From: Greg Kroah-Hartman Date: Sat, 30 May 2026 10:35:45 +0000 (+0200) Subject: fuzz cleanup X-Git-Tag: v5.10.258~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8c0c83f94185728d9056f6c6206fdead61afe803;p=thirdparty%2Fkernel%2Fstable-queue.git fuzz cleanup --- diff --git a/queue-6.1/bpf-sockmap-fix-af_unix-iter-deadlock.patch b/queue-6.1/bpf-sockmap-fix-af_unix-iter-deadlock.patch index 1f1578272d..12a0a1dede 100644 --- a/queue-6.1/bpf-sockmap-fix-af_unix-iter-deadlock.patch +++ b/queue-6.1/bpf-sockmap-fix-af_unix-iter-deadlock.patch @@ -62,14 +62,12 @@ Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-2-2af6fe97918e@rbox.co Signed-off-by: Sasha Levin --- - net/unix/af_unix.c | 7 +++---- + net/unix/af_unix.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 99d80687998bd..f810c2b90b8b1 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c -@@ -3601,15 +3601,14 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) +@@ -3598,15 +3598,14 @@ static int bpf_iter_unix_seq_show(struct struct bpf_prog *prog; struct sock *sk = v; uid_t uid; @@ -87,7 +85,7 @@ index 99d80687998bd..f810c2b90b8b1 100644 ret = SEQ_SKIP; goto unlock; } -@@ -3619,7 +3618,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) +@@ -3616,7 +3615,7 @@ static int bpf_iter_unix_seq_show(struct prog = bpf_iter_get_info(&meta, false); ret = unix_prog_seq_show(prog, &meta, v, uid); unlock: @@ -96,6 +94,3 @@ index 99d80687998bd..f810c2b90b8b1 100644 return ret; } --- -2.53.0 - diff --git a/queue-6.1/bpf-sockmap-take-state-lock-for-af_unix-iter.patch b/queue-6.1/bpf-sockmap-take-state-lock-for-af_unix-iter.patch index bd7573c722..f89c0c0b87 100644 --- a/queue-6.1/bpf-sockmap-take-state-lock-for-af_unix-iter.patch +++ b/queue-6.1/bpf-sockmap-take-state-lock-for-af_unix-iter.patch @@ -87,14 +87,12 @@ Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-5-2af6fe97918e@rbox.co Signed-off-by: Sasha Levin --- - net/unix/af_unix.c | 2 ++ + net/unix/af_unix.c | 2 ++ 1 file changed, 2 insertions(+) -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index f810c2b90b8b1..8b0dc82fcdca3 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c -@@ -3607,6 +3607,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) +@@ -3604,6 +3604,7 @@ static int bpf_iter_unix_seq_show(struct return 0; lock_sock(sk); @@ -102,7 +100,7 @@ index f810c2b90b8b1..8b0dc82fcdca3 100644 if (unlikely(sock_flag(sk, SOCK_DEAD))) { ret = SEQ_SKIP; -@@ -3618,6 +3619,7 @@ static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) +@@ -3615,6 +3616,7 @@ static int bpf_iter_unix_seq_show(struct prog = bpf_iter_get_info(&meta, false); ret = unix_prog_seq_show(prog, &meta, v, uid); unlock: @@ -110,6 +108,3 @@ index f810c2b90b8b1..8b0dc82fcdca3 100644 release_sock(sk); return ret; } --- -2.53.0 - diff --git a/queue-6.12/firmware-arm_ffa-align-rxtx-buffer-size-before-mappi.patch b/queue-6.12/firmware-arm_ffa-align-rxtx-buffer-size-before-mappi.patch index 9305b76943..0b099fd572 100644 --- a/queue-6.12/firmware-arm_ffa-align-rxtx-buffer-size-before-mappi.patch +++ b/queue-6.12/firmware-arm_ffa-align-rxtx-buffer-size-before-mappi.patch @@ -23,14 +23,12 @@ Link: https://patch.msgid.link/20260428-ffa_fixes-v2-9-8595ae450034@kernel.org Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- - drivers/firmware/arm_ffa/driver.c | 3 ++- + drivers/firmware/arm_ffa/driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c -index 521007bfa35a4..f35c3a56326c7 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c -@@ -1929,6 +1929,7 @@ static int __init ffa_init(void) +@@ -1885,6 +1885,7 @@ static int __init ffa_init(void) rxtx_bufsz = SZ_4K; } @@ -38,7 +36,7 @@ index 521007bfa35a4..f35c3a56326c7 100644 drv_info->rxtx_bufsz = rxtx_bufsz; drv_info->rx_buffer = alloc_pages_exact(rxtx_bufsz, GFP_KERNEL); if (!drv_info->rx_buffer) { -@@ -1944,7 +1945,7 @@ static int __init ffa_init(void) +@@ -1900,7 +1901,7 @@ static int __init ffa_init(void) ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer), virt_to_phys(drv_info->rx_buffer), @@ -47,6 +45,3 @@ index 521007bfa35a4..f35c3a56326c7 100644 if (ret) { pr_err("failed to register FFA RxTx buffers\n"); goto free_pages; --- -2.53.0 - diff --git a/queue-6.12/firmware-arm_ffa-fix-sched-recv-callback-partition-l.patch b/queue-6.12/firmware-arm_ffa-fix-sched-recv-callback-partition-l.patch index f13a8d6085..210d91e2cf 100644 --- a/queue-6.12/firmware-arm_ffa-fix-sched-recv-callback-partition-l.patch +++ b/queue-6.12/firmware-arm_ffa-fix-sched-recv-callback-partition-l.patch @@ -18,14 +18,12 @@ Link: https://patch.msgid.link/20260428-ffa_fixes-v2-11-8595ae450034@kernel.org Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin --- - drivers/firmware/arm_ffa/driver.c | 6 +++--- + drivers/firmware/arm_ffa/driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c -index f35c3a56326c7..89474fa3c80e5 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c -@@ -1155,7 +1155,7 @@ static int +@@ -1111,7 +1111,7 @@ static int ffa_sched_recv_cb_update(struct ffa_device *dev, ffa_sched_recv_cb callback, void *cb_data, bool is_registration) { @@ -34,7 +32,7 @@ index f35c3a56326c7..89474fa3c80e5 100644 struct list_head *phead; bool cb_valid; -@@ -1168,11 +1168,11 @@ ffa_sched_recv_cb_update(struct ffa_device *dev, ffa_sched_recv_cb callback, +@@ -1124,11 +1124,11 @@ ffa_sched_recv_cb_update(struct ffa_devi return -EINVAL; } @@ -48,6 +46,3 @@ index f35c3a56326c7..89474fa3c80e5 100644 pr_err("%s: No such partition ID 0x%x\n", __func__, dev->vm_id); return -EINVAL; } --- -2.53.0 - diff --git a/queue-6.18/net-shaper-annotate-the-data-races.patch b/queue-6.18/net-shaper-annotate-the-data-races.patch index a3f5b333e0..b23d98c0eb 100644 --- a/queue-6.18/net-shaper-annotate-the-data-races.patch +++ b/queue-6.18/net-shaper-annotate-the-data-races.patch @@ -22,14 +22,12 @@ Signed-off-by: Jakub Kicinski Stable-dep-of: b8d7519352ba ("net: shaper: rework the VALID marking (again)") Signed-off-by: Sasha Levin --- - net/shaper/shaper.c | 53 ++++++++++++++++++++++++++++++++------------- + net/shaper/shaper.c | 53 +++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 38 insertions(+), 15 deletions(-) -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index 23d535f157294..a01de4392eb66 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -138,35 +138,58 @@ static int net_shaper_fill_handle(struct sk_buff *msg, +@@ -136,35 +136,58 @@ handle_nest_cancel: return -EMSGSIZE; } @@ -102,7 +100,7 @@ index 23d535f157294..a01de4392eb66 100644 goto nla_put_failure; genlmsg_end(msg, hdr); -@@ -424,7 +447,7 @@ static void net_shaper_commit(struct net_shaper_binding *binding, +@@ -422,7 +445,7 @@ static void net_shaper_commit(struct net /* Successful update: drop the tentative mark * and update the hierarchy container. */ @@ -111,6 +109,3 @@ index 23d535f157294..a01de4392eb66 100644 smp_wmb(); __xa_set_mark(&hierarchy->shapers, index, NET_SHAPER_VALID); } --- -2.53.0 - diff --git a/queue-6.18/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch b/queue-6.18/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch index d5b05185c9..567d6128a5 100644 --- a/queue-6.18/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch +++ b/queue-6.18/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch @@ -21,14 +21,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-10-kuba@kernel.org Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- - net/shaper/shaper.c | 6 ++++++ + net/shaper/shaper.c | 6 ++++++ 1 file changed, 6 insertions(+) -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index b2d85963243fa..d65008b819dc9 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -482,6 +482,12 @@ static int net_shaper_parse_handle(const struct nlattr *attr, +@@ -480,6 +480,12 @@ static int net_shaper_parse_handle(const else if (handle->scope == NET_SHAPER_SCOPE_NODE) id = NET_SHAPER_ID_UNSPEC; @@ -41,6 +39,3 @@ index b2d85963243fa..d65008b819dc9 100644 handle->id = id; return 0; } --- -2.53.0 - diff --git a/queue-6.18/net-shaper-reject-queue-scope-handle-with-missing-id.patch b/queue-6.18/net-shaper-reject-queue-scope-handle-with-missing-id.patch index da7ab108a1..dc506bdb4d 100644 --- a/queue-6.18/net-shaper-reject-queue-scope-handle-with-missing-id.patch +++ b/queue-6.18/net-shaper-reject-queue-scope-handle-with-missing-id.patch @@ -25,14 +25,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-11-kuba@kernel.org Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- - net/shaper/shaper.c | 9 +++++++-- + net/shaper/shaper.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index d65008b819dc9..23d535f157294 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -477,10 +477,15 @@ static int net_shaper_parse_handle(const struct nlattr *attr, +@@ -475,10 +475,15 @@ static int net_shaper_parse_handle(const * shaper (any other value). */ id_attr = tb[NET_SHAPER_A_HANDLE_ID]; @@ -50,6 +48,3 @@ index d65008b819dc9..23d535f157294 100644 if (id && handle->scope == NET_SHAPER_SCOPE_NETDEV) { NL_SET_ERR_MSG_ATTR(info->extack, id_attr, --- -2.53.0 - diff --git a/queue-6.18/net-shaper-rework-the-valid-marking-again.patch b/queue-6.18/net-shaper-rework-the-valid-marking-again.patch index 0cb93d399a..cb46238c5e 100644 --- a/queue-6.18/net-shaper-rework-the-valid-marking-again.patch +++ b/queue-6.18/net-shaper-rework-the-valid-marking-again.patch @@ -31,12 +31,10 @@ Link: https://patch.msgid.link/20260515221325.1685455-3-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- - include/net/net_shaper.h | 1 + - net/shaper/shaper.c | 45 ++++++++++++++++------------------------ + include/net/net_shaper.h | 1 + + net/shaper/shaper.c | 45 ++++++++++++++++++--------------------------- 2 files changed, 19 insertions(+), 27 deletions(-) -diff --git a/include/net/net_shaper.h b/include/net/net_shaper.h -index 5c3f49b52fe96..3939b816b0011 100644 --- a/include/net/net_shaper.h +++ b/include/net/net_shaper.h @@ -53,6 +53,7 @@ struct net_shaper { @@ -47,11 +45,9 @@ index 5c3f49b52fe96..3939b816b0011 100644 struct rcu_head rcu; }; -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index a01de4392eb66..f992b28e19fd6 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -306,31 +306,24 @@ static void net_shaper_default_parent(const struct net_shaper_handle *handle, +@@ -304,31 +304,24 @@ static void net_shaper_default_parent(co parent->id = 0; } @@ -91,7 +87,7 @@ index a01de4392eb66..f992b28e19fd6 100644 } /* Allocate on demand the per device shaper's hierarchy container. -@@ -444,12 +437,10 @@ static void net_shaper_commit(struct net_shaper_binding *binding, +@@ -442,12 +435,10 @@ static void net_shaper_commit(struct net if (WARN_ON_ONCE(!cur)) continue; @@ -107,7 +103,7 @@ index a01de4392eb66..f992b28e19fd6 100644 } xa_unlock(&hierarchy->shapers); } -@@ -466,10 +457,10 @@ static void net_shaper_rollback(struct net_shaper_binding *binding) +@@ -464,10 +455,10 @@ static void net_shaper_rollback(struct n xa_lock(&hierarchy->shapers); xa_for_each(&hierarchy->shapers, index, cur) { @@ -120,7 +116,7 @@ index a01de4392eb66..f992b28e19fd6 100644 } xa_unlock(&hierarchy->shapers); } -@@ -882,12 +873,12 @@ int net_shaper_nl_get_dumpit(struct sk_buff *skb, +@@ -880,12 +871,12 @@ int net_shaper_nl_get_dumpit(struct sk_b goto out_unlock; for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index, @@ -138,6 +134,3 @@ index a01de4392eb66..f992b28e19fd6 100644 ret = net_shaper_fill_one(skb, binding, shaper, info); if (ret) break; --- -2.53.0 - diff --git a/queue-7.0/net-shaper-annotate-the-data-races.patch b/queue-7.0/net-shaper-annotate-the-data-races.patch index 0b560fc224..668dc6f032 100644 --- a/queue-7.0/net-shaper-annotate-the-data-races.patch +++ b/queue-7.0/net-shaper-annotate-the-data-races.patch @@ -22,14 +22,12 @@ Signed-off-by: Jakub Kicinski Stable-dep-of: b8d7519352ba ("net: shaper: rework the VALID marking (again)") Signed-off-by: Sasha Levin --- - net/shaper/shaper.c | 53 ++++++++++++++++++++++++++++++++------------- + net/shaper/shaper.c | 53 +++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 38 insertions(+), 15 deletions(-) -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index b1c65110f04d3..520cefdc3d908 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -138,35 +138,58 @@ static int net_shaper_fill_handle(struct sk_buff *msg, +@@ -136,35 +136,58 @@ handle_nest_cancel: return -EMSGSIZE; } @@ -102,7 +100,7 @@ index b1c65110f04d3..520cefdc3d908 100644 goto nla_put_failure; genlmsg_end(msg, hdr); -@@ -424,7 +447,7 @@ static void net_shaper_commit(struct net_shaper_binding *binding, +@@ -422,7 +445,7 @@ static void net_shaper_commit(struct net /* Successful update: drop the tentative mark * and update the hierarchy container. */ @@ -111,6 +109,3 @@ index b1c65110f04d3..520cefdc3d908 100644 smp_wmb(); __xa_set_mark(&hierarchy->shapers, index, NET_SHAPER_VALID); } --- -2.53.0 - diff --git a/queue-7.0/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch b/queue-7.0/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch index c3d20670aa..982e58ed8d 100644 --- a/queue-7.0/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch +++ b/queue-7.0/net-shaper-enforce-singleton-netdev-scope-with-id-0.patch @@ -21,14 +21,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-10-kuba@kernel.org Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- - net/shaper/shaper.c | 6 ++++++ + net/shaper/shaper.c | 6 ++++++ 1 file changed, 6 insertions(+) -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index eb049847fed65..4ae3ee6764a0a 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -482,6 +482,12 @@ static int net_shaper_parse_handle(const struct nlattr *attr, +@@ -480,6 +480,12 @@ static int net_shaper_parse_handle(const else if (handle->scope == NET_SHAPER_SCOPE_NODE) id = NET_SHAPER_ID_UNSPEC; @@ -41,6 +39,3 @@ index eb049847fed65..4ae3ee6764a0a 100644 handle->id = id; return 0; } --- -2.53.0 - diff --git a/queue-7.0/net-shaper-reject-queue-scope-handle-with-missing-id.patch b/queue-7.0/net-shaper-reject-queue-scope-handle-with-missing-id.patch index ea00919b2f..31b6aa18d5 100644 --- a/queue-7.0/net-shaper-reject-queue-scope-handle-with-missing-id.patch +++ b/queue-7.0/net-shaper-reject-queue-scope-handle-with-missing-id.patch @@ -25,14 +25,12 @@ Link: https://patch.msgid.link/20260510192904.3987113-11-kuba@kernel.org Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- - net/shaper/shaper.c | 9 +++++++-- + net/shaper/shaper.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index 4ae3ee6764a0a..b1c65110f04d3 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -477,10 +477,15 @@ static int net_shaper_parse_handle(const struct nlattr *attr, +@@ -475,10 +475,15 @@ static int net_shaper_parse_handle(const * shaper (any other value). */ id_attr = tb[NET_SHAPER_A_HANDLE_ID]; @@ -50,6 +48,3 @@ index 4ae3ee6764a0a..b1c65110f04d3 100644 if (id && handle->scope == NET_SHAPER_SCOPE_NETDEV) { NL_SET_ERR_MSG_ATTR(info->extack, id_attr, --- -2.53.0 - diff --git a/queue-7.0/net-shaper-rework-the-valid-marking-again.patch b/queue-7.0/net-shaper-rework-the-valid-marking-again.patch index 642c33250b..33958bf1d8 100644 --- a/queue-7.0/net-shaper-rework-the-valid-marking-again.patch +++ b/queue-7.0/net-shaper-rework-the-valid-marking-again.patch @@ -31,12 +31,10 @@ Link: https://patch.msgid.link/20260515221325.1685455-3-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- - include/net/net_shaper.h | 1 + - net/shaper/shaper.c | 45 ++++++++++++++++------------------------ + include/net/net_shaper.h | 1 + + net/shaper/shaper.c | 45 ++++++++++++++++++--------------------------- 2 files changed, 19 insertions(+), 27 deletions(-) -diff --git a/include/net/net_shaper.h b/include/net/net_shaper.h -index 5c3f49b52fe96..3939b816b0011 100644 --- a/include/net/net_shaper.h +++ b/include/net/net_shaper.h @@ -53,6 +53,7 @@ struct net_shaper { @@ -47,11 +45,9 @@ index 5c3f49b52fe96..3939b816b0011 100644 struct rcu_head rcu; }; -diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c -index 520cefdc3d908..dea9270f3e57d 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c -@@ -306,31 +306,24 @@ static void net_shaper_default_parent(const struct net_shaper_handle *handle, +@@ -304,31 +304,24 @@ static void net_shaper_default_parent(co parent->id = 0; } @@ -91,7 +87,7 @@ index 520cefdc3d908..dea9270f3e57d 100644 } /* Allocate on demand the per device shaper's hierarchy container. -@@ -444,12 +437,10 @@ static void net_shaper_commit(struct net_shaper_binding *binding, +@@ -442,12 +435,10 @@ static void net_shaper_commit(struct net if (WARN_ON_ONCE(!cur)) continue; @@ -107,7 +103,7 @@ index 520cefdc3d908..dea9270f3e57d 100644 } xa_unlock(&hierarchy->shapers); } -@@ -466,10 +457,10 @@ static void net_shaper_rollback(struct net_shaper_binding *binding) +@@ -464,10 +455,10 @@ static void net_shaper_rollback(struct n xa_lock(&hierarchy->shapers); xa_for_each(&hierarchy->shapers, index, cur) { @@ -120,7 +116,7 @@ index 520cefdc3d908..dea9270f3e57d 100644 } xa_unlock(&hierarchy->shapers); } -@@ -882,12 +873,12 @@ int net_shaper_nl_get_dumpit(struct sk_buff *skb, +@@ -880,12 +871,12 @@ int net_shaper_nl_get_dumpit(struct sk_b goto out_unlock; for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index, @@ -138,6 +134,3 @@ index 520cefdc3d908..dea9270f3e57d 100644 ret = net_shaper_fill_one(skb, binding, shaper, info); if (ret) break; --- -2.53.0 -