--- /dev/null
+From 9825cf2cb59fac7480e7fac9eee13ab9af3f1ea8 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 30 Jun 2026 18:03:03 +0200
+Subject: ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 9825cf2cb59fac7480e7fac9eee13ab9af3f1ea8 upstream.
+
+Commit 292db66afd20 ("ACPICA: Unbreak tools build after switching over
+to strscpy_pad()") added an #ifdef based on a __KERNEL__ check which is
+sort of nasty to the acpi_ut_safe_strncpy() definition to unbreak ACPICA
+tools builds broken by commit 97f7d3f9c9ac ("ACPICA: Replace strncpy()
+with strscpy_pad() in acpi_ut_safe_strncpy()"). However, that #ifdef
+effectively produces dead code when tools are built because they don't
+call acpi_ut_safe_strncpy().
+
+Accordingly, drop the existing definition of acpi_ut_safe_strncpy() and
+define it as a strscpy_pad() alias.
+
+Fixes: 292db66afd20 ("ACPICA: Unbreak tools build after switching over to strscpy_pad()")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+[ rjw: Tweak the changelog ]
+Link: https://patch.msgid.link/12941764.O9o76ZdvQC@rafael.j.wysocki
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpica/acutils.h | 2 --
+ drivers/acpi/acpica/utnonansi.c | 16 ----------------
+ include/acpi/platform/aclinuxex.h | 1 +
+ 3 files changed, 1 insertion(+), 18 deletions(-)
+
+--- a/drivers/acpi/acpica/acutils.h
++++ b/drivers/acpi/acpica/acutils.h
+@@ -626,8 +626,6 @@ void acpi_ut_repair_name(char *name);
+ #if defined (ACPI_DEBUGGER) || defined (ACPI_APPLICATION) || defined (ACPI_DEBUG_OUTPUT)
+ u8 acpi_ut_safe_strcpy(char *dest, acpi_size dest_size, char *source);
+
+-void acpi_ut_safe_strncpy(char *dest, char *source, acpi_size dest_size);
+-
+ u8 acpi_ut_safe_strcat(char *dest, acpi_size dest_size, char *source);
+
+ u8
+--- a/drivers/acpi/acpica/utnonansi.c
++++ b/drivers/acpi/acpica/utnonansi.c
+@@ -164,20 +164,4 @@ acpi_ut_safe_strncat(char *dest,
+ return (FALSE);
+ }
+
+-void acpi_ut_safe_strncpy(char *dest, char *source, acpi_size dest_size)
+-{
+- /* Always terminate destination string */
+-
+-#ifdef __KERNEL__
+- strscpy_pad(dest, source, dest_size);
+-#else
+- /*
+- * strscpy_pad() is not defined in ACPICA tools builds, so use strncpy()
+- * and directly NUL-terminate the destination string in that case.
+- */
+- strncpy(dest, source, dest_size);
+- dest[dest_size - 1] = 0;
+-#endif
+-}
+-
+ #endif
+--- a/include/acpi/platform/aclinuxex.h
++++ b/include/acpi/platform/aclinuxex.h
+@@ -134,6 +134,7 @@ static inline void acpi_os_terminate_deb
+ /*
+ * OSL interfaces added by Linux
+ */
++#define acpi_ut_safe_strncpy strscpy_pad
+
+ #endif /* __KERNEL__ */
+
--- /dev/null
+From f5ef65adf81da3dbce4e692e48c1754c0bb95da0 Mon Sep 17 00:00:00 2001
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+Date: Tue, 30 Jun 2026 19:22:21 +0000
+Subject: drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+commit f5ef65adf81da3dbce4e692e48c1754c0bb95da0 upstream.
+
+When CONFIG_DRM_GPUSVM=n (e.g. um-allyesconfig), the only caller of
+xe_pt_svm_userptr_notifier_lock() is compiled out, triggering:
+
+ drivers/gpu/drm/xe/xe_pt.c:1418:13: warning:
+ 'xe_pt_svm_userptr_notifier_lock' defined but not used
+ [-Wunused-function]
+
+The helpers cannot simply be removed in this case: the matching
+xe_pt_svm_userptr_notifier_unlock() is also referenced from
+xe_pt_update_ops_run(), which lives outside any DRM_GPUSVM ifdef and is
+gated only at runtime by pt_update_ops->needs_svm_lock. The symbol must
+exist in all builds.
+
+Provide empty static inline stubs for !DRM_GPUSVM, matching the pattern
+used by xe_svm_notifier_lock()/_unlock() in xe_svm.h.
+
+Fixes: dca6e08c923a ("drm/xe/userptr: Hold notifier_lock for write on inject test path")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202606302210.QqcLbOEN-lkp@intel.com/
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260630192221.2998168-1-shuicheng.lin@intel.com
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+(cherry picked from commit 3359422bf0a1140e96d783a19a397686e580a3ca)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_pt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/xe/xe_pt.c
++++ b/drivers/gpu/drm/xe/xe_pt.c
+@@ -1407,6 +1407,7 @@ static int xe_pt_pre_commit(struct xe_mi
+ pt_update_ops, rftree);
+ }
+
++#if IS_ENABLED(CONFIG_DRM_GPUSVM)
+ /*
+ * Acquire/release the svm notifier_lock around xe_pt_svm_userptr_pre_commit()
+ * and the matching late release in xe_pt_update_ops_run(). Read mode by
+@@ -1433,6 +1434,10 @@ static void xe_pt_svm_userptr_notifier_u
+ xe_svm_notifier_unlock(vm);
+ #endif
+ }
++#else
++static inline void xe_pt_svm_userptr_notifier_lock(struct xe_vm *vm) { }
++static inline void xe_pt_svm_userptr_notifier_unlock(struct xe_vm *vm) { }
++#endif
+
+ #if IS_ENABLED(CONFIG_DRM_GPUSVM)
+ #ifdef CONFIG_DRM_XE_USERPTR_INVAL_INJECT
--- /dev/null
+From 8d187d4b33c262c0f3e44842553521151d8629e8 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Tue, 7 Jul 2026 17:29:35 +0100
+Subject: KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 8d187d4b33c262c0f3e44842553521151d8629e8 upstream.
+
+Assigning the invalidation level (an s8 value) with TLBI_TTL_UNKNOWN
+(a 32bit signed value) is not ideal, to say the least. Instead of
+this, only pass TLBI_TTL_UNKNOWN to __kvm_tlb_flush_vmid_ipa_nsh()
+when we know for sure that we don't have a provided level.
+
+Fixes: 100baf0184896 ("KVM: arm64: Ensure level is always initialized when relaxing perms")
+Reported-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Oliver Upton <oupton@kernel.org>
+Link: https://lore.kernel.org/r/akztC7H2IsEKaq4i@sirena.org.uk
+Link: https://patch.msgid.link/20260707162935.1900874-1-maz@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/hyp/pgtable.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kvm/hyp/pgtable.c
++++ b/arch/arm64/kvm/hyp/pgtable.c
+@@ -1358,7 +1358,7 @@ int kvm_pgtable_stage2_relax_perms(struc
+ enum kvm_pgtable_prot prot, enum kvm_pgtable_walk_flags flags)
+ {
+ kvm_pte_t xn = 0, set = 0, clr = 0;
+- s8 level = TLBI_TTL_UNKNOWN;
++ s8 level;
+ int ret;
+
+ if (prot & KVM_PTE_LEAF_ATTR_HI_SW)
+@@ -1379,7 +1379,8 @@ int kvm_pgtable_stage2_relax_perms(struc
+
+ ret = stage2_update_leaf_attrs(pgt, addr, 1, set, clr, NULL, &level, flags);
+ if (!ret || ret == -EAGAIN)
+- kvm_call_hyp(__kvm_tlb_flush_vmid_ipa_nsh, pgt->mmu, addr, level);
++ kvm_call_hyp(__kvm_tlb_flush_vmid_ipa_nsh, pgt->mmu, addr,
++ (ret == -EAGAIN) ? TLBI_TTL_UNKNOWN : level);
+ return ret;
+ }
+
--- /dev/null
+From 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 Mon Sep 17 00:00:00 2001
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+Date: Tue, 30 Jun 2026 11:09:22 -0400
+Subject: net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
+
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+
+commit 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 upstream.
+
+This is a followup based on sashiko comments [1] on commit e5b811fe7931
+("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
+
+Use plain rcu_read_lock()/spin_lock() in teql_master_xmit() instead of the
+_bh variants, since ndo_start_xmit is already invoked with BH disabled
+by the core stack and the _bh primitives can warn in_hardirq() when xmit
+is reached through netpoll or a softirq xmit path with hard IRQs disabled.
+
+Moves rcu_read_lock() after restart: label + adds rcu_read_unlock() before
+goto restart (fixes the unbounded RCU hold across retries)
+
+[1] https://sashiko.dev/#/patchset/20260628111229.669751-1-jhs%40mojatatu.com
+
+Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
+Link: https://patch.msgid.link/20260630150922.238714-1-jhs@mojatatu.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_teql.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+--- a/net/sched/sch_teql.c
++++ b/net/sched/sch_teql.c
+@@ -311,14 +311,14 @@ static netdev_tx_t teql_master_xmit(stru
+ int subq = skb_get_queue_mapping(skb);
+ struct sk_buff *skb_res = NULL;
+
+- rcu_read_lock_bh();
+-
+- start = rcu_dereference_bh(master->slaves);
+-
+ restart:
+ nores = 0;
+ busy = 0;
+
++ rcu_read_lock();
++
++ start = rcu_dereference(master->slaves);
++
+ q = start;
+ if (!q)
+ goto drop;
+@@ -345,17 +345,17 @@ restart:
+ netdev_start_xmit(skb, slave, slave_txq, false) ==
+ NETDEV_TX_OK) {
+ __netif_tx_unlock(slave_txq);
+- spin_lock_bh(&master->slaves_lock);
++ spin_lock(&master->slaves_lock);
+ if (rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock)) == q)
+ rcu_assign_pointer(master->slaves,
+ rcu_dereference_protected(NEXT_SLAVE(q),
+ lockdep_is_held(&master->slaves_lock)));
+- spin_unlock_bh(&master->slaves_lock);
++ spin_unlock(&master->slaves_lock);
+ netif_wake_queue(dev);
+ master->tx_packets++;
+ master->tx_bytes += length;
+- rcu_read_unlock_bh();
++ rcu_read_unlock();
+ return NETDEV_TX_OK;
+ }
+ __netif_tx_unlock(slave_txq);
+@@ -364,37 +364,38 @@ restart:
+ busy = 1;
+ break;
+ case 1:
+- spin_lock_bh(&master->slaves_lock);
++ spin_lock(&master->slaves_lock);
+ if (rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock)) == q)
+ rcu_assign_pointer(master->slaves,
+ rcu_dereference_protected(NEXT_SLAVE(q),
+ lockdep_is_held(&master->slaves_lock)));
+- spin_unlock_bh(&master->slaves_lock);
+- rcu_read_unlock_bh();
++ spin_unlock(&master->slaves_lock);
++ rcu_read_unlock();
+ return NETDEV_TX_OK;
+ default:
+ nores = 1;
+ break;
+ }
+ __skb_pull(skb, skb_network_offset(skb));
+- } while ((q = rcu_dereference_bh(NEXT_SLAVE(q))) != start);
++ } while ((q = rcu_dereference(NEXT_SLAVE(q))) != start);
+
+ if (nores && skb_res == NULL) {
+ skb_res = skb;
++ rcu_read_unlock();
+ goto restart;
+ }
+
+ if (busy) {
+ netif_stop_queue(dev);
+- rcu_read_unlock_bh();
++ rcu_read_unlock();
+ return NETDEV_TX_BUSY;
+ }
+ master->tx_errors++;
+
+ drop:
+ master->tx_dropped++;
+- rcu_read_unlock_bh();
++ rcu_read_unlock();
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+ }
--- /dev/null
+From 278296b69fae5dd951599692cd481bae4995215c Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Wed, 1 Jul 2026 12:46:57 +0200
+Subject: netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master on updates
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 278296b69fae5dd951599692cd481bae4995215c upstream.
+
+Really cap it to NF_CT_EXPECT_MAX_CNT (255) on updates.
+
+The commit ("netfilter: nfnetlink_cthelper: cap to maximum number of
+expectation per master") only covers creation of helpers, not updates.
+
+Fixes: 397c8300972f ("netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nfnetlink_cthelper.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -316,6 +316,8 @@ nfnl_cthelper_update_policy_one(const st
+
+ new_policy->max_expected =
+ ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
++ if (!new_policy->max_expected)
++ new_policy->max_expected = NF_CT_EXPECT_MAX_CNT;
+ if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
+ return -EINVAL;
+
--- /dev/null
+From bf5355cfdede3e30b30e63a5a74f6bdaafb26082 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 26 Jun 2026 13:40:42 +0200
+Subject: netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit bf5355cfdede3e30b30e63a5a74f6bdaafb26082 upstream.
+
+If userspace helper policy updates sets maximum number of expectation to
+zero, cap it to NF_CT_EXPECT_MAX_CNT (255) on updates too.
+
+Fixes: 397c8300972f ("netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nfnetlink_cthelper.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -163,6 +163,8 @@ nfnl_cthelper_expect_policy(struct nf_co
+ tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN);
+ expect_policy->max_expected =
+ ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
++ if (!expect_policy->max_expected)
++ expect_policy->max_expected = NF_CT_EXPECT_MAX_CNT;
+ if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
+ return -EINVAL;
+
--- /dev/null
+From a0738abd042f7406edd2175a819cf2e66388ed97 Mon Sep 17 00:00:00 2001
+From: Daniel Gibson <daniel@gibson.sh>
+Date: Sat, 27 Jun 2026 00:02:10 +0200
+Subject: platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Gibson <daniel@gibson.sh>
+
+commit a0738abd042f7406edd2175a819cf2e66388ed97 upstream.
+
+dmi_get_system_info(...) can return NULL. Using that as %s arguments
+of dev_info() would log "(null)" (as part of a message like
+'... System Vendor: "(null)", Product Name: "(null)" ...'), which may
+be confusing for users.
+
+Use Elvis operator to print "(Unknown)" instead.
+
+Fixes: 428b9fd2dce5 ("platform/x86/amd/pmc: Add delay_suspend module parameter")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202606251540.Nr2BtaNu-lkp@intel.com/
+Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Daniel Gibson <daniel@gibson.sh>
+Link: https://patch.msgid.link/20260626220210.1761783-2-daniel@gibson.sh
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -660,11 +660,11 @@ static bool amd_pmc_want_suspend_delay(s
+ } else if (delay_suspend == 1) {
+ if (!intermediate_wakeup)
+ dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
+- dmi_get_system_info(DMI_SYS_VENDOR),
+- dmi_get_system_info(DMI_PRODUCT_NAME),
+- dmi_get_system_info(DMI_PRODUCT_FAMILY),
+- dmi_get_system_info(DMI_BOARD_VENDOR),
+- dmi_get_system_info(DMI_BOARD_NAME));
++ dmi_get_system_info(DMI_SYS_VENDOR) ?: "(Unknown)",
++ dmi_get_system_info(DMI_PRODUCT_NAME) ?: "(Unknown)",
++ dmi_get_system_info(DMI_PRODUCT_FAMILY) ?: "(Unknown)",
++ dmi_get_system_info(DMI_BOARD_VENDOR) ?: "(Unknown)",
++ dmi_get_system_info(DMI_BOARD_NAME) ?: "(Unknown)");
+ return true;
+ }
+ return false;
gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch
octeontx2-af-cn10k-restrict-vf-lmtline-sharing-to-its-own-pf.patch
ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch
+netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master.patch
+platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch
+net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
+acpica-define-acpi_ut_safe_strncpy-as-strscpy_pad-alias.patch
+drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch
+netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch
+kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
