Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/batman-adv/main.c | 8 ++++++++
- net/batman-adv/soft-interface.c | 13 ++-----------
- net/batman-adv/soft-interface.h | 2 ++
+ net/batman-adv/main.c | 8 ++++++++
+ net/batman-adv/soft-interface.c | 13 ++-----------
+ net/batman-adv/soft-interface.h | 2 ++
3 files changed, 12 insertions(+), 11 deletions(-)
-diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
-index ac7fa70c09ca85..87f798701dabdc 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
-@@ -259,6 +259,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+@@ -259,6 +259,7 @@ err_orig:
void batadv_mesh_free(struct net_device *soft_iface)
{
struct batadv_priv *bat_priv = netdev_priv(soft_iface);
atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
-@@ -274,6 +275,13 @@ void batadv_mesh_free(struct net_device *soft_iface)
+@@ -274,6 +275,13 @@ void batadv_mesh_free(struct net_device
batadv_mcast_free(bat_priv);
/* Free the TT and the originator tables only after having terminated
* all the other depending components which may use these structures for
* their purposes.
-diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
-index bc72238e7a08c3..aaebe74c1bc0a9 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
-@@ -606,8 +606,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
+@@ -606,8 +606,8 @@ int batadv_softif_create_vlan(struct bat
* @bat_priv: the bat priv with all the soft interface information
* @vlan: the object to remove
*/
{
/* explicitly remove the associated TT local entry because it is marked
* with the NOPURGE flag
-@@ -1103,22 +1103,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev,
+@@ -1103,22 +1103,13 @@ static int batadv_softif_newlink(struct
static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
struct list_head *head)
{
unregister_netdevice_queue(soft_iface, head);
}
-diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
-index 9f2003f1a4972e..13709a5d23e3bf 100644
--- a/net/batman-adv/soft-interface.h
+++ b/net/batman-adv/soft-interface.h
-@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface,
+@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_devi
bool batadv_softif_is_valid(const struct net_device *net_dev);
extern struct rtnl_link_ops batadv_link_ops;
int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid);
void batadv_softif_vlan_release(struct kref *ref);
struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv,
unsigned short vid);
---
-2.53.0
-
--- /dev/null
+From a986fde914d88af47eb78fd29c5d1af7952c3500 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Sat, 20 Jun 2026 11:53:50 +0530
+Subject: bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit a986fde914d88af47eb78fd29c5d1af7952c3500 upstream.
+
+If the allocation of fp[i].tpa_info fails, the error path will not free
+the struct bnx2x_fastpath allocated earlier, as it is not linked to the
+bp structure yet. Fix that by linking it immediately after allocation.
+
+Cc: stable@vger.kernel.org
+Fixes: 15192a8cf8a8 ("bnx2x: Split the FP structure")
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260620062402.89549-1-nihaal@cse.iitm.ac.in
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -4750,6 +4750,7 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
+ fp = kcalloc(bp->fp_array_size, sizeof(*fp), GFP_KERNEL);
+ if (!fp)
+ goto alloc_err;
++ bp->fp = fp;
+ for (i = 0; i < bp->fp_array_size; i++) {
+ fp[i].tpa_info =
+ kcalloc(ETH_MAX_AGGREGATION_QUEUES_E1H_E2,
+@@ -4758,8 +4759,6 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
+ goto alloc_err;
+ }
+
+- bp->fp = fp;
+-
+ /* allocate sp objs */
+ bp->sp_objs = kcalloc(bp->fp_array_size, sizeof(struct bnx2x_sp_objs),
+ GFP_KERNEL);
--- /dev/null
+From 007800408002d871f5699bdb944f985896730b8f Mon Sep 17 00:00:00 2001
+From: Sabrina Dubroca <sd@queasysnail.net>
+Date: Fri, 12 Jun 2026 16:11:39 +0200
+Subject: espintcp: use sk_msg_free_partial to fix partial send
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+commit 007800408002d871f5699bdb944f985896730b8f upstream.
+
+sk_msg_free_partial() ensures consistency of the skmsg at every
+iteration, without having to manually handle uncharges and offsets.
+This simplifies the code, and fixes some bugs in skmsg accounting when
+we don't send the full contents.
+
+Cc: stable@vger.kernel.org
+Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
+Reported-by: Aaron Esau <aaron1esau@gmail.com>
+Reported-by: Yiming Qian <yimingqian591@gmail.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/espintcp.c | 34 +++++++---------------------------
+ 1 file changed, 7 insertions(+), 27 deletions(-)
+
+--- a/net/xfrm/espintcp.c
++++ b/net/xfrm/espintcp.c
+@@ -215,43 +215,23 @@ static int espintcp_sendskmsg_locked(str
+ struct sk_msg *skmsg = &emsg->skmsg;
+ bool more = flags & MSG_MORE;
+ struct scatterlist *sg;
+- int done = 0;
+ int ret;
+
+- sg = &skmsg->sg.data[skmsg->sg.start];
+ do {
+ struct bio_vec bvec;
+- size_t size = sg->length - emsg->offset;
+- int offset = sg->offset + emsg->offset;
+- struct page *p;
+-
+- emsg->offset = 0;
+
++ sg = &skmsg->sg.data[skmsg->sg.start];
+ if (sg_is_last(sg) && !more)
+ msghdr.msg_flags &= ~MSG_MORE;
+
+- p = sg_page(sg);
+-retry:
+- bvec_set_page(&bvec, p, size, offset);
+- iov_iter_bvec(&msghdr.msg_iter, ITER_SOURCE, &bvec, 1, size);
+- ret = tcp_sendmsg_locked(sk, &msghdr, size);
+- if (ret < 0) {
+- emsg->offset = offset - sg->offset;
+- skmsg->sg.start += done;
++ bvec_set_page(&bvec, sg_page(sg), sg->length, sg->offset);
++ iov_iter_bvec(&msghdr.msg_iter, ITER_SOURCE, &bvec, 1, sg->length);
++ ret = tcp_sendmsg_locked(sk, &msghdr, sg->length);
++ if (ret < 0)
+ return ret;
+- }
+
+- if (ret != size) {
+- offset += ret;
+- size -= ret;
+- goto retry;
+- }
+-
+- done++;
+- put_page(p);
+- sk_mem_uncharge(sk, sg->length);
+- sg = sg_next(sg);
+- } while (sg);
++ sk_msg_free_partial(sk, skmsg, ret);
++ } while (skmsg->sg.size);
+
+ memset(emsg, 0, sizeof(*emsg));
+
--- /dev/null
+From 018e9828eb523c638fa3d9bdf0fd4956b74555b2 Mon Sep 17 00:00:00 2001
+From: Hongchen Zhang <zhanghongchen@loongson.cn>
+Date: Thu, 25 Jun 2026 13:03:49 +0800
+Subject: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
+
+From: Hongchen Zhang <zhanghongchen@loongson.cn>
+
+commit 018e9828eb523c638fa3d9bdf0fd4956b74555b2 upstream.
+
+When hardware page table walker (PTW) is enabled on LoongArch, the CPU
+may set _PAGE_DIRTY directly in the page table entry during a write TLB
+miss, without going through the software TLB store handler. The software
+TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED
+together:
+
+ ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)
+
+Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e.
+_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has
+_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED
+clear (software is unaware).
+
+When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls
+pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and
+_PAGE_DIRTY bits:
+
+ pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);
+
+Since _PAGE_MODIFIED was never set, the dirtiness information is lost
+completely. Subsequently, when memory pressure triggers page reclaim,
+page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty()
+returns false) and the page may be freed without writeback, causing data
+corruption.
+
+Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in
+both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits:
+
+ if (pte_val(pte) & _PAGE_DIRTY)
+ pte_val(pte) |= _PAGE_MODIFIED;
+
+The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case,
+where pmd entries need the same treatment.
+
+This ensures the software dirty tracking bit (checked by pte_dirty() and
+pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is
+preserved across fork COW write-protection.
+
+The issue was found by the LTP madvise09 test case, which exercises page
+reclaim after "madvise(MADV_FREE), write and fork" operation sequence on
+private anonymous mappings.
+
+Cc: stable@vger.kernel.org
+Fixes: 09cfefb7fa70 ("LoongArch: Add memory management")
+Co-developed-by: Tianyang Zhang <zhangtianyang@loongson.cn>
+Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
+Signed-off-by: Hongchen Zhang <zhanghongchen@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/include/asm/pgtable.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/loongarch/include/asm/pgtable.h
++++ b/arch/loongarch/include/asm/pgtable.h
+@@ -390,6 +390,8 @@ static inline pte_t pte_mkwrite_novma(pt
+
+ static inline pte_t pte_wrprotect(pte_t pte)
+ {
++ if (pte_val(pte) & _PAGE_DIRTY)
++ pte_val(pte) |= _PAGE_MODIFIED;
+ pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);
+ return pte;
+ }
+@@ -505,6 +507,8 @@ static inline pmd_t pmd_mkwrite_novma(pm
+
+ static inline pmd_t pmd_wrprotect(pmd_t pmd)
+ {
++ if (pmd_val(pmd) & _PAGE_DIRTY)
++ pmd_val(pmd) |= _PAGE_MODIFIED;
+ pmd_val(pmd) &= ~(_PAGE_WRITE | _PAGE_DIRTY);
+ return pmd;
+ }
--- /dev/null
+From 9792ff8afa9017fe14f436f3ef3cd75f41f9f145 Mon Sep 17 00:00:00 2001
+From: Conor Dooley <conor.dooley@microchip.com>
+Date: Wed, 13 May 2026 18:55:55 +0100
+Subject: rtc: mpfs: fix counter upload completion condition
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+commit 9792ff8afa9017fe14f436f3ef3cd75f41f9f145 upstream.
+
+The condition that needs to be checked for upload completion is the
+UPLOAD bit in the completion register going low. The original iterations
+of this driver used a do-while and this was converted to a
+read_poll_timeout() during upstreaming without the condition being
+inverted as it should have been.
+
+I suspect that this went unnoticed until now because a) the first read
+was done when the bit was still set, immediately completing the
+read_poll_timeout() and b) because the RTC doesn't hold time when power
+is removed from the SoC reducing its utility (I for one keep it
+disabled). If my first suspicion was true when the driver was
+upstreamed, it's not true any longer though, hence the detection of the
+problem.
+
+Fixes: 0b31d703598dc ("rtc: Add driver for Microchip PolarFire SoC")
+CC: stable@vger.kernel.org
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Tested-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
+Link: https://patch.msgid.link/20260513-panhandle-ashy-70c6abf84d59@spud
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-mpfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-mpfs.c
++++ b/drivers/rtc/rtc-mpfs.c
+@@ -112,7 +112,7 @@ static int mpfs_rtc_settime(struct devic
+ ctrl |= CONTROL_UPLOAD_BIT;
+ writel(ctrl, rtcdev->base + CONTROL_REG);
+
+- ret = read_poll_timeout(readl, prog, prog & CONTROL_UPLOAD_BIT, 0, UPLOAD_TIMEOUT_US,
++ ret = read_poll_timeout(readl, prog, !(prog & CONTROL_UPLOAD_BIT), 0, UPLOAD_TIMEOUT_US,
+ false, rtcdev->base + CONTROL_REG);
+ if (ret) {
+ dev_err(dev, "timed out uploading time to rtc");
batman-adv-ensure-minimal-ethernet-header-on-tx.patch
rust-block-allow-deprecated-for-fetch_update-for-rus.patch
batman-adv-clean-untagged-vlan-on-netdev-registratio.patch
+loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch
+espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch
+bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch
+rtc-mpfs-fix-counter-upload-completion-condition.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
