--- /dev/null
+From d5f8e5f6040d052d44fcbf4f31dd35145c0c8d7d Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Mon, 27 Jul 2026 15:05:51 +0530
+Subject: cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit d5f8e5f6040d052d44fcbf4f31dd35145c0c8d7d upstream.
+
+The memory allocated for data->powernow_table inside
+powernow_k8_cpu_init_acpi() or find_psb_table() is not freed in one of
+the error paths in powernowk8_cpu_init(). Fix that by adding a kfree().
+
+Fixes: 1ff6e97f1d99 ("[CPUFREQ] cpumask: avoid playing with cpus_allowed in powernow-k8.c")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260727093553.98246-1-nihaal@cse.iitm.ac.in
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/powernow-k8.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -1083,6 +1083,7 @@ static int powernowk8_cpu_init(struct cp
+
+ err_out_exit_acpi:
+ powernow_k8_cpu_exit_acpi(data);
++ kfree(data->powernow_table);
+
+ err_out:
+ kfree(data);
--- /dev/null
+From f27f6976ea269219c1259a7c2f8c6dfe782540a3 Mon Sep 17 00:00:00 2001
+From: Hongyan Xu <getshell@seu.edu.cn>
+Date: Wed, 29 Jul 2026 18:01:16 +0800
+Subject: hwmon: (npcm750-pwm-fan): stop fan timer on device detach
+
+From: Hongyan Xu <getshell@seu.edu.cn>
+
+commit f27f6976ea269219c1259a7c2f8c6dfe782540a3 upstream.
+
+When a fan tach channel is present, npcm7xx_pwm_fan_probe() starts
+fan_timer. The timer callback polls tach state and rearms the timer, but
+the driver has no remove callback or devm cleanup action to stop it. On
+device detach, the devm-managed driver data and I/O mappings can be
+released while the timer is still pending or running.
+
+Register a devm cleanup action before starting the timer and shut the
+timer down synchronously from that action.
+
+This issue was found by a static analysis tool.
+
+Fixes: f1fd4a4db777 ("hwmon: Add NPCM7xx PWM and Fan driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
+Link: https://lore.kernel.org/r/20260729100116.790-1-getshell@seu.edu.cn
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/npcm750-pwm-fan.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/hwmon/npcm750-pwm-fan.c
++++ b/drivers/hwmon/npcm750-pwm-fan.c
+@@ -360,6 +360,11 @@ static void npcm7xx_fan_polling(struct t
+ add_timer(&data->fan_timer);
+ }
+
++static void npcm7xx_fan_cleanup(void *timer)
++{
++ timer_shutdown_sync(timer);
++}
++
+ static inline void npcm7xx_fan_compute(struct npcm7xx_pwm_fan_data *data,
+ u8 fan, u8 cmp, u8 fan_id, u8 flag_int,
+ u8 flag_mode, u8 flag_clear)
+@@ -1003,6 +1008,12 @@ static int npcm7xx_pwm_fan_probe(struct
+ msecs_to_jiffies(NPCM7XX_FAN_POLL_TIMER_200MS);
+ timer_setup(&data->fan_timer,
+ npcm7xx_fan_polling, 0);
++ ret = devm_add_action_or_reset(dev,
++ npcm7xx_fan_cleanup,
++ &data->fan_timer);
++ if (ret)
++ return ret;
++
+ add_timer(&data->fan_timer);
+ break;
+ }
--- /dev/null
+From 82048795242f04275a3f49ffc66ad851b6120954 Mon Sep 17 00:00:00 2001
+From: Myeonghun Pak <mhun512@gmail.com>
+Date: Tue, 21 Jul 2026 23:41:47 +0900
+Subject: i2c: amd-mp2: Unregister callback on adapter add failure
+
+From: Myeonghun Pak <mhun512@gmail.com>
+
+commit 82048795242f04275a3f49ffc66ad851b6120954 upstream.
+
+amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI
+driver's callback table before the adapter is registered. If
+i2c_add_adapter() fails, probe returns and devres frees the context,
+but the PCI driver can still dereference the stale pointer from its IRQ
+and system-sleep callbacks.
+
+Unregister the callback before returning the adapter registration error.
+
+Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller")
+Co-developed-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
+Cc: <stable@vger.kernel.org> # v5.2+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20260721144147.31150-1-mhun512@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-amd-mp2-plat.c
++++ b/drivers/i2c/busses/i2c-amd-mp2-plat.c
+@@ -326,8 +326,10 @@ static int i2c_amd_probe(struct platform
+
+ amd_mp2_pm_runtime_put(mp2_dev);
+
+- if (ret < 0)
++ if (ret < 0) {
+ dev_err(&pdev->dev, "i2c add adapter failed = %d\n", ret);
++ amd_mp2_unregister_cb(&i2c_dev->common);
++ }
+
+ return ret;
+ }
--- /dev/null
+From 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f Mon Sep 17 00:00:00 2001
+From: Liem <liem16213@gmail.com>
+Date: Mon, 29 Jun 2026 10:38:29 +0800
+Subject: i2c: imx: Cancel hrtimer before clearing slave pointer
+
+From: Liem <liem16213@gmail.com>
+
+commit 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f upstream.
+
+In i2c_imx_unreg_slave(), the slave pointer is set to NULL after
+disabling interrupts. However, a pending interrupt might already
+have started the hrtimer (i2c_imx_slave_timeout) before the pointer
+was cleared. If the hrtimer fires after i2c_imx->slave is set to
+NULL, the timer callback i2c_imx_slave_finish_op() will call
+i2c_imx_slave_event() with a NULL slave pointer, which results in a
+use-after-free / NULL pointer dereference.
+
+Fix by canceling the hrtimer and waiting for it to complete after
+disabling interrupts, before clearing the slave pointer.
+
+Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver")
+Signed-off-by: Liem <liem16213@gmail.com>
+Cc: <stable@vger.kernel.org> # v5.11+
+Acked-by: Carlos Song <carlos.song@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20260629023829.152651-3-liem16213@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-imx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -865,6 +865,7 @@ static int i2c_imx_unreg_slave(struct i2
+
+ i2c_imx_reset_regs(i2c_imx);
+
++ hrtimer_cancel(&i2c_imx->slave_timer);
+ i2c_imx->slave = NULL;
+
+ /* Suspend */
--- /dev/null
+From d99607c888f26e8a4e9fe9772860cef4aff86bb4 Mon Sep 17 00:00:00 2001
+From: "H. Nikolaus Schaller" <hns@goldelico.com>
+Date: Sun, 19 Jul 2026 22:19:43 +0200
+Subject: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+commit d99607c888f26e8a4e9fe9772860cef4aff86bb4 upstream.
+
+Fix a severe AB/BA deadlock between the Common Clock Framework (CCF)
+and the I2C adapter lock, which triggers when an I2C-controlled clock
+generator client (like the Si5351) is registered or modified under the CCF.
+
+During an i2c client clock (generator) frequency change, the CCF acquires its global
+'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's
+chip registers, stalling for the adapter's I2C bus lock.
+
+Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO
+expander handling LEDs) can hold the I2C adapter lock. Inside this parallel
+transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host
+controller's input clock to calculate bus timings. This call attempts to acquire
+the blocked CCF 'prepare_lock', creating a circular dependency that freezes
+the system.
+
+The jz4780 host controller clock itself is static and never changes at runtime.
+
+However, calling clk_get_rate() inside the active transfer path introduces
+an unnecessary dependency on the CCF internal locks.
+
+Eliminate this synchronous clk_get_rate() call from the active transfer
+path by caching the static host peripheral clock rate once - inside the private
+jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed()
+to use this cached value, safely decoupling active I2C transactions from the
+CCF internal locks without any risk of stale timings.
+
+Assisted-by web based Google AI (pinpointing the bug and writing the message).
+
+Fixes: ba92222ed63a12 ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.1+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/2db6fd233aceb7238474e4833f4d25ca681c3ffb.1784492382.git.hns@goldelico.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-jz4780.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-jz4780.c
++++ b/drivers/i2c/busses/i2c-jz4780.c
+@@ -141,6 +141,7 @@ struct jz4780_i2c {
+ void __iomem *iomem;
+ int irq;
+ struct clk *clk;
++ unsigned long clk_rate_khz;
+ struct i2c_adapter adap;
+ const struct ingenic_i2c_config *cdata;
+
+@@ -246,7 +247,7 @@ static int jz4780_i2c_set_target(struct
+
+ static int jz4780_i2c_set_speed(struct jz4780_i2c *i2c)
+ {
+- int dev_clk_khz = clk_get_rate(i2c->clk) / 1000;
++ int dev_clk_khz = i2c->clk_rate_khz;
+ int cnt_high = 0; /* HIGH period count of the SCL clock */
+ int cnt_low = 0; /* LOW period count of the SCL clock */
+ int cnt_period = 0; /* period count of the SCL clock */
+@@ -800,6 +801,8 @@ static int jz4780_i2c_probe(struct platf
+ if (ret)
+ return ret;
+
++ i2c->clk_rate_khz = clk_get_rate(i2c->clk) / 1000;
++
+ ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency",
+ &clk_freq);
+ if (ret) {
--- /dev/null
+From 0b45f6927a14914ff685fe0e6f9d11232a1e03df Mon Sep 17 00:00:00 2001
+From: Link Lin <linkl@google.com>
+Date: Tue, 21 Jul 2026 00:55:33 +0000
+Subject: mm/page_reporting: use system_freezable_wq to fix UAF during suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Link Lin <linkl@google.com>
+
+commit 0b45f6927a14914ff685fe0e6f9d11232a1e03df upstream.
+
+During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like
+virtio_balloon reset their underlying virtio devices and delete their
+virtqueues via vdev->config->del_vqs().
+
+However, page reporting work (page_reporting_process) was scheduled on the
+global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM
+freezer skips it, leaving page_reporting_process active during suspend.
+
+If pages are freed into the buddy allocator while suspending (for example,
+when core MM invokes the balloon shrinker during S4 hibernation image
+saving), page reporting triggers virtballoon_free_page_report() on deleted
+virtqueues, resulting in a Use-After-Free / General Protection Fault:
+
+ [ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI
+ [ 196.825967] Workqueue: events page_reporting_process
+ [ 196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring]
+ [ 196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon]
+ [ 196.946943] page_reporting_process+0x370/0x4f0
+
+Fix this by switching page reporting work to system_freezable_wq. This
+ensures that the PM freezer pauses page_reporting_process before device
+drivers destroy their reporting virtqueues. Because the reporting worker
+is frozen, memory reclamation/freeing (e.g. via shrinker execution) can
+safely return pages to MM during freeze without triggering unfrozen
+reporting work on deleted virtqueues.
+
+This aligns with the driver's existing design. The comment in
+virtballoon_freeze() states:
+ /*
+ * The workqueue is already frozen by the PM core before this
+ * function is called.
+ */
+
+Testing:
+I have verified these fixes using Google’s virtualization infrastructure
+by running continuous suspend/resume iterations (40+ cycles) while
+churning memory using stress-ng (`stress-ng --vm 4 --vm-bytes 60%
+--timeout 1`) to constantly create free pages for the buddy allocator. We
+also set the `page_reporting_order` parameter to 0 to make the page
+reporting worker highly sensitive, forcing it to pick up any 4K free
+pages. This confirmed that the UAF crashes are no longer reproducible.
+
+Link: https://lore.kernel.org/20260721005603.1710551-1-linkl@google.com
+Fixes: 36e66c554b5c ("mm: introduce Reported pages")
+Signed-off-by: Link Lin <linkl@google.com>
+Suggested-by: David Hildenbrand (Arm) <david@kernel.org>
+Suggested-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: David Rientjes <rientjes@google.com>
+Acked-by: David Hildenbrand (Arm) <david@kernel.org>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Cc: Alexander Duyck <alexander.duyck@gmail.com>
+Cc: Greg Thelen <gthelen@google.com>
+Cc: James Houghton <jthoughton@google.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Jiaqi Yan <jiaqiyan@google.com>
+Cc: Vlastimil Babka <vbabka@kernel.org>
+Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/page_reporting.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/page_reporting.c
++++ b/mm/page_reporting.c
+@@ -48,7 +48,8 @@ __page_reporting_request(struct page_rep
+ * now we are limiting this to running no more than once every
+ * couple of seconds.
+ */
+- schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY);
++ queue_delayed_work(system_freezable_wq, &prdev->work,
++ PAGE_REPORTING_DELAY);
+ }
+
+ /* notify prdev of free page reporting request */
+@@ -311,7 +312,8 @@ err_out:
+ */
+ state = atomic_cmpxchg(&prdev->state, state, PAGE_REPORTING_IDLE);
+ if (state == PAGE_REPORTING_REQUESTED)
+- schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY);
++ queue_delayed_work(system_freezable_wq, &prdev->work,
++ PAGE_REPORTING_DELAY);
+ }
+
+ static DEFINE_MUTEX(page_reporting_mutex);
--- /dev/null
+From a39789f211b8a4125f0c70e05b30cf715f4f187d Mon Sep 17 00:00:00 2001
+From: Zhiling Zou <zhilinz@nebusec.ai>
+Date: Fri, 24 Jul 2026 00:52:48 +0800
+Subject: net: bridge: stop fast-leave after deleting a port group
+
+From: Zhiling Zou <zhilinz@nebusec.ai>
+
+commit a39789f211b8a4125f0c70e05b30cf715f4f187d upstream.
+
+br_multicast_leave_group() iterates mp->ports with pp = &p->next in
+its fast-leave path. After br_multicast_del_pg() removes p,
+continuing the loop advances pp through the deleted entry.
+
+If multicast-to-unicast was enabled, the bridge can hold multiple port
+groups for the same port and group with different source MAC
+addresses. Once multicast-to-unicast is disabled,
+br_port_group_equal() matches those entries by port only. A fast leave
+can then delete one entry and continue from its stale next pointer,
+leaving mp->ports pointing at a deleted port group.
+
+Fast leave only needs to remove one matching port group. Break after
+br_multicast_del_pg() so the loop stops before dereferencing the
+removed entry.
+
+Fixes: 6db6f0eae605 ("bridge: multicast to unicast")
+Cc: stable@vger.kernel.org
+Reported-by: Vega <vega@nebusec.ai>
+Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
+Signed-off-by: Ren Wei <enjou1224z@gmail.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/1cf0898872ef7c72d5f4c0304414a192c6dac591.1784707712.git.zhilinz@nebusec.ai
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_multicast.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -3511,6 +3511,7 @@ br_multicast_leave_group(struct net_brid
+
+ p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
+ br_multicast_del_pg(mp, p, pp);
++ break;
+ }
+ goto out;
+ }
--- /dev/null
+From 6aea62e433fe1b586202a5fee8b5807ce635e1d7 Mon Sep 17 00:00:00 2001
+From: Zhiling Zou <zhilinz@nebusec.ai>
+Date: Fri, 24 Jul 2026 00:48:52 +0800
+Subject: net: ipv6: clear suppressed fib6 rule result
+
+From: Zhiling Zou <zhilinz@nebusec.ai>
+
+commit 6aea62e433fe1b586202a5fee8b5807ce635e1d7 upstream.
+
+fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
+but leaves res->rt6 pointing at the released rt6_info.
+
+If no later rule supplies a replacement, fib6_rule_lookup() still sees
+res.rt6 and returns that stale dst to its caller. A suppressing rule can
+therefore leak a released route back to rt6_lookup(), and the next put
+hits rcuref_put_slowpath() from dst_release().
+
+Clear res->rt6 when suppressing the route so suppressed lookups fall
+through to the null dst instead of reusing the released one.
+
+Fixes: cdef485217d3 ("ipv6: fix memory leak in fib6_rule_suppress")
+Cc: stable@vger.kernel.org
+Reported-by: Vega <vega@nebusec.ai>
+Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
+Signed-off-by: Ren Wei <enjou1224z@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/4b8acb7787d54e440155585dd32ebdf0bef7d122.1784710966.git.zhilinz@nebusec.ai
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/fib6_rules.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/fib6_rules.c
++++ b/net/ipv6/fib6_rules.c
+@@ -300,6 +300,7 @@ INDIRECT_CALLABLE_SCOPE bool fib6_rule_s
+
+ suppress_route:
+ ip6_rt_put_flags(rt, flags);
++ res->rt6 = NULL;
+ return true;
+ }
+
--- /dev/null
+From a58a2b0ce354df531ebc71fc870058c2feb59f6b Mon Sep 17 00:00:00 2001
+From: Ilya Maximets <i.maximets@ovn.org>
+Date: Mon, 27 Jul 2026 14:10:21 +0200
+Subject: net: openvswitch: fix potential UAF on meter attach failure
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+commit a58a2b0ce354df531ebc71fc870058c2feb59f6b upstream.
+
+While attaching a newly created meter attach_meter() function makes
+the new meter visible to other CPUs but can still fail afterwards.
+On failure, it detaches the meter back and returns an error.
+
+However, this is an unexpected behavior for the ovs_meter_cmd_set()
+that uses a plain kfree(meter) on attach failure without waiting for
+RCU readers to stop using it, assuming it was never visible.
+
+This is never a problem for ovs-vswitchd as it always creates meters
+before creating any flows that use them. But the UAF can be triggered
+with a custom application using uAPI:
+
+ BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653)
+ Read of size 8 at addr ffff88810d152650 by task meter/2508
+
+ Call Trace:
+ ovs_meter_execute (net/openvswitch/meter.c:653)
+ do_execute_actions (net/openvswitch/actions.c:1407)
+ ovs_execute_actions (net/openvswitch/actions.c:1584)
+ ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)
+ ...
+ netlink_sendmsg (af_netlink.c:1900)
+
+ Allocated by task 2519:
+ __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
+ ovs_meter_cmd_set (net/openvswitch/meter.c:422)
+ ...
+ netlink_sendmsg (af_netlink.c:1900)
+
+ Freed by task 2519:
+ kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
+ ovs_meter_cmd_set (net/openvswitch/meter.c:479)
+ ...
+ netlink_sendmsg (af_netlink.c:1900)
+
+Fix that by making sure attach_meter() doesn't make the meter visible
+until all the checks are done and the function can't fail anymore.
+
+This also makes sure the "hash" value is calculated after the potential
+re-sizing of the table.
+
+Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642.
+
+Fixes: c7c4c44c9a95 ("net: openvswitch: expand the meters supported number")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
+Link: https://patch.msgid.link/20260727121022.198461-1-i.maximets@ovn.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/openvswitch/meter.c | 33 +++++++++++++++++++--------------
+ 1 file changed, 19 insertions(+), 14 deletions(-)
+
+--- a/net/openvswitch/meter.c
++++ b/net/openvswitch/meter.c
+@@ -136,18 +136,10 @@ static void dp_meter_instance_remove(str
+
+ static int attach_meter(struct dp_meter_table *tbl, struct dp_meter *meter)
+ {
+- struct dp_meter_instance *ti = rcu_dereference_ovsl(tbl->ti);
+- u32 hash = meter_hash(ti, meter->id);
++ struct dp_meter_instance *ti;
++ u32 hash;
+ int err;
+
+- /* In generally, slots selected should be empty, because
+- * OvS uses id-pool to fetch a available id.
+- */
+- if (unlikely(rcu_dereference_ovsl(ti->dp_meters[hash])))
+- return -EBUSY;
+-
+- dp_meter_instance_insert(ti, meter);
+-
+ /* That function is thread-safe. */
+ tbl->count++;
+ if (tbl->count >= tbl->max_meters_allowed) {
+@@ -155,16 +147,29 @@ static int attach_meter(struct dp_meter_
+ goto attach_err;
+ }
+
+- if (tbl->count >= ti->n_meters &&
+- dp_meter_instance_realloc(tbl, ti->n_meters * 2)) {
+- err = -ENOMEM;
++ ti = rcu_dereference_ovsl(tbl->ti);
++ if (tbl->count >= ti->n_meters) {
++ err = dp_meter_instance_realloc(tbl, ti->n_meters * 2);
++ if (err)
++ goto attach_err;
++
++ ti = rcu_dereference_ovsl(tbl->ti);
++ }
++
++ hash = meter_hash(ti, meter->id);
++
++ /* In general, selected slots should be empty, because
++ * OvS uses id-pool to fetch available ids.
++ */
++ if (unlikely(rcu_dereference_ovsl(ti->dp_meters[hash]))) {
++ err = -EBUSY;
+ goto attach_err;
+ }
+
++ dp_meter_instance_insert(ti, meter);
+ return 0;
+
+ attach_err:
+- dp_meter_instance_remove(ti, meter);
+ tbl->count--;
+ return err;
+ }
--- /dev/null
+From bc62e843bc48f933da765ce47079fd992e535794 Mon Sep 17 00:00:00 2001
+From: Ilya Maximets <i.maximets@ovn.org>
+Date: Mon, 27 Jul 2026 20:18:31 +0200
+Subject: net: openvswitch: fix skb leak on flow key update failure during ct
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+commit bc62e843bc48f933da765ce47079fd992e535794 upstream.
+
+ovs_ct_execute() always steals or frees the skb on failure while
+ovs_flow_key_update() does not. So, if it fails and we return right
+away, the skb ends up leaked.
+
+Fix that by breaking instead and letting the common error handling
+code at the bottom of the loop to free the skb properly.
+
+This is a very unlikely scenario as it requires the packet to become
+unparseable by applying a set of actions on a previously parseable skb,
+but should be fixed nevertheless.
+
+Reported by Sashiko.
+
+Fixes: ec0d043d05e6 ("openvswitch: Ensure flow is valid before executing ct")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Reviewed-by: Aaron Conole <aconole@redhat.com>
+Link: https://patch.msgid.link/20260727181851.306076-3-i.maximets@ovn.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/openvswitch/actions.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -1326,7 +1326,7 @@ static int do_execute_actions(struct dat
+ if (!is_flow_key_valid(key)) {
+ err = ovs_flow_key_update(skb, key);
+ if (err)
+- return err;
++ break;
+ }
+
+ err = ovs_ct_execute(ovs_dp_get_net(dp), skb, key,
--- /dev/null
+From 6cb22477929489a412df8d153e550e77a012e701 Mon Sep 17 00:00:00 2001
+From: Nava kishore Manne <nava.kishore.manne@amd.com>
+Date: Sat, 27 Jun 2026 21:22:27 +0530
+Subject: phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
+
+From: Nava kishore Manne <nava.kishore.manne@amd.com>
+
+commit 6cb22477929489a412df8d153e550e77a012e701 upstream.
+
+The L0_TX_DIG_61 register bit 2 is a reserved read-only field.
+The previous mask value 0x0f incorrectly included bit 2, causing
+unintended writes to a reserved bit on every scrambler bypass
+operation.
+
+Correct the mask to (BIT(3) | GENMASK(1, 0)) to cover only the
+valid scramble bypass control bits.
+
+Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nava kishore Manne <nava.kishore.manne@amd.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260627155229.2791113-2-radhey.shyam.pandey@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/xilinx/phy-zynqmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/xilinx/phy-zynqmp.c
++++ b/drivers/phy/xilinx/phy-zynqmp.c
+@@ -53,7 +53,7 @@
+ #define L0_TM_DIG_6 0x106c
+ #define L0_TM_DIS_DESCRAMBLE_DECODER 0x0f
+ #define L0_TX_DIG_61 0x00f4
+-#define L0_TM_DISABLE_SCRAMBLE_ENCODER 0x0f
++#define L0_TM_DISABLE_SCRAMBLE_ENCODER (BIT(3) | GENMASK(1, 0))
+
+ /* PLL Test Mode register parameters */
+ #define L0_TM_PLL_DIG_37 0x2094
--- /dev/null
+From 7eb61caf45607e1e1270f51f8f93f0ded53146da Mon Sep 17 00:00:00 2001
+From: Nava kishore Manne <nava.kishore.manne@amd.com>
+Date: Sat, 27 Jun 2026 21:22:29 +0530
+Subject: phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
+
+From: Nava kishore Manne <nava.kishore.manne@amd.com>
+
+commit 7eb61caf45607e1e1270f51f8f93f0ded53146da upstream.
+
+USB Gen1 requires scrambling and 8b/10b encoding to be performed in the
+physical layer. Do not bypass PHY-side scrambler or encoder/decoder for
+USB operation, as mandated by the USB 3.x specification.
+
+Scrambler and 8b/10b bypass remain restricted to SATA and SGMII
+modes, where encoding is handled in the controller.
+
+Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nava kishore Manne <nava.kishore.manne@amd.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260627155229.2791113-4-radhey.shyam.pandey@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/xilinx/phy-zynqmp.c | 39 +++++++++++++++++++++++++++++----------
+ 1 file changed, 29 insertions(+), 10 deletions(-)
+
+--- a/drivers/phy/xilinx/phy-zynqmp.c
++++ b/drivers/phy/xilinx/phy-zynqmp.c
+@@ -488,15 +488,30 @@ static void xpsgtr_lane_set_protocol(str
+ }
+ }
+
+-/* Bypass (de)scrambler and 8b/10b decoder and encoder. */
+-static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy)
++/**
++ * xpsgtr_bypass_scrambler_8b10b - Configure scrambler/encoder behavior
++ * @gtr_phy: pointer to lane context
++ * @bypass: true to enable scrambler/encoder bypass (SATA/SGMII),
++ * false to disable scrambler/encoder bypass (USB3)
++ *
++ * Uses RMW to preserve reserved and unrelated register fields.
++ */
++static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy,
++ bool bypass)
+ {
+- xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6,
+- L0_TM_DIS_DESCRAMBLE_DECODER,
+- L0_TM_DIS_DESCRAMBLE_DECODER);
+- xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61,
+- L0_TM_DISABLE_SCRAMBLE_ENCODER,
+- L0_TM_DISABLE_SCRAMBLE_ENCODER);
++ if (bypass) {
++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6,
++ L0_TM_DIS_DESCRAMBLE_DECODER,
++ L0_TM_DIS_DESCRAMBLE_DECODER);
++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61,
++ L0_TM_DISABLE_SCRAMBLE_ENCODER,
++ L0_TM_DISABLE_SCRAMBLE_ENCODER);
++ } else {
++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6,
++ L0_TM_DIS_DESCRAMBLE_DECODER, 0);
++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61,
++ L0_TM_DISABLE_SCRAMBLE_ENCODER, 0);
++ }
+ }
+
+ /* DP-specific initialization. */
+@@ -517,7 +532,7 @@ static void xpsgtr_phy_init_sata(struct
+ {
+ struct xpsgtr_dev *gtr_dev = gtr_phy->dev;
+
+- xpsgtr_bypass_scrambler_8b10b(gtr_phy);
++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, true);
+
+ writel(gtr_phy->lane, gtr_dev->siou + SATA_CONTROL_OFFSET);
+ }
+@@ -533,7 +548,7 @@ static void xpsgtr_phy_init_sgmii(struct
+ xpsgtr_clr_set(gtr_dev, TX_PROT_BUS_WIDTH, mask, val);
+ xpsgtr_clr_set(gtr_dev, RX_PROT_BUS_WIDTH, mask, val);
+
+- xpsgtr_bypass_scrambler_8b10b(gtr_phy);
++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, true);
+ }
+
+ /* Configure TX de-emphasis and margining for DP. */
+@@ -694,6 +709,10 @@ static int xpsgtr_phy_init(struct phy *p
+ case ICM_PROTOCOL_SGMII:
+ xpsgtr_phy_init_sgmii(gtr_phy);
+ break;
++
++ case ICM_PROTOCOL_USB:
++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, false);
++ break;
+ }
+
+ goto out;
--- /dev/null
+From 21e0749f931702765b9d52d05740092bc87fcd8d Mon Sep 17 00:00:00 2001
+From: Nava kishore Manne <nava.kishore.manne@amd.com>
+Date: Sat, 27 Jun 2026 21:22:28 +0530
+Subject: phy: zynqmp: use read-modify-write for SERDES scrambler bypass
+
+From: Nava kishore Manne <nava.kishore.manne@amd.com>
+
+commit 21e0749f931702765b9d52d05740092bc87fcd8d upstream.
+
+xpsgtr_bypass_scrambler_8b10b() used xpsgtr_write_phy() which performs
+a full register write, silently clearing any bits beyond the intended
+bypass control fields.
+
+Switch to xpsgtr_clr_set_phy() with clr=mask, set=mask to set only
+the bypass bits while preserving the remaining bits in each register.
+
+Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nava kishore Manne <nava.kishore.manne@amd.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://patch.msgid.link/20260627155229.2791113-3-radhey.shyam.pandey@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/xilinx/phy-zynqmp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/xilinx/phy-zynqmp.c
++++ b/drivers/phy/xilinx/phy-zynqmp.c
+@@ -491,8 +491,12 @@ static void xpsgtr_lane_set_protocol(str
+ /* Bypass (de)scrambler and 8b/10b decoder and encoder. */
+ static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy)
+ {
+- xpsgtr_write_phy(gtr_phy, L0_TM_DIG_6, L0_TM_DIS_DESCRAMBLE_DECODER);
+- xpsgtr_write_phy(gtr_phy, L0_TX_DIG_61, L0_TM_DISABLE_SCRAMBLE_ENCODER);
++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6,
++ L0_TM_DIS_DESCRAMBLE_DECODER,
++ L0_TM_DIS_DESCRAMBLE_DECODER);
++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61,
++ L0_TM_DISABLE_SCRAMBLE_ENCODER,
++ L0_TM_DISABLE_SCRAMBLE_ENCODER);
+ }
+
+ /* DP-specific initialization. */
--- /dev/null
+From 0bb024f11d120abff3e8db9144a585b9d7fb8459 Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Sat, 11 Jul 2026 15:09:32 +0200
+Subject: powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit 0bb024f11d120abff3e8db9144a585b9d7fb8459 upstream.
+
+If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path
+decrements iopage but keeps using the failed mapping's offset. As a
+result, it repeatedly tries to invalidate the failed IOPTE slot and
+leaves the already installed IOPTEs valid.
+
+Recompute offset and invalidate the installed IOPTEs instead.
+
+Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20260711130931.740719-3-thorsten.blum@linux.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/ps3/mm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/platforms/ps3/mm.c
++++ b/arch/powerpc/platforms/ps3/mm.c
+@@ -616,6 +616,7 @@ static int dma_ioc0_map_pages(struct ps3
+
+ fail_map:
+ for (iopage--; 0 <= iopage; iopage--) {
++ offset = (1 << r->page_size) * iopage;
+ lv1_put_iopte(0,
+ c->bus_addr + offset,
+ c->lpar_addr + offset,
--- /dev/null
+From 9973026f572db6b67570cadc30942f3014e41079 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20H=C3=B6ppner?= <hoeppner@linux.ibm.com>
+Date: Mon, 27 Jul 2026 16:28:39 +0200
+Subject: s390/dasd: Fix potential NULL pointer dereference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Höppner <hoeppner@linux.ibm.com>
+
+commit 9973026f572db6b67570cadc30942f3014e41079 upstream.
+
+dasd_release_space() checks the implementation of the is_ese()
+discipline function before calling it to determine if a given device is
+an ESE DASD.
+
+The current usage of the logical AND operator will lead to a NULL
+pointer dereference as the function is called even if the function
+pointer is NULL.
+
+Fix this by using the logical OR operator.
+
+Fixes: 91dc4a197569 ("s390/dasd: Add new ioctl to release space")
+Cc: stable@vger.kernel.org # v5.3+
+Reported-by: Vasily Gorbik <gor@linux.ibm.com>
+Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
+Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Link: https://patch.msgid.link/20260727142840.567286-3-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd_ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/block/dasd_ioctl.c
++++ b/drivers/s390/block/dasd_ioctl.c
+@@ -330,7 +330,7 @@ out_err:
+ static int dasd_release_space(struct dasd_device *device,
+ struct format_data_t *rdata)
+ {
+- if (!device->discipline->is_ese && !device->discipline->is_ese(device))
++ if (!device->discipline->is_ese || !device->discipline->is_ese(device))
+ return -ENOTSUPP;
+ if (!device->discipline->release_space)
+ return -ENOTSUPP;
--- /dev/null
+From d211028bac1bd0fff0026bfa2a8328e5b78cd0e6 Mon Sep 17 00:00:00 2001
+From: Aswin Karuvally <aswin@linux.ibm.com>
+Date: Thu, 23 Jul 2026 16:00:50 +0200
+Subject: s390/qeth: Check CAP_NET_ADMIN for private ioctls
+
+From: Aswin Karuvally <aswin@linux.ibm.com>
+
+commit d211028bac1bd0fff0026bfa2a8328e5b78cd0e6 upstream.
+
+Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,
+SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN
+capable check to ensure unprivileged users cannot invoke them.
+
+Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate")
+Cc: stable@vger.kernel.org
+Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
+Link: https://patch.msgid.link/20260723140050.762991-1-aswin@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/net/qeth_core_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -6609,6 +6609,9 @@ int qeth_siocdevprivate(struct net_devic
+ struct qeth_card *card = dev->ml_priv;
+ int rc = 0;
+
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++
+ switch (cmd) {
+ case SIOC_QETH_ADP_SET_SNMP_CONTROL:
+ rc = qeth_snmp_command(card, data);
--- /dev/null
+From 06afe425d5283b9764303de47f554da5a808ce8a Mon Sep 17 00:00:00 2001
+From: Holger Dengler <dengler@linux.ibm.com>
+Date: Wed, 29 Jul 2026 11:36:15 +0200
+Subject: s390/zcrypt: Validate length for CCA AES cipher key requests
+
+From: Holger Dengler <dengler@linux.ibm.com>
+
+commit 06afe425d5283b9764303de47f554da5a808ce8a upstream.
+
+cca_cipher2protkey() derives the copy length for the CPRB parameter
+block directly from the length field in the key token. Reject the
+request early if the token length exceeds the available space in the
+parameter block.
+
+Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys")
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Cc: stable@vger.kernel.org # 5.4+
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -1232,6 +1232,9 @@ int cca_cipher2protkey(u16 cardnr, u16 d
+ } __packed * prepparm;
+ int keytoklen = ((struct cipherkeytoken *)ckey)->len;
+
++ if (keytoklen > PARMBSIZE - sizeof(struct aureqparm))
++ return -EINVAL;
++
+ /* get already prepared memory for 2 cprbs with param block each */
+ rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
+ if (rc)
--- /dev/null
+From a9ae0f6dd45c3ccc1d69363f7aea8af179122730 Mon Sep 17 00:00:00 2001
+From: Holger Dengler <dengler@linux.ibm.com>
+Date: Wed, 29 Jul 2026 11:36:16 +0200
+Subject: s390/zcrypt: Validate length for CCA ECC private key requests
+
+From: Holger Dengler <dengler@linux.ibm.com>
+
+commit a9ae0f6dd45c3ccc1d69363f7aea8af179122730 upstream.
+
+cca_ecc2protkey() derives the copy length for the CPRB parameter
+block directly from the length field in the key token. Reject the
+request early if the token length exceeds the available space in the
+parameter block.
+
+Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys")
+Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
+Cc: stable@vger.kernel.org # 5.10+
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -1404,6 +1404,9 @@ int cca_ecc2protkey(u16 cardnr, u16 doma
+ } __packed * prepparm;
+ int keylen = ((struct eccprivkeytoken *)key)->len;
+
++ if (keylen > PARMBSIZE - sizeof(struct aureqparm))
++ return -EINVAL;
++
+ /* get already prepared memory for 2 cprbs with param block each */
+ rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
+ if (rc)
--- /dev/null
+From bd0e9289e2642f6a5c54faad304ce0f41e926d22 Mon Sep 17 00:00:00 2001
+From: Asim Viladi Oglu Manizada <manizada@pm.me>
+Date: Sat, 25 Jul 2026 03:21:06 +0000
+Subject: sctp: prevent peer transport count overflow
+
+From: Asim Viladi Oglu Manizada <manizada@pm.me>
+
+commit bd0e9289e2642f6a5c54faad304ce0f41e926d22 upstream.
+
+sctp_assoc_add_peer() increments the association's 16-bit transport_count
+for every new unique peer. Adding the 65,536th transport wraps the count to
+zero.
+
+SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
+then copies one sockaddr_storage for every entry in transport_addr_list.
+After the wrap, a diagnostic dump reserves an empty payload and writes
+8 MiB of peer addresses past the skb tail.
+
+Reject a new unique peer when transport_count has reached U16_MAX. Perform
+the check after the existing-peer lookup so a duplicate address continues
+to return its existing transport at the limit.
+
+Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
+Cc: stable@vger.kernel.org
+Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/20260725032053.521705-1-manizada@pm.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/associola.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -616,6 +616,9 @@ struct sctp_transport *sctp_assoc_add_pe
+ return peer;
+ }
+
++ if (asoc->peer.transport_count == U16_MAX)
++ return NULL;
++
+ peer = sctp_transport_new(asoc->base.net, addr, gfp);
+ if (!peer)
+ return NULL;
--- /dev/null
+From 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 Mon Sep 17 00:00:00 2001
+From: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Date: Thu, 23 Jul 2026 22:56:23 +0000
+Subject: sctp: reject stale cookies with mismatched verification tags
+
+From: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+
+commit 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 upstream.
+
+sctp_unpack_cookie() skips cookie expiration checks whenever an
+association already exists. This is broader than the exception in
+RFC 9260 Section 5.2.4.
+
+For an existing association, Section 5.2.4 permits an expired State
+Cookie only when both Verification Tags in the cookie match the current
+association. Otherwise, the packet SHOULD be discarded and a Stale
+Cookie ERROR MUST be sent.
+
+The broad check lets an expired Action A restart cookie reach
+sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second
+cookie lifetime, replaying such a cookie after 65 seconds returned a
+COOKIE-ACK and restarted the association.
+
+Check cookie expiration unless both Verification Tags match. This
+preserves the Action D exception for a lost COOKIE ACK while rejecting
+expired cookies in all other cases.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/20260723225623.2658868-1-yangyx22@mails.tsinghua.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/sm_make_chunk.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -1821,9 +1821,9 @@ no_hmac:
+ goto fail;
+ }
+
+- /* Check to see if the cookie is stale. If there is already
+- * an association, there is no need to check cookie's expiration
+- * for init collision case of lost COOKIE ACK.
++ /* Check to see if the cookie is stale. RFC 9260 Section 5.2.4
++ * exempts an expired cookie only when both Verification Tags match
++ * the current association.
+ * If skb has been timestamped, then use the stamp, otherwise
+ * use current time. This introduces a small possibility that
+ * a cookie may be considered expired, but this would only slow
+@@ -1834,7 +1834,10 @@ no_hmac:
+ else
+ kt = ktime_get_real();
+
+- if (!asoc && ktime_before(bear_cookie->expiration, kt)) {
++ if ((!asoc ||
++ asoc->c.my_vtag != bear_cookie->my_vtag ||
++ asoc->c.peer_vtag != bear_cookie->peer_vtag) &&
++ ktime_before(bear_cookie->expiration, kt)) {
+ suseconds_t usecs = ktime_to_us(ktime_sub(kt, bear_cookie->expiration));
+ __be32 n = htonl(usecs);
+
--- /dev/null
+From 8f6f9fd93cd7a5dd607ad5cd910476dd68fff3ed Mon Sep 17 00:00:00 2001
+From: Chris Gellermann <christian.gellermann@codasip.com>
+Date: Wed, 22 Jul 2026 15:02:45 +0200
+Subject: selftests/clone3: fix wild pointer access of getline due to missing init
+
+From: Chris Gellermann <christian.gellermann@codasip.com>
+
+commit 8f6f9fd93cd7a5dd607ad5cd910476dd68fff3ed upstream.
+
+Patch series "selftests: Add missing initalization of pointer passed to
+getline", v2.
+
+
+This patch (of 2):
+
+Clone3_set_tid uses getline(&line, ...) in a loop to read the child's
+process status. The code expects that getline allocates the buffer for
+the line on the first loop iteration. According to the Open Group
+Spec[1], char *line has to be null pointer for this:
+
+> ssize_t getline(char **restrict lineptr, ...);
+> If *lineptr is a null pointer or if the object pointed to by *lineptr
+> is of insufficient size, an object shall be allocated as if by
+malloc()
+> or the object shall be reallocated as if by realloc()[...].
+
+However, char *line is only declared, leading to an undefined value that
+is potentially non-null. In an example run with Musl v1.2.6, the realloc
+call[2] of getdelim, which implements getline, triggers a segfault:
+
+./run_kselftest.sh --test clone3:clone3_set_tid
+[ 1366.165898] kselftest: Running tests in clone3
+...
+[ 1367.799244] clone3_set_tid[811]: unhandled signal 11 code 0x1 at
+0x0000000000000000 in libc.so[68184,3fbf69f000+4c000]
+[ 1367.802808] CPU: 0 UID: 0 PID: 811 Comm: clone3_set_tid Not tainted
+..
+[ 1367.804188] epc: 0x0000003fbf6b0184
+[ 1367.804188] ra : 0x0000003fbf6d4664
+[ 1367.804188] sp : 0x0000003fce5f2e40
+[ 1367.805314] gp : 0x0000002aaab0dfb8
+[ 1367.805314] tp : 0x0000003fbf6f14a8
+[ 1367.805314] t0 : 0x0000003fbf63d000
+...
+
+Looking at the realloc implementation, Musl mallocs for a null pointer
+memory. But for a non-null pointer, it assumes it's passed a valid
+pointer to the heap and tries to access its meta-data. This leads to the
+segfault we see:
+
+void *realloc(void *p, size_t n)
+{
+ if (!p) return malloc(n);
+ if (size_overflows(n)) return 0;
+
+ struct meta *g = get_meta(p);
+ ...
+}
+
+Fix this by properly initializing the line pointer to NULL.
+
+Link: https://lore.kernel.org/20260722130246.2135563-1-christian.gellermann@codasip.com
+Link: https://lore.kernel.org/20260722130246.2135563-2-christian.gellermann@codasip.com
+Link: https://pubs.opengroup.org/onlinepubs/9799919799/functions/getline.html [1]
+Link: https://git.musl-libc.org/cgit/musl/tree/src/stdio/getdelim.c#n38 [2]
+Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid")
+Signed-off-by: Chris Gellermann <christian.gellermann@codasip.com>
+Acked-by: David Hildenbrand (arm) <david@kernel.org>
+Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Liam R. Howlett <liam@infradead.org>
+Cc: Lorenzo Stoakes <ljs@kernel.org>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Vlastimil Babka <vbabka@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/clone3/clone3_set_tid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/clone3/clone3_set_tid.c
++++ b/tools/testing/selftests/clone3/clone3_set_tid.c
+@@ -146,7 +146,7 @@ int main(int argc, char *argv[])
+ {
+ FILE *f;
+ char buf;
+- char *line;
++ char *line = NULL;
+ int status;
+ int ret = -1;
+ size_t len = 0;
tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch
wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch
binfmt_misc-reject-a-flag-character-as-the-field-delimiter.patch
+mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch
+net-bridge-stop-fast-leave-after-deleting-a-port-group.patch
+net-ipv6-clear-suppressed-fib6-rule-result.patch
+powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch
+um-vector-fix-use-after-free-in-vector_mmsg_rx.patch
+vxlan-re-fetch-eth-header-after-route_shortcircuit.patch
+vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch
+vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch
+vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch
+tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch
+tracing-filters-fix-false-positive-match-in-regex_match_full.patch
+selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch
+sctp-reject-stale-cookies-with-mismatched-verification-tags.patch
+sctp-prevent-peer-transport-count-overflow.patch
+hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch
+i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch
+cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch
+s390-qeth-check-cap_net_admin-for-private-ioctls.patch
+s390-dasd-fix-potential-null-pointer-dereference.patch
+s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch
+s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch
+phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch
+phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch
+phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch
+net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch
+net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch
+i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch
+i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch
--- /dev/null
+From ac8719969e6c3c54e939834df812bc41f25453cf Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Wed, 29 Jul 2026 09:27:58 +0900
+Subject: tracing: Check return value of __register_event() in trace_module_add_events()
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit ac8719969e6c3c54e939834df812bc41f25453cf upstream.
+
+trace_module_add_events() ignores the return value of __register_event()
+and unconditionally calls __add_event_to_tracers() for each event.
+
+If __register_event() fails (for example, if event_init() fails), the
+trace_event_call is not added to ftrace_events list, but
+__add_event_to_tracers() still creates a trace_event_file pointing to it.
+If module loading subsequently fails and module memory is freed, tracing
+state retains a stale trace_event_call pointer in trace_event_file,
+leading to a use-after-free when tracefs or tracing subsystem operations
+are later executed.
+
+Fix this by checking the return value of __register_event() and only
+calling __add_event_to_tracers() if event registration succeeded.
+
+Fixes: ae63b31e4d0e ("tracing: Separate out trace events from global variables")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/178528487878.124250.14170824576025743236.stgit@devnote2
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -3089,8 +3089,8 @@ static void trace_module_add_events(stru
+ end = mod->trace_events + mod->num_trace_events;
+
+ for_each_event(call, start, end) {
+- __register_event(*call, mod);
+- __add_event_to_tracers(*call);
++ if (!__register_event(*call, mod))
++ __add_event_to_tracers(*call);
+ }
+ }
+
--- /dev/null
+From c22c7b735f9810ad276014f788f9aa5c879ec238 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Wed, 29 Jul 2026 09:28:07 +0900
+Subject: tracing/filters: Fix false positive match in regex_match_full()
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit c22c7b735f9810ad276014f788f9aa5c879ec238 upstream.
+
+regex_match_full() calls strncmp(str, r->pattern, len) where len is the
+target field buffer size. When len is smaller than r->len (the filter
+pattern length), strncmp() checks only len bytes of r->pattern against
+str. If those len bytes match, strncmp() returns 0, resulting in a
+false-positive match where a shorter string in a fixed-size field
+matches a longer filter pattern.
+
+For example, a 4-byte static string field containing "abcd" matched the
+filter pattern "abcdefgh" because strncmp("abcd", "abcdefgh", 4)
+returned 0. In this case, @len does NOT include '\0' because it is
+fixed-size array.
+
+Fix this by returning 0 (no match) early when len < r->len.
+
+Fixes: 1889d20922d1 ("tracing/filters: Provide basic regex support")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/178528488779.124250.5571741156199253769.stgit@devnote2
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events_filter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -836,6 +836,9 @@ static int regex_match_full(char *str, s
+ if (!len)
+ return strcmp(str, r->pattern) == 0;
+
++ if (len < r->len)
++ return 0;
++
+ return strncmp(str, r->pattern, len) == 0;
+ }
+
--- /dev/null
+From af421e9aed3920c7ac88c24daa48606c7112feca Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Mon, 22 Jun 2026 08:47:22 -0400
+Subject: um: vector: fix use-after-free in vector_mmsg_rx()
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit af421e9aed3920c7ac88c24daa48606c7112feca upstream.
+
+When vector_mmsg_rx() discards a packet whose overlay header fails
+verify_header(), it frees the skb and continues the loop:
+
+ if (header_check < 0) {
+ dev_kfree_skb_irq(skb);
+ vp->estats.rx_encaps_errors++;
+ continue;
+ }
+
+The normal and short-packet paths fall through to the bottom of the
+loop body, which clears the consumed slot and advances the cursors:
+
+ (*skbuff_vector) = NULL;
+ mmsg_vector++;
+ skbuff_vector++;
+
+The verify_header() < 0 path skips that via continue, so the freed skb
+is left in skbuff_vector[] and the cursors do not advance. The next
+iteration reads the same slot, gets the freed skb, and frees it again,
+producing a refcount underflow / use-after-free in the RX path.
+
+Discard the slot the same way the other paths do before continuing.
+
+Only transports whose verify_header() can return negative are affected:
+GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not),
+so any peer on such a transport can trigger it without authentication.
+
+Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/um/drivers/vector_kern.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/um/drivers/vector_kern.c
++++ b/arch/um/drivers/vector_kern.c
+@@ -1007,6 +1007,9 @@ static int vector_mmsg_rx(struct vector_
+ */
+ dev_kfree_skb_irq(skb);
+ vp->estats.rx_encaps_errors++;
++ (*skbuff_vector) = NULL;
++ mmsg_vector++;
++ skbuff_vector++;
+ continue;
+ }
+ if (header_check > 0) {
--- /dev/null
+From 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 23 Jul 2026 14:42:45 +0000
+Subject: vxlan: re-fetch eth header after route_shortcircuit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 upstream.
+
+Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).
+
+Inside route_shortcircuit(), pskb_may_pull() can be called, which may
+reallocate skb->head.
+
+In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to
+freed memory, leading to a use-after-free when dereferencing eth->h_dest.
+
+Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
+
+Fixes: ae8840825605 ("VXLAN: Allow L2 redirection with L3 switching")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20260723144249.759100-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -2941,6 +2941,7 @@ static netdev_tx_t vxlan_xmit(struct sk_
+ (ntohs(eth->h_proto) == ETH_P_IP ||
+ ntohs(eth->h_proto) == ETH_P_IPV6)) {
+ did_rsc = route_shortcircuit(dev, skb);
++ eth = eth_hdr(skb);
+ if (did_rsc)
+ f = vxlan_find_mac(vxlan, eth->h_dest, vni);
+ }
--- /dev/null
+From 760d36e737f2b3867762f42af36c663f55babcc4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 23 Jul 2026 14:42:46 +0000
+Subject: vxlan: unclone skb head before modifying eth header in route_shortcircuit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 760d36e737f2b3867762f42af36c663f55babcc4 upstream.
+
+When route_shortcircuit() performs L3 short-circuit routing, it modifies
+the Ethernet header of the skb in-place:
+ memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, dev->addr_len);
+ memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len);
+
+If the incoming skb is cloned (for example by packet sockets, tcpdump, or
+dev_queue_xmit), modifying the Ethernet header without uncloning can corrupt
+the packet header for other readers holding a reference to the cloned skb.
+
+Ensure the skb header is writable and unshared by calling skb_cow_head(skb, 0)
+prior to updating the Ethernet header. If skb_cow_head() fails, abort short-circuiting
+and return false to allow standard packet processing fallback.
+
+Fixes: e4f67addf158 ("add DOVE extensions for VXLAN")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260723144249.759100-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -2292,6 +2292,10 @@ static bool route_shortcircuit(struct ne
+
+ diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha);
+ if (diff) {
++ if (skb_cow_head(skb, 0)) {
++ neigh_release(n);
++ return false;
++ }
+ memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
+ dev->addr_len);
+ memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len);
--- /dev/null
+From 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 23 Jul 2026 14:42:47 +0000
+Subject: vxlan: use neigh_ha_snapshot() in route_shortcircuit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d upstream.
+
+The neighbour hardware address n->ha can be updated asynchronously by the
+neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without
+holding the seqlock loop can lead to torn reads or reading a partially updated
+MAC address.
+
+Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under
+read_seqbegin()/read_seqretry() lock protection before using it.
+
+Note that arp_reduce() and neigh_reduce() seem to have the same issue
+left for future patches.
+
+Fixes: e4f67addf158 ("add DOVE extensions for VXLAN")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20260723144249.759100-4-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -2288,9 +2288,11 @@ static bool route_shortcircuit(struct ne
+ }
+
+ if (n) {
++ u8 haddr[ETH_ALEN];
+ bool diff;
+
+- diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha);
++ neigh_ha_snapshot(haddr, n, dev);
++ diff = !ether_addr_equal_unaligned(eth_hdr(skb)->h_dest, haddr);
+ if (diff) {
+ if (skb_cow_head(skb, 0)) {
+ neigh_release(n);
+@@ -2298,7 +2300,7 @@ static bool route_shortcircuit(struct ne
+ }
+ memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
+ dev->addr_len);
+- memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len);
++ memcpy(eth_hdr(skb)->h_dest, haddr, dev->addr_len);
+ }
+ neigh_release(n);
+ return diff;
--- /dev/null
+From 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 23 Jul 2026 14:42:48 +0000
+Subject: vxlan: use pskb_network_may_pull() in route_shortcircuit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb upstream.
+
+route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))
+(or ipv6hdr), which checks if bytes are available starting from skb->data.
+
+However, in vxlan_xmit(), skb->data points to the MAC header, so
+skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)
+only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of
+IP header), leaving the rest of the IP header potentially un-pulled in non-linear
+frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled
+linear buffer length.
+
+Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to
+the length check to ensure the full network header is present in the linear buffer.
+
+Fixes: e4f67addf158 ("add DOVE extensions for VXLAN")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20260723144249.759100-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -2240,7 +2240,7 @@ static bool route_shortcircuit(struct ne
+ {
+ struct iphdr *pip;
+
+- if (!pskb_may_pull(skb, sizeof(struct iphdr)))
++ if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
+ return false;
+ pip = ip_hdr(skb);
+ n = neigh_lookup(&arp_tbl, &pip->daddr, dev);
+@@ -2266,7 +2266,7 @@ static bool route_shortcircuit(struct ne
+ */
+ if (!ipv6_stub->nd_tbl)
+ return false;
+- if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
++ if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
+ return false;
+ pip6 = ipv6_hdr(skb);
+ n = neigh_lookup(ipv6_stub->nd_tbl, &pip6->daddr, dev);
projects / thirdparty / kernel / stable-queue.git / commitdiff
