Skip to content

[Deepin-Kernel-SIG] [linux 6.18-y] [Upstream] Update kernel base to 6.18.27#1670

Merged
opsiff merged 279 commits into
deepin-community:linux-6.18.yfrom
opsiff:linux-6.18-update-6.18.26
May 8, 2026
Merged

[Deepin-Kernel-SIG] [linux 6.18-y] [Upstream] Update kernel base to 6.18.27#1670
opsiff merged 279 commits into
deepin-community:linux-6.18.yfrom
opsiff:linux-6.18-update-6.18.26

Conversation

@opsiff
Copy link
Copy Markdown
Member

@opsiff opsiff commented May 8, 2026

Update kernel base to 6.18.27.

git log --oneline v6.18.26..v6.18.27 | wc
277 2545 20145

Handle:
mei: me: use PCI_DEVICE_DATA macro
[SURFACE: mei: me: Add Icelake device ID for iTouch merged]:
32733c2 SURFACE: mei: me: Add Icelake device ID for iTouch
50cd647 mei: me: add nova lake point H DID
4359c46 mei: me: use PCI_DEVICE_DATA macro
ff619c8 Revert "SURFACE: mei: me: Add Icelake device ID for iTouch"
PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access
[("UPSTREAM: PCI: cadence: Add support for High Perf Architecture (HPA) controller") merged,Use upstream version]

Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @opsiff, your pull request is larger than the review limit of 150000 diff characters

@deepin-ci-robot
Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from opsiff. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Deepin kernel stable base from Linux 6.18.26 to 6.18.27, bringing in upstream stable fixes across MM, networking, drivers, crypto, filesystems, tooling, and selftests.

Changes:

  • Bump kernel version to 6.18.27 and sync a broad set of upstream stable fixes.
  • Tighten correctness/safety in multiple subsystems (e.g., bounds checks, refcounting fixes, locking fixes, error-path cleanups).
  • Adjust tooling/selftests behavior (e.g., selftest timeouts, perf annotate freeing hooks).

Reviewed changes

Copilot reviewed 272 out of 273 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
tools/testing/vma/vma_internal.h Add stubs for new VMA helpers used by MM code in test environment.
tools/testing/selftests/vfio/lib/vfio_pci_device.c Avoid VLA zero-init by explicitly memset’ing IRQ buffer.
tools/testing/selftests/mqueue/settings Add selftest timeout configuration.
tools/testing/selftests/landlock/scoped_abstract_unix_test.c Update audit expectations (remove domain check).
tools/testing/selftests/landlock/ptrace_test.c Update audit expectations (remove domain check).
tools/testing/selftests/landlock/net_test.c Fix format cast for 64-bit access logging.
tools/testing/selftests/kvm/x86/msrs_test.c Extend feature gating logic for reserved MSR tests.
tools/testing/ktest/ktest.pl Fix month formatting in timestamp generation.
tools/perf/util/disasm.c Add jump operand free hook declaration.
tools/perf/arch/loongarch/annotate/instructions.c Hook instruction operand free callback.
tools/accounting/procacct.c Increase netlink buffer size + handle truncated recvmsg.
tools/accounting/getdelays.c Increase netlink buffer size + handle truncated recvmsg.
sound/usb/mixer.c Tighten/alter volume range heuristic and update comment.
sound/usb/mixer_quirks.c Improve error handling for samplerate set; fix SPDIF switch condition.
sound/usb/format.c Return early when rate list exceeds maximum.
sound/usb/endpoint.c Reorder packsize clamping after maxframesize computation.
sound/usb/caiaq/input.c Return -ENODEV when device has no supported input method.
sound/usb/caiaq/device.c Make setup path return errors consistently; adjust cleanup wiring.
sound/usb/caiaq/control.c Avoid redundant USB commands and roll back state on failure.
sound/usb/6fire/control.c Simplify volume update logic and reduce repeated expressions.
sound/soc/intel/avs/path.c Use sysfs_streq for robust string equality checks.
sound/pci/ctxfi/ctatc.c Fix PLL rate selection fallback when pll_rate is zero.
sound/hda/codecs/realtek/alc269.c Add a new HP Victus quirk entry.
sound/drivers/pcmtest.c Fix init error-path cleanup ordering for debugfs and platform dev.
sound/drivers/aloop.c Add synchronization to avoid freeing peer runtime during stop.
sound/core/seq/oss/seq_oss_rw.c Fix write return semantics when loading patches.
sound/core/misc.c Fix fasync list/work synchronization to avoid races.
sound/core/control.c Add defensive buf_len==0 handling when parsing enum names.
sound/aoa/soundbus/i2sbus/core.c Fix OF node refcounting and resume behavior for empty codec list.
security/landlock/cred.c Always transfer ruleset ref (domain may be NULL-safe).
security/apparmor/lsm.c Switch to RCU-safe credential access for procattr reads.
scripts/check-uapi.sh Change compile test to shared object build with -nostdlib/-fPIC.
rust/kernel/dma.rs Remove DMA_ATTR_NO_KERNEL_MAPPING constant binding.
net/strparser/strparser.c Reset skb tracking on abort to avoid stale pointers/state.
net/smc/smc_clc.c Guard lgr deref when handling first-contact decline.
net/rxrpc/skbuff.c Remove rxrpc_eaten_skb tracing helper.
net/rxrpc/rxgk_common.h Add xdr_round_down helper macro.
net/rxrpc/rxgk_app.c Harden token length checks; fix error propagation.
net/rxrpc/io_thread.c Refactor input packet API; remove skb_unshare path here.
net/rxrpc/conn_event.c Add skb copy fallback for in-place decrypt verify_response; simplify queue processing.
net/rxrpc/call_event.c Copy cloned encrypted DATA skb before in-place decryption.
net/rxrpc/ar-internal.h Remove rxrpc_eaten_skb prototype.
net/rds/rdma.c Adjust error path for cookie put_user handling.
net/netfilter/nft_bitwise.c Reject zero shift value and validate shift bounds.
net/mctp/route.c Mask/validate header version field using new mask.
net/ipv6/seg6_iptunnel.c Force dst ref after route input; allow L2ENCAP_RED in redirect logic.
net/ipv6/rpl_iptunnel.c Force dst ref after route input (NOREF dst handling).
net/ipv6/exthdrs.c Fix headroom handling and reduce duplicated length math.
net/ipv4/inet_connection_sock.c Protect callback invocation with RCU read lock and READ_ONCE.
net/ipv4/icmp.c Add nospec hardening for icmp_pointers indexing.
net/ceph/auth.c Fix protocol init condition when protocol is unset.
net/caif/cfsrvl.c Fix client free path and clear up/down links before release.
net/bridge/br_arp_nd_proxy.c READ_ONCE fdb dst to avoid races when inspecting port flags.
net/bluetooth/hci_event.c Add hci_dev_lock/unlock around conn lookups and updates.
mm/zsmalloc.c Copy KMSAN page metadata during zs page migration.
mm/vmalloc.c Fix vrealloc copy size; add vmap purge lock in shrinker scan.
mm/vma.c Use vma_supports_mlock() to centralize VM_LOCKED eligibility.
mm/truncate.c Use a_ops->free_folio if present; adjust folio ref dropping.
mm/slub.c Avoid UP spin_trylock-in-NMI pitfalls; fix krealloc/kvrealloc copy sizes.
mm/page_alloc.c Record early PFNs for alloc_tag when page_ext isn’t ready; avoid UP NMI lock pitfall.
mm/mlock.c Centralize mlock eligibility via vma_supports_mlock() and special-case secretmem.
mm/migrate.c Preserve deferred split queue state across folio migration.
mm/mempolicy.c Fix weighted interleave sysfs store logic and cleanup on no-op.
mm/internal.h Add vma_supports_mlock() helper; remove exported filemap_free_folio decl.
mm/hugetlb.c Validate hugetlb cmdline arg pointer.
mm/filemap.c Make filemap_free_folio() static and const-correct mapping argument.
mm/damon/stat.c Fix error path to destroy DAMON stat context on start failure.
Makefile Bump SUBLEVEL to 27; adjust Rust clippy flags.
lib/ts_kmp.c Reject zero-length and overflowed KMP patterns; harden allocation sizing.
kernel/trace/ring_buffer.c Fix reader/head tracking in ring buffer meta validation.
kernel/trace/fprobe.c Mutex guard changes; rename/adjust “registered” check usage.
kernel/taskstats.c Set taskstats version in exit stats.
kernel/sched/sched.h Change to_ratio() prototype to return u64.
kernel/sched/rt.c Use u64 totals for RT schedulability math.
kernel/sched/core.c Change to_ratio() return type to u64.
kernel/locking/rtmutex.c Fix waiter removal to use waiter->task pi_lock, not current.
kernel/fork.c Initialize per-task random kstack offset state.
io_uring/timeout.c Validate previously-unused SQE padding fields.
io_uring/register.c Fix ring resize copying for SQE128/CQE32 modes via memcpy sizing/masks.
io_uring/poll.c Fix poll_refs compare cast; propagate EPOLLONESHOT into req state.
init/main.c Remove per-cpu kstack_offset storage.
include/trace/events/rxrpc.h Update rxrpc trace enums for new skb copy/nomem cases.
include/net/mctp.h Add version mask definition for MCTP header.
include/net/mana/mana.h Add exported helper prototype to disable vport RX.
include/linux/usb.h Clarify hcpriv lifetime requirements while BW is allocated.
include/linux/tpm_eventlog.h Convert TPM_MEMREMAP/TPM_MEMUNMAP macros to inline stubs.
include/linux/sched.h Add per-task kstack_offset field under CONFIG_RANDOMIZE_KSTACK_OFFSET.
include/linux/randomize_kstack.h Switch from per-cpu to per-task kstack offset; add init helper.
include/linux/pgalloc_tag.h Guard alloc_tag lookup with is_codetag_empty() check.
include/linux/hugetlb_inline.h Make is_vm_hugetlb_page() take const vma.
include/linux/fwnode.h Convert fwnode flags to bit indexes + atomic bitops helpers.
include/linux/device.h Add bitmap device flags + ready_to_probe accessors.
include/linux/damon.h Add call_controls_obsolete flag to DAMON context.
include/linux/alloc_tag.h Add alloc_tag_add_early_pfn() declaration/stub.
fs/xfs/xfs_zone_gc.c Add safe wakeup helper for zone GC thread.
fs/xfs/xfs_zone_alloc.h Declare/inline xfs_zone_gc_wakeup().
fs/xfs/xfs_sysfs.c Wake zone GC thread when low_space threshold changes.
fs/xfs/xfs_buf.c Fix error path to put dax device before freeing buftarg.
fs/userfaultfd.c Remove mmap_min_addr check from unaligned-range validator.
fs/ntfs3/run.c Harden runlist unpack bounds and overflow checks.
fs/notify/inotify/inotify_user.c Fix watch count decrement on failure.
fs/nfs/nfs4proc.c Apply session size limits when cloning server.
fs/nfs/nfs4client.c Export session size limit helpers (remove static).
fs/nfs/internal.h Add prototypes for exported session limit helpers.
fs/jbd2/revoke.c Avoid alias revoke clearing for blockdev sb; WARN on unexpected same bh.
fs/file_table.c Refactor backing_file free/init; ensure safe fput behavior.
fs/ext4/xattr.c Fix bounds check for xattr entry; init iloc; release bh.
fs/ext2/inode.c Detect suspicious zero-nlink inode state as corruption.
fs/erofs/dir.c Harden dirent parsing against corruption and negative name lengths.
fs/ceph/dir.c Only d_add() when dentry is unhashed.
fs/afs/file.c Switch from mmap_prepare to mmap file op; set vma->vm_ops accordingly.
drivers/vfio/pci/virtio/common.h Replace spinlock with mutex for list synchronization.
drivers/vfio/cdx/private.h Add mutex include + irq lock in vfio_cdx_device.
drivers/vfio/cdx/main.c Initialize/destroy cdx_irqs_lock via vfio device ops init/release.
drivers/vfio/cdx/intr.c Serialize MSI trigger ops; validate configured MSI before use.
drivers/usb/host/xhci.c Stop clearing hcpriv on endpoint disable (lifetime preservation).
drivers/usb/chipidea/otg.c Guard VBUS handling by role; adjust ID switch condition.
drivers/usb/chipidea/core.c Consolidate OTG ID/BSV interrupt handling and work queuing.
drivers/thermal/thermal_core.c Ensure governor cleared on release and error paths.
drivers/spi/spi-imx.c Hold/put controller ref across unregister/remove teardown.
drivers/spi/spi-ch341.c Fix probe error unwinding and URB lifecycle; kill URB on disconnect.
drivers/scsi/sd.c Fix disk ref leak on device_add failure.
drivers/rtc/rtc-ntxec.c Use device_set_of_node_from_dev() instead of direct of_node assignment.
drivers/remoteproc/xlnx_r5_remoteproc.c Avoid NULL deref in mailbox RX callback (buffered IPI).
drivers/pwm/pwm-imx-tpm.c Count enabled channels at probe to seed enable_count.
drivers/power/supply/axp288_charger.c Use devm_work_autocancel for work cleanup; simplify teardown.
drivers/phy/qualcomm/phy-qcom-m31-eusb2.c Adjust init table (PHY enable + PLL_EN default).
drivers/pci/endpoint/functions/pci-epf-ntb.c Simplify EPC error handling and cleanup paths.
drivers/pci/endpoint/functions/pci-epf-mhi.c Fix EDMA timeout return path to not report spurious errors.
drivers/pci/controller/dwc/pci-imx6.c Add IMX6SX flag to skip L23 ready.
drivers/pci/controller/cadence/pcie-cadence.h Fix cfg read helpers to use aligned-size reads safely.
drivers/of/unittest.c Fix OF node reference handling in unittest paths.
drivers/of/platform.c Use fwnode_clear_flag helper for NOT_DEVICE.
drivers/of/dynamic.c Use fwnode_set_flag helper for NOT_DEVICE.
drivers/of/base.c Use fwnode_set_flag helper for BEST_EFFORT.
drivers/nvme/host/pci.c Add quirk for Kingston OM3SGP4xxxxK.
drivers/nvme/host/core.c Respect disable-write-zeroes quirk when using wzsl.
drivers/net/wireless/realtek/rtw88/pci.c NULL-check bridge pointer before vendor access.
drivers/net/wireless/realtek/rtl8xxxu/core.c Simplify MCS rate parsing and avoid invalid rate cases.
drivers/net/wireless/mediatek/mt76/mt792x_usb.c Refactor WFSYS reset by SoC descriptor; add mt7925 constants.
drivers/net/wireless/mediatek/mt76/mt792x_regs.h Add mt7925 reset/init-done register constants.
drivers/net/wireless/marvell/mwifiex/init.c Use timer_delete_sync in adapter cleanup.
drivers/net/phy/mdio_bus_provider.c Use fwnode_set_flag helper for NEEDS_CHILD_BOUND_ON_ADD.
drivers/net/netconsole.c Guard trim_newline for empty strings.
drivers/net/gtp.c Disable BH around udp_tunnel_xmit_skb call.
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c Add rtnl_lock around phylink_disconnect.
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c Fix firmware version check for wx_mac_sp only.
drivers/net/ethernet/microsoft/mana/mana_en.c Add exported disable_vport_rx helper; fence RQs before destroy.
drivers/net/ethernet/micrel/ks8851.h Update lock/unlock function pointer signatures.
drivers/net/ethernet/micrel/ks8851_spi.c Adjust lock helpers and call sites for updated signature.
drivers/net/ethernet/micrel/ks8851_par.c Switch to bh lock and update signature usage.
drivers/net/can/usb/ucan.c Allocate control buffer off interface device (correct devm parent).
drivers/mtd/spi-nor/sst.c Re-enable write-enable latch when switching from byte to AAI.
drivers/mtd/nand/spi/winbond.c Mark parts as requiring QE bit.
drivers/mtd/devices/docg3.c Fix bch_free to use cascade member.
drivers/mmc/host/sdhci-of-dwcmshc.c Ensure clock disabled during DLL config and always re-enabled.
drivers/mmc/core/queue.h Add request flags for single-block recovery.
drivers/mmc/core/block.c Force single-block retries for write recovery paths.
drivers/misc/mei/hw-me.h Remove unused MEI_PCI_DEVICE macro.
drivers/misc/mei/bus-fixup.c Use canonical PCI device IDs for MEI watchdog fixup.
drivers/misc/ibmasm/remote.c Add bounds check on queue indices to avoid OOB access.
drivers/misc/ibmasm/lowlevel.c Harden command size calculations and clamp to I2O limit.
drivers/misc/ibmasm/ibmasmfs.c Add header size check and validate command size vs write count.
drivers/mfd/stpmic1.c Retry PMIC poweroff sequence and report persistent failure.
drivers/mfd/mfd-core.c Preserve existing OF fwnode by using set_primary_fwnode for ACPI.
drivers/media/rc/ttusbir.c Convert bulk buffer to heap allocation (contains a probe logic bug).
drivers/media/rc/igorplugusb.c Convert ctrlrequest to heap allocation (needs follow-up update to URB setup usage).
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c Cancel pending work before releasing M2M context.
drivers/media/platform/amphion/vpu_v4l2.c Replace job_abort with job_ready (job_ready currently blocks scheduling).
drivers/media/i2c/imx219.c Handle ERR_PTR reset GPIO with dev_err_probe.
drivers/md/raid5.c Fix stripe release path under device lock in retry_aligned_read.
drivers/md/raid10.c Fix error path to free r10bio instead of ending I/O incorrectly.
drivers/md/md-llbitmap.c Skip non-In_sync devices; adjust barrier/state machine ordering.
drivers/md/dm-raid1.c Fix argument count validation logic for mirror log creation.
drivers/leds/rgb/leds-qcom-lpg.c Add bounds check for HI_RES PWM clk index.
drivers/input/touchscreen/edt-ft5x06.c Guard raw buffer free under mutex and NULL it.
drivers/infiniband/sw/rxe/rxe_recv.c Tighten packet length validation using paylen/padding/ICRC.
drivers/infiniband/hw/mana/qp.c Disable vPort RX steering before destroying RSS RX WQs.
drivers/infiniband/core/addr.c Add neigh lock coverage when reading NUD state/HA snapshot.
drivers/iio/adc/ti-ads7950.c Switch to unaligned timestamp push helper and shrink rx buffer.
drivers/iio/adc/ad7768-1.c Ensure device is put into continuous mode during setup.
drivers/i2c/i2c-core-of.c Use fwnode_clear_flag helper for NOT_DEVICE.
drivers/hwmon/pt5161l.c Use I2C_SMBUS_BLOCK_MAX and return -EIO on short read.
drivers/hwmon/powerz.c Correctly handle interruptible timeout return values.
drivers/hwmon/isl28022.c Use 64-bit math helpers and clamp power calculation.
drivers/hid/hid-apple.c Set LED_CORE_SUSPENDRESUME on keyboard backlight LEDs.
drivers/gpu/drm/tiny/arcpgu.c Use __free(device_node) for OF node lifetime management.
drivers/gpu/drm/nouveau/nouveau_gem.c Fix relocation bounds check using u64 arithmetic.
drivers/gpu/drm/nouveau/nouveau_drm.c Ensure proper cleanup path on aperture remove failure.
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c Remove unused pipe_idx bookkeeping.
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c Handle mmhub reg differences per IP version for deep sleep IB.
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h Mark internal_reg_offset __maybe_unused to avoid warnings.
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c Skip on-chip range manager init for zero size.
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c Remove unused page index variable in unbind loop.
drivers/firmware/google/framebuffer-coreboot.c Remove IORESOURCE_BUSY and drop custom remove callback.
drivers/edac/versalnet_edac.c Fix OF node lifetime and free mcdi on error/remove.
drivers/crypto/nx/nx-842.h Switch to __struct_group and update static_assert message.
drivers/crypto/nx/nx-842.c Fix ctx alloc failure cleanup and correct free_pages usage.
drivers/crypto/intel/qat/qat_6xxx/adf_drv.c Ensure adf_dev_down() called on adf_dev_up failure.
drivers/crypto/hisilicon/sec/sec_algs.c Fix DMA unmap direction for IV buffer.
drivers/crypto/ccree/cc_hash.c Unmap result on map_ahash_request_final failure.
drivers/crypto/atmel-tdes.c Fix DMA sync direction (for CPU) before copying out.
drivers/crypto/atmel-sha204a.c Improve OTP read error handling and sysfs emit usage; fix remove cleanup.
drivers/crypto/atmel-i2c.c Fix OTP address validation and return -EINVAL.
drivers/crypto/atmel-ecc.c Free I2C client on fallback tfm alloc failure.
drivers/crypto/atmel-aes.c Fix free_pages order for AES buffer cleanup.
drivers/char/tpm/tpm2-sessions.c Fix tpm_buf_destroy() on error and on success path.
drivers/char/tpm/tpm2-cmd.c Ensure buffer destroyed via unified out path on session fill failure.
drivers/char/tpm/tpm-chip.c Use kfree_sensitive for auth material.
drivers/char/tpm/tpm_tis_core.c Improve error logging and retry exhaustion handling.
drivers/char/ipmi/ipmi_ssif.c Harden thread lifecycle handling on shutdown/probe failure.
drivers/bus/mhi/host/pci_generic.c Switch to async power up for MHI controller.
drivers/bus/imx-weim.c Use fwnode_clear_flag helper for NOT_DEVICE.
drivers/block/zram/zram_drv.c Ensure bio_endio on early discard return path.
drivers/block/rbd.c Fix error path by device_del on add_disk failure.
drivers/base/dd.c Defer probes until dev_ready_to_probe is set; avoid early probing during device_add.
Documentation/scheduler/sched-ext.rst Update scheduler flow documentation.
Documentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml Allow alternative reg/reg-names layouts and constrain clocks/items.
crypto/pcrypt.c Handle EINPROGRESS in callback; treat EBUSY like EINPROGRESS for async ops.
crypto/authencesn.c Reject too-small digest sizes for authenc ESN.
crypto/algif_aead.c Copy IV into per-request storage to avoid races across concurrent ops.
crypto/acompress.c Fix request chaining save/restore to avoid abusing req->base.data.
certs/extract-cert.c Guard key_pass usage behind USE_PKCS11_ENGINE.
block/blk.h Add helper to prevent mixing incompatible zone-device pages in a bio.
block/blk-zoned.c Fix work refcounting when queue_work returns already-scheduled.
block/bio.c Use new compatibility helper and constrain merges to same pgmap where required.
block/bio-integrity.c Same as bio.c: prevent incompatible zone-device mixing and constrain merges.
arch/x86/mm/pti.c Disable FRED when PTI is enabled.
arch/x86/kvm/svm/svm.h Inline svm_copy_lbrs macro; extend cached save area.
arch/x86/kvm/svm/hyperv.h Add helper for detecting L2 TLB flush hypercalls.
arch/x86/kvm/hyperv.h Remove stub helpers (moved/renamed elsewhere).
arch/x86/kernel/shstk.c Harden shstk_pop_sigframe against VMA changes using speculation seq.
arch/x86/Kconfig Require PER_VMA_LOCK for userspace shadow stack.
arch/um/drivers/cow_user.c Avoid glibc C23 strrchr macro by calling kernel_strrchr directly.
arch/parisc/lib/Makefile Drop arch-specific checksum.o from lib-y.
arch/parisc/lib/checksum.c Remove parisc checksum implementation (use generic).
arch/parisc/kernel/syscalls/syscall.tbl Fix _llseek entry ABI annotation.
arch/parisc/Kconfig Select GENERIC_CSUM.
arch/loongarch/kvm/vcpu.c Fix PLV check to use CSR_CRMD_PLV.
arch/loongarch/kernel/syscall.c Add nospec array index for syscall table.
arch/loongarch/kernel/cpu-probe.c Add Spectre v1 sysfs mitigation text.
arch/arm64/mm/init.c Delay swiotlb_update_mem_attributes until mem_init; add page_alloc_available.
arch/arm64/include/asm/mmu.h Export page_alloc_available.
arch/arm64/crypto/aes-modes.S Fix csinv operand width (use w regs).
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi Add pullups for eMMC data lines.
arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi Add ethernet aliases.
arch/arm/mm/flush.c Fix dcache clean bit handling to avoid missed flush due to test_and_set semantics.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 191 to 197
tt = kzalloc(sizeof(*tt), GFP_KERNEL);
buffer = kzalloc(5, GFP_KERNEL);
rc = rc_allocate_device(RC_DRIVER_IR_RAW);
if (!tt || !rc) {
if (!tt || !rc || buffer) {
ret = -ENOMEM;
goto out;
}
Comment on lines +451 to 459
static int vpu_m2m_job_ready(void *priv)
{
struct vpu_inst *inst = priv;
struct v4l2_m2m_ctx *m2m_ctx = inst->fh.m2m_ctx;

v4l2_m2m_job_finish(m2m_ctx->m2m_dev, m2m_ctx);
return 0;
}

static const struct v4l2_m2m_ops vpu_m2m_ops = {
.device_run = vpu_m2m_device_run,
.job_abort = vpu_m2m_job_abort
.job_ready = vpu_m2m_job_ready,
};
Comment on lines +167 to +177
ir->request = kzalloc(sizeof(*ir->request), GFP_KERNEL);
if (!ir->request)
goto fail;

ir->dev = &intf->dev;

timer_setup(&ir->timer, igorplugusb_timer, 0);

ir->request.bRequest = GET_INFRACODE;
ir->request.bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
ir->request.wLength = cpu_to_le16(MAX_PACKET);
ir->request->bRequest = GET_INFRACODE;
ir->request->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
ir->request->wLength = cpu_to_le16(MAX_PACKET);
mmhonap and others added 21 commits May 8, 2026 11:05
commit 4f42d716707654134789a0205a050b0d022be948 upstream.

C does not permit an initialiser expression on a variable-length array
(C99 Section 6.7.9 constraint: "The type of the entity to be initialized
shall not be a variable length array type").

vfio_pci_irq_set() declared:

      u8 buf[sizeof(struct vfio_irq_set) + sizeof(int) * count] = {};

where `count` is a runtime function parameter, making `buf` a VLA.

GCC rejects this with (tried with GCC-9.4.0):

      error: variable-sized object may not be initialized

Fix by removing the `= {}` initialiser and inserting an explicit
memset() immediately after the declaration.  memset() on a VLA is
perfectly legal and achieves the same zero-initialisation on all
conforming C implementations.

Fixes: 19faf6f ("vfio: selftests: Add a helper library for VFIO selftests")
Cc: stable@vger.kernel.org
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: David Matlack <dmatlack@google.com>
Signed-off-by: Manish Honap <mhonap@nvidia.com>
Link: https://lore.kernel.org/r/20260317051402.3725670-1-mhonap@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7aa27b20e938bfd1b0035f423474b1e26bc7e9c3)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 903570835f12b7436ca0edb0a9ed351c0349121e upstream.

The list_lock spinlock with IRQ disabling was copied from the mlx5
vfio-pci variant driver, where it is justified by a hardirq async
command completion callback that accesses the protected lists.  The
virtio driver has no such interrupt context usage; all list_lock
acquisitions occur in process context via file read/write operations
or state transitions under state_mutex.

Convert list_lock to a mutex to be consistent with peer vfio-pci
variant drivers (hisilicon, pds, qat, xe) which all use mutexes for
equivalent migration data protection.  This also fixes a mismatched
spin_lock()/spin_unlock_irq() pair in virtiovf_read_device_context_chunk()
that could incorrectly enable interrupts.

Reported-by: Jinhui Guo <guojinhui.liam@bytedance.com>
Closes: https://lore.kernel.org/all/20260413073603.30538-1-guojinhui.liam@bytedance.com
Fixes: 0bbc82e ("vfio/virtio: Add support for the basic live migration functionality")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Link: https://lore.kernel.org/r/20260414200625.3601509-2-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 08da3594c8ba49da00ef4c75ff5a5f7b38fa6cfe)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 670e8864b1a218d72f08db40d0103adf38fa1d9b upstream.

vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the
vdev->cdx_irqs array based on its value, but provides no serialization
against concurrent VFIO_DEVICE_SET_IRQS ioctls.  Two callers can race
such that one observes config_msi as set while another clears it and
frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free
of the cdx_irqs array.

Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in
vfio_cdx_set_msi_trigger(), which is the single chokepoint through
which all updates to config_msi, cdx_irqs, and msi_count flow, covering
both the ioctl path and the close-device cleanup path.  This keeps the
test of config_msi atomic with the subsequent enable, disable, or
trigger operations.

Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part
of this change: the optimization it provided is redundant with the
!config_msi early-return inside vfio_cdx_msi_disable(), and leaving the
test in place would be an unsynchronized read of state the new lock is
meant to protect.

Fixes: 848e447 ("vfio/cdx: add interrupt support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Acked-by: Nikhil Agarwal <nikhil.agarwal@amd.com>
Link: https://lore.kernel.org/r/20260417202800.88287-3-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7b436ade16cc81095d79b79f8efa3af0a4f5c5a2)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 5ea5880764cbb164afb17a62e76ca75dc371409d upstream.

Add validation to ensure MSI is configured before accessing cdx_irqs
array in vfio_cdx_set_msi_trigger(). Without this check, userspace
can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS
with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before
ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD.

The vfio_cdx_msi_enable() function allocates the cdx_irqs array and
sets config_msi to 1 only when called through the EVENTFD path. The
trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been
done, but there was no enforcement of this call ordering.

This matches the protection used in the PCI VFIO driver where
vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.

Fixes: 848e447 ("vfio/cdx: add interrupt support")
Cc: stable@vger.kernel.org
Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
Acked-by: Nipun Gupta <nipun.gupta@amd.com>
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Acked-by: Nikhil Agarwal <nikhil.agarwal@amd.com>
Link: https://lore.kernel.org/r/20260417202800.88287-2-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 5d6c349c9823eb819fed8b537b088cf38126018c)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 91e901c65b4da02a6fd543e3f0049829ae9645b7 upstream.

Building ARCH=um on glibc >= 2.43 fails:

  arch/um/drivers/cow_user.c: error: implicit declaration of
  function 'strrchr' [-Wimplicit-function-declaration]

glibc 2.43's C23 const-preserving strrchr() macro does not survive
UML's global -Dstrrchr=kernel_strrchr remap from arch/um/Makefile.
Call kernel_strrchr() directly in cow_user.c so the source no longer
depends on the -D rewrite.

Fixes: 2c51a4b ("um: fix strrchr() problems")
Suggested-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Assisted-by: Codex:gpt-5-4
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260408070102.2325572-1-michael.bommarito@gmail.com
[remove unnecessary 'extern']
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2810fc760aaf9d60aa2047e90e1ca5cd938062b0)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 upstream.

If thermal_zone_device_register_with_trips() fails after adding
a thermal governor to the thermal zone being registered, the
governor is not removed from it as appropriate which may lead to
a memory leak.

In turn, thermal_zone_device_unregister() calls thermal_set_governor()
without acquiring the thermal zone lock beforehand which may race with
a governor update via sysfs and may lead to a use-after-free in that
case.

Address these issues by adding two thermal_set_governor() calls, one to
thermal_release() to remove the governor from the given thermal zone,
and one to the thermal zone registration error path to cover failures
preceding the thermal zone device registration.

Fixes: e33df1d ("thermal: let governors have private data for each thermal zone")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 75f8f3c3e09122270986de9d7aa347d701676761)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 1c78c2002380a1fe31bfb01a3d5f29809e55a096 upstream.

The SPI subsystem frees the controller and any subsystem allocated
driver data as part of deregistration (unless the allocation is device
managed).

Take another reference before deregistering the controller so that the
driver data is not freed until the driver is done with it.

Fixes: 307c897 ("spi: spi-imx: replace struct spi_imx_data::bitbang by pointer to struct spi_controller")
Cc: stable@vger.kernel.org	# 5.19
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260324082326.901043-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 132e47030b0b5e398e0da6c59df5a5dae9b52cff)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit b99e3ddb91b499d920e63a2daff8880be68cfe9e upstream.

Make sure to deregister the controller, disable pins, and kill and free
the RX URB on probe failures to mirror disconnect and avoid memory
leaks and use-after-free.

Also add an explicit URB kill on disconnect for symmetry (even if that
is not strictly required as USB core would have stopped it in the
current setup).

Fixes: 8846739 ("spi: add ch341a usb2spi driver")
Cc: stable@vger.kernel.org	# 6.11
Cc: Johannes Thumshirn <jth@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260327104305.1309915-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ff8a7996dc8bf433efe2126ffdaee5b374a89e30)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 615d9bb2ccad42f9e21d837431e401db2e471195 upstream.

We can only call filemap_free_folio() if we have a reference to (or hold a
lock on) the mapping.  Otherwise, we've already removed the folio from the
mapping so it no longer pins the mapping and the mapping can be removed,
causing a use-after-free when accessing mapping->a_ops.

Follow the same pattern as __remove_mapping() and load the free_folio
function pointer before dropping the lock on the mapping.  That lets us
make filemap_free_folio() static as this was the only caller outside
filemap.c.

Link: https://lore.kernel.org/20260413184314.3419945-1-willy@infradead.org
Fixes: fb7d3bc ("mm/filemap: drop streaming/uncached pages when writeback completes")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-501448199@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit efc52947247a21bbf79059539bbbd40f4ea76f00)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 5aa58c3a572b3e3b6c786953339f7978b845cc52 upstream.

AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during
request processing.  For async requests, later socket activity can
update that shared state before the original request has fully
completed, which can lead to inconsistent IV handling.

Snapshot the IV into per-request storage when preparing the AEAD
request, so in-flight operations no longer depend on mutable socket
state.

Fixes: d887c52 ("crypto: algif_aead - overhaul memory management")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn>
Tested-by: Yucheng Lu <kanolyc@gmail.com>
Signed-off-by: Douya Le <ldy3087146292@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ebc235675f24b0e3f8bc92b8419471d42f837d8f)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 915b692e6cb723aac658c25eb82c58fd81235110 upstream.

MAY_BACKLOG requests can return EBUSY.  Handle them by checking
for that value and filtering out EINPROGRESS notifications.

Reported-by: Yiming Qian <yimingqian591@gmail.com>
Fixes: 5a1436b ("crypto: pcrypt - call the complete function on error")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 77d55bc8675ee851ed639dc9be77325a8024cf67)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…traints

commit 9c469240997584449cfac51a75d1d3d71968c76f upstream.

The AM62L DSS [1] support incorrectly used the same register and
clock constraints as AM65x, but AM62L has a single video port

Fix this by adding conditional constraints that properly define the
register regions and clocks for AM62L DSS (single video port) versus
other AM65x variants (dual video port).

[1]: Section 12.7 (Display Subsystem and Peripherals)
Link : https://www.ti.com/lit/pdf/sprujb4

Fixes: cb8d432 ("dt-bindings: display: ti,am65x-dss: Add support for AM62L DSS")
Cc: stable@vger.kernel.org
Signed-off-by: Swamil Jain <s-jain1@ti.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260415110409.2577633-1-s-jain1@ti.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 824897e69d7ae94f9a65790b74e8e37032e3393c)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit faecdd423c27f0d6090156a435ba9dbbac0eaddb upstream.

The variable 'parent' is assigned the value of 'nchangeset' earlier in the
function, meaning both point to the same struct device_node. The call to
of_node_put(nchangeset) can decrement the reference count to zero and
free the node if there are no other holders. After that, the code still
uses 'parent' to check for the presence of a property and to read a
string property, leading to a use-after-free.

Fix this by moving the of_node_put() call after the last access to
'parent', avoiding the UAF.

Fixes: 1c668ea ("of: unittest: Use of_property_present()")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409022233.418103-1-vulab@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7f0f0926f3010b10cff5e93446258f971e42f2fd)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 07fd339b2c253205794bea5d9b4b7548a4546c56 upstream.

The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.

The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.

Fixes: 26409dd ("of: unittest: Add pci_dt_testdrv pci driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 5b6122a67a295f8a08b7c18d908a1bd974dfaec8)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit b66437cb20a2d9ef201f40b675569f8ea7787c9f upstream.

wait_for_completion_interruptible_timeout() returns -ERESTARTSYS when
interrupted. This needs to abort the URB and return an error. No data
has been received from the device so any reads from the transfer
buffer are invalid.

The original code tests !ret, which only catches the timeout case (0).
On signal delivery (-ERESTARTSYS), !ret is false so the function skips
usb_kill_urb() and falls through to read from the unfilled transfer
buffer.

Fix by capturing the return value into a long (matching the function
return type) and handling signal (negative) and timeout (zero) cases
with separate checks that both call usb_kill_urb() before returning.

Fixes: 4381a36 ("hwmon: add POWER-Z driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260410002521.422645-3-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b6cb07f02253bdefd2339e57eaa1428a7b28cd0f)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 5c709b376460ff322580c41600e31c02f7cc0307 upstream.

of_parse_phandle() returns a device_node reference that must be released with
of_node_put(). The original code never freed r5_core_node on any exit path,
causing a memory leak.

Fix this by using the automatic cleanup attribute __free(device_node) which
ensures of_node_put() is called when the variable goes out of scope.

Fixes: d5fe2fe ("EDAC: Add a driver for the AMD Versal NET DDR controller")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
Cc: <stable@kernel.org>
Link: https://patch.msgid.link/20260323-versalnet-v1-1-4ab3012635ef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b6e61356ad24987be40bf25369d22dd8dd00a513)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 5f73cf1db829c21b7fd44a8d2587cd395b1b2d76 upstream.

On i.MX6SX, the LTSSM registers become inaccessible after the
PME_Turn_Off message is sent to the link. So there is no way to verify
whether the link has entered L2/L3 Ready state or not.

Hence, set IMX_PCIE_FLAG_SKIP_L23_READY flag for i.MX6SX SoC to skip the
L2/L3 Ready state polling and let the DWC core wait for 10ms after sending
the PME_Turn_Off message as per the PCIe spec r6.0, sec 5.3.3.2.1.

Fixes: a528d1a ("PCI: imx6: Use DWC common suspend resume method")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260228080925.1558395-1-hongxing.zhu@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit e0a621459c61384fe648a13287cb1a6dee07d853)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e upstream.

Fix kernel panic caused by race condition where v4l2_m2m_ctx_release()
frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run
with the same context.

Race sequence:
  v4l2_m2m_try_run():           v4l2_m2m_ctx_release():
    lock/unlock                   v4l2_m2m_cancel_job()
                                    job_abort()
                                      v4l2_m2m_job_finish()
                                  kfree(m2m_ctx)  <- frees ctx
    device_run()  <- use-after-free crash at 0x538

Crash trace:
  Unable to handle kernel read from unreadable memory at virtual address
  0000000000000538
  v4l2_m2m_try_run+0x78/0x138
  v4l2_m2m_device_run_work+0x14/0x20

The amphion vpu driver does not rely on the m2m framework's device_run
callback to perform encode/decode operations.

Fix the race by preventing m2m framework job scheduling entirely:
- Add job_ready callback returning 0 (no jobs ready for m2m framework)
- Remove job_abort callback to avoid the race condition

Fixes: 3cd0845 ("media: amphion: add vpu v4l2 m2m support")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit fdc150dac1adb9a98be9d6956cff0348838b024a)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…_enum_names()

commit e0da8a8cac74f4b9f577979d131f0d2b88a84487 upstream.

snd_ctl_elem_init_enum_names() advances pointer p through the names
buffer while decrementing buf_len. If buf_len reaches zero but items
remain, the next iteration calls strnlen(p, 0).

While strnlen(p, 0) returns 0 and would hit the existing name_len == 0
error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks
maxlen against __builtin_dynamic_object_size(). When Clang loses track
of p's object size inside the loop, this triggers a BRK exception panic
before the return value is examined.

Add a buf_len == 0 guard at the loop entry to prevent calling fortified
strnlen() on an exhausted buffer.

Found by kernel fuzz testing through Xiaomi Smartphone.

Fixes: 8d44816 ("ALSA: control: add support for ENUMERATED user space controls")
Cc: stable@vger.kernel.org
Signed-off-by: Ziqing Chen <chenziqing@xiaomi.com>
Link: https://patch.msgid.link/20260414132437.261304-1-chenziqing@xiaomi.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 654c818a69c21d2bea4e8fd9eae7da865df9a5c8)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8 upstream.

`caif_connect()` can tear down an existing client after remote shutdown by
calling `caif_disconnect_client()` followed by `caif_free_client()`.
`caif_free_client()` releases the service layer referenced by
`adap_layer->dn`, but leaves that pointer stale.

When the socket is later destroyed, `caif_sock_destructor()` calls
`caif_free_client()` again and dereferences the freed service pointer.

Clear the client/service links before releasing the service object so
repeated teardown becomes harmless.

Fixes: 43e3692 ("caif: Move refcount from service layer to sock and dev.")
Cc: stable@kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/9f3d37847c0037568aae698ca23cd47c6691acb0.1775897577.git.zcliangcn@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 63d21a3aa0108b9dde4e99b0d3d5d679ac68c0f9)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit fe72340daaf1af588be88056faf98965f39e6032 upstream.

When the stream parser is aborted, for example after a message assembly timeout,
it can still hold a reference to a partially assembled message in
strp->skb_head.

That skb is not released in strp_abort_strp(), which leaks the partially
assembled message and can be triggered repeatedly to exhaust memory.

Fix this by freeing strp->skb_head and resetting the parser state in the
abort path. Leave strp_stop() unchanged so final cleanup still happens in
strp_done() after the work and timer have been synchronized.

Fixes: 43a0c67 ("strparser: Stream parser for messages")
Cc: stable@kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/ade3857a9404999ce9a1c27ec523efc896072678.1775482694.git.rakukuip@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 19ca9475f18f991735f98a22e735c43e95e6298d)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
StollD and others added 28 commits May 8, 2026 11:12
Signed-off-by: Dorian Stoll <dorian.stoll@tmsp.io>
Patchset: ipts

Link: linux-surface/linux-surface@91786c3
Signed-off-by: Mingcong Bai <jeffbai@aosc.io>
(cherry picked from commit 4241b8562f1ec9b7b79f9969fe53dafa430508b8)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
(cherry picked from commit ec441e0)
Conflicts:
	drivers/misc/mei/hw-me-regs.h
	drivers/misc/mei/pci-me.c
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 7044ed6 ]

Certain platforms may not have the PHY_ENABLE bit set on power on reset.
Update the current sequence to explicitly write to enable the PHY_ENABLE
bit.  This ensures that regardless of the platform, the PHY is properly
enabled.

Signed-off-by: Ronak Raheja <ronak.raheja@oss.qualcomm.com>
Signed-off-by: Wesley Cheng <wesley.cheng@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20250920032158.242725-1-wesley.cheng@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Stable-dep-of: 520a98bdf7ae ("phy: qcom: m31-eusb2: clear PLL_EN during init")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 37ef11ab2cf3ce04a92e4a5c1a59a74670c88a24)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 520a98bdf7ae0130e22d8adced3d69a2e211b41f ]

The driver currently sets bit 0 of USB_PHY_CFG1 (PLL_EN) during PHY
initialization. According to the M31 EUSB2 PHY hardware documentation,
this bit is intended only for test/debug scenarios and does not control
mission mode operation. Keeping PLL_EN asserted causes the PHY to draw
additional current during USB bus suspend. Clearing this bit results in
lower suspend power consumption without affecting normal operation.

Update the driver to leave PLL_EN cleared as recommended by the hardware
documentation.

Fixes: 9c85048 ("phy: qcom: Add M31 based eUSB2 PHY driver")
Cc: stable@vger.kernel.org
Signed-off-by: Elson Serrao <elson.serrao@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260217201130.2804550-1-elson.serrao@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 09e1c96594afb2a13e4090119728545ca9c06dfd)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit e6f48512c1ceebcd1ce6bb83df3b3d56a261507d ]

Prepare mt792xu_wfsys_reset() for chips that share the same USB WFSYS
reset flow but use different register definitions.

This is a pure refactor of the current mt7921u path and keeps the reset
sequence unchanged.

Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Link: https://patch.msgid.link/20260311002825.15502-1-sean.wang@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Stable-dep-of: 56154fef47d1 ("wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0bc155c4ca4776f9de1851d54d457671d676ac57)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 56154fef47d104effa9f29ed3db4f805cbc0d640 ]

mt7925u uses different reset/status registers from mt7921u. Reusing the
mt7921u register set causes the WFSYS reset to fail.

Add a chip-specific descriptor in mt792xu_wfsys_reset() to select the
correct registers and fix mt7925u failing to initialize after a warm
reboot.

Fixes: d28e1a4 ("wifi: mt76: mt792x: introduce mt792x-usb module")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Link: https://patch.msgid.link/20260311002825.15502-2-sean.wang@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7d7863018f40df0c6d32714a1723ae0c119abba0)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 50acaad3d202c064779db8dc3d010007347f59c7 ]

Buffers must not share a cache line with other data structures.
Allocate separately.

Fixes: 0938069 ("[media] rc: Add support for the TechnoTrend USB IR Receiver")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[ kept kzalloc(sizeof(*tt), GFP_KERNEL) instead of kzalloc_obj() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7ba734027b2beeaa24a6f76614004a4126cccf74)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit eac69475b01fe1e861dfe3960b57fa95671c132e ]

In a control request, the USB request structure
can be subject to DMA on some HCs. Hence it must obey
the rules for DMA coherency. Allocate it separately.

Fixes: b1c9719 ("[media] rc: port IgorPlug-USB to rc-core")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[ replaced kzalloc_obj(*ir->request, GFP_KERNEL) with kzalloc(sizeof(*ir->request), GFP_KERNEL) ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0adac0ee2c42027d80bac02ea9b576a88f8955d3)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit e61b5bb0e91390adee41eaddc0a1a7d55d5652b2 ]

Introduce a local struct device pointer in functions that reference
&spi->dev for device-managed resource calls and device property reads,
improving code readability.

Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: aac0a51b1670 ("iio: frequency: admv1013: fix NULL pointer dereference on str")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c772e9efe2b1f1b1dcd481474e36eae42a42176d)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit aac0a51b16700b403a55b67ba495de021db78763 ]

When device_property_read_string() fails, str is left uninitialized
but the code falls through to strcmp(str, ...), dereferencing a garbage
pointer. Replace manual read/strcmp with
device_property_match_property_string() and consolidate the SE mode
enums into a single sequential enum, mapping to hardware register
values via a switch consistent with other bitfields in the driver.

Several cleanup patches have been applied to this driver recently so
this will need a manual backport.

Fixes: da35a7b ("iio: frequency: admv1013: add support for ADMV1013")
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 5e9f1bad26df3d3afb3cbbfa408b6d6e809708ac)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit d5ee2ff98322337951c56398e79d51815acbf955 ]

Current code does no bound checking on the number of servers added per
node. A malicious client can flood NEW_SERVER messages and exhaust memory.

Fix this issue by limiting the maximum number of server registrations to
256 per node. If the NEW_SERVER message is received for an old port, then
don't restrict it as it will get replaced. While at it, also rate limit
the error messages in the failure path of qrtr_ns_worker().

Note that the limit of 256 is chosen based on the current platform
requirements. If requirement changes in the future, this limit can be
increased.

Cc: stable@vger.kernel.org
Fixes: 0c2204a ("net: qrtr: Migrate nameservice to kernel from userspace")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260409-qrtr-fix-v3-1-00a8a5ff2b51@oss.qualcomm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 35fb4a0c077c5d1049c2628b769e0a1b1e65df0d)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 5640227d9a21c6a8be249a10677b832e7f40dc55 ]

Current code does no bound checking on the number of lookups a client can
perform. Though the code restricts the lookups to local clients, there is
still a possibility of a malicious local client sending a flood of
NEW_LOOKUP messages over the same socket.

Fix this issue by limiting the maximum number of lookups to 64 globally.
Since the nameserver allows only atmost one local observer, this global
lookup count will ensure that the lookups stay within the limit.

Note that, limit of 64 is chosen based on the current platform
requirements. If requirement changes in the future, this limit can be
increased.

Cc: stable@vger.kernel.org
Fixes: 0c2204a ("net: qrtr: Migrate nameservice to kernel from userspace")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260409-qrtr-fix-v3-2-00a8a5ff2b51@oss.qualcomm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ adapted comment block to only mention QRTR_NS_MAX_LOOKUPS and kept kzalloc() instead of kzalloc_obj() due to missing prerequisite commits ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 20855cef7e659ef84ac73251256fa530819b2346)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 27d5e84e810b0849d08b9aec68e48570461ce313 ]

Currently, the nameserver doesn't limit the number of nodes it handles.
This can be an attack vector if a malicious client starts registering
random nodes, leading to memory exhaustion.

Hence, limit the maximum number of nodes to 64. Note that, limit of 64 is
chosen based on the current platform requirements. If requirement changes
in the future, this limit can be increased.

Cc: stable@vger.kernel.org
Fixes: 0c2204a ("net: qrtr: Migrate nameservice to kernel from userspace")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260409-qrtr-fix-v3-4-00a8a5ff2b51@oss.qualcomm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ dropped comment/define changes for missing QRTR_NS_MAX_SERVERS/LOOKUPS prereqs and kept plain kzalloc instead of kzalloc_obj ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 5cf6d5e5e3b804a44692fbf548a5179442e2e923)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 5db6ef9847717329f12c5ea8aba7e9f588a980c0 upstream.

authencesn requires either a zero authsize or an authsize of at least
4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of
high-order sequence number data at the end of the authenticated data.

While crypto_authenc_esn_setauthsize() already rejects explicit
non-zero authsizes in the range 1..3, crypto_authenc_esn_create()
still copied auth->digestsize into inst->alg.maxauthsize without
validating it.  The AEAD core then initialized the tfm's default
authsize from that value.

As a result, selecting an ahash with digest size 1..3, such as
cbcmac(cipher_null), exposed authencesn instances whose default
authsize was invalid even though setauthsize() would have rejected the
same value.  AF_ALG could then trigger the ESN tail handling with a
too-short tag and hit an out-of-bounds access.

Reject authencesn instances whose ahash digest size is in the invalid
non-zero range 1..3 so that no tfm can inherit an unsupported default
authsize.

Fixes: f15f05b ("crypto: ccm - switch to separate cbcmac driver")
Cc: stable@kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yuhang Zheng <z1652074432@gmail.com>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Yucheng Lu <kanolyc@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b42821c15445f93daea3e76ada682b2b7181c476)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 5b484311507b5d403c1f7a45f6aa3778549e268b upstream.

Even though nobody should use this value (except when declaring the
"flags" bitmap), kernel-doc still gets upset that it's not documented.
It reports:

  WARNING: ../include/linux/device.h:519
  Enum value 'DEV_FLAG_COUNT' not described in enum 'struct_device_flags'

Add the description of DEV_FLAG_COUNT.

Fixes: a2225b6e834a ("driver core: Don't let a device probe until it's ready")
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Closes: https://lore.kernel.org/f318cd43-81fd-48b9-abf7-92af85f12f91@infradead.org
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260413195910.1.I23aca74fe2d3636a47df196a80920fecb2643220@changeid
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b8c5acce56e07eb6654d0ff0427945875d9179f8)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 0a7b5221b5b51cc798fcfc3be00d02eade149d69 upstream.

The previous fix for handling the error from setup_card() missed that
an internal URB cdev->ep1_in_urb might have been already submitted
beforehand.  In the normal case, this URB gets killed at the
disconnection, but in the error path, we didn't do it, hence there can
be a potential leak.

Fix it in the error path for setup_card(), too.

Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly")
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260427123819.890185-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1d160e30aa42b7c41163e51366bb34432367260d)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit b32ae47a2b0a1fb4bd4942242847966d9b178222 upstream.

The previous fix to handle the error from setup_card() caused a
regression for the models that have no dedicated input device;
snd_usb_caiaq_input_init() just returns -EINVAL, and we treat it as a
fatal error although it should be ignored.

As a regression fix, change the error code to -ENODEV, and ignore this
error in the callee, to continue probing.

Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly")
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221423
Link: https://patch.msgid.link/20260427145642.6637-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3d46009e2ad467cfd2eda23165f92d9e3c1e8480)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 9e6bf146b55999a095bb14f73a843942456d1adc upstream.

ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back.  The
recompressed header can be larger than the received one when the swap
reduces the common-prefix length the segments share with daddr (CmprI=0,
CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).

pskb_expand_head() was gated on segments_left == 0, so on earlier
segments the push consumed unchecked headroom.  Once skb_push() leaves
fewer than skb->mac_len bytes in front of data,
skb_mac_header_rebuild()'s call to:

	skb_set_mac_header(skb, -skb->mac_len);

will store (data - head) - mac_len into the u16 mac_header field, which
wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB
past skb->head.

A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two
segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one
pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.

Fix this by expanding the head whenever the remaining room is less than
the push size plus mac_len, and request that much extra so the rebuilt
MAC header fits afterwards.

Fixes: 8610c7c ("net: ipv6: add support for rpl sr exthdr")
Cc: stable <stable@kernel.org>
Reported-by: Anthropic
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026042133-gout-unvented-1bd9@gregkh
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c261d07a80576dc8ccf394ef8f074f8c67a06b37)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 095a8b0ad3c3b5cdc3850d961adb8a8f735220bb upstream.

RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory
resources. The gfx_v12_0 initialisation code correctly leaves
adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at
zero to reflect this.

amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for
each of these resources regardless of size. When the size is zero,
amdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(),
which calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires
DRM_MM_BUG_ON(start + size <= start) -- trivially true when size is
zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT.

Guard against this by returning 0 early from
amdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM
resource manager registration for hardware resources that are absent,
without affecting any other GPU type.

DRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in
the kernel config.  This is apparently rarely enabled as these chips
have been in the market for over a year and this issue was only reported
now.

Link: https://lore.kernel.org/all/bug-221376-2300@https.bugzilla.kernel.org%2F/
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221376
Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html
Assisted-by: GitHub Copilot:Claude Sonnet 4.6 linux-kernel-oops-x86.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 30c000a49094ec568c9b51b7421f7a4a3f0b0298)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b upstream.

create_card() takes a reference on the USB device with usb_get_dev()
and stores the matching usb_put_dev() in card_free(), which is
installed as the snd_card's ->private_free destructor.

However, ->private_free is only assigned near the end of init_card(),
after several failure points (usb_set_interface(), EP type checks,
usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its
timeout). When any of those fail, init_card() returns an error to
snd_probe(), which calls snd_card_free(card). Because ->private_free
is still NULL, card_free() never runs, the usb_get_dev() reference
is not dropped, and the struct usb_device leaks along with its
descriptor allocations and device_private.

syzbot reproduces this with a malformed UAC3 device whose only valid
altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call
fails with -EIO and triggers the leak.

Move the ->private_free assignment into create_card(), immediately
after usb_get_dev(), so that every error path reaching snd_card_free()
balances the reference. card_free()'s callees (snd_usb_caiaq_input_free,
free_urbs, kfree) already tolerate the partially-initialized state
because the chip private area is zero-initialized by snd_card_new().

Fixes: 80bb50e2d459 ("ALSA: caiaq: take a reference on the USB device in create_card()")
Reported-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2afd7e71155c7e241560
Tested-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260426001934.70813-1-kartikey406@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6153878c5255bb69b7d0868105ca078ef13cbcf8)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff upstream.

loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit
826af7f ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.

A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.

Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.

Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f
Fixes: 597603d ("ALSA: introduce the snd-aloop module for the PCM loopback")
Cc: stable@vger.kernel.org
Suggested-by: Takashi Iwai <tiwai@suse.com>
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 82d1f01292d3f09bf063f829f8ab8de12b4280a1 upstream.

Commit 4c5d336 ("mm/vmalloc: allow to set node and align in
vrealloc") added the ability to force a new allocation if the current
pointer is on the wrong NUMA node, or if an alignment constraint is not
met, even if the user is shrinking the allocation.

On this path (need_realloc), the code allocates a new object of 'size'
bytes and then memcpy()s 'old_size' bytes into it.  If the request is to
shrink the object (size < old_size), this results in an out-of-bounds
write on the new buffer.

Fix this by bounding the copy length by the new allocation size.

Link: https://lore.kernel.org/20260420114805.3572606-2-elver@google.com
Fixes: 4c5d336 ("mm/vmalloc: allow to set node and align in vrealloc")
Signed-off-by: Marco Elver <elver@google.com>
Reported-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit e9b057a44deff4c59c13f44672a5cc74dcd57522)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…NMI on UP

commit 620b46ed6ae17c8438d889c8c0cfddab36a1476c upstream.

On UP kernels (!CONFIG_SMP), spin_trylock() is a no-op that
unconditionally succeeds even when the lock is already held. As a
result, alloc_frozen_pages_nolock() called from NMI context can
re-enter rmqueue() and acquire the zone lock that the interrupted
context is already holding, corrupting the freelists.

With CONFIG_DEBUG_SPINLOCK on UP, the following BUG is triggered with
the slub_kunit test module:

  BUG: spinlock trylock failure on UP on CPU#0, kunit_try_catch/243
  [...]
  Call Trace:
   <NMI>
   dump_stack_lvl+0x3f/0x60
   do_raw_spin_trylock+0x41/0x50
   _raw_spin_trylock+0x24/0x50
   rmqueue.isra.0+0x2a9/0xa70
   get_page_from_freelist+0xeb/0x450
   alloc_frozen_pages_nolock_noprof+0x111/0x1e0
   allocate_slab+0x42a/0x500
   ___slab_alloc+0xa7/0x4c0
   kmalloc_nolock_noprof+0x164/0x310
   [...]
   </NMI>

Fix this by returning NULL early when invoked from NMI on a UP kernel.

Link: https://lore.kernel.org/linux-mm/ad_cqe51pvr1WaDg@hyeyoo
Cc: stable@vger.kernel.org
Fixes: d7242af ("mm: Introduce alloc_frozen_pages_nolock()")
Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
Link: https://patch.msgid.link/20260427-nolock-api-fix-v2-1-a6b83a92d9a4@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 05b4ed8bef30bba4f559c8d835e2dd20c48cf8a4)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 5b31044e649e3e54c2caef135c09b371c2fbcd08 upstream.

On UP kernels (!CONFIG_SMP), spin_trylock() is a no-op that
unconditionally succeeds even when the lock is already held. As a
result, kmalloc_nolock() called from NMI context can re-enter the slab
allocator and acquire n->list_lock that the interrupted context is
already holding, corrupting slab state.

With CONFIG_DEBUG_SPINLOCK on UP, the following BUG is triggered with
the slub_kunit test module:

  BUG: spinlock trylock failure on UP on CPU#0, kunit_try_catch/243
  [...]
  Call Trace:
   <NMI>
   dump_stack_lvl+0x3f/0x60
   do_raw_spin_trylock+0x41/0x50
   _raw_spin_trylock+0x24/0x50
   get_from_partial_node+0x120/0x4d0
   ___slab_alloc+0x8a/0x4c0
   kmalloc_nolock_noprof+0x164/0x310
   [...]
   </NMI>

Fix this by returning NULL early when invoked from NMI on a UP kernel.

Link: https://lore.kernel.org/linux-mm/ad_cqe51pvr1WaDg@hyeyoo
Cc: stable@vger.kernel.org
Fixes: af92793 ("slab: Introduce kmalloc_nolock() and kfree_nolock().")
Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
Link: https://patch.msgid.link/20260427-nolock-api-fix-v2-2-a6b83a92d9a4@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a8d95d274be241ad21f6523bf2d6ba0d7d7e46b7)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e upstream.

seg6_input_core() and rpl_input() call ip6_route_input() which sets a
NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking
dst_hold() unconditionally.
On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can
release the underlying pcpu_rt between the lookup and the caching
through a concurrent FIB lookup on a shared nexthop.
Simplified race sequence:

  ksoftirqd/X                       higher-prio task (same CPU X)
  -----------                       --------------------------------
  seg6_input_core(,skb)/rpl_input(skb)
    dst_cache_get()
      -> miss
    ip6_route_input(skb)
      -> ip6_pol_route(,skb,flags)
         [RT6_LOOKUP_F_DST_NOREF in flags]
        -> FIB lookup resolves fib6_nh
           [nhid=N route]
        -> rt6_make_pcpu_route()
           [creates pcpu_rt, refcount=1]
             pcpu_rt->sernum = fib6_sernum
             [fib6_sernum=W]
           -> cmpxchg(fib6_nh.rt6i_pcpu,
                      NULL, pcpu_rt)
              [slot was empty, store succeeds]
      -> skb_dst_set_noref(skb, dst)
         [dst is pcpu_rt, refcount still 1]

                                    rt_genid_bump_ipv6()
                                      -> bumps fib6_sernum
                                         [fib6_sernum from W to Z]
                                    ip6_route_output()
                                      -> ip6_pol_route()
                                        -> FIB lookup resolves fib6_nh
                                           [nhid=N]
                                        -> rt6_get_pcpu_route()
                                             pcpu_rt->sernum != fib6_sernum
                                             [W <> Z, stale]
                                          -> prev = xchg(rt6i_pcpu, NULL)
                                          -> dst_release(prev)
                                             [prev is pcpu_rt,
                                              refcount 1->0, dead]

    dst = skb_dst(skb)
    [dst is the dead pcpu_rt]
    dst_cache_set_ip6(dst)
      -> dst_hold() on dead dst
      -> WARN / use-after-free

For the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without
PREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release
the pcpu_rt. Shared nexthop objects provide such a path, as two routes
pointing to the same nhid share the same fib6_nh and its rt6i_pcpu
entry.

Fix seg6_input_core() and rpl_input() by calling skb_dst_force() after
ip6_route_input() to force the NOREF dst into a refcounted one before
caching.
The output path is not affected as ip6_route_output() already returns a
refcounted dst.

Fixes: af4a220 ("ipv6: sr: use dst_cache in seg6_input")
Fixes: a7a29f9 ("net: ipv6: add rpl sr tunnel")
Cc: stable@vger.kernel.org
Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
Link: https://patch.msgid.link/20260421094735.20997-1-andrea.mayer@uniroma2.it
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b778b6d095421619c331fd2d7751143cd5387103)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit fe11e5c40817b84abaa5d83bfb6586d8412bfd07 upstream.

Reject zero shift operands for nft_bitwise left and right shift
expressions during initialization.

The carry propagation logic computes the carry from the adjacent 32-bit
word using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this
into a 32-bit shift, which is undefined behaviour.

Reject zero shift operands in the control plane, alongside the existing
check for values greater than or equal to 32, so malformed rules never
reach the packet path.

Fixes: 567d746 ("netfilter: bitwise: add support for shifts.")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Kai Ma <k4729.23098@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6f820139d16a4c9865a145d4a9cf9c92cc632c14)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 91eb7ec7261254b6875909df767185838598e21e upstream.

A section was in {} that didn't need to be, move the variable
definition to the top and set th eindentino properly.

Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 52a7c9a2823da0d06b1a659b1bea1290a79a5044)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit a8aebe93a4938c0ca1941eeaae821738f869be3d upstream.

Cleanup code was checking the thread for NULL, but it was possibly
a PTR_ERR() in one spot.

Spotted with static analysis.

Link: https://sourceforge.net/p/openipmi/mailman/message/59324676/
Fixes: 75c486cb1bca ("ipmi:ssif: Clean up kthread on errors")
Cc: <stable@vger.kernel.org> # 91eb7ec72612: ipmi:ssif: Remove unnecessary indention
Cc: stable@vger.kernel.org
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 97d35052a816875ad16bc37ae163ebc873b2928d)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://lore.kernel.org/r/20260504135142.929052779@linuxfoundation.org
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Tested-by: Wentao Guan <guanwentao@uniontech.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Tested-by: Mark Brown <broonie@kernel.org>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Dileep Malepu <dileep.debian@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ce685b6a03dc0270f78bc7aaf2c9ada9cbd45a86)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
@opsiff opsiff force-pushed the linux-6.18-update-6.18.26 branch from 135acc4 to af93ee6 Compare May 8, 2026 03:13
@opsiff opsiff merged commit af93ee6 into deepin-community:linux-6.18.y May 8, 2026
10 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.