Changelog in Linux kernel 6.19.13

 
ALSA: hda/intel: enforce stricter period-size alignment for Intel NVL [+ + +]
Author: Kai Vehmanen <[email protected]>
Date:   Wed Apr 8 11:45:13 2026 +0300

    ALSA: hda/intel: enforce stricter period-size alignment for Intel NVL
    
    commit 082c192c0dd03f685514c9ce2eb0a80fd28e2175 upstream.
    
    Intel ACE4 based products set more strict constraints on HDA BDLE start
    address and length alignment. Modify capability flags to drop
    AZX_DCAPS_NO_ALIGN_BUFSIZE for Intel Nova Lake platforms.
    
    Fixes: 7f428282fde3 ("ALSA: hda: controllers: intel: add support for Nova Lake")
    Signed-off-by: Kai Vehmanen <[email protected]>
    Reviewed-by: Péter Ujfalusi <[email protected]>
    Reviewed-by: Liam Girdwood <[email protected]>
    Cc: <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges [+ + +]
Author: Shawn Guo <[email protected]>
Date:   Fri Feb 27 15:22:10 2026 +0800

    arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
    
    commit 1af997cad473d505248df6d9577183bb91f69670 upstream.
    
    Reboot starts failing on Poplar since commit 8424ecdde7df ("arm64: mm:
    Set ZONE_DMA size based on devicetree's dma-ranges"), which effectively
    changes zone_dma_bits from 30 to 32 for arm64 platforms that do not
    properly define dma-ranges in device tree.  It's unclear how Poplar reboot
    gets broken by this change exactly, but a dma-ranges limiting zone_dma to
    the first 1 GB fixes the regression.
    
    Fixes: 2f20182ed670 ("arm64: dts: hisilicon: add dts files for hi3798cv200-poplar board")
    Cc: [email protected]
    Signed-off-by: Shawn Guo <[email protected]>
    Signed-off-by: Wei Xu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity [+ + +]
Author: Shawn Guo <[email protected]>
Date:   Fri Feb 27 15:19:58 2026 +0800

    arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
    
    commit c1f2b0f2b5e37b2c27540a175aea2755a3799433 upstream.
    
    The PCIe reset GPIO on Poplar is actually active low.  The active high
    worked before because kernel driver didn't respect the setting from DT.
    This is changed since commit 1d26a55fbeb9 ("PCI: histb: Switch to using
    gpiod API"), and thus PCIe on Poplar got brken since then.
    
    Fix the problem by correcting the polarity.
    
    Fixes: 32fa01761bd9 ("arm64: dts: hi3798cv200: enable PCIe support for poplar board")
    Cc: [email protected]
    Signed-off-by: Shawn Guo <[email protected]>
    Signed-off-by: Wei Xu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V [+ + +]
Author: Sebastian Krzyszkowiak <[email protected]>
Date:   Sat Feb 21 19:15:19 2026 +0100

    arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
    
    commit 511f76bf1dce5acf8907b65a7d1bc8f7e7c0d637 upstream.
    
    The minimal voltage of VDD_SOC sourced from BUCK1 is 0.81V, which
    is the currently set value. However, BD71837 only guarantees accuracy
    of ±0.01V, and this still doesn't factor other reasons for actual
    voltage to slightly drop in, resulting in the possibility of running
    out of the operational range.
    
    Bump the voltage up to 0.85V, which should give enough headroom.
    
    Cc: [email protected]
    Fixes: 8f0216b006e5 ("arm64: dts: Add a device tree for the Librem 5 phone")
    Signed-off-by: Sebastian Krzyszkowiak <[email protected]>
    Signed-off-by: Frank Li <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM [+ + +]
Author: Marek Vasut <[email protected]>
Date:   Tue Mar 24 15:33:28 2026 +0100

    arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM
    
    commit ed8444006df9863ffa682e315352c44a49d9f4cb upstream.
    
    Mark the first 128 MiB of DRAM as reserved. The first 128 MiB of DRAM
    may optionally be used by TFA and other firmware for its own purposes,
    and in such case, Linux must not use this memory.
    
    On this platform, U-Boot runs in EL3 and starts TFA BL31 and Linux from
    a single combined fitImage. U-Boot has full access to all memory in the
    0x40000000..0xbfffffff range, as well memory in the memory banks in the
    64-bit address ranges, and therefore U-Boot patches this full complete
    view of platform memory layout into the DT that is passed to the next
    stage.
    
    The next stage is TFA BL31 and then the Linux kernel. The TFA BL31 does
    not modify the DT passed from U-Boot to TFA BL31 and then to Linux with
    any new reserved-memory {} node to reserve memory areas used by the TFA
    BL31 to prevent the next stage from using those areas, which lets Linux
    to use all of the available DRAM as described in the DT that was passed
    in by U-Boot, including the areas that are newly utilized by TFA BL31.
    
    In case of high DRAM utilization, for example in case of four instances
    of "memtester 3900M" running in parallel, unless the memory used by TFA
    BL31 is properly reserved, Linux may use and corrupt the memory used by
    TFA BL31, which would often lead to system becoming unresponsive.
    
    Until TFA BL31 can properly fill its own reserved-memory node into the
    DT, and to assure older versions of TFA BL31 do not cause problems, add
    explicitly reserved-memory {} node which prevents Linux from using the
    first 128 MiB of DRAM.
    
    Note that TFA BL31 can be adjusted to use different memory areas, this
    newly added reserved-memory {} node follows longer-term practice on the
    R-Car SoCs where the first 128 MiB of DRAM is reserved for firmware use.
    In case user does modify TFA BL31 to use different memory ranges, they
    must either use a future version of TFA BL31 which properly patches a
    reserved-memory {} node into the DT, or they must adjust the address
    ranges of this reserved-memory {} node accordingly.
    
    Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
    Cc: [email protected]
    Signed-off-by: Marek Vasut <[email protected]>
    Reviewed-by: Geert Uytterhoeven <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Geert Uytterhoeven <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
ASoC: SOF: Intel: hda: modify period size constraints for ACE4 [+ + +]
Author: Kai Vehmanen <[email protected]>
Date:   Wed Apr 8 11:45:14 2026 +0300

    ASoC: SOF: Intel: hda: modify period size constraints for ACE4
    
    commit 0f71866057262d669ed6a21246eaac0ad6d04d4e upstream.
    
    Intel ACE4 based products set more strict constraints on HDA BDLE start
    address and length alignment. Add a constraint to align period size to
    128 bytes.
    
    The commit removes the "minimum as per HDA spec" comment. This comment
    was misleading as spec actually does allow a 2 byte BDLE length, and
    more importantly, period size also directly impacts how the BDLE start
    addresses are aligned, so it is not sufficient just to consider allowed
    buffer length.
    
    Fixes: d3df422f66e8 ("ASoC: SOF: Intel: add initial support for NVL-S")
    Cc: [email protected]
    Reported-by: Peter Ujfalusi <[email protected]>
    Signed-off-by: Kai Vehmanen <[email protected]>
    Reviewed-by: Péter Ujfalusi <[email protected]>
    Reviewed-by: Liam Girdwood <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
batman-adv: hold claim backbone gateways by reference [+ + +]
Author: Haoze Xie <[email protected]>
Date:   Mon Apr 6 21:17:28 2026 +0800

    batman-adv: hold claim backbone gateways by reference
    
    commit 82d8701b2c930d0e96b0dbc9115a218d791cb0d2 upstream.
    
    batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
    gateway's last reference while readers still follow the pointer.
    
    The netlink claim dump path dereferences claim->backbone_gw->orig and
    takes claim->backbone_gw->crc_lock without pinning the underlying
    backbone gateway. batadv_bla_check_claim() still has the same naked
    pointer access pattern.
    
    Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate
    on a stable gateway reference until the read-side work is complete.
    This keeps the dump and claim-check paths aligned with the lifetime
    rules introduced for the other BLA claim readers.
    
    Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
    Fixes: 04f3f5bf1883 ("batman-adv: add B.A.T.M.A.N. Dump BLA claims via netlink")
    Cc: [email protected]
    Reported-by: Yifan Wu <[email protected]>
    Reported-by: Juefei Pu <[email protected]>
    Co-developed-by: Yuan Tan <[email protected]>
    Signed-off-by: Yuan Tan <[email protected]>
    Suggested-by: Xin Liu <[email protected]>
    Signed-off-by: Haoze Xie <[email protected]>
    Signed-off-by: Ao Zhou <[email protected]>
    Signed-off-by: Sven Eckelmann <[email protected]>
    Signed-off-by: Simon Wunderlich <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

batman-adv: reject oversized global TT response buffers [+ + +]
Author: Ruide Cao <[email protected]>
Date:   Thu Apr 2 23:12:31 2026 +0800

    batman-adv: reject oversized global TT response buffers
    
    commit 3a359bf5c61d52e7f09754108309d637532164a6 upstream.
    
    batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
    global TT response in 16-bit temporaries. When a remote originator
    advertises a large enough global TT, the TT payload length plus the VLAN
    header offset can exceed 65535 and wrap before kmalloc().
    
    The full-table response path still uses the original TT payload length when
    it fills tt_change, so the wrapped allocation is too small and
    batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object
    before the later packet-size check runs.
    
    Fix this by rejecting TT responses whose TVLV value length cannot fit in
    the 16-bit TVLV payload length field.
    
    Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
    Cc: [email protected]
    Reported-by: Yifan Wu <[email protected]>
    Reported-by: Juefei Pu <[email protected]>
    Co-developed-by: Yuan Tan <[email protected]>
    Signed-off-by: Yuan Tan <[email protected]>
    Suggested-by: Xin Liu <[email protected]>
    Tested-by: Ren Wei <[email protected]>
    Signed-off-by: Ruide Cao <[email protected]>
    Signed-off-by: Ren Wei <[email protected]>
    Signed-off-by: Sven Eckelmann <[email protected]>
    Signed-off-by: Simon Wunderlich <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() [+ + +]
Author: robbieko <[email protected]>
Date:   Wed Mar 25 18:18:15 2026 +0800

    btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()
    
    [ Upstream commit 316fb1b3169efb081d2db910cbbfef445afa03b9 ]
    
    After commit 1618aa3c2e01 ("btrfs: simplify return variables in
    lookup_extent_data_ref()"), the err and ret variables were merged into
    a single ret variable. However, when btrfs_next_leaf() returns 0
    (success), ret is overwritten from -ENOENT to 0. If the first key in
    the next leaf does not match (different objectid or type), the function
    returns 0 instead of -ENOENT, making the caller believe the lookup
    succeeded when it did not. This can lead to operations on the wrong
    extent tree item, potentially causing extent tree corruption.
    
    Fix this by returning -ENOENT directly when the key does not match,
    instead of relying on the ret variable.
    
    Fixes: 1618aa3c2e01 ("btrfs: simplify return variables in lookup_extent_data_ref()")
    CC: [email protected] # 6.12+
    Reviewed-by: Filipe Manana <[email protected]>
    Signed-off-by: robbieko <[email protected]>
    Signed-off-by: Filipe Manana <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: remove pointless out labels from extent-tree.c [+ + +]
Author: Filipe Manana <[email protected]>
Date:   Tue Jan 20 19:52:10 2026 +0000

    btrfs: remove pointless out labels from extent-tree.c
    
    [ Upstream commit ea8f9210050136bdd14f5e32b04cd01c8bd5c0ca ]
    
    Some functions (lookup_extent_data_ref(), __btrfs_mod_ref() and
    btrfs_free_tree_block()) have an 'out' label that does nothing but
    return, making it pointless. Simplify this by removing the label and
    returning instead of gotos plus setting the 'ret' variable.
    
    Reviewed-by: Johannes Thumshirn <[email protected]>
    Signed-off-by: Filipe Manana <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Stable-dep-of: 316fb1b3169e ("btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()")
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat [+ + +]
Author: Sebastian Brzezinka <[email protected]>
Date:   Wed Apr 1 12:10:07 2026 +0200

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
    
    commit 4c71fd099513bfa8acab529b626e1f0097b76061 upstream.
    
    A use-after-free / refcount underflow is possible when the heartbeat
    worker and intel_engine_park_heartbeat() race to release the same
    engine->heartbeat.systole request.
    
    The heartbeat worker reads engine->heartbeat.systole and calls
    i915_request_put() on it when the request is complete, but clears
    the pointer in a separate, non-atomic step. Concurrently, a request
    retirement on another CPU can drop the engine wakeref to zero, triggering
    __engine_park() -> intel_engine_park_heartbeat(). If the heartbeat
    timer is pending at that point, cancel_delayed_work() returns true and
    intel_engine_park_heartbeat() reads the stale non-NULL systole pointer
    and calls i915_request_put() on it again, causing a refcount underflow:
    
    ```
    <4> [487.221889] Workqueue: i915-unordered engine_retire [i915]
    <4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0
    ...
    <4> [487.222707] Call Trace:
    <4> [487.222711]  <TASK>
    <4> [487.222716]  intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]
    <4> [487.223115]  intel_engine_park_heartbeat+0x25/0x40 [i915]
    <4> [487.223566]  __engine_park+0xb9/0x650 [i915]
    <4> [487.223973]  ____intel_wakeref_put_last+0x2e/0xb0 [i915]
    <4> [487.224408]  __intel_wakeref_put_last+0x72/0x90 [i915]
    <4> [487.224797]  intel_context_exit_engine+0x7c/0x80 [i915]
    <4> [487.225238]  intel_context_exit+0xf1/0x1b0 [i915]
    <4> [487.225695]  i915_request_retire.part.0+0x1b9/0x530 [i915]
    <4> [487.226178]  i915_request_retire+0x1c/0x40 [i915]
    <4> [487.226625]  engine_retire+0x122/0x180 [i915]
    <4> [487.227037]  process_one_work+0x239/0x760
    <4> [487.227060]  worker_thread+0x200/0x3f0
    <4> [487.227068]  ? __pfx_worker_thread+0x10/0x10
    <4> [487.227075]  kthread+0x10d/0x150
    <4> [487.227083]  ? __pfx_kthread+0x10/0x10
    <4> [487.227092]  ret_from_fork+0x3d4/0x480
    <4> [487.227099]  ? __pfx_kthread+0x10/0x10
    <4> [487.227107]  ret_from_fork_asm+0x1a/0x30
    <4> [487.227141]  </TASK>
    ```
    
    Fix this by replacing the non-atomic pointer read + separate clear with
    xchg() in both racing paths. xchg() is a single indivisible hardware
    instruction that atomically reads the old pointer and writes NULL. This
    guarantees only one of the two concurrent callers obtains the non-NULL
    pointer and performs the put, the other gets NULL and skips it.
    
    Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15880
    Fixes: 058179e72e09 ("drm/i915/gt: Replace hangcheck by heartbeats")
    Cc: <[email protected]> # v5.5+
    Signed-off-by: Sebastian Brzezinka <[email protected]>
    Reviewed-by: Krzysztof Karas <[email protected]>
    Reviewed-by: Andi Shyti <[email protected]>
    Signed-off-by: Andi Shyti <[email protected]>
    Link: https://lore.kernel.org/r/d4c1c14255688dd07cc8044973c4f032a8d1559e.1775038106.git.sebastian.brzezinka@intel.com
    (cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)
    Signed-off-by: Joonas Lahtinen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
drm/i915/psr: Do not use pipe_src as borders for SU area [+ + +]
Author: Jouni Högander <[email protected]>
Date:   Fri Mar 27 13:45:53 2026 +0200

    drm/i915/psr: Do not use pipe_src as borders for SU area
    
    commit 75519f5df2a9b23f7bf305e12dc9a6e3e65c24b7 upstream.
    
    This far using crtc_state->pipe_src as borders for Selective Update area
    haven't caused visible problems as drm_rect_width(crtc_state->pipe_src) ==
    crtc_state->hw.adjusted_mode.crtc_hdisplay and
    drm_rect_height(crtc_state->pipe_src) ==
    crtc_state->hw.adjusted_mode.crtc_vdisplay when pipe scaling is not
    used. On the other hand using pipe scaling is forcing full frame updates and all the
    Selective Update area calculations are skipped. Now this improper usage of
    crtc_state->pipe_src is causing following warnings:
    
    <4> [7771.978166] xe 0000:00:02.0: [drm] drm_WARN_ON_ONCE(su_lines % vdsc_cfg->slice_height)
    
    after WARN_ON_ONCE was added by commit:
    
    "drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters"
    
    These warnings are seen when DSC and pipe scaling are enabled
    simultaneously. This is because on full frame update SU area is improperly
    set as pipe_src which is not aligned with DSC slice height.
    
    Fix these by creating local rectangle using
    crtc_state->hw.adjusted_mode.crtc_hdisplay and
    crtc_state->hw.adjusted_mode.crtc_vdisplay. Use this local rectangle as
    borders for SU area.
    
    Fixes: d6774b8c3c58 ("drm/i915: Ensure damage clip area is within pipe area")
    Cc: <[email protected]> # v6.0+
    Signed-off-by: Jouni Högander <[email protected]>
    Reviewed-by: Mika Kahola <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    (cherry picked from commit da0cdc1c329dd2ff09c41fbbe9fbd9c92c5d2c6e)
    Signed-off-by: Joonas Lahtinen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
EDAC/mc: Fix error path ordering in edac_mc_alloc() [+ + +]
Author: Borislav Petkov (AMD) <[email protected]>
Date:   Tue Mar 31 14:16:23 2026 +0200

    EDAC/mc: Fix error path ordering in edac_mc_alloc()
    
    commit 51520e03e70d6c73e33ee7cbe0319767d05764fe upstream.
    
    When the mci->pvt_info allocation in edac_mc_alloc() fails, the error path
    will call put_device() which will end up calling the device's release
    function.
    
    However, the init ordering is wrong such that device_initialize() happens
    *after* the failed allocation and thus the device itself and the release
    function pointer are not initialized yet when they're called:
    
      MCE: In-kernel MCE decoding enabled.
      ------------[ cut here ]------------
      kobject: '(null)': is not initialized, yet kobject_put() is being called.
      WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd
      CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full)
      RIP: 0010:kobject_put
      Call Trace:
       <TASK>
       edac_mc_alloc+0xbe/0xe0 [edac_core]
       amd64_edac_init+0x7a4/0xff0 [amd64_edac]
       ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac]
       do_one_initcall
       ...
    
    Reorder the calling sequence so that the device is initialized and thus the
    release function pointer is properly set before it can be used.
    
    This was found by Claude while reviewing another EDAC patch.
    
    Fixes: 0bbb265f7089 ("EDAC/mc: Get rid of silly one-shot struct allocation in edac_mc_alloc()")
    Reported-by: Claude Code:claude-opus-4.5
    Signed-off-by: Borislav Petkov (AMD) <[email protected]>
    Reviewed-by: Qiuxu Zhuo <[email protected]>
    Cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
firmware: thead: Fix buffer overflow and use standard endian macros [+ + +]
Author: Michal Wilczynski <[email protected]>
Date:   Thu Apr 3 15:10:51 2025 +0200

    firmware: thead: Fix buffer overflow and use standard endian macros
    
    commit 88c4bd90725557796c15878b7cb70066e9e6b5ab upstream.
    
    Addresses two issues in the TH1520 AON firmware protocol driver:
    
    1. Fix a potential buffer overflow where the code used unsafe pointer
       arithmetic to access the 'mode' field through the 'resource' pointer
       with an offset. This was flagged by Smatch static checker as:
       "buffer overflow 'data' 2 <= 3"
    
    2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard
       kernel endianness conversion macros (cpu_to_be16, etc.) for better
       portability and maintainability.
    
    The functionality was re-tested with the GPU power-up sequence,
    confirming the GPU powers up correctly and the driver probes
    successfully.
    
    [   12.702370] powervr ffef400000.gpu: [drm] loaded firmware
    powervr/rogue_36.52.104.182_v1.fw
    [   12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build
    6645434 OS)
    [   12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on
    minor 0
    
    Fixes: e4b3cbd840e5 ("firmware: thead: Add AON firmware protocol driver")
    Reported-by: Dan Carpenter <[email protected]>
    Closes: https://lore.kernel.org/all/[email protected]/
    Signed-off-by: Michal Wilczynski <[email protected]>
    Reviewed-by: Dan Carpenter <[email protected]>
    Acked-by: Drew Fustini <[email protected]>
    Cc: [email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
i2c: imx: zero-initialize dma_slave_config for eDMA [+ + +]
Author: Anthony Pighin <[email protected]>
Date:   Tue Mar 31 14:26:32 2026 -0400

    i2c: imx: zero-initialize dma_slave_config for eDMA
    
    commit 39ed7d89b973329cc5c764b65ba6302b17b1907e upstream.
    
    commit 66d88e16f204 ("dmaengine: fsl-edma: read/write multiple registers
    in cyclic transactions") causes fsl_edma_fill_tcd() to read
    dst_port_window_size and src_port_window_size when building transfer
    control descriptors.
    
    Initialize the structure so unset fields are explicitly zero.
    
    Fixes: 66d88e16f204 ("dmaengine: fsl-edma: read/write multiple registers in cyclic transactions")
    Signed-off-by: Anthony Pighin <[email protected]>
    Cc: <[email protected]> # v6.14+
    Signed-off-by: Andi Shyti <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling [+ + +]
Author: Emil Tantilov <[email protected]>
Date:   Thu Mar 19 14:13:33 2026 -0700

    idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
    
    commit 591478118293c1bd628de330a99eb1eb2ef8d76b upstream.
    
    Switch from using the completion's raw spinlock to a local lock in the
    idpf_vc_xn struct. The conversion is safe because complete/_all() are
    called outside the lock and there is no reason to share the completion
    lock in the current logic. This avoids invalid wait context reported by
    the kernel due to the async handler taking BH spinlock:
    
    [  805.726977] =============================
    [  805.726991] [ BUG: Invalid wait context ]
    [  805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S         OE
    [  805.727026] -----------------------------
    [  805.727038] kworker/u261:0/572 is trying to lock:
    [  805.727051] ff190da6a8dbb6a0 (&vport_config->mac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
    [  805.727099] other info that might help us debug this:
    [  805.727111] context-{5:5}
    [  805.727119] 3 locks held by kworker/u261:0/572:
    [  805.727132]  #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730
    [  805.727163]  #1: ff3c6f0a6131fe50 ((work_completion)(&(&adapter->mbx_task)->work)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730
    [  805.727191]  #2: ff190da765190020 (&x->wait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf]
    [  805.727218] stack backtrace:
    ...
    [  805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf]
    [  805.727247] Call Trace:
    [  805.727249]  <TASK>
    [  805.727251]  dump_stack_lvl+0x77/0xb0
    [  805.727259]  __lock_acquire+0xb3b/0x2290
    [  805.727268]  ? __irq_work_queue_local+0x59/0x130
    [  805.727275]  lock_acquire+0xc6/0x2f0
    [  805.727277]  ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
    [  805.727284]  ? _printk+0x5b/0x80
    [  805.727290]  _raw_spin_lock_bh+0x38/0x50
    [  805.727298]  ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
    [  805.727303]  idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
    [  805.727310]  idpf_recv_mb_msg+0x1c8/0x710 [idpf]
    [  805.727317]  process_one_work+0x226/0x730
    [  805.727322]  worker_thread+0x19e/0x340
    [  805.727325]  ? __pfx_worker_thread+0x10/0x10
    [  805.727328]  kthread+0xf4/0x130
    [  805.727333]  ? __pfx_kthread+0x10/0x10
    [  805.727336]  ret_from_fork+0x32c/0x410
    [  805.727345]  ? __pfx_kthread+0x10/0x10
    [  805.727347]  ret_from_fork_asm+0x1a/0x30
    [  805.727354]  </TASK>
    
    Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager")
    Cc: [email protected]
    Suggested-by: Sebastian Andrzej Siewior <[email protected]>
    Reported-by: Ray Zhang <[email protected]>
    Signed-off-by: Emil Tantilov <[email protected]>
    Reviewed-by: Aleksandr Loktionov <[email protected]>
    Acked-by: Sebastian Andrzej Siewior <[email protected]>
    Tested-by: Samuel Salin <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

idpf: improve locking around idpf_vc_xn_push_free() [+ + +]
Author: Emil Tantilov <[email protected]>
Date:   Thu Mar 19 14:13:34 2026 -0700

    idpf: improve locking around idpf_vc_xn_push_free()
    
    commit d086fae65006368618104ba4c57779440eab2217 upstream.
    
    Protect the set_bit() operation for the free_xn bitmask in
    idpf_vc_xn_push_free(), to make the locking consistent with rest of the
    code and avoid potential races in that logic.
    
    Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager")
    Cc: [email protected]
    Reported-by: Ray Zhang <[email protected]>
    Signed-off-by: Emil Tantilov <[email protected]>
    Reviewed-by: Aleksandr Loktionov <[email protected]>
    Acked-by: Sebastian Andrzej Siewior <[email protected]>
    Tested-by: Samuel Salin <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

idpf: set the payload size before calling the async handler [+ + +]
Author: Emil Tantilov <[email protected]>
Date:   Thu Mar 19 14:13:35 2026 -0700

    idpf: set the payload size before calling the async handler
    
    commit 8e2a2420e267a515f6db56a6e9570b5cacd92919 upstream.
    
    Set the payload size before forwarding the reply to the async handler.
    Without this, xn->reply_sz will be 0 and idpf_mac_filter_async_handler()
    will never get past the size check.
    
    Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager")
    Cc: [email protected]
    Signed-off-by: Emil Tantilov <[email protected]>
    Reviewed-by: Aleksandr Loktionov <[email protected]>
    Reviewed-by: Li Li <[email protected]>
    Acked-by: Sebastian Andrzej Siewior <[email protected]>
    Tested-by: Samuel Salin <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
igb: remove napi_synchronize() in igb_down() [+ + +]
Author: Alex Dvoretsky <[email protected]>
Date:   Thu Mar 12 14:52:55 2026 +0100

    igb: remove napi_synchronize() in igb_down()
    
    commit b1e067240379f950a0022208e0685f3465c211cb upstream.
    
    When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9),
    the XSK buffer pool is destroyed but NAPI polling continues.
    igb_clean_rx_irq_zc() repeatedly returns the full budget, preventing
    napi_complete_done() from clearing NAPI_STATE_SCHED.
    
    igb_down() calls napi_synchronize() before napi_disable() for each queue
    vector. napi_synchronize() spins waiting for NAPI_STATE_SCHED to clear,
    which never happens. igb_down() blocks indefinitely, the TX watchdog
    fires, and the TX queue remains permanently stalled.
    
    napi_disable() already handles this correctly: it sets NAPI_STATE_DISABLE.
    After a full-budget poll, __napi_poll() checks napi_disable_pending(). If
    set, it forces completion and clears NAPI_STATE_SCHED, breaking the loop
    that napi_synchronize() cannot.
    
    napi_synchronize() was added in commit 41f149a285da ("igb: Fix possible
    panic caused by Rx traffic arrival while interface is down").
    napi_disable() provides stronger guarantees: it prevents further
    scheduling and waits for any active poll to exit.
    Other Intel drivers (ixgbe, ice, i40e) use napi_disable() without a
    preceding napi_synchronize() in their down paths.
    
    Remove redundant napi_synchronize() call and reorder napi_disable()
    before igb_set_queue_napi() so the queue-to-NAPI mapping is only
    cleared after polling has fully stopped.
    
    Fixes: 2c6196013f84 ("igb: Add AF_XDP zero-copy Rx support")
    Cc: [email protected]
    Suggested-by: Maciej Fijalkowski <[email protected]>
    Reviewed-by: Aleksandr Loktionov <[email protected]>
    Signed-off-by: Alex Dvoretsky <[email protected]>
    Reviewed-by: Maciej Fijalkowski <[email protected]>
    Tested-by: Patryk Holda <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Input: uinput - fix circular locking dependency with ff-core [+ + +]
Author: Mikhail Gavrilov <[email protected]>
Date:   Tue Apr 7 12:50:31 2026 +0500

    Input: uinput - fix circular locking dependency with ff-core
    
    commit 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 upstream.
    
    A lockdep circular locking dependency warning can be triggered
    reproducibly when using a force-feedback gamepad with uinput (for
    example, playing ELDEN RING under Wine with a Flydigi Vader 5
    controller):
    
      ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex
    
    The cycle is caused by four lock acquisition paths:
    
    1. ff upload: input_ff_upload() holds ff->mutex and calls
       uinput_dev_upload_effect() -> uinput_request_submit() ->
       uinput_request_send(), which acquires udev->mutex.
    
    2. device create: uinput_ioctl_handler() holds udev->mutex and calls
       uinput_create_device() -> input_register_device(), which acquires
       input_mutex.
    
    3. device register: input_register_device() holds input_mutex and
       calls kbd_connect() -> input_register_handle(), which acquires
       dev->mutex.
    
    4. evdev release: evdev_release() calls input_flush_device() under
       dev->mutex, which calls input_ff_flush() acquiring ff->mutex.
    
    Fix this by introducing a new state_lock spinlock to protect
    udev->state and udev->dev access in uinput_request_send() instead of
    acquiring udev->mutex.  The function only needs to atomically check
    device state and queue an input event into the ring buffer via
    uinput_dev_event() -- both operations are safe under a spinlock
    (ktime_get_ts64() and wake_up_interruptible() do not sleep).  This
    breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in
    the lock ordering and cannot form cycles with mutexes.
    
    To keep state transitions visible to uinput_request_send(), protect
    writes to udev->state in uinput_create_device() and
    uinput_destroy_device() with the same state_lock spinlock.
    
    Additionally, move init_completion(&request->done) from
    uinput_request_send() to uinput_request_submit() before
    uinput_request_reserve_slot().  Once the slot is allocated,
    uinput_flush_requests() may call complete() on it at any time from
    the destroy path, so the completion must be initialised before the
    request becomes visible.
    
    Lock ordering after the fix:
    
      ff->mutex -> state_lock (spinlock, leaf)
      udev->mutex -> state_lock (spinlock, leaf)
      udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
    
    Fixes: ff462551235d ("Input: uinput - switch to the new FF interface")
    Cc: [email protected]
    Link: https://lore.kernel.org/all/CABXGCsMoxag+kEwHhb7KqhuyxfmGGd0P=tHZyb1uKE0pLr8Hkg@mail.gmail.com/
    Signed-off-by: Mikhail Gavrilov <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Dmitry Torokhov <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

Input: uinput - take event lock when submitting FF request "event" [+ + +]
Author: Dmitry Torokhov <[email protected]>
Date:   Tue Apr 7 22:16:27 2026 -0700

    Input: uinput - take event lock when submitting FF request "event"
    
    commit ff14dafde15c11403fac61367a34fea08926e9ee upstream.
    
    To avoid racing with FF playback events and corrupting device's event
    queue take event_lock spinlock when calling uinput_dev_event() when
    submitting a FF upload or erase "event".
    
    Tested-by: Mikhail Gavrilov <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Cc: [email protected]
    Signed-off-by: Dmitry Torokhov <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
kbuild: modules-cpio-pkg: Respect INSTALL_MOD_PATH [+ + +]
Author: Janne Grunau <[email protected]>
Date:   Fri Mar 27 09:30:29 2026 +0100

    kbuild: modules-cpio-pkg: Respect INSTALL_MOD_PATH
    
    commit 742de64b62b690a368dbeb846499eb8ac8ceedb9 upstream.
    
    The modules-cpio-pkg target added in commit 2a9c8c0b59d3 ("kbuild: add
    target to build a cpio containing modules") is incompatible with
    initramfs with merged /lib and /usr/lib directories [1]. "/lib" cannot
    be a link and directory at the same time.
    Respect a non-empty INSTALL_MOD_PATH in the modules-cpio-pkg target so
    that `make INSTALL_MOD_PATH=/usr modules-cpio-pkg` results in the same
    module install location as `make INSTALL_MOD_PATH=/usr modules_install`.
    
    Tested with Fedora distribution initramfs produced by dracut.
    
    Link: https://systemd.io/THE_CASE_FOR_THE_USR_MERGE/ [1]
    Fixes: 2a9c8c0b59d3 ("kbuild: add target to build a cpio containing modules")
    Cc: [email protected]
    Reviewed-by: Simon Glass <[email protected]>
    Reviewed-by: Nathan Chancellor <[email protected]>
    Reviewed-by: Thomas Weißschuh <[email protected]>
    Signed-off-by: Janne Grunau <[email protected]>
    Reviewed-by: Nicolas Schier <[email protected]>
    Tested-by: Nicolas Schier <[email protected]>
    Reviewed-by: Ahmad Fatoum <[email protected]>
    Link: https://patch.msgid.link/20260327-kbuild-modules-cpio-pkg-usr-merge-v3-1-ef507dfa006c@jannau.net
    Signed-off-by: Nathan Chancellor <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Linux: Linux 6.19.13 [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Sat Apr 18 10:46:48 2026 +0200

    Linux 6.19.13
    
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Ronald Warsow <[email protected]>
    Tested-by: Brett A C Sheffield <[email protected]>
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Salvatore Bonaccorso <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Ron Economos <[email protected]>
    Tested-by: Takeshi Ogasawara <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Tested-by: Mark Brown <[email protected]>
    Tested-by: Miguel Ojeda <[email protected]>
    Tested-by: Peter Schneider <[email protected]>
    Tested-by: Barry K. Nathan <[email protected]>
    Tested-by: Shung-Hsi Yu <[email protected]>
    Tested-by: Dileep Malepu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
liveupdate: propagate file deserialization failures [+ + +]
Author: Leo Timmins <[email protected]>
Date:   Wed Mar 25 12:46:07 2026 +0800

    liveupdate: propagate file deserialization failures
    
    commit 307e0c5859b0aecc34180468b1aa76684adcf539 upstream.
    
    luo_session_deserialize() ignored the return value from
    luo_file_deserialize().  As a result, a session could be left partially
    restored even though the /dev/liveupdate open path treats deserialization
    failures as fatal.
    
    Propagate the error so a failed file deserialization aborts session
    deserialization instead of silently continuing.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation")
    Signed-off-by: Leo Timmins <[email protected]>
    Reviewed-by: Pasha Tatashin <[email protected]>
    Reviewed-by: Pratyush Yadav <[email protected]>
    Cc: Mike Rapoport <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
MIPS: Always record SEGBITS in cpu_data.vmbits [+ + +]
Author: Maciej W. Rozycki <[email protected]>
Date:   Fri Apr 10 01:48:10 2026 +0100

    MIPS: Always record SEGBITS in cpu_data.vmbits
    
    commit 8374c2cb83b95b3c92f129fd56527225c20a058c upstream.
    
    With a 32-bit kernel running on 64-bit MIPS hardware the hardcoded value
    of `cpu_vmbits' only records the size of compatibility useg and does not
    reflect the size of native xuseg or the complete range of values allowed
    in the VPN2 field of TLB entries.
    
    An upcoming change will need the actual VPN2 value range permitted even
    in 32-bit kernel configurations, so always include the `vmbits' member
    in `struct cpuinfo_mips' and probe for SEGBITS when running on 64-bit
    hardware and resorting to the currently hardcoded value of 31 on 32-bit
    processors.  No functional change for users of `cpu_vmbits'.
    
    Signed-off-by: Maciej W. Rozycki <[email protected]>
    Signed-off-by: Thomas Bogendoerfer <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

MIPS: mm: Rewrite TLB uniquification for the hidden bit feature [+ + +]
Author: Maciej W. Rozycki <[email protected]>
Date:   Fri Apr 10 01:48:12 2026 +0100

    MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
    
    commit 540760b77b8fc49d39d1b2b76196e5ec57711a32 upstream.
    
    Before the introduction of the EHINV feature, which lets software mark
    TLB entries invalid, certain older implementations of the MIPS ISA were
    equipped with an analogous bit, as a vendor extension, which however is
    hidden from software and only ever set at reset, and then any software
    write clears it, making the intended TLB entry valid.
    
    This feature makes it unsafe to read a TLB entry with TLBR, modify the
    page mask, and write the entry back with TLBWI, because this operation
    will implicitly clear the hidden bit and this may create a duplicate
    entry, as with the presence of the hidden bit there is no guarantee all
    the entries across the TLB are unique each.
    
    Usually the firmware has already uniquified TLB entries before handing
    control over, in which case we only need to guarantee at bootstrap no
    clash will happen with the VPN2 values chosen in local_flush_tlb_all().
    
    However with systems such as Mikrotik RB532 we get handed the TLB as at
    reset, with the hidden bit set across the entries and possibly duplicate
    entries present.  This then causes a machine check exception when page
    sizes are reset in r4k_tlb_uniquify() and prevents the system from
    booting.
    
    Rewrite the algorithm used in r4k_tlb_uniquify() then such as to avoid
    the reuse of ASID/VPN values across the TLB.  Get rid of global entries
    first as they may be blocking the entire address space, e.g. 16 256MiB
    pages will exhaust the whole address space of a 32-bit CPU and a single
    big page can exhaust the 32-bit compatibility space on a 64-bit CPU.
    
    Details of the algorithm chosen are given across the code itself.
    
    Fixes: 9f048fa48740 ("MIPS: mm: Prevent a TLB shutdown on initial uniquification")
    Signed-off-by: Maciej W. Rozycki <[email protected]>
    Cc: [email protected] # v6.18+
    Signed-off-by: Thomas Bogendoerfer <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

MIPS: mm: Suppress TLB uniquification on EHINV hardware [+ + +]
Author: Maciej W. Rozycki <[email protected]>
Date:   Fri Apr 10 01:48:11 2026 +0100

    MIPS: mm: Suppress TLB uniquification on EHINV hardware
    
    commit 74283cfe216392c7b776ebf6045b5b15ed9dffcd upstream.
    
    Hardware that supports the EHINV feature, mandatory for R6 ISA and FTLB
    implementation, lets software mark TLB entries invalid, which eliminates
    the need to ensure no duplicate matching entries are ever created.  This
    feature is already used by local_flush_tlb_all(), via the UNIQUE_ENTRYHI
    macro, making the preceding call to r4k_tlb_uniquify() superfluous.
    
    The next change will also modify uniquification code such that it'll
    become incompatible with the FTLB and MMID features, as well as MIPSr6
    CPUs that do not implement 4KiB pages.
    
    Therefore prevent r4k_tlb_uniquify() from being used on EHINV hardware,
    as denoted by `cpu_has_tlbinv'.
    
    Signed-off-by: Maciej W. Rozycki <[email protected]>
    Signed-off-by: Thomas Bogendoerfer <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
mm/damon/stat: deallocate damon_call() failure leaking damon_ctx [+ + +]
Author: SeongJae Park <[email protected]>
Date:   Thu Apr 2 06:44:17 2026 -0700

    mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
    
    commit 4c04c6b47c361612b1d70cec8f7a60b1482d1400 upstream.
    
    damon_stat_start() always allocates the module's damon_ctx object
    (damon_stat_context).  Meanwhile, if damon_call() in the function fails,
    the damon_ctx object is not deallocated.  Hence, if the damon_call() is
    failed, and the user writes Y to “enabled” again, the previously
    allocated damon_ctx object is leaked.
    
    This cannot simply be fixed by deallocating the damon_ctx object when
    damon_call() fails.  That's because damon_call() failure doesn't guarantee
    the kdamond main function, which accesses the damon_ctx object, is
    completely finished.  In other words, if damon_stat_start() deallocates
    the damon_ctx object after damon_call() failure, the not-yet-terminated
    kdamond could access the freed memory (use-after-free).
    
    Fix the leak while avoiding the use-after-free by keeping returning
    damon_stat_start() without deallocating the damon_ctx object after
    damon_call() failure, but deallocating it when the function is invoked
    again and the kdamond is completely terminated.  If the kdamond is not yet
    terminated, simply return -EAGAIN, as the kdamond will soon be terminated.
    
    The issue was discovered [1] by sashiko.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Link: https://lore.kernel.org/[email protected] [1]
    Fixes: 405f61996d9d ("mm/damon/stat: use damon_call() repeat mode instead of damon_callback")
    Signed-off-by: SeongJae Park <[email protected]>
    Cc: <[email protected]> # 6.17.x
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails [+ + +]
Author: SeongJae Park <[email protected]>
Date:   Thu Mar 26 17:32:22 2026 -0700

    mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails
    
    commit 0199390a6b92fc21860e1b858abf525c7e73b956 upstream.
    
    damon_call() for repeat_call_control of DAMON_SYSFS could fail if somehow
    the kdamond is stopped before the damon_call().  It could happen, for
    example, when te damon context was made for monitroing of a virtual
    address processes, and the process is terminated immediately, before the
    damon_call() invocation.  In the case, the dyanmically allocated
    repeat_call_control is not deallocated and leaked.
    
    Fix the leak by deallocating the repeat_call_control under the
    damon_call() failure.
    
    This issue is discovered by sashiko [1].
    
    Link: https://lkml.kernel.org/r/[email protected]
    Link: https://lore.kernel.org/[email protected] [1]
    Fixes: 04a06b139ec0 ("mm/damon/sysfs: use dynamically allocated repeat mode damon_call_control")
    Signed-off-by: SeongJae Park <[email protected]>
    Cc: <[email protected]>    [6.17+]
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug [+ + +]
Author: Hao Li <[email protected]>
Date:   Mon Mar 30 11:57:49 2026 +0800

    mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug
    
    commit 2ecbe06abf9bfb2261cd6464a6bc3a3615625402 upstream.
    
    N_NORMAL_MEMORY is initialized from zone population at boot, but memory
    hotplug currently only updates N_MEMORY.  As a result, a node that gains
    normal memory via hotplug can remain invisible to users iterating over
    N_NORMAL_MEMORY, while a node that loses its last normal memory can stay
    incorrectly marked as such.
    
    The most visible effect is that
    /sys/devices/system/node/has_normal_memory does not report a node even
    after that node has gained normal memory via hotplug.
    
    Also, list_lru-based shrinkers can undercount objects on such a node
    and may skip reclaim on that node entirely, which can lead to a higher
    memory footprint than expected.
    
    Restore N_NORMAL_MEMORY maintenance directly in online_pages() and
    offline_pages().  Set the bit when a node that currently lacks normal
    memory onlines pages into a zone <= ZONE_NORMAL, and clear it when
    offlining removes the last present pages from zones <= ZONE_NORMAL.
    
    This restores the intended semantics without bringing back the old
    status_change_nid_normal notifier plumbing which was removed in
    8d2882a8edb8.
    
    Current users that benefit include list_lru, zswap, nfsd filecache,
    hugetlb_cgroup, and has_normal_memory sysfs reporting.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 8d2882a8edb8 ("mm,memory_hotplug: remove status_change_nid_normal and update documentation")
    Signed-off-by: Hao Li <[email protected]>
    Reviewed-by: Harry Yoo (Oracle) <[email protected]>
    Acked-by: Vlastimil Babka (SUSE) <[email protected]>
    Reviewed-by: Joshua Hahn <[email protected]>
    Acked-by: David Hildenbrand (Arm) <[email protected]>
    Cc: Oscar Salvador <[email protected]>
    Cc: Vlastimil Babka <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mm/vma: fix memory leak in __mmap_region() [+ + +]
Author: Sechang Lim <[email protected]>
Date:   Tue Mar 31 18:08:11 2026 +0000

    mm/vma: fix memory leak in __mmap_region()
    
    commit 894f99eb535edc4514f756818f3c4f688ba53a59 upstream.
    
    commit 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare
    swaps the file") handled the success path by skipping get_file() via
    file_doesnt_need_get, but missed the error path.
    
    When /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls
    shmem_zero_setup_desc() which allocates a new shmem file to back the
    mapping. If __mmap_new_vma() subsequently fails, this replacement
    file is never fput()'d - the original is released by
    ksys_mmap_pgoff(), but nobody releases the new one.
    
    Add fput() for the swapped file in the error path.
    
    Reproducible with fault injection.
    
    FAULT_INJECTION: forcing a failure.
    name failslab, interval 1, probability 0, space 0, times 1
    CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full)
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x164/0x1f0
     should_fail_ex+0x525/0x650
     should_failslab+0xdf/0x140
     kmem_cache_alloc_noprof+0x78/0x630
     vm_area_alloc+0x24/0x160
     __mmap_region+0xf6b/0x2660
     mmap_region+0x2eb/0x3a0
     do_mmap+0xc79/0x1240
     vm_mmap_pgoff+0x252/0x4c0
     ksys_mmap_pgoff+0xf8/0x120
     __x64_sys_mmap+0x12a/0x190
     do_syscall_64+0xa9/0x580
     entry_SYSCALL_64_after_hwframe+0x76/0x7e
     </TASK>
    
    kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
    BUG: memory leak
    unreferenced object 0xffff8881118aca80 (size 360):
      comm "syz.7.14", pid 366, jiffies 4294913255
      hex dump (first 32 bytes):
        00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
        ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff  .........(M.....
      backtrace (crc db0f53bc):
        kmem_cache_alloc_noprof+0x3ab/0x630
        alloc_empty_file+0x5a/0x1e0
        alloc_file_pseudo+0x135/0x220
        __shmem_file_setup+0x274/0x420
        shmem_zero_setup_desc+0x9c/0x170
        mmap_zero_prepare+0x123/0x140
        __mmap_region+0xdda/0x2660
        mmap_region+0x2eb/0x3a0
        do_mmap+0xc79/0x1240
        vm_mmap_pgoff+0x252/0x4c0
        ksys_mmap_pgoff+0xf8/0x120
        __x64_sys_mmap+0x12a/0x190
        do_syscall_64+0xa9/0x580
        entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
    Found by syzkaller.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file")
    Signed-off-by: Sechang Lim <[email protected]>
    Reviewed-by: Lorenzo Stoakes (Oracle) <[email protected]>
    Acked-by: Vlastimil Babka (SUSE) <[email protected]>
    Cc: Jann Horn <[email protected]>
    Cc: Liam Howlett <[email protected]>
    Cc: Lorenzo Stoakes (Oracle) <[email protected]>
    Cc: Pedro Falcato <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() [+ + +]
Author: Baolin Wang <[email protected]>
Date:   Tue Mar 17 17:29:55 2026 +0800

    mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
    
    commit f58df566524ebcdfa394329c64f47e3c9257516e upstream.
    
    When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I
    encountered some very strange crash issues showing up as "Bad page state":
    
    "
    [  734.496287] BUG: Bad page state in process stress-ng-env  pfn:415735fb
    [  734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb
    [  734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff)
    [  734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000
    [  734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000
    [  734.496442] page dumped because: nonzero mapcount
    "
    
    After analyzing this page’s state, it is hard to understand why the
    mapcount is not 0 while the refcount is 0, since this page is not where
    the issue first occurred.  By enabling the CONFIG_DEBUG_VM config, I can
    reproduce the crash as well and captured the first warning where the issue
    appears:
    
    "
    [  734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0
    [  734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
    [  734.469315] memcg:ffff000807a8ec00
    [  734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):"stress-ng-mmaptorture-9397-0-2736200540"
    [  734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff)
    ......
    [  734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1),
    const struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *:
    (struct folio *)_compound_head(page + nr_pages - 1))) != folio)
    [  734.469390] ------------[ cut here ]------------
    [  734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468,
    CPU#90: stress-ng-mlock/9430
    [  734.469551]  folio_add_file_rmap_ptes+0x3b8/0x468 (P)
    [  734.469555]  set_pte_range+0xd8/0x2f8
    [  734.469566]  filemap_map_folio_range+0x190/0x400
    [  734.469579]  filemap_map_pages+0x348/0x638
    [  734.469583]  do_fault_around+0x140/0x198
    ......
    [  734.469640]  el0t_64_sync+0x184/0x188
    "
    
    The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page +
    nr_pages - 1) != folio, folio)", which indicates that set_pte_range()
    tried to map beyond the large folio’s size.
    
    By adding more debug information, I found that 'nr_pages' had overflowed
    in filemap_map_pages(), causing set_pte_range() to establish mappings for
    a range exceeding the folio size, potentially corrupting fields of pages
    that do not belong to this folio (e.g., page->_mapcount).
    
    After above analysis, I think the possible race is as follows:
    
    CPU 0                                                  CPU 1
    filemap_map_pages()                                   ext4_setattr()
       //get and lock folio with old inode->i_size
       next_uptodate_folio()
    
                                                              .......
                                                              //shrink the inode->i_size
                                                              i_size_write(inode, attr->ia_size);
    
       //calculate the end_pgoff with the new inode->i_size
       file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;
       end_pgoff = min(end_pgoff, file_end);
    
       ......
       //nr_pages can be overflowed, cause xas.xa_index > end_pgoff
       end = folio_next_index(folio) - 1;
       nr_pages = min(end, end_pgoff) - xas.xa_index + 1;
    
       ......
       //map large folio
       filemap_map_folio_range()
                                                              ......
                                                              //truncate folios
                                                              truncate_pagecache(inode, inode->i_size);
    
    To fix this issue, move the 'end_pgoff' calculation before
    next_uptodate_folio(), so the retrieved folio stays consistent with the
    file end to avoid 'nr_pages' calculation overflow.  After this patch, the
    crash issue is gone.
    
    Link: https://lkml.kernel.org/r/1cf1ac59018fc647a87b0dad605d4056a71c14e4.1773739704.git.baolin.wang@linux.alibaba.com
    Fixes: 743a2753a02e ("filemap: cap PTE range to be created to allowed zero fill in folio_map_range()")
    Signed-off-by: Baolin Wang <[email protected]>
    Reported-by: Yuanhe Shu <[email protected]>
    Tested-by: Yuanhe Shu <[email protected]>
    Acked-by: Kiryl Shutsemau (Meta) <[email protected]>
    Acked-by: David Hildenbrand (Arm) <[email protected]>
    Cc: Christian Brauner <[email protected]>
    Cc: Daniel Gomez <[email protected]>
    Cc: "Darrick J. Wong" <[email protected]>
    Cc: Dave Chinner <[email protected]>
    Cc: David Howells <[email protected]>
    Cc: Hannes Reinecke <[email protected]>
    Cc: Lorenzo Stoakes (Oracle) <[email protected]>
    Cc: Luis Chamberalin <[email protected]>
    Cc: Matthew Wilcox (Oracle) <[email protected]>
    Cc: Pankaj Raghav <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mmc: vub300: fix NULL-deref on disconnect [+ + +]
Author: Johan Hovold <[email protected]>
Date:   Fri Mar 27 11:52:05 2026 +0100

    mmc: vub300: fix NULL-deref on disconnect
    
    commit dff34ef879c5e73298443956a8b391311ba78d57 upstream.
    
    Make sure to deregister the controller before dropping the reference to
    the driver data on disconnect to avoid NULL-pointer dereferences or
    use-after-free.
    
    Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
    Cc: [email protected] # 3.0+
    Signed-off-by: Johan Hovold <[email protected]>
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

mmc: vub300: fix use-after-free on disconnect [+ + +]
Author: Johan Hovold <[email protected]>
Date:   Fri Mar 27 11:52:06 2026 +0100

    mmc: vub300: fix use-after-free on disconnect
    
    commit 8f4d20a710225ec7a565f6a0459862d3b1f32330 upstream.
    
    The vub300 driver maintains an explicit reference count for the
    controller and its driver data and the last reference can in theory be
    dropped after the driver has been unbound.
    
    This specifically means that the controller allocation must not be
    device managed as that can lead to use-after-free.
    
    Note that the lifetime is currently also incorrectly tied the parent USB
    device rather than interface, which can lead to memory leaks if the
    driver is unbound without its device being physically disconnected (e.g.
    on probe deferral).
    
    Fix both issues by reverting to non-managed allocation of the controller.
    
    Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper")
    Cc: [email protected] # 6.17+
    Cc: Binbin Zhou <[email protected]>
    Signed-off-by: Johan Hovold <[email protected]>
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
modpost: Declare extra_warn with unused attribute [+ + +]
Author: Nathan Chancellor <[email protected]>
Date:   Wed Mar 25 18:20:30 2026 -0700

    modpost: Declare extra_warn with unused attribute
    
    commit deb4605671cfae3b2803cfbbf4739e7245248398 upstream.
    
    A recent strengthening of -Wunused-but-set-variable (enabled with -Wall)
    in clang under a new subwarning, -Wunused-but-set-global, points out an
    unused static global variable in scripts/mod/modpost.c:
    
      scripts/mod/modpost.c:59:13: error: variable 'extra_warn' set but not used [-Werror,-Wunused-but-set-global]
         59 | static bool extra_warn;
            |             ^
    
    This variable has been unused since commit 6c6c1fc09de3 ("modpost:
    require a MODULE_DESCRIPTION()") but that is expected, as there are
    currently no extra warnings at W=1 right now. Declare the variable with
    the unused attribute to make it clear to the compiler that this variable
    may be unused.
    
    Cc: [email protected]
    Fixes: 6c6c1fc09de3 ("modpost: require a MODULE_DESCRIPTION()")
    Link: https://patch.msgid.link/20260325-modpost-extra_warn-unused-but-set-global-v1-1-2e84003b7e81@kernel.org
    Reviewed-by: Nicolas Schier <[email protected]>
    Signed-off-by: Nathan Chancellor <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mptcp: fix slab-use-after-free in __inet_lookup_established [+ + +]
Author: Jiayuan Chen <[email protected]>
Date:   Mon Apr 6 11:15:10 2026 +0800

    mptcp: fix slab-use-after-free in __inet_lookup_established
    
    commit 9b55b253907e7431210483519c5ad711a37dafa1 upstream.
    
    The ehash table lookups are lockless and rely on
    SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability
    during RCU read-side critical sections. Both tcp_prot and
    tcpv6_prot have their slab caches created with this flag
    via proto_register().
    
    However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into
    tcpv6_prot_override during inet_init() (fs_initcall, level 5),
    before inet6_init() (module_init/device_initcall, level 6) has
    called proto_register(&tcpv6_prot). At that point,
    tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab
    remains NULL permanently.
    
    This causes MPTCP v6 subflow child sockets to be allocated via
    kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab
    cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so
    when these sockets are freed without SOCK_RCU_FREE (which is
    cleared for child sockets by design), the memory can be
    immediately reused. Concurrent ehash lookups under
    rcu_read_lock can then access freed memory, triggering a
    slab-use-after-free in __inet_lookup_established.
    
    Fix this by splitting the IPv6-specific initialization out of
    mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called
    from mptcp_proto_v6_init() before protocol registration. This
    ensures tcpv6_prot_override.slab correctly inherits the
    SLAB_TYPESAFE_BY_RCU slab cache.
    
    Fixes: b19bc2945b40 ("mptcp: implement delegated actions")
    Cc: [email protected]
    Signed-off-by: Jiayuan Chen <[email protected]>
    Reviewed-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
net/mlx5: Update the list of the PCI supported devices [+ + +]
Author: Michael Guralnik <[email protected]>
Date:   Fri Apr 3 12:17:56 2026 +0300

    net/mlx5: Update the list of the PCI supported devices
    
    commit a9d4f4f6e65e0bf9bbddedecc84d67249991979c upstream.
    
    Add the upcoming ConnectX-10 NVLink-C2C device ID to the table of
    supported PCI device IDs.
    
    Cc: [email protected]
    Signed-off-by: Michael Guralnik <[email protected]>
    Reviewed-by: Patrisious Haddad <[email protected]>
    Signed-off-by: Tariq Toukan <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption [+ + +]
Author: Muhammad Alifa Ramdhan <[email protected]>
Date:   Fri Apr 3 09:36:17 2026 +0800

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
    
    commit a9b8b18364fffce4c451e6f6fd218fa4ab646705 upstream.
    
    The -EBUSY handling in tls_do_encryption(), introduced by commit
    859054147318 ("net: tls: handle backlogging of crypto requests"), has
    a use-after-free due to double cleanup of encrypt_pending and the
    scatterlist entry.
    
    When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to
    the cryptd backlog and the async callback tls_encrypt_done() will be
    invoked upon completion. That callback unconditionally restores the
    scatterlist entry (sge->offset, sge->length) and decrements
    ctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an
    error, the synchronous error path in tls_do_encryption() performs the
    same cleanup again, double-decrementing encrypt_pending and
    double-restoring the scatterlist.
    
    The double-decrement corrupts the encrypt_pending sentinel (initialized
    to 1), making tls_encrypt_async_wait() permanently skip the wait for
    pending async callbacks. A subsequent sendmsg can then free the
    tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still
    pending, resulting in a use-after-free when the callback fires on the
    freed record.
    
    Fix this by skipping the synchronous cleanup when the -EBUSY async
    wait returns an error, since the callback has already handled
    encrypt_pending and sge restoration.
    
    Fixes: 859054147318 ("net: tls: handle backlogging of crypto requests")
    Cc: [email protected]
    Signed-off-by: Muhammad Alifa Ramdhan <[email protected]>
    Reviewed-by: Sabrina Dubroca <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() [+ + +]
Author: David Carlier <[email protected]>
Date:   Wed Apr 1 22:12:18 2026 +0100

    net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
    
    commit 6dede3967619b5944003227a5d09fdc21ed57d10 upstream.
    
    When dma_map_single() fails in tse_start_xmit(), the function returns
    NETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the
    stack the packet was consumed, the skb is never freed, leaking memory
    on every DMA mapping failure.
    
    Add dev_kfree_skb_any() before returning to properly free the skb.
    
    Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver")
    Cc: [email protected]
    Signed-off-by: David Carlier <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

net: lan966x: fix page pool leak in error paths [+ + +]
Author: David Carlier <[email protected]>
Date:   Sun Apr 5 06:52:40 2026 +0100

    net: lan966x: fix page pool leak in error paths
    
    commit 076344a6ad9d1308faaed1402fdcfdda68b604ab upstream.
    
    lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if
    the subsequent fdma_alloc_coherent() call fails, leaking the pool.
    
    Similarly, lan966x_fdma_init() frees the coherent DMA memory when
    lan966x_fdma_tx_alloc() fails but does not destroy the page pool that
    was successfully created by lan966x_fdma_rx_alloc(), leaking it.
    
    Add the missing page_pool_destroy() calls in both error paths.
    
    Fixes: 11871aba1974 ("net: lan96x: Use page_pool API")
    Cc: [email protected]
    Signed-off-by: David Carlier <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() [+ + +]
Author: David Carlier <[email protected]>
Date:   Sun Apr 5 06:52:39 2026 +0100

    net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
    
    commit 3fd0da4fd8851a7e62d009b7db6c4a05b092bc19 upstream.
    
    page_pool_create() can return an ERR_PTR on failure. The return value
    is used unconditionally in the loop that follows, passing the error
    pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),
    which dereferences it, causing a kernel oops.
    
    Add an IS_ERR check after page_pool_create() to return early on failure.
    
    Fixes: 11871aba1974 ("net: lan96x: Use page_pool API")
    Cc: [email protected]
    Signed-off-by: David Carlier <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() [+ + +]
Author: David Carlier <[email protected]>
Date:   Sun Apr 5 06:52:41 2026 +0100

    net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
    
    commit 59c3d55a946cacdb4181600723c20ac4f4c20c84 upstream.
    
    When lan966x_fdma_reload() fails to allocate new RX buffers, the restore
    path restarts DMA using old descriptors whose pages were already freed
    via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can
    release pages back to the buddy allocator, the hardware may DMA into
    memory now owned by other kernel subsystems.
    
    Additionally, on the restore path, the newly created page pool (if
    allocation partially succeeded) is overwritten without being destroyed,
    leaking it.
    
    Fix both issues by deferring the release of old pages until after the
    new allocation succeeds. Save the old page array before the allocation
    so old pages can be freed on the success path. On the failure path, the
    old descriptors, pages and page pool are all still valid, making the
    restore safe. Also ensure the restore path re-enables NAPI and wakes
    the netdev, matching the success path.
    
    Fixes: 89ba464fcf54 ("net: lan966x: refactor buffer reload function")
    Cc: [email protected]
    Signed-off-by: David Carlier <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure [+ + +]
Author: Pengpeng Hou <[email protected]>
Date:   Thu Apr 2 15:12:07 2026 +0800

    net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
    
    commit b76254c55dc8f23edc089027dd3f8792554c69fb upstream.
    
    qca_tty_receive() consumes each input byte before checking whether a
    completed frame needs a fresh receive skb. When the current byte completes
    a frame, the driver delivers that frame and then allocates a new skb for
    the next one.
    
    If that allocation fails, the current code returns i even though data[i]
    has already been consumed and may already have completed the delivered
    frame. Since serdev interprets the return value as the number of accepted
    bytes, this under-reports progress by one byte and can replay the final
    byte of the completed frame into a fresh parser state on the next call.
    
    Return i + 1 in that failure path so the accepted-byte count matches the
    actual receive-state progress.
    
    Fixes: dfc768fbe618 ("net: qualcomm: add QCA7000 UART driver")
    Cc: [email protected]
    Signed-off-by: Pengpeng Hou <[email protected]>
    Reviewed-by: Stefan Wahren <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

net: rfkill: prevent unlimited numbers of rfkill events from being created [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Mon Mar 30 11:14:13 2026 +0200

    net: rfkill: prevent unlimited numbers of rfkill events from being created
    
    commit ea245d78dec594372e27d8c79616baf49e98a4a1 upstream.
    
    Userspace can create an unlimited number of rfkill events if the system
    is so configured, while not consuming them from the rfkill file
    descriptor, causing a potential out of memory situation.  Prevent this
    from bounding the number of pending rfkill events at a "large" number
    (i.e. 1000) to prevent abuses like this.
    
    Cc: Johannes Berg <[email protected]>
    Reported-by: Yuan Tan <[email protected]>
    Reported-by: Yifan Wu <[email protected]>
    Reported-by: Juefei Pu <[email protected]>
    Reported-by: Xin Liu <[email protected]>
    Cc: stable <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Link: https://patch.msgid.link/2026033013-disfigure-scroll-e25e@gregkh
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

net: skb: fix cross-cache free of KFENCE-allocated skb head [+ + +]
Author: Jiayuan Chen <[email protected]>
Date:   Fri Apr 3 09:45:12 2026 +0800

    net: skb: fix cross-cache free of KFENCE-allocated skb head
    
    commit 0f42e3f4fe2a58394e37241d02d9ca6ab7b7d516 upstream.
    
    SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2
    value (e.g. 704 on x86_64) to avoid collisions with generic kmalloc
    bucket sizes. This ensures that skb_kfree_head() can reliably use
    skb_end_offset to distinguish skb heads allocated from
    skb_small_head_cache vs. generic kmalloc caches.
    
    However, when KFENCE is enabled, kfence_ksize() returns the exact
    requested allocation size instead of the slab bucket size. If a caller
    (e.g. bpf_test_init) allocates skb head data via kzalloc() and the
    requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then
    slab_build_skb() -> ksize() returns that exact value. After subtracting
    skb_shared_info overhead, skb_end_offset ends up matching
    SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free
    the object to skb_small_head_cache instead of back to the original
    kmalloc cache, resulting in a slab cross-cache free:
    
      kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected
      skbuff_small_head but got kmalloc-1k
    
    Fix this by always calling kfree(head) in skb_kfree_head(). This keeps
    the free path generic and avoids allocator-specific misclassification
    for KFENCE objects.
    
    Fixes: bf9f1baa279f ("net: add dedicated kmem_cache for typical/small skb->head")
    Reported-by: Antonius <[email protected]>
    Closes: https://lore.kernel.org/netdev/CAK8a0jxC5L5N7hq-DT2_NhUyjBxrPocoiDazzsBk4TGgT1r4-A@mail.gmail.com/
    Signed-off-by: Jiayuan Chen <[email protected]>
    Reviewed-by: Eric Dumazet <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

net: stmmac: fix integer underflow in chain mode [+ + +]
Author: Tyllis Xu <[email protected]>
Date:   Tue Mar 31 23:47:07 2026 -0500

    net: stmmac: fix integer underflow in chain mode
    
    commit 51f4e090b9f87b40c21b6daadb5c06e6c0a07b67 upstream.
    
    The jumbo_frm() chain-mode implementation unconditionally computes
    
        len = nopaged_len - bmax;
    
    where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is
    BUF_SIZE_8KiB or BUF_SIZE_2KiB.  However, the caller stmmac_xmit()
    decides to invoke jumbo_frm() based on skb->len (total length including
    page fragments):
    
        is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);
    
    When a packet has a small linear portion (nopaged_len <= bmax) but a
    large total length due to page fragments (skb->len > bmax), the
    subtraction wraps as an unsigned integer, producing a huge len value
    (~0xFFFFxxxx).  This causes the while (len != 0) loop to execute
    hundreds of thousands of iterations, passing skb->data + bmax * i
    pointers far beyond the skb buffer to dma_map_single().  On IOMMU-less
    SoCs (the typical deployment for stmmac), this maps arbitrary kernel
    memory to the DMA engine, constituting a kernel memory disclosure and
    potential memory corruption from hardware.
    
    Fix this by introducing a buf_len local variable clamped to
    min(nopaged_len, bmax).  Computing len = nopaged_len - buf_len is then
    always safe: it is zero when the linear portion fits within a single
    descriptor, causing the while (len != 0) loop to be skipped naturally,
    and the fragment loop in stmmac_xmit() handles page fragments afterward.
    
    Fixes: 286a83721720 ("stmmac: add CHAINED descriptor mode support (V4)")
    Cc: [email protected]
    Signed-off-by: Tyllis Xu <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
netfilter: nft_ct: fix use-after-free in timeout object destroy [+ + +]
Author: Tuan Do <[email protected]>
Date:   Fri Apr 3 00:33:17 2026 -0700

    netfilter: nft_ct: fix use-after-free in timeout object destroy
    
    commit f8dca15a1b190787bbd03285304b569631160eda upstream.
    
    nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
    immediately after nf_ct_untimeout(), without waiting for an RCU grace
    period. Concurrent packet processing on other CPUs may still hold
    RCU-protected references to the timeout object obtained via
    rcu_dereference() in nf_ct_timeout_data().
    
    Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer
    freeing until after an RCU grace period, matching the approach already
    used in nfnetlink_cttimeout.c.
    
    KASAN report:
     BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0
     Read of size 4 at addr ffff8881035fe19c by task exploit/80
    
     Call Trace:
      nf_conntrack_tcp_packet+0x1381/0x29d0
      nf_conntrack_in+0x612/0x8b0
      nf_hook_slow+0x70/0x100
      __ip_local_out+0x1b2/0x210
      tcp_sendmsg_locked+0x722/0x1580
      __sys_sendto+0x2d8/0x320
    
     Allocated by task 75:
      nft_ct_timeout_obj_init+0xf6/0x290
      nft_obj_init+0x107/0x1b0
      nf_tables_newobj+0x680/0x9c0
      nfnetlink_rcv_batch+0xc29/0xe00
    
     Freed by task 26:
      nft_obj_destroy+0x3f/0xa0
      nf_tables_trans_destroy_work+0x51c/0x5c0
      process_one_work+0x2c4/0x5a0
    
    Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support")
    Cc: [email protected]
    Signed-off-by: Tuan Do <[email protected]>
    Signed-off-by: Florian Westphal <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
nfc: pn533: allocate rx skb before consuming bytes [+ + +]
Author: Pengpeng Hou <[email protected]>
Date:   Sun Apr 5 08:40:00 2026 +0800

    nfc: pn533: allocate rx skb before consuming bytes
    
    commit c71ba669b570c7b3f86ec875be222ea11dacb352 upstream.
    
    pn532_receive_buf() reports the number of accepted bytes to the serdev
    core. The current code consumes bytes into recv_skb and may already hand
    a complete frame to pn533_recv_frame() before allocating a fresh receive
    buffer.
    
    If that alloc_skb() fails, the callback returns 0 even though it has
    already consumed bytes, and it leaves recv_skb as NULL for the next
    receive callback. That breaks the receive_buf() accounting contract and
    can also lead to a NULL dereference on the next skb_put_u8().
    
    Allocate the receive skb lazily before consuming the next byte instead.
    If allocation fails, return the number of bytes already accepted.
    
    Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver")
    Cc: [email protected]
    Signed-off-by: Pengpeng Hou <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
platform/x86/intel-uncore-freq: Handle autonomous UFS status bit [+ + +]
Author: Srinivas Pandruvada <[email protected]>
Date:   Wed Mar 25 12:29:09 2026 -0700

    platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
    
    commit 4ab604b3f3aa8dcccc7505f5d310016682a99d5f upstream.
    
    When the AUTONOMOUS_UFS_DISABLED bit is set in the header, the ELC
    (Efficiency Latency Control) feature is non-functional. Hence, return
    error for read or write to ELC attributes.
    
    Fixes: bb516dc79c4a ("platform/x86/intel-uncore-freq: Add support for efficiency latency control")
    Signed-off-by: Srinivas Pandruvada <[email protected]>
    Cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Reviewed-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
platform/x86: ISST: Reset core count to 0 [+ + +]
Author: Srinivas Pandruvada <[email protected]>
Date:   Wed Mar 25 12:26:38 2026 -0700

    platform/x86: ISST: Reset core count to 0
    
    commit e1415b9418eb22b4a7a1ef4b4aec9dd0a49e3fa7 upstream.
    
    Based on feature revision, number of buckets can be less than the
    TRL_MAX_BUCKETS. In that case core counts in the remaining buckets
    can be set to some invalid values.
    
    Hence reset core count to 0 for all buckets before assigning correct
    values.
    
    Fixes: 885d1c2a30b7 ("platform/x86: ISST: Support SST-TF revision 2")
    Signed-off-by: Srinivas Pandruvada <[email protected]>
    Cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Reviewed-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled [+ + +]
Author: Jacky Bai <[email protected]>
Date:   Fri Mar 20 16:43:46 2026 +0800

    pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
    
    commit e91d5f94acf68618ea3ad9c92ac28614e791ae7d upstream.
    
    Keep the NOC_HDCP clock always enabled to fix the potential hang
    caused by the NoC ADB400 port power down handshake.
    
    Fixes: 77b0ddb42add ("soc: imx: add i.MX8MP HDMI blk ctrl HDCP/HRV_MWR")
    Signed-off-by: Jacky Bai <[email protected]>
    Cc: [email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone" [+ + +]
Author: Takashi Iwai <[email protected]>
Date:   Tue Apr 7 14:33:17 2026 +0200

    Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone"
    
    commit 8508e9118649f13f7b857e9e10147b241db615d7 upstream.
    
    This reverts commit 56fbbe096a89ff4b52af78a21a4afd9d94bdcc80.
    
    It caused regressions on other Gigabyte models, and looking at the
    bugzilla entry again, the suggested change appears rather dubious, as
    incorrectly setting the front mic pin as the headphone.
    
    Fixes: 56fbbe096a89 ("ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone")
    Cc: <[email protected]>
    Reported-by: Marcin Krycki <[email protected]>
    Reported-by: Theodoros Orfanidis <[email protected]>
    Closes: https://lore.kernel.org/CAEfRphPU_ABuVFzaHhspxgp2WAqi7kKNGo4yOOt0zeVFPSj8+Q@mail.gmail.com
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" [+ + +]
Author: Sebastian Krzyszkowiak <[email protected]>
Date:   Sat Feb 21 19:15:18 2026 +0100

    Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
    
    commit 4cd46ea0eb4504f7f4fea92cb4601c5c9a3e545e upstream.
    
    This reverts commit c24a9b698fb02cd0723fa8375abab07f94b97b10.
    
    It's been found that there's a significant per-unit variance in accepted
    supply voltages and the current set still makes some units unstable.
    
    Revert back to nominal values.
    
    Cc: [email protected]
    Fixes: c24a9b698fb0 ("arm64: dts: imx8mq-librem5: Set the DVS voltages lower")
    Signed-off-by: Sebastian Krzyszkowiak <[email protected]>
    Signed-off-by: Frank Li <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro" [+ + +]
Author: Heiko Stuebner <[email protected]>
Date:   Tue Feb 10 13:01:42 2026 +0100

    Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro"
    
    commit 29d1f56c4f3001b7f547123e0a307c009ac717f8 upstream.
    
    This reverts commit 6d54d935062e2d4a7d3f779ceb9eeff108d0535d.
    
    It seems there are different variants of the Wifi chipset in use on the
    Pinebook Pro. And according to the reported regression - see Closes
    below, the reverted change causes issues with one Wifi chipset.
    
    The original commit message indicates a "further description" only and
    does not indicate this would fix an actual problem, so a revert should
    not cause further problems.
    
    Fixes: 6d54d935062e ("arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro")
    Cc: Jan Palus <[email protected]>
    Cc: Peter Robinson <[email protected]>
    Cc: Thorsten Leemhuis <[email protected]>
    Cc: [email protected]
    Closes: https://lore.kernel.org/r/[email protected]/
    Tested-by: Jan Palus <[email protected]>
    Reviewed-by: Dragan Simic <[email protected]>
    Signed-off-by: Heiko Stuebner <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Heiko Stuebner <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Revert "mptcp: add needs_id for netlink appending addr" [+ + +]
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Tue Apr 7 10:41:41 2026 +0200

    Revert "mptcp: add needs_id for netlink appending addr"
    
    commit 8e2760eaab778494fc1fa257031e0e1799647f46 upstream.
    
    This commit was originally adding the ability to add MPTCP endpoints
    with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the
    net namespace level, is not supposed to handle endpoints with such ID,
    because this ID 0 is reserved to the initial subflow, as mentioned in
    the MPTCPv1 protocol [1], a per-connection setting.
    
    Note that 'ip mptcp endpoint add id 0' stops early with an error, but
    other tools might still request the in-kernel PM to create MPTCP
    endpoints with this restricted ID 0.
    
    In other words, it was wrong to call the mptcp_pm_has_addr_attr_id
    helper to check whether the address ID attribute is set: if it was set
    to 0, a new MPTCP endpoint would be created with ID 0, which is not
    expected, and might cause various issues later.
    
    Fixes: 584f38942626 ("mptcp: add needs_id for netlink appending addr")
    Cc: [email protected]
    Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1]
    Reviewed-by: Geliang Tang <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
rxrpc: Fix anonymous key handling [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:31 2026 +0100

    rxrpc: Fix anonymous key handling
    
    commit 6a59d84b4fc2f27f7b40e348506cc686712e260b upstream.
    
    In rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to
    be substituted for a NULL key pointer, but the variable this is done with
    is subsequently not used.
    
    Fix this by using "key" rather than "rx->key" when filling in the
    connection parameters.
    
    Note that this only affects direct use of AF_RXRPC; the kAFS filesystem
    doesn't use sendmsg() directly and so bypasses the issue.  Further,
    AF_RXRPC passes a NULL key in if no key is set, so using an anonymous key
    in that manner works.  Since this hasn't been noticed to this point, it
    might be better just to remove the "key" variable and the code that sets it
    - and, arguably, rxrpc_init_client_call_security() would be a better place
    to handle it.
    
    Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info")
    Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:47 2026 +0100

    rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()
    
    commit f564af387c8c28238f8ebc13314c589d7ba8475d upstream.
    
    Fix rxgk_do_verify_authenticator() to check the buffer size before checking
    the nonce.
    
    Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
    Closes: https://sashiko.dev/#/patchset/[email protected]
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix call removal to use RCU safe deletion [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:32 2026 +0100

    rxrpc: Fix call removal to use RCU safe deletion
    
    commit 146d4ab94cf129ee06cd467cb5c71368a6b5bad6 upstream.
    
    Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu()
    rather than list_del_init() to prevent stuffing up reading
    /proc/net/rxrpc/calls from potentially getting into an infinite loop.
    
    This, however, means that list_empty() no longer works on an entry that's
    been deleted from the list, making it harder to detect prior deletion.  Fix
    this by:
    
    Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that
    are unexpectedly still on the list.  Limiting the number of steps means
    there's no need to call cond_resched() or to remove calls from the list
    here, thereby eliminating the need for rxrpc_put_call() to check for that.
    
    rxrpc_put_call() can then be fixed to unconditionally delete the call from
    the list as it is the only place that the deletion occurs.
    
    Fixes: 2baec2c3f854 ("rxrpc: Support network namespacing")
    Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Linus Torvalds <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix integer overflow in rxgk_verify_response() [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:45 2026 +0100

    rxrpc: Fix integer overflow in rxgk_verify_response()
    
    commit 699e52180f4231c257821c037ed5c99d5eb0edb8 upstream.
    
    In rxgk_verify_response(), there's a potential integer overflow due to
    rounding up token_len before checking it, thereby allowing the length check to
    be bypassed.
    
    Fix this by checking the unrounded value against len too (len is limited as
    the response must fit in a single UDP packet).
    
    Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
    Closes: https://sashiko.dev/#/patchset/[email protected]
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix key parsing memleak [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:30 2026 +0100

    rxrpc: Fix key parsing memleak
    
    commit b555912b9b21075e8298015f888ffe3ff60b1a97 upstream.
    
    In rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be
    leaked in a few error paths after it's allocated.
    
    Fix this by freeing it in the "reject_token:" case.
    
    Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class")
    Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix key quota calculation for multitoken keys [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:29 2026 +0100

    rxrpc: Fix key quota calculation for multitoken keys
    
    commit bdbfead6d38979475df0c2f4bad2b19394fe9bdc upstream.
    
    In the rxrpc key preparsing, every token extracted sets the proposed quota
    value, but for multitoken keys, this will overwrite the previous proposed
    quota, losing it.
    
    Fix this by adding to the proposed quota instead.
    
    Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing")
    Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix key reference count leak from call->key [+ + +]
Author: Anderson Nascimento <[email protected]>
Date:   Wed Apr 8 13:12:36 2026 +0100

    rxrpc: Fix key reference count leak from call->key
    
    commit d666540d217e8d420544ebdfbadeedd623562733 upstream.
    
    When creating a client call in rxrpc_alloc_client_call(), the code obtains
    a reference to the key.  This is never cleaned up and gets leaked when the
    call is destroyed.
    
    Fix this by freeing call->key in rxrpc_destroy_call().
    
    Before the patch, it shows the key reference counter elevated:
    
    $ cat /proc/keys | grep afs@54321
    1bffe9cd I--Q--i 8053480 4169w 3b010000  1000  1000 rxrpc     afs@54321: ka
    $
    
    After the patch, the invalidated key is removed when the code exits:
    
    $ cat /proc/keys | grep afs@54321
    $
    
    Fixes: f3441d4125fc ("rxrpc: Copy client call parameters into rxrpc_call earlier")
    Signed-off-by: Anderson Nascimento <[email protected]>
    Co-developed-by: David Howells <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    Reviewed-by: Jeffrey Altman <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:43 2026 +0100

    rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
    
    commit 2afd86ccbb2082a3c4258aea8c07e5bb6267bc2f upstream.
    
    An AF_RXRPC socket can be both client and server at the same time.  When
    sending new calls (ie. it's acting as a client), it uses rx->key to set the
    security, and when accepting incoming calls (ie. it's acting as a server),
    it uses rx->securities.
    
    setsockopt(RXRPC_SECURITY_KEY) sets rx->key to point to an rxrpc-type key
    and setsockopt(RXRPC_SECURITY_KEYRING) sets rx->securities to point to a
    keyring of rxrpc_s-type keys.
    
    Now, it should be possible to use both rx->key and rx->securities on the
    same socket - but for userspace AF_RXRPC sockets rxrpc_setsockopt()
    prevents that.
    
    Fix this by:
    
     (1) Remove the incorrect check rxrpc_setsockopt(RXRPC_SECURITY_KEYRING)
         makes on rx->key.
    
     (2) Move the check that rxrpc_setsockopt(RXRPC_SECURITY_KEY) makes on
         rx->key down into rxrpc_request_key().
    
     (3) Remove rxrpc_request_key()'s check on rx->securities.
    
    This (in combination with a previous patch) pushes the checks down into the
    functions that set those pointers and removes the cross-checks that prevent
    both key and keyring being set.
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Closes: https://sashiko.dev/#/patchset/[email protected]
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Anderson Nascimento <[email protected]>
    cc: Luxiao Xu <[email protected]>
    cc: Yuan Tan <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix leak of rxgk context in rxgk_verify_response() [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:46 2026 +0100

    rxrpc: Fix leak of rxgk context in rxgk_verify_response()
    
    commit 7e1876caa8363056f58a21d3b31b82c2daf7e608 upstream.
    
    Fix rxgk_verify_response() to clean up the rxgk context it creates.
    
    Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
    Closes: https://sashiko.dev/#/patchset/[email protected]
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix missing error checks for rxkad encryption/decryption failure [+ + +]
Author: David Howells <[email protected]>
Date:   Wed Apr 8 13:12:44 2026 +0100

    rxrpc: Fix missing error checks for rxkad encryption/decryption failure
    
    commit f93af41b9f5f798823d0d0fb8765c2a936d76270 upstream.
    
    Add error checking for failure of crypto_skcipher_en/decrypt() to various
    rxkad function as the crypto functions can fail with ENOMEM at least.
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Closes: https://sashiko.dev/#/patchset/[email protected]
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: fix oversized RESPONSE authenticator length check [+ + +]
Author: Keenan Dong <[email protected]>
Date:   Wed Apr 8 13:12:41 2026 +0100

    rxrpc: fix oversized RESPONSE authenticator length check
    
    commit a2567217ade970ecc458144b6be469bc015b23e5 upstream.
    
    rxgk_verify_response() decodes auth_len from the packet and is supposed
    to verify that it fits in the remaining bytes. The existing check is
    inverted, so oversized RESPONSE authenticators are accepted and passed
    to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an
    impossible length and hit BUG_ON(len).
    
    Decoded from the original latest-net reproduction logs with
    scripts/decode_stacktrace.sh:
    
    RIP: __skb_to_sgvec()
      [net/core/skbuff.c:5285 (discriminator 1)]
    Call Trace:
     skb_to_sgvec() [net/core/skbuff.c:5305]
     rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]
     rxgk_verify_response() [net/rxrpc/rxgk.c:1268]
     rxrpc_process_connection()
       [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364
        net/rxrpc/conn_event.c:386]
     process_one_work() [kernel/workqueue.c:3281]
     worker_thread()
       [kernel/workqueue.c:3353 kernel/workqueue.c:3440]
     kthread() [kernel/kthread.c:436]
     ret_from_fork() [arch/x86/kernel/process.c:164]
    
    Reject authenticator lengths that exceed the remaining packet payload.
    
    Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
    Signed-off-by: Keenan Dong <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: Willy Tarreau <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix rack timer warning to report unexpected mode [+ + +]
Author: Alok Tiwari <[email protected]>
Date:   Wed Apr 8 13:12:35 2026 +0100

    rxrpc: Fix rack timer warning to report unexpected mode
    
    commit 65b3ffe0972ed023acc3981a0f7e1ae5d0208bd3 upstream.
    
    rxrpc_rack_timer_expired() clears call->rack_timer_mode to OFF before
    the switch. The default case warning therefore always prints OFF and
    doesn't identify the unexpected timer mode.
    
    Log the saved mode value instead so the warning reports the actual
    unexpected rack timer mode.
    
    Fixes: 7c482665931b ("rxrpc: Implement RACK/TLP to deal with transmission stalls [RFC8985]")
    Signed-off-by: Alok Tiwari <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Reviewed-by: Jeffrey Altman <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: fix reference count leak in rxrpc_server_keyring() [+ + +]
Author: Luxiao Xu <[email protected]>
Date:   Wed Apr 8 13:12:42 2026 +0100

    rxrpc: fix reference count leak in rxrpc_server_keyring()
    
    commit f125846ee79fcae537a964ce66494e96fa54a6de upstream.
    
    This patch fixes a reference count leak in rxrpc_server_keyring()
    by checking if rx->securities is already set.
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Reported-by: Yifan Wu <[email protected]>
    Reported-by: Juefei Pu <[email protected]>
    Co-developed-by: Yuan Tan <[email protected]>
    Signed-off-by: Yuan Tan <[email protected]>
    Suggested-by: Xin Liu <[email protected]>
    Tested-by: Ren Wei <[email protected]>
    Signed-off-by: Luxiao Xu <[email protected]>
    Signed-off-by: Ren Wei <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: fix RESPONSE authenticator parser OOB read [+ + +]
Author: Keenan Dong <[email protected]>
Date:   Wed Apr 8 13:12:40 2026 +0100

    rxrpc: fix RESPONSE authenticator parser OOB read
    
    commit 3e3138007887504ee9206d0bfb5acb062c600025 upstream.
    
    rxgk_verify_authenticator() copies auth_len bytes into a temporary
    buffer and then passes p + auth_len as the parser limit to
    rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the
    parser end pointer by a factor of four and lets malformed RESPONSE
    authenticators read past the kmalloc() buffer.
    
    Decoded from the original latest-net reproduction logs with
    scripts/decode_stacktrace.sh:
    
    BUG: KASAN: slab-out-of-bounds in rxgk_verify_response()
    Call Trace:
     dump_stack_lvl() [lib/dump_stack.c:123]
     print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]
     kasan_report() [mm/kasan/report.c:597]
     rxgk_verify_response()
       [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167
        net/rxrpc/rxgk.c:1274]
     rxrpc_process_connection()
       [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364
        net/rxrpc/conn_event.c:386]
     process_one_work() [kernel/workqueue.c:3281]
     worker_thread()
       [kernel/workqueue.c:3353 kernel/workqueue.c:3440]
     kthread() [kernel/kthread.c:436]
     ret_from_fork() [arch/x86/kernel/process.c:164]
    
    Allocated by task 54:
     rxgk_verify_response()
       [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155
        net/rxrpc/rxgk.c:1274]
     rxrpc_process_connection()
       [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364
        net/rxrpc/conn_event.c:386]
    
    Convert the byte count to __be32 units before constructing the parser
    limit.
    
    Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
    Signed-off-by: Keenan Dong <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: Willy Tarreau <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix RxGK token loading to check bounds [+ + +]
Author: Oleh Konko <[email protected]>
Date:   Wed Apr 8 13:12:33 2026 +0100

    rxrpc: Fix RxGK token loading to check bounds
    
    commit d179a868dd755b0cfcf7582e00943d702b9943b8 upstream.
    
    rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length
    from the XDR token as u32 values and passes each through round_up(x, 4)
    before using the rounded value for validation and allocation.  When the raw
    length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and
    kzalloc both use 0 while the subsequent memcpy still copies the original
    ~4 GiB value, producing a heap buffer overflow reachable from an
    unprivileged add_key() call.
    
    Fix this by:
    
     (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket
         lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with
         the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.
    
     (2) Sizing the flexible-array allocation from the validated raw key
         length via struct_size_t() instead of the rounded value.
    
     (3) Caching the raw lengths so that the later field assignments and
         memcpy calls do not re-read from the token, eliminating a class of
         TOCTOU re-parse.
    
    The control path (valid token with lengths within bounds) is unaffected.
    
    Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class")
    Signed-off-by: Oleh Konko <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    Reviewed-by: Jeffrey Altman <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix to request an ack if window is limited [+ + +]
Author: Marc Dionne <[email protected]>
Date:   Wed Apr 8 13:12:37 2026 +0100

    rxrpc: Fix to request an ack if window is limited
    
    commit 0cd3e3f3f2ec1a45aa559e2c0f3d57fac5eb3c25 upstream.
    
    Peers may only send immediate acks for every 2 UDP packets received.
    When sending a jumbogram, it is important to check that there is
    sufficient window space to send another same sized jumbogram following
    the current one, and request an ack if there isn't.  Failure to do so may
    cause the call to stall waiting for an ack until the resend timer fires.
    
    Where jumbograms are in use this causes a very significant drop in
    performance.
    
    Fixes: fe24a5494390 ("rxrpc: Send jumbo DATA packets")
    Signed-off-by: Marc Dionne <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial [+ + +]
Author: Alok Tiwari <[email protected]>
Date:   Wed Apr 8 13:12:34 2026 +0100

    rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial
    
    commit b33f5741bb187db8ff32e8f5b96def77cc94dfca upstream.
    
    In rxrpc_post_response(), the code should be comparing the challenge serial
    number from the cached response before deciding to switch to a newer
    response, but looks at the newer packet private data instead, rendering the
    comparison always false.
    
    Fix this by switching to look at the older packet.
    
    Fix further[1] to substitute the new packet in place of the old one if
    newer and also to release whichever we don't use.
    
    Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
    Signed-off-by: Alok Tiwari <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    Reviewed-by: Jeffrey Altman <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com [1]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: only handle RESPONSE during service challenge [+ + +]
Author: Wang Jie <[email protected]>
Date:   Wed Apr 8 13:12:48 2026 +0100

    rxrpc: only handle RESPONSE during service challenge
    
    commit c43ffdcfdbb5567b1f143556df8a04b4eeea041c upstream.
    
    Only process RESPONSE packets while the service connection is still in
    RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before
    running response verification and security initialization, then use a local
    secured flag to decide whether to queue the secured-connection work after
    the state transition. This keeps duplicate or late RESPONSE packets from
    re-running the setup path and removes the unlocked post-transition state
    test.
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Reported-by: Yifan Wu <[email protected]>
    Reported-by: Juefei Pu <[email protected]>
    Co-developed-by: Yuan Tan <[email protected]>
    Signed-off-by: Yuan Tan <[email protected]>
    Suggested-by: Xin Liu <[email protected]>
    Signed-off-by: Jie Wang <[email protected]>
    Signed-off-by: Yang Yang <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Jeffrey Altman <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: Only put the call ref if one was acquired [+ + +]
Author: Douya Le <[email protected]>
Date:   Wed Apr 8 13:12:38 2026 +0100

    rxrpc: Only put the call ref if one was acquired
    
    commit 6331f1b24a3e85465f6454e003a3e6c22005a5c5 upstream.
    
    rxrpc_input_packet_on_conn() can process a to-client packet after the
    current client call on the channel has already been torn down.  In that
    case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is
    no reference to drop.
    
    The client-side implicit-end error path does not account for that and
    unconditionally calls rxrpc_put_call().  This turns a protocol error
    path into a kernel crash instead of rejecting the packet.
    
    Only drop the call reference if one was actually acquired.  Keep the
    existing protocol error handling unchanged.
    
    Fixes: 5e6ef4f1017c ("rxrpc: Make the I/O thread take over the call and local processor work")
    Reported-by: Yifan Wu <[email protected]>
    Reported-by: Juefei Pu <[email protected]>
    Signed-off-by: Douya Le <[email protected]>
    Co-developed-by: Yuan Tan <[email protected]>
    Signed-off-by: Yuan Tan <[email protected]>
    Suggested-by: Xin Liu <[email protected]>
    Signed-off-by: Ao Zhou <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: proc: size address buffers for %pISpc output [+ + +]
Author: Pengpeng Hou <[email protected]>
Date:   Wed Apr 8 13:12:49 2026 +0100

    rxrpc: proc: size address buffers for %pISpc output
    
    commit a44ce6aa2efb61fe44f2cfab72bb01544bbca272 upstream.
    
    The AF_RXRPC procfs helpers format local and remote socket addresses into
    fixed 50-byte stack buffers with "%pISpc".
    
    That is too small for the longest current-tree IPv6-with-port form the
    formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a
    dotted-quad tail not only for v4mapped addresses, but also for ISATAP
    addresses via ipv6_addr_is_isatap().
    
    As a result, a case such as
    
      [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535
    
    is possible with the current formatter. That is 50 visible characters, so
    51 bytes including the trailing NUL, which does not fit in the existing
    char[50] buffers used by net/rxrpc/proc.c.
    
    Size the buffers from the formatter's maximum textual form and switch the
    call sites to scnprintf().
    
    Changes since v1:
    - correct the changelog to cite the actual maximum current-tree case
      explicitly
    - frame the proof around the ISATAP formatting path instead of the earlier
      mapped-v4 example
    
    Fixes: 75b54cb57ca3 ("rxrpc: Add IPv6 support")
    Signed-off-by: Pengpeng Hou <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Anderson Nascimento <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

rxrpc: reject undecryptable rxkad response tickets [+ + +]
Author: Yuqi Xu <[email protected]>
Date:   Wed Apr 8 13:12:39 2026 +0100

    rxrpc: reject undecryptable rxkad response tickets
    
    commit fe4447cd95623b1cfacc15f280aab73a6d7340b2 upstream.
    
    rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then
    parses the buffer as plaintext without checking whether
    crypto_skcipher_decrypt() succeeded.
    
    A malformed RESPONSE can therefore use a non-block-aligned ticket
    length, make the decrypt operation fail, and still drive the ticket
    parser with attacker-controlled bytes.
    
    Check the decrypt result and abort the connection with RXKADBADTICKET
    when ticket decryption fails.
    
    Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
    Reported-by: Yifan Wu <[email protected]>
    Reported-by: Juefei Pu <[email protected]>
    Co-developed-by: Yuan Tan <[email protected]>
    Signed-off-by: Yuan Tan <[email protected]>
    Suggested-by: Xin Liu <[email protected]>
    Tested-by: Ren Wei <[email protected]>
    Signed-off-by: Yuqi Xu <[email protected]>
    Signed-off-by: Ren Wei <[email protected]>
    Signed-off-by: David Howells <[email protected]>
    cc: Marc Dionne <[email protected]>
    cc: Simon Horman <[email protected]>
    cc: [email protected]
    cc: [email protected]
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
seg6: separate dst_cache for input and output paths in seg6 lwtunnel [+ + +]
Author: Andrea Mayer <[email protected]>
Date:   Sat Apr 4 02:44:04 2026 +0200

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel
    
    commit c3812651b522fe8437ebb7063b75ddb95b571643 upstream.
    
    The seg6 lwtunnel uses a single dst_cache per encap route, shared
    between seg6_input_core() and seg6_output_core(). These two paths
    can perform the post-encap SID lookup in different routing contexts
    (e.g., ip rules matching on the ingress interface, or VRF table
    separation). Whichever path runs first populates the cache, and the
    other reuses it blindly, bypassing its own lookup.
    
    Fix this by splitting the cache into cache_input and cache_output,
    so each path maintains its own cached dst independently.
    
    Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
    Cc: [email protected]
    Signed-off-by: Andrea Mayer <[email protected]>
    Reviewed-by: Nicolas Dichtel <[email protected]>
    Reviewed-by: Justin Iurman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG [+ + +]
Author: Oleh Konko <[email protected]>
Date:   Thu Apr 2 09:48:57 2026 +0000

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
    
    commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream.
    
    The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
    bc_ackers on every inbound group ACK, even when the same member has
    already acknowledged the current broadcast round.
    
    Because bc_ackers is a u16, a duplicate ACK received after the last
    legitimate ACK wraps the counter to 65535. Once wrapped,
    tipc_group_bc_cong() keeps reporting congestion and later group
    broadcasts on the affected socket stay blocked until the group is
    recreated.
    
    Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
    bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
    prevents the underflow path.
    
    Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
    Cc: [email protected]
    Signed-off-by: Oleh Konko <[email protected]>
    Reviewed-by: Tung Nguyen <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
usb: typec: ucsi: skip connector validation before init [+ + +]
Author: Nathan Rebello <[email protected]>
Date:   Tue Apr 7 02:39:58 2026 -0400

    usb: typec: ucsi: skip connector validation before init
    
    commit 5a1140404cbf7ba40137dfb1fb96893aa9a67d68 upstream.
    
    Notifications can arrive before ucsi_init() has populated
    ucsi->cap.num_connectors via GET_CAPABILITY. At that point
    num_connectors is still 0, causing all valid connector numbers to be
    incorrectly rejected as bogus.
    
    Skip the bounds check when num_connectors is 0 (not yet initialized).
    Pre-init notifications are already handled safely by the early-event
    guard in ucsi_connector_change().
    
    Reported-by: Takashi Iwai <[email protected]>
    Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()")
    Cc: [email protected]
    Signed-off-by: Nathan Rebello <[email protected]>
    Tested-by: Takashi Iwai <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
 
wifi: brcmsmac: Fix dma_free_coherent() size [+ + +]
Author: Thomas Fourier <[email protected]>
Date:   Wed Feb 18 14:07:37 2026 +0100

    wifi: brcmsmac: Fix dma_free_coherent() size
    
    commit 12cd7632757a54ce586e36040210b1a738a0fc53 upstream.
    
    dma_alloc_consistent() may change the size to align it. The new size is
    saved in alloced.
    
    Change the free size to match the allocation size.
    
    Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
    Cc: <[email protected]>
    Signed-off-by: Thomas Fourier <[email protected]>
    Acked-by: Arend van Spriel <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

wifi: rt2x00usb: fix devres lifetime [+ + +]
Author: Johan Hovold <[email protected]>
Date:   Fri Mar 27 12:32:19 2026 +0100

    wifi: rt2x00usb: fix devres lifetime
    
    commit 25369b22223d1c56e42a0cd4ac9137349d5a898e upstream.
    
    USB drivers bind to USB interfaces and any device managed resources
    should have their lifetime tied to the interface rather than parent USB
    device. This avoids issues like memory leaks when drivers are unbound
    without their devices being physically disconnected (e.g. on probe
    deferral or configuration changes).
    
    Fix the USB anchor lifetime so that it is released on driver unbind.
    
    Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
    Cc: [email protected]      # 4.7
    Cc: Vishal Thanki <[email protected]>
    Signed-off-by: Johan Hovold <[email protected]>
    Acked-by: Stanislaw Gruszka <[email protected]>
    Reviewed-by: Greg Kroah-Hartman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Johannes Berg <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works [+ + +]
Author: Matthew Brost <[email protected]>
Date:   Tue Mar 31 18:07:39 2026 -0700

    workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works
    
    commit 703ccb63ae9f7444d6ff876d024e17f628103c69 upstream.
    
    In unplug_oldest_pwq(), the first inactive work item on the
    pool_workqueue is activated correctly. However, if multiple inactive
    works exist on the same pool_workqueue, subsequent works fail to
    activate because wq_node_nr_active.pending_pwqs is empty — the list
    insertion is skipped when the pool_workqueue is plugged.
    
    Fix this by checking for additional inactive works in
    unplug_oldest_pwq() and updating wq_node_nr_active.pending_pwqs
    accordingly.
    
    Fixes: 4c065dbce1e8 ("workqueue: Enable unbound cpumask update on ordered workqueues")
    Cc: [email protected]
    Cc: Carlos Santa <[email protected]>
    Cc: Ryan Neph <[email protected]>
    Cc: Lai Jiangshan <[email protected]>
    Cc: Waiman Long <[email protected]>
    Cc: [email protected]
    Signed-off-by: Matthew Brost <[email protected]>
    Signed-off-by: Tejun Heo <[email protected]>
    Acked-by: Waiman Long <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
X.509: Fix out-of-bounds access when parsing extensions [+ + +]
Author: Lukas Wunner <[email protected]>
Date:   Tue Apr 7 12:58:18 2026 +0200

    X.509: Fix out-of-bounds access when parsing extensions
    
    commit d702c3408213bb12bd570bb97204d8340d141c51 upstream.
    
    Leo reports an out-of-bounds access when parsing a certificate with
    empty Basic Constraints or Key Usage extension because the first byte of
    the extension is read before checking its length.  Fix it.
    
    The bug can be triggered by an unprivileged user by submitting a
    specially crafted certificate to the kernel through the keyrings(7) API.
    Leo has demonstrated this with a proof-of-concept program responsibly
    disclosed off-list.
    
    Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
    Fixes: 567671281a75 ("KEYS: X.509: Parse Key Usage")
    Reported-by: Leo Lin <[email protected]> # off-list
    Signed-off-by: Lukas Wunner <[email protected]>
    Reviewed-by: Ignat Korchagin <[email protected]>
    Cc: [email protected] # v6.4+
    Signed-off-by: Herbert Xu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
x86/CPU: Fix FPDSS on Zen1 [+ + +]
Author: Borislav Petkov (AMD) <[email protected]>
Date:   Tue Apr 7 11:40:03 2026 +0200

    x86/CPU: Fix FPDSS on Zen1
    
    commit e55d98e7756135f32150b9b8f75d580d0d4b2dd3 upstream.
    
    Zen1's hardware divider can leave, under certain circumstances, partial
    results from previous operations.  Those results can be leaked by
    another, attacker thread.
    
    Fix that with a chicken bit.
    
    Signed-off-by: Borislav Petkov (AMD) <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
x86/mce/amd: Filter bogus hardware errors on Zen3 clients [+ + +]
Author: Yazen Ghannam <[email protected]>
Date:   Sat Feb 28 09:08:14 2026 -0500

    x86/mce/amd: Filter bogus hardware errors on Zen3 clients
    
    commit 0422b07bc4c296b736e240d95d21fbfebbfaa2ca upstream.
    
    Users have been observing multiple L3 cache deferred errors after recent
    kernel rework of deferred error handling.¹ ⁴
    
    The errors are bogus due to inconsistent status values. Also, user verified
    that bogus MCA_DESTAT values are present on the system even with an older
    kernel.²
    
    The errors seem to be garbage values present in the MCA_DESTAT of some L3
    cache banks. These were implicitly ignored before the recent kernel rework
    because these do not generate a deferred error interrupt.
    
    A later revision of the rework patch was merged for v6.19. This naturally
    filtered out most of the bogus error logs. However, a few signatures still
    remain.³
    
    Minimize the scope of the filter to the reported CPU
    family/model/stepping and only for errors which don't have the Enabled
    bit in the MCi status MSR.
    
    ¹ https://lore.kernel.org/[email protected]
    ² https://lore.kernel.org/[email protected]
    ³ https://lore.kernel.org/[email protected]
    ⁴ https://lore.kernel.org/r/CAKFB093B2k3sKsGJ_QNX1jVQsaXVFyy=wNwpzCGLOXa_vSDwXw@mail.gmail.com
    
      [ bp: Generalize the condition according to which errors are bogus. ]
    
    Fixes: 7cb735d7c0cb ("x86/mce: Unify AMD DFR handler with MCA Polling")
    Closes: https://lore.kernel.org/[email protected]
    Reported-by: Bert Karwatzki <[email protected]>
    Signed-off-by: Yazen Ghannam <[email protected]>
    Signed-off-by: Borislav Petkov (AMD) <[email protected]>
    Reviewed-by: Mario Limonciello <[email protected]>
    Tested-By: Bert Karwatzki <[email protected]>
    Cc: [email protected]
    Link: https://lore.kernel.org/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
xfrm: clear trailing padding in build_polexpire() [+ + +]
Author: Yasuaki Torimaru <[email protected]>
Date:   Thu Mar 26 14:58:00 2026 +0900

    xfrm: clear trailing padding in build_polexpire()
    
    commit 71a98248c63c535eaa4d4c22f099b68d902006d0 upstream.
    
    build_expire() clears the trailing padding bytes of struct
    xfrm_user_expire after setting the hard field via memset_after(),
    but the analogous function build_polexpire() does not do this for
    struct xfrm_user_polexpire.
    
    The padding bytes after the __u8 hard field are left
    uninitialized from the heap allocation, and are then sent to
    userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
    leaking kernel heap memory contents.
    
    Add the missing memset_after() call, matching build_expire().
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: [email protected]
    Signed-off-by: Yasuaki Torimaru <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Reviewed-by: Breno Leitao <[email protected]>
    Signed-off-by: Steffen Klassert <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

xfrm: hold dev ref until after transport_finish NF_HOOK [+ + +]
Author: Qi Tang <[email protected]>
Date:   Thu Apr 2 19:44:01 2026 +0800

    xfrm: hold dev ref until after transport_finish NF_HOOK
    
    commit 1c428b03840094410c5fb6a5db30640486bbbfcb upstream.
    
    After async crypto completes, xfrm_input_resume() calls dev_put()
    immediately on re-entry before the skb reaches transport_finish.
    The skb->dev pointer is then used inside NF_HOOK and its okfn,
    which can race with device teardown.
    
    Remove the dev_put from the async resumption entry and instead
    drop the reference after the NF_HOOK call in transport_finish,
    using a saved device pointer since NF_HOOK may consume the skb.
    This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip
    the okfn.
    
    For non-transport exits (decaps, gro, drop) and secondary
    async return points, release the reference inline when
    async is set.
    
    Suggested-by: Florian Westphal <[email protected]>
    Fixes: acf568ee859f ("xfrm: Reinject transport-mode packets through tasklet")
    Cc: [email protected]
    Signed-off-by: Qi Tang <[email protected]>
    Signed-off-by: Steffen Klassert <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
xfrm_user: fix info leak in build_report() [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Mon Apr 6 17:34:22 2026 +0200

    xfrm_user: fix info leak in build_report()
    
    commit d10119968d0e1f2b669604baf2a8b5fdb72fa6b4 upstream.
    
    struct xfrm_user_report is a __u8 proto field followed by a struct
    xfrm_selector which means there is three "empty" bytes of padding, but
    the padding is never zeroed before copying to userspace.  Fix that up by
    zeroing the structure before setting individual member variables.
    
    Cc: stable <[email protected]>
    Cc: Steffen Klassert <[email protected]>
    Cc: Herbert Xu <[email protected]>
    Cc: "David S. Miller" <[email protected]>
    Cc: Eric Dumazet <[email protected]>
    Cc: Jakub Kicinski <[email protected]>
    Cc: Paolo Abeni <[email protected]>
    Cc: Simon Horman <[email protected]>
    Assisted-by: gregkh_clanker_t1000
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Steffen Klassert <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>