From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:20:55 +0000 (+0200) Subject: 7.1-stable patches X-Git-Tag: v5.10.261~75 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=0ce65eed06c4c84a848f11ad73ba9e6963dccb7d;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: amdkfd-properly-free-secondary-context-id.patch arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch ata-libata-core-allow-capacity-transition-to-zero-for-locked-drives.patch ata-libata-core-skip-hpa-resize-for-locked-drives.patch cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch cpu-hotplug-fix-null-kobject-warning-in-cpuhp_smt_enable.patch dibs-loopback-validate-offset-and-size-in-move_data.patch drbd-reject-data-replies-with-an-out-of-range-payload-size.patch fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch fs-resctrl-free-mon_data-structures-on-rdt_get_tree-failure.patch ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch mac802154-remove-interfaces-with-rcu-list-deletion.patch macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch net-macb-drop-in-flight-tx-skbs-on-close.patch octeontx2-pf-fix-sqb-pointer-leak-on-init-failure.patch riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch s390-diag-add-missing-array_index_nospec-call-to-memtop_get_page_count.patch s390-mm-fix-type-mismatch-in-get_align_mask.patch s390-monwriter-reject-buffer-reuse-with-different-data-length.patch selftests-net-make-busywait-timeout-clock-portable.patch selftests-rseq-fix-a-building-error-for-riscv-arch.patch tracing-osnoise-call-synchronize_rcu-when-unregistering.patch --- diff --git a/queue-7.1/amdkfd-properly-free-secondary-context-id.patch b/queue-7.1/amdkfd-properly-free-secondary-context-id.patch new file mode 100644 index 0000000000..3c68efd97f --- /dev/null +++ b/queue-7.1/amdkfd-properly-free-secondary-context-id.patch @@ -0,0 +1,36 @@ +From a88419af8dbd5abf8b1dfdfd9346376bce5413b4 Mon Sep 17 00:00:00 2001 +From: Zhu Lingshan +Date: Wed, 1 Jul 2026 16:08:12 +0800 +Subject: amdkfd: properly free secondary context id + +From: Zhu Lingshan + +commit a88419af8dbd5abf8b1dfdfd9346376bce5413b4 upstream. + +Function kfd_process_free_id() should skip over +the primary kfd process because its context id +is fixed assigned, not allocated through the ida table. +This function should only work on secondary contexts. + +Fixes: fac682a1d1af ("amdkfd: identify a secondary kfd process by its id") +Signed-off-by: Zhu Lingshan +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +(cherry picked from commit 8799ba6fb6a48438aea20c82e74c2f2a3d2b2e7a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -910,7 +910,7 @@ static void kfd_process_free_id(struct k + { + struct kfd_process *primary_process; + +- if (process->context_id != KFD_CONTEXT_ID_PRIMARY) ++ if (process->context_id == KFD_CONTEXT_ID_PRIMARY) + return; + + primary_process = kfd_lookup_process_by_mm(process->lead_thread->mm); diff --git a/queue-7.1/arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch b/queue-7.1/arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch new file mode 100644 index 0000000000..5b194f8a9c --- /dev/null +++ b/queue-7.1/arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch @@ -0,0 +1,75 @@ +From 18a4e5cf633fad5c40ac9d936c51bf38db68796d Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Wed, 10 Jun 2026 15:52:01 +0800 +Subject: arm64: smp: Fix hot-unplug tearing by forcing unregistration + +From: Jinjie Ruan + +commit 18a4e5cf633fad5c40ac9d936c51bf38db68796d upstream. + +Sashiko review pointed out the following issue[1]. + +Commit eba4675008a6 ("arm64: arch_register_cpu() variant to check if +an ACPI handle is now available.") introduced architectural safety +blocks inside arch_unregister_cpu(). If a hot-unplug operation is +determined to be a physical hardware removal (where _STA evaluates to +!ACPI_STA_DEVICE_PRESENT), or if firmware evaluation fails, it aborts +the unregistration transaction early to protect unreadied arm64 +infrastructure. + +However, returning early from arch_unregister_cpu() causes a catastrophic +state tearing because the generic ACPI layer (acpi_processor_post_eject()) +unconditionally continues its cleanup flow. This leaves the stale sysfs +device leaked in the memory, deadlocking any subsequent hot-add attempts +on the same CPU. + +Fix it by simplifying arch_unregister_cpu() to always proceed with +the unregistration, as a pr_err_once() warning is sufficient to make +it more visible for currently not supported physical CPU removal. +Also remove the redundant NULL check on acpi_handle as it cannot be +NULL when calling arch_unregister_cpu(). + +Cc: Catalin Marinas +Cc: Jonathan Cameron +Cc: James Morse +Cc: stable@vger.kernel.org +Link: https://sashiko.dev/#/patchset/20260520022023.126670-1-ruanjinjie@huawei.com [1] +Fixes: eba4675008a6 ("arm64: arch_register_cpu() variant to check if an ACPI handle is now available.") +Suggested-by: Catalin Marinas +Signed-off-by: Jinjie Ruan +Reviewed-by: Catalin Marinas +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/smp.c | 16 +++------------- + 1 file changed, 3 insertions(+), 13 deletions(-) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -535,23 +535,13 @@ void arch_unregister_cpu(int cpu) + { + acpi_handle acpi_handle = acpi_get_processor_handle(cpu); + struct cpu *c = &per_cpu(cpu_devices, cpu); +- acpi_status status; + unsigned long long sta; +- +- if (!acpi_handle) { +- pr_err_once("Removing a CPU without associated ACPI handle\n"); +- return; +- } ++ acpi_status status; + + status = acpi_evaluate_integer(acpi_handle, "_STA", NULL, &sta); +- if (ACPI_FAILURE(status)) +- return; +- +- /* For now do not allow anything that looks like physical CPU HP */ +- if (cpu_present(cpu) && !(sta & ACPI_STA_DEVICE_PRESENT)) { ++ if (!ACPI_FAILURE(status) && ++ cpu_present(cpu) && !(sta & ACPI_STA_DEVICE_PRESENT)) + pr_err_once("Changing CPU present bit is not supported\n"); +- return; +- } + + unregister_cpu(c); + } diff --git a/queue-7.1/ata-libata-core-allow-capacity-transition-to-zero-for-locked-drives.patch b/queue-7.1/ata-libata-core-allow-capacity-transition-to-zero-for-locked-drives.patch new file mode 100644 index 0000000000..58d981a569 --- /dev/null +++ b/queue-7.1/ata-libata-core-allow-capacity-transition-to-zero-for-locked-drives.patch @@ -0,0 +1,49 @@ +From 793bf193b18e9bff6c4280268bbffd16a5b533e5 Mon Sep 17 00:00:00 2001 +From: TJ Adams +Date: Mon, 6 Jul 2026 14:00:54 -0700 +Subject: ata: libata-core: Allow capacity transition to zero for locked drives + +From: TJ Adams + +commit 793bf193b18e9bff6c4280268bbffd16a5b533e5 upstream. + +Commit 91842ed844a0 ("ata: libata-core: Set capacity to zero for a +security locked drive") introduced setting the device capacity (n_sectors) +to zero in ata_dev_configure() if the drive is security locked. + +However, during runtime revalidation, ata_dev_revalidate() compares the +new capacity (now 0) with the old capacity (>0) and detects a mismatch. +Since it does not consider the locked status, it returns -ENODEV. + +This revalidation failure can occur when doing a reset of the PHY (e.g. +hard reset) for a controller that has I/Os in flight. The timed out +I/Os trigger the SCSI Error Handling (EH) path, which in turn invokes +libata device revalidation. If the drive is locked at runtime (e.g. +it lost power during reset and relocked), revalidation sees the capacity +transition to zero and fails, eventually disabling the device. + +Fix this by allowing the capacity transition to zero in +ata_dev_revalidate() if the drive is reported as security locked by +ata_id_is_locked(). + +Fixes: 91842ed844a0 ("ata: libata-core: Set capacity to zero for a security locked drive") +Cc: stable@vger.kernel.org +Assisted-by: Antigravity:gemini-3.5-flash +Signed-off-by: Terrence Adams +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -3992,7 +3992,7 @@ int ata_dev_revalidate(struct ata_device + + /* verify n_sectors hasn't changed */ + if (dev->class != ATA_DEV_ATA || !n_sectors || +- dev->n_sectors == n_sectors) ++ dev->n_sectors == n_sectors || ata_id_is_locked(dev->id)) + return 0; + + /* n_sectors has changed */ diff --git a/queue-7.1/ata-libata-core-skip-hpa-resize-for-locked-drives.patch b/queue-7.1/ata-libata-core-skip-hpa-resize-for-locked-drives.patch new file mode 100644 index 0000000000..6ebbe8cf9d --- /dev/null +++ b/queue-7.1/ata-libata-core-skip-hpa-resize-for-locked-drives.patch @@ -0,0 +1,37 @@ +From 917d0a4b95ea7ba01ed6296fb808f752d5d81107 Mon Sep 17 00:00:00 2001 +From: TJ Adams +Date: Mon, 6 Jul 2026 14:00:53 -0700 +Subject: ata: libata-core: Skip HPA resize for locked drives + +From: TJ Adams + +commit 917d0a4b95ea7ba01ed6296fb808f752d5d81107 upstream. + +Skip HPA resize in ata_hpa_resize() if the drive is security locked. +If the drive is locked, the command to read the native max address +fails with -EACCES, which currently causes the sticky quirk +ATA_QUIRK_BROKEN_HPA to be set on the device. + +Setting this sticky quirk causes subsequent revalidations (after the +drive is unlocked) to bypass HPA checks, preventing the unlocked drive +from exposing its full native capacity without a reboot or device removal. + +Cc: stable@vger.kernel.org +Signed-off-by: Terrence Adams +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -1338,7 +1338,7 @@ static int ata_hpa_resize(struct ata_dev + /* do we need to do it? */ + if ((dev->class != ATA_DEV_ATA && dev->class != ATA_DEV_ZAC) || + !ata_id_has_lba(dev->id) || !ata_id_hpa_enabled(dev->id) || +- (dev->quirks & ATA_QUIRK_BROKEN_HPA)) ++ (dev->quirks & ATA_QUIRK_BROKEN_HPA) || ata_id_is_locked(dev->id)) + return 0; + + /* read native max address */ diff --git a/queue-7.1/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch b/queue-7.1/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch new file mode 100644 index 0000000000..91acaed2ed --- /dev/null +++ b/queue-7.1/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch @@ -0,0 +1,76 @@ +From b983c56426383e4a06fa5970c4e33cee879b1482 Mon Sep 17 00:00:00 2001 +From: Farhad Alemi +Date: Mon, 6 Jul 2026 10:20:23 +0200 +Subject: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Farhad Alemi + +commit b983c56426383e4a06fa5970c4e33cee879b1482 upstream. + +Creating a child cpuset where cpuset.mems is never set leads to a div/0 +when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a +CPU hotplug event. + +Reproduction steps: + 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) + 2) Move the task into the child cpuset + 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES + 4) unplug and hotplug a cpu + echo 0 > /sys/devices/system/cpu/cpu1/online + echo 1 > /sys/devices/system/cpu/cpu1/online + 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the + call to __nodes_fold() + +The cpuset code passes (cs->mems_allowed) which is not guaranteed to have +nodes to the rebind routine. Use cs->effective_mems instead, which is +guaranteed to have a non-empty nodemask once we reach that code path. + +Link: https://lore.kernel.org/all/CA+0ovCiEz6SP_sn3kN4Tb+_oC=eHMXy_Ffj=usV3wREdQrUtww@mail.gmail.com/ +Fixes: ae1c802382f7 ("cpuset: apply cs->effective_{cpus,mems}") +Closes: https://lore.kernel.org/linux-mm/CA+0ovCgxbZkXa+OU8w3s84R3KNPNxxRfmsNR-udh+afQBbGNmw@mail.gmail.com/ +Suggested-by: Gregory Price +Suggested-by: Waiman Long +Acked-by: Waiman Long +Signed-off-by: Farhad Alemi +Cc: Andrew Morton +Cc: Alistair Popple +Cc: Byungchul Park +Cc: Gregory Price +Cc: "Huang, Ying" +Cc: Joshua Hahn +Cc: Matthew Brost +Cc: Rakie Kim +Cc: Rasmus Villemoes +Cc: Zi Yan +Cc: Tejun Heo +Cc: Ridong Chen +Cc: Johannes Weiner +Cc: "Michal Koutný" +Cc: +[ david: add a comment, slightly rephrase description ] +Signed-off-by: David Hildenbrand (Arm) +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cgroup/cpuset.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -2650,7 +2650,12 @@ void cpuset_update_tasks_nodemask(struct + + migrate = is_memory_migrate(cs); + +- mpol_rebind_mm(mm, &cs->mems_allowed); ++ /* ++ * For v1 we can have empty effective_mems, but we cannot ++ * attach any tasks (see cpuset_can_attach_check()). For v2, ++ * effective_mems is guaranteed to not be empty. ++ */ ++ mpol_rebind_mm(mm, &cs->effective_mems); + if (migrate) + cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems); + else diff --git a/queue-7.1/cpu-hotplug-fix-null-kobject-warning-in-cpuhp_smt_enable.patch b/queue-7.1/cpu-hotplug-fix-null-kobject-warning-in-cpuhp_smt_enable.patch new file mode 100644 index 0000000000..a896ee87ee --- /dev/null +++ b/queue-7.1/cpu-hotplug-fix-null-kobject-warning-in-cpuhp_smt_enable.patch @@ -0,0 +1,174 @@ +From f9a82544c7174851f5c7524622f5966dcafd3a47 Mon Sep 17 00:00:00 2001 +From: Jinjie Ruan +Date: Wed, 10 Jun 2026 15:52:02 +0800 +Subject: cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() + +From: Jinjie Ruan + +commit f9a82544c7174851f5c7524622f5966dcafd3a47 upstream. + +On arm64, when booting with `maxcpus` greater than the number of present +CPUs (e.g., QEMU -smp cpus=4,maxcpus=8), some CPUs are marked as 'present' +but have not yet been registered via register_cpu(). Consequently, +the per-cpu device objects for these CPUs are not yet initialized. + +In cpuhp_smt_enable(), the code iterates over all present CPUs. Calling +_cpu_up() for these unregistered CPUs eventually leads to +sysfs_create_group() being called with a NULL kobject (or a kobject +without a directory), triggering the following warning in +fs/sysfs/group.c: + + WARNING: fs/sysfs/group.c:137 at internal_create_group+0x41c/0x4bc, CPU#2: sh/181 + [...] + Call trace: + internal_create_group+0x41c/0x4bc (P) + sysfs_create_group+0x18/0x24 + topology_add_dev+0x1c/0x28 + cpuhp_invoke_callback+0x104/0x20c + __cpuhp_invoke_callback_range+0x94/0x11c + _cpu_up+0x200/0x37c + +When booting with ACPI, arm64 smp_prepare_cpus() currently sets all +enumerated CPUs as "present" regardless of their status in the MADT. This +causes issues with SMT hotplug control. For instance, with QEMU's +"-smp 4,maxcpus=8" configuration, the MADT GICC entries are populated as +follows: + +1. The first four CPUs: `Enabled` set but `Online Capable` not set. + +2. The remaining four CPUs: `Online Capable` set but `Enabled` not set + to support potential hot-plugging. + +Fix this by: + +1. When booting with ACPI, checking the ACPI_MADT_ENABLED flag in the GICC + entry before calling set_cpu_present() during SMP initialization. + +2. Properly managing the present mask in acpi_map_cpu() and + acpi_unmap_cpu() to support actual CPU hotplug events, This aligns with + other architectures like x86 and LoongArch. + +3. Update the arm64 CPU hotplug documentation to no longer state that all + online-capable vCPUs are marked as present by the kernel at boot time. + +This ensures that only physically available or explicitly enabled CPUs +are in the present mask, keeping the SMT control logic consistent with +the actual hardware state. + +Cc: Catalin Marinas +Cc: Jonathan Cameron +Cc: James Morse +Cc: Yicong Yang +Cc: stable@vger.kernel.org +Link: https://uefi.org/specs/ACPI/6.5/05_ACPI_Software_Programming_Model.html#gic-cpu-interface-gicc-structure +Fixes: eed4583bcf9a ("arm64: Kconfig: Enable HOTPLUG_SMT") +Reviewed-by: Catalin Marinas +Suggested-by: Catalin Marinas +Signed-off-by: Jinjie Ruan +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/arch/arm64/cpu-hotplug.rst | 28 ++++++++++++++++------------ + arch/arm64/kernel/acpi.c | 2 ++ + arch/arm64/kernel/smp.c | 12 +++++++++++- + 3 files changed, 29 insertions(+), 13 deletions(-) + +--- a/Documentation/arch/arm64/cpu-hotplug.rst ++++ b/Documentation/arch/arm64/cpu-hotplug.rst +@@ -47,11 +47,12 @@ ever have can be described at boot. Ther + as such devices are emulated. + + CPU Hotplug on virtual systems is supported. It is distinct from physical +-CPU Hotplug as all resources are described as ``present``, but CPUs may be +-marked as disabled by firmware. Only the CPU's online/offline behaviour is +-influenced by firmware. An example is where a virtual machine boots with a +-single CPU, and additional CPUs are added once a cloud orchestrator deploys +-the workload. ++CPU Hotplug as all vCPU resources are statically described in the firmware ++configuration tables (e.g. MADT), meaning their maximum possible count is ++known at boot. However, vCPUs that are not enabled at boot are not marked ++as ``present`` by the kernel until they are hotplugged. An example is where ++a virtual machine boots with a single CPU, and additional CPUs are added ++once a cloud orchestrator deploys the workload. + + For a virtual machine, the VMM (e.g. Qemu) plays the part of firmware. + +@@ -60,16 +61,19 @@ brought online. Firmware can enforce its + ``DENIED``. + + The ACPI tables must describe all the resources of the virtual machine. CPUs +-that firmware wishes to disable either from boot (or later) should not be +-``enabled`` in the MADT GICC structures, but should have the ``online capable`` +-bit set, to indicate they can be enabled later. The boot CPU must be marked as +-``enabled``. The 'always on' GICR structure must be used to describe the +-redistributors. ++that are hot-pluggable must have the ``online capable`` bit set and the ++``enabled`` bit cleared in the MADT GICC structures to indicate they can be ++enabled later. The boot CPU must be marked as ``enabled`` with its ++``online capable`` bit cleared. The 'always on' GICR structure must be used ++to describe the redistributors. + + CPUs described as ``online capable`` but not ``enabled`` can be set to enabled + by the DSDT's Processor object's _STA method. On virtual systems the _STA method +-must always report the CPU as ``present``. Changes to the firmware policy can +-be notified to the OS via device-check or eject-request. ++must always set the ``ACPI_STA_DEVICE_PRESENT`` bit, while toggling the ++``ACPI_STA_DEVICE_ENABLED`` bit to reflect its plug status. The kernel will ++then dynamically mark the vCPU as ``present`` within the OS when the ++``ACPI_STA_DEVICE_ENABLED`` bit becomes set during hot-add. Changes to the ++firmware policy can be notified to the OS via device-check or eject-request. + + CPUs described as ``enabled`` in the static table, should not have their _STA + modified dynamically by firmware. Soft-restart features such as kexec will +--- a/arch/arm64/kernel/acpi.c ++++ b/arch/arm64/kernel/acpi.c +@@ -448,12 +448,14 @@ int acpi_map_cpu(acpi_handle handle, phy + return *pcpu; + } + ++ set_cpu_present(*pcpu, true); + return 0; + } + EXPORT_SYMBOL(acpi_map_cpu); + + int acpi_unmap_cpu(int cpu) + { ++ set_cpu_present(cpu, false); + return 0; + } + EXPORT_SYMBOL(acpi_unmap_cpu); +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -556,6 +556,11 @@ struct acpi_madt_generic_interrupt *acpi + } + EXPORT_SYMBOL_GPL(acpi_cpu_get_madt_gicc); + ++static bool acpi_cpu_is_present(int cpu) ++{ ++ return acpi_cpu_get_madt_gicc(cpu)->flags & ACPI_MADT_ENABLED; ++} ++ + /* + * acpi_map_gic_cpu_interface - parse processor MADT entry + * +@@ -660,6 +665,10 @@ static void __init acpi_parse_and_init_c + early_map_cpu_to_node(i, acpi_numa_get_nid(i)); + } + #else ++static bool acpi_cpu_is_present(int cpu) ++{ ++ return false; ++} + #define acpi_parse_and_init_cpus(...) do { } while (0) + #endif + +@@ -798,7 +807,8 @@ void __init smp_prepare_cpus(unsigned in + if (err) + continue; + +- set_cpu_present(cpu, true); ++ if (acpi_disabled || acpi_cpu_is_present(cpu)) ++ set_cpu_present(cpu, true); + numa_store_cpu_info(cpu); + } + } diff --git a/queue-7.1/dibs-loopback-validate-offset-and-size-in-move_data.patch b/queue-7.1/dibs-loopback-validate-offset-and-size-in-move_data.patch new file mode 100644 index 0000000000..31d4fe26fb --- /dev/null +++ b/queue-7.1/dibs-loopback-validate-offset-and-size-in-move_data.patch @@ -0,0 +1,44 @@ +From 78237e3c0720fcc6eb9b87e90fd70f63eeca886f Mon Sep 17 00:00:00 2001 +From: Dust Li +Date: Tue, 7 Jul 2026 15:43:18 +0800 +Subject: dibs: loopback: validate offset and size in move_data() + +From: Dust Li + +commit 78237e3c0720fcc6eb9b87e90fd70f63eeca886f upstream. + +The loopback move_data() performs a memcpy into the registered DMB +without checking whether offset + size exceeds the DMB length. Unlike +real ISM hardware, which enforces memory region bounds natively, the +software loopback has no such protection. + +A peer-supplied out-of-bounds offset or oversized write would result in +an OOB write past the allocated kernel buffer. Add an explicit bounds +check before the memcpy to reject such requests with -EINVAL. + +Fixes: f7a22071dbf3 ("net/smc: implement DMB-related operations of loopback-ism") +Cc: stable@vger.kernel.org +Reported-by: Federico Kirschbaum +Signed-off-by: Dust Li +Reported-by: Baul Lee +Link: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dibs/dibs_loopback.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/dibs/dibs_loopback.c ++++ b/drivers/dibs/dibs_loopback.c +@@ -254,6 +254,11 @@ static int dibs_lo_move_data(struct dibs + read_unlock_bh(&ldev->dmb_ht_lock); + return -EINVAL; + } ++ if ((u64)offset + size > rmb_node->len) { ++ read_unlock_bh(&ldev->dmb_ht_lock); ++ return -EINVAL; ++ } ++ + memcpy((char *)rmb_node->cpu_addr + offset, data, size); + sba_idx = rmb_node->sba_idx; + read_unlock_bh(&ldev->dmb_ht_lock); diff --git a/queue-7.1/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch b/queue-7.1/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch new file mode 100644 index 0000000000..3ce2b69aab --- /dev/null +++ b/queue-7.1/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch @@ -0,0 +1,63 @@ +From bd910a7660d280595ef94cb6d193951d855d330f Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Thu, 9 Jul 2026 22:28:37 -0400 +Subject: drbd: reject data replies with an out-of-range payload size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Bommarito + +commit bd910a7660d280595ef94cb6d193951d855d330f upstream. + +recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an +outstanding read request. The peer-supplied payload length reaches it as +the signed int data_size, and two peer-controlled inputs can make it +negative. With a negotiated data-integrity-alg the digest length is +subtracted first, so a reply whose payload is smaller than the digest +underflows data_size. With no integrity algorithm (the default) data_size +is assigned from the unsigned h95/h100 wire length and drbdd() never +bounds it for a payload-carrying command, so a length above INT_MAX casts +it negative; this path needs no non-default feature. The bio receive loop +then computes expect = min_t(int, data_size, bv_len), which is negative, +and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX +into the first mapped page. + +The sibling receive path read_in_block() is not affected: it uses an +unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving. +Reject a data reply whose size is negative after the optional digest +subtraction, covering both triggers. + +Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen +bytes past a bio page in the receiver, corrupting kernel memory. A node +that reads from its peer (a diskless node, or read-balancing to the peer) +is exposed in the default configuration; data-integrity-alg is not +required. + +Fixes: b411b3637fa7 ("The DRBD driver") +Cc: stable@vger.kernel.org +Assisted-by: Codex:gpt-5-5-xhigh +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Michael Bommarito +Reviewed-by: Christoph Böhmwalder +Link: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/drbd/drbd_receiver.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -1810,6 +1810,11 @@ static int recv_dless_read(struct drbd_p + data_size -= digest_size; + } + ++ if (data_size < 0) { ++ drbd_err(peer_device, "Invalid data reply size\n"); ++ return -EIO; ++ } ++ + /* optimistically update recv_cnt. if receiving fails below, + * we disconnect anyways, and counters will be reset. */ + peer_device->device->recv_cnt += data_size>>9; diff --git a/queue-7.1/fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch b/queue-7.1/fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch new file mode 100644 index 0000000000..dfa52278b1 --- /dev/null +++ b/queue-7.1/fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch @@ -0,0 +1,56 @@ +From b9f089723aee892efc77c349ae47a6b452b293c4 Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Mon, 6 Jul 2026 15:46:23 -0700 +Subject: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list + +From: Reinette Chatre + +commit b9f089723aee892efc77c349ae47a6b452b293c4 upstream. + +A pseudo-locked group's RMID is freed when it is created. On unmount +rmdir_all_sub() unconditionally frees all RMID of all groups, resulting +in a double-free of the pseudo-locked group's RMID. The consequence of this +is that the original free results in the pseudo-locked group's RMID being +added to the rmid_free_lru linked list and the second free then attempts +to add the same RMID entry to the rmid_free_lru again. + +Do not double-free a pseudo-locked group's RMID. + +Fixes: e0bdfe8e36f3 ("x86/intel_rdt: Support creation/removal of pseudo-locked region") +Signed-off-by: Reinette Chatre +Signed-off-by: Borislav Petkov (AMD) +Cc: +Link: https://patch.msgid.link/551432dd7e624a862b8e58314c38aaba0afff3e9.1783377598.git.reinette.chatre@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + fs/resctrl/rdtgroup.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/fs/resctrl/rdtgroup.c ++++ b/fs/resctrl/rdtgroup.c +@@ -3074,10 +3074,6 @@ static void rmdir_all_sub(void) + if (rdtgrp == &rdtgroup_default) + continue; + +- if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP || +- rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) +- rdtgroup_pseudo_lock_remove(rdtgrp); +- + /* + * Give any CPUs back to the default group. We cannot copy + * cpu_online_mask because a CPU might have executed the +@@ -3088,7 +3084,13 @@ static void rmdir_all_sub(void) + + rdtgroup_unassign_cntrs(rdtgrp); + +- free_rmid(rdtgrp->closid, rdtgrp->mon.rmid); ++ if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP || ++ rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) { ++ rdtgroup_pseudo_lock_remove(rdtgrp); ++ } else { ++ /* Pseudo-locked group's RMID is freed during setup. */ ++ free_rmid(rdtgrp->closid, rdtgrp->mon.rmid); ++ } + + kernfs_remove(rdtgrp->kn); + list_del(&rdtgrp->rdtgroup_list); diff --git a/queue-7.1/fs-resctrl-free-mon_data-structures-on-rdt_get_tree-failure.patch b/queue-7.1/fs-resctrl-free-mon_data-structures-on-rdt_get_tree-failure.patch new file mode 100644 index 0000000000..2048820ab9 --- /dev/null +++ b/queue-7.1/fs-resctrl-free-mon_data-structures-on-rdt_get_tree-failure.patch @@ -0,0 +1,49 @@ +From ca0676ae2e1a23ac3e858224fc630b99f9e216ea Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Mon, 6 Jul 2026 15:46:21 -0700 +Subject: fs/resctrl: Free mon_data structures on rdt_get_tree() failure + +From: Tony Luck + +commit ca0676ae2e1a23ac3e858224fc630b99f9e216ea upstream. + +If mkdir_mondata_all() or a subsequent call in rdt_get_tree() fails, the +mon_data structures allocated by mon_get_kn_priv() are leaked. + +Add mon_put_kn_priv() to the out_mongrp error path to free the mon_data +structures. + +Fixes: 2a6566038544 ("x86/resctrl: Expand the width of domid by replacing mon_data_bits") +Closes: https://lore.kernel.org/lkml/5d38c1fb-8f91-472b-8897-24b2f50c772b@intel.com/ +Reported-by: Reinette Chatre +Signed-off-by: Tony Luck +Signed-off-by: Reinette Chatre +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Chen Yu +Reviewed-by: Ben Horgan +Cc: +Link: https://patch.msgid.link/433623b7e3316ffd52323255d1aa4f156ad97cb1.1783377598.git.reinette.chatre@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + fs/resctrl/rdtgroup.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/resctrl/rdtgroup.c ++++ b/fs/resctrl/rdtgroup.c +@@ -74,6 +74,8 @@ static int rdtgroup_setup_root(struct rd + + static void rdtgroup_destroy_root(void); + ++static void mon_put_kn_priv(void); ++ + struct dentry *debugfs_resctrl; + + /* +@@ -2895,6 +2897,7 @@ out_mondata: + kernfs_remove(kn_mondata); + out_mongrp: + if (resctrl_arch_mon_capable()) { ++ mon_put_kn_priv(); + rdtgroup_unassign_cntrs(&rdtgroup_default); + kernfs_remove(kn_mongrp); + } diff --git a/queue-7.1/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch b/queue-7.1/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch new file mode 100644 index 0000000000..0072b1b8e7 --- /dev/null +++ b/queue-7.1/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch @@ -0,0 +1,65 @@ +From 2975324d164c552b028632f107b567302863b7f6 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Thu, 2 Jul 2026 19:28:36 +0800 +Subject: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new + +From: Yizhou Zhao + +commit 2975324d164c552b028632f107b567302863b7f6 upstream. + +Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in +ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn +object with kmem_cache_alloc(). The function then initializes many +fields explicitly, but only resets in_seq.delta and out_seq.delta in the +two struct ip_vs_seq members. + +That leaves init_seq and previous_delta uninitialized. This is normally +harmless while the corresponding IP_VS_CONN_F_IN_SEQ or +IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync +message, however, ip_vs_proc_conn() preserves those flags from +IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits +IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with +SEQ flags set but with the rest of in_seq/out_seq still containing stale +slab data. + +When a packet for such a connection is later handled by an IPVS +application helper, vs_fix_seq() and vs_fix_ack_seq() use +previous_delta and init_seq to rewrite TCP sequence numbers. A malformed +sync message can therefore make forwarded packets carry stale slab bytes +in their TCP seq/ack numbers, and can also corrupt the forwarded TCP +flow. + +Reset both struct ip_vs_seq members completely before publishing the +connection. This matches the existing "reset struct ip_vs_seq" comment +and keeps the sequence-adjustment gates inactive unless valid sequence +data is installed later. + +Fixes: 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") +Cc: stable@vger.kernel.org +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude-Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -1411,8 +1411,8 @@ ip_vs_conn_new(const struct ip_vs_conn_p + cp->app = NULL; + cp->app_data = NULL; + /* reset struct ip_vs_seq */ +- cp->in_seq.delta = 0; +- cp->out_seq.delta = 0; ++ memset(&cp->in_seq, 0, sizeof(cp->in_seq)); ++ memset(&cp->out_seq, 0, sizeof(cp->out_seq)); + + atomic_inc(&ipvs->conn_count); + if (unlikely(flags & IP_VS_CONN_F_NO_CPORT)) { diff --git a/queue-7.1/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch b/queue-7.1/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch new file mode 100644 index 0000000000..34d78753c1 --- /dev/null +++ b/queue-7.1/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch @@ -0,0 +1,83 @@ +From 2f75c0faa3361b28e36cc0512b3299e163e25789 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Mon, 6 Jul 2026 18:16:24 +0800 +Subject: ipvs: use parsed transport offset in SCTP state lookup + +From: Yizhou Zhao + +commit 2f75c0faa3361b28e36cc0512b3299e163e25789 upstream. + +set_sctp_state() reads the SCTP chunk header again in order to drive the +IPVS SCTP state table. For IPv6 it computes the offset with +sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from +ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped +extension headers and found the real transport header. + +This makes the state machine read from the wrong offset for IPv6 SCTP +packets that carry extension headers. For example, an INIT packet with an +8-byte destination options header can be scheduled correctly by +sctp_conn_schedule(), but set_sctp_state() reads the first byte of the +SCTP verification tag as a DATA chunk type. The connection then moves +from NONE to ESTABLISHED instead of INIT1, gets the longer established +timeout, and updates the active/inactive destination counters +incorrectly. This happens even though the SCTP handshake has not +completed. + +Use the parsed transport offset passed down from ip_vs_set_state() for +the SCTP chunk-header lookup. For IPv4 and IPv6 packets without +extension headers this preserves the existing offset. + +Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/ +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -372,20 +372,15 @@ static const char *sctp_state_name(int s + + static inline void + set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, +- int direction, const struct sk_buff *skb) ++ int direction, const struct sk_buff *skb, ++ unsigned int iph_len) + { + struct sctp_chunkhdr _sctpch, *sch; + unsigned char chunk_type; + int event, next_state; +- int ihl, cofs; +- +-#ifdef CONFIG_IP_VS_IPV6 +- ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr); +-#else +- ihl = ip_hdrlen(skb); +-#endif ++ int cofs; + +- cofs = ihl + sizeof(struct sctphdr); ++ cofs = iph_len + sizeof(struct sctphdr); + sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch); + if (sch == NULL) + return; +@@ -472,7 +467,7 @@ sctp_state_transition(struct ip_vs_conn + unsigned int iph_len) + { + spin_lock_bh(&cp->lock); +- set_sctp_state(pd, cp, direction, skb); ++ set_sctp_state(pd, cp, direction, skb, iph_len); + spin_unlock_bh(&cp->lock); + } + diff --git a/queue-7.1/irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch b/queue-7.1/irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch new file mode 100644 index 0000000000..488b91d3dc --- /dev/null +++ b/queue-7.1/irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch @@ -0,0 +1,64 @@ +From 1358126fbed104e5657955d3ba029b283687ba02 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Tue, 23 Jun 2026 15:37:44 +0800 +Subject: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure + +From: Haoxiang Li + +commit 1358126fbed104e5657955d3ba029b283687ba02 upstream. + +imsic_early_acpi_init() allocates a firmware node before setting up the +IMSIC state. If imsic_setup_state() fails, the function returns without +freeing the allocated fwnode. + +Free the fwnode and clear the global pointer on this error path, matching +the cleanup already done when imsic_early_probe() fails. + +[ tglx: Use a common cleanup path instead of copying code around ] + +Fixes: fbe826b1c106 ("irqchip/riscv-imsic: Add ACPI support") +Signed-off-by: Haoxiang Li +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260623073744.2009137-1-haoxiang_li2024@163.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-riscv-imsic-early.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/irqchip/irq-riscv-imsic-early.c ++++ b/drivers/irqchip/irq-riscv-imsic-early.c +@@ -272,16 +272,13 @@ static int __init imsic_early_acpi_init( + rc = imsic_setup_state(imsic_acpi_fwnode, imsic); + if (rc) { + pr_err("%pfwP: failed to setup state (error %d)\n", imsic_acpi_fwnode, rc); +- return rc; ++ goto cleanup; + } + + /* Do early setup of IMSIC state and IPIs */ + rc = imsic_early_probe(imsic_acpi_fwnode); +- if (rc) { +- irq_domain_free_fwnode(imsic_acpi_fwnode); +- imsic_acpi_fwnode = NULL; +- return rc; +- } ++ if (rc) ++ goto cleanup; + + rc = imsic_platform_acpi_probe(imsic_acpi_fwnode); + +@@ -300,8 +297,12 @@ static int __init imsic_early_acpi_init( + * DT where IPI works but MSI probe fails for some reason. + */ + return 0; +-} + ++cleanup: ++ irq_domain_free_fwnode(imsic_acpi_fwnode); ++ imsic_acpi_fwnode = NULL; ++ return rc; ++} + IRQCHIP_ACPI_DECLARE(riscv_imsic, ACPI_MADT_TYPE_IMSIC, NULL, + 1, imsic_early_acpi_init); + #endif diff --git a/queue-7.1/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch b/queue-7.1/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch new file mode 100644 index 0000000000..fe0e915d3a --- /dev/null +++ b/queue-7.1/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch @@ -0,0 +1,45 @@ +From 660667cd406648bbaffbd5c0d897c2263a852f11 Mon Sep 17 00:00:00 2001 +From: Shuangpeng Bai +Date: Tue, 30 Jun 2026 15:48:56 -0400 +Subject: llc: fix SAP refcount leak in llc_ui_autobind() + +From: Shuangpeng Bai + +commit 660667cd406648bbaffbd5c0d897c2263a852f11 upstream. + +llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. +llc_sap_open() returns a reference owned by the caller, and +llc_sap_add_socket() takes a second reference for the socket's +membership in the SAP hash tables. + +llc_ui_bind() drops the caller's reference after adding the socket, +but llc_ui_autobind() keeps it. When the socket is closed, +llc_sap_remove_socket() releases only the socket reference, leaving +the SAP on llc_sap_list with sk_count == 0. + +This is user-visible because repeated autobind and close cycles can consume +all dynamic SAP values and make later autobinds fail with -EUSERS. + +Drop the caller's reference after a successful autobind, matching +llc_ui_bind()'s ownership model. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Shuangpeng Bai +Link: https://patch.msgid.link/20260630194856.1036497-1-shuangpeng.kernel@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/af_llc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -317,6 +317,7 @@ static int llc_ui_autobind(struct socket + /* assign new connection to its SAP */ + llc_sap_add_socket(sap, sk); + sock_reset_flag(sk, SOCK_ZAPPED); ++ llc_sap_put(sap); + rc = 0; + out: + dev_put(dev); diff --git a/queue-7.1/mac802154-remove-interfaces-with-rcu-list-deletion.patch b/queue-7.1/mac802154-remove-interfaces-with-rcu-list-deletion.patch new file mode 100644 index 0000000000..a6813c0f82 --- /dev/null +++ b/queue-7.1/mac802154-remove-interfaces-with-rcu-list-deletion.patch @@ -0,0 +1,43 @@ +From 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 Mon Sep 17 00:00:00 2001 +From: Yousef Alhouseen +Date: Wed, 1 Jul 2026 18:42:22 +0200 +Subject: mac802154: remove interfaces with RCU list deletion + +From: Yousef Alhouseen + +commit 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 upstream. + +Queue wake, stop, and disable paths walk local->interfaces under RCU. +The bulk hardware teardown path removes entries with list_del(), so an +asynchronous transmit completion can follow a poisoned list node in +ieee802154_wake_queue(). + +Use list_del_rcu() as in the single-interface removal path. The following +unregister_netdevice() waits for in-flight RCU readers before freeing the +netdevice, so no separate grace-period wait is needed. + +Fixes: 592dfbfc72f5 ("mac820154: move interface unregistration into iface") +Reported-by: syzbot+36256deb69a588e9290e@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=36256deb69a588e9290e +Cc: stable@vger.kernel.org +Signed-off-by: Yousef Alhouseen +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Miquel Raynal +Link: https://patch.msgid.link/20260701164222.9094-1-alhouseenyousef@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mac802154/iface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac802154/iface.c ++++ b/net/mac802154/iface.c +@@ -703,7 +703,7 @@ void ieee802154_remove_interfaces(struct + + mutex_lock(&local->iflist_mtx); + list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) { +- list_del(&sdata->list); ++ list_del_rcu(&sdata->list); + + unregister_netdevice(sdata->dev); + } diff --git a/queue-7.1/macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch b/queue-7.1/macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch new file mode 100644 index 0000000000..d38e3bc142 --- /dev/null +++ b/queue-7.1/macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch @@ -0,0 +1,47 @@ +From f5089008f90c0a7c5520dff3934e0af00adf322d Mon Sep 17 00:00:00 2001 +From: Daehyeon Ko <4ncienth@gmail.com> +Date: Fri, 3 Jul 2026 17:36:33 +0900 +Subject: macsec: don't read an unset MAC header in macsec_encrypt() + +From: Daehyeon Ko <4ncienth@gmail.com> + +commit f5089008f90c0a7c5520dff3934e0af00adf322d upstream. + +macsec_encrypt() reads the Ethernet header via eth_hdr(skb) +(skb->head + skb->mac_header) to memmove() the 12 source/destination MAC +bytes forward and make room for the SecTAG. + +On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb +reaches the macsec ndo_start_xmit() with the MAC header unset, so +eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of +bounds: a 12-byte heap over-read that is also emitted on the wire as the +frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds +read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET +build flags it as an unset mac header in skb_mac_header(). + +On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added +by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in +macvlan_broadcast()") for exactly this purpose. + +Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") +Cc: stable@vger.kernel.org +Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20260703083634.2035145-1-4ncienth@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/macsec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -646,7 +646,7 @@ static struct sk_buff *macsec_encrypt(st + } + + unprotected_len = skb->len; +- eth = eth_hdr(skb); ++ eth = skb_eth_hdr(skb); + sci_present = macsec_send_sci(secy); + hh = skb_push(skb, macsec_extra_len(sci_present)); + memmove(hh, eth, 2 * ETH_ALEN); diff --git a/queue-7.1/mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch b/queue-7.1/mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch new file mode 100644 index 0000000000..fad3d08314 --- /dev/null +++ b/queue-7.1/mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch @@ -0,0 +1,53 @@ +From 7da7d599b8a83271c464adfd5ef160202b470570 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Mon, 22 Jun 2026 11:30:42 -0400 +Subject: mm/compaction: handle free_pages_prepare() properly in compaction_free() + +From: Zi Yan + +commit 7da7d599b8a83271c464adfd5ef160202b470570 upstream. + +free_pages_prepare() can fail but compaction_free() does not handle the +failure case. Failed pages should not be added back to cc->freepages for +future use, since they can be either PageHWPoison or free_page_is_bad() +and might cause data corruption. + +Link: https://lore.kernel.org/20260622-handle_free_pages_prepare_in_compaction_free-v1-1-fcf3b14abcf7@nvidia.com +Fixes: 733aea0b3a7b ("mm/compaction: add support for >0 order folio memory compaction.") +Signed-off-by: Zi Yan +Reviewed-by: Vlastimil Babka (SUSE) +Acked-by: Johannes Weiner +Reviewed-by: Baolin Wang +Reviewed-by: Lance Yang +Cc: Brendan Jackman +Cc: Jiaqi Yan +Cc: Michal Hocko +Cc: Suren Baghdasaryan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/compaction.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -1875,15 +1875,14 @@ static void compaction_free(struct folio + int order = folio_order(dst); + struct page *page = &dst->page; + +- if (folio_put_testzero(dst)) { +- free_pages_prepare(page, order); ++ if (folio_put_testzero(dst) && free_pages_prepare(page, order)) { + list_add(&dst->lru, &cc->freepages[order]); + cc->nr_freepages += 1 << order; + } + cc->nr_migratepages += 1 << order; + /* +- * someone else has referenced the page, we cannot take it back to our +- * free list. ++ * someone else has referenced the page or free_pages_prepare() fails, ++ * we cannot take it back to our free list. + */ + } + diff --git a/queue-7.1/net-macb-drop-in-flight-tx-skbs-on-close.patch b/queue-7.1/net-macb-drop-in-flight-tx-skbs-on-close.patch new file mode 100644 index 0000000000..19b644fec8 --- /dev/null +++ b/queue-7.1/net-macb-drop-in-flight-tx-skbs-on-close.patch @@ -0,0 +1,61 @@ +From 27f575836cfebbf872dec020428742b10650a955 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Th=C3=A9o=20Lebrun?= +Date: Thu, 2 Jul 2026 17:37:02 +0200 +Subject: net: macb: drop in-flight Tx SKBs on close +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Théo Lebrun + +commit 27f575836cfebbf872dec020428742b10650a955 upstream. + +The MACB driver has since forever leaked the outgoing SKBs that +have not yet been marked as completed. They live in queue->tx_skb +which gets freed without remorse nor checking. + +macb_free_consistent() gets called in a few codepaths, but only close will +trigger the added expressions. In macb_open() and macb_alloc_consistent() +failure cases, queues' tx_skb just got allocated and are empty. + +Fixes: 89e5785fc8a6 ("[PATCH] Atmel MACB ethernet driver") +Cc: stable@vger.kernel.org +Reviewed-by: Nicolai Buchwitz +Signed-off-by: Théo Lebrun +Link: https://patch.msgid.link/20260702-macb-drop-tx-v4-1-1c833eebdbc8@bootlin.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cadence/macb_main.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2668,8 +2668,25 @@ static void macb_free_consistent(struct + dma_free_coherent(dev, size, bp->queues[0].rx_ring, bp->queues[0].rx_ring_dma); + + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { +- kfree(queue->tx_skb); +- queue->tx_skb = NULL; ++ if (queue->tx_skb) { ++ unsigned int dropped = 0, tail; ++ ++ for (tail = queue->tx_tail; tail != queue->tx_head; ++ tail++) { ++ if (macb_tx_skb(queue, tail)->skb) ++ dropped++; ++ macb_tx_unmap(bp, macb_tx_skb(queue, tail), 0); ++ } ++ ++ queue->stats.tx_dropped += dropped; ++ bp->dev->stats.tx_dropped += dropped; ++ ++ kfree(queue->tx_skb); ++ queue->tx_skb = NULL; ++ } ++ ++ queue->tx_head = 0; ++ queue->tx_tail = 0; + queue->tx_ring = NULL; + queue->rx_ring = NULL; + } diff --git a/queue-7.1/octeontx2-pf-fix-sqb-pointer-leak-on-init-failure.patch b/queue-7.1/octeontx2-pf-fix-sqb-pointer-leak-on-init-failure.patch new file mode 100644 index 0000000000..d86f483e96 --- /dev/null +++ b/queue-7.1/octeontx2-pf-fix-sqb-pointer-leak-on-init-failure.patch @@ -0,0 +1,79 @@ +From 62e7df6d042aeebd5efb581074e28865c04477be Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Tue, 30 Jun 2026 15:16:25 +0800 +Subject: octeontx2-pf: fix SQB pointer leak on init failure + +From: Dawei Feng + +commit 62e7df6d042aeebd5efb581074e28865c04477be upstream. + +otx2_init_hw_resources() initializes SQ aura and pool resources before +several later setup steps. On failure, err_free_sq_ptrs only frees SQB +pages, leaving the per-SQ sqb_ptrs arrays behind. + +Use otx2_free_sq_res() for the SQ unwind path and let it free sqb_ptrs +even when sq->sqe has not been allocated yet. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still +present in v7.1.1. + +An x86_64 allyesconfig build showed no new warnings. As we do not have an +OcteonTX2 PF device and the corresponding AF mailbox setup to test with, +no runtime testing was able to be performed. + +Fixes: caa2da34fd25 ("octeontx2-pf: Initialize and config queues") +Cc: stable@vger.kernel.org +Reviewed-by: Ratheesh Kannoth +Signed-off-by: Dawei Feng +Link: https://patch.msgid.link/20260630071625.349996-1-dawei.feng@seu.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 21 +++++++++---------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1569,15 +1569,15 @@ static void otx2_free_sq_res(struct otx2 + otx2_sq_free_sqbs(pf); + for (qidx = 0; qidx < otx2_get_total_tx_queues(pf); qidx++) { + sq = &qset->sq[qidx]; +- /* Skip freeing Qos queues if they are not initialized */ +- if (!sq->sqe) +- continue; +- qmem_free(pf->dev, sq->sqe); +- qmem_free(pf->dev, sq->sqe_ring); +- qmem_free(pf->dev, sq->cpt_resp); +- qmem_free(pf->dev, sq->tso_hdrs); +- qmem_free(pf->dev, sq->timestamps); +- kfree(sq->sg); ++ /* sq->sqe is not initialized for unused QoS queues */ ++ if (sq->sqe) { ++ qmem_free(pf->dev, sq->sqe); ++ qmem_free(pf->dev, sq->sqe_ring); ++ qmem_free(pf->dev, sq->cpt_resp); ++ qmem_free(pf->dev, sq->tso_hdrs); ++ qmem_free(pf->dev, sq->timestamps); ++ kfree(sq->sg); ++ } + kfree(sq->sqb_ptrs); + } + } +@@ -1712,13 +1712,12 @@ int otx2_init_hw_resources(struct otx2_n + return err; + + err_free_nix_queues: +- otx2_free_sq_res(pf); + otx2_free_cq_res(pf); + otx2_ctx_disable(mbox, NIX_AQ_CTYPE_RQ, false); + err_free_txsch: + otx2_txschq_stop(pf); + err_free_sq_ptrs: +- otx2_sq_free_sqbs(pf); ++ otx2_free_sq_res(pf); + err_free_rq_ptrs: + otx2_free_aura_ptr(pf, AURA_NIX_RQ); + otx2_ctx_disable(mbox, NPA_AQ_CTYPE_POOL, true); diff --git a/queue-7.1/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch b/queue-7.1/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch new file mode 100644 index 0000000000..77d6722558 --- /dev/null +++ b/queue-7.1/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch @@ -0,0 +1,53 @@ +From 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f Mon Sep 17 00:00:00 2001 +From: Tao Liu +Date: Mon, 6 Jul 2026 11:27:07 +1200 +Subject: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() + +From: Tao Liu + +commit 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f upstream. + +A NULL pointer dereference issue is noticed in riscv's +machine_kexec_prepare(), where image->segment[i].buf might be NULL and +copied unchecked. + +The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by +kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without +a check in machine_kexec_prepare(): + + kexec_file_load + -> kimage_file_alloc_init() + -> kimage_file_prepare_segments() + -> ima_add_kexec_buffer() + -> kexec_add_buffer() + -> machine_kexec_prepare() + -> memcpy() + +Address this by adding a check before the data copy attempt. + +Fixes: b7fb4d78a6ad ("RISC-V: use memcpy for kexec_file mode") +Cc: stable@vger.kernel.org +Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/ +Acked-by: Baoquan He +Acked-by: Pratyush Yadav +Reviewed-by: Nutty Liu +Signed-off-by: Tao Liu +Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/machine_kexec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/riscv/kernel/machine_kexec.c ++++ b/arch/riscv/kernel/machine_kexec.c +@@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *ima + if (image->segment[i].memsz <= sizeof(fdt)) + continue; + ++ if (!image->segment[i].buf) ++ continue; ++ + if (image->file_mode) + memcpy(&fdt, image->segment[i].buf, sizeof(fdt)); + else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt))) diff --git a/queue-7.1/s390-diag-add-missing-array_index_nospec-call-to-memtop_get_page_count.patch b/queue-7.1/s390-diag-add-missing-array_index_nospec-call-to-memtop_get_page_count.patch new file mode 100644 index 0000000000..7f0528675e --- /dev/null +++ b/queue-7.1/s390-diag-add-missing-array_index_nospec-call-to-memtop_get_page_count.patch @@ -0,0 +1,46 @@ +From b7577fe4c47a31ca7c99714c53244a44af03cdfe Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 22 Jun 2026 16:31:24 +0200 +Subject: s390/diag: Add missing array_index_nospec() call to memtop_get_page_count() + +From: Heiko Carstens + +commit b7577fe4c47a31ca7c99714c53244a44af03cdfe upstream. + +'level' is user space controlled and used to read from an array. Add the +missing array_index_nospec() call to prevent speculative execution. + +Cc: stable@vger.kernel.org +Fixes: 0d30871739ab ("s390/diag: Add memory topology information via diag310") +Signed-off-by: Heiko Carstens +Reviewed-by: Mete Durlu +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/diag/diag310.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/s390/kernel/diag/diag310.c ++++ b/arch/s390/kernel/diag/diag310.c +@@ -190,17 +190,18 @@ static int memtop_get_stride_len(unsigne + static int memtop_get_page_count(unsigned long *res, unsigned long level) + { + static unsigned long memtop_pages[DIAG310_LEVELMAX]; +- unsigned long pages; ++ unsigned long pages, idx; + int rc; + + if (level > DIAG310_LEVELMAX || level < DIAG310_LEVELMIN) + return -EINVAL; +- pages = READ_ONCE(memtop_pages[level - 1]); ++ idx = array_index_nospec(level - 1, ARRAY_SIZE(memtop_pages)); ++ pages = READ_ONCE(memtop_pages[idx]); + if (!pages) { + rc = diag310_get_memtop_size(&pages, level); + if (rc) + return rc; +- WRITE_ONCE(memtop_pages[level - 1], pages); ++ WRITE_ONCE(memtop_pages[idx], pages); + } + *res = pages; + return 0; diff --git a/queue-7.1/s390-mm-fix-type-mismatch-in-get_align_mask.patch b/queue-7.1/s390-mm-fix-type-mismatch-in-get_align_mask.patch new file mode 100644 index 0000000000..29e2503774 --- /dev/null +++ b/queue-7.1/s390-mm-fix-type-mismatch-in-get_align_mask.patch @@ -0,0 +1,38 @@ +From ec84aad4c3594307d103af563991b4415ac5c8ab Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Tue, 30 Jun 2026 19:32:14 +0200 +Subject: s390/mm: Fix type mismatch in get_align_mask(). + +From: Gerald Schaefer + +commit ec84aad4c3594307d103af563991b4415ac5c8ab upstream. + +Commit 86f48f922ba79 ("s390/mmap: disable mmap alignment when +randomize_va_space = 0") introduced get_align_mask() with return type of +'int', while the target field 'info.align_mask' in struct +vm_unmapped_area_info is 'unsigned long'. + +With currently used masks, this should not cause truncation issues, but +fix it and return 'unsigned long' to avoid future problems. + +Fixes: 86f48f922ba79 ("s390/mmap: disable mmap alignment when randomize_va_space = 0") +Cc: stable@vger.kernel.org # v6.9+ +Signed-off-by: Gerald Schaefer +Reviewed-by: Sven Schnelle +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/mmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/mm/mmap.c ++++ b/arch/s390/mm/mmap.c +@@ -64,7 +64,7 @@ static inline unsigned long mmap_base(un + return PAGE_ALIGN(STACK_TOP - gap - rnd); + } + +-static int get_align_mask(struct file *filp, unsigned long flags) ++static unsigned long get_align_mask(struct file *filp, unsigned long flags) + { + if (filp && is_file_hugepages(filp)) + return huge_page_mask_align(filp); diff --git a/queue-7.1/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch b/queue-7.1/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch new file mode 100644 index 0000000000..c28d484547 --- /dev/null +++ b/queue-7.1/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch @@ -0,0 +1,43 @@ +From 2995ccec260caa9e85b3301a4aba1e66ed80ad74 Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Tue, 23 Jun 2026 19:44:06 +0200 +Subject: s390/monwriter: Reject buffer reuse with different data length + +From: Gerald Schaefer + +commit 2995ccec260caa9e85b3301a4aba1e66ed80ad74 upstream. + +When data buffers are reused, e.g. for interval sample records, the +first record determines the data length, and the size of the buffer for +user copy. Current monwriter code does not check if the data length was +changed for subsequent records, which also would never happen for valid +user programs. + +However, a malicious user could change the data length, resulting in out +of bounds user copy to the kernel buffer, and memory corruption. By +default, the monwriter misc device is created with root-only permissions, +so practical impact is typically low. + +Fix this by checking for changed data length and rejecting such records. + +Cc: stable@vger.kernel.org +Signed-off-by: Gerald Schaefer +Reviewed-by: Christian Borntraeger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/char/monwriter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/char/monwriter.c ++++ b/drivers/s390/char/monwriter.c +@@ -122,6 +122,9 @@ static int monwrite_new_hdr(struct mon_p + kfree(monbuf->data); + kfree(monbuf); + monbuf = NULL; ++ } else if (monbuf->hdr.datalen != monhdr->datalen) { ++ /* Data with buffer reuse must not change its length */ ++ return -EINVAL; + } + } else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) { + if (mon_buf_count >= mon_max_bufs) diff --git a/queue-7.1/selftests-net-make-busywait-timeout-clock-portable.patch b/queue-7.1/selftests-net-make-busywait-timeout-clock-portable.patch new file mode 100644 index 0000000000..88f02dd75a --- /dev/null +++ b/queue-7.1/selftests-net-make-busywait-timeout-clock-portable.patch @@ -0,0 +1,72 @@ +From dd6a23bac306b7aa322e0aaccb60c6e32a198fb3 Mon Sep 17 00:00:00 2001 +From: Nirmoy Das +Date: Tue, 30 Jun 2026 09:51:57 -0700 +Subject: selftests: net: make busywait timeout clock portable + +From: Nirmoy Das + +commit dd6a23bac306b7aa322e0aaccb60c6e32a198fb3 upstream. + +loopy_wait() expects millisecond timestamps. However, Ubuntu Resolute +can use uutils date, where `date -u +%s%3N` returns seconds plus full +nanoseconds instead of a 3-digit millisecond field. This makes +busywait expire too early and can make vlan_bridge_binding.sh read a +stale operstate. + +Fixes: 25ae948b4478 ("selftests/net: add lib.sh") +Cc: stable@vger.kernel.org # 6.8+ +Link: https://github.com/uutils/coreutils/issues/11658 +Signed-off-by: Nirmoy Das +Link: https://patch.msgid.link/20260630165157.3814871-1-nirmoyd@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/lib.sh | 25 +++++++++++++++++++++++-- + 1 file changed, 23 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/net/lib.sh ++++ b/tools/testing/selftests/net/lib.sh +@@ -70,12 +70,33 @@ ksft_exit_status_merge() + $ksft_xfail $ksft_pass $ksft_skip $ksft_fail + } + ++timestamp_ms() ++{ ++ local now ++ local seconds ++ local nanoseconds ++ ++ now=$(date -u +%s:%N) || return ++ seconds=${now%:*} ++ nanoseconds=${now#*:} ++ ++ if [[ $nanoseconds =~ ^[0-9]+$ ]]; then ++ nanoseconds=${nanoseconds:0:9} ++ else ++ nanoseconds=0 ++ fi ++ ++ echo $((seconds * 1000 + 10#$nanoseconds / 1000000)) ++} ++ + loopy_wait() + { + local sleep_cmd=$1; shift + local timeout_ms=$1; shift ++ local start_time ++ local current_time + +- local start_time="$(date -u +%s%3N)" ++ start_time=$(timestamp_ms) || return + while true + do + local out +@@ -84,7 +105,7 @@ loopy_wait() + return 0 + fi + +- local current_time="$(date -u +%s%3N)" ++ current_time=$(timestamp_ms) || return + if ((current_time - start_time > timeout_ms)); then + echo -n "$out" + return 1 diff --git a/queue-7.1/selftests-rseq-fix-a-building-error-for-riscv-arch.patch b/queue-7.1/selftests-rseq-fix-a-building-error-for-riscv-arch.patch new file mode 100644 index 0000000000..1efd73afa2 --- /dev/null +++ b/queue-7.1/selftests-rseq-fix-a-building-error-for-riscv-arch.patch @@ -0,0 +1,48 @@ +From a2ac823d8a228e392bc6a79ea63b550ab84a55b2 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Tue, 7 Jul 2026 16:23:48 +0800 +Subject: selftests/rseq: Fix a building error for riscv arch + +From: Hui Wang + +commit a2ac823d8a228e392bc6a79ea63b550ab84a55b2 upstream. + +RISC-V rseq selftests include asm/fence.h from tools/arch/riscv, +but the rseq Makefile only adds tools/include in the CFLAGS, this +results in the building failure both for native and cross build: + + In file included from rseq.h:131, + from rseq.c:37: + rseq-riscv.h:11:10: fatal error: asm/fence.h: No such file or directory + +To fix it, add the matching tools/arch/$(ARCH)/include path in the +CFLAGS and derive ARCH from SUBARCH for standalone native builds where +ARCH is not set. + +Fixes: c92786e179e0 ("KVM: riscv: selftests: Use the existing RISCV_FENCE macro in `rseq-riscv.h`") +Cc: stable@vger.kernel.org +Signed-off-by: Hui Wang +Link: https://patch.msgid.link/20260707082348.36896-1-hui.wang@canonical.com +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/rseq/Makefile | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/rseq/Makefile ++++ b/tools/testing/selftests/rseq/Makefile +@@ -5,9 +5,13 @@ CLANG_FLAGS += -no-integrated-as + endif + + top_srcdir = ../../../.. ++include $(top_srcdir)/scripts/subarch.include ++ARCH ?= $(SUBARCH) ++LINUX_TOOL_ARCH_INCLUDE = $(top_srcdir)/tools/arch/$(ARCH)/include + + CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -L$(OUTPUT) -Wl,-rpath=./ \ +- $(CLANG_FLAGS) -I$(top_srcdir)/tools/include ++ $(CLANG_FLAGS) -I$(top_srcdir)/tools/include \ ++ -I$(LINUX_TOOL_ARCH_INCLUDE) + LDLIBS += -lpthread -ldl + + # Own dependencies because we only want to build against 1st prerequisite, but diff --git a/queue-7.1/series b/queue-7.1/series index 8c10260b8a..f94a9b10cf 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1977,3 +1977,29 @@ net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch riscv-probes-save-original-sp-in-rethook-trampoline.patch +mm-compaction-handle-free_pages_prepare-properly-in-compaction_free.patch +irqchip-irq-riscv-imsic-early-fix-fwnode-leak-on-state-setup-failure.patch +s390-monwriter-reject-buffer-reuse-with-different-data-length.patch +mac802154-remove-interfaces-with-rcu-list-deletion.patch +octeontx2-pf-fix-sqb-pointer-leak-on-init-failure.patch +selftests-net-make-busywait-timeout-clock-portable.patch +llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch +ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch +ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch +macsec-don-t-read-an-unset-mac-header-in-macsec_encrypt.patch +dibs-loopback-validate-offset-and-size-in-move_data.patch +net-macb-drop-in-flight-tx-skbs-on-close.patch +amdkfd-properly-free-secondary-context-id.patch +arm64-smp-fix-hot-unplug-tearing-by-forcing-unregistration.patch +cpu-hotplug-fix-null-kobject-warning-in-cpuhp_smt_enable.patch +fs-resctrl-free-mon_data-structures-on-rdt_get_tree-failure.patch +fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch +ata-libata-core-skip-hpa-resize-for-locked-drives.patch +ata-libata-core-allow-capacity-transition-to-zero-for-locked-drives.patch +drbd-reject-data-replies-with-an-out-of-range-payload-size.patch +riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch +tracing-osnoise-call-synchronize_rcu-when-unregistering.patch +s390-diag-add-missing-array_index_nospec-call-to-memtop_get_page_count.patch +s390-mm-fix-type-mismatch-in-get_align_mask.patch +selftests-rseq-fix-a-building-error-for-riscv-arch.patch +cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch diff --git a/queue-7.1/tracing-osnoise-call-synchronize_rcu-when-unregistering.patch b/queue-7.1/tracing-osnoise-call-synchronize_rcu-when-unregistering.patch new file mode 100644 index 0000000000..8f4d1e0409 --- /dev/null +++ b/queue-7.1/tracing-osnoise-call-synchronize_rcu-when-unregistering.patch @@ -0,0 +1,37 @@ +From fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a Mon Sep 17 00:00:00 2001 +From: Crystal Wood +Date: Mon, 8 Jun 2026 23:54:30 -0500 +Subject: tracing/osnoise: Call synchronize_rcu() when unregistering + +From: Crystal Wood + +commit fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a upstream. + +This ensures that any RCU readers traversing the instance list +have finished, before releasing the reference on the tracer that +the instance points to. + +Cc: stable@vger.kernel.org +Fixes: a6ed2aee54644 ("tracing: Switch to kvfree_rcu() API") +Link: https://patch.msgid.link/20260609045430.1589786-1-crwood@redhat.com +Suggested-by: Steven Rostedt +Signed-off-by: Crystal Wood +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_osnoise.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_osnoise.c ++++ b/kernel/trace/trace_osnoise.c +@@ -162,7 +162,9 @@ static void osnoise_unregister_instance( + if (!found) + return; + +- kvfree_rcu_mightsleep(inst); ++ /* Do a full sync to ensure that tr remains valid, not just inst */ ++ synchronize_rcu(); ++ kvfree(inst); + } + + /*