From 904089330c1c2f3b03b4a1c9f59672f784390003 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 13 Feb 2026 12:24:27 +0100 Subject: [PATCH] 6.12-stable patches added patches: bluetooth-btusb-add-usb-id-7392-e611-for-edimax-ew-7611uxb.patch bus-mhi-host-pci_generic-add-telit-fe990b40-modem-support.patch crypto-iaa-fix-out-of-bounds-index-in-find_empty_iaa_compression_mode.patch crypto-octeontx-fix-length-check-to-avoid-truncation-in-ucode_load_store.patch crypto-omap-allocate-omap_crypto_force_copy-scatterlists-correctly.patch crypto-virtio-add-spinlock-protection-with-virtqueue-notification.patch crypto-virtio-remove-duplicated-virtqueue_kick-in-virtio_crypto_skcipher_crypt_req.patch mptcp-fix-race-in-mptcp_pm_nl_flush_addrs_doit.patch nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch scsi-qla2xxx-allow-recovery-for-tape-devices.patch scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch wifi-rtw88-fix-alignment-fault-in-rtw_core_enable_beacon.patch --- ...b-id-7392-e611-for-edimax-ew-7611uxb.patch | 78 +++++++++++++ ...ric-add-telit-fe990b40-modem-support.patch | 52 +++++++++ ...x-in-find_empty_iaa_compression_mode.patch | 51 ++++++++ ...avoid-truncation-in-ucode_load_store.patch | 38 ++++++ ...to_force_copy-scatterlists-correctly.patch | 35 ++++++ ...otection-with-virtqueue-notification.patch | 55 +++++++++ ...-in-virtio_crypto_skcipher_crypt_req.patch | 36 ++++++ ...race-in-mptcp_pm_nl_flush_addrs_doit.patch | 75 ++++++++++++ ...lock-overflow-that-cause-system-hang.patch | 72 ++++++++++++ ...2xxx-allow-recovery-for-tape-devices.patch | 55 +++++++++ ...unload-while-fabric-scan-in-progress.patch | 70 +++++++++++ ...sp-in-error-path-to-fix-system-crash.patch | 83 +++++++++++++ ...w-again-before-proceeding-with-login.patch | 92 +++++++++++++++ ...-sp-before-freeing-associated-memory.patch | 110 ++++++++++++++++++ queue-6.12/series | 15 +++ ...ment-fault-in-rtw_core_enable_beacon.patch | 86 ++++++++++++++ 16 files changed, 1003 insertions(+) create mode 100644 queue-6.12/bluetooth-btusb-add-usb-id-7392-e611-for-edimax-ew-7611uxb.patch create mode 100644 queue-6.12/bus-mhi-host-pci_generic-add-telit-fe990b40-modem-support.patch create mode 100644 queue-6.12/crypto-iaa-fix-out-of-bounds-index-in-find_empty_iaa_compression_mode.patch create mode 100644 queue-6.12/crypto-octeontx-fix-length-check-to-avoid-truncation-in-ucode_load_store.patch create mode 100644 queue-6.12/crypto-omap-allocate-omap_crypto_force_copy-scatterlists-correctly.patch create mode 100644 queue-6.12/crypto-virtio-add-spinlock-protection-with-virtqueue-notification.patch create mode 100644 queue-6.12/crypto-virtio-remove-duplicated-virtqueue_kick-in-virtio_crypto_skcipher_crypt_req.patch create mode 100644 queue-6.12/mptcp-fix-race-in-mptcp_pm_nl_flush_addrs_doit.patch create mode 100644 queue-6.12/nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch create mode 100644 queue-6.12/scsi-qla2xxx-allow-recovery-for-tape-devices.patch create mode 100644 queue-6.12/scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch create mode 100644 queue-6.12/scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch create mode 100644 queue-6.12/scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch create mode 100644 queue-6.12/scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch create mode 100644 queue-6.12/wifi-rtw88-fix-alignment-fault-in-rtw_core_enable_beacon.patch diff --git a/queue-6.12/bluetooth-btusb-add-usb-id-7392-e611-for-edimax-ew-7611uxb.patch b/queue-6.12/bluetooth-btusb-add-usb-id-7392-e611-for-edimax-ew-7611uxb.patch new file mode 100644 index 0000000000..59cb681ef9 --- /dev/null +++ b/queue-6.12/bluetooth-btusb-add-usb-id-7392-e611-for-edimax-ew-7611uxb.patch @@ -0,0 +1,78 @@ +From 6c0568b7741a346088fd6dfced2d871f7d481d06 Mon Sep 17 00:00:00 2001 +From: Zenm Chen +Date: Thu, 29 Jan 2026 10:28:19 +0800 +Subject: Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB + +From: Zenm Chen + +commit 6c0568b7741a346088fd6dfced2d871f7d481d06 upstream. + +Add USB ID 7392:e611 for Edimax EW-7611UXB which is RTL8851BU-based +Wi-Fi + Bluetooth adapter. + +The information in /sys/kernel/debug/usb/devices about the Bluetooth +device is listed as the below: + +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=7392 ProdID=e611 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=802.11ax WLAN Adapter +S: SerialNumber=00e04c000001 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu_git +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org # 6.6.x +Signed-off-by: Zenm Chen +Reviewed-by: Paul Menzel +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -519,6 +519,8 @@ static const struct usb_device_id quirks + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x2001, 0x332a), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x7392, 0xe611), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek 8852AE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK | diff --git a/queue-6.12/bus-mhi-host-pci_generic-add-telit-fe990b40-modem-support.patch b/queue-6.12/bus-mhi-host-pci_generic-add-telit-fe990b40-modem-support.patch new file mode 100644 index 0000000000..472421218d --- /dev/null +++ b/queue-6.12/bus-mhi-host-pci_generic-add-telit-fe990b40-modem-support.patch @@ -0,0 +1,52 @@ +From 6eaee77923ddf04beedb832c06f983679586361c Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Wed, 15 Oct 2025 12:20:59 +0200 +Subject: bus: mhi: host: pci_generic: Add Telit FE990B40 modem support + +From: Daniele Palmas + +commit 6eaee77923ddf04beedb832c06f983679586361c upstream. + +Add SDX72 based modem Telit FE990B40, reusing FN920C04 configuration. + +01:00.0 Unassigned class [ff00]: Qualcomm Device 0309 + Subsystem: Device 1c5d:2025 + +Signed-off-by: Daniele Palmas +Signed-off-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20251015102059.1781001-1-dnlplm@gmail.com +Signed-off-by: Fabio Porcedda +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/pci_generic.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/bus/mhi/host/pci_generic.c ++++ b/drivers/bus/mhi/host/pci_generic.c +@@ -744,6 +744,16 @@ static const struct mhi_pci_dev_info mhi + .edl_trigger = true, + }; + ++static const struct mhi_pci_dev_info mhi_telit_fe990b40_info = { ++ .name = "telit-fe990b40", ++ .config = &modem_telit_fn920c04_config, ++ .bar_num = MHI_PCI_DEFAULT_BAR_NUM, ++ .dma_data_width = 32, ++ .sideband_wake = false, ++ .mru_default = 32768, ++ .edl_trigger = true, ++}; ++ + static const struct mhi_pci_dev_info mhi_netprisma_lcur57_info = { + .name = "netprisma-lcur57", + .edl = "qcom/prog_firehose_sdx24.mbn", +@@ -792,6 +802,9 @@ static const struct pci_device_id mhi_pc + /* Telit FN990B40 (sdx72) */ + { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0309, 0x1c5d, 0x201a), + .driver_data = (kernel_ulong_t) &mhi_telit_fn990b40_info }, ++ /* Telit FE990B40 (sdx72) */ ++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0309, 0x1c5d, 0x2025), ++ .driver_data = (kernel_ulong_t) &mhi_telit_fe990b40_info }, + { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0309), + .driver_data = (kernel_ulong_t) &mhi_qcom_sdx75_info }, + { PCI_DEVICE(PCI_VENDOR_ID_QUECTEL, 0x1001), /* EM120R-GL (sdx24) */ diff --git a/queue-6.12/crypto-iaa-fix-out-of-bounds-index-in-find_empty_iaa_compression_mode.patch b/queue-6.12/crypto-iaa-fix-out-of-bounds-index-in-find_empty_iaa_compression_mode.patch new file mode 100644 index 0000000000..69cb7039e3 --- /dev/null +++ b/queue-6.12/crypto-iaa-fix-out-of-bounds-index-in-find_empty_iaa_compression_mode.patch @@ -0,0 +1,51 @@ +From 48329301969f6d21b2ef35f678e40f72b59eac94 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Thu, 27 Nov 2025 15:01:57 +0100 +Subject: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode + +From: Thorsten Blum + +commit 48329301969f6d21b2ef35f678e40f72b59eac94 upstream. + +The local variable 'i' is initialized with -EINVAL, but the for loop +immediately overwrites it and -EINVAL is never returned. + +If no empty compression mode can be found, the function would return the +out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid +array access in add_iaa_compression_mode(). + +Fix both issues by returning either a valid index or -EINVAL. + +Cc: stable@vger.kernel.org +Fixes: b190447e0fa3 ("crypto: iaa - Add compression mode management along with fixed mode") +Signed-off-by: Thorsten Blum +Acked-by: Kanchana P Sridhar +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/intel/iaa/iaa_crypto_main.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/crypto/intel/iaa/iaa_crypto_main.c ++++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c +@@ -223,15 +223,13 @@ static struct iaa_compression_mode *iaa_ + + static int find_empty_iaa_compression_mode(void) + { +- int i = -EINVAL; ++ int i; + +- for (i = 0; i < IAA_COMP_MODES_MAX; i++) { +- if (iaa_compression_modes[i]) +- continue; +- break; +- } ++ for (i = 0; i < IAA_COMP_MODES_MAX; i++) ++ if (!iaa_compression_modes[i]) ++ return i; + +- return i; ++ return -EINVAL; + } + + static struct iaa_compression_mode *find_iaa_compression_mode(const char *name, int *idx) diff --git a/queue-6.12/crypto-octeontx-fix-length-check-to-avoid-truncation-in-ucode_load_store.patch b/queue-6.12/crypto-octeontx-fix-length-check-to-avoid-truncation-in-ucode_load_store.patch new file mode 100644 index 0000000000..35c143a668 --- /dev/null +++ b/queue-6.12/crypto-octeontx-fix-length-check-to-avoid-truncation-in-ucode_load_store.patch @@ -0,0 +1,38 @@ +From 5565a72b24fa7935a9f30af386e92c8c9dfb23b9 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Wed, 26 Nov 2025 10:46:13 +0100 +Subject: crypto: octeontx - Fix length check to avoid truncation in ucode_load_store + +From: Thorsten Blum + +commit 5565a72b24fa7935a9f30af386e92c8c9dfb23b9 upstream. + +OTX_CPT_UCODE_NAME_LENGTH limits the microcode name to 64 bytes. If a +user writes a string of exactly 64 characters, the original code used +'strlen(buf) > 64' to check the length, but then strscpy() copies only +63 characters before adding a NUL terminator, silently truncating the +copied string. + +Fix this off-by-one error by using 'count' directly for the length check +to ensure long names are rejected early and copied without truncation. + +Cc: stable@vger.kernel.org +Fixes: d9110b0b01ff ("crypto: marvell - add support for OCTEON TX CPT engine") +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c ++++ b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c +@@ -1336,7 +1336,7 @@ static ssize_t ucode_load_store(struct d + int del_grp_idx = -1; + int ucode_idx = 0; + +- if (strlen(buf) > OTX_CPT_UCODE_NAME_LENGTH) ++ if (count >= OTX_CPT_UCODE_NAME_LENGTH) + return -EINVAL; + + eng_grps = container_of(attr, struct otx_cpt_eng_grps, ucode_load_attr); diff --git a/queue-6.12/crypto-omap-allocate-omap_crypto_force_copy-scatterlists-correctly.patch b/queue-6.12/crypto-omap-allocate-omap_crypto_force_copy-scatterlists-correctly.patch new file mode 100644 index 0000000000..0af85f573b --- /dev/null +++ b/queue-6.12/crypto-omap-allocate-omap_crypto_force_copy-scatterlists-correctly.patch @@ -0,0 +1,35 @@ +From 1562b1fb7e17c1b3addb15e125c718b2be7f5512 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Fri, 6 Feb 2026 19:49:54 -0800 +Subject: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly + +From: Kees Cook + +commit 1562b1fb7e17c1b3addb15e125c718b2be7f5512 upstream. + +The existing allocation of scatterlists in omap_crypto_copy_sg_lists() +was allocating an array of scatterlist pointers, not scatterlist objects, +resulting in a 4x too small allocation. + +Use sizeof(*new_sg) to get the correct object size. + +Fixes: 74ed87e7e7f7 ("crypto: omap - add base support library for common routines") +Signed-off-by: Kees Cook +Acked-by: Herbert Xu +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/omap-crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/omap-crypto.c ++++ b/drivers/crypto/omap-crypto.c +@@ -21,7 +21,7 @@ static int omap_crypto_copy_sg_lists(int + struct scatterlist *tmp; + + if (!(flags & OMAP_CRYPTO_FORCE_SINGLE_ENTRY)) { +- new_sg = kmalloc_array(n, sizeof(*sg), GFP_KERNEL); ++ new_sg = kmalloc_array(n, sizeof(*new_sg), GFP_KERNEL); + if (!new_sg) + return -ENOMEM; + diff --git a/queue-6.12/crypto-virtio-add-spinlock-protection-with-virtqueue-notification.patch b/queue-6.12/crypto-virtio-add-spinlock-protection-with-virtqueue-notification.patch new file mode 100644 index 0000000000..f397d323d4 --- /dev/null +++ b/queue-6.12/crypto-virtio-add-spinlock-protection-with-virtqueue-notification.patch @@ -0,0 +1,55 @@ +From b505047ffc8057555900d2d3a005d033e6967382 Mon Sep 17 00:00:00 2001 +From: Bibo Mao +Date: Tue, 13 Jan 2026 11:05:54 +0800 +Subject: crypto: virtio - Add spinlock protection with virtqueue notification + +From: Bibo Mao + +commit b505047ffc8057555900d2d3a005d033e6967382 upstream. + +When VM boots with one virtio-crypto PCI device and builtin backend, +run openssl benchmark command with multiple processes, such as + openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 + +openssl processes will hangup and there is error reported like this: + virtio_crypto virtio0: dataq.0:id 3 is not a head! + +It seems that the data virtqueue need protection when it is handled +for virtio done notification. If the spinlock protection is added +in virtcrypto_done_task(), openssl benchmark with multiple processes +works well. + +Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet") +Cc: stable@vger.kernel.org +Signed-off-by: Bibo Mao +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/virtio/virtio_crypto_core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/crypto/virtio/virtio_crypto_core.c ++++ b/drivers/crypto/virtio/virtio_crypto_core.c +@@ -75,15 +75,20 @@ static void virtcrypto_done_task(unsigne + struct data_queue *data_vq = (struct data_queue *)data; + struct virtqueue *vq = data_vq->vq; + struct virtio_crypto_request *vc_req; ++ unsigned long flags; + unsigned int len; + ++ spin_lock_irqsave(&data_vq->lock, flags); + do { + virtqueue_disable_cb(vq); + while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) { ++ spin_unlock_irqrestore(&data_vq->lock, flags); + if (vc_req->alg_cb) + vc_req->alg_cb(vc_req, len); ++ spin_lock_irqsave(&data_vq->lock, flags); + } + } while (!virtqueue_enable_cb(vq)); ++ spin_unlock_irqrestore(&data_vq->lock, flags); + } + + static void virtcrypto_dataq_callback(struct virtqueue *vq) diff --git a/queue-6.12/crypto-virtio-remove-duplicated-virtqueue_kick-in-virtio_crypto_skcipher_crypt_req.patch b/queue-6.12/crypto-virtio-remove-duplicated-virtqueue_kick-in-virtio_crypto_skcipher_crypt_req.patch new file mode 100644 index 0000000000..4552cf775d --- /dev/null +++ b/queue-6.12/crypto-virtio-remove-duplicated-virtqueue_kick-in-virtio_crypto_skcipher_crypt_req.patch @@ -0,0 +1,36 @@ +From 14f86a1155cca1176abf55987b2fce7f7fcb2455 Mon Sep 17 00:00:00 2001 +From: Bibo Mao +Date: Tue, 13 Jan 2026 11:05:55 +0800 +Subject: crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req + +From: Bibo Mao + +commit 14f86a1155cca1176abf55987b2fce7f7fcb2455 upstream. + +With function virtio_crypto_skcipher_crypt_req(), there is already +virtqueue_kick() call with spinlock held in function +__virtio_crypto_skcipher_do_req(). Remove duplicated virtqueue_kick() +function call here. + +Fixes: d79b5d0bbf2e ("crypto: virtio - support crypto engine framework") +Cc: stable@vger.kernel.org +Signed-off-by: Bibo Mao +Acked-by: Jason Wang +Acked-by: Michael S. Tsirkin +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/virtio/virtio_crypto_skcipher_algs.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/crypto/virtio/virtio_crypto_skcipher_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_skcipher_algs.c +@@ -550,8 +550,6 @@ int virtio_crypto_skcipher_crypt_req( + if (ret < 0) + return ret; + +- virtqueue_kick(data_vq->vq); +- + return 0; + } + diff --git a/queue-6.12/mptcp-fix-race-in-mptcp_pm_nl_flush_addrs_doit.patch b/queue-6.12/mptcp-fix-race-in-mptcp_pm_nl_flush_addrs_doit.patch new file mode 100644 index 0000000000..e9abc1af14 --- /dev/null +++ b/queue-6.12/mptcp-fix-race-in-mptcp_pm_nl_flush_addrs_doit.patch @@ -0,0 +1,75 @@ +From e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 24 Jan 2026 11:59:18 +0100 +Subject: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() + +From: Eric Dumazet + +commit e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d upstream. + +syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() +and/or mptcp_pm_nl_is_backup() + +Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() +which is not RCU ready. + +list_splice_init_rcu() can not be called here while holding pernet->lock +spinlock. + +Many thanks to Eulgyu Kim for providing a repro and testing our patches. + +Fixes: 141694df6573 ("mptcp: remove address when netlink flushes addrs") +Signed-off-by: Eric Dumazet +Reported-by: syzbot+5498a510ff9de39d37da@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/6970a46d.a00a0220.3ad28e.5cf0.GAE@google.com/T/ +Reported-by: Eulgyu Kim +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/611 +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260124-net-mptcp-race_nl_flush_addrs-v3-1-b2dc1b613e9d@kernel.org +Signed-off-by: Jakub Kicinski +[ Conflicts because the code has been moved from pm_netlink.c to + pm_kernel.c later on in commit 8617e85e04bd ("mptcp: pm: split + in-kernel PM specific code"). The same modifications can be applied + in pm_netlink.c with one exception, because 'pernet->local_addr_list' + has been renamed to 'pernet->endp_list' in commit 35e71e43a56d + ("mptcp: pm: in-kernel: rename 'local_addr_list' to 'endp_list'"). The + previous name is then still being used in this version. ] +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm_netlink.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -1811,16 +1811,26 @@ static void __reset_counters(struct pm_n + int mptcp_pm_nl_flush_addrs_doit(struct sk_buff *skb, struct genl_info *info) + { + struct pm_nl_pernet *pernet = genl_info_pm_nl(info); +- LIST_HEAD(free_list); ++ struct list_head free_list; + + spin_lock_bh(&pernet->lock); +- list_splice_init(&pernet->local_addr_list, &free_list); ++ free_list = pernet->local_addr_list; ++ INIT_LIST_HEAD_RCU(&pernet->local_addr_list); + __reset_counters(pernet); + pernet->next_id = 1; + bitmap_zero(pernet->id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1); + spin_unlock_bh(&pernet->lock); +- mptcp_nl_flush_addrs_list(sock_net(skb->sk), &free_list); ++ ++ if (free_list.next == &pernet->local_addr_list) ++ return 0; ++ + synchronize_rcu(); ++ ++ /* Adjust the pointers to free_list instead of pernet->local_addr_list */ ++ free_list.prev->next = &free_list; ++ free_list.next->prev = &free_list; ++ ++ mptcp_nl_flush_addrs_list(sock_net(skb->sk), &free_list); + __flush_addrs(&free_list); + return 0; + } diff --git a/queue-6.12/nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch b/queue-6.12/nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch new file mode 100644 index 0000000000..d3ac27d8c8 --- /dev/null +++ b/queue-6.12/nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch @@ -0,0 +1,72 @@ +From ed527ef0c264e4bed6c7b2a158ddf516b17f5f66 Mon Sep 17 00:00:00 2001 +From: Edward Adam Davis +Date: Sat, 20 Dec 2025 03:04:25 +0900 +Subject: nilfs2: Fix potential block overflow that cause system hang + +From: Edward Adam Davis + +commit ed527ef0c264e4bed6c7b2a158ddf516b17f5f66 upstream. + +When a user executes the FITRIM command, an underflow can occur when +calculating nblocks if end_block is too small. Since nblocks is of +type sector_t, which is u64, a negative nblocks value will become a +very large positive integer. This ultimately leads to the block layer +function __blkdev_issue_discard() taking an excessively long time to +process the bio chain, and the ns_segctor_sem lock remains held for a +long period. This prevents other tasks from acquiring the ns_segctor_sem +lock, resulting in the hang reported by syzbot in [1]. + +If the ending block is too small, typically if it is smaller than 4KiB +range, depending on the usage of the segment 0, it may be possible to +attempt a discard request beyond the device size causing the hang. + +Exiting successfully and assign the discarded size (0 in this case) +to range->len. + +Although the start and len values in the user input range are too small, +a conservative strategy is adopted here to safely ignore them, which is +equivalent to a no-op; it will not perform any trimming and will not +throw an error. + +[1] +task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000 +Call Trace: + rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272 + nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357 + nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline] + nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684 + +[ryusuke: corrected part of the commit message about the consequences] + +Fixes: 82e11e857be3 ("nilfs2: add nilfs_sufile_trim_fs to trim clean segs") +Reported-by: syzbot+7eedce5eb281acd832f0@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=7eedce5eb281acd832f0 +Signed-off-by: Edward Adam Davis +Signed-off-by: Ryusuke Konishi +Cc: stable@vger.kernel.org +Signed-off-by: Viacheslav Dubeyko +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/sufile.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/nilfs2/sufile.c ++++ b/fs/nilfs2/sufile.c +@@ -1106,6 +1106,9 @@ int nilfs_sufile_trim_fs(struct inode *s + else + end_block = start_block + len - 1; + ++ if (end_block < nilfs->ns_first_data_block) ++ goto out; ++ + segnum = nilfs_get_segnum_of_block(nilfs, start_block); + segnum_end = nilfs_get_segnum_of_block(nilfs, end_block); + +@@ -1203,6 +1206,7 @@ int nilfs_sufile_trim_fs(struct inode *s + out_sem: + up_read(&NILFS_MDT(sufile)->mi_sem); + ++out: + range->len = ndiscarded << nilfs->ns_blocksize_bits; + return ret; + } diff --git a/queue-6.12/scsi-qla2xxx-allow-recovery-for-tape-devices.patch b/queue-6.12/scsi-qla2xxx-allow-recovery-for-tape-devices.patch new file mode 100644 index 0000000000..bddd15e8bb --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-allow-recovery-for-tape-devices.patch @@ -0,0 +1,55 @@ +From b0335ee4fb94832a4ef68774ca7e7b33b473c7a6 Mon Sep 17 00:00:00 2001 +From: Shreyas Deodhar +Date: Wed, 10 Dec 2025 15:45:58 +0530 +Subject: scsi: qla2xxx: Allow recovery for tape devices + +From: Shreyas Deodhar + +commit b0335ee4fb94832a4ef68774ca7e7b33b473c7a6 upstream. + +Tape device doesn't show up after RSCNs. To fix this, remove tape +device specific checks which allows recovery of tape devices. + +Fixes: 44c57f205876 ("scsi: qla2xxx: Changes to support FCP2 Target") +Cc: stable@vger.kernel.org +Signed-off-by: Shreyas Deodhar +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Link: https://patch.msgid.link/20251210101604.431868-7-njavali@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_gs.c | 3 --- + drivers/scsi/qla2xxx/qla_init.c | 9 --------- + 2 files changed, 12 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3356,9 +3356,6 @@ login_logout: + atomic_read(&fcport->state) == FCS_ONLINE) || + do_delete) { + if (fcport->loop_id != FC_NO_LOOP_ID) { +- if (fcport->flags & FCF_FCP2_DEVICE) +- continue; +- + ql_log(ql_log_warn, vha, 0x20f0, + "%s %d %8phC post del sess\n", + __func__, __LINE__, +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1859,15 +1859,6 @@ void qla2x00_handle_rscn(scsi_qla_host_t + case RSCN_PORT_ADDR: + fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1); + if (fcport) { +- if (ql2xfc2target && +- fcport->flags & FCF_FCP2_DEVICE && +- atomic_read(&fcport->state) == FCS_ONLINE) { +- ql_dbg(ql_dbg_disc, vha, 0x2115, +- "Delaying session delete for FCP2 portid=%06x %8phC ", +- fcport->d_id.b24, fcport->port_name); +- return; +- } +- + if (vha->hw->flags.edif_enabled && DBELL_ACTIVE(vha)) { + /* + * On ipsec start by remote port, Target port diff --git a/queue-6.12/scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch b/queue-6.12/scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch new file mode 100644 index 0000000000..ec1e6e16b0 --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch @@ -0,0 +1,70 @@ +From 8890bf450e0b6b283f48ac619fca5ac2f14ddd62 Mon Sep 17 00:00:00 2001 +From: Anil Gurumurthy +Date: Wed, 10 Dec 2025 15:45:59 +0530 +Subject: scsi: qla2xxx: Delay module unload while fabric scan in progress + +From: Anil Gurumurthy + +commit 8890bf450e0b6b283f48ac619fca5ac2f14ddd62 upstream. + +System crash seen during load/unload test in a loop. + +[105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 +[105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0 +[105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000 +[105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 +[105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 +[105954.384928] PKRU: 55555554 +[105954.384929] Call Trace: +[105954.384931] +[105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] +[105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] +[105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] +[105954.384999] ? __wake_up_common+0x80/0x190 +[105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] +[105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] +[105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 +[105954.385044] ? handle_irq_event+0x58/0xb0 +[105954.385046] ? handle_edge_irq+0x93/0x240 +[105954.385050] ? __common_interrupt+0x41/0xa0 +[105954.385055] ? common_interrupt+0x3e/0xa0 +[105954.385060] ? asm_common_interrupt+0x22/0x40 + +The root cause of this was that there was a free (dma_free_attrs) in the +interrupt context. There was a device discovery/fabric scan in +progress. A module unload was issued which set the UNLOADING flag. As +part of the discovery, after receiving an interrupt a work queue was +scheduled (which involved a work to be queued). Since the UNLOADING +flag is set, the work item was not allocated and the mapped memory had +to be freed. The free occurred in interrupt context leading to system +crash. Delay the driver unload until the fabric scan is complete to +avoid the crash. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/202512090414.07Waorz0-lkp@intel.com/ +Fixes: 783e0dc4f66a ("qla2xxx: Check for device state before unloading the driver.") +Cc: stable@vger.kernel.org +Signed-off-by: Anil Gurumurthy +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Link: https://patch.msgid.link/20251210101604.431868-8-njavali@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_os.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1194,7 +1194,8 @@ qla2x00_wait_for_hba_ready(scsi_qla_host + while ((qla2x00_reset_active(vha) || ha->dpc_active || + ha->flags.mbox_busy) || + test_bit(FX00_RESET_RECOVERY, &vha->dpc_flags) || +- test_bit(FX00_TARGET_SCAN, &vha->dpc_flags)) { ++ test_bit(FX00_TARGET_SCAN, &vha->dpc_flags) || ++ (vha->scan.scan_flags & SF_SCANNING)) { + if (test_bit(UNLOADING, &base_vha->dpc_flags)) + break; + msleep(1000); diff --git a/queue-6.12/scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch b/queue-6.12/scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch new file mode 100644 index 0000000000..8d674dcee8 --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch @@ -0,0 +1,83 @@ +From 7adbd2b7809066c75f0433e5e2a8e114b429f30f Mon Sep 17 00:00:00 2001 +From: Anil Gurumurthy +Date: Wed, 10 Dec 2025 15:46:00 +0530 +Subject: scsi: qla2xxx: Free sp in error path to fix system crash + +From: Anil Gurumurthy + +commit 7adbd2b7809066c75f0433e5e2a8e114b429f30f upstream. + +System crash seen during load/unload test in a loop, + +[61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. +[61110.467494] ============================================================================= +[61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() +[61110.467501] ----------------------------------------------------------------------------- + +[61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff) +[61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 +[61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 +[61110.467515] Call Trace: +[61110.467516] +[61110.467519] dump_stack_lvl+0x34/0x48 +[61110.467526] slab_err.cold+0x53/0x67 +[61110.467534] __kmem_cache_shutdown+0x16e/0x320 +[61110.467540] kmem_cache_destroy+0x51/0x160 +[61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx] +[61110.467607] ? __do_sys_delete_module.constprop.0+0x178/0x280 +[61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0 +[61110.467616] ? do_syscall_64+0x5c/0x90 +[61110.467619] ? exc_page_fault+0x62/0x150 +[61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd +[61110.467626] +[61110.467627] Disabling lock debugging due to kernel taint +[61110.467635] Object 0x0000000026f7e6e6 @offset=16000 +[61110.467639] ------------[ cut here ]------------ +[61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx] +[61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160 +[61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 +[61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 +[61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160 +[61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 +[61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282 +[61110.467727] RAX: 0000000000000000 RBX: ffffffffc0d9a860 RCX: 0000000000000027 +[61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI: ffff8fd5ff9598a0 +[61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7 +[61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000 +[61110.467731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +[61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000 +[61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0 +[61110.467736] PKRU: 55555554 +[61110.467737] Call Trace: +[61110.467738] +[61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx] +[61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280 + +Free sp in the error path to fix the crash. + +Fixes: f352eeb75419 ("scsi: qla2xxx: Add ability to use GPNFT/GNNFT for RSCN handling") +Cc: stable@vger.kernel.org +Signed-off-by: Anil Gurumurthy +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Link: https://patch.msgid.link/20251210101604.431868-9-njavali@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_gs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3622,8 +3622,8 @@ int qla_fab_async_scan(scsi_qla_host_t * + if (vha->scan.scan_flags & SF_SCANNING) { + spin_unlock_irqrestore(&vha->work_lock, flags); + ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2012, +- "%s: scan active\n", __func__); +- return rval; ++ "%s: scan active for sp:%p\n", __func__, sp); ++ goto done_free_sp; + } + vha->scan.scan_flags |= SF_SCANNING; + if (!sp) diff --git a/queue-6.12/scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch b/queue-6.12/scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch new file mode 100644 index 0000000000..50ba41bd55 --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch @@ -0,0 +1,92 @@ +From 42b2dab4340d39b71334151e10c6d7d9b0040ffa Mon Sep 17 00:00:00 2001 +From: Anil Gurumurthy +Date: Wed, 10 Dec 2025 15:46:02 +0530 +Subject: scsi: qla2xxx: Query FW again before proceeding with login + +From: Anil Gurumurthy + +commit 42b2dab4340d39b71334151e10c6d7d9b0040ffa upstream. + +Issue occurred during a continuous reboot test of several thousand +iterations specific to a fabric topo with dual mode target where it +sends a PLOGI/PRLI and then sends a LOGO. The initiator was also in the +process of discovery and sent a PLOGI to the switch. It then queried a +list of ports logged in via mbx 75h and the GPDB response indicated that +the target was logged in. This caused a mismatch in the states between +the driver and FW. Requery the FW for the state and proceed with the +rest of discovery process. + +Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery") +Cc: stable@vger.kernel.org +Signed-off-by: Anil Gurumurthy +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Link: https://patch.msgid.link/20251210101604.431868-11-njavali@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_init.c | 19 +++++++++++++++++-- + drivers/scsi/qla2xxx/qla_isr.c | 19 +++++++++++++++++-- + 2 files changed, 34 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2462,8 +2462,23 @@ qla24xx_handle_plogi_done_event(struct s + ea->sp->gen1, fcport->rscn_gen, + ea->data[0], ea->data[1], ea->iop[0], ea->iop[1]); + +- if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) || +- (fcport->fw_login_state == DSC_LS_PRLI_PEND)) { ++ if (fcport->fw_login_state == DSC_LS_PLOGI_PEND) { ++ ql_dbg(ql_dbg_disc, vha, 0x20ea, ++ "%s %d %8phC Remote is trying to login\n", ++ __func__, __LINE__, fcport->port_name); ++ /* ++ * If we get here, there is port thats already logged in, ++ * but it's state has not moved ahead. Recheck with FW on ++ * what state it is in and proceed ahead ++ */ ++ if (!N2N_TOPO(vha->hw)) { ++ fcport->fw_login_state = DSC_LS_PRLI_COMP; ++ qla24xx_post_gpdb_work(vha, fcport, 0); ++ } ++ return; ++ } ++ ++ if (fcport->fw_login_state == DSC_LS_PRLI_PEND) { + ql_dbg(ql_dbg_disc, vha, 0x20ea, + "%s %d %8phC Remote is trying to login\n", + __func__, __LINE__, fcport->port_name); +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1676,13 +1676,28 @@ skip_rio: + + /* Port logout */ + fcport = qla2x00_find_fcport_by_loopid(vha, mb[1]); +- if (!fcport) ++ if (!fcport) { ++ ql_dbg(ql_dbg_async, vha, 0x5011, ++ "Could not find fcport:%04x %04x %04x\n", ++ mb[1], mb[2], mb[3]); + break; +- if (atomic_read(&fcport->state) != FCS_ONLINE) ++ } ++ ++ if (atomic_read(&fcport->state) != FCS_ONLINE) { ++ ql_dbg(ql_dbg_async, vha, 0x5012, ++ "Port state is not online State:0x%x \n", ++ atomic_read(&fcport->state)); ++ ql_dbg(ql_dbg_async, vha, 0x5012, ++ "Scheduling session for deletion \n"); ++ fcport->logout_on_delete = 0; ++ qlt_schedule_sess_for_deletion(fcport); + break; ++ } ++ + ql_dbg(ql_dbg_async, vha, 0x508a, + "Marking port lost loopid=%04x portid=%06x.\n", + fcport->loop_id, fcport->d_id.b24); ++ + if (qla_ini_mode_enabled(vha)) { + fcport->logout_on_delete = 0; + qlt_schedule_sess_for_deletion(fcport); diff --git a/queue-6.12/scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch b/queue-6.12/scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch new file mode 100644 index 0000000000..6c8d502c8b --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch @@ -0,0 +1,110 @@ +From b6df15aec8c3441357d4da0eaf4339eb20f5999f Mon Sep 17 00:00:00 2001 +From: Anil Gurumurthy +Date: Wed, 10 Dec 2025 15:46:01 +0530 +Subject: scsi: qla2xxx: Validate sp before freeing associated memory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Anil Gurumurthy + +commit b6df15aec8c3441357d4da0eaf4339eb20f5999f upstream. + +System crash with the following signature +[154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete +[154564.169363] qla2xxx [0000:b0:00.1]-3002:2: nvme: Sched: Set ZIO exchange threshold to 3. +[154564.169405] qla2xxx [0000:b0:00.1]-ffffff:2: SET ZIO Activity exchange threshold to 5. +[154565.539974] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 0080 0000. +[154565.545744] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 00a0 0000. +[154565.545857] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate). +[154565.552760] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate). +[154565.553079] BUG: kernel NULL pointer dereference, address: 00000000000000f8 +[154565.553080] #PF: supervisor read access in kernel mode +[154565.553082] #PF: error_code(0x0000) - not-present page +[154565.553084] PGD 80000010488ab067 P4D 80000010488ab067 PUD 104978a067 PMD 0 +[154565.553089] Oops: 0000 1 PREEMPT SMP PTI +[154565.553092] CPU: 10 PID: 858 Comm: qla2xxx_2_dpc Kdump: loaded Tainted: G OE ------- --- 5.14.0-503.11.1.el9_5.x86_64 #1 +[154565.553096] Hardware name: HPE Synergy 660 Gen10/Synergy 660 Gen10 Compute Module, BIOS I43 09/30/2024 +[154565.553097] RIP: 0010:qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] +[154565.553141] Code: 00 00 e8 58 a3 ec d4 49 89 e9 ba 12 20 00 00 4c 89 e6 49 c7 c0 00 ee a8 c0 48 c7 c1 66 c0 a9 c0 bf 00 80 00 10 e8 15 69 00 00 <4c> 8b 8d f8 00 00 00 4d 85 c9 74 35 49 8b 84 24 00 19 00 00 48 8b +[154565.553143] RSP: 0018:ffffb4dbc8aebdd0 EFLAGS: 00010286 +[154565.553145] RAX: 0000000000000000 RBX: ffff8ec2cf0908d0 RCX: 0000000000000002 +[154565.553147] RDX: 0000000000000000 RSI: ffffffffc0a9c896 RDI: ffffb4dbc8aebd47 +[154565.553148] RBP: 0000000000000000 R08: ffffb4dbc8aebd45 R09: 0000000000ffff0a +[154565.553150] R10: 0000000000000000 R11: 000000000000000f R12: ffff8ec2cf0908d0 +[154565.553151] R13: ffff8ec2cf090900 R14: 0000000000000102 R15: ffff8ec2cf084000 +[154565.553152] FS: 0000000000000000(0000) GS:ffff8ed27f800000(0000) knlGS:0000000000000000 +[154565.553154] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[154565.553155] CR2: 00000000000000f8 CR3: 000000113ae0a005 CR4: 00000000007706f0 +[154565.553157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[154565.553158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[154565.553159] PKRU: 55555554 +[154565.553160] Call Trace: +[154565.553162] +[154565.553165] ? show_trace_log_lvl+0x1c4/0x2df +[154565.553172] ? show_trace_log_lvl+0x1c4/0x2df +[154565.553177] ? qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] +[154565.553215] ? __die_body.cold+0x8/0xd +[154565.553218] ? page_fault_oops+0x134/0x170 +[154565.553223] ? snprintf+0x49/0x70 +[154565.553229] ? exc_page_fault+0x62/0x150 +[154565.553238] ? asm_exc_page_fault+0x22/0x30 + +Check for sp being non NULL before freeing any associated memory + +Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery") +Cc: stable@vger.kernel.org +Signed-off-by: Anil Gurumurthy +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Link: https://patch.msgid.link/20251210101604.431868-10-njavali@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_gs.c | 34 ++++++++++++++++++---------------- + 1 file changed, 18 insertions(+), 16 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3791,23 +3791,25 @@ int qla_fab_async_scan(scsi_qla_host_t * + return rval; + + done_free_sp: +- if (sp->u.iocb_cmd.u.ctarg.req) { +- dma_free_coherent(&vha->hw->pdev->dev, +- sp->u.iocb_cmd.u.ctarg.req_allocated_size, +- sp->u.iocb_cmd.u.ctarg.req, +- sp->u.iocb_cmd.u.ctarg.req_dma); +- sp->u.iocb_cmd.u.ctarg.req = NULL; +- } +- if (sp->u.iocb_cmd.u.ctarg.rsp) { +- dma_free_coherent(&vha->hw->pdev->dev, +- sp->u.iocb_cmd.u.ctarg.rsp_allocated_size, +- sp->u.iocb_cmd.u.ctarg.rsp, +- sp->u.iocb_cmd.u.ctarg.rsp_dma); +- sp->u.iocb_cmd.u.ctarg.rsp = NULL; +- } ++ if (sp) { ++ if (sp->u.iocb_cmd.u.ctarg.req) { ++ dma_free_coherent(&vha->hw->pdev->dev, ++ sp->u.iocb_cmd.u.ctarg.req_allocated_size, ++ sp->u.iocb_cmd.u.ctarg.req, ++ sp->u.iocb_cmd.u.ctarg.req_dma); ++ sp->u.iocb_cmd.u.ctarg.req = NULL; ++ } ++ if (sp->u.iocb_cmd.u.ctarg.rsp) { ++ dma_free_coherent(&vha->hw->pdev->dev, ++ sp->u.iocb_cmd.u.ctarg.rsp_allocated_size, ++ sp->u.iocb_cmd.u.ctarg.rsp, ++ sp->u.iocb_cmd.u.ctarg.rsp_dma); ++ sp->u.iocb_cmd.u.ctarg.rsp = NULL; ++ } + +- /* ref: INIT */ +- kref_put(&sp->cmd_kref, qla2x00_sp_release); ++ /* ref: INIT */ ++ kref_put(&sp->cmd_kref, qla2x00_sp_release); ++ } + + spin_lock_irqsave(&vha->work_lock, flags); + vha->scan.scan_flags &= ~SF_SCANNING; diff --git a/queue-6.12/series b/queue-6.12/series index 1f1a145026..ac85f36914 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -2,3 +2,18 @@ smb-client-split-cached_fid-bitfields-to-avoid-shared-byte-rmw-races.patch ksmbd-fix-infinite-loop-caused-by-next_smb2_rcv_hdr_off-reset-in-error-paths.patch smb-server-fix-leak-of-active_num_conn-in-ksmbd_tcp_new_connection.patch driver-core-enforce-device_lock-for-driver_match_device.patch +bluetooth-btusb-add-usb-id-7392-e611-for-edimax-ew-7611uxb.patch +crypto-iaa-fix-out-of-bounds-index-in-find_empty_iaa_compression_mode.patch +crypto-octeontx-fix-length-check-to-avoid-truncation-in-ucode_load_store.patch +crypto-omap-allocate-omap_crypto_force_copy-scatterlists-correctly.patch +crypto-virtio-add-spinlock-protection-with-virtqueue-notification.patch +crypto-virtio-remove-duplicated-virtqueue_kick-in-virtio_crypto_skcipher_crypt_req.patch +nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch +wifi-rtw88-fix-alignment-fault-in-rtw_core_enable_beacon.patch +scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch +scsi-qla2xxx-allow-recovery-for-tape-devices.patch +scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch +scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch +scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch +bus-mhi-host-pci_generic-add-telit-fe990b40-modem-support.patch +mptcp-fix-race-in-mptcp_pm_nl_flush_addrs_doit.patch diff --git a/queue-6.12/wifi-rtw88-fix-alignment-fault-in-rtw_core_enable_beacon.patch b/queue-6.12/wifi-rtw88-fix-alignment-fault-in-rtw_core_enable_beacon.patch new file mode 100644 index 0000000000..63797d26e4 --- /dev/null +++ b/queue-6.12/wifi-rtw88-fix-alignment-fault-in-rtw_core_enable_beacon.patch @@ -0,0 +1,86 @@ +From 0177aa828d966117ea30a44f2e1890fdb356118e Mon Sep 17 00:00:00 2001 +From: Bitterblue Smith +Date: Wed, 24 Dec 2025 01:24:21 +0200 +Subject: wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() + +From: Bitterblue Smith + +commit 0177aa828d966117ea30a44f2e1890fdb356118e upstream. + +rtw_core_enable_beacon() reads 4 bytes from an address that is not a +multiple of 4. This results in a crash on some systems. + +Do 1 byte reads/writes instead. + +Unable to handle kernel paging request at virtual address ffff8000827e0522 +Mem abort info: + ESR = 0x0000000096000021 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x21: alignment fault +Data abort info: + ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000005492000 +[ffff8000827e0522] pgd=0000000000000000, p4d=10000001021d9403, pud=10000001021da403, pmd=100000011061c403, pte=00780000f3200f13 +Internal error: Oops: 0000000096000021 [#1] SMP +Modules linked in: [...] rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core [...] +CPU: 0 UID: 0 PID: 73 Comm: kworker/u32:2 Tainted: G W 6.17.9 #1-NixOS VOLUNTARY +Tainted: [W]=WARN +Hardware name: FriendlyElec NanoPC-T6 LTS (DT) +Workqueue: phy0 rtw_c2h_work [rtw88_core] +pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : rtw_pci_read32+0x18/0x40 [rtw88_pci] +lr : rtw_core_enable_beacon+0xe0/0x148 [rtw88_core] +sp : ffff800080cc3ca0 +x29: ffff800080cc3ca0 x28: ffff0001031fc240 x27: ffff000102100828 +x26: ffffd2cb7c9b4088 x25: ffff0001031fc2c0 x24: ffff000112fdef00 +x23: ffff000112fdef18 x22: ffff000111c29970 x21: 0000000000000001 +x20: 0000000000000001 x19: ffff000111c22040 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 +x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 +x11: 0000000000000000 x10: 0000000000000000 x9 : ffffd2cb6507c090 +x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : 0000000000007f10 x1 : 0000000000000522 x0 : ffff8000827e0522 +Call trace: + rtw_pci_read32+0x18/0x40 [rtw88_pci] (P) + rtw_hw_scan_chan_switch+0x124/0x1a8 [rtw88_core] + rtw_fw_c2h_cmd_handle+0x254/0x290 [rtw88_core] + rtw_c2h_work+0x50/0x98 [rtw88_core] + process_one_work+0x178/0x3f8 + worker_thread+0x208/0x418 + kthread+0x120/0x220 + ret_from_fork+0x10/0x20 +Code: d28fe202 8b020000 f9524400 8b214000 (b9400000) +---[ end trace 0000000000000000 ]--- + +Fixes: ad6741b1e044 ("wifi: rtw88: Stop high queue during scan") +Cc: stable@vger.kernel.org +Closes: https://github.com/lwfinger/rtw88/issues/418 +Signed-off-by: Bitterblue Smith +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/6345300d-8c93-464c-9b05-d0d9af3c97ad@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtw88/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -2408,10 +2408,10 @@ void rtw_core_enable_beacon(struct rtw_d + + if (enable) { + rtw_write32_set(rtwdev, REG_BCN_CTRL, BIT_EN_BCN_FUNCTION); +- rtw_write32_clr(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE); ++ rtw_write8_clr(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE); + } else { + rtw_write32_clr(rtwdev, REG_BCN_CTRL, BIT_EN_BCN_FUNCTION); +- rtw_write32_set(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE); ++ rtw_write8_set(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE); + } + } + -- 2.47.3