1024-bit key) header.d=yandex-team.ru header.i=@yandex-team.ru header.b=P49fEwis; arc=none smtp.client-ip=178.154.239.136
Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex-team.ru
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex-team.ru
Received: from mail-nwsmtp-smtp-corp-main-66.iva.yp-c.yandex.net (mail-nwsmtp-smtp-corp-main-66.iva.yp-c.yandex.net [IPv6:2a02:6b8:c0c:1a8f:0:640:2fa2:0])
	by forwardcorp1b.mail.yandex.net (Yandex) with ESMTPS id 9E260804B3;
	Mon, 27 Oct 2025 10:48:03 +0300 (MSK)
Received: from i111667286.ld.yandex.ru (unknown [2a02:6bf:8080:994::1:8])
	by mail-nwsmtp-smtp-corp-main-66.iva.yp-c.yandex.net (smtpcorp/Yandex) with ESMTPSA id 0mW16e1FpuQ0-LqkXLN0L;
	Mon, 27 Oct 2025 10:48:02 +0300
X-Yandex-Fwd: 1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru;
	s=default; t=1761551282;
	bh=0w2fmspoFXzBsApnGldGOaGahnNb+24s0WLPhF3empo=;
	h=Message-ID:Date:Cc:Subject:To:From;
	b=P49fEwisOYO7W+IztiTmu46vQWxujnBUZ9jVNSUg2xIsZMI4cRkURnjAr1PyHmKlk
	 B500oLyWSwLEUbPIhzm+MhF0HJ1slQ6q8IUpm5so09zCcF2SQ8SR0WMeAB+uaboNQ0
	 InHQ+2k1TujbP5Lpg8Tf60dPKX03bB6Lq/RiGjlA=
Authentication-Results: mail-nwsmtp-smtp-corp-main-66.iva.yp-c.yandex.net; dkim=pass header.i=@yandex-team.ru
From: Andrey Troshin <drtrosh@yandex-team.ru>
To: stable@vger.kernel.org,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Andrey Troshin <drtrosh@yandex-team.ru>,
	"Martin K . Petersen" <martin.petersen@oracle.com>,
	linux-scsi@vger.kernel.org,
	target-devel@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	lvc-project@linuxtesting.org
Subject: [PATCH 5.10] scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Date: Mon, 27 Oct 2025 10:48:06 +0300
Message-ID: <20251027074806.2036-1-drtrosh@yandex-team.ru>
X-Mailer: git-send-email 2.51.0.windows.2
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-DKIM: signer='yandex-team.ru' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: yandex-team.ru]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
SpamTally: Final spam score: 4

From: Wang Haoran <haoranwangsec@gmail.com>

commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream.

A buffer overflow arises from the usage of snprintf to write into the
buffer "buf" in target_lu_gp_members_show function located in
/drivers/target/target_core_configfs.c. This buffer is allocated with
size LU_GROUP_NAME_BUF (256 bytes).

snprintf(...) formats multiple strings into buf with the HBA name
(hba->hba_group.cg_item), a slash character, a devicename (dev->
dev_group.cg_item) and a newline character, the total formatted string
length may exceed the buffer size of 256 bytes.

Since snprintf() returns the total number of bytes that would have been
written (the length of %s/%sn ), this value may exceed the buffer length
(256 bytes) passed to memcpy(), this will ultimately cause function
memcpy reporting a buffer overflow error.

An additional check of the return value of snprintf() can avoid this
buffer overflow.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: ziiiro <yuanmingbuaa@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[Andrey Troshin: patch adaptation for linux-5.10]
Signed-off-by: Andrey Troshin <drtrosh@yandex-team.ru>
---
Backport fix for CVE-2025-39998
Link: https://nvd.nist.gov/vuln/detail/CVE-2025-39998
---
 drivers/target/target_core_configfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 4d2fbe1429b6..e6996428c07d 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2637,7 +2637,7 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page)
 			config_item_name(&dev->dev_group.cg_item));
 		cur_len++; /* Extra byte for NULL terminator */
 
-		if ((cur_len + len) > PAGE_SIZE) {
+		if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) {
 			pr_warn("Ran out of lu_gp_show_attr"
 				"_members buffer\n");
 			break;
-- 
2.34.1



From - Mon Oct 27 07:52:01 2025
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <io-uring+bounces-10230-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id CM9SHJ4k/2jVlDEAYBR5ng
	(envelope-from <io-uring+bounces-10230-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Mon, 27 Oct 2025 07:51:58 +0000
Return-path: <io-uring+bounces-10230-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Mon, 27 Oct 2025 07:51:58 +0000
Received: from sv.mirrors.kernel.org ([139.178.88.99])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <io-uring+bounces-10230-hi=josie.lol@vger.kernel.org>)
	id 1vDI1G-0000000EvJc-0YU4
	for hi@josie.lol;
	Mon, 27 Oct 2025 07:51:58 +0000
Received: from smtp.subspace.kernel.org (relay.kernel.org [52.25.139.140])
	(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by sv.mirrors.kernel.org (Postfix) with ESMTPS id 485673BD513
	for <hi@josie.lol>; Mon, 27 Oct 2025 07:51:50 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 8A0B52E4278;
	Mon, 27 Oct 2025 07:51:49 +0000 (UTC)
X-Original-To: io-uring@vger.kernel.org
Received: from verein.lst.de (verein.lst.de [213.95.11.211])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03D0B2E4241;
	Mon, 27 Oct 2025 07:51:47 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.95.11.211
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1761551509; cv=none; b=LrQFjmJB2X94O0g01agl7Uy7g4SriW25Gf2iEXx7/Fuitdkte450KEsoKfDP4tOS9vG0spcIwuX3wFLH42rfKO20o2GgUSMLjtMxYD267awi7yB4DnL5jJoU1vBlgD/+S7c2qs4JuMIZA6gtfmCUeW1X80MbqAe7EpuFgEbVF1Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1761551509; c=relaxed/simple;
	bh=f3iwptgJ39Cvn/1R/92zDLiiyDlPBo6yDS5IVREqL2Q=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=WHvMWMqFFT/Wfp32mHhtxIZhl+se8OunbViA2tZTC7XZfgjFtPalP85qCumC8knVxzoZY4fj+OD1qs55TGPWx1C52imqQBw5EbMkoF8e930sjcz6TtxrdD2/I+jMUIGHKueVeDlFcup3hsLd709RKn8uHFmlMPxi7OH4AJeMCqk=
ARC-Ausults: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="eJhm7LNZ"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 559A081AA8;
	Wed, 28 Jan 2026 16:01:40 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769616100; cv=none; b=ToSYwmMFzXP8b+qEXv0ZwcLZFO2c9frdJjIm6T7rE0tXM6H27o4FBXFOhqJQAi5B9DOZmt1bPt/9EO0Md4s95ve8vOf9NHmUYinzmyAqYGP02mSUaJ/CE5lG6rqmYAwYPAWT40c9ncKHDitaSlm3nrlLEMPUeU+OXy0FkOdiq54=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769616100; c=relaxed/simple;
	bh=LXFa4VoPxVHpekAajJHCjORDjPF9c8WQCjK/CELfaLI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=q3p4IlNRLawmoah6628IpzGjOHZIAXrtoCffiOOG2kqsDi0vRxt6HHcbvPpEACbWdUMHKT9/oxfTWysQ5JNJcmo9cVuBSFG3RC6bBWbExPv9bNODeKGgwHA/OYkNXwR9lTYfOvtlVydEt8Q1a84j4yleDTDtn8wILxw50TIXPNY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eJhm7LNZ; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id C2DFBC4CEF1;
	Wed, 28 Jan 2026 16:01:39 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1769616100;
	bh=LXFa4VoPxVHpekAajJHCjORDjPF9c8WQCjK/CELfaLI=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=eJhm7LNZZ6bgaLEO3TbLy4Qqpu9YzhXwqmyRhoXIQReX233PV4C/8sjUG8Nyqa+VC
	 03XOwaUgUiS5mDIkN28PWGc6jsT5wL5NuwtTuquok6X6WH2XgjZQGhXx+Ks/8zxZ98
	 Vg/xF1Yi6gx+rVpuD576SodLyCPDiLnAIjBu/MMw=
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Thomas Fourier <fourier.thomas@gmail.com>,
	Baochen Qiang <baochen.qiang@oss.qualcomm.com>,
	Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Subject: [PATCH 6.18 174/227] wifi: ath10k: fix dma_free_coherent() pointer
Date: Wed, 28 Jan 2026 16:23:39 +0100
Message-ID: <20260128145350.711621517@linuxfoundation.org>
X-Mailer: git-send-email 2.52.0
In-Reply-To: <20260128145344.331957407@linuxfoundation.org>
References: <20260128145344.331957407@linuxfoundation.org>
User-Agent: quilt/0.69
X-stable: review
X-Patchwork-Hint: ignore
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-DKIM: signer='linuxfoundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Fourier <fourier.thomas@gmail.com>

commit 9282a1e171ad8d2205067e8ec3bbe4e3cef4f29f upstream.

dma_alloc_coherent() allocates a DMA mapped buffer and stores the
addresses in XXX_unaligned fields.  Those should be reused when freeing
the buffer rather than the aligned addresses.

Fixes: 2a1e1ad3fd37 ("ath10k: Add support for 64 bit ce descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260105210439.20131-2-fourier.thomas@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath10k/ce.c |   16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -1727,8 +1727,8 @@ static void _ath10k_ce_free_pipe(struct
 				  (ce_state->src_ring->nentries *
 				   sizeof(struct ce_desc) +
 				   CE_DESC_RING_ALIGN),
-				  ce_state->src_ring->base_addr_owner_space,
-				  ce_state->src_ring->base_addr_ce_space);
+				  ce_state->src_ring->base_addr_owner_space_unaligned,
+				  ce_state->src_ring->base_addr_ce_space_unaligned);
 		kfree(ce_state->src_ring);
 	}
 
@@ -1737,8 +1737,8 @@ static void _ath10k_ce_free_pipe(struct
 				  (ce_state->dest_ring->nentries *
 				   sizeof(struct ce_desc) +
 				   CE_DESC_RING_ALIGN),
-				  ce_state->dest_ring->base_addr_owner_space,
-				  ce_state->dest_ring->base_addr_ce_space);
+				  ce_state->dest_ring->base_addr_owner_space_unaligned,
+				  ce_state->dest_ring->base_addr_ce_space_unaligned);
 		kfree(ce_state->dest_ring);
 	}
 
@@ -1758,8 +1758,8 @@ static void _ath10k_ce_free_pipe_64(stru
 				  (ce_state->src_ring->nentries *
 				   sizeof(struct ce_desc_64) +
 				   CE_DESC_RING_ALIGN),
-				  ce_state->src_ring->base_addr_owner_space,
-				  ce_state->src_ring->base_addr_ce_space);
+				  ce_state->src_ring->base_addr_owner_space_unaligned,
+				  ce_state->src_ring->base_addr_ce_space_unaligned);
 		kfree(ce_state->src_ring);
 	}
 
@@ -1768,8 +1768,8 @@ static void _ath10k_ce_free_pipe_64(stru
 				  (ce_state->dest_ring->nentries *
 				   sizeof(struct ce_desc_64) +
 				   CE_DESC_RING_ALIGN),
-				  ce_state->dest_ring->base_addr_owner_space,
-				  ce_state->dest_ring->base_addr_ce_space);
+				  ce_state->dest_ring->base_addr_owner_space_unaligned,
+				  ce_state->dest_ring->base_addr_ce_space_unaligned);
 		kfree(ce_state->dest_ring);
 	}
 




From - Wed Jan 28 16:10:47 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-212614-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id 2KsgKQM1eml4gz4AYBR5ng
	(envelope-from <stable+bounces-212614-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:10:43 +0000
Return-path: <stable+bounces-212614-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Wed, 28 Jan 2026 16:10:43 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-212614-hi=josie.lol@vger.kernel.org>)
	id 1vl87v-0000000HWMU-1d1a
	for hi@josie.lol;
	Wed, 28 Jan 2026 16:10:43 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id B3F95317D8E0
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:01:58 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 8F1C630C635;
	Wed, 28 Jan 2026 16:01:50 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="dCwPc+IJ"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A0E130C37E;
	Wed, 28 Jan 2026 16:01:50 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769616110; cv=none; b=EqHJrYjDzHYQ5fY7V82LN1bqQ8SHLKUyOntdPeVdNMzzQ2kEUIP2c0AKYcfhl2sAvHwwlWvOW0Uh8cjRdcIIJGNPg4saU57Dqn3pu+z528NQYN7YFfUCBWHfVlfSbNNZ6S6b9tw54iwcKllpAwl9zAR0smI5ueue4uzs0YXcax4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769616110; c=relaxed/simple;
	bh=njMYHPSmA8oQctWqjJaLd5GmBXebTX0wybmrY0c8ygA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PfDdv1rSqCG0GeVaXnOdy9luarKb8Nh1hauXQlBI95nEe/bJxQ43jjp/dvoGG4bg2aQ5UaUW8GTGvr48Ha9hIGHX7BItx2GCs7hPVTXBAPxZ8drukUgrDQK5jBH+Nlsl9fzpmQ7/oCrlMIxNVNyfrFKFwg8X0QlzcUVJuakYT1Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dCwPc+IJ; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5371C4CEF1;
	Wed, 28 Jan 2026 16:01:49 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1769616110;
	bh=njMYHPSmA8oQctWqjJaLd5GmBXebTX0wybmrY0c8ygA=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=dCwPc+IJqZTP/r86wQ459CzMzywGZGMIW9pPMnDh6p5aoqdhdlMzludUcvnRTnzhC
	 fiObNuHEoNiEHVRDYyA2NpEhBxr/HXC1jPCRhMusSnhc3L2ywFngVgqyEl05xoOUNn
	 44LPpwLLhN9zYHSEYXHS2CVSty5cbj0bxH9WD7C0=
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Zhang Heng <zhangheng@kylinos.cn>,
	Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 6.18 167/227] ALSA: hda/realtek: Add quirk for Samsung 730QED to fix headphone
Date: Wed, 28 Jan 2026 16:23:32 +0100
Message-ID: <20260128145350.461677001@linuxfoundation.org>
X-Mailer: git-send-email 2.52.0
In-Reply-To: <20260128145344.331957407@linuxfoundation.org>
References: <20260128145344.331957407@linuxfoundation.org>
User-Agent: quilt/0.69
X-stable: review
X-Patchwork-Hint: ignore
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-DKIM: signer='linuxfoundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhang Heng <zhangheng@kylinos.cn>

commit c45385ed624eecc5305ff165e1ac5dfa7548bcd5 upstream.

After applying this quirk for the ALC256 audio codec, the headphone
audio path functions normally; otherwise, headphones produce no sound.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220574
Cc: <stable@vger.kernel.org>
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260122085240.3163975-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/hda/codecs/realtek/alc269.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6906,6 +6906,7 @@ static const struct hda_quirk alc269_fix
 	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+	SND_PCI_QUIRK(0x144d, 0xc876, "Samsung 730QED (NP730QED-KA2US)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x144d, 0xca03, "Samsung Galaxy Book2 Pro 360 (NP930QED)", ALC298_FIXUP_SAMSUNG_AMP),
 	SND_PCI_QUIRK(0x144d, 0xca06, "Samsung Galaxy Book3 360 (NP730QFG)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
 	SND_PCI_QUIRK(0x144d, 0xc868, "Samsung Galaxy Book2 Pro (NP930XED)", ALC298_FIXUP_SAMSUNG_AMP),




From - Wed Jan 28 16:11:06 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-212617-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id WPMdChY1eml4gz4AYBR5ng
	(envelope-from <stable+bounces-212617-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:11:02 +0000
Return-path: <stable+bounces-212617-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Wed, 28 Jan 2026 16:11:02 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-212617-hi=josie.lol@vger.kernel.org>)
	id 1vl88D-0000000HWri-3Tu9
	for hi@josie.lol;
	Wed, 28 Jan 2026 16:11:02 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id 4EA2B324DA05
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:02:17 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 7B8D5285C8D;
	Wed, 28 Jan 2026 16:02:01 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ZuHY3EgZ"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5907D18027;
	Wed, 28 Jan 2026 16:02:01 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769616121; cv=none; b=CjR1CAxpBXQ2LQU1VJ9XDmLOjyFGQCO0w9xuzP43tJGwh815kzFUagKTu13GLhB26MczWnAaARao3M8pdvTTgaakQYQTVGyRc9FPdlYpm/YsQESGO1H+cAqskPIvJOM24s4ie1BcHsTnKYl/npvVEtyzY8fU/No95IufstehOAo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769616121; c=relaxed/simple;
	bh=2ewflZ9ZXxnoSmizBldznpGKd3yTy07l23W7Y4bZGcI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=F7klcILEGR38vwX+l16wZFq7u0Fu5TPgQTOEy6m6BdlnddSah5qK3hlkyTnDivbl4PuciQTs18dN8D+xDqtIkufqtdjN3Va6YvhSkeb954hU+ETgl7vE5TEgi+vQyS0xhcMbQvMs99fSzskhbINt48y89JIVrYapi3SFPjJJ1wY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZuHY3EgZ; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id BBA9BC4CEF1;
	Wed, 28 Jan 2026 16:02:00 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1769616121;
	bh=2ewflZ9ZXxnoSmizBldznpGKd3yTy07l23W7Y4bZGcI=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=ZuHY3EgZW8Pba0SVs5eQQ6ULAFzPFi9xw36z1fZjxgrB6DoKry/pHmuYonCq/G3wa
	 1dAjmc0WZ66jJ5SxZD5xueQX0S2hTAuCrZn/1/xX9SmA54Apz1ham37lmLb+bP7U75
	 Rx2aAAOog2xTnu2k2SmVvdqJe4IfaoIgP9vH5WxY=
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Osama Abdelkader <osama.abdelkader@gmail.com>,
	Louis Chauvet <louis.chauvet@bootlin.com>,
	Luca Ceresoli <luca.ceresoli@bootlin.com>
Subject: [PATCH 6.18 213/227] drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind
Date: Wed, 28 Jan 2026 16:24:18 +0100
Message-ID: <20260128145352.099322698@linuxfoundation.org>
X-Mailer: git-send-email 2.52.0
In-Reply-To: <20260128145344.331957407@linuxfoundation.org>
References: <20260128145344.331957407@linuxfoundation.org>
User-Agent: quilt/0.69
X-stable: review
X-Patchwork-Hint: ignore
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-DKIM: signer='linuxfoundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Osama Abdelkader <osama.abdelkader@gmail.com>

commit 1a0f69e3c28477b97d3609569b7e8feb4b6162e8 upstream.

Fix several issues in dw_dp_bind() error handling:

1. Missing return after drm_bridge_attach() failure - the function
   continued execution instead of returning an error.

2. Resource leak: drm_dp_aux_register() is not a devm function, so
   drm_dp_aux_unregister() must be called on all error paths after
   aux registration succeeds. This affects errors from:
   - drm_bridge_attach()
   - phy_init()
   - devm_add_action_or_reset()
   - platform_get_irq()
   - devm_request_threaded_irq()

3. Bug fix: platform_get_irq() returns the IRQ number or a negative
   error code, but the error path was returning ERR_PTR(ret) instead
   of ERR_PTR(dp->irq).

Use a goto label for cleanup to ensure consistent error handling.

Fixes: 86eecc3a9c2e ("drm/bridge: synopsys: Add DW DPTX Controller support library")
Cc: stable@vger.kernel.org

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://patch.msgid.link/20260102155553.13243-1-osama.abdelkader@gmail.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/bridge/synopsys/dw-dp.c |   20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

--- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
@@ -2060,33 +2060,41 @@ struct dw_dp *dw_dp_bind(struct device *
 	}
 
 	ret = drm_bridge_attach(encoder, bridge, NULL, DRM_BRIDGE_ATTACH_NO_CONNECTOR);
-	if (ret)
+	if (ret) {
 		dev_err_probe(dev, ret, "Failed to attach bridge\n");
+		goto unregister_aux;
+	}
 
 	dw_dp_init_hw(dp);
 
 	ret = phy_init(dp->phy);
 	if (ret) {
 		dev_err_probe(dev, ret, "phy init failed\n");
-		return ERR_PTR(ret);
+		goto unregister_aux;
 	}
 
 	ret = devm_add_action_or_reset(dev, dw_dp_phy_exit, dp);
 	if (ret)
-		return ERR_PTR(ret);
+		goto unregister_aux;
 
 	dp->irq = platform_get_irq(pdev, 0);
-	if (dp->irq < 0)
-		return ERR_PTR(ret);
+	if (dp->irq < 0) {
+		ret = dp->irq;
+		goto unregister_aux;
+	}
 
 	ret = devm_request_threaded_irq(dev, dp->irq, NULL, dw_dp_irq,
 					IRQF_ONESHOT, dev_name(dev), dp);
 	if (ret) {
 		dev_err_probe(dev, ret, "failed to request irq\n");
-		return ERR_PTR(ret);
+		goto unregister_aux;
 	}
 
 	return dp;
+
+unregister_aux:
+	drm_dp_aux_unregister(&dp->aux);
+	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(dw_dp_bind);
 




From - Wed Jan 28 16:11:09 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-212619-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id 6I06MRc1emmcrj8AYBR5ng
	(envelope-from <stable+bounces-212619-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:11:03 +0000
Return-path: <stable+bounces-212619-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Wed, 28 Jan 2026 16:11:04 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-212619-hi=josie.lol@vger.kernel.org>)
	id 1vl88F-0000000HWwy-2GTT
	for hi@josie.lol;
	Wed, 28 Jan 2026 16:11:03 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id 70245332A7A2
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:02:19 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 6E03E30C37E;
	Wed, 28 Jan 2026 16:02:08 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="L7pedKUf"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AE7930BBBC;
	Wed, 28 Jan 2026 16:02:08 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769616128; cv=none; b=pPm3+9IHwGSZLq7JaHFZd1X+8PTzA8sn3IpNiNQbvmsWDD63JFfGcVsBHpnb+gdSm2rUYk6OaGVRHjSlkyiaAETKiBmqtL1RXkbLhZ1To+WFRQzt5RAQuqrldXunTOukLPM5pujxce58PWU3KrRIlmQsP+IvvjCKaZcjA6zTnq4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769616128; c=relaxed/simple;
	bh=ZXauBZ7t6zl3/f5DAXVZPeUqNk69NF841fb8gCFK9g4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=nrsmzW25q0GHO3lVXFmpReaerVTRPl9MKjsk2z1b0z/BwK6be/U2kscQWVQBpP6eKG6DQD/WksLc9bR7Wq78Pqg62P5Va+8m8TTOn30Ct7CI/kYLIJAw1xHCtjoSSZ6b4XU0dbYRNgJFgb3+Hn++eJu5cpOK1okUEjQVU4O6Zg8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=L7pedKUf; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1FC8C4CEF1;
	Wed, 28 Jan 2026 16:02:07 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1769616128;
	bh=ZXauBZ7t6zl3/f5DAXVZPeUqNk69NF841fb8gCFK9g4=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=L7pedKUfgYy6HIlft3lADvcSxfM8doljUn3T60i4Dw1tp10Hd2cPV5L7FRvrZ5CdP
	 MkzmSySJussJG7AGvwxtLnY2sMvvY335zUmeaBm+RxIeM2NmRK4EUOvZa62WbpIswk
	 ZAkWwAVMj0OCAALj9dMnzpxMAK+d7uc2iERJFz2M=
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Marco Crivellari <marco.crivellari@suse.com>,
	Matthew Brost <matthew.brost@intel.com>,
	=?UTF-8?q?Thomas=20Hellstr=C3=B6m?= <thomas.hellstrom@linux.intel.com>
Subject: [PATCH 6.18 215/227] drm/xe: fix WQ_MEM_RECLAIM passed as max_active to alloc_workqueue()
Date: Wed, 28 Jan 2026 16:24:20 +0100
Message-ID: <20260128145352.171207120@linuxfoundation.org>
X-Mailer: git-send-email 2.52.0
In-Reply-To: <20260128145344.331957407@linuxfoundation.org>
References: <20260128145344.331957407@linuxfoundation.org>
User-Agent: quilt/0.69
X-stable: review
X-Patchwork-Hint: ignore
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-DKIM: signer='linuxfoundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marco Crivellari <marco.crivellari@suse.com>

commit 6f287b1c8d0e255e94e54116ebbe126515f5c911 upstream.

Workqueue xe-ggtt-wq has been allocated using WQ_MEM_RECLAIM, but
the flag has been passed as 3rd parameter (max_active) instead
of 2nd (flags) creating the workqueue as per-cpu with max_active = 8
(the WQ_MEM_RECLAIM value).

So change this by set WQ_MEM_RECLAIM as the 2nd parameter with a
default max_active.

Fixes: 60df57e496e4 ("drm/xe: Mark GGTT work queue with WQ_MEM_RECLAIM")
Cc: stable@vger.kernel.org
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260108180148.423062-1-marco.crivellari@suse.com
(cherry picked from commit aa39abc08e77d66ebb0c8c9ec4cc8d38ded34dc9)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/xe/xe_ggtt.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/xe/xe_ggtt.c
+++ b/drivers/gpu/drm/xe/xe_ggtt.c
@@ -291,7 +291,7 @@ int xe_ggtt_init_early(struct xe_ggtt *g
 	else
 		ggtt->pt_ops = &xelp_pt_ops;
 
-	ggtt->wq = alloc_workqueue("xe-ggtt-wq", 0, WQ_MEM_RECLAIM);
+	ggtt->wq = alloc_workqueue("xe-ggtt-wq", WQ_MEM_RECLAIM, 0);
 	if (!ggtt->wq)
 		return -ENOMEM;
 




From - Wed Jan 28 16:11:09 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-212620-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id WAslHRg1emno2jwAYBR5ng
	(envelope-from <stable+bounces-212620-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:11:04 +0000
Return-path: <stable+bounces-212620-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Wed, 28 Jan 2026 16:11:04 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-212620-hi=josie.lol@vger.kernel.org>)
	id 1vl88G-0000000HX1a-0yXZ
	for hi@josie.lol;
	Wed, 28 Jan 2026 16:11:04 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id 8466A324E555
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:02:20 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 53722308F05;
	Wed, 28 Jan 2026 16:02:12 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="eeswfm2v"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 304FF306B06;
	Wed, 28 Jan 2026 16:02:12 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769616132; cv=none; b=MM/jou4p/QRYoR+MKIy90i0j5K/wvljocnJPZvSdHBTmCeD/kiJl+HnNFi9cJKQktrnapuMQeKTDKeQoXWge158s5TiRvrAmtuHsoEcOXC0ZGeCWV1nzbQ+2iorNV9GLB6O8ekKFYuf71Jueu43Da4/58tmySC5UGYMu55N69Bo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769616132; c=relaxed/simple;
	bh=70LYdc2L//Uc69cdw5TN+eELvzaAW/qQVlXMEZFDMac=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GArRnwGE+BDIcOqgqQXXHRk7qon4n11XYT84bghCH0rSvRydQNnx9ZyTGykoXvGxAWiVvxCNm7dzqB/iafQQYtoosabnl4L2XJ2NmATF09mZ2yXoYX9b7nJGLTeKEPhtRFwO8TQyfRP31Yetf4xCa0hvd3FnLq/478CndL1lXOY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eeswfm2v; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98BA3C4CEF1;
	Wed, 28 Jan 2026 16:02:11 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1769616132;
	bh=70LYdc2L//Uc69cdw5TN+eELvzaAW/qQVlXMEZFDMac=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=eeswfm2v7j9jsb/ph81kzXwIDLMRR8SE4D+0Kk9qlDdSaPYMAiuLXInvySXylt7BS
	 hgr5IDMCCiBM+0TLvjm0VTVAAHLoeqKt08bhZJ02IrytBgoYfR7Mza20SC6VTp4K+t
	 I+9kUM4PM1dB6SJOApu3fynsYdkC93L2Ek3AoLe8=
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Tzung-Bi Shih <tzungbi@kernel.org>,
	Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Subject: [PATCH 6.18 216/227] gpio: cdev: Correct return code on memory allocation failure
Date: Wed, 28 Jan 2026 16:24:21 +0100
Message-ID: <20260128145352.206534173@linuxfoundation.org>
X-Mailer: git-send-email 2.52.0
In-Reply-To: <20260128145344.331957407@linuxfoundation.org>
References: <20260128145344.331957407@linuxfoundation.org>
User-Agent: quilt/0.69
X-stable: review
X-Patchwork-Hint: ignore
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-DKIM: signer='linuxfoundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tzung-Bi Shih <tzungbi@kernel.org>

commit faff6846474e99295a139997f93ef6db222b5cee upstream.

-ENOMEM is a more appropriate return code for memory allocation
failures.  Correct it.

Cc: stable@vger.kernel.org
Fixes: 20bddcb40b2b ("gpiolib: cdev: replace locking wrappers for gpio_device with guards")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://lore.kernel.org/r/20260116081036.352286-6-tzungbi@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpiolib-cdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -2720,7 +2720,7 @@ static int gpio_chrdev_open(struct inode
 
 	cdev = kzalloc(sizeof(*cdev), GFP_KERNEL);
 	if (!cdev)
-		return -ENODEV;
+		return -ENOMEM;
 
 	cdev->watched_lines = bitmap_zalloc(gdev->ngpio, GFP_KERNEL);
 	if (!cdev->watched_lines)




From - Wed Jan 28 16:11:13 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-212622-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id MJENBBw1eml4gz4AYBR5ng
	(envelope-from <stable+bounces-212622-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:11:08 +0000
Return-path: <stable+bounces-212622-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Wed, 28 Jan 2026 16:11:08 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-212622-hi=josie.lol@vger.kernel.org>)
	id 1vl88J-0000000HX6E-3HaT
	for hi@josie.lol;
	Wed, 28 Jan 2026 16:11:08 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id B687B318BFB1
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:02:22 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 4B5F0286D4B;
	Wed, 28 Jan 2026 16:02:19 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oG2Q8B+w"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 288D5285C8D;
	Wed, 28 Jan 2026 16:02:19 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769616139; cv=none; b=rfVPfny+wMrh+y5J0vj5ITpcj9NE8m3nLkMCSnM8pGjaQYIuLiwllywXfsShWYiMeiaxzDO90r9uKQ9HlHIIkvwyZrYVZ7zj5nhxNGhyfXz2snw9GMDjMxer+z3ENgj+Ujwf/eNmNTP7lK+b5RhnjGgzbjDCZGzDowzrld5+BrY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769616139; c=relaxed/simple;
	bh=ECNYry+I+ctakyeQ1OEUoQKGGou1GNt6pVlU3HU0PrU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ArNdAv1xtH1LEQMV+J9raxS5fE39WV7NGUW05+cztYAu7Be3YWV3R0PXWFokXKZtfVXuLxK4068IwsTAmrilu/ta31qVHByCLfSIHuZJFE4GZQMpIvVGECOU7XTNfQXAylXSeI2XOmz8GfPV5YnqK5DnjcA4NDAu9oyV8RkiWg8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oG2Q8B+w; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BF57C4CEF7;
	Wed, 28 Jan 2026 16:02:18 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1769616139;
	bh=ECNYry+I+ctakyeQ1OEUoQKGGou1GNt6pVlU3HU0PrU=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=oG2Q8B+wqh4QhQX5jqiAhNxRhMwgbQAbC1pNhmmTv4VmqANDzpLOCUMUQbdrwtJPg
	 xUgvg93pBsU0FNLQCT4ySk+luEiQrjx8H8ojL9wja0bbdq2pUwmP8BET9m6NzF2GNr
	 0lNwl1NxPv23T/i3S1mloXZfom3XEmH1wqjmY/T0=
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Tzung-Bi Shih <tzungbi@kernel.org>,
	Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Subject: [PATCH 6.18 218/227] gpio: cdev: Fix resource leaks on errors in gpiolib_cdev_register()
Date: Wed, 28 Jan 2026 16:24:23 +0100
Message-ID: <20260128145352.276855826@linuxfoundation.org>
X-Mailer: git-send-email 2.52.0
In-Reply-To: <20260128145344.331957407@linuxfoundation.org>
References: <20260128145344.331957407@linuxfoundation.org>
User-Agent: quilt/0.69
X-stable: review
X-Patchwork-Hint: ignore
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-DKIM: signer='linuxfoundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tzung-Bi Shih <tzungbi@kernel.org>

commit 8a8c942cad4cd12f739a8bb60cac77fd173c4e07 upstream.

On error handling paths, gpiolib_cdev_register() doesn't free the
allocated resources which results leaks.  Fix it.

Cc: stable@vger.kernel.org
Fixes: 7b9b77a8bba9 ("gpiolib: add a per-gpio_device line state notification workqueue")
Fixes: d83cee3d2bb1 ("gpio: protect the pointer to gpio_chip in gpio_device with SRCU")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://lore.kernel.org/r/20260120092650.2305319-1-tzungbi@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpiolib-cdev.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -2821,13 +2821,18 @@ int gpiolib_cdev_register(struct gpio_de
 		return -ENOMEM;
 
 	ret = cdev_device_add(&gdev->chrdev, &gdev->dev);
-	if (ret)
+	if (ret) {
+		destroy_workqueue(gdev->line_state_wq);
 		return ret;
+	}
 
 	guard(srcu)(&gdev->srcu);
 	gc = srcu_dereference(gdev->chip, &gdev->srcu);
-	if (!gc)
+	if (!gc) {
+		cdev_device_del(&gdev->chrdev, &gdev->dev);
+		destroy_workqueue(gdev->line_state_wq);
 		return -ENODEV;
+	}
 
 	gpiochip_dbg(gc, "added GPIO chardev (%d:%d)\n", MAJOR(devt), gdev->id);
 




From - Wed Jan 28 16:11:49 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-212158-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id WOX6K0E1emnn9DYAYBR5ng
	(envelope-from <stable+bounces-212158-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:11:45 +0000
Return-path: <stable+bounces-212158-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Wed, 28 Jan 2026 16:11:45 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-212158-hi=josie.lol@vger.kernel.org>)
	id 1vl88v-0000000HYFB-1XdZ
	for hi@josie.lol;
	Wed, 28 Jan 2026 16:11:45 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id BB45E3164878
	for <hi@josie.lol>; Wed, 28 Jan 2026 15:36:31 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id BE8C52D6E6A;
	Wed, 28 Jan 2026 15:36:25 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ijHYkxpe"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BF362D6605;
	Wed, 28 Jan 2026 15:36:25 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769614585; cv=none; b=ciqVsX0Iu95HV/sUbd+h9uxMD2cW34cY6tzkp6vOjHQfDXTUc25Q2tt8PGY1M9DX02Jqtf6lYBibMmwmdsmSkOtfD6uKjb40324E7W1dFTm8CfgR30QQ3r1hyKhQBEOQWsRdUMrKd5rfOKHKuFMVkWEnZ4hCMEkZQVPB76DlwiU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769614585; c=relaxed/simple;
	bh=yeB+xjXPmPdIYeyyYTT7PZuG1VqLst+f8XQkIg/Gnx4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=p7VzE4LW36f0Fjhs07FwmIfOmciUvvgaEIsLYethmOQm70T7tZyIYMKZ3XAN8LSwZ6O/jheHfsIWPrUedRnP0L+Wj6ju3TzcVJ5Xn8W10WZSb12TfnHYqJsYEPOq3vM8xC98jWa1+rS1uc9G1VbOQkr/ScWX5IgF4zXrYOwewuU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ijHYkxpe; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF5B2C16AAE;
	Wed, 28 Jan 2026 15:36:24 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1769614585;
	bh=yeB+xjXPmPdIYeyyYTT7PZuG1VqLst+f8XQkIg/Gnx4=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=ijHYkxpe5Sz2uzpanLltiNFMTLgIM1riER2nGt/hFBuFnStMkg84yWKHBGFui3NJI
	 mTE8qO9h7IGbDDufyJOVdMFvum0I9vVMZA521F1nACxlfQ/rdbHadDRCtf1Z7I4qia
	 Fqy8GCEVeOo0cb45rz9E8KKUYgTPFBNrOt1VgOm8=
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	syzbot+5cf914f193dffde3bd3c@syzkaller.appspotmail.com,
	Eric Dumazet <edumazet@google.com>,
	Yotam Gigi <yotam.gi@gmail.com>,
	Jamal Hadi Salim <jhs@mojatatu.com>,
	Jakub Kicinski <kuba@kernel.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.6 182/254] net/sched: act_ife: avoid possible NULL deref
Date: Wed, 28 Jan 2026 16:22:38 +0100
Message-ID: <20260128145351.353445915@linuxfoundation.org>
X-Mailer: git-send-email 2.52.0
In-Reply-To: <20260128145344.698118637@linuxfoundation.org>
References: <20260128145344.698118637@linuxfoundation.org>
User-Agent: quilt/0.69
X-stable: review
X-Patchwork-Hint: ignore
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-DKIM: signer='linuxfoundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 27880b0b0d35ad1c98863d09788254e36f874968 ]

tcf_ife_encode() must make sure ife_encode() does not return NULL.

syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166
CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full)
Call Trace:
 <TASK>
  ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101
  tcf_ife_encode net/sched/act_ife.c:841 [inline]
  tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877
  tc_act include/net/tc_wrapper.h:130 [inline]
  tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152
  tcf_exts_exec include/net/pkt_cls.h:349 [inline]
  mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42
  tc_classify include/net/tc_wrapper.h:197 [inline]
  __tcf_classify net/sched/cls_api.c:1764 [inline]
  tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860
  multiq_classify net/sched/sch_multiq.c:39 [inline]
  multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66
  dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147
  __dev_xmit_skb net/core/dev.c:4262 [inline]
  __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798

Fixes: 295a6e06d21e ("net/sched: act_ife: Change to use ife module")
Reported-by: syzbot+5cf914f193dffde3bd3c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6970d61d.050a0220.706b.0010.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yotam Gigi <yotam.gi@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260121133724.3400020-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/act_ife.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 431921204f660..567a58d30df8d 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -821,6 +821,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
 	/* could be stupid policy setup or mtu config
 	 * so lets be conservative.. */
 	if ((action == TC_ACT_SHOT) || exceed_mtu) {
+drop:
 		qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
 		return TC_ACT_SHOT;
 	}
@@ -829,6 +830,8 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
 		skb_push(skb, skb->dev->hard_header_len);
 
 	ife_meta = ife_encode(skb, metalen);
+	if (!ife_meta)
+		goto drop;
 
 	spin_lock(&ife->tcf_lock);
 
@@ -844,8 +847,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
 		if (err < 0) {
 			/* too corrupt to keep around if overwritten */
 			spin_unlock(&ife->tcf_lock);
-			qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
-			return TC_ACT_SHOT;
+			goto drop;
 		}
 		skboff += err;
 	}
-- 
2.51.0





From - Wed Jan 28 16:12:02 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-212165-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id qHqFOU41emkzPDoAYBR5ng
	(envelope-from <stable+bounces-212165-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Wed, 28 Jan 2026 16:11:58 +0000
Return-path: <stable+bounces-212165-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Wed, 28 Jan 2026 16:11:59 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-212165-hi=josie.lol@vger.kernel.org>)
	id 1vl898-0000000HYes-2wA3
	for hi@josie.lol;
	Wed, 28 Jan 2026 16:11:58 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id EC89A319E91B
	for <hi@josie.lol>; Wed, 28 Jan 2026 15:36:58 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id DCBBE2DB780;
	Wed, 28 Jan 2026 15:36:48 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2J7eIPOK"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id B9AF72DA765;
	Wed, 28 Jan 2026 15:36:48 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1769614608; cv=none; b=liKiYYfOC1hv/iU76YwDk93QBk2OcEWmTDmOj1LybShG1XZ8V01CNksvMGMF0bdl1+LVK48hY8D4TDPxsqknKwg7m7anNfpT6h5t/K6A8jJHDxfKupJZf/gmVYDFsd5l9dR0J4Noc0ZmiNNJKGmlaDsayFKp287SlSxt4KLPBQ0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1769614608; c=relaxed/simple;
	bh=WZF7otD+xN72WQs9ine46MrwsKr2dqKVIdTdCqOkuHY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=gPGhtpfkO4O1Iz5twi7ShDW0SscvLF/JKeHW69BXUMnF6eep5iGN4fsigCMWRfESbO0NqD4UTc6KH9aK2LedKUilEeVdsT1AsPDJc2Fey9ELNeHvmz8ecyLLL4TDWPk+Ydidp/wnjU1EoRUKcjhinnC8Gh+em6zriAO1jheSflA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2J7eIPOK; arc=none smtp.client-ip=10.e (no submodule setup required)\n- Integrated with Eclipse Che via a provided Devfile for simplified workspace development\n- Supports the Roo Code extension with Google Gemini API integration for AI-powered features"}]},"uuid":"9235eefc-4877-491f-acb6-231a8fcf0dce","timestamp":"2026-03-03T15:59:12.167Z"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a89d01fac9987c994"},"toolUseID":"agent_msg_01LaZbcwBNQcmsb4m76XpKpT","parentToolUseID":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","uuid":"f4abefc7-e7bd-45e6-9155-4aa7b6761420","timestamp":"2026-03-03T15:59:12.209Z"}
{"parentUuid":"f4abefc7-e7bd-45e6-9155-4aa7b6761420","isSidechain":false,"userType":"external","cwd":"/home/josie/development/personal/neoche","sessionId":"9303e978-70a2-45c9-8b56-4884f8ec6796","version":"2.1.63","gitBranch":"HEAD","slug":"noble-waddling-lemon","type":"progress","data":{"message":{"type":"assistant","timestamp":"2026-03-03T15:59:15.453Z","message":{"model":"claude-haiku-4-5-20251001","id":"msg_01JmrztaUohLZ9oPsjTfZPiE","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_013vtMK7JA7Xx7Y3JsMrqcg3","name":"WebFetch","input":{"url":"https://github.com/che-incubator/che-code/tree/main/build/scripts/helper","prompt":"Show me what helper scripts exist in the helper directory"},"caller":{"type":"direct"}}],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":0,"cache_creation_input_tokens":521,"cache_read_input_tokens":61898,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":521},"output_tokens":5,"service_tier":"standard","inference_geo":"not_available"},"context_management":null},"requestId":"req_011CYgRYWMUsciQr5Xbimihq","uuid":"88d6cf54-db6e-4307-8957-053e434fe2be"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a89d01fac9987c994"},"toolUseID":"agent_msg_01LaZbcwBNQcmsb4m76XpKpT","parentToolUseID":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","uuid":"ae77722f-9de3-470d-ba0e-c3b2239c036b","timestamp":"2026-03-03T15:59:15.453Z"}
{"parentUuid":"ae77722f-9de3-470d-ba0e-c3b2239c036b","isSidechain":false,"userType":"external","cwd":"/home/josie/development/personal/neoche","sessionId":"9303e978-70a2-45c9-8b56-4884f8ec6796","version":"2.1.63","gitBranch":"HEAD","slug":"noble-waddling-lemon","type":"progress","data":{"message":{"type":"user","message":{"role":"user","content":[{"type":"tool_result","content":"Unable to verify if domain github.com is safe to fetch. This may be due to network restrictions or enterprise security policies blocking claude.ai.","is_error":true,"tool_use_id":"toolu_013vtMK7JA7Xx7Y3JsMrqcg3"}]},"uuid":"e2980829-9f49-4f9f-8d3f-98b27b36d03f","timestamp":"2026-03-03T16:00:21.351Z","toolUseResult":"Error: Unable to verify if domain github.com is safe to fetch. This may be due to network restrictions or enterprise security policies blocking claude.ai."},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a89d01fac9987c994"},"toolUseID":"agent_msg_01LaZbcwBNQcmsb4m76XpKpT","parentToolUseID":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","uuid":"d83acb23-7dcb-42ce-ad0c-25d1178075be","timestamp":"2026-03-03T16:00:21.351Z"}
{"parentUuid":"d83acb23-7dcb-42ce-ad0c-25d1178075be","isSidechain":false,"userType":"external","cwd":"/home/josie/development/personal/neoche","sessionId":"9303e978-70a2-45c9-8b56-4884f8ec6796","version":"2.1.63","gitBranch":"HEAD","slug":"noble-waddling-lemon","type":"progress","data":{"message":{"type":"assistant","timestamp":"2026-03-03T16:00:25.010Z","message":{"model":"claude-haiku-4-5-20251001","id":"msg_01VXyGnCNz4jnXsiJPyikr1E","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_014AK6MMb23Hjs14GJMDzMNq","name":"WebFetch","input":{"url":"https://raw.githubusercontent.com/che-incubator/che-code/main/build/scripts/sshd.start","prompt":"Show me the sshd.start script"},"caller":{"type":"direct"}}],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":1,"cache_creation_input_tokens":205,"cache_read_input_tokens":62419,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":205},"output_tokens":24,"service_tier":"standard","inference_geo":"not_available"},"context_management":null},"requestId":"req_011CYgRddeupBqdbVDnKhj5J","uuid":"727bdb40-7697-409c-8276-ff2109df8f50"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a89d01fac9987c994"},"toolUseID":"agent_msg_01LaZbcwBNQcmsb4m76XpKpT","parentToolUseID":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","uuid":"372d237b-2363-4559-bc2e-20b5db8c2435","timestamp":"2026-03-03T16:00:25.011Z"}
{"parentUuid":"372d237b-2363-4559-bc2e-20b5db8c2435","isSidechain":false,"userType":"external","cwd":"/home/josie/development/personal/neoche","sessionId":"9303e978-70a2-45c9-8b56-4884f8ec6796","version":"2.1.63","gitBranch":"HEAD","slug":"noble-waddling-lemon","type":"progress","data":{"message":{"type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_014AK6MMb23Hjs14GJMDzMNq","type":"tool_result","content":"# sshd.start Script\n\nThis is a bash startup script for configuring and launching SSHD as a non-root user in a container environment. Here are the key sections:\n\n**Initialization:**\n- Detects the OS version (UBI 8, 9, or 10) and sets appropriate library paths with `LD_PRELOAD`\n\n**User Configuration:**\n- Creates wrapper passwd/group files for non-root users (IDs other than 0 and 1001)\n- \"Configure passwd/group files for SSHD\" to enable login shells and home directories\n\n**Environment Setup:**\n- Copies essential tools (tar, gzip, which) to the user's bin directory\n- Exports environment variables to shell profiles\n\n**SSH Host Key Generation:**\n- Generates DSA, RSA (4096-bit), ECDSA, and Ed25519 host keys in `/var/tmp/ssh`\n\n**SSHD Configuration:**\n- Modifies `sshd_config` to use non-standard port 2022, disable strict mode checks, and point to generated host keys\n- Sets up authorized_keys from either an existing key or generates a new Ed25519 client key\n\n**Execution:**\n- Launches SSHD in foreground mode with debug logging to `/tmp/sshd.log`\n\nThe script is designed for container environments where privileged access isn't available."}]},"uuid":"7ecc9e7b-b5be-4088-ac22-a5e342631bed","timestamp":"2026-03-03T16:00:34.744Z"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a89d01fac9987c994"},"toolUseID":"agent_msg_01LaZbcwBNQcmsb4m76XpKpT","parentToolUseID":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","uuid":"d056ddc8-ddd6-47b0-a0fe-8ff5afda2175","timestamp":"2026-03-03T16:00:34.799Z"}
{"parentUuid":"d056ddc8-ddd6-47b0-a0fe-8ff5afda2175","isSidechain":false,"userType":"external","cwd":"/home/josie/development/personal/neoche","sessionId":"9303e978-70a2-45c9-8b56-4884f8ec6796","version":"2.1.63","gitBranch":"HEAD","slug":"noble-waddling-lemon","type":"progress","data":{"type":"hook_progress","hookEvent":"PostToolUse","hookName":"PostToolUse:Agent","command":"python3 ${CLAUDE_PLUGIN_ROOT}/hooks/posttooluse.py"},"parentToolUseID":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","toolUseID":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","timestamp":"2026-03-03T16:01:11.363Z","uuid":"f4b4a131-9789-43b7-a5cb-3c98bf5a2d0d"}
{"parentUuid":"528d8d61-c0d0-43af-8951-ace324490924","isSidechain":false,"userType":"external","cwd":"/home/josie/development/personal/neoche","sessionId":"9303e978-70a2-45c9-8b56-4884f8ec6796","version":"2.1.63","gitBranch":"HEAD","slug":"noble-waddling-lemon","type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01DMN65ezQEYZDpAfbiCAUCQ","type":"tool_result","content":[{"type":"text","text":"Perfect! Now let me compile a comprehensive research report with all the findings. Let me create a summary document:\n\n## Research Report: Che-Code Editor Architecture and Neovim Docker Patterns\n\nBased on my research of the `che-incubator/che-code` and `Lanjelin/nvim-docker` repositories, here are the concrete patterns and architecture you can replicate for a Neovim editor:\n\n---\n\n### 1. CHE-CODE ARCHITECTURE OVERVIEW\n\n**Key Principle**: Multi-stage Docker builds with runtime binary selection based on system C library detection (musl vs glibc/OpenSSL versions).\n\n**Repository Structure**:\n```\nche-code/\n