From: Sasha Levin Date: Sun, 9 Aug 2026 02:51:10 +0000 (-0400) Subject: Fixes for all trees X-Git-Tag: v6.6.151~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=311a680fc07da81d6f05222905eb24ecc4cad37c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/staging-5.10/mount-honour-sb_nouser-in-the-new-mount-api.patch b/staging-5.10/mount-honour-sb_nouser-in-the-new-mount-api.patch new file mode 100644 index 0000000000..a287a39473 --- /dev/null +++ b/staging-5.10/mount-honour-sb_nouser-in-the-new-mount-api.patch @@ -0,0 +1,42 @@ +From cd001423637cd2d227d93ba317caa0eb82172005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2026 13:38:27 +0300 +Subject: mount: honour SB_NOUSER in the new mount API + +From: Al Viro + +[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ] + +One should *not* be allowed to mount one of those, new API or not. + +Reported-by: Denis Arefev +Signed-off-by: Al Viro +Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV +Signed-off-by: Christian Brauner (Amutable) +[Denis: rename new_mnt -> newmount.mnt] +[Denis: use goto err_unlock instead of direct return] +Signed-off-by: Denis Arefev +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index e9b8d516f1919..fcb9ab4617754 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -3657,6 +3657,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, + ret = PTR_ERR(newmount.mnt); + goto err_unlock; + } ++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) { ++ mntput(newmount.mnt); ++ ret = -EINVAL; ++ goto err_unlock; ++ } + newmount.dentry = dget(fc->root); + newmount.mnt->mnt_flags = mnt_flags; + +-- +2.53.0 + diff --git a/staging-5.10/series b/staging-5.10/series new file mode 100644 index 0000000000..d51a045887 --- /dev/null +++ b/staging-5.10/series @@ -0,0 +1 @@ +mount-honour-sb_nouser-in-the-new-mount-api.patch diff --git a/staging-5.15/mount-honour-sb_nouser-in-the-new-mount-api.patch b/staging-5.15/mount-honour-sb_nouser-in-the-new-mount-api.patch new file mode 100644 index 0000000000..6d0650f727 --- /dev/null +++ b/staging-5.15/mount-honour-sb_nouser-in-the-new-mount-api.patch @@ -0,0 +1,42 @@ +From 76843dde657d29ba78b01afd0d982f3a5fc4a74b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2026 13:38:27 +0300 +Subject: mount: honour SB_NOUSER in the new mount API + +From: Al Viro + +[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ] + +One should *not* be allowed to mount one of those, new API or not. + +Reported-by: Denis Arefev +Signed-off-by: Al Viro +Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV +Signed-off-by: Christian Brauner (Amutable) +[Denis: rename new_mnt -> newmount.mnt] +[Denis: use goto err_unlock instead of direct return] +Signed-off-by: Denis Arefev +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index ae1b8530eb939..2c502d554f619 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -3700,6 +3700,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, + ret = PTR_ERR(newmount.mnt); + goto err_unlock; + } ++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) { ++ mntput(newmount.mnt); ++ ret = -EINVAL; ++ goto err_unlock; ++ } + newmount.dentry = dget(fc->root); + newmount.mnt->mnt_flags = mnt_flags; + +-- +2.53.0 + diff --git a/staging-5.15/series b/staging-5.15/series new file mode 100644 index 0000000000..d51a045887 --- /dev/null +++ b/staging-5.15/series @@ -0,0 +1 @@ +mount-honour-sb_nouser-in-the-new-mount-api.patch diff --git a/staging-6.1/mount-honour-sb_nouser-in-the-new-mount-api.patch b/staging-6.1/mount-honour-sb_nouser-in-the-new-mount-api.patch new file mode 100644 index 0000000000..4273573845 --- /dev/null +++ b/staging-6.1/mount-honour-sb_nouser-in-the-new-mount-api.patch @@ -0,0 +1,42 @@ +From 457b874bd86a38c389a283e1fd30ea69389fbf1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2026 13:38:27 +0300 +Subject: mount: honour SB_NOUSER in the new mount API + +From: Al Viro + +[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ] + +One should *not* be allowed to mount one of those, new API or not. + +Reported-by: Denis Arefev +Signed-off-by: Al Viro +Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV +Signed-off-by: Christian Brauner (Amutable) +[Denis: rename new_mnt -> newmount.mnt] +[Denis: use goto err_unlock instead of direct return] +Signed-off-by: Denis Arefev +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index f22f76d9c22f9..ed5e9e7251e34 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -3744,6 +3744,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, + ret = PTR_ERR(newmount.mnt); + goto err_unlock; + } ++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) { ++ mntput(newmount.mnt); ++ ret = -EINVAL; ++ goto err_unlock; ++ } + newmount.dentry = dget(fc->root); + newmount.mnt->mnt_flags = mnt_flags; + +-- +2.53.0 + diff --git a/staging-6.1/series b/staging-6.1/series new file mode 100644 index 0000000000..d51a045887 --- /dev/null +++ b/staging-6.1/series @@ -0,0 +1 @@ +mount-honour-sb_nouser-in-the-new-mount-api.patch diff --git a/staging-6.12/mount-honour-sb_nouser-in-the-new-mount-api.patch b/staging-6.12/mount-honour-sb_nouser-in-the-new-mount-api.patch new file mode 100644 index 0000000000..3ac9b6b6c0 --- /dev/null +++ b/staging-6.12/mount-honour-sb_nouser-in-the-new-mount-api.patch @@ -0,0 +1,42 @@ +From 7c999d589feb5d12b33331c2fe620699645b0c4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2026 13:38:27 +0300 +Subject: mount: honour SB_NOUSER in the new mount API + +From: Al Viro + +[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ] + +One should *not* be allowed to mount one of those, new API or not. + +Reported-by: Denis Arefev +Signed-off-by: Al Viro +Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV +Signed-off-by: Christian Brauner (Amutable) +[Denis: rename new_mnt -> newmount.mnt] +[Denis: use goto err_unlock instead of direct return] +Signed-off-by: Denis Arefev +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index 94c06c8429023..a596381dba1c4 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -4229,6 +4229,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, + ret = PTR_ERR(newmount.mnt); + goto err_unlock; + } ++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) { ++ mntput(newmount.mnt); ++ ret = -EINVAL; ++ goto err_unlock; ++ } + newmount.dentry = dget(fc->root); + newmount.mnt->mnt_flags = mnt_flags; + +-- +2.53.0 + diff --git a/staging-6.12/series b/staging-6.12/series new file mode 100644 index 0000000000..d51a045887 --- /dev/null +++ b/staging-6.12/series @@ -0,0 +1 @@ +mount-honour-sb_nouser-in-the-new-mount-api.patch diff --git a/staging-6.18/kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch b/staging-6.18/kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch new file mode 100644 index 0000000000..cf5b414931 --- /dev/null +++ b/staging-6.18/kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch @@ -0,0 +1,80 @@ +From 7486fdbe2f4bed9ad33aea4483e7fe620c121ee6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2026 12:22:18 -0700 +Subject: KVM: s390: pci: Fix resource leak on IRQ registration failure + +From: Farhan Ali + +[ Upstream commit 5580c9858f1e00f60191eb09c3add359836d60b6 ] + +Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns +the error code but doesn't do any resource cleanup thus leaking resources. +Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and +unpinning any pinned pages. While at it, remove dead code that stored FIB +values that were never referenced. + +As part of the cleanup, we are also holding the aift_lock a bit longer, as +we hold the lock while executing the MPCIFC instruction. Though this is not +strictly necessary, it means we don't have to drop and re-acquire in the +error case. + +Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") +Cc: stable@vger.kernel.org +Reviewed-by: Matthew Rosato +Reviewed-by: Christian Borntraeger +Signed-off-by: Farhan Ali +Tested-by: Matthew Rosato +Signed-off-by: Christian Borntraeger +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/pci.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/arch/s390/kvm/pci.c b/arch/s390/kvm/pci.c +index 4cc554c9d3283..b729457d30167 100644 +--- a/arch/s390/kvm/pci.c ++++ b/arch/s390/kvm/pci.c +@@ -359,19 +359,32 @@ static int kvm_s390_pci_aif_enable(struct zpci_dev *zdev, struct zpci_fib *fib, + aift->kzdev[zdev->aisb] = zdev->kzdev; + spin_unlock_irq(&aift->gait_lock); + +- /* Update guest FIB for re-issue */ +- fib->fmt0.aisbo = zdev->aisb & 63; +- fib->fmt0.aisb = virt_to_phys(aift->sbv->vector + (zdev->aisb / 64) * 8); +- fib->fmt0.isc = gisc; +- + /* Save some guest fib values in the host for later use */ +- zdev->kzdev->fib.fmt0.isc = fib->fmt0.isc; ++ zdev->kzdev->fib.fmt0.isc = gisc; + zdev->kzdev->fib.fmt0.aibv = fib->fmt0.aibv; +- mutex_unlock(&aift->aift_lock); + + /* Issue the clp to setup the irq now */ + rc = kvm_zpci_set_airq(zdev); +- return rc; ++ if (!rc) { ++ mutex_unlock(&aift->aift_lock); ++ return rc; ++ } ++ ++ /* Start cleanup */ ++ zdev->kzdev->fib.fmt0.isc = 0; ++ zdev->kzdev->fib.fmt0.aibv = 0; ++ ++ spin_lock_irq(&aift->gait_lock); ++ gaite->count--; ++ gaite->aisb = 0; ++ gaite->gisc = 0; ++ gaite->aisbo = 0; ++ gaite->gisa = 0; ++ aift->kzdev[zdev->aisb] = NULL; ++ spin_unlock_irq(&aift->gait_lock); ++ ++ airq_iv_release(zdev->aibv); ++ zdev->aibv = NULL; + + free_aisb: + airq_iv_free_bit(aift->sbv, zdev->aisb); +-- +2.53.0 + diff --git a/staging-6.18/mount-honour-sb_nouser-in-the-new-mount-api.patch b/staging-6.18/mount-honour-sb_nouser-in-the-new-mount-api.patch new file mode 100644 index 0000000000..4e058b1dd8 --- /dev/null +++ b/staging-6.18/mount-honour-sb_nouser-in-the-new-mount-api.patch @@ -0,0 +1,42 @@ +From 742060c87b6278128efd3f94926fecabcea23b6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2026 13:38:27 +0300 +Subject: mount: honour SB_NOUSER in the new mount API + +From: Al Viro + +[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ] + +One should *not* be allowed to mount one of those, new API or not. + +Reported-by: Denis Arefev +Signed-off-by: Al Viro +Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV +Signed-off-by: Christian Brauner (Amutable) +[Denis: rename new_mnt -> newmount.mnt] +[Denis: use goto err_unlock instead of direct return] +Signed-off-by: Denis Arefev +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index 5fd8b021785a4..d886ae255e40a 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -4352,6 +4352,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, + ret = PTR_ERR(newmount.mnt); + goto err_unlock; + } ++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) { ++ mntput(newmount.mnt); ++ ret = -EINVAL; ++ goto err_unlock; ++ } + newmount.dentry = dget(fc->root); + newmount.mnt->mnt_flags = mnt_flags; + +-- +2.53.0 + diff --git a/staging-6.18/series b/staging-6.18/series new file mode 100644 index 0000000000..b231884439 --- /dev/null +++ b/staging-6.18/series @@ -0,0 +1,2 @@ +kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch +mount-honour-sb_nouser-in-the-new-mount-api.patch diff --git a/staging-6.6/mount-honour-sb_nouser-in-the-new-mount-api.patch b/staging-6.6/mount-honour-sb_nouser-in-the-new-mount-api.patch new file mode 100644 index 0000000000..217bfaf552 --- /dev/null +++ b/staging-6.6/mount-honour-sb_nouser-in-the-new-mount-api.patch @@ -0,0 +1,42 @@ +From 705e43b73bf638051584ee90764480401a254162 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2026 13:38:27 +0300 +Subject: mount: honour SB_NOUSER in the new mount API + +From: Al Viro + +[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ] + +One should *not* be allowed to mount one of those, new API or not. + +Reported-by: Denis Arefev +Signed-off-by: Al Viro +Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV +Signed-off-by: Christian Brauner (Amutable) +[Denis: rename new_mnt -> newmount.mnt] +[Denis: use goto err_unlock instead of direct return] +Signed-off-by: Denis Arefev +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index 646d9e7d41ee8..f185de5f5df4a 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -4050,6 +4050,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, + ret = PTR_ERR(newmount.mnt); + goto err_unlock; + } ++ if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) { ++ mntput(newmount.mnt); ++ ret = -EINVAL; ++ goto err_unlock; ++ } + newmount.dentry = dget(fc->root); + newmount.mnt->mnt_flags = mnt_flags; + +-- +2.53.0 + diff --git a/staging-6.6/series b/staging-6.6/series new file mode 100644 index 0000000000..d51a045887 --- /dev/null +++ b/staging-6.6/series @@ -0,0 +1 @@ +mount-honour-sb_nouser-in-the-new-mount-api.patch diff --git a/staging-7.1/mount-honour-sb_nouser-in-the-new-mount-api.patch b/staging-7.1/mount-honour-sb_nouser-in-the-new-mount-api.patch new file mode 100644 index 0000000000..afb4c8416a --- /dev/null +++ b/staging-7.1/mount-honour-sb_nouser-in-the-new-mount-api.patch @@ -0,0 +1,38 @@ +From 867a4cb6b92b5e4a5e7d05c6f019d1ef92320391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jun 2026 03:04:44 +0100 +Subject: mount: honour SB_NOUSER in the new mount API + +From: Al Viro + +[ Upstream commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf ] + +One should *not* be allowed to mount one of those, new API or not. + +Reported-by: Denis Arefev +Signed-off-by: Al Viro +Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index 341ddd353b3a8..841ef26127861 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -4502,6 +4502,10 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, + new_mnt = vfs_create_mount(fc); + if (IS_ERR(new_mnt)) + return PTR_ERR(new_mnt); ++ if (new_mnt->mnt_sb->s_flags & SB_NOUSER) { ++ mntput(new_mnt); ++ return -EINVAL; ++ } + new_mnt->mnt_flags = mnt_flags; + + new_path.dentry = dget(fc->root); +-- +2.53.0 + diff --git a/staging-7.1/series b/staging-7.1/series new file mode 100644 index 0000000000..d51a045887 --- /dev/null +++ b/staging-7.1/series @@ -0,0 +1 @@ +mount-honour-sb_nouser-in-the-new-mount-api.patch