xmei5@asu.edu>
+
+commit 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d upstream.
+
+br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
+ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb
+skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
+prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a
+use-after-free write.
+
+Save prevhdr's offset before skb_checksum_help() and recompute it after,
+like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
+fragment").
+
+ BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)
+ Write of size 1 at addr ffff888013ff5016 by task exploit/141
+ Call Trace:
+ ...
+ kasan_report (mm/kasan/report.c:595)
+ ip6_frag_next (net/ipv6/ip6_output.c:857)
+ br_ip6_fragment (net/ipv6/netfilter.c:212)
+ nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)
+ nf_hook_slow (net/netfilter/core.c:619)
+ br_forward_finish (net/bridge/br_forward.c:66)
+ __br_forward (net/bridge/br_forward.c:115)
+ maybe_deliver (net/bridge/br_forward.c:191)
+ br_flood (net/bridge/br_forward.c:245)
+ br_handle_frame_finish (net/bridge/br_input.c:229)
+ br_handle_frame (net/bridge/br_input.c:442)
+ ...
+ packet_sendmsg (net/packet/af_packet.c:3114)
+ ...
+ do_syscall_64 (arch/x86/entry/syscall_64.c:94)
+ entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
+ Kernel panic - not syncing: Fatal exception in interrupt
+
+Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6")
+Cc: stable@vger.kernel.org
+Reported-by: AutonomousCodeSecurity@microsoft.com
+Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/netfilter.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -120,7 +120,7 @@ int br_ip6_fragment(struct net *net, str
+ ktime_t tstamp = skb->tstamp;
+ struct ip6_frag_state state;
+ u8 *prevhdr, nexthdr = 0;
+- unsigned int mtu, hlen;
++ unsigned int mtu, hlen, nexthdr_offset;
+ int hroom, err = 0;
+ __be32 frag_id;
+
+@@ -129,6 +129,7 @@ int br_ip6_fragment(struct net *net, str
+ goto blackhole;
+ hlen = err;
+ nexthdr = *prevhdr;
++ nexthdr_offset = prevhdr - skb_network_header(skb);
+
+ mtu = skb->dev->mtu;
+ if (frag_max_size > mtu ||
+@@ -147,6 +148,7 @@ int br_ip6_fragment(struct net *net, str
+ (err = skb_checksum_help(skb)))
+ goto blackhole;
+
++ prevhdr = skb_network_header(skb) + nexthdr_offset;
+ hroom = LL_RESERVED_SPACE(skb->dev);
+ if (skb_has_frag_list(skb)) {
+ unsigned int first_len = skb_pagelen(skb);
--- /dev/null
+From b06163ce52ec0561f202fbfb9b08090cb61f512e Mon Sep 17 00:00:00 2001
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Date: Tue, 7 Jul 2026 19:00:14 +0800
+Subject: netfilter: ecache: fix inverted time_after() check
+
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+
+commit b06163ce52ec0561f202fbfb9b08090cb61f512e upstream.
+
+ecache_work_evict_list() redelivers DESTROY events for conntracks that
+were moved to the per-netns dying_list after event delivery failed. It
+sets a 10ms deadline:
+
+ stop = jiffies + ECACHE_MAX_JIFFIES
+
+but then tests:
+
+ time_after(stop, jiffies)
+
+This condition is true while the deadline is still in the future, so the
+worker returns STATE_RESTART after the first successful redelivery in the
+usual case. ecache_work() maps STATE_RESTART to delay 0, which turns the
+redelivery path into one dying conntrack per workqueue dispatch and makes
+the sent > 16 batching/cond_resched() path effectively unreachable.
+
+A conntrack netlink listener whose receive queue is congested can make
+DESTROY event delivery fail with -ENOBUFS. With sustained conntrack
+churn, entries then accumulate on the dying_list and are only drained at
+the degraded one-entry-per-dispatch rate once delivery succeeds again,
+wasting CPU on back-to-back workqueue reschedules and prolonging
+conntrack memory/resource pressure.
+
+In a KASAN QEMU test with CONFIG_NF_CONNTRACK_EVENTS=y and
+nf_conntrack.enable_hooks=1, a congested DESTROY listener caused 8192
+nf_ct_delete() calls to return false and move entries to the dying_list.
+After closing the listener, the unfixed kernel needed 7670 ecache_work()
+entries to destroy 7669 conntracks. With this change, the same 8192
+entries were destroyed by 2 ecache_work() entries.
+
+Swap the comparison so the worker restarts only after the deadline has
+expired.
+
+Fixes: 2ed3bf188b33 ("netfilter: ecache: use dedicated list for event redelivery")
+Cc: stable@vger.kernel.org
+Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Reported-by: Ao Wang <wangao@seu.edu.cn>
+Reported-by: Xuewei Feng <fengxw06@126.com>
+Reported-by: Qi Li <qli01@tsinghua.edu.cn>
+Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
+Assisted-by: Claude-Code:GLM-5.2
+Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_ecache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_ecache.c
++++ b/net/netfilter/nf_conntrack_ecache.c
+@@ -77,7 +77,7 @@ next:
+ hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
+ hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode, &evicted_list);
+
+- if (time_after(stop, jiffies)) {
++ if (time_after(jiffies, stop)) {
+ ret = STATE_RESTART;
+ break;
+ }
--- /dev/null
+From fa7395c02d95e51bad2952325d2d6503bfbad437 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 30 Jun 2026 11:40:56 +0200
+Subject: netfilter: flowtable: support IPIP tunnel with direct xmit
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit fa7395c02d95e51bad2952325d2d6503bfbad437 upstream.
+
+The combination of IPIP tunnel with direct xmit, eg. bridge device,
+breaks because no dst_entry is provided to check the skb headroom and to
+set the iph->frag_off field. This leads to invalid dst usage and can
+trigger a crash in the tunnel transmit path.
+
+Fix this by moving dst_cache and dst_cookie out of the runtime union so
+that they can be shared by neighbour, xfrm, and direct tunnel flows.
+For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve
+route state in these shared fields and release it through the common
+dst release path.
+
+Since dst_entry is now available to the three supported xmit modes and
+dst_release() already deals with NULL dst, remove the xmit type check
+in nft_flow_dst_release(). Moreover, skip the check if the dst entry
+is NULL in nf_flow_dst_check() which is now the case for the direct
+xmit case.
+
+Based on patch from Rein Wei <n05ec@lzu.edu.cn>.
+
+Fixes: d30301ba4b07 ("netfilter: flowtable: Add IPIP tx sw acceleration")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Reported-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
+Reported-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/netfilter/nf_flow_table.h | 5 +++--
+ net/netfilter/nf_flow_table_core.c | 12 ++++++++----
+ net/netfilter/nf_flow_table_ip.c | 3 +--
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -155,11 +155,12 @@ struct flow_offload_tuple {
+ tun_num:2,
+ in_vlan_ingress:2;
+ u16 mtu;
++ u32 dst_cookie;
++ struct dst_entry *dst_cache;
++
+ union {
+ struct {
+- struct dst_entry *dst_cache;
+ u32 ifidx;
+- u32 dst_cookie;
+ };
+ struct {
+ u32 ifidx;
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -127,12 +127,18 @@ static int flow_offload_fill_route(struc
+
+ switch (route->tuple[dir].xmit_type) {
+ case FLOW_OFFLOAD_XMIT_DIRECT:
++ if (flow_tuple->tun_num) {
++ flow_tuple->dst_cache = dst;
++ flow_tuple->dst_cookie =
++ flow_offload_dst_cookie(flow_tuple);
++ }
+ memcpy(flow_tuple->out.h_dest, route->tuple[dir].out.h_dest,
+ ETH_ALEN);
+ memcpy(flow_tuple->out.h_source, route->tuple[dir].out.h_source,
+ ETH_ALEN);
+ flow_tuple->out.ifidx = route->tuple[dir].out.ifindex;
+- dst_release(dst);
++ if (!flow_tuple->tun_num)
++ dst_release(dst);
+ break;
+ case FLOW_OFFLOAD_XMIT_XFRM:
+ case FLOW_OFFLOAD_XMIT_NEIGH:
+@@ -152,9 +158,7 @@ static int flow_offload_fill_route(struc
+ static void nft_flow_dst_release(struct flow_offload *flow,
+ enum flow_offload_tuple_dir dir)
+ {
+- if (flow->tuplehash[dir].tuple.xmit_type == FLOW_OFFLOAD_XMIT_NEIGH ||
+- flow->tuplehash[dir].tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)
+- dst_release(flow->tuplehash[dir].tuple.dst_cache);
++ dst_release(flow->tuplehash[dir].tuple.dst_cache);
+ }
+
+ void flow_offload_route_init(struct flow_offload *flow,
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -299,8 +299,7 @@ static bool nf_flow_exceeds_mtu(const st
+
+ static inline bool nf_flow_dst_check(struct flow_offload_tuple *tuple)
+ {
+- if (tuple->xmit_type != FLOW_OFFLOAD_XMIT_NEIGH &&
+- tuple->xmit_type != FLOW_OFFLOAD_XMIT_XFRM)
++ if (!tuple->dst_cache)
+ return true;
+
+ return dst_check(tuple->dst_cache, tuple->dst_cookie);
--- /dev/null
+From 90941d9c925d66a482c9121919ec3546a6988c16 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 9 Jul 2026 13:40:25 +0200
+Subject: netfilter: flowtable: use correct direction to set up tunnel route
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 90941d9c925d66a482c9121919ec3546a6988c16 upstream.
+
+The layer 2 encapsulation and layer 3 tunnel information in the xmit
+path is taken from the other tuple, because the tunnel information that
+is included in the tuple for hashtable lookups is also used to perform
+the egress encapsulation in the transmit path.
+
+This patch uses the correct direction when setting up the tunnel, the
+original proposed patch to address this fix uses the reversed direction.
+
+While at it, remove the redundant check to call dst_release() to drop
+the reference on the dst that was obtained from the forward path, which
+is not useful in the direct xmit path unless tunneling is performed.
+
+Fixes: fa7395c02d95 ("netfilter: flowtable: support IPIP tunnel with direct xmit")
+Cc: stable@vger.kernel.org
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_flow_table_core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -127,18 +127,18 @@ static int flow_offload_fill_route(struc
+
+ switch (route->tuple[dir].xmit_type) {
+ case FLOW_OFFLOAD_XMIT_DIRECT:
+- if (flow_tuple->tun_num) {
++ if (route->tuple[!dir].in.num_tuns) {
+ flow_tuple->dst_cache = dst;
+ flow_tuple->dst_cookie =
+ flow_offload_dst_cookie(flow_tuple);
++ } else {
++ dst_release(dst);
+ }
+ memcpy(flow_tuple->out.h_dest, route->tuple[dir].out.h_dest,
+ ETH_ALEN);
+ memcpy(flow_tuple->out.h_source, route->tuple[dir].out.h_source,
+ ETH_ALEN);
+ flow_tuple->out.ifidx = route->tuple[dir].out.ifindex;
+- if (!flow_tuple->tun_num)
+- dst_release(dst);
+ break;
+ case FLOW_OFFLOAD_XMIT_XFRM:
+ case FLOW_OFFLOAD_XMIT_NEIGH:
--- /dev/null
+From c328b90c17fc5fa7786503695152880b2afb9326 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 30 Jun 2026 11:40:54 +0200
+Subject: netfilter: flowtable: use dst in this direction when pushing IPIP header
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit c328b90c17fc5fa7786503695152880b2afb9326 upstream.
+
+When pushing the IPIP header, the route of the other direction is used
+to calculate the headroom, use the route in this direction. Accessing
+the other tuple to set the IP source and destination is fine because
+this tuple does not provide such information to avoid storing redundant
+information. However, this tuple already provides the dst for this
+direction, this went unnoticed because this bug affects headroom and
+iph->frag_off only at this stage.
+
+Fixes: d30301ba4b07 ("netfilter: flowtable: Add IPIP tx sw acceleration")
+Fixes: 93cf357fa797 ("netfilter: flowtable: Add IP6IP6 tx sw acceleration")
+Cc: stable@vger.kernel.org
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_flow_table_ip.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
+index 29e93ac1e2e4..089f2bc19972 100644
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -590,10 +590,10 @@ static int nf_flow_pppoe_push(struct sk_buff *skb, u16 id,
+
+ static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb,
+ struct flow_offload_tuple *tuple,
+- __be32 *ip_daddr)
++ struct dst_entry *dst, __be32 *ip_daddr)
+ {
+ struct iphdr *iph = (struct iphdr *)skb_network_header(skb);
+- struct rtable *rt = dst_rtable(tuple->dst_cache);
++ struct rtable *rt = dst_rtable(dst);
+ u8 tos = iph->tos, ttl = iph->ttl;
+ __be16 frag_off = iph->frag_off;
+ u32 headroom = sizeof(*iph);
+@@ -636,21 +636,22 @@ static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb,
+
+ static int nf_flow_tunnel_v4_push(struct net *net, struct sk_buff *skb,
+ struct flow_offload_tuple *tuple,
+- __be32 *ip_daddr)
++ struct dst_entry *dst, __be32 *ip_daddr)
+ {
+ if (tuple->tun_num)
+- return nf_flow_tunnel_ipip_push(net, skb, tuple, ip_daddr);
++ return nf_flow_tunnel_ipip_push(net, skb, tuple, dst, ip_daddr);
+
+ return 0;
+ }
+
+ static int nf_flow_tunnel_ip6ip6_push(struct net *net, struct sk_buff *skb,
+ struct flow_offload_tuple *tuple,
++ struct dst_entry *dst,
+ struct in6_addr **ip6_daddr)
+ {
+ struct ipv6hdr *ip6h = (struct ipv6hdr *)skb_network_header(skb);
+- struct rtable *rt = dst_rtable(tuple->dst_cache);
+ __u8 dsfield = ipv6_get_dsfield(ip6h);
++ struct rtable *rt = dst_rtable(dst);
+ struct flowi6 fl6 = {
+ .daddr = tuple->tun.src_v6,
+ .saddr = tuple->tun.dst_v6,
+@@ -696,10 +697,11 @@ static int nf_flow_tunnel_ip6ip6_push(struct net *net, struct sk_buff *skb,
+
+ static int nf_flow_tunnel_v6_push(struct net *net, struct sk_buff *skb,
+ struct flow_offload_tuple *tuple,
++ struct dst_entry *dst,
+ struct in6_addr **ip6_daddr)
+ {
+ if (tuple->tun_num)
+- return nf_flow_tunnel_ip6ip6_push(net, skb, tuple, ip6_daddr);
++ return nf_flow_tunnel_ip6ip6_push(net, skb, tuple, dst, ip6_daddr);
+
+ return 0;
+ }
+@@ -842,7 +844,8 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
+ other_tuple = &flow->tuplehash[!dir].tuple;
+ ip_daddr = other_tuple->src_v4.s_addr;
+
+- if (nf_flow_tunnel_v4_push(state->net, skb, other_tuple, &ip_daddr) < 0)
++ if (nf_flow_tunnel_v4_push(state->net, skb, other_tuple,
++ tuplehash->tuple.dst_cache, &ip_daddr) < 0)
+ return NF_DROP;
+
+ switch (tuplehash->tuple.xmit_type) {
+@@ -1158,6 +1161,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
+ ip6_daddr = &other_tuple->src_v6;
+
+ if (nf_flow_tunnel_v6_push(state->net, skb, other_tuple,
++ tuplehash->tuple.dst_cache,
+ &ip6_daddr) < 0)
+ return NF_DROP;
+
+--
+2.55.0
+
--- /dev/null
+From f62c41b4910e65da396ec9a8c40c1fe7fe82e449 Mon Sep 17 00:00:00 2001
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Date: Wed, 8 Jul 2026 13:27:28 +0800
+Subject: netfilter: nf_conncount: fix zone comparison in tuple dedup
+
+From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+
+commit f62c41b4910e65da396ec9a8c40c1fe7fe82e449 upstream.
+
+The "already exists" dedup logic in __nf_conncount_add() decides
+whether a connection has already been counted and can be skipped instead
+of incrementing the connlimit count. It compares the conntrack zone of a
+list entry with the zone of the connection being added using
+nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or
+zone->dir as the direction argument.
+
+Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0
+and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask:
+NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and
+NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction
+shifts the meaning of every non-zero value. An ORIG-only zone passes 1
+and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and
+test bits beyond the valid direction range. In those cases
+nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using
+the real zone id, so different zones can be treated as equal and dedup
+collapses to tuple equality alone.
+
+nf_conncount stores and compares the original-direction tuple for a
+connection. If an skb already has an attached conntrack entry,
+get_ct_or_tuple_from_skb() explicitly copies
+ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's
+ctinfo. Therefore the zone comparison in the tuple dedup path must use
+IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a
+zone id applies, not which direction this conncount tuple represents.
+
+Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly.
+Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone
+ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the
+direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional
+zone contains the ORIG bit, so it naturally returns the real zone id;
+reply-only zones continue to fall back for original-direction tuple
+comparisons.
+
+Fixes: 21ba8847f857 ("netfilter: nf_conncount: Fix garbage collection with zones")
+Fixes: b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race")
+Cc: stable@vger.kernel.org
+Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Reported-by: Ao Wang <wangao@seu.edu.cn>
+Reported-by: Xuewei Feng <fengxw06@126.com>
+Reported-by: Qi Li <qli01@tsinghua.edu.cn>
+Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
+Assisted-by: Claude-Code:GLM-5.2
+Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conncount.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -207,8 +207,8 @@ check_connections:
+ /* Not found, but might be about to be confirmed */
+ if (PTR_ERR(found) == -EAGAIN) {
+ if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
+- nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
+- nf_ct_zone_id(zone, zone->dir))
++ nf_ct_zone_id(&conn->zone, IP_CT_DIR_ORIGINAL) ==
++ nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL))
+ goto out_put; /* already exists */
+ } else {
+ collect++;
+@@ -219,7 +219,7 @@ check_connections:
+ found_ct = nf_ct_tuplehash_to_ctrack(found);
+
+ if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
+- nf_ct_zone_equal(found_ct, zone, zone->dir)) {
++ nf_ct_zone_equal(found_ct, zone, IP_CT_DIR_ORIGINAL)) {
+ /*
+ * We should not see tuples twice unless someone hooks
+ * this into a table without "-p tcp --syn".
--- /dev/null
+From ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a Mon Sep 17 00:00:00 2001
+From: Muhammad Bilal <meatuni001@gmail.com>
+Date: Tue, 19 May 2026 17:23:28 -0400
+Subject: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
+
+From: Muhammad Bilal <meatuni001@gmail.com>
+
+commit ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a upstream.
+
+parse_dcc() treats data_end as an inclusive end pointer, but its only
+caller passes data_limit = ib_ptr + datalen, which points one past the
+last valid byte.
+
+The newline search loop iterates while tmp <= data_end, so when no
+newline is present, *tmp is read at tmp == data_end, one byte beyond
+the region filled by skb_header_pointer().
+
+irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is
+capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte
+is uninitialized or stale; if it contains an ASCII digit, simple_strtoul
+will consume it and produce a wrong DCC IP or port in the conntrack
+expectation. The extra allocation byte is also a fragile guard: if the
+cap or allocation size changes, this becomes a real out-of-bounds read.
+
+Change the loop and its post-loop check to use strict less-than,
+consistent with the caller's exclusive-end convention. Update the
+function comment accordingly.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_irc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_irc.c
++++ b/net/netfilter/nf_conntrack_irc.c
+@@ -59,7 +59,7 @@ static const char *const dccprotos[] = {
+ /* tries to get the ip_addr and port out of a dcc command
+ * return value: -1 on failure, 0 on success
+ * data pointer to first byte of DCC command data
+- * data_end pointer to last byte of dcc command data
++ * data_end one past end of data
+ * ip returns parsed ip of dcc command
+ * port returns parsed port of dcc command
+ * ad_beg_p returns pointer to first byte of addr data
+@@ -77,10 +77,10 @@ static int parse_dcc(char *data, const c
+
+ /* Make sure we have a newline character within the packet boundaries
+ * because simple_strtoul parses until the first invalid character. */
+- for (tmp = data; tmp <= data_end; tmp++)
++ for (tmp = data; tmp < data_end; tmp++)
+ if (*tmp == '\n')
+ break;
+- if (tmp > data_end || *tmp != '\n')
++ if (tmp >= data_end || *tmp != '\n')
+ return -1;
+
+ *ad_beg_p = data;
--- /dev/null
+From 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 Mon Sep 17 00:00:00 2001
+From: Xiang Mei <xmei5@asu.edu>
+Date: Sun, 5 Jul 2026 16:36:29 -0700
+Subject: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
+
+From: Xiang Mei <xmei5@asu.edu>
+
+commit 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 upstream.
+
+nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6
+fragment header and then unconditionally advances skb->mac_header:
+
+ skb->mac_header += sizeof(struct frag_hdr);
+
+On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header
+yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding
+sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7),
+after which skb_mac_header_was_set() wrongly reports a MAC header is
+present and skb_mac_header() points into the headroom.
+
+The reassembler has done this unconditional add since it was introduced;
+it was harmless while mac_header was a bare pointer, but wrong once
+mac_header became a u16 offset whose unset state is the ~0U sentinel
+tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c
+does the same relocation and does guard the adjustment; mirror the
+guard here.
+
+Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
+Cc: stable@vger.kernel.org
+Reported-by: Weiming Shi <bestswngs@gmail.com>
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -348,7 +348,8 @@ static int nf_ct_frag6_reasm(struct frag
+ skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
+ memmove(skb->head + sizeof(struct frag_hdr), skb->head,
+ (skb->data - skb->head) - sizeof(struct frag_hdr));
+- skb->mac_header += sizeof(struct frag_hdr);
++ if (skb_mac_header_was_set(skb))
++ skb->mac_header += sizeof(struct frag_hdr);
+ skb->network_header += sizeof(struct frag_hdr);
+
+ skb_reset_transport_header(skb);
--- /dev/null
+From e5e24a365a5e024efef63cc49abb345fbd4852c5 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 26 Jun 2026 13:24:49 +0200
+Subject: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit e5e24a365a5e024efef63cc49abb345fbd4852c5 upstream.
+
+tc ingress and openvswitch do not guarantee routing information to be
+available. These subsystems use the conntrack helper infrastructure, and
+the SIP helper relies on the skb_dst() to be present if
+sip_external_media is set to 1 (which is disabled by default as a module
+parameter).
+
+This effectively disables the sip_external_media toggle for these
+subsystems without resulting in a crash.
+
+Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action")
+Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
+Cc: stable@vger.kernel.org
+Reported-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_sip.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_sip.c
++++ b/net/netfilter/nf_conntrack_sip.c
+@@ -956,7 +956,6 @@ static int set_expected_rtp_rtcp(struct
+ return NF_ACCEPT;
+ saddr = &ct->tuplehash[!dir].tuple.src.u3;
+ } else if (sip_external_media) {
+- struct net_device *dev = skb_dst(skb)->dev;
+ struct dst_entry *dst = NULL;
+ struct flowi fl;
+
+@@ -978,7 +977,11 @@ static int set_expected_rtp_rtcp(struct
+ * through the same interface as the signalling peer.
+ */
+ if (dst) {
+- bool external_media = (dst->dev == dev);
++ const struct dst_entry *this_dst = skb_dst(skb);
++ bool external_media = false;
++
++ if (this_dst && dst->dev == this_dst->dev)
++ external_media = true;
+
+ dst_release(dst);
+ if (external_media)
--- /dev/null
+From 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 1 Jul 2026 07:44:17 +0200
+Subject: netfilter: nf_nat_sip: reload possible stale data pointer
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 upstream.
+
+quoting sashiko:
+ ------------------------------------------------------------------------
+ [..] noticed a potential memory bug and header corruption involving the
+ SIP NAT helper.
+
+ In net/netfilter/nf_nat_sip.c:nf_nat_sip():
+ if (skb_ensure_writable(skb, skb->len)) {
+ nf_ct_helper_log(skb, ct, "cannot mangle packet");
+ return NF_DROP;
+ }
+ uh = (void *)skb->data + protoff;
+ uh->dest = ct_sip_info->forced_dport;
+ if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
+ 0, 0, NULL, 0)) {
+
+ If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the
+ old data buffer is freed. However, nf_nat_sip() fails to update *dptr to
+ point to the new buffer.
+
+ It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP
+ packet, which would overwrite the sequence number with a checksum update.
+ ------------------------------------------------------------------------
+
+nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.
+But clones are possible, so rebuild dptr.
+
+Disable nf_nat_mangle_udp_packet() branch for TCP streams.
+It doesn't look like this can ever happen, else we should have received
+bug reports about this, so just check the conntrack is UDP and drop
+otherwise.
+
+The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages,
+so I don't think this is ever expected to be true for a TCP stream.
+
+Fixes: 7266507d8999 ("netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-sonnet-4-6
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_nat_sip.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/net/netfilter/nf_nat_sip.c
++++ b/net/netfilter/nf_nat_sip.c
+@@ -289,13 +289,24 @@ next:
+
+ /* Mangle destination port for Cisco phones, then fix up checksums */
+ if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
++ int doff = *dptr - (const char *)skb->data;
+ struct udphdr *uh;
+
++ if (doff <= 0) {
++ DEBUG_NET_WARN_ON_ONCE(1);
++ return NF_DROP;
++ }
++
++ /* ct_sip_info->forced_dport only expected with UDP */
++ if (nf_ct_protonum(ct) != IPPROTO_UDP)
++ return NF_DROP;
++
+ if (skb_ensure_writable(skb, skb->len)) {
+ nf_ct_helper_log(skb, ct, "cannot mangle packet");
+ return NF_DROP;
+ }
+
++ *dptr = skb->data + doff;
+ uh = (void *)skb->data + protoff;
+ uh->dest = ct_sip_info->forced_dport;
+
--- /dev/null
+From c9c9b37f8c5505224e8d206184df3bb668ee00cf Mon Sep 17 00:00:00 2001
+From: Haoze Xie <royenheart@gmail.com>
+Date: Mon, 8 Jun 2026 13:43:44 +0800
+Subject: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
+
+From: Haoze Xie <royenheart@gmail.com>
+
+commit c9c9b37f8c5505224e8d206184df3bb668ee00cf upstream.
+
+The br_netfilter fake rtable is embedded in struct net_bridge and is
+attached to bridged packets with skb_dst_set_noref(). If such a packet is
+queued to NFQUEUE, __nf_queue() upgrades that fake dst with
+skb_dst_force().
+
+At that point the queued skb can hold a real dst reference after bridge
+teardown has started. The problem is not that every bridged packet needs
+its own dst reference. The problem is that NFQUEUE can keep the bridge
+private fake dst alive after unregister begins.
+
+Fix this by keeping the bridge fake dst model unchanged and pinning the
+bridge master device only while the packet sits in NFQUEUE. Record the
+bridge device in nf_queue_entry when the queued skb carries a bridge fake
+dst, take a device reference for the queue lifetime, and drop it when the
+queue entry is freed.
+
+Also make sure queued entries are reaped when that bridge device goes
+down, and drop the redundant nf_bridge_info_exists() test from the fake
+dst detection.
+
+This keeps netdev_priv(br->dev) alive until verdict completion, so the
+embedded fake rtable and its metrics backing storage cannot be freed out
+from under dst_release(). It also avoids the constant refcount bump and
+avoids using ipv4-specific dst helpers for IPv6 bridge traffic.
+
+Fixes: 34666d467cbf ("netfilter: bridge: move br_netfilter out of the core")
+Cc: stable@kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Haoze Xie <royenheart@gmail.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/netfilter/nf_queue.h | 1 +
+ net/netfilter/nf_queue.c | 14 ++++++++++++++
+ net/netfilter/nfnetlink_queue.c | 3 +++
+ 3 files changed, 18 insertions(+)
+
+--- a/include/net/netfilter/nf_queue.h
++++ b/include/net/netfilter/nf_queue.h
+@@ -18,6 +18,7 @@ struct nf_queue_entry {
+ unsigned int id;
+ unsigned int hook_index; /* index in hook_entries->hook[] */
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
++ struct net_device *bridge_dev;
+ struct net_device *physin;
+ struct net_device *physout;
+ #endif
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -68,6 +68,7 @@ static void nf_queue_entry_release_refs(
+ nf_queue_sock_put(state->sk);
+
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
++ dev_put(entry->bridge_dev);
+ dev_put(entry->physin);
+ dev_put(entry->physout);
+ #endif
+@@ -84,6 +85,8 @@ static void __nf_queue_entry_init_physde
+ {
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+ const struct sk_buff *skb = entry->skb;
++ struct dst_entry *dst = skb_dst(skb);
++ struct net_device *dev = NULL;
+
+ if (nf_bridge_info_exists(skb)) {
+ entry->physin = nf_bridge_get_physindev(skb, entry->state.net);
+@@ -92,6 +95,16 @@ static void __nf_queue_entry_init_physde
+ entry->physin = NULL;
+ entry->physout = NULL;
+ }
++
++ if (entry->state.pf == NFPROTO_BRIDGE &&
++ dst && (dst->flags & DST_FAKE_RTABLE))
++ dev = dst_dev_rcu(dst);
++
++ /* Must hold a reference on the bridge device: dst_hold() protects
++ * the dst itself, but the fake rtable is embedded in bridge-private
++ * storage that netdevice teardown can free independently.
++ */
++ entry->bridge_dev = dev;
+ #endif
+ }
+
+@@ -108,6 +121,7 @@ bool nf_queue_entry_get_refs(struct nf_q
+ dev_hold(state->out);
+
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
++ dev_hold(entry->bridge_dev);
+ dev_hold(entry->physin);
+ dev_hold(entry->physout);
+ #endif
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -1270,6 +1270,9 @@ dev_cmp(struct nf_queue_entry *entry, un
+
+ if (physinif == ifindex || physoutif == ifindex)
+ return 1;
++
++ if (entry->bridge_dev && entry->bridge_dev->ifindex == ifindex)
++ return 1;
+ #endif
+ if (entry->skb_dev && entry->skb_dev->ifindex == ifindex)
+ return 1;
--- /dev/null
+From d738feccb98cb224ebabecb703e98f5008276bff Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Sat, 11 Apr 2026 19:57:21 +0100
+Subject: netfilter: nfnl_cthelper: apply per-class values when updating policies
+
+From: David Carlier <devnexen@gmail.com>
+
+commit d738feccb98cb224ebabecb703e98f5008276bff upstream.
+
+When a userspace conntrack helper with multiple expectation classes is
+updated via nfnetlink, every class ends up with the first class's
+max_expected and timeout values.
+
+nfnl_cthelper_update_policy_all() validates each new policy into the
+corresponding slot of the temporary new_policy array, but the second
+loop that commits the values into the live helper dereferences
+new_policy as a pointer instead of indexing it, so every iteration
+reads new_policy[0] regardless of i. An update that changes per-class
+values is silently collapsed onto class 0's values with no error
+returned to userspace.
+
+Index the temporary array by i in the commit loop so each class gets
+its own validated values.
+
+Fixes: 2c422257550f ("netfilter: nfnl_cthelper: fix runtime expectation policy updates")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nfnetlink_cthelper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -354,8 +354,8 @@ static int nfnl_cthelper_update_policy_a
+ for (i = 0; i < helper->expect_class_max + 1; i++) {
+ policy = (struct nf_conntrack_expect_policy *)
+ &helper->expect_policy[i];
+- policy->max_expected = new_policy->max_expected;
+- policy->timeout = new_policy->timeout;
++ policy->max_expected = new_policy[i].max_expected;
++ policy->timeout = new_policy[i].timeout;
+ }
+
+ err:
--- /dev/null
+From d07955dd34ecae17d35d8c7d0a273a3fba653a8c Mon Sep 17 00:00:00 2001
+From: Theodor Arsenij Larionov-Trichkine <theodorlarionov@gmail.com>
+Date: Mon, 29 Jun 2026 12:53:11 +0200
+Subject: netfilter: nft_fib: reject fib expression on the netdev egress hook
+
+From: Theodor Arsenij Larionov-Trichkine <theodorlarionov@gmail.com>
+
+commit d07955dd34ecae17d35d8c7d0a273a3fba653a8c upstream.
+
+A fib expression in a netdev egress base chain dereferences nft_in(pkt),
+NULL on the transmit path, causing a NULL pointer dereference at eval.
+nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook
+numbers are a separate enum that aliases them (NF_NETDEV_EGRESS ==
+NF_INET_LOCAL_IN), so an egress chain passes validation and then faults.
+
+Add nft_fib_netdev_validate() that limits each result/flag to the netdev
+hook where the device it reads exists: the input-device cases (OIF,
+OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE
+with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict
+nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are
+not applied to another family's hooks.
+
+Fixes: 42df6e1d221d ("netfilter: Introduce egress hook")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/netfilter-devel/ajxsjcDOnwllMfoR@strlen.de/
+Signed-off-by: Theodor Arsenij Larionov-Trichkine <theodorlarionov@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nft_fib.c | 9 +++++++++
+ net/netfilter/nft_fib_netdev.c | 29 ++++++++++++++++++++++++++++-
+ 2 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nft_fib.c
++++ b/net/netfilter/nft_fib.c
+@@ -31,6 +31,15 @@ int nft_fib_validate(const struct nft_ct
+ const struct nft_fib *priv = nft_expr_priv(expr);
+ unsigned int hooks;
+
++ switch (ctx->family) {
++ case NFPROTO_IPV4:
++ case NFPROTO_IPV6:
++ case NFPROTO_INET:
++ break;
++ default:
++ return -EOPNOTSUPP;
++ }
++
+ switch (priv->result) {
+ case NFT_FIB_RESULT_OIF:
+ case NFT_FIB_RESULT_OIFNAME:
+--- a/net/netfilter/nft_fib_netdev.c
++++ b/net/netfilter/nft_fib_netdev.c
+@@ -50,6 +50,33 @@ static void nft_fib_netdev_eval(const st
+ regs->verdict.code = NFT_BREAK;
+ }
+
++static int nft_fib_netdev_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ const struct nft_fib *priv = nft_expr_priv(expr);
++ unsigned int hooks;
++
++ switch (priv->result) {
++ case NFT_FIB_RESULT_OIF:
++ case NFT_FIB_RESULT_OIFNAME:
++ hooks = (1 << NF_NETDEV_INGRESS);
++ break;
++ case NFT_FIB_RESULT_ADDRTYPE:
++ if (priv->flags & NFTA_FIB_F_IIF)
++ hooks = (1 << NF_NETDEV_INGRESS);
++ else if (priv->flags & NFTA_FIB_F_OIF)
++ hooks = (1 << NF_NETDEV_EGRESS);
++ else
++ hooks = (1 << NF_NETDEV_INGRESS) |
++ (1 << NF_NETDEV_EGRESS);
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ return nft_chain_validate_hooks(ctx->chain, hooks);
++}
++
+ static struct nft_expr_type nft_fib_netdev_type;
+ static const struct nft_expr_ops nft_fib_netdev_ops = {
+ .type = &nft_fib_netdev_type,
+@@ -57,7 +84,7 @@ static const struct nft_expr_ops nft_fib
+ .eval = nft_fib_netdev_eval,
+ .init = nft_fib_init,
+ .dump = nft_fib_dump,
+- .validate = nft_fib_validate,
++ .validate = nft_fib_netdev_validate,
+ };
+
+ static struct nft_expr_type nft_fib_netdev_type __read_mostly = {
--- /dev/null
+From 47e65eff50691f0a5b79d325e28d83ec1da43bcf Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 16 Jun 2026 13:26:26 +0200
+Subject: netfilter: nft_set_pipapo: don't leak bad clone into future transaction
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 47e65eff50691f0a5b79d325e28d83ec1da43bcf upstream.
+
+On memory allocation failure the cloned nft_pipapo_match can enter a bad
+state:
+ - some fields can have their lookup tables resized while others did
+ not
+ - bits might have been toggled
+ - scratch map can be undersized which also means m->bsize_max can be
+ lower than what is required
+
+This means that the next insertion in the same batch can trigger
+out-of-bounds writes.
+
+Furthermore, a failure in the first can result in the bad clone to
+leak into the next transaction because the abort callback is never
+executed in this case (the upper layer saw an error and no attempt to
+allocate a transactional request was made).
+
+Record a state for the nft_pipapo_match structure:
+- NEW (pristine clone)
+- MOD (modified clone with good state)
+- ERR (potentially bogus content)
+
+Then make it so that deletes and insertions fail when the clone
+entered ERR state.
+
+In case the very first insert attempt results in an error, free the
+clone right away.
+
+Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: Seesee <cjc000013@gmail.com>
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nft_set_pipapo.c | 34 +++++++++++++++++++++++++++++-----
+ net/netfilter/nft_set_pipapo.h | 8 ++++++++
+ 2 files changed, 37 insertions(+), 5 deletions(-)
+
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -342,6 +342,8 @@
+ #include "nft_set_pipapo_avx2.h"
+ #include "nft_set_pipapo.h"
+
++static void nft_pipapo_abort(const struct nft_set *set);
++
+ /**
+ * pipapo_refill() - For each set bit, set bits from selected mapping table item
+ * @map: Bitmap to be scanned for set bits
+@@ -1296,7 +1298,7 @@ static int nft_pipapo_insert(const struc
+ const u8 *start_p, *end_p;
+ int i, bsize_max, err = 0;
+
+- if (!m)
++ if (!m || m->state == NFT_PIPAPO_CLONE_ERR)
+ return -ENOMEM;
+
+ if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
+@@ -1367,8 +1369,10 @@ static int nft_pipapo_insert(const struc
+ else
+ ret = pipapo_expand(f, start, end, f->groups * f->bb);
+
+- if (ret < 0)
+- return ret;
++ if (ret < 0) {
++ err = ret;
++ goto abort;
++ }
+
+ if (f->bsize > bsize_max)
+ bsize_max = f->bsize;
+@@ -1384,7 +1388,7 @@ static int nft_pipapo_insert(const struc
+
+ err = pipapo_realloc_scratch(m, bsize_max);
+ if (err)
+- return err;
++ goto abort;
+
+ m->bsize_max = bsize_max;
+ } else {
+@@ -1396,7 +1400,26 @@ static int nft_pipapo_insert(const struc
+
+ pipapo_map(m, rulemap, e);
+
++ m->state = NFT_PIPAPO_CLONE_MOD;
+ return 0;
++abort:
++ DEBUG_NET_WARN_ON_ONCE(m->state == NFT_PIPAPO_CLONE_ERR);
++
++ /* Two rollback cases:
++ * 1) no previous changes. nft_pipapo_abort is not
++ * guaranteed to be invoked (there might be no further
++ * add/delete requests coming after this).
++ *
++ * 2) we had previous changes: there are transaction
++ * records pointing to this set. Leave the rollback to
++ * the transaction handling.
++ */
++ if (m->state == NFT_PIPAPO_CLONE_NEW)
++ nft_pipapo_abort(set); /* releases m */
++ else
++ m->state = NFT_PIPAPO_CLONE_ERR;
++
++ return err;
+ }
+
+ /**
+@@ -1473,6 +1496,7 @@ static struct nft_pipapo_match *pipapo_c
+ dst++;
+ }
+
++ new->state = NFT_PIPAPO_CLONE_NEW;
+ return new;
+
+ out_mt:
+@@ -1896,7 +1920,7 @@ nft_pipapo_deactivate(const struct net *
+ /* removal must occur on priv->clone, if we are low on memory
+ * we have no choice and must fail the removal request.
+ */
+- if (!m)
++ if (!m || m->state == NFT_PIPAPO_CLONE_ERR)
+ return NULL;
+
+ e = pipapo_get(m, (const u8 *)elem->key.val.data,
+--- a/net/netfilter/nft_set_pipapo.h
++++ b/net/netfilter/nft_set_pipapo.h
+@@ -131,9 +131,16 @@ struct nft_pipapo_scratch {
+ unsigned long __map[];
+ };
+
++enum nft_pipapo_clone_state {
++ NFT_PIPAPO_CLONE_NEW,
++ NFT_PIPAPO_CLONE_MOD,
++ NFT_PIPAPO_CLONE_ERR,
++};
++
+ /**
+ * struct nft_pipapo_match - Data used for lookup and matching
+ * @field_count: Amount of fields in set
++ * @state: add/delete state; used from control plane
+ * @bsize_max: Maximum lookup table bucket size of all fields, in longs
+ * @scratch: Preallocated per-CPU maps for partial matching results
+ * @rcu: Matching data is swapped on commits
+@@ -141,6 +148,7 @@ struct nft_pipapo_scratch {
+ */
+ struct nft_pipapo_match {
+ u8 field_count;
++ enum nft_pipapo_clone_state state:8;
+ unsigned int bsize_max;
+ struct nft_pipapo_scratch * __percpu *scratch;
+ struct rcu_head rcu;
--- /dev/null
+From 5feba91006ec92da57acc1cc2e34df623b98541e Mon Sep 17 00:00:00 2001
+From: Wyatt Feng <bronzed_45_vested@icloud.com>
+Date: Thu, 11 Jun 2026 15:21:42 +0800
+Subject: netfilter: xt_cluster: reject template conntracks in hash match
+
+From: Wyatt Feng <bronzed_45_vested@icloud.com>
+
+commit 5feba91006ec92da57acc1cc2e34df623b98541e upstream.
+
+xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully
+initialized conntrack and passes it to xt_cluster_hash().
+
+This causes a state confusion bug when the raw table CT target attaches
+a template conntrack to skb->_nfct before normal conntrack processing.
+Templates carry IPS_TEMPLATE status but do not have a valid tuple for
+hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the
+zeroed l3num field.
+
+Reject template conntracks before hashing them. This matches existing
+netfilter handling for template objects and avoids hashing incomplete
+conntrack state.
+
+Fixes: 0269ea493734 ("netfilter: xtables: add cluster match")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Assisted-by: Codex:GPT-5.4
+Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/xt_cluster.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/xt_cluster.c
++++ b/net/netfilter/xt_cluster.c
+@@ -107,7 +107,7 @@ xt_cluster_mt(const struct sk_buff *skb,
+ }
+
+ ct = nf_ct_get(skb, &ctinfo);
+- if (ct == NULL)
++ if (!ct || nf_ct_is_template(ct))
+ return false;
+
+ if (ct->master)
--- /dev/null
+From 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd Mon Sep 17 00:00:00 2001
+From: Wyatt Feng <bronzed_45_vested@icloud.com>
+Date: Sat, 13 Jun 2026 18:27:15 +0800
+Subject: netfilter: xt_nat: reject unsupported target families
+
+From: Wyatt Feng <bronzed_45_vested@icloud.com>
+
+commit 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd upstream.
+
+xt_nat SNAT and DNAT target handlers assume IP-family conntrack state
+is present and can dereference a NULL pointer when instantiated from an
+unsupported family through nft_compat. A bridge-family compat rule can
+therefore trigger a NULL-dereference in nf_nat_setup_info().
+
+Reject non-IP families in xt_nat_checkentry() so unsupported targets
+cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT
+compat users and leave the runtime fast path unchanged.
+
+[ The crash was fixed via
+ 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"),
+ so this patch is no longer critical.
+ Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra
+ family check is a good idea in any case. ]
+
+Fixes: c7232c9979cb ("netfilter: add protocol independent NAT core")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Assisted-by: Codex:GPT-5.4
+Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/xt_nat.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/net/netfilter/xt_nat.c
++++ b/net/netfilter/xt_nat.c
+@@ -26,6 +26,15 @@ static int xt_nat_checkentry_v0(const st
+
+ static int xt_nat_checkentry(const struct xt_tgchk_param *par)
+ {
++ switch (par->family) {
++ case NFPROTO_IPV4:
++ case NFPROTO_IPV6:
++ case NFPROTO_INET:
++ break;
++ default:
++ return -EINVAL;
++ }
++
+ return nf_ct_netns_get(par->net, par->family);
+ }
+
--- /dev/null
+From f468c48d488d0ea2df3422b3e1dfafae1611e853 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Fri, 10 Jul 2026 12:44:41 +0200
+Subject: netfilter: xt_physdev: masks are not c-strings
+
+From: Florian Westphal <fw@strlen.de>
+
+commit f468c48d488d0ea2df3422b3e1dfafae1611e853 upstream.
+
+... and must not be subjected to the 'nul terminated' constraint.
+If the interface name is 15 characters long, the mask is 16-bytes
+'0xff' (to cover for \0) and the valid device name is rejected.
+
+Fixes: 8df772afc9d0 ("netfilter: x_physdev: reject empty or not-nul terminated device names")
+Cc: stable@vger.kernel.org
+Closes: https://bugs.launchpad.net/neutron/+bug/2159935
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/xt_physdev.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/net/netfilter/xt_physdev.c
++++ b/net/netfilter/xt_physdev.c
+@@ -130,11 +130,6 @@ static int physdev_mt_check(const struct
+ if (X(physoutdev))
+ return -ENAMETOOLONG;
+ }
+-
+- if (X(in_mask))
+- return -ENAMETOOLONG;
+- if (X(out_mask))
+- return -ENAMETOOLONG;
+ #undef X
+
+ if (!brnf_probed) {
--- /dev/null
+From 47915e855fb38b42133e31ba917d99565f862154 Mon Sep 17 00:00:00 2001
+From: Sandipan Das <sandipan.das@amd.com>
+Date: Fri, 10 Jul 2026 22:04:49 +0530
+Subject: perf/x86/amd/brs: Fix kernel address leakage
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+commit 47915e855fb38b42133e31ba917d99565f862154 upstream.
+
+A user-only branch stack can contain branches that originate from
+the kernel. As a result, kernel addresses are exposed to user space
+even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
+supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries
+such as SYSRET/interrupt returns for which the branch-from addresses
+are in the kernel.
+
+E.g.
+
+ $ perf record -j any,u -c 4000 -e branch-brs -o - -- \
+ perf bench syscall basic --loop 1000 | \
+ perf script -i - -F brstack|tr ' ' '\n'| \
+ grep -E '0x[89a-f][0-9a-f]{15}'
+
+ ...
+ 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
+ 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
+ 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
+ ...
+
+BRS provides no hardware branch filtering, so privilege level
+filtering is performed entirely in software. However, amd_brs_match_plm()
+only validates the branch-to address against the requested privilege
+levels. For branches from the kernel to user space, the branch-from
+address is left unchecked and is leaked. Extend the software filter to
+also validate the branch-from address, so that any branch record whose
+branch-from address is in the kernel is dropped when
+PERF_SAMPLE_BRANCH_USER is requested.
+
+Fixes: 8910075d61a3 ("perf/x86/amd: Enable branch sampling priv level filtering")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: stable@vger.kernel.org
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com
+Closes: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/amd/brs.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/events/amd/brs.c
++++ b/arch/x86/events/amd/brs.c
+@@ -259,13 +259,13 @@ void amd_brs_disable_all(void)
+ amd_brs_disable();
+ }
+
+-static bool amd_brs_match_plm(struct perf_event *event, u64 to)
++static bool amd_brs_match_plm(struct perf_event *event, u64 from, u64 to)
+ {
+ int type = event->attr.branch_sample_type;
+ int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV;
+ int plm_u = PERF_SAMPLE_BRANCH_USER;
+
+- if (!(type & plm_k) && kernel_ip(to))
++ if (!(type & plm_k) && (kernel_ip(to) || kernel_ip(from)))
+ return 0;
+
+ if (!(type & plm_u) && !kernel_ip(to))
+@@ -338,11 +338,11 @@ void amd_brs_drain(void)
+ */
+ to = (u64)(((s64)to << shift) >> shift);
+
+- if (!amd_brs_match_plm(event, to))
+- continue;
+-
+ rdmsrq(brs_from(brs_idx), from);
+
++ if (!amd_brs_match_plm(event, from, to))
++ continue;
++
+ perf_clear_branch_entry_bitfields(br+nr);
+
+ br[nr].from = from;
--- /dev/null
+From 2a892294b83f541115c94b0bb637f39bef187657 Mon Sep 17 00:00:00 2001
+From: Sandipan Das <sandipan.das@amd.com>
+Date: Fri, 10 Jul 2026 16:15:27 +0530
+Subject: perf/x86/amd/lbr: Fix kernel address leakage
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+commit 2a892294b83f541115c94b0bb637f39bef187657 upstream.
+
+A user-only branch stack can contain branches that originate from
+the kernel. As a result, kernel addresses are exposed to user space
+even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
+supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET
+entries for which the branch-from addresses are in the kernel.
+
+E.g.
+
+ $ perf record -e cycles -o - -j any,save_type,u -- \
+ perf bench syscall basic --loop 1000 | \
+ perf script -i - -F brstack|tr ' ' '\n'| \
+ grep -E '0x[89a-f][0-9a-f]{15}'
+
+ ...
+ 0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ 0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ 0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ 0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ 0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ 0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
+ ...
+
+The reason is that the hardware filter only considers the privilege
+level applicable to the branch target. Extend software filtering to
+also validate the branch-from addresses against br_sel, so that any
+branch record whose branch-from address is in the kernel is dropped
+when PERF_SAMPLE_BRANCH_USER is requested.
+
+Fixes: f4f925dae741 ("perf/x86/amd/lbr: Add LbrExtV2 hardware branch filter support")
+Reported-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: stable@vger.kernel.org
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://patch.msgid.link/a898a29725f6b2f30518354cdc2e432db66c43cf.1783680119.git.sandipan.das@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/amd/lbr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/events/amd/lbr.c
++++ b/arch/x86/events/amd/lbr.c
+@@ -125,7 +125,8 @@ static void amd_pmu_lbr_filter(void)
+ }
+
+ /* If type does not correspond, then discard */
+- if (type == X86_BR_NONE || (br_sel & type) != type) {
++ if (type == X86_BR_NONE || (br_sel & type) != type ||
++ (!(br_sel & X86_BR_KERNEL) && kernel_ip(cpuc->lbr_entries[i].from))) {
+ cpuc->lbr_entries[i].from = 0; /* mark invalid */
+ compress = true;
+ }
--- /dev/null
+From 49145bce539117db4b6e9e83c0e5ef528e361050 Mon Sep 17 00:00:00 2001
+From: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Date: Mon, 6 Jul 2026 12:46:31 +0200
+Subject: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
+
+From: Sumanth Korikkar <sumanthk@linux.ibm.com>
+
+commit 49145bce539117db4b6e9e83c0e5ef528e361050 upstream.
+
+ev variable is userspace controlled via event->attr.config and used
+as an array index after bounds checking, but without speculation
+barriers.
+
+Add the missing array_index_nospec() call to prevent speculative
+execution.
+
+Cc: stable@vger.kernel.org
+Fixes: 212188a596d1 ("[S390] perf: add support for s390x CPU counters")
+Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Acked-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/perf_cpum_cf.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/s390/kernel/perf_cpum_cf.c
++++ b/arch/s390/kernel/perf_cpum_cf.c
+@@ -15,6 +15,7 @@
+ #include <linux/init.h>
+ #include <linux/miscdevice.h>
+ #include <linux/perf_event.h>
++#include <linux/nospec.h>
+
+ #include <asm/cpu_mf.h>
+ #include <asm/hwctrset.h>
+@@ -768,6 +769,7 @@ static int __hw_perf_event_init(struct p
+ if (!is_userspace_event(ev)) {
+ if (ev >= ARRAY_SIZE(cpumf_generic_events_user))
+ return -EOPNOTSUPP;
++ ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_user));
+ ev = cpumf_generic_events_user[ev];
+ }
+ } else if (!attr->exclude_kernel && attr->exclude_user) {
+@@ -778,6 +780,7 @@ static int __hw_perf_event_init(struct p
+ if (!is_userspace_event(ev)) {
+ if (ev >= ARRAY_SIZE(cpumf_generic_events_basic))
+ return -EOPNOTSUPP;
++ ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_basic));
+ ev = cpumf_generic_events_basic[ev];
+ }
+ }
--- /dev/null
+From 56acfeb10019e200ab6787d01f8d7cbe0f01526f Mon Sep 17 00:00:00 2001
+From: Tristan Madani <tristan@talencesecurity.com>
+Date: Thu, 25 Jun 2026 23:53:36 +0000
+Subject: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
+
+From: Tristan Madani <tristan@talencesecurity.com>
+
+commit 56acfeb10019e200ab6787d01f8d7cbe0f01526f upstream.
+
+selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a
+struct socket * to selinux_socket_bind() and
+selinux_socket_connect_helper(). However, when the hook is invoked
+from the ASCONF softirq path (sctp_process_asconf), there is no file
+reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt
+callers (bindx, connectx, set_primary, sendmsg connect) hold a file
+reference and are not affected.
+
+Both selinux_socket_bind() and selinux_socket_connect_helper()
+immediately resolve sock->sk, never using the struct socket * for
+anything else. Refactor the inner logic into helpers that take a
+struct sock * directly so that selinux_sctp_bind_connect() never needs
+to touch sk->sk_socket at all.
+
+Cc: stable@vger.kernel.org
+Fixes: d452930fd3b9 ("selinux: Add SCTP support")
+Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
+Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Tested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -4998,9 +4998,8 @@ static int selinux_socket_socketpair(str
+ Need to determine whether we should perform a name_bind
+ permission check between the socket and the port number. */
+
+-static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
++static int __selinux_socket_bind(struct sock *sk, struct sockaddr *address, int addrlen)
+ {
+- struct sock *sk = sock->sk;
+ struct sk_security_struct *sksec = selinux_sock(sk);
+ u16 family;
+ int err;
+@@ -5130,13 +5129,17 @@ err_af:
+ return -EAFNOSUPPORT;
+ }
+
++static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
++{
++ return __selinux_socket_bind(sock->sk, address, addrlen);
++}
++
+ /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
+ * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
+ */
+-static int selinux_socket_connect_helper(struct socket *sock,
++static int selinux_socket_connect_helper(struct sock *sk,
+ struct sockaddr *address, int addrlen)
+ {
+- struct sock *sk = sock->sk;
+ struct sk_security_struct *sksec = selinux_sock(sk);
+ int err;
+
+@@ -5225,7 +5228,7 @@ static int selinux_socket_connect(struct
+ int err;
+ struct sock *sk = sock->sk;
+
+- err = selinux_socket_connect_helper(sock, address, addrlen);
++ err = selinux_socket_connect_helper(sk, address, addrlen);
+ if (err)
+ return err;
+
+@@ -5727,13 +5730,11 @@ static int selinux_sctp_bind_connect(str
+ int len, err = 0, walk_size = 0;
+ void *addr_buf;
+ struct sockaddr *addr;
+- struct socket *sock;
+
+ if (!selinux_policycap_extsockclass())
+ return 0;
+
+ /* Process one or more addresses that may be IPv4 or IPv6 */
+- sock = sk->sk_socket;
+ addr_buf = address;
+
+ while (walk_size < addrlen) {
+@@ -5762,14 +5763,14 @@ static int selinux_sctp_bind_connect(str
+ case SCTP_PRIMARY_ADDR:
+ case SCTP_SET_PEER_PRIMARY_ADDR:
+ case SCTP_SOCKOPT_BINDX_ADD:
+- err = selinux_socket_bind(sock, addr, len);
++ err = __selinux_socket_bind(sk, addr, len);
+ break;
+ /* Connect checks */
+ case SCTP_SOCKOPT_CONNECTX:
+ case SCTP_PARAM_SET_PRIMARY:
+ case SCTP_PARAM_ADD_IP:
+ case SCTP_SENDMSG_CONNECT:
+- err = selinux_socket_connect_helper(sock, addr, len);
++ err = selinux_socket_connect_helper(sk, addr, len);
+ if (err)
+ return err;
+
--- /dev/null
+From 44c74d27d1b9aaa99fa8a83640c1223575262b80 Mon Sep 17 00:00:00 2001
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+Date: Thu, 18 Jun 2026 13:55:14 -0400
+Subject: selinux: check connect-related permissions on TCP Fast Open
+
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+
+commit 44c74d27d1b9aaa99fa8a83640c1223575262b80 upstream.
+
+Similar to Landlock, SELinux was not updated when TCP Fast Open
+support was introduced to ensure connect-related permissions are
+checked when using TCP Fast Open. Update its socket_sendmsg() hook to
+call selinux_socket_connect() when MSG_FASTOPEN is passed.
+
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/
+Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/
+Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reported-by: Matthieu Buffet <matthieu@buffet.re>
+Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Tested-by: Bryam Vargas <hexlabsecurity@proton.me>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5266,7 +5266,24 @@ static int selinux_socket_accept(struct
+ static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
+ int size)
+ {
+- return sock_has_perm(sock->sk, SOCKET__WRITE);
++ int rc;
++ struct sockaddr *const addr = msg->msg_name;
++ const int addrlen = msg->msg_namelen;
++
++ rc = sock_has_perm(sock->sk, SOCKET__WRITE);
++ if (rc)
++ return rc;
++
++ if (addr && (msg->msg_flags & MSG_FASTOPEN) &&
++ (sk_is_tcp(sock->sk) ||
++ (sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM &&
++ sock->sk->sk_protocol == IPPROTO_MPTCP))) {
++ rc = selinux_socket_connect(sock, addr, addrlen);
++ if (rc)
++ return rc;
++ }
++
++ return 0;
+ }
+
+ static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
--- /dev/null
+From 9fe595fad54d4ac6a402edb3f60bec859d52cea6 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Tue, 14 Jul 2026 14:57:59 +0200
+Subject: selinux: fix incorrect execmem checks on overlayfs
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+commit 9fe595fad54d4ac6a402edb3f60bec859d52cea6 upstream.
+
+The commit fixing the overlayfs mmap() and mprotect() access checks
+failed to skip the execmem check in __file_map_prot_check() for the case
+where the "mounter check" is being performed. This check should be
+performed only against the credentials of the task that is calling
+mmap()/mprotect(), since it doesn't pertain to the file itself, but
+rather just gates the ability of the calling task to get an executable
+memory mapping in general.
+
+The purpose of the "mounter check" is to guard against using an
+overlayfs mount to gain file access that would otherwise be denied to
+the mounter. For execmem this is not relevant, as there is no further
+file access granted based on it (notice that the file's context is not
+used as the target in the check), so checking it also against the
+mounter credentials would be incorrect.
+
+Fix this by passing a boolean to [__]file_map_prot_check() and
+selinux_mmap_file_common() that indicates if we are doing the "mounter
+check" and skiping the execmem check in that case. Since this boolean
+also indicates if we use current_cred() or the mounter cred as the
+subject, also remove the "cred" argument from these functions and
+determine it based on the boolean and the file struct.
+
+Cc: stable@vger.kernel.org
+Fixes: 82544d36b172 ("selinux: fix overlayfs mmap() and mprotect() access checks")
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 42 ++++++++++++++++++++++++------------------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3973,9 +3973,9 @@ static int selinux_file_ioctl_compat(str
+
+ static int default_noexec __ro_after_init;
+
+-static int __file_map_prot_check(const struct cred *cred,
+- const struct file *file, unsigned long prot,
+- bool shared, bool bf_user_file)
++static int __file_map_prot_check(const struct file *file, unsigned long prot,
++ bool shared, bool mounter_check,
++ bool bf_user_file)
+ {
+ struct inode *inode = NULL;
+ bool prot_exec = prot & PROT_EXEC;
+@@ -3988,10 +3988,10 @@ static int __file_map_prot_check(const s
+ inode = file_inode(file);
+ }
+
+- if (default_noexec && prot_exec &&
++ if (!mounter_check && default_noexec && prot_exec &&
+ (!file || IS_PRIVATE(inode) || (!shared && prot_write))) {
+ int rc;
+- u32 sid = cred_sid(cred);
++ u32 sid = current_sid();
+
+ /*
+ * We are making executable an anonymous mapping or a private
+@@ -4004,6 +4004,8 @@ static int __file_map_prot_check(const s
+ }
+
+ if (file) {
++ const struct cred *cred = mounter_check ?
++ file->f_cred : current_cred();
+ /* "read" always possible, "write" only if shared */
+ u32 av = FILE__READ;
+ if (shared && prot_write)
+@@ -4017,11 +4019,11 @@ static int __file_map_prot_check(const s
+ return 0;
+ }
+
+-static inline int file_map_prot_check(const struct cred *cred,
+- const struct file *file,
+- unsigned long prot, bool shared)
++static inline int file_map_prot_check(const struct file *file,
++ unsigned long prot, bool shared,
++ bool mounter_check)
+ {
+- return __file_map_prot_check(cred, file, prot, shared, false);
++ return __file_map_prot_check(file, prot, shared, mounter_check, false);
+ }
+
+ static int selinux_mmap_addr(unsigned long addr)
+@@ -4037,12 +4039,14 @@ static int selinux_mmap_addr(unsigned lo
+ return rc;
+ }
+
+-static int selinux_mmap_file_common(const struct cred *cred, struct file *file,
+- unsigned long prot, bool shared)
++static int selinux_mmap_file_common(struct file *file, unsigned long prot,
++ bool shared, bool mounter_check)
+ {
+ if (file) {
+ int rc;
+ struct common_audit_data ad;
++ const struct cred *cred = mounter_check ?
++ file->f_cred : current_cred();
+
+ ad.type = LSM_AUDIT_DATA_FILE;
+ ad.u.file = file;
+@@ -4051,15 +4055,16 @@ static int selinux_mmap_file_common(cons
+ return rc;
+ }
+
+- return file_map_prot_check(cred, file, prot, shared);
++ return file_map_prot_check(file, prot, shared, mounter_check);
+ }
+
+ static int selinux_mmap_file(struct file *file,
+ unsigned long reqprot __always_unused,
+ unsigned long prot, unsigned long flags)
+ {
+- return selinux_mmap_file_common(current_cred(), file, prot,
+- (flags & MAP_TYPE) == MAP_SHARED);
++ return selinux_mmap_file_common(file, prot,
++ (flags & MAP_TYPE) == MAP_SHARED,
++ false);
+ }
+
+ /**
+@@ -4091,8 +4096,9 @@ static int selinux_mmap_backing_file(str
+ if (vma->vm_flags & VM_EXEC)
+ prot |= PROT_EXEC;
+
+- return selinux_mmap_file_common(backing_file->f_cred, backing_file,
+- prot, vma->vm_flags & VM_SHARED);
++ return selinux_mmap_file_common(backing_file, prot,
++ vma->vm_flags & VM_SHARED,
++ true);
+ }
+
+ static int selinux_file_mprotect(struct vm_area_struct *vma,
+@@ -4153,11 +4159,11 @@ static int selinux_file_mprotect(struct
+ }
+ }
+
+- rc = __file_map_prot_check(cred, file, prot, shared, backing_file);
++ rc = __file_map_prot_check(file, prot, shared, false, backing_file);
+ if (rc)
+ return rc;
+ if (backing_file) {
+- rc = file_map_prot_check(file->f_cred, file, prot, shared);
++ rc = file_map_prot_check(file, prot, shared, true);
+ if (rc)
+ return rc;
+ }
kvm-arm64-nv-inject-sea-if-kvm_translate_vncr-can-t-resolve-pfn.patch
kvm-arm64-nv-re-translate-vncr-before-injecting-abort.patch
kvm-arm64-nv-inject-sea-if-guest-vncr-isn-t-normal-memory.patch
+fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch
+fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch
+fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch
+fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch
+fbdev-efifb-fix-memory-leak-in-efifb_probe.patch
+fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch
+fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch
+fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch
+fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch
+fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch
+fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch
+fbdev-vesafb-fix-memory-leak-in-vesafb_probe.patch
+fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch
+fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch
+asoc-sof-topology-fix-memory-leak-in-snd_sof_load_topology.patch
+asoc-sof-ipc3-control-fix-heap-overflow-in-bytes_ext-put-get.patch
+asoc-sof-ipc3-control-validate-size-in-snd_sof_update_control.patch
+asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch
+asoc-mediatek-mt8192-release-reserved-memory-on-cleanup.patch
+asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch
+asoc-mediatek-mt8183-release-reserved-memory-on-cleanup.patch
+asoc-qcom-q6apm-fix-null-pointer-dereference-in-graph_callback.patch
+netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch
+netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch
+netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch
+netfilter-nf_queue-pin-bridge-device-while-nfqueue-holds-fake-dst.patch
+netfilter-nft_fib-reject-fib-expression-on-the-netdev-egress-hook.patch
+netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch
+netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch
+netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch
+netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch
+netfilter-flowtable-use-dst-in-this-direction-when-pushing-ipip-header.patch
+netfilter-flowtable-support-ipip-tunnel-with-direct-xmit.patch
+netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch
+netfilter-xt_physdev-masks-are-not-c-strings.patch
+netfilter-ecache-fix-inverted-time_after-check.patch
+netfilter-xt_nat-reject-unsupported-target-families.patch
+netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch
+netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch
+gpu-nova-core-simplify-and_then-with-condition-to-filter.patch
+gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch
+gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch
+soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch
+soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch
+selinux-check-connect-related-permissions-on-tcp-fast-open.patch
+selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch
+selinux-fix-incorrect-execmem-checks-on-overlayfs.patch
+leds-uleds-fix-potential-buffer-overread.patch
+mfd-sm501-fix-reference-leak-on-failed-device-registration.patch
+tools-power-x86-intel-speed-select-harden-daemon-pidfile-open.patch
+x86-video-only-fall-back-to-vga_default_device-without-screen-info.patch
+x86-virt-sev-revert-drop-wbinvd-before-setting-msr_amd64_syscfg_snp_en.patch
+x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch
+x86-boot-reject-too-long-acpi_rsdp-values.patch
+perf-x86-amd-brs-fix-kernel-address-leakage.patch
+perf-x86-amd-lbr-fix-kernel-address-leakage.patch
+cpufreq-schedutil-fix-uncleared-need_freq_update-on-the-.adjust_perf-path.patch
+cpufreq-intel_pstate-set-non-turbo-capacity-to-hwp_guaranteed_perf.patch
+s390-perf_cpum_cf-add-missing-array_index_nospec-to-__hw_perf_event_init.patch
+batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch
+batman-adv-retrieve-ethhdr-after-potential-skb-realloc-on-rx.patch
+batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch
+batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch
+batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch
+batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch
+batman-adv-ensure-minimal-ethernet-header-on-tx.patch
+batman-adv-dat-fix-tie-break-for-candidate-selection.patch
+batman-adv-tt-avoid-request-storms-during-pending-request.patch
+batman-adv-fix-vlan-priority-offset.patch
+batman-adv-frag-free-unfragmentable-packet.patch
+batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch
+batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch
+batman-adv-mcast-avoid-oob-read-of-num_dests-header.patch
+batman-adv-tt-prevent-tvlv-oob-check-overflow.patch
+cifs-invalidate-cfid-on-unlink-rename-rmdir.patch
+mfd-tps6586x-fix-of-node-refcount.patch
+backlight-ktd2801-enable-bl_core_suspendresume.patch
--- /dev/null
+From a0fe29d20e7822182e12324905af5115c1b3aed3 Mon Sep 17 00:00:00 2001
+From: Wang Jun <1742789905@qq.com>
+Date: Fri, 27 Mar 2026 08:12:25 +0800
+Subject: soc: fsl: qe: panic on ioremap() failure in qe_reset()
+
+From: Wang Jun <1742789905@qq.com>
+
+commit a0fe29d20e7822182e12324905af5115c1b3aed3 upstream.
+
+When ioremap() fails in qe_reset(), the global pointer qe_immr remains
+NULL, leading to a subsequent NULL pointer dereference when the pointer
+is accessed. Since this happens early in the boot process, a failure to
+map a few bytes of I/O memory indicates a fatal error from which the
+system cannot recover.
+
+Follow the same pattern as qe_sdma_init() and panic immediately when
+ioremap() fails. This avoids a silent NULL pointer dereference later
+and makes the error explicit.
+
+Fixes: 986585385131 ("[POWERPC] Add QUICC Engine (QE) infrastructure")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wang Jun <1742789905@qq.com>
+Link: https://lore.kernel.org/r/tencent_FED49CF5331CC0C7910618883332A08E2606@qq.com
+[chleroy: Rearranged change to reduce churn]
+Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/fsl/qe/qe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/soc/fsl/qe/qe.c
++++ b/drivers/soc/fsl/qe/qe.c
+@@ -89,6 +89,9 @@ void qe_reset(void)
+ if (qe_immr == NULL)
+ qe_immr = ioremap(get_qe_base(), QE_IMMAP_SIZE);
+
++ if (!qe_immr)
++ panic("QE:ioremap failed!");
++
+ qe_snums_init();
+
+ qe_issue_cmd(QE_RESET, QE_CR_SUBBLOCK_INVALID,
--- /dev/null
+From b920352cfd2b0fcd1249ff006618c939b64fc8f7 Mon Sep 17 00:00:00 2001
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+Date: Fri, 1 May 2026 18:10:54 +0530
+Subject: soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+commit b920352cfd2b0fcd1249ff006618c939b64fc8f7 upstream.
+
+k3_ringacc_ring_pop_tail_io() and k3_ringacc_ring_pop_tail_proxy()
+incorrectly use K3_RINGACC_ACCESS_MODE_POP_HEAD instead of
+K3_RINGACC_ACCESS_MODE_POP_TAIL. This will result in ring elements being
+popped in the reverse order of that which the caller expects. Fix this.
+
+Fixes: 3277e8aa2504 ("soc: ti: k3: add navss ringacc driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com>
+Link: https://patch.msgid.link/20260501124129.362192-1-s-vadapalli@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/ti/k3-ringacc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/soc/ti/k3-ringacc.c
++++ b/drivers/soc/ti/k3-ringacc.c
+@@ -1012,7 +1012,7 @@ static int k3_ringacc_ring_pop_head_prox
+ static int k3_ringacc_ring_pop_tail_proxy(struct k3_ring *ring, void *elem)
+ {
+ return k3_ringacc_ring_access_proxy(ring, elem,
+- K3_RINGACC_ACCESS_MODE_POP_HEAD);
++ K3_RINGACC_ACCESS_MODE_POP_TAIL);
+ }
+
+ static int k3_ringacc_ring_access_io(struct k3_ring *ring, void *elem,
+@@ -1083,7 +1083,7 @@ static int k3_ringacc_ring_pop_io(struct
+ static int k3_ringacc_ring_pop_tail_io(struct k3_ring *ring, void *elem)
+ {
+ return k3_ringacc_ring_access_io(ring, elem,
+- K3_RINGACC_ACCESS_MODE_POP_HEAD);
++ K3_RINGACC_ACCESS_MODE_POP_TAIL);
+ }
+
+ /*
--- /dev/null
+From 607af438e6430893a822964c841a1994b33acccc Mon Sep 17 00:00:00 2001
+From: Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
+Date: Sun, 26 Apr 2026 08:09:28 -0700
+Subject: tools/power/x86/intel-speed-select: Harden daemon pidfile open
+
+From: Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
+
+commit 607af438e6430893a822964c841a1994b33acccc upstream.
+
+Avoid symlink-based pidfile clobbering by opening the pidfile with
+O_NOFOLLOW and validating it with fstat() before locking/writing.
+
+The daemon currently uses a fixed pidfile path under /tmp. A local
+unprivileged user can pre-create a symlink at that path and cause a
+root-run daemon instance to write into an attacker-chosen file.
+
+Fixes: 7fd786dfbd2c ("tools/power/x86/intel-speed-select: OOB daemon mode")
+Signed-off-by: Ali Ahmet MEMIS <dev@unknownbbqr.xyz>
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/power/x86/intel-speed-select/isst-daemon.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/tools/power/x86/intel-speed-select/isst-daemon.c
++++ b/tools/power/x86/intel-speed-select/isst-daemon.c
+@@ -148,6 +148,7 @@ static void daemonize(char *rundir, char
+ {
+ int pid, sid, i;
+ char str[10];
++ struct stat st;
+ struct sigaction sig_actions;
+ sigset_t sig_set;
+ int ret;
+@@ -200,11 +201,17 @@ static void daemonize(char *rundir, char
+ if (ret == -1)
+ exit(EXIT_FAILURE);
+
+- pid_file_handle = open(pidfile, O_RDWR | O_CREAT, 0600);
++ pid_file_handle = open(pidfile, O_RDWR | O_CREAT | O_NOFOLLOW, 0600);
+ if (pid_file_handle == -1) {
+ /* Couldn't open lock file */
+ exit(1);
+ }
++
++ if (fstat(pid_file_handle, &st) == -1)
++ exit(1);
++
++ if (!S_ISREG(st.st_mode))
++ exit(1);
+ /* Try to lock file */
+ #ifdef LOCKF_SUPPORT
+ if (lockf(pid_file_handle, F_TLOCK, 0) == -1) {
--- /dev/null
+From d130041a7b96f79cd4c7079a6c2431a6db4c9619 Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Sun, 21 Jun 2026 19:00:10 +0200
+Subject: x86/boot: Reject too long acpi_rsdp= values
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit d130041a7b96f79cd4c7079a6c2431a6db4c9619 upstream.
+
+cmdline_find_option() returns the full length of the parsed acpi_rsdp=
+value. get_cmdline_acpi_rsdp() then silently truncates values which do
+not fit in the val[] buffer.
+
+Prevent boot_kstrtoul() from parsing a truncated value and then the
+kernel from silently using the wrong RSDP address, see discussion in
+Link:.
+
+Issue a warning so that the user is aware that s/he supplied a malformed
+value and can get feedback instead of silent crashes.
+
+ [ bp: Make commit message more precise. ]
+
+Fixes: 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20260617130417.36651-4-thorsten.blum@linux.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/compressed/acpi.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/boot/compressed/acpi.c
++++ b/arch/x86/boot/compressed/acpi.c
+@@ -184,10 +184,15 @@ static unsigned long get_cmdline_acpi_rs
+ char val[MAX_ADDR_LEN] = { };
+ int ret;
+
+- ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN);
++ ret = cmdline_find_option("acpi_rsdp", val, sizeof(val));
+ if (ret < 0)
+ return 0;
+
++ if (ret >= sizeof(val)) {
++ warn("acpi_rsdp= value too long; ignoring");
++ return 0;
++ }
++
+ if (boot_kstrtoul(val, 16, &addr))
+ return 0;
+ #endif
--- /dev/null
+From ffa0aa5b625fe0bed7463ac613f8b06676ff4542 Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Mon, 13 Jul 2026 21:49:25 +0200
+Subject: x86/boot: Validate console=uart8250 baud rate to fix early boot hang
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit ffa0aa5b625fe0bed7463ac613f8b06676ff4542 upstream.
+
+When the baud rate is empty, 0, invalid, or overflows to 0 when stored
+as an int, the system will hang during early boot because of a division
+by zero in early_serial_init().
+
+Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent
+an early system hang.
+
+Fixes: ce0aa5dd20e4 ("x86, setup: Make the setup code also accept console=uart8250")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260713194924.126472-3-thorsten.blum@linux.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/early_serial_console.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/boot/early_serial_console.c
++++ b/arch/x86/boot/early_serial_console.c
+@@ -117,7 +117,7 @@ static unsigned int probe_baud(int port)
+ static void parse_console_uart8250(void)
+ {
+ char optstr[64], *options;
+- int baud = DEFAULT_BAUD;
++ int baud;
+ int port = 0;
+
+ /*
+@@ -136,10 +136,13 @@ static void parse_console_uart8250(void)
+ else
+ return;
+
+- if (options && (options[0] == ','))
+- baud = simple_strtoull(options + 1, &options, 0);
+- else
++ if (options && (options[0] == ',')) {
++ baud = simple_strtoull(options + 1, NULL, 0);
++ if (!baud)
++ baud = DEFAULT_BAUD;
++ } else {
+ baud = probe_baud(port);
++ }
+
+ if (port)
+ early_serial_init(port, baud);
--- /dev/null
+From 596b3678326d3d1aed7c19423b6746f1ce09688a Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Tue, 23 Jun 2026 07:15:05 -0700
+Subject: x86/video: Only fall back to vga_default_device() without screen info
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 596b3678326d3d1aed7c19423b6746f1ce09688a upstream.
+
+Some multi GPU systems may have a VGA compatible device, but that might not be
+used for display. If due to enumeration order this device is found before the
+one actually used for display then multiple devices may show the boot_display
+attribute, confusing userspace.
+
+When screen info is valid, use it exclusively to find the primary device so
+that only the device backing the framebuffer is reported. Only when no
+framebuffer has been set up does it make sense to fall back to the default VGA
+device. This ensures at most one primary graphics device, preferably the one
+with the framebuffer.
+
+Fixes: ad90860bd10ee ("fbcon: Use screen info to find primary device")
+Closes: https://lore.kernel.org/linux-pci/20260618081803.2790848-1-aaron.ma@canonical.com/#t
+Reported-by: Aaron Ma <aaron.ma@canonical.com>
+Suggested-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Tested-by: Aaron Ma <aaron.ma@canonical.com>
+Cc: <stable@kernel.org>
+Link: https://patch.msgid.link/20260623141505.1816786-1-mario.limonciello@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/video/video-common.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/video/video-common.c
++++ b/arch/x86/video/video-common.c
+@@ -43,21 +43,26 @@ bool video_is_primary_device(struct devi
+ if (!pci_is_display(pdev))
+ return false;
+
+- if (pdev == vga_default_device())
+- return true;
+-
+ #ifdef CONFIG_SCREEN_INFO
+ numres = screen_info_resources(si, res, ARRAY_SIZE(res));
+- for (i = 0; i < numres; ++i) {
+- if (!(res[i].flags & IORESOURCE_MEM))
+- continue;
++ if (numres > 0) {
++ for (i = 0; i < numres; ++i) {
++ if (!(res[i].flags & IORESOURCE_MEM))
++ continue;
++
++ if (pci_find_resource(pdev, &res[i]))
++ return true;
++ }
+
+- if (pci_find_resource(pdev, &res[i]))
+- return true;
++ return false;
+ }
+ #endif
+
+- return false;
++ /*
++ * No framebuffer was set up by the firmware/bootloader, so fall back
++ * to the default VGA device.
++ */
++ return pdev == vga_default_device();
+ }
+ EXPORT_SYMBOL(video_is_primary_device);
+
--- /dev/null
+From 4c2509f3b79756679a02bea649c6a7501b58f52c Mon Sep 17 00:00:00 2001
+From: "Tycho Andersen (AMD)" <tycho@kernel.org>
+Date: Tue, 7 Jul 2026 09:00:33 -0600
+Subject: x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"
+
+From: Tycho Andersen (AMD) <tycho@kernel.org>
+
+commit 4c2509f3b79756679a02bea649c6a7501b58f52c upstream.
+
+Revert
+
+ 99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN").
+
+Section 8.8 of the SNP spec says:
+
+ Before invoking SNP_INIT_EX with INIT_RMP set to 1, software must ensure
+ that no CPUs contain dirty cache lines for the memory containing the RMP.
+
+Cachelines can be moved from cache to cache in a dirty state. The
+wbinvd_on_all_cpus() before SNP_INIT_EX flushes the caches for each CPU, but
+if the IPIs for WBINVD race with this dirty cacheline movement, it is possible
+that they may not get flushed, violating the firmware requirement.
+
+Doing wbinvd_on_all_cpus() before setting SNPEn is safer since the RMP
+table is not yet in use.
+
+ [ Heroically bisected by Srikanth. ]
+ [ bp: Massage commit message. ]
+
+Fixes: 99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN")
+Reported-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
+Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Tested-by: Srikanth Aithal <Srikanth.Aithal@amd.com>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: <stable@kernel.org>
+Link: https://patch.msgid.link/20260707150033.2364758-1-tycho@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/virt/svm/sev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/virt/svm/sev.c
++++ b/arch/x86/virt/svm/sev.c
+@@ -527,6 +527,8 @@ void snp_prepare(void)
+
+ cpus_read_lock();
+
++ wbinvd_on_all_cpus();
++
+ /*
+ * MtrrFixDramModEn is not shared between threads on a core,
+ * therefore it must be set on all CPUs prior to enabling SNP.
projects / thirdparty / kernel / stable-queue.git / commitdiff
