From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:42:06 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=ea3354b4125657006fb3a3d08aec228e3dfd4d1a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch bluetooth-l2cap-fix-tx-ident-leak-for-commands-without-a-response.patch crypto-ccp-always-pass-in-an-error-pointer-to-__sev_platform_shutdown_locked.patch crypto-ccp-fix-__sev_snp_shutdown_locked.patch crypto-ccp-fix-dereferencing-uninitialized-error-pointer.patch crypto-ccp-fix-leaking-the-same-page-twice.patch crypto-ccp-fix-snp-panic-notifier-unregistration.patch dpll-fix-null-pointer-dereference-in-dpll_msg_add_pin_ref_sync.patch i40e-drop-udp_tunnel_get_rx_info-call-from-i40e_open.patch ice-drop-udp_tunnel_get_rx_info-call-from-ndo_open.patch jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch net-airoha-fix-channel-configuration-for-ets-qdisc.patch perf-arm-spe-use-old-behavior-when-opening-old-spe-files.patch perf-build-id-ensure-snprintf-string-is-empty-when-size-is-0.patch perf-build-id-fix-off-by-one-bug-when-printing-kernel-module-build-id.patch perf-callchain-handle-multiple-address-spaces.patch perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch perf-libunwind-arm64-fix-missing-close-parens-in-an-if-statement.patch perf-synthetic-events-fix-stale-build-id-in-module-mmap2-records.patch rtnetlink-make-per-netns-rtnl-dereference-helpers-to-macro.patch seqlock-fix-scoped_seqlock_read-kernel-doc.patch udp_tunnel-fix-deadlock-in-udp_tunnel_nic_set_port_priv.patch --- diff --git a/queue-6.12/afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch b/queue-6.12/afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch new file mode 100644 index 0000000000..185493d721 --- /dev/null +++ b/queue-6.12/afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch @@ -0,0 +1,48 @@ +From 0307d16f3610eb29ad0b7529846de7d62fed60ca Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 18 Mar 2025 11:20:19 +0000 +Subject: afs: Fix afs_atcell_get_link() to check if ws_cell is unset first + +From: David Howells + +commit 0307d16f3610eb29ad0b7529846de7d62fed60ca upstream. + +Fix afs_atcell_get_link() to check if the workstation cell is unset before +doing the RCU pathwalk bit where we dereference that. + +Fixes: 823869e1e616 ("afs: Fix afs_atcell_get_link() to handle RCU pathwalk") +Reported-by: syzbot+76a6f18e3af82e84f264@syzkaller.appspotmail.com +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/2481796.1742296819@warthog.procyon.org.uk +Tested-by: syzbot+76a6f18e3af82e84f264@syzkaller.appspotmail.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/dynroot.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -209,6 +209,9 @@ static const char *afs_atcell_get_link(s + const char *name; + bool dotted = vnode->fid.vnode == 3; + ++ if (!rcu_access_pointer(net->ws_cell)) ++ return ERR_PTR(-ENOENT); ++ + if (!dentry) { + /* We're in RCU-pathwalk. */ + cell = rcu_dereference(net->ws_cell); +@@ -220,9 +223,6 @@ static const char *afs_atcell_get_link(s + return name; + } + +- if (!rcu_access_pointer(net->ws_cell)) +- return ERR_PTR(-ENOENT); +- + down_read(&net->cells_lock); + + cell = rcu_dereference_protected(net->ws_cell, lockdep_is_held(&net->cells_lock)); diff --git a/queue-6.12/afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch b/queue-6.12/afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch new file mode 100644 index 0000000000..8c97bcf99f --- /dev/null +++ b/queue-6.12/afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch @@ -0,0 +1,49 @@ +From a64e4d48a0b77e4ada19ac26ca3a08cd492f6362 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 8 Apr 2025 21:46:29 +0100 +Subject: afs: Fix afs_dynroot_readdir() to not use the RCU read lock + +From: David Howells + +commit a64e4d48a0b77e4ada19ac26ca3a08cd492f6362 upstream. + +afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst +emitting cell automount entries - but dir_emit() may write to a userspace +buffer, thereby causing a fault to occur and waits to happen. + +Fix afs_dynroot_readdir() to get a shared lock on net->cells_lock instead. + +This can be triggered by enabling lockdep, preconfiguring a number of +cells, doing "mount -t afs none /afs -o dyn" (or using the kafs-client +package with afs.mount systemd unit enabled) and then doing "ls /afs". + +Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand") +Reported-by: syzbot+3b6c5c6a1d0119b687a1@syzkaller.appspotmail.com +Reported-by: syzbot+8245611446194a52150d@syzkaller.appspotmail.com +Reported-by: syzbot+1aa62e6852a6ad1c7944@syzkaller.appspotmail.com +Reported-by: syzbot+54e6c2176ba76c56217e@syzkaller.appspotmail.com +Signed-off-by: David Howells +Link: https://lore.kernel.org/1638014.1744145189@warthog.procyon.org.uk +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/dynroot.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -347,9 +347,9 @@ static int afs_dynroot_readdir(struct fi + } + + if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) { +- rcu_read_lock(); ++ down_read(&net->cells_lock); + ret = afs_dynroot_readdir_cells(net, ctx); +- rcu_read_unlock(); ++ up_read(&net->cells_lock); + } + return ret; + } diff --git a/queue-6.12/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch b/queue-6.12/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch new file mode 100644 index 0000000000..2e5806b24b --- /dev/null +++ b/queue-6.12/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch @@ -0,0 +1,62 @@ +From d38eaf611839b85ade3dd3db309dbc8aaaaf0095 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Fri, 12 Jun 2026 10:21:09 -0400 +Subject: Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev + +From: Luiz Augusto von Dentz + +commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 upstream. + +b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding +conn ref") don't reset the chan->conn to NULL anymore making the bt# +netdev not be remove once the last l2cap_chan_del is removed. + +Instead of restoring the original behavior this remove the logic of +keeping the interface after the last channel is removed because it +never worked as intended and the l2cap_chan_del always detach its +l2cap_conn which results in always removing the channel anyway. + +Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/6lowpan.c | 18 +++--------------- + 1 file changed, 3 insertions(+), 15 deletions(-) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -781,20 +781,10 @@ static void chan_close_cb(struct l2cap_c + struct lowpan_btle_dev *dev = NULL; + struct lowpan_peer *peer; + int err = -ENOENT; +- bool last = false, remove = true; ++ bool last = false; + + BT_DBG("chan %p conn %p", chan, chan->conn); + +- if (chan->conn && chan->conn->hcon) { +- if (!is_bt_6lowpan(chan->conn->hcon)) +- return; +- +- /* If conn is set, then the netdev is also there and we should +- * not remove it. +- */ +- remove = false; +- } +- + spin_lock(&devices_lock); + + list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { +@@ -821,10 +811,8 @@ static void chan_close_cb(struct l2cap_c + + ifdown(dev->netdev); + +- if (remove) { +- INIT_WORK(&entry->delete_netdev, delete_netdev); +- schedule_work(&entry->delete_netdev); +- } ++ INIT_WORK(&entry->delete_netdev, delete_netdev); ++ schedule_work(&entry->delete_netdev); + } else { + spin_unlock(&devices_lock); + } diff --git a/queue-6.12/bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch b/queue-6.12/bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch new file mode 100644 index 0000000000..a9427df41b --- /dev/null +++ b/queue-6.12/bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch @@ -0,0 +1,31 @@ +From 59710a26a289ad4e7ef227d22063e964930928b0 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Mon, 30 Jun 2025 15:37:46 -0400 +Subject: Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state + +From: Luiz Augusto von Dentz + +commit 59710a26a289ad4e7ef227d22063e964930928b0 upstream. + +The check for destination to be BDADDR_ANY is no longer necessary with +the introduction of BIS_LINK. + +Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + include/net/bluetooth/hci_core.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1367,8 +1367,7 @@ hci_conn_hash_lookup_big_state(struct hc + rcu_read_lock(); + + list_for_each_entry_rcu(c, &h->list, list) { +- if (c->type != BIS_LINK || bacmp(&c->dst, BDADDR_ANY) || +- c->state != state) ++ if (c->type != BIS_LINK || c->state != state) + continue; + + if (handle == c->iso_qos.bcast.big) { diff --git a/queue-6.12/bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch b/queue-6.12/bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch new file mode 100644 index 0000000000..9c66979c3e --- /dev/null +++ b/queue-6.12/bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch @@ -0,0 +1,30 @@ +From 314d30b1508682e27c8a324096262c66f23455d9 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Thu, 3 Jul 2025 09:45:08 -0400 +Subject: Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle + +From: Luiz Augusto von Dentz + +commit 314d30b1508682e27c8a324096262c66f23455d9 upstream. + +BIS/PA connections do have their own cleanup proceedure which are +performed by hci_conn_cleanup/bis_cleanup. + +Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_sync.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -5543,7 +5543,7 @@ static int hci_disconnect_sync(struct hc + { + struct hci_cp_disconnect cp; + +- if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) { ++ if (conn->type == BIS_LINK) { + /* This is a BIS connection, hci_conn_del will + * do the necessary cleanup. + */ diff --git a/queue-6.12/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch b/queue-6.12/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch new file mode 100644 index 0000000000..58a14c7355 --- /dev/null +++ b/queue-6.12/bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch @@ -0,0 +1,81 @@ +From 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Tue, 17 Mar 2026 11:54:01 -0400 +Subject: Bluetooth: L2CAP: Fix regressions caused by reusing ident + +From: Luiz Augusto von Dentz + +commit 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 upstream. + +This attempt to fix regressions caused by reusing ident which apparently +is not handled well on certain stacks causing the stack to not respond to +requests, so instead of simple returning the first unallocated id this +stores the last used tx_ident and then attempt to use the next until all +available ids are exausted and then cycle starting over to 1. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177 +Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident") +Signed-off-by: Luiz Augusto von Dentz +Tested-by: Christian Eggers +Signed-off-by: Greg Kroah-Hartman +--- + include/net/bluetooth/l2cap.h | 1 + + net/bluetooth/l2cap_core.c | 29 ++++++++++++++++++++++++++--- + 2 files changed, 27 insertions(+), 3 deletions(-) + +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -660,6 +660,7 @@ struct l2cap_conn { + struct sk_buff *rx_skb; + __u32 rx_len; + struct ida tx_ida; ++ __u8 tx_ident; + + struct sk_buff_head pending_rx; + struct work_struct pending_rx_work; +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -958,16 +958,39 @@ int l2cap_chan_check_security(struct l2c + + static int l2cap_get_ident(struct l2cap_conn *conn) + { ++ u8 max; ++ int ident; ++ + /* LE link does not support tools like l2ping so use the full range */ + if (conn->hcon->type == LE_LINK) +- return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC); +- ++ max = 255; + /* Get next available identificator. + * 1 - 128 are used by kernel. + * 129 - 199 are reserved. + * 200 - 254 are used by utilities like l2ping, etc. + */ +- return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC); ++ else ++ max = 128; ++ ++ /* Allocate ident using min as last used + 1 (cyclic) */ ++ ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1, ++ max, GFP_ATOMIC); ++ /* Force min 1 to start over */ ++ if (ident <= 0) { ++ ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC); ++ if (ident <= 0) { ++ /* If all idents are in use, log an error, this is ++ * extremely unlikely to happen and would indicate a bug ++ * in the code that idents are not being freed properly. ++ */ ++ BT_ERR("Unable to allocate ident: %d", ident); ++ return 0; ++ } ++ } ++ ++ WRITE_ONCE(conn->tx_ident, ident); ++ ++ return ident; + } + + static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb, diff --git a/queue-6.12/bluetooth-l2cap-fix-tx-ident-leak-for-commands-without-a-response.patch b/queue-6.12/bluetooth-l2cap-fix-tx-ident-leak-for-commands-without-a-response.patch new file mode 100644 index 0000000000..891365fd5e --- /dev/null +++ b/queue-6.12/bluetooth-l2cap-fix-tx-ident-leak-for-commands-without-a-response.patch @@ -0,0 +1,93 @@ +From 6e1930ece855a4c256f1c7e6632d634cfb9888b5 Mon Sep 17 00:00:00 2001 +From: Stig Hornang +Date: Fri, 12 Jun 2026 16:38:18 +0200 +Subject: Bluetooth: L2CAP: fix tx ident leak for commands without a response + +From: Stig Hornang + +commit 6e1930ece855a4c256f1c7e6632d634cfb9888b5 upstream. + +Commit 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding +TX ident") changed ident allocation to use an IDA, releasing idents in +l2cap_put_ident() when the matching response command is received. + +But identifiers allocated for commands that have no response defined +are never released. In particular L2CAP_LE_CREDITS is sent repeatedly for +the lifetime of an LE CoC channel, so a peer streaming data to the +host exhausts the 1-255 ident range after 254 credit packets. From +then on l2cap_get_ident() fails: + + kernel: Bluetooth: Unable to allocate ident: -28 + +and every subsequent L2CAP_LE_CREDITS packet is sent with ident 0, +which is invalid (Core Spec, Vol 3, Part A, Section 4: "Signaling +identifier 0x00 is an invalid identifier and shall never be used in +any command"). Remote stacks that validate the ident drop these +commands, never receive new credits, and the channel stalls +permanently. With default socket buffers this happens after roughly 0.5 MB +of received data (the exact amount depends on the socket receive buffer): + + < ACL Data TX: Handle 2048 flags 0x00 dlen 12 + LE L2CAP: LE Flow Control Credit (0x16) ident 0 len 4 + Source CID: 64 + Credits: 1 + +Release the ident immediately after sending L2CAP_LE_CREDITS since no +response will ever release it. Use a local variable instead of +chan->ident so that an ident that an EXT_FLOWCTL channel may be waiting on +(e.g. a pending reconfigure) is not overwritten by a credit packet. + +Also add the missing L2CAP_LE_CONN_RSP case to l2cap_put_ident() so +idents allocated for outgoing L2CAP_LE_CONN_REQ commands are released +when the response arrives. + +Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=221629 +Assisted-by: Claude:claude-opus-4.8 +Assisted-by: Fable:5 +Signed-off-by: Stig Hornang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/l2cap_core.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4857,6 +4857,7 @@ static void l2cap_put_ident(struct l2cap + case L2CAP_ECHO_RSP: + case L2CAP_INFO_RSP: + case L2CAP_CONN_PARAM_UPDATE_RSP: ++ case L2CAP_LE_CONN_RSP: + case L2CAP_ECRED_CONN_RSP: + case L2CAP_ECRED_RECONF_RSP: + /* The remote may send bogus ids that would make ida_free +@@ -6755,6 +6756,7 @@ static void l2cap_chan_le_send_credits(s + struct l2cap_conn *conn = chan->conn; + struct l2cap_le_credits pkt; + u16 return_credits = l2cap_le_rx_credits(chan); ++ int ident; + + if (chan->mode != L2CAP_MODE_LE_FLOWCTL && + chan->mode != L2CAP_MODE_EXT_FLOWCTL) +@@ -6772,9 +6774,18 @@ static void l2cap_chan_le_send_credits(s + pkt.cid = cpu_to_le16(chan->scid); + pkt.credits = cpu_to_le16(return_credits); + +- chan->ident = l2cap_get_ident(conn); ++ ident = l2cap_get_ident(conn); ++ ++ l2cap_send_cmd(conn, ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); + +- l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); ++ /* L2CAP_LE_CREDITS has no response so the ident is never released by ++ * l2cap_put_ident() - release it right away, otherwise the tx_ida ++ * range is exhausted after 254 packets and from then on credits are ++ * sent with the invalid ident 0, which some remote stacks ignore, ++ * stalling the channel. ++ */ ++ if (ident > 0) ++ ida_free(&conn->tx_ida, ident); + } + + void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail) diff --git a/queue-6.12/crypto-ccp-always-pass-in-an-error-pointer-to-__sev_platform_shutdown_locked.patch b/queue-6.12/crypto-ccp-always-pass-in-an-error-pointer-to-__sev_platform_shutdown_locked.patch new file mode 100644 index 0000000000..069fa69099 --- /dev/null +++ b/queue-6.12/crypto-ccp-always-pass-in-an-error-pointer-to-__sev_platform_shutdown_locked.patch @@ -0,0 +1,97 @@ +From 46834d90a9a13549264b9581067d8f746b4b36cc Mon Sep 17 00:00:00 2001 +From: "Borislav Petkov (AMD)" +Date: Sat, 6 Sep 2025 14:21:45 +0200 +Subject: crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() + +From: Borislav Petkov (AMD) + +commit 46834d90a9a13549264b9581067d8f746b4b36cc upstream. + +When + + 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown") + +moved the error messages dumping so that they don't need to be issued by +the callers, it missed the case where __sev_firmware_shutdown() calls +__sev_platform_shutdown_locked() with a NULL argument which leads to +a NULL ptr deref on the shutdown path, during suspend to disk: + + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: Oops: 0000 [#1] SMP NOPTI + CPU: 0 UID: 0 PID: 983 Comm: hib.sh Not tainted 6.17.0-rc4+ #1 PREEMPT(voluntary) + Hardware name: Supermicro Super Server/H12SSL-i, BIOS 2.5 09/08/2022 + RIP: 0010:__sev_platform_shutdown_locked.cold+0x0/0x21 [ccp] + +That rIP is: + + 00000000000006fd <__sev_platform_shutdown_locked.cold>: + 6fd: 8b 13 mov (%rbx),%edx + 6ff: 48 8b 7d 00 mov 0x0(%rbp),%rdi + 703: 89 c1 mov %eax,%ecx + + Code: 74 05 31 ff 41 89 3f 49 8b 3e 89 ea 48 c7 c6 a0 8e 54 a0 41 bf 92 ff ff ff e8 e5 2e 09 e1 c6 05 2a d4 38 00 01 e9 26 af ff ff <8b> 13 48 8b 7d 00 89 c1 48 c7 c6 18 90 54 a0 89 44 24 04 e8 c1 2e + RSP: 0018:ffffc90005467d00 EFLAGS: 00010282 + RAX: 00000000ffffff92 RBX: 0000000000000000 RCX: 0000000000000000 + ^^^^^^^^^^^^^^^^ +and %rbx is nice and clean. + + Call Trace: + + __sev_firmware_shutdown.isra.0 + sev_dev_destroy + psp_dev_destroy + sp_destroy + pci_device_shutdown + device_shutdown + kernel_power_off + hibernate.cold + state_store + kernfs_fop_write_iter + vfs_write + ksys_write + do_syscall_64 + entry_SYSCALL_64_after_hwframe + +Pass in a pointer to the function-local error var in the caller. + +With that addressed, suspending the ccp shows the error properly at +least: + + ccp 0000:47:00.1: sev command 0x2 timed out, disabling PSP + ccp 0000:47:00.1: SEV: failed to SHUTDOWN error 0x0, rc -110 + SEV-SNP: Leaking PFN range 0x146800-0x146a00 + SEV-SNP: PFN 0x146800 unassigned, dumping non-zero entries in 2M PFN region: [0x146800 - 0x146a00] + ... + ccp 0000:47:00.1: SEV-SNP firmware shutdown failed, rc -16, error 0x0 + ACPI: PM: Preparing to enter system sleep state S5 + kvm: exiting hardware virtualization + reboot: Power down + +Btw, this driver is crying to be cleaned up to pass in a proper I/O +struct which can be used to store information between the different +functions, otherwise stuff like that will happen in the future again. + +Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown") +Signed-off-by: Borislav Petkov (AMD) +Cc: +Reviewed-by: Ashish Kalra +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/ccp/sev-dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -2408,7 +2408,7 @@ static void __sev_firmware_shutdown(stru + { + int error; + +- __sev_platform_shutdown_locked(NULL); ++ __sev_platform_shutdown_locked(&error); + + if (sev_es_tmr) { + /* diff --git a/queue-6.12/crypto-ccp-fix-__sev_snp_shutdown_locked.patch b/queue-6.12/crypto-ccp-fix-__sev_snp_shutdown_locked.patch new file mode 100644 index 0000000000..84e280685a --- /dev/null +++ b/queue-6.12/crypto-ccp-fix-__sev_snp_shutdown_locked.patch @@ -0,0 +1,35 @@ +From 9af6339a65426b0b4850b07ff3b6959497bfcac5 Mon Sep 17 00:00:00 2001 +From: Ashish Kalra +Date: Wed, 9 Apr 2025 19:34:29 +0000 +Subject: crypto: ccp - Fix __sev_snp_shutdown_locked + +From: Ashish Kalra + +commit 9af6339a65426b0b4850b07ff3b6959497bfcac5 upstream. + +Fix smatch warning: + drivers/crypto/ccp/sev-dev.c:1755 __sev_snp_shutdown_locked() + error: uninitialized symbol 'dfflush_error'. + +Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-crypto/d9c2e79c-e26e-47b7-8243-ff6e7b101ec3@stanley.mountain/ +Signed-off-by: Ashish Kalra +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/ccp/sev-dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -1743,7 +1743,7 @@ static int __sev_snp_shutdown_locked(int + ret = __sev_do_cmd_locked(SEV_CMD_SNP_SHUTDOWN_EX, &data, error); + /* SHUTDOWN may require DF_FLUSH */ + if (*error == SEV_RET_DFFLUSH_REQUIRED) { +- int dfflush_error; ++ int dfflush_error = SEV_RET_NO_FW_CALL; + + ret = __sev_do_cmd_locked(SEV_CMD_SNP_DF_FLUSH, NULL, &dfflush_error); + if (ret) { diff --git a/queue-6.12/crypto-ccp-fix-dereferencing-uninitialized-error-pointer.patch b/queue-6.12/crypto-ccp-fix-dereferencing-uninitialized-error-pointer.patch new file mode 100644 index 0000000000..245c4185a5 --- /dev/null +++ b/queue-6.12/crypto-ccp-fix-dereferencing-uninitialized-error-pointer.patch @@ -0,0 +1,52 @@ +From 0fa766726c091ff0ec7d26874f6e4724d23ecb0e Mon Sep 17 00:00:00 2001 +From: Ashish Kalra +Date: Wed, 28 May 2025 20:20:18 +0000 +Subject: crypto: ccp - Fix dereferencing uninitialized error pointer + +From: Ashish Kalra + +commit 0fa766726c091ff0ec7d26874f6e4724d23ecb0e upstream. + +Fix below smatch warnings: +drivers/crypto/ccp/sev-dev.c:1312 __sev_platform_init_locked() +error: we previously assumed 'error' could be null + +Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202505071746.eWOx5QgC-lkp@intel.com/ +Signed-off-by: Ashish Kalra +Reviewed-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/ccp/sev-dev.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -1271,9 +1271,11 @@ static int __sev_platform_init_handle_in + + static int __sev_platform_init_locked(int *error) + { +- int rc, psp_ret = SEV_RET_NO_FW_CALL; ++ int rc, psp_ret, dfflush_error; + struct sev_device *sev; + ++ psp_ret = dfflush_error = SEV_RET_NO_FW_CALL; ++ + if (!psp_master || !psp_master->sev_data) + return -ENODEV; + +@@ -1315,10 +1317,10 @@ static int __sev_platform_init_locked(in + + /* Prepare for first SEV guest launch after INIT */ + wbinvd_on_all_cpus(); +- rc = __sev_do_cmd_locked(SEV_CMD_DF_FLUSH, NULL, error); ++ rc = __sev_do_cmd_locked(SEV_CMD_DF_FLUSH, NULL, &dfflush_error); + if (rc) { + dev_err(sev->dev, "SEV: DF_FLUSH failed %#x, rc %d\n", +- *error, rc); ++ dfflush_error, rc); + return rc; + } + diff --git a/queue-6.12/crypto-ccp-fix-leaking-the-same-page-twice.patch b/queue-6.12/crypto-ccp-fix-leaking-the-same-page-twice.patch new file mode 100644 index 0000000000..ac475d833f --- /dev/null +++ b/queue-6.12/crypto-ccp-fix-leaking-the-same-page-twice.patch @@ -0,0 +1,51 @@ +From 5c52607c43c397b79a9852ce33fc61de58c3645c Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Wed, 4 Mar 2026 12:39:34 -0800 +Subject: crypto: ccp - Fix leaking the same page twice + +From: Guenter Roeck + +commit 5c52607c43c397b79a9852ce33fc61de58c3645c upstream. + +Commit 551120148b67 ("crypto: ccp - Fix a case where SNP_SHUTDOWN is +missed") fixed a case where SNP is left in INIT state if page reclaim +fails. It removes the transition to the INIT state for this command and +adjusts the page state management. + +While doing this, it added a call to snp_leak_pages() after a call to +snp_reclaim_pages() failed. Since snp_reclaim_pages() already calls +snp_leak_pages() internally on the pages it fails to reclaim, calling +it again leaks the exact same page twice. + +Fix by removing the extra call to snp_leak_pages(). + +The problem was found by an experimental code review agent based on +gemini-3.1-pro while reviewing backports into v6.18.y. + +Assisted-by: Gemini:gemini-3.1-pro +Fixes: 551120148b67 ("crypto: ccp - Fix a case where SNP_SHUTDOWN is missed") +Cc: Tycho Andersen (AMD) +Cc: Tom Lendacky +Signed-off-by: Guenter Roeck +Reviewed-by: Tom Lendacky +Reviewed-by: Tycho Andersen (AMD) +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/ccp/sev-dev.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -2102,10 +2102,8 @@ static int sev_ioctl_do_snp_platform_sta + * in Firmware state on failure. Use snp_reclaim_pages() to + * transition either case back to Hypervisor-owned state. + */ +- if (snp_reclaim_pages(__pa(data), 1, true)) { +- snp_leak_pages(__page_to_pfn(status_page), 1); ++ if (snp_reclaim_pages(__pa(data), 1, true)) + return -EFAULT; +- } + } + + if (ret) diff --git a/queue-6.12/crypto-ccp-fix-snp-panic-notifier-unregistration.patch b/queue-6.12/crypto-ccp-fix-snp-panic-notifier-unregistration.patch new file mode 100644 index 0000000000..223cd6bdf8 --- /dev/null +++ b/queue-6.12/crypto-ccp-fix-snp-panic-notifier-unregistration.patch @@ -0,0 +1,52 @@ +From ab8b9fd39c45b7760093528cbef93e7353359d82 Mon Sep 17 00:00:00 2001 +From: Ashish Kalra +Date: Mon, 16 Jun 2025 21:50:27 +0000 +Subject: crypto: ccp - Fix SNP panic notifier unregistration + +From: Ashish Kalra + +commit ab8b9fd39c45b7760093528cbef93e7353359d82 upstream. + +Panic notifiers are invoked with RCU read lock held and when the +SNP panic notifier tries to unregister itself from the panic +notifier callback itself it causes a deadlock as notifier +unregistration does RCU synchronization. + +Code flow for SNP panic notifier: +snp_shutdown_on_panic() -> +__sev_firmware_shutdown() -> +__sev_snp_shutdown_locked() -> +atomic_notifier_chain_unregister(.., &snp_panic_notifier) + +Fix SNP panic notifier to unregister itself during SNP shutdown +only if panic is not in progress. + +Reviewed-by: Tom Lendacky +Cc: stable@vger.kernel.org +Fixes: 19860c3274fb ("crypto: ccp - Register SNP panic notifier only if SNP is enabled") +Signed-off-by: Ashish Kalra +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/ccp/sev-dev.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -1785,8 +1785,14 @@ static int __sev_snp_shutdown_locked(int + sev->snp_initialized = false; + dev_dbg(sev->dev, "SEV-SNP firmware shutdown\n"); + +- atomic_notifier_chain_unregister(&panic_notifier_list, +- &snp_panic_notifier); ++ /* ++ * __sev_snp_shutdown_locked() deadlocks when it tries to unregister ++ * itself during panic as the panic notifier is called with RCU read ++ * lock held and notifier unregistration does RCU synchronization. ++ */ ++ if (!panic) ++ atomic_notifier_chain_unregister(&panic_notifier_list, ++ &snp_panic_notifier); + + /* Reset TMR size back to default */ + sev_es_tmr_size = SEV_TMR_SIZE; diff --git a/queue-6.12/dpll-fix-null-pointer-dereference-in-dpll_msg_add_pin_ref_sync.patch b/queue-6.12/dpll-fix-null-pointer-dereference-in-dpll_msg_add_pin_ref_sync.patch new file mode 100644 index 0000000000..dccf3ac6b7 --- /dev/null +++ b/queue-6.12/dpll-fix-null-pointer-dereference-in-dpll_msg_add_pin_ref_sync.patch @@ -0,0 +1,66 @@ +From d2e914a4a0d0f753dbae830264850d044026167c Mon Sep 17 00:00:00 2001 +From: Ivan Vecera +Date: Fri, 10 Jul 2026 21:36:25 +0200 +Subject: dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() + +From: Ivan Vecera + +commit d2e914a4a0d0f753dbae830264850d044026167c upstream. + +When a dpll_pin is shared across multiple dpll_device instances and +those devices are being unregistered (e.g. during driver module removal), +a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync(). + +This happens under the following conditions: + - A pin is registered with two or more dpll devices (dpll_A, dpll_B) + - The pin has ref_sync pairs with other pins + - During unregistration of dpll_A's pins, a ref_sync partner pin is + unregistered first, removing it from dpll_A->pin_refs + - But since the partner pin is still registered with dpll_B, its + dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT + run and the partner stays in the pin's ref_sync_pins xarray + - When the pin itself is then unregistered from dpll_A, the delete + notification calls dpll_msg_add_pin_ref_sync() which finds the + partner in ref_sync_pins, passes dpll_pin_available() (partner is + still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, + partner) returns NULL because partner was already removed from + dpll_A->pin_refs + - The NULL priv pointer is passed to the driver's ref_sync_get + callback, which dereferences it + + BUG: kernel NULL pointer dereference, address: 0000000000000034 + Oops: Oops: 0000 [#1] SMP NOPTI + RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] + Call Trace: + dpll_msg_add_pin_ref_sync+0xb8/0x200 + dpll_cmd_pin_get_one+0x3b6/0x4b0 + dpll_pin_event_send+0x72/0x140 + __dpll_pin_unregister+0x5a/0x2b0 + dpll_pin_unregister+0x49/0x70 + +Fix this by skipping ref_sync pins whose priv pointer cannot be resolved +for the current dpll device. + +Fixes: 58256a26bfb3 ("dpll: add reference sync get/set") +Signed-off-by: Ivan Vecera +Reviewed-by: Vadim Fedorenko +Reviewed-by: Jiri Pirko +Link: https://patch.msgid.link/20260710193625.1378822-1-ivecera@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dpll/dpll_netlink.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/dpll/dpll_netlink.c ++++ b/drivers/dpll/dpll_netlink.c +@@ -424,6 +424,9 @@ dpll_msg_add_pin_ref_sync(struct sk_buff + if (!dpll_pin_available(ref_sync_pin)) + continue; + ref_sync_pin_priv = dpll_pin_on_dpll_priv(dpll, ref_sync_pin); ++ /* Pin may have been unregistered from this dpll already */ ++ if (!ref_sync_pin_priv) ++ continue; + if (WARN_ON(!ops->ref_sync_get)) + return -EOPNOTSUPP; + ret = ops->ref_sync_get(pin, pin_priv, ref_sync_pin, diff --git a/queue-6.12/i40e-drop-udp_tunnel_get_rx_info-call-from-i40e_open.patch b/queue-6.12/i40e-drop-udp_tunnel_get_rx_info-call-from-i40e_open.patch new file mode 100644 index 0000000000..bb1dd0bdce --- /dev/null +++ b/queue-6.12/i40e-drop-udp_tunnel_get_rx_info-call-from-i40e_open.patch @@ -0,0 +1,57 @@ +From 40857194956dcaf3d2b66d6bd113d844c93bef54 Mon Sep 17 00:00:00 2001 +From: Mohammad Heib +Date: Sun, 28 Dec 2025 21:40:20 +0200 +Subject: i40e: drop udp_tunnel_get_rx_info() call from i40e_open() + +From: Mohammad Heib + +commit 40857194956dcaf3d2b66d6bd113d844c93bef54 upstream. + +The i40e driver calls udp_tunnel_get_rx_info() during i40e_open(). +This is redundant because UDP tunnel RX offload state is preserved +across device down/up cycles. The udp_tunnel core handles +synchronization automatically when required. + +Furthermore, recent changes in the udp_tunnel infrastructure require +querying RX info while holding the udp_tunnel lock. Calling it +directly from the ndo_open path violates this requirement, +triggering the following lockdep warning: + + Call Trace: + + ? __udp_tunnel_nic_assert_locked+0x39/0x40 [udp_tunnel] + i40e_open+0x135/0x14f [i40e] + __dev_open+0x121/0x2e0 + __dev_change_flags+0x227/0x270 + dev_change_flags+0x3d/0xb0 + devinet_ioctl+0x56f/0x860 + sock_do_ioctl+0x7b/0x130 + __x64_sys_ioctl+0x91/0xd0 + do_syscall_64+0x90/0x170 + ... + + +Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from +i40e_open() resolve the locking violation. + +Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") +Signed-off-by: Mohammad Heib +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Paul Menzel +Tested-by: Rinitha S (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -9110,7 +9110,6 @@ int i40e_open(struct net_device *netdev) + TCP_FLAG_FIN | + TCP_FLAG_CWR) >> 16); + wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16); +- udp_tunnel_get_rx_info(netdev); + + return 0; + } diff --git a/queue-6.12/ice-drop-udp_tunnel_get_rx_info-call-from-ndo_open.patch b/queue-6.12/ice-drop-udp_tunnel_get_rx_info-call-from-ndo_open.patch new file mode 100644 index 0000000000..2b9b5f47fd --- /dev/null +++ b/queue-6.12/ice-drop-udp_tunnel_get_rx_info-call-from-ndo_open.patch @@ -0,0 +1,58 @@ +From 234e615bfece9e3e91c50fe49ab9e68ee37c791a Mon Sep 17 00:00:00 2001 +From: Mohammad Heib +Date: Sun, 28 Dec 2025 21:40:21 +0200 +Subject: ice: drop udp_tunnel_get_rx_info() call from ndo_open() + +From: Mohammad Heib + +commit 234e615bfece9e3e91c50fe49ab9e68ee37c791a upstream. + +The ice driver calls udp_tunnel_get_rx_info() during ice_open_internal(). +This is redundant because UDP tunnel RX offload state is preserved +across device down/up cycles. The udp_tunnel core handles +synchronization automatically when required. + +Furthermore, recent changes in the udp_tunnel infrastructure require +querying RX info while holding the udp_tunnel lock. Calling it +directly from the ndo_open path violates this requirement, +triggering the following lockdep warning: + +Call Trace: + + ice_open_internal+0x253/0x350 [ice] + __udp_tunnel_nic_assert_locked+0x86/0xb0 [udp_tunnel] + __dev_open+0x2f5/0x880 + __dev_change_flags+0x44c/0x660 + netif_change_flags+0x80/0x160 + devinet_ioctl+0xd21/0x15f0 + inet_ioctl+0x311/0x350 + sock_ioctl+0x114/0x220 + __x64_sys_ioctl+0x131/0x1a0 + ... + + +Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from +ice_open_internal() to resolve the locking violation + +Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") +Signed-off-by: Mohammad Heib +Reviewed-by: Aleksandr Loktionov +Tested-by: Rinitha S (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_main.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -9574,9 +9574,6 @@ int ice_open_internal(struct net_device + netdev_err(netdev, "Failed to open VSI 0x%04X on switch 0x%04X\n", + vsi->vsi_num, vsi->vsw->sw_id); + +- /* Update existing tunnels information */ +- udp_tunnel_get_rx_info(netdev); +- + return err; + } + diff --git a/queue-6.12/jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch b/queue-6.12/jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch new file mode 100644 index 0000000000..a6d6619a7f --- /dev/null +++ b/queue-6.12/jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch @@ -0,0 +1,39 @@ +From bb2784d9ab49587ba4fbff37a319fff2924db289 Mon Sep 17 00:00:00 2001 +From: Easwar Hariharan +Date: Thu, 30 Jan 2025 19:26:58 +0000 +Subject: jiffies: Cast to unsigned long in secs_to_jiffies() conversion + +From: Easwar Hariharan + +commit bb2784d9ab49587ba4fbff37a319fff2924db289 upstream. + +While converting users of msecs_to_jiffies(), lkp reported that some range +checks would always be true because of the mismatch between the implied int +value of secs_to_jiffies() vs the unsigned long return value of the +msecs_to_jiffies() calls it was replacing. + +Fix this by casting the secs_to_jiffies() input value to unsigned long. + +Fixes: b35108a51cf7ba ("jiffies: Define secs_to_jiffies()") +Reported-by: kernel test robot +Signed-off-by: Easwar Hariharan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20250130192701.99626-1-eahariha@linux.microsoft.com +Closes: https://lore.kernel.org/oe-kbuild-all/202501301334.NB6NszQR-lkp@intel.com/ +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/jiffies.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -537,7 +537,7 @@ static __always_inline unsigned long mse + * + * Return: jiffies value + */ +-#define secs_to_jiffies(_secs) ((_secs) * HZ) ++#define secs_to_jiffies(_secs) (unsigned long)((_secs) * HZ) + + extern unsigned long __usecs_to_jiffies(const unsigned int u); + #if !(USEC_PER_SEC % HZ) diff --git a/queue-6.12/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch b/queue-6.12/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch new file mode 100644 index 0000000000..41123fc7b0 --- /dev/null +++ b/queue-6.12/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch @@ -0,0 +1,86 @@ +From 7ce4fc40018de07f05f3035241122d992610dbfb Mon Sep 17 00:00:00 2001 +From: Gil Portnoy +Date: Thu, 28 May 2026 00:00:00 +0000 +Subject: ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd + +From: Gil Portnoy + +commit 7ce4fc40018de07f05f3035241122d992610dbfb upstream. + +Two concurrent same-user DHnC reconnects can both observe fp->conn == NULL +before either sets it. ksmbd_reopen_durable_fd() checks fp->conn to guard +against a handle already being reconnected, but the check and the binding +assignment are not atomic: both threads pass the guard, both call +ksmbd_conn_get() on the same fp, and both eventually reach +kfree(fp->owner.name) -- a double-free of the owner.name slab object. +The double-bound ksmbd_file also causes a write-UAF on the 344-byte +ksmbd_file_cache object when a concurrent smb2_close() spins on fp->f_lock +after the object has been freed by the losing reconnect path. + +KASAN on 7.1-rc5 (48-thread concurrent reconnect, 3000 cycles): + BUG: KASAN: double-free in ksmbd_reopen_durable_fd+0x268/0x308 + BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x150 + Write of size 4 at offset 24 into freed ksmbd_file_cache object +Five double-bind windows observed; 63 total KASAN reports triggered. + +Fix: validate and claim fp->conn under write_lock(&global_ft.lock) so the +check-and-claim is atomic. ksmbd_lookup_durable_fd() already treats +fp->conn != NULL as "in use" and skips such an fp; setting fp->conn before +dropping the lock closes the race. ksmbd_conn_get() is a non-sleeping +refcount increment, safe under the rwlock. The rollback path on __open_id() +failure also clears fp->conn/tcon under the lock so concurrent readers see +a consistent state. + +Fixes: b1f1e80620de ("ksmbd: centralize ksmbd_conn final release to plug transport leak") +Assisted-by: Henry (Claude):claude-opus-4 +Signed-off-by: Gil Portnoy +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/vfs_cache.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/fs/smb/server/vfs_cache.c ++++ b/fs/smb/server/vfs_cache.c +@@ -1185,19 +1185,19 @@ int ksmbd_reopen_durable_fd(struct ksmbd + struct ksmbd_lock *smb_lock; + unsigned int old_f_state; + ++ write_lock(&global_ft.lock); + if (!fp->is_durable || fp->conn || fp->tcon) { ++ write_unlock(&global_ft.lock); + pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon); + return -EBADF; + } + + if (has_file_id(fp->volatile_id)) { ++ write_unlock(&global_ft.lock); + pr_err("Still in use durable fd: %llu\n", fp->volatile_id); + return -EBADF; + } + +- old_f_state = fp->f_state; +- fp->f_state = FP_NEW; +- + /* + * Initialize fp's connection binding before publishing fp into the + * session's file table. If __open_id() is ordered first, a +@@ -1208,11 +1208,17 @@ int ksmbd_reopen_durable_fd(struct ksmbd + */ + fp->conn = ksmbd_conn_get(conn); + fp->tcon = work->tcon; ++ write_unlock(&global_ft.lock); ++ ++ old_f_state = fp->f_state; ++ fp->f_state = FP_NEW; + + __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID); + if (!has_file_id(fp->volatile_id)) { ++ write_lock(&global_ft.lock); + fp->conn = NULL; + fp->tcon = NULL; ++ write_unlock(&global_ft.lock); + ksmbd_conn_put(conn); + fp->f_state = old_f_state; + return -EBADF; diff --git a/queue-6.12/net-airoha-fix-channel-configuration-for-ets-qdisc.patch b/queue-6.12/net-airoha-fix-channel-configuration-for-ets-qdisc.patch new file mode 100644 index 0000000000..584186c31b --- /dev/null +++ b/queue-6.12/net-airoha-fix-channel-configuration-for-ets-qdisc.patch @@ -0,0 +1,41 @@ +From 7d0da8f862340c5f42f0062b8560b8d0971a6ac4 Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Tue, 7 Jan 2025 23:26:28 +0100 +Subject: net: airoha: Fix channel configuration for ETS Qdisc + +From: Lorenzo Bianconi + +commit 7d0da8f862340c5f42f0062b8560b8d0971a6ac4 upstream. + +Limit ETS QoS channel to AIROHA_NUM_QOS_CHANNELS in +airoha_tc_setup_qdisc_ets() in order to align the configured channel to +the value set in airoha_dev_select_queue(). + +Fixes: 20bf7d07c956 ("net: airoha: Add sched ETS offload support") +Signed-off-by: Lorenzo Bianconi +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/20250107-airoha-ets-fix-chan-v1-1-97f66ed3a068@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mediatek/airoha_eth.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mediatek/airoha_eth.c ++++ b/drivers/net/ethernet/mediatek/airoha_eth.c +@@ -2798,11 +2798,14 @@ static int airoha_qdma_get_tx_ets_stats( + static int airoha_tc_setup_qdisc_ets(struct airoha_gdm_port *port, + struct tc_ets_qopt_offload *opt) + { +- int channel = TC_H_MAJ(opt->handle) >> 16; ++ int channel; + + if (opt->parent == TC_H_ROOT) + return -EINVAL; + ++ channel = TC_H_MAJ(opt->handle) >> 16; ++ channel = channel % AIROHA_NUM_QOS_CHANNELS; ++ + switch (opt->command) { + case TC_ETS_REPLACE: + return airoha_qdma_set_tx_ets_sched(port, channel, opt); diff --git a/queue-6.12/perf-arm-spe-use-old-behavior-when-opening-old-spe-files.patch b/queue-6.12/perf-arm-spe-use-old-behavior-when-opening-old-spe-files.patch new file mode 100644 index 0000000000..31437ed9b9 --- /dev/null +++ b/queue-6.12/perf-arm-spe-use-old-behavior-when-opening-old-spe-files.patch @@ -0,0 +1,100 @@ +From ba993e5ada1ddce7a71140dc85ef65bc2cd981bc Mon Sep 17 00:00:00 2001 +From: James Clark +Date: Tue, 29 Oct 2024 14:37:33 +0000 +Subject: perf arm-spe: Use old behavior when opening old SPE files + +From: James Clark + +commit ba993e5ada1ddce7a71140dc85ef65bc2cd981bc upstream. + +Since the linked commit, we stopped interpreting data source if the +perf.data file doesn't have the new metadata version. This means that +perf c2c will show no samples in this case. + +Keep the old behavior so old files can be opened, but also still show +the new warning that updating might improve the decoding. + +Also re-write the warning to be more concise and specific to a user. + +Fixes: ba5e7169e548 ("perf arm-spe: Use metadata to decide the data source feature") +Signed-off-by: James Clark +Reviewed-by: Leo Yan +Cc: Julio.Suarez@arm.com +Cc: Kiel.Friedt@arm.com +Cc: Ryan.Roberts@arm.com +Cc: Will Deacon +Cc: Mike Leach +Cc: linux-arm-kernel@lists.infradead.org +Cc: Besar Wicaksono +Cc: John Garry +Link: https://lore.kernel.org/r/20241029143734.291638-1-james.clark@linaro.org +Signed-off-by: Namhyung Kim +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/arm-spe.c | 50 ++++++++++++++++++++++------------------------ + 1 file changed, 24 insertions(+), 26 deletions(-) + +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -655,37 +655,35 @@ static bool arm_spe__is_common_ds_encodi + u64 *metadata = NULL; + u64 midr = 0; + +- /* +- * Metadata version 1 doesn't contain any info for MIDR. +- * Simply return false in this case. +- */ ++ /* Metadata version 1 assumes all CPUs are the same (old behavior) */ + if (spe->metadata_ver == 1) { +- pr_warning_once("The data file contains metadata version 1, " +- "which is absent the info for data source. " +- "Please upgrade the tool to record data.\n"); +- return false; +- } +- +- /* CPU ID is -1 for per-thread mode */ +- if (speq->cpu < 0) { +- /* +- * On the heterogeneous system, due to CPU ID is -1, +- * cannot confirm the data source packet is supported. +- */ +- if (!spe->is_homogeneous) +- return false; ++ const char *cpuid; + +- /* In homogeneous system, simply use CPU0's metadata */ +- if (spe->metadata) +- metadata = spe->metadata[0]; ++ pr_warning_once("Old SPE metadata, re-record to improve decode accuracy\n"); ++ cpuid = perf_env__cpuid(spe->session->evlist->env); ++ midr = strtol(cpuid, NULL, 16); + } else { +- metadata = arm_spe__get_metadata_by_cpu(spe, speq->cpu); +- } ++ /* CPU ID is -1 for per-thread mode */ ++ if (speq->cpu < 0) { ++ /* ++ * On the heterogeneous system, due to CPU ID is -1, ++ * cannot confirm the data source packet is supported. ++ */ ++ if (!spe->is_homogeneous) ++ return false; ++ ++ /* In homogeneous system, simply use CPU0's metadata */ ++ if (spe->metadata) ++ metadata = spe->metadata[0]; ++ } else { ++ metadata = arm_spe__get_metadata_by_cpu(spe, speq->cpu); ++ } + +- if (!metadata) +- return false; ++ if (!metadata) ++ return false; + +- midr = metadata[ARM_SPE_CPU_MIDR]; ++ midr = metadata[ARM_SPE_CPU_MIDR]; ++ } + + is_in_cpu_list = is_midr_in_range_list(midr, common_ds_encoding_cpus); + if (is_in_cpu_list) diff --git a/queue-6.12/perf-build-id-ensure-snprintf-string-is-empty-when-size-is-0.patch b/queue-6.12/perf-build-id-ensure-snprintf-string-is-empty-when-size-is-0.patch new file mode 100644 index 0000000000..c1112209da --- /dev/null +++ b/queue-6.12/perf-build-id-ensure-snprintf-string-is-empty-when-size-is-0.patch @@ -0,0 +1,52 @@ +From 0dc96cae063cbf9ebf6631b33b08e9ba02324248 Mon Sep 17 00:00:00 2001 +From: Ian Rogers +Date: Thu, 18 Sep 2025 10:24:16 -0700 +Subject: perf build-id: Ensure snprintf string is empty when size is 0 + +From: Ian Rogers + +commit 0dc96cae063cbf9ebf6631b33b08e9ba02324248 upstream. + +The string result of build_id__snprintf() is unconditionally used in +places like dsos__fprintf_buildid_cb(). If the build id has size 0 then +this creates a use of uninitialized memory. Add null termination for the +size 0 case. + +A similar fix was written by Jiri Olsa in commit 6311951d4f8f28c4 ("perf +tools: Initialize output buffer in build_id__sprintf") but lost in the +transition to snprintf. + +Fixes: fccaaf6fbbc59910 ("perf build-id: Change sprintf functions to snprintf") +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Howard Chu +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/build-id.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/tools/perf/util/build-id.c ++++ b/tools/perf/util/build-id.c +@@ -71,6 +71,13 @@ int build_id__snprintf(const struct buil + { + size_t offs = 0; + ++ if (build_id->size == 0) { ++ /* Ensure bf is always \0 terminated. */ ++ if (bf_size > 0) ++ bf[0] = '\0'; ++ return 0; ++ } ++ + for (size_t i = 0; i < build_id->size && offs < bf_size; ++i) + offs += snprintf(bf + offs, bf_size - offs, "%02x", build_id->data[i]); + diff --git a/queue-6.12/perf-build-id-fix-off-by-one-bug-when-printing-kernel-module-build-id.patch b/queue-6.12/perf-build-id-fix-off-by-one-bug-when-printing-kernel-module-build-id.patch new file mode 100644 index 0000000000..4ad7ead505 --- /dev/null +++ b/queue-6.12/perf-build-id-fix-off-by-one-bug-when-printing-kernel-module-build-id.patch @@ -0,0 +1,60 @@ +From 017bca78e4d72b1ff027d368c20a1b2c654edaf7 Mon Sep 17 00:00:00 2001 +From: Michael Petlan +Date: Wed, 20 May 2026 00:38:55 +0200 +Subject: perf build-id: Fix off-by-one bug when printing kernel/module build-id + +From: Michael Petlan + +commit 017bca78e4d72b1ff027d368c20a1b2c654edaf7 upstream. + +When changing sprintf functions to snprintf, one byte got lost. Since +snprintf ones do not handle the '\0' terminating character, the number +of printed characters is 40, while sizeof(sbuild_id) is 41, including +the terminating '\0' character. + +This makes the later check fail so that nothing is printed. + +Fix that. + +Before: + + [Michael@Carbon ~]$ perf buildid-list -k + [Michael@Carbon ~]$ + +After: + + [Michael@Carbon ~]$ perf buildid-list -k + a527806324d543c4bc3ff2f9c9519d494fed5f68 + [Michael@Carbon ~]$ + +Fixes: fccaaf6fbbc59910 ("perf build-id: Change sprintf functions to snprintf") +Signed-off-by: Michael Petlan +Tested-by: Ian Rogers +Cc: Ian Rogers +Cc: Namhyung Kim +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-buildid-list.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/perf/builtin-buildid-list.c ++++ b/tools/perf/builtin-buildid-list.c +@@ -58,7 +58,7 @@ static int sysfs__fprintf_build_id(FILE + int ret; + + ret = sysfs__snprintf_build_id("/", sbuild_id, sizeof(sbuild_id)); +- if (ret != sizeof(sbuild_id)) ++ if (ret + 1 != sizeof(sbuild_id)) + return ret < 0 ? ret : -EINVAL; + + return fprintf(fp, "%s\n", sbuild_id); +@@ -70,7 +70,7 @@ static int filename__fprintf_build_id(co + int ret; + + ret = filename__snprintf_build_id(name, sbuild_id, sizeof(sbuild_id)); +- if (ret != sizeof(sbuild_id)) ++ if (ret + 1 != sizeof(sbuild_id)) + return ret < 0 ? ret : -EINVAL; + + return fprintf(fp, "%s\n", sbuild_id); diff --git a/queue-6.12/perf-callchain-handle-multiple-address-spaces.patch b/queue-6.12/perf-callchain-handle-multiple-address-spaces.patch new file mode 100644 index 0000000000..290c854c27 --- /dev/null +++ b/queue-6.12/perf-callchain-handle-multiple-address-spaces.patch @@ -0,0 +1,150 @@ +From ae15db3e9b639491007cc1e9e99638e4b6091781 Mon Sep 17 00:00:00 2001 +From: Thomas Richter +Date: Tue, 14 Apr 2026 14:42:41 +0200 +Subject: perf callchain: Handle multiple address spaces + +From: Thomas Richter + +commit ae15db3e9b639491007cc1e9e99638e4b6091781 upstream. + +perf test 'perf inject to convert DWARF callchains to regular ones' +fails on s390. It was introduced with commit 92ea788d2af4e65a ("perf +inject: Add --convert-callchain option") + +The failure comes the difference in output. Without the inject script to +convert DWARF the callchains is: + + # perf record -F 999 --call-graph dwarf -- perf test -w noploop + # perf report -i perf.data --stdio --no-children -q \ + --percent-limit=1 > /tmp/111 + # cat /tmp/111 + 99.30% perf-noploop perf [.] noploop + | + ---noploop + run_workload (inlined) + cmd_test + run_builtin (inlined) + handle_internal_command + run_argv (inlined) + main + __libc_start_call_main + __libc_start_main_impl (inlined) + _start + # + +With the inject script step the output is: + + # perf inject -i perf.data --convert-callchain -o /tmp/perf-inject-1.out + # perf report -i /tmp/perf-inject-1.out --stdio --no-children -q \ + --percent-limit=1 > /tmp/222 + # cat /tmp/222 + 99.40% perf-noploop perf [.] noploop + | + ---noploop + run_workload (inlined) + cmd_test + run_builtin (inlined) + handle_internal_command + run_argv (inlined) + main + _start + # diff /tmp/111 /tmp/222 + 1c1 + < 99.30% perf-noploop perf [.] noploop + --- + > 99.40% perf-noploop perf [.] noploop + 10,11d9 + < __libc_start_call_main + < __libc_start_main_impl (inlined) + # + +The difference are the symbols __libc_start_call_main and +__libc_start_main_impl. + +On x86_64, kernel and user space share a single virtual address space, +with the kernel mapped to the upper end of memory. The instruction +pointer value alone is sufficient to distinguish between user space and +kernel space addresses. + +This is not true for s390, which uses separate address spaces for user +and kernel. + +The same virtual address can be valid in both address spaces, so the +instruction pointer value alone cannot determine whether an address +belongs to the kernel or user space. + +Instead, perf must rely on the cpumode metadata derived from the +processor status word (PSW) at sample time. + +In function perf_event__convert_sample_callchain() the first part +copies a kernel callchain and context entries, if any. + +It then appends additional entries ignoring the address space +architecture. Taking that into account, the symbols at addresses + + 0x3ff970348cb __libc_start_call_main + 0x3ff970349c5 __libc_start_main_impl + +(located after the kernel address space on s390) are now included. + +Output before: + + # perf test 83 + 83: perf inject to convert DWARF callchains to regular ones : FAILED! + +Output after: + # perf test 83 + 83: perf inject to convert DWARF callchains to regular ones : Ok + +Question to Namhyung: + +In function perf_event__convert_sample_callchain() just before the +for() loop this patch modifies, the kernel callchain is copied, +see this comment and the next 5 lines: + + /* copy kernel callchain and context entries */ + +Then why is machine__kernel_ip() needed in the for() loop, when +the kernel entries have been copied just before the loop? + +Note: This patch was tested on x86_64 virtual machine and succeeded. + +Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option") +Signed-off-by: Thomas Richter +Acked-by: Namhyung Kim +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Jan Polensky +Cc: linux-s390@vger.kernel.org +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/common.c | 4 +++- + tools/perf/builtin-inject.c | 3 ++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/tools/perf/arch/common.c ++++ b/tools/perf/arch/common.c +@@ -237,5 +237,7 @@ int perf_env__lookup_objdump(struct perf + */ + bool perf_env__single_address_space(struct perf_env *env) + { +- return strcmp(perf_env__arch(env), "sparc"); ++ const char *arch = perf_env__arch(env); ++ ++ return strcmp(arch, "s390") && strcmp(arch, "sparc"); + } +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -452,7 +452,8 @@ static int perf_event__convert_sample_ca + + node = cursor->first; + for (k = 0; k < cursor->nr && i < PERF_MAX_STACK_DEPTH; k++) { +- if (machine__kernel_ip(machine, node->ip)) ++ if (machine->single_address_space && ++ machine__kernel_ip(machine, node->ip)) + /* kernel IPs were added already */; + else if (node->ms.sym && node->ms.sym->inlined) + /* we can't handle inlined callchains */; diff --git a/queue-6.12/perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch b/queue-6.12/perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch new file mode 100644 index 0000000000..7163100f21 --- /dev/null +++ b/queue-6.12/perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch @@ -0,0 +1,47 @@ +From e786a04b4a5461dd7e2829422314a5a6d5a664d9 Mon Sep 17 00:00:00 2001 +From: Ian Rogers +Date: Thu, 22 Jan 2026 09:58:46 -0800 +Subject: perf inject: With --convert-callchain ignore the dummy event for dwarf stacks + +From: Ian Rogers + +commit e786a04b4a5461dd7e2829422314a5a6d5a664d9 upstream. + +On hybrid systems there is generally >1 event and a dummy event. + +The perf inject --convert-callchain option is failing to convert +perf.data files on such systems reporting "--convert-callchain requires +DWARF call graph." + +The failing event is the dummy event that doesn't need to be set up for +samples. + +As such ignore this event when checking the evsels. + +Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-inject.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -2739,7 +2739,7 @@ int cmd_inject(int argc, const char **ar + } + + evlist__for_each_entry(inject.session->evlist, evsel) { +- if (!evsel__has_dwarf_callchain(evsel)) { ++ if (!evsel__has_dwarf_callchain(evsel) && !evsel__is_dummy_event(evsel)) { + pr_err("--convert-callchain requires DWARF call graph.\n"); + goto out_delete; + } diff --git a/queue-6.12/perf-libunwind-arm64-fix-missing-close-parens-in-an-if-statement.patch b/queue-6.12/perf-libunwind-arm64-fix-missing-close-parens-in-an-if-statement.patch new file mode 100644 index 0000000000..796608ca8e --- /dev/null +++ b/queue-6.12/perf-libunwind-arm64-fix-missing-close-parens-in-an-if-statement.patch @@ -0,0 +1,33 @@ +From 1293dacbbd43ab9848ac4655f6f2ba1dcc5a96ad Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Wed, 9 Apr 2025 10:35:31 -0300 +Subject: perf libunwind arm64: Fix missing close parens in an if statement + +From: Arnaldo Carvalho de Melo + +commit 1293dacbbd43ab9848ac4655f6f2ba1dcc5a96ad upstream. + +While testing building with libunwind (using LIBUNWIND=1) in various +arches I noticed a problem on arm64, on an rpi5 system, a missing close +parens in a change related to dso__data_get_fd() usage, fix it. + +Fixes: 5ac22c35aa8519f1 ("perf dso: Use lock annotations to fix asan deadlock") +Signed-off-by: Arnaldo Carvalho de Melo +Link: https://lore.kernel.org/r/Z_Z3o8KvB2i5c6ab@x1 +Signed-off-by: Namhyung Kim +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/unwind-libunwind-local.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/unwind-libunwind-local.c ++++ b/tools/perf/util/unwind-libunwind-local.c +@@ -371,7 +371,7 @@ static int read_unwind_spec_debug_frame( + * has to be pointed by symsrc_filename + */ + if (ofs == 0) { +- if (dso__data_get_fd(dso, machine, &fd) { ++ if (dso__data_get_fd(dso, machine, &fd)) { + ofs = elf_section_offset(fd, ".debug_frame"); + dso__data_put_fd(dso); + } diff --git a/queue-6.12/perf-synthetic-events-fix-stale-build-id-in-module-mmap2-records.patch b/queue-6.12/perf-synthetic-events-fix-stale-build-id-in-module-mmap2-records.patch new file mode 100644 index 0000000000..ba4a63f43d --- /dev/null +++ b/queue-6.12/perf-synthetic-events-fix-stale-build-id-in-module-mmap2-records.patch @@ -0,0 +1,74 @@ +From 35b16a7a2c4fc458304447128b86514ce9f70f3c Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Tue, 10 Mar 2026 13:59:51 -0400 +Subject: perf synthetic-events: Fix stale build ID in module MMAP2 records + +From: Chuck Lever + +commit 35b16a7a2c4fc458304447128b86514ce9f70f3c upstream. + +perf_event__synthesize_modules() allocates a single union perf_event and +reuses it across every kernel module callback. + +After the first module is processed, perf_record_mmap2__read_build_id() +sets PERF_RECORD_MISC_MMAP_BUILD_ID in header.misc and writes that +module's build ID into the event. + +On subsequent iterations the callback overwrites start, len, pid, and +filename for the next module but never clears the stale build ID fields +or the MMAP_BUILD_ID flag. + +When perf_record_mmap2__read_build_id() runs for the second module it +sees the flag, reads the stale build ID into a dso_id, and +__dso__improve_id() permanently poisons the DSO with the wrong build ID. + +Every module after the first therefore receives the first module's build +ID in its MMAP2 record. + +On a system with the sunrpc and nfsd modules loaded, this causes perf +script and perf report to show [unknown] for all module symbols. + +The latent bug has existed since commit d9f2ecbc5e47fca7 ("perf dso: +Move build_id to dso_id") introduced the PERF_RECORD_MISC_MMAP_BUILD_ID +check in perf_record_mmap2__read_build_id(). + +Commit 53b00ff358dc75b1 ("perf record: Make --buildid-mmap the default") +then exposed it to all users by making the MMAP2-with-build-ID path the +default. Both commits were merged in the same series. + +Clear the MMAP_BUILD_ID flag and zero the build_id union before each +call to perf_record_mmap2__read_build_id() so that every module starts +with a clean slate. + +Fixes: d9f2ecbc5e47fca7 ("perf dso: Move build_id to dso_id") +Reviewed-by: Ian Rogers +Signed-off-by: Chuck Lever +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/synthetic-events.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/tools/perf/util/synthetic-events.c ++++ b/tools/perf/util/synthetic-events.c +@@ -702,6 +702,11 @@ static int perf_event__synthesize_module + + memcpy(event->mmap2.filename, dso__long_name(dso), dso__long_name_len(dso) + 1); + ++ /* Clear stale build ID from previous module iteration */ ++ event->mmap2.header.misc &= ~PERF_RECORD_MISC_MMAP_BUILD_ID; ++ memset(event->mmap2.build_id, 0, sizeof(event->mmap2.build_id)); ++ event->mmap2.build_id_size = 0; ++ + perf_record_mmap2__read_build_id(&event->mmap2, args->machine, false); + } else { + size = PERF_ALIGN(dso__long_name_len(dso) + 1, sizeof(u64)); diff --git a/queue-6.12/rtnetlink-make-per-netns-rtnl-dereference-helpers-to-macro.patch b/queue-6.12/rtnetlink-make-per-netns-rtnl-dereference-helpers-to-macro.patch new file mode 100644 index 0000000000..a52ef9421f --- /dev/null +++ b/queue-6.12/rtnetlink-make-per-netns-rtnl-dereference-helpers-to-macro.patch @@ -0,0 +1,90 @@ +From 9cb7e40d388d6c0e4677809c6b2950bc67fd8830 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Mon, 21 Oct 2024 11:32:28 -0700 +Subject: rtnetlink: Make per-netns RTNL dereference helpers to macro. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kuniyuki Iwashima + +commit 9cb7e40d388d6c0e4677809c6b2950bc67fd8830 upstream. + +When CONFIG_DEBUG_NET_SMALL_RTNL is off, rtnl_net_dereference() is the +static inline wrapper of rtnl_dereference() returning a plain (void *) +pointer to make sure net is always evaluated as requested in [0]. + +But, it makes sparse complain [1] when the pointer has __rcu annotation: + + net/ipv4/devinet.c:674:47: sparse: warning: incorrect type in argument 2 (different address spaces) + net/ipv4/devinet.c:674:47: sparse: expected void *p + net/ipv4/devinet.c:674:47: sparse: got struct in_ifaddr [noderef] __rcu * + +Also, if we evaluate net as (void *) in a macro, then the compiler +in turn fails to build due to -Werror=unused-value. + + #define rtnl_net_dereference(net, p) \ + ({ \ + (void *)net; \ + rtnl_dereference(p); \ + }) + + net/ipv4/devinet.c: In function ‘inet_rtm_deladdr’: + ./include/linux/rtnetlink.h:154:17: error: statement with no effect [-Werror=unused-value] + 154 | (void *)net; \ + net/ipv4/devinet.c:674:21: note: in expansion of macro ‘rtnl_net_dereference’ + 674 | (ifa = rtnl_net_dereference(net, *ifap)) != NULL; + | ^~~~~~~~~~~~~~~~~~~~ + +Let's go back to the original simplest macro. + +Note that checkpatch complains about this approach, but it's one-shot and +less noisy than the other two. + + WARNING: Argument 'net' is not used in function-like macro + #76: FILE: include/linux/rtnetlink.h:142: + +#define rtnl_net_dereference(net, p) \ + + rtnl_dereference(p) + +Fixes: 844e5e7e656d ("rtnetlink: Add assertion helpers for per-netns RTNL.") +Link: https://lore.kernel.org/netdev/20241004132145.7fd208e9@kernel.org/ [0] +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202410200325.SaEJmyZS-lkp@intel.com/ [1] +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/rtnetlink.h | 21 ++++++--------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +--- a/include/linux/rtnetlink.h ++++ b/include/linux/rtnetlink.h +@@ -146,21 +146,12 @@ static inline void ASSERT_RTNL_NET(struc + ASSERT_RTNL(); + } + +-static inline void *rcu_dereference_rtnl_net(struct net *net, void *p) +-{ +- return rcu_dereference_rtnl(p); +-} +- +-static inline void *rtnl_net_dereference(struct net *net, void *p) +-{ +- return rtnl_dereference(p); +-} +- +-static inline void *rcu_replace_pointer_rtnl_net(struct net *net, +- void *rp, void *p) +-{ +- return rcu_replace_pointer_rtnl(rp, p); +-} ++#define rcu_dereference_rtnl_net(net, p) \ ++ rcu_dereference_rtnl(p) ++#define rtnl_net_dereference(net, p) \ ++ rtnl_dereference(p) ++#define rcu_replace_pointer_rtnl_net(net, rp, p) \ ++ rcu_replace_pointer_rtnl(rp, p) + #endif + + static inline struct netdev_queue *dev_ingress_queue(struct net_device *dev) diff --git a/queue-6.12/seqlock-fix-scoped_seqlock_read-kernel-doc.patch b/queue-6.12/seqlock-fix-scoped_seqlock_read-kernel-doc.patch new file mode 100644 index 0000000000..efac1b7016 --- /dev/null +++ b/queue-6.12/seqlock-fix-scoped_seqlock_read-kernel-doc.patch @@ -0,0 +1,58 @@ +From f88a31308db6a856229150039b0f56d59696ed31 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Fri, 23 Jan 2026 10:37:49 -0800 +Subject: seqlock: fix scoped_seqlock_read kernel-doc + +From: Randy Dunlap + +commit f88a31308db6a856229150039b0f56d59696ed31 upstream. + +Eliminate all kernel-doc warnings in seqlock.h: + +- correct the macro to have "()" immediately following the macro name +- don't include the macro parameters in the short description (first line) +- make the parameter names in the comments match the actual macro + parameter names. +- use "::" for the Example + +WARNING: include/linux/seqlock.h:1341 This comment starts with '/**', but isn't a kernel-doc comment. + * scoped_seqlock_read (lock, ss_state) - execute the read side critical +Documentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING: + Definition list ends without a blank line; unexpected unindent. [docutils] +Warning: include/linux/seqlock.h:1357 function parameter '_seqlock' not described in 'scoped_seqlock_read' +Warning: include/linux/seqlock.h:1357 function parameter '_target' not described in 'scoped_seqlock_read' + +Fixes: cc39f3872c08 ("seqlock: Introduce scoped_seqlock_read()") +Signed-off-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Link: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/seqlock.h | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/include/linux/seqlock.h ++++ b/include/linux/seqlock.h +@@ -1277,15 +1277,14 @@ __scoped_seqlock_next(struct ss_tmp *sst + __scoped_seqlock_next(&_s, _seqlock, _target)) + + /** +- * scoped_seqlock_read (lock, ss_state) - execute the read side critical +- * section without manual sequence +- * counter handling or calls to other +- * helpers +- * @lock: pointer to seqlock_t protecting the data +- * @ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} indicating +- * the type of critical read section ++ * scoped_seqlock_read() - execute the read-side critical section ++ * without manual sequence counter handling ++ * or calls to other helpers ++ * @_seqlock: pointer to seqlock_t protecting the data ++ * @_target: an enum ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} ++ * indicating the type of critical read section + * +- * Example: ++ * Example:: + * + * scoped_seqlock_read (&lock, ss_lock) { + * // read-side critical section diff --git a/queue-6.12/series b/queue-6.12/series index f4f8064e7b..17f328bd11 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1246,3 +1246,31 @@ kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch perf-x86-amd-brs-fix-kernel-address-leakage.patch dibs-loopback-validate-offset-and-size-in-move_data.patch +perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch +seqlock-fix-scoped_seqlock_read-kernel-doc.patch +perf-callchain-handle-multiple-address-spaces.patch +ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch +rtnetlink-make-per-netns-rtnl-dereference-helpers-to-macro.patch +perf-arm-spe-use-old-behavior-when-opening-old-spe-files.patch +net-airoha-fix-channel-configuration-for-ets-qdisc.patch +jiffies-cast-to-unsigned-long-in-secs_to_jiffies-conversion.patch +afs-fix-afs_atcell_get_link-to-check-if-ws_cell-is-unset-first.patch +afs-fix-afs_dynroot_readdir-to-not-use-the-rcu-read-lock.patch +perf-libunwind-arm64-fix-missing-close-parens-in-an-if-statement.patch +crypto-ccp-fix-__sev_snp_shutdown_locked.patch +crypto-ccp-fix-dereferencing-uninitialized-error-pointer.patch +crypto-ccp-fix-snp-panic-notifier-unregistration.patch +udp_tunnel-fix-deadlock-in-udp_tunnel_nic_set_port_priv.patch +bluetooth-hci_core-remove-check-of-bdaddr_any-in-hci_conn_hash_lookup_big_state.patch +bluetooth-hci_sync-fix-attempting-to-send-hci_disconnect-to-bis-handle.patch +crypto-ccp-always-pass-in-an-error-pointer-to-__sev_platform_shutdown_locked.patch +perf-build-id-ensure-snprintf-string-is-empty-when-size-is-0.patch +i40e-drop-udp_tunnel_get_rx_info-call-from-i40e_open.patch +ice-drop-udp_tunnel_get_rx_info-call-from-ndo_open.patch +crypto-ccp-fix-leaking-the-same-page-twice.patch +perf-synthetic-events-fix-stale-build-id-in-module-mmap2-records.patch +bluetooth-l2cap-fix-regressions-caused-by-reusing-ident.patch +bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch +bluetooth-l2cap-fix-tx-ident-leak-for-commands-without-a-response.patch +dpll-fix-null-pointer-dereference-in-dpll_msg_add_pin_ref_sync.patch +perf-build-id-fix-off-by-one-bug-when-printing-kernel-module-build-id.patch diff --git a/queue-6.12/udp_tunnel-fix-deadlock-in-udp_tunnel_nic_set_port_priv.patch b/queue-6.12/udp_tunnel-fix-deadlock-in-udp_tunnel_nic_set_port_priv.patch new file mode 100644 index 0000000000..0e1897ce9a --- /dev/null +++ b/queue-6.12/udp_tunnel-fix-deadlock-in-udp_tunnel_nic_set_port_priv.patch @@ -0,0 +1,85 @@ +From c9e78afa688afec528784b79bb02d513cdcd6527 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Mon, 23 Jun 2025 12:53:55 +0200 +Subject: udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv() + +From: Paolo Abeni + +commit c9e78afa688afec528784b79bb02d513cdcd6527 upstream. + +While configuring a vxlan tunnel in a system with a i40e NIC driver, I +observe the following deadlock: + + WARNING: possible recursive locking detected + 6.16.0-rc2.net-next-6.16_92d87230d899+ #13 Tainted: G E + -------------------------------------------- + kworker/u256:4/1125 is trying to acquire lock: + ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: i40e_udp_tunnel_set_port (/home/pabeni/net-next/include/net/udp_tunnel.h:343 /home/pabeni/net-next/drivers/net/ethernet/intel/i40e/i40e_main.c:13013) i40e + + but task is already holding lock: + ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:739) udp_tunnel + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&utn->lock); + lock(&utn->lock); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 4 locks held by kworker/u256:4/1125: + #0: ffff8892910ca158 ((wq_completion)udp_tunnel_nic){+.+.}-{0:0}, at: process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3213) + #1: ffffc900244efd30 ((work_completion)(&utn->work)){+.+.}-{0:0}, at: process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3214) + #2: ffffffff9a14e290 (rtnl_mutex){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:737) udp_tunnel + #3: ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:739) udp_tunnel + + stack backtrace: + Hardware name: Dell Inc. PowerEdge R7525/0YHMCJ, BIOS 2.2.5 04/08/2021 +i + Call Trace: + + dump_stack_lvl (/home/pabeni/net-next/lib/dump_stack.c:123) + print_deadlock_bug (/home/pabeni/net-next/kernel/locking/lockdep.c:3047) + validate_chain (/home/pabeni/net-next/kernel/locking/lockdep.c:3901) + __lock_acquire (/home/pabeni/net-next/kernel/locking/lockdep.c:5240) + lock_acquire.part.0 (/home/pabeni/net-next/kernel/locking/lockdep.c:473 /home/pabeni/net-next/kernel/locking/lockdep.c:5873) + __mutex_lock (/home/pabeni/net-next/kernel/locking/mutex.c:604 /home/pabeni/net-next/kernel/locking/mutex.c:747) + i40e_udp_tunnel_set_port (/home/pabeni/net-next/include/net/udp_tunnel.h:343 /home/pabeni/net-next/drivers/net/ethernet/intel/i40e/i40e_main.c:13013) i40e + udp_tunnel_nic_device_sync_by_port (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:230 /home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:249) udp_tunnel + __udp_tunnel_nic_device_sync.part.0 (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:292) udp_tunnel + udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:742) udp_tunnel + process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3243) + worker_thread (/home/pabeni/net-next/kernel/workqueue.c:3315 /home/pabeni/net-next/kernel/workqueue.c:3402) + kthread (/home/pabeni/net-next/kernel/kthread.c:464) + +AFAICS all the existing callsites of udp_tunnel_nic_set_port_priv() are +already under the utn lock scope, avoid (re-)acquiring it in such a +function. + +Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") +Signed-off-by: Paolo Abeni +Acked-by: Stanislav Fomichev +Link: https://patch.msgid.link/95a827621ec78c12d1564ec3209e549774f9657d.1750675978.git.pabeni@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/net/udp_tunnel.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/include/net/udp_tunnel.h ++++ b/include/net/udp_tunnel.h +@@ -323,9 +323,8 @@ udp_tunnel_nic_set_port_priv(struct net_ + unsigned int idx, u8 priv) + { + if (udp_tunnel_nic_ops) { +- udp_tunnel_nic_ops->lock(dev); ++ udp_tunnel_nic_ops->assert_locked(dev); + udp_tunnel_nic_ops->set_port_priv(dev, table, idx, priv); +- udp_tunnel_nic_ops->unlock(dev); + } + } +