Merge tag 'v6.18.39' into qcom-6.18.y#856
Conversation
commit a9029dd upstream. During system reboot, cpufreq_suspend() is called via the kernel_restart() -> device_shutdown() path. Unlike the normal system suspend path, the reboot path does not call freeze_processes(), so userspace processes and kernel threads remain active. This allows CPU hotplug operations to run concurrently with cpufreq_suspend(). The original code has no synchronization with CPU hotplug, leading to a race condition where governor_data can be freed by the hotplug path while cpufreq_suspend() is still accessing it, resulting in a null pointer dereference: Unable to handle kernel NULL pointer dereference Call Trace: do_kernel_fault+0x28/0x3c cpufreq_suspend+0xdc/0x160 device_shutdown+0x18/0x200 kernel_restart+0x40/0x80 arm64_sys_reboot+0x1b0/0x200 Fix this by adding cpus_read_lock()/cpus_read_unlock() to cpufreq_suspend() to block CPU hotplug operations while suspend is in progress. Fixes: 65650b3 ("cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown") Signed-off-by: Tianxiang Chen <nanmu@xiaomi.com> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Cc: All applicable <stable@vger.kernel.org> [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260408141914.35281-1-nanmu@xiaomi.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 266d3dd upstream. pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existing buffer to write into, the second call wrote into freed memory (use-after-free). The subsequent kfree(output.pointer) at out_free then freed the same pointer a second time (double free). Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER after freeing the first result, so ACPICA allocates a fresh buffer for each phase independently. Fixes: 0f1d683 ("[CPUFREQ] Processor Clocking Control interface driver") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Cc: All applicable <stable@vger.kernel.org> Link: https://patch.msgid.link/20260416144621.93964-1-dbgh9129@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 87bd2ad upstream. In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak. Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function. Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: WenTao Liang <vulab@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260611161738.97043-1-vulab@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f24df84 upstream. Teddy reported that a XEN HVM has a long boot delay, which was bisected to the recent enhancements to the negative motion detection. It turned out that the jiffies clocksource is used in early boot before it is registered, which leaves the max_delta_raw field at zero. That causes the read out to be clamped to the max delta of 0, which means time is not making progress. Cure it by ensuring that it is initialized before its first usage in timekeeping_init(). Fixes: 76031d9 ("clocksource: Make negative motion detection more robust") Reported-by: Teddy Astie <teddy.astie@vates.tech> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Teddy Astie <teddy.astie@vates.tech> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/87y0gn3fve.ffs@fw13 Closes: https://lore.kernel.org/all/1780914594.8631fc262581453bbf619ec5b2062170.19ea6c8227b000701b@vates.tech Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
… instances commit ca57bf4 upstream. Tegra SoCs support multiple watchdogs; currently only one (WDT0) is used. When multiple watchdogs are registered, tegra186_wdt_enable() overwrites the TKEIE(x) register, discarding any existing watchdog interrupt enable bits. As a result, enabling one watchdog inadvertently disables interrupts for the others. Fix this by preserving the existing TKEIE(x) value and updating it using a read-modify-write sequence. Fixes: 42cee19 ("clocksource: Add Tegra186 timers support") Cc: stable@vger.kernel.org Signed-off-by: Kartik Rajput <kkartik@nvidia.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260507154557.2082697-2-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 37540b8 upstream. load_unaligned_zeropad() reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions which may happen if reading from the second page results in an exception. For pages which are donated to the Ultravisor for secure execution purposes the do_secure_storage_access() exception handler however does not handle such exceptions correctly. Such an exception may result in an endless exception loop which will never be resolved. An attempt to fix this [1] turned out to be not sufficient. For now revert load_unaligned_zeropad() until this problem has been resolved in a proper way. Note that the implementation of load_unaligned_zeropad() itself is correct. The revert is just a temporary workaround until there is complete fix for secure storage access exceptions. [1] commit b00be77 ("s390/mm: Add missing secure storage access fixups for donated memory") Fixes: 802ba53 ("s390: add support for DCACHE_WORD_ACCESS") Cc: stable@vger.kernel.org Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5936245 upstream. The new DVM node events added in CMN-700 also apply to CMN S3; fix the model encoding so that we can expose the aliases and handle occupancy filtering on newer CMNs too. Cc: stable@vger.kernel.org Fixes: 0dc2f49 ("perf/arm-cmn: Support CMN S3") Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3b626ba upstream. x509_load_certificate_list() seeks to enforce that a certificate starts with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256 and less than 65535 bytes). But it only enforces that *either* of those two byte values are present, instead of checking for the *conjunction* of the two values. Fix it. Fixes: 631cc66 ("MODSIGN: Provide module signing public keys to the kernel") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/r/20260508033917.B5873C2BCB0@smtp.kernel.org/ Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: stable@vger.kernel.org # v3.7+ Reviewed-by: Ignat Korchagin <ignat@linux.win> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…abled commit 648927c upstream. When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is requested, in order to provide krealloc()'s __GFP_ZERO guarantees. But if we track the requested size, krealloc() uses that information to do the right thing, so we can zero only the requested size. With red zoning also enabled, any extra size became part of the red zone, so it must not be zeroed and thus we must zero only the requested size. However the current check is imprecise, and will trigger also when only SLAB_RED_ZONE is enabled without SLAB_STORE_USER (which enables tracking the requested size). This means enabling red zoning alone can compromise krealloc()'s __GFP_ZERO contract. Fix this by using slub_debug_orig_size() instead, which is the exact check for whether the requested size is tracked. We don't need to care if red zoning is also enabled or not. Also update and expand the comment accordingly. Fixes: 9ce6739 ("mm/slub: only zero requested size of buffer for kzalloc when debug enabled") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260610-slab_alloc_flags-v2-1-7190909db118@kernel.org Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org> Reviewed-by: Hao Li <hao.li@linux.dev> Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 235ab68 upstream. The disable trace path in slab_debug() had a logic error where it would set trace=1 instead of trace=0. This made trace functionality permanently enabled once turned on for any slab cache. Fixes: a87615b ("SLUB: slabinfo upgrade") Cc: stable@vger.kernel.org Reviewed-by: SeongJae Park <sj@kernel.org> Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn> WARNING: From:/Signed-off-by: email address mismatch: 'From: wangxuewen <18810879172@163.com>' != 'Signed-off-by: wangxuewen <wangxuewen@kylinos.cn>' Link: https://patch.msgid.link/20260518062159.80664-2-wangxuewen@kylinos.cn Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 892a786 upstream. SLUB exports the total_objects sysfs attribute, but slabinfo tries to read objects_total. As a result, the lookup fails and the field remains zero. Use the correct attribute name and rename the corresponding structure member to match. Fixes: 205ab99 ("slub: Update statistics handling for variable order slabs") Signed-off-by: Yichong Chen <chenyichong@uniontech.com> Cc: <stable@vger.kernel.org> Reviewed-by: SeongJae Park <sj@kernel.org> Link: https://patch.msgid.link/96556748872BB47E+20260612071359.649946-1-chenyichong@uniontech.com Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…rflow commit db0a076 upstream. goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set hid_ll_driver.max_buffer_size and performs no bounds checking before copying the payload: memcpy(tmp_buf + tx_len, buf, len); A hidraw SET_REPORT ioctl with a report larger than ~116 bytes overflows the stack buffer. Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity. Discovered by Atuin - Automated Vulnerability Discovery Engine. Fixes: 75e16c8 ("HID: hid-goodix: Add Goodix HID-over-SPI driver") Cc: stable@vger.kernel.org Signed-off-by: Tianchu Chen <flynnnchen@tencent.com> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 63a694c upstream. Commit 0a3fe97 ("HID: core: Mitigate potential OOB by removing bogus memset()"), added a check in hid_report_raw_event() to reject reports if the received data size is smaller than expected. This was intended to prevent OOB errors by no longer allowing zeroing-out of shorter reports due to the lack of buffer size information. However, this leads to regressions in hid_report_raw_event(), where shorter than expected reports are rejected, even though their buffers are sufficiently large to be zero-padded. To solve this issue, Benjamin introduced a safer alternative in commit 2063425 ("HID: core: introduce hid_safe_input_report()"), which forwards the buffer size and allows hid_report_raw_event() to safely zero-pad the data. Convert uhid to use hid_safe_input_report() and pass UHID_DATA_MAX as the buffer size. This prevents the reported regressions [1], allowing hid core to zero-pad the shorter reports safely as expected. Cc: stable@vger.kernel.org Fixes: 0a3fe97 ("HID: core: Mitigate potential OOB by removing bogus memset()") Closes: https://lore.kernel.org/all/ahsh0UtTX6e0ZeHa@google.com/ [1] Signed-off-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Lee Jones <lee@kernel.org> Closes: https://lore.kernel.org/all/ahsh0UtTX6e0ZeHa@google.com/ Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ec2612b upstream. wacom_parse_and_register() starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release Wacom resources without stopping the HID hardware. Route post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: c1d6708 ("HID: wacom: Do not register input devices until after hid_hw_start") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b251598 upstream. When updating an existing effect, the effect type from the last created effect was sent to the device instead of the updated one. This caused incorrect reports when a game creates multiple different effects and updates only one that is not the last created. Fixes FFB in multiple games that create multiple simultaneous effects (Forza Horizon 5/6). Fixes: 224ee88 ("Input: add force feedback driver for PID devices") Cc: stable@vger.kernel.org Tested-by: Oliver Roundtree <oroundtree1@gmail.com> Co-developed-by: Ryno Kotzé <lemon.xah@gmail.com> Signed-off-by: Ryno Kotzé <lemon.xah@gmail.com> Signed-off-by: Oleg Makarenko <oleg@makarenk.ooo> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6b3014e upstream. wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifo_skip() reads stale data left in the kmalloc'd buffer via __kfifo_peek_n() and interprets it as a record length, advancing fifo->out by that garbage value. This corrupts the internal kfifo state, causing kfifo_unused() to return a value much larger than the actual buffer size, which bypasses __kfifo_in_r()'s guard: if (len + recsize > kfifo_unused(fifo)) return 0; kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to 3842 bytes past the 256-byte buffer. Add a !kfifo_is_empty() condition to the while loop so kfifo_skip() is never called on an empty fifo, and check the return value of kfifo_in() to reject reports that are too large for the fifo. Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Fixes: 5e013ad ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit") Cc: stable@vger.kernel.org Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 55f1ad5 upstream. wacom_wac_queue_flush() is called via the .raw_event callback (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush). For USB HID devices, this callback is invoked from hid_irq_in(), which is a URB completion handler running in atomic context. Using GFP_KERNEL in this path can sleep, leading to a "scheduling while atomic" bug. Use GFP_ATOMIC instead. The existing code already handles allocation failure by skipping the fifo entry and continuing. Reported-by: Sashiko-bot <sashiko-bot@kernel.org> Fixes: 5e013ad ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 46c8bee upstream. letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event may have armed the timer before devm releases data. Fix by adding a .remove callback that calls hid_hw_stop() first. hid_hw_stop() synchronously kills the URBs that deliver raw_event(), so once it returns no path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. Apply the same timer_shutdown_sync() in the probe error path so the timer is guaranteed not to outlive data. Fixes: 33a5c27 ("HID: Add new Letsketch tablet driver") Cc: stable@vger.kernel.org Signed-off-by: Manish Khadka <maskmemanish@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8813b06 upstream. mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG. As a result, a multitouch device that advertises a large contact count makes set_bit()/clear_bit() operate past the mt_io_flags word and corrupt the adjacent members of struct mt_device. The sticky-fingers release timer is the easiest way to reach this. mt_release_contacts() runs for (i = 0; i < mt->num_slots; i++) clear_bit(i, &td->mt_io_flags); with num_slots == maxcontacts. For maxcontacts around 250 the loop clears the bits that overlap td->applications.next, zeroing that list head, and the list_for_each_entry() that immediately follows then dereferences NULL. The kernel panics from timer (softirq) context. On a KASAN build this shows up as a general protection fault in mt_release_contacts() with a null-ptr-deref at offset 0x58, which is offsetof(struct mt_application, num_received). The state is reachable from an untrusted USB or Bluetooth HID multitouch device; no local privileges are required. Store the per-slot active state in a separately allocated bitmap sized for maxcontacts, the same pattern already used for pending_palm_slots, and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two "mt_io_flags & MT_IO_SLOTS_MASK" arming checks become bitmap_empty(td->active_slots, td->maxcontacts). Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the same commit to leave the low byte for the slot bits; with the slot bits gone it fits in bit 0 again, which also keeps it within the unsigned long on 32-bit. Fixes: 46f781e ("HID: multitouch: fix sticky fingers") Cc: stable@vger.kernel.org Signed-off-by: Trung Nguyen <trungnh@cystack.net> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 75fe87e upstream. appleir_remove() runs hid_hw_stop() before timer_delete_sync(). hid_hw_stop() synchronously unregisters the HID input device via hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(), which drops the last reference and frees the underlying input_dev when no userspace handle holds it open. key_up_tick() reads appleir->input_dev and calls input_report_key() / input_sync() on it. The timer is armed from appleir_raw_event() with a HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a key was pressed shortly before the device is disconnected, the timer can fire after hid_hw_stop() has freed input_dev but before the teardown drains it. A simple reorder is not sufficient. Putting the timer drain first still leaves a window where a USB URB completion (raw_event) running during hid_hw_stop() can call mod_timer() and re-arm the timer, which then fires after hidinput_disconnect() has freed input_dev. The same URB-completion window also lets raw_event() reach key_up(), key_down() and battery_flat() directly, all of which dereference appleir->input_dev. Introduce a 'removing' flag on struct appleir, gated by the existing spinlock. appleir_remove() sets the flag under the lock and then shuts down the timer with timer_shutdown_sync(), which both drains any in-flight callback and permanently disables further mod_timer() calls. appleir_raw_event() and key_up_tick() bail out early if the flag is set, so no path can arm or run the timer, or dereference appleir->input_dev, after remove() has started tearing down. The keyrepeat and flatbattery branches of appleir_raw_event() previously called into the input layer without holding the spinlock; take it now so the flag check is well-defined. This incidentally closes a pre-existing read-side race on appleir->current_key in the keyrepeat branch. This bug is structurally a sibling of commit 4db2af9 ("HID: appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been present since the driver was introduced. Fixes: 9a4a557 ("HID: appleir: add support for Apple ir devices") Cc: stable@vger.kernel.org Signed-off-by: Manish Khadka <maskmemanish@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7705b41 upstream. lg_g15_data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key, and lg_g510_leds_event() does it too. The worker dereferences the lg_g15_data back through container_of. The driver had no remove callback and never cancelled the work. So if a report scheduled the work and the keyboard was then unplugged, devres freed lg_g15_data while the work was still pending or running, and the worker touched freed memory. This is a use-after-free. It is reachable as a race on device unplug. Add a remove callback that cancels the work before devres frees the state. g15->work is only initialized for the models that schedule it (G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the cancel on g15->work.func to avoid cancelling a work that was never set up. The g15 NULL test mirrors the one already in lg_g15_raw_event(). Fixes: 97b741a ("HID: lg-g15: Add keyboard and LCD backlight control") Cc: stable@vger.kernel.org Suggested-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…te reads commit f784fce upstream. sensor_hub_input_attr_get_raw_value() is limited to returning a single 32-bit value, which is insufficient for sensors that report data larger than 32 bits, such as a quaternion with four s16 elements. Add sensor_hub_input_attr_read_values() that accepts a caller-provided buffer and accumulates incoming data until the buffer is full. The two paths are distinguished in sensor_hub_raw_event() by pending.max_raw_size being non-zero, preserving backward compatibility. Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Co-developed-by: Zhang Lixu <lixu.zhang@intel.com> Signed-off-by: Zhang Lixu <lixu.zhang@intel.com> Acked-by: Jiri Kosina <jkosina@suse.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d67aade upstream. hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken. Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb Tested-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com Fixes: a431930 ("hfs: fix slab-out-of-bounds in hfs_bnode_read()") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Link: https://lore.kernel.org/r/20260505111300.3592757-3-tristmd@gmail.com Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0e7a690 upstream. Syzbot reported a hung task in nilfs_transaction_begin() where multiple tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds waiting to acquire ns_segctor_sem for read: INFO: task syz.0.17:5918 blocked for more than 143 seconds. Call Trace: schedule+0x164/0x360 rwsem_down_read_slowpath+0x6d9/0x940 down_read+0x99/0x2e0 nilfs_transaction_begin+0x364/0x710 fs/nilfs2/segment.c:221 nilfs_setattr+0x124/0x2c0 fs/nilfs2/inode.c:921 notify_change+0xc1a/0xf40 chmod_common+0x273/0x4a0 do_fchmodat+0x12d/0x230 The writer holding ns_segctor_sem was a concurrent NILFS_IOCTL_CLEAN_SEGMENTS caller, stuck inside printk while emitting per-element warnings from nilfs_sufile_updatev(): __nilfs_msg+0x373/0x450 fs/nilfs2/super.c:78 nilfs_sufile_updatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186 nilfs_sufile_freev fs/nilfs2/sufile.h:93 [inline] nilfs_free_segments fs/nilfs2/segment.c:1140 [inline] nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1261 [inline] nilfs_segctor_do_construct+0x1f55/0x76c0 nilfs_clean_segments+0x3bd/0xa50 nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline] nilfs_ioctl+0x261f/0x2780 The root cause is that user-supplied segment numbers are not validated before nilfs_clean_segments() begins doing work; the range check on each segnum is performed deep inside the call chain by nilfs_sufile_updatev(), which emits a nilfs_warn() per invalid entry while still holding the segctor lock and the sufile mi_sem. Under load (repeated invocations across multiple mounts saturating the global printk path), the cumulative printk latency keeps ns_segctor_sem held long enough to trip the hung_task watchdog, blocking concurrent operations such as chmod() that need ns_segctor_sem for read. Fix by validating the contents of kbufs[4] in nilfs_clean_segments() immediately after acquiring ns_segctor_sem via nilfs_transaction_lock(). Holding ns_segctor_sem serializes the check against nilfs_ioctl_resize(), which can modify ns_nsegments, so the validation uses a consistent value. Out-of-range segment numbers are rejected with -EINVAL before any segment-cleaning work begins, so the bad entries never reach the per-element diagnostic path inside nilfs_sufile_updatev(). Reported-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=62f0f99d2f2bb8e3bbd7 Tested-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Fixes: 071cb4b ("nilfs2: eliminate removal list of segments") Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…only commit b1845a2 upstream. Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_sync function. Currently, only the multicore based variants use this workqueue and they have the jpeg_worker platform data field initialized with a workqueue callback function. For the others, this field value remain NULL by default. The cancel_work_sync function is unconditionally called in mtk_jpeg_release function, even for the variants that do not use the workqueue. This call generates a WARN_ON print in __flush_work because the workqueue callback function presence check fails in __flush_work function (used by cancel_work_sync). So, to avoid these warnings, call cancel_work_sync only if a workqueue callback is defined in platform data. Fixes: 34c519f ("media: mtk-jpeg: fix use-after-free in release path due to uncancelled work") Cc: stable@vger.kernel.org Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b1b4efe upstream. In accordance with Errata (specification updates) HSUART May Stop Functioning when DMA is Active. - Denverton document #572409, rev 3.4, DNV60 - Ice Lake Xeon D document #714070, ICXD65 - Snowridge document #731931, SNR44 For a quick fix just disable the respective callbacks during the device probe. Depending on the future development we might remove them completely. Reported-by: micas-opensource <zjianan156@gmail.com> Closes: https://lore.kernel.org/linux-serial/20250625031409.2404219-1-opensource@ruijie.com.cn/ Fixes: 6ede6dc ("serial: 8250_mid: add support for DMA engine handling from UART MMIO") Cc: stable <stable@kernel.org> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260626094937.561776-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit cc9af5e upstream. xlog_do_recovery_pass() may return before setting first_bad. The caller must distinguish that case from an error at a valid log block, including block zero after the log wraps. Initialize first_bad to XFS_BUF_DADDR_NULL and test it explicitly before treating the error as a torn write. Fixes: 7088c41 ("xfs: detect and trim torn writes during log recovery") Suggested-by: Darrick J. Wong <djwong@kernel.org> Reported-by: syzbot+b7dfbed0c6c2b5e9fd34@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b7dfbed0c6c2b5e9fd34 Cc: stable@vger.kernel.org # v4.5 Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0c1b3a8 upstream. xfs_qm_dqpurge() gets a locked buffer from xfs_dquot_use_attached_buf(). If xfs_qm_dqflush() fails, the error path skips xfs_buf_relse() and then calls xfs_dquot_detach_buf(), which tries to lock the same buffer again. Release the buffer after xfs_qm_dqflush() returns so the error path drops the caller hold and unlocks the buffer before the dquot is detached, matching the other dqflush callers. Fixes: a40fe30 ("xfs: separate dquot buffer reads from xfs_dqflush") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Yingjie Gao <gaoyingjie@uniontech.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 03866d1 upstream. The dqp->q_id == 0 check inside the XFS_DQTYPE_BIGTIME block is unreachable because root dquots return successfully earlier. Reject root dquots with XFS_DQTYPE_BIGTIME before that early return, preserving the intended validation and removing the unreachable condition. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4ea1ff3 ("xfs: widen ondisk quota expiration timestamps to handle y2038+") Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Allison Henderson <achender@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 84eec3f upstream. The translation of the old XFS_BMBT_KEY_ADDR macro into a static function is not correct on 32-bit systems because the sizeof() argument went from being a xfs_bmbt_key_t (i.e. a struct) to a (struct xfs_bmbt_key *) (i.e. a pointer to the same struct). On 64-bit systems this turns out ok because they are the same size, but on 32-bit systems this is catastrophic because they are not the same size. So far there have been no complaints, most likely because the xfs developers urge against running it on 32-bit systems. But this needs fixing asap. Cc: stable@vger.kernel.org # v6.12 Fixes: 79124b3 ("xfs: replace shouty XFS_BM{BT,DR} macros") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…ULL deref commit 1c57a69 upstream. If a copy into the userspace ring buffer fails, a request will be terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This can lead to a NULL deref if the request expiration logic scans ent_w_req_queue in the window before the entry is moved off it. Fix this by taking the entry off ent_w_req_queue and changing its state from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request. Fixes: 4fea593 ("fuse: optimize over-io-uring request expiration check") Cc: stable@kernel.org Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…roup commit 82d6e01 upstream. Load imbalance is observed when the workload frequently forks new threads. Due to CPU affinity, the workload can run on CPU 0-7 in the first group, and only on CPU 8-11 in the second group. CPU 12-15 are always idle. { 0 1 2 3 4 5 6 7 } {8 9 10 11 12 13 14 15} * * * * * * * * * * * * When looking for dst group for newly forked threads, in many times update_sg_wakeup_stats() reports the second group has more idle CPUs than the first group. The scheduler thinks the second group is less busy. Then it selects least busy CPUs among CPU 8-11. Therefore CPU 8-11 can be crowded with newly forked threads, at the same time CPU 0-7 can be idle. A task may not use all the CPUs in a schedule group due to CPU affinity. Only update schedule group statistics for allowed CPUs. Signed-off-by: Adam Li <adamli@os.amperecomputing.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Erwan Velu <e.velu@criteo.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…ion checks commit 82cfd47 upstream. When parsing endpoint descriptors, ffs_data_got_descs() generates the eps_addrmap which contains the endpoint direction. However, epfile->in was previously only populated in ffs_func_eps_enable() which executes upon USB host connection. As a result, early userspace ioctls like FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see epfile->in as 0, leading to incorrect DMA directions. By moving the initialization to ffs_epfiles_create(), epfile->in is accurate before userspace opens the endpoint files. Fixes: 7b07a2a ("usb: gadget: functionfs: Add DMABUF import interface") Cc: stable <stable@kernel.org> Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Neill Kapron <nkapron@google.com> Link: https://patch.msgid.link/20260619040609.4010746-2-nkapron@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8fa3082 upstream. Commit f24df84 ("time/jiffies: Register jiffies clocksource before usage") moved the jiffies clocksource registration into clocksource_default_clock(), so that it is registered lazily on the first call. __clocksource_register() acquires clocksource_mutex, but the first caller is timekeeping_init(), which invokes clocksource_default_clock() while holding tk_core.lock, a raw spinlock. Acquiring a sleeping mutex while holding a raw spinlock is invalid. The default clocksource only has to be registered before tk_setup_internals() consumes its mult/shift/maxadj. Neither clocksource_default_clock(), the ->enable() callback, nor the registration itself need tk_core.lock, so fetch and enable the clock before acquiring the lock. This preserves the "register before usage" ordering while keeping clocksource_mutex out of the raw spinlock section. clocksource_default_clock() has a second caller, clocksource_done_booting(), which invokes it with clocksource_mutex already held. That path avoids a recursive lock because timekeeping_init() has already run and set cs_jiffies_registered, so the registration is skipped there. This change does not alter that; it only fixes the invalid wait context in timekeeping_init(). Fixes: f24df84 ("time/jiffies: Register jiffies clocksource before usage") Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reported-by: Breno Leitao <leitao@debian.org> Reported-by: Oleg Nesterov <oleg@redhat.com> Reviewed-by: Breno Leitao <leitao@debian.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260616070914.65818-1-mikhail.v.gavrilov@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…etdev commit d38eaf6 upstream. b66774b ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") don't reset the chan->conn to NULL anymore making the bt# netdev not be remove once the last l2cap_chan_del is removed. Instead of restoring the original behavior this remove the logic of keeping the interface after the last channel is removed because it never worked as intended and the l2cap_chan_del always detach its l2cap_conn which results in always removing the channel anyway. Fixes: b66774b ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
…ata_block" commit ccaba78 upstream. This reverts commit 9609dd7. The kernel panics are keeping to be reported especially when the f2fs partition get almost full. By investigation, we find that the reason is one f2fs page got freed to buddy without being deleted from LRU and the root cause is the race happened in [2] which is enrolled by this commit. There are 3 race processes in this scenario, please find below for their main activities. The changed code in move_data_block() lets the GC path evict the tail-end folio from the page cache through folio_end_dropbehind(). Once folio_unmap_invalidate() removes the folio from mapping->i_pages, the page-cache references for all pages in the folio are dropped. The folio is then kept alive only by temporary external references, which allows a later split to operate on a folio whose subpages are no longer protected by page-cache references. After the page-cache references are gone, split_folio_to_order() can split the big folio into individual pages and put the resulting subpages back on the LRU. For tail pages beyond EOF, split removes them from the page cache and drops their page-cache references. A tail page can then remain on the LRU with PG_lru set while holding only the split caller's temporary reference. When free_folio_and_swap_cache() drops that final reference, the page enters the final folio_put() release path. In parallel, folio_isolate_lru() can observe the same tail page with a non-zero refcount and PG_lru set. It clears PG_lru before taking its own reference. If this races with the final folio_put() from the split path, __folio_put() sees PG_lru already cleared and skips lruvec_del_folio(). The page is then freed back to the allocator while its lru links are still present in the LRU list. A later LRU operation on a neighboring page detects the stale link and reports list corruption. [1] [ 22.486082] list_del corruption. next->prev should be fffffffec10e0ac8, but was dead000000000122. (next=fffffffec10e0a88) [ 22.486130] ------------[ cut here ]------------ [ 22.486134] kernel BUG at lib/list_debug.c:67! [ 22.486141] Internal error: Oops - BUG: 00000000f2000800 [qualcomm-linux#1] SMP [ 22.488502] Tainted: [W]=WARN, [O]=OOT_MODULE [ 22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT) [ 22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154 [ 22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154 [ 22.488539] sp : ffffffc08006b830 [ 22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000 [ 22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0 [ 22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122 [ 22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060 [ 22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058 [ 22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003 [ 22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00 [ 22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c [ 22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010 [ 22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d [ 22.488647] Call trace: [ 22.488651] __list_del_entry_valid_or_report+0x14c/0x154 (P) [ 22.488661] __folio_put+0x2bc/0x434 [ 22.488670] folio_put+0x28/0x58 [ 22.488678] do_garbage_collect+0x1a34/0x2584 [ 22.488689] f2fs_gc+0x230/0x9b4 [ 22.488697] f2fs_fallocate+0xb90/0xdf4 [ 22.488706] vfs_fallocate+0x1b4/0x2bc [ 22.488716] __arm64_sys_fallocate+0x44/0x78 [ 22.488725] invoke_syscall+0x58/0xe4 [ 22.488732] do_el0_svc+0x48/0xdc [ 22.488739] el0_svc+0x3c/0x98 [ 22.488747] el0t_64_sync_handler+0x20/0x130 [ 22.488754] el0t_64_sync+0x1c4/0x1c8 [2] CPU0 (f2fs GC) CPU1 (split_folio_to_order) CPU2 (folio_isolate_lru) F: pagecache refs = n F: extra refs = GC + split F: PG_lru set move_data_block() folio = f2fs_grab_cache_folio(F) ... __folio_set_dropbehind(F) folio_unlock(F) folio_end_dropbehind(F) folio_unmap_invalidate(F) __filemap_remove_folio(F) folio_put_refs(F, n) folio_put(F) split_folio_to_order(F) folio_ref_freeze(F, 1) ... lru_add_split_folio(T) list_add_tail(&T->lru, &F->lru) folio_set_lru(T) __filemap_remove_folio(T) folio_put_refs(T, 1) /* T refcount == 1, PageLRU set */ folio_isolate_lru(T) folio_test_clear_lru(T) free_folio_and_swap_cache(T) folio_put(T) /* refcount: 1 -> 0 */ __folio_put(T) __page_cache_release(T) folio_test_lru(T) == false /* skip lruvec_del_folio(T) */ free_frozen_pages(T) folio_get(T) lruvec_del_folio(T) later: list_del(adjacent->lru) next == &T->lru next->prev == LIST_POISON / PCP freelist BUG Cc: stable@vger.kernel.org Fixes: 9609dd7 ("f2fs: remove non-uptodate folio from the page cache in move_data_block") Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8986c93 upstream. Commit 53b7c27 ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions. Fixes: 53b7c27 ("smb: client: restrict implied bcc[0] exemption to responses without data area") Cc: stable@vger.kernel.org Signed-off-by: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9202ee5 upstream. If dfp is not NULL we exit early here, when dfp is NULL it's allocated in xfs_defer_alloc() but not assigned. The tracepoint tries to dereference members of dfp struct. Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org> Cc: stable@vger.kernel.org # v6.8 Fixes: 3f3cec0 ("xfs: force small EFIs for reaping btree extents") Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2094dab upstream. If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and ri_buf == NULL. The header can be split across op records, so later ops may still add regions; the item is only invalid if the transaction commits with none. The runtime commit path never emits such a transaction, so this only happens on a crafted log. It came from an AI-assisted code audit of the recovery parser. xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads *(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL ri_buf. Reject it there, before the commit handlers that also read ri_buf[0]. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836) xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043) xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501) xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244) xlog_recover (fs/xfs/xfs_log_recover.c:3493) xfs_log_mount (fs/xfs/xfs_log.c:618) xfs_mountfs (fs/xfs/xfs_mount.c:1034) xfs_fs_fill_super (fs/xfs/xfs_super.c:1938) vfs_get_tree (fs/super.c:1695) path_mount (fs/namespace.c:4161) __x64_sys_mount (fs/namespace.c:4367) Fixes: 89cebc8 ("xfs: validate transaction header length on log recovery") Cc: stable@vger.kernel.org # v4.3 Reported-by: Xiang Mei <xmei5@asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2f4acd0 upstream. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle. Cc: hch@lst.de Cc: stable@vger.kernel.org # v4.11 Fixes: 3c68d44 ("xfs: allocate direct I/O COW blocks in iomap_begin") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d766e4e upstream. LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64. Cc: stable@vger.kernel.org # v6.8 Fixes: 21d7500 ("xfs: improve dquot iteration for scrub") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ea6e2d9 upstream. LOLLM noticed that we aren't grabbing the rtrmap btree when we check the realtime group superblock. As a result, none of the cross-referencing checks have ever run. Fix this. Cc: stable@vger.kernel.org # v6.14 Fixes: 428e488 ("xfs: allow queued realtime intents to drain before scrubbing") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 881f2eb upstream. LOLLM also noticed that xchk_rtrmapbt_xref ought to be using the rtdev version of the "is this a cow extent?" helper function, not the datadev one. Cc: stable@vger.kernel.org # v6.14 Fixes: 91683bb ("xfs: cross-reference checks with the rt refcount btree") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 540ddc6 upstream. LOLLM noticed that we *disable* interruptible sorts when the KILLABLE flag is set. This is backwards. Fix the incorrect logic, and rename the variable to make the connection more obvious. Cc: stable@vger.kernel.org # v6.10 Fixes: 271557d ("xfs: reduce the rate of cond_resched calls inside scrub") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 353a590 upstream. LOLLM noticed that two helper functions in the rtrmapbt scrub code don't actually handle non-inode owners correctly -- CoW staging extents and rgsuperblock extents are not shareable, but they are mergeable. Fix these two helpers. Cc: stable@vger.kernel.org # v6.14 Fixes: 2d9a3e9 ("xfs: allow overlapping rtrmapbt records for shared data extents") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 15e38a9 upstream. LOLLM noticed an off-by-one error in the nsec clamping; fix that so that we never have tv_nsec == 1e9. Cc: stable@vger.kernel.org # v6.8 Fixes: 2d295fe ("xfs: repair inode records") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ba150ce upstream. LOLLM noticed that the directory tree path checking declares the path to be ok if the inumber in the parent pointer reaches the root directory. Unfortunately, it neglects to check that the generation is correct. Fix that by moving the generation check up. Cc: stable@vger.kernel.org # v6.10 Fixes: 928b721 ("xfs: teach online scrub to find directory tree structure problems") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 59c462b upstream. LOLLM noticed a discrepancy between the bmbt level checks in the libxfs bmbt code vs. the inode repair code. We do actually allow a bmbt root that proclaims to have a height of XFS_BM_MAXLEVELS. Cc: stable@vger.kernel.org # v6.8 Fixes: e744cef ("xfs: zap broken inode forks") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5d72a68 upstream. LOLLM noticed an off-by-one error when computing the length of the rtrmap to cross-check. Cc: stable@vger.kernel.org # v6.14 Fixes: 037a44d ("xfs: cross-reference the realtime rmapbt") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9af789f upstream. The rtgroup superblock fixer should write the rtgroup superblock. LOLLM noticed this, oops. :/ Cc: stable@vger.kernel.org # v6.13 Fixes: 1433f8f ("xfs: repair realtime group superblock") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ee24815 upstream. LOLLM points out that we pass the wrong btree cursor here. We want the rtrefcount btree cursor, not the non-rt one. This is fairly benign since it only affects tracing data. Cc: stable@vger.kernel.org # v6.14 Fixes: 91683bb ("xfs: cross-reference checks with the rt refcount btree") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20260716133044.672218725@linuxfoundation.org Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Miguel Ojeda <ojeda@kernel.org> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Wentao Guan <guanwentao@uniontech.com> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Tested-by: Pavel Machek (CIP) <pavel@nabladev.com> Link: https://lore.kernel.org/r/20260717101904.922623678@linuxfoundation.org Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Pavel Machek (CIP) <pavel@nabladev.com> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Mark Brown <broonie@kernel.org> Tested-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.18.39
xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
xfs: write the rg superblock when fixing it
xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
xfs: don't zap bmbt forks if they are MAXLEVELS tall
xfs: fully check the parent handle when it points to the rootdir
xfs: clamp timestamp nanoseconds correctly
xfs: handle non-inode owners for rtrmap record checking
xfs: set xfarray killable sort correctly
xfs: use the rt version of the cow staging checker
xfs: grab rtrmap btree when checking rgsuper
xfs: don't wrap around quota ids in dqiterate
xfs: resample the data fork mapping after cycling ILOCK
xfs: fail recovery on a committed log item with no regions
xfs: fix null pointer dereference in tracepoint
smb: client: reject overlapping data areas in SMB2 responses
Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
timekeeping: Register default clocksource before taking tk_core.lock
usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
sched/fair: Only update stats for allowed CPUs when looking for dst group
fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
fuse-uring: make a fuse_req on SQE commit only findable after memcpy
fuse-uring: Avoid queue->stopped races and set/read that value under lock
fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
fuse-uring: end fuse_req on io-uring cancel task work
fuse-uring: fix moving cancelled entry to ent_in_userspace list
fuse-uring: fix data races on ring->ready
fuse-uring: fix EFAULT clobber in fuse_uring_commit
fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
fuse: fix io-uring background queue dispatch on request completion
fuse: re-lock request before returning from fuse_ref_folio()
fuse: fix device node leak in cuse_process_init_reply()
fuse: avoid 32-bit prune notification count wrap
fuse: back uncached readdir buffers with pages
RDMA/siw: bound Read Response placement to the RREAD length
RDMA/core: Fix broadcast address falsely detected as local
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
Input: maplecontrol - set driver data before registering input device
Input: maplemouse - set driver data before registering input device
Input: maple_keyb - set driver data before registering input device
Input: mms114 - fix multi-touch slot corruption
Input: maplemouse - fix NULL pointer dereference in open()
Input: gscps2 - advance receive buffer write index
Input: mms114 - reject an oversized device packet size
Input: touchwin - reset the packet index on every complete packet
Input: ads7846 - don't use scratch for tx_buf when clearing register
Input: mms114 - fix touch indexing for MMS134S and MMS136
Input: iforce - bound the device-reported force-feedback effect index
Input: goodix - clamp the device-reported contact count
Input: elan_i2c - prevent division by zero and arithmetic underflow
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
i2c: i801: fix hardware state machine corruption in error path
i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
i2c: stm32f7: truncate clock period instead of rounding it
i2c: davinci: Unregister cpufreq notifier on probe failure
i2c: mpc: Fix timeout calculations
i2c: core: fix adapter deregistration race
i2c: core: fix adapter debugfs creation
i2c: core: fix adapter probe deferral loop
i2c: core: fix NULL-deref on adapter registration failure
i2c: core: fix irq domain leak on adapter registration failure
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
udmabuf: fix DMA direction mismatch in release_udmabuf()
KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
KVM: VMX: Handle bad values on proxied writes to LBR MSRs
KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
LoongArch: KVM: Add missing slots_lock for device register/unregister
KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
selftests/landlock: Filter dealloc records in audit_count_records()
landlock: Set audit_net.sk for socket access checks
audit: fix removal of dangling executable rules
iommufd: Set upper bounds on cache invalidation entry_num and entry_len
iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
iommufd: Break the loop on failure in iommufd_fault_fops_read()
iommufd: Reject invalid read count in iommufd_fault_fops_read()
iommufd: Reject invalid read count in iommufd_veventq_fops_read()
iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
iommufd: Set veventq_depth upper bound
iommufd: Fix data_len byte-count vs element-count mismatch
iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
iommu/vt-d: Avoid WARNING in sva unbind path
crypto: loongson - Remove broken and unused loongson-rng
selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
mm: do file ownership checks with the proper mount idmap
mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
selftests: mm: fix and speedup "droppable" test
mm: fix mmap errno value when MAP_DROPPABLE is not supported
riscv: mm: Unconditionally sfence.vma for spurious fault
riscv: mm: Define DIRECT_MAP_PHYSMEM_END
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
exfat: bound uniname advance in exfat_find_dir_entry()
module: decompress: check return value of module_extend_max_pages()
rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
audit: fix potential integer overflow in audit_log_n_hex()
tracing: Prevent out-of-bounds read in glob matching
perf/aux: Fix page UAF in map_range()
i2c: core: fix hang on adapter registration failure
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
watchdog: apple: Add "apple,t8103-wdt" compatible
EDAC/i10nm: Don't fail probing if ADXL is missing
x86/mm: Fix freeing of PMD-sized vmemmap pages
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
crypto: talitos/hash - remove useless wrapper
crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
crypto: talitos/hash - drop workqueue mechanism for SEC1
crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
crypto: talitos - move code in current_desc_hdr() into a standalone function
crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
crypto: qat - factor out AER reset helpers
crypto: qat - validate RSA CRT component lengths
crypto: qat - skip restart for down devices
crypto: qat - protect service table iterations with service_lock
crypto: qat - notify fatal error before AER reset preparation
crypto: qat - keep VFs enabled during reset
crypto: qat - handle sysfs-triggered reset callbacks
crypto: qat - centralize bus master enable
crypto: drbg - Fix the fips_enabled priority boost
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
crypto: drbg - Fix returning success on failure in CTR_DRBG
crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
crypto: ccp - Do not initialize SNP for SEV ioctls
crypto: loongson - Select CRYPTO_RNG
crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
crypto: pcrypt - restore callback for non-parallel fallback
crypto: hisi-trng - Remove crypto_rng interface
crypto: ecc - Fix carry overflow in vli multiplication
crypto: crypto4xx - Remove insecure and unused rng_alg
crypto: chacha20poly1305 - validate poly1305 template argument
crypto: caam - use print_hex_dump_devel to guard key hex dumps again
crypto: caam - use print_hex_dump_devel to guard key hex dumps
crypto: af_alg - Remove zero-copy support from skcipher and aead
isofs: bound Rock Ridge symlink components to the SL record
partitions: aix: bound the pp_count scan to the ppe array
btrfs: do not trim a device which is not writeable
btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
nvmet-auth: validate reply message payload bounds against transfer length
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
dm-ioctl: report an error if a device has no table
block: partitions: fix of_node refcount leak in of_partition()
nvme: target: rdma: fix ndev refcount leak on queue connect
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
hwrng: jh7110 - fix refcount leak in starfive_trng_read()
udf: validate sparing table length as an entry count, not a byte count
udf: validate VAT header length against the VAT inode size
udf: validate free block extents against the partition length
bpf: Prefer dirty packs for eBPF allocations
bpf: Prefer packs that won't trigger an IBPB flush on allocation
bpf: Skip redundant IBPB in pack allocator
bpf: Restrict JIT predictor flush to cBPF
x86/bugs: Enable IBPB flush on BPF JIT allocation
bpf: Support for hardening against JIT spraying
rust_binder: fix BINDER_GET_EXTENDED_ERROR
rust_binder: introduce TransactionInfo
x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
mm: shmem: fix potential livelock issue for shmem direct swapin
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
usb: gadget: f_fs: Fix DMA fence leak
usb: typec: ucsi: cancel pending work on system suspend
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
usb: typec: ucsi: Invert DisplayPort role assignment
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
usb: typec: tcpm: Fix VDM type for Enter Mode commands
usb: typec: class: drop PD lookup reference
usb: typec: anx7411: use devm_pm_runtime_enable()
usbip: vudc: fix NULL deref in vep_dequeue()
usbip: tools: support SuperSpeedPlus devices
USB: usb-storage: ene_ub6250: restore media-ready check
USB: ulpi: fix memory leak on registration failure
USB: serial: digi_acceleport: fix write buffer corruption
USB: serial: digi_acceleport: fix hard lockup on disconnect
USB: serial: digi_acceleport: fix broken rx after throttle
USB: serial: option: add Telit Cinterion FE990D50 compositions
USB: serial: keyspan_pda: fix information leak
usb: mtu3: unmap request DMA on queue failure
USB: misc: uss720: unregister parport on probe failure
usb: misc: usbio: bound bulk IN response length to the received transfer
USB: storage: include US_FL_NO_SAME in quirks mask
usb: sl811-hcd: disable controller wakeup on remove
USB: legousbtower: fix use-after-free on disconnect race
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
USB: iowarrior: fix use-after-free on disconnect
USB: ldusb: fix use-after-free on disconnect race
USB: idmouse: fix use-after-free on disconnect race
usb: gadget: f_printer: take kref only for successful open
usb: gadget: udc: Fix use-after-free in gadget_match_driver
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
usb: free iso schedules on failed submit
usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
usb: cdc_acm: Add quirk for Uniden BC125AT scanner
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
bpf: Validate BTF repeated field counts before expansion
bpf: Restore sysctl new-value from 1 to 0
bpf: Reject fragmented frames in devmap
xfs: fix memory leak in xfs_dqinode_metadir_create()
xfs: fix exchmaps reservation limit check
xfs: fix pointer arithmetic error on 32-bit systems
xfs: fix unreachable BIGTIME check in dquot flush validation
xfs: release dquot buffer after dqflush failure
xfs: use null daddr for unset first bad log block
serial: 8250_mid: Disable DMA for selected platforms
media: mtk-jpeg: cancel workqueue on release for supported platforms only
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
HID: lg-g15: cancel pending work on remove to fix a use-after-free
HID: appleir: fix UAF on pending key_up_timer in remove()
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
HID: letsketch: fix UAF on inrange_timer at driver unbind
HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
HID: pidff: Use correct effect type in effect update
HID: wacom: stop hardware after post-start probe failures
HID: uhid: convert to hid_safe_input_report()
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
tools/mm/slabinfo: fix total_objects attribute name
tools/mm/slabinfo: Fix trace disable logic inversion
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
X.509: Fix validation of ASN.1 certificate header
perf/arm-cmn: Fix DVM node events
s390: Revert support for DCACHE_WORD_ACCESS
clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
time/jiffies: Register jiffies clocksource before usage
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
cpufreq: Fix hotplug-suspend race during reboot
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
cpufreq: intel_pstate: Sync policy->cur during CPU offline
perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
firmware_loader: fix device reference leak in firmware_upload_register()
cpufreq: qcom-cpufreq-hw: Fix possible double free
OPP: of: Fix potential memory leak in opp_parse_supplies()
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
smb: client: mask server-provided mode to 07777 in modefromsid
smb: client: fix atime clamp check in read completion
smb: client: harden POSIX SID length parsing
smb: client: use unaligned reads in parse_posix_ctxt()
smb: client: Fix next buffer leak in receive_encrypted_standard()
smb: client: fix double-free in SMB2_close() replay
smb: client: fix double-free in SMB2_open() replay
smb: client: fix double-free in SMB2_flush() replay
smb: client: fix change notify replay double-free
smb: client: fix double-free in SMB2_ioctl() replay
smb: client: fix query_info() replay double-free
smb: client: fix query directory replay double-free
ksmbd: use opener credentials for ADS I/O
ksmbd: use opener credentials for delete-on-close
ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
ksmbd: run set info with opener credentials
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
ksmbd: require source read access for duplicate extents
ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
ksmbd: serialize QUERY_DIRECTORY requests per file
ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
smb/client: Fix error code in smb2_aead_req_alloc()
smb: client: resolve SWN tcon from live registrations
coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
fs/ntfs3: fsync files by syncing parent inodes
fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
iommu/vt-d: Fix race condition during PASID entry replacement
Bluetooth: L2CAP: validate option length before reading conf opt value
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
Bluetooth: fix UAF in bt_accept_dequeue()
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
Bluetooth: bnep: pin L2CAP connection during netdev registration
Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
netfilter: flowtable: fix offloaded ct timeout never being extended
netfilter: ebtables: terminate table name before find_table_lock()
netfilter: ebtables: module names must be null-terminated
netfilter: ebtables: zero chainstack array
netfilter: handle unreadable frags
netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
mm: shrinker: fix NULL pointer dereference in debugfs
mm: shrinker: fix shrinker_info teardown race with expansion
mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
mfd: cros_ec: Delay dev_set_drvdata() until probe success
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
ipv4: igmp: remove multicast group from hash table on device destruction
netpoll: fix a use-after-free on shutdown path
io_uring/rw: preserve partial result for iopoll
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
gpio: sch: use raw_spinlock_t in the irq startup path
gpio: eic-sprd: use raw_spinlock_t in the irq startup path
NTB: epf: Avoid calling pci_irq_vector() from hardirq context
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
debugobjects: Plug race against a concurrent OOM disable
coresight: etb10: restore atomic_t for shared reading state
Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
audit: Fix data races of skb_queue_len() readers on audit_queue
net: af_key: initialize alg_key_len for IPComp states
ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
crypto: krb5 - filter out async aead implementations at alloc
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
staging: rtl8723bs: fix OOB write in HT_caps_handler()
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
staging: media: ipu7: fix double-free and use-after-free in error paths
staging: media: atomisp: reduce load_primary_binaries() stack usage
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
staging: vme_user: fix location monitor leak in tsi148 bridge
staging: vme_user: fix location monitor leak in fake bridge
smb: client: restrict implied bcc[0] exemption to responses without data area
staging: vme_user: bound slave read/write to the kern_buf size
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
6lowpan: fix NHC entry use-after-free on error path
usb: misc: usbio: fix disconnect UAF in client teardown
usb: dwc3: run gadget disconnect from sleepable suspend context
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
hwrng: virtio: clamp device-reported used.len at copy_data()
virtio-mmio: fix device release warning on module unload
virtio_pci: fix vq info pointer lookup via wrong index
netfilter: ipset: fix race between dump and ip_set_list resize
mm/damon/ops-common: handle extreme intervals in damon_hot_score()
tcp: restore RCU grace period in tcp_ao_destroy_sock
PCI/IOV: Skip VF Resizable BAR restore on read error
PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
PCI: mediatek: Fix IRQ domain leak when port fails to enable
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
PCI: host-common: Request bus reassignment when not probe-only
PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
PCI: altera: Fix resource leaks on probe failure
PCI: altera: Do not dispose parent IRQ mapping
PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
xhci: sideband: fix ring sg table pages leak
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
rust_binder: clear freeze listener on node removal
rust_binder: synchronize Rust Binder stats with freeze commands
rust_binder: reject context manager self-transaction
rust_binder: use a u64 stride when cleaning up the offsets array
binder: fix UAF in binder_free_transaction()
binder: fix UAF in binder_thread_release()
Bluetooth: btusb: fix wakeup source leak on probe failure
Bluetooth: btusb: fix use-after-free on marvell probe failure
Bluetooth: btusb: fix use-after-free on registration failure
Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
vfio: Remove device debugfs before releasing devres
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
vfio/pci: Fix racy bitfields and tighten struct layout
vfio/pci: Release the VGA arbiter client on register_device() failure
vfio/pci: Latch disable_idle_d3 per device
vfio/pci: Use a private flag to prevent power state change with VFs
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
ALSA: usb-audio: Roll back quirk control caches on write errors
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
ALSA: usb-audio: avoid kobject path lookup in DualSense match
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
ALSA: ice1712: check snd_ctl_new1() return value
ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
ALSA: hda/cs35l41: Fix firmware load work teardown
ALSA: gus: check snd_ctl_new1() return value
ALSA: firewire: isight: bound the sample count to the packet payload
ALSA: FCP: Add Focusrite ISA C8X support
ALSA: es1938: check snd_ctl_new1() return value
ALSA: compress: Fix task creation error unwind
ALSA: cmipci: check snd_ctl_new1() return value
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
ALSA: aoa: check snd_ctl_new1() return value
ALSA: ymfpci: check snd_ctl_new1() return value
ALSA: virtio: Validate control metadata from the device
ALSA: virtio: Add missing 384 kHz PCM rate mapping
ALSA: usx2y: us144mkii: fix work UAF on disconnect
iio: temperature: tmp006: use devm_iio_trigger_register
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
iio: temperature: Build mlx90635 with CONFIG_MLX90635
iio: resolver: ad2s1210: notify trigger and clear state on fault read error
iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
iio: pressure: mpl115: fix runtime PM leak on read error
iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
iio: light: veml6030: fix channel type when pushing events
iio: light: tsl2591: return actual error from probe IRQ failure
iio: light: opt3001: fix missing state reset on timeout
iio: light: gp2ap002: fix runtime PM leak on read error
iio: light: al3320a: read both ALS ADC registers again
iio: light: al3320a: add missing REGMAP_I2C to Kconfig
iio: light: al3010: read both ALS ADC registers again
iio: light: al3010: fix incorrect scale for the highest gain range
iio: light: al3010: add missing REGMAP_I2C to Kconfig
iio: light: al3000a: add missing REGMAP_I2C to Kconfig
iio: imu: st_lsm6dsx: deselect shub page before reading whoami
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
iio: imu: inv_icm42600: fix timestamp clock period by using lower value
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
iio: gyro: bmg160: wait full startup time after mode change at probe
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
iio: event: Fix event FIFO reset race
iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
iio: core: fix uninitialized data in debugfs
iio: common: st_sensors: honour channel endianness in read_axis_data
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
iio: backend: fix uninitialized data in debugfs
iio: adc: ti-ads124s08: Return reset GPIO lookup errors
iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
iio: adc: spear: Initialize completion before requesting IRQ
iio: adc: lpc32xx: Initialize completion before requesting IRQ
iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
iio: adc: ad7768-1: Select GPIOLIB
iio: adc: ad7380: select REGMAP
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
iio: accel: bmc150: clamp the device-reported FIFO frame count
usb: gadget: function: rndis: add length check for header
usb: gadget: function: rndis: add length check to response query
fscrypt: Replace mk_users keyring with simple list
fscrypt: Fix key setup in edge case with multiple data unit sizes
rust: kasan: KASAN+RUST requires clang
perf/core: Detach event groups during remove_on_exec
futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
rust: doctest: fix incorrect pattern in replacement
rust: block: fix GenDisk cleanup paths
rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
LoongArch: Add PIO for early access before ACPI PCI root register
platform/x86: intel-hid: Protect ACPI notify handler against recursion
ACPI: NFIT: core: Fix possible NULL pointer dereference
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
KVM: x86: Unconditionally recompute CR8 intercept on PPR update
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
KVM: x86: Move update_cr8_intercept() to lapic.c
perf trace beauty fcntl: Fix build with older kernel headers
slab: recognize @gfp parameter as optional in kernel-doc
default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
add default_gfp() helper macro and use it in the new *alloc_obj() helpers
slab: Introduce kmalloc_flex() and family
mm/khugepaged: write all dirty file folios when collapsing
nfsd: change nfs4_client_to_reclaim() to allocate data
nfsd: move name lookup out of nfsd4_list_rec_dir()
net/sched: dualpi2: fix GSO backlog accounting
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
f2fs: detect more inconsistent cases in sanity_check_node_footer()
f2fs: optimize trace_f2fs_write_checkpoint with enums
f2fs: introduce f2fs_schedule_timeout()
f2fs: use memalloc_retry_wait() as much as possible
f2fs: fix listxattr handling of corrupted xattr entries
f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
f2fs: fix potential deadlock in f2fs_balance_fs()
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
f2fs: remove non-uptodate folio from the page cache in move_data_block
device property: initialize the remaining fields of fwnode_handle in fwnode_init()
userfaultfd: gate must_wait writability check on pte_present()
rust: str: clean unused import for Rust >= 1.98
rust: str: use the "kernel vertical" imports style
nfsd: release layout stid on setlease failure
nfsd: update mtime/ctime on COPY in presence of delegated attributes
nfsd: update mtime/ctime on CLONE in presense of delegated attributes
bpf, arm64: Reject out-of-range B.cond targets
Linux 6.18.38
apparmor: advertise the tcp fast open fix is applied
net/tcp-ao: fix use-after-free of key in del_async path
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
NFS: Prevent resource leak in nfs_alloc_server()
NFSv4: clear exception state on successful mkdir retry
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
NFSv4/flexfiles: reject zero filehandle version count
nfsd: reset write verifier on deferred writeback errors
nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
nfsd: check get_user() return when reading princhashlen
nfsd: fix inverted cp_ttl check in async copy reaper
nfsd: fix posix_acl leak on SETACL decode failure
NFSD: Fix SECINFO_NO_NAME decode error cleanup
i2c: core: fix adapter registration race
fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
fbdev: modedb: fix a possible UAF in fb_find_mode()
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
riscv: mm: Extract helper mark_new_valid_map()
power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
KVM: x86: hyper-v: Bound the bank index when querying sparse banks
MIPS: smp: report dying CPU to RCU in stop_this_cpu()
9p: avoid putting oldfid in p9_client_walk() error path
ocfs2: reject oversized group bitmap descriptors
rpmsg: char: Fix use-after-free on probe error path
fpga: region: fix use-after-free in child_regions_with_firmware()
irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
pNFS: Fix use-after-free in pnfs_update_layout()
LoongArch: Report dying CPU to RCU in stop_this_cpu()
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
blk-cgroup: fix UAF in __blkcg_rstat_flush()
hdlc_ppp: sync per-proto timers before freeing hdlc state
pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
gfs2: fix use-after-free in gfs2_qd_dealloc
crypto: nx - fix nx_crypto_ctx_exit argument
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
exfat: fix potential use-after-free in exfat_find_dir_entry()
MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
bpf: use kvfree() for replaced sysctl write buffer
block: Avoid mounting the bdev pseudo-filesystem in userspace
f2fs: keep atomic write retry from zeroing original data
f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
f2fs: fix to round down start offset of fallocate for pin file
f2fs: validate compress cache inode only when enabled
f2fs: validate orphan inode entry count
f2fs: pass correct iostat type for single node writes
wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
wifi: iwlwifi: mld: fix race condition in PTP removal
wifi: iwlwifi: mvm: fix race condition in PTP removal
wifi: rtw88: usb: fix memory leaks on USB write failures
wifi: rtw88: increase TX report timeout to fix race condition
wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
wifi: ath11k: fix warning when unbinding
wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
keys: Pin request_key_auth payload in instantiate paths
KEYS: fix overflow in keyctl_pkey_params_get_2()
gcov: use atomic counter updates to fix concurrent access crashes
err.h: use __always_inline on all error pointer helpers
KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
block: invalidate cached plug timestamp after task switch
kernel/fork: clear PF_BLOCK_TS in copy_process()
fbdev: fix use-after-free in store_modes()
NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
apparmor: fix use-after-free in rawdata dedup loop
apparmor: mediate the implicit connect of TCP fast open sendmsg
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
net: skmsg: preserve sg.copy across SG transforms
mac802154: llsec: add skb_cow_data() before in-place crypto
af_unix: Set gc_in_progress to true in unix_gc().
wifi: mt76: add wcid publish check in mt76_sta_add
ntfs3: reject direct userspace writes to reserved $LX* xattrs
ipv4: account for fraggap on the paged allocation path
ipv6: account for fraggap on the paged allocation path
batman-adv: tvlv: avoid race of cifsnotfound handler state
batman-adv: tvlv: enforce 2-byte alignment
batman-adv: dat: prevent false sharing between VLANs
batman-adv: tt: track roam count per VID
batman-adv: tt: don't merge change entries with different VIDs
batman-adv: tp_meter: handle overlapping packets
batman-adv: tp_meter: prevent parallel modifications of last_recv
batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
batman-adv: tp_meter: restrict number of unacked list entries
batman-adv: v: prevent OGM aggregation on disabled hardif
batman-adv: frag: avoid underflow of TTL
batman-adv: frag: ensure fragment is writable before modifying TTL
batman-adv: fix (m|b)cast csum after decrementing TTL
batman-adv: ensure bcast is writable before modifying TTL
batman-adv: gw: don't deselect gateway with active hardif
batman-adv: tp_meter: initialize last_recv_time during init
batman-adv: prevent ELP transmission interval underflow
batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
batman-adv: tp_meter: add only finished tp_vars to lists
batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
batman-adv: tp_meter: fix fast recovery precondition
batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
batman-adv: tp_meter: avoid window underflow
batman-adv: tp_meter: initialize dec_cwnd explicitly
batman-adv: tp_meter: initialize dup_acks explicitly
batman-adv: tp_meter: keep unacked list in ascending ordered
lockd: fix TEST handling when not all permissions are available.
Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
selinux: fix overlayfs mmap() and mprotect() access checks
lsm: add backing_file LSM hooks
KVM: x86: Fix shadow paging use-after-free due to unexpected role
Signed-off-by: Naveen Kumar Siddam <nsiddam@qti.qualcomm.com>
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
PR #856 — validate-patchPR: #856
Final Summary
|
PR #856 — checker-log-analyzerPR: #856
Detailed report: Full report
|
No description provided.