--- /dev/null
+From 86f436567f2516a0083b210bedc933544826a2c3 Mon Sep 17 00:00:00 2001
+From: Bradley Morgan <include@grrlz.net>
+Date: Fri, 19 Jun 2026 16:37:18 +0000
+Subject: cpu: hotplug: Bound hotplug states sysfs output
+
+From: Bradley Morgan <include@grrlz.net>
+
+commit 86f436567f2516a0083b210bedc933544826a2c3 upstream.
+
+states_show() adds CPU hotplug state names into a single sysfs buffer
+using sprintf(). With enough registered states, this can write past the
+end of the PAGE_SIZE buffer.
+
+Use sysfs_emit_at() so output is bounded.
+
+Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface")
+Signed-off-by: Bradley Morgan <include@grrlz.net>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cpu.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2854,21 +2854,17 @@ static const struct attribute_group cpuh
+ .name = "hotplug",
+ };
+
+-static ssize_t states_show(struct device *dev,
+- struct device_attribute *attr, char *buf)
++static ssize_t states_show(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+- ssize_t cur, res = 0;
++ ssize_t res = 0;
+ int i;
+
+ mutex_lock(&cpuhp_state_mutex);
+ for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) {
+ struct cpuhp_step *sp = cpuhp_get_step(i);
+
+- if (sp->name) {
+- cur = sprintf(buf, "%3d: %s\n", i, sp->name);
+- buf += cur;
+- res += cur;
+- }
++ if (sp->name)
++ res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name);
+ }
+ mutex_unlock(&cpuhp_state_mutex);
+ return res;
--- /dev/null
+From 673db10729fb121ea1b16fe57791a0cb9eac1eb5 Mon Sep 17 00:00:00 2001
+From: Bradley Morgan <include@grrlz.net>
+Date: Fri, 19 Jun 2026 16:37:17 +0000
+Subject: cpu: hotplug: Preserve per instance callback errors
+
+From: Bradley Morgan <include@grrlz.net>
+
+commit 673db10729fb121ea1b16fe57791a0cb9eac1eb5 upstream.
+
+cpuhp_invoke_callback() unwinds earlier callbacks for the same
+hotplug state when one instance fails. The rollback path currently
+reuses ret, so a successful rollback can hide the original error and
+make the failed transition look successful.
+
+Keep the rollback result separate from the original error.
+
+Fixes: 724a86881d03 ("smp/hotplug: Callback vs state-machine consistency")
+Signed-off-by: Bradley Morgan <include@grrlz.net>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260619163719.12103-1-include@grrlz.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cpu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -174,7 +174,7 @@ static int cpuhp_invoke_callback(unsigne
+ struct cpuhp_step *step = cpuhp_get_step(state);
+ int (*cbm)(unsigned int cpu, struct hlist_node *node);
+ int (*cb)(unsigned int cpu);
+- int ret, cnt;
++ int ret, cnt, rollback_ret;
+
+ if (st->fail == state) {
+ st->fail = CPUHP_INVALID;
+@@ -238,12 +238,12 @@ err:
+ break;
+
+ trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
+- ret = cbm(cpu, node);
+- trace_cpuhp_exit(cpu, st->state, state, ret);
++ rollback_ret = cbm(cpu, node);
++ trace_cpuhp_exit(cpu, st->state, state, rollback_ret);
+ /*
+ * Rollback must not fail,
+ */
+- WARN_ON_ONCE(ret);
++ WARN_ON_ONCE(rollback_ret);
+ }
+ return ret;
+ }
--- /dev/null
+From 9a6c0b6ea12746d50cf53d59a7e05fd83f974bda Mon Sep 17 00:00:00 2001
+From: Paul Louvel <paul.louvel@bootlin.com>
+Date: Mon, 29 Jun 2026 16:07:02 +0200
+Subject: gpio-f7188x: Add support for NCT6126D version B
+
+From: Paul Louvel <paul.louvel@bootlin.com>
+
+commit 9a6c0b6ea12746d50cf53d59a7e05fd83f974bda upstream.
+
+The Nuvoton NCT6126D Super-I/O is available in two hardware revisions.
+According to the manufacturer datasheet revision 2.4, version A reports
+chip ID 0xD283, while version B reports chip ID 0xD284.
+
+The driver currently only recognizes only the version A ID. Version B
+only contains hardware fixes unrelated to the GPIO functionality, so it
+can be supported by simply adding its chip ID without any other driver
+changes.
+
+Fixes: 3002b8642f01 ("gpio-f7188x: fix chip name and pin count on Nuvoton chip")
+Cc: stable@vger.kernel.org
+
+Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
+Link: https://patch.msgid.link/20260629-gpio-f7188x-nct6126d-version-b-v1-1-a06226c02a2d@bootlin.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-f7188x.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpio-f7188x.c
++++ b/drivers/gpio/gpio-f7188x.c
+@@ -48,7 +48,8 @@
+ /*
+ * Nuvoton devices.
+ */
+-#define SIO_NCT6126D_ID 0xD283 /* NCT6126D chipset ID */
++#define SIO_NCT6126D_VER_A_ID 0xD283 /* NCT6126D version A chipset ID */
++#define SIO_NCT6126D_VER_B_ID 0xD284 /* NCT6126D version B chipset ID */
+
+ #define SIO_LD_GPIO_NUVOTON 0x07 /* GPIO logical device */
+
+@@ -564,7 +565,8 @@ static int __init f7188x_find(int addr,
+ case SIO_F81865_ID:
+ sio->type = f81865;
+ break;
+- case SIO_NCT6126D_ID:
++ case SIO_NCT6126D_VER_A_ID:
++ case SIO_NCT6126D_VER_B_ID:
+ sio->device = SIO_LD_GPIO_NUVOTON;
+ sio->type = nct6126d;
+ break;
--- /dev/null
+From 1781172526d1092323af443fa03f00e6de560401 Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Fri, 26 Jun 2026 08:01:09 +0200
+Subject: gpio: mt7621: avoid corruption of shared interrupt trigger state
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+commit 1781172526d1092323af443fa03f00e6de560401 upstream.
+
+The bank-shared fields like 'rising' and 'falling' are modified using
+non-atomic read-modify-write operations. Since every gpio chip instance
+represents an entire bank of 32 pins, if 'mediatek_gpio_irq_type()' is
+called concurrently for different IRQs on the same bank a possible overwrite
+of each other's configuration is possible. Thus, protect this state with
+'gpio_generic_lock_irqsave' lock in the same way it is handled in irp_chip
+'mediatek_gpio_irq_mask()' and 'mediatek_gpio_irq_unmask()' callbacks.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://patch.msgid.link/20260626060112.2498324-2-sergio.paracuellos@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-mt7621.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpio/gpio-mt7621.c
++++ b/drivers/gpio/gpio-mt7621.c
+@@ -187,6 +187,8 @@ mediatek_gpio_irq_type(struct irq_data *
+ struct mtk_gc *rg = gpiochip_get_data(gc);
+ u32 mask = BIT(mt7621_gpio_hwirq_to_offset(d->hwirq, rg));
+
++ guard(gpio_generic_lock_irqsave)(&rg->chip);
++
+ if (type == IRQ_TYPE_PROBE) {
+ if ((rg->rising | rg->falling |
+ rg->hlevel | rg->llevel) & mask)
--- /dev/null
+From 0e024f58291dfcb28d98c512002e1a80fad69798 Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Fri, 26 Jun 2026 08:01:11 +0200
+Subject: gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+commit 0e024f58291dfcb28d98c512002e1a80fad69798 upstream.
+
+Function 'mediatek_gpio_bank_probe()' registers three GPIO chips using
+'devm_gpiochip_add_data()'. At this point, the chips become live and visible
+to consumers. However, the IRQ domain isn't allocated and set up until
+'mt7621_gpio_irq_setup()' is called after the GPIO chips setup finishes.
+If a consumer requests a GPIO IRQ concurrently 'mt7621_gpio_to_irq()' can
+be called and pass a NULL irq domain pointer irq_create_mapping(), that can
+corrupt the mappings or cause a crash. Fix this possible problem seting up
+irq domain before GPIO chips setup is performed.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: a46f2e5720f5 ("gpio: mt7621: fix interrupt banks mapping on gpio chips")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://patch.msgid.link/20260626060112.2498324-4-sergio.paracuellos@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-mt7621.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpio/gpio-mt7621.c
++++ b/drivers/gpio/gpio-mt7621.c
+@@ -464,12 +464,6 @@ mediatek_gpio_probe(struct platform_devi
+ mtk->num_gpios = MTK_BANK_WIDTH * MTK_BANK_CNT;
+ platform_set_drvdata(pdev, mtk);
+
+- for (i = 0; i < MTK_BANK_CNT; i++) {
+- ret = mediatek_gpio_bank_probe(dev, i);
+- if (ret)
+- return ret;
+- }
+-
+ if (mtk->gpio_irq > 0) {
+ ret = mt7621_gpio_irq_setup(pdev, mtk);
+ if (ret)
+@@ -480,6 +474,12 @@ mediatek_gpio_probe(struct platform_devi
+ if (ret)
+ return ret;
+
++ for (i = 0; i < MTK_BANK_CNT; i++) {
++ ret = mediatek_gpio_bank_probe(dev, i);
++ if (ret)
++ return ret;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From 839738536adabae1a7e98ed3fc332ce9cc991d27 Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Fri, 26 Jun 2026 08:01:10 +0200
+Subject: gpio: mt7621: more robust management of IRQ domain teardown
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+commit 839738536adabae1a7e98ed3fc332ce9cc991d27 upstream.
+
+The driver uses devm_gpiochip_add_data() to register the GPIO chips which
+means the devres subsystem will unregister them only after the function
+'mt7621_gpio_remove()' returns. During the window between domain destruction
+and devres unregistering the GPIO chips, the chips are still fully active.
+If a consumer or userspace invokes gpiod_to_irq() during this window,
+'mt7621_gpio_to_irq()' can dereference the already-freed irq domain pointer.
+Thus, manage the IRQ domain teardown using 'devm_add_action_or_reset()' to
+guarantee it is destroyed strictly after the GPIO chips are removed.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Fixes: a46f2e5720f5 ("gpio: mt7621: fix interrupt banks mapping on gpio chips")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://patch.msgid.link/20260626060112.2498324-3-sergio.paracuellos@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-mt7621.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpio/gpio-mt7621.c
++++ b/drivers/gpio/gpio-mt7621.c
+@@ -270,9 +270,9 @@ static const struct irq_chip mt7621_irq_
+ };
+
+ static void
+-mt7621_gpio_remove(struct platform_device *pdev)
++mt7621_gpio_remove(void *data)
+ {
+- struct mtk *priv = platform_get_drvdata(pdev);
++ struct mtk *priv = data;
+ int offset, virq;
+
+ if (priv->gpio_irq > 0)
+@@ -473,14 +473,14 @@ mediatek_gpio_probe(struct platform_devi
+ if (mtk->gpio_irq > 0) {
+ ret = mt7621_gpio_irq_setup(pdev, mtk);
+ if (ret)
+- goto fail;
++ return ret;
+ }
+
+- return 0;
++ ret = devm_add_action_or_reset(dev, mt7621_gpio_remove, mtk);
++ if (ret)
++ return ret;
+
+-fail:
+- mt7621_gpio_remove(pdev);
+- return ret;
++ return 0;
+ }
+
+ static const struct of_device_id mediatek_gpio_match[] = {
+@@ -491,7 +491,6 @@ MODULE_DEVICE_TABLE(of, mediatek_gpio_ma
+
+ static struct platform_driver mediatek_gpio_driver = {
+ .probe = mediatek_gpio_probe,
+- .remove = mt7621_gpio_remove,
+ .driver = {
+ .name = "mt7621_gpio",
+ .of_match_table = mediatek_gpio_match,
--- /dev/null
+From d3e91a95b2b0fc6336dbf3ec90d831a1654d2720 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Fri, 19 Jun 2026 23:24:39 +0800
+Subject: gpio: tegra: do not call pinctrl for GPIO direction
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit d3e91a95b2b0fc6336dbf3ec90d831a1654d2720 upstream.
+
+tegra_gpio_direction_input() and tegra_gpio_direction_output() already
+program the GPIO controller direction registers directly. The additional
+pinctrl_gpio_direction_input/output() calls do not add a Tegra pinctrl
+operation, because the Tegra pinmux ops provide GPIO request/free
+handling but no gpio_set_direction hook.
+
+The extra call still enters the pinctrl core and takes pctldev->mutex.
+Shared GPIO users can call the direction path while holding their
+per-line spinlock, so this otherwise redundant pinctrl direction call can
+sleep in an atomic context.
+
+This was found by our static analysis tool and then confirmed by manual
+review of tegra_gpio_probe(), the Tegra GPIO direction callbacks and the
+Tegra pinctrl ops. The reviewed path has a default non-sleeping
+struct gpio_chip while the direction callback still enters the pinctrl
+mutex path.
+
+A directed runtime validation kept the same non-sleeping chip registration
+and drove:
+
+ gpio_shared_proxy_direction_output()
+ gpiod_direction_output_raw_commit()
+ tegra_gpio_direction_output()
+ pinctrl_gpio_direction_output()
+
+Lockdep reported a sleep-in-atomic warning with the shared GPIO spinlock
+held and pinctrl_get_device_gpio_range() plus tegra_gpio_direction_output()
+on the stack.
+
+Do not mark the whole chip as can_sleep to paper over this: can_sleep
+describes whether get()/set() may sleep, and Tegra value access is MMIO.
+Remove the redundant pinctrl direction calls and keep pinctrl involvement
+in the existing request/free path.
+
+Fixes: 11da90541283 ("gpio: tegra: Fix offset of pinctrl calls")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Link: https://patch.msgid.link/20260619152439.1239561-1-runyu.xiao@seu.edu.cn
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-tegra.c | 18 ++----------------
+ 1 file changed, 2 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpio/gpio-tegra.c
++++ b/drivers/gpio/gpio-tegra.c
+@@ -172,18 +172,11 @@ static int tegra_gpio_direction_input(st
+ unsigned int offset)
+ {
+ struct tegra_gpio_info *tgi = gpiochip_get_data(chip);
+- int ret;
+
+ tegra_gpio_mask_write(tgi, GPIO_MSK_OE(tgi, offset), offset, 0);
+ tegra_gpio_enable(tgi, offset);
+
+- ret = pinctrl_gpio_direction_input(chip, offset);
+- if (ret < 0)
+- dev_err(tgi->dev,
+- "Failed to set pinctrl input direction of GPIO %d: %d",
+- chip->base + offset, ret);
+-
+- return ret;
++ return 0;
+ }
+
+ static int tegra_gpio_direction_output(struct gpio_chip *chip,
+@@ -191,19 +184,12 @@ static int tegra_gpio_direction_output(s
+ int value)
+ {
+ struct tegra_gpio_info *tgi = gpiochip_get_data(chip);
+- int ret;
+
+ tegra_gpio_set(chip, offset, value);
+ tegra_gpio_mask_write(tgi, GPIO_MSK_OE(tgi, offset), offset, 1);
+ tegra_gpio_enable(tgi, offset);
+
+- ret = pinctrl_gpio_direction_output(chip, offset);
+- if (ret < 0)
+- dev_err(tgi->dev,
+- "Failed to set pinctrl output direction of GPIO %d: %d",
+- chip->base + offset, ret);
+-
+- return ret;
++ return 0;
+ }
+
+ static int tegra_gpio_get_direction(struct gpio_chip *chip,
--- /dev/null
+From db4a79713ed8e252d5e4edf6eaaa80948b6855a2 Mon Sep 17 00:00:00 2001
+From: Andreas Kemnade <andreas@kemnade.info>
+Date: Sat, 4 Jul 2026 10:40:54 +0200
+Subject: gpios: palmas: add .get_direction() op
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+commit db4a79713ed8e252d5e4edf6eaaa80948b6855a2 upstream.
+
+Accessing debug/gpio is quite noisy without a get_direction()
+implementation. To calm that down add an implementation.
+
+Fixes: 3d50a2785271 ("gpio: palmas: Add support for Palmas GPIO")
+Cc: stable@vger.kernel.org
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-palmas.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/gpio/gpio-palmas.c
++++ b/drivers/gpio/gpio-palmas.c
+@@ -116,6 +116,24 @@ static int palmas_gpio_input(struct gpio
+ return ret;
+ }
+
++static int palmas_gpio_get_direction(struct gpio_chip *gc, unsigned int offset)
++{
++ struct palmas_gpio *pg = gpiochip_get_data(gc);
++ struct palmas *palmas = pg->palmas;
++ unsigned int val;
++ unsigned int reg;
++ int ret;
++ int gpio16 = (offset/8);
++
++ offset %= 8;
++ reg = (gpio16) ? PALMAS_GPIO_DATA_DIR2 : PALMAS_GPIO_DATA_DIR;
++ ret = palmas_read(palmas, PALMAS_GPIO_BASE, reg, &val);
++ if (ret)
++ return ret;
++
++ return (val & BIT(offset)) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN;
++}
++
+ static int palmas_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
+ {
+ struct palmas_gpio *pg = gpiochip_get_data(gc);
+@@ -165,6 +183,7 @@ static int palmas_gpio_probe(struct plat
+ palmas_gpio->gpio_chip.can_sleep = true;
+ palmas_gpio->gpio_chip.direction_input = palmas_gpio_input;
+ palmas_gpio->gpio_chip.direction_output = palmas_gpio_output;
++ palmas_gpio->gpio_chip.get_direction = palmas_gpio_get_direction;
+ palmas_gpio->gpio_chip.to_irq = palmas_gpio_to_irq;
+ palmas_gpio->gpio_chip.set = palmas_gpio_set;
+ palmas_gpio->gpio_chip.get = palmas_gpio_get;
--- /dev/null
+From d676c9a73bdcd8237425dbb826f2bd1a25c36e40 Mon Sep 17 00:00:00 2001
+From: Ankit Garg <nktgrg@google.com>
+Date: Tue, 16 Jun 2026 18:32:08 -0700
+Subject: gve: fix header buffer corruption with header-split and HW-GRO
+
+From: Ankit Garg <nktgrg@google.com>
+
+commit d676c9a73bdcd8237425dbb826f2bd1a25c36e40 upstream.
+
+The DQO RX datapath programs a per-buffer-queue-descriptor
+header_buf_addr at post time and reads the split header back at
+completion time. Both the post and the read currently index the
+header buffer by queue position rather than by the buffer's identity:
+
+ - post (gve_rx_post_buffers_dqo): header_buf_addr is computed from
+ bufq->tail
+ - read (gve_rx_dqo): the header is read from desc_idx (the completion
+ queue head index)
+
+This relies on the buffer-queue index and the completion-queue index
+being equal for the start of every packet, i.e. on the device consuming
+posted buffers and returning completions in the exact same order. That
+assumption does not hold once HW-GRO is enabled with multiple
+flows: coalesced segments are accepted and completed in an order that
+may differ from the order buffers were posted, and segments from
+different flows may interleave.
+
+That results in two problems:
+
+1. Wrong header slot on read. Because the read offset is derived from
+ the completion index (desc_idx) while the device wrote the header to
+ the address programmed for the buffer's buf_id, the driver can copy
+ a header belonging to a different packet. This shows up as
+ throughput drop (about 30% drop and large numbers of TCP
+ retransmissions) with header-split and HW-GRO both enabled and many
+ streams.
+
+2. Header buffer reused while still owned by the device. The driver
+ advances bufq->head by one per completion and re-posts buffers based
+ on that. Arrival of N RX completions only guarantees that at least N
+ RX buffer descriptors have been read by the device. It does not
+ guarantee that the device has relinquished the ownership of all the
+ buffers corresponding to those N descriptors. With out-of-order
+ completions (e.g. the completion for a packet copied into buffer N
+ arrives before the completion for a packet copied into buffer N-1),
+ the driver can re-post and overwrite a header buffer that the device
+ is still going to write into, corrupting the header of a packet
+ whose completion has not yet been processed.
+
+Fix both issues by indexing the header buffer by buf_id on both the post
+and read paths. Reading from buf_id's slot is therefore always correct
+regardless of completion ordering (fixes problem 1).
+
+Indexing by buf_id also ties each header slot to the lifetime of its
+buffer state. A buffer state is only returned to the free/recycle lists
+when its own completion (buf_id) is processed, so its header slot can
+only be re-posted after the device is done with it. This makes header
+slot reuse safe under out-of-order completions (fixes problem 2).
+
+Allocate (gve_rx_alloc_hdr_bufs) and free (gve_rx_free_hdr_bufs) the
+header buffers based on num_buf_states to match the buf_id indexing.
+
+Cc: stable@vger.kernel.org
+Fixes: 5e37d8254e7f ("gve: Add header split data path")
+Signed-off-by: Ankit Garg <nktgrg@google.com>
+Reviewed-by: Praveen Kaligineedi <pkaligineedi@google.com>
+Reviewed-by: Jordan Rhee <jordanrhee@google.com>
+Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com>
+Signed-off-by: Joshua Washington <joshwash@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260617013208.3781453-1-joshwash@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/google/gve/gve_rx_dqo.c | 28 +++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c
++++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+@@ -21,11 +21,13 @@
+ static void gve_rx_free_hdr_bufs(struct gve_priv *priv, struct gve_rx_ring *rx)
+ {
+ struct device *hdev = &priv->pdev->dev;
+- int buf_count = rx->dqo.bufq.mask + 1;
+
+ if (rx->dqo.hdr_bufs.data) {
+- dma_free_coherent(hdev, priv->header_buf_size * buf_count,
+- rx->dqo.hdr_bufs.data, rx->dqo.hdr_bufs.addr);
++ size_t size =
++ (size_t)priv->header_buf_size * rx->dqo.num_buf_states;
++
++ dma_free_coherent(hdev, size, rx->dqo.hdr_bufs.data,
++ rx->dqo.hdr_bufs.addr);
+ rx->dqo.hdr_bufs.data = NULL;
+ }
+ }
+@@ -254,7 +256,7 @@ int gve_rx_alloc_ring_dqo(struct gve_pri
+
+ /* Allocate header buffers for header-split */
+ if (cfg->enable_header_split)
+- if (gve_rx_alloc_hdr_bufs(priv, rx, buffer_queue_slots))
++ if (gve_rx_alloc_hdr_bufs(priv, rx, rx->dqo.num_buf_states))
+ goto err;
+
+ /* Allocate RX completion queue */
+@@ -381,10 +383,13 @@ void gve_rx_post_buffers_dqo(struct gve_
+ break;
+ }
+
+- if (rx->dqo.hdr_bufs.data)
++ if (rx->dqo.hdr_bufs.data) {
++ u16 buf_id = le16_to_cpu(desc->buf_id);
++
+ desc->header_buf_addr =
+ cpu_to_le64(rx->dqo.hdr_bufs.addr +
+- priv->header_buf_size * bufq->tail);
++ (size_t)priv->header_buf_size * buf_id);
++ }
+
+ bufq->tail = (bufq->tail + 1) & bufq->mask;
+ complq->num_free_slots--;
+@@ -826,10 +831,13 @@ static int gve_rx_dqo(struct napi_struct
+ int unsplit = 0;
+
+ if (hdr_len && !hbo) {
+- rx->ctx.skb_head = gve_rx_copy_data(priv->dev, napi,
+- rx->dqo.hdr_bufs.data +
+- desc_idx * priv->header_buf_size,
+- hdr_len);
++ size_t offset =
++ (size_t)buffer_id * priv->header_buf_size;
++
++ rx->ctx.skb_head =
++ gve_rx_copy_data(priv->dev, napi,
++ rx->dqo.hdr_bufs.data + offset,
++ hdr_len);
+ if (unlikely(!rx->ctx.skb_head))
+ goto error;
+ rx->ctx.skb_tail = rx->ctx.skb_head;
--- /dev/null
+From 9c1e0b6d49471a712511d23fc9d06901561135e8 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Wed, 20 May 2026 10:16:39 -0400
+Subject: ieee802154: admin-gate legacy LLSEC dump operations
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit 9c1e0b6d49471a712511d23fc9d06901561135e8 upstream.
+
+In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table
+builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV,
+LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which
+sets no .flags, so generic netlink runs them ungated. The modern
+nl802154 family admin-gates the equivalent reads via
+NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM.
+
+Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve
+the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev
+that has an LLSEC key installed; the dump handler writes the raw
+16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied
+verbatim from struct ieee802154_llsec_key.key) into the reply.
+Recovering the AES key compromises 802.15.4 LLSEC link confidentiality
+and authenticity, since LLSEC uses CCM* and the same key authenticates
+and encrypts frames.
+
+Impact: any local uid with no capabilities can read the raw 16-byte
+AES-128 LLSEC key from the kernel keytable on any wpan netdev that has
+an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY
+dump on the legacy IEEE802154_NL generic-netlink family.
+
+Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but
+setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump
+entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the
+modern nl802154 family exposes their equivalents to unprivileged
+readers by design (NL802154_CMD_GET_WPAN_PHY and
+NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged
+users" annotations).
+
+Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-7
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Link: https://lore.kernel.org/20260520141640.1149513-2-michael.bommarito@gmail.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ieee802154/ieee802154.h | 8 ++++++++
+ net/ieee802154/netlink.c | 16 ++++++++--------
+ 2 files changed, 16 insertions(+), 8 deletions(-)
+
+--- a/net/ieee802154/ieee802154.h
++++ b/net/ieee802154/ieee802154.h
+@@ -23,6 +23,14 @@ void ieee802154_nl_exit(void);
+ .dumpit = _dump, \
+ }
+
++#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \
++ { \
++ .cmd = _cmd, \
++ .doit = _func, \
++ .dumpit = _dump, \
++ .flags = GENL_ADMIN_PERM, \
++ }
++
+ struct genl_info;
+
+ struct sk_buff *ieee802154_nl_create(int flags, u8 req);
+--- a/net/ieee802154/netlink.c
++++ b/net/ieee802154/netlink.c
+@@ -98,20 +98,20 @@ static const struct genl_small_ops ieee8
+ IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams),
+ IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams),
+ IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL,
+- ieee802154_llsec_dump_keys),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL,
++ ieee802154_llsec_dump_keys),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL,
+- ieee802154_llsec_dump_devs),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL,
++ ieee802154_llsec_dump_devs),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
+- ieee802154_llsec_dump_devkeys),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
++ ieee802154_llsec_dump_devkeys),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
+- ieee802154_llsec_dump_seclevels),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
++ ieee802154_llsec_dump_seclevels),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL,
+ ieee802154_llsec_add_seclevel),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL,
--- /dev/null
+From a6bfdfcc6711d1d5a92e98644359dedc67c0c858 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Wed, 20 May 2026 10:16:40 -0400
+Subject: ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit a6bfdfcc6711d1d5a92e98644359dedc67c0c858 upstream.
+
+The LLSEC ADD/DEL doit handlers under the legacy IEEE802154_NL family
+consume IEEE802154_ATTR_LLSEC_KEY_BYTES and
+IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS, both declared in
+net/ieee802154/nl_policy.c as bare length entries with no .type
+(defaulting to NLA_UNSPEC). Generic netlink strict validation rejects
+all NLA_UNSPEC attributes via validate_nla(), so every LLSEC_ADD_KEY,
+LLSEC_DEL_KEY, LLSEC_ADD_DEV, LLSEC_DEL_DEV, LLSEC_ADD_DEVKEY,
+LLSEC_DEL_DEVKEY, LLSEC_ADD_SECLEVEL, and LLSEC_DEL_SECLEVEL request
+fails at the dispatcher with "Unsupported attribute" before reaching
+the handler.
+
+The doit path has been silently dead since strict validation became
+the default for genl families that do not opt out. The dump path is
+unaffected because dump requests carry no LLSEC attributes to
+validate, which is why the LLSEC_LIST_KEY read remained reachable
+(patch 1/2). Introduce IEEE802154_OP_RELAXED() mirroring
+IEEE802154_OP() but with .validate = GENL_DONT_VALIDATE_STRICT, and
+use it for the eight legacy LLSEC mutate ops so admin-driven LLSEC
+configuration via the legacy interface works again.
+
+Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-7
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Link: https://lore.kernel.org/20260520141640.1149513-3-michael.bommarito@gmail.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ieee802154/ieee802154.h | 9 +++++++++
+ net/ieee802154/netlink.c | 20 ++++++++++----------
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+--- a/net/ieee802154/ieee802154.h
++++ b/net/ieee802154/ieee802154.h
+@@ -16,6 +16,15 @@ void ieee802154_nl_exit(void);
+ .flags = GENL_ADMIN_PERM, \
+ }
+
++#define IEEE802154_OP_RELAXED(_cmd, _func) \
++ { \
++ .cmd = _cmd, \
++ .doit = _func, \
++ .dumpit = NULL, \
++ .flags = GENL_ADMIN_PERM, \
++ .validate = GENL_DONT_VALIDATE_STRICT,\
++ }
++
+ #define IEEE802154_DUMP(_cmd, _func, _dump) \
+ { \
+ .cmd = _cmd, \
+--- a/net/ieee802154/netlink.c
++++ b/net/ieee802154/netlink.c
+@@ -100,22 +100,22 @@ static const struct genl_small_ops ieee8
+ IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL,
+ ieee802154_llsec_dump_keys),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL,
+ ieee802154_llsec_dump_devs),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
+ ieee802154_llsec_dump_devkeys),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
+ ieee802154_llsec_dump_seclevels),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL,
+- ieee802154_llsec_add_seclevel),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL,
+- ieee802154_llsec_del_seclevel),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_SECLEVEL,
++ ieee802154_llsec_add_seclevel),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_SECLEVEL,
++ ieee802154_llsec_del_seclevel),
+ };
+
+ static const struct genl_multicast_group ieee802154_mcgrps[] = {
--- /dev/null
+From e09390e439bd7cca30dd10893b1f64802961667a Mon Sep 17 00:00:00 2001
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+Date: Tue, 21 Apr 2026 13:02:59 +0530
+Subject: ieee802154: ca8210: fix cas_ctl leak on spi_async failure
+
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+
+commit e09390e439bd7cca30dd10893b1f64802961667a upstream.
+
+ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)
+and relies entirely on the SPI completion callback
+ca8210_spi_transfer_complete() to free it.
+
+The spi_async() API only invokes the completion callback on successful
+submission. On failure it returns a negative error code without ever
+queuing the callback, which leaves cas_ctl and its embedded spi_message
+and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is
+inside the completion callback, so there is no other reclamation path.
+
+ca8210_spi_transfer() is called from ca8210_spi_exchange(), the
+interrupt handler ca8210_interrupt_handler(), and from the retry path
+inside the completion callback itself. The exchange and interrupt
+handler paths loop on -EBUSY, so under sustained SPI bus contention
+every retry iteration leaks a fresh cas_ctl (~600 bytes per
+occurrence).
+
+Fix it by freeing cas_ctl on the spi_async() error path. While here,
+correct the misleading error string: the function calls spi_async(),
+not spi_sync().
+
+Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/20260421073259.2259783-1-shitalkumar.gandhi@cambiumnetworks.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/ca8210.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -919,9 +919,10 @@ static int ca8210_spi_transfer(
+ if (status < 0) {
+ dev_crit(
+ &spi->dev,
+- "status %d from spi_sync in write\n",
++ "status %d from spi_async in write\n",
+ status
+ );
++ kfree(cas_ctl);
+ }
+
+ return status;
--- /dev/null
+From 6d7f7bcf225b2d566176bf6229dbd1252940cb3c Mon Sep 17 00:00:00 2001
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+Date: Wed, 20 May 2026 16:27:50 +0530
+Subject: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
+
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+
+commit 6d7f7bcf225b2d566176bf6229dbd1252940cb3c upstream.
+
+ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange
+a kmalloc'd buffer pointer through a struct kfifo, but pass a literal
+'4' as the byte count to kfifo_in()/kfifo_out().
+
+This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the
+low 4 bytes of the 8-byte pointer are written into the FIFO. The reader
+then reads back 4 bytes into an 8-byte local pointer variable, leaving
+the upper 4 bytes uninitialized stack data. The first dereference of
+the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel
+address and generally results in an oops.
+
+Use sizeof(fifo_buffer) so the byte count matches pointer width on every
+architecture.
+
+The driver has no architecture restriction in Kconfig, so any 64-bit
+build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has
+been latent since the driver was added in 2017 because it is most
+commonly deployed on 32-bit MCUs.
+
+Found via a custom Coccinelle semantic patch hunting for short-byte
+kfifo I/O on byte-mode kfifos used to shuttle pointers.
+
+Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/20260520105750.30144-1-shitalkumar.gandhi@cambiumnetworks.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/ca8210.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -595,7 +595,7 @@ static int ca8210_test_int_driver_write(
+ fifo_buffer = kmemdup(buf, len, GFP_KERNEL);
+ if (!fifo_buffer)
+ return -ENOMEM;
+- kfifo_in(&test->up_fifo, &fifo_buffer, 4);
++ kfifo_in(&test->up_fifo, &fifo_buffer, sizeof(fifo_buffer));
+ wake_up_interruptible(&priv->test.readq);
+
+ return 0;
+@@ -2526,6 +2526,7 @@ static ssize_t ca8210_test_int_user_read
+ struct ca8210_priv *priv = filp->private_data;
+ unsigned char *fifo_buffer;
+ unsigned long bytes_not_copied;
++ unsigned int copied;
+
+ if (filp->f_flags & O_NONBLOCK) {
+ /* Non-blocking mode */
+@@ -2539,7 +2540,8 @@ static ssize_t ca8210_test_int_user_read
+ );
+ }
+
+- if (kfifo_out(&priv->test.up_fifo, &fifo_buffer, 4) != 4) {
++ copied = kfifo_out(&priv->test.up_fifo, &fifo_buffer, sizeof(fifo_buffer));
++ if (copied != sizeof(fifo_buffer)) {
+ dev_err(
+ &priv->spi->dev,
+ "test_interface: Wrong number of elements popped from upstream fifo\n"
--- /dev/null
+From 89038cc87d80c77e7aa6f42a64b2573b74af339f Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@kernel.org>
+Date: Fri, 19 Jun 2026 14:52:08 +0200
+Subject: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
+
+From: Thomas Gleixner <tglx@kernel.org>
+
+commit 89038cc87d80c77e7aa6f42a64b2573b74af339f upstream.
+
+rt_spin_unlock() releases the RCU protection before unlocking the
+lock. That opens the door for the following UAF scenario:
+
+ T1 T2
+ spin_lock(&p->lock); rcu_read_lock();
+ invalidate(p); p = rcu_dereference(ptr);
+ rcu_assign_pointer(ptr, NULL); if (!p) return;
+ spin_unlock(&p->lock); spin_lock(&p->lock)
+ lock(&lock->lock);
+ rcu_read_lock();
+ kfree_rcu(p); rcu_read_unlock();
+ ....
+ spin_unlock(&p->lock)
+ rcu_read_unlock(); // Ends grace period
+ rcu_do_batch()
+ kfree(p);
+ UAF -> rt_mutex_cmpxchg_release(&lock->lock...)
+
+Regular spinlocks keep preemption disabled accross the unlock operation,
+which provides full RCU protection, but the RT substitution fails to
+resemble that. Same applies for the rwlock substitution.
+
+Move the rcu_read_unlock() invocation past the unlock operations to match
+the non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but
+that's harmless as the caller needs to hold RCU read lock across the lock
+operation. The migrate_enable() call stays before the unlock operation
+because there is no per CPU operation in the unlock path which would
+require migration to be kept disabled.
+
+Fixes: 0f383b6dc96e ("locking/spinlock: Provide RT variant")
+Reported-by: syzbot+000c800a02097aaa10ed@syzkaller.appspotmail.com
+Decoded-by: Jann Horn <jannh@google.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/87jyrud75z.ffs@fw13
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/spinlock_rt.c | 27 ++++++++++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
+
+--- a/kernel/locking/spinlock_rt.c
++++ b/kernel/locking/spinlock_rt.c
+@@ -79,10 +79,27 @@ void __sched rt_spin_unlock(spinlock_t *
+ {
+ spin_release(&lock->dep_map, _RET_IP_);
+ migrate_enable();
+- rcu_read_unlock();
+
+ if (unlikely(!rt_mutex_cmpxchg_release(&lock->lock, current, NULL)))
+ rt_mutex_slowunlock(&lock->lock);
++
++ /*
++ * This must be last to prevent the following UAF:
++ *
++ * T1 T2
++ * spin_lock(&p->lock); rcu_read_lock();
++ * invalidate(p); p = rcu_dereference(ptr);
++ * rcu_assign_pointer(ptr, NULL); if (!p) return;
++ * spin_unlock(&p->lock); spin_lock(&p->lock);
++ * kfree_rcu(p); rcu_read_unlock();
++ * ....
++ * spin_unlock(&p->lock)
++ * rcu_read_unlock(); // Ends grace period
++ * rcu_do_batch()
++ * kfree(p);
++ * UAF -> rt_mutex_cmpxchg_release(&p->lock.lock...)
++ */
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL(rt_spin_unlock);
+
+@@ -262,17 +279,21 @@ void __sched rt_read_unlock(rwlock_t *rw
+ {
+ rwlock_release(&rwlock->dep_map, _RET_IP_);
+ migrate_enable();
+- rcu_read_unlock();
+ rwbase_read_unlock(&rwlock->rwbase, TASK_RTLOCK_WAIT);
++
++ /* This must be last. See comment in rt_spin_unlock() */
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL(rt_read_unlock);
+
+ void __sched rt_write_unlock(rwlock_t *rwlock) __releases(RCU)
+ {
+ rwlock_release(&rwlock->dep_map, _RET_IP_);
+- rcu_read_unlock();
+ migrate_enable();
+ rwbase_write_unlock(&rwlock->rwbase);
++
++ /* This must be last. See comment in rt_spin_unlock() */
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL(rt_write_unlock);
+
--- /dev/null
+From 1bd6676254b4ab6acd44b662b5e92822c036463a Mon Sep 17 00:00:00 2001
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+Date: Tue, 16 Jun 2026 22:24:24 +0800
+Subject: net: ena: clean up XDP TX queues when regular TX setup fails
+
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+
+commit 1bd6676254b4ab6acd44b662b5e92822c036463a upstream.
+
+create_queues_with_size_backoff() creates XDP TX queues before setting
+up the regular TX path. If the subsequent allocation or creation of
+regular TX queues fails, the error handling paths omit the teardown of the
+XDP TX queues, leading to a resource leak.
+
+Fix this by explicitly destroying the XDP TX queue subset at the two
+missing failure points.
+
+The bug was first flagged by an experimental analysis tool we are
+developing for kernel memory-management bugs while analyzing
+v6.13-rc1. The tool is still under development and is not yet publicly
+available. Manual inspection confirms that the bug is still
+present in v7.1-rc7.
+
+An x86_64 allyesconfig build showed no new warnings. As we do not have
+an ENA device to test with, no runtime testing was able to be performed.
+
+Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
+Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com>
+Tested-by: Arthur Kiyanovski <akiyano@amazon.com>
+Link: https://patch.msgid.link/20260616142424.4005130-1-dawei.feng@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -752,6 +752,18 @@ static void ena_destroy_all_tx_queues(st
+ }
+ }
+
++static void ena_destroy_xdp_tx_queues(struct ena_adapter *adapter)
++{
++ u16 ena_qid;
++ int i;
++
++ for (i = adapter->xdp_first_ring;
++ i < adapter->xdp_first_ring + adapter->xdp_num_queues; i++) {
++ ena_qid = ENA_IO_TXQ_IDX(i);
++ ena_com_destroy_io_queue(adapter->ena_dev, ena_qid);
++ }
++}
++
+ static void ena_destroy_all_rx_queues(struct ena_adapter *adapter)
+ {
+ u16 ena_qid;
+@@ -2078,14 +2090,21 @@ static int create_queues_with_size_backo
+ rc = ena_setup_tx_resources_in_range(adapter,
+ 0,
+ adapter->num_io_queues);
+- if (rc)
++ if (rc) {
++ ena_destroy_xdp_tx_queues(adapter);
++ ena_free_all_io_tx_resources_in_range(adapter,
++ adapter->xdp_first_ring,
++ adapter->xdp_num_queues);
+ goto err_setup_tx;
++ }
+
+ rc = ena_create_io_tx_queues_in_range(adapter,
+ 0,
+ adapter->num_io_queues);
+- if (rc)
++ if (rc) {
++ ena_destroy_xdp_tx_queues(adapter);
+ goto err_create_tx_queues;
++ }
+
+ rc = ena_setup_all_rx_resources(adapter);
+ if (rc)
--- /dev/null
+From 27b9daba50609335db6ca81e4cccf50ded21ec76 Mon Sep 17 00:00:00 2001
+From: Philippe Schenker <philippe.schenker@impulsing.ch>
+Date: Thu, 18 Jun 2026 11:30:24 +0200
+Subject: net: ethernet: ti: icssg: guard PA stat lookups
+
+From: Philippe Schenker <philippe.schenker@impulsing.ch>
+
+commit 27b9daba50609335db6ca81e4cccf50ded21ec76 upstream.
+
+icssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name()
+with FW PA stat names regardless of whether the PA stats block is
+present on the hardware. emac_get_stat_by_name() already guards the
+PA stats lookup with `if (emac->prueth->pa_stats)`; when that pointer
+is NULL the lookup falls through to netdev_err() and returns -EINVAL.
+Because ndo_get_stats64 is polled regularly by the networking stack
+this produces thousands of log entries of the form:
+
+ icssg-prueth icssg1-eth end0: Invalid stats FW_RX_ERROR
+
+A secondary consequence is that the int(-EINVAL) return value is
+implicitly widened to a near-ULLONG_MAX unsigned value when accumulated
+into the __u64 fields of rtnl_link_stats64, silently corrupting the
+rx_errors, rx_dropped and tx_dropped counters reported by `ip -s link`.
+
+Every other PA-aware code path in the driver is already guarded with
+the same `if (emac->prueth->pa_stats)` check. Apply the same guard
+here.
+
+Fixes: 0d15a26b247d ("net: ti: icssg-prueth: Add ICSSG FW Stats")
+Signed-off-by: Philippe Schenker <philippe.schenker@impulsing.ch>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Cc: danishanwar@ti.com
+Cc: rogerq@kernel.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260618093037.3448858-1-dev@pschenker.ch
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/ti/icssg/icssg_common.c | 49 +++++++++++++++------------
+ 1 file changed, 28 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/ethernet/ti/icssg/icssg_common.c
++++ b/drivers/net/ethernet/ti/icssg/icssg_common.c
+@@ -1651,28 +1651,35 @@ void icssg_ndo_get_stats64(struct net_de
+ stats->rx_over_errors = emac_get_stat_by_name(emac, "rx_over_errors");
+ stats->multicast = emac_get_stat_by_name(emac, "rx_multicast_frames");
+
+- stats->rx_errors = ndev->stats.rx_errors +
+- emac_get_stat_by_name(emac, "FW_RX_ERROR") +
+- emac_get_stat_by_name(emac, "FW_RX_EOF_SHORT_FRMERR") +
+- emac_get_stat_by_name(emac, "FW_RX_B0_DROP_EARLY_EOF") +
+- emac_get_stat_by_name(emac, "FW_RX_EXP_FRAG_Q_DROP") +
+- emac_get_stat_by_name(emac, "FW_RX_FIFO_OVERRUN");
+- stats->rx_dropped = ndev->stats.rx_dropped +
+- emac_get_stat_by_name(emac, "FW_DROPPED_PKT") +
+- emac_get_stat_by_name(emac, "FW_INF_PORT_DISABLED") +
+- emac_get_stat_by_name(emac, "FW_INF_SAV") +
+- emac_get_stat_by_name(emac, "FW_INF_SA_DL") +
+- emac_get_stat_by_name(emac, "FW_INF_PORT_BLOCKED") +
+- emac_get_stat_by_name(emac, "FW_INF_DROP_TAGGED") +
+- emac_get_stat_by_name(emac, "FW_INF_DROP_PRIOTAGGED") +
+- emac_get_stat_by_name(emac, "FW_INF_DROP_NOTAG") +
+- emac_get_stat_by_name(emac, "FW_INF_DROP_NOTMEMBER");
++ stats->rx_errors = ndev->stats.rx_errors;
++ stats->rx_dropped = ndev->stats.rx_dropped;
+ stats->tx_errors = ndev->stats.tx_errors;
+- stats->tx_dropped = ndev->stats.tx_dropped +
+- emac_get_stat_by_name(emac, "FW_RTU_PKT_DROP") +
+- emac_get_stat_by_name(emac, "FW_TX_DROPPED_PACKET") +
+- emac_get_stat_by_name(emac, "FW_TX_TS_DROPPED_PACKET") +
+- emac_get_stat_by_name(emac, "FW_TX_JUMBO_FRM_CUTOFF");
++ stats->tx_dropped = ndev->stats.tx_dropped;
++
++ if (!emac->prueth->pa_stats)
++ return;
++
++ stats->rx_errors +=
++ emac_get_stat_by_name(emac, "FW_RX_ERROR") +
++ emac_get_stat_by_name(emac, "FW_RX_EOF_SHORT_FRMERR") +
++ emac_get_stat_by_name(emac, "FW_RX_B0_DROP_EARLY_EOF") +
++ emac_get_stat_by_name(emac, "FW_RX_EXP_FRAG_Q_DROP") +
++ emac_get_stat_by_name(emac, "FW_RX_FIFO_OVERRUN");
++ stats->rx_dropped +=
++ emac_get_stat_by_name(emac, "FW_DROPPED_PKT") +
++ emac_get_stat_by_name(emac, "FW_INF_PORT_DISABLED") +
++ emac_get_stat_by_name(emac, "FW_INF_SAV") +
++ emac_get_stat_by_name(emac, "FW_INF_SA_DL") +
++ emac_get_stat_by_name(emac, "FW_INF_PORT_BLOCKED") +
++ emac_get_stat_by_name(emac, "FW_INF_DROP_TAGGED") +
++ emac_get_stat_by_name(emac, "FW_INF_DROP_PRIOTAGGED") +
++ emac_get_stat_by_name(emac, "FW_INF_DROP_NOTAG") +
++ emac_get_stat_by_name(emac, "FW_INF_DROP_NOTMEMBER");
++ stats->tx_dropped +=
++ emac_get_stat_by_name(emac, "FW_RTU_PKT_DROP") +
++ emac_get_stat_by_name(emac, "FW_TX_DROPPED_PACKET") +
++ emac_get_stat_by_name(emac, "FW_TX_TS_DROPPED_PACKET") +
++ emac_get_stat_by_name(emac, "FW_TX_JUMBO_FRM_CUTOFF");
+ }
+ EXPORT_SYMBOL_GPL(icssg_ndo_get_stats64);
+
--- /dev/null
+From f00a50876d2818bd6dc86fa98b3ef360884c53c8 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:39 +0800
+Subject: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit f00a50876d2818bd6dc86fa98b3ef360884c53c8 upstream.
+
+ip6gre_changelink() and ip6erspan_changelink() operate on at most two
+netns, dev_net(dev) and the tunnel link netns t->net. They differ once
+the device is created in or moved to a netns other than the one the
+request runs in. The rtnl changelink path checks CAP_NET_ADMIN only
+against dev_net(dev), so a caller privileged there but not in t->net can
+rewrite a tunnel that lives in t->net.
+
+Gate both ops on rtnl_dev_link_net_capable() at their top, before any
+attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 690afc165bb3 ("net: ip6_gre: fix moving ip6gre between namespaces")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-6-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_gre.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -2047,6 +2047,9 @@ static int ip6gre_changelink(struct net_
+ struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
+ struct __ip6_tnl_parm p;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ t = ip6gre_changelink_common(dev, tb, data, &p, extack);
+ if (IS_ERR(t))
+ return PTR_ERR(t);
+@@ -2266,6 +2269,9 @@ static int ip6erspan_changelink(struct n
+ struct __ip6_tnl_parm p;
+ struct ip6gre_net *ign;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ ign = net_generic(t->net, ip6gre_net_id);
+ t = ip6gre_changelink_common(dev, tb, data, &p, extack);
+ if (IS_ERR(t))
--- /dev/null
+From 2496fa0b7d180b3ad356b514e7ff93bb14e6140a Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:38 +0800
+Subject: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 2496fa0b7d180b3ad356b514e7ff93bb14e6140a upstream.
+
+ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate ip6_tnl_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 0bd8762824e7 ("ip6tnl: add x-netns support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-5-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_tunnel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -2109,6 +2109,9 @@ static int ip6_tnl_changelink(struct net
+ struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+ struct ip_tunnel_encap ipencap;
+
++ if (!rtnl_dev_link_net_capable(dev, net))
++ return -EPERM;
++
+ if (dev == ip6n->fb_tnl_dev) {
+ if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
+ /* iproute2 always sets TUNNEL_ENCAP_FLAG_CSUM6, so
--- /dev/null
+From e2ac3b242c37dff323a964962e43854f4b1a2b79 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:40 +0800
+Subject: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit e2ac3b242c37dff323a964962e43854f4b1a2b79 upstream.
+
+vti6_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 61220ab34948 ("vti6: Enable namespace changing")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-7-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_vti.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -1046,6 +1046,9 @@ static int vti6_changelink(struct net_de
+ struct __ip6_tnl_parm p;
+ struct vti6_net *ip6n;
+
++ if (!rtnl_dev_link_net_capable(dev, net))
++ return -EPERM;
++
+ ip6n = net_generic(net, vti6_net_id);
+ if (dev == ip6n->fb_tnl_dev)
+ return -EINVAL;
--- /dev/null
+From 95cceadbfd52d7239bd730afdda0655287d77425 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:37 +0800
+Subject: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 95cceadbfd52d7239bd730afdda0655287d77425 upstream.
+
+vti_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate vti_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 895de9a3488a ("vti4: Enable namespace changing")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-4-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_vti.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -596,6 +596,9 @@ static int vti_changelink(struct net_dev
+ struct ip_tunnel_parm_kern p;
+ __u32 fwmark = t->fwmark;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ vti_netlink_parms(data, &p, &fwmark);
+ return ip_tunnel_changelink(dev, tb, &p, fwmark);
+ }
--- /dev/null
+From 8211a26324667980a463c069469a818e71207e02 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:36 +0800
+Subject: net: ipip: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 8211a26324667980a463c069469a818e71207e02 upstream.
+
+ipip_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 6c742e714d8c ("ipip: add x-netns support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-3-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ipip.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -494,6 +494,9 @@ static int ipip_changelink(struct net_de
+ bool collect_md;
+ __u32 fwmark = t->fwmark;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
+ int err = ip_tunnel_encap_setup(t, &ipencap);
+
--- /dev/null
+From db818b0e8af7bac16860116a19c341a63d6677b4 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Mon, 22 Jun 2026 12:30:15 +0800
+Subject: net: ixp4xx_hss: fix duplicate HDLC netdev allocation
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit db818b0e8af7bac16860116a19c341a63d6677b4 upstream.
+
+ixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored
+in ndev, initialized, and registered with register_hdlc_device(). The
+second one is stored in port->netdev and later used by the remove path
+for unregister_hdlc_device() and free_netdev().
+
+This means that the registered netdev is not the same object that is
+unregistered and freed on remove. It also leaks the first allocation if
+the second alloc_hdlcdev() call fails, and the first allocation is not
+checked before ndev is used.
+
+Older code allocated the HDLC netdev only once and stored the same object
+in both the local variable and port->netdev. The buggy conversion split
+this into two alloc_hdlcdev() calls. A later rename changed the local
+variable name to ndev, but the underlying mismatch remained.
+
+Fix this by allocating the HDLC netdev only once and assigning the same
+object to port->netdev.
+
+Fixes: 99ebe65eb9c0 ("net: ixp4xx_hss: move out assignment in if condition")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Link: https://patch.msgid.link/20260622043015.643637-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wan/ixp4xx_hss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wan/ixp4xx_hss.c
++++ b/drivers/net/wan/ixp4xx_hss.c
+@@ -1487,11 +1487,11 @@ static int ixp4xx_hss_probe(struct platf
+ "unable to get CLK internal GPIO\n");
+
+ ndev = alloc_hdlcdev(port);
+- port->netdev = alloc_hdlcdev(port);
+- if (!port->netdev) {
++ if (!ndev) {
+ err = -ENOMEM;
+ goto err_plat;
+ }
++ port->netdev = ndev;
+
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+ hdlc = dev_to_hdlc(ndev);
--- /dev/null
+From c72a0f09c57f92113df69f9b902d11c9e4b132f5 Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Wed, 1 Jul 2026 21:12:37 -0700
+Subject: net: mana: Sync page pool RX frags for CPU
+
+From: Dexuan Cui <decui@microsoft.com>
+
+commit c72a0f09c57f92113df69f9b902d11c9e4b132f5 upstream.
+
+MANA allocates RX buffers from page pool fragments when frag_count is
+greater than 1. In that case the buffers remain DMA mapped by page pool
+and the RX completion path does not call dma_unmap_single(). As a result,
+the implicit sync-for-CPU normally performed by dma_unmap_single() is
+missing before the packet data is passed to the networking stack.
+
+This breaks RX on configurations which require explicit DMA syncing, for
+example when booted with swiotlb=force.
+
+Fix this by recording the page pool page and DMA sync offset when the RX
+buffer is allocated, and syncing the received packet range for CPU access
+before handing the RX buffer to the stack.
+
+Fixes: 730ff06d3f5c ("net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.")
+Cc: stable@vger.kernel.org
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Link: https://patch.msgid.link/20260702041237.617719-3-decui@microsoft.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microsoft/mana/mana_en.c | 40 +++++++++++++++++++++-----
+ include/net/mana/mana.h | 8 +++++
+ 2 files changed, 41 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
+@@ -2056,12 +2056,16 @@ drop:
+ }
+
+ static void *mana_get_rxfrag(struct mana_rxq *rxq, struct device *dev,
+- dma_addr_t *da, bool *from_pool)
++ dma_addr_t *da, bool *from_pool,
++ struct page **pp_page, u32 *dma_sync_offset)
+ {
+ struct page *page;
+ u32 offset;
+ void *va;
++
+ *from_pool = false;
++ *pp_page = NULL;
++ *dma_sync_offset = 0;
+
+ /* Don't use fragments for jumbo frames or XDP where it's 1 fragment
+ * per page.
+@@ -2099,31 +2103,47 @@ static void *mana_get_rxfrag(struct mana
+ va = page_to_virt(page) + offset;
+ *da = page_pool_get_dma_addr(page) + offset + rxq->headroom;
+ *from_pool = true;
++ *pp_page = page;
++ *dma_sync_offset = offset + rxq->headroom;
+
+ return va;
+ }
+
+ /* Allocate frag for rx buffer, and save the old buf */
+ static void mana_refill_rx_oob(struct device *dev, struct mana_rxq *rxq,
+- struct mana_recv_buf_oob *rxoob, void **old_buf,
+- bool *old_fp)
++ struct mana_recv_buf_oob *rxoob, u32 pktlen,
++ void **old_buf, bool *old_fp)
+ {
++ struct page *pp_page;
++ u32 dma_sync_offset;
+ bool from_pool;
+ dma_addr_t da;
+ void *va;
+
+- va = mana_get_rxfrag(rxq, dev, &da, &from_pool);
++ va = mana_get_rxfrag(rxq, dev, &da, &from_pool, &pp_page,
++ &dma_sync_offset);
+ if (!va)
+ return;
+- if (!rxoob->from_pool || rxq->frag_count == 1)
++ if (!rxoob->from_pool || rxq->frag_count == 1) {
+ dma_unmap_single(dev, rxoob->sgl[0].address, rxq->datasize,
+ DMA_FROM_DEVICE);
++ } else {
++ /* The page pool maps the whole page and only syncs for device
++ * automatically (PP_FLAG_DMA_SYNC_DEV). Sync the received bytes
++ * for the CPU before they are read: this is required if DMA
++ * is incoherent or bounce buffers are used.
++ */
++ page_pool_dma_sync_for_cpu(rxq->page_pool, rxoob->pp_page,
++ rxoob->dma_sync_offset, pktlen);
++ }
+ *old_buf = rxoob->buf_va;
+ *old_fp = rxoob->from_pool;
+
+ rxoob->buf_va = va;
+ rxoob->sgl[0].address = da;
+ rxoob->from_pool = from_pool;
++ rxoob->pp_page = pp_page;
++ rxoob->dma_sync_offset = dma_sync_offset;
+ }
+
+ static void mana_process_rx_cqe(struct mana_rxq *rxq, struct mana_cq *cq,
+@@ -2194,7 +2214,8 @@ static void mana_process_rx_cqe(struct m
+ /* Reuse the RX buffer since rxbuf_oob is unchanged. */
+ } else {
+
+- mana_refill_rx_oob(dev, rxq, rxbuf_oob, &old_buf, &old_fp);
++ mana_refill_rx_oob(dev, rxq, rxbuf_oob, pktlen,
++ &old_buf, &old_fp);
+
+ /* Unsuccessful refill will have old_buf == NULL.
+ * In this case, mana_rx_skb() will drop the packet.
+@@ -2592,6 +2613,8 @@ static int mana_fill_rx_oob(struct mana_
+ struct mana_rxq *rxq, struct device *dev)
+ {
+ struct mana_port_context *mpc = netdev_priv(rxq->ndev);
++ struct page *pp_page = NULL;
++ u32 dma_sync_offset = 0;
+ bool from_pool = false;
+ dma_addr_t da;
+ void *va;
+@@ -2599,13 +2622,16 @@ static int mana_fill_rx_oob(struct mana_
+ if (mpc->rxbufs_pre)
+ va = mana_get_rxbuf_pre(rxq, &da);
+ else
+- va = mana_get_rxfrag(rxq, dev, &da, &from_pool);
++ va = mana_get_rxfrag(rxq, dev, &da, &from_pool, &pp_page,
++ &dma_sync_offset);
+
+ if (!va)
+ return -ENOMEM;
+
+ rx_oob->buf_va = va;
+ rx_oob->from_pool = from_pool;
++ rx_oob->pp_page = pp_page;
++ rx_oob->dma_sync_offset = dma_sync_offset;
+
+ rx_oob->sgl[0].address = da;
+ rx_oob->sgl[0].size = rxq->datasize;
+--- a/include/net/mana/mana.h
++++ b/include/net/mana/mana.h
+@@ -305,6 +305,14 @@ struct mana_recv_buf_oob {
+
+ void *buf_va;
+ bool from_pool; /* allocated from a page pool */
++ /* head page of the page_pool fragment; valid only when
++ * from_pool && frag_count > 1.
++ */
++ struct page *pp_page;
++ /* Fragment offset plus rxq->headroom, passed to
++ * page_pool_dma_sync_for_cpu().
++ */
++ u32 dma_sync_offset;
+
+ /* SGL of the buffer going to be sent as part of the work request. */
+ u32 num_sge;
--- /dev/null
+From 2e2a83b4998af4384e677d3b2ac08565274279bf Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Wed, 1 Jul 2026 21:12:36 -0700
+Subject: net: mana: Validate the packet length reported by the NIC
+
+From: Dexuan Cui <decui@microsoft.com>
+
+commit 2e2a83b4998af4384e677d3b2ac08565274279bf upstream.
+
+Validate the packet length reported in the RX CQE before passing it
+to skb processing. The CQE is supplied by the NIC device and should
+not be blindly trusted.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
+Link: https://patch.msgid.link/20260702041237.617719-2-decui@microsoft.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microsoft/mana/mana_en.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
+@@ -2182,12 +2182,25 @@ static void mana_process_rx_cqe(struct m
+ rxbuf_oob = &rxq->rx_oobs[curr];
+ WARN_ON_ONCE(rxbuf_oob->wqe_inf.wqe_size_in_bu != 1);
+
+- mana_refill_rx_oob(dev, rxq, rxbuf_oob, &old_buf, &old_fp);
++ if (unlikely(pktlen > rxq->datasize)) {
++ /* Increase it even if mana_rx_skb() isn't called. */
++ rxq->rx_cq.work_done++;
+
+- /* Unsuccessful refill will have old_buf == NULL.
+- * In this case, mana_rx_skb() will drop the packet.
+- */
+- mana_rx_skb(old_buf, old_fp, oob, rxq, i);
++ ++ndev->stats.rx_dropped;
++ netdev_warn_once(ndev,
++ "Dropped oversized RX packet: len=%u, datasize=%u\n",
++ pktlen, rxq->datasize);
++
++ /* Reuse the RX buffer since rxbuf_oob is unchanged. */
++ } else {
++
++ mana_refill_rx_oob(dev, rxq, rxbuf_oob, &old_buf, &old_fp);
++
++ /* Unsuccessful refill will have old_buf == NULL.
++ * In this case, mana_rx_skb() will drop the packet.
++ */
++ mana_rx_skb(old_buf, old_fp, oob, rxq, i);
++ }
+
+ mana_move_wq_tail(rxq->gdma_rq,
+ rxbuf_oob->wqe_inf.wqe_size_in_bu);
--- /dev/null
+From 9092e15defbe6c7bc241c306093ca9d358a578e7 Mon Sep 17 00:00:00 2001
+From: Zihan Xi <xizh2024@lzu.edu.cn>
+Date: Sun, 14 Jun 2026 01:42:39 +0800
+Subject: net/sched: act_ct: preserve tc_skb_cb across defragmentation
+
+From: Zihan Xi <xizh2024@lzu.edu.cn>
+
+commit 9092e15defbe6c7bc241c306093ca9d358a578e7 upstream.
+
+tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving
+and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases
+the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through
+act_ct therefore loses qdisc metadata such as pkt_segs and can trigger
+WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.
+
+Save and restore the full tc_skb_cb around nf_ct_handle_fragments(),
+matching the pattern used by ovs_ct_handle_fragments().
+
+Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Link: https://patch.msgid.link/510c51217fd7aaf29c6dc298bab8d643fe229b1c.1781358692.git.xizh2024@lzu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/act_ct.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -844,11 +844,11 @@ static int tcf_ct_handle_fragments(struc
+ u8 family, u16 zone, bool *defrag)
+ {
+ enum ip_conntrack_info ctinfo;
++ struct tc_skb_cb cb;
+ struct nf_conn *ct;
+ int err = 0;
+ bool frag;
+ u8 proto;
+- u16 mru;
+
+ /* Previously seen (loopback)? Ignore. */
+ ct = nf_ct_get(skb, &ctinfo);
+@@ -862,12 +862,13 @@ static int tcf_ct_handle_fragments(struc
+ if (err || !frag)
+ return err;
+
+- err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &mru);
++ cb = *tc_skb_cb(skb);
++ err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &cb.mru);
+ if (err)
+ return err;
+
+ *defrag = true;
+- tc_skb_cb(skb)->mru = mru;
++ *tc_skb_cb(skb) = cb;
+
+ return 0;
+ }
--- /dev/null
+From 27ccb68e7cccead5d8c611665a45d23032d468b3 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Thu, 18 Jun 2026 15:08:17 +0800
+Subject: net: sit: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 27ccb68e7cccead5d8c611665a45d23032d468b3 upstream.
+
+ipip6_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed. sit was the one tunnel type not covered
+by the recent series that added this check to the other changelink()
+handlers.
+
+Fixes: 5e6700b3bf98 ("sit: add support of x-netns")
+Link: https://lore.kernel.org/netdev/20260612085941.3158249-1-maoyixie.tju@gmail.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260618070817.3378283-1-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/sit.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1611,6 +1611,9 @@ static int ipip6_changelink(struct net_d
+ __u32 fwmark = t->fwmark;
+ int err;
+
++ if (!rtnl_dev_link_net_capable(dev, net))
++ return -EPERM;
++
+ if (dev == sitn->fb_tunnel_dev)
+ return -EINVAL;
+
--- /dev/null
+From 2bd6f26d4ce1e87de4d736b1e8896daf3acf1c0e Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Sun, 21 Jun 2026 11:17:14 +0800
+Subject: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 2bd6f26d4ce1e87de4d736b1e8896daf3acf1c0e upstream.
+
+t7xx_cldma_late_init() creates md_ctrl->gpd_dmapool before
+initializing the TX and RX rings. If any ring initialization
+fails, the error path frees the already initialized rings but
+leaves the DMA pool allocated.
+
+Destroy md_ctrl->gpd_dmapool on the late-init failure path
+to avoid leaking the DMA pool.
+
+Fixes: 39d439047f1d ("net: wwan: t7xx: Add control DMA interface")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260621031714.3605022-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wwan/t7xx/t7xx_hif_cldma.c
++++ b/drivers/net/wwan/t7xx/t7xx_hif_cldma.c
+@@ -1063,6 +1063,9 @@ err_free_tx_ring:
+ while (i--)
+ t7xx_cldma_ring_free(md_ctrl, &md_ctrl->tx_ring[i], DMA_TO_DEVICE);
+
++ dma_pool_destroy(md_ctrl->gpd_dmapool);
++ md_ctrl->gpd_dmapool = NULL;
++
+ return ret;
+ }
+
--- /dev/null
+From 8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915 Mon Sep 17 00:00:00 2001
+From: Junrui Luo <moonafterrain@outlook.com>
+Date: Mon, 15 Jun 2026 23:04:27 +0800
+Subject: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
+
+From: Junrui Luo <moonafterrain@outlook.com>
+
+commit 8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915 upstream.
+
+rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
+index into the LMT map table to read another function's LMTLINE
+physical base address and copy it into the caller's own LMT map table
+entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the
+IRQ source, but req->base_pcifunc is a separate payload field and is
+not sanitized.
+
+Reject the request with -EPERM when a VF caller's base_pcifunc is not a
+valid function under its own PF. is_pf_func_valid() bounds the FUNC field
+to the PF's configured VF count, keeping the computed index inside the
+caller's own slot block.
+
+Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions")
+Reported-by: Yuhao Jiang <danisjiang@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
+Link: https://patch.msgid.link/SYBPR01MB78811656934E713B77DA6CEDAFE62@SYBPR01MB7881.ausprd01.prod.outlook.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
+@@ -178,6 +178,15 @@ int rvu_mbox_handler_lmtst_tbl_setup(str
+ * pcifunc (will be the one who is calling this mailbox).
+ */
+ if (req->base_pcifunc) {
++ /* A VF is untrusted and must not redirect its LMTLINE to
++ * another PF's region, so confine VF callers to their own PF.
++ */
++ if (is_vf(req->hdr.pcifunc) &&
++ (!is_pf_func_valid(rvu, req->base_pcifunc) ||
++ rvu_get_pf(rvu->pdev, req->hdr.pcifunc) !=
++ rvu_get_pf(rvu->pdev, req->base_pcifunc)))
++ return -EPERM;
++
+ /* Calculating the LMT table index equivalent to primary
+ * pcifunc.
+ */
--- /dev/null
+From 36323f54cd323122a1be89ab2c316a6e55a94e30 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Tue, 23 Jun 2026 19:43:16 +0800
+Subject: octeontx2-af: Free BPID bitmap on setup failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 36323f54cd323122a1be89ab2c316a6e55a94e30 upstream.
+
+nix_setup_bpids() allocates bp->bpids with rvu_alloc_bitmap(), which uses
+a plain kcalloc(). If any of the following devm_kcalloc() allocations for
+the BPID mapping arrays fails, the function returns without freeing the
+bitmap. Free the BPID bitmap before returning from those error paths.
+
+Fixes: d6212d2e41a0 ("octeontx2-af: Create BPIDs free pool")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260623114316.2182271-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -527,19 +527,24 @@ static int nix_setup_bpids(struct rvu *r
+ bp->fn_map = devm_kcalloc(rvu->dev, bp->bpids.max,
+ sizeof(u16), GFP_KERNEL);
+ if (!bp->fn_map)
+- return -ENOMEM;
++ goto free_bpids;
+
+ bp->intf_map = devm_kcalloc(rvu->dev, bp->bpids.max,
+ sizeof(u8), GFP_KERNEL);
+ if (!bp->intf_map)
+- return -ENOMEM;
++ goto free_bpids;
+
+ bp->ref_cnt = devm_kcalloc(rvu->dev, bp->bpids.max,
+ sizeof(u8), GFP_KERNEL);
+ if (!bp->ref_cnt)
+- return -ENOMEM;
++ goto free_bpids;
+
+ return 0;
++
++free_bpids:
++ rvu_free_bitmap(&bp->bpids);
++ bp->bpids.bmap = NULL;
++ return -ENOMEM;
+ }
+
+ void rvu_nix_flr_free_bpids(struct rvu *rvu, u16 pcifunc)
--- /dev/null
+From 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f Mon Sep 17 00:00:00 2001
+From: Zhan Xusheng <zhanxusheng1024@gmail.com>
+Date: Tue, 16 Jun 2026 19:20:17 +0800
+Subject: posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
+
+From: Zhan Xusheng <zhanxusheng1024@gmail.com>
+
+commit 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f upstream.
+
+update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with
+
+ u64 nsecs = rlim_new * NSEC_PER_SEC;
+
+On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC
+(1000000000L) are 32-bit, so the multiplication is performed in unsigned
+long and truncated for rlim_new > 4 seconds before being widened to u64.
+
+The same file already casts to u64 for the matching computation in
+check_process_timers():
+
+ u64 softns = (u64)soft * NSEC_PER_SEC;
+
+As a result, the truncated value is installed into the CPUCLOCK_PROF
+expiry cache (nextevt), causing the process CPU timer to be programmed
+to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The
+actual SIGXCPU/SIGKILL decision in check_process_timers() already casts
+to u64 and is therefore correct, so limit enforcement is not broken;
+only the expiry-cache programming is wrong. Apply the same cast here so
+both paths convert rlim_cur identically.
+
+64-bit kernels are unaffected.
+
+Fixes: 858cf3a8c599 ("timers/itimer: Convert internal cputime_t units to nsec")
+Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/posix-cpu-timers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -41,7 +41,7 @@ void posix_cputimers_group_init(struct p
+ */
+ int update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new)
+ {
+- u64 nsecs = rlim_new * NSEC_PER_SEC;
++ u64 nsecs = (u64)rlim_new * NSEC_PER_SEC;
+ unsigned long irq_fl;
+
+ if (!lock_task_sighand(task, &irq_fl))
--- /dev/null
+From 808c447df2fe234eb7d9e08ecf53159d291c104c Mon Sep 17 00:00:00 2001
+From: Cao Ruichuang <create0818@163.com>
+Date: Tue, 7 Apr 2026 18:26:13 +0800
+Subject: selftests/ftrace: Drop invalid top-level local in test_ownership
+
+From: Cao Ruichuang <create0818@163.com>
+
+commit 808c447df2fe234eb7d9e08ecf53159d291c104c upstream.
+
+test_ownership.tc is sourced by ftracetest under /bin/sh.
+
+The script currently declares mount_point with local at file scope,
+which makes /bin/sh abort with "local: not in a function" before the
+test can reach the eventfs ownership checks.
+
+Replace the top-level local declaration with a normal shell variable so
+kernels that support the gid= tracefs mount option can run the test at
+all.
+
+Link: https://lore.kernel.org/r/20260407102613.81419-1-create0818@163.com
+Fixes: 8b55572e51805 ("tracing/selftests: Add tracefs mount options test")
+Signed-off-by: Cao Ruichuang <create0818@163.com>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc
++++ b/tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc
+@@ -6,7 +6,7 @@
+ original_group=`stat -c "%g" .`
+ original_owner=`stat -c "%u" .`
+
+-local mount_point=$(get_mount_point)
++mount_point=$(get_mount_point)
+
+ mount_options=$(get_mnt_options "$mount_point")
+
--- /dev/null
+From b8613e9792002add3bf77122868cc06ce142e953 Mon Sep 17 00:00:00 2001
+From: Ross Porter <ross.porter@canonical.com>
+Date: Wed, 17 Jun 2026 18:10:39 +1200
+Subject: selftests: net: fix file owner for broadcast_ether_dst test
+
+From: Ross Porter <ross.porter@canonical.com>
+
+commit b8613e9792002add3bf77122868cc06ce142e953 upstream.
+
+Ensure the output file is always owned by root (even if tcpdump was
+compiled with `--with-user`), by passing the `-Z root` argument when
+invoking it.
+
+Cc: stable@vger.kernel.org
+Reported-by: Edoardo Canepa <edoardo.canepa@canonical.com>
+Closes: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2129815
+Fixes: bf59028ea8d4 ("selftests: net: add test for destination in broadcast packets")
+Suggested-by: Edoardo Canepa <edoardo.canepa@canonical.com>
+Tested-by: Ross Porter <ross.porter@canonical.com>
+Signed-off-by: Ross Porter <ross.porter@canonical.com>
+Link: https://patch.msgid.link/20260617061039.79717-2-ross.porter@canonical.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/broadcast_ether_dst.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/broadcast_ether_dst.sh b/tools/testing/selftests/net/broadcast_ether_dst.sh
+index 334a7eca8a80..cc571f607429 100755
+--- a/tools/testing/selftests/net/broadcast_ether_dst.sh
++++ b/tools/testing/selftests/net/broadcast_ether_dst.sh
+@@ -44,7 +44,7 @@ test_broadcast_ether_dst() {
+ # tcpdump will exit after receiving a single packet
+ # timeout will kill tcpdump if it is still running after 2s
+ timeout 2s ip netns exec "${CLIENT_NS}" \
+- tcpdump -i link0 -c 1 -w "${CAPFILE}" icmp &> "${OUTPUT}" &
++ tcpdump -i link0 -c 1 -w "${CAPFILE}" -Z root icmp &> "${OUTPUT}" &
+ pid=$!
+ slowwait 1 grep -qs "listening" "${OUTPUT}"
+
+--
+2.55.0
+
net-mlx5e-macsec-fix-use-after-free-of-metadata_dst-on-rx-sc-delete.patch
tracing-user_events-fix-use-after-free-in-user_event_mm_dup.patch
wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch
+locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch
+posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch
+selftests-ftrace-drop-invalid-top-level-local-in-test_ownership.patch
+cpu-hotplug-preserve-per-instance-callback-errors.patch
+cpu-hotplug-bound-hotplug-states-sysfs-output.patch
+net-mana-validate-the-packet-length-reported-by-the-nic.patch
+net-mana-sync-page-pool-rx-frags-for-cpu.patch
+gpio-mt7621-more-robust-management-of-irq-domain-teardown.patch
+gpio-tegra-do-not-call-pinctrl-for-gpio-direction.patch
+gpio-mt7621-be-sure-irq-domain-is-created-before-exposing-gpio-chips.patch
+gpio-f7188x-add-support-for-nct6126d-version-b.patch
+gpio-mt7621-avoid-corruption-of-shared-interrupt-trigger-state.patch
+gpios-palmas-add-.get_direction-op.patch
+net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ethernet-ti-icssg-guard-pa-stat-lookups.patch
+net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch
+net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch
+net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation.patch
+selftests-net-fix-file-owner-for-broadcast_ether_dst-test.patch
+net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch
+net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+octeontx2-af-free-bpid-bitmap-on-setup-failure.patch
+ieee802154-admin-gate-legacy-llsec-dump-operations.patch
+ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch
+ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
+ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
+gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch
+octeontx2-af-cn10k-restrict-vf-lmtline-sharing-to-its-own-pf.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
