From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 13:50:47 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4ee5f0f3449b736c7f4bfebc9d1c588109b24e4e;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch jbd2-fix-integer-underflow-in-jbd2_journal_initialize_fast_commit.patch lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch nvdimm-btt-free-arenas-on-btt_init-error-paths.patch pinctrl-renesas-rzg2l-use-enotsupp-instead-of-eopnotsupp.patch sunrpc-bound-check-xdr_buf_to_bvec-stores-before-writing.patch sunrpc-harden-rq_procinfo-lifecycle-to-prevent-double-free.patch sunrpc-pin-svc_xprt-across-the-asynchronous-tls-handshake-callback.patch sunrpc-wait-for-in-flight-tls-handshake-callback-when-cancel-loses-race.patch --- diff --git a/queue-7.1/cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch b/queue-7.1/cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch new file mode 100644 index 0000000000..2142e94205 --- /dev/null +++ b/queue-7.1/cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch @@ -0,0 +1,215 @@ +From c268f949e219f9e179558e836f457f6c5fbec416 Mon Sep 17 00:00:00 2001 +From: Terry Bowman +Date: Fri, 5 Jun 2026 13:06:10 -0500 +Subject: cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size + +From: Terry Bowman + +commit c268f949e219f9e179558e836f457f6c5fbec416 upstream. + +The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 +bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing +64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512, +eight times the actual on-device size. + +header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the +RAS capability iomap, overrunning the 88-byte mapping by 448 bytes. +The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE +(512) bytes from its source. For the CPER caller the source is +struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a +stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes +of kernel stack into the trace event ring buffer where userspace can +read it via tracefs. + +Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it, +bringing all iomap readers into agreement on 16 dwords. Userspace tools +such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32) +header_log layout in the cxl_aer_uncorrectable_error trace event. Add +CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event +__array and its memcpy to preserve that ABI. Both callers now pass a +zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only +the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware; +the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring +buffer layout intact. + +[ dj: Replaced 64 with SZ_64 per RichardC ] + +Fixes: 36f257e3b0ba ("acpi/ghes, cxl/pci: Process CXL CPER Protocol Errors") +Fixes: 2905cb5236cb ("cxl/pci: Add (hopeful) error handling support") +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Signed-off-by: Terry Bowman +Reviewed-by: Alison Schofield +Reviewed-by: Dave Jiang +Reviewed-by: Ben Cheatham +Reviewed-by: Richard Cheng +Link: https://patch.msgid.link/20260605180610.2249458-1-terry.bowman@amd.com +Signed-off-by: Dave Jiang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cxl/core/ras.c | 27 ++++++++++++++++++++------- + drivers/cxl/core/trace.h | 24 ++++++++++++++++-------- + drivers/cxl/cxl.h | 14 ++++++++++++-- + 3 files changed, 48 insertions(+), 17 deletions(-) + +--- a/drivers/cxl/core/ras.c ++++ b/drivers/cxl/core/ras.c +@@ -8,6 +8,10 @@ + #include + #include "trace.h" + ++/* Check that UCE header definition is maintained to keep ABI intact */ ++static_assert(CXL_HEADERLOG_TRACE_SIZE_U32 == 128, ++ "rasdaemon ABI requires exactly 128 u32s"); ++ + static void cxl_cper_trace_corr_port_prot_err(struct pci_dev *pdev, + struct cxl_ras_capability_regs ras_cap) + { +@@ -19,6 +23,7 @@ static void cxl_cper_trace_corr_port_pro + static void cxl_cper_trace_uncorr_port_prot_err(struct pci_dev *pdev, + struct cxl_ras_capability_regs ras_cap) + { ++ u32 hl[CXL_HEADERLOG_TRACE_SIZE_U32] = {}; + u32 status = ras_cap.uncor_status & ~ras_cap.uncor_mask; + u32 fe; + +@@ -28,8 +33,8 @@ static void cxl_cper_trace_uncorr_port_p + else + fe = status; + +- trace_cxl_port_aer_uncorrectable_error(&pdev->dev, status, fe, +- ras_cap.header_log); ++ memcpy(hl, ras_cap.header_log, CXL_HEADERLOG_SIZE); ++ trace_cxl_port_aer_uncorrectable_error(&pdev->dev, status, fe, hl); + } + + static void cxl_cper_trace_corr_prot_err(struct cxl_memdev *cxlmd, +@@ -44,6 +49,7 @@ static void + cxl_cper_trace_uncorr_prot_err(struct cxl_memdev *cxlmd, + struct cxl_ras_capability_regs ras_cap) + { ++ u32 hl[CXL_HEADERLOG_TRACE_SIZE_U32] = {}; + u32 status = ras_cap.uncor_status & ~ras_cap.uncor_mask; + u32 fe; + +@@ -53,8 +59,15 @@ cxl_cper_trace_uncorr_prot_err(struct cx + else + fe = status; + +- trace_cxl_aer_uncorrectable_error(cxlmd, status, fe, +- ras_cap.header_log); ++ /* ++ * ras_cap.header_log[] holds CXL_HEADERLOG_SIZE_U32 (16) hardware ++ * dwords. Copy them into the front of a zero-filled ++ * CXL_HEADERLOG_TRACE_SIZE_U32 (128) u32 staging buffer so the trace ++ * event memcpy sees a full 512-byte source and the userspace ABI ++ * (rasdaemon) is preserved. ++ */ ++ memcpy(hl, ras_cap.header_log, CXL_HEADERLOG_SIZE); ++ trace_cxl_aer_uncorrectable_error(cxlmd, status, fe, hl); + } + + static int match_memdev_by_parent(struct device *dev, const void *uport) +@@ -204,12 +217,12 @@ static void header_log_copy(void __iomem + { + void __iomem *addr; + u32 *log_addr; +- int i, log_u32_size = CXL_HEADERLOG_SIZE / sizeof(u32); ++ int i; + + addr = ras_base + CXL_RAS_HEADER_LOG_OFFSET; + log_addr = log; + +- for (i = 0; i < log_u32_size; i++) { ++ for (i = 0; i < CXL_HEADERLOG_SIZE_U32; i++) { + *log_addr = readl(addr); + log_addr++; + addr += sizeof(u32); +@@ -222,7 +235,7 @@ static void header_log_copy(void __iomem + */ + bool cxl_handle_ras(struct device *dev, void __iomem *ras_base) + { +- u32 hl[CXL_HEADERLOG_SIZE_U32]; ++ u32 hl[CXL_HEADERLOG_TRACE_SIZE_U32] = {}; + void __iomem *addr; + u32 status; + u32 fe; +--- a/drivers/cxl/core/trace.h ++++ b/drivers/cxl/core/trace.h +@@ -56,7 +56,7 @@ TRACE_EVENT(cxl_port_aer_uncorrectable_e + __string(host, dev_name(dev->parent)) + __field(u32, status) + __field(u32, first_error) +- __array(u32, header_log, CXL_HEADERLOG_SIZE_U32) ++ __array(u32, header_log, CXL_HEADERLOG_TRACE_SIZE_U32) + ), + TP_fast_assign( + __assign_str(device); +@@ -64,10 +64,14 @@ TRACE_EVENT(cxl_port_aer_uncorrectable_e + __entry->status = status; + __entry->first_error = fe; + /* +- * Embed the 512B headerlog data for user app retrieval and +- * parsing, but no need to print this in the trace buffer. ++ * Embed headerlog data for user app retrieval and parsing, ++ * but no need to print in the trace buffer. Only ++ * CXL_HEADERLOG_SIZE_U32 (16) dwords are hardware data; ++ * the remaining entries preserve the 512-byte ABI layout ++ * rasdaemon depends on and are zero-filled by the caller. + */ +- memcpy(__entry->header_log, hl, CXL_HEADERLOG_SIZE); ++ memcpy(__entry->header_log, hl, ++ CXL_HEADERLOG_TRACE_SIZE_U32 * sizeof(u32)); + ), + TP_printk("device=%s host=%s status: '%s' first_error: '%s'", + __get_str(device), __get_str(host), +@@ -85,7 +89,7 @@ TRACE_EVENT(cxl_aer_uncorrectable_error, + __field(u64, serial) + __field(u32, status) + __field(u32, first_error) +- __array(u32, header_log, CXL_HEADERLOG_SIZE_U32) ++ __array(u32, header_log, CXL_HEADERLOG_TRACE_SIZE_U32) + ), + TP_fast_assign( + __assign_str(memdev); +@@ -94,10 +98,14 @@ TRACE_EVENT(cxl_aer_uncorrectable_error, + __entry->status = status; + __entry->first_error = fe; + /* +- * Embed the 512B headerlog data for user app retrieval and +- * parsing, but no need to print this in the trace buffer. ++ * Embed headerlog data for user app retrieval and parsing, ++ * but no need to print in the trace buffer. Only ++ * CXL_HEADERLOG_SIZE_U32 (16) dwords are hardware data; ++ * the remaining entries preserve the 512-byte ABI layout ++ * rasdaemon depends on and are zero-filled by the caller. + */ +- memcpy(__entry->header_log, hl, CXL_HEADERLOG_SIZE); ++ memcpy(__entry->header_log, hl, ++ CXL_HEADERLOG_TRACE_SIZE_U32 * sizeof(u32)); + ), + TP_printk("memdev=%s host=%s serial=%lld: status: '%s' first_error: '%s'", + __get_str(memdev), __get_str(host), __entry->serial, +--- a/drivers/cxl/cxl.h ++++ b/drivers/cxl/cxl.h +@@ -158,8 +158,18 @@ static inline int ways_to_eiw(unsigned i + #define CXL_RAS_CAP_CONTROL_FE_MASK GENMASK(5, 0) + #define CXL_RAS_HEADER_LOG_OFFSET 0x18 + #define CXL_RAS_CAPABILITY_LENGTH 0x58 +-#define CXL_HEADERLOG_SIZE SZ_512 +-#define CXL_HEADERLOG_SIZE_U32 SZ_512 / sizeof(u32) ++#define CXL_HEADERLOG_SIZE SZ_64 ++#define CXL_HEADERLOG_SIZE_U32 (CXL_HEADERLOG_SIZE / sizeof(u32)) ++ ++/* ++ * The RAS UCE trace event header array was originally sized at SZ_512/sizeof(u32) ++ * = 128 u32s due to a bug. Userspace tools (rasdaemon) have grown a dependency ++ * on that 512-byte layout. Keep the trace array at 128 u32s to preserve the ++ * ABI; only CXL_HEADERLOG_SIZE_U32 (16) dwords are valid hardware data, the ++ * remainder are zero-filled. ++ */ ++#define CXL_HEADERLOG_TRACE_SIZE SZ_512 ++#define CXL_HEADERLOG_TRACE_SIZE_U32 (CXL_HEADERLOG_TRACE_SIZE / sizeof(u32)) + + /* CXL 2.0 8.2.8.1 Device Capabilities Array Register */ + #define CXLDEV_CAP_ARRAY_OFFSET 0x0 diff --git a/queue-7.1/jbd2-fix-integer-underflow-in-jbd2_journal_initialize_fast_commit.patch b/queue-7.1/jbd2-fix-integer-underflow-in-jbd2_journal_initialize_fast_commit.patch new file mode 100644 index 0000000000..24c5d40bd6 --- /dev/null +++ b/queue-7.1/jbd2-fix-integer-underflow-in-jbd2_journal_initialize_fast_commit.patch @@ -0,0 +1,48 @@ +From 289a2ca0c9b7eae74f93fc213b0b971669b8683d Mon Sep 17 00:00:00 2001 +From: Junrui Luo +Date: Wed, 13 May 2026 17:28:40 +0800 +Subject: jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() + +From: Junrui Luo + +commit 289a2ca0c9b7eae74f93fc213b0b971669b8683d upstream. + +jbd2_journal_initialize_fast_commit() validates journal capacity by +checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). +Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds +j_last the subtraction wraps to a large value, bypassing the bounds +check. + +The resulting underflow corrupts j_last, j_fc_first, and j_free, +leading to journal abort. + +Fix by checking num_fc_blks against j_last before the subtraction, +returning -EFSCORRUPTED. + +Fixes: 6866d7b3f2bb ("ext4 / jbd2: add fast commit initialization") +Reported-by: Yuhao Jiang +Cc: stable@vger.kernel.org +Signed-off-by: Junrui Luo +Fixes: e029c5f27987 ("ext4: make num of fast commit blocks configurable") +Reviewed-by: Baokun Li +Fixes: e029c5f279872 ("ext4: make num of fast commit blocks configurable") +Reviewed-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://patch.msgid.link/SYBPR01MB7881663C927DE9D7BBF4D1DFAF062@SYBPR01MB7881.ausprd01.prod.outlook.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/jbd2/journal.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -2263,6 +2263,8 @@ jbd2_journal_initialize_fast_commit(jour + unsigned long long num_fc_blks; + + num_fc_blks = jbd2_journal_get_num_fc_blks(sb); ++ if (num_fc_blks > journal->j_last) ++ return -EFSCORRUPTED; + if (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS) + return -ENOSPC; + diff --git a/queue-7.1/lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch b/queue-7.1/lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch new file mode 100644 index 0000000000..1a2dabf510 --- /dev/null +++ b/queue-7.1/lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch @@ -0,0 +1,38 @@ +From f16a1513452edb532fec81e591c64c320866719c Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 14 May 2026 16:56:04 -0400 +Subject: lockd: Plug nlm_file leak when nlm_do_fopen() fails + +From: Chuck Lever + +commit f16a1513452edb532fec81e591c64c320866719c upstream. + +A client can repeatedly drive nlm_do_fopen() failures by presenting +file handles that the underlying export rejects. After kzalloc_obj() +succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not +yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps +to out_unlock, which releases nlm_file_mutex and returns without +freeing the allocation, so each failure leaks one nlm_file. + +Route the failure through out_free so kfree() runs before the +function returns. + +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/lockd/svcsubs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -165,7 +165,7 @@ nlm_lookup_file(struct svc_rqst *rqstp, + + nfserr = nlm_do_fopen(rqstp, file, mode); + if (nfserr) +- goto out_unlock; ++ goto out_free; + + hlist_add_head(&file->f_list, &nlm_files[hash]); + diff --git a/queue-7.1/lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch b/queue-7.1/lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch new file mode 100644 index 0000000000..ecbbb243b5 --- /dev/null +++ b/queue-7.1/lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch @@ -0,0 +1,42 @@ +From 70a38f87bed7f0694fd07988b47b2db1e10d8df3 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 14 May 2026 16:56:06 -0400 +Subject: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure + +From: Chuck Lever + +commit 70a38f87bed7f0694fd07988b47b2db1e10d8df3 upstream. + +The cached-file path in nlm_lookup_file() reaches the found: label +unconditionally, even when nlm_do_fopen() fails. At that label +*result and file->f_count are updated before the error is returned. +The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then +bail out of their switch without copying *result back to their +caller, so the proc handler's local nlm_file pointer remains NULL +and the cleanup path skips nlm_release_file(). The f_count +increment is never released, and nlm_traverse_files() can no +longer reap the file because its refcount never returns to zero +between requests. + +Short-circuit the cached path so neither *result nor f_count is +touched when nlm_do_fopen() fails on a hashed nlm_file. + +Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file") +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/lockd/svcsubs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/lockd/svcsubs.c ++++ b/fs/lockd/svcsubs.c +@@ -149,6 +149,8 @@ nlm_lookup_file(struct svc_rqst *rqstp, + mutex_lock(&file->f_mutex); + nfserr = nlm_do_fopen(rqstp, file, mode); + mutex_unlock(&file->f_mutex); ++ if (nfserr) ++ goto out_unlock; + goto found; + } + nlm_debug_print_fh("creating file for", &lock->fh); diff --git a/queue-7.1/nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch b/queue-7.1/nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch new file mode 100644 index 0000000000..a51c464425 --- /dev/null +++ b/queue-7.1/nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch @@ -0,0 +1,41 @@ +From 13fe4cd9ddd0aacb7777812328be525a11ea3fea Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Tue, 19 May 2026 11:20:12 +0530 +Subject: nvdimm/btt: Free arena sub-allocations on discover_arenas() error path + +From: Abdun Nihaal + +commit 13fe4cd9ddd0aacb7777812328be525a11ea3fea upstream. + +Memory allocated by btt_freelist_init(), btt_rtt_init(), and +btt_maplocks_init() is not freed on some discover_arenas() error +paths. This leaks memory when arena discovery fails. + +Add the missing kfree() calls to release the allocations before +returning an error. + +[ as: commit message and log edits ] + +Fixes: 5212e11fde4d ("nd_btt: atomic sector updates") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Alison Schofield +Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-1-592300fb7a43@cse.iitm.ac.in +Signed-off-by: Alison Schofield +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvdimm/btt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -919,6 +919,9 @@ static int discover_arenas(struct btt *b + return ret; + + out: ++ kfree(arena->freelist); ++ kfree(arena->rtt); ++ kfree(arena->map_locks); + kfree(arena); + free_arenas(btt); + return ret; diff --git a/queue-7.1/nvdimm-btt-free-arenas-on-btt_init-error-paths.patch b/queue-7.1/nvdimm-btt-free-arenas-on-btt_init-error-paths.patch new file mode 100644 index 0000000000..aaf3a53092 --- /dev/null +++ b/queue-7.1/nvdimm-btt-free-arenas-on-btt_init-error-paths.patch @@ -0,0 +1,72 @@ +From 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Tue, 19 May 2026 11:20:13 +0530 +Subject: nvdimm/btt: Free arenas on btt_init() error paths + +From: Abdun Nihaal + +commit 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 upstream. + +The arenas allocated by discover_arenas() or create_arenas() are not +freed on some error paths in btt_init(). This leaks memory when BTT +initialization fails. + +Call free_arenas() from the affected error paths to release the +allocations. + +[ as: commit message and log edits ] + +Fixes: 5212e11fde4d ("nd_btt: atomic sector updates") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Alison Schofield +Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-2-592300fb7a43@cse.iitm.ac.in +Signed-off-by: Alison Schofield +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvdimm/btt.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -1589,7 +1589,7 @@ static struct btt *btt_init(struct nd_bt + if (btt->init_state != INIT_READY && nd_region->ro) { + dev_warn(dev, "%s is read-only, unable to init btt metadata\n", + dev_name(&nd_region->dev)); +- return NULL; ++ goto err; + } else if (btt->init_state != INIT_READY) { + btt->num_arenas = (rawsize / ARENA_MAX_SIZE) + + ((rawsize % ARENA_MAX_SIZE) ? 1 : 0); +@@ -1599,25 +1599,28 @@ static struct btt *btt_init(struct nd_bt + ret = create_arenas(btt); + if (ret) { + dev_info(dev, "init: create_arenas: %d\n", ret); +- return NULL; ++ goto err; + } + + ret = btt_meta_init(btt); + if (ret) { + dev_err(dev, "init: error in meta_init: %d\n", ret); +- return NULL; ++ goto err; + } + } + + ret = btt_blk_init(btt); + if (ret) { + dev_err(dev, "init: error in blk_init: %d\n", ret); +- return NULL; ++ goto err; + } + + btt_debugfs_init(btt); + + return btt; ++err: ++ free_arenas(btt); ++ return NULL; + } + + /** diff --git a/queue-7.1/pinctrl-renesas-rzg2l-use-enotsupp-instead-of-eopnotsupp.patch b/queue-7.1/pinctrl-renesas-rzg2l-use-enotsupp-instead-of-eopnotsupp.patch new file mode 100644 index 0000000000..9a96f9781a --- /dev/null +++ b/queue-7.1/pinctrl-renesas-rzg2l-use-enotsupp-instead-of-eopnotsupp.patch @@ -0,0 +1,74 @@ +From c1492da3939c89372929e062d731f328f7693f1e Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Fri, 15 May 2026 15:40:07 +0300 +Subject: pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP + +From: Claudiu Beznea + +commit c1492da3939c89372929e062d731f328f7693f1e upstream. + +The pinctrl and GPIO core code make exceptions for the -ENOTSUPP error +code. One such example is gpio_set_config_with_argument_optional(), +which returns success when gpio_set_config_with_argument() returns +-ENOTSUPP, but reports failure for all other error codes. + +Returning -EOPNOTSUPP from the pinctrl driver on the unsupported pinctrl +operation may lead to boot failures when pinctrl drivers implements +struct gpio_chip::set_config, the system uses GPIO hogs, and the +struct gpio_chip::set_config implementation returns -EOPNOTSUPP for the +unsupported operations. + +Return -ENOTSUPP for the unsupported pinctrl operation. + +Fixes: 560c633d378a ("pinctrl: renesas: rzg2l: Drop oen_read and oen_write callbacks") +Fixes: c4c4637eb57f ("pinctrl: renesas: Add RZ/G2L pin and gpio controller driver") +Cc: stable@vger.kernel.org +Signed-off-by: Claudiu Beznea +Reviewed-by: Bartosz Golaszewski +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20260515124008.2947838-2-claudiu.beznea@kernel.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +@@ -1103,7 +1103,7 @@ static int rzg2l_read_oen(struct rzg2l_p + int bit; + + if (!pctrl->data->pin_to_oen_bit) +- return -EOPNOTSUPP; ++ return -ENOTSUPP; + + bit = pctrl->data->pin_to_oen_bit(pctrl, _pin); + if (bit < 0) +@@ -1145,7 +1145,7 @@ static int rzg2l_write_oen(struct rzg2l_ + u8 val; + + if (!pctrl->data->pin_to_oen_bit) +- return -EOPNOTSUPP; ++ return -ENOTSUPP; + + bit = pctrl->data->pin_to_oen_bit(pctrl, _pin); + if (bit < 0) +@@ -1576,7 +1576,7 @@ static int rzg2l_pinctrl_pinconf_set(str + break; + + default: +- return -EOPNOTSUPP; ++ return -ENOTSUPP; + } + } + +@@ -1658,7 +1658,7 @@ static int rzg2l_pinctrl_pinconf_group_g + + /* Check config matching between to pin */ + if (i && prev_config != *config) +- return -EOPNOTSUPP; ++ return -ENOTSUPP; + + prev_config = *config; + } diff --git a/queue-7.1/series b/queue-7.1/series index dee56816a3..81e93372c8 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1665,3 +1665,14 @@ batman-adv-tt-prevent-tvlv-oob-check-overflow.patch cifs-invalidate-cfid-on-unlink-rename-rmdir.patch mfd-tps6586x-fix-of-node-refcount.patch backlight-ktd2801-enable-bl_core_suspendresume.patch +cxl-fix-cxl_headerlog_size-to-match-ras-capability-size.patch +jbd2-fix-integer-underflow-in-jbd2_journal_initialize_fast_commit.patch +nvdimm-btt-free-arenas-on-btt_init-error-paths.patch +nvdimm-btt-free-arena-sub-allocations-on-discover_arenas-error-path.patch +pinctrl-renesas-rzg2l-use-enotsupp-instead-of-eopnotsupp.patch +sunrpc-pin-svc_xprt-across-the-asynchronous-tls-handshake-callback.patch +sunrpc-wait-for-in-flight-tls-handshake-callback-when-cancel-loses-race.patch +sunrpc-harden-rq_procinfo-lifecycle-to-prevent-double-free.patch +lockd-plug-nlm_file-leak-when-nlm_do_fopen-fails.patch +lockd-plug-nlm_file-refcount-leak-on-cached-nlm_do_fopen-failure.patch +sunrpc-bound-check-xdr_buf_to_bvec-stores-before-writing.patch diff --git a/queue-7.1/sunrpc-bound-check-xdr_buf_to_bvec-stores-before-writing.patch b/queue-7.1/sunrpc-bound-check-xdr_buf_to_bvec-stores-before-writing.patch new file mode 100644 index 0000000000..0650852479 --- /dev/null +++ b/queue-7.1/sunrpc-bound-check-xdr_buf_to_bvec-stores-before-writing.patch @@ -0,0 +1,80 @@ +From 42f5b80dda6b86e424054baf1475df686c403d5c Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Tue, 19 May 2026 09:34:21 -0400 +Subject: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing + +From: Chuck Lever + +commit 42f5b80dda6b86e424054baf1475df686c403d5c upstream. + +xdr_buf_to_bvec() writes a bio_vec into the caller's array before +testing whether that slot is in range, and the head branch performs +the store with no check at all. When the caller's budget is exactly +used up, the next store lands one element past the end of the array. +The overflow label returns count - 1, which masks the surplus store +but cannot undo it. + +rq_bvec, the array passed by nfsd_vfs_write(), is allocated to +exactly rq_maxpages entries with no slack. The OOB store can land in +adjacent slab memory; the bv_len and bv_offset fields written there +are derived from client-supplied RPC payload sizes. + +Move the in-range check ahead of the store in the head, page-loop, +and tail branches. With the check at the top of each sequence, count +is incremented only after a successful store, so the overflow label +can return count directly. + +Reported-by: Chris Mason +Fixes: 2eb2b9358181 ("SUNRPC: Convert svc_tcp_sendmsg to use bio_vecs directly") +Cc: stable@vger.kernel.org +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/xdr.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -152,6 +152,8 @@ unsigned int xdr_buf_to_bvec(struct bio_ + unsigned int count = 0; + + if (head->iov_len) { ++ if (unlikely(count >= bvec_size)) ++ goto bvec_overflow; + bvec_set_virt(bvec++, head->iov_base, head->iov_len); + ++count; + } +@@ -165,25 +167,27 @@ unsigned int xdr_buf_to_bvec(struct bio_ + while (remaining > 0) { + len = min_t(unsigned int, remaining, + PAGE_SIZE - offset); ++ if (unlikely(count >= bvec_size)) ++ goto bvec_overflow; + bvec_set_page(bvec++, *pages++, len, offset); + remaining -= len; + offset = 0; +- if (unlikely(++count > bvec_size)) +- goto bvec_overflow; ++ ++count; + } + } + + if (tail->iov_len) { +- bvec_set_virt(bvec, tail->iov_base, tail->iov_len); +- if (unlikely(++count > bvec_size)) ++ if (unlikely(count >= bvec_size)) + goto bvec_overflow; ++ bvec_set_virt(bvec, tail->iov_base, tail->iov_len); ++ ++count; + } + + return count; + + bvec_overflow: + pr_warn_once("%s: bio_vec array overflow\n", __func__); +- return count - 1; ++ return count; + } + EXPORT_SYMBOL_GPL(xdr_buf_to_bvec); + diff --git a/queue-7.1/sunrpc-harden-rq_procinfo-lifecycle-to-prevent-double-free.patch b/queue-7.1/sunrpc-harden-rq_procinfo-lifecycle-to-prevent-double-free.patch new file mode 100644 index 0000000000..a70534eefc --- /dev/null +++ b/queue-7.1/sunrpc-harden-rq_procinfo-lifecycle-to-prevent-double-free.patch @@ -0,0 +1,76 @@ +From 18d216788bef06332ff8901670ecf1ed8f6eb614 Mon Sep 17 00:00:00 2001 +From: Luxiao Xu +Date: Thu, 21 May 2026 15:06:32 +0800 +Subject: sunrpc: harden rq_procinfo lifecycle to prevent double-free + +From: Luxiao Xu + +commit 18d216788bef06332ff8901670ecf1ed8f6eb614 upstream. + +The svc_release_rqst() function executes the callback inside +rqstp->rq_procinfo->pc_release. However, if a worker thread begins +processing a new request and encounters an early error path (e.g., +unsupported protocol, short frame, or bad auth) before a valid +rq_procinfo is installed, a stale release hook can be re-triggered +against reused state from the previous RPC, resulting in a double-free +or use-after-free vulnerability. + +Harden the lifecycle of rq_procinfo by: +1. Ensuring svc_release_rqst() always clears rq_procinfo after the + optional pc_release() call, regardless of whether the hook exists. +2. Explicitly clearing rq_procinfo at request entry in svc_process() + before any early decode or drop paths. +3. Ensuring svc_process_bc() does the same at backchannel entry. + +This guarantees that error flows will not encounter a non-NULL stale +rq_procinfo pointer when there is nothing to release. + +Fixes: d9adbb6e10bf ("sunrpc: delay pc_release callback until after the reply is sent") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Suggested-by: Chuck Lever +Reviewed-by: Jeff Layton +Signed-off-by: Luxiao Xu +Signed-off-by: Ren Wei +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/svc.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1598,6 +1598,12 @@ static void svc_release_rqst(struct svc_ + + if (procp && procp->pc_release) + procp->pc_release(rqstp); ++ ++ /* ++ * A subsequent svc_release_rqst() on this rqstp must not ++ * re-invoke pc_release against released state. ++ */ ++ rqstp->rq_procinfo = NULL; + } + + /** +@@ -1616,6 +1622,9 @@ void svc_process(struct svc_rqst *rqstp) + svc_xprt_deferred_close(rqstp->rq_xprt); + #endif + ++ /* Discard a stale release hook from a previous RPC. */ ++ rqstp->rq_procinfo = NULL; ++ + /* + * Setup response xdr_buf. + * Initially it has just one page +@@ -1672,6 +1681,7 @@ void svc_process_bc(struct rpc_rqst *req + int proc_error; + + /* Build the svc_rqst used by the common processing routine */ ++ rqstp->rq_procinfo = NULL; + rqstp->rq_xid = req->rq_xid; + rqstp->rq_prot = req->rq_xprt->prot; + rqstp->rq_bc_net = req->rq_xprt->xprt_net; diff --git a/queue-7.1/sunrpc-pin-svc_xprt-across-the-asynchronous-tls-handshake-callback.patch b/queue-7.1/sunrpc-pin-svc_xprt-across-the-asynchronous-tls-handshake-callback.patch new file mode 100644 index 0000000000..bb68433fc3 --- /dev/null +++ b/queue-7.1/sunrpc-pin-svc_xprt-across-the-asynchronous-tls-handshake-callback.patch @@ -0,0 +1,88 @@ +From 4f988f3a2808fb659f3880c282041ff067acad78 Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Fri, 22 May 2026 09:39:06 -0400 +Subject: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback + +From: Chris Mason + +commit 4f988f3a2808fb659f3880c282041ff067acad78 upstream. + +svc_tcp_handshake() stores the raw svc_xprt pointer in +tls_handshake_args.ta_data and submits the request through +tls_server_hello_x509(). The handshake core takes only +sock_hold(req->hr_sk); nothing references the embedding struct +svc_sock that svc_tcp_handshake_done() reaches via container_of(). + +Two close races leave the in-flight callback writing through a freed +svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards +its return value: a false return means handshake_complete() has +already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have +finished, yet svc_sock_free() proceeds to kfree(svsk). The +cancel-loser fall-through inside svc_tcp_handshake() itself produces +the same window: when wait_for_completion_interruptible_timeout() +returns <= 0 (timeout or signal) and tls_handshake_cancel() returns +false, the function does not drain, returns, and svc_handle_xprt() +calls svc_xprt_received(), which clears XPT_BUSY and can drop the +last reference. A concurrent close then runs svc_sock_free() while +svc_tcp_handshake_done() is still updating xpt_flags and walking +svsk->sk_handshake_done. + +The corruption surfaces as set_bit/clear_bit RMW into the freed +xpt_flags slab slot and as complete_all() walking and writing the +freed wait_queue_head_t list embedded in sk_handshake_done -- a +slab-corruption primitive, not a benign read. The path is reachable +on any TLS-enabled NFS server whenever a connection close overlaps +the tlshd downcall delivery window; the interruptible wait means +signal delivery suffices, not just SVC_HANDSHAKE_TO expiry. + +Take svc_xprt_get(xprt) immediately before tls_server_hello_x509() +so the in-flight callback owns its own reference. Release it on the +two edges where the callback is guaranteed not to fire -- submission +failure from tls_server_hello_x509() and a successful +tls_handshake_cancel() -- and at the tail of +svc_tcp_handshake_done() after complete_all(). + +Fixes: b3cbf98e2fdf ("SUNRPC: Support TLS handshake in the server-side TCP socket code") +Cc: stable@vger.kernel.org +Signed-off-by: Chris Mason +Assisted-by: kres (claude-opus-4-7) +[cel: rewrote commit message to describe the actual change] +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/svcsock.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -471,6 +471,7 @@ static void svc_tcp_handshake_done(void + } + clear_bit(XPT_HANDSHAKE, &xprt->xpt_flags); + complete_all(&svsk->sk_handshake_done); ++ svc_xprt_put(xprt); + } + + /** +@@ -494,9 +495,13 @@ static void svc_tcp_handshake(struct svc + clear_bit(XPT_TLS_SESSION, &xprt->xpt_flags); + init_completion(&svsk->sk_handshake_done); + ++ /* Pin the transport across the asynchronous handshake callback. */ ++ svc_xprt_get(xprt); ++ + ret = tls_server_hello_x509(&args, GFP_KERNEL); + if (ret) { + trace_svc_tls_not_started(xprt); ++ svc_xprt_put(xprt); + goto out_failed; + } + +@@ -505,6 +510,7 @@ static void svc_tcp_handshake(struct svc + if (ret <= 0) { + if (tls_handshake_cancel(sk)) { + trace_svc_tls_timed_out(xprt); ++ svc_xprt_put(xprt); + goto out_close; + } + } diff --git a/queue-7.1/sunrpc-wait-for-in-flight-tls-handshake-callback-when-cancel-loses-race.patch b/queue-7.1/sunrpc-wait-for-in-flight-tls-handshake-callback-when-cancel-loses-race.patch new file mode 100644 index 0000000000..cf52a3b251 --- /dev/null +++ b/queue-7.1/sunrpc-wait-for-in-flight-tls-handshake-callback-when-cancel-loses-race.patch @@ -0,0 +1,62 @@ +From d00e32f84ca1a77cb67a3fbf59f58dada95f5a21 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Fri, 22 May 2026 09:39:07 -0400 +Subject: sunrpc: wait for in-flight TLS handshake callback when cancel loses race + +From: Chuck Lever + +commit d00e32f84ca1a77cb67a3fbf59f58dada95f5a21 upstream. + +When wait_for_completion_interruptible_timeout() in +svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and +tls_handshake_cancel() then returns false, handshake_complete() has +won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and +is about to invoke svc_tcp_handshake_done(), but the callback's +side effects on xpt_flags and on svsk->sk_handshake_done have not +yet committed. + +The current code reads xpt_flags immediately to decide whether the +session succeeded. Two races result. + +If the callback has executed set_bit(XPT_TLS_SESSION) but not yet +clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session, +enqueues the transport, and returns. svc_xprt_received() then +clears XPT_BUSY, a worker thread picks the transport up, the +dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set, +and xpo_handshake is invoked a second time. That svc_tcp_handshake() +calls init_completion(&svsk->sk_handshake_done) while the original +callback concurrently calls complete_all() on it, corrupting the +embedded swait_queue. + +If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet +entered svc_tcp_handshake_done(), svc_tcp_handshake() reads +XPT_TLS_SESSION as clear and tears the connection down even though +the handshake is about to succeed. + +Wait for the callback to commit before inspecting xpt_flags. The +completion is guaranteed to fire because handshake_complete() +invokes svc_tcp_handshake_done() unconditionally once it has set +HANDSHAKE_F_REQ_COMPLETED. + +Fixes: b3cbf98e2fdf ("SUNRPC: Support TLS handshake in the server-side TCP socket code") +Cc: stable@vger.kernel.org +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/svcsock.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -513,6 +513,10 @@ static void svc_tcp_handshake(struct svc + svc_xprt_put(xprt); + goto out_close; + } ++ /* Cancellation lost to handshake_complete(): the ++ * callback is in flight and should finish quickly. ++ */ ++ wait_for_completion(&svsk->sk_handshake_done); + } + + if (!test_bit(XPT_TLS_SESSION, &xprt->xpt_flags)) {