From: Sasha Levin Date: Tue, 21 Jul 2026 00:55:52 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7890e04c656892089d65d0894628623c0e099034;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/batman-adv-ensure-minimal-ethernet-header-on-tx.patch b/queue-5.10/batman-adv-ensure-minimal-ethernet-header-on-tx.patch new file mode 100644 index 0000000000..6e8d67cd62 --- /dev/null +++ b/queue-5.10/batman-adv-ensure-minimal-ethernet-header-on-tx.patch @@ -0,0 +1,46 @@ +From 34ee5651129814db9e6a01ee857f7679641536a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:32:05 +0200 +Subject: batman-adv: ensure minimal ethernet header on TX + +From: Sven Eckelmann + +commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream. + +As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have +at least eth header len bytes"), it is possible by for a local user with +eBPF TC hook access to attach a tc filter which truncates the packet and +redirects to an batadv interface. But the code assumes that at least +ETH_HLEN bytes are available and thus might read outside of the available +buffer. + +The batadv_interface_tx() must therefore always check itself if enough data +is available for the ethernet header and don't rely on min_header_len. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Reported-by: Sashiko +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 8b4a8e80c0a320..c044d0d46bf808 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -210,6 +210,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) + goto dropped; + ++ if (!pskb_may_pull(skb, ETH_HLEN)) ++ goto dropped; ++ + /* reset control block to avoid left overs from previous users */ + memset(skb->cb, 0, sizeof(struct batadv_skb_cb)); + +-- +2.53.0 + diff --git a/queue-5.10/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch b/queue-5.10/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch new file mode 100644 index 0000000000..e1c19f0742 --- /dev/null +++ b/queue-5.10/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch @@ -0,0 +1,42 @@ +From 30f900e8a012532110896a87b24c3d7a07a05480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:24:35 +0200 +Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX + +From: Sven Eckelmann + +commit 035e1fed892d3d06002a73ff73668f618a514644 upstream. + +pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind +the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the VLAN header but missed for the ethernet +header which is later used for the TT and AP isolation handling. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header") +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index c8c62b0cd54c76..8b4a8e80c0a320 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -454,6 +454,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + ++ ethhdr = eth_hdr(skb); + vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ +-- +2.53.0 + diff --git a/queue-5.10/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch b/queue-5.10/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch new file mode 100644 index 0000000000..10d1b2ae1d --- /dev/null +++ b/queue-5.10/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch @@ -0,0 +1,51 @@ +From 0c0510e0f1a6c3028e617cfdc5e68135d7e83398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 09:54:15 -0400 +Subject: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error + path + +From: Shivam Kumar + +commit 4606467a75cfc16721937272ed29462a750b60c8 upstream. + +In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, +nvmet_req_uninit() is called unconditionally. However, if the command +arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() +had returned false and percpu_ref_tryget_live() was never executed. The +unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a +refcount underflow, leading to a WARNING in +percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and +eventually a permanent workqueue deadlock. + +Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling +nvmet_req_uninit(), matching the existing pattern in +nvmet_tcp_execute_request(). + +Reviewed-by: Christoph Hellwig +Signed-off-by: Shivam Kumar +Signed-off-by: Keith Busch +[shivam: inlined nvmet_tcp_finish_cmd() at the fix site for 5.10.y] +Signed-off-by: Shivam Kumar +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 4bd82e9b113ff5..3d9a830950ef26 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1227,7 +1227,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue) + queue->idx, cmd->req.cmd->common.command_id, + queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst), + le32_to_cpu(cmd->exp_ddgst)); +- nvmet_tcp_finish_cmd(cmd); ++ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED)) ++ nvmet_req_uninit(&cmd->req); ++ nvmet_tcp_free_cmd_buffers(cmd); + nvmet_tcp_fatal_error(queue); + ret = -EPROTO; + goto out; +-- +2.53.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 451ed375c1..4b2ba02661 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -534,3 +534,6 @@ ieee802154-admin-gate-legacy-llsec-dump-operations.patch ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch +nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch +batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch +batman-adv-ensure-minimal-ethernet-header-on-tx.patch diff --git a/queue-5.15/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch b/queue-5.15/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch new file mode 100644 index 0000000000..6d413ebc2b --- /dev/null +++ b/queue-5.15/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch @@ -0,0 +1,112 @@ +From f426a180a5cd9299c65f4372ce877d546eb374a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:49:54 +0200 +Subject: batman-adv: clean untagged VLAN on netdev registration failure + +From: Sven Eckelmann + +commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream. + +When an mesh interface is registered, it creates an untagged struct +batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in +this process, another receiver of this notification can veto the +registration. The netdev registration will be aborted because of this veto. + +The register_netdevice() call will try to clean up the net_device using +unregister_netdevice_queue() - which only uses the .priv_destructor to +free private resources. In this situation, .dellink will not be called. + +The cleanup of the untagged batadv_meshif_vlan must thefore be done in the +destructor to avoid a leak of this object. + +Cc: stable@vger.kernel.org +Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") +[ switch to old "mesh_iface" name "soft_iface" ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/main.c | 8 ++++++++ + net/batman-adv/soft-interface.c | 13 ++----------- + net/batman-adv/soft-interface.h | 2 ++ + 3 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c +index 1074e4762a1e6b..1a65dfd0c4c5b6 100644 +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -258,6 +258,7 @@ int batadv_mesh_init(struct net_device *soft_iface) + void batadv_mesh_free(struct net_device *soft_iface) + { + struct batadv_priv *bat_priv = netdev_priv(soft_iface); ++ struct batadv_softif_vlan *vlan; + + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); + +@@ -273,6 +274,13 @@ void batadv_mesh_free(struct net_device *soft_iface) + + batadv_mcast_free(bat_priv); + ++ /* destroy the "untagged" VLAN */ ++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); ++ if (vlan) { ++ batadv_softif_destroy_vlan(bat_priv, vlan); ++ batadv_softif_vlan_put(vlan); ++ } ++ + /* Free the TT and the originator tables only after having terminated + * all the other depending components which may use these structures for + * their purposes. +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index bdd6dd7fa77588..ef67bac290e36e 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -605,8 +605,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid) + * @bat_priv: the bat priv with all the soft interface information + * @vlan: the object to remove + */ +-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, +- struct batadv_softif_vlan *vlan) ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan) + { + /* explicitly remove the associated TT local entry because it is marked + * with the NOPURGE flag +@@ -1088,22 +1088,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev, + static void batadv_softif_destroy_netlink(struct net_device *soft_iface, + struct list_head *head) + { +- struct batadv_priv *bat_priv = netdev_priv(soft_iface); + struct batadv_hard_iface *hard_iface; +- struct batadv_softif_vlan *vlan; + + list_for_each_entry(hard_iface, &batadv_hardif_list, list) { + if (hard_iface->soft_iface == soft_iface) + batadv_hardif_disable_interface(hard_iface); + } + +- /* destroy the "untagged" VLAN */ +- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); +- if (vlan) { +- batadv_softif_destroy_vlan(bat_priv, vlan); +- batadv_softif_vlan_put(vlan); +- } +- + unregister_netdevice_queue(soft_iface, head); + } + +diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h +index 9f2003f1a4972e..13709a5d23e3bf 100644 +--- a/net/batman-adv/soft-interface.h ++++ b/net/batman-adv/soft-interface.h +@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface, + bool batadv_softif_is_valid(const struct net_device *net_dev); + extern struct rtnl_link_ops batadv_link_ops; + int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan); + void batadv_softif_vlan_release(struct kref *ref); + struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv, + unsigned short vid); +-- +2.53.0 + diff --git a/queue-5.15/batman-adv-ensure-minimal-ethernet-header-on-tx.patch b/queue-5.15/batman-adv-ensure-minimal-ethernet-header-on-tx.patch new file mode 100644 index 0000000000..e7c324766b --- /dev/null +++ b/queue-5.15/batman-adv-ensure-minimal-ethernet-header-on-tx.patch @@ -0,0 +1,46 @@ +From 113ad00cf6af4bf0cad9fe1e06c1241f8dcb27ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:34:30 +0200 +Subject: batman-adv: ensure minimal ethernet header on TX + +From: Sven Eckelmann + +commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream. + +As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have +at least eth header len bytes"), it is possible by for a local user with +eBPF TC hook access to attach a tc filter which truncates the packet and +redirects to an batadv interface. But the code assumes that at least +ETH_HLEN bytes are available and thus might read outside of the available +buffer. + +The batadv_interface_tx() must therefore always check itself if enough data +is available for the ethernet header and don't rely on min_header_len. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Reported-by: Sashiko +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 21297af54e4ea7..bdd6dd7fa77588 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -208,6 +208,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) + goto dropped; + ++ if (!pskb_may_pull(skb, ETH_HLEN)) ++ goto dropped; ++ + /* reset control block to avoid left overs from previous users */ + memset(skb->cb, 0, sizeof(struct batadv_skb_cb)); + +-- +2.53.0 + diff --git a/queue-5.15/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch b/queue-5.15/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch new file mode 100644 index 0000000000..fadf2e93da --- /dev/null +++ b/queue-5.15/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch @@ -0,0 +1,42 @@ +From f8493ab8c4c76a0701a6028ba9c016af02e72105 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:26:40 +0200 +Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX + +From: Sven Eckelmann + +commit 035e1fed892d3d06002a73ff73668f618a514644 upstream. + +pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind +the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the VLAN header but missed for the ethernet +header which is later used for the TT and AP isolation handling. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header") +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index b46480ec7bd1d0..21297af54e4ea7 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -444,6 +444,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + ++ ethhdr = eth_hdr(skb); + vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ +-- +2.53.0 + diff --git a/queue-5.15/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch b/queue-5.15/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch new file mode 100644 index 0000000000..a98a51b149 --- /dev/null +++ b/queue-5.15/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch @@ -0,0 +1,51 @@ +From da366bd14f5d4b6ff81b2c194415a927cbbd010e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 09:45:50 -0400 +Subject: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error + path + +From: Shivam Kumar + +commit 4606467a75cfc16721937272ed29462a750b60c8 upstream. + +In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, +nvmet_req_uninit() is called unconditionally. However, if the command +arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() +had returned false and percpu_ref_tryget_live() was never executed. The +unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a +refcount underflow, leading to a WARNING in +percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and +eventually a permanent workqueue deadlock. + +Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling +nvmet_req_uninit(), matching the existing pattern in +nvmet_tcp_execute_request(). + +Reviewed-by: Christoph Hellwig +Signed-off-by: Shivam Kumar +Signed-off-by: Keith Busch +[shivam: inlined nvmet_tcp_finish_cmd() at the fix site for 5.15.y] +Signed-off-by: Shivam Kumar +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 06cfcf0850076b..95081052dce78f 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1239,7 +1239,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue) + queue->idx, cmd->req.cmd->common.command_id, + queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst), + le32_to_cpu(cmd->exp_ddgst)); +- nvmet_tcp_finish_cmd(cmd); ++ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED)) ++ nvmet_req_uninit(&cmd->req); ++ nvmet_tcp_free_cmd_buffers(cmd); + nvmet_tcp_fatal_error(queue); + ret = -EPROTO; + goto out; +-- +2.53.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 62ce89e819..35d6756b96 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -689,3 +689,7 @@ ieee802154-admin-gate-legacy-llsec-dump-operations.patch ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch +nvmet-tcp-check-init_failed-before-nvmet_req_uninit-.patch +batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch +batman-adv-ensure-minimal-ethernet-header-on-tx.patch +batman-adv-clean-untagged-vlan-on-netdev-registratio.patch diff --git a/queue-6.1/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch b/queue-6.1/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch new file mode 100644 index 0000000000..be45b288de --- /dev/null +++ b/queue-6.1/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch @@ -0,0 +1,112 @@ +From 4765ada1d07816e0cce8cb24236b8015a00bcf75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:52:01 +0200 +Subject: batman-adv: clean untagged VLAN on netdev registration failure + +From: Sven Eckelmann + +commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream. + +When an mesh interface is registered, it creates an untagged struct +batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in +this process, another receiver of this notification can veto the +registration. The netdev registration will be aborted because of this veto. + +The register_netdevice() call will try to clean up the net_device using +unregister_netdevice_queue() - which only uses the .priv_destructor to +free private resources. In this situation, .dellink will not be called. + +The cleanup of the untagged batadv_meshif_vlan must thefore be done in the +destructor to avoid a leak of this object. + +Cc: stable@vger.kernel.org +Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") +[ switch to old "mesh_iface" name "soft_iface" ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/main.c | 8 ++++++++ + net/batman-adv/soft-interface.c | 13 ++----------- + net/batman-adv/soft-interface.h | 2 ++ + 3 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c +index 28f616b8891a12..417de98c39a7be 100644 +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -258,6 +258,7 @@ int batadv_mesh_init(struct net_device *soft_iface) + void batadv_mesh_free(struct net_device *soft_iface) + { + struct batadv_priv *bat_priv = netdev_priv(soft_iface); ++ struct batadv_softif_vlan *vlan; + + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); + +@@ -273,6 +274,13 @@ void batadv_mesh_free(struct net_device *soft_iface) + + batadv_mcast_free(bat_priv); + ++ /* destroy the "untagged" VLAN */ ++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); ++ if (vlan) { ++ batadv_softif_destroy_vlan(bat_priv, vlan); ++ batadv_softif_vlan_put(vlan); ++ } ++ + /* Free the TT and the originator tables only after having terminated + * all the other depending components which may use these structures for + * their purposes. +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index a8239902b4428c..57962ed4285b3f 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -605,8 +605,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid) + * @bat_priv: the bat priv with all the soft interface information + * @vlan: the object to remove + */ +-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, +- struct batadv_softif_vlan *vlan) ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan) + { + /* explicitly remove the associated TT local entry because it is marked + * with the NOPURGE flag +@@ -1088,22 +1088,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev, + static void batadv_softif_destroy_netlink(struct net_device *soft_iface, + struct list_head *head) + { +- struct batadv_priv *bat_priv = netdev_priv(soft_iface); + struct batadv_hard_iface *hard_iface; +- struct batadv_softif_vlan *vlan; + + list_for_each_entry(hard_iface, &batadv_hardif_list, list) { + if (hard_iface->soft_iface == soft_iface) + batadv_hardif_disable_interface(hard_iface); + } + +- /* destroy the "untagged" VLAN */ +- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); +- if (vlan) { +- batadv_softif_destroy_vlan(bat_priv, vlan); +- batadv_softif_vlan_put(vlan); +- } +- + unregister_netdevice_queue(soft_iface, head); + } + +diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h +index 9f2003f1a4972e..13709a5d23e3bf 100644 +--- a/net/batman-adv/soft-interface.h ++++ b/net/batman-adv/soft-interface.h +@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface, + bool batadv_softif_is_valid(const struct net_device *net_dev); + extern struct rtnl_link_ops batadv_link_ops; + int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan); + void batadv_softif_vlan_release(struct kref *ref); + struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv, + unsigned short vid); +-- +2.53.0 + diff --git a/queue-6.1/batman-adv-ensure-minimal-ethernet-header-on-tx.patch b/queue-6.1/batman-adv-ensure-minimal-ethernet-header-on-tx.patch new file mode 100644 index 0000000000..30c38034bd --- /dev/null +++ b/queue-6.1/batman-adv-ensure-minimal-ethernet-header-on-tx.patch @@ -0,0 +1,46 @@ +From 0f3a32b1cd0ad0d88507a9a9adc8d833935dc21d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:36:57 +0200 +Subject: batman-adv: ensure minimal ethernet header on TX + +From: Sven Eckelmann + +commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream. + +As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have +at least eth header len bytes"), it is possible by for a local user with +eBPF TC hook access to attach a tc filter which truncates the packet and +redirects to an batadv interface. But the code assumes that at least +ETH_HLEN bytes are available and thus might read outside of the available +buffer. + +The batadv_interface_tx() must therefore always check itself if enough data +is available for the ethernet header and don't rely on min_header_len. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Reported-by: Sashiko +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 40354da5c5b555..a8239902b4428c 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -208,6 +208,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) + goto dropped; + ++ if (!pskb_may_pull(skb, ETH_HLEN)) ++ goto dropped; ++ + /* reset control block to avoid left overs from previous users */ + memset(skb->cb, 0, sizeof(struct batadv_skb_cb)); + +-- +2.53.0 + diff --git a/queue-6.1/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch b/queue-6.1/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch new file mode 100644 index 0000000000..57a8c84377 --- /dev/null +++ b/queue-6.1/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch @@ -0,0 +1,42 @@ +From ac38b597fd0a0b12b2cb5d5e21f816004966c76d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:18:32 +0200 +Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX + +From: Sven Eckelmann + +commit 035e1fed892d3d06002a73ff73668f618a514644 upstream. + +pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind +the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the VLAN header but missed for the ethernet +header which is later used for the TT and AP isolation handling. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header") +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index c0549abcae7a64..40354da5c5b555 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -444,6 +444,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + ++ ethhdr = eth_hdr(skb); + vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ +-- +2.53.0 + diff --git a/queue-6.1/mm-damon-reclaim-fix-typo-in-damon_reclaim_timer_fn.patch b/queue-6.1/mm-damon-reclaim-fix-typo-in-damon_reclaim_timer_fn.patch new file mode 100644 index 0000000000..fd19fd140f --- /dev/null +++ b/queue-6.1/mm-damon-reclaim-fix-typo-in-damon_reclaim_timer_fn.patch @@ -0,0 +1,43 @@ +From df20ce7a1b9204bc1d17bf14e9897f96d05ab9c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 17:47:08 +0800 +Subject: mm/damon/reclaim: fix typo in damon_reclaim_timer_fn() + +From: Liew Rui Yan + +Commit 2f54908fae211 ("mm/damon/reclaim: detect and use fresh enabled +and kdamond_pid values") introduced a typo in damon_reclaim_timer_fn() +where '!=' was used instead of '==' (unlike damon_lru_sort_timer_fn()). +This caused damon_reclaim to return early during the delayed work, +breaking early boot parameter configuration like +'damon_reclaim.enabled=Y'. + +Fix this by changing '!=' to '=='. + +Fixes: 2f54908fae21 ("mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values") +Cc: # 6.1.x +Reported-by: Yikai Zhao +Closes: https://lore.kernel.org/CANMyjpgq5n0Ekt4dgyLRHGb89_Ew0aOMZ3j32V_w0GjHkqH1FQ@mail.gmail.com +Reviewed-by: SJ Park +Signed-off-by: Liew Rui Yan +Signed-off-by: Sasha Levin +--- + mm/damon/reclaim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/damon/reclaim.c b/mm/damon/reclaim.c +index 016cd8d83ca9de..bb4b705d842c1d 100644 +--- a/mm/damon/reclaim.c ++++ b/mm/damon/reclaim.c +@@ -198,7 +198,7 @@ static void damon_reclaim_timer_fn(struct work_struct *work) + bool now_enabled; + + now_enabled = enabled; +- if (damon_reclaim_enabled() != now_enabled) ++ if (damon_reclaim_enabled() == now_enabled) + return; + damon_reclaim_turn(now_enabled); + } +-- +2.53.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 1bd306a684..314487b1d4 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -886,3 +886,7 @@ ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch +mm-damon-reclaim-fix-typo-in-damon_reclaim_timer_fn.patch +batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch +batman-adv-ensure-minimal-ethernet-header-on-tx.patch +batman-adv-clean-untagged-vlan-on-netdev-registratio.patch diff --git a/queue-6.12/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch b/queue-6.12/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch new file mode 100644 index 0000000000..ec7abb4150 --- /dev/null +++ b/queue-6.12/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch @@ -0,0 +1,112 @@ +From 249a45f5f963290add20f5a60e5ff1221eb4c52e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:42:34 +0200 +Subject: batman-adv: clean untagged VLAN on netdev registration failure + +From: Sven Eckelmann + +commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream. + +When an mesh interface is registered, it creates an untagged struct +batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in +this process, another receiver of this notification can veto the +registration. The netdev registration will be aborted because of this veto. + +The register_netdevice() call will try to clean up the net_device using +unregister_netdevice_queue() - which only uses the .priv_destructor to +free private resources. In this situation, .dellink will not be called. + +The cleanup of the untagged batadv_meshif_vlan must thefore be done in the +destructor to avoid a leak of this object. + +Cc: stable@vger.kernel.org +Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") +[ switch to old "mesh_iface" name "soft_iface" ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/main.c | 8 ++++++++ + net/batman-adv/soft-interface.c | 13 ++----------- + net/batman-adv/soft-interface.h | 2 ++ + 3 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c +index ac7fa70c09ca85..87f798701dabdc 100644 +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -259,6 +259,7 @@ int batadv_mesh_init(struct net_device *soft_iface) + void batadv_mesh_free(struct net_device *soft_iface) + { + struct batadv_priv *bat_priv = netdev_priv(soft_iface); ++ struct batadv_softif_vlan *vlan; + + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); + +@@ -274,6 +275,13 @@ void batadv_mesh_free(struct net_device *soft_iface) + + batadv_mcast_free(bat_priv); + ++ /* destroy the "untagged" VLAN */ ++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); ++ if (vlan) { ++ batadv_softif_destroy_vlan(bat_priv, vlan); ++ batadv_softif_vlan_put(vlan); ++ } ++ + /* Free the TT and the originator tables only after having terminated + * all the other depending components which may use these structures for + * their purposes. +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index bc72238e7a08c3..aaebe74c1bc0a9 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -606,8 +606,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid) + * @bat_priv: the bat priv with all the soft interface information + * @vlan: the object to remove + */ +-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, +- struct batadv_softif_vlan *vlan) ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan) + { + /* explicitly remove the associated TT local entry because it is marked + * with the NOPURGE flag +@@ -1103,22 +1103,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev, + static void batadv_softif_destroy_netlink(struct net_device *soft_iface, + struct list_head *head) + { +- struct batadv_priv *bat_priv = netdev_priv(soft_iface); + struct batadv_hard_iface *hard_iface; +- struct batadv_softif_vlan *vlan; + + list_for_each_entry(hard_iface, &batadv_hardif_list, list) { + if (hard_iface->soft_iface == soft_iface) + batadv_hardif_disable_interface(hard_iface); + } + +- /* destroy the "untagged" VLAN */ +- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); +- if (vlan) { +- batadv_softif_destroy_vlan(bat_priv, vlan); +- batadv_softif_vlan_put(vlan); +- } +- + unregister_netdevice_queue(soft_iface, head); + } + +diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h +index 9f2003f1a4972e..13709a5d23e3bf 100644 +--- a/net/batman-adv/soft-interface.h ++++ b/net/batman-adv/soft-interface.h +@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface, + bool batadv_softif_is_valid(const struct net_device *net_dev); + extern struct rtnl_link_ops batadv_link_ops; + int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan); + void batadv_softif_vlan_release(struct kref *ref); + struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv, + unsigned short vid); +-- +2.53.0 + diff --git a/queue-6.12/batman-adv-ensure-minimal-ethernet-header-on-tx.patch b/queue-6.12/batman-adv-ensure-minimal-ethernet-header-on-tx.patch new file mode 100644 index 0000000000..00213d0f0b --- /dev/null +++ b/queue-6.12/batman-adv-ensure-minimal-ethernet-header-on-tx.patch @@ -0,0 +1,46 @@ +From 7c30877e2034ce21d3dcc3247a7fcb7f9a8b151e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:29:51 +0200 +Subject: batman-adv: ensure minimal ethernet header on TX + +From: Sven Eckelmann + +commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream. + +As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have +at least eth header len bytes"), it is possible by for a local user with +eBPF TC hook access to attach a tc filter which truncates the packet and +redirects to an batadv interface. But the code assumes that at least +ETH_HLEN bytes are available and thus might read outside of the available +buffer. + +The batadv_interface_tx() must therefore always check itself if enough data +is available for the ethernet header and don't rely on min_header_len. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Reported-by: Sashiko +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 42ad04d356904f..bc72238e7a08c3 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -206,6 +206,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) + goto dropped; + ++ if (!pskb_may_pull(skb, ETH_HLEN)) ++ goto dropped; ++ + /* reset control block to avoid left overs from previous users */ + memset(skb->cb, 0, sizeof(struct batadv_skb_cb)); + +-- +2.53.0 + diff --git a/queue-6.12/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch b/queue-6.12/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch new file mode 100644 index 0000000000..9bc623861e --- /dev/null +++ b/queue-6.12/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch @@ -0,0 +1,42 @@ +From 568d4667764e12e5901eadb7f5bc7f7b45dd9629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:14:59 +0200 +Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX + +From: Sven Eckelmann + +commit 035e1fed892d3d06002a73ff73668f618a514644 upstream. + +pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind +the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the VLAN header but missed for the ethernet +header which is later used for the TT and AP isolation handling. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header") +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index f46064333f3343..42ad04d356904f 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -445,6 +445,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + ++ ethhdr = eth_hdr(skb); + vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ +-- +2.53.0 + diff --git a/queue-6.12/rust-block-allow-deprecated-for-fetch_update-for-rus.patch b/queue-6.12/rust-block-allow-deprecated-for-fetch_update-for-rus.patch new file mode 100644 index 0000000000..cc0d604ed4 --- /dev/null +++ b/queue-6.12/rust-block-allow-deprecated-for-fetch_update-for-rus.patch @@ -0,0 +1,68 @@ +From 90aa57c12d20338849eb75b59b5c1a60fc3affaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jul 2026 20:23:23 +0200 +Subject: rust: block: `allow(deprecated)` for `fetch_update` for Rust >= + 1.99.0 + +From: Miguel Ojeda + +Starting with Rust 1.99.0 (expected 2026-10-01), the +`Atomic*::fetch_update` method is deprecated, with the compiler suggesting +the `try_update` alias instead: + + error: use of deprecated method `core::sync::atomic::Atomic::::fetch_update`: renamed to `try_update` for consistency + --> rust/kernel/block/mq/request.rs:206:22 + | + 206 | let old = target.fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x))); + | ^^^^^^^^^^^^ + | + = note: `-D deprecated` implied by `-D warnings` + = help: to override `-D warnings` add `#[allow(deprecated)]` + help: replace the use of the deprecated method + | + 206 - let old = target.fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x))); + 206 + let old = target.try_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x))); + | + +The deprecation was added in Rust 1.95.0 [1], but only triggers starting +with Rust 1.99.0. + +However, we cannot use the alias since our minimum in 6.12.y is Rust +1.78.0 -- `try_update` was added in Rust 1.86.0 [2]. + +Thus just allow the lint. + +Cc: Andreas Hindborg +Cc: Boqun Feng +Cc: Jens Axboe +Link: https://github.com/rust-lang/rust/pull/148590 [1] +Link: https://github.com/rust-lang/rust/pull/133829 [2] +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + rust/kernel/block/mq/request.rs | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/rust/kernel/block/mq/request.rs b/rust/kernel/block/mq/request.rs +index 7943f43b957532..1c793765354260 100644 +--- a/rust/kernel/block/mq/request.rs ++++ b/rust/kernel/block/mq/request.rs +@@ -203,6 +203,7 @@ unsafe impl Sync for Request {} + /// Store the result of `op(target.load())` in target, returning new value of + /// target. + fn atomic_relaxed_op_return(target: &AtomicU64, op: impl Fn(u64) -> u64) -> u64 { ++ #[allow(deprecated)] + let old = target.fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| Some(op(x))); + + // SAFETY: Because the operation passed to `fetch_update` above always +@@ -215,6 +216,7 @@ fn atomic_relaxed_op_return(target: &AtomicU64, op: impl Fn(u64) -> u64) -> u64 + /// Store the result of `op(target.load)` in `target` if `target.load() != + /// pred`, returning [`true`] if the target was updated. + fn atomic_relaxed_op_unless(target: &AtomicU64, op: impl Fn(u64) -> u64, pred: u64) -> bool { ++ #[allow(deprecated)] + target + .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |x| { + if x == pred { +-- +2.53.0 + diff --git a/queue-6.12/s390-revert-support-for-dcache_word_access.patch b/queue-6.12/s390-revert-support-for-dcache_word_access.patch new file mode 100644 index 0000000000..8de5f70cfc --- /dev/null +++ b/queue-6.12/s390-revert-support-for-dcache_word_access.patch @@ -0,0 +1,152 @@ +From f7d28c7571b2147d4d74a248d19765a7d9202766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 14:20:44 +0200 +Subject: s390: Revert support for DCACHE_WORD_ACCESS + +From: Heiko Carstens + +commit 37540b8c287fc817bdbd0c62bb75ad6eab0e5d03 upstream. + +load_unaligned_zeropad() reads eight bytes from unaligned addresses and may +cross page boundaries. It handles exceptions which may happen if reading +from the second page results in an exception. + +For pages which are donated to the Ultravisor for secure execution purposes +the do_secure_storage_access() exception handler however does not handle +such exceptions correctly. Such an exception may result in an endless +exception loop which will never be resolved. + +An attempt to fix this [1] turned out to be not sufficient. For now revert +load_unaligned_zeropad() until this problem has been resolved in a proper +way. + +Note that the implementation of load_unaligned_zeropad() itself is +correct. The revert is just a temporary workaround until there is complete +fix for secure storage access exceptions. + +[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory") + +Fixes: 802ba53eefc5 ("s390: add support for DCACHE_WORD_ACCESS") +Cc: stable@vger.kernel.org +Acked-by: Christian Borntraeger +Signed-off-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/Kconfig | 1 - + arch/s390/include/asm/asm-extable.h | 4 ---- + arch/s390/include/asm/word-at-a-time.h | 22 ---------------------- + arch/s390/mm/extable.c | 18 ------------------ + 4 files changed, 45 deletions(-) + +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index 5e6aebf1b739a6..28e900e5212ca1 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -137,7 +137,6 @@ config S390 + select ARCH_WANT_LD_ORPHAN_WARN + select BUILDTIME_TABLE_SORT + select CLONE_BACKWARDS2 +- select DCACHE_WORD_ACCESS if !KMSAN + select DYNAMIC_FTRACE if FUNCTION_TRACER + select FUNCTION_ALIGNMENT_8B if CC_IS_GCC + select FUNCTION_ALIGNMENT_16B if !CC_IS_GCC +diff --git a/arch/s390/include/asm/asm-extable.h b/arch/s390/include/asm/asm-extable.h +index 00a67464c44534..f87e06ec86ac67 100644 +--- a/arch/s390/include/asm/asm-extable.h ++++ b/arch/s390/include/asm/asm-extable.h +@@ -13,7 +13,6 @@ + #define EX_TYPE_UA_LOAD_MEM 4 + #define EX_TYPE_UA_LOAD_REG 5 + #define EX_TYPE_UA_LOAD_REGPAIR 6 +-#define EX_TYPE_ZEROPAD 7 + #define EX_TYPE_FPC 8 + + #define EX_DATA_REG_ERR_SHIFT 0 +@@ -82,9 +81,6 @@ + #define EX_TABLE_UA_LOAD_REGPAIR(_fault, _target, _regerr, _regzero) \ + __EX_TABLE(__ex_table, _fault, _target, EX_TYPE_UA_LOAD_REGPAIR, _regerr, _regzero, 0) + +-#define EX_TABLE_ZEROPAD(_fault, _target, _regdata, _regaddr) \ +- __EX_TABLE(__ex_table, _fault, _target, EX_TYPE_ZEROPAD, _regdata, _regaddr, 0) +- + #define EX_TABLE_FPC(_fault, _target) \ + __EX_TABLE(__ex_table, _fault, _target, EX_TYPE_FPC, __stringify(%%r0), __stringify(%%r0), 0) + +diff --git a/arch/s390/include/asm/word-at-a-time.h b/arch/s390/include/asm/word-at-a-time.h +index 203acd6e431b12..e9287036392d08 100644 +--- a/arch/s390/include/asm/word-at-a-time.h ++++ b/arch/s390/include/asm/word-at-a-time.h +@@ -4,7 +4,6 @@ + + #include + #include +-#include + #include + + struct word_at_a_time { +@@ -41,25 +40,4 @@ static inline unsigned long zero_bytemask(unsigned long data) + return ~1UL << data; + } + +-/* +- * Load an unaligned word from kernel space. +- * +- * In the (very unlikely) case of the word being a page-crosser +- * and the next page not being mapped, take the exception and +- * return zeroes in the non-existing part. +- */ +-static inline unsigned long load_unaligned_zeropad(const void *addr) +-{ +- unsigned long data; +- +- asm volatile( +- "0: lg %[data],0(%[addr])\n" +- "1: nopr %%r7\n" +- EX_TABLE_ZEROPAD(0b, 1b, %[data], %[addr]) +- EX_TABLE_ZEROPAD(1b, 1b, %[data], %[addr]) +- : [data] "=d" (data) +- : [addr] "a" (addr), "m" (*(unsigned long *)addr)); +- return data; +-} +- + #endif /* _ASM_WORD_AT_A_TIME_H */ +diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c +index 812ec5be129169..30e4b96be20727 100644 +--- a/arch/s390/mm/extable.c ++++ b/arch/s390/mm/extable.c +@@ -61,22 +61,6 @@ static bool ex_handler_ua_load_reg(const struct exception_table_entry *ex, + return true; + } + +-static bool ex_handler_zeropad(const struct exception_table_entry *ex, struct pt_regs *regs) +-{ +- unsigned int reg_addr = FIELD_GET(EX_DATA_REG_ADDR, ex->data); +- unsigned int reg_data = FIELD_GET(EX_DATA_REG_ERR, ex->data); +- unsigned long data, addr, offset; +- +- addr = regs->gprs[reg_addr]; +- offset = addr & (sizeof(unsigned long) - 1); +- addr &= ~(sizeof(unsigned long) - 1); +- data = *(unsigned long *)addr; +- data <<= BITS_PER_BYTE * offset; +- regs->gprs[reg_data] = data; +- regs->psw.addr = extable_fixup(ex); +- return true; +-} +- + static bool ex_handler_fpc(const struct exception_table_entry *ex, struct pt_regs *regs) + { + asm volatile("sfpc %[val]\n" : : [val] "d" (0)); +@@ -104,8 +88,6 @@ bool fixup_exception(struct pt_regs *regs) + return ex_handler_ua_load_reg(ex, false, regs); + case EX_TYPE_UA_LOAD_REGPAIR: + return ex_handler_ua_load_reg(ex, true, regs); +- case EX_TYPE_ZEROPAD: +- return ex_handler_zeropad(ex, regs); + case EX_TYPE_FPC: + return ex_handler_fpc(ex, regs); + } +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 7c567235df..182053c18b 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1061,3 +1061,8 @@ ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch +s390-revert-support-for-dcache_word_access.patch +batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch +batman-adv-ensure-minimal-ethernet-header-on-tx.patch +rust-block-allow-deprecated-for-fetch_update-for-rus.patch +batman-adv-clean-untagged-vlan-on-netdev-registratio.patch diff --git a/queue-6.18/kvm-tdx-account-all-non-transient-page-allocations-f.patch b/queue-6.18/kvm-tdx-account-all-non-transient-page-allocations-f.patch new file mode 100644 index 0000000000..d94059b598 --- /dev/null +++ b/queue-6.18/kvm-tdx-account-all-non-transient-page-allocations-f.patch @@ -0,0 +1,90 @@ +From 15cff99a79fa8335b1bf35802f385ac0020d9326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 11:03:29 +0800 +Subject: KVM: TDX: Account all non-transient page allocations for per-TD + structures + +From: Sean Christopherson + +[ Upstream commit a8b2924676ec42d76597f849baba31acc3ba1bfc ] + +Account all non-transient allocations associated with a single TD (or its +vCPUs), as KVM's ABI is that allocations that are active for the lifetime +of a VM are accounted. Leave temporary allocations, i.e. allocations that +are freed within a single function/ioctl, unaccounted, to again align with +KVM's existing behavior, e.g. see commit dd103407ca31 ("KVM: X86: Remove +unnecessary GFP_KERNEL_ACCOUNT for temporary variables"). + +Fixes: 8d032b683c29 ("KVM: TDX: create/destroy VM structure") +Fixes: a50f673f25e0 ("KVM: TDX: Do TDX specific vcpu initialization") +Cc: stable@vger.kernel.org +Reviewed-by: Kai Huang +Reviewed-by: Rick Edgecombe +Link: https://patch.msgid.link/20260129011517.3545883-4-seanjc@google.com +Signed-off-by: Sean Christopherson +[ Binbin: Resolved conflicts in __tdx_td_init() due to lacking commits + eac90a5ba0aa and 69050f8d6d07, retain nr_configured_hkid increment and + kcalloc() call. ] +Signed-off-by: Binbin Wu +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx/tdx.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c +index d9ffc16dfefe61..7534397defa295 100644 +--- a/arch/x86/kvm/vmx/tdx.c ++++ b/arch/x86/kvm/vmx/tdx.c +@@ -2474,7 +2474,7 @@ static int __tdx_td_init(struct kvm *kvm, struct td_params *td_params, + + atomic_inc(&nr_configured_hkid); + +- tdr_page = alloc_page(GFP_KERNEL); ++ tdr_page = alloc_page(GFP_KERNEL_ACCOUNT); + if (!tdr_page) + goto free_hkid; + +@@ -2482,12 +2482,12 @@ static int __tdx_td_init(struct kvm *kvm, struct td_params *td_params, + /* TDVPS = TDVPR(4K page) + TDCX(multiple 4K pages), -1 for TDVPR. */ + kvm_tdx->td.tdcx_nr_pages = tdx_sysinfo->td_ctrl.tdvps_base_size / PAGE_SIZE - 1; + tdcs_pages = kcalloc(kvm_tdx->td.tdcs_nr_pages, sizeof(*kvm_tdx->td.tdcs_pages), +- GFP_KERNEL); ++ GFP_KERNEL_ACCOUNT); + if (!tdcs_pages) + goto free_tdr; + + for (i = 0; i < kvm_tdx->td.tdcs_nr_pages; i++) { +- tdcs_pages[i] = alloc_page(GFP_KERNEL); ++ tdcs_pages[i] = alloc_page(GFP_KERNEL_ACCOUNT); + if (!tdcs_pages[i]) + goto free_tdcs; + } +@@ -2937,7 +2937,7 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u64 vcpu_rcx) + int ret, i; + u64 err; + +- page = alloc_page(GFP_KERNEL); ++ page = alloc_page(GFP_KERNEL_ACCOUNT); + if (!page) + return -ENOMEM; + tdx->vp.tdvpr_page = page; +@@ -2950,14 +2950,14 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u64 vcpu_rcx) + tdx->vp.tdvpr_pa = page_to_phys(tdx->vp.tdvpr_page); + + tdx->vp.tdcx_pages = kcalloc(kvm_tdx->td.tdcx_nr_pages, sizeof(*tdx->vp.tdcx_pages), +- GFP_KERNEL); ++ GFP_KERNEL_ACCOUNT); + if (!tdx->vp.tdcx_pages) { + ret = -ENOMEM; + goto free_tdvpr; + } + + for (i = 0; i < kvm_tdx->td.tdcx_nr_pages; i++) { +- page = alloc_page(GFP_KERNEL); ++ page = alloc_page(GFP_KERNEL_ACCOUNT); + if (!page) { + ret = -ENOMEM; + goto free_tdcx; +-- +2.53.0 + diff --git a/queue-6.18/series b/queue-6.18/series index c0963a6854..2e80224ab0 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -1421,3 +1421,4 @@ gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch +kvm-tdx-account-all-non-transient-page-allocations-f.patch diff --git a/queue-6.6/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch b/queue-6.6/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch new file mode 100644 index 0000000000..f07a9b9a8f --- /dev/null +++ b/queue-6.6/batman-adv-clean-untagged-vlan-on-netdev-registratio.patch @@ -0,0 +1,112 @@ +From 03fd3e09751161997a056e35a58832ddf0e57e31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:44:48 +0200 +Subject: batman-adv: clean untagged VLAN on netdev registration failure + +From: Sven Eckelmann + +commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream. + +When an mesh interface is registered, it creates an untagged struct +batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in +this process, another receiver of this notification can veto the +registration. The netdev registration will be aborted because of this veto. + +The register_netdevice() call will try to clean up the net_device using +unregister_netdevice_queue() - which only uses the .priv_destructor to +free private resources. In this situation, .dellink will not be called. + +The cleanup of the untagged batadv_meshif_vlan must thefore be done in the +destructor to avoid a leak of this object. + +Cc: stable@vger.kernel.org +Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") +[ switch to old "mesh_iface" name "soft_iface" ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/main.c | 8 ++++++++ + net/batman-adv/soft-interface.c | 13 ++----------- + net/batman-adv/soft-interface.h | 2 ++ + 3 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c +index 28f616b8891a12..417de98c39a7be 100644 +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -258,6 +258,7 @@ int batadv_mesh_init(struct net_device *soft_iface) + void batadv_mesh_free(struct net_device *soft_iface) + { + struct batadv_priv *bat_priv = netdev_priv(soft_iface); ++ struct batadv_softif_vlan *vlan; + + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); + +@@ -273,6 +274,13 @@ void batadv_mesh_free(struct net_device *soft_iface) + + batadv_mcast_free(bat_priv); + ++ /* destroy the "untagged" VLAN */ ++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); ++ if (vlan) { ++ batadv_softif_destroy_vlan(bat_priv, vlan); ++ batadv_softif_vlan_put(vlan); ++ } ++ + /* Free the TT and the originator tables only after having terminated + * all the other depending components which may use these structures for + * their purposes. +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 9760ae08451ac9..97578973943be8 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -603,8 +603,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid) + * @bat_priv: the bat priv with all the soft interface information + * @vlan: the object to remove + */ +-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, +- struct batadv_softif_vlan *vlan) ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan) + { + /* explicitly remove the associated TT local entry because it is marked + * with the NOPURGE flag +@@ -1086,22 +1086,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev, + static void batadv_softif_destroy_netlink(struct net_device *soft_iface, + struct list_head *head) + { +- struct batadv_priv *bat_priv = netdev_priv(soft_iface); + struct batadv_hard_iface *hard_iface; +- struct batadv_softif_vlan *vlan; + + list_for_each_entry(hard_iface, &batadv_hardif_list, list) { + if (hard_iface->soft_iface == soft_iface) + batadv_hardif_disable_interface(hard_iface); + } + +- /* destroy the "untagged" VLAN */ +- vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); +- if (vlan) { +- batadv_softif_destroy_vlan(bat_priv, vlan); +- batadv_softif_vlan_put(vlan); +- } +- + unregister_netdevice_queue(soft_iface, head); + } + +diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h +index 9f2003f1a4972e..13709a5d23e3bf 100644 +--- a/net/batman-adv/soft-interface.h ++++ b/net/batman-adv/soft-interface.h +@@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface, + bool batadv_softif_is_valid(const struct net_device *net_dev); + extern struct rtnl_link_ops batadv_link_ops; + int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan); + void batadv_softif_vlan_release(struct kref *ref); + struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv, + unsigned short vid); +-- +2.53.0 + diff --git a/queue-6.6/batman-adv-ensure-minimal-ethernet-header-on-tx.patch b/queue-6.6/batman-adv-ensure-minimal-ethernet-header-on-tx.patch new file mode 100644 index 0000000000..21b0ebc734 --- /dev/null +++ b/queue-6.6/batman-adv-ensure-minimal-ethernet-header-on-tx.patch @@ -0,0 +1,46 @@ +From 3b73fe808077c8e64dd1c2139c411238fe063d45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:39:41 +0200 +Subject: batman-adv: ensure minimal ethernet header on TX + +From: Sven Eckelmann + +commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream. + +As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have +at least eth header len bytes"), it is possible by for a local user with +eBPF TC hook access to attach a tc filter which truncates the packet and +redirects to an batadv interface. But the code assumes that at least +ETH_HLEN bytes are available and thus might read outside of the available +buffer. + +The batadv_interface_tx() must therefore always check itself if enough data +is available for the ethernet header and don't rely on min_header_len. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Reported-by: Sashiko +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index e4d302c93478b9..9760ae08451ac9 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -206,6 +206,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) + goto dropped; + ++ if (!pskb_may_pull(skb, ETH_HLEN)) ++ goto dropped; ++ + /* reset control block to avoid left overs from previous users */ + memset(skb->cb, 0, sizeof(struct batadv_skb_cb)); + +-- +2.53.0 + diff --git a/queue-6.6/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch b/queue-6.6/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch new file mode 100644 index 0000000000..950279d002 --- /dev/null +++ b/queue-6.6/batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch @@ -0,0 +1,42 @@ +From 108d812cf10ce6d869eafd645fd97aaa27d79d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2026 15:20:56 +0200 +Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX + +From: Sven Eckelmann + +commit 035e1fed892d3d06002a73ff73668f618a514644 upstream. + +pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind +the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the VLAN header but missed for the ethernet +header which is later used for the TT and AP isolation handling. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header") +[ move from mesh- to soft-interface.c ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Sasha Levin +--- + net/batman-adv/soft-interface.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 680f729b3b0228..e4d302c93478b9 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -442,6 +442,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + ++ ethhdr = eth_hdr(skb); + vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ +-- +2.53.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 6c6fd50b03..d1aaa55b7e 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1092,3 +1092,6 @@ ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch +batman-adv-retrieve-ethhdr-after-potential-skb-reall.patch +batman-adv-ensure-minimal-ethernet-header-on-tx.patch +batman-adv-clean-untagged-vlan-on-netdev-registratio.patch diff --git a/queue-7.1/riscv-vdso-always-declare-vdso_start-symbols.patch b/queue-7.1/riscv-vdso-always-declare-vdso_start-symbols.patch new file mode 100644 index 0000000000..e3ad431575 --- /dev/null +++ b/queue-7.1/riscv-vdso-always-declare-vdso_start-symbols.patch @@ -0,0 +1,65 @@ +From ed9f927e4d9462fac422c4bc8396bc4b2d6f2dee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 May 2026 08:30:50 +0200 +Subject: riscv: vdso: Always declare vdso_start symbols +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 499578e22ae0cc33d05803f22e5c71ffb7077b2f ] + +Make the declarations of vdso_start and its related symbols always +visible. With that their users don't have to use ifdeffery but can +use the better IS_ENABLED() compile-time checks. + +Signed-off-by: Thomas Weißschuh +Link: https://patch.msgid.link/20260504-riscv-cfi-vdso-alternative-v1-1-bcdf3d37f62e@linutronix.de +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/vdso.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/riscv/include/asm/vdso.h b/arch/riscv/include/asm/vdso.h +index 35bf830a557612..f7998d9ad9b2d7 100644 +--- a/arch/riscv/include/asm/vdso.h ++++ b/arch/riscv/include/asm/vdso.h +@@ -12,12 +12,15 @@ + * All systems with an MMU have a VDSO, but systems without an MMU don't + * support shared libraries and therefore don't have one. + */ +-#ifdef CONFIG_MMU + + #define __VDSO_PAGES 4 + + #ifndef __ASSEMBLER__ ++ ++#ifdef CONFIG_MMU + #include ++#endif ++ + #ifdef CONFIG_RISCV_USER_CFI + #include + #endif +@@ -38,15 +41,12 @@ + #define COMPAT_VDSO_SYMBOL(base, name) \ + (void __user *)((unsigned long)(base) + compat__vdso_##name##_offset) + +-extern char compat_vdso_start[], compat_vdso_end[]; +- + #endif /* CONFIG_COMPAT */ + + extern char vdso_start[], vdso_end[]; + extern char vdso_cfi_start[], vdso_cfi_end[]; ++extern char compat_vdso_start[], compat_vdso_end[]; + + #endif /* !__ASSEMBLER__ */ + +-#endif /* CONFIG_MMU */ +- + #endif /* _ASM_RISCV_VDSO_H */ +-- +2.53.0 + diff --git a/queue-7.1/series b/queue-7.1/series index 74ddbef7ce..1116fe98b9 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1945,3 +1945,4 @@ acpica-define-acpi_ut_safe_strncpy-as-strscpy_pad-alias.patch drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch +riscv-vdso-always-declare-vdso_start-symbols.patch