-hi=josie.lol@vger.kernel.org>) for ; Mon, 09 Feb 2026 14:25:49 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Mon, 09 Feb 2026 14:25:49 +0000 Received: from tor.lore.kernel.org ([172.105.105.114]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vpSCu-0000000GIZT-2HM8 for hi@josie.lol; Mon, 09 Feb 2026 14:25:48 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 38FED301946C for ; Mon, 9 Feb 2026 14:25:33 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 05CDE37997D; Mon, 9 Feb 2026 14:25:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="J1LpRbQa" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D80763793AC; Mon, 9 Feb 2026 14:25:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647132; cv=none; b=PzqWpmfHIYiw8cGqt8Pi6T20zLUOgYZLpDrYJIDqgKz4/zxQNAGDIc+ut7RcXhul32PSjibir0pqCp2PcXrJRHRP0VtKnYcKFX+SbzZPEmeKJErNZPA4H15gq911zxtXRYJAiVpKLyCyXkQd+ElmZT1UGULUdyWeeXP9JSKfbrU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647132; c=relaxed/simple; bh=ypWJOnwa1Y+exNsdUseGPjuTEJBJ85Rr10BwFTxUsPU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dSO4ee7HDNv02Z9vxHNIouVcv6SMli39MtdhXGIjAATLMsDFwAHyMde76d3uBNFZt7bkTpCKPicy+G2kauD7vs3KH3we4gU069aIqjqaSXIAJKCtS/L04LX1I8WKAc0+hoGEFKfKbqvgtQOO9eGpb04ak7HuxBnxsTzHYQmTVeI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=J1LpRbQa; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 471EDC16AAE; Mon, 9 Feb 2026 14:25:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1770647132; bh=ypWJOnwa1Y+exNsdUseGPjuTEJBJ85Rr10BwFTxUsPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J1LpRbQa2pMbndvP8riAUh+VZcCBLYWNIy0LnzzzHOKj8b+FuCKFwDMTsozJ27ZEN +DY+XRfMCSvUGtZxP6ZEPB1s2hpzIMVq+Efk5t28p4/ezaaRO9kkg2zZZE+Bu2YGm1 B+HPaq6yHQNYr1XWpSGbPGhW4THV1SnTUjI/eI4U= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, YunJe Shin , Sagi Grimberg , Joonkyo Jung , Keith Busch Subject: [PATCH 6.18 001/175] nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec Date: Mon, 9 Feb 2026 15:21:14 +0100 Message-ID: <20260209142320.530837941@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260209142320.474120190@linuxfoundation.org> References: <20260209142320.474120190@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: YunJe Shin commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c upstream. nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: YunJe Shin Reviewed-by: Sagi Grimberg Reviewed-by: Joonkyo Jung Signed-off-by: Keith Busch Signed-off-by: Greg Kroah-Hartman --- drivers/nvme/target/tcp.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -349,11 +349,14 @@ static void nvmet_tcp_free_cmd_buffers(s cmd->req.sg = NULL; } +static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue); + static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) { struct bio_vec *iov = cmd->iov; struct scatterlist *sg; u32 length, offset, sg_offset; + unsigned int sg_remaining; int nr_pages; length = cmd->pdu_len; @@ -361,9 +364,22 @@ static void nvmet_tcp_build_pdu_iovec(st offset = cmd->rbytes_done; cmd->sg_idx = offset / PAGE_SIZE; sg_offset = offset % PAGE_SIZE; + if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } sg = &cmd->req.sg[cmd->sg_idx]; + sg_remaining = cmd->req.sg_cnt - cmd->sg_idx; while (length) { + if (!sg_remaining) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } + if (!sg->length || sg->length <= sg_offset) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } u32 iov_len = min_t(u32, length, sg->length - sg_offset); bvec_set_page(iov, sg_page(sg), iov_len, @@ -371,6 +387,7 @@ static void nvmet_tcp_build_pdu_iovec(st length -= iov_len; sg = sg_next(sg); + sg_remaining--; iov++; sg_offset = 0; } From - Mon Feb 09 14:26:13 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id CEWkJ3/uiWk89zoAYBR5ng (envelope-from ) for ; Mon, 09 Feb 2026 14:26:07 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Mon, 09 Feb 2026 14:26:07 +0000 Received: from tor.lore.kernel.org ([172.105.105.114]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vpSDG-0000000GJEy-10pt for hi@josie.lol; Mon, 09 Feb 2026 14:26:07 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id CACAE3011A4A for ; Mon, 9 Feb 2026 14:26:05 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9805F37AA96; Mon, 9 Feb 2026 14:26:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vcyyexll" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7578837AA90; Mon, 9 Feb 2026 14:26:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647165; cv=none; b=QQiQdIMFSwsG6J07tHYtrwMw1oOC6fMw0/6374HQzUVepOaCK1chfC6bnOxN/FT154ryg35gdywM4pD+O177pkAwYOhvlfQN875Jo8PjA7OTOnJoUvlRSRLbCX4krWmMnoovDMmuTCsEId/hStqeeyhFlzc2O+F47T8e53aU39c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647165; c=relaxed/simple; bh=eD7bTQ/8+zl9o4NGUmN5RiFfPscYIY1jxPgwEmzMc18=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HlCblzeSbviyULRADtuQlfK+be97N2KPzwNZcSVHK3Ul+fo9m7R2op3R/T8Re2+3bPkp+b3m1hPD1CvWd8KlPmZZ0rnk6gDMvN6JelAll2yqNDBqYsvEsjoykY3T22INsiGyWY7khsdh4byG4ZNrvK4mWpZpsq6jz7ryxlkZNPA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vcyyexll; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED063C16AAE; Mon, 9 Feb 2026 14:26:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1770647165; bh=eD7bTQ/8+zl9o4NGUmN5RiFfPscYIY1jxPgwEmzMc18=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vcyyexllh8ZSF/P5GrxUyxJTIJuzQfs0re9ycnANEwktTZ5UOJZL5ITX2zsIZDjXk Ur3i9gtTiNsP50SMqlnkNY820xrce6hXV2vfpOHDZGaFJWuBooOdpgUeukV4q0b6iY pSGEpTjsKOVSjyeOb4Z2fPDRD3ODMQzv9HFO0qW8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ulf Hansson , Xu Yang Subject: [PATCH 6.18 008/175] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup Date: Mon, 9 Feb 2026 15:21:21 +0100 Message-ID: <20260209142320.777430028@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260209142320.474120190@linuxfoundation.org> References: <20260209142320.474120190@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.105.105.114 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Xu Yang commit e9ab2b83893dd03cf04d98faded81190e635233f upstream. Current design will power off all dependent GPC power domains in imx8mp_blk_ctrl_suspend(), even though the user device has enabled wakeup capability. The result is that wakeup function never works for such device. An example will be USB wakeup on i.MX8MP. PHY device '382f0040.usb-phy' is attached to power domain 'hsioblk-usb-phy2' which is spawned by hsio block control. A virtual power domain device 'genpd:3:32f10000.blk-ctrl' is created to build connection with 'hsioblk-usb-phy2' and it depends on GPC power domain 'usb-otg2'. If device '382f0040.usb-phy' enable wakeup, only power domain 'hsioblk-usb-phy2' keeps on during system suspend, power domain 'usb-otg2' is off all the time. So the wakeup event can't happen. In order to further establish a connection between the power domains related to GPC and block control during system suspend, register a genpd power on/off notifier for the power_dev. This allows us to prevent the GPC power domain from being powered off, in case the block control power domain is kept on to serve system wakeup. Suggested-by: Ulf Hansson Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman --- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) --- a/drivers/pmdomain/imx/imx8mp-blk-ctrl.c +++ b/drivers/pmdomain/imx/imx8mp-blk-ctrl.c @@ -65,6 +65,7 @@ struct imx8mp_blk_ctrl_domain { struct icc_bulk_data paths[DOMAIN_MAX_PATHS]; struct device *power_dev; struct imx8mp_blk_ctrl *bc; + struct notifier_block power_nb; int num_paths; int id; }; @@ -594,6 +595,20 @@ static int imx8mp_blk_ctrl_power_off(str return 0; } +static int imx8mp_blk_ctrl_gpc_notifier(struct notifier_block *nb, + unsigned long action, void *data) +{ + struct imx8mp_blk_ctrl_domain *domain = + container_of(nb, struct imx8mp_blk_ctrl_domain, power_nb); + + if (action == GENPD_NOTIFY_PRE_OFF) { + if (domain->genpd.status == GENPD_STATE_ON) + return NOTIFY_BAD; + } + + return NOTIFY_OK; +} + static struct lock_class_key blk_ctrl_genpd_lock_class; static int imx8mp_blk_ctrl_probe(struct platform_device *pdev) @@ -698,6 +713,14 @@ static int imx8mp_blk_ctrl_probe(struct goto cleanup_pds; } + domain->power_nb.notifier_call = imx8mp_blk_ctrl_gpc_notifier; + ret = dev_pm_genpd_add_notifier(domain->power_dev, &domain->power_nb); + if (ret) { + dev_err_probe(dev, ret, "failed to add power notifier\n"); + dev_pm_domain_detach(domain->power_dev, true); + goto cleanup_pds; + } + domain->genpd.name = data->name; domain->genpd.power_on = imx8mp_blk_ctrl_power_on; domain->genpd.power_off = imx8mp_blk_ctrl_power_off; @@ -707,6 +730,7 @@ static int imx8mp_blk_ctrl_probe(struct ret = pm_genpd_init(&domain->genpd, NULL, true); if (ret) { dev_err_probe(dev, ret, "failed to init power domain\n"); + dev_pm_genpd_remove_notifier(domain->power_dev); dev_pm_domain_detach(domain->power_dev, true); goto cleanup_pds; } @@ -755,6 +779,7 @@ cleanup_provider: cleanup_pds: for (i--; i >= 0; i--) { pm_genpd_remove(&bc->domains[i].genpd); + dev_pm_genpd_remove_notifier(bc->domains[i].power_dev); dev_pm_domain_detach(bc->domains[i].power_dev, true); } @@ -774,6 +799,7 @@ static void imx8mp_blk_ctrl_remove(struc struct imx8mp_blk_ctrl_domain *domain = &bc->domains[i]; pm_genpd_remove(&domain->genpd); + dev_pm_genpd_remove_notifier(domain->power_dev); dev_pm_domain_detach(domain->power_dev, true); } From - Mon Feb 09 14:26:20 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id 4APCDojuiWmaozoAYBR5ng (envelope-from ) for ; Mon, 09 Feb 2026 14:26:16 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Mon, 09 Feb 2026 14:26:16 +0000 Received: from tor.lore.kernel.org ([172.105.105.114]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vpSDP-0000000GJXn-0NcK for hi@josie.lol; Mon, 09 Feb 2026 14:26:16 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 848EC3017524 for ; Mon, 9 Feb 2026 14:26:12 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 4C04537AA96; Mon, 9 Feb 2026 14:26:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jgaABkGP" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 28E8237A496; Mon, 9 Feb 2026 14:26:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647172; cv=none; b=SiHkmcr+lHLfMrJwo6LFIjREg4iSHPb2wRv4svPvbA2aHjN1t4z3rV8mAz39fvORvwil0sDV9AAFHCe6KyR9VAHklUGaabhVoiGB8ayHmfNgI/X/1p17LqRQnvgaRoABVtzYJdrIAyJOmkxM19nD/E2FM1MVzj8cBx0NF/Zcw8U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647172; c=relaxed/simple; bh=2I821ocIsTWcoskjLjzllF8eJw4+PTDQPAFe26CiPvQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=WN7odKF82qyx22iw+8fNelkXnRSzQSHsVABTgmSLoen29ZZER5i8mdvw8ULPSQZiy65qreZNjfjvcaAXyhZbSG0oPgm9enmb0kszH+BMMjhH/mB0pHqcsijnC2l3ZbtqLIunaGXULruroTnXHzMWpwr+7kopX0S3rmeixBHrlBY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jgaABkGP; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48580C16AAE; Mon, 9 Feb 2026 14:26:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1770647172; bh=2I821ocIsTWcoskjLjzllF8eJw4+PTDQPAFe26CiPvQ=; h=From:To:Cc:Subject:Date:From; b=jgaABkGPsJTJ1lGTXBIQ/rdgWR1nubhLPWcc10KBrd2IxWtZLwNL3aXpEjT6xsOpC eAi+19XpbwQsyKNptfU2mDSmFFOFqBLvKkPJJFKTaKbD4QTj9IyvKLCihNGEjijHPl 55CSkH7tTCxk9WcSIJSUC662O+cPLDaYb+48rg4s= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org, lkft-triage@lists.linaro.org, pavel@nabladev.com, jonathanh@nvidia.com, f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, rwarsow@gmx.de, conor@kernel.org, hargar@microsoft.com, broonie@kernel.org, achill@achill.org, sr@sladewatkins.com Subject: [PATCH 6.18 000/175] 6.18.10-rc1 review Date: Mon, 9 Feb 2026 15:21:13 +0100 Message-ID: <20260209142320.474120190@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.10-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-6.18.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 6.18.10-rc1 X-KernelTest-Deadline: 2026-02-11T14:23+00:00 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 This is the start of the stable review cycle for the 6.18.10 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 11 Feb 2026 14:22:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.10-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 6.18.10-rc1 Nathan Chancellor riscv: Add intermediate cast to 'unsigned long' in __get_user_asm Takashi Iwai ALSA: usb-audio: Use the right limit for PCM OOB check Werner Sembach ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. Vishwaroop A spi: tegra114: Preserve SPI mode bits in def_command1_reg Felix Gu spi: tegra: Fix a memory leak in tegra_slink_probe() Breno Leitao spi: tegra210-quad: Protect curr_xfer check in IRQ handler Breno Leitao spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer Breno Leitao spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer Breno Leitao spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one Breno Leitao spi: tegra210-quad: Move curr_xfer read inside spinlock Breno Leitao spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer Guodong Xu regulator: spacemit-p1: Fix n_voltages for BUCK and LDO regulators LI Qingwu i2c: imx: preserve error state in block data length handler Chen Ni gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() Chris Bainbridge ASoC: amd: fix memory leak in acp3x pdm dma ops Sergey Shtylyov ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() Richard Fitzgerald firmware: cs_dsp: rate-limit log messages in KUnit builds Richard Fitzgerald firmware: cs_dsp: Factor out common debugfs string read Shigeru Yoshida ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF Keith Busch nvme-pci: handle changing device dma map requirements Daniele Ceraolo Spurio drm/xe/guc: Fix CFI violation in debugfs access. Andrew Fasano netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() Arnd Bergmann hwmon: (occ) Mark occ_init_attribute() as __printf Karthik Poosa drm/xe/pm: Disable D3Cold for BMG only on specific platforms Shuicheng Lin drm/xe/query: Fix topology query pointer advance Jacob Keller drm/mgag200: fix mgag200_bmc_stop_scanout() Paolo Abeni net: gro: fix outer network offset Eric Dumazet net: add proper RCU protection to /proc/net/ptype Chen Ni net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() Melissa Wen drm/amd/display: fix wrong color value mapping on MCM shaper LUT Miri Korenblit wifi: iwlwifi: mvm: pause TCM on fast resume Miri Korenblit wifi: iwlwifi: mld: cancel mlo_scan_start_wk Claudiu Manoil net: enetc: Convert 16-bit register reads to 32-bit for ENETC v4 Claudiu Manoil net: enetc: Convert 16-bit register writes to 32-bit for ENETC v4 Claudiu Manoil net: enetc: Remove CBDR cacheability AXI settings for ENETC v4 Claudiu Manoil net: enetc: Remove SI/BDR cacheability AXI settings for ENETC v4 Daniel Hodges tipc: use kfree_sensitive() for session key material Jakub Kicinski net: rss: fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for contexts Jiayuan Chen linkwatch: use __dev_put() in callers to prevent UAF Pavel Begunkov io_uring/zcrx: fix page array leak Jakub Kicinski net: don't touch dev->stats in BPF redirect paths Rafael J. Wysocki hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify() Sergey Senozhatsky net: usb: r8152: fix resume reset deadlock Eric Dumazet macvlan: fix error recovery in macvlan_common_newlink() Marek Behún net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module Mohammad Heib i40e: drop udp_tunnel_get_rx_info() call from i40e_open() Mohammad Heib ice: drop udp_tunnel_get_rx_info() call from ndo_open() Aaron Ma ice: Fix PTP NULL pointer dereference during VSI rebuild Jacob Keller ice: PTP: fix missing timestamps on E825 hardware Grzegorz Nitka ice: fix missing TX timestamps interrupts on E825 devices Junrui Luo dpaa2-switch: add bounds check for if_id in IRQ handler Zilin Guan net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup Zilin Guan net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup Zilin Guan net: liquidio: Initialize netdev pointer before queue setup Junrui Luo dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero Eric Dumazet net/sched: cls_u32: use skb_header_pointer_careful() Eric Dumazet net: add skb_header_pointer_careful() helper leobannocloutier@gmail.com hwmon: (dell-smm) Add Dell G15 5510 to fan control whitelist ChenXiaoSong smb/client: fix memory leak in smb2_open_file() Ricardo Neri platform/x86/intel/tpmi/plr: Make the file domain/status writeable Mario Limonciello platform/x86: hp-bioscfg: Skip empty attribute names Kaushlendra Kumar platform/x86: intel_telemetry: Fix PSS event register mask Rafael J. Wysocki platform/x86: toshiba_haps: Fix memory leaks in add/remove routines Alex Deucher Revert "drm/amd/display: pause the workload setting in dm" Ian Rogers tracing: Avoid possible signed 64-bit truncation Martin Hamilton ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio Qu Wenruo btrfs: reject new transactions if the fs is fully read-only Miri Korenblit wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice Edward Adam Davis btrfs: sync read disk super and set block size Miri Korenblit wifi: mac80211: correctly check if CSA is active Qiang Ma btrfs: fix Wmaybe-uninitialized warning in replay_one_buffer() Maurizio Lombardi scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() Tim Guttzeit ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU Jens Axboe io_uring/rw: free potentially allocated iovec on cache put failure Nathan Chancellor riscv: Use 64-bit variable for output in __get_user_asm Maurizio Lombardi scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() Veerendranath Jakkam wifi: cfg80211: Fix bitrate calculation overflow for HE rates Alan Borzeszkowski spi: intel-pci: Add support for Nova Lake SPI serial flash Lianqin Hu ALSA: usb-audio: Add delay quirk for MOONDROP Moonriver2 Ti Kaushlendra Kumar regmap: maple: free entry on mas_store_gfp() failure Devyn Liu spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization Shenghao Ding ALSA: hda/tas2781: Add newly-released HP laptop Dimitrios Katsaros ASoC: tlv320adcx140: Propagate error codes during probe Radhi Bajahaw ASoC: amd: yc: Fix microphone on ASUS M6500RE Hannes Reinecke nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() Edward Adam Davis ALSA: usb-audio: Prevent excessive number of frames Chaitanya Kulkarni nvme-fc: release admin tagset if init fails Shengjiu Wang ASoC: simple-card-utils: Check device node before overwrite direction Kery Qi ASoC: davinci-evm: Fix reference leak in davinci_evm_probe Guodong Xu dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Deep Harsora ASoC: Intel: sof_sdw: Add new quirks for PTL on Dell with CS42L43 Baochen Qiang wifi: mac80211: collect station statistics earlier when disconnect Arnoud Willemsen HID: Elecom: Add support for ELECOM M-XT3DRBK (018C) Dennis Marttinen HID: logitech: add HID++ support for Logitech MX Anywhere 3S Martin Kaiser riscv: trace: fix snapshot deadlock with sbi ecall Wupeng Ma ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free Perry Yuan drm/amd/pm: Disable MMIO access during SMU Mode 1 reset Rodrigo Lugathe da Conceição Alves HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) Even Xu HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer Kwok Kin Ming HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() Chris Chiu HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list Nathan Chancellor drm/amd/display: Reduce number of arguments of dcn30's CalculatePrefetchSchedule() Daniel Gomez netfilter: replace -EEXIST with -EBUSY Manivannan Sadhasivam PCI: qcom: Remove ASPM L0s support for MSM8996 SoC Ruslan Krupitsa ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk Brendan Jackman x86/sev: Disable GCOV on noinstr object Matouš Lánský ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 Siarhei Vishniakou HID: playstation: Center initial joystick axes to prevent spurious events Zhang Lixu HID: intel-ish-hid: Reset enum_devices_done before enumeration Lukas Gerlach riscv: Sanitize syscall table indexing under speculation Filipe Manana btrfs: fix reservation leak in some error paths when inserting inline extent DaytonCL HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL Zhang Lixu HID: intel-ish-hid: Update ishtp bus match to support device ID table Filipe Manana btrfs: do not free data reservation in fallback from inline due to -ENOSPC ZhangGuoDong smb/server: fix refcount leak in parse_durable_handle_context() Chenghao Duan LoongArch: Enable exception fixup for specific ADE subcode Alexandre Negrel io_uring: use GFP_NOWAIT for overflow CQEs on legacy rings ZhangGuoDong smb/server: fix refcount leak in smb2_open() FengWei Shih md: suspend array while updating raid_disks via sysfs Huacai Chen LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED ZhangGuoDong smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() shechenglong block,bfq: fix aux stat accumulation destination Dmytro Bagrii platform/x86: dell-lis3lv02d: Add Latitude 5400 Yao Zi wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP Ethan Nelson-Moore net: usb: sr9700: support devices with virtual driver CD Johannes Berg wifi: mac80211: don't WARN for connections on invalid channels Peter Åstrand wifi: wlcore: ensure skb headroom before skb_push Moon Hee Lee wifi: mac80211: ocb: skip rx_no_sta when interface is not joined Steven Rostedt tracing: Fix ftrace event field alignments Carlos Llamas binderfs: fix ida_alloc_max() upper bound Carlos Llamas binder: fix BR_FROZEN_REPLY error log Carlos Llamas binder: fix UAF in binder_netlink_report() Carlos Llamas rust_binderfs: fix ida_alloc_max() upper bound Alice Ryhl rust_binder: add additional alignment checks Alice Ryhl rust_binder: correctly handle FDA objects of length zero Peter Zijlstra sched/fair: Have SD_SERIALIZE affect newidle balancing Tim Chen sched/fair: Skip sched_balance_running cmpxchg when balance is not due Daniele Palmas bus: mhi: host: pci_generic: Add Telit FE990B40 modem support Lukas Wunner treewide: Drop pci_save_state() after pci_restore_state() Lukas Wunner PCI/ERR: Ensure error recoverability at all times Gabor Juhos hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled Gabor Juhos hwmon: (gpio-fan) Fix set_rpm() return value Sean Christopherson KVM: Don't clobber irqfd routing type when deassigning irqfd Zhiquan Li KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures Tomas Hlavacek net: spacemit: k1-emac: fix jumbo frame support Kevin Hao net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue Kevin Hao net: cpsw: Execute ndo_set_rx_mode callback in a work queue Dave Airlie nouveau/gsp: fix suspend/resume regression on r570 firmware Dave Airlie nouveau/gsp: use rpc sequence numbers properly. Dave Airlie nouveau: add a third state to the fini handler. Bert Karwatzki Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" Kairui Song mm, shmem: prevent infinite loop on truncate race Max Yuan gve: Correct ethtool rx_dropped calculation Debarghya Kundu gve: Fix stats report corruption on queue count change Mario Limonciello drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52 Chen Ridong cgroup/dmem: avoid pool UAF Chen Ridong cgroup/dmem: avoid rcu warning when unregister region Chen Ridong cgroup/dmem: fix NULL pointer dereference when setting max Daniel Vogelbacher ceph: fix oops due to invalid pointer for kfree() in parse_longname() Thomas Weissschuh ARM: 9468/1: fix memset64() on big-endian Ilya Dryomov rbd: check for EOD after exclusive lock is ensured to be held Viacheslav Dubeyko ceph: fix NULL pointer dereference in ceph_mds_auth_match() Hao Ge mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single Andrii Nakryiko procfs: avoid fetching build ID while holding VMA lock Xu Yang pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains Xu Yang pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup Jacky Bai pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset Xu Yang pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup Gabor Juhos pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state Takashi Iwai ALSA: aloop: Fix racy access at PCM trigger Kaushlendra Kumar platform/x86: intel_telemetry: Fix swapped arrays in PSS output Sean Christopherson KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps() Andrew Cooper x86/kfence: fix booting on 32bit non-PAE systems Josh Poimboeuf x86/vmware: Fix hypercall clobbers YunJe Shin nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec ------------- Diffstat: Makefile | 4 +- arch/arm/include/asm/string.h | 5 +- arch/loongarch/kernel/traps.c | 5 + arch/loongarch/mm/cache.c | 8 +- arch/riscv/include/asm/uaccess.h | 14 +- arch/riscv/kernel/Makefile | 15 +- arch/riscv/kernel/traps.c | 4 +- arch/x86/coco/sev/Makefile | 2 + arch/x86/include/asm/kfence.h | 7 +- arch/x86/include/asm/vmware.h | 4 +- arch/x86/kvm/svm/svm.c | 2 + arch/x86/kvm/vmx/vmx.c | 2 + arch/x86/kvm/x86.c | 30 +-- arch/x86/kvm/x86.h | 2 + block/bfq-cgroup.c | 2 +- drivers/android/binder.c | 19 +- drivers/android/binder/rust_binderfs.c | 8 +- drivers/android/binder/thread.rs | 109 +++++---- drivers/android/binderfs.c | 8 +- drivers/base/regmap/regcache-maple.c | 11 +- drivers/block/rbd.c | 33 ++- drivers/bus/mhi/host/pci_generic.c | 13 ++ drivers/crypto/intel/qat/qat_common/adf_aer.c | 2 - drivers/dma/ioat/init.c | 1 - drivers/dma/mmp_pdma.c | 6 + drivers/firmware/cirrus/cs_dsp.c | 82 +++++-- drivers/firmware/cirrus/cs_dsp.h | 18 ++ drivers/firmware/cirrus/test/cs_dsp_test_bin.c | 22 +- .../firmware/cirrus/test/cs_dsp_test_bin_error.c | 24 +- drivers/firmware/cirrus/test/cs_dsp_test_wmfw.c | 26 ++- .../firmware/cirrus/test/cs_dsp_test_wmfw_error.c | 24 +- drivers/firmware/cirrus/test/cs_dsp_tests.c | 1 + drivers/gpio/gpio-loongson-64bit.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 - drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 11 - .../gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 7 +- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 258 ++++++--------------- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 7 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 9 +- drivers/gpu/drm/mgag200/mgag200_bmc.c | 31 +-- drivers/gpu/drm/mgag200/mgag200_drv.h | 6 + drivers/gpu/drm/nouveau/include/nvif/client.h | 2 +- drivers/gpu/drm/nouveau/include/nvif/driver.h | 2 +- drivers/gpu/drm/nouveau/include/nvkm/core/device.h | 3 +- drivers/gpu/drm/nouveau/include/nvkm/core/engine.h | 2 +- drivers/gpu/drm/nouveau/include/nvkm/core/object.h | 5 +- drivers/gpu/drm/nouveau/include/nvkm/core/oproxy.h | 2 +- drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h | 4 +- .../drm/nouveau/include/nvkm/core/suspend_state.h | 11 + drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h | 6 + drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_nvif.c | 10 +- drivers/gpu/drm/nouveau/nvif/client.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/engine.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/ioctl.c | 4 +- drivers/gpu/drm/nouveau/nvkm/core/object.c | 20 +- drivers/gpu/drm/nouveau/nvkm/core/oproxy.c | 2 +- drivers/gpu/drm/nouveau/nvkm/core/subdev.c | 18 +- drivers/gpu/drm/nouveau/nvkm/core/uevent.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ce/ga100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/ce/priv.h | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 22 +- drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/device/priv.h | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/device/user.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/chan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/falcon.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv04.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv10.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv20.h | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/nv40.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/sec2/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/xtensa.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/devinit/base.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/fault/user.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gpio/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/gh100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h | 8 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/fbsr.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 8 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 6 + .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c | 8 +- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/tu102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 6 +- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 2 +- drivers/gpu/drm/xe/xe_guc.c | 6 +- drivers/gpu/drm/xe/xe_guc.h | 2 +- drivers/gpu/drm/xe/xe_pm.c | 13 +- drivers/gpu/drm/xe/xe_query.c | 2 +- drivers/hid/hid-elecom.c | 15 +- drivers/hid/hid-ids.h | 7 +- drivers/hid/hid-logitech-hidpp.c | 2 + drivers/hid/hid-multitouch.c | 1 + drivers/hid/hid-playstation.c | 5 + drivers/hid/hid-quirks.c | 5 +- drivers/hid/i2c-hid/i2c-hid-core.c | 1 + drivers/hid/intel-ish-hid/ishtp-hid-client.c | 1 + drivers/hid/intel-ish-hid/ishtp/bus.c | 12 +- .../hid/intel-thc-hid/intel-thc/intel-thc-dma.c | 5 + drivers/hwmon/acpi_power_meter.c | 17 +- drivers/hwmon/dell-smm-hwmon.c | 8 + drivers/hwmon/gpio-fan.c | 6 +- drivers/hwmon/occ/common.c | 1 + drivers/i2c/busses/i2c-imx.c | 3 +- drivers/md/md.c | 4 +- drivers/net/ethernet/adi/adin1110.c | 3 + drivers/net/ethernet/broadcom/bnx2.c | 2 - drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 1 - drivers/net/ethernet/broadcom/tg3.c | 1 - drivers/net/ethernet/cavium/liquidio/lio_main.c | 39 ++-- drivers/net/ethernet/cavium/liquidio/lio_vf_main.c | 4 +- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 1 - drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 - .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 10 + drivers/net/ethernet/freescale/enetc/enetc.c | 11 +- drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 6 +- drivers/net/ethernet/freescale/enetc/enetc_cbdr.c | 4 - drivers/net/ethernet/freescale/enetc/enetc_hw.h | 17 +- drivers/net/ethernet/google/gve/gve_ethtool.c | 77 +++--- drivers/net/ethernet/google/gve/gve_main.c | 4 +- drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 1 - drivers/net/ethernet/intel/e1000e/netdev.c | 1 - drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 6 - drivers/net/ethernet/intel/i40e/i40e_main.c | 2 - drivers/net/ethernet/intel/ice/ice_main.c | 28 +-- drivers/net/ethernet/intel/ice/ice_ptp.c | 179 ++++++++------ drivers/net/ethernet/intel/ice/ice_ptp.h | 18 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 - drivers/net/ethernet/intel/igc/igc_main.c | 2 - drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 1 - drivers/net/ethernet/mellanox/mlx4/main.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 - drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 1 - drivers/net/ethernet/microchip/lan743x_main.c | 1 - drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 4 - drivers/net/ethernet/neterion/s2io.c | 1 - drivers/net/ethernet/spacemit/k1_emac.c | 21 +- drivers/net/ethernet/ti/cpsw.c | 41 +++- drivers/net/ethernet/ti/cpsw_new.c | 34 ++- drivers/net/ethernet/ti/cpsw_priv.h | 1 + drivers/net/macvlan.c | 5 +- drivers/net/phy/sfp.c | 2 + drivers/net/usb/r8152.c | 29 +-- drivers/net/usb/sr9700.c | 5 + drivers/net/wireless/intel/iwlwifi/mld/iface.c | 2 - drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 + drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 7 + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 7 + drivers/net/wireless/ti/wlcore/tx.c | 5 + drivers/nvme/host/fc.c | 2 + drivers/nvme/host/pci.c | 45 ++-- drivers/nvme/target/tcp.c | 26 ++- drivers/pci/bus.c | 3 + drivers/pci/controller/dwc/pcie-qcom.c | 4 +- drivers/pci/pci.c | 3 - drivers/pci/pcie/portdrv.c | 1 - drivers/platform/x86/dell/dell-lis3lv02d.c | 1 + drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 5 + drivers/platform/x86/intel/plr_tpmi.c | 2 +- drivers/platform/x86/intel/telemetry/debugfs.c | 4 +- drivers/platform/x86/intel/telemetry/pltdrv.c | 2 +- drivers/platform/x86/toshiba_haps.c | 2 +- drivers/pmdomain/imx/gpcv2.c | 8 +- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 2 +- drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 30 +++ drivers/pmdomain/qcom/rpmpd.c | 2 +- drivers/regulator/spacemit-p1.c | 6 +- drivers/scsi/bfa/bfad.c | 1 - drivers/scsi/csiostor/csio_init.c | 1 - drivers/scsi/ipr.c | 1 - drivers/scsi/lpfc/lpfc_init.c | 6 - drivers/scsi/qla2xxx/qla_os.c | 5 - drivers/scsi/qla4xxx/ql4_os.c | 5 - drivers/spi/spi-hisi-kunpeng.c | 4 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-tegra114.c | 3 + drivers/spi/spi-tegra20-slink.c | 6 +- drivers/spi/spi-tegra210-quad.c | 56 ++++- drivers/target/iscsi/iscsi_target_util.c | 10 +- drivers/tty/serial/8250/8250_pci.c | 1 - drivers/tty/serial/jsm/jsm_driver.c | 1 - fs/btrfs/disk-io.c | 13 ++ fs/btrfs/fs.h | 8 + fs/btrfs/inode.c | 22 +- fs/btrfs/tree-log.c | 2 +- fs/btrfs/volumes.c | 2 + fs/ceph/crypto.c | 9 +- fs/ceph/mds_client.c | 5 +- fs/ceph/mdsmap.c | 26 ++- fs/ceph/mdsmap.h | 1 + fs/ceph/super.h | 16 +- fs/proc/task_mmu.c | 42 ++-- fs/smb/client/smb2file.c | 1 + fs/smb/server/smb2pdu.c | 8 +- include/linux/buildid.h | 3 + include/linux/ceph/ceph_fs.h | 6 + include/linux/firmware/cirrus/cs_dsp.h | 4 +- include/linux/skbuff.h | 12 + io_uring/io_uring.c | 2 +- io_uring/rw.c | 15 +- io_uring/zcrx.c | 1 + kernel/cgroup/dmem.c | 70 +++++- kernel/sched/fair.c | 54 ++--- kernel/trace/ring_buffer.c | 2 + kernel/trace/trace.c | 8 +- kernel/trace/trace.h | 7 +- kernel/trace/trace_entries.h | 32 +-- kernel/trace/trace_export.c | 21 +- lib/buildid.c | 42 +++- mm/shmem.c | 23 +- mm/slub.c | 6 +- net/bridge/netfilter/ebtables.c | 2 +- net/core/filter.c | 8 +- net/core/gro.c | 2 + net/core/link_watch.c | 20 +- net/core/net-procfs.c | 50 ++-- net/ethtool/common.c | 3 - net/ethtool/rss.c | 9 +- net/ipv6/ip6_fib.c | 3 +- net/mac80211/iface.c | 8 +- net/mac80211/key.c | 3 +- net/mac80211/mlme.c | 5 +- net/mac80211/ocb.c | 3 + net/mac80211/sta_info.c | 7 +- net/netfilter/nf_log.c | 4 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/x_tables.c | 2 +- net/sched/cls_u32.c | 13 +- net/tipc/crypto.c | 4 +- net/wireless/util.c | 8 +- sound/drivers/aloop.c | 62 ++--- sound/hda/codecs/realtek/alc269.c | 27 ++- sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 5 +- sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/tlv320adcx140.c | 3 + sound/soc/generic/simple-card-utils.c | 4 +- sound/soc/intel/boards/sof_sdw.c | 8 + sound/soc/ti/davinci-evm.c | 39 +++- sound/usb/mixer_quirks.c | 9 +- sound/usb/pcm.c | 3 +- sound/usb/quirks.c | 2 + tools/testing/selftests/kvm/Makefile.kvm | 1 + virt/kvm/eventfd.c | 44 ++-- 265 files changed, 1872 insertions(+), 1033 deletions(-) From - Mon Feb 09 14:26:41 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id QCHyJJzuiWk7jjgAYBR5ng (envelope-from ) for ; Mon, 09 Feb 2026 14:26:36 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Mon, 09 Feb 2026 14:26:36 +0000 Received: from sto.lore.kernel.org ([172.232.135.74]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vpSDk-0000000GKA0-0jkL for hi@josie.lol; Mon, 09 Feb 2026 14:26:36 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id B68D5300AB28 for ; Mon, 9 Feb 2026 14:26:22 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 5EEB637A496; Mon, 9 Feb 2026 14:26:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="WHZ43Kcd" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C99A37997D; Mon, 9 Feb 2026 14:26:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647182; cv=none; b=ZG3uIdSjShunkbBrELEYzSpwhDZ2sQl8KRxEMHcahX3obEPDYj/j1h32wTgwRpdDapIdM8nkc9GGPwgUn4Vo9T0XTewdeemFbkq1lx0DALRzFkmn+eOPQ5OmymWF3JbGJUzqFeNfg07JuSR+fMC6U/Te6wEGa8w9wJIuD1jKy9U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770647182; c=relaxed/simple; bh=L1ajPb3YaHTnOZtHHGum1ITzDaetJVTK1un6QqNFiVs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L+AGu40O12bg/RsakQxV1LBfZ9FsL0g+AhM7GBn9ee9DAZwn/7fRH9Jppv43nY3pTbuf1aLCVEcU13mrBcDr5LLPhcL0fLHyR5VcT16LUm/bUrQSOvOlYTcT7aMpcWLX8YFTh/g5zpJt2bAUNRtW7oiiMHjHTMPLlOyDgKhaWY8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WHZ43Kcd; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81B8CC116C6; Mon, 9 Feb 2026 14:26:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1770647182; bh=L1ajPb3YaHTnOZtHHGum1ITzDaetJVTK1un6QqNFiVs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WHZ43KcdCDA8rODwz2QF/zlgQiAaZ0QSkN0fWkHo4u3RPa1mrnPwyVij9oZYLmOrN jkDjARAZ6dQcXrkgyGEGT6p8wWje0X9lcjHl1O9InUBhVX3WdP4VdFY8avwXds+cWe J273cEoSgdnwaMORWW++Ug7La5RWmaekAS3Tv7L4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Kairui Song , Chris Mason , Baolin Wang , Baoquan He , Barry Song , Chris Li , Hugh Dickins , Kemeng Shi , Nhat Pham , Andrew Morton Subject: [PATCH 6.18 024/175] mm, shmem: prevent infinite loop on truncate race Date: Mon, 9 Feb 2026 15:21:37 +0100 Message-ID: <20260209142321.349534204@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260209142320.474120190@linuxfoundation.org> References: <20260209142320.474120190@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.232.135.74 listed in list.dnswl.org] -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kairui Song commit 2030dddf95451b4e7a389f052091e7c4b7b274c6 upstream. When truncating a large swap entry, shmem_free_swap() returns 0 when the entry's index doesn't match the given index due to lookup alignment. The failure fallback path checks if the entry crosses the end border and aborts when it happens, so truncate won't erase an unexpected entry or range. But one scenario was ignored. When `index` points to the middle of a large swap entry, and the large swap entry doesn't go across the end border, find_get_entries() will return that large swap entry as the first item in the batch with `indices[0]` equal to `index`. The entry's base index will be smaller than `indices[0]`, so shmem_free_swap() will fail and return 0 due to the "base < index" check. The code will then call shmem_confirm_swap(), get the order, check if it crosses the END boundary (which it doesn't), and retry with the same index. The next iteration will find the same entry again at the same index with same indices, leading to an infinite loop. Fix this by retrying with a round-down index, and abort if the index is smaller than the truncate range. Link: https://lkml.kernel.org/r/aXo6ltB5iqAKJzY8@KASONG-MC4 Fixes: 809bc86517cc ("mm: shmem: support large folio swap out") Fixes: 8a1968bd997f ("mm/shmem, swap: fix race of truncate and swap entry split") Signed-off-by: Kairui Song Reported-by: Chris Mason Closes: https://lore.kernel.org/linux-mm/20260128130336.727049-1-clm@meta.com/ Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Hugh Dickins Cc: Kemeng Shi Cc: Nhat Pham Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- mm/shmem.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1193,17 +1193,22 @@ whole_folios: swaps_freed = shmem_free_swap(mapping, indices[i], end - 1, folio); if (!swaps_freed) { - /* - * If found a large swap entry cross the end border, - * skip it as the truncate_inode_partial_folio above - * should have at least zerod its content once. - */ + pgoff_t base = indices[i]; + order = shmem_confirm_swap(mapping, indices[i], radix_to_swp_entry(folio)); - if (order > 0 && indices[i] + (1 << order) > end) - continue; - /* Swap was replaced by page: retry */ - index = indices[i]; + /* + * If found a large swap entry cross the end or start + * border, skip it as the truncate_inode_partial_folio + * above should have at least zerod its content once. + */ + if (order > 0) { + base = round_down(base, 1 << order); + if (base < start || base + (1 << order) > end) + continue; + } + /* Swap was replaced by page or extended, retry */ + index = base; break; } nr_swaps_freed += swaps_freed; From - Mon Feb 09 14:26:47 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id iCDzJ6LuiWndVjoAYBR5ng (envelope-from ) for ; Mon, 09 Feb 2026 14:26:42 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Mon, 09 Feb 2026 14:26:42 +0000 Received: from tor.lore.kernel.org ([172.105.105.114]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vpSDq-0000000GKOF-1i7f for hi@josie.lol; Mon, 09 Feb 2026 14:26:42 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id E2BF0301947A for ; Mon, 9 Feb 2026 14:26:35 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9651137B3E9; Mon, 9 Feb 2026 14:26:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Cv/ETpjJ" X-Original-To: stable@vger.kernel.org Received: from smtp.k