From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:20:37 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a734c34aa6fb2f8d9f9fd191baf086af7855cbe2;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch ata-libata-core-skip-hpa-resize-for-locked-drives.patch cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch drbd-reject-data-replies-with-an-out-of-range-payload-size.patch ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch mac802154-remove-interfaces-with-rcu-list-deletion.patch macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch s390-mm-fix-type-mismatch-in-get_align_mask.patch s390-monwriter-reject-buffer-reuse-with-different-data-length.patch selftests-net-make-busywait-timeout-clock-portable.patch tracing-osnoise-call-synchronize_rcu-when-unregistering.patch --- diff --git a/queue-6.12/arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch b/queue-6.12/arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch new file mode 100644 index 0000000000..eb456c49f7 --- /dev/null +++ b/queue-6.12/arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch @@ -0,0 +1,75 @@ +From 18a4e5cf633fad5c40ac9d936c51bf38db68796d Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Wed, 10 Jun 2026 15:52:01 +0800 +Subject: arm64: smp: Fix hot-unplug tearing by forcing unregistration + +From: Jinjie Ruan + +commit 18a4e5cf633fad5c40ac9d936c51bf38db68796d upstream. + +Sashiko review pointed out the following issue[1]. + +Commit eba4675008a6 ("arm64: arch_register_cpu() variant to check if +an ACPI handle is now available.") introduced architectural safety +blocks inside arch_unregister_cpu(). If a hot-unplug operation is +determined to be a physical hardware removal (where _STA evaluates to +!ACPI_STA_DEVICE_PRESENT), or if firmware evaluation fails, it aborts +the unregistration transaction early to protect unreadied arm64 +infrastructure. + +However, returning early from arch_unregister_cpu() causes a catastrophic +state tearing because the generic ACPI layer (acpi_processor_post_eject()) +unconditionally continues its cleanup flow. This leaves the stale sysfs +device leaked in the memory, deadlocking any subsequent hot-add attempts +on the same CPU. + +Fix it by simplifying arch_unregister_cpu() to always proceed with +the unregistration, as a pr_err_once() warning is sufficient to make +it more visible for currently not supported physical CPU removal. +Also remove the redundant NULL check on acpi_handle as it cannot be +NULL when calling arch_unregister_cpu(). + +Cc: Catalin Marinas +Cc: Jonathan Cameron +Cc: James Morse +Cc: stable@vger.kernel.org +Link: https://sashiko.dev/#/patchset/20260520022023.126670-1-ruanjinjie@huawei.com [1] +Fixes: eba4675008a6 ("arm64: arch_register_cpu() variant to check if an ACPI handle is now available.") +Suggested-by: Catalin Marinas +Signed-off-by: Jinjie Ruan +Reviewed-by: Catalin Marinas +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/smp.c | 16 +++------------- + 1 file changed, 3 insertions(+), 13 deletions(-) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -543,23 +543,13 @@ void arch_unregister_cpu(int cpu) + { + acpi_handle acpi_handle = acpi_get_processor_handle(cpu); + struct cpu *c = &per_cpu(cpu_devices, cpu); +- acpi_status status; + unsigned long long sta; +- +- if (!acpi_handle) { +- pr_err_once("Removing a CPU without associated ACPI handle\n"); +- return; +- } ++ acpi_status status; + + status = acpi_evaluate_integer(acpi_handle, "_STA", NULL, &sta); +- if (ACPI_FAILURE(status)) +- return; +- +- /* For now do not allow anything that looks like physical CPU HP */ +- if (cpu_present(cpu) && !(sta & ACPI_STA_DEVICE_PRESENT)) { ++ if (!ACPI_FAILURE(status) && ++ cpu_present(cpu) && !(sta & ACPI_STA_DEVICE_PRESENT)) + pr_err_once("Changing CPU present bit is not supported\n"); +- return; +- } + + unregister_cpu(c); + } diff --git a/queue-6.12/ata-libata-core-skip-hpa-resize-for-locked-drives.patch b/queue-6.12/ata-libata-core-skip-hpa-resize-for-locked-drives.patch new file mode 100644 index 0000000000..9dc5992a91 --- /dev/null +++ b/queue-6.12/ata-libata-core-skip-hpa-resize-for-locked-drives.patch @@ -0,0 +1,37 @@ +From 917d0a4b95ea7ba01ed6296fb808f752d5d81107 Mon Sep 17 00:00:00 2001 +From: TJ Adams +Date: Mon, 6 Jul 2026 14:00:53 -0700 +Subject: ata: libata-core: Skip HPA resize for locked drives + +From: TJ Adams + +commit 917d0a4b95ea7ba01ed6296fb808f752d5d81107 upstream. + +Skip HPA resize in ata_hpa_resize() if the drive is security locked. +If the drive is locked, the command to read the native max address +fails with -EACCES, which currently causes the sticky quirk +ATA_QUIRK_BROKEN_HPA to be set on the device. + +Setting this sticky quirk causes subsequent revalidations (after the +drive is unlocked) to bypass HPA checks, preventing the unlocked drive +from exposing its full native capacity without a reboot or device removal. + +Cc: stable@vger.kernel.org +Signed-off-by: Terrence Adams +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -1324,7 +1324,7 @@ static int ata_hpa_resize(struct ata_dev + /* do we need to do it? */ + if ((dev->class != ATA_DEV_ATA && dev->class != ATA_DEV_ZAC) || + !ata_id_has_lba(dev->id) || !ata_id_hpa_enabled(dev->id) || +- (dev->quirks & ATA_QUIRK_BROKEN_HPA)) ++ (dev->quirks & ATA_QUIRK_BROKEN_HPA) || ata_id_is_locked(dev->id)) + return 0; + + /* read native max address */ diff --git a/queue-6.12/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch b/queue-6.12/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch new file mode 100644 index 0000000000..758c270609 --- /dev/null +++ b/queue-6.12/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch @@ -0,0 +1,76 @@ +From b983c56426383e4a06fa5970c4e33cee879b1482 Mon Sep 17 00:00:00 2001 +From: Farhad Alemi +Date: Mon, 6 Jul 2026 10:20:23 +0200 +Subject: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Farhad Alemi + +commit b983c56426383e4a06fa5970c4e33cee879b1482 upstream. + +Creating a child cpuset where cpuset.mems is never set leads to a div/0 +when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a +CPU hotplug event. + +Reproduction steps: + 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) + 2) Move the task into the child cpuset + 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES + 4) unplug and hotplug a cpu + echo 0 > /sys/devices/system/cpu/cpu1/online + echo 1 > /sys/devices/system/cpu/cpu1/online + 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the + call to __nodes_fold() + +The cpuset code passes (cs->mems_allowed) which is not guaranteed to have +nodes to the rebind routine. Use cs->effective_mems instead, which is +guaranteed to have a non-empty nodemask once we reach that code path. + +Link: https://lore.kernel.org/all/CA+0ovCiEz6SP_sn3kN4Tb+_oC=eHMXy_Ffj=usV3wREdQrUtww@mail.gmail.com/ +Fixes: ae1c802382f7 ("cpuset: apply cs->effective_{cpus,mems}") +Closes: https://lore.kernel.org/linux-mm/CA+0ovCgxbZkXa+OU8w3s84R3KNPNxxRfmsNR-udh+afQBbGNmw@mail.gmail.com/ +Suggested-by: Gregory Price +Suggested-by: Waiman Long +Acked-by: Waiman Long +Signed-off-by: Farhad Alemi +Cc: Andrew Morton +Cc: Alistair Popple +Cc: Byungchul Park +Cc: Gregory Price +Cc: "Huang, Ying" +Cc: Joshua Hahn +Cc: Matthew Brost +Cc: Rakie Kim +Cc: Rasmus Villemoes +Cc: Zi Yan +Cc: Tejun Heo +Cc: Ridong Chen +Cc: Johannes Weiner +Cc: "Michal Koutný" +Cc: +[ david: add a comment, slightly rephrase description ] +Signed-off-by: David Hildenbrand (Arm) +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cgroup/cpuset.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2586,7 +2586,12 @@ void cpuset_update_tasks_nodemask(struct + + migrate = is_memory_migrate(cs); + +- mpol_rebind_mm(mm, &cs->mems_allowed); ++ /* ++ * For v1 we can have empty effective_mems, but we cannot ++ * attach any tasks (see cpuset_can_attach_check()). For v2, ++ * effective_mems is guaranteed to not be empty. ++ */ ++ mpol_rebind_mm(mm, &cs->effective_mems); + if (migrate) + cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems); + else diff --git a/queue-6.12/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch b/queue-6.12/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch new file mode 100644 index 0000000000..3260dd2de8 --- /dev/null +++ b/queue-6.12/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch @@ -0,0 +1,63 @@ +From bd910a7660d280595ef94cb6d193951d855d330f Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Thu, 9 Jul 2026 22:28:37 -0400 +Subject: drbd: reject data replies with an out-of-range payload size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Bommarito + +commit bd910a7660d280595ef94cb6d193951d855d330f upstream. + +recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an +outstanding read request. The peer-supplied payload length reaches it as +the signed int data_size, and two peer-controlled inputs can make it +negative. With a negotiated data-integrity-alg the digest length is +subtracted first, so a reply whose payload is smaller than the digest +underflows data_size. With no integrity algorithm (the default) data_size +is assigned from the unsigned h95/h100 wire length and drbdd() never +bounds it for a payload-carrying command, so a length above INT_MAX casts +it negative; this path needs no non-default feature. The bio receive loop +then computes expect = min_t(int, data_size, bv_len), which is negative, +and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX +into the first mapped page. + +The sibling receive path read_in_block() is not affected: it uses an +unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving. +Reject a data reply whose size is negative after the optional digest +subtraction, covering both triggers. + +Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen +bytes past a bio page in the receiver, corrupting kernel memory. A node +that reads from its peer (a diskless node, or read-balancing to the peer) +is exposed in the default configuration; data-integrity-alg is not +required. + +Fixes: b411b3637fa7 ("The DRBD driver") +Cc: stable@vger.kernel.org +Assisted-by: Codex:gpt-5-5-xhigh +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Michael Bommarito +Reviewed-by: Christoph Böhmwalder +Link: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/drbd/drbd_receiver.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -1998,6 +1998,11 @@ static int recv_dless_read(struct drbd_p + data_size -= digest_size; + } + ++ if (data_size < 0) { ++ drbd_err(peer_device, "Invalid data reply size\n"); ++ return -EIO; ++ } ++ + /* optimistically update recv_cnt. if receiving fails below, + * we disconnect anyways, and counters will be reset. */ + peer_device->device->recv_cnt += data_size>>9; diff --git a/queue-6.12/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch b/queue-6.12/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch new file mode 100644 index 0000000000..280f2abea9 --- /dev/null +++ b/queue-6.12/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch @@ -0,0 +1,65 @@ +From 2975324d164c552b028632f107b567302863b7f6 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Thu, 2 Jul 2026 19:28:36 +0800 +Subject: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new + +From: Yizhou Zhao + +commit 2975324d164c552b028632f107b567302863b7f6 upstream. + +Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in +ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn +object with kmem_cache_alloc(). The function then initializes many +fields explicitly, but only resets in_seq.delta and out_seq.delta in the +two struct ip_vs_seq members. + +That leaves init_seq and previous_delta uninitialized. This is normally +harmless while the corresponding IP_VS_CONN_F_IN_SEQ or +IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync +message, however, ip_vs_proc_conn() preserves those flags from +IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits +IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with +SEQ flags set but with the rest of in_seq/out_seq still containing stale +slab data. + +When a packet for such a connection is later handled by an IPVS +application helper, vs_fix_seq() and vs_fix_ack_seq() use +previous_delta and init_seq to rewrite TCP sequence numbers. A malformed +sync message can therefore make forwarded packets carry stale slab bytes +in their TCP seq/ack numbers, and can also corrupt the forwarded TCP +flow. + +Reset both struct ip_vs_seq members completely before publishing the +connection. This matches the existing "reset struct ip_vs_seq" comment +and keeps the sequence-adjustment gates inactive unless valid sequence +data is installed later. + +Fixes: 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") +Cc: stable@vger.kernel.org +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude-Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -996,8 +996,8 @@ ip_vs_conn_new(const struct ip_vs_conn_p + cp->app = NULL; + cp->app_data = NULL; + /* reset struct ip_vs_seq */ +- cp->in_seq.delta = 0; +- cp->out_seq.delta = 0; ++ memset(&cp->in_seq, 0, sizeof(cp->in_seq)); ++ memset(&cp->out_seq, 0, sizeof(cp->out_seq)); + + atomic_inc(&ipvs->conn_count); + if (flags & IP_VS_CONN_F_NO_CPORT) diff --git a/queue-6.12/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch b/queue-6.12/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch new file mode 100644 index 0000000000..34d78753c1 --- /dev/null +++ b/queue-6.12/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch @@ -0,0 +1,83 @@ +From 2f75c0faa3361b28e36cc0512b3299e163e25789 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Mon, 6 Jul 2026 18:16:24 +0800 +Subject: ipvs: use parsed transport offset in SCTP state lookup + +From: Yizhou Zhao + +commit 2f75c0faa3361b28e36cc0512b3299e163e25789 upstream. + +set_sctp_state() reads the SCTP chunk header again in order to drive the +IPVS SCTP state table. For IPv6 it computes the offset with +sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from +ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped +extension headers and found the real transport header. + +This makes the state machine read from the wrong offset for IPv6 SCTP +packets that carry extension headers. For example, an INIT packet with an +8-byte destination options header can be scheduled correctly by +sctp_conn_schedule(), but set_sctp_state() reads the first byte of the +SCTP verification tag as a DATA chunk type. The connection then moves +from NONE to ESTABLISHED instead of INIT1, gets the longer established +timeout, and updates the active/inactive destination counters +incorrectly. This happens even though the SCTP handshake has not +completed. + +Use the parsed transport offset passed down from ip_vs_set_state() for +the SCTP chunk-header lookup. For IPv4 and IPv6 packets without +extension headers this preserves the existing offset. + +Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/ +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -372,20 +372,15 @@ static const char *sctp_state_name(int s + + static inline void + set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, +- int direction, const struct sk_buff *skb) ++ int direction, const struct sk_buff *skb, ++ unsigned int iph_len) + { + struct sctp_chunkhdr _sctpch, *sch; + unsigned char chunk_type; + int event, next_state; +- int ihl, cofs; +- +-#ifdef CONFIG_IP_VS_IPV6 +- ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr); +-#else +- ihl = ip_hdrlen(skb); +-#endif ++ int cofs; + +- cofs = ihl + sizeof(struct sctphdr); ++ cofs = iph_len + sizeof(struct sctphdr); + sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch); + if (sch == NULL) + return; +@@ -472,7 +467,7 @@ sctp_state_transition(struct ip_vs_conn + unsigned int iph_len) + { + spin_lock_bh(&cp->lock); +- set_sctp_state(pd, cp, direction, skb); ++ set_sctp_state(pd, cp, direction, skb, iph_len); + spin_unlock_bh(&cp->lock); + } + diff --git a/queue-6.12/irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch b/queue-6.12/irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch new file mode 100644 index 0000000000..55dc96ec57 --- /dev/null +++ b/queue-6.12/irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch @@ -0,0 +1,64 @@ +From 1358126fbed104e5657955d3ba029b283687ba02 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Tue, 23 Jun 2026 15:37:44 +0800 +Subject: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure + +From: Haoxiang Li + +commit 1358126fbed104e5657955d3ba029b283687ba02 upstream. + +imsic_early_acpi_init() allocates a firmware node before setting up the +IMSIC state. If imsic_setup_state() fails, the function returns without +freeing the allocated fwnode. + +Free the fwnode and clear the global pointer on this error path, matching +the cleanup already done when imsic_early_probe() fails. + +[ tglx: Use a common cleanup path instead of copying code around ] + +Fixes: fbe826b1c106 ("irqchip/riscv-imsic: Add ACPI support") +Signed-off-by: Haoxiang Li +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260623073744.2009137-1-haoxiang_li2024@163.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-riscv-imsic-early.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/irqchip/irq-riscv-imsic-early.c ++++ b/drivers/irqchip/irq-riscv-imsic-early.c +@@ -236,16 +236,13 @@ static int __init imsic_early_acpi_init( + rc = imsic_setup_state(imsic_acpi_fwnode, imsic); + if (rc) { + pr_err("%pfwP: failed to setup state (error %d)\n", imsic_acpi_fwnode, rc); +- return rc; ++ goto cleanup; + } + + /* Do early setup of IMSIC state and IPIs */ + rc = imsic_early_probe(imsic_acpi_fwnode); +- if (rc) { +- irq_domain_free_fwnode(imsic_acpi_fwnode); +- imsic_acpi_fwnode = NULL; +- return rc; +- } ++ if (rc) ++ goto cleanup; + + rc = imsic_platform_acpi_probe(imsic_acpi_fwnode); + +@@ -264,8 +261,12 @@ static int __init imsic_early_acpi_init( + * DT where IPI works but MSI probe fails for some reason. + */ + return 0; +-} + ++cleanup: ++ irq_domain_free_fwnode(imsic_acpi_fwnode); ++ imsic_acpi_fwnode = NULL; ++ return rc; ++} + IRQCHIP_ACPI_DECLARE(riscv_imsic, ACPI_MADT_TYPE_IMSIC, NULL, + 1, imsic_early_acpi_init); + #endif diff --git a/queue-6.12/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch b/queue-6.12/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch new file mode 100644 index 0000000000..fe0e915d3a --- /dev/null +++ b/queue-6.12/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch @@ -0,0 +1,45 @@ +From 660667cd406648bbaffbd5c0d897c2263a852f11 Mon Sep 17 00:00:00 2001 +From: Shuangpeng Bai +Date: Tue, 30 Jun 2026 15:48:56 -0400 +Subject: llc: fix SAP refcount leak in llc_ui_autobind() + +From: Shuangpeng Bai + +commit 660667cd406648bbaffbd5c0d897c2263a852f11 upstream. + +llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. +llc_sap_open() returns a reference owned by the caller, and +llc_sap_add_socket() takes a second reference for the socket's +membership in the SAP hash tables. + +llc_ui_bind() drops the caller's reference after adding the socket, +but llc_ui_autobind() keeps it. When the socket is closed, +llc_sap_remove_socket() releases only the socket reference, leaving +the SAP on llc_sap_list with sk_count == 0. + +This is user-visible because repeated autobind and close cycles can consume +all dynamic SAP values and make later autobinds fail with -EUSERS. + +Drop the caller's reference after a successful autobind, matching +llc_ui_bind()'s ownership model. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Shuangpeng Bai +Link: https://patch.msgid.link/20260630194856.1036497-1-shuangpeng.kernel@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/af_llc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -317,6 +317,7 @@ static int llc_ui_autobind(struct socket + /* assign new connection to its SAP */ + llc_sap_add_socket(sap, sk); + sock_reset_flag(sk, SOCK_ZAPPED); ++ llc_sap_put(sap); + rc = 0; + out: + dev_put(dev); diff --git a/queue-6.12/mac802154-remove-interfaces-with-rcu-list-deletion.patch b/queue-6.12/mac802154-remove-interfaces-with-rcu-list-deletion.patch new file mode 100644 index 0000000000..a6813c0f82 --- /dev/null +++ b/queue-6.12/mac802154-remove-interfaces-with-rcu-list-deletion.patch @@ -0,0 +1,43 @@ +From 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 Mon Sep 17 00:00:00 2001 +From: Yousef Alhouseen +Date: Wed, 1 Jul 2026 18:42:22 +0200 +Subject: mac802154: remove interfaces with RCU list deletion + +From: Yousef Alhouseen + +commit 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 upstream. + +Queue wake, stop, and disable paths walk local->interfaces under RCU. +The bulk hardware teardown path removes entries with list_del(), so an +asynchronous transmit completion can follow a poisoned list node in +ieee802154_wake_queue(). + +Use list_del_rcu() as in the single-interface removal path. The following +unregister_netdevice() waits for in-flight RCU readers before freeing the +netdevice, so no separate grace-period wait is needed. + +Fixes: 592dfbfc72f5 ("mac820154: move interface unregistration into iface") +Reported-by: syzbot+36256deb69a588e9290e@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=36256deb69a588e9290e +Cc: stable@vger.kernel.org +Signed-off-by: Yousef Alhouseen +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Miquel Raynal +Link: https://patch.msgid.link/20260701164222.9094-1-alhouseenyousef@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mac802154/iface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac802154/iface.c ++++ b/net/mac802154/iface.c +@@ -703,7 +703,7 @@ void ieee802154_remove_interfaces(struct + + mutex_lock(&local->iflist_mtx); + list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) { +- list_del(&sdata->list); ++ list_del_rcu(&sdata->list); + + unregister_netdevice(sdata->dev); + } diff --git a/queue-6.12/macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch b/queue-6.12/macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch new file mode 100644 index 0000000000..e84b2122b6 --- /dev/null +++ b/queue-6.12/macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch @@ -0,0 +1,47 @@ +From f5089008f90c0a7c5520dff3934e0af00adf322d Mon Sep 17 00:00:00 2001 +From: Daehyeon Ko <4ncienth@gmail.com> +Date: Fri, 3 Jul 2026 17:36:33 +0900 +Subject: macsec: don't read an unset MAC header in macsec_encrypt() + +From: Daehyeon Ko <4ncienth@gmail.com> + +commit f5089008f90c0a7c5520dff3934e0af00adf322d upstream. + +macsec_encrypt() reads the Ethernet header via eth_hdr(skb) +(skb->head + skb->mac_header) to memmove() the 12 source/destination MAC +bytes forward and make room for the SecTAG. + +On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb +reaches the macsec ndo_start_xmit() with the MAC header unset, so +eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of +bounds: a 12-byte heap over-read that is also emitted on the wire as the +frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds +read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET +build flags it as an unset mac header in skb_mac_header(). + +On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added +by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in +macvlan_broadcast()") for exactly this purpose. + +Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") +Cc: stable@vger.kernel.org +Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20260703083634.2035145-1-4ncienth@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/macsec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -641,7 +641,7 @@ static struct sk_buff *macsec_encrypt(st + } + + unprotected_len = skb->len; +- eth = eth_hdr(skb); ++ eth = skb_eth_hdr(skb); + sci_present = macsec_send_sci(secy); + hh = skb_push(skb, macsec_extra_len(sci_present)); + memmove(hh, eth, 2 * ETH_ALEN); diff --git a/queue-6.12/mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch b/queue-6.12/mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch new file mode 100644 index 0000000000..6d849c556a --- /dev/null +++ b/queue-6.12/mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch @@ -0,0 +1,53 @@ +From 7da7d599b8a83271c464adfd5ef160202b470570 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Mon, 22 Jun 2026 11:30:42 -0400 +Subject: mm/compaction: handle free_pages_prepare() properly in compaction_free() + +From: Zi Yan + +commit 7da7d599b8a83271c464adfd5ef160202b470570 upstream. + +free_pages_prepare() can fail but compaction_free() does not handle the +failure case. Failed pages should not be added back to cc->freepages for +future use, since they can be either PageHWPoison or free_page_is_bad() +and might cause data corruption. + +Link: https://lore.kernel.org/20260622-handle_free_pages_prepare_in_compaction_free-v1-1-fcf3b14abcf7@nvidia.com +Fixes: 733aea0b3a7b ("mm/compaction: add support for >0 order folio memory compaction.") +Signed-off-by: Zi Yan +Reviewed-by: Vlastimil Babka (SUSE) +Acked-by: Johannes Weiner +Reviewed-by: Baolin Wang +Reviewed-by: Lance Yang +Cc: Brendan Jackman +Cc: Jiaqi Yan +Cc: Michal Hocko +Cc: Suren Baghdasaryan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/compaction.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -1894,15 +1894,14 @@ static void compaction_free(struct folio + int order = folio_order(dst); + struct page *page = &dst->page; + +- if (folio_put_testzero(dst)) { +- free_pages_prepare(page, order); ++ if (folio_put_testzero(dst) && free_pages_prepare(page, order)) { + list_add(&dst->lru, &cc->freepages[order]); + cc->nr_freepages += 1 << order; + } + cc->nr_migratepages += 1 << order; + /* +- * someone else has referenced the page, we cannot take it back to our +- * free list. ++ * someone else has referenced the page or free_pages_prepare() fails, ++ * we cannot take it back to our free list. + */ + } + diff --git a/queue-6.12/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch b/queue-6.12/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch new file mode 100644 index 0000000000..77d6722558 --- /dev/null +++ b/queue-6.12/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch @@ -0,0 +1,53 @@ +From 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f Mon Sep 17 00:00:00 2001 +From: Tao Liu +Date: Mon, 6 Jul 2026 11:27:07 +1200 +Subject: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() + +From: Tao Liu + +commit 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f upstream. + +A NULL pointer dereference issue is noticed in riscv's +machine_kexec_prepare(), where image->segment[i].buf might be NULL and +copied unchecked. + +The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by +kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without +a check in machine_kexec_prepare(): + + kexec_file_load + -> kimage_file_alloc_init() + -> kimage_file_prepare_segments() + -> ima_add_kexec_buffer() + -> kexec_add_buffer() + -> machine_kexec_prepare() + -> memcpy() + +Address this by adding a check before the data copy attempt. + +Fixes: b7fb4d78a6ad ("RISC-V: use memcpy for kexec_file mode") +Cc: stable@vger.kernel.org +Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/ +Acked-by: Baoquan He +Acked-by: Pratyush Yadav +Reviewed-by: Nutty Liu +Signed-off-by: Tao Liu +Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/machine_kexec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/riscv/kernel/machine_kexec.c ++++ b/arch/riscv/kernel/machine_kexec.c +@@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *ima + if (image->segment[i].memsz <= sizeof(fdt)) + continue; + ++ if (!image->segment[i].buf) ++ continue; ++ + if (image->file_mode) + memcpy(&fdt, image->segment[i].buf, sizeof(fdt)); + else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt))) diff --git a/queue-6.12/s390-mm-fix-type-mismatch-in-get_align_mask.patch b/queue-6.12/s390-mm-fix-type-mismatch-in-get_align_mask.patch new file mode 100644 index 0000000000..ccb6925554 --- /dev/null +++ b/queue-6.12/s390-mm-fix-type-mismatch-in-get_align_mask.patch @@ -0,0 +1,38 @@ +From ec84aad4c3594307d103af563991b4415ac5c8ab Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Tue, 30 Jun 2026 19:32:14 +0200 +Subject: s390/mm: Fix type mismatch in get_align_mask(). + +From: Gerald Schaefer + +commit ec84aad4c3594307d103af563991b4415ac5c8ab upstream. + +Commit 86f48f922ba79 ("s390/mmap: disable mmap alignment when +randomize_va_space = 0") introduced get_align_mask() with return type of +'int', while the target field 'info.align_mask' in struct +vm_unmapped_area_info is 'unsigned long'. + +With currently used masks, this should not cause truncation issues, but +fix it and return 'unsigned long' to avoid future problems. + +Fixes: 86f48f922ba79 ("s390/mmap: disable mmap alignment when randomize_va_space = 0") +Cc: stable@vger.kernel.org # v6.9+ +Signed-off-by: Gerald Schaefer +Reviewed-by: Sven Schnelle +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/mmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/mm/mmap.c ++++ b/arch/s390/mm/mmap.c +@@ -71,7 +71,7 @@ static inline unsigned long mmap_base(un + return PAGE_ALIGN(STACK_TOP - gap - rnd); + } + +-static int get_align_mask(struct file *filp, unsigned long flags) ++static unsigned long get_align_mask(struct file *filp, unsigned long flags) + { + if (!(current->flags & PF_RANDOMIZE)) + return 0; diff --git a/queue-6.12/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch b/queue-6.12/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch new file mode 100644 index 0000000000..c28d484547 --- /dev/null +++ b/queue-6.12/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch @@ -0,0 +1,43 @@ +From 2995ccec260caa9e85b3301a4aba1e66ed80ad74 Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Tue, 23 Jun 2026 19:44:06 +0200 +Subject: s390/monwriter: Reject buffer reuse with different data length + +From: Gerald Schaefer + +commit 2995ccec260caa9e85b3301a4aba1e66ed80ad74 upstream. + +When data buffers are reused, e.g. for interval sample records, the +first record determines the data length, and the size of the buffer for +user copy. Current monwriter code does not check if the data length was +changed for subsequent records, which also would never happen for valid +user programs. + +However, a malicious user could change the data length, resulting in out +of bounds user copy to the kernel buffer, and memory corruption. By +default, the monwriter misc device is created with root-only permissions, +so practical impact is typically low. + +Fix this by checking for changed data length and rejecting such records. + +Cc: stable@vger.kernel.org +Signed-off-by: Gerald Schaefer +Reviewed-by: Christian Borntraeger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/char/monwriter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/char/monwriter.c ++++ b/drivers/s390/char/monwriter.c +@@ -122,6 +122,9 @@ static int monwrite_new_hdr(struct mon_p + kfree(monbuf->data); + kfree(monbuf); + monbuf = NULL; ++ } else if (monbuf->hdr.datalen != monhdr->datalen) { ++ /* Data with buffer reuse must not change its length */ ++ return -EINVAL; + } + } else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) { + if (mon_buf_count >= mon_max_bufs) diff --git a/queue-6.12/selftests-net-make-busywait-timeout-clock-portable.patch b/queue-6.12/selftests-net-make-busywait-timeout-clock-portable.patch new file mode 100644 index 0000000000..10038235c3 --- /dev/null +++ b/queue-6.12/selftests-net-make-busywait-timeout-clock-portable.patch @@ -0,0 +1,72 @@ +From dd6a23bac306b7aa322e0aaccb60c6e32a198fb3 Mon Sep 17 00:00:00 2001 +From: Nirmoy Das +Date: Tue, 30 Jun 2026 09:51:57 -0700 +Subject: selftests: net: make busywait timeout clock portable + +From: Nirmoy Das + +commit dd6a23bac306b7aa322e0aaccb60c6e32a198fb3 upstream. + +loopy_wait() expects millisecond timestamps. However, Ubuntu Resolute +can use uutils date, where `date -u +%s%3N` returns seconds plus full +nanoseconds instead of a 3-digit millisecond field. This makes +busywait expire too early and can make vlan_bridge_binding.sh read a +stale operstate. + +Fixes: 25ae948b4478 ("selftests/net: add lib.sh") +Cc: stable@vger.kernel.org # 6.8+ +Link: https://github.com/uutils/coreutils/issues/11658 +Signed-off-by: Nirmoy Das +Link: https://patch.msgid.link/20260630165157.3814871-1-nirmoyd@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/lib.sh | 25 +++++++++++++++++++++++-- + 1 file changed, 23 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/net/lib.sh ++++ b/tools/testing/selftests/net/lib.sh +@@ -67,12 +67,33 @@ ksft_exit_status_merge() + $ksft_xfail $ksft_pass $ksft_skip $ksft_fail + } + ++timestamp_ms() ++{ ++ local now ++ local seconds ++ local nanoseconds ++ ++ now=$(date -u +%s:%N) || return ++ seconds=${now%:*} ++ nanoseconds=${now#*:} ++ ++ if [[ $nanoseconds =~ ^[0-9]+$ ]]; then ++ nanoseconds=${nanoseconds:0:9} ++ else ++ nanoseconds=0 ++ fi ++ ++ echo $((seconds * 1000 + 10#$nanoseconds / 1000000)) ++} ++ + loopy_wait() + { + local sleep_cmd=$1; shift + local timeout_ms=$1; shift ++ local start_time ++ local current_time + +- local start_time="$(date -u +%s%3N)" ++ start_time=$(timestamp_ms) || return + while true + do + local out +@@ -81,7 +102,7 @@ loopy_wait() + return 0 + fi + +- local current_time="$(date -u +%s%3N)" ++ current_time=$(timestamp_ms) || return + if ((current_time - start_time > timeout_ms)); then + echo -n "$out" + return 1 diff --git a/queue-6.12/series b/queue-6.12/series index e402654d91..1e1d92e301 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1086,3 +1086,19 @@ ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch riscv-probes-save-original-sp-in-rethook-trampoline.patch +mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch +irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch +s390-monwriter-reject-buffer-reuse-with-different-data-length.patch +mac802154-remove-interfaces-with-rcu-list-deletion.patch +selftests-net-make-busywait-timeout-clock-portable.patch +llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch +ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch +ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch +macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch +arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch +ata-libata-core-skip-hpa-resize-for-locked-drives.patch +drbd-reject-data-replies-with-an-out-of-range-payload-size.patch +riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch +tracing-osnoise-call-synchronize_rcu-when-unregistering.patch +s390-mm-fix-type-mismatch-in-get_align_mask.patch +cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch diff --git a/queue-6.12/tracing-osnoise-call-synchronize_rcu-when-unregistering.patch b/queue-6.12/tracing-osnoise-call-synchronize_rcu-when-unregistering.patch new file mode 100644 index 0000000000..671eeafc2c --- /dev/null +++ b/queue-6.12/tracing-osnoise-call-synchronize_rcu-when-unregistering.patch @@ -0,0 +1,37 @@ +From fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a Mon Sep 17 00:00:00 2001 +From: Crystal Wood +Date: Mon, 8 Jun 2026 23:54:30 -0500 +Subject: tracing/osnoise: Call synchronize_rcu() when unregistering + +From: Crystal Wood + +commit fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a upstream. + +This ensures that any RCU readers traversing the instance list +have finished, before releasing the reference on the tracer that +the instance points to. + +Cc: stable@vger.kernel.org +Fixes: a6ed2aee54644 ("tracing: Switch to kvfree_rcu() API") +Link: https://patch.msgid.link/20260609045430.1589786-1-crwood@redhat.com +Suggested-by: Steven Rostedt +Signed-off-by: Crystal Wood +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_osnoise.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_osnoise.c ++++ b/kernel/trace/trace_osnoise.c +@@ -159,7 +159,9 @@ static void osnoise_unregister_instance( + if (!found) + return; + +- kvfree_rcu_mightsleep(inst); ++ /* Do a full sync to ensure that tr remains valid, not just inst */ ++ synchronize_rcu(); ++ kvfree(inst); + } + + /*