m/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sabrina Dubroca [ Upstream commit 2a198bbec6913ae1c90ec963750003c6213668c7 ] This reverts commit f75a2804da391571563c4b6b29e7797787332673. With all states (whether user or kern) removed from the hashtables during deletion, there's no need for synchronous destruction of states. xfrm6_tunnel states still need to have been destroyed (which will be the case when its last user is deleted (not destroyed)) so that xfrm6_tunnel_free_spi removes it from the per-netns hashtable before the netns is destroyed. This has the benefit of skipping one synchronize_rcu per state (in __xfrm_state_destroy(sync=true)) when we exit a netns. Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- include/net/xfrm.h | 12 +++--------- net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/xfrm/xfrm_state.c | 23 +++++++++-------------- net/xfrm/xfrm_user.c | 2 +- 5 files changed, 15 insertions(+), 26 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index a8584de9b18b7..411949a66a83c 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -794,7 +794,7 @@ static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) xfrm_pol_put(pols[i]); } -void __xfrm_state_destroy(struct xfrm_state *, bool); +void __xfrm_state_destroy(struct xfrm_state *); static inline void __xfrm_state_put(struct xfrm_state *x) { @@ -804,13 +804,7 @@ static inline void __xfrm_state_put(struct xfrm_state *x) static inline void xfrm_state_put(struct xfrm_state *x) { if (refcount_dec_and_test(&x->refcnt)) - __xfrm_state_destroy(x, false); -} - -static inline void xfrm_state_put_sync(struct xfrm_state *x) -{ - if (refcount_dec_and_test(&x->refcnt)) - __xfrm_state_destroy(x, true); + __xfrm_state_destroy(x); } static inline void xfrm_state_hold(struct xfrm_state *x) @@ -1585,7 +1579,7 @@ struct xfrmk_spdinfo { struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); int xfrm_state_delete(struct xfrm_state *x); -int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync); +int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c index 61ffc01b6c479..70f9540937489 100644 --- a/net/ipv6/xfrm6_tunnel.c +++ b/net/ipv6/xfrm6_tunnel.c @@ -331,7 +331,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net) struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net); unsigned int i; - xfrm_state_flush(net, 0, false, true); + xfrm_state_flush(net, IPSEC_PROTO_ANY, false); xfrm_flush_gc(); for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++) diff --git a/net/key/af_key.c b/net/key/af_key.c index f42854973ba8d..de4606d2eb643 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1770,7 +1770,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_m if (proto == 0) return -EINVAL; - err = xfrm_state_flush(net, proto, true, false); + err = xfrm_state_flush(net, proto, true); err2 = unicast_flush_resp(sk, hdr); if (err || err2) { if (err == -ESRCH) /* empty table - go quietly */ diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 3cd878a25602a..a45d7e1dc5c6f 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -476,7 +476,7 @@ void xfrm_state_free(struct xfrm_state *x) } EXPORT_SYMBOL(xfrm_state_free); -static void ___xfrm_state_destroy(struct xfrm_state *x) +static void xfrm_state_gc_destroy(struct xfrm_state *x) { hrtimer_cancel(&x->mtimer); del_timer_sync(&x->rtimer); @@ -514,7 +514,7 @@ static void xfrm_state_gc_task(struct work_struct *work) synchronize_rcu(); hlist_for_each_entry_safe(x, tmp, &gc_list, gclist) - ___xfrm_state_destroy(x); + xfrm_state_gc_destroy(x); } static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me) @@ -637,19 +637,14 @@ struct xfrm_state *xfrm_state_alloc(struct net *net) } EXPORT_SYMBOL(xfrm_state_alloc); -void __xfrm_state_destroy(struct xfrm_state *x, bool sync) +void __xfrm_state_destroy(struct xfrm_state *x) { WARN_ON(x->km.state != XFRM_STATE_DEAD); - if (sync) { - synchronize_rcu(); - ___xfrm_state_destroy(x); - } else { - spin_lock_bh(&xfrm_state_gc_lock); - hlist_add_head(&x->gclist, &xfrm_state_gc_list); - spin_unlock_bh(&xfrm_state_gc_lock); - schedule_work(&xfrm_state_gc_work); - } + spin_lock_bh(&xfrm_state_gc_lock); + hlist_add_head(&x->gclist, &xfrm_state_gc_list); + spin_unlock_bh(&xfrm_state_gc_lock); + schedule_work(&xfrm_state_gc_work); } EXPORT_SYMBOL(__xfrm_state_destroy); @@ -758,7 +753,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool } #endif -int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync) +int xfrm_state_flush(struct net *net, u8 proto, bool task_valid) { int i, err = 0, cnt = 0; @@ -2707,7 +2702,7 @@ void xfrm_state_fini(struct net *net) unsigned int sz; flush_work(&net->xfrm.state_hash_work); - xfrm_state_flush(net, 0, false, true); + xfrm_state_flush(net, IPSEC_PROTO_ANY, false); flush_work(&xfrm_state_gc_work); WARN_ON(!list_empty(&net->xfrm.state_all)); diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index aa509857b6660..480da22b7ef85 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2111,7 +2111,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, struct xfrm_usersa_flush *p = nlmsg_data(nlh); int err; - err = xfrm_state_flush(net, p->proto, true, false); + err = xfrm_state_flush(net, p->proto, true); if (err) { if (err == -ESRCH) /* empty table */ return 0; -- 2.51.0 From - Thu Jan 15 18:08:03 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id kK+ANf0saWnG/RsAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:07:57 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:07:58 +0000 Received: from tor.lore.kernel.org ([172.105.105.114]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlF-00000008jXP-2lqs for hi@josie.lol; Thu, 15 Jan 2026 18:07:57 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 0AEEB30D69B8 for ; Thu, 15 Jan 2026 18:00:52 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 0A0BD3C198F; Thu, 15 Jan 2026 17:51:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="pZV7cxU+" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DBDC23C0088; Thu, 15 Jan 2026 17:51:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768499487; cv=none; b=mOea3iKOTxauwlDRaEn93gf1cgXH5SzBnclQm8zxQYMRRN5MOXBTn7P1OrsTlXFigQG0eSLCsPOPXXunsFb+89liVhiKAJRrC5T23l1BTHLmbou7qB8coqjSTMPMbzacNRzvvvA4AqufnhZMjjXZ8T9P2GuQxTOzYiTTYL9DHNg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768499487; c=relaxed/simple; bh=bjwyuehjaCY+ndwyUyipBtwu2WV2nsrpizYMligdmPk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=T+d5B1sn7vzacQ9+27IwWGQa/8I8Zk4a9ORmgKNKbmbdkVxMbOXb5fHKXOfKNx9evOH/cN5Nt8g5X2TTKz4mgjeS6l4zmnE5U9I47MNZyH6RA5+2gCdps5uRnTlYF89Gr9nyseWNzHRC1irG1ELT5LNW6kd+HvcplUFKkb4dt/0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pZV7cxU+; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65DFFC19422; Thu, 15 Jan 2026 17:51:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768499487; bh=bjwyuehjaCY+ndwyUyipBtwu2WV2nsrpizYMligdmPk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pZV7cxU+TcP7UZbF7kxhwq3WsJKL/2+CBcuDoKF6DNGW5YPVusWmLkqzATIZs3xNS ax0LDzXmL5S1PvtanVU06x7t8tQ6ryHyNxg3A1O8ekeNYMGRu/TMEC95QX4450gSMf 5i7uGEXTMVFVgVqjuV7ktXb27aVL1bH62tMidlsI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable@kernel.org, Chao Yu , Jaegeuk Kim Subject: [PATCH 5.10 245/451] f2fs: fix return value of f2fs_recover_fsync_data() Date: Thu, 15 Jan 2026 17:47:26 +0100 Message-ID: <20260115164239.755826163@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164230.864985076@linuxfoundation.org> References: <20260115164230.864985076@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.105.105.114 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chao Yu commit 01fba45deaddcce0d0b01c411435d1acf6feab7b upstream. With below scripts, it will trigger panic in f2fs: mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync echo 111 >> /mnt/f2fs/foo f2fs_io fsync /mnt/f2fs/foo f2fs_io shutdown 2 /mnt/f2fs umount /mnt/f2fs mount -o ro,norecovery /dev/vdd /mnt/f2fs or mount -o ro,disable_roll_forward /dev/vdd /mnt/f2fs F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 F2FS-fs (vdd): Mounted with checkpoint version = 7f5c361f F2FS-fs (vdd): Stopped filesystem due to reason: 0 F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 Filesystem f2fs get_tree() didn't set fc->root, returned 1 ------------[ cut here ]------------ kernel BUG at fs/super.c:1761! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 722 Comm: mount Not tainted 6.18.0-rc2+ #721 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:vfs_get_tree.cold+0x18/0x1a Call Trace: fc_mount+0x13/0xa0 path_mount+0x34e/0xc50 __x64_sys_mount+0x121/0x150 do_syscall_64+0x84/0x800 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa6cc126cfe The root cause is we missed to handle error number returned from f2fs_recover_fsync_data() when mounting image w/ ro,norecovery or ro,disable_roll_forward mount option, result in returning a positive error number to vfs_get_tree(), fix it. Cc: stable@kernel.org Fixes: 6781eabba1bd ("f2fs: give -EINVAL for norecovery and rw mount") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman --- fs/f2fs/super.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -3910,11 +3910,15 @@ try_onemore: } } else { err = f2fs_recover_fsync_data(sbi, true); - - if (!f2fs_readonly(sb) && err > 0) { - err = -EINVAL; - f2fs_err(sbi, "Need to recover fsync data"); - goto free_meta; + if (err > 0) { + if (!f2fs_readonly(sb)) { + f2fs_err(sbi, "Need to recover fsync data"); + err = -EINVAL; + goto free_meta; + } else { + f2fs_info(sbi, "drop all fsynced data"); + err = 0; + } } } From - Thu Jan 15 18:08:03 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id SHHPHP4saWnzEh0AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:07:58 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:07:58 +0000 Received: from sin.lore.kernel.org ([104.64.211.4]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlF-00000008jSz-3336 for hi@josie.lol; Thu, 15 Jan 2026 18:07:58 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id AD19630019DF for ; Thu, 15 Jan 2026 17:39:11 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id CF5452C21F4; Thu, 15 Jan 2026 17:39:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="rZDlI8kR" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA49327AC5C; Thu, 15 Jan 2026 17:39:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498749; cv=none; b=HBaCiswpijouj68kn8KQTnRvJRq78jYhM8TPB3aC6zxEwCDIL7DuM6P1uMGQT/51jkfmZEFt6PXAR7yaEFn3C37NdNR/OiLvcg0BdIroxde6CrZNd1UUh/Ar41rt7aV4+XpSgxohPR1aA2IDIPtnaPWnDKGXAH1uLBBrm+KXADQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498749; c=relaxed/simple; bh=3xHGqtTal0thJBjK6VSnkOdW+fHJvakWI/zXIj5oHvg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=H0+ws8bxmvxEMA//SwRk+Z/MyD9uDs2hUYuur3/5m/9Atu6p6UqDbwv7/PRVnPN+4RVLNJdTIbYGy3UgD/NvaFf9NmZGHptA+ZNnO+wi2NVObkF88wFp/XWoGMvf+CPrpH61u81ny+xfWj/SkQX0CLjAM4MbtmOYoFRQGM0wq7s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rZDlI8kR; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id D79C9C116D0; Thu, 15 Jan 2026 17:39:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768498749; bh=3xHGqtTal0thJBjK6VSnkOdW+fHJvakWI/zXIj5oHvg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rZDlI8kRsSeCY/hjlrC58MNZcsZ11yFZ/PxwE6tHOo3RwMPZaIXT/gI+0kg3+onZx +y+jvSBcfBAebF3XDDpWp3WehggmZuMRciSg0sSIW/4oDF8l7VHTWJF194NkdnV2In nIqBAekHyxsUksRgynTT8sImIgu9DxlZ+cSq8PlM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+58b44a770a1585795351@syzkaller.appspotmail.com, Eric Dumazet , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 541/554] arp: do not assume dev_hard_header() does not change skb->head Date: Thu, 15 Jan 2026 17:50:07 +0100 Message-ID: <20260115164305.907390409@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164246.225995385@linuxfoundation.org> References: <20260115164246.225995385@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: msgid.link] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [104.64.211.4 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ] arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call. Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv4/arp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index ef69321886798..5a76164980344 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -542,7 +542,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, skb_reserve(skb, hlen); skb_reset_network_header(skb); - arp = skb_put(skb, arp_hdr_len(dev)); + skb_put(skb, arp_hdr_len(dev)); skb->dev = dev; skb->protocol = htons(ETH_P_ARP); if (!src_hw) @@ -550,12 +550,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, if (!dest_hw) dest_hw = dev->broadcast; - /* - * Fill the device header for the ARP frame + /* Fill the device header for the ARP frame. + * Note: skb->head can be changed. */ if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0) goto out; + arp = arp_hdr(skb); /* * Fill out the arp protocol part. * -- 2.51.0 From - Thu Jan 15 18:08:06 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id WCnlEQAtaWnFsh8AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:00 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:00 +0000 Received: from sto.lore.kernel.org ([172.232.135.74]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlH-00000008jZW-3ZQA for hi@josie.lol; Thu, 15 Jan 2026 18:08:00 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id 7F61E3053138 for ; Thu, 15 Jan 2026 18:01:04 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 3F8393D3D03; Thu, 15 Jan 2026 17:51:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="F7rsN0CH" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1BF923C0085; Thu, 15 Jan 2026 17:51:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768499505; cv=none; b=r26cQzmVd5gkPfq0zYGPVh0AMGWyYrhXlozZAjZ6FY+f3nHyPJUCmN2G9k6tyIY5OHKuidBoBfd9l9opRC7QuzK2FfILd7zmmpjzMP4ZpD8pI/dvJ7Ly/ZA+UlslF8FFqRrEGqo3U5totq1dGMjTRZ823LcNIjbUP/zZGXqB7/A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768499505; c=relaxed/simple; bh=7tcD0KYnNm8+UTDMPga3Kecx/9opHoCk+/gb+WUAb/Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tuT/5zOqDO5nmPigFWbig4zShNGqVuwa00NBlyc7GAHDIIR7xVKBvdbNCqdthDxfuO4gIk/+4kwAgP3NPumEiMMUWIswwGr0gLxryniBn9GOc5aOaReoH2YMYYm4eWZxhAatrbf+M86HxPTxbvtYgP+cu3WTVSDM9RZLUXauoBg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=F7rsN0CH; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B7C9C116D0; Thu, 15 Jan 2026 17:51:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768499504; bh=7tcD0KYnNm8+UTDMPga3Kecx/9opHoCk+/gb+WUAb/Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F7rsN0CHSBc3afsaexF3XY+TeYf9VQxYmB60mjqf1h9hiGdS2JQWnnvCwz0bPLD83 N7KNOqKdVyzmYoSd9fqwtH6hl7wluL7DN5XvAdTtDwwx04D/8nRlk2Bu50tR3xlYYT e1VUPMD8xQrFJl70gul4micyY4/jNbtJ8K7Ui3Lk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Ma Ke Subject: [PATCH 5.10 233/451] USB: lpc32xx_udc: Fix error handling in probe Date: Thu, 15 Jan 2026 17:47:14 +0100 Message-ID: <20260115164239.324759125@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164230.864985076@linuxfoundation.org> References: <20260115164230.864985076@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ma Ke commit c84117912bddd9e5d87e68daf182410c98181407 upstream. lpc32xx_udc_probe() acquires an i2c_client reference through isp1301_get_client() but fails to release it in both error handling paths and the normal removal path. This could result in a reference count leak for the I2C device, preventing proper cleanup and potentially leading to resource exhaustion. Add put_device() to release the reference in the probe failure path and in the remove function. Calling path: isp1301_get_client() -> of_find_i2c_device_by_node() -> i2c_find_device_by_fwnode(). As comments of i2c_find_device_by_fwnode() says, 'The user must call put_device(&client->dev) once done with the i2c client.' Found by code review. Cc: stable Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx") Signed-off-by: Ma Ke Link: https://patch.msgid.link/20251215020931.15324-1-make24@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/udc/lpc32xx_udc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) --- a/drivers/usb/gadget/udc/lpc32xx_udc.c +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c @@ -3026,7 +3026,7 @@ static int lpc32xx_udc_probe(struct plat pdev->dev.dma_mask = &lpc32xx_usbd_dmamask; retval = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); if (retval) - return retval; + goto i2c_fail; udc->board = &lpc32xx_usbddata; @@ -3044,28 +3044,32 @@ static int lpc32xx_udc_probe(struct plat /* Get IRQs */ for (i = 0; i < 4; i++) { udc->udp_irq[i] = platform_get_irq(pdev, i); - if (udc->udp_irq[i] < 0) - return udc->udp_irq[i]; + if (udc->udp_irq[i] < 0) { + retval = udc->udp_irq[i]; + goto i2c_fail; + } } udc->udp_baseaddr = devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(udc->udp_baseaddr)) { dev_err(udc->dev, "IO map failure\n"); - return PTR_ERR(udc->udp_baseaddr); + retval = PTR_ERR(udc->udp_baseaddr); + goto i2c_fail; } /* Get USB device clock */ udc->usb_slv_clk = devm_clk_get(&pdev->dev, NULL); if (IS_ERR(udc->usb_slv_clk)) { dev_err(udc->dev, "failed to acquire USB device clock\n"); - return PTR_ERR(udc->usb_slv_clk); + retval = PTR_ERR(udc->usb_slv_clk); + goto i2c_fail; } /* Enable USB device clock */ retval = clk_prepare_enable(udc->usb_slv_clk); if (retval < 0) { dev_err(udc->dev, "failed to start USB device clock\n"); - return retval; + goto i2c_fail; } /* Setup deferred workqueue data */ @@ -3167,6 +3171,8 @@ dma_alloc_fail: dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, udc->udca_v_base, udc->udca_p_base); i2c_fail: + if (udc->isp1301_i2c_client) + put_device(&udc->isp1301_i2c_client->dev); clk_disable_unprepare(udc->usb_slv_clk); dev_err(udc->dev, "%s probe failed, %d\n", driver_name, retval); @@ -3192,6 +3198,9 @@ static int lpc32xx_udc_remove(struct pla dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, udc->udca_v_base, udc->udca_p_base); + if (udc->isp1301_i2c_client) + put_device(&udc->isp1301_i2c_client->dev); + clk_disable_unprepare(udc->usb_slv_clk); return 0; From - Thu Jan 15 18:08:06 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id aIn3AgEtaWm7whwAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:01 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:01 +0000 Received: from sin.lore.kernel.org ([104.64.211.4]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlH-00000008jYq-44Mj for hi@josie.lol; Thu, 15 Jan 2026 18:08:01 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id A4BD7308D7E7 for ; Thu, 15 Jan 2026 17:39:12 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 4C1BD2749DF; Thu, 15 Jan 2026 17:39:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ryCnnF8g" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2903986334; Thu, 15 Jan 2026 17:39:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498752; cv=none; b=JKs29c7ZiRRuzPMu8vQ+FoGL3FjbV23JbiE/Lm+aXz9XCTnxkvODQJ+Ckv3FCViySARqdZW358OtO60qbYor3/Y1QRqOdOE8xyk/PYEzGKLYh5c/TebCITlbq2BUnbGpKdBbtFCevJ0gRWweWYEdzNX8KCjcn1WBRQ7c8I+NHJA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498752; c=relaxed/simple; bh=v36icPnHLlt1mgM+Yncit7Sy/pCDMRiXQA+ufVRNtLI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MtvbF0oEU8jTN1t5KeqDdJhJmm3KbjsYJ0IaTFKrvE35cR3XhCfzb9Shbd1KeO59jMULjF0P0hWf+9t7K94UeEEnX9soH/jo5X/mO/BfOZW3MI55oCC6EAGOomyN1eA5UpqYmreBaVjZzhwEBNQmZhi0tma8fkmKNM7ieWNL3HA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ryCnnF8g; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC956C116D0; Thu, 15 Jan 2026 17:39:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768498752; bh=v36icPnHLlt1mgM+Yncit7Sy/pCDMRiXQA+ufVRNtLI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ryCnnF8g9KOLFmKyWPjwgkf4c8c+y2shZQJH0tBRenb/hoRVCtk8QeYuTWbNtGCrJ Gr/Eqnxm3R9SjcugC+/RWbpg5n6WTHfp+00AB/iwZ/6ljZJCbDRc/61BzjuYMklNz6 UEMJRVE15k82mKxwDu1ceamzf2Cd2pW3HrdES9pk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Chen Hanxiao , Jeff Layton , Chuck Lever , Sasha Levin Subject: [PATCH 5.15 542/554] NFS: trace: show TIMEDOUT instead of 0x6e Date: Thu, 15 Jan 2026 17:50:08 +0100 Message-ID: <20260115164305.942970814@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164246.225995385@linuxfoundation.org> References: <20260115164246.225995385@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [104.64.211.4 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chen Hanxiao [ Upstream commit cef48236dfe55fa266d505e8a497963a7bc5ef2a ] __nfs_revalidate_inode may return ETIMEDOUT. print symbol of ETIMEDOUT in nfs trace: before: cat-5191 [005] 119.331127: nfs_revalidate_inode_exit: error=-110 (0x6e) after: cat-1738 [004] 44.365509: nfs_revalidate_inode_exit: error=-110 (TIMEDOUT) Signed-off-by: Chen Hanxiao Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Stable-dep-of: c6c209ceb87f ("NFSD: Remove NFSERR_EAGAIN") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- include/trace/misc/nfs.h | 1 + 1 file changed, 1 insertion(+) --- a/include/trace/misc/nfs.h +++ b/include/trace/misc/nfs.h @@ -52,6 +52,7 @@ TRACE_DEFINE_ENUM(NFSERR_JUKEBOX); { NFSERR_IO, "IO" }, \ { NFSERR_NXIO, "NXIO" }, \ { ECHILD, "CHILD" }, \ + { ETIMEDOUT, "TIMEDOUT" }, \ { NFSERR_EAGAIN, "AGAIN" }, \ { NFSERR_ACCES, "ACCES" }, \ { NFSERR_EXIST, "EXIST" }, \ From - Thu Jan 15 18:08:21 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id qK8gNxAtaWnSxR4AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:16 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:17 +0000 Received: from sin.lore.kernel.org ([104.64.211.4]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlY-00000008k4r-0r4I for hi@josie.lol; Thu, 15 Jan 2026 18:08:16 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id DFAFD309D364 for ; Thu, 15 Jan 2026 17:40:55 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 935CB3A7F5D; Thu, 15 Jan 2026 17:40:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QGkhIzoL" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F6ED3A0E9A; Thu, 15 Jan 2026 17:40:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498850; cv=none; b=sVLJqjcjS7giU/rGlwv74HsThIbAEMa8RJgQu3WAjzAPFQj1ZBAQ2QvLyRiHtylHmY+Htxukl60bVUMwBKuPbWK2eZaiRYMwIBoHuJWBArHUE+1XqN+IHYjrLgQ/oMIGvgmq7kMdqSR9uJ7tl8eQVjWJ61BqTn3aoKH5VQWkSAo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498850; c=relaxed/simple; bh=S79HGThcbZ75zQqgvzvT6b3wCG5FjL88d5RFfSfvdns=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ci4eTOd5nTcrAJ4oCGUWe5y+dQevaOM/wfXRDzTF5aj3+6wI2JuSfoWz248+OWYIf+QJWN5AcPC4CSU1SS9Og0eCMKAnyXLBYeCoUIjDFel1xlJA7LFkSU672gngxPPqDBcB+Y0wZ1yun3b57leFMxIoNxS3ldoezuVLDLkI0NQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QGkhIzoL; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6883C116D0; Thu, 15 Jan 2026 17:40:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768498850; bh=S79HGThcbZ75zQqgvzvT6b3wCG5FjL88d5RFfSfvdns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QGkhIzoLHM544Pngzs3bBXxIBJCQjiqDpoWDZfpogeE4EuTBTOJX903hdLq7cQivi 3sF0OK5ZYww6OYg/m4BL6JIg64OUD4lHyqig63dACyvDloF8Vu8qhr5ZlSIXGmLLgL dOGHwWzBpVKzg/4eBeFM2kZVZc5WDji0gtqz2hNg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+f3185be57d7e8dda32b8@syzkaller.appspotmail.com, stable@kernel.org, Deepanshu Kartikey , Theodore Tso Subject: [PATCH 5.10 007/451] ext4: refresh inline data size before write operations Date: Thu, 15 Jan 2026 17:43:28 +0100 Message-ID: <20260115164231.146038957@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164230.864985076@linuxfoundation.org> References: <20260115164230.864985076@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [104.64.211.4 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Deepanshu Kartikey commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b upstream. The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue. Reported-by: syzbot+f3185be57d7e8dda32b8@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8 Cc: stable@kernel.org Signed-off-by: Deepanshu Kartikey Message-ID: <20251020060936.474314-1-kartikey406@gmail.com> Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -410,7 +410,12 @@ static int ext4_prepare_inline_data(hand return -ENOSPC; ext4_write_lock_xattr(inode, &no_expand); - + /* + * ei->i_inline_size may have changed since the initial check + * if other xattrs were added. Recalculate to ensure + * ext4_update_inline_data() validates against current capacity. + */ + (void) ext4_find_inline_data_nolock(inode); if (ei->i_inline_off) ret = ext4_update_inline_data(handle, inode, len); else From - Thu Jan 15 18:08:25 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id YJglChQtaWmNYB0AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:20 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:20 +0000 Received: from sin.lore.kernel.org ([104.64.211.4]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlZ-00000008k9Q-2dVn for hi@josie.lol; Thu, 15 Jan 2026 18:08:19 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id 7DBBF30ECDBD for ; Thu, 15 Jan 2026 17:41:04 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 4DBE42D9488; Thu, 15 Jan 2026 17:40:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PaozZRSa" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1646B2D595B; Thu, 15 Jan 2026 17:40:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498859; cv=none; b=CbCDWLHkiS7LGf4ITqJvKDwCOsaB51sKdLyD+5ev6RcvThWmKPMC87arSznnojF/cfxzIxKDqQjlvt1YYp68e1drXghJ/i9VOM+GRwlR+OSy9JrFhLmlrss5PD0U/Qj/2Wgw4IVPKvMIbuaO5gken65lcQlJnb8/ae7q0YHFbrc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498859; c=relaxed/simple; bh=XrXvacDROq+4KPbbjlSqlynRLG7MhY7DQ59KNbIAsD4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=C4RS1FjBFHo/5QhTuNmlL6h+BFK94+zW5uxvlmyXK8lKbHH5UTI69ZvY2sofgJirmHnBf9VjT39pqEn8LM/x09fiOPYTA+CBZKMKm6cC5RWviRNhmLBTGo6bG5AkjTUSJ9n85VuZ6mNj1Oy7QGuaUI8GeaUAPILxOA0WS3NgfDo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PaozZRSa; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C347C116D0; Thu, 15 Jan 2026 17:40:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768498858; bh=XrXvacDROq+4KPbbjlSqlynRLG7MhY7DQ59KNbIAsD4=; h=From:To:Cc:Subject:Date:From; b=PaozZRSaPupDMQ0f6ervEQsdn5kGG1xOWeHve7Gvy/w2fqv3f6+tKRu1gZNcbfLRi vSRt2+XWfrtobgpZfXaJ5a86nI4PrlQ8y3yL85PJYdI99igBvScjZquxCstf0jXB5g OZbxV6nlWS47mWwooahhaLs9DZZG14L5pGaYJBMQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org, lkft-triage@lists.linaro.org, pavel@denx.de, jonathanh@nvidia.com, f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, rwarsow@gmx.de, conor@kernel.org, hargar@microsoft.com, broonie@kernel.org, achill@achill.org, sr@sladewatkins.com Subject: [PATCH 5.10 000/451] 5.10.248-rc1 review Date: Thu, 15 Jan 2026 17:43:21 +0100 Message-ID: <20260115164230.864985076@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.248-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-5.10.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 5.10.248-rc1 X-KernelTest-Deadline: 2026-01-17T16:42+00:00 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [104.64.211.4 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 This is the start of the stable review cycle for the 5.10.248 release. There are 451 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.248-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 5.10.248-rc1 Michal Rábek scsi: sg: Fix occasional bogus elapsed time that exceeds timeout Alexander Stein ASoC: fsl_sai: Add missing registers to cache default Tetsuo Handa can: j1939: make j1939_session_activate() fail if device is no longer registered Sumeet Pawnikar powercap: fix sscanf() error return value handling Sumeet Pawnikar powercap: fix race condition in register_control_type() NeilBrown nfsd: provide locking for v4_end_grace Laibin Qiu blk-throttle: Set BIO_THROTTLED when bio has been throttled Eric Dumazet arp: do not assume dev_hard_header() does not change skb->head Petko Manolov net: usb: pegasus: fix memory leak in update_eth_regs_async() Xiang Mei net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset René Rebe HID: quirks: work around VID/PID conflict for appledisplay Srijit Bose bnxt_en: Fix potential data corruption with HW GRO/LRO Jakub Kicinski eth: bnxt: move and rename reset helpers Gal Pressman net/mlx5e: Don't print error message due to invalid module Di Zhu netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates Weiming Shi net: sock: fix hardened usercopy panic in sock_recv_errqueue yuan.gao inet: ping: Fix icmp out counting Alexandre Knecht bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress Fernando Fernandez Mancera netfilter: nf_conncount: update last_gc only when GC has been performed Fernando Fernandez Mancera netfilter: nft_synproxy: avoid possible data-race on update operation Ian Ray ARM: dts: imx6q-ba16: fix RTC interrupt level Xingui Yang scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" Wen Xiong scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset Trond Myklebust NFS: Fix up the automount fs_context to use the correct cred Scott Mayhew NFSv4: ensure the open stateid seqid doesn't go backwards Sam James alpha: don't reference obsolete termio struct for TC* constants Sebastian Andrzej Siewior ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels Jakub Sitnicki bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself Kuniyuki Iwashima tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Tariq Toukan net: netdevice: Add operation ndo_sk_get_lower_dev Sharath Chandra Vurukala net: Add locking to protect skb->dev access in ip_output Ye Bin ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() Ye Bin ext4: introduce ITAIL helper Ilya Dryomov libceph: make calc_target() set t->paused, not just clear it Tuo Li libceph: make free_choose_arg_map() resilient to partial allocation Ilya Dryomov libceph: replace overzealous BUG_ON in osdmap_apply_incremental() Eric Dumazet wifi: avoid kernel-infoleak from struct iw_point Miaoqian Lin drm/pl111: Fix error handling in pl111_amba_probe Eric Biggers lib/crypto: aes: Fix missing MMU protection for AES S-box Alexander Usyskin mei: me: add nova lake point S DID Thomas Fourier net: 3com: 3c59x: fix possible null dereference in vortex_probe1() Thomas Fourier atm: Fix dma_free_coherent() size Johan Hovold usb: gadget: lpc32xx_udc: fix clock imbalance in error path Su Hui net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() Sanjeev Yadav scsi: core: ufs: Fix a hang in the error handler Greg Kroah-Hartman Revert "iommu/amd: Skip enabling command/event buffers for kdump" Sean Nyekjaer pwm: stm32: Always program polarity Christian Hitz leds: leds-lp50xx: Enable chip before any communication Uwe Kleine-König leds: lp50xx: Remove duplicated error reporting in .remove() Andy Shevchenko leds: lp50xx: Get rid of redundant check in lp50xx_enable_disable() Andy Shevchenko leds: lp50xx: Reduce level of dereferences Shin'ichiro Kawasaki bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() Josef Bacik btrfs: do not clean up repair bio if submit fails Kees Cook ovl: Use "buf" flexible array for memcpy() destination Henry Martin cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() Mike Christie scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Mike Christie scsi: iscsi: Move pool freeing Peter Xu mm/mprotect: use long for page accountings and retval Chuck Lever NFSD: NFSv4 file creation neglects setting ACL Jouni Malinen wifi: mac80211: Discard Beacon frames to non-broadcast address Thomas Zimmermann drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() NeilBrown lockd: fix vfs_test_lock() calls Marek Szyprowski media: samsung: exynos4-is: fix potential ABBA deadlock on init Johan Hovold media: vpif_capture: fix section mismatch Haoxiang Li media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() David Hildenbrand powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages David Hildenbrand mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() David Hildenbrand mm/balloon_compaction: we cannot have isolated pages in the balloon list Miaohe Lin mm/balloon_compaction: make balloon page compaction callbacks static Johan Hovold ASoC: stm32: sai: fix clk prepare imbalance on probe failure Christophe JAILLET ASoC: stm32: sai: Use the devm_clk_get_optional() helper Kuninori Morimoto ASoC: stm: Use dev_err_probe() helper Miaoqian Lin media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled David Hildenbrand powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION Jim Quinlan PCI: brcmstb: Fix disabling L0s capability Donet Tom powerpc/64s/slb: Fix SLB multihit issue during SLB preload Johan Hovold iommu/qcom: fix device leak on of_xlate() Nicolas Ferre ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 Shivani Agarwal crypto: af_alg - zero initialize memory allocated via sock_kmalloc Gui-Dong Han hwmon: (max16065) Use local variable to avoid TOCTOU Guenter Roeck hwmon: replace snprintf in show functions with sysfs_emit Joshua Rogers SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf Chuck Lever NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap Jarkko Sakkinen tpm: Cap the number of PCR banks Ye Bin jbd2: fix the inconsistency between checksum and data in memory for journal sb Johan Hovold usb: ohci-nxp: fix device leak on probe failure Zhang Zekun usb: ohci-nxp: Use helper function devm_clk_get_enabled() Matthieu Baerts (NGI0) mptcp: pm: ignore unknown endpoint flags Udipto Goswami usb: dwc3: keep susphy enabled during exit to avoid controller faults Chao Yu f2fs: fix to avoid updating zero-sized extent in extent cache Chao Yu f2fs: fix to propagate error from f2fs_enable_checkpoint() Chao Yu f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() Chao Yu f2fs: use global inline_xattr_slab instead of per-sb slab cache Haoxiang Li xfs: fix a memory leak in xfs_buf_item_init() Josef Bacik btrfs: don't rewrite ret from inode_permission Fedor Pchelkin ext4: fix string copying in parse_apply_sb_mount_options() Junrui Luo ALSA: wavefront: Fix integer overflow in sample size validation Junrui Luo ALSA: wavefront: Clear substream pointers on close Kees Cook net/mlx5e: Avoid field-overflowing memcpy() Jimmy Hu usb: gadget: udc: fix use-after-free in usb_gadget_state_work Łukasz Bartosik xhci: dbgtty: fix device unregister Alan Stern HID: core: Harden s32ton() against conversion to 0 bits Shigeru Yoshida ipv4: Fix uninit-value access in __ip_make_skb() Shigeru Yoshida ipv6: Fix potential uninit-value access in __ip6_make_skb() Michal Pecio usb: xhci: Apply the link chain quirk on NEC isoc endpoints Niklas Neronin usb: xhci: move link chain bit quirk checks into one helper function. Zack Rusin drm/vmwgfx: Fix a null-ptr access in the cursor snooper Peilin Ye fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount Peilin Ye parisc/sticore: Avoid hard-coding built-in font charcount Peilin Ye Fonts: Add charcount field to font_desc Peilin Ye console: Delete dummy con_font_set() and con_font_default() callback implementations Peilin Ye console: Delete unused con_font_copy() callback implementations Maximilian Immanuel Brandtner virtio_console: fix order of fields cols and rows Zhu Yanjun RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Lyude Paul drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb Akhil P Oommen drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers Xiaolei Wang net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() Deepanshu Kartikey net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write Ethan Nelson-Moore net: usb: sr9700: fix incorrect command used to write single register Haoxiang Li nfsd: Drop the client reference in client_states_open() Haoxiang Li fjes: Add missing iounmap in fjes_hw_init() Guangshuo Li e1000: fix OOB in e1000_tbi_should_accept() Jason Gunthorpe RDMA/cm: Fix leaking the multicast GID table reference Jason Gunthorpe RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly Matthew Wilcox (Oracle) idr: fix idr_alloc() returning an ID out of range Duoming Zhou media: i2c: adv7842: Remove redundant cancel_delayed_work in probe Duoming Zhou media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe Duoming Zhou media: TDA1997x: Remove redundant cancel_delayed_work in probe Ivan Abramov media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() Haotian Zhang media: cec: Fix debugfs leak on bus_register() failure René Rebe fbdev: tcx.c fix mem_map to correct smem_start offset Thorsten Blum fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing Rene Rebe fbdev: gbefb: fix to use physical address instead of dma address Uladzislau Rezki (Sony) dm-ebs: Mark full buffer dirty even on partial write Ivan Abramov media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() Sven Schnelle parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() Sven Schnelle parisc: entry.S: fix space adjustment on interruption for 64-bit userspace Haotian Zhang media: rc: st_rc: Fix reset control resource leak Krzysztof Kozlowski mfd: max77620: Fix potential IRQ chip conflict when probing two devices Johan Hovold mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup Christian Hitz leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs Christian Hitz leds: leds-lp50xx: Allow LED 0 to be added to module bank Lukas Wunner PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths Hans de Goede HID: logitech-dj: Remove duplicate error logging Johan Hovold iommu/sun50i: fix device leak on of_xlate() Johan Hovold iommu/omap: fix device leaks on probe_device() Johan Hovold iommu/mediatek: fix device leak on of_xlate() Johan Hovold iommu/mediatek-v1: fix device leak on probe_device() Johan Hovold iommu/ipmmu-vmsa: fix device leak on of_xlate() Johan Hovold iommu/exynos: fix device leak on of_xlate() Srinivas Kandagatla ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. Srinivas Kandagatla ASoC: qcom: q6adm: the the copp device only during last instance Srinivas Kandagatla ASoC: qcom: q6asm-dai: perform correct state check before closing Johan Hovold ASoC: stm32: sai: fix device leak on probe Yipeng Zou selftests/ftrace: traceonoff_triggers: strip off names Thomas Fourier RDMA/bnxt_re: fix dma_free_coherent() pointer Kalesh AP RDMA/bnxt_re: Fix to use correct page size for PDE table Alok Tiwari RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send Alok Tiwari RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() Jang Ingyu RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() Michael Margolin RDMA/efa: Remove possible negative shift Pwnverse net: rose: fix invalid array index in rose_kill_by_device() Ido Schimmel ipv4: Fix reference count leak when using error routes with nexthop objects Will Rosenberg ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() Anshumali Gaur octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" Bagas Sanjaya net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct Jonas Gorski net: dsa: b53: skip multicast entries for fdb_dump() Thomas Fourier firewire: nosy: Fix dma_free_coherent() size Christophe JAILLET firewire: nosy: switch from 'pci_' to 'dma_' API Andrew Morton genalloc.h: fix htmldocs warning Deepakkumar Karn net: usb: rtl8150: fix memory leak on usb_submit_urb() failure Jiri Pirko team: fix check for port enabled in team_queue_override_port_prio_changed() Junrui Luo platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic Thomas Fourier platform/x86: msi-laptop: add missing sysfs_remove_group() Eric Dumazet ip6_gre: make ip6gre_header() robust Toke Høiland-Jørgensen net: openvswitch: Avoid needlessly taking the RTNL on vport destroy Jacky Chou net: mdio: aspeed: add dummy read to avoid read-after-write issue Potin Lai net: mdio: aspeed: move reg accessing part into separate functions Herbert Xu crypto: seqiv - Do not use req->iv after crypto_aead_encrypt Kohei Enju iavf: fix off-by-one issues in iavf_config_rss_reg() Przemyslaw Korba i40e: fix scheduling in set_rx_mode Gui-Dong Han hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU Gui-Dong Han hwmon: (w83791d) Convert macros to functions to avoid TOCTOU Ma Ke i2c: amd-mp2: fix reference leak in MP2 PCI device Srinivas Kandagatla rpmsg: glink: fix rpmsg device leak Johan Hovold soc: amlogic: canvas: fix device leak on lookup Johan Hovold soc: qcom: ocmem: fix device leak on lookup Johan Hovold amba: tegra-ahb: Fix device leak on SMMU enable Alex Deucher drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() Prithvi Tambewagh io_uring: fix filename leak in __io_openat_prep() Andy Shevchenko nfsd: Mark variable __maybe_unused to avoid W=1 build break Amir Goldstein fsnotify: do not generate ACCESS/MODIFY events on child for special files Rafael J. Wysocki PM: runtime: Do not clear needs_force_resume with enabled runtime PM Steven Rostedt tracing: Do not register unsupported perf events Sean Christopherson KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) Yosry Ahmed KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation fuqiang wang KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer fuqiang wang KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() Sean Christopherson KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 Ilya Dryomov libceph: make decode_pool() more resilient against corrupted osdmaps Helge Deller parisc: Do not reprogram affinitiy on ASP chip Zhichi Lin scs: fix a wrong parameter in __scs_magic Tzung-Bi Shih platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver Prithvi Tambewagh ocfs2: fix kernel BUG in ocfs2_find_victim_chain Jeongjun Park media: vidtv: initialize local pointers upon transfer of memory ownership Alison Schofield tools/testing/nvdimm: Use per-DIMM device handle Chao Yu f2fs: fix return value of f2fs_recover_fsync_data() Deepanshu Kartikey f2fs: invalidate dentry cache on failed whiteout creation Andrey Vatoropin scsi: target: Reset t_task_cdb pointer in error case Dai Ngo NFSD: use correct reservation type in nfsd4_scsi_fence_client Junrui Luo scsi: aic94xx: fix use-after-free in device removal path Tony Battersby scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" Miaoqian Lin cpufreq: nforce2: fix reference count leak in nforce2 Ma Ke intel_th: Fix error handling in intel_th_output_open Tianchu Chen char: applicom: fix NULL pointer dereference in ac_ioctl Haoxiang Li usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() Miaoqian Lin usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe Duoming Zhou usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal Ma Ke USB: lpc32xx_udc: Fix error handling in probe Johan Hovold phy: broadcom: bcm63xx-usbh: fix section mismatches Colin Ian King media: pvrusb2: Fix incorrect variable used in trace message Jeongjun Park media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() Chen Changcheng usb: usb-storage: Maintain minimal modifications to the bcdDevice range. Laurent Pinchart media: v4l2-mem2mem: Fix outdated documentation Byungchul Park jbd2: use a weaker annotation in journal handling Yongjian Sun ext4: fix incorrect group number assertion in mb_check_buddy Karina Yankevich ext4: xattr: fix null pointer deref in ext4_raw_inode() Steven Rostedt ktest.pl: Fix uninitialized var in config-bisect.pl Rene Rebe floppy: fix for PAGE_SIZE != 4KB Eric Biggers lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit Stefano Garzarella vhost/vsock: improve RCU read sections around vhost_vsock_get() Dan Carpenter block: rnbd-clt: Fix signedness bug in init_dev() Daniel Wagner nvme-fc: don't hold rport lock when putting ctrl Wenhua Lin serial: sprd: Return -EPROBE_DEFER when uart clock is not ready Chen Changcheng usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. Hongyu Xie usb: xhci: limit run_graceperiod for only usb 3.0 devices Mark Pearson usb: typec: ucsi: Handle incorrect num_connectors capability Lizhi Xu usbip: Fix locking bug in RT-enabled kernels Yuezhang Mo exfat: fix remount failure in different process environments Encrow Thorne reset: fix BIT macro reference Li Qiang via_wdt: fix critical boot hang due to unnamed resource allocation Tony Battersby scsi: qla2xxx: Use reinit_completion on mbx_intr_comp Tony Battersby scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive Ben Collins powerpc/addnote: Fix overflow on 32-bit builds Josua Mayer clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 Matthias Schiffer ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx Peng Fan firmware: imx: scu-irq: Init workqueue before request mbox channel Jinhui Guo ipmi: Fix __scan_channels() failing to rescan channels Jinhui Guo ipmi: Fix the race between __scan_channels() and deliver_response() Shipei Qu ALSA: usb-mixer: us16x08: validate meter packet indices Haotian Zhang ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path Haotian Zhang ALSA: vxpocket: Fix resource leak in vxpocket_probe error path Shaurya Rane net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() Christophe Leroy spi: fsl-cpm: Check length parity before switching to 16 bit mode Pengjie Zhang ACPI: CPPC: Fix missing PCC check for guaranteed_perf Christoffer Sandberg Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table Junjie Cao Input: ti_am335x_tsc - fix off-by-one error in wire_order validation Ping Cheng HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen Thomas Fourier block: rnbd-clt: Fix leaked ID in init_dev() Guoqing Jiang block/rnbd-clt: fix wrong max ID in ida_alloc_max Christophe JAILLET block/rnbd: Remove a useless mutex Haoxiang Li MIPS: Fix a reference leak bug in ip22_check_gio() Junrui Luo hwmon: (ibmpex) fix use-after-free in high/low store Jian Shen net: hns3: add VLAN id validation before using Jian Shen net: hns3: using the num_tqps in the vf driver to apply for resources Shay Drory net/mlx5: fw_tracer, Handle escaped percent properly Shay Drory net/mlx5: fw_tracer, Validate format string parameters Shay Drory net/mlx5: fw_tracer, Add support for unrecognized string Gal Pressman ethtool: Avoid overflowing userspace buffer on stats query Daniil Tatianin net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers Daniil Tatianin net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats Tom Rix ethtool: use phydev variable Dan Carpenter nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() Victor Nogueira net/sched: ets: Remove drr class from the active list if it changes to strict Junrui Luo caif: fix integer underflow in cffrml_receive() Slavin Liu ipvs: fix ipv4 null-ptr-deref in route error path Fernando Fernandez Mancera netfilter: nf_conncount: fix leaked ct in error paths Alexey Simakov broadcom: b44: prevent uninitialized value usage Ilya Maximets net: openvswitch: fix middle attribute validation in push_nsh() action Ido Schimmel mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Ido Schimmel mlxsw: spectrum_router: Fix neighbour use-after-free Dmitry Skorodumov ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() Jamal Hadi Salim net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change Wang Liang netrom: Fix memory leak in nr_sendmsg() Gongwei Li Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE Qu Wenruo btrfs: scrub: always update btrfs_scrub_progress::last_physical Viacheslav Dubeyko hfsplus: fix volume corruption issue for generic/073 Tetsuo Handa hfsplus: Verify inode mode when loading from disk Yang Chenzhi hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create Viacheslav Dubeyko hfsplus: fix volume corruption issue for generic/070 Song Liu livepatch: Match old_sympos 0 and 1 in klp_find_func() Shuhao Fu cpufreq: s5pv210: fix refcount leak Sakari Ailus ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only Cryolitia PukNgae ACPICA: Avoid walking the Namespace if start_node is NULL Peter Zijlstra x86/ptrace: Always inline trivial accessors Deepanshu Kartikey btrfs: fix memory leak of fs_devices in degraded seed device path Ondrej Mosnacek bpf, arm64: Do not audit capability check in do_jit() Pablo Neira Ayuso netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails Jamie Iles i3c: fix uninitialized variable use in i2c setup Nicklas Bo Jensen netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around Sun Ke NFS: Fix missing unlock in nfs_unlink() Junrui Luo ALSA: dice: fix buffer overflow in detect_stream_formats() Diogo Ivo usb: phy: Initialize struct usb_phy list_head Haotien Hsu usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Dmitry Antipov ocfs2: fix memory leak in ocfs2_merge_rec_left() Mauro Carvalho Chehab efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Mauro Carvalho Chehab efi/cper: Adjust infopfx size to accept an extra space Mauro Carvalho Chehab efi/cper: Add a new helper function to print bitmasks Haotian Zhang dm log-writes: Add missing set_freezable() for freezable kthread Alexey Simakov dm-raid: fix possible NULL dereference with undefined raid type Liyuan Pang ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Andres J Rosa ALSA: uapi: Fix typo in asound.h comment Dave Kleikamp dma/pool: eliminate alloc_pages warning in atomic_pool_expand shechenglong block: fix comment for op_is_zone_mgmt() to include RESET_ALL Cong Zhang blk-mq: Abort suspend when wakeup events are pending Shengjiu Wang ASoC: ak5558: Disable regulator when error happens Shengjiu Wang ASoC: ak4458: Disable regulator when error happens Haotian Zhang ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() Anton Khirnov platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Armin Wolf fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Trond Myklebust NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Ondrej Mosnacek fs_context: drop the unused lsm_flags member Trond Myklebust Revert "nfs: ignore SB_RDONLY when mounting nfs" Trond Myklebust Revert "nfs: clear SB_RDONLY before getting superblock" Trond Myklebust Revert "nfs: ignore SB_RDONLY when remounting nfs" Jonathan Curley NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Armin Wolf fs/nls: Fix utf16 to utf8 conversion Trond Myklebust NFS: Avoid changing nlink when file removes and attribute updates race NeilBrown NFS: don't unhash dentry during unlink/rename Trond Myklebust NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink() Trond Myklebust NFS: Fix open coded versions of nfs_set_cache_invalid() Trond Myklebust NFS: Clean up function nfs_mark_dir_for_revalidate() Abdun Nihaal fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Haotian Zhang pinctrl: single: Fix incorrect type for error return variable Matthijs Kooijman pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling Namhyung Kim perf tools: Fix split kallsyms DSO counting Xiang Mei net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Ivan Stepchenko mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Fernando Fernandez Mancera netfilter: nft_connlimit: update the count if add was skipped Fernando Fernandez Mancera netfilter: nf_conncount: rework API to use sk_buff directly William Tu netfilter: nf_conncount: reduce unnecessary GC Pablo Neira Ayuso netfilter: nft_connlimit: move stateful fields out of expression data sparkhuang regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex Michael S. Tsirkin virtio: fix virtqueue_set_affinity() docs Yongjian Sun ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Kemeng Shi ext4: remove unused return value of __mb_check_buddy René Rebe ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 Dan Carpenter drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() Stephan Gerhold iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Randy Dunlap backlight: lp855x: Fix lp855x.h kernel-doc warnings Luca Ceresoli backlight: led-bl: Add devlink to supplier LEDs Mans Rullgard backlight: led_bl: Take led_access lock when required Ria Thomas wifi: ieee80211: correct FILS status codes Shawn Lin PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Jianglei Nie staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Haotian Zhang crypto: ccree - Correctly handle return of sg_nents_for_len Matt Bobrowski selftests/bpf: Improve reliability of test_perf_branches_no_hw() Gopi Krishna Menon usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Jisheng Zhang usb: dwc2: fix hang during suspend if set as peripheral Jisheng Zhang usb: dwc2: fix hang during shutdown if set as peripheral Jisheng Zhang usb: dwc2: disable platform lowlevel hw resources during shutdown Oliver Neukum usb: chaoskey: fix locking for O_NONBLOCK Zhao Yipeng ima: Handle error code returned by ima_filter_rule_match() Seungjin Bae wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Haotian Zhang mfd: mt6358-irq: Fix missing irq_domain_remove() in error path Haotian Zhang mfd: mt6397-irq: Fix missing irq_domain_remove() in error path Uwe Kleine-König pwm: bcm2835: Make sure the channel is enabled after pwm_request() Lino Sanfilippo pwm: bcm2835: Support apply function for atomic configuration Ritesh Harjani (IBM) powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Abdun Nihaal wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() Sergey Bashirov NFSD/blocklayout: Fix minlength check in proc_layoutget Haotian Zhang watchdog: wdat_wdt: Fix ACPI table leak in probe function Liu Xinpeng watchdog: wdat_wdt: Stop watchdog when uninstalling module Alexei Starovoitov selftests/bpf: Fix failure paths in send_signal test Siddharth Vadapalli PCI: keystone: Exit ks_pcie_probe() for invalid mode Haotian Zhang leds: netxbig: Fix GPIO descriptor leak in error paths Haotian Zhang scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls Haotian Zhang ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() Dmitry Antipov ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() Andy Shevchenko lib/vsprintf: Check pointer before dereferencing in time_and_date() Haotian Zhang clk: renesas: r9a06g032: Fix memory leak in error path Herve Codina soc: renesas: r9a06g032-sysctrl: Handle h2mode setting based on USBF presence Miquel Raynal clk: renesas: r9a06g032: Export function to set dmamux Zheng Qixing nbd: defer config unlock in nbd_genl_connect Abdun Nihaal wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() Long Li macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Ma Ke RDMA/rtrs: server: Fix error handling in get_or_create_srv Haotian Zhang scsi: stex: Fix reboot_notifier leak in probe error path Zheng Qixing nbd: defer config put in recv_work Yu Kuai nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply() Yu Kuai nbd: clean up return value checking of sock_xmit() Gabor Juhos regulator: core: disable supply if enabling main regulator fails Dapeng Mi perf/x86/intel: Correct large PEBS flag check Zhang Yi ext4: correct the checking of quota files before moving extents Eric Whitney ext4: minor defrag code improvements Haotian Zhang mfd: da9055: Fix missing regmap_del_irq_chip() in error path Bart Van Assche scsi: target: Do not write NUL characters into ASCII configfs output Ahelenia Ziemiańska power: supply: apm_power: only unset own apm_get_power_status Ivan Abramov power: supply: wm831x: Check wm831x_set_bits() return value Frank Li i3c: fix refcount inconsistency in i3c_master_register Jarkko Nikula i3c: master: Inherit DMA masks and parameters from parent device Jeremy Kerr i3c: Allow OF-alias-based persistent bus numbering Jamie Iles i3c: support dynamically added i2c devices Jamie Iles i3c: remove i2c board info from i2c_dev_desc Haotian Zhang pinctrl: stm32: fix hwspinlock resource leak in probe function Tengda Wu x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Alexander Potapenko x86: kmsan: don't instrument stack walking functions Alexander Potapenko kmsan: introduce __no_sanitize_memory and __no_kmsan_checks Kees Cook compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer Hui Su x86/dumpstack: Make show_trace_log_lvl() static Peng Fan firmware: imx: scu-irq: fix OF node leak in Heiko Carstens s390/ap: Don't leak debug feature files if AP instructions are not available Heiko Carstens s390/smp: Fix fallback CPU detection Thorsten Blum crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Francesco Lavra iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Lorenzo Bianconi iio: imu: st_lsm6dsx: discard samples during filters settling time Lorenzo Bianconi iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine Xuanqiang Luo inet: Avoid ehash lookup race in inet_ehash_insert() Xuanqiang Luo rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() Johan Hovold irqchip/qcom-irq-combiner: Fix section mismatch Seungjin Bae USB: Fix descriptor count when handling invalid MBIM extended descriptor Janusz Krzysztofik drm/vgem-fence: Fix potential deadlock on release Guido Günther drm/panel: visionox-rm69299: Don't clear all mode flags Konstantin Andreev smack: fix bug: unprivileged task can create labels Navaneeth K staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing Nikita Zhandarovich comedi: check device's attached status in compat ioctls Nikita Zhandarovich comedi: multiq3: sanitize config options in multiq3_attach() Ian Abbott comedi: c6xdigio: Fix invalid PNP driver unregistration Linus Torvalds samples: work around glibc redefining some of our defines wrong Jia Ston platform/x86: huawei-wmi: add keys for HONOR models Armin Wolf platform/x86: acer-wmi: Ignore backlight event Praveen Talari pinctrl: qcom: msm: Fix deadlock in pinmux configuration Tetsuo Handa bfs: Reconstruct file type when loading from disk Robin Gong spi: imx: keep dma request disabled before dma transfer setup Alvaro Gamez Machado spi: xilinx: increase number of retries before declaring stall Johan Hovold USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC Johan Hovold USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC Magne Bruno serial: add support of CPCI cards Johan Hovold USB: serial: ftdi_sio: match on interface number for jtag Fabio Porcedda USB: serial: option: move Telit 0x10c7 composition in the right place Fabio Porcedda USB: serial: option: add Telit Cinterion FE910C04 new compositions Slark Xiao USB: serial: option: add Foxconn T99W760 Alexey Nepomnyashih ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() Alexander Sverdlin locking/spinlock/debug: Fix data-race in do_raw_write_lock Deepanshu Kartikey ext4: refresh inline data size before write operations Ye Bin jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted Bagas Sanjaya Documentation: process: Also mention Sasha Levin as stable tree maintainer Sabrina Dubroca xfrm: flush all states in xfrm_state_fini Sabrina Dubroca xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added Sabrina Dubroca Revert "xfrm: destroy xfrm_state synchronously on net exit path" Sabrina Dubroca xfrm: delete x->tunnel as we delete x ------------- Diffstat: Documentation/filesystems/mount_api.rst | 1 - Documentation/process/2.Process.rst | 6 +- Makefile | 4 +- arch/alpha/include/uapi/asm/ioctls.h | 8 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/imx6q-ba16.dtsi | 2 +- arch/arm/boot/dts/sama5d2.dtsi | 10 +- arch/arm/include/asm/word-at-a-time.h | 10 +- arch/arm64/net/bpf_jit_comp.c | 2 +- arch/mips/sgi-ip22/ip22-gio.c | 3 +- arch/parisc/kernel/asm-offsets.c | 2 + arch/parisc/kernel/entry.S | 16 +- arch/powerpc/boot/addnote.c | 7 +- arch/powerpc/kernel/process.c | 5 - arch/powerpc/mm/book3s64/internal.h | 1 - arch/powerpc/mm/book3s64/mmu_context.c | 2 - arch/powerpc/mm/book3s64/slb.c | 88 --------- arch/powerpc/mm/ptdump/hashpagetable.c | 6 + arch/powerpc/platforms/pseries/cmm.c | 5 +- arch/s390/kernel/smp.c | 1 + arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/events/intel/core.c | 4 +- arch/x86/include/asm/ptrace.h | 20 +- arch/x86/include/asm/stacktrace.h | 3 - arch/x86/kernel/dumpstack.c | 29 ++- arch/x86/kernel/unwind_frame.c | 11 ++ arch/x86/kvm/lapic.c | 32 ++- arch/x86/kvm/svm/nested.c | 4 +- arch/x86/kvm/svm/svm.c | 18 +- block/blk-mq.c | 18 +- block/blk-throttle.c | 16 +- crypto/af_alg.c | 5 +- crypto/algif_hash.c | 3 +- crypto/algif_rng.c | 3 +- crypto/asymmetric_keys/asymmetric_type.c | 12 +- crypto/seqiv.c | 8 +- drivers/acpi/acpica/nswalk.c | 9 +- drivers/acpi/apei/ghes.c | 16 +- drivers/acpi/cppc_acpi.c | 3 +- drivers/acpi/processor_core.c | 2 +- drivers/acpi/property.c | 9 +- drivers/amba/tegra-ahb.c | 1 + drivers/atm/he.c | 3 +- drivers/base/power/runtime.c | 22 ++- drivers/block/floppy.c | 2 +- drivers/block/nbd.c | 96 +++++---- drivers/block/rnbd/rnbd-clt.c | 20 +- drivers/block/rnbd/rnbd-clt.h | 2 +- drivers/bluetooth/btusb.c | 2 + drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +- drivers/bus/ti-sysc.c | 11 +- drivers/char/applicom.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 20 +- drivers/char/tpm/tpm-chip.c | 1 - drivers/char/tpm/tpm1-cmd.c | 5 - drivers/char/tpm/tpm2-cmd.c | 8 +- drivers/char/virtio_console.c | 2 +- drivers/clk/mvebu/cp110-system-controller.c | 20 ++ drivers/clk/renesas/r9a06g032-clocks.c | 69 ++++++- drivers/cpufreq/cpufreq-nforce2.c | 3 + drivers/cpufreq/s5pv210-cpufreq.c | 6 +- drivers/cpufreq/scmi-cpufreq.c | 10 +- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +- drivers/firewire/nosy.c | 47 +++-- drivers/firmware/efi/cper-arm.c | 52 +++-- drivers/firmware/efi/cper.c | 60 ++++++ drivers/firmware/imx/imx-scu-irq.c | 8 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 2 +- drivers/gpu/drm/gma500/framebuffer.c | 44 ----- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 13 ++ drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +- drivers/gpu/drm/pl111/pl111_drv.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 +- drivers/hid/hid-core.c | 7 +- drivers/hid/hid-input.c | 18 +- drivers/hid/hid-logitech-dj.c | 56 +++--- drivers/hid/hid-quirks.c | 9 + drivers/hwmon/applesmc.c | 34 ++-- drivers/hwmon/ibmpex.c | 9 +- drivers/hwmon/ina209.c | 6 +- drivers/hwmon/ina2xx.c | 2 +- drivers/hwmon/ina3221.c | 2 +- drivers/hwmon/lineage-pem.c | 8 +- drivers/hwmon/ltc2945.c | 4 +- drivers/hwmon/ltc2990.c | 2 +- drivers/hwmon/ltc4151.c | 2 +- drivers/hwmon/ltc4215.c | 8 +- drivers/hwmon/ltc4222.c | 4 +- drivers/hwmon/ltc4260.c | 4 +- drivers/hwmon/ltc4261.c | 4 +- drivers/hwmon/max16065.c | 19 +- drivers/hwmon/occ/common.c | 69 +++---- drivers/hwmon/occ/sysfs.c | 4 +- drivers/hwmon/pmbus/inspur-ipsps.c | 28 +-- drivers/hwmon/pmbus/pmbus_core.c | 8 +- drivers/hwmon/s3c-hwmon.c | 4 +- drivers/hwmon/sch5627.c | 24 +-- drivers/hwmon/sch5636.c | 20 +- drivers/hwmon/smm665.c | 4 +- drivers/hwmon/stts751.c | 20 +- drivers/hwmon/vexpress-hwmon.c | 12 +- drivers/hwmon/w83791d.c | 19 +- drivers/hwmon/w83l786ng.c | 26 ++- drivers/hwmon/xgene-hwmon.c | 14 +- drivers/hwtracing/intel_th/core.c | 20 +- drivers/i2c/busses/i2c-amd-mp2-pci.c | 5 +- drivers/i3c/master.c | 189 ++++++++++++++++-- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 24 ++- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 71 +++++-- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 32 +-- drivers/infiniband/core/addr.c | 33 +--- drivers/infiniband/core/cma.c | 3 + drivers/infiniband/core/device.c | 5 + drivers/infiniband/core/verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 8 +- drivers/infiniband/hw/efa/efa_verbs.c | 4 - drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/input/touchscreen/ti_am335x_tsc.c | 2 +- drivers/iommu/amd/init.c | 28 +-- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 ++- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 +- drivers/iommu/exynos-iommu.c | 9 +- drivers/iommu/ipmmu-vmsa.c | 2 + drivers/iommu/mtk_iommu.c | 2 + drivers/iommu/mtk_iommu_v1.c | 2 + drivers/iommu/omap-iommu.c | 2 +- drivers/iommu/omap-iommu.h | 2 - drivers/iommu/sun50i-iommu.c | 2 + drivers/irqchip/qcom-irq-combiner.c | 2 +- drivers/leds/leds-lp50xx.c | 95 +++++---- drivers/leds/leds-netxbig.c | 36 +++- drivers/macintosh/mac_hid.c | 3 +- drivers/md/dm-ebs-target.c | 2 +- drivers/md/dm-log-writes.c | 1 + drivers/md/dm-raid.c | 2 + drivers/media/cec/core/cec-core.c | 1 + drivers/media/i2c/adv7604.c | 4 +- drivers/media/i2c/adv7842.c | 11 +- drivers/media/i2c/msp3400-kthreads.c | 2 + drivers/media/i2c/tda1997x.c | 1 - drivers/media/platform/davinci/vpif_capture.c | 4 +- drivers/media/platform/exynos4-is/media-dev.c | 10 +- .../media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 4 +- drivers/media/platform/rcar_drif.c | 1 + drivers/media/rc/st_rc.c | 2 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 3 + drivers/media/usb/dvb-usb/dtv5100.c | 5 + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 +- drivers/mfd/altera-sysmgr.c | 2 + drivers/mfd/da9055-core.c | 1 + drivers/mfd/max77620.c | 15 +- drivers/mfd/mt6358-irq.c | 1 + drivers/mfd/mt6397-irq.c | 1 + drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/vmw_balloon.c | 3 +- drivers/mtd/lpddr/lpddr_cmds.c | 8 +- drivers/net/dsa/b53/b53_common.c | 3 + drivers/net/ethernet/3com/3c59x.c | 2 +- drivers/net/ethernet/broadcom/b44.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 87 ++++---- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +- drivers/net/ethernet/cadence/macb_main.c | 3 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +- .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 8 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 122 ++++++++++-- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/en.h | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 2 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 17 +- drivers/net/fjes/fjes_hw.c | 12 +- drivers/net/ipvlan/ipvlan_core.c | 3 + drivers/net/mdio/mdio-aspeed.c | 77 +++++--- drivers/net/team/team.c | 2 +- drivers/net/usb/pegasus.c | 2 + drivers/net/usb/rtl8150.c | 2 + drivers/net/usb/sr9700.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 ++- drivers/net/wireless/st/cw1200/bh.c | 6 +- drivers/nfc/pn533/usb.c | 2 +- drivers/nvme/host/fc.c | 6 +- drivers/parisc/gsc.c | 4 +- drivers/pci/controller/dwc/pci-keystone.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 +- drivers/pci/controller/pcie-brcmstb.c | 10 +- drivers/pci/pci-driver.c | 4 + drivers/phy/broadcom/phy-bcm63xx-usbh.c | 6 +- drivers/pinctrl/pinctrl-single.c | 25 ++- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- drivers/platform/chrome/cros_ec_ishtp.c | 1 + drivers/platform/x86/acer-wmi.c | 4 + drivers/platform/x86/asus-wmi.c | 8 +- drivers/platform/x86/huawei-wmi.c | 4 + drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/msi-laptop.c | 3 + drivers/power/supply/apm_power.c | 3 +- drivers/power/supply/wm831x_power.c | 10 +- drivers/powercap/powercap_sys.c | 22 ++- drivers/pwm/pwm-bcm2835.c | 95 +++------ drivers/pwm/pwm-stm32.c | 3 +- drivers/regulator/core.c | 37 ++-- drivers/rpmsg/qcom_glink_native.c | 8 + drivers/s390/crypto/ap_bus.c | 8 +- drivers/scsi/aic94xx/aic94xx_init.c | 3 + drivers/scsi/ipr.c | 28 ++- drivers/scsi/iscsi_tcp.c | 13 +- drivers/scsi/libiscsi.c | 39 +++- drivers/scsi/libsas/sas_internal.h | 14 -- drivers/scsi/qla2xxx/qla_mbx.c | 2 + drivers/scsi/qla2xxx/qla_os.c | 14 +- drivers/scsi/sg.c | 20 +- drivers/scsi/sim710.c | 2 + drivers/scsi/stex.c | 1 + drivers/scsi/ufs/ufshcd.c | 4 +- drivers/soc/amlogic/meson-canvas.c | 5 +- drivers/soc/qcom/ocmem.c | 2 +- drivers/spi/spi-fsl-spi.c | 2 +- drivers/spi/spi-imx.c | 15 +- drivers/spi/spi-xilinx.c | 2 +- drivers/staging/comedi/comedi_fops.c | 42 +++- drivers/staging/comedi/drivers/c6xdigio.c | 46 +++-- drivers/staging/comedi/drivers/multiq3.c | 9 + drivers/staging/fbtft/fbtft-core.c | 4 +- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 5 +- drivers/target/target_core_configfs.c | 1 - drivers/target/target_core_transport.c | 1 + drivers/tty/serial/8250/8250_pci.c | 37 ++++ drivers/tty/serial/sprd_serial.c | 6 + drivers/usb/core/message.c | 2 +- drivers/usb/dwc2/platform.c | 16 +- drivers/usb/dwc3/dwc3-of-simple.c | 7 +- drivers/usb/dwc3/gadget.c | 2 +- drivers/usb/dwc3/host.c | 2 +- drivers/usb/gadget/legacy/raw_gadget.c | 3 + drivers/usb/gadget/udc/core.c | 17 +- drivers/usb/gadget/udc/lpc32xx_udc.c | 20 +- drivers/usb/gadget/udc/tegra-xudc.c | 6 - drivers/usb/host/ohci-nxp.c | 20 +- drivers/usb/host/xhci-dbgtty.c | 6 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 10 +- drivers/usb/host/xhci-ring.c | 8 +- drivers/usb/host/xhci.h | 16 +- drivers/usb/misc/chaoskey.c | 16 +- drivers/usb/misc/sisusbvga/sisusb_con.c | 21 -- drivers/usb/phy/phy-fsl-usb.c | 1 + drivers/usb/phy/phy.c | 4 + drivers/usb/renesas_usbhs/pipe.c | 2 + drivers/usb/serial/belkin_sa.c | 28 +-- drivers/usb/serial/ftdi_sio.c | 72 +++---- drivers/usb/serial/kobil_sct.c | 18 +- drivers/usb/serial/option.c | 22 ++- drivers/usb/storage/unusual_uas.h | 2 +- drivers/usb/typec/ucsi/ucsi.c | 6 + drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/vhost/vsock.c | 15 +- drivers/video/backlight/led_bl.c | 18 +- drivers/video/console/dummycon.c | 20 -- drivers/video/console/sticore.c | 8 +- drivers/video/fbdev/core/fbcon.c | 68 ++----- drivers/video/fbdev/core/fbcon_rotate.c | 3 +- drivers/video/fbdev/core/tileblit.c | 4 +- drivers/video/fbdev/gbefb.c | 5 +- drivers/video/fbdev/pxafb.c | 12 +- drivers/video/fbdev/ssd1307fb.c | 4 +- drivers/video/fbdev/tcx.c | 2 +- drivers/virtio/virtio_balloon.c | 4 +- drivers/watchdog/via_wdt.c | 1 + drivers/watchdog/wdat_wdt.c | 65 ++++-- fs/bfs/inode.c | 19 +- fs/btrfs/extent_io.c | 15 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/scrub.c | 5 + fs/btrfs/volumes.c | 1 + fs/exfat/super.c | 19 +- fs/ext4/inline.c | 14 +- fs/ext4/inode.c | 5 + fs/ext4/mballoc.c | 58 ++++-- fs/ext4/move_extent.c | 18 +- fs/ext4/super.c | 7 +- fs/ext4/xattr.c | 38 +--- fs/ext4/xattr.h | 10 + fs/f2fs/f2fs.h | 3 - fs/f2fs/file.c | 3 +- fs/f2fs/namei.c | 6 +- fs/f2fs/recovery.c | 9 +- fs/f2fs/super.c | 53 ++--- fs/f2fs/xattr.c | 32 ++- fs/f2fs/xattr.h | 10 +- fs/hfsplus/bnode.c | 4 +- fs/hfsplus/dir.c | 7 +- fs/hfsplus/inode.c | 32 ++- fs/jbd2/journal.c | 14 ++ fs/jbd2/transaction.c | 21 +- fs/lockd/svc4proc.c | 4 +- fs/lockd/svclock.c | 21 +- fs/lockd/svcproc.c | 5 +- fs/locks.c | 13 +- fs/nfs/dir.c | 131 ++++++++---- fs/nfs/inode.c | 6 +- fs/nfs/internal.h | 5 +- fs/nfs/namespace.c | 11 ++ fs/nfs/nfs4proc.c | 13 +- fs/nfs/nfs4trace.h | 1 + fs/nfs/pnfs.c | 1 + fs/nfs/super.c | 26 --- fs/nfs/unlink.c | 6 +- fs/nfs/write.c | 8 +- fs/nfsd/blocklayout.c | 7 +- fs/nfsd/export.c | 2 +- fs/nfsd/netns.h | 2 + fs/nfsd/nfs4state.c | 46 ++++- fs/nfsd/nfs4xdr.c | 5 + fs/nfsd/nfsctl.c | 3 +- fs/nfsd/state.h | 2 +- fs/nfsd/vfs.c | 2 +- fs/nls/nls_base.c | 27 ++- fs/notify/fsnotify.c | 9 +- fs/ocfs2/alloc.c | 1 - fs/ocfs2/move_extents.c | 8 +- fs/ocfs2/suballoc.c | 10 + fs/overlayfs/export.c | 2 +- fs/overlayfs/overlayfs.h | 2 +- fs/xfs/xfs_buf_item.c | 1 + include/linux/balloon_compaction.h | 65 ++---- include/linux/blk_types.h | 5 +- include/linux/compiler-clang.h | 23 +++ include/linux/compiler-gcc.h | 14 ++ include/linux/console.h | 1 - include/linux/cper.h | 12 +- include/linux/font.h | 1 + include/linux/fs_context.h | 1 - include/linux/genalloc.h | 1 + include/linux/hugetlb.h | 4 +- include/linux/i3c/master.h | 1 - include/linux/ieee80211.h | 4 +- include/linux/mm.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/nfs_fs.h | 9 + include/linux/platform_data/lp855x.h | 4 +- include/linux/rculist_nulls.h | 59 ++++++ include/linux/reset.h | 1 + include/linux/security.h | 2 +- include/linux/soc/renesas/r9a06g032-sysctrl.h | 11 ++ include/linux/tpm.h | 9 +- include/linux/usb/gadget.h | 5 + include/linux/virtio_config.h | 2 +- include/media/v4l2-mem2mem.h | 3 +- include/net/dst.h | 12 ++ include/net/netfilter/nf_conntrack_count.h | 16 +- include/net/sock.h | 13 ++ include/net/xfrm.h | 13 +- include/scsi/libiscsi.h | 2 + include/uapi/linux/kd.h | 2 +- include/uapi/linux/mptcp.h | 1 + include/uapi/sound/asound.h | 2 +- io_uring/io_uring.c | 2 +- kernel/dma/pool.c | 2 +- kernel/livepatch/core.c | 8 +- kernel/locking/spinlock_debug.c | 4 +- kernel/scs.c | 2 +- kernel/trace/trace_events.c | 2 + lib/crypto/aes.c | 4 +- lib/fonts/font_10x18.c | 1 + lib/fonts/font_6x10.c | 1 + lib/fonts/font_6x11.c | 1 + lib/fonts/font_6x8.c | 1 + lib/fonts/font_7x14.c | 1 + lib/fonts/font_8x16.c | 1 + lib/fonts/font_8x8.c | 1 + lib/fonts/font_acorn_8x8.c | 1 + lib/fonts/font_mini_4x6.c | 1 + lib/fonts/font_pearl_8x8.c | 1 + lib/fonts/font_sun12x22.c | 1 + lib/fonts/font_sun8x16.c | 1 + lib/fonts/font_ter16x32.c | 1 + lib/idr.c | 2 + lib/vsprintf.c | 6 +- mm/balloon_compaction.c | 15 +- mm/hugetlb.c | 4 +- mm/mempolicy.c | 2 +- mm/mprotect.c | 34 ++-- net/bridge/br_private.h | 1 + net/bridge/br_vlan_tunnel.c | 11 +- net/caif/cffrml.c | 9 +- net/can/j1939/transport.c | 2 + net/ceph/osd_client.c | 11 +- net/ceph/osdmap.c | 140 +++++++------ net/core/dev.c | 33 ++++ net/core/sock.c | 7 +- net/core/sock_map.c | 53 ++--- net/ethtool/ioctl.c | 134 +++++++++---- net/hsr/hsr_forward.c | 2 + net/ipv4/arp.c | 7 +- net/ipv4/fib_trie.c | 7 +- net/ipv4/inet_hashtables.c | 8 +- net/ipv4/ip_output.c | 19 +- net/ipv4/ipcomp.c | 2 + net/ipv4/ping.c | 4 +- net/ipv4/raw.c | 3 + net/ipv6/calipso.c | 3 +- net/ipv6/ip6_gre.c | 9 +- net/ipv6/ip6_output.c | 3 +- net/ipv6/ipcomp6.c | 2 + net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/mac80211/rx.c | 5 + net/mptcp/pm_netlink.c | 3 +- net/netfilter/ipvs/ip_vs_xmit.c | 3 + net/netfilter/nf_conncount.c | 219 ++++++++++++++------- net/netfilter/nft_connlimit.c | 69 ++++--- net/netfilter/nft_synproxy.c | 6 +- net/netfilter/xt_connlimit.c | 14 +- net/netrom/nr_out.c | 4 +- net/nfc/core.c | 9 +- net/openvswitch/conntrack.c | 16 +- net/openvswitch/flow_netlink.c | 13 +- net/openvswitch/vport-netdev.c | 17 +- net/rose/af_rose.c | 2 +- net/sched/sch_cake.c | 60 +++--- net/sched/sch_ets.c | 6 +- net/sched/sch_qfq.c | 2 +- net/sunrpc/auth_gss/svcauth_gss.c | 3 +- net/tls/tls_device.c | 18 +- net/wireless/wext-core.c | 4 + net/wireless/wext-priv.c | 4 + net/xfrm/xfrm_ipcomp.c | 1 - net/xfrm/xfrm_state.c | 41 ++-- net/xfrm/xfrm_user.c | 2 +- samples/vfs/test-statx.c | 6 + samples/watch_queue/watch_test.c | 6 + security/integrity/ima/ima_policy.c | 2 +- security/smack/smack_lsm.c | 41 ++-- sound/firewire/dice/dice-extension.c | 4 +- sound/isa/wavefront/wavefront_midi.c | 2 + sound/isa/wavefront/wavefront_synth.c | 4 +- sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +- sound/pcmcia/vx/vxpocket.c | 8 +- sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +- sound/soc/codecs/ak4458.c | 10 +- sound/soc/codecs/ak5558.c | 10 +- sound/soc/fsl/fsl_sai.c | 3 + sound/soc/qcom/qdsp6/q6adm.c | 146 +++++++------- sound/soc/qcom/qdsp6/q6asm-dai.c | 7 +- sound/soc/stm/stm32_i2s.c | 62 ++---- sound/soc/stm/stm32_sai.c | 39 ++-- sound/soc/stm/stm32_sai_sub.c | 46 ++--- sound/soc/stm/stm32_spdifrx.c | 44 ++--- sound/usb/mixer_us16x08.c | 20 +- tools/perf/util/symbol.c | 4 +- tools/testing/ktest/config-bisect.pl | 4 +- tools/testing/nvdimm/test/nfit.c | 7 +- tools/testing/radix-tree/idr-test.c | 21 ++ .../selftests/bpf/prog_tests/perf_branches.c | 16 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 5 + .../selftests/bpf/progs/test_perf_branches.c | 3 + .../test.d/ftrace/func_traceonoff_triggers.tc | 5 +- 472 files changed, 4037 insertions(+), 2442 deletions(-) From - Thu Jan 15 18:08:29 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id OCVaNBctaWmNYB0AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:23 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:24 +0000 Received: from tor.lore.kernel.org ([172.105.105.114]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlf-00000008kLJ-2l45 for hi@josie.lol; Thu, 15 Jan 2026 18:08:23 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id C1134315E799 for ; Thu, 15 Jan 2026 18:01:36 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 83EF73D410C; Thu, 15 Jan 2026 17:52:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mAHAjAea" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F5673C1997; Thu, 15 Jan 2026 17:52:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768499545; cv=none; b=mI/Rop4RcnfJqzT/9sI1hyd8ffON/+KxHk08RvAUNg+KTWtq8ZL/jjis3bKLtnKGzCBN3RxaY7ojoSWCygG0J0UCCj36HCUpU7NffyRYUSyBZK2u5PqmSu6hBOvHStmtOXZbrDBDj3bDn8/+VT48vqwX2OT/9vgN4OJRSgx4Z6I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768499545; c=relaxed/simple; bh=Wur3+XaQaKrJ4K3WAlihJl1MHcLKIbOk9ddHGULjgYc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PsrljYG+ReC0haeK75T5E/TC3+rx7Bw3+n4BHSJIWepr7Wv9POvsHX84MNYsGm4syBsH98ET0kr2/biZuTwirTmDZpFu+PgiOSRbDBdDuY7CxKnRVbvkrR+iB0CmMzVa42Q7znywC/WXOinYBWX7yJUL91aEAPteatodaLrp0LU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mAHAjAea; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id DFC09C116D0; Thu, 15 Jan 2026 17:52:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768499545; bh=Wur3+XaQaKrJ4K3WAlihJl1MHcLKIbOk9ddHGULjgYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mAHAjAeaNClEy/Zvvah1GBNJ8tFiKISX5rtC1Ab9wKxnheKrlAQV/u7NeRgBf0dQb c0bhoAQV2333U41tpJKhynDHLisf3/3z3MhsYynGCFUMLXxOyfYYcaGL+hkEC1Mtzx KmHS4bqCi2vowq9vH1GQkYUHG4RgT40eoWEItrFI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Harry Wentland , Alex Deucher Subject: [PATCH 5.10 263/451] drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() Date: Thu, 15 Jan 2026 17:47:44 +0100 Message-ID: <20260115164240.399884319@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164230.864985076@linuxfoundation.org> References: <20260115164230.864985076@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: freedesktop.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher commit 3c41114dcdabb7b25f5bc33273c6db9c7af7f4a7 upstream. This can get called from an atomic context. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4470 Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit 8acdad9344cc7b4e7bc01f0dfea80093eb3768db) Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/amd/display/dc/core/dc_surface.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_surface.c @@ -104,7 +104,7 @@ void enable_surface_flip_reporting(struc struct dc_plane_state *dc_create_plane_state(struct dc *dc) { struct dc_plane_state *plane_state = kvzalloc(sizeof(*plane_state), - GFP_KERNEL); + GFP_ATOMIC); if (NULL == plane_state) return NULL; From - Thu Jan 15 18:08:33 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id 6AyzFhwtaWlymB0AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:28 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:28 +0000 Received: from sin.lore.kernel.org ([104.64.211.4]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlj-00000008kQz-2nKx for hi@josie.lol; Thu, 15 Jan 2026 18:08:28 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id 8BE7F3091D4C for ; Thu, 15 Jan 2026 17:39:37 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 88CB72C21F4; Thu, 15 Jan 2026 17:39:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="D27GwgWb" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6555D3624C4; Thu, 15 Jan 2026 17:39:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498775; cv=none; b=KqD9IBmFl/owjaH3z78Ko33r9Yq1glFFwrnEZ5NAORw77QokLEQFdukQB1FwaNuAs3gtdOoJXqdLvFf8zTrT3dwHVc7dJGx4YZTA9dtmviy23hyh8dSvVrEcOBxslXwuO7TxnB98q1RIoHoQH+ykHbdYLWcwBtc7VAZBtpR9KVo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498775; c=relaxed/simple; bh=4ZD2pfzhrX49eguK2Jhkfx1ePbQHf67YJqc0o12TvCY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Nvt0gaMEPRBItuOswTup7vtB3rVALGqVGWQcc7/yGe0GqlCPhrWwNrayW2sQbqZNB7WUE81hnUxLxPg/ku+3C38WyZvMM6A2roycQlw/eWYVtZy9rbegmh4HJyHysyY4gUJfkH3iOdb8Lfgfys0yNFthjjlRRY2K/uvr1aqVxnk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=D27GwgWb; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2212C16AAE; Thu, 15 Jan 2026 17:39:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768498775; bh=4ZD2pfzhrX49eguK2Jhkfx1ePbQHf67YJqc0o12TvCY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D27GwgWbAseboMgknaku9I8Ycuu1HbHT7NFQxP4AMbNLBQMZGeulDXkHrfxu1q6PK yhDWW5ql2N0e4S4FC9ko86eGXjMdHqIxU8Uj+2zQdBZZtNLBBpmaFkv6iIdpXXc2zc fQWPhwDuVWpq3LMml+EqLQ3rAqex4UsxLV/XjBG0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Laibin Qiu , Ming Lei , Jens Axboe , Sasha Levin , Keerthana K , Shivani Agarwal Subject: [PATCH 5.15 549/554] blk-throttle: Set BIO_THROTTLED when bio has been throttled Date: Thu, 15 Jan 2026 17:50:15 +0100 Message-ID: <20260115164306.200991490@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164246.225995385@linuxfoundation.org> References: <20260115164246.225995385@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [104.64.211.4 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Laibin Qiu [ Upstream commit 5a011f889b4832aa80c2a872a5aade5c48d2756f ] 1.In current process, all bio will set the BIO_THROTTLED flag after __blk_throtl_bio(). 2.If bio needs to be throttled, it will start the timer and stop submit bio directly. Bio will submit in blk_throtl_dispatch_work_fn() when the timer expires.But in the current process, if bio is throttled. The BIO_THROTTLED will be set to bio after timer start. If the bio has been completed, it may cause use-after-free blow. BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 Read of size 2 at addr ffff88801b8902d4 by task fio/26380 dump_stack+0x9b/0xce print_address_description.constprop.6+0x3e/0x60 kasan_report.cold.9+0x22/0x3a blk_throtl_bio+0x12f0/0x2c70 submit_bio_checks+0x701/0x1550 submit_bio_noacct+0x83/0xc80 submit_bio+0xa7/0x330 mpage_readahead+0x380/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 26380: kasan_save_stack+0x19/0x40 __kasan_kmalloc.constprop.2+0xc1/0xd0 kmem_cache_alloc+0x146/0x440 mempool_alloc+0x125/0x2f0 bio_alloc_bioset+0x353/0x590 mpage_alloc+0x3b/0x240 do_mpage_readpage+0xddf/0x1ef0 mpage_readahead+0x264/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: kasan_save_stack+0x19/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x1b/0x30 __kasan_slab_free+0x111/0x160 kmem_cache_free+0x94/0x460 mempool_free+0xd6/0x320 bio_free+0xe0/0x130 bio_put+0xab/0xe0 bio_endio+0x3a6/0x5d0 blk_update_request+0x590/0x1370 scsi_end_request+0x7d/0x400 scsi_io_completion+0x1aa/0xe50 scsi_softirq_done+0x11b/0x240 blk_mq_complete_request+0xd4/0x120 scsi_mq_done+0xf0/0x200 virtscsi_vq_done+0xbc/0x150 vring_interrupt+0x179/0x390 __handle_irq_event_percpu+0xf7/0x490 handle_irq_event_percpu+0x7b/0x160 handle_irq_event+0xcc/0x170 handle_edge_irq+0x215/0xb20 common_interrupt+0x60/0x120 asm_common_interrupt+0x1e/0x40 Fix this by move BIO_THROTTLED set into the queue_lock. Signed-off-by: Laibin Qiu Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20220301123919.2381579-1-qiulaibin@huawei.com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin [ Keerthana: Remove 'out' and handle return with reference to commit 81c7a63 ] Signed-off-by: Keerthana K Signed-off-by: Shivani Agarwal Signed-off-by: Greg Kroah-Hartman --- block/blk-throttle.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -2222,8 +2222,10 @@ bool blk_throtl_bio(struct bio *bio) rcu_read_lock(); /* see throtl_charge_bio() */ - if (bio_flagged(bio, BIO_THROTTLED)) - goto out; + if (bio_flagged(bio, BIO_THROTTLED)) { + rcu_read_unlock(); + return false; + } if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) { blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf, @@ -2231,8 +2233,10 @@ bool blk_throtl_bio(struct bio *bio) blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1); } - if (!tg->has_rules[rw]) - goto out; + if (!tg->has_rules[rw]) { + rcu_read_unlock(); + return false; + } spin_lock_irq(&q->queue_lock); @@ -2316,14 +2320,14 @@ again: } out_unlock: - spin_unlock_irq(&q->queue_lock); -out: bio_set_flag(bio, BIO_THROTTLED); #ifdef CONFIG_BLK_DEV_THROTTLING_LOW if (throttled || !td->track_bio_latency) bio->bi_issue.value |= BIO_ISSUE_THROTL_SKIP_LATENCY; #endif + spin_unlock_irq(&q->queue_lock); + rcu_read_unlock(); return throttled; } From - Thu Jan 15 18:08:33 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id ACj5Bh0taWmNYB0AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:29 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:29 +0000 Received: from sin.lore.kernel.org ([104.64.211.4]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlk-00000008kRf-1sQC for hi@josie.lol; Thu, 15 Jan 2026 18:08:29 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id F04F03092AAB for ; Thu, 15 Jan 2026 17:39:39 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 75E502D595B; Thu, 15 Jan 2026 17:39:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="xVET4aTx" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A9AA2D0C79; Thu, 15 Jan 2026 17:39:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498778; cv=none; b=S8S6aX33Llcj6MzTSwglj0VMk37o6XVLYU2WalXRdhPxsQJZavzI7srO25nce4EhgsG5ps53qNuc961s+xaGC0dXAwxu8DdBAp1QQMFhkjw2z/xIS35JWAiog7Dhi/t32dUtdy51MoEKemVs2Dod1b6KAZmeEJNB+fEeNsfQGGo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768498778; c=relaxed/simple; bh=hACj+KIMEuuiLZ3yqRrAFhNze5xzY2J3ajahYER2Flw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XhGYBFLabHa3cbZk6wmIegeHD/4sYtsv/4Tg4cVsdBiVSjFOfEsoXQgzATKrrL+fkYNSYoXEZ9W4Ka/vtPWbkOMD4IOTPJKXDaj1TZqdKWCxIowGLwWloDUdV5D//1JEtuKbG+FBO097K4FZLBynlufRXY+dXKrB9h84ZGqjVBo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xVET4aTx; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7EA63C116D0; Thu, 15 Jan 2026 17:39:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768498777; bh=hACj+KIMEuuiLZ3yqRrAFhNze5xzY2J3ajahYER2Flw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xVET4aTxrUwXRrLM9is2CCDGQeB/jVosSPowUENw8Fs/DvwuoNesVvU64vPnuEYF/ lVw+UasGJ+Py31mQItEIGnvvRGA24b/ySwyOhxs5SBG7gKAKWaJ35jJ4QShl8XNiVa qLf+dh468q++HaZHP6bd6cQO5FXmYJxe1dO1hJbM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sumeet Pawnikar , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 5.15 550/554] powercap: fix race condition in register_control_type() Date: Thu, 15 Jan 2026 17:50:16 +0100 Message-ID: <20260115164306.238160702@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164246.225995385@linuxfoundation.org> References: <20260115164246.225995385@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: msgid.link] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sumeet Pawnikar [ Upstream commit 7bda1910c4bccd4b8d4726620bb3d6bbfb62286e ] The device becomes visible to userspace via device_register() even before it fully initialized by idr_init(). If userspace or another thread tries to register a zone immediately after device_register(), the control_type_valid() will fail because the control_type is not yet in the list. The IDR is not yet initialized, so this race condition causes zone registration failure. Move idr_init() and list addition before device_register() fix the race condition. Signed-off-by: Sumeet Pawnikar [ rjw: Subject adjustment, empty line added ] Link: https://patch.msgid.link/20251205190216.5032-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- drivers/powercap/powercap_sys.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c index fd475e463d1fa..d7dadcaa3736b 100644 --- a/drivers/powercap/powercap_sys.c +++ b/drivers/powercap/powercap_sys.c @@ -624,17 +624,23 @@ struct powercap_control_type *powercap_register_control_type( INIT_LIST_HEAD(&control_type->node); control_type->dev.class = &powercap_class; dev_set_name(&control_type->dev, "%s", name); - result = device_register(&control_type->dev); - if (result) { - put_device(&control_type->dev); - return ERR_PTR(result); - } idr_init(&control_type->idr); mutex_lock(&powercap_cntrl_list_lock); list_add_tail(&control_type->node, &powercap_cntrl_list); mutex_unlock(&powercap_cntrl_list_lock); + result = device_register(&control_type->dev); + if (result) { + mutex_lock(&powercap_cntrl_list_lock); + list_del(&control_type->node); + mutex_unlock(&powercap_cntrl_list_lock); + + idr_destroy(&control_type->idr); + put_device(&control_type->dev); + return ERR_PTR(result); + } + return control_type; } EXPORT_SYMBOL_GPL(powercap_register_control_type); -- 2.51.0 From - Thu Jan 15 18:08:48 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id 8GkCDSwtaWnDJB8AYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 18:08:44 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 18:08:44 +0000 Received: from sea.lore.kernel.org ([172.234.253.10]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgRlz-00000008kw0-3rrW for hi@josie.lol; Thu, 15 Jan 2026 18:08:44 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id 7445C32209E9 for ; Thu, 15 Jan 2026 17:23:19 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C50513BFE28; Thu, 15 Jan 2026 17:22:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="j1VgIDyT" X-Original-To: stable@vger.