--- /dev/null
+From e057b94772328221405b067c3a85fe479b915dc8 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Thu, 16 Jul 2026 13:06:39 +0100
+Subject: arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
+
+From: Will Deacon <will@kernel.org>
+
+commit e057b94772328221405b067c3a85fe479b915dc8 upstream.
+
+When seccomp support was originally added to arm64 in a1ae65b21941
+("arm64: add seccomp support"), seccomp was erroneously called _before_
+the ptrace syscall-enter-stop and therefore the tracer could trivially
+manipulate the syscall register state after the seccomp check had
+passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run
+seccomp after ptrace") by moving the seccomp check after the tracer has
+run. Unfortunately, a decade later, that fix has been reported to be
+incomplete.
+
+On arm64, both the first argument to a syscall and its eventual return
+value are allocated to register x0. In order to facilitate syscall
+restarting and querying of syscall arguments on the syscall exit path,
+the original value of x0 is stashed in 'struct pt_regs::orig_x0' early
+during the syscall entry path and is returned for the first argument by
+syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not
+directly exposed via ptrace() and so changes to register x0 made by the
+tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This
+means that seccomp, syscall tracepoints and audit can observe a stale
+value for the register compared to the argument that will be observed by
+the actual syscall.
+
+Re-sync 'orig_x0' from x0 on the syscall entry path following a
+potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or
+SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because
+compat tasks expose 'orig_r0' to ptrace) where the syscall is not being
+skipped (because x0 is updated to hold the return value of -ENOSYS in
+that case).
+
+Cc: Kees Cook <kees@kernel.org>
+Cc: Jinjie Ruan <ruanjinjie@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: stable@vger.kernel.org
+Reported-by: Yiqi Sun <sunyiqixm@gmail.com>
+Link: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Fixes: a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace")
+Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Tested-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/ptrace.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -1844,6 +1844,21 @@ static void tracehook_report_syscall(str
+ }
+ }
+
++static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
++{
++ /*
++ * Keep orig_x0 authoritative so that seccomp (via
++ * syscall_get_arguments()), audit and the restart path all see the same
++ * first argument the syscall is dispatched with, even if it has been
++ * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
++ * or the tracer), as regs[0] holds the return value (see the comment in
++ * el0_svc_common()) and can be unwound using syscall_rollback().
++ * For compat tasks, orig_r0 is provided directly through GPR index 17.
++ */
++ if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
++ regs->orig_x0 = regs->regs[0];
++}
++
+ int syscall_trace_enter(struct pt_regs *regs)
+ {
+ unsigned long flags = READ_ONCE(current_thread_info()->flags);
+@@ -1852,12 +1867,26 @@ int syscall_trace_enter(struct pt_regs *
+ tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+ if (flags & _TIF_SYSCALL_EMU)
+ return NO_SYSCALL;
++
++ /*
++ * Ensure ptrace changes to x0 during a regular
++ * syscall-enter-stop (PTRACE_SYSCALL) are visible to
++ * subsequent seccomp checks, tracepoints and audit.
++ */
++ update_syscall_orig_x0_after_ptrace(regs);
+ }
+
+ /* Do the secure computing after ptrace; failures should be fast. */
+ if (secure_computing() == -1)
+ return NO_SYSCALL;
+
++ /*
++ * Ensure tracer changes to x0 during seccomp ptrace exit
++ * processing (SECCOMP_RET_TRACE) are visible to tracepoints and
++ * audit.
++ */
++ update_syscall_orig_x0_after_ptrace(regs);
++
+ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
+ trace_sys_enter(regs, regs->syscallno);
+
--- /dev/null
+From b27e195d4db8dea263050bdbeb11881b2999c9c6 Mon Sep 17 00:00:00 2001
+From: Xu Rao <raoxu@uniontech.com>
+Date: Mon, 20 Jul 2026 20:44:21 +0100
+Subject: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
+
+From: Xu Rao <raoxu@uniontech.com>
+
+commit b27e195d4db8dea263050bdbeb11881b2999c9c6 upstream.
+
+mmc_ioctl_cdrom_volume() first reads the audio control mode page into a
+32-byte stack buffer with cgc->buflen set to 24. If the device reports a
+block descriptor, the function increases cgc->buflen to include that
+descriptor and reads the page again.
+
+For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list
+by moving cgc->buffer forward by offset - 8 bytes. This drops the block
+descriptor from the outgoing payload and leaves a new 8-byte mode
+parameter header in front of the audio control page. However, cgc->buflen
+is left unchanged.
+
+With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8
+but cgc->buflen remains 32. cdrom_mode_select() therefore asks the low
+level packet path to write 32 bytes from that adjusted pointer, reading 8
+bytes past the end of the 32-byte stack buffer.
+
+This is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on
+drives that return a non-zero block descriptor length, which helps explain
+why it has gone unnoticed. The overread is also sent to the device as
+extra MODE SELECT payload, so it may not produce an obvious local failure.
+
+Reduce cgc->buflen by the same amount as the buffer pointer adjustment so
+the MODE SELECT transfer covers only the intended parameter list.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Link: https://patch.msgid.link/20260720194421.1497-2-phil@philpotter.co.uk
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cdrom/cdrom.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -3165,6 +3165,7 @@ static noinline int mmc_ioctl_cdrom_volu
+
+ /* set volume */
+ cgc->buffer = buffer + offset - 8;
++ cgc->buflen -= offset - 8;
+ memset(cgc->buffer, 0, 8);
+ return cdrom_mode_select(cdi, cgc);
+ }
--- /dev/null
+From 17221216ae8ce6a24e8a4e787382e3ebc81b88a8 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Wed, 27 May 2026 13:51:03 +0100
+Subject: comedi: comedi_parport: deal with premature interrupt
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 17221216ae8ce6a24e8a4e787382e3ebc81b88a8 upstream.
+
+Syzbot reported a general protection fault in
+`comedi_get_is_subdevice_running()`, which was called from the interrupt
+handler `parport_interrupt()` in the "comedi_parport" driver, but it
+does not currently have a C reproducer for the problem. It's
+probably due to a premature interrupt for one of two reasons:
+
+1. The driver sets up the interrupt handler before the comedi subdevices
+ used by the interrupt handler have been allocated, but does not
+ disable the interrupt in the parallel port's CTRL register first.
+2. The driver uses a user-supplied I/O port base address which Syzbot
+ would have supplied, but it might not be backed by real parallel port
+ hardware.
+
+Change the initialization order in the driver's comedi "attach" handler
+(`parport_attach()`) so that the hardware registers are initialized
+before the interrupt handler is requested. This should prevent
+premature interrupts occurring for real hardware.
+
+Also add a test to the interrupt handler to ensure the comedi device is
+fully attached and return early if it isn't.
+
+Fixes: 241ab6ad7108e ("Staging: comedi: add comedi_parport driver")
+Reported-by: syzbot+f24c3d5d316011bacc70@syzkaller.appspotmail.com
+Cc: stable <stable@kernel.org>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://patch.msgid.link/20260527125104.96596-1-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/comedi/drivers/comedi_parport.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/comedi/drivers/comedi_parport.c
++++ b/drivers/comedi/drivers/comedi_parport.c
+@@ -212,6 +212,13 @@ static irqreturn_t parport_interrupt(int
+ unsigned int ctrl;
+ unsigned short val = 0;
+
++ /*
++ * Check device is fully attached. Device interrupts should have
++ * been disabled, but do this in case of bad hardware.
++ */
++ if (!dev->attached)
++ return IRQ_NONE;
++
+ ctrl = inb(dev->iobase + PARPORT_CTRL_REG);
+ if (!(ctrl & PARPORT_CTRL_IRQ_ENA))
+ return IRQ_NONE;
+@@ -232,6 +239,9 @@ static int parport_attach(struct comedi_
+ if (ret)
+ return ret;
+
++ outb(0, dev->iobase + PARPORT_DATA_REG);
++ outb(0, dev->iobase + PARPORT_CTRL_REG);
++
+ if (it->options[1]) {
+ ret = request_irq(it->options[1], parport_interrupt, 0,
+ dev->board_name, dev);
+@@ -287,9 +297,6 @@ static int parport_attach(struct comedi_
+ s->cancel = parport_intr_cancel;
+ }
+
+- outb(0, dev->iobase + PARPORT_DATA_REG);
+- outb(0, dev->iobase + PARPORT_CTRL_REG);
+-
+ return 0;
+ }
+
--- /dev/null
+From 761b785a0cfbce43761227bc42a7f984f31f8921 Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Wed, 15 Jul 2026 15:08:51 +0800
+Subject: intel_th: fix MSC output device reference leak
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit 761b785a0cfbce43761227bc42a7f984f31f8921 upstream.
+
+intel_th_output_open() looks up the output device with
+bus_find_device_by_devt(), which returns the device with a reference that
+must be dropped after use.
+
+commit 95fc36a234da ("intel_th: fix device leak on output open()")
+attempted to drop the reference from intel_th_output_release(). However,
+a successful open replaces file->f_op with the output driver file
+operations before returning, so close runs the output driver release
+callback instead.
+
+For MSC outputs, close runs intel_th_msc_release(), which only removes
+the per-file iterator and does not drop the device reference taken by
+intel_th_output_open(). Consequently, every successful MSC output open
+leaks one device reference.
+
+Drop the device reference from intel_th_msc_release(), which is the
+release path actually used for MSC output files. Remove the now-unused
+intel_th_output_release() callback from intel_th_output_fops.
+
+Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Reviewed-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260715070851.2077965-1-lgs201920130244@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwtracing/intel_th/core.c | 10 ----------
+ drivers/hwtracing/intel_th/msu.c | 2 ++
+ 2 files changed, 2 insertions(+), 10 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/core.c
++++ b/drivers/hwtracing/intel_th/core.c
+@@ -843,18 +843,8 @@ out_put_device:
+ return err;
+ }
+
+-static int intel_th_output_release(struct inode *inode, struct file *file)
+-{
+- struct intel_th_device *thdev = file->private_data;
+-
+- put_device(&thdev->dev);
+-
+- return 0;
+-}
+-
+ static const struct file_operations intel_th_output_fops = {
+ .open = intel_th_output_open,
+- .release = intel_th_output_release,
+ .llseek = noop_llseek,
+ };
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -1479,8 +1479,10 @@ static int intel_th_msc_release(struct i
+ {
+ struct msc_iter *iter = file->private_data;
+ struct msc *msc = iter->msc;
++ struct intel_th_device *thdev = msc->thdev;
+
+ msc_iter_remove(iter, msc);
++ put_device(&thdev->dev);
+
+ return 0;
+ }
--- /dev/null
+From b2ff91b752b0d85e8815e7f44fd85205c4268094 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Thu, 9 Jul 2026 15:19:25 -0400
+Subject: mptcp: only set DATA_FIN when a mapping is present
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit b2ff91b752b0d85e8815e7f44fd85205c4268094 upstream.
+
+mptcp_get_options() clears only the status group of struct
+mptcp_options_received; data_seq, subflow_seq and data_len are filled in
+by mptcp_parse_option() exclusively inside the DSS mapping block, which
+runs only when the DSS M (mapping present) bit is set.
+
+A peer can send a DSS option with the DATA_FIN flag set but the mapping
+bit clear. The parser then records mp_opt->data_fin while leaving
+data_len and data_seq uninitialized. For a zero-length segment
+mptcp_incoming_options() evaluates
+
+ if (mp_opt.data_fin && mp_opt.data_len == 1 &&
+ mptcp_update_rcv_data_fin(msk, mp_opt.data_seq, mp_opt.dsn64))
+
+which reads the uninitialized data_len and data_seq; KMSAN reports an
+uninit-value in mptcp_incoming_options(). The stale data_seq can also be
+fed into the receive-side DATA_FIN sequence tracking.
+
+Record the DATA_FIN flag only when the DSS option carries a mapping, so
+data_fin is never set without data_seq and data_len also being present.
+data_fin is part of the status group that mptcp_get_options() clears up
+front, so on the no-map path it stays zero and the zero-length DATA_FIN
+branch is simply skipped. A DATA_FIN is always transmitted together with
+a mapping (mptcp_write_data_fin() sets use_map along with data_seq and
+data_len), so legitimate DATA_FIN handling is unaffected.
+
+Move the pr_debug() that logs the parsed DSS flags below the mapping
+block, so it reports the final data_fin value instead of the stale one
+it would otherwise print before the assignment.
+
+Fixes: 43b54c6ee382 ("mptcp: Use full MPTCP-level disconnect state machine")
+Suggested-by: Paolo Abeni <pabeni@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260709191925.2811195-1-michael.bommarito@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/options.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -152,17 +152,11 @@ static void mptcp_parse_option(const str
+ ptr++;
+
+ flags = (*ptr++) & MPTCP_DSS_FLAG_MASK;
+- mp_opt->data_fin = (flags & MPTCP_DSS_DATA_FIN) != 0;
+ mp_opt->dsn64 = (flags & MPTCP_DSS_DSN64) != 0;
+ mp_opt->use_map = (flags & MPTCP_DSS_HAS_MAP) != 0;
+ mp_opt->ack64 = (flags & MPTCP_DSS_ACK64) != 0;
+ mp_opt->use_ack = (flags & MPTCP_DSS_HAS_ACK);
+
+- pr_debug("data_fin=%d dsn64=%d use_map=%d ack64=%d use_ack=%d\n",
+- mp_opt->data_fin, mp_opt->dsn64,
+- mp_opt->use_map, mp_opt->ack64,
+- mp_opt->use_ack);
+-
+ expected_opsize = TCPOLEN_MPTCP_DSS_BASE;
+
+ if (mp_opt->use_ack) {
+@@ -173,12 +167,18 @@ static void mptcp_parse_option(const str
+ }
+
+ if (mp_opt->use_map) {
++ mp_opt->data_fin = (flags & MPTCP_DSS_DATA_FIN) != 0;
+ if (mp_opt->dsn64)
+ expected_opsize += TCPOLEN_MPTCP_DSS_MAP64;
+ else
+ expected_opsize += TCPOLEN_MPTCP_DSS_MAP32;
+ }
+
++ pr_debug("data_fin=%d dsn64=%d use_map=%d ack64=%d use_ack=%d\n",
++ mp_opt->data_fin, mp_opt->dsn64,
++ mp_opt->use_map, mp_opt->ack64,
++ mp_opt->use_ack);
++
+ /* Always parse any csum presence combination, we will enforce
+ * RFC 8684 Section 3.3.0 checks later in subflow_data_ready
+ */
--- /dev/null
+From 26b483d52417253d88a3a01262ac85914a7aec8e Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Fri, 17 Jul 2026 17:25:58 +0100
+Subject: Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
+
+From: Will Deacon <will@kernel.org>
+
+commit 26b483d52417253d88a3a01262ac85914a7aec8e upstream.
+
+This reverts commit e057b94772328221405b067c3a85fe479b915dc8.
+
+Sashiko points out that updating 'orig_x0' after secure_computing()
+has returned is too late to handle the case where a seccomp filter is
+re-evaluated after initially returning SECCOMP_RET_TRACE. This means
+that a tracer can manipulate the first argument of the syscall behind
+seccomp's back.
+
+For now, revert the initial fix and we'll have another crack at it soon.
+Since the incorrect fix was cc'd to stable, do the same here with an
+appropriate fixes tag.
+
+Cc: stable@vger.kernel.org
+Fixes: e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates")
+Link: https://sashiko.dev/#/patchset/20260716120640.6590-1-will@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/ptrace.c | 29 -----------------------------
+ 1 file changed, 29 deletions(-)
+
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -1844,21 +1844,6 @@ static void tracehook_report_syscall(str
+ }
+ }
+
+-static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
+-{
+- /*
+- * Keep orig_x0 authoritative so that seccomp (via
+- * syscall_get_arguments()), audit and the restart path all see the same
+- * first argument the syscall is dispatched with, even if it has been
+- * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
+- * or the tracer), as regs[0] holds the return value (see the comment in
+- * el0_svc_common()) and can be unwound using syscall_rollback().
+- * For compat tasks, orig_r0 is provided directly through GPR index 17.
+- */
+- if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
+- regs->orig_x0 = regs->regs[0];
+-}
+-
+ int syscall_trace_enter(struct pt_regs *regs)
+ {
+ unsigned long flags = READ_ONCE(current_thread_info()->flags);
+@@ -1867,26 +1852,12 @@ int syscall_trace_enter(struct pt_regs *
+ tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+ if (flags & _TIF_SYSCALL_EMU)
+ return NO_SYSCALL;
+-
+- /*
+- * Ensure ptrace changes to x0 during a regular
+- * syscall-enter-stop (PTRACE_SYSCALL) are visible to
+- * subsequent seccomp checks, tracepoints and audit.
+- */
+- update_syscall_orig_x0_after_ptrace(regs);
+ }
+
+ /* Do the secure computing after ptrace; failures should be fast. */
+ if (secure_computing() == -1)
+ return NO_SYSCALL;
+
+- /*
+- * Ensure tracer changes to x0 during seccomp ptrace exit
+- * processing (SECCOMP_RET_TRACE) are visible to tracepoints and
+- * audit.
+- */
+- update_syscall_orig_x0_after_ptrace(regs);
+-
+ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
+ trace_sys_enter(regs, regs->syscallno);
+
bluetooth-rfcomm-fix-session-uaf-in-set_termios.patch
exec-fix-unsigned-loop-counter-wrap-in-transfer_args_to_stack.patch
binfmt_misc-set-have_execfd-only-once-the-interpreter-is-opened.patch
+cdrom-fix-stack-out-of-bounds-read-in-cdromvolctrl.patch
+x86-boot-compressed-disable-jump-tables.patch
+comedi-comedi_parport-deal-with-premature-interrupt.patch
+intel_th-fix-msc-output-device-reference-leak.patch
+tracing-fix-mmiotrace-possible-null-dereferencing-of-hiter-dev.patch
+tracing-fix-resource-leak-on-mmiotrace-trace_pipe-close.patch
+tracing-eprobe-fix-exact-system-name-matching-in-eprobe_dyn_event_match.patch
+tracing-probes-avoid-temporary-buffer-truncation-in-trace_probe_match_command_args.patch
+tracing-probes-fix-potential-underflow-in-len_or_zero-macro.patch
+tracing-probes-prevent-out-of-bounds-write-in-__trace_probe_log_err.patch
+arm64-syscall-ensure-saved-x0-is-kept-in-sync-with-tracer-updates.patch
+revert-arm64-syscall-ensure-saved-x0-is-kept-in-sync-with-tracer-updates.patch
+mptcp-only-set-data_fin-when-a-mapping-is-present.patch
--- /dev/null
+From f418d68d71fd4a0a9cef92377bc8c4c3334b5b53 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Mon, 20 Jul 2026 19:12:38 +0900
+Subject: tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit f418d68d71fd4a0a9cef92377bc8c4c3334b5b53 upstream.
+
+eprobe_dyn_event_match() checks if the target event system in argv[0]
+matches ep->event_system using strncmp(ep->event_system, argv[0], len).
+However, if ep->event_system is longer than len (e.g. "eprobes" vs
+"ep/event"), strncmp() still returns 0 because the first len characters
+match.
+
+Check that ep->event_system[len] is '\0' to ensure exact system name
+matching.
+
+Link: https://lore.kernel.org/all/178454235856.290363.14872590900774231133.stgit@devnote2/
+
+Fixes: 7d5fda1c841f ("tracing: Fix event probe removal from dynamic events")
+Cc: stable@vger.kernel.org
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_eprobe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_eprobe.c
++++ b/kernel/trace/trace_eprobe.c
+@@ -159,7 +159,8 @@ static bool eprobe_dyn_event_match(const
+ if (!slash)
+ return false;
+
+- if (strncmp(ep->event_system, argv[0], slash - argv[0]))
++ if (strncmp(ep->event_system, argv[0], slash - argv[0]) ||
++ ep->event_system[slash - argv[0]] != '\0')
+ return false;
+ if (strcmp(ep->event_name, slash + 1))
+ return false;
--- /dev/null
+From 144f29e85702234b23d2a62abf723e6a17eb5427 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Tue, 21 Jul 2026 21:11:43 -0400
+Subject: tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit 144f29e85702234b23d2a62abf723e6a17eb5427 upstream.
+
+If the mmio_pipe_open() fails to find a PCI device, the hiter->dev
+will be assigned to NULL. The mmiotrace read() function dereferences the
+hiter->dev if hiter exists.
+
+Change the test of the read to not only check hiter being NULL, but also
+the hiter->dev before dereferencing it.
+
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260721211143.36dbd559@gandalf.local.home
+Fixes: f984b51e0779 ("ftrace: add mmiotrace plugin")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Link: https://sashiko.dev/#/patchset/20260715143604.14481-1-gaikwad.dcg%40gmail.com
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_mmiotrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_mmiotrace.c
++++ b/kernel/trace/trace_mmiotrace.c
+@@ -146,7 +146,7 @@ static ssize_t mmio_read(struct trace_it
+ goto print_out;
+ }
+
+- if (!hiter)
++ if (!hiter || !hiter->dev)
+ return 0;
+
+ mmio_print_pcidev(s, hiter->dev);
--- /dev/null
+From c1d87e724ae55e781b7cc7ccafb34d9e668582b2 Mon Sep 17 00:00:00 2001
+From: deepakraog <gaikwad.dcg@gmail.com>
+Date: Wed, 15 Jul 2026 20:06:04 +0530
+Subject: tracing: Fix resource leak on mmiotrace trace_pipe close
+
+From: deepakraog <gaikwad.dcg@gmail.com>
+
+commit c1d87e724ae55e781b7cc7ccafb34d9e668582b2 upstream.
+
+The mmiotrace tracer was added May 12th 2008. At that time, resources
+created in pipe_open() could not be freed because there was not
+pipe_close function pointer of the tracer. The pipe_close function pointer
+was added in December 7th, 2009, but the mmiotrace tracer was not updated.
+
+mmio_pipe_open() allocates a header_iter and takes a pci_dev reference
+when trace_pipe is opened. mmio_close() frees them, but it was only
+wired to the tracer's .close callback.
+
+tracing_release_pipe() invokes .pipe_close, not .close, when the
+trace_pipe file is released. As a result, closing trace_pipe with the
+mmiotrace tracer active leaked the header_iter allocation and left a
+stale pci_dev reference.
+
+Set .pipe_close to mmio_close, matching how function_graph wires both
+callbacks to the same handler.
+
+Note, if the trace_pipe is read to completion, it will clean up the
+resources, but if one were to run:
+
+ # head -n 1 /sys/kernel/tracing/trace_pipe
+ VERSION 20070824
+
+Over and over again, it would trigger a massive leak.
+
+Cc: stable@vger.kernel.org
+Fixes: c521efd1700a8 ("tracing: Add pipe_close interface)
+Link: https://patch.msgid.link/20260715143604.14481-1-gaikwad.dcg@gmail.com
+Signed-off-by: deepakraog <gaikwad.dcg@gmail.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_mmiotrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_mmiotrace.c
++++ b/kernel/trace/trace_mmiotrace.c
+@@ -109,7 +109,6 @@ static void mmio_pipe_open(struct trace_
+ iter->private = hiter;
+ }
+
+-/* XXX: This is not called when the pipe is closed! */
+ static void mmio_close(struct trace_iterator *iter)
+ {
+ struct header_iter *hiter = iter->private;
+@@ -279,6 +278,7 @@ static struct tracer mmio_tracer __read_
+ .start = mmio_trace_start,
+ .pipe_open = mmio_pipe_open,
+ .close = mmio_close,
++ .pipe_close = mmio_close,
+ .read = mmio_read,
+ .print_line = mmio_print_line,
+ .noboot = true,
--- /dev/null
+From 15f197856d68882af9416fc97516bb55079b7677 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Mon, 20 Jul 2026 19:12:10 +0900
+Subject: tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 15f197856d68882af9416fc97516bb55079b7677 upstream.
+
+In trace_probe_match_command_args(), a stack buffer buf[MAX_ARGSTR_LEN + 1]
+(256 bytes) is used to format "<name>=<comm>". However, since name can
+be up to 32 bytes (MAX_ARG_NAME_LEN) and comm up to 255 bytes
+(MAX_ARGSTR_LEN), the formatted string can exceed 256 bytes and get
+truncated by snprintf(), causing spurious argument matching failures.
+
+Instead of formatting into a temporary buffer on stack, compare the
+argument name, the '=' delimiter, and the comm expression directly.
+
+Link: https://lore.kernel.org/all/178454233010.290363.10428767141343428804.stgit@devnote2/
+
+Fixes: eb5bf81330a7 ("tracing/kprobe: Add per-probe delete from event")
+Cc: stable@vger.kernel.org
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_probe.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -1212,16 +1212,17 @@ int trace_probe_compare_arg_type(struct
+ bool trace_probe_match_command_args(struct trace_probe *tp,
+ int argc, const char **argv)
+ {
+- char buf[MAX_ARGSTR_LEN + 1];
+ int i;
+
+ if (tp->nr_args < argc)
+ return false;
+
+ for (i = 0; i < argc; i++) {
+- snprintf(buf, sizeof(buf), "%s=%s",
+- tp->args[i].name, tp->args[i].comm);
+- if (strcmp(buf, argv[i]))
++ int len = strlen(tp->args[i].name);
++
++ if (strncmp(argv[i], tp->args[i].name, len) ||
++ argv[i][len] != '=' ||
++ strcmp(argv[i] + len + 1, tp->args[i].comm))
+ return false;
+ }
+ return true;
--- /dev/null
+From 8ce20bfba48902e1382187cd1a852f7cf3a1e739 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Mon, 20 Jul 2026 19:12:29 +0900
+Subject: tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 8ce20bfba48902e1382187cd1a852f7cf3a1e739 upstream.
+
+In __set_print_fmt(), LEN_OR_ZERO is defined as (len ? len - pos : 0).
+If len is non-zero but smaller than pos, len - pos evaluates to a negative
+integer. When passed as a size argument to snprintf(), this negative value
+is cast to a large unsigned size_t, bypassing buffer size limits.
+
+Ensure len > pos before subtracting to avoid integer underflow.
+
+Link: https://lore.kernel.org/all/178454234934.290363.15247317871499514139.stgit@devnote2/
+
+Fixes: 5bf652aaf46c ("tracing/probes: Integrate duplicate set_print_fmt()")
+Cc: stable@vger.kernel.org
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -896,7 +896,7 @@ int traceprobe_update_arg(struct probe_a
+ }
+
+ /* When len=0, we just calculate the needed length */
+-#define LEN_OR_ZERO (len ? len - pos : 0)
++#define LEN_OR_ZERO (len > pos ? len - pos : 0)
+ static int __set_print_fmt(struct trace_probe *tp, char *buf, int len,
+ enum probe_print_type ptype)
+ {
--- /dev/null
+From a9d6fb284039a5d3858a1d9f9a0d7e46cfb7c2d4 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Mon, 20 Jul 2026 19:12:20 +0900
+Subject: tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit a9d6fb284039a5d3858a1d9f9a0d7e46cfb7c2d4 upstream.
+
+If trace_probe_log.argc is 0 in __trace_probe_log_err(), the loop
+constructing the command string will not execute and p will remain equal to
+command. Writing to *(p - 1) will cause an out-of-bounds access before
+command. This should not happen, but better to be treated.
+
+Reject if trace_probe_log.argc is 0.
+
+Link: https://lore.kernel.org/all/178454233992.290363.18323091580600697731.stgit@devnote2/
+
+Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events")
+Cc: stable@vger.kernel.org
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -176,7 +176,7 @@ void __trace_probe_log_err(int offset, i
+
+ lockdep_assert_held(&dyn_event_ops_mutex);
+
+- if (!trace_probe_log.argv)
++ if (!trace_probe_log.argv || !trace_probe_log.argc)
+ return;
+
+ /* Recalculate the length and allocate buffer */
--- /dev/null
+From 4a9ec5ec9555ad62dc5b81a37ac946025c2ea002 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Wed, 22 Jul 2026 17:09:43 -0700
+Subject: x86/boot/compressed: Disable jump tables
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 4a9ec5ec9555ad62dc5b81a37ac946025c2ea002 upstream.
+
+After a recent upstream LLVM change to start generating jump and lookup
+tables in switch statements in more instances [1], linking the
+compressed x86 boot image when CONFIG_KERNEL_ZSTD is enabled fails with:
+
+ ld.lld: error: Unexpected run-time relocations (.rela) detected!
+
+Dumping the relocations in misc.o, which is the only file influenced by
+CONFIG_KERNEL_ZSTD in the decompressor, shows dynamic relocations to
+some string constants, which correspond to the string literals in the
+switch statement in handle_zstd_error():
+
+ Relocation section '.rela.data.rel.ro' at offset 0x277b0 contains 31 entries:
+ Offset Info Type Symbol's Value Symbol's Name + Addend
+ 0000000000000000 0000006600000001 R_X86_64_64 0000000000000000 .rodata.str1.1 + 73a
+ 0000000000000008 0000006600000001 R_X86_64_64 0000000000000000 .rodata.str1.1 + 78e
+ 0000000000000010 0000006600000001 R_X86_64_64 0000000000000000 .rodata.str1.1 + 78e
+ 0000000000000018 0000006600000001 R_X86_64_64 0000000000000000 .rodata.str1.1 + 78e
+ ...
+
+This optimization is problematic for the decompressor environment, as it
+is built as -fPIE without any explicit absolute references (as described
+at the top of misc.c) while not applying any dynamic relocations, hence
+the linker assertion. To opt out of this optimization, which is of
+little value in this special early boot code, and to mirror the other
+x86 startup code in arch/x86/boot/startup, disable jump tables in the
+decompressor.
+
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Link: https://github.com/llvm/llvm-project/commit/fa02a6ed66b1700c996b49c96c6bc0eb014c9518 [1]
+Link: https://patch.msgid.link/20260722-x86-boot-compressed-disable-jt-clang-v2-1-7373d38482fb@kernel.org
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2165
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/compressed/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -35,6 +35,7 @@ targets := vmlinux vmlinux.bin vmlinux.b
+ KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS)
+ KBUILD_CFLAGS += -std=gnu89
+ KBUILD_CFLAGS += -fno-strict-aliasing -fPIE
++KBUILD_CFLAGS += -fno-jump-tables
+ KBUILD_CFLAGS += -Wundef
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+ cflags-$(CONFIG_X86_32) := -march=i386
projects / thirdparty / kernel / stable-queue.git / commitdiff
