Skip to content

Merge tag 'v6.18.39' into qcom-6.18.y#856

Open
nsiddams (nsiddams) wants to merge 608 commits into
qualcomm-linux:qcom-6.18.yfrom
nsiddams:6.18.39-lts
Open

Merge tag 'v6.18.39' into qcom-6.18.y#856
nsiddams (nsiddams) wants to merge 608 commits into
qualcomm-linux:qcom-6.18.yfrom
nsiddams:6.18.39-lts

Conversation

@nsiddams

Copy link
Copy Markdown

No description provided.

Tianxiang Chen and others added 30 commits July 18, 2026 16:53
commit a9029dd upstream.

During system reboot, cpufreq_suspend() is called via the
kernel_restart() -> device_shutdown() path. Unlike the normal system
suspend path, the reboot path does not call freeze_processes(), so
userspace processes and kernel threads remain active.

This allows CPU hotplug operations to run concurrently with
cpufreq_suspend(). The original code has no synchronization with CPU
hotplug, leading to a race condition where governor_data can be freed
by the hotplug path while cpufreq_suspend() is still accessing it,
resulting in a null pointer dereference:

  Unable to handle kernel NULL pointer dereference
  Call Trace:
   do_kernel_fault+0x28/0x3c
   cpufreq_suspend+0xdc/0x160
   device_shutdown+0x18/0x200
   kernel_restart+0x40/0x80
   arm64_sys_reboot+0x1b0/0x200

Fix this by adding cpus_read_lock()/cpus_read_unlock() to
cpufreq_suspend() to block CPU hotplug operations while suspend is in
progress.

Fixes: 65650b3 ("cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown")
Signed-off-by: Tianxiang Chen <nanmu@xiaomi.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260408141914.35281-1-nanmu@xiaomi.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 266d3dd upstream.

pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
two-phase _OSC negotiation. Between the two calls it freed
output.pointer but left output.length unchanged. Since
acpi_evaluate_object() treats a non-zero length with a non-NULL
pointer as an existing buffer to write into, the second call wrote
into freed memory (use-after-free). The subsequent kfree(output.pointer)
at out_free then freed the same pointer a second time (double free).

Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
after freeing the first result, so ACPICA allocates a fresh buffer for
each phase independently.

Fixes: 0f1d683 ("[CPUFREQ] Processor Clocking Control interface driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260416144621.93964-1-dbgh9129@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 87bd2ad upstream.

In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
posix_cpu_timer_set() call fails, the function returns immediately
without calling posix_cpu_timer_del() to release the pid reference,
causing a leak.

Fix it by calling posix_cpu_timer_del() before the unlock-and-return
on the error path, consistent with the other exit paths in the same
function.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260611161738.97043-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f24df84 upstream.

Teddy reported that a XEN HVM has a long boot delay, which was bisected to
the recent enhancements to the negative motion detection. It turned out
that the jiffies clocksource is used in early boot before it is registered,
which leaves the max_delta_raw field at zero. That causes the read out to
be clamped to the max delta of 0, which means time is not making progress.

Cure it by ensuring that it is initialized before its first usage in
timekeeping_init().

Fixes: 76031d9 ("clocksource: Make negative motion detection more robust")
Reported-by: Teddy Astie <teddy.astie@vates.tech>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Teddy Astie <teddy.astie@vates.tech>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/87y0gn3fve.ffs@fw13
Closes: https://lore.kernel.org/all/1780914594.8631fc262581453bbf619ec5b2062170.19ea6c8227b000701b@vates.tech
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
… instances

commit ca57bf4 upstream.

Tegra SoCs support multiple watchdogs; currently only one (WDT0) is
used. When multiple watchdogs are registered, tegra186_wdt_enable()
overwrites the TKEIE(x) register, discarding any existing watchdog
interrupt enable bits. As a result, enabling one watchdog inadvertently
disables interrupts for the others.

Fix this by preserving the existing TKEIE(x) value and updating it
using a read-modify-write sequence.

Fixes: 42cee19 ("clocksource: Add Tegra186 timers support")
Cc: stable@vger.kernel.org
Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260507154557.2082697-2-kkartik@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 37540b8 upstream.

load_unaligned_zeropad() reads eight bytes from unaligned addresses and may
cross page boundaries. It handles exceptions which may happen if reading
from the second page results in an exception.

For pages which are donated to the Ultravisor for secure execution purposes
the do_secure_storage_access() exception handler however does not handle
such exceptions correctly. Such an exception may result in an endless
exception loop which will never be resolved.

An attempt to fix this [1] turned out to be not sufficient. For now revert
load_unaligned_zeropad() until this problem has been resolved in a proper
way.

Note that the implementation of load_unaligned_zeropad() itself is
correct. The revert is just a temporary workaround until there is complete
fix for secure storage access exceptions.

[1] commit b00be77 ("s390/mm: Add missing secure storage access fixups for donated memory")

Fixes: 802ba53 ("s390: add support for DCACHE_WORD_ACCESS")
Cc: stable@vger.kernel.org
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5936245 upstream.

The new DVM node events added in CMN-700 also apply to CMN S3; fix
the model encoding so that we can expose the aliases and handle
occupancy filtering on newer CMNs too.

Cc: stable@vger.kernel.org
Fixes: 0dc2f49 ("perf/arm-cmn: Support CMN S3")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3b626ba upstream.

x509_load_certificate_list() seeks to enforce that a certificate starts
with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256
and less than 65535 bytes).

But it only enforces that *either* of those two byte values are present,
instead of checking for the *conjunction* of the two values.  Fix it.

Fixes: 631cc66 ("MODSIGN: Provide module signing public keys to the kernel")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260508033917.B5873C2BCB0@smtp.kernel.org/
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.7+
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…abled

commit 648927c upstream.

When init (zeroing) on allocation is requested, for kmalloc() we
generally have to zero the full object size even if a smaller size is
requested, in order to provide krealloc()'s __GFP_ZERO guarantees.

But if we track the requested size, krealloc() uses that information to
do the right thing, so we can zero only the requested size. With red
zoning also enabled, any extra size became part of the red zone, so it
must not be zeroed and thus we must zero only the requested size.

However the current check is imprecise, and will trigger also when only
SLAB_RED_ZONE is enabled without SLAB_STORE_USER (which enables tracking
the requested size). This means enabling red zoning alone can compromise
krealloc()'s __GFP_ZERO contract.

Fix this by using slub_debug_orig_size() instead, which is the exact
check for whether the requested size is tracked. We don't need to care
if red zoning is also enabled or not. Also update and expand the
comment accordingly.

Fixes: 9ce6739 ("mm/slub: only zero requested size of buffer for kzalloc when debug enabled")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260610-slab_alloc_flags-v2-1-7190909db118@kernel.org
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Hao Li <hao.li@linux.dev>
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 235ab68 upstream.

The disable trace path in slab_debug() had a logic error where it would
set trace=1 instead of trace=0. This made trace functionality permanently
enabled once turned on for any slab cache.

Fixes: a87615b ("SLUB: slabinfo upgrade")
Cc: stable@vger.kernel.org
Reviewed-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn>
WARNING: From:/Signed-off-by: email address mismatch: 'From: wangxuewen <18810879172@163.com>' != 'Signed-off-by: wangxuewen <wangxuewen@kylinos.cn>'
Link: https://patch.msgid.link/20260518062159.80664-2-wangxuewen@kylinos.cn
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 892a786 upstream.

SLUB exports the total_objects sysfs attribute, but slabinfo tries to read
objects_total. As a result, the lookup fails and the field remains zero.

Use the correct attribute name and rename the corresponding structure
member to match.

Fixes: 205ab99 ("slub: Update statistics handling for variable order slabs")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: SeongJae Park <sj@kernel.org>
Link: https://patch.msgid.link/96556748872BB47E+20260612071359.649946-1-chenyichong@uniontech.com
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…rflow

commit db0a076 upstream.

goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack
buffer (tmp_buf), writing an 11-12 byte header followed by the
caller-supplied report data.  The HID core caps report size at
HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set
hid_ll_driver.max_buffer_size and performs no bounds checking before
copying the payload:

    memcpy(tmp_buf + tx_len, buf, len);

A hidraw SET_REPORT ioctl with a report larger than ~116 bytes
overflows the stack buffer.

Add a size check after constructing the header, rejecting reports that
would exceed the buffer capacity.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Fixes: 75e16c8 ("HID: hid-goodix: Add Goodix HID-over-SPI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 63a694c upstream.

Commit 0a3fe97 ("HID: core: Mitigate potential OOB by removing
bogus memset()"), added a check in hid_report_raw_event() to reject
reports if the received data size is smaller than expected. This was
intended to prevent OOB errors by no longer allowing zeroing-out of
shorter reports due to the lack of buffer size information.

However, this leads to regressions in hid_report_raw_event(), where
shorter than expected reports are rejected, even though their buffers
are sufficiently large to be zero-padded.

To solve this issue, Benjamin introduced a safer alternative in commit
2063425 ("HID: core: introduce hid_safe_input_report()"), which
forwards the buffer size and allows hid_report_raw_event() to safely
zero-pad the data.

Convert uhid to use hid_safe_input_report() and pass UHID_DATA_MAX as
the buffer size. This prevents the reported regressions [1], allowing
hid core to zero-pad the shorter reports safely as expected.

Cc: stable@vger.kernel.org
Fixes: 0a3fe97 ("HID: core: Mitigate potential OOB by removing bogus memset()")
Closes: https://lore.kernel.org/all/ahsh0UtTX6e0ZeHa@google.com/ [1]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Lee Jones <lee@kernel.org>
Closes: https://lore.kernel.org/all/ahsh0UtTX6e0ZeHa@google.com/
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ec2612b upstream.

wacom_parse_and_register() starts HID hardware before registering inputs
and initializing pad LEDs/remotes. Those later steps can fail, but their
error paths currently release Wacom resources without stopping the HID
hardware.

Route post-hid_hw_start() failures through hid_hw_stop() before
releasing driver resources.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: c1d6708 ("HID: wacom: Do not register input devices until after hid_hw_start")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b251598 upstream.

When updating an existing effect, the effect type from the last created
effect was sent to the device instead of the updated one.
This caused incorrect reports when a game creates multiple different
effects and updates only one that is not the last created.

Fixes FFB in multiple games that create multiple simultaneous effects
(Forza Horizon 5/6).

Fixes: 224ee88 ("Input: add force feedback driver for PID devices")
Cc: stable@vger.kernel.org
Tested-by: Oliver Roundtree <oroundtree1@gmail.com>
Co-developed-by: Ryno Kotzé <lemon.xah@gmail.com>
Signed-off-by: Ryno Kotzé <lemon.xah@gmail.com>
Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6b3014e upstream.

wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo
doesn't have enough space for the incoming report. If the kfifo is
empty, kfifo_skip() reads stale data left in the kmalloc'd buffer
via __kfifo_peek_n() and interprets it as a record length, advancing
fifo->out by that garbage value. This corrupts the internal kfifo
state, causing kfifo_unused() to return a value much larger than the
actual buffer size, which bypasses __kfifo_in_r()'s guard:

  if (len + recsize > kfifo_unused(fifo))
      return 0;

kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to
3842 bytes past the 256-byte buffer.

Add a !kfifo_is_empty() condition to the while loop so kfifo_skip()
is never called on an empty fifo, and check the return value of
kfifo_in() to reject reports that are too large for the fifo.

Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Fixes: 5e013ad ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit")
Cc: stable@vger.kernel.org
Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 55f1ad5 upstream.

wacom_wac_queue_flush() is called via the .raw_event callback
(wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush).
For USB HID devices, this callback is invoked from hid_irq_in(), which
is a URB completion handler running in atomic context. Using GFP_KERNEL
in this path can sleep, leading to a "scheduling while atomic" bug.

Use GFP_ATOMIC instead. The existing code already handles allocation
failure by skipping the fifo entry and continuing.

Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
Fixes: 5e013ad ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 46c8bee upstream.

letsketch_driver does not provide a .remove callback, but
letsketch_probe() arms a per-device timer:

    timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);

The timer is re-armed from letsketch_raw_event() with a 100 ms
timeout on every pen-in-range report, and its callback dereferences
data->input_tablet to deliver a synthetic BTN_TOOL_PEN release.

letsketch_data is allocated with devm_kzalloc(), and its input_dev
fields are devm-allocated via letsketch_setup_input_tablet().  On
device unbind (USB unplug or rmmod), the HID core runs its default
teardown and devm cleanup frees both letsketch_data and the input
devices.  Because no .remove callback exists, nothing drains the
timer first: if raw_event armed it within ~100 ms of the unbind,
the pending timer fires on freed memory.  This is a UAF read of
data and of data->input_tablet, followed by input_report_key() /
input_sync() into the freed input_dev.

The same problem can occur on the probe error path: if
hid_hw_start() enabled I/O on an always-poll-quirk device and then
failed, raw_event may have armed the timer before devm releases
data.

Fix by adding a .remove callback that calls hid_hw_stop() first.
hid_hw_stop() synchronously kills the URBs that deliver raw_event(),
so once it returns no path can re-arm the timer.  timer_shutdown_sync()
then drains any in-flight callback and permanently disables further
mod_timer() calls.  Apply the same timer_shutdown_sync() in the probe
error path so the timer is guaranteed not to outlive data.

Fixes: 33a5c27 ("HID: Add new Letsketch tablet driver")
Cc: stable@vger.kernel.org
Signed-off-by: Manish Khadka <maskmemanish@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8813b06 upstream.

mt_io_flags is a single unsigned long, but mt_process_slot(),
mt_release_pending_palms() and mt_release_contacts() use it as a
per-slot bitmap indexed by the slot number. That slot number is only
bounded by td->maxcontacts, which is taken from the device's
ContactCountMaximum feature report and can be up to 255, not by
BITS_PER_LONG.

As a result, a multitouch device that advertises a large contact count
makes set_bit()/clear_bit() operate past the mt_io_flags word and
corrupt the adjacent members of struct mt_device. The sticky-fingers
release timer is the easiest way to reach this. mt_release_contacts()
runs

	for (i = 0; i < mt->num_slots; i++)
		clear_bit(i, &td->mt_io_flags);

with num_slots == maxcontacts. For maxcontacts around 250 the loop
clears the bits that overlap td->applications.next, zeroing that list
head, and the list_for_each_entry() that immediately follows then
dereferences NULL. The kernel panics from timer (softirq) context. On a
KASAN build this shows up as a general protection fault in
mt_release_contacts() with a null-ptr-deref at offset 0x58, which is
offsetof(struct mt_application, num_received).

The state is reachable from an untrusted USB or Bluetooth HID
multitouch device; no local privileges are required.

Store the per-slot active state in a separately allocated bitmap sized
for maxcontacts, the same pattern already used for pending_palm_slots,
and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two
"mt_io_flags & MT_IO_SLOTS_MASK" arming checks become
bitmap_empty(td->active_slots, td->maxcontacts).

Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the
same commit to leave the low byte for the slot bits; with the slot bits
gone it fits in bit 0 again, which also keeps it within the unsigned
long on 32-bit.

Fixes: 46f781e ("HID: multitouch: fix sticky fingers")
Cc: stable@vger.kernel.org
Signed-off-by: Trung Nguyen <trungnh@cystack.net>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 75fe87e upstream.

appleir_remove() runs hid_hw_stop() before timer_delete_sync().
hid_hw_stop() synchronously unregisters the HID input device via
hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),
which drops the last reference and frees the underlying input_dev when
no userspace handle holds it open.

key_up_tick() reads appleir->input_dev and calls input_report_key() /
input_sync() on it.  The timer is armed from appleir_raw_event() with
a HZ/8 (~125 ms) timeout on every keydown and key-repeat report.  If a
key was pressed shortly before the device is disconnected, the timer
can fire after hid_hw_stop() has freed input_dev but before the
teardown drains it.

A simple reorder is not sufficient.  Putting the timer drain first
still leaves a window where a USB URB completion (raw_event) running
during hid_hw_stop() can call mod_timer() and re-arm the timer, which
then fires after hidinput_disconnect() has freed input_dev.  The same
URB-completion window also lets raw_event() reach key_up(), key_down()
and battery_flat() directly, all of which dereference
appleir->input_dev.

Introduce a 'removing' flag on struct appleir, gated by the existing
spinlock.  appleir_remove() sets the flag under the lock and then
shuts down the timer with timer_shutdown_sync(), which both drains any
in-flight callback and permanently disables further mod_timer() calls.
appleir_raw_event() and key_up_tick() bail out early if the flag is
set, so no path can arm or run the timer, or dereference
appleir->input_dev, after remove() has started tearing down.

The keyrepeat and flatbattery branches of appleir_raw_event()
previously called into the input layer without holding the spinlock;
take it now so the flag check is well-defined.  This incidentally
closes a pre-existing read-side race on appleir->current_key in the
keyrepeat branch.

This bug is structurally a sibling of commit 4db2af9 ("HID:
appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been
present since the driver was introduced.

Fixes: 9a4a557 ("HID: appleir: add support for Apple ir devices")
Cc: stable@vger.kernel.org
Signed-off-by: Manish Khadka <maskmemanish@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7705b41 upstream.

lg_g15_data is allocated with devm and holds a work item. The report
handlers schedule that work straight from device input.
lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,
and lg_g510_leds_event() does it too. The worker dereferences the
lg_g15_data back through container_of.

The driver had no remove callback and never cancelled the work. So if a
report scheduled the work and the keyboard was then unplugged, devres
freed lg_g15_data while the work was still pending or running, and the
worker touched freed memory. This is a use-after-free. It is reachable
as a race on device unplug.

Add a remove callback that cancels the work before devres frees the
state. g15->work is only initialized for the models that schedule it
(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the
cancel on g15->work.func to avoid cancelling a work that was never set
up. The g15 NULL test mirrors the one already in lg_g15_raw_event().

Fixes: 97b741a ("HID: lg-g15: Add keyboard and LCD backlight control")
Cc: stable@vger.kernel.org
Suggested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…te reads

commit f784fce upstream.

sensor_hub_input_attr_get_raw_value() is limited to returning a single
32-bit value, which is insufficient for sensors that report data larger
than 32 bits, such as a quaternion with four s16 elements.

Add sensor_hub_input_attr_read_values() that accepts a caller-provided
buffer and accumulates incoming data until the buffer is full. The two
paths are distinguished in sensor_hub_raw_event() by pending.max_raw_size
being non-zero, preserving backward compatibility.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Co-developed-by: Zhang Lixu <lixu.zhang@intel.com>
Signed-off-by: Zhang Lixu <lixu.zhang@intel.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d67aade upstream.

hfs_bnode_read() can return early without writing to the output buffer
when is_bnode_offset_valid() fails or when check_and_correct_requested_
length() corrects the length to zero.  Callers such as hfs_bnode_read_
u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the
result unconditionally, leading to KMSAN uninit-value reports.

Rather than initializing at each individual call site, zero the buffer
at the start of hfs_bnode_read() before any validation checks.  This
ensures all callers in both hfs and hfsplus get a deterministic zero
value regardless of which early-return path is taken.

Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Tested-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Fixes: a431930 ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260505111300.3592757-3-tristmd@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0e7a690 upstream.

Syzbot reported a hung task in nilfs_transaction_begin() where multiple
tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds
waiting to acquire ns_segctor_sem for read:

  INFO: task syz.0.17:5918 blocked for more than 143 seconds.
  Call Trace:
   schedule+0x164/0x360
   rwsem_down_read_slowpath+0x6d9/0x940
   down_read+0x99/0x2e0
   nilfs_transaction_begin+0x364/0x710 fs/nilfs2/segment.c:221
   nilfs_setattr+0x124/0x2c0 fs/nilfs2/inode.c:921
   notify_change+0xc1a/0xf40
   chmod_common+0x273/0x4a0
   do_fchmodat+0x12d/0x230

The writer holding ns_segctor_sem was a concurrent
NILFS_IOCTL_CLEAN_SEGMENTS caller, stuck inside printk while emitting
per-element warnings from nilfs_sufile_updatev():

   __nilfs_msg+0x373/0x450 fs/nilfs2/super.c:78
   nilfs_sufile_updatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186
   nilfs_sufile_freev fs/nilfs2/sufile.h:93 [inline]
   nilfs_free_segments fs/nilfs2/segment.c:1140 [inline]
   nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1261 [inline]
   nilfs_segctor_do_construct+0x1f55/0x76c0
   nilfs_clean_segments+0x3bd/0xa50
   nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline]
   nilfs_ioctl+0x261f/0x2780

The root cause is that user-supplied segment numbers are not validated
before nilfs_clean_segments() begins doing work; the range check on
each segnum is performed deep inside the call chain by
nilfs_sufile_updatev(), which emits a nilfs_warn() per invalid entry
while still holding the segctor lock and the sufile mi_sem.  Under load
(repeated invocations across multiple mounts saturating the global
printk path), the cumulative printk latency keeps ns_segctor_sem held
long enough to trip the hung_task watchdog, blocking concurrent
operations such as chmod() that need ns_segctor_sem for read.

Fix by validating the contents of kbufs[4] in nilfs_clean_segments()
immediately after acquiring ns_segctor_sem via nilfs_transaction_lock().
Holding ns_segctor_sem serializes the check against
nilfs_ioctl_resize(), which can modify ns_nsegments, so the validation
uses a consistent value.  Out-of-range segment numbers are rejected
with -EINVAL before any segment-cleaning work begins, so the bad
entries never reach the per-element diagnostic path inside
nilfs_sufile_updatev().

Reported-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=62f0f99d2f2bb8e3bbd7
Tested-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Fixes: 071cb4b ("nilfs2: eliminate removal list of segments")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…only

commit b1845a2 upstream.

Since a recent fix the mtk_jpeg_release function cancels any pending
or running work present in the driver workqueue using
cancel_work_sync function.
Currently, only the multicore based variants use this workqueue and they
have the jpeg_worker platform data field initialized with a workqueue
callback function. For the others, this field value remain NULL by
default.
The cancel_work_sync function is unconditionally called in
mtk_jpeg_release function, even for the variants that do not use the
workqueue. This call generates a WARN_ON print in __flush_work because
the workqueue callback function presence check fails in __flush_work
function (used by cancel_work_sync).

So, to avoid these warnings, call cancel_work_sync only if a workqueue
callback is defined in platform data.

Fixes: 34c519f ("media: mtk-jpeg: fix use-after-free in release path due to uncancelled work")
Cc: stable@vger.kernel.org
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b1b4efe upstream.

In accordance with Errata (specification updates)
HSUART May Stop Functioning when DMA is Active.

- Denverton document #572409, rev 3.4, DNV60
- Ice Lake Xeon D document #714070, ICXD65
- Snowridge document #731931, SNR44

For a quick fix just disable the respective callbacks during the device probe.
Depending on the future development we might remove them completely.

Reported-by: micas-opensource <zjianan156@gmail.com>
Closes: https://lore.kernel.org/linux-serial/20250625031409.2404219-1-opensource@ruijie.com.cn/
Fixes: 6ede6dc ("serial: 8250_mid: add support for DMA engine handling from UART MMIO")
Cc: stable <stable@kernel.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260626094937.561776-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit cc9af5e upstream.

xlog_do_recovery_pass() may return before setting first_bad.  The caller
must distinguish that case from an error at a valid log block, including
block zero after the log wraps.

Initialize first_bad to XFS_BUF_DADDR_NULL and test it explicitly before
treating the error as a torn write.

Fixes: 7088c41 ("xfs: detect and trim torn writes during log recovery")
Suggested-by: Darrick J. Wong <djwong@kernel.org>
Reported-by: syzbot+b7dfbed0c6c2b5e9fd34@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b7dfbed0c6c2b5e9fd34
Cc: stable@vger.kernel.org # v4.5
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0c1b3a8 upstream.

xfs_qm_dqpurge() gets a locked buffer from xfs_dquot_use_attached_buf().
If xfs_qm_dqflush() fails, the error path skips xfs_buf_relse() and then
calls xfs_dquot_detach_buf(), which tries to lock the same buffer again.

Release the buffer after xfs_qm_dqflush() returns so the error path drops
the caller hold and unlocks the buffer before the dquot is detached,
matching the other dqflush callers.

Fixes: a40fe30 ("xfs: separate dquot buffer reads from xfs_dqflush")
Cc: stable@vger.kernel.org # v6.13+
Signed-off-by: Yingjie Gao <gaoyingjie@uniontech.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 03866d1 upstream.

The dqp->q_id == 0 check inside the XFS_DQTYPE_BIGTIME block is
unreachable because root dquots return successfully earlier. Reject root
dquots with XFS_DQTYPE_BIGTIME before that early return, preserving the
intended validation and removing the unreachable condition.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4ea1ff3 ("xfs: widen ondisk quota expiration timestamps to handle y2038+")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Allison Henderson <achender@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 84eec3f upstream.

The translation of the old XFS_BMBT_KEY_ADDR macro into a static
function is not correct on 32-bit systems because the sizeof() argument
went from being a xfs_bmbt_key_t (i.e. a struct) to a (struct
xfs_bmbt_key *) (i.e. a pointer to the same struct).  On 64-bit systems
this turns out ok because they are the same size, but on 32-bit systems
this is catastrophic because they are not the same size.  So far there
have been no complaints, most likely because the xfs developers urge
against running it on 32-bit systems.  But this needs fixing asap.

Cc: stable@vger.kernel.org # v6.12
Fixes: 79124b3 ("xfs: replace shouty XFS_BM{BT,DR} macros")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
joannekoong and others added 23 commits July 18, 2026 16:53
…ULL deref

commit 1c57a69 upstream.

If a copy into the userspace ring buffer fails, a request will be
terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but
it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This
can lead to a NULL deref if the request expiration logic scans
ent_w_req_queue in the window before the entry is moved off it.

Fix this by taking the entry off ent_w_req_queue and changing its state
from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.

Fixes: 4fea593 ("fuse: optimize over-io-uring request expiration check")
Cc: stable@kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…roup

commit 82d6e01 upstream.

Load imbalance is observed when the workload frequently forks new threads.
Due to CPU affinity, the workload can run on CPU 0-7 in the first
group, and only on CPU 8-11 in the second group. CPU 12-15 are always idle.

{ 0 1 2 3 4 5 6 7 } {8 9 10 11 12 13 14 15}
  * * * * * * * *    * * *  *

When looking for dst group for newly forked threads, in many times
update_sg_wakeup_stats() reports the second group has more idle CPUs
than the first group. The scheduler thinks the second group is less
busy. Then it selects least busy CPUs among CPU 8-11. Therefore CPU 8-11
can be crowded with newly forked threads, at the same time CPU 0-7
can be idle.

A task may not use all the CPUs in a schedule group due to CPU affinity.
Only update schedule group statistics for allowed CPUs.

Signed-off-by: Adam Li <adamli@os.amperecomputing.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Erwan Velu <e.velu@criteo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…ion checks

commit 82cfd47 upstream.

When parsing endpoint descriptors, ffs_data_got_descs() generates the
eps_addrmap which contains the endpoint direction. However, epfile->in
was previously only populated in ffs_func_eps_enable() which executes
upon USB host connection. As a result, early userspace ioctls like
FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see
epfile->in as 0, leading to incorrect DMA directions.

By moving the initialization to ffs_epfiles_create(), epfile->in is
accurate before userspace opens the endpoint files.

Fixes: 7b07a2a ("usb: gadget: functionfs: Add DMABUF import interface")
Cc: stable <stable@kernel.org>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Neill Kapron <nkapron@google.com>
Link: https://patch.msgid.link/20260619040609.4010746-2-nkapron@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8fa3082 upstream.

Commit f24df84 ("time/jiffies: Register jiffies clocksource before
usage") moved the jiffies clocksource registration into
clocksource_default_clock(), so that it is registered lazily on the first
call. __clocksource_register() acquires clocksource_mutex, but the first
caller is timekeeping_init(), which invokes clocksource_default_clock()
while holding tk_core.lock, a raw spinlock.

Acquiring a sleeping mutex while holding a raw spinlock is invalid.

The default clocksource only has to be registered before
tk_setup_internals() consumes its mult/shift/maxadj. Neither
clocksource_default_clock(), the ->enable() callback, nor the registration
itself need tk_core.lock, so fetch and enable the clock before acquiring
the lock. This preserves the "register before usage" ordering while
keeping clocksource_mutex out of the raw spinlock section.

clocksource_default_clock() has a second caller,
clocksource_done_booting(), which invokes it with clocksource_mutex already
held. That path avoids a recursive lock because timekeeping_init() has
already run and set cs_jiffies_registered, so the registration is skipped
there. This change does not alter that; it only fixes the invalid wait
context in timekeeping_init().

Fixes: f24df84 ("time/jiffies: Register jiffies clocksource before usage")
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reported-by: Breno Leitao <leitao@debian.org>
Reported-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616070914.65818-1-mikhail.v.gavrilov@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…etdev

commit d38eaf6 upstream.

b66774b ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding
conn ref") don't reset the chan->conn to NULL anymore making the bt#
netdev not be remove once the last l2cap_chan_del is removed.

Instead of restoring the original behavior this remove the logic of
keeping the interface after the last channel is removed because it
never worked as intended and the l2cap_chan_del always detach its
l2cap_conn which results in always removing the channel anyway.

Fixes: b66774b ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…ata_block"

commit ccaba78 upstream.

This reverts commit 9609dd7.

The kernel panics are keeping to be reported especially when the f2fs
partition get almost full. By investigation, we find that the reason is
one f2fs page got freed to buddy without being deleted from LRU and the
root cause is the race happened in [2] which is enrolled by this commit.

There are 3 race processes in this scenario, please find below for their
main activities.

The changed code in move_data_block() lets the GC path evict the tail-end
folio from the page cache through folio_end_dropbehind().  Once
folio_unmap_invalidate() removes the folio from mapping->i_pages, the
page-cache references for all pages in the folio are dropped.  The folio
is then kept alive only by temporary external references, which allows a
later split to operate on a folio whose subpages are no longer protected
by page-cache references.

After the page-cache references are gone, split_folio_to_order() can
split the big folio into individual pages and put the resulting subpages
back on the LRU.  For tail pages beyond EOF, split removes them from the
page cache and drops their page-cache references.  A tail page can then
remain on the LRU with PG_lru set while holding only the split caller's
temporary reference.  When free_folio_and_swap_cache() drops that final
reference, the page enters the final folio_put() release path.

In parallel, folio_isolate_lru() can observe the same tail page with a
non-zero refcount and PG_lru set.  It clears PG_lru before taking its own
reference.  If this races with the final folio_put() from the split path,
__folio_put() sees PG_lru already cleared and skips lruvec_del_folio().
The page is then freed back to the allocator while its lru links are
still present in the LRU list.  A later LRU operation on a neighboring
page detects the stale link and reports list corruption.

[1]
[   22.486082] list_del corruption. next->prev should be fffffffec10e0ac8, but was dead000000000122. (next=fffffffec10e0a88)
[   22.486130] ------------[ cut here ]------------
[   22.486134] kernel BUG at lib/list_debug.c:67!
[   22.486141] Internal error: Oops - BUG: 00000000f2000800 [qualcomm-linux#1]  SMP
[   22.488502] Tainted: [W]=WARN, [O]=OOT_MODULE
[   22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT)
[   22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154
[   22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154
[   22.488539] sp : ffffffc08006b830
[   22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000
[   22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0
[   22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122
[   22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060
[   22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058
[   22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003
[   22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00
[   22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c
[   22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010
[   22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d
[   22.488647] Call trace:
[   22.488651]  __list_del_entry_valid_or_report+0x14c/0x154 (P)
[   22.488661]  __folio_put+0x2bc/0x434
[   22.488670]  folio_put+0x28/0x58
[   22.488678]  do_garbage_collect+0x1a34/0x2584
[   22.488689]  f2fs_gc+0x230/0x9b4
[   22.488697]  f2fs_fallocate+0xb90/0xdf4
[   22.488706]  vfs_fallocate+0x1b4/0x2bc
[   22.488716]  __arm64_sys_fallocate+0x44/0x78
[   22.488725]  invoke_syscall+0x58/0xe4
[   22.488732]  do_el0_svc+0x48/0xdc
[   22.488739]  el0_svc+0x3c/0x98
[   22.488747]  el0t_64_sync_handler+0x20/0x130
[   22.488754]  el0t_64_sync+0x1c4/0x1c8

[2]
CPU0 (f2fs GC)              CPU1 (split_folio_to_order)          CPU2 (folio_isolate_lru)

F: pagecache refs = n
F: extra refs = GC + split
F: PG_lru set
move_data_block()
folio = f2fs_grab_cache_folio(F)
...
__folio_set_dropbehind(F)
folio_unlock(F)
folio_end_dropbehind(F)
  folio_unmap_invalidate(F)
    __filemap_remove_folio(F)
    folio_put_refs(F, n)
folio_put(F)
                            split_folio_to_order(F)
                              folio_ref_freeze(F, 1)
                              ...
                              lru_add_split_folio(T)
                                list_add_tail(&T->lru, &F->lru)
                                folio_set_lru(T)
                              __filemap_remove_folio(T)
                              folio_put_refs(T, 1)
                              /* T refcount == 1, PageLRU set */
                                                                  folio_isolate_lru(T)
                                                                    folio_test_clear_lru(T)
                            free_folio_and_swap_cache(T)
                              folio_put(T)
                                /* refcount: 1 -> 0 */
                                __folio_put(T)
                                  __page_cache_release(T)
                                    folio_test_lru(T) == false
                                    /* skip lruvec_del_folio(T) */
                                  free_frozen_pages(T)
                                                                  folio_get(T)
                                                                  lruvec_del_folio(T)
later:
  list_del(adjacent->lru)
    next == &T->lru
    next->prev == LIST_POISON / PCP freelist
    BUG

Cc: stable@vger.kernel.org
Fixes: 9609dd7 ("f2fs: remove non-uptodate folio from the page cache in move_data_block")
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8986c93 upstream.

Commit 53b7c27 ("smb: client: restrict implied bcc[0] exemption to
responses without data area") restricted the implied bcc[0] length
exception to responses without a data area. However, the overlap
handling in __smb2_calc_size() clears data_length, which can make an
invalid response appear to have no data area and so qualify for the
exception.

Track data area overlap separately and reject such responses before
applying the length compatibility exceptions.

Fixes: 53b7c27 ("smb: client: restrict implied bcc[0] exemption to responses without data area")
Cc: stable@vger.kernel.org
Signed-off-by: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9202ee5 upstream.

If dfp is not NULL we exit early here, when dfp is NULL it's allocated
in xfs_defer_alloc() but not assigned. The tracepoint tries to
dereference members of dfp struct.

Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Cc: stable@vger.kernel.org # v6.8
Fixes: 3f3cec0 ("xfs: force small EFIs for reaping btree extents")
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2094dab upstream.

If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.

The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log.  It came from an AI-assisted code audit of the
recovery parser.

xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf.  Reject it there, before the commit handlers that also read
ri_buf[0].

 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
  xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
  xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
  xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
  xlog_recover (fs/xfs/xfs_log_recover.c:3493)
  xfs_log_mount (fs/xfs/xfs_log.c:618)
  xfs_mountfs (fs/xfs/xfs_mount.c:1034)
  xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
  vfs_get_tree (fs/super.c:1695)
  path_mount (fs/namespace.c:4161)
  __x64_sys_mount (fs/namespace.c:4367)

Fixes: 89cebc8 ("xfs: validate transaction header length on log recovery")
Cc: stable@vger.kernel.org # v4.3
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2f4acd0 upstream.

xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
a data fork mapping, and a cow fork mapping.  Unfortunately, these two
helpers cycle the ILOCK to grab a transaction, which means that the
mappings are stale as soon as we reacquire the ILOCK.  Currently we
refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but
we don't refresh the data fork mapping beforehand, which means that the
xfs_bmap_trim_cow in that function queries the refcount btree about the
wrong physical blocks and returns an inaccurate value in *shared.

If *shared is now false, the directio write proceeds with a stale data
fork mapping.  Fix this by querying the data fork mapping if the
sequence counter changes across the ILOCK cycle.

Cc: hch@lst.de
Cc: stable@vger.kernel.org # v4.11
Fixes: 3c68d44 ("xfs: allocate direct I/O COW blocks in iomap_begin")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d766e4e upstream.

LOLLM noticed that q_id is an unsigned 32-bit variable.  If it happens
to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot
for ID_MAX, then this addition will truncate to zero and the iteration
starts over.  Fix this by casting to u64.

Cc: stable@vger.kernel.org # v6.8
Fixes: 21d7500 ("xfs: improve dquot iteration for scrub")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ea6e2d9 upstream.

LOLLM noticed that we aren't grabbing the rtrmap btree when we check the
realtime group superblock.  As a result, none of the cross-referencing
checks have ever run.  Fix this.

Cc: stable@vger.kernel.org # v6.14
Fixes: 428e488 ("xfs: allow queued realtime intents to drain before scrubbing")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 881f2eb upstream.

LOLLM also noticed that xchk_rtrmapbt_xref ought to be using the rtdev
version of the "is this a cow extent?" helper function, not the datadev
one.

Cc: stable@vger.kernel.org # v6.14
Fixes: 91683bb ("xfs: cross-reference checks with the rt refcount btree")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 540ddc6 upstream.

LOLLM noticed that we *disable* interruptible sorts when the KILLABLE
flag is set.  This is backwards.  Fix the incorrect logic, and rename
the variable to make the connection more obvious.

Cc: stable@vger.kernel.org # v6.10
Fixes: 271557d ("xfs: reduce the rate of cond_resched calls inside scrub")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 353a590 upstream.

LOLLM noticed that two helper functions in the rtrmapbt scrub code don't
actually handle non-inode owners correctly -- CoW staging extents and
rgsuperblock extents are not shareable, but they are mergeable.  Fix
these two helpers.

Cc: stable@vger.kernel.org # v6.14
Fixes: 2d9a3e9 ("xfs: allow overlapping rtrmapbt records for shared data extents")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 15e38a9 upstream.

LOLLM noticed an off-by-one error in the nsec clamping; fix that so that
we never have tv_nsec == 1e9.

Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe ("xfs: repair inode records")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ba150ce upstream.

LOLLM noticed that the directory tree path checking declares the path to
be ok if the inumber in the parent pointer reaches the root directory.
Unfortunately, it neglects to check that the generation is correct.  Fix
that by moving the generation check up.

Cc: stable@vger.kernel.org # v6.10
Fixes: 928b721 ("xfs: teach online scrub to find directory tree structure problems")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 59c462b upstream.

LOLLM noticed a discrepancy between the bmbt level checks in the libxfs
bmbt code vs. the inode repair code.  We do actually allow a bmbt root
that proclaims to have a height of XFS_BM_MAXLEVELS.

Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef ("xfs: zap broken inode forks")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5d72a68 upstream.

LOLLM noticed an off-by-one error when computing the length of the
rtrmap to cross-check.

Cc: stable@vger.kernel.org # v6.14
Fixes: 037a44d ("xfs: cross-reference the realtime rmapbt")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9af789f upstream.

The rtgroup superblock fixer should write the rtgroup superblock.
LOLLM noticed this, oops. :/

Cc: stable@vger.kernel.org # v6.13
Fixes: 1433f8f ("xfs: repair realtime group superblock")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ee24815 upstream.

LOLLM points out that we pass the wrong btree cursor here.  We want the
rtrefcount btree cursor, not the non-rt one.  This is fairly benign
since it only affects tracing data.

Cc: stable@vger.kernel.org # v6.14
Fixes: 91683bb ("xfs: cross-reference checks with the rt refcount btree")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20260716133044.672218725@linuxfoundation.org
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Wentao Guan <guanwentao@uniontech.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
Link: https://lore.kernel.org/r/20260717101904.922623678@linuxfoundation.org
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Tested-by: Mark Brown <broonie@kernel.org>
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  Linux 6.18.39
  xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
  xfs: write the rg superblock when fixing it
  xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
  xfs: don't zap bmbt forks if they are MAXLEVELS tall
  xfs: fully check the parent handle when it points to the rootdir
  xfs: clamp timestamp nanoseconds correctly
  xfs: handle non-inode owners for rtrmap record checking
  xfs: set xfarray killable sort correctly
  xfs: use the rt version of the cow staging checker
  xfs: grab rtrmap btree when checking rgsuper
  xfs: don't wrap around quota ids in dqiterate
  xfs: resample the data fork mapping after cycling ILOCK
  xfs: fail recovery on a committed log item with no regions
  xfs: fix null pointer dereference in tracepoint
  smb: client: reject overlapping data areas in SMB2 responses
  Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
  Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
  timekeeping: Register default clocksource before taking tk_core.lock
  usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
  sched/fair: Only update stats for allowed CPUs when looking for dst group
  fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
  fuse-uring: make a fuse_req on SQE commit only findable after memcpy
  fuse-uring: Avoid queue->stopped races and set/read that value under lock
  fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
  fuse-uring: end fuse_req on io-uring cancel task work
  fuse-uring: fix moving cancelled entry to ent_in_userspace list
  fuse-uring: fix data races on ring->ready
  fuse-uring: fix EFAULT clobber in fuse_uring_commit
  fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
  fuse: fix io-uring background queue dispatch on request completion
  fuse: re-lock request before returning from fuse_ref_folio()
  fuse: fix device node leak in cuse_process_init_reply()
  fuse: avoid 32-bit prune notification count wrap
  fuse: back uncached readdir buffers with pages
  RDMA/siw: bound Read Response placement to the RREAD length
  RDMA/core: Fix broadcast address falsely detected as local
  RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
  Input: maplecontrol - set driver data before registering input device
  Input: maplemouse - set driver data before registering input device
  Input: maple_keyb - set driver data before registering input device
  Input: mms114 - fix multi-touch slot corruption
  Input: maplemouse - fix NULL pointer dereference in open()
  Input: gscps2 - advance receive buffer write index
  Input: mms114 - reject an oversized device packet size
  Input: touchwin - reset the packet index on every complete packet
  Input: ads7846 - don't use scratch for tx_buf when clearing register
  Input: mms114 - fix touch indexing for MMS134S and MMS136
  Input: iforce - bound the device-reported force-feedback effect index
  Input: goodix - clamp the device-reported contact count
  Input: elan_i2c - prevent division by zero and arithmetic underflow
  Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
  Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
  Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
  i2c: i801: fix hardware state machine corruption in error path
  i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
  i2c: stm32f7: truncate clock period instead of rounding it
  i2c: davinci: Unregister cpufreq notifier on probe failure
  i2c: mpc: Fix timeout calculations
  i2c: core: fix adapter deregistration race
  i2c: core: fix adapter debugfs creation
  i2c: core: fix adapter probe deferral loop
  i2c: core: fix NULL-deref on adapter registration failure
  i2c: core: fix irq domain leak on adapter registration failure
  fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
  dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
  udmabuf: fix DMA direction mismatch in release_udmabuf()
  KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
  KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
  KVM: VMX: Handle bad values on proxied writes to LBR MSRs
  KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
  KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
  KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
  KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
  KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
  LoongArch: KVM: Add missing slots_lock for device register/unregister
  KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
  selftests/landlock: Filter dealloc records in audit_count_records()
  landlock: Set audit_net.sk for socket access checks
  audit: fix removal of dangling executable rules
  iommufd: Set upper bounds on cache invalidation entry_num and entry_len
  iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
  iommufd: Break the loop on failure in iommufd_fault_fops_read()
  iommufd: Reject invalid read count in iommufd_fault_fops_read()
  iommufd: Reject invalid read count in iommufd_veventq_fops_read()
  iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
  iommufd: Set veventq_depth upper bound
  iommufd: Fix data_len byte-count vs element-count mismatch
  iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
  iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
  iommu/vt-d: Avoid WARNING in sva unbind path
  crypto: loongson - Remove broken and unused loongson-rng
  selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
  mm: do file ownership checks with the proper mount idmap
  mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
  selftests: mm: fix and speedup "droppable" test
  mm: fix mmap errno value when MAP_DROPPABLE is not supported
  riscv: mm: Unconditionally sfence.vma for spurious fault
  riscv: mm: Define DIRECT_MAP_PHYSMEM_END
  NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
  exfat: bound uniname advance in exfat_find_dir_entry()
  module: decompress: check return value of module_extend_max_pages()
  rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
  NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
  audit: fix potential integer overflow in audit_log_n_hex()
  tracing: Prevent out-of-bounds read in glob matching
  perf/aux: Fix page UAF in map_range()
  i2c: core: fix hang on adapter registration failure
  regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
  watchdog: apple: Add "apple,t8103-wdt" compatible
  EDAC/i10nm: Don't fail probing if ADXL is missing
  x86/mm: Fix freeing of PMD-sized vmemmap pages
  spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
  spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
  arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
  crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
  crypto: talitos/hash - remove useless wrapper
  crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
  crypto: talitos/hash - drop workqueue mechanism for SEC1
  crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
  crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
  crypto: talitos - move code in current_desc_hdr() into a standalone function
  crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
  crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
  crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
  crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
  crypto: qat - factor out AER reset helpers
  crypto: qat - validate RSA CRT component lengths
  crypto: qat - skip restart for down devices
  crypto: qat - protect service table iterations with service_lock
  crypto: qat - notify fatal error before AER reset preparation
  crypto: qat - keep VFs enabled during reset
  crypto: qat - handle sysfs-triggered reset callbacks
  crypto: qat - centralize bus master enable
  crypto: drbg - Fix the fips_enabled priority boost
  crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
  crypto: drbg - Fix returning success on failure in CTR_DRBG
  crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
  crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
  crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
  crypto: ccp - Do not initialize SNP for SEV ioctls
  crypto: loongson - Select CRYPTO_RNG
  crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
  crypto: pcrypt - restore callback for non-parallel fallback
  crypto: hisi-trng - Remove crypto_rng interface
  crypto: ecc - Fix carry overflow in vli multiplication
  crypto: crypto4xx - Remove insecure and unused rng_alg
  crypto: chacha20poly1305 - validate poly1305 template argument
  crypto: caam - use print_hex_dump_devel to guard key hex dumps again
  crypto: caam - use print_hex_dump_devel to guard key hex dumps
  crypto: af_alg - Remove zero-copy support from skcipher and aead
  isofs: bound Rock Ridge symlink components to the SL record
  partitions: aix: bound the pp_count scan to the ppe array
  btrfs: do not trim a device which is not writeable
  btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
  nvmet-auth: validate reply message payload bounds against transfer length
  nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
  nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
  dm-ioctl: report an error if a device has no table
  block: partitions: fix of_node refcount leak in of_partition()
  nvme: target: rdma: fix ndev refcount leak on queue connect
  crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
  hwrng: jh7110 - fix refcount leak in starfive_trng_read()
  udf: validate sparing table length as an entry count, not a byte count
  udf: validate VAT header length against the VAT inode size
  udf: validate free block extents against the partition length
  bpf: Prefer dirty packs for eBPF allocations
  bpf: Prefer packs that won't trigger an IBPB flush on allocation
  bpf: Skip redundant IBPB in pack allocator
  bpf: Restrict JIT predictor flush to cBPF
  x86/bugs: Enable IBPB flush on BPF JIT allocation
  bpf: Support for hardening against JIT spraying
  rust_binder: fix BINDER_GET_EXTENDED_ERROR
  rust_binder: introduce TransactionInfo
  x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
  mm: shmem: fix potential livelock issue for shmem direct swapin
  block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
  usb: gadget: f_fs: Fix DMA fence leak
  usb: typec: ucsi: cancel pending work on system suspend
  usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
  usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
  usb: typec: ucsi: Invert DisplayPort role assignment
  usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
  usb: typec: tcpm: Fix VDM type for Enter Mode commands
  usb: typec: class: drop PD lookup reference
  usb: typec: anx7411: use devm_pm_runtime_enable()
  usbip: vudc: fix NULL deref in vep_dequeue()
  usbip: tools: support SuperSpeedPlus devices
  USB: usb-storage: ene_ub6250: restore media-ready check
  USB: ulpi: fix memory leak on registration failure
  USB: serial: digi_acceleport: fix write buffer corruption
  USB: serial: digi_acceleport: fix hard lockup on disconnect
  USB: serial: digi_acceleport: fix broken rx after throttle
  USB: serial: option: add Telit Cinterion FE990D50 compositions
  USB: serial: keyspan_pda: fix information leak
  usb: mtu3: unmap request DMA on queue failure
  USB: misc: uss720: unregister parport on probe failure
  usb: misc: usbio: bound bulk IN response length to the received transfer
  USB: storage: include US_FL_NO_SAME in quirks mask
  usb: sl811-hcd: disable controller wakeup on remove
  USB: legousbtower: fix use-after-free on disconnect race
  USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
  USB: iowarrior: fix use-after-free on disconnect
  USB: ldusb: fix use-after-free on disconnect race
  USB: idmouse: fix use-after-free on disconnect race
  usb: gadget: f_printer: take kref only for successful open
  usb: gadget: udc: Fix use-after-free in gadget_match_driver
  usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
  usb: free iso schedules on failed submit
  usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
  USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
  usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
  usb: cdc_acm: Add quirk for Uniden BC125AT scanner
  net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
  bpf: Validate BTF repeated field counts before expansion
  bpf: Restore sysctl new-value from 1 to 0
  bpf: Reject fragmented frames in devmap
  xfs: fix memory leak in xfs_dqinode_metadir_create()
  xfs: fix exchmaps reservation limit check
  xfs: fix pointer arithmetic error on 32-bit systems
  xfs: fix unreachable BIGTIME check in dquot flush validation
  xfs: release dquot buffer after dqflush failure
  xfs: use null daddr for unset first bad log block
  serial: 8250_mid: Disable DMA for selected platforms
  media: mtk-jpeg: cancel workqueue on release for supported platforms only
  nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
  hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
  HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
  HID: lg-g15: cancel pending work on remove to fix a use-after-free
  HID: appleir: fix UAF on pending key_up_timer in remove()
  HID: multitouch: fix out-of-bounds bit access on mt_io_flags
  HID: letsketch: fix UAF on inrange_timer at driver unbind
  HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
  HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
  HID: pidff: Use correct effect type in effect update
  HID: wacom: stop hardware after post-start probe failures
  HID: uhid: convert to hid_safe_input_report()
  HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
  tools/mm/slabinfo: fix total_objects attribute name
  tools/mm/slabinfo: Fix trace disable logic inversion
  mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
  X.509: Fix validation of ASN.1 certificate header
  perf/arm-cmn: Fix DVM node events
  s390: Revert support for DCACHE_WORD_ACCESS
  clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
  time/jiffies: Register jiffies clocksource before usage
  posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
  cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
  cpufreq: Fix hotplug-suspend race during reboot
  sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
  cpufreq: intel_pstate: Sync policy->cur during CPU offline
  perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
  libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
  firmware_loader: fix device reference leak in firmware_upload_register()
  cpufreq: qcom-cpufreq-hw: Fix possible double free
  OPP: of: Fix potential memory leak in opp_parse_supplies()
  writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
  smb: client: mask server-provided mode to 07777 in modefromsid
  smb: client: fix atime clamp check in read completion
  smb: client: harden POSIX SID length parsing
  smb: client: use unaligned reads in parse_posix_ctxt()
  smb: client: Fix next buffer leak in receive_encrypted_standard()
  smb: client: fix double-free in SMB2_close() replay
  smb: client: fix double-free in SMB2_open() replay
  smb: client: fix double-free in SMB2_flush() replay
  smb: client: fix change notify replay double-free
  smb: client: fix double-free in SMB2_ioctl() replay
  smb: client: fix query_info() replay double-free
  smb: client: fix query directory replay double-free
  ksmbd: use opener credentials for ADS I/O
  ksmbd: use opener credentials for delete-on-close
  ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
  ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
  ksmbd: run set info with opener credentials
  ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
  ksmbd: require source read access for duplicate extents
  ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
  ksmbd: serialize QUERY_DIRECTORY requests per file
  ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
  ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
  smb/client: Fix error code in smb2_aead_req_alloc()
  smb: client: resolve SWN tcon from live registrations
  coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
  fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
  fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
  fs/ntfs3: fsync files by syncing parent inodes
  fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
  iommu/vt-d: Fix race condition during PASID entry replacement
  Bluetooth: L2CAP: validate option length before reading conf opt value
  Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
  Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
  Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
  Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
  Bluetooth: fix UAF in bt_accept_dequeue()
  Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
  Bluetooth: bnep: pin L2CAP connection during netdev registration
  Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
  netfilter: flowtable: fix offloaded ct timeout never being extended
  netfilter: ebtables: terminate table name before find_table_lock()
  netfilter: ebtables: module names must be null-terminated
  netfilter: ebtables: zero chainstack array
  netfilter: handle unreadable frags
  netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
  mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
  mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
  mm: shrinker: fix NULL pointer dereference in debugfs
  mm: shrinker: fix shrinker_info teardown race with expansion
  mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
  mfd: cros_ec: Delay dev_set_drvdata() until probe success
  net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
  ipv4: igmp: remove multicast group from hash table on device destruction
  netpoll: fix a use-after-free on shutdown path
  io_uring/rw: preserve partial result for iopoll
  io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
  io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
  gpio: sch: use raw_spinlock_t in the irq startup path
  gpio: eic-sprd: use raw_spinlock_t in the irq startup path
  NTB: epf: Avoid calling pci_irq_vector() from hardirq context
  fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
  debugobjects: Plug race against a concurrent OOM disable
  coresight: etb10: restore atomic_t for shared reading state
  Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
  Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
  audit: Fix data races of skb_queue_len() readers on audit_queue
  net: af_key: initialize alg_key_len for IPComp states
  ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
  crypto: krb5 - filter out async aead implementations at alloc
  crypto: amlogic - avoid double cleanup in meson_crypto_probe()
  staging: rtl8723bs: fix OOB write in HT_caps_handler()
  staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
  staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
  staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
  staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
  staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
  staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
  staging: media: ipu7: fix double-free and use-after-free in error paths
  staging: media: atomisp: reduce load_primary_binaries() stack usage
  media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
  staging: vme_user: fix location monitor leak in tsi148 bridge
  staging: vme_user: fix location monitor leak in fake bridge
  smb: client: restrict implied bcc[0] exemption to responses without data area
  staging: vme_user: bound slave read/write to the kern_buf size
  tipc: fix out-of-bounds read in broadcast Gap ACK blocks
  6lowpan: fix NHC entry use-after-free on error path
  usb: misc: usbio: fix disconnect UAF in client teardown
  usb: dwc3: run gadget disconnect from sleepable suspend context
  USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
  hwrng: virtio: clamp device-reported used.len at copy_data()
  virtio-mmio: fix device release warning on module unload
  virtio_pci: fix vq info pointer lookup via wrong index
  netfilter: ipset: fix race between dump and ip_set_list resize
  mm/damon/ops-common: handle extreme intervals in damon_hot_score()
  tcp: restore RCU grace period in tcp_ao_destroy_sock
  PCI/IOV: Skip VF Resizable BAR restore on read error
  PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
  PCI: mediatek: Fix IRQ domain leak when port fails to enable
  PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
  PCI: host-common: Request bus reassignment when not probe-only
  PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
  PCI: altera: Fix resource leaks on probe failure
  PCI: altera: Do not dispose parent IRQ mapping
  PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
  usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
  xhci: sideband: fix ring sg table pages leak
  usb: xhci: Fix sleep in atomic context in xhci_free_streams()
  rust_binder: clear freeze listener on node removal
  rust_binder: synchronize Rust Binder stats with freeze commands
  rust_binder: reject context manager self-transaction
  rust_binder: use a u64 stride when cleaning up the offsets array
  binder: fix UAF in binder_free_transaction()
  binder: fix UAF in binder_thread_release()
  Bluetooth: btusb: fix wakeup source leak on probe failure
  Bluetooth: btusb: fix use-after-free on marvell probe failure
  Bluetooth: btusb: fix use-after-free on registration failure
  Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
  vfio: Remove device debugfs before releasing devres
  vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
  vfio/pci: Fix racy bitfields and tighten struct layout
  vfio/pci: Release the VGA arbiter client on register_device() failure
  vfio/pci: Latch disable_idle_d3 per device
  vfio/pci: Use a private flag to prevent power state change with VFs
  ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
  ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
  ALSA: usb-audio: Roll back quirk control caches on write errors
  ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
  ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
  ALSA: usb-audio: avoid kobject path lookup in DualSense match
  ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
  ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
  ALSA: ice1712: check snd_ctl_new1() return value
  ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
  ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
  ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
  ALSA: hda/cs35l41: Fix firmware load work teardown
  ALSA: gus: check snd_ctl_new1() return value
  ALSA: firewire: isight: bound the sample count to the packet payload
  ALSA: FCP: Add Focusrite ISA C8X support
  ALSA: es1938: check snd_ctl_new1() return value
  ALSA: compress: Fix task creation error unwind
  ALSA: cmipci: check snd_ctl_new1() return value
  ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
  ALSA: aoa: check snd_ctl_new1() return value
  ALSA: ymfpci: check snd_ctl_new1() return value
  ALSA: virtio: Validate control metadata from the device
  ALSA: virtio: Add missing 384 kHz PCM rate mapping
  ALSA: usx2y: us144mkii: fix work UAF on disconnect
  iio: temperature: tmp006: use devm_iio_trigger_register
  iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
  iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
  iio: temperature: Build mlx90635 with CONFIG_MLX90635
  iio: resolver: ad2s1210: notify trigger and clear state on fault read error
  iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
  iio: pressure: mpl115: fix runtime PM leak on read error
  iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
  iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
  iio: light: veml6030: fix channel type when pushing events
  iio: light: tsl2591: return actual error from probe IRQ failure
  iio: light: opt3001: fix missing state reset on timeout
  iio: light: gp2ap002: fix runtime PM leak on read error
  iio: light: al3320a: read both ALS ADC registers again
  iio: light: al3320a: add missing REGMAP_I2C to Kconfig
  iio: light: al3010: read both ALS ADC registers again
  iio: light: al3010: fix incorrect scale for the highest gain range
  iio: light: al3010: add missing REGMAP_I2C to Kconfig
  iio: light: al3000a: add missing REGMAP_I2C to Kconfig
  iio: imu: st_lsm6dsx: deselect shub page before reading whoami
  iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
  iio: imu: inv_icm42600: fix timestamp clock period by using lower value
  iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
  iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
  iio: gyro: bmg160: wait full startup time after mode change at probe
  iio: gyro: bmg160: bail out when bandwidth/filter is not in table
  iio: event: Fix event FIFO reset race
  iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
  iio: core: fix uninitialized data in debugfs
  iio: common: st_sensors: honour channel endianness in read_axis_data
  iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
  iio: backend: fix uninitialized data in debugfs
  iio: adc: ti-ads124s08: Return reset GPIO lookup errors
  iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
  iio: adc: spear: Initialize completion before requesting IRQ
  iio: adc: lpc32xx: Initialize completion before requesting IRQ
  iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
  iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
  iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
  iio: adc: ad7768-1: Select GPIOLIB
  iio: adc: ad7380: select REGMAP
  iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
  iio: accel: bmc150: clamp the device-reported FIFO frame count
  usb: gadget: function: rndis: add length check for header
  usb: gadget: function: rndis: add length check to response query
  fscrypt: Replace mk_users keyring with simple list
  fscrypt: Fix key setup in edge case with multiple data unit sizes
  rust: kasan: KASAN+RUST requires clang
  perf/core: Detach event groups during remove_on_exec
  futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
  rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
  rust: doctest: fix incorrect pattern in replacement
  rust: block: fix GenDisk cleanup paths
  rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
  LoongArch: Add PIO for early access before ACPI PCI root register
  platform/x86: intel-hid: Protect ACPI notify handler against recursion
  ACPI: NFIT: core: Fix possible NULL pointer dereference
  ACPI: CPPC: Suppress UBSAN warning caused by field misuse
  KVM: x86: Unconditionally recompute CR8 intercept on PPR update
  KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
  KVM: x86: Move update_cr8_intercept() to lapic.c
  perf trace beauty fcntl: Fix build with older kernel headers
  slab: recognize @gfp parameter as optional in kernel-doc
  default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
  add default_gfp() helper macro and use it in the new *alloc_obj() helpers
  slab: Introduce kmalloc_flex() and family
  mm/khugepaged: write all dirty file folios when collapsing
  nfsd: change nfs4_client_to_reclaim() to allocate data
  nfsd: move name lookup out of nfsd4_list_rec_dir()
  net/sched: dualpi2: fix GSO backlog accounting
  fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
  f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
  f2fs: detect more inconsistent cases in sanity_check_node_footer()
  f2fs: optimize trace_f2fs_write_checkpoint with enums
  f2fs: introduce f2fs_schedule_timeout()
  f2fs: use memalloc_retry_wait() as much as possible
  f2fs: fix listxattr handling of corrupted xattr entries
  f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
  f2fs: fix potential deadlock in f2fs_balance_fs()
  f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
  f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
  f2fs: remove non-uptodate folio from the page cache in move_data_block
  device property: initialize the remaining fields of fwnode_handle in fwnode_init()
  userfaultfd: gate must_wait writability check on pte_present()
  rust: str: clean unused import for Rust >= 1.98
  rust: str: use the "kernel vertical" imports style
  nfsd: release layout stid on setlease failure
  nfsd: update mtime/ctime on COPY in presence of delegated attributes
  nfsd: update mtime/ctime on CLONE in presense of delegated attributes
  bpf, arm64: Reject out-of-range B.cond targets
  Linux 6.18.38
  apparmor: advertise the tcp fast open fix is applied
  net/tcp-ao: fix use-after-free of key in del_async path
  serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
  ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
  NFS: Prevent resource leak in nfs_alloc_server()
  NFSv4: clear exception state on successful mkdir retry
  NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
  NFSv4/flexfiles: reject zero filehandle version count
  nfsd: reset write verifier on deferred writeback errors
  nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
  nfsd: check get_user() return when reading princhashlen
  nfsd: fix inverted cp_ttl check in async copy reaper
  nfsd: fix posix_acl leak on SETACL decode failure
  NFSD: Fix SECINFO_NO_NAME decode error cleanup
  i2c: core: fix adapter registration race
  fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
  fbdev: modedb: fix a possible UAF in fb_find_mode()
  fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
  riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
  riscv: mm: Extract helper mark_new_valid_map()
  power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
  KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
  KVM: x86: hyper-v: Bound the bank index when querying sparse banks
  MIPS: smp: report dying CPU to RCU in stop_this_cpu()
  9p: avoid putting oldfid in p9_client_walk() error path
  ocfs2: reject oversized group bitmap descriptors
  rpmsg: char: Fix use-after-free on probe error path
  fpga: region: fix use-after-free in child_regions_with_firmware()
  irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
  pNFS: Fix use-after-free in pnfs_update_layout()
  LoongArch: Report dying CPU to RCU in stop_this_cpu()
  tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
  blk-cgroup: fix UAF in __blkcg_rstat_flush()
  hdlc_ppp: sync per-proto timers before freeing hdlc state
  pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
  gfs2: fix use-after-free in gfs2_qd_dealloc
  crypto: nx - fix nx_crypto_ctx_exit argument
  KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
  KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
  exfat: fix potential use-after-free in exfat_find_dir_entry()
  MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
  bpf: use kvfree() for replaced sysctl write buffer
  block: Avoid mounting the bdev pseudo-filesystem in userspace
  f2fs: keep atomic write retry from zeroing original data
  f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
  f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
  f2fs: fix to round down start offset of fallocate for pin file
  f2fs: validate compress cache inode only when enabled
  f2fs: validate orphan inode entry count
  f2fs: pass correct iostat type for single node writes
  wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
  wifi: iwlwifi: mld: fix race condition in PTP removal
  wifi: iwlwifi: mvm: fix race condition in PTP removal
  wifi: rtw88: usb: fix memory leaks on USB write failures
  wifi: rtw88: increase TX report timeout to fix race condition
  wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
  wifi: ath11k: fix warning when unbinding
  wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
  wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
  userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
  keys: Pin request_key_auth payload in instantiate paths
  KEYS: fix overflow in keyctl_pkey_params_get_2()
  gcov: use atomic counter updates to fix concurrent access crashes
  err.h: use __always_inline on all error pointer helpers
  KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
  block: invalidate cached plug timestamp after task switch
  kernel/fork: clear PF_BLOCK_TS in copy_process()
  fbdev: fix use-after-free in store_modes()
  NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
  apparmor: fix use-after-free in rawdata dedup loop
  apparmor: mediate the implicit connect of TCP fast open sendmsg
  net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
  net: skmsg: preserve sg.copy across SG transforms
  mac802154: llsec: add skb_cow_data() before in-place crypto
  af_unix: Set gc_in_progress to true in unix_gc().
  wifi: mt76: add wcid publish check in mt76_sta_add
  ntfs3: reject direct userspace writes to reserved $LX* xattrs
  ipv4: account for fraggap on the paged allocation path
  ipv6: account for fraggap on the paged allocation path
  batman-adv: tvlv: avoid race of cifsnotfound handler state
  batman-adv: tvlv: enforce 2-byte alignment
  batman-adv: dat: prevent false sharing between VLANs
  batman-adv: tt: track roam count per VID
  batman-adv: tt: don't merge change entries with different VIDs
  batman-adv: tp_meter: handle overlapping packets
  batman-adv: tp_meter: prevent parallel modifications of last_recv
  batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
  batman-adv: tp_meter: restrict number of unacked list entries
  batman-adv: v: prevent OGM aggregation on disabled hardif
  batman-adv: frag: avoid underflow of TTL
  batman-adv: frag: ensure fragment is writable before modifying TTL
  batman-adv: fix (m|b)cast csum after decrementing TTL
  batman-adv: ensure bcast is writable before modifying TTL
  batman-adv: gw: don't deselect gateway with active hardif
  batman-adv: tp_meter: initialize last_recv_time during init
  batman-adv: prevent ELP transmission interval underflow
  batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
  batman-adv: tp_meter: add only finished tp_vars to lists
  batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
  batman-adv: tp_meter: fix fast recovery precondition
  batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
  batman-adv: tp_meter: avoid window underflow
  batman-adv: tp_meter: initialize dec_cwnd explicitly
  batman-adv: tp_meter: initialize dup_acks explicitly
  batman-adv: tp_meter: keep unacked list in ascending ordered
  lockd: fix TEST handling when not all permissions are available.
  Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
  selinux: fix overlayfs mmap() and mprotect() access checks
  lsm: add backing_file LSM hooks
  KVM: x86: Fix shadow paging use-after-free due to unexpected role

Signed-off-by: Naveen Kumar Siddam <nsiddam@qti.qualcomm.com>
@qswat-orbit-external

Copy link
Copy Markdown

Merge Check Failed: No CR Numbers Found

Error: No Change Request numbers were found.

Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests.

@qlijarvis

Copy link
Copy Markdown

PR #856 — validate-patch

PR: #856

Verdict Issues Detailed Report
5 Full report

Final Summary

  1. Lore link present: No — no lore.kernel.org links found; pr.patch is a raw diff without commit structure
  2. Lore link matches PR commits: N/A — no individual commits to validate; cannot verify 4088 file changes against upstream without commit boundaries
  3. Upstream patch status: N/A — this is a stable version merge (6.18.37→6.18.39) that should contain accepted stable patches, but cannot verify individual patches without proper commit structure
  4. PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence
Verdict: ❌ — click to expand

🔍 Patch Validation

PR: #856 - Stable kernel update 6.18.37 → 6.18.39
Upstream commit: N/A (stable version merge)
Verdict: ❌ FAIL

Commit Message

Check Status Note
Subject matches upstream N/A No commit message present in pr.patch
Body preserves rationale N/A No commit message present in pr.patch
Fixes tag present/correct N/A Not applicable for stable merge
Authorship preserved N/A No commit metadata in pr.patch
Backport note (if applicable) N/A Not applicable for stable merge

Diff

File Status Notes
Makefile SUBLEVEL bump 37 → 39 (stable version update)
4087 other files ⚠️ Cannot validate individual patches without commit structure

Issues

Critical: No commit structure or lore links

This PR contains a raw unified diff (4088 files changed) without:

  • Individual commit messages
  • Lore.kernel.org links for each upstream stable patch
  • Author attribution for each change
  • Signed-off-by trailers
  • Fixes tags where applicable

Expected structure for stable merges:

Stable kernel updates should be imported as a series of individual commits, each with:

  1. Original commit message from stable tree
  2. Link: tag pointing to the stable commit or lore posting
  3. Proper authorship (From: matching upstream author)
  4. All trailers preserved (Signed-off-by, Reviewed-by, Cc: stable, etc.)
  5. Prefix indicating source (e.g., UPSTREAM:, BACKPORT:, or FROMGIT:)

What this PR contains instead:

A single monolithic diff representing the delta between 6.18.37 and 6.18.39, which likely contains hundreds of individual upstream stable patches squashed together.

Verdict

Do not merge. This PR cannot be validated against lore.kernel.org sources because it lacks the required commit structure. Stable updates must be imported as individual commits to maintain:

  • Proper attribution to upstream authors
  • Traceability to upstream stable commits
  • Ability to validate each patch independently
  • Ability to revert individual changes if needed
  • Compliance with kernel development practices

Recommendation

Reject this PR and re-import the stable update correctly:

  1. Use git merge or git cherry-pick to import commits from the stable tree individually
  2. Ensure each commit retains its original message, authorship, and trailers
  3. Add appropriate prefix (UPSTREAM: or BACKPORT:) to each commit subject
  4. Add Link: tags pointing to kernel.org stable commits or lore postings
  5. Submit as a properly structured patch series

Example workflow:

# Fetch stable tree
git remote add stable https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
git fetch stable linux-6.18.y

# Cherry-pick or merge the range
git cherry-pick v6.18.37..v6.18.39
# OR
git merge v6.18.39

# Each commit will preserve original authorship and message

Final Summary

  1. Lore link present: No — no lore.kernel.org links found; pr.patch is a raw diff without commit structure
  2. Lore link matches PR commits: N/A — no individual commits to validate; cannot verify 4088 file changes against upstream without commit boundaries
  3. Upstream patch status: N/A — this is a stable version merge (6.18.37→6.18.39) that should contain accepted stable patches, but cannot verify individual patches without proper commit structure
  4. PR present in qcom-next/topics: Partial — integration_presence_report.md shows 1/1 commit with only partial evidence; however, the lack of proper commit structure makes this result unreliable

Deterministic Integration Presence

Integration Presence Report

This report is generated by Jarvis before validate-patch runs.
It is the authoritative source for whether PR changes are already present
in qcom-next or in the kernel topic branches.

Kernel repo: /local/mnt/workspace/sgaud/Qgenie/image_pipeline/kernel
qcom-next ref: 07f50dc44eddcf748a99d1a7523a466438bfffa6
topics remote: topics -> https://github.com/qualcomm-linux/kernel-topics
topics fetch: fetched

Commit Subject qcom-next topics Final
1/1 `` partial - subject or partial tree evidence found, but full change was not verified partial - subject or partial tree evidence found, but full change was not verified partial

Final Status

overall_status: PARTIAL
present_commits: 0/1
partial_commits: 1/1
missing_commits: 0/1
topics_checked_for_commits: 1/1
final_summary: PR present in qcom-next/topics: Partial - 1/1 commit(s) only have partial integration evidence

@qlijarvis

Copy link
Copy Markdown

PR #856 — checker-log-analyzer

PR: #856
Checker run: https://github.com/qualcomm-linux/kernel-config/actions/runs/29998352413

Checker Result Summary
Checker Result Summary
checkpatch ⚠️ 607 commits with minor style warnings (mostly informational)
dt-binding-check ⏭️ Skipped - no DT binding changes
dtb-check ⏭️ Skipped - no devicetree changes
sparse-check Passed
check-uapi-headers Passed
check-patch-compliance 607 commits missing required prefix
tag-check All 607 commits missing subject prefix (mandatory for qcom-6.18.y)

Detailed report: Full report

Checker analysis — click to expand

🤖 CI Checker Analysis (checker-log-analyzer)

PR: #856 - Stable kernel merge (Linux 6.18.38 → 6.18.39)
Source: https://github.com/qualcomm-linux/kernel-config/actions/runs/29998352413
Target branch: qcom-6.18.y

Checker Result Summary
checkpatch ⚠️ 607 commits with minor style warnings (mostly informational)
dt-binding-check ⏭️ Skipped - no DT binding changes
dtb-check ⏭️ Skipped - no devicetree changes
sparse-check Passed
check-uapi-headers Passed
check-patch-compliance 607 commits missing required prefix
tag-check All 607 commits missing subject prefix (mandatory for qcom-6.18.y)

❌ check-patch-compliance

Root cause: All 607 commits in this stable kernel merge lack the required subject-line prefix.

Failure details:

Checking commit: KVM: x86: Fix shadow paging use-after-free due to unexpected role
Commit summary does not start with a required prefix

Checking commit: lsm: add backing_file LSM hooks
Commit summary does not start with a required prefix

Checking commit: selinux: fix overlayfs mmap() and mprotect() access checks
Commit summary does not start with a required prefix

[... 604 more commits with the same error ...]

Fix: Add the appropriate prefix to each commit subject line. For stable kernel merges from upstream:

# For each commit, rebase and add UPSTREAM: prefix
git rebase -i <base_sha>

# For each commit marked 'edit':
git commit --amend -m "UPSTREAM: $(git log -1 --format=%s)"
git rebase --continue

Reproduce locally:

cd kernel
./scripts/check-patch-compliance.sh --base qcom-6.18.y --head <PR-branch>

❌ tag-check (mandatory for qcom-6.18.y)

Root cause: The target branch qcom-6.18.y is not qcom-next or qcom-next-staging, therefore every commit must start with a valid prefix tag.

Failure details:
All 607 commits are missing the required subject-line prefix. Examples:

  • KVM: x86: Fix shadow paging use-after-free due to unexpected role
  • lsm: add backing_file LSM hooks
  • selinux: fix overlayfs mmap() and mprotect() access checks
  • Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
  • lockd: fix TEST handling when not all permissions are available.

Required prefixes:

Prefix Use case
UPSTREAM: Patch merged into Linus's mainline tree (✅ correct for this PR)
FROMLIST: Patch posted to mailing list but not yet merged
FROMGIT: Patch taken from a maintainer git tree
BACKPORT: Upstream patch backported with modifications
QCLINUX: Vendor-only change with no upstream equivalent
PENDING: Work-in-progress, not yet posted upstream
WORKAROUND: Temporary fix not suitable for upstream

Fix:

Since this is a stable kernel merge (Linux 6.18.38 → 6.18.39), all commits are from upstream stable and should be prefixed with UPSTREAM::

git rebase -i <base_sha>

# Mark all commits as 'edit' (or use a script)
# For each commit:
git commit --amend -m "UPSTREAM: $(git log -1 --format=%s)"
git rebase --continue

Automated fix script:

#!/bin/bash
# Rebase all commits and add UPSTREAM: prefix
base_sha="<base_sha>"
commits=$(git rev-list --reverse ${base_sha}..HEAD)

git rebase -i ${base_sha} --exec '
  subject=$(git log -1 --format=%s)
  if ! echo "$subject" | grep -qE "^(UPSTREAM|FROMLIST|FROMGIT|BACKPORT|QCLINUX|PENDING|WORKAROUND):"; then
    git commit --amend -m "UPSTREAM: $subject"
  fi
'

⚠️ checkpatch (informational only)

Root cause: Upstream stable commits contain minor style warnings that are acceptable for stable merges.

Common warnings observed:

  • WARNING: Reported-by: should be immediately followed by Closes: (informational)
  • WARNING: The commit message has 'stable@', perhaps it also needs a 'Fixes:' tag? (informational)
  • WARNING: Prefer a maximum 75 chars per line (commit message formatting)
  • WARNING: From:/Signed-off-by: email address mismatch (author used different email addresses)
  • WARNING: Block comments use * on subsequent lines (code style)
  • WARNING: Duplicate signature (on Linux 6.18.39 release commit)

Assessment: These warnings are typical for upstream stable commits and do not require fixes. The stable kernel maintainers have already reviewed and accepted these commits.

Reproduce locally:

./scripts/checkpatch.pl --strict --ignore FILE_PATH_CHANGES --git 4def074fd0b5b6d0124f4afdb32dfbd5126a6e65..c861e1ffdf451e98f3d526312036c8c33b69a537

Verdict

❌ BLOCKER: 607 commits missing required subject prefix

This PR merges Linux stable kernel updates (6.18.38 → 6.18.39) into qcom-6.18.y. The target branch requires all commits to carry a subject-line prefix tag, but all 607 commits are missing this prefix.

Required action:

  1. Rebase all 607 commits to add UPSTREAM: prefix to each subject line
  2. Force-push the updated branch
  3. Re-trigger CI to verify the fix

Note: The checkpatch warnings are informational only and typical for upstream stable commits. No code changes are needed—only commit message formatting (adding the UPSTREAM: prefix).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.