age-ID: <20260115164155.849566108@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164151.948839306@linuxfoundation.org> References: <20260115164151.948839306@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.232.135.74 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fei Shao [ Upstream commit 8c04b77f87e6e321ae6acd28ce1de5553916153f ] This driver is migrated to use threaded IRQ since commit 5972eb05ca32 ("spi: spi-mt65xx: Use threaded interrupt for non-SPIMEM transfer"), and we almost always want to disable the interrupt line to avoid excess interrupts while the threaded handler is processing SPI transfer. Use IRQF_ONESHOT for that purpose. In practice, we see MediaTek devices show SPI transfer timeout errors when communicating with ChromeOS EC in certain scenarios, and with IRQF_ONESHOT, the issue goes away. Signed-off-by: Fei Shao Link: https://patch.msgid.link/20251217101131.1975131-1-fshao@chromium.org Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- drivers/spi/spi-mt65xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c index dfee244fc3173..5532ace0b1334 100644 --- a/drivers/spi/spi-mt65xx.c +++ b/drivers/spi/spi-mt65xx.c @@ -1266,7 +1266,7 @@ static int mtk_spi_probe(struct platform_device *pdev) ret = devm_request_threaded_irq(dev, irq, mtk_spi_interrupt, mtk_spi_interrupt_thread, - IRQF_TRIGGER_NONE, dev_name(dev), host); + IRQF_ONESHOT, dev_name(dev), host); if (ret) return dev_err_probe(dev, ret, "failed to register irq\n"); -- 2.51.0 From - Thu Jan 15 17:07:33 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id gA9eA9EeaWlaDBgAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 17:07:29 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 17:07:29 +0000 Received: from sea.lore.kernel.org ([172.234.253.10]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgQoi-00000006qP5-39oX for hi@josie.lol; Thu, 15 Jan 2026 17:07:29 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id 0ACD530BBDF3 for ; Thu, 15 Jan 2026 17:00:20 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id AB0A92C028F; Thu, 15 Jan 2026 17:00:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="uTg6wUx8" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 883FE2BE7C6; Thu, 15 Jan 2026 17:00:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496419; cv=none; b=TNxhebjTmYU3h2+Y5H8D3IF66KruBils2kRrroGMB7txqwRLd9Tx1OOxsaNXkFQjkE+Em7NoLRQcRaXQFrpom9ZVbvO20Wr6VhMLDdI+WahDK9bvl6v08aR+lfIFGWCepSTff0j/wIzUevE/WtPofmtUAIjIq9a33hkb0THLivg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496419; c=relaxed/simple; bh=UIBdPndzv5+0MabyG6GJ7aqZHrnlIFJZGCM4bI97Lmk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EXxGEQQ/cYfTY4XFM18I8yTKhmZK4zTvFN/kH/lKwTB/qQ4lKjTjB95dgM7BoTeScv/tRnDc8i3peTfDO85bd+UbapPBO9EvdV01vPwz9Vne88yh1VPydgRx7JjTFD3py0ywkyde20OAhDetkD8iiAKOgdv4BLS845xM7AhDGLM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uTg6wUx8; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18CDCC116D0; Thu, 15 Jan 2026 17:00:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768496419; bh=UIBdPndzv5+0MabyG6GJ7aqZHrnlIFJZGCM4bI97Lmk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uTg6wUx880qiAphkkS5Wdhk17IHpixgj/YqAnkxN5qJUyRLnzhcddw8KJyQE2i00d i19Jtd52fFCb5Tp190rswC0FL9KD/E8o3Gt8hbNJOt+LFfVbFf+edUhAKl7LuP2m4W gYL5Jhv8CZlj517wtsH6/PDLyC/IcB74PnwaCtKg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Mateusz Litwin , Mark Brown , Sasha Levin Subject: [PATCH 6.18 181/181] spi: cadence-quadspi: Prevent lost complete() call during indirect read Date: Thu, 15 Jan 2026 17:48:38 +0100 Message-ID: <20260115164208.847590764@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164202.305475649@linuxfoundation.org> References: <20260115164202.305475649@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.234.253.10 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mateusz Litwin [ Upstream commit d67396c9d697041b385d70ff2fd59cb07ae167e8 ] A race condition exists between the read loop and IRQ `complete()` call. An interrupt could call the complete() between the inner loop and reinit_completion(), potentially losing the completion event and causing an unnecessary timeout. Moving reinit_completion() before the loop prevents this. A premature signal will only result in a spurious wakeup and another wait cycle, which is preferable to waiting for a timeout. Signed-off-by: Mateusz Litwin Link: https://patch.msgid.link/20251218-cqspi_indirect_read_improve-v2-1-396079972f2a@nokia.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- drivers/spi/spi-cadence-quadspi.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c index 3231bdaf9bd06..1cca9d87fbde4 100644 --- a/drivers/spi/spi-cadence-quadspi.c +++ b/drivers/spi/spi-cadence-quadspi.c @@ -769,6 +769,7 @@ static int cqspi_indirect_read_execute(struct cqspi_flash_pdata *f_pdata, readl(reg_base + CQSPI_REG_INDIRECTRD); /* Flush posted write. */ while (remaining > 0) { + ret = 0; if (use_irq && !wait_for_completion_timeout(&cqspi->transfer_complete, msecs_to_jiffies(CQSPI_READ_TIMEOUT_MS))) @@ -781,6 +782,14 @@ static int cqspi_indirect_read_execute(struct cqspi_flash_pdata *f_pdata, if (cqspi->slow_sram) writel(0x0, reg_base + CQSPI_REG_IRQMASK); + /* + * Prevent lost interrupt and race condition by reinitializing early. + * A spurious wakeup and another wait cycle can occur here, + * which is preferable to waiting until timeout if interrupt is lost. + */ + if (use_irq) + reinit_completion(&cqspi->transfer_complete); + bytes_to_read = cqspi_get_rd_sram_level(cqspi); if (ret && bytes_to_read == 0) { @@ -813,7 +822,6 @@ static int cqspi_indirect_read_execute(struct cqspi_flash_pdata *f_pdata, } if (use_irq && remaining > 0) { - reinit_completion(&cqspi->transfer_complete); if (cqspi->slow_sram) writel(CQSPI_REG_IRQ_WATERMARK, reg_base + CQSPI_REG_IRQMASK); } -- 2.51.0 From - Thu Jan 15 17:07:36 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id KLi4NNEeaWnAdRcAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 17:07:29 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 17:07:30 +0000 Received: from sto.lore.kernel.org ([172.232.135.74]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgQoj-00000006qPo-20ZG for hi@josie.lol; Thu, 15 Jan 2026 17:07:29 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id 4C8FB302A3D0 for ; Thu, 15 Jan 2026 17:06:43 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 89F663BFE25; Thu, 15 Jan 2026 17:06:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="SLVDr0RV" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6755B3BF2F6; Thu, 15 Jan 2026 17:06:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496765; cv=none; b=AzUaFdPEr5awjjVIOqice2MYTfPOHqU8QlqHhRQPXJqxiVGRyG9mTTTdSQmJ2APK7UcMLt/SX6jkGa1TSFnZZkFA7o6namaaUQJAY0jXDfdlj+dtLBlaqD8cc8u3DsyVodEvHsvCYGiRm9JpleGQHxhX+jUjr6NuVt757HewdSA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496765; c=relaxed/simple; bh=tUvw6uLFlWsSTnHmM9HcGgNC3cG3kP1IUuMCXxoO65U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=tcOQ//jA8BuGY1y4B4s3dxwsw6NRjybQ+DQyGxBYRpEFfw4CAb3FQP6Evg0LeVtghB64IVJOM5WmLB4849tqEyFlnJQQz5rFQmP5RCySrzD04X1UqRjU3WFcC9jvdLBsMoUjDac9utGftCLkoMDmoPUD5L0w5gmW5S2Z0depoiA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SLVDr0RV; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5E21C19422; Thu, 15 Jan 2026 17:06:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768496765; bh=tUvw6uLFlWsSTnHmM9HcGgNC3cG3kP1IUuMCXxoO65U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SLVDr0RVStMzFwwTQWl05nZclqBJvSsYvNO1pjCNdH2f6lAfBWaTSGW4FRobbIFeZ VPrWSy8wFSedh4bFL+Ebg4kM/s2H7rmEEeA9/u1K1TTWCCb/DHd4wyYR57xmMoJCkf p7BEIXoyPmnVCn5c2afBbU0swaaVMBpyMSKxm+dk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yinhao Hu , Kaiyan Mei , =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Amery Hung , Alexei Starovoitov , Sasha Levin Subject: [PATCH 6.12 100/119] bpf, test_run: Subtract size of xdp_frame from allowed metadata size Date: Thu, 15 Jan 2026 17:48:35 +0100 Message-ID: <20260115164155.562651773@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164151.948839306@linuxfoundation.org> References: <20260115164151.948839306@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Toke Høiland-Jørgensen [ Upstream commit e558cca217790286e799a8baacd1610bda31b261 ] The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom). If userspace supplies such a large metadata size in live packet mode, the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff. The commit in the Fixes tag fixed a related bug where the second check in xdp_update_frame_from_buff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment. Link: https://lore.kernel.org/r/fa2be179-bad7-4ee3-8668-4903d1853461@hust.edu.cn Fixes: b6f1f780b393 ("bpf, test_run: Fix packet size check for live packet mode") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Signed-off-by: Toke Høiland-Jørgensen Reviewed-by: Amery Hung Link: https://lore.kernel.org/r/20260105114747.1358750-1-toke@redhat.com Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin --- net/bpf/test_run.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 318ffd55cf608..84ed67a15dee0 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -1230,8 +1230,6 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, batch_size = NAPI_POLL_WEIGHT; else if (batch_size > TEST_XDP_MAX_BATCH) return -E2BIG; - - headroom += sizeof(struct xdp_page_head); } else if (batch_size) { return -EINVAL; } @@ -1244,16 +1242,26 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr, /* There can't be user provided data before the meta data */ if (ctx->data_meta || ctx->data_end > kattr->test.data_size_in || ctx->data > ctx->data_end || - unlikely(xdp_metalen_invalid(ctx->data)) || (do_live && (kattr->test.data_out || kattr->test.ctx_out))) goto free_ctx; - /* Meta data is allocated from the headroom */ - headroom -= ctx->data; meta_sz = ctx->data; + if (xdp_metalen_invalid(meta_sz) || meta_sz > headroom - sizeof(struct xdp_frame)) + goto free_ctx; + + /* Meta data is allocated from the headroom */ + headroom -= meta_sz; linear_sz = ctx->data_end; } + /* The xdp_page_head structure takes up space in each page, limiting the + * size of the packet data; add the extra size to headroom here to make + * sure it's accounted in the length checks below, but not in the + * metadata size check above. + */ + if (do_live) + headroom += sizeof(struct xdp_page_head); + max_linear_sz = PAGE_SIZE - headroom - tailroom; linear_sz = min_t(u32, linear_sz, max_linear_sz); -- 2.51.0 From - Thu Jan 15 17:07:36 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id IKE7IdMeaWlaDBgAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 17:07:31 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 17:07:31 +0000 Received: from sto.lore.kernel.org ([172.232.135.74]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgQol-00000006qUI-0sNb for hi@josie.lol; Thu, 15 Jan 2026 17:07:31 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id 30198301AB9C for ; Thu, 15 Jan 2026 17:06:44 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 99BF53BF31C; Thu, 15 Jan 2026 17:06:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="p0yhitkA" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6AFE73BF2FD; Thu, 15 Jan 2026 17:06:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496768; cv=none; b=u6aYPqiHvnfHuBHczgL8nvXI9KHAonap778Uq5Mj/1b3By9ZVFH6d+kYtO9SbL4H9LSoKxSZdHdJCPFwwbIHGcS1f4beaQfiTGxR+yBh8rI/cuWTN8gTmp7xe67HTdhijFhzqRyqxGsqfsirt/i7fYn93leFGKnBGqL2GyOJNMY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496768; c=relaxed/simple; bh=cv3fDb0aNN8QZYXIOxICMe++yD6vjj+Za01SoMYXOKw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IlZnEt/PwWri699UHHkDkKYIC1hzc7Lrnn8azMomFEmAItJHflEJK38YM7ZycjO0FCiLtIkoMH0OqqmR5MJCdHOfDedkb4Txy+HroS1o1+zXV9+OXT9XSRLfp9WNOxVr9743+UIxmwK1YmJKHhBx94fuoY9rnmxVHqobroHa64Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=p0yhitkA; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6087C116D0; Thu, 15 Jan 2026 17:06:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768496768; bh=cv3fDb0aNN8QZYXIOxICMe++yD6vjj+Za01SoMYXOKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p0yhitkA0DZevx1UyYhqZSeuVBYtlv2lds3qdJm9Pk9pMnh4Am8CTcedm/cVNWYXb uFxcJ/eSoNQIecQoJ7FM5QsInIr5B/O9l6HVarQc19Muk8uTehRr5RUB0tYwv2BVyt I15E+KWNq+sA9U+L8gc6bC2rx3YK50cJ2RT4XXEU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Scott Mayhew , Jeff Layton , NeilBrown , Chuck Lever Subject: [PATCH 6.6 01/88] NFSD: Fix permission check for read access to executable-only files Date: Thu, 15 Jan 2026 17:47:44 +0100 Message-ID: <20260115164146.369101014@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164146.312481509@linuxfoundation.org> References: <20260115164146.312481509@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.232.135.74 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Scott Mayhew commit e901c7fce59e72d9f3c92733c379849c4034ac50 upstream. Commit abc02e5602f7 ("NFSD: Support write delegations in LAYOUTGET") added NFSD_MAY_OWNER_OVERRIDE to the access flags passed from nfsd4_layoutget() to fh_verify(). This causes LAYOUTGET to fail for executable-only files, and causes xfstests generic/126 to fail on pNFS SCSI. To allow read access to executable-only files, what we really want is: 1. The "permissions" portion of the access flags (the lower 6 bits) must be exactly NFSD_MAY_READ 2. The "hints" portion of the access flags (the upper 26 bits) can contain any combination of NFSD_MAY_OWNER_OVERRIDE and NFSD_MAY_READ_IF_EXEC Fixes: abc02e5602f7 ("NFSD: Support write delegations in LAYOUTGET") Cc: stable@vger.kernel.org # v6.6+ Signed-off-by: Scott Mayhew Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman --- fs/nfsd/vfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -2474,8 +2474,8 @@ nfsd_permission(struct svc_rqst *rqstp, /* Allow read access to binaries even when mode 111 */ if (err == -EACCES && S_ISREG(inode->i_mode) && - (acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) || - acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC))) + (((acc & NFSD_MAY_MASK) == NFSD_MAY_READ) && + (acc & (NFSD_MAY_OWNER_OVERRIDE | NFSD_MAY_READ_IF_EXEC)))) err = inode_permission(&nop_mnt_idmap, inode, MAY_EXEC); return err? nfserrno(err) : 0; From - Thu Jan 15 17:07:36 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id IIp+E9UeaWm4dRcAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 17:07:33 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 17:07:33 +0000 Received: from sto.lore.kernel.org ([172.232.135.74]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgQom-00000006qUI-2X2j for hi@josie.lol; Thu, 15 Jan 2026 17:07:33 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id 2403A302A835 for ; Thu, 15 Jan 2026 17:06:45 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 73BD23BFE27; Thu, 15 Jan 2026 17:06:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="FreKbzYH" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 508C43BF2FD; Thu, 15 Jan 2026 17:06:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496771; cv=none; b=QVQoXjfDYNf5aJ5cE+zsELXmZO1FcsFBQ/e6s+l93gWhalPMinve3NGY3Jn2Zd1d3vlWRWnrF1g0yZu0E7d6Ly2NIVAZbWMqTD32+aNshXb/twmlsBGr/5Vw8NtbiIp9w1lHXD+x2xfku+HdYjHY0nA9jZ43UZM1JNyWYqTZyFQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496771; c=relaxed/simple; bh=QwodK+MVD5QVRouDn0D6fBFGXlqdxOqtCtSCqeGHWXI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=NTvQpW3FQNBLG5stjbpQXn07c2cLegBMSSaI2vrJ1gfZMTaNH0H9lQuDmNbDWhFTwOhZIAd2+k/c2PGNRndCbP4uIxi10/7mvvYdLlA2xac3w26d+xmSux/FDBuMg8V8pd6uq4WaZua0o8XKdfb4rMnC6Tl869fWdpKT2l5fc1c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FreKbzYH; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65057C116D0; Thu, 15 Jan 2026 17:06:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768496770; bh=QwodK+MVD5QVRouDn0D6fBFGXlqdxOqtCtSCqeGHWXI=; h=From:To:Cc:Subject:Date:From; b=FreKbzYHCzVTDykNR21vhtXIQ5Q3qxVGUaWd3U7V5KtBGORJnKOS+r/OEZA1IYEyF lY6okrTcoZCwsTQH2cHIguGd00iTu4D4eeOG4wRlRMrVkBYTZuoGRKZBaPPIQwvZiQ TbGScD/ktVGUin0iRR/4sC1tWJwSW3Ood3WeM0Bk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org, lkft-triage@lists.linaro.org, pavel@denx.de, jonathanh@nvidia.com, f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, rwarsow@gmx.de, conor@kernel.org, hargar@microsoft.com, broonie@kernel.org, achill@achill.org, sr@sladewatkins.com Subject: [PATCH 6.6 00/88] 6.6.121-rc1 review Date: Thu, 15 Jan 2026 17:47:43 +0100 Message-ID: <20260115164146.312481509@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.121-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-6.6.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 6.6.121-rc1 X-KernelTest-Deadline: 2026-01-17T16:41+00:00 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.232.135.74 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 This is the start of the stable review cycle for the 6.6.121 release. There are 88 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 17 Jan 2026 16:41:26 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.121-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 6.6.121-rc1 Sascha Hauer gpio: pca953x: fix wrong error probe return value Shardul Bankar bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path Michal Rábek scsi: sg: Fix occasional bogus elapsed time that exceeds timeout Alexander Stein ASoC: fsl_sai: Add missing registers to cache default Andrew Elantsev ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 Jussi Laako ALSA: usb-audio: Update for native DSD support quirks Tetsuo Handa can: j1939: make j1939_session_activate() fail if device is no longer registered Charlene Liu drm/amd/display: Fix DP no audio issue Florian Westphal netfilter: nf_tables: avoid chain re-validation if possible Sumeet Pawnikar powercap: fix sscanf() error return value handling Sumeet Pawnikar powercap: fix race condition in register_control_type() Tetsuo Handa bpf: Fix reference count leak in bpf_prog_test_run_xdp() Toke Høiland-Jørgensen bpf, test_run: Subtract size of xdp_frame from allowed metadata size Amery Hung bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN Amery Hung bpf: Make variables in bpf_prog_test_run_xdp less confusing Yonghong Song bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K Björn Töpel riscv: uprobes: Add missing fence.i after building the XOL buffer Borislav Petkov (AMD) x86/microcode/AMD: Select which microcode patch to load Chuck Lever NFSD: Remove NFSERR_EAGAIN Mike Snitzer nfs_common: factor out nfs_errtbl and nfs_stat_to_errno Chen Hanxiao NFS: trace: show TIMEDOUT instead of 0x6e Haoxiang Li ALSA: ac97: fix a double free in snd_ac97_controller_register() Takashi Iwai ALSA: ac97bus: Use guard() for mutex locks Hengqi Chen LoongArch: Add more instruction opcodes and emit_* helpers Eric Dumazet arp: do not assume dev_hard_header() does not change skb->head Wei Fang net: enetc: fix build warning when PAGE_SIZE is greater than 128K Petko Manolov net: usb: pegasus: fix memory leak in update_eth_regs_async() Xiang Mei net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset René Rebe HID: quirks: work around VID/PID conflict for appledisplay Mohammad Heib net: fix memory leak in skb_segment_list for GRO packets Srijit Bose bnxt_en: Fix potential data corruption with HW GRO/LRO Zilin Guan net: wwan: iosm: Fix memory leak in ipc_mux_deinit() Gal Pressman net/mlx5e: Don't print error message due to invalid module Di Zhu netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates Weiming Shi net: sock: fix hardened usercopy panic in sock_recv_errqueue yuan.gao inet: ping: Fix icmp out counting Jerry Wu net: mscc: ocelot: Fix crash when adding interface under a lag Alexandre Knecht bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress Alok Tiwari net: marvell: prestera: fix NULL dereference on devlink_alloc() failure Fernando Fernandez Mancera netfilter: nf_conncount: update last_gc only when GC has been performed Zilin Guan netfilter: nf_tables: fix memory leak in nf_tables_newrule() Ernest Van Hoecke gpio: pca953x: handle short interrupt pulses on PCAL devices Potin Lai gpio: pca953x: Add support for level-triggered interrupts Andy Shevchenko gpio: pca953x: Utilise temporary variable for struct device Andy Shevchenko gpio: pca953x: Utilise dev_err_probe() where it makes sense Fernando Fernandez Mancera netfilter: nft_synproxy: avoid possible data-race on update operation Marek Vasut arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM Ian Ray ARM: dts: imx6q-ba16: fix RTC interrupt level Haibo Chen arm64: dts: add off-on-delay-us for usdhc2 regulator Xingui Yang scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" Brian Kao scsi: ufs: core: Fix EH failure after W-LUN resume error Wen Xiong scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset ChenXiaoSong smb/client: fix NT_STATUS_NO_DATA_DETECTED value ChenXiaoSong smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value ChenXiaoSong smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value Trond Myklebust NFS: Fix up the automount fs_context to use the correct cred Scott Mayhew NFSv4: ensure the open stateid seqid doesn't go backwards Mikulas Patocka dm-snapshot: fix 'scheduling while atomic' on real-time kernels Sam James alpha: don't reference obsolete termio struct for TC* constants Sebastian Andrzej Siewior ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels Yang Li csky: fix csky_cmpxchg_fixup not working Kuniyuki Iwashima tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Chuck Lever NFSD: NFSv4 file creation neglects setting ACL Stephen Smalley nfsd: set security label during create operations Trond Myklebust nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() Jeff Layton nfsd: convert to new timestamp accessors Sharath Chandra Vurukala net: Add locking to protect skb->dev access in ip_output Pedro Demarchi Gomes ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Ilya Dryomov libceph: make calc_target() set t->paused, not just clear it Sam Edwards libceph: reset sparse-read state in osd_fault() Ilya Dryomov libceph: return the handler error from mon_handle_auth_done() Tuo Li libceph: make free_choose_arg_map() resilient to partial allocation Ilya Dryomov libceph: replace overzealous BUG_ON in osdmap_apply_incremental() ziming zhang libceph: prevent potential out-of-bounds reads in handle_auth_done() Eric Dumazet wifi: avoid kernel-infoleak from struct iw_point Bartosz Golaszewski pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping Bartosz Golaszewski gpio: rockchip: mark the GPIO controller as sleeping Alex Deucher drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] Miaoqian Lin drm/pl111: Fix error handling in pl111_amba_probe Alexander Sverdlin counter: interrupt-cnt: Drop IRQF_NO_THREAD flag Haotian Zhang counter: 104-quad-8: Fix incorrect return value in IRQ handler Eric Biggers lib/crypto: aes: Fix missing MMU protection for AES S-box Alexander Usyskin mei: me: add nova lake point S DID Filipe Manana btrfs: always detect conflicting inodes when logging inode refs Thomas Fourier net: 3com: 3c59x: fix possible null dereference in vortex_probe1() Thomas Fourier atm: Fix dma_free_coherent() size NeilBrown nfsd: provide locking for v4_end_grace Scott Mayhew NFSD: Fix permission check for read access to executable-only files ------------- Diffstat: Makefile | 4 +- arch/alpha/include/uapi/asm/ioctls.h | 8 +- arch/arm/Kconfig | 2 +- arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi | 2 +- .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 + arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 + arch/csky/mm/fault.c | 4 +- arch/loongarch/include/asm/inst.h | 13 +++ arch/riscv/kernel/probes/uprobes.c | 10 +- arch/x86/kernel/cpu/microcode/amd.c | 104 +++++++++++------ drivers/atm/he.c | 3 +- drivers/counter/104-quad-8.c | 20 +++- drivers/counter/interrupt-cnt.c | 3 +- drivers/gpio/gpio-pca953x.c | 93 ++++++++++----- drivers/gpio/gpio-rockchip.c | 1 + .../amd/display/dc/dce110/dce110_hw_sequencer.c | 8 +- drivers/gpu/drm/pl111/pl111_drv.c | 2 +- drivers/gpu/drm/radeon/pptable.h | 2 +- drivers/hid/hid-quirks.c | 9 ++ drivers/md/dm-exception-store.h | 2 +- drivers/md/dm-snap.c | 73 ++++++------ drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/net/ethernet/3com/3c59x.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +- drivers/net/ethernet/freescale/enetc/enetc.h | 4 +- .../ethernet/marvell/prestera/prestera_devlink.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 +- drivers/net/ethernet/mscc/ocelot.c | 6 +- drivers/net/usb/pegasus.c | 2 + drivers/net/wwan/iosm/iosm_ipc_mux.c | 6 + drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 2 +- drivers/powercap/powercap_sys.c | 22 ++-- drivers/scsi/ipr.c | 28 ++++- drivers/scsi/libsas/sas_internal.h | 14 --- drivers/scsi/sg.c | 20 ++-- drivers/ufs/core/ufshcd.c | 40 +++++-- fs/btrfs/tree-log.c | 6 +- fs/nfs/Kconfig | 1 + fs/nfs/namespace.c | 5 + fs/nfs/nfs2xdr.c | 70 +----------- fs/nfs/nfs3xdr.c | 108 ++++-------------- fs/nfs/nfs4proc.c | 13 ++- fs/nfs/nfs4trace.h | 1 + fs/nfs/nfs4xdr.c | 4 +- fs/nfs_common/Makefile | 2 + fs/nfs_common/common.c | 66 +++++++++++ fs/nfsd/Kconfig | 1 + fs/nfsd/blocklayout.c | 3 +- fs/nfsd/netns.h | 2 + fs/nfsd/nfs3proc.c | 10 +- fs/nfsd/nfs3xdr.c | 5 +- fs/nfsd/nfs4proc.c | 13 +-- fs/nfsd/nfs4state.c | 44 ++++++- fs/nfsd/nfsctl.c | 5 +- fs/nfsd/nfsd.h | 1 - fs/nfsd/nfsproc.c | 6 +- fs/nfsd/state.h | 2 +- fs/nfsd/vfs.c | 26 +++-- fs/nfsd/vfs.h | 11 +- fs/nfsd/xdr3.h | 2 +- fs/smb/client/nterr.h | 6 +- include/linux/netdevice.h | 3 +- include/linux/nfs_common.h | 16 +++ include/net/dst.h | 12 ++ include/net/netfilter/nf_tables.h | 34 ++++-- include/trace/misc/nfs.h | 3 +- include/uapi/linux/nfs.h | 1 - lib/crypto/aes.c | 4 +- mm/ksm.c | 126 ++++++++++++++++++--- net/bpf/test_run.c | 60 ++++++---- net/bridge/br_vlan_tunnel.c | 11 +- net/can/j1939/transport.c | 2 + net/ceph/messenger_v2.c | 2 + net/ceph/mon_client.c | 2 +- net/ceph/osd_client.c | 14 ++- net/ceph/osdmap.c | 24 ++-- net/core/skbuff.c | 8 +- net/core/sock.c | 7 +- net/ipv4/arp.c | 7 +- net/ipv4/ip_output.c | 15 ++- net/ipv4/ping.c | 4 +- net/netfilter/nf_conncount.c | 2 +- net/netfilter/nf_tables_api.c | 72 +++++++++++- net/netfilter/nft_synproxy.c | 6 +- net/sched/sch_qfq.c | 2 +- net/tls/tls_device.c | 18 +-- net/wireless/wext-core.c | 4 + net/wireless/wext-priv.c | 4 + sound/ac97/bus.c | 32 +++--- sound/soc/amd/yc/acp6x-mach.c | 7 ++ sound/soc/fsl/fsl_sai.c | 3 + sound/usb/quirks.c | 10 ++ .../selftests/bpf/prog_tests/xdp_adjust_tail.c | 96 ++++++++++++++-- .../bpf/prog_tests/xdp_context_test_run.c | 4 +- .../bpf/progs/test_xdp_adjust_tail_grow.c | 8 +- 97 files changed, 1050 insertions(+), 525 deletions(-) From - Thu Jan 15 17:07:48 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id kElMAuAeaWlmDRMAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 17:07:44 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 17:07:44 +0000 Received: from sea.lore.kernel.org ([172.234.253.10]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgQox-00000006qxn-1hiy for hi@josie.lol; Thu, 15 Jan 2026 17:07:44 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id 7D2F830D9750 for ; Thu, 15 Jan 2026 17:00:28 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 349842C237E; Thu, 15 Jan 2026 17:00:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="iGuGwHVY" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F4CE2C11F8; Thu, 15 Jan 2026 17:00:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496428; cv=none; b=eM5SPHenInK7UYNekrp7w9zZIZsZ2n1ywDqsRkQiC2Ly4llOIs+WtGYSBgfqYxD8QCTXjTQmnPLKhJ9KDjkmt+N7G3lrDVKg+X6ShwSsquwmkTA0RGJirNqfHVjeZ2eZ2ERYhl0GZ3E4m769GtS2P1K31yCqZzzGMjnQHoyXsFY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496428; c=relaxed/simple; bh=5wwB6EPCt9v7y35xwjyT2NqQGpr67w3DJOe7nA/bpuk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s8T/SmQP6Htw0qw9ekITBbY76RXuI2ta6VPyem1Halh01ic++Tul++3tUjXw6D0cCWOMiKxj+WK49syIF61bCYNZOFTtKfZsBuq9q2ZIZbrX26c8iNyKmChlvON9Obk3GP3CS8X2ZG9KWlhVJt9FSV79XMkwX3tD2MuSgHnorK4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iGuGwHVY; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90E30C16AAE; Thu, 15 Jan 2026 17:00:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768496427; bh=5wwB6EPCt9v7y35xwjyT2NqQGpr67w3DJOe7nA/bpuk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iGuGwHVYAx9ZfDUYw9PM3ajlozml6M3JU7ftktrpqU0frmwlhFM71ISUU7g84MYc3 i7v0egG4qbu37VExnsefbE9SaWv1L9rD5rb1rXmjBza/ndVRbt4qVk/th9UvtLuVuu nivqGEK/PZdu1ebLtJ+I3z4rC4bLx4GXaFpJS0A0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Filipe Manana , David Sterba Subject: [PATCH 6.12 010/119] btrfs: always detect conflicting inodes when logging inode refs Date: Thu, 15 Jan 2026 17:47:05 +0100 Message-ID: <20260115164152.332395041@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164151.948839306@linuxfoundation.org> References: <20260115164151.948839306@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-DKIM: signer='linuxfoundation.org' status='pass' reason='' DKIMCheck: Server passes DKIM test, 0 Spam score X-Spam-Score: 0.4 (/) X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has performed the tests listed below against this email. Information: https://mxroutedocs.com/directadmin/spamfilters/ --- Content analysis details: (0.4 points) --- pts rule name description ---- ---------------------- ----------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: linuxfoundation.org] 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [172.234.253.10 listed in list.dnswl.org] 1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -0.0 DKIMWL_WL_HIGH DKIMwl.org - High trust sender SpamTally: Final spam score: 4 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Filipe Manana commit 7ba0b6461bc4edb3005ea6e00cdae189bcf908a5 upstream. After rename exchanging (either with the rename exchange operation or regular renames in multiple non-atomic steps) two inodes and at least one of them is a directory, we can end up with a log tree that contains only of the inodes and after a power failure that can result in an attempt to delete the other inode when it should not because it was not deleted before the power failure. In some case that delete attempt fails when the target inode is a directory that contains a subvolume inside it, since the log replay code is not prepared to deal with directory entries that point to root items (only inode items). 1) We have directories "dir1" (inode A) and "dir2" (inode B) under the same parent directory; 2) We have a file (inode C) under directory "dir1" (inode A); 3) We have a subvolume inside directory "dir2" (inode B); 4) All these inodes were persisted in a past transaction and we are currently at transaction N; 5) We rename the file (inode C), so at btrfs_log_new_name() we update inode C's last_unlink_trans to N; 6) We get a rename exchange for "dir1" (inode A) and "dir2" (inode B), so after the exchange "dir1" is inode B and "dir2" is inode A. During the rename exchange we call btrfs_log_new_name() for inodes A and B, but because they are directories, we don't update their last_unlink_trans to N; 7) An fsync against the file (inode C) is done, and because its inode has a last_unlink_trans with a value of N we log its parent directory (inode A) (through btrfs_log_all_parents(), called from btrfs_log_inode_parent()). 8) So we end up with inode B not logged, which now has the old name of inode A. At copy_inode_items_to_log(), when logging inode A, we did not check if we had any conflicting inode to log because inode A has a generation lower than the current transaction (created in a past transaction); 9) After a power failure, when replaying the log tree, since we find that inode A has a new name that conflicts with the name of inode B in the fs tree, we attempt to delete inode B... this is wrong since that directory was never deleted before the power failure, and because there is a subvolume inside that directory, attempting to delete it will fail since replay_dir_deletes() and btrfs_unlink_inode() are not prepared to deal with dir items that point to roots instead of inodes. When that happens the mount fails and we get a stack trace like the following: [87.2314] BTRFS info (device dm-0): start tree-log replay [87.2318] BTRFS critical (device dm-0): failed to delete reference to subvol, root 5 inode 256 parent 259 [87.2332] ------------[ cut here ]------------ [87.2338] BTRFS: Transaction aborted (error -2) [87.2346] WARNING: CPU: 1 PID: 638968 at fs/btrfs/inode.c:4345 __btrfs_unlink_inode+0x416/0x440 [btrfs] [87.2368] Modules linked in: btrfs loop dm_thin_pool (...) [87.2470] CPU: 1 UID: 0 PID: 638968 Comm: mount Tainted: G W 6.18.0-rc7-btrfs-next-218+ #2 PREEMPT(full) [87.2489] Tainted: [W]=WARN [87.2494] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [87.2514] RIP: 0010:__btrfs_unlink_inode+0x416/0x440 [btrfs] [87.2538] Code: c0 89 04 24 (...) [87.2568] RSP: 0018:ffffc0e741f4b9b8 EFLAGS: 00010286 [87.2574] RAX: 0000000000000000 RBX: ffff9d3ec8a6cf60 RCX: 0000000000000000 [87.2582] RDX: 0000000000000002 RSI: ffffffff84ab45a1 RDI: 00000000ffffffff [87.2591] RBP: ffff9d3ec8a6ef20 R08: 0000000000000000 R09: ffffc0e741f4b840 [87.2599] R10: ffff9d45dc1fffa8 R11: 0000000000000003 R12: ffff9d3ee26d77e0 [87.2608] R13: ffffc0e741f4ba98 R14: ffff9d4458040800 R15: ffff9d44b6b7ca10 [87.2618] FS: 00007f7b9603a840(0000) GS:ffff9d4658982000(0000) knlGS:0000000000000000 [87.2629] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [87.2637] CR2: 00007ffc9ec33b98 CR3: 000000011273e003 CR4: 0000000000370ef0 [87.2648] Call Trace: [87.2651] [87.2654] btrfs_unlink_inode+0x15/0x40 [btrfs] [87.2661] unlink_inode_for_log_replay+0x27/0xf0 [btrfs] [87.2669] check_item_in_log+0x1ea/0x2c0 [btrfs] [87.2676] replay_dir_deletes+0x16b/0x380 [btrfs] [87.2684] fixup_inode_link_count+0x34b/0x370 [btrfs] [87.2696] fixup_inode_link_counts+0x41/0x160 [btrfs] [87.2703] btrfs_recover_log_trees+0x1ff/0x7c0 [btrfs] [87.2711] ? __pfx_replay_one_buffer+0x10/0x10 [btrfs] [87.2719] open_ctree+0x10bb/0x15f0 [btrfs] [87.2726] btrfs_get_tree.cold+0xb/0x16c [btrfs] [87.2734] ? fscontext_read+0x15c/0x180 [87.2740] ? rw_verify_area+0x50/0x180 [87.2746] vfs_get_tree+0x25/0xd0 [87.2750] vfs_cmd_create+0x59/0xe0 [87.2755] __do_sys_fsconfig+0x4f6/0x6b0 [87.2760] do_syscall_64+0x50/0x1220 [87.2764] entry_SYSCALL_64_after_hwframe+0x76/0x7e [87.2770] RIP: 0033:0x7f7b9625f4aa [87.2775] Code: 73 01 c3 48 (...) [87.2803] RSP: 002b:00007ffc9ec35b08 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [87.2817] RAX: ffffffffffffffda RBX: 0000558bfa91ac20 RCX: 00007f7b9625f4aa [87.2829] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [87.2842] RBP: 0000558bfa91b120 R08: 0000000000000000 R09: 0000000000000000 [87.2854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [87.2864] R13: 00007f7b963f1580 R14: 00007f7b963f326c R15: 00007f7b963d8a23 [87.2877] [87.2882] ---[ end trace 0000000000000000 ]--- [87.2891] BTRFS: error (device dm-0 state A) in __btrfs_unlink_inode:4345: errno=-2 No such entry [87.2904] BTRFS: error (device dm-0 state EAO) in do_abort_log_replay:191: errno=-2 No such entry [87.2915] BTRFS critical (device dm-0 state EAO): log tree (for root 5) leaf currently being processed (slot 7 key (258 12 257)): [87.2929] BTRFS info (device dm-0 state EAO): leaf 30736384 gen 10 total ptrs 7 free space 15712 owner 18446744073709551610 [87.2929] BTRFS info (device dm-0 state EAO): refs 3 lock_owner 0 current 638968 [87.2929] item 0 key (257 INODE_ITEM 0) itemoff 16123 itemsize 160 [87.2929] inode generation 9 transid 10 size 0 nbytes 0 [87.2929] block group 0 mode 40755 links 1 uid 0 gid 0 [87.2929] rdev 0 sequence 7 flags 0x0 [87.2929] atime 1765464494.678070921 [87.2929] ctime 1765464494.686606513 [87.2929] mtime 1765464494.686606513 [87.2929] otime 1765464494.678070921 [87.2929] item 1 key (257 INODE_REF 256) itemoff 16109 itemsize 14 [87.2929] index 4 name_len 4 [87.2929] item 2 key (257 DIR_LOG_INDEX 2) itemoff 16101 itemsize 8 [87.2929] dir log end 2 [87.2929] item 3 key (257 DIR_LOG_INDEX 3) itemoff 16093 itemsize 8 [87.2929] dir log end 18446744073709551615 [87.2930] item 4 key (257 DIR_INDEX 3) itemoff 16060 itemsize 33 [87.2930] location key (258 1 0) type 1 [87.2930] transid 10 data_len 0 name_len 3 [87.2930] item 5 key (258 INODE_ITEM 0) itemoff 15900 itemsize 160 [87.2930] inode generation 9 transid 10 size 0 nbytes 0 [87.2930] block group 0 mode 100644 links 1 uid 0 gid 0 [87.2930] rdev 0 sequence 2 flags 0x0 [87.2930] atime 1765464494.678456467 [87.2930] ctime 1765464494.686606513 [87.2930] mtime 1765464494.678456467 [87.2930] otime 1765464494.678456467 [87.2930] item 6 key (258 INODE_REF 257) itemoff 15887 itemsize 13 [87.2930] index 3 name_len 3 [87.2930] BTRFS critical (device dm-0 state EAO): log replay failed in unlink_inode_for_log_replay:1045 for root 5, stage 3, with error -2: failed to unlink inode 256 parent dir 259 name subvol root 5 [87.2963] BTRFS: error (device dm-0 state EAO) in btrfs_recover_log_trees:7743: errno=-2 No such entry [87.2981] BTRFS: error (device dm-0 state EAO) in btrfs_replay_log:2083: errno=-2 No such entry (Failed to recover log tr So fix this by changing copy_inode_items_to_log() to always detect if there are conflicting inodes for the ref/extref of the inode being logged even if the inode was created in a past transaction. A test case for fstests will follow soon. CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/tree-log.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -6032,10 +6032,8 @@ again: * and no keys greater than that, so bail out. */ break; - } else if ((min_key->type == BTRFS_INODE_REF_KEY || - min_key->type == BTRFS_INODE_EXTREF_KEY) && - (inode->generation == trans->transid || - ctx->logging_conflict_inodes)) { + } else if (min_key->type == BTRFS_INODE_REF_KEY || + min_key->type == BTRFS_INODE_EXTREF_KEY) { u64 other_ino = 0; u64 other_parent = 0; From - Thu Jan 15 17:08:06 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: hi@josie.lol Received: from witcher.mxrouting.net by witcher.mxrouting.net with LMTP id MGtrJvIeaWnAdRcAYBR5ng (envelope-from ) for ; Thu, 15 Jan 2026 17:08:02 +0000 Return-path: Envelope-to: hi@josie.lol Delivery-date: Thu, 15 Jan 2026 17:08:02 +0000 Received: from sea.lore.kernel.org ([172.234.253.10]) by witcher.mxrouting.net with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from ) id 1vgQpG-00000006rch-0esz for hi@josie.lol; Thu, 15 Jan 2026 17:08:02 +0000 Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id A771B30D9ED7 for ; Thu, 15 Jan 2026 17:00:32 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 7F8D72D238A; Thu, 15 Jan 2026 17:00:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="asFj1B1F" X-Original-To: stable@vger.kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel