From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:29:54 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.10.260~21 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3320172efd239f3b77c6a661b8f4bc179afd5ddf;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: crypto-qat-remove-unused-character-device-and-ioctls.patch crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch documentation-ioctl-number-extend-include-file-column-width.patch drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch fuse-re-lock-request-before-replacing-page-cache-folio.patch futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch hv-utils-handle-and-propagate-errors-in-kvp_register.patch ipv6-account-for-fraggap-on-the-paged-allocation-path.patch locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch mptcp-fix-missing-wakeups-in-edge-scenarios.patch mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch net-phonet-free-phonet_device-after-rcu-grace-period.patch phonet-pass-ifindex-to-fill_addr.patch phonet-pass-net-and-ifindex-to-phonet_address_notify.patch serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch --- diff --git a/queue-6.1/crypto-qat-remove-unused-character-device-and-ioctls.patch b/queue-6.1/crypto-qat-remove-unused-character-device-and-ioctls.patch new file mode 100644 index 0000000000..a003fb9529 --- /dev/null +++ b/queue-6.1/crypto-qat-remove-unused-character-device-and-ioctls.patch @@ -0,0 +1,707 @@ +From stable+bounces-268641-greg=kroah.com@vger.kernel.org Thu Jun 25 19:56:16 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 13:56:04 -0400 +Subject: crypto: qat - remove unused character device and IOCTLs +To: stable@vger.kernel.org +Cc: Giovanni Cabiddu , Zhi Wang , Bin Yu , MingYu Wang , Ahsan Atta , Herbert Xu , Sasha Levin +Message-ID: <20260625175604.2543972-4-sashal@kernel.org> + +From: Giovanni Cabiddu + +[ Upstream commit d237230728c567297f2f98b425d63156ab2ed17f ] + +The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs +for device configuration, start, stop, status query and enumeration. +These IOCTLs are not part of any public uAPI header and have no known +in-tree or out-of-tree users. Device lifecycle is already managed via +sysfs. + +The ioctl interface also increases the attack surface and is the +subject of a number of bug reports. + +Remove the character device, the IOCTL definitions, and the related +data structures (adf_dev_status_info, adf_user_cfg_key_val, +adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused +adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal +module_init/module_exit hooks for workqueue, AER, and crypto/compression +algorithm registration. + +Clean up leftover dead code that was only reachable from the removed +IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), +adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), +adf_get_vf_real_id() and the unused ADF_CFG macros. + +Additionally, drop the entry associated to QAT IOCTLs in +ioctl-number.rst. + +Cc: stable@vger.kernel.org +Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") +Reported-by: Zhi Wang +Reported-by: Bin Yu +Reported-by: MingYu Wang +Closes: https://lore.kernel.org/all/61d6d499.ab89.19b9b7f3186.Coremail.wangzhi_xd@stu.xidian.edu.cn/ +Link: https://lore.kernel.org/all/20260508034841.256794-1-w15303746062@163.com/ +Link: https://lore.kernel.org/all/20260508023542.256299-1-w15303746062@163.com/ +Link: https://lore.kernel.org/all/20260504025120.98242-1-w15303746062@163.com/ +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Ahsan Atta +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/userspace-api/ioctl/ioctl-number.rst | 1 + drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 - + drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 - + drivers/crypto/qat/qat_common/adf_common_drv.h | 3 + drivers/crypto/qat/qat_common/adf_ctl_drv.c | 413 --------------------- + drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 --- + 6 files changed, 3 insertions(+), 554 deletions(-) + delete mode 100644 drivers/crypto/qat/qat_common/adf_cfg_user.h + +--- a/Documentation/userspace-api/ioctl/ioctl-number.rst ++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst +@@ -218,7 +218,6 @@ Code Seq# Include File + + 'a' all linux/atm*.h, linux/sonet.h ATM on linux + +-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver + 'b' 00-FF conflict! bit3 vme host bridge + + 'c' all linux/cm4000_cs.h conflict! +--- a/drivers/crypto/qat/qat_common/adf_cfg_common.h ++++ b/drivers/crypto/qat/qat_common/adf_cfg_common.h +@@ -4,18 +4,11 @@ + #define ADF_CFG_COMMON_H_ + + #include +-#include + + #define ADF_CFG_MAX_STR_LEN 64 + #define ADF_CFG_MAX_KEY_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN + #define ADF_CFG_MAX_VAL_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN + #define ADF_CFG_MAX_SECTION_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN +-#define ADF_CFG_BASE_DEC 10 +-#define ADF_CFG_BASE_HEX 16 +-#define ADF_CFG_ALL_DEVICES 0xFE +-#define ADF_CFG_NO_DEVICE 0xFF +-#define ADF_CFG_AFFINITY_WHATEVER 0xFF +-#define MAX_DEVICE_NAME_SIZE 32 + #define ADF_MAX_DEVICES (32 * 32) + #define ADF_DEVS_ARRAY_SIZE BITS_TO_LONGS(ADF_MAX_DEVICES) + +@@ -48,29 +41,4 @@ enum adf_device_type { + DEV_C3XXXVF, + DEV_4XXX, + }; +- +-struct adf_dev_status_info { +- enum adf_device_type type; +- __u32 accel_id; +- __u32 instance_id; +- __u8 num_ae; +- __u8 num_accel; +- __u8 num_logical_accel; +- __u8 banks_per_accel; +- __u8 state; +- __u8 bus; +- __u8 dev; +- __u8 fun; +- char name[MAX_DEVICE_NAME_SIZE]; +-}; +- +-#define ADF_CTL_IOC_MAGIC 'a' +-#define IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS _IOW(ADF_CTL_IOC_MAGIC, 0, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_STOP_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 1, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_START_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 2, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_STATUS_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 3, __u32) +-#define IOCTL_GET_NUM_DEVICES _IOW(ADF_CTL_IOC_MAGIC, 4, __s32) + #endif +--- a/drivers/crypto/qat/qat_common/adf_cfg_user.h ++++ /dev/null +@@ -1,38 +0,0 @@ +-/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) */ +-/* Copyright(c) 2014 - 2020 Intel Corporation */ +-#ifndef ADF_CFG_USER_H_ +-#define ADF_CFG_USER_H_ +- +-#include "adf_cfg_common.h" +-#include "adf_cfg_strings.h" +- +-struct adf_user_cfg_key_val { +- char key[ADF_CFG_MAX_KEY_LEN_IN_BYTES]; +- char val[ADF_CFG_MAX_VAL_LEN_IN_BYTES]; +- union { +- struct adf_user_cfg_key_val *next; +- __u64 padding3; +- }; +- enum adf_cfg_val_type type; +-} __packed; +- +-struct adf_user_cfg_section { +- char name[ADF_CFG_MAX_SECTION_LEN_IN_BYTES]; +- union { +- struct adf_user_cfg_key_val *params; +- __u64 padding1; +- }; +- union { +- struct adf_user_cfg_section *next; +- __u64 padding3; +- }; +-} __packed; +- +-struct adf_user_cfg_ctl_data { +- union { +- struct adf_user_cfg_section *config_section; +- __u64 padding; +- }; +- __u8 device_id; +-} __packed; +-#endif +--- a/drivers/crypto/qat/qat_common/adf_common_drv.h ++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h +@@ -75,11 +75,8 @@ int adf_devmgr_add_dev(struct adf_accel_ + void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev, + struct adf_accel_dev *pf); + struct list_head *adf_devmgr_get_head(void); +-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id); + struct adf_accel_dev *adf_devmgr_get_first(void); + struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev); +-int adf_devmgr_verify_id(u32 id); +-void adf_devmgr_get_num_dev(u32 *num); + int adf_devmgr_in_reset(struct adf_accel_dev *accel_dev); + int adf_dev_started(struct adf_accel_dev *accel_dev); + int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev); +--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c +@@ -1,416 +1,14 @@ + // SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) + /* Copyright(c) 2014 - 2020 Intel Corporation */ ++ ++#include ++#include + #include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include + +-#include "adf_accel_devices.h" + #include "adf_common_drv.h" +-#include "adf_cfg.h" +-#include "adf_cfg_common.h" +-#include "adf_cfg_user.h" +- +-#define ADF_CFG_MAX_SECTION 512 +-#define ADF_CFG_MAX_KEY_VAL 256 +- +-#define DEVICE_NAME "qat_adf_ctl" +- +-static DEFINE_MUTEX(adf_ctl_lock); +-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg); +- +-static const struct file_operations adf_ctl_ops = { +- .owner = THIS_MODULE, +- .unlocked_ioctl = adf_ctl_ioctl, +- .compat_ioctl = compat_ptr_ioctl, +-}; +- +-struct adf_ctl_drv_info { +- unsigned int major; +- struct cdev drv_cdev; +- struct class *drv_class; +-}; +- +-static struct adf_ctl_drv_info adf_ctl_drv; +- +-static void adf_chr_drv_destroy(void) +-{ +- device_destroy(adf_ctl_drv.drv_class, MKDEV(adf_ctl_drv.major, 0)); +- cdev_del(&adf_ctl_drv.drv_cdev); +- class_destroy(adf_ctl_drv.drv_class); +- unregister_chrdev_region(MKDEV(adf_ctl_drv.major, 0), 1); +-} +- +-static int adf_chr_drv_create(void) +-{ +- dev_t dev_id; +- struct device *drv_device; +- +- if (alloc_chrdev_region(&dev_id, 0, 1, DEVICE_NAME)) { +- pr_err("QAT: unable to allocate chrdev region\n"); +- return -EFAULT; +- } +- +- adf_ctl_drv.drv_class = class_create(THIS_MODULE, DEVICE_NAME); +- if (IS_ERR(adf_ctl_drv.drv_class)) { +- pr_err("QAT: class_create failed for adf_ctl\n"); +- goto err_chrdev_unreg; +- } +- adf_ctl_drv.major = MAJOR(dev_id); +- cdev_init(&adf_ctl_drv.drv_cdev, &adf_ctl_ops); +- if (cdev_add(&adf_ctl_drv.drv_cdev, dev_id, 1)) { +- pr_err("QAT: cdev add failed\n"); +- goto err_class_destr; +- } +- +- drv_device = device_create(adf_ctl_drv.drv_class, NULL, +- MKDEV(adf_ctl_drv.major, 0), +- NULL, DEVICE_NAME); +- if (IS_ERR(drv_device)) { +- pr_err("QAT: failed to create device\n"); +- goto err_cdev_del; +- } +- return 0; +-err_cdev_del: +- cdev_del(&adf_ctl_drv.drv_cdev); +-err_class_destr: +- class_destroy(adf_ctl_drv.drv_class); +-err_chrdev_unreg: +- unregister_chrdev_region(dev_id, 1); +- return -EFAULT; +-} +- +-static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg) +-{ +- struct adf_user_cfg_ctl_data *cfg_data; +- +- cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); +- if (IS_ERR(cfg_data)) +- pr_err("QAT: failed to copy from user cfg_data.\n"); +- return cfg_data; +-} +- +-static int adf_add_key_value_data(struct adf_accel_dev *accel_dev, +- const char *section, +- const struct adf_user_cfg_key_val *key_val) +-{ +- if (key_val->type == ADF_HEX) { +- long *ptr = (long *)key_val->val; +- long val = *ptr; +- +- if (adf_cfg_add_key_value_param(accel_dev, section, +- key_val->key, (void *)val, +- key_val->type)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add hex keyvalue.\n"); +- return -EFAULT; +- } +- } else { +- if (adf_cfg_add_key_value_param(accel_dev, section, +- key_val->key, key_val->val, +- key_val->type)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add keyvalue.\n"); +- return -EFAULT; +- } +- } +- return 0; +-} +- +-static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev, +- struct adf_user_cfg_ctl_data *ctl_data) +-{ +- struct adf_user_cfg_key_val key_val; +- struct adf_user_cfg_key_val *params_head; +- struct adf_user_cfg_section section, *section_head; +- int i, j; +- +- section_head = ctl_data->config_section; +- +- for (i = 0; section_head && i < ADF_CFG_MAX_SECTION; i++) { +- if (copy_from_user(§ion, (void __user *)section_head, +- sizeof(*section_head))) { +- dev_err(&GET_DEV(accel_dev), +- "failed to copy section info\n"); +- goto out_err; +- } +- +- if (adf_cfg_section_add(accel_dev, section.name)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add section.\n"); +- goto out_err; +- } +- +- params_head = section.params; +- +- for (j = 0; params_head && j < ADF_CFG_MAX_KEY_VAL; j++) { +- if (copy_from_user(&key_val, (void __user *)params_head, +- sizeof(key_val))) { +- dev_err(&GET_DEV(accel_dev), +- "Failed to copy keyvalue.\n"); +- goto out_err; +- } +- if (adf_add_key_value_data(accel_dev, section.name, +- &key_val)) { +- goto out_err; +- } +- params_head = key_val.next; +- } +- section_head = section.next; +- } +- return 0; +-out_err: +- adf_cfg_del_all(accel_dev); +- return -EFAULT; +-} +- +-static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- struct adf_user_cfg_ctl_data *ctl_data; +- struct adf_accel_dev *accel_dev; +- int ret = 0; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); +- if (!accel_dev) { +- ret = -EFAULT; +- goto out; +- } +- +- if (adf_dev_started(accel_dev)) { +- ret = -EFAULT; +- goto out; +- } +- +- if (adf_copy_key_value_data(accel_dev, ctl_data)) { +- ret = -EFAULT; +- goto out; +- } +- set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status); +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_is_device_in_use(int id) +-{ +- struct adf_accel_dev *dev; +- +- list_for_each_entry(dev, adf_devmgr_get_head(), list) { +- if (id == dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (adf_devmgr_in_reset(dev) || adf_dev_in_use(dev)) { +- dev_info(&GET_DEV(dev), +- "device qat_dev%d is busy\n", +- dev->accel_id); +- return -EBUSY; +- } +- } +- } +- return 0; +-} +- +-static void adf_ctl_stop_devices(u32 id) +-{ +- struct adf_accel_dev *accel_dev; +- +- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { +- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (!adf_dev_started(accel_dev)) +- continue; +- +- /* First stop all VFs */ +- if (!accel_dev->is_vf) +- continue; +- +- adf_dev_stop(accel_dev); +- adf_dev_shutdown(accel_dev); +- } +- } +- +- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { +- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (!adf_dev_started(accel_dev)) +- continue; +- +- adf_dev_stop(accel_dev); +- adf_dev_shutdown(accel_dev); +- } +- } +-} +- +-static int adf_ctl_ioctl_dev_stop(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- int ret; +- struct adf_user_cfg_ctl_data *ctl_data; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- if (adf_devmgr_verify_id(ctl_data->device_id)) { +- pr_err("QAT: Device %d not found\n", ctl_data->device_id); +- ret = -ENODEV; +- goto out; +- } +- +- ret = adf_ctl_is_device_in_use(ctl_data->device_id); +- if (ret) +- goto out; +- +- if (ctl_data->device_id == ADF_CFG_ALL_DEVICES) +- pr_info("QAT: Stopping all acceleration devices.\n"); +- else +- pr_info("QAT: Stopping acceleration device qat_dev%d.\n", +- ctl_data->device_id); +- +- adf_ctl_stop_devices(ctl_data->device_id); +- +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_ioctl_dev_start(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- int ret; +- struct adf_user_cfg_ctl_data *ctl_data; +- struct adf_accel_dev *accel_dev; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- ret = -ENODEV; +- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); +- if (!accel_dev) +- goto out; +- +- if (!adf_dev_started(accel_dev)) { +- dev_info(&GET_DEV(accel_dev), +- "Starting acceleration device qat_dev%d.\n", +- ctl_data->device_id); +- ret = adf_dev_init(accel_dev); +- if (!ret) +- ret = adf_dev_start(accel_dev); +- } else { +- dev_info(&GET_DEV(accel_dev), +- "Acceleration device qat_dev%d already started.\n", +- ctl_data->device_id); +- } +- if (ret) { +- dev_err(&GET_DEV(accel_dev), "Failed to start qat_dev%d\n", +- ctl_data->device_id); +- adf_dev_stop(accel_dev); +- adf_dev_shutdown(accel_dev); +- } +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_ioctl_get_num_devices(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- u32 num_devices = 0; +- +- adf_devmgr_get_num_dev(&num_devices); +- if (copy_to_user((void __user *)arg, &num_devices, sizeof(num_devices))) +- return -EFAULT; +- +- return 0; +-} +- +-static int adf_ctl_ioctl_get_status(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- struct adf_hw_device_data *hw_data; +- struct adf_dev_status_info dev_info; +- struct adf_accel_dev *accel_dev; +- +- if (copy_from_user(&dev_info, (void __user *)arg, +- sizeof(struct adf_dev_status_info))) { +- pr_err("QAT: failed to copy from user.\n"); +- return -EFAULT; +- } +- +- accel_dev = adf_devmgr_get_dev_by_id(dev_info.accel_id); +- if (!accel_dev) +- return -ENODEV; +- +- hw_data = accel_dev->hw_device; +- dev_info.state = adf_dev_started(accel_dev) ? DEV_UP : DEV_DOWN; +- dev_info.num_ae = hw_data->get_num_aes(hw_data); +- dev_info.num_accel = hw_data->get_num_accels(hw_data); +- dev_info.num_logical_accel = hw_data->num_logical_accel; +- dev_info.banks_per_accel = hw_data->num_banks +- / hw_data->num_logical_accel; +- strscpy(dev_info.name, hw_data->dev_class->name, sizeof(dev_info.name)); +- dev_info.instance_id = hw_data->instance_id; +- dev_info.type = hw_data->dev_class->type; +- dev_info.bus = accel_to_pci_dev(accel_dev)->bus->number; +- dev_info.dev = PCI_SLOT(accel_to_pci_dev(accel_dev)->devfn); +- dev_info.fun = PCI_FUNC(accel_to_pci_dev(accel_dev)->devfn); +- +- if (copy_to_user((void __user *)arg, &dev_info, +- sizeof(struct adf_dev_status_info))) { +- dev_err(&GET_DEV(accel_dev), "failed to copy status.\n"); +- return -EFAULT; +- } +- return 0; +-} +- +-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) +-{ +- int ret; +- +- if (mutex_lock_interruptible(&adf_ctl_lock)) +- return -EFAULT; +- +- switch (cmd) { +- case IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS: +- ret = adf_ctl_ioctl_dev_config(fp, cmd, arg); +- break; +- +- case IOCTL_STOP_ACCEL_DEV: +- ret = adf_ctl_ioctl_dev_stop(fp, cmd, arg); +- break; +- +- case IOCTL_START_ACCEL_DEV: +- ret = adf_ctl_ioctl_dev_start(fp, cmd, arg); +- break; +- +- case IOCTL_GET_NUM_DEVICES: +- ret = adf_ctl_ioctl_get_num_devices(fp, cmd, arg); +- break; +- +- case IOCTL_STATUS_ACCEL_DEV: +- ret = adf_ctl_ioctl_get_status(fp, cmd, arg); +- break; +- default: +- pr_err_ratelimited("QAT: Invalid ioctl %d\n", cmd); +- ret = -EFAULT; +- break; +- } +- mutex_unlock(&adf_ctl_lock); +- return ret; +-} + + static int __init adf_register_ctl_device_driver(void) + { +- if (adf_chr_drv_create()) +- goto err_chr_dev; +- + if (adf_init_misc_wq()) + goto err_misc_wq; + +@@ -437,22 +35,17 @@ err_pf_wq: + err_aer: + adf_exit_misc_wq(); + err_misc_wq: +- adf_chr_drv_destroy(); +-err_chr_dev: +- mutex_destroy(&adf_ctl_lock); + return -EFAULT; + } + + static void __exit adf_unregister_ctl_device_driver(void) + { +- adf_chr_drv_destroy(); + adf_exit_misc_wq(); + adf_exit_aer(); + adf_exit_vf_wq(); + adf_exit_pf_wq(); + qat_crypto_unregister(); + adf_clean_vf_map(false); +- mutex_destroy(&adf_ctl_lock); + } + + module_init(adf_register_ctl_device_driver); +--- a/drivers/crypto/qat/qat_common/adf_dev_mgr.c ++++ b/drivers/crypto/qat/qat_common/adf_dev_mgr.c +@@ -45,19 +45,6 @@ static struct vf_id_map *adf_find_vf(u32 + return NULL; + } + +-static int adf_get_vf_real_id(u32 fake) +-{ +- struct list_head *itr; +- +- list_for_each(itr, &vfs_table) { +- struct vf_id_map *ptr = +- list_entry(itr, struct vf_id_map, list); +- if (ptr->fake_id == fake) +- return ptr->id; +- } +- return -1; +-} +- + /** + * adf_clean_vf_map() - Cleans VF id mapings + * +@@ -314,63 +301,6 @@ struct adf_accel_dev *adf_devmgr_pci_to_ + } + EXPORT_SYMBOL_GPL(adf_devmgr_pci_to_accel_dev); + +-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id) +-{ +- struct list_head *itr; +- int real_id; +- +- mutex_lock(&table_lock); +- real_id = adf_get_vf_real_id(id); +- if (real_id < 0) +- goto unlock; +- +- id = real_id; +- +- list_for_each(itr, &accel_table) { +- struct adf_accel_dev *ptr = +- list_entry(itr, struct adf_accel_dev, list); +- if (ptr->accel_id == id) { +- mutex_unlock(&table_lock); +- return ptr; +- } +- } +-unlock: +- mutex_unlock(&table_lock); +- return NULL; +-} +- +-int adf_devmgr_verify_id(u32 id) +-{ +- if (id == ADF_CFG_ALL_DEVICES) +- return 0; +- +- if (adf_devmgr_get_dev_by_id(id)) +- return 0; +- +- return -ENODEV; +-} +- +-static int adf_get_num_dettached_vfs(void) +-{ +- struct list_head *itr; +- int vfs = 0; +- +- mutex_lock(&table_lock); +- list_for_each(itr, &vfs_table) { +- struct vf_id_map *ptr = +- list_entry(itr, struct vf_id_map, list); +- if (ptr->bdf != ~0 && !ptr->attached) +- vfs++; +- } +- mutex_unlock(&table_lock); +- return vfs; +-} +- +-void adf_devmgr_get_num_dev(u32 *num) +-{ +- *num = num_devices - adf_get_num_dettached_vfs(); +-} +- + /** + * adf_dev_in_use() - Check whether accel_dev is currently in use + * @accel_dev: Pointer to acceleration device. diff --git a/queue-6.1/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch b/queue-6.1/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch new file mode 100644 index 0000000000..02907fc608 --- /dev/null +++ b/queue-6.1/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch @@ -0,0 +1,54 @@ +From stable+bounces-268638-greg=kroah.com@vger.kernel.org Thu Jun 25 19:59:02 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 13:56:02 -0400 +Subject: crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() +To: stable@vger.kernel.org +Cc: Thorsten Blum , Herbert Xu , Sasha Levin +Message-ID: <20260625175604.2543972-2-sashal@kernel.org> + +From: Thorsten Blum + +[ Upstream commit 1e26339703e2afd397037defa798682b2b93dcc0 ] + +Replace kzalloc() followed by copy_from_user() with memdup_user() to +improve and simplify adf_ctl_alloc_resources(). memdup_user() returns +either -ENOMEM or -EFAULT (instead of -EIO) if an error occurs. + +Remove the unnecessary device id initialization, since memdup_user() +(like copy_from_user()) immediately overwrites it. + +No functional changes intended other than returning the more idiomatic +error code -EFAULT. + +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/qat/qat_common/adf_ctl_drv.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c +@@ -90,17 +90,10 @@ static int adf_ctl_alloc_resources(struc + { + struct adf_user_cfg_ctl_data *cfg_data; + +- cfg_data = kzalloc(sizeof(*cfg_data), GFP_KERNEL); +- if (!cfg_data) +- return -ENOMEM; +- +- /* Initialize device id to NO DEVICE as 0 is a valid device id */ +- cfg_data->device_id = ADF_CFG_NO_DEVICE; +- +- if (copy_from_user(cfg_data, (void __user *)arg, sizeof(*cfg_data))) { ++ cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); ++ if (IS_ERR(cfg_data)) { + pr_err("QAT: failed to copy from user cfg_data.\n"); +- kfree(cfg_data); +- return -EIO; ++ return PTR_ERR(cfg_data); + } + + *ctl_data = cfg_data; diff --git a/queue-6.1/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch b/queue-6.1/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch new file mode 100644 index 0000000000..570240d45b --- /dev/null +++ b/queue-6.1/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch @@ -0,0 +1,123 @@ +From stable+bounces-268639-greg=kroah.com@vger.kernel.org Thu Jun 25 19:59:06 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 13:56:03 -0400 +Subject: crypto: qat - Return pointer directly in adf_ctl_alloc_resources +To: stable@vger.kernel.org +Cc: Herbert Xu , Thorsten Blum , Giovanni Cabiddu , Sasha Levin +Message-ID: <20260625175604.2543972-3-sashal@kernel.org> + +From: Herbert Xu + +[ Upstream commit 5ce9891ea928208a915411ce8227f8c3e37e5ad9 ] + +Returning values through arguments is confusing and that has +upset the compiler with the recent change to memdup_user: + +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:308:26: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 308 | ctl_data->device_id); + | ^~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:294:39: note: ‘ctl_data’ was declared here + 294 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ +In function ‘adf_ctl_ioctl_dev_stop’, + inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:386:9: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:273:48: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 273 | ret = adf_ctl_is_device_in_use(ctl_data->device_id); + | ~~~~~~~~^~~~~~~~~~~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:261:39: note: ‘ctl_data’ was declared here + 261 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ +In function ‘adf_ctl_ioctl_dev_config’, + inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:382:9: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:192:54: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 192 | accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); + | ~~~~~~~~^~~~~~~~~~~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:185:39: note: ‘ctl_data’ was declared here + 185 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ + +Fix this by returning the pointer directly. + +Signed-off-by: Herbert Xu +Reviewed-by: Thorsten Blum +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/qat/qat_common/adf_ctl_drv.c | 31 +++++++++++----------------- + 1 file changed, 13 insertions(+), 18 deletions(-) + +--- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c +@@ -85,19 +85,14 @@ err_chrdev_unreg: + return -EFAULT; + } + +-static int adf_ctl_alloc_resources(struct adf_user_cfg_ctl_data **ctl_data, +- unsigned long arg) ++static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg) + { + struct adf_user_cfg_ctl_data *cfg_data; + + cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); +- if (IS_ERR(cfg_data)) { ++ if (IS_ERR(cfg_data)) + pr_err("QAT: failed to copy from user cfg_data.\n"); +- return PTR_ERR(cfg_data); +- } +- +- *ctl_data = cfg_data; +- return 0; ++ return cfg_data; + } + + static int adf_add_key_value_data(struct adf_accel_dev *accel_dev, +@@ -177,13 +172,13 @@ out_err: + static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd, + unsigned long arg) + { +- int ret; + struct adf_user_cfg_ctl_data *ctl_data; + struct adf_accel_dev *accel_dev; ++ int ret = 0; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); + if (!accel_dev) { +@@ -258,9 +253,9 @@ static int adf_ctl_ioctl_dev_stop(struct + int ret; + struct adf_user_cfg_ctl_data *ctl_data; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + if (adf_devmgr_verify_id(ctl_data->device_id)) { + pr_err("QAT: Device %d not found\n", ctl_data->device_id); +@@ -292,9 +287,9 @@ static int adf_ctl_ioctl_dev_start(struc + struct adf_user_cfg_ctl_data *ctl_data; + struct adf_accel_dev *accel_dev; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + ret = -ENODEV; + accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); diff --git a/queue-6.1/documentation-ioctl-number-extend-include-file-column-width.patch b/queue-6.1/documentation-ioctl-number-extend-include-file-column-width.patch new file mode 100644 index 0000000000..2628a91da9 --- /dev/null +++ b/queue-6.1/documentation-ioctl-number-extend-include-file-column-width.patch @@ -0,0 +1,578 @@ +From stable+bounces-268640-greg=kroah.com@vger.kernel.org Thu Jun 25 19:56:16 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 13:56:01 -0400 +Subject: Documentation: ioctl-number: Extend "Include File" column width +To: stable@vger.kernel.org +Cc: Bagas Sanjaya , Haren Myneni , Madhavan Srinivasan , Jonathan Corbet , Sasha Levin +Message-ID: <20260625175604.2543972-1-sashal@kernel.org> + +From: Bagas Sanjaya + +[ Upstream commit 15afd5def819e4df2a29cef6fcfa6ae7ba167c0f ] + +Extend width of "Include File" column to fit full path to +papr-physical-attestation.h in later commit. + +Reviewed-by: Haren Myneni +Signed-off-by: Bagas Sanjaya +Acked-by: Madhavan Srinivasan +Signed-off-by: Jonathan Corbet +Link: https://lore.kernel.org/r/20250714015711.14525-3-bagasdotme@gmail.com +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/userspace-api/ioctl/ioctl-number.rst | 464 ++++++++++----------- + 1 file changed, 232 insertions(+), 232 deletions(-) + +--- a/Documentation/userspace-api/ioctl/ioctl-number.rst ++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst +@@ -66,17 +66,17 @@ This table lists ioctls visible from use + most drivers up to 2.6.31, but I know I am missing some. There has been + no attempt to list non-X86 architectures or ioctls from drivers/staging/. + +-==== ===== ======================================================= ================================================================ +-Code Seq# Include File Comments ++==== ===== ========================================================= ================================================================ ++Code Seq# Include File Comments + (hex) +-==== ===== ======================================================= ================================================================ +-0x00 00-1F linux/fs.h conflict! +-0x00 00-1F scsi/scsi_ioctl.h conflict! +-0x00 00-1F linux/fb.h conflict! +-0x00 00-1F linux/wavefront.h conflict! ++==== ===== ========================================================= ================================================================ ++0x00 00-1F linux/fs.h conflict! ++0x00 00-1F scsi/scsi_ioctl.h conflict! ++0x00 00-1F linux/fb.h conflict! ++0x00 00-1F linux/wavefront.h conflict! + 0x02 all linux/fd.h + 0x03 all linux/hdreg.h +-0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these. ++0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these. + 0x06 all linux/lp.h + 0x09 all linux/raid/md_u.h + 0x10 00-0F drivers/char/s390/vmcp.h +@@ -84,298 +84,298 @@ Code Seq# Include File + 0x10 20-2F arch/s390/include/uapi/asm/hypfs.h + 0x12 all linux/fs.h + linux/blkpg.h +-0x1b all InfiniBand Subsystem +- ++0x1b all InfiniBand Subsystem ++ + 0x20 all drivers/cdrom/cm206.h + 0x22 all scsi/sg.h +-0x3E 00-0F linux/counter.h ++0x3E 00-0F linux/counter.h + '!' 00-1F uapi/linux/seccomp.h +-'#' 00-3F IEEE 1394 Subsystem +- Block for the entire subsystem ++'#' 00-3F IEEE 1394 Subsystem ++ Block for the entire subsystem + '$' 00-0F linux/perf_counter.h, linux/perf_event.h +-'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem +- ++'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem ++ + '&' 00-07 drivers/firewire/nosy-user.h +-'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl +- ++'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl ++ + '2' 01-04 linux/i2o.h +-'3' 00-0F drivers/s390/char/raw3270.h conflict! +-'3' 00-1F linux/suspend_ioctls.h, conflict! ++'3' 00-0F drivers/s390/char/raw3270.h conflict! ++'3' 00-1F linux/suspend_ioctls.h, conflict! + kernel/power/user.c +-'8' all SNP8023 advanced NIC card +- ++'8' all SNP8023 advanced NIC card ++ + ';' 64-7F linux/vfio.h +-'=' 00-3f uapi/linux/ptp_clock.h +-'@' 00-0F linux/radeonfb.h conflict! +-'@' 00-0F drivers/video/aty/aty128fb.c conflict! +-'A' 00-1F linux/apm_bios.h conflict! +-'A' 00-0F linux/agpgart.h, conflict! ++'=' 00-3f uapi/linux/ptp_clock.h ++'@' 00-0F linux/radeonfb.h conflict! ++'@' 00-0F drivers/video/aty/aty128fb.c conflict! ++'A' 00-1F linux/apm_bios.h conflict! ++'A' 00-0F linux/agpgart.h, conflict! + drivers/char/agp/compat_ioctl.h +-'A' 00-7F sound/asound.h conflict! +-'B' 00-1F linux/cciss_ioctl.h conflict! +-'B' 00-0F include/linux/pmu.h conflict! +-'B' C0-FF advanced bbus +-'B' 00-0F xen/xenbus_dev.h conflict! +-'C' all linux/soundcard.h conflict! +-'C' 01-2F linux/capi.h conflict! +-'C' F0-FF drivers/net/wan/cosa.h conflict! ++'A' 00-7F sound/asound.h conflict! ++'B' 00-1F linux/cciss_ioctl.h conflict! ++'B' 00-0F include/linux/pmu.h conflict! ++'B' C0-FF advanced bbus ++'B' 00-0F xen/xenbus_dev.h conflict! ++'C' all linux/soundcard.h conflict! ++'C' 01-2F linux/capi.h conflict! ++'C' F0-FF drivers/net/wan/cosa.h conflict! + 'D' all arch/s390/include/asm/dasd.h +-'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022 ++'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022 + 'D' 05 drivers/scsi/pmcraid.h +-'E' all linux/input.h conflict! +-'E' 00-0F xen/evtchn.h conflict! +-'F' all linux/fb.h conflict! +-'F' 01-02 drivers/scsi/pmcraid.h conflict! +-'F' 20 drivers/video/fsl-diu-fb.h conflict! +-'F' 20 drivers/video/intelfb/intelfb.h conflict! +-'F' 20 linux/ivtvfb.h conflict! +-'F' 20 linux/matroxfb.h conflict! +-'F' 20 drivers/video/aty/atyfb_base.c conflict! +-'F' 00-0F video/da8xx-fb.h conflict! +-'F' 80-8F linux/arcfb.h conflict! +-'F' DD video/sstfb.h conflict! +-'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict! +-'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict! +-'H' 00-7F linux/hiddev.h conflict! +-'H' 00-0F linux/hidraw.h conflict! +-'H' 01 linux/mei.h conflict! +-'H' 02 linux/mei.h conflict! +-'H' 03 linux/mei.h conflict! +-'H' 00-0F sound/asound.h conflict! +-'H' 20-40 sound/asound_fm.h conflict! +-'H' 80-8F sound/sfnt_info.h conflict! +-'H' 10-8F sound/emu10k1.h conflict! +-'H' 10-1F sound/sb16_csp.h conflict! +-'H' 10-1F sound/hda_hwdep.h conflict! +-'H' 40-4F sound/hdspm.h conflict! +-'H' 40-4F sound/hdsp.h conflict! ++'E' all linux/input.h conflict! ++'E' 00-0F xen/evtchn.h conflict! ++'F' all linux/fb.h conflict! ++'F' 01-02 drivers/scsi/pmcraid.h conflict! ++'F' 20 drivers/video/fsl-diu-fb.h conflict! ++'F' 20 drivers/video/intelfb/intelfb.h conflict! ++'F' 20 linux/ivtvfb.h conflict! ++'F' 20 linux/matroxfb.h conflict! ++'F' 20 drivers/video/aty/atyfb_base.c conflict! ++'F' 00-0F video/da8xx-fb.h conflict! ++'F' 80-8F linux/arcfb.h conflict! ++'F' DD video/sstfb.h conflict! ++'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict! ++'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict! ++'H' 00-7F linux/hiddev.h conflict! ++'H' 00-0F linux/hidraw.h conflict! ++'H' 01 linux/mei.h conflict! ++'H' 02 linux/mei.h conflict! ++'H' 03 linux/mei.h conflict! ++'H' 00-0F sound/asound.h conflict! ++'H' 20-40 sound/asound_fm.h conflict! ++'H' 80-8F sound/sfnt_info.h conflict! ++'H' 10-8F sound/emu10k1.h conflict! ++'H' 10-1F sound/sb16_csp.h conflict! ++'H' 10-1F sound/hda_hwdep.h conflict! ++'H' 40-4F sound/hdspm.h conflict! ++'H' 40-4F sound/hdsp.h conflict! + 'H' 90 sound/usb/usx2y/usb_stream.h +-'H' 00-0F uapi/misc/habanalabs.h conflict! ++'H' 00-0F uapi/misc/habanalabs.h conflict! + 'H' A0 uapi/linux/usb/cdc-wdm.h +-'H' C0-F0 net/bluetooth/hci.h conflict! +-'H' C0-DF net/bluetooth/hidp/hidp.h conflict! +-'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict! +-'H' C0-DF net/bluetooth/bnep/bnep.h conflict! +-'H' F1 linux/hid-roccat.h ++'H' C0-F0 net/bluetooth/hci.h conflict! ++'H' C0-DF net/bluetooth/hidp/hidp.h conflict! ++'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict! ++'H' C0-DF net/bluetooth/bnep/bnep.h conflict! ++'H' F1 linux/hid-roccat.h + 'H' F8-FA sound/firewire.h +-'I' all linux/isdn.h conflict! +-'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict! +-'I' 40-4F linux/mISDNif.h conflict! ++'I' all linux/isdn.h conflict! ++'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict! ++'I' 40-4F linux/mISDNif.h conflict! + 'K' all linux/kd.h +-'L' 00-1F linux/loop.h conflict! +-'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict! +-'L' E0-FF linux/ppdd.h encrypted disk device driver +- +-'M' all linux/soundcard.h conflict! +-'M' 01-16 mtd/mtd-abi.h conflict! ++'L' 00-1F linux/loop.h conflict! ++'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict! ++'L' E0-FF linux/ppdd.h encrypted disk device driver ++ ++'M' all linux/soundcard.h conflict! ++'M' 01-16 mtd/mtd-abi.h conflict! + and drivers/mtd/mtdchar.c + 'M' 01-03 drivers/scsi/megaraid/megaraid_sas.h +-'M' 00-0F drivers/video/fsl-diu-fb.h conflict! ++'M' 00-0F drivers/video/fsl-diu-fb.h conflict! + 'N' 00-1F drivers/usb/scanner.h + 'N' 40-7F drivers/block/nvme.c +-'O' 00-06 mtd/ubi-user.h UBI +-'P' all linux/soundcard.h conflict! +-'P' 60-6F sound/sscape_ioctl.h conflict! +-'P' 00-0F drivers/usb/class/usblp.c conflict! +-'P' 01-09 drivers/misc/pci_endpoint_test.c conflict! +-'P' 00-0F xen/privcmd.h conflict! ++'O' 00-06 mtd/ubi-user.h UBI ++'P' all linux/soundcard.h conflict! ++'P' 60-6F sound/sscape_ioctl.h conflict! ++'P' 00-0F drivers/usb/class/usblp.c conflict! ++'P' 01-09 drivers/misc/pci_endpoint_test.c conflict! ++'P' 00-0F xen/privcmd.h conflict! + 'Q' all linux/soundcard.h +-'R' 00-1F linux/random.h conflict! +-'R' 01 linux/rfkill.h conflict! ++'R' 00-1F linux/random.h conflict! ++'R' 01 linux/rfkill.h conflict! + 'R' C0-DF net/bluetooth/rfcomm.h + 'R' E0 uapi/linux/fsl_mc.h +-'S' all linux/cdrom.h conflict! +-'S' 80-81 scsi/scsi_ioctl.h conflict! +-'S' 82-FF scsi/scsi.h conflict! +-'S' 00-7F sound/asequencer.h conflict! +-'T' all linux/soundcard.h conflict! +-'T' 00-AF sound/asound.h conflict! +-'T' all arch/x86/include/asm/ioctls.h conflict! +-'T' C0-DF linux/if_tun.h conflict! +-'U' all sound/asound.h conflict! +-'U' 00-CF linux/uinput.h conflict! ++'S' all linux/cdrom.h conflict! ++'S' 80-81 scsi/scsi_ioctl.h conflict! ++'S' 82-FF scsi/scsi.h conflict! ++'S' 00-7F sound/asequencer.h conflict! ++'T' all linux/soundcard.h conflict! ++'T' 00-AF sound/asound.h conflict! ++'T' all arch/x86/include/asm/ioctls.h conflict! ++'T' C0-DF linux/if_tun.h conflict! ++'U' all sound/asound.h conflict! ++'U' 00-CF linux/uinput.h conflict! + 'U' 00-EF linux/usbdevice_fs.h + 'U' C0-CF drivers/bluetooth/hci_uart.h +-'V' all linux/vt.h conflict! +-'V' all linux/videodev2.h conflict! +-'V' C0 linux/ivtvfb.h conflict! +-'V' C0 linux/ivtv.h conflict! +-'V' C0 media/davinci/vpfe_capture.h conflict! +-'V' C0 media/si4713.h conflict! +-'W' 00-1F linux/watchdog.h conflict! +-'W' 00-1F linux/wanrouter.h conflict! (pre 3.9) +-'W' 00-3F sound/asound.h conflict! ++'V' all linux/vt.h conflict! ++'V' all linux/videodev2.h conflict! ++'V' C0 linux/ivtvfb.h conflict! ++'V' C0 linux/ivtv.h conflict! ++'V' C0 media/davinci/vpfe_capture.h conflict! ++'V' C0 media/si4713.h conflict! ++'W' 00-1F linux/watchdog.h conflict! ++'W' 00-1F linux/wanrouter.h conflict! (pre 3.9) ++'W' 00-3F sound/asound.h conflict! + 'W' 40-5F drivers/pci/switch/switchtec.c + 'W' 60-61 linux/watch_queue.h +-'X' all fs/xfs/xfs_fs.h, conflict! ++'X' all fs/xfs/xfs_fs.h, conflict! + fs/xfs/linux-2.6/xfs_ioctl32.h, + include/linux/falloc.h, + linux/fs.h, +-'X' all fs/ocfs2/ocfs_fs.h conflict! +-'X' 01 linux/pktcdvd.h conflict! ++'X' all fs/ocfs2/ocfs_fs.h conflict! ++'X' 01 linux/pktcdvd.h conflict! + 'Z' 14-15 drivers/message/fusion/mptctl.h +-'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices +- +-'a' all linux/atm*.h, linux/sonet.h ATM on linux +- +-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver +-'b' 00-FF conflict! bit3 vme host bridge +- +-'c' all linux/cm4000_cs.h conflict! +-'c' 00-7F linux/comstats.h conflict! +-'c' 00-7F linux/coda.h conflict! +-'c' 00-1F linux/chio.h conflict! +-'c' 80-9F arch/s390/include/asm/chsc.h conflict! ++'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices ++ ++'a' all linux/atm*.h, linux/sonet.h ATM on linux ++ ++'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver ++'b' 00-FF conflict! bit3 vme host bridge ++ ++'c' all linux/cm4000_cs.h conflict! ++'c' 00-7F linux/comstats.h conflict! ++'c' 00-7F linux/coda.h conflict! ++'c' 00-1F linux/chio.h conflict! ++'c' 80-9F arch/s390/include/asm/chsc.h conflict! + 'c' A0-AF arch/x86/include/asm/msr.h conflict! +-'d' 00-FF linux/char/drm/drm.h conflict! +-'d' 02-40 pcmcia/ds.h conflict! ++'d' 00-FF linux/char/drm/drm.h conflict! ++'d' 02-40 pcmcia/ds.h conflict! + 'd' F0-FF linux/digi1.h +-'e' all linux/digi1.h conflict! +-'f' 00-1F linux/ext2_fs.h conflict! +-'f' 00-1F linux/ext3_fs.h conflict! +-'f' 00-0F fs/jfs/jfs_dinode.h conflict! +-'f' 00-0F fs/ext4/ext4.h conflict! +-'f' 00-0F linux/fs.h conflict! +-'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict! ++'e' all linux/digi1.h conflict! ++'f' 00-1F linux/ext2_fs.h conflict! ++'f' 00-1F linux/ext3_fs.h conflict! ++'f' 00-0F fs/jfs/jfs_dinode.h conflict! ++'f' 00-0F fs/ext4/ext4.h conflict! ++'f' 00-0F linux/fs.h conflict! ++'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict! + 'f' 13-27 linux/fscrypt.h + 'f' 81-8F linux/fsverity.h + 'g' 00-0F linux/usb/gadgetfs.h + 'g' 20-2F linux/usb/g_printer.h +-'h' 00-7F conflict! Charon filesystem +- +-'h' 00-1F linux/hpet.h conflict! ++'h' 00-7F conflict! Charon filesystem ++ ++'h' 00-1F linux/hpet.h conflict! + 'h' 80-8F fs/hfsplus/ioctl.c +-'i' 00-3F linux/i2o-dev.h conflict! +-'i' 0B-1F linux/ipmi.h conflict! ++'i' 00-3F linux/i2o-dev.h conflict! ++'i' 0B-1F linux/ipmi.h conflict! + 'i' 80-8F linux/i8k.h +-'i' 90-9F `linux/iio/*.h` IIO ++'i' 90-9F `linux/iio/*.h` IIO + 'j' 00-3F linux/joystick.h +-'k' 00-0F linux/spi/spidev.h conflict! +-'k' 00-05 video/kyro.h conflict! +-'k' 10-17 linux/hsi/hsi_char.h HSI character device +-'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system +- +-'l' 40-7F linux/udf_fs_i.h in development: +- +-'m' 00-09 linux/mmtimer.h conflict! +-'m' all linux/mtio.h conflict! +-'m' all linux/soundcard.h conflict! +-'m' all linux/synclink.h conflict! +-'m' 00-19 drivers/message/fusion/mptctl.h conflict! +-'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict! ++'k' 00-0F linux/spi/spidev.h conflict! ++'k' 00-05 video/kyro.h conflict! ++'k' 10-17 linux/hsi/hsi_char.h HSI character device ++'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system ++ ++'l' 40-7F linux/udf_fs_i.h in development: ++ ++'m' 00-09 linux/mmtimer.h conflict! ++'m' all linux/mtio.h conflict! ++'m' all linux/soundcard.h conflict! ++'m' all linux/synclink.h conflict! ++'m' 00-19 drivers/message/fusion/mptctl.h conflict! ++'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict! + 'n' 00-7F linux/ncp_fs.h and fs/ncpfs/ioctl.c +-'n' 80-8F uapi/linux/nilfs2_api.h NILFS2 +-'n' E0-FF linux/matroxfb.h matroxfb +-'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2 +-'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps) +-'o' 40-41 mtd/ubi-user.h UBI +-'o' 01-A1 `linux/dvb/*.h` DVB +-'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this) +-'p' 00-1F linux/rtc.h conflict! ++'n' 80-8F uapi/linux/nilfs2_api.h NILFS2 ++'n' E0-FF linux/matroxfb.h matroxfb ++'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2 ++'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps) ++'o' 40-41 mtd/ubi-user.h UBI ++'o' 01-A1 `linux/dvb/*.h` DVB ++'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this) ++'p' 00-1F linux/rtc.h conflict! + 'p' 40-7F linux/nvram.h +-'p' 80-9F linux/ppdev.h user-space parport +- +-'p' A1-A5 linux/pps.h LinuxPPS +- ++'p' 80-9F linux/ppdev.h user-space parport ++ ++'p' A1-A5 linux/pps.h LinuxPPS ++ + 'q' 00-1F linux/serio.h +-'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK +- linux/ixjuser.h ++'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK ++ linux/ixjuser.h + 'r' 00-1F linux/msdos_fs.h and fs/fat/dir.c + 's' all linux/cdk.h + 't' 00-7F linux/ppp-ioctl.h + 't' 80-8F linux/isdn_ppp.h +-'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM +-'u' 00-1F linux/smb_fs.h gone +-'u' 20-3F linux/uvcvideo.h USB video class host driver +-'u' 40-4f linux/udmabuf.h userspace dma-buf misc device +-'v' 00-1F linux/ext2_fs.h conflict! +-'v' 00-1F linux/fs.h conflict! +-'v' 00-0F linux/sonypi.h conflict! +-'v' 00-0F media/v4l2-subdev.h conflict! +-'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API +-'v' C0-FF linux/meye.h conflict! +-'w' all CERN SCI driver +-'y' 00-1F packet based user level communications +- +-'z' 00-3F CAN bus card conflict! +- +-'z' 40-7F CAN bus card conflict! +- +-'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict! ++'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM ++'u' 00-1F linux/smb_fs.h gone ++'u' 20-3F linux/uvcvideo.h USB video class host driver ++'u' 40-4f linux/udmabuf.h userspace dma-buf misc device ++'v' 00-1F linux/ext2_fs.h conflict! ++'v' 00-1F linux/fs.h conflict! ++'v' 00-0F linux/sonypi.h conflict! ++'v' 00-0F media/v4l2-subdev.h conflict! ++'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API ++'v' C0-FF linux/meye.h conflict! ++'w' all CERN SCI driver ++'y' 00-1F packet based user level communications ++ ++'z' 00-3F CAN bus card conflict! ++ ++'z' 40-7F CAN bus card conflict! ++ ++'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict! + '|' 00-7F linux/media.h + 0x80 00-1F linux/fb.h + 0x81 00-1F linux/vduse.h + 0x89 00-06 arch/x86/include/asm/sockios.h + 0x89 0B-DF linux/sockios.h +-0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range +-0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range ++0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range ++0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range + 0x8B all linux/wireless.h +-0x8C 00-3F WiNRADiO driver +- ++0x8C 00-3F WiNRADiO driver ++ + 0x90 00 drivers/cdrom/sbpcd.h + 0x92 00-0F drivers/usb/mon/mon_bin.c + 0x93 60-7F linux/auto_fs.h +-0x94 all fs/btrfs/ioctl.h Btrfs filesystem +- and linux/fs.h some lifted to vfs/generic +-0x97 00-7F fs/ceph/ioctl.h Ceph file system +-0x99 00-0F 537-Addinboard driver +- +-0xA0 all linux/sdp/sdp.h Industrial Device Project +- +-0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver +-0xA2 all uapi/linux/acrn.h ACRN hypervisor +-0xA3 80-8F Port ACL in development: +- ++0x94 all fs/btrfs/ioctl.h Btrfs filesystem ++ and linux/fs.h some lifted to vfs/generic ++0x97 00-7F fs/ceph/ioctl.h Ceph file system ++0x99 00-0F 537-Addinboard driver ++ ++0xA0 all linux/sdp/sdp.h Industrial Device Project ++ ++0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver ++0xA2 all uapi/linux/acrn.h ACRN hypervisor ++0xA3 80-8F Port ACL in development: ++ + 0xA3 90-9F linux/dtlk.h +-0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem +-0xA4 00-1F uapi/asm/sgx.h +-0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator +- +-0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver +- ++0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem ++0xA4 00-1F uapi/asm/sgx.h ++0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator ++ ++0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver ++ + 0xAA 00-3F linux/uapi/linux/userfaultfd.h + 0xAB 00-1F linux/nbd.h + 0xAC 00-1F linux/raw.h +-0xAD 00 Netfilter device in development: +- +-0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine +- +-0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine +- +-0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves +-0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor +-0xB0 all RATIO devices in development: +- +-0xB1 00-1F PPPoX +- ++0xAD 00 Netfilter device in development: ++ ++0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine ++ ++0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine ++ ++0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves ++0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor ++0xB0 all RATIO devices in development: ++ ++0xB1 00-1F PPPoX ++ + 0xB3 00 linux/mmc/ioctl.h +-0xB4 00-0F linux/gpio.h +-0xB5 00-0F uapi/linux/rpmsg.h ++0xB4 00-0F linux/gpio.h ++0xB5 00-0F uapi/linux/rpmsg.h + 0xB6 all linux/fpga-dfl.h +-0xB7 all uapi/linux/remoteproc_cdev.h +-0xB7 all uapi/linux/nsfs.h > ++0xB7 all uapi/linux/remoteproc_cdev.h ++0xB7 all uapi/linux/nsfs.h > + 0xC0 00-0F linux/usb/iowarrior.h + 0xCA 00-0F uapi/misc/cxl.h + 0xCA 10-2F uapi/misc/ocxl.h + 0xCA 80-BF uapi/scsi/cxlflash_ioctl.h +-0xCB 00-1F CBM serial IEC bus in development: +- +-0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver ++0xCB 00-1F CBM serial IEC bus in development: ++ ++0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver + 0xCD 01 linux/reiserfs_fs.h +-0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices ++0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices + 0xCF 02 fs/cifs/ioctl.c + 0xDB 00-0F drivers/char/mwave/mwavepub.h +-0xDD 00-3F ZFCP device driver see drivers/s390/scsi/ +- ++0xDD 00-3F ZFCP device driver see drivers/s390/scsi/ ++ + 0xE5 00-3F linux/fuse.h +-0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver +-0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry +-0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development) +- +-0xF6 all LTTng Linux Trace Toolkit Next Generation +- +-0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver +- ++0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver ++0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry ++0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development) ++ ++0xF6 all LTTng Linux Trace Toolkit Next Generation ++ ++0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver ++ + 0xFD all linux/dm-ioctl.h + 0xFE all linux/isst_if.h +-==== ===== ======================================================= ================================================================ ++==== ===== ========================================================= ================================================================ diff --git a/queue-6.1/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch b/queue-6.1/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch new file mode 100644 index 0000000000..2ebb098dba --- /dev/null +++ b/queue-6.1/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch @@ -0,0 +1,153 @@ +From stable+bounces-266590-greg=kroah.com@vger.kernel.org Wed Jun 17 00:46:53 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 18:46:46 -0400 +Subject: Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs +To: stable@vger.kernel.org +Cc: Dexuan Cui , Michael Kelley , Krister Johansen , Matthew Ruffell , Wei Liu , Sasha Levin +Message-ID: <20260616224646.3561132-1-sashal@kernel.org> + +From: Dexuan Cui + +[ Upstream commit 016a25e4b0df4d77e7c258edee4aaf982e4ee809 ] + +If vmbus_reserve_fb() in the kdump/kexec kernel fails to properly reserve +the framebuffer MMIO range (which is below 4GB) due to a Gen2 VM's +screen.lfb_base being zero [1], there is an MMIO conflict between the +drivers hyperv-drm and pci-hyperv: when the driver pci-hyperv's +hv_allocate_config_window() calls vmbus_allocate_mmio() to get an +MMIO range, typically it gets a 32-bit MMIO range that overlaps with the +framebuffer MMIO range, and later hv_pci_enter_d0() fails with an +error message "PCI Pass-through VSP failed D0 Entry with status" since +the host thinks that PCI devices must not use MMIO space that the +host has assigned to the framebuffer. + +This is especially an issue if pci-hyperv is built-in and hyperv-drm is +built as a module. Consequently, the kdump/kexec kernel fails to detect +PCI devices via pci-hyperv, and may fail to mount the root file system, +which may reside in a NVMe disk. The issue described here has existed +for SR-IOV VF NICs since day one of the pci-hyperv driver, and has been +worked around on x64 when possible. With the recent introduction of +ARM64 VMs that boot from NVMe, there is no workaround, so we need a +formal fix. + +On Gen2 VMs, if the screen.lfb_base is 0 in the kdump/kexec kernel [1], +fall back to the low MMIO base, which should be equal to the framebuffer +MMIO base [2] (the statement is true according to my testing on x64 +Windows Server 2016, and on x64 and ARM64 Windows Server 2025 and on +Azure. I checked with the Hyper-V team and they said the statement should +continue to be true for Gen2 VMs). In the first kernel, screen.lfb_base +is not 0; if the user specifies a very high resolution, it's not enough +to only reserve 8MB: let's always reserve half of the space below 4GB, +but cap the reservation to 128MB, which is the required framebuffer size +of the highest resolution 7680*4320 supported by Hyper-V. + +While at it, fix the comparison "end > VTPM_BASE_ADDRESS" by changing +the > to >=. Here the 'end' is an inclusive end (typically, it's +0xFFFF_FFFF for the low MMIO range). + +Note: vmbus_reserve_fb() now also reserves an MMIO range at the beginning +of the low MMIO range on CVMs, which have no framebuffers (the +'screen.lfb_base' in vmbus_reserve_fb() is 0 for CVMs), just in case the +host might treat the beginning of the low MMIO range specially [3]. BTW, +the OpenHCL kernel is not affected by the change, because that kernel +boots with DeviceTree rather than ACPI (so vmbus_reserve_fb() won't run +there), and there is no framebuffer device for that kernel. + +Note: normally Gen1 VMs don't have the MMIO conflict issue because the +framebuffer MMIO range (which is hardcoded to base=4GB-128MB and +size=64MB for Gen1 VMs by the host) is always reported via the legacy PCI +graphics device's BAR, so the kdump/kexec kernel can reserve the 64MB +MMIO range; however, if the VM is configured to use a very high resolution +and the required framebuffer size exceeds 64MB (AFAIK, in practice, this +isn't a typical configuration by users), the hyperv-drm driver may need to +allocate an MMIO range above 4GB and change the framebuffer MMIO location +to the allocated MMIO range -- in this case, there can still be issues [4] +which can't be easily fixed: any possible affected Gen1 users would have +to use a resolution whose framebuffer size is <= 64MB, or switch to Gen2 +VMs. + +[1] https://lore.kernel.org/all/SA1PR21MB692176C1BC53BFC9EAE5CF8EBF51A@SA1PR21MB6921.namprd21.prod.outlook.com/ +[2] https://lore.kernel.org/all/SA1PR21MB69218F955B62DFF62E3E88D2BF222@SA1PR21MB6921.namprd21.prod.outlook.com/ +[3] https://lore.kernel.org/all/SN6PR02MB415726B17D5A6027CD1717E8D4342@SN6PR02MB4157.namprd02.prod.outlook.com/ +[4] https://lore.kernel.org/all/SA1PR21MB69213486F821CA5A2C793C81BF342@SA1PR21MB6921.namprd21.prod.outlook.com/ + +Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs") +CC: stable@vger.kernel.org +Reviewed-by: Michael Kelley +Tested-by: Krister Johansen +Tested-by: Matthew Ruffell +Signed-off-by: Dexuan Cui +Signed-off-by: Wei Liu +[ changed `sysfb_primary_display.screen.lfb_base/lfb_size` reads to the global `screen_info.lfb_base/lfb_size` and dropped the `if (IS_ENABLED(CONFIG_SYSFB))` wrapper, de-indenting the block. ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hv/vmbus_drv.c | 29 ++++++++++++++++++++++++++--- + 1 file changed, 26 insertions(+), 3 deletions(-) + +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2027,8 +2027,8 @@ static acpi_status vmbus_walk_resources( + return AE_NO_MEMORY; + + /* If this range overlaps the virtual TPM, truncate it. */ +- if (end > VTPM_BASE_ADDRESS && start < VTPM_BASE_ADDRESS) +- end = VTPM_BASE_ADDRESS; ++ if (end >= VTPM_BASE_ADDRESS && start < VTPM_BASE_ADDRESS) ++ end = VTPM_BASE_ADDRESS - 1; + + new_res->name = "hyperv mmio"; + new_res->flags = IORESOURCE_MEM; +@@ -2096,12 +2096,31 @@ static int vmbus_acpi_remove(struct acpi + static void vmbus_reserve_fb(void) + { + resource_size_t start = 0, size; ++ resource_size_t low_mmio_base; + struct pci_dev *pdev; + + if (efi_enabled(EFI_BOOT)) { + /* Gen2 VM: get FB base from EFI framebuffer */ + start = screen_info.lfb_base; + size = max_t(__u32, screen_info.lfb_size, 0x800000); ++ ++ low_mmio_base = hyperv_mmio->start; ++ if (!low_mmio_base || upper_32_bits(low_mmio_base) || ++ (start && start < low_mmio_base)) { ++ pr_warn("Unexpected low mmio base %pa\n", &low_mmio_base); ++ } else { ++ /* ++ * If the kdump/kexec or CVM kernel's lfb_base ++ * is 0, fall back to the low mmio base. ++ */ ++ if (!start) ++ start = low_mmio_base; ++ /* ++ * Reserve half of the space below 4GB for high ++ * resolutions, but cap the reservation to 128MB. ++ */ ++ size = min((SZ_4G - start) / 2, SZ_128M); ++ } + } else { + /* Gen1 VM: get FB base from PCI */ + pdev = pci_get_device(PCI_VENDOR_ID_MICROSOFT, +@@ -2121,8 +2140,10 @@ static void vmbus_reserve_fb(void) + pci_dev_put(pdev); + } + +- if (!start) ++ if (!start) { ++ pr_warn("Unexpected framebuffer mmio base of zero\n"); + return; ++ } + + /* + * Make a claim for the frame buffer in the resource tree under the +@@ -2132,6 +2153,8 @@ static void vmbus_reserve_fb(void) + */ + for (; !fb_mmio && (size >= 0x100000); size >>= 1) + fb_mmio = __request_region(hyperv_mmio, start, size, fb_mmio_name, 0); ++ ++ pr_info("hv_mmio=%pR,%pR fb=%pR\n", hyperv_mmio, hyperv_mmio->sibling, fb_mmio); + } + + /** diff --git a/queue-6.1/fuse-re-lock-request-before-replacing-page-cache-folio.patch b/queue-6.1/fuse-re-lock-request-before-replacing-page-cache-folio.patch new file mode 100644 index 0000000000..95e61aa12e --- /dev/null +++ b/queue-6.1/fuse-re-lock-request-before-replacing-page-cache-folio.patch @@ -0,0 +1,71 @@ +From stable+bounces-268014-greg=kroah.com@vger.kernel.org Tue Jun 23 21:49:44 2026 +From: Sasha Levin +Date: Tue, 23 Jun 2026 15:49:37 -0400 +Subject: fuse: re-lock request before replacing page cache folio +To: stable@vger.kernel.org +Cc: Joanne Koong , Lei Lu , Miklos Szeredi , Sasha Levin +Message-ID: <20260623194937.1375846-1-sashal@kernel.org> + +From: Joanne Koong + +[ Upstream commit a078484921052d0badd827fcc2770b5cfc1d4120 ] + +fuse_try_move_folio() unlocks the request on entry but does not +re-lock it on the success path. This means fuse_chan_abort() can end the +request and free the fuse_io_args (eg fuse_readpages_end()) while the +subsequent copy chain logic after fuse_try_move_folio() accesses the +fuse_io_args, leading to use-after-free issues. + +Fix this by calling lock_request() before replace_page_cache_folio(). +This ensures the request is locked on the success path which will +prevent the fuse_io_args from being freed while the later copying logic +runs, and also ensures that the ap->folios[i]->mapping is never null +since ap->folios[i] will always point to the newfolio after +replace_page_cache_folio(). + +Fixes: ce534fb05292 ("fuse: allow splice to move pages") +Cc: stable@vger.kernel.org +Reported-by: Lei Lu +Signed-off-by: Joanne Koong +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/fuse/dev.c | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -839,6 +839,10 @@ static int fuse_try_move_page(struct fus + if (WARN_ON(PageMlocked(oldpage))) + goto out_fallback_unlock; + ++ err = lock_request(cs->req); ++ if (err) ++ goto out_fallback_unlock; ++ + replace_page_cache_page(oldpage, newpage); + + get_page(newpage); +@@ -852,20 +856,7 @@ static int fuse_try_move_page(struct fus + */ + pipe_buf_release(cs->pipe, buf); + +- err = 0; +- spin_lock(&cs->req->waitq.lock); +- if (test_bit(FR_ABORTED, &cs->req->flags)) +- err = -ENOENT; +- else +- *pagep = newpage; +- spin_unlock(&cs->req->waitq.lock); +- +- if (err) { +- unlock_page(newpage); +- put_page(newpage); +- goto out_put_old; +- } +- ++ *pagep = newpage; + unlock_page(oldpage); + /* Drop ref for ap->pages[] array */ + put_page(oldpage); diff --git a/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch new file mode 100644 index 0000000000..9a18eecd25 --- /dev/null +++ b/queue-6.1/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch @@ -0,0 +1,48 @@ +From stable+bounces-266564-greg=kroah.com@vger.kernel.org Tue Jun 16 21:53:00 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 15:52:54 -0400 +Subject: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock +To: stable@vger.kernel.org +Cc: Ji'an Zhou , Thomas Gleixner , Sasha Levin +Message-ID: <20260616195254.3526787-1-sashal@kernel.org> + +From: Ji'an Zhou + +[ Upstream commit 74e144274af39935b0f410c0ee4d2b91c3730414 ] + +When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the +target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting +waiter->task. + +The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences +the NULL waiter->task, causing a kernel crash. + +Add a self-deadlock check for non-top waiters before calling +rt_mutex_start_proxy_lock(), analogous to the top-waiter check in +futex_lock_pi_atomic(). + +Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") +Signed-off-by: Ji'an Zhou +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/futex/requeue.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/kernel/futex/requeue.c ++++ b/kernel/futex/requeue.c +@@ -629,6 +629,12 @@ retry_private: + continue; + } + ++ /* Self-deadlock: non-top waiter already owns the PI futex. */ ++ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { ++ ret = -EDEADLK; ++ break; ++ } ++ + ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, + this->rt_waiter, + this->task); diff --git a/queue-6.1/hv-utils-handle-and-propagate-errors-in-kvp_register.patch b/queue-6.1/hv-utils-handle-and-propagate-errors-in-kvp_register.patch new file mode 100644 index 0000000000..2d6f122277 --- /dev/null +++ b/queue-6.1/hv-utils-handle-and-propagate-errors-in-kvp_register.patch @@ -0,0 +1,89 @@ +From stable+bounces-265329-greg=kroah.com@vger.kernel.org Tue Jun 16 19:30:49 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 13:24:09 -0400 +Subject: hv: utils: handle and propagate errors in kvp_register +To: stable@vger.kernel.org +Cc: Thorsten Blum , Long Li , Wei Liu , Sasha Levin +Message-ID: <20260616172409.3390421-1-sashal@kernel.org> + +From: Thorsten Blum + +[ Upstream commit 3fcf923302a8f5c0dc3af3d2ca2657cb5fae4297 ] + +Make kvp_register() return an error code instead of silently ignoring +failures, and propagate the error from kvp_handle_handshake() instead of +returning success. + +This propagates both kzalloc_obj() and hvutil_transport_send() failures +to kvp_handle_handshake() and thus to kvp_on_msg(). + +Fixes: 245ba56a52a3 ("Staging: hv: Implement key/value pair (KVP)") +Cc: stable@vger.kernel.org +Signed-off-by: Thorsten Blum +Reviewed-by: Long Li +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hv/hv_kvp.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -93,7 +93,7 @@ static void kvp_send_key(struct work_str + static void kvp_respond_to_host(struct hv_kvp_msg *msg, int error); + static void kvp_timeout_func(struct work_struct *dummy); + static void kvp_host_handshake_func(struct work_struct *dummy); +-static void kvp_register(int); ++static int kvp_register(int); + + static DECLARE_DELAYED_WORK(kvp_timeout_work, kvp_timeout_func); + static DECLARE_DELAYED_WORK(kvp_host_handshake_work, kvp_host_handshake_func); +@@ -127,24 +127,26 @@ static void kvp_register_done(void) + hv_poll_channel(kvp_transaction.recv_channel, kvp_poll_wrapper); + } + +-static void ++static int + kvp_register(int reg_value) + { + + struct hv_kvp_msg *kvp_msg; + char *version; ++ int ret; + + kvp_msg = kzalloc(sizeof(*kvp_msg), GFP_KERNEL); ++ if (!kvp_msg) ++ return -ENOMEM; + +- if (kvp_msg) { +- version = kvp_msg->body.kvp_register.version; +- kvp_msg->kvp_hdr.operation = reg_value; +- strcpy(version, HV_DRV_VERSION); +- +- hvutil_transport_send(hvt, kvp_msg, sizeof(*kvp_msg), +- kvp_register_done); +- kfree(kvp_msg); +- } ++ version = kvp_msg->body.kvp_register.version; ++ kvp_msg->kvp_hdr.operation = reg_value; ++ strcpy(version, HV_DRV_VERSION); ++ ++ ret = hvutil_transport_send(hvt, kvp_msg, sizeof(*kvp_msg), ++ kvp_register_done); ++ kfree(kvp_msg); ++ return ret; + } + + static void kvp_timeout_func(struct work_struct *dummy) +@@ -186,9 +188,8 @@ static int kvp_handle_handshake(struct h + */ + pr_debug("KVP: userspace daemon ver. %d connected\n", + msg->kvp_hdr.operation); +- kvp_register(dm_reg_value); + +- return 0; ++ return kvp_register(dm_reg_value); + } + + diff --git a/queue-6.1/ipv6-account-for-fraggap-on-the-paged-allocation-path.patch b/queue-6.1/ipv6-account-for-fraggap-on-the-paged-allocation-path.patch new file mode 100644 index 0000000000..3c08252543 --- /dev/null +++ b/queue-6.1/ipv6-account-for-fraggap-on-the-paged-allocation-path.patch @@ -0,0 +1,71 @@ +From stable+bounces-269993-greg=kroah.com@vger.kernel.org Tue Jun 30 17:10:37 2026 +From: Sasha Levin +Date: Tue, 30 Jun 2026 11:08:14 -0400 +Subject: ipv6: account for fraggap on the paged allocation path +To: stable@vger.kernel.org +Cc: Wongi Lee , Jungwoo Lee , Ido Schimmel , Jakub Kicinski , Sasha Levin +Message-ID: <20260630150814.2524002-1-sashal@kernel.org> + +From: Wongi Lee + +[ Upstream commit 736b380e28d0480c7bc3e022f1950f31fe53a7c5 ] + +In __ip6_append_data(), when the paged-allocation branch is taken +(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are +computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap (datalen = length + fraggap). When +fraggap is non-zero, this is not the first skb and transhdrlen is zero. +The fraggap bytes carried over from the previous skb are copied just past +the fragment headers in the new skb's linear area. The linear area is +therefore undersized by fraggap bytes while pagedlen is overstated by the +same amount, and the copy writes past skb->end into the trailing +skb_shared_info. + +An unprivileged user can trigger this via a UDPv6 socket using +MSG_MORE together with MSG_SPLICE_PAGES. + +The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: +avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix +__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative +copy value caused -EINVAL to be returned. That later commit allowed +MSG_SPLICE_PAGES to proceed in this case, making the corruption +triggerable. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. +Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES +case, remove the MSG_SPLICE_PAGES exception from the negative copy check. + +Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_output.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1622,8 +1622,8 @@ alloc_new_skb: + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + alloclen += alloc_extra; + diff --git a/queue-6.1/locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch b/queue-6.1/locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch new file mode 100644 index 0000000000..71a7e8e7c5 --- /dev/null +++ b/queue-6.1/locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch @@ -0,0 +1,69 @@ +From stable+bounces-266743-greg=kroah.com@vger.kernel.org Wed Jun 17 14:46:40 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 08:46:07 -0400 +Subject: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued +To: stable@vger.kernel.org +Cc: Davidlohr Bueso , syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com, Thomas Gleixner , Sasha Levin +Message-ID: <20260617124607.3857087-1-sashal@kernel.org> + +From: Davidlohr Bueso + +[ Upstream commit 40a25d59e85b3c8709ac2424d44f65610467871e ] + +syzbot triggered the following splat in remove_waiter() via +FUTEX_CMP_REQUEUE_PI: + + KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] + class_raw_spinlock_constructor + remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 + rt_mutex_start_proxy_lock+0x103/0x120 + futex_requeue+0x10e4/0x20d0 + __x64_sys_futex+0x34f/0x4d0 + +task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, +leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead +of current in remove_waiter()") made this fatal. + +Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() +upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock +return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() +(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to +account for try_to_take_rt_mutex(). + +Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") +Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com +Signed-off-by: Davidlohr Bueso +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ +Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/rtmutex.c | 3 +++ + kernel/locking/rtmutex_api.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/kernel/locking/rtmutex.c ++++ b/kernel/locking/rtmutex.c +@@ -1524,6 +1524,9 @@ static void __sched remove_waiter(struct + + lockdep_assert_held(&lock->wait_lock); + ++ if (!waiter_task) /* never enqueued */ ++ return; ++ + scoped_guard(raw_spinlock, &waiter_task->pi_lock) { + rt_mutex_dequeue(lock, waiter); + waiter_task->pi_blocked_on = NULL; +--- a/kernel/locking/rtmutex_api.c ++++ b/kernel/locking/rtmutex_api.c +@@ -344,7 +344,7 @@ int __sched rt_mutex_start_proxy_lock(st + + raw_spin_lock_irq(&lock->wait_lock); + ret = __rt_mutex_start_proxy_lock(lock, waiter, task); +- if (unlikely(ret)) ++ if (unlikely(ret < 0)) + remove_waiter(lock, waiter); + raw_spin_unlock_irq(&lock->wait_lock); + diff --git a/queue-6.1/misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch b/queue-6.1/misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch new file mode 100644 index 0000000000..40618ab04f --- /dev/null +++ b/queue-6.1/misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch @@ -0,0 +1,47 @@ +From sashal@kernel.org Tue Jun 16 21:05:49 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 15:05:45 -0400 +Subject: misc: fastrpc: Add dma_mask to fastrpc_channel_ctx +To: stable@vger.kernel.org +Cc: Abel Vesa , Srinivas Kandagatla , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260616190546.3486929-1-sashal@kernel.org> + +From: Abel Vesa + +[ Upstream commit 9bde43a0e2f469961e18d0a3496a9a74379c22bf ] + +dma_set_mask_and_coherent only updates the mask to which the device +dma_mask pointer points to. Add a dma_mask to the channel ctx and set +the device dma_mask to point to that, otherwise the dma_set_mask will +return an error and the dma_set_coherent_mask will be skipped too. + +Co-developed-by: Srinivas Kandagatla +Signed-off-by: Abel Vesa +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20221125071405.148786-11-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 5401fb4fe10f ("misc: fastrpc: Fix NULL pointer dereference in rpmsg callback") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -262,6 +262,7 @@ struct fastrpc_channel_ctx { + struct fastrpc_device *fdevice; + bool secure; + bool unsigned_support; ++ u64 dma_mask; + }; + + struct fastrpc_device { +@@ -2175,6 +2176,7 @@ static int fastrpc_rpmsg_probe(struct rp + kref_init(&data->refcount); + + dev_set_drvdata(&rpdev->dev, data); ++ rdev->dma_mask = &data->dma_mask; + dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32)); + INIT_LIST_HEAD(&data->users); + spin_lock_init(&data->lock); diff --git a/queue-6.1/misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch b/queue-6.1/misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch new file mode 100644 index 0000000000..a60e7a3e68 --- /dev/null +++ b/queue-6.1/misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch @@ -0,0 +1,83 @@ +From sashal@kernel.org Tue Jun 16 21:05:49 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 15:05:46 -0400 +Subject: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback +To: stable@vger.kernel.org +Cc: Mukesh Ojha , Bjorn Andersson , Srinivas Kandagatla , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260616190546.3486929-2-sashal@kernel.org> + +From: Mukesh Ojha + +[ Upstream commit 5401fb4fe10fac6134c308495df18ed74aebb9c4 ] + +A NULL pointer dereference was observed on Hawi at boot when the DSP +sends a glink message before fastrpc_rpmsg_probe() has completed +initialization: + + Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178 + pc : _raw_spin_lock_irqsave+0x34/0x8c + lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] + ... + Call trace: + _raw_spin_lock_irqsave+0x34/0x8c (P) + fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] + qcom_glink_native_rx+0x538/0x6a4 + qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem] + +The faulting address 0x178 corresponds to the lock variable inside +struct fastrpc_channel_ctx, confirming that cctx is NULL when +fastrpc_rpmsg_callback() attempts to take the spinlock. + +There are two issues here. First, dev_set_drvdata() is called before +spin_lock_init() and idr_init(), leaving a window where the callback +can retrieve a valid cctx pointer but operate on an uninitialized +spinlock. Second, the rpmsg channel becomes live as soon as the driver +is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata() +is called at all, resulting in dev_get_drvdata() returning NULL. + +Fix both issues by moving all cctx initialization ahead of +dev_set_drvdata() so the structure is fully initialized before it +becomes visible to the callback, and add a NULL check in +fastrpc_rpmsg_callback() as a guard against any remaining window. + +Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model") +Cc: stable@vger.kernel.org +Signed-off-by: Mukesh Ojha +Reviewed-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204528.116920-4-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -2175,7 +2175,6 @@ static int fastrpc_rpmsg_probe(struct rp + + kref_init(&data->refcount); + +- dev_set_drvdata(&rpdev->dev, data); + rdev->dma_mask = &data->dma_mask; + dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32)); + INIT_LIST_HEAD(&data->users); +@@ -2183,6 +2182,7 @@ static int fastrpc_rpmsg_probe(struct rp + idr_init(&data->ctx_idr); + data->domain_id = domain_id; + data->rpdev = rpdev; ++ dev_set_drvdata(&rpdev->dev, data); + + err = of_platform_populate(rdev->of_node, NULL, NULL, rdev); + if (err) +@@ -2249,6 +2249,9 @@ static int fastrpc_rpmsg_callback(struct + if (len < sizeof(*rsp)) + return -EINVAL; + ++ if (!cctx) ++ return -ENODEV; ++ + ctxid = ((rsp->ctx & FASTRPC_CTXID_MASK) >> 4); + + spin_lock_irqsave(&cctx->lock, flags); diff --git a/queue-6.1/mptcp-fix-missing-wakeups-in-edge-scenarios.patch b/queue-6.1/mptcp-fix-missing-wakeups-in-edge-scenarios.patch new file mode 100644 index 0000000000..ef3acfb210 --- /dev/null +++ b/queue-6.1/mptcp-fix-missing-wakeups-in-edge-scenarios.patch @@ -0,0 +1,46 @@ +From stable+bounces-264596-greg=kroah.com@vger.kernel.org Tue Jun 16 18:40:19 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 12:18:58 -0400 +Subject: mptcp: fix missing wakeups in edge scenarios +To: stable@vger.kernel.org +Cc: Paolo Abeni , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin +Message-ID: <20260616161858.3332254-1-sashal@kernel.org> + +From: Paolo Abeni + +[ Upstream commit 9d8d28738f24b75616d6ca7a27cb4aed88520343 ] + +The mptcp_recvmsg() can fill MPTCP socket receive queue via +mptcp_move_skbs(), but currently does not try to wakeup any listener, +because the same process is going to check the receive queue soon. + +When multiple threads are reading from the same fd, the above can +cause stall. Add the missing wakeup. + +Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2197,8 +2197,10 @@ static bool __mptcp_move_skbs(struct mpt + __mptcp_splice_receive_queue(sk); + mptcp_data_unlock(sk); + } +- if (ret) ++ if (ret) { + mptcp_check_data_fin((struct sock *)msk); ++ sk->sk_data_ready(sk); ++ } + return !skb_queue_empty(&msk->receive_queue); + } + diff --git a/queue-6.1/mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch b/queue-6.1/mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch new file mode 100644 index 0000000000..11bafb0c30 --- /dev/null +++ b/queue-6.1/mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch @@ -0,0 +1,65 @@ +From stable+bounces-264593-greg=kroah.com@vger.kernel.org Tue Jun 16 18:18:55 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 12:18:46 -0400 +Subject: mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation +To: stable@vger.kernel.org +Cc: Tao Cui , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin +Message-ID: <20260616161846.3332083-1-sashal@kernel.org> + +From: Tao Cui + +[ Upstream commit 14e9fea30b68fc75b2b3d97396a7e6adb544bd2a ] + +The userspace PM increments extra_subflows after __mptcp_subflow_connect() +succeeds, but __mptcp_subflow_connect() calls mptcp_pm_close_subflow() +on failure to roll back the pre-increment done by the kernel PM's fill_*() +helpers. Because the userspace PM hasn't incremented yet at that point, +this decrement is spurious and causes extra_subflows to underflow. + +Fix it by aligning the userspace PM with the kernel PM: increment +extra_subflows before calling __mptcp_subflow_connect(), so the existing +error path in subflow.c correctly rolls it back on failure. Also simplify +the error handling by taking pm.lock only when needed for cleanup. + +Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") +Cc: stable@vger.kernel.org +Signed-off-by: Tao Cui +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-5-856831229976@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_userspace.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/net/mptcp/pm_userspace.c ++++ b/net/mptcp/pm_userspace.c +@@ -410,18 +410,21 @@ int mptcp_nl_cmd_sf_create(struct sk_buf + goto create_err; + } + ++ spin_lock_bh(&msk->pm.lock); ++ msk->pm.subflows++; ++ spin_unlock_bh(&msk->pm.lock); ++ + lock_sock(sk); + + err = __mptcp_subflow_connect(sk, &addr_l, &addr_r); + + release_sock(sk); + +- spin_lock_bh(&msk->pm.lock); +- if (err) ++ if (err) { ++ spin_lock_bh(&msk->pm.lock); + mptcp_userspace_pm_delete_local_addr(msk, &local); +- else +- msk->pm.subflows++; +- spin_unlock_bh(&msk->pm.lock); ++ spin_unlock_bh(&msk->pm.lock); ++ } + + create_err: + sock_put((struct sock *)msk); diff --git a/queue-6.1/net-phonet-free-phonet_device-after-rcu-grace-period.patch b/queue-6.1/net-phonet-free-phonet_device-after-rcu-grace-period.patch new file mode 100644 index 0000000000..95daab13c1 --- /dev/null +++ b/queue-6.1/net-phonet-free-phonet_device-after-rcu-grace-period.patch @@ -0,0 +1,43 @@ +From stable+bounces-266799-greg=kroah.com@vger.kernel.org Wed Jun 17 16:46:08 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 10:45:04 -0400 +Subject: net: phonet: free phonet_device after RCU grace period +To: stable@vger.kernel.org +Cc: "Santosh Kalluri" , "Rémi Denis-Courmont" , "Simon Horman" , "Jakub Kicinski" , "Sasha Levin" +Message-ID: <20260617144504.4144644-3-sashal@kernel.org> + +From: Santosh Kalluri + +[ Upstream commit 71de0177b28da751f407581a4515cf4d762f6296 ] + +phonet_device_destroy() removes a phonet_device from the per-net device +list with list_del_rcu(), but frees it immediately. RCU readers walking +the same list can still hold a pointer to the object after it has been +removed, leading to a slab-use-after-free. + +Use kfree_rcu(), matching the lifetime rule already used by +phonet_address_del() for the same object type. + +Fixes: eeb74a9d45f7 ("Phonet: convert devices list to RCU") +Cc: stable@vger.kernel.org +Signed-off-by: Santosh Kalluri +Acked-by: Rémi Denis-Courmont +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/phonet/pn_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/phonet/pn_dev.c ++++ b/net/phonet/pn_dev.c +@@ -105,7 +105,7 @@ static void phonet_device_destroy(struct + for_each_set_bit(addr, pnd->addrs, 64) + phonet_address_notify(net, RTM_DELADDR, ifindex, addr); + +- kfree(pnd); ++ kfree_rcu(pnd, rcu); + } + } + diff --git a/queue-6.1/phonet-pass-ifindex-to-fill_addr.patch b/queue-6.1/phonet-pass-ifindex-to-fill_addr.patch new file mode 100644 index 0000000000..6597c285f6 --- /dev/null +++ b/queue-6.1/phonet-pass-ifindex-to-fill_addr.patch @@ -0,0 +1,80 @@ +From stable+bounces-266797-greg=kroah.com@vger.kernel.org Wed Jun 17 16:45:32 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 10:45:02 -0400 +Subject: phonet: Pass ifindex to fill_addr(). +To: stable@vger.kernel.org +Cc: Kuniyuki Iwashima , Eric Dumazet , Paolo Abeni , Sasha Levin +Message-ID: <20260617144504.4144644-1-sashal@kernel.org> + +From: Kuniyuki Iwashima + +[ Upstream commit 08a9572be36819b5d9011604edfa5db6c5062a7a ] + +We will convert addr_doit() and getaddr_dumpit() to RCU, both +of which call fill_addr(). + +The former will call phonet_address_notify() outside of RCU +due to GFP_KERNEL, so dev will not be available in fill_addr(). + +Let's pass ifindex directly to fill_addr(). + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Signed-off-by: Paolo Abeni +Stable-dep-of: 71de0177b28d ("net: phonet: free phonet_device after RCU grace period") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/phonet/pn_netlink.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/net/phonet/pn_netlink.c ++++ b/net/phonet/pn_netlink.c +@@ -19,7 +19,7 @@ + + /* Device address handling */ + +-static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr, ++static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr, + u32 portid, u32 seq, int event); + + void phonet_address_notify(int event, struct net_device *dev, u8 addr) +@@ -31,7 +31,8 @@ void phonet_address_notify(int event, st + nla_total_size(1), GFP_KERNEL); + if (skb == NULL) + goto errout; +- err = fill_addr(skb, dev, addr, 0, 0, event); ++ ++ err = fill_addr(skb, dev->ifindex, addr, 0, 0, event); + if (err < 0) { + WARN_ON(err == -EMSGSIZE); + kfree_skb(skb); +@@ -92,8 +93,8 @@ static int addr_doit(struct sk_buff *skb + return err; + } + +-static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr, +- u32 portid, u32 seq, int event) ++static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr, ++ u32 portid, u32 seq, int event) + { + struct ifaddrmsg *ifm; + struct nlmsghdr *nlh; +@@ -107,7 +108,7 @@ static int fill_addr(struct sk_buff *skb + ifm->ifa_prefixlen = 0; + ifm->ifa_flags = IFA_F_PERMANENT; + ifm->ifa_scope = RT_SCOPE_LINK; +- ifm->ifa_index = dev->ifindex; ++ ifm->ifa_index = ifindex; + if (nla_put_u8(skb, IFA_LOCAL, addr)) + goto nla_put_failure; + nlmsg_end(skb, nlh); +@@ -140,7 +141,7 @@ static int getaddr_dumpit(struct sk_buff + if (addr_idx++ < addr_start_idx) + continue; + +- if (fill_addr(skb, pnd->netdev, addr << 2, ++ if (fill_addr(skb, pnd->netdev->ifindex, addr << 2, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, RTM_NEWADDR) < 0) + goto out; diff --git a/queue-6.1/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch b/queue-6.1/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch new file mode 100644 index 0000000000..17c8c240e6 --- /dev/null +++ b/queue-6.1/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch @@ -0,0 +1,114 @@ +From stable+bounces-266798-greg=kroah.com@vger.kernel.org Wed Jun 17 16:45:56 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 10:45:03 -0400 +Subject: phonet: Pass net and ifindex to phonet_address_notify(). +To: stable@vger.kernel.org +Cc: Kuniyuki Iwashima , Eric Dumazet , Paolo Abeni , Sasha Levin +Message-ID: <20260617144504.4144644-2-sashal@kernel.org> + +From: Kuniyuki Iwashima + +[ Upstream commit 68ed5c38b512b734caf3da1f87db4a99fcfe3002 ] + +Currently, phonet_address_notify() fetches netns and ifindex from dev. + +Once addr_doit() is converted to RCU, phonet_address_notify() will be +called outside of RCU due to GFP_KERNEL, and dev will be unavailable +there. + +Let's pass net and ifindex to phonet_address_notify(). + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Signed-off-by: Paolo Abeni +Stable-dep-of: 71de0177b28d ("net: phonet: free phonet_device after RCU grace period") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/phonet/pn_dev.h | 2 +- + net/phonet/pn_dev.c | 10 +++++++--- + net/phonet/pn_netlink.c | 12 ++++++------ + 3 files changed, 14 insertions(+), 10 deletions(-) + +--- a/include/net/phonet/pn_dev.h ++++ b/include/net/phonet/pn_dev.h +@@ -38,7 +38,7 @@ int phonet_address_add(struct net_device + int phonet_address_del(struct net_device *dev, u8 addr); + u8 phonet_address_get(struct net_device *dev, u8 addr); + int phonet_address_lookup(struct net *net, u8 addr); +-void phonet_address_notify(int event, struct net_device *dev, u8 addr); ++void phonet_address_notify(struct net *net, int event, u32 ifindex, u8 addr); + + int phonet_route_add(struct net_device *dev, u8 daddr); + int phonet_route_del(struct net_device *dev, u8 daddr); +--- a/net/phonet/pn_dev.c ++++ b/net/phonet/pn_dev.c +@@ -98,10 +98,13 @@ static void phonet_device_destroy(struct + mutex_unlock(&pndevs->lock); + + if (pnd) { ++ struct net *net = dev_net(dev); ++ u32 ifindex = dev->ifindex; + u8 addr; + + for_each_set_bit(addr, pnd->addrs, 64) +- phonet_address_notify(RTM_DELADDR, dev, addr); ++ phonet_address_notify(net, RTM_DELADDR, ifindex, addr); ++ + kfree(pnd); + } + } +@@ -244,8 +247,9 @@ static int phonet_device_autoconf(struct + ret = phonet_address_add(dev, req.ifr_phonet_autoconf.device); + if (ret) + return ret; +- phonet_address_notify(RTM_NEWADDR, dev, +- req.ifr_phonet_autoconf.device); ++ ++ phonet_address_notify(dev_net(dev), RTM_NEWADDR, dev->ifindex, ++ req.ifr_phonet_autoconf.device); + return 0; + } + +--- a/net/phonet/pn_netlink.c ++++ b/net/phonet/pn_netlink.c +@@ -22,7 +22,7 @@ + static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr, + u32 portid, u32 seq, int event); + +-void phonet_address_notify(int event, struct net_device *dev, u8 addr) ++void phonet_address_notify(struct net *net, int event, u32 ifindex, u8 addr) + { + struct sk_buff *skb; + int err = -ENOBUFS; +@@ -32,17 +32,17 @@ void phonet_address_notify(int event, st + if (skb == NULL) + goto errout; + +- err = fill_addr(skb, dev->ifindex, addr, 0, 0, event); ++ err = fill_addr(skb, ifindex, addr, 0, 0, event); + if (err < 0) { + WARN_ON(err == -EMSGSIZE); + kfree_skb(skb); + goto errout; + } +- rtnl_notify(skb, dev_net(dev), 0, +- RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL); ++ ++ rtnl_notify(skb, net, 0, RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL); + return; + errout: +- rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err); ++ rtnl_set_sk_err(net, RTNLGRP_PHONET_IFADDR, err); + } + + static const struct nla_policy ifa_phonet_policy[IFA_MAX+1] = { +@@ -89,7 +89,7 @@ static int addr_doit(struct sk_buff *skb + else + err = phonet_address_del(dev, pnaddr); + if (!err) +- phonet_address_notify(nlh->nlmsg_type, dev, pnaddr); ++ phonet_address_notify(net, nlh->nlmsg_type, ifm->ifa_index, pnaddr); + return err; + } + diff --git a/queue-6.1/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch b/queue-6.1/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch new file mode 100644 index 0000000000..019d91f544 --- /dev/null +++ b/queue-6.1/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch @@ -0,0 +1,51 @@ +From stable+bounces-268561-greg=kroah.com@vger.kernel.org Thu Jun 25 16:06:49 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:06:00 -0400 +Subject: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails +To: stable@vger.kernel.org +Cc: Stepan Ionichev , Andy Shevchenko , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260625140600.2429183-1-sashal@kernel.org> + +From: Stepan Ionichev + +[ Upstream commit 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 ] + +dw8250_probe() registers the 8250 port via serial8250_register_8250_port() +and then, if the device has a clock, registers a clock notifier. If +clk_notifier_register() fails, probe returns the error but leaves the +8250 port registered. The matching serial8250_unregister_port() lives +in dw8250_remove(), which is not called when probe fails, so the port +slot stays occupied until the device is rebound or the system is +rebooted. The devm-allocated driver data is freed while the port still +references it (via the saved private_data and serial_in/serial_out +callbacks), so any access to that port slot before a rebind is a +use-after-free hazard. + +Unregister the port on the clk_notifier_register() error path. + +Fixes: cc816969d7b5 ("serial: 8250_dw: Fix common clocks usage race condition") +Cc: stable@vger.kernel.org +Signed-off-by: Stepan Ionichev +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20260514143746.23671-2-sozdayvek@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_dw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -673,8 +673,10 @@ static int dw8250_probe(struct platform_ + */ + if (data->clk) { + err = clk_notifier_register(data->clk, &data->clk_notifier); +- if (err) ++ if (err) { ++ serial8250_unregister_port(data->data.line); + return dev_err_probe(dev, err, "Failed to set the clock notifier\n"); ++ } + queue_work(system_unbound_wq, &data->clk_work); + } + diff --git a/queue-6.1/series b/queue-6.1/series index 0923629c9f..cf84113b60 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -109,3 +109,21 @@ nfsd-check-get_user-return-when-reading-princhashlen.patch nfsv4-pnfs-reject-zero-length-r_addr-in-nfs4_decode_mp_ds_addr.patch ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch rpmsg-char-add-lock-to-avoid-race-when-rpmsg-device-is-released.patch +mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch +mptcp-fix-missing-wakeups-in-edge-scenarios.patch +hv-utils-handle-and-propagate-errors-in-kvp_register.patch +misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch +misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch +futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch +drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch +locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch +phonet-pass-ifindex-to-fill_addr.patch +phonet-pass-net-and-ifindex-to-phonet_address_notify.patch +net-phonet-free-phonet_device-after-rcu-grace-period.patch +fuse-re-lock-request-before-replacing-page-cache-folio.patch +serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch +documentation-ioctl-number-extend-include-file-column-width.patch +crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch +crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch +crypto-qat-remove-unused-character-device-and-ioctls.patch +ipv6-account-for-fraggap-on-the-paged-allocation-path.patch