From: Sasha Levin Date: Sat, 16 May 2026 17:01:49 +0000 (-0400) Subject: drop 3 patches based on RC review feedback X-Git-Tag: v6.6.140~1^2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=326313d5a2bc336022b7c9e641e68bec08bc100e;p=thirdparty%2Fkernel%2Fstable-queue.git drop 3 patches based on RC review feedback Dropped patches: - "sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation" Queues: 6.12, 6.18 Reason: build break — HK_TYPE_DOMAIN_BOOT is introduced by upstream commit 4fca0e550d50 ("sched/isolation: Save boot defined domain flags").. Report: https://lore.kernel.org/stable/508bf3b7-56c7-4290-b663-7daf8ed4e80d@googlemail.com/ - "vsock/virtio: fix potential unbounded skb queue" Queues: 6.6, 6.12, 6.18, 7.0 Reason: Michael S. Tsirkin (VIRTIO maintainer) raised that this fix trades the DoS for silently broken sockets; Stefano Garzarella has a v3/v4 follow-up in flight upstream. Drop from stable and wait for the proper upstream resolution. Report: https://lore.kernel.org/stable/20260515113503-mutt-send-email-mst@kernel.org/ - "media: mali-c55: Fix wrong comment of ISP block types" Queues: 7.0 Reason: comment-only fix. Report: https://lore.kernel.org/stable/agdO8lvv9vj9_1n8@zed/ Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch b/queue-6.12/sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch deleted file mode 100644 index 98a34d13a7..0000000000 --- a/queue-6.12/sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 6ae315d37924435516d697ea7dde0b799a5928e0 Mon Sep 17 00:00:00 2001 -From: Andrea Righi -Date: Wed, 13 May 2026 13:24:38 +0200 -Subject: sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation - -From: Andrea Righi - -commit 6ae315d37924435516d697ea7dde0b799a5928e0 upstream. - -scx_enable() refuses to attach a BPF scheduler when isolcpus=domain is -in effect by comparing housekeeping_cpumask(HK_TYPE_DOMAIN) against -cpu_possible_mask. - -Since commit 27c3a5967f05 ("sched/isolation: Convert housekeeping -cpumasks to rcu pointers"), HK_TYPE_DOMAIN's cpumask is RCU protected -and dereferencing it requires either RCU read lock, the cpu_hotplug -write lock, or the cpuset lock; scx_enable() holds none of these, so -booting with isolcpus=domain and attaching any BPF scheduler triggers -the following lockdep splat: - - ============================= - WARNING: suspicious RCU usage - ----------------------------- - kernel/sched/isolation.c:60 suspicious rcu_dereference_check() usage! - - 1 lock held by scx_flash/281: - #0: ffffffff8379fce0 (update_mutex){+.+.}-{4:4}, at: - bpf_struct_ops_link_create+0x134/0x1c0 - - Call Trace: - dump_stack_lvl+0x6f/0xb0 - lockdep_rcu_suspicious.cold+0x37/0x70 - housekeeping_cpumask+0xcd/0xe0 - scx_enable.isra.0+0x17/0x120 - bpf_scx_reg+0x5e/0x80 - bpf_struct_ops_link_create+0x151/0x1c0 - __sys_bpf+0x1e4b/0x33c0 - __x64_sys_bpf+0x21/0x30 - do_syscall_64+0x117/0xf80 - entry_SYSCALL_64_after_hwframe+0x77/0x7f - -In addition, commit 03ff73510169 ("cpuset: Update HK_TYPE_DOMAIN cpumask -from cpuset") made HK_TYPE_DOMAIN include cpuset isolated partitions as -well, which means the current check also rejects BPF schedulers when a -cpuset partition is active. That contradicts the original intent of -commit 9f391f94a173 ("sched_ext: Disallow loading BPF scheduler if -isolcpus= domain isolation is in effect"), which explicitly noted that -cpuset partitions are honored through per-task cpumasks and should not -be rejected. - -Switch to housekeeping_enabled(HK_TYPE_DOMAIN_BOOT), which reads only -the housekeeping flag bit (no RCU dereference) and reflects exactly the -boot-time isolcpus= configuration that the error message refers to. - -Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers") -Cc: stable@vger.kernel.org # v7.0+ -Signed-off-by: Andrea Righi -Signed-off-by: Tejun Heo -Acked-by: Frederic Weisbecker -Signed-off-by: Greg Kroah-Hartman ---- - kernel/sched/ext.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/kernel/sched/ext.c -+++ b/kernel/sched/ext.c -@@ -5521,8 +5521,7 @@ static int scx_ops_enable(struct sched_e - static DEFINE_MUTEX(helper_mutex); - struct scx_enable_cmd cmd; - -- if (!cpumask_equal(housekeeping_cpumask(HK_TYPE_DOMAIN), -- cpu_possible_mask)) { -+ if (housekeeping_enabled(HK_TYPE_DOMAIN_BOOT)) { - pr_err("sched_ext: Not compatible with \"isolcpus=\" domain isolation\n"); - return -EINVAL; - } diff --git a/queue-6.12/series b/queue-6.12/series index be104863d9..8f63432679 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -98,7 +98,6 @@ batman-adv-stop-caching-unowned-originator-pointers-in-bat-iv.patch batman-adv-bla-prevent-use-after-free-when-deleting-claims.patch batman-adv-bla-only-purge-non-released-claims.patch batman-adv-bla-put-backbone-reference-on-failed-claim-hash-insert.patch -sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch usb-typec-tcpm-reset-internal-port-states-on-soft-reset-ams.patch usb-dwc3-move-guid-programming-after-phy-initialization.patch alsa-hda-cs35l56-propagate-asp-tx-source-control-errors.patch @@ -138,7 +137,6 @@ batman-adv-tp_meter-fix-tp_num-leak-on-kmalloc-failure.patch vsock-fix-buffer-size-clamping-order.patch vsock-virtio-fix-length-and-offset-in-tap-skb-for-split-packets.patch vsock-virtio-fix-empty-payload-in-tap-skb-for-non-linear-buffers.patch -vsock-virtio-fix-potential-unbounded-skb-queue.patch vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch drm-amdgpu-vcn3-avoid-overflow-on-msg-bound-check.patch drm-amdgpu-vcn4-avoid-overflow-on-msg-bound-check.patch diff --git a/queue-6.12/vsock-virtio-fix-potential-unbounded-skb-queue.patch b/queue-6.12/vsock-virtio-fix-potential-unbounded-skb-queue.patch deleted file mode 100644 index 0b995be747..0000000000 --- a/queue-6.12/vsock-virtio-fix-potential-unbounded-skb-queue.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 059b7dbd20a6f0c539a45ddff1573cb8946685b5 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 30 Apr 2026 12:26:52 +0000 -Subject: vsock/virtio: fix potential unbounded skb queue -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Eric Dumazet - -commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 upstream. - -virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. - -virtio_transport_recv_enqueue() skips coalescing for packets -with VIRTIO_VSOCK_SEQ_EOM. - -If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, -a very large number of packets can be queued -because vvs->rx_bytes stays at 0. - -Fix this by estimating the skb metadata size: - - (Number of skbs in the queue) * SKB_TRUESIZE(0) - -Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") -Signed-off-by: Eric Dumazet -Cc: Arseniy Krasnov -Cc: Stefan Hajnoczi -Cc: Stefano Garzarella -Cc: "Michael S. Tsirkin" -Cc: Jason Wang -Cc: Xuan Zhuo -Cc: "Eugenio Pérez" -Cc: virtualization@lists.linux.dev -Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -Cc: Luigi Leonardi -Signed-off-by: Greg Kroah-Hartman ---- - net/vmw_vsock/virtio_transport_common.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -430,7 +430,9 @@ static int virtio_transport_send_pkt_inf - static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs, - u32 len) - { -- if (vvs->buf_used + len > vvs->buf_alloc) -+ u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0); -+ -+ if (skb_overhead + vvs->buf_used + len > vvs->buf_alloc) - return false; - - vvs->rx_bytes += len; diff --git a/queue-6.18/sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch b/queue-6.18/sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch deleted file mode 100644 index 299e28bd96..0000000000 --- a/queue-6.18/sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 6ae315d37924435516d697ea7dde0b799a5928e0 Mon Sep 17 00:00:00 2001 -From: Andrea Righi -Date: Wed, 13 May 2026 13:24:38 +0200 -Subject: sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation - -From: Andrea Righi - -commit 6ae315d37924435516d697ea7dde0b799a5928e0 upstream. - -scx_enable() refuses to attach a BPF scheduler when isolcpus=domain is -in effect by comparing housekeeping_cpumask(HK_TYPE_DOMAIN) against -cpu_possible_mask. - -Since commit 27c3a5967f05 ("sched/isolation: Convert housekeeping -cpumasks to rcu pointers"), HK_TYPE_DOMAIN's cpumask is RCU protected -and dereferencing it requires either RCU read lock, the cpu_hotplug -write lock, or the cpuset lock; scx_enable() holds none of these, so -booting with isolcpus=domain and attaching any BPF scheduler triggers -the following lockdep splat: - - ============================= - WARNING: suspicious RCU usage - ----------------------------- - kernel/sched/isolation.c:60 suspicious rcu_dereference_check() usage! - - 1 lock held by scx_flash/281: - #0: ffffffff8379fce0 (update_mutex){+.+.}-{4:4}, at: - bpf_struct_ops_link_create+0x134/0x1c0 - - Call Trace: - dump_stack_lvl+0x6f/0xb0 - lockdep_rcu_suspicious.cold+0x37/0x70 - housekeeping_cpumask+0xcd/0xe0 - scx_enable.isra.0+0x17/0x120 - bpf_scx_reg+0x5e/0x80 - bpf_struct_ops_link_create+0x151/0x1c0 - __sys_bpf+0x1e4b/0x33c0 - __x64_sys_bpf+0x21/0x30 - do_syscall_64+0x117/0xf80 - entry_SYSCALL_64_after_hwframe+0x77/0x7f - -In addition, commit 03ff73510169 ("cpuset: Update HK_TYPE_DOMAIN cpumask -from cpuset") made HK_TYPE_DOMAIN include cpuset isolated partitions as -well, which means the current check also rejects BPF schedulers when a -cpuset partition is active. That contradicts the original intent of -commit 9f391f94a173 ("sched_ext: Disallow loading BPF scheduler if -isolcpus= domain isolation is in effect"), which explicitly noted that -cpuset partitions are honored through per-task cpumasks and should not -be rejected. - -Switch to housekeeping_enabled(HK_TYPE_DOMAIN_BOOT), which reads only -the housekeeping flag bit (no RCU dereference) and reflects exactly the -boot-time isolcpus= configuration that the error message refers to. - -Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers") -Cc: stable@vger.kernel.org # v7.0+ -Signed-off-by: Andrea Righi -Signed-off-by: Tejun Heo -Acked-by: Frederic Weisbecker -Signed-off-by: Greg Kroah-Hartman ---- - kernel/sched/ext.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/kernel/sched/ext.c -+++ b/kernel/sched/ext.c -@@ -4906,8 +4906,7 @@ static int scx_enable(struct sched_ext_o - static DEFINE_MUTEX(helper_mutex); - struct scx_enable_cmd cmd; - -- if (!cpumask_equal(housekeeping_cpumask(HK_TYPE_DOMAIN), -- cpu_possible_mask)) { -+ if (housekeeping_enabled(HK_TYPE_DOMAIN_BOOT)) { - pr_err("sched_ext: Not compatible with \"isolcpus=\" domain isolation\n"); - return -EINVAL; - } diff --git a/queue-6.18/series b/queue-6.18/series index 59d08ea909..70c08c6efb 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -138,7 +138,6 @@ batman-adv-stop-caching-unowned-originator-pointers-in-bat-iv.patch batman-adv-bla-prevent-use-after-free-when-deleting-claims.patch batman-adv-bla-only-purge-non-released-claims.patch batman-adv-bla-put-backbone-reference-on-failed-claim-hash-insert.patch -sched_ext-use-hk_type_domain_boot-to-detect-isolcpus-domain-isolation.patch io_uring-zcrx-use-guards-for-locking.patch io_uring-zcrx-warn-on-freelist-violations.patch loongarch-kvm-compile-switch.s-directly-into-the-kernel.patch @@ -180,7 +179,6 @@ batman-adv-tp_meter-fix-tp_num-leak-on-kmalloc-failure.patch vsock-fix-buffer-size-clamping-order.patch vsock-virtio-fix-length-and-offset-in-tap-skb-for-split-packets.patch vsock-virtio-fix-empty-payload-in-tap-skb-for-non-linear-buffers.patch -vsock-virtio-fix-potential-unbounded-skb-queue.patch vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch drm-amdgpu-vcn3-avoid-overflow-on-msg-bound-check.patch drm-amdgpu-vcn4-avoid-overflow-on-msg-bound-check.patch diff --git a/queue-6.18/vsock-virtio-fix-potential-unbounded-skb-queue.patch b/queue-6.18/vsock-virtio-fix-potential-unbounded-skb-queue.patch deleted file mode 100644 index 148df2308f..0000000000 --- a/queue-6.18/vsock-virtio-fix-potential-unbounded-skb-queue.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 059b7dbd20a6f0c539a45ddff1573cb8946685b5 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 30 Apr 2026 12:26:52 +0000 -Subject: vsock/virtio: fix potential unbounded skb queue -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Eric Dumazet - -commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 upstream. - -virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. - -virtio_transport_recv_enqueue() skips coalescing for packets -with VIRTIO_VSOCK_SEQ_EOM. - -If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, -a very large number of packets can be queued -because vvs->rx_bytes stays at 0. - -Fix this by estimating the skb metadata size: - - (Number of skbs in the queue) * SKB_TRUESIZE(0) - -Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") -Signed-off-by: Eric Dumazet -Cc: Arseniy Krasnov -Cc: Stefan Hajnoczi -Cc: Stefano Garzarella -Cc: "Michael S. Tsirkin" -Cc: Jason Wang -Cc: Xuan Zhuo -Cc: "Eugenio Pérez" -Cc: virtualization@lists.linux.dev -Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -Cc: Luigi Leonardi -Signed-off-by: Greg Kroah-Hartman ---- - net/vmw_vsock/virtio_transport_common.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -429,7 +429,9 @@ static int virtio_transport_send_pkt_inf - static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs, - u32 len) - { -- if (vvs->buf_used + len > vvs->buf_alloc) -+ u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0); -+ -+ if (skb_overhead + vvs->buf_used + len > vvs->buf_alloc) - return false; - - vvs->rx_bytes += len; diff --git a/queue-6.6/series b/queue-6.6/series index 838d23c808..e6f2ed981c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -464,7 +464,6 @@ kvm-arm64-wake-up-from-wfi-when-iqrchip-is-in-userspace.patch vsock-fix-buffer-size-clamping-order.patch vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch vsock-virtio-fix-length-and-offset-in-tap-skb-for-split-packets.patch -vsock-virtio-fix-potential-unbounded-skb-queue.patch drm-amdgpu-vcn3-avoid-overflow-on-msg-bound-check.patch drm-amdgpu-vcn4-avoid-overflow-on-msg-bound-check.patch mtd-spi-nor-sst-fix-sst-write-failure.patch diff --git a/queue-6.6/vsock-virtio-fix-potential-unbounded-skb-queue.patch b/queue-6.6/vsock-virtio-fix-potential-unbounded-skb-queue.patch deleted file mode 100644 index 531a253b8c..0000000000 --- a/queue-6.6/vsock-virtio-fix-potential-unbounded-skb-queue.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 059b7dbd20a6f0c539a45ddff1573cb8946685b5 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 30 Apr 2026 12:26:52 +0000 -Subject: vsock/virtio: fix potential unbounded skb queue -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Eric Dumazet - -commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 upstream. - -virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. - -virtio_transport_recv_enqueue() skips coalescing for packets -with VIRTIO_VSOCK_SEQ_EOM. - -If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, -a very large number of packets can be queued -because vvs->rx_bytes stays at 0. - -Fix this by estimating the skb metadata size: - - (Number of skbs in the queue) * SKB_TRUESIZE(0) - -Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") -Signed-off-by: Eric Dumazet -Cc: Arseniy Krasnov -Cc: Stefan Hajnoczi -Cc: Stefano Garzarella -Cc: "Michael S. Tsirkin" -Cc: Jason Wang -Cc: Xuan Zhuo -Cc: "Eugenio Pérez" -Cc: virtualization@lists.linux.dev -Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -[LL: Fixed conflict since this tree does not use buf_used added by commit - 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")] -Signed-off-by: Luigi Leonardi -Signed-off-by: Greg Kroah-Hartman ---- - net/vmw_vsock/virtio_transport_common.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -283,7 +283,9 @@ static int virtio_transport_send_pkt_inf - static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs, - u32 len) - { -- if (vvs->rx_bytes + len > vvs->buf_alloc) -+ u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0); -+ -+ if (skb_overhead + vvs->rx_bytes + len > vvs->buf_alloc) - return false; - - vvs->rx_bytes += len; diff --git a/queue-7.0/media-mali-c55-fix-wrong-comment-of-isp-block-types.patch b/queue-7.0/media-mali-c55-fix-wrong-comment-of-isp-block-types.patch deleted file mode 100644 index e0f35e3b48..0000000000 --- a/queue-7.0/media-mali-c55-fix-wrong-comment-of-isp-block-types.patch +++ /dev/null @@ -1,50 +0,0 @@ -From df16624248296ce4e8890c7ddcc95f0ccb642bcd Mon Sep 17 00:00:00 2001 -From: Jacopo Mondi -Date: Mon, 19 Jan 2026 11:00:23 +0100 -Subject: media: mali-c55: Fix wrong comment of ISP block types -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Jacopo Mondi - -commit df16624248296ce4e8890c7ddcc95f0ccb642bcd upstream. - -Some bad copy&paste happened in the description of the ISP block types -and AWB_CONFIG got mixed up with SHADING_CONFIG. - -Fix it by assigning to each block the correct type. - -As only the comment is changed, there is no uABI breakage or regression. - -Cc: stable@vger.kernel.org -Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") -Reviewed-by: Daniel Scally -Reviewed-by: Barnabás Pőcze -Signed-off-by: Jacopo Mondi -Signed-off-by: Hans Verkuil -Signed-off-by: Greg Kroah-Hartman ---- - drivers/media/platform/arm/mali-c55/mali-c55-params.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c -index be0e909bcf29..c03a6120ddbf 100644 ---- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c -+++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c -@@ -43,9 +43,9 @@ - * @digital_gain: For header->type == MALI_C55_PARAM_BLOCK_DIGITAL_GAIN - * @awb_gains: For header->type == MALI_C55_PARAM_BLOCK_AWB_GAINS and - * header->type = MALI_C55_PARAM_BLOCK_AWB_GAINS_AEXP -- * @awb_config: For header->type == MALI_C55_PARAM_MESH_SHADING_CONFIG -- * @shading_config: For header->type == MALI_C55_PARAM_MESH_SHADING_SELECTION -- * @shading_selection: For header->type == MALI_C55_PARAM_BLOCK_SENSOR_OFFS -+ * @awb_config: For header->type == MALI_C55_PARAM_BLOCK_AWB_CONFIG -+ * @shading_config: For header->type == MALI_C55_PARAM_MESH_SHADING_CONFIG -+ * @shading_selection: For header->type == MALI_C55_PARAM_MESH_SHADING_SELECTION - * @data: Allows easy initialisation of a union variable with a - * pointer into a __u8 array. - */ --- -2.54.0 - diff --git a/queue-7.0/series b/queue-7.0/series index 92eb38eb61..62b3c72383 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -11,7 +11,6 @@ media-rzv2h-ivc-fix-fm_stop-register-write.patch media-rzv2h-ivc-fix-concurrent-buffer-list-access.patch media-mali-c55-initialize-the-isp-in-enable_streams.patch media-mali-c55-fix-iridix-bypass-macros.patch -media-mali-c55-fix-wrong-comment-of-isp-block-types.patch media-renesas-vsp1-fix-null-pointer-deref-on-module-unload.patch media-renesas-vin-fix-raw8-again.patch media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch @@ -193,7 +192,6 @@ mm-vma-do-not-try-to-unmap-a-vma-if-mmap_prepare-invoked-from-mmap.patch vsock-fix-buffer-size-clamping-order.patch vsock-virtio-fix-length-and-offset-in-tap-skb-for-split-packets.patch vsock-virtio-fix-empty-payload-in-tap-skb-for-non-linear-buffers.patch -vsock-virtio-fix-potential-unbounded-skb-queue.patch vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch drm-amdgpu-vcn3-avoid-overflow-on-msg-bound-check.patch drm-amdgpu-vcn4-avoid-overflow-on-msg-bound-check.patch diff --git a/queue-7.0/vsock-virtio-fix-potential-unbounded-skb-queue.patch b/queue-7.0/vsock-virtio-fix-potential-unbounded-skb-queue.patch deleted file mode 100644 index 148df2308f..0000000000 --- a/queue-7.0/vsock-virtio-fix-potential-unbounded-skb-queue.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 059b7dbd20a6f0c539a45ddff1573cb8946685b5 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 30 Apr 2026 12:26:52 +0000 -Subject: vsock/virtio: fix potential unbounded skb queue -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Eric Dumazet - -commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 upstream. - -virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. - -virtio_transport_recv_enqueue() skips coalescing for packets -with VIRTIO_VSOCK_SEQ_EOM. - -If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, -a very large number of packets can be queued -because vvs->rx_bytes stays at 0. - -Fix this by estimating the skb metadata size: - - (Number of skbs in the queue) * SKB_TRUESIZE(0) - -Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") -Signed-off-by: Eric Dumazet -Cc: Arseniy Krasnov -Cc: Stefan Hajnoczi -Cc: Stefano Garzarella -Cc: "Michael S. Tsirkin" -Cc: Jason Wang -Cc: Xuan Zhuo -Cc: "Eugenio Pérez" -Cc: virtualization@lists.linux.dev -Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -Cc: Luigi Leonardi -Signed-off-by: Greg Kroah-Hartman ---- - net/vmw_vsock/virtio_transport_common.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/vmw_vsock/virtio_transport_common.c -+++ b/net/vmw_vsock/virtio_transport_common.c -@@ -429,7 +429,9 @@ static int virtio_transport_send_pkt_inf - static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs, - u32 len) - { -- if (vvs->buf_used + len > vvs->buf_alloc) -+ u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0); -+ -+ if (skb_overhead + vvs->buf_used + len > vvs->buf_alloc) - return false; - - vvs->rx_bytes += len;