ion.
                             [URIs: msgid.link]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: msgid.link]
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.105.105.114 listed in zen.spamhaus.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.105.105.114 listed in list.dnswl.org]
  0.0 URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             zen.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: msgid.link]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -11

From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

[ Upstream commit 0e5aef2795008c80c515f6fa04e377c6e5715958 ]

If writes are blocked, then return error during SST-CP enable command.
Add missing write block check in this code path.

Fixes: 8bed9ff7dbcc ("platform/x86: ISST: Process read/write blocked feature status")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260107060256.1634188-2-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
index 34bff2f65a835..f587709ddd473 100644
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -612,6 +612,9 @@ static long isst_if_core_power_state(void __user *argp)
 		return -EINVAL;
 
 	if (core_power.get_set) {
+		if (power_domain_info->write_blocked)
+			return -EPERM;
+
 		_write_cp_info("cp_enable", core_power.enable, SST_CP_CONTROL_OFFSET,
 			       SST_CP_ENABLE_START, SST_CP_ENABLE_WIDTH, SST_MUL_FACTOR_NONE)
 		_write_cp_info("cp_prio_type", core_power.priority_type, SST_CP_CONTROL_OFFSET,
-- 
2.51.0



From - Sat Feb 28 20:00:34 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221010-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id SAFMLl1Jo2kORAEAYBR5ng
	(envelope-from <stable+bounces-221010-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:29 +0000
Return-path: <stable+bounces-221010-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:30 +0000
Received: from tor.lore.kernel.org ([172.105.105.114])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221010-hi=josie.lol@vger.kernel.org>)
	id 1vwQUH-00000000Y8f-2JQx
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:29 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by tor.lore.kernel.org (Postfix) with ESMTP id DEDE23155FF2
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:45:49 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id BE23A4BC01F;
	Sat, 28 Feb 2026 17:55:53 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nWE/uZhW"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B9654BC002;
	Sat, 28 Feb 2026 17:55:53 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1772301353; cv=none; b=O9+JWgxqFHNl3AvUO5+out2vJO0qArWBpqBbfdlLsc0pRA6dG321min72fpAfNQNM4sfQ6ZOrjnOH9GRt/UK88lz/ppWdh53BJ3GvxDmO0V5EEin1MVvX+ZSASYqj7XFyaqG4XcSVaEYq4eFanViZm7uF7CLD7o+tFJGXKiaTU4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1772301353; c=relaxed/simple;
	bh=g+lQ6eEmCsqoIVmNzQsNBTXxuJYWt6+/ZurWb0pCyQ8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Lu8TGggZymnPPo2G8gMXkV4PMMXiYcoycuGfVYLyAa0QfXrywSegDCLbl1pX4ZxpHO57OG5dBwC1y1tAmhs8J1SYGtLWVGeYUG+Fus0GGdp6Tq8F4bwZKo2VfgdqTP+v6rc4HOVD5QIJ0VcBLPh7Bl9ElW+a94YoAty3Cx/25hQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nWE/uZhW; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1964C19423;
	Sat, 28 Feb 2026 17:55:52 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1772301353;
	bh=g+lQ6eEmCsqoIVmNzQsNBTXxuJYWt6+/ZurWb0pCyQ8=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=nWE/uZhWknhT1NLqF2At+TLVfc3nUZVQrveYJlZkxKLcKnLl2uYbEyI8pamtVf5cX
	 t6tErP5TNnD1qLG2Q6wQ0IzzYwM/6paHyB29ahzDuQhMThPfamBdFvKsHZJmcWg9Rd
	 v2VVe40OvZeW6t4IBnKKmKATfDu9u404gwDoj22As0TBkR7q4H38ek1LH/fQ6dYSrO
	 /BuC2gRCIeuTrehI2IugbJAIlCpNHTsOyTp+HpY6WwQ3xBOLRJ4tBrKpTr9kZIY9Lc
	 TppaC4CMv7kp6eUoEDIXlveWrJ/N4m399puwp+QGzfFRD2tM5jDxU3OMR0jrDtyNBQ
	 ogoNkXi9CD+hQ==
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev
Cc: Michael Liang <mliang@purestorage.com>,
	Mohamed Khalfella <mkhalfella@purestorage.com>,
	Mikulas Patocka <mpatocka@redhat.com>,
	stable@vger.kernel.org,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.18 541/752] dm: clear cloned request bio pointer when last clone bio completes
Date: Sat, 28 Feb 2026 12:44:12 -0500
Message-ID: <20260228174750.1542406-541-sashal@kernel.org>
X-Mailer: git-send-email 2.51.0
In-Reply-To: <20260228174750.1542406-1-sashal@kernel.org>
References: <20260228174750.1542406-1-sashal@kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-stable: review
X-Patchwork-Hint: Ignore
Content-Transfer-Encoding: 8bit
X-DKIM: signer='kernel.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: -1.2 (-)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://docs.mxroute.com/docs/expert-spam-filtering.html
 ---
 Content analysis details:   (-1.2 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.105.105.114 listed in zen.spamhaus.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.105.105.114 listed in list.dnswl.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -11

From: Michael Liang <mliang@purestorage.com>

[ Upstream commit fb8a6c18fb9a6561f7a15b58b272442b77a242dd ]

Stale rq->bio values have been observed to cause double-initialization of
cloned bios in request-based device-mapper targets, leading to
use-after-free and double-free scenarios.

One such case occurs when using dm-multipath on top of a PCIe NVMe
namespace, where cloned request bios are freed during
blk_complete_request(), but rq->bio is left intact. Subsequent clone
teardown then attempts to free the same bios again via
blk_rq_unprep_clone().

The resulting double-free path looks like:

  nvme_pci_complete_batch()
    nvme_complete_batch()
      blk_mq_end_request_batch()
        blk_complete_request()        // called on a DM clone request
          bio_endio()                 // first free of all clone bios
          ...
        rq->end_io()                  // end_clone_request()
          dm_complete_request(tio->orig)
            dm_softirq_done()
              dm_done()
                dm_end_request()
                  blk_rq_unprep_clone()  // second free of clone bios

Fix this by clearing the clone request's bio pointer when the last cloned
bio completes, ensuring that later teardown paths do not attempt to free
already-released bios.

Signed-off-by: Michael Liang <mliang@purestorage.com>
Reviewed-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-rq.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 5e08546696145..923252fb57aec 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -109,14 +109,21 @@ static void end_clone_bio(struct bio *clone)
 	 */
 	tio->completed += nr_bytes;
 
+	if (!is_last)
+		return;
+	/*
+	 * At this moment we know this is the last bio of the cloned request,
+	 * and all cloned bios have been released, so reset the clone request's
+	 * bio pointer to avoid double free.
+	 */
+	tio->clone->bio = NULL;
+ exit:
 	/*
 	 * Update the original request.
 	 * Do not use blk_mq_end_request() here, because it may complete
 	 * the original request before the clone, and break the ordering.
 	 */
-	if (is_last)
- exit:
-		blk_update_request(tio->orig, BLK_STS_OK, tio->completed);
+	blk_update_request(tio->orig, BLK_STS_OK, tio->completed);
 }
 
 static struct dm_rq_target_io *tio_from_request(struct request *rq)
-- 
2.51.0



From - Sat Feb 28 20:00:48 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221213-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id 8N9HGmxJo2n6aD8AYBR5ng
	(envelope-from <stable+bounces-221213-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:44 +0000
Return-path: <stable+bounces-221213-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:44 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221213-hi=josie.lol@vger.kernel.org>)
	id 1vwQUV-00000000YX0-2W3e
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:44 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id 0D56F3670CBA
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:51:38 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 569CF359A70;
	Sat, 28 Feb 2026 18:13:39 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=gmx.de header.i=rwarsow@gmx.de header.b="O7iDXdO8"
X-Original-To: stable@vger.kernel.org
Received: from mout.gmx.net (mout.gmx.net [212.227.15.18])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E084359A65;
	Sat, 28 Feb 2026 18:13:37 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.227.15.18
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1772302419; cv=none; b=VvNOHw/2Zjg4E4DekI/jNNUD6oPJ4sLqPrXP3l1pX/+/Hv/ScUMmIPjqN9SID9ZqhVLKJdikmzz6l0DggVz2EVGPtlPDTip+Hr4SKV1FcCe6SFkHq/PrSCjBm7dQpUh9UXLsobaL51MzlJbj0658O/nusV12vFW50Btg5z3DmGM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1772302419; c=relaxed/simple;
	bh=3GgB+gs45LBEf3dGewRLcICT7q47jgtonicntnTw8uw=;
	h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:
	 In-Reply-To:Content-Type; b=GUpnyjR0YFG4leNa7IO1HXH33JLrSrFrmji/GZtyjmT2+NXPolKk6+AWBi4mVlCpKy31cRjG78edhSl/xqDwQdN+BStVIl8AmJ2dyk84xkgy5QN07r3ioQU0ZtDsfLab6Pc5zjc1IRXGC6dY3CvfQZetoQIrSWZWtc9Wv/Y6C7A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de; spf=pass smtp.mailfrom=gmx.de; dkim=pass (2048-bit key) header.d=gmx.de header.i=rwarsow@gmx.de header.b=O7iDXdO8; arc=none smtp.client-ip=212.227.15.18
Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmx.de
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmx.de;
	s=s31663417; t=1772302380; x=1772907180; i=rwarsow@gmx.de;
	bh=UTLeHg7r+2CFWjP6BhDbuinUwW/QDWJLRM7o8udHdxk=;
	h=X-UI-Sender-Class:Message-ID:Date:MIME-Version:Subject:To:Cc:
	 References:From:In-Reply-To:Content-Type:
	 Content-Transfer-Encoding:cc:content-transfer-encoding:
	 content-type:date:from:message-id:mime-version:reply-to:subject:
	 to;
	b=O7iDXdO8cSRhXIpMm4E2GZcIO1O7iOgcqOF69Kr15RbvICf2K0BjyWydmHf/ypce
	 KdvIsyXI8pYoF6l1AOC3NRMkRgnW1vEqO1QuMqgDIxHebnRKWurUq/URPz/CY5u/P
	 1r0eqkhWwqE6QFQ4djSaRMMAZQhQpIGag4ERdSkNmuGpy8YGFpCmBDbEzbmVtt3oW
	 dRUg0IbFc/JpJdPgdbqrgSGM/TJZ2aeGJJQAmRAa11RulxQ67aHWneytiBEmLBi1F
	 jNPIvYTIDI5XhVhdCVaYq6wNQr6FzRyU22C3DQKujuoX9CpVu5bvaIFeIlrjMmQPn
	 Vu8DZlBgCzARQO7M0w==
X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a
Received: from client.hidden.invalid by mail.gmx.net (mrgmx004
 [212.227.17.190]) with ESMTPSA (Nemesis) id 1N6KYl-1vcUTN20fR-00wLGZ; Sat, 28
 Feb 2026 19:13:00 +0100
Message-ID: <601576c7-970a-4e9d-af5e-c818740be8e8@gmx.de>
Date: Sat, 28 Feb 2026 19:12:58 +0100
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
To: Sasha Levin <sashal@kernel.org>, linux-kernel@vger.kernel.org,
 stable@vger.kernel.org
Cc: gregkh@linuxfoundation.org, patches@lists.linux.dev,
 torvalds@linux-foundation.org, akpm@linux-foundation.org,
 linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org,
 lkft-triage@lists.linaro.org, pavel@nabladev.com, jonathanh@nvidia.com,
 f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, conor@kernel.org,
 hargar@microsoft.com, broonie@kernel.org, achill@achill.org,
 sr@sladewatkins.com
References: <20260228173244.1509663-1-sashal@kernel.org>
From: Ronald Warsow <rwarsow@gmx.de>
Content-Language: de-DE, en-US
In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K1:w+kwudU/jgDKwLTQyxYncJKHRXT9H/jIWc6+Fkx8I1o/kXz/7XN
 yS4T7p3lwFHus0WrnmFBFg46s1ybNdGB9o+UykgRcwFhMAMUlgiwfu1hYywR6qtNGKeuLRP
 IEDTXMZBxtyYL3ccLnPwOgagR5sOXDhkYMSMfutRFjINNKpsIEy0Xb26EJXOL6VeYAu8qnx
 QzsHRsfZXQSVuSYkMQC/w==
X-Spam-Flag: NO
UI-OutboundReport: notjunk:1;M01:P0:KyzC7M9Waf8=;cmKLYmjF9kfFB+BdVyuxJTT97oW
 N9slu8Brua7Qs1OZOuIcB71n5JOrPX/jZ7U4h4OC/3fGdX4b2IrWBbzReZEi15a4h9Ftszjui
 SwHwwfaj8o6OZJgy7/nZ8FU8xOVSzIJPaVMw2OdL8TKPCnT14kUHUbW+Os3gRBACWUy+O8+Zu
 pnXkc0Eg0D6Q0LJ3EQ58pqf9krwz6ptqeYP4tclzj6w2toIyiUqa7zUmuNaZveDr9cKVJ4uqS
 YEI+ug60PVbetEqd1mFwPfWG32Ag5HKwqejpm3Hrj5uXqHL/tjQg0Ez2qymtyMy62Bh6pdmi5
 J0KG9R3w1OvgnanqU0xcrmfWwmGDTcB/TV06Qm5rjsdHXGTmFNgSNr/HV9iz/i67uDILoxTEM
 40C61HIUby5zJHRqwQGhvEgNDu+Cfh+qwItokGRExpUE6y+Y2/n3S4hzir4Ks7zqEJwuAtmqa
 BOm4WJYE+WUAFpwU8sSapB5z2QiOt0XCbqLbbTLAUR4DQARJMt/PtfZXxHy/XqaaQvHAABcEr
 dRW6F5YDYlJC1SmffFYK8Gt6ds0DQxpC3KpaJ5VtRdDqx7IAs8HYFCKgxguzLptUuTooinqAy
 EqR3tinEueYq9HcjHJGZUGjh2YIB7FolX+yGEcowBoc1PvoBgSvhZ6aFm6f05WlE7JpbttrlS
 2FpdfBz0oFHf0yweDSXEGGEjWINwt2ETJtSKwY/BW6jRlUd/K6dQwlR2OYGxg7CQUVlcywxSq
 O5DrVmS4O8Dm6/EHOr5PlwMU9/K7wFzKCFTnk9XWYt81KeqoOvlhwccWzOhXiSIb/iJX7CdaR
 +HryPeqOxOaLXAuqX7M4x1GKkMyh891TPNlIAmn22OjN4Ze3IYfLKRn94bw9F9yxGEteKc4B+
 2hGl4vNtYsu/O4l0+4rm565uW1vBKyS0cAaMU9YfAfRLgllYsC8Q3sYT2AWKNL0O2awcfT+4i
 88shdrSxnUgaaMzux/LV0xduan8tpK1K1viIpUe9ZYD5KOOptqRRLi/fOBSh+No5ja1QAB3Qb
 SpDDLcRaHPIXpuuflM0LtSF3nkzGXK0kHT6aDm86Ib5dRvsdH7vOBHzcawZckurbhzYVZ82cI
 VdbPNW9crPlAXsHCoVLC1hgSW2r/+OUxq3PHgsweXawWbAw3S5FrLJKsDrDvorKWiRLZ5zZG+
 RyH+JBkteH/qNDPNuQQbYJC5juiRlwv3BVs3fF1BNZpBgv7EHU6qvUs9yzN6E11POSg4IqlmC
 J4Xl7Gu+tnmhdfZjgGK7N12T/3PQd4P9p14d9oqd7tj60UTsie84ZeU0oXCEwJxWgasMszXnr
 +lyfP30qeV1Y6hHqm6Hwkkg9YX0+06cW0BG80RWO57GjurBn+8WL0Z30XDG/Nn4XRKUhgJ0ZF
 OzaKqcDL/gdClVsD43eRGPa//97BfUWL9cId0n1pV3psfv0DgrIRlrIVH9pt8g3t1I2ejR1YH
 D8rubk89G55fUdSLxmKhOfKgMNp4rQHGk3VWFnJW5kqw92wL27Yrx9MMKlF0QpJ4aCrf5DRYa
 hWEQrH3UQQX9QjUWfWi6WDL6R0trwOhBvKS4zdoci2ZYiNr3gEQv98xw1tOgHytuOpaoALGUm
 46E2QVOGi32BktXuh1J865WALqIVtJUjxSp2gyv0leClgKH556V9uyHEYabN8VZN0yC5skRHi
 pjXhTcl33byCJOlpobnGHmy570eSjjp1QqCou/Ru/GLEZXYegjHexZq0ipw6YqcaJ4e7YMR6g
 b3Rj0O6jswFO6ysqfm0lTbgmILt9iMSMVU8LqiVz7W00ks9UV3UPZTkLwiQUuLg5QNCYZT2oc
 l+uVfqDEnM+fOd6WZqLvFGB5jH+BybOVPZnb+HlDUQ8XnEeA8Bgc5ZhNxJRWRF2Wux62b1fGf
 GzX4WpOtL2oxENl7fVJnGmnhBUVUTmBpudHgkndGuAUKqoObODFMHOlng4+eGa2MJkHs/x8c3
 BvCTru/mRT9T4kVw/1Jw7XEyvVvixNBdgeTg0LgibkmkQN4fSiY8D3eXrKv2kHHpL2v8qNd60
 /EsEyzQL/mxLwMPbwLQwodKDRtcwWfn/713HSQqxBatpO9QziWHQZWKBP5CWmPb30J3yJ4Xpb
 FZ27hw0eoGSckfXTGXbFIXI569lJlZqYtKpLvAvW4j37w5XnM7Ai6XT7ZsqpxVCwCg2Ej65yu
 +iHPT1l+Jc3p6qaaWpjfVkwM/WFsvTMWtIH9JrVGVD/vIvfgjcjKSEmekNQFg0UhFTHOHhfR/
 qXhf9A2w5NuvpWaxMjGMsGRAzSoYtz5DEVFa8PyW3SKVDZQ8c+xubpLOYL5D9xdnFF2BVuWDX
 MV0bI2W1q9t0zICC0+OiKEmMKnwkIzYB4ShvsyGnjLuOpKCyDdJaZ1qFWy+q4+/JzYEYN354D
 vvx3AlXL5Kzpdmq9V855Ie0Ke4xXMBxzxedKVIIOTZmSQrDBV+OE5g8c2JdZc4bSPANQKtGNk
 g4uJebru8bAZ/Cv6d0SfhZkNV7EiToAjE31AY2ukeWMVsWEbB+4NEHWQVVi/5unqgWp8JJVYN
 vPPqQC0bxmHMwpywMX1loGoG0Mzoe3hZwE2NyhD/1V+Up73gOkWjwC+9TuS1E9ktfJfjhDo/r
 8MzhEWxHmgVjSQ0DtW+LBAG0IJPByoKVc0w3R/eKSOSeVR0/Dcvg7lS3sW1iUHPgLTNeUTJ1B
 1YSsQCCp52iucz0ChYEWquw21SxsVPTlFTfDKeseieaz+1/IHikAq4y8tFVdEfFJKg51YIepv
 ZAIpwgNmdeR2aPCGt99nrILyUaFRuEo+PaB/XggXsBbs/f+CsSZgaVfMC9I3KYwc4uTpy7cJ/
 L09jPaB9Po0v9eHLf7j0xEnIJXFgf2jiZzOB0PA1t2aYBIEIZlJBdvqxyKg7TxQjm6Bd248Ir
 fp7NKkDiWEEU4HMpFXDqLCyPDRtJEVVhA4w/j1D+tW8k8Y2izjLQEjx//Lo0/ZiAoq+FVynxm
 Rq+GAN9oucPwxvflpH5z6r69IBNX1GmfkEPnIKXVBhMlrHNUhp8/5wRSLrrTUPKUFnWO8ktFO
 lLNLslXacteNKSt+oB8fkraVr2iObZ2QPMRzdEQyUfYKxAkiO1iRm7rtg3WmmYEbMaLGrMYq1
 oZwKR9b4BqF1rHK6fyQoO2wTmQ6KVkjllJbkaqHGnfZur0C9IDTK7M4iz2HaHJxObHihhfYvq
 FI9tv/skjHJ5VvH/gk4xJsPwU0nJ9WFcMZUzr2L56w0ZWqTT3xgwJYDrCYVwASXjGsFTM1vlG
 djyc9GRQ2IA3qCc/QohIRj76waLkFRBXf6qRjxvHddXBXl0vxo99m0EzWU9wzNSQP8t1gCA86
 unBRGgHYUi9hy2bzF2X0cCqJhRdCR1gXRLh0vb0Ba9m3IKcjtR+3y5DDic+ALaOreYJ9BH2RZ
 YDOG2KzMZqehjJmKZg7TIrpgWtK4CP4Ea46Dnvg2UL4KlmwgR7PFQ5I228hM6NmRMECdpxf+4
 2Nykaa47n168XN6cv9YhJSRS/B3MNOmRlCe/tWBQW8l9fLyTuptJvlJDEI1tz6ncmU7G1O7pX
 A6qWtsAvCVqaxD9bfhAEvbSS8kXP7y477syLkst3vCFY/z/BJpdwdU2L063haQgq+QtKBO07t
 1olQ6j6LUVHQjwj6anuQSYUOFOYc6zKYPPFRQgQ4+RvzBSvI191Nxt7PEBbzwmBYFwf/HvugZ
 6xk7eSM6tNq7GEclZueG5bU0QFU8dGbhKVVm676cJo2A2V5pGsDk4g7FhwzBPCcNDL3KHbJS9
 AD1CO2IGJeKzYKZ1s5TsHBFWH7O3SjJnslGAFyfyYggq94pwBe/KLyFMR7YlOMhpsbZLbbP7G
 I6RuLcWwyjPtjYQXppnyz1xhpPy59CEn6VPqfOQEAisKptn5Aro1VahjKIm7XkJgmqAK8kluw
 ylQhyhu4cj/HIOYl2fZyjyZBUpwur4e3zI/EmQ/eshbopVqmoeHsvJitadqP7GpPNRUP/K7J3
 5CbTUNqGBvOCTWWLWA7Z1QJz52gM5exJ0xwiHAHpiruEqb+soXR1moFGL0cDYxMKe/QBBD2QJ
 Ii1WWrP4IXJMFmwTyrK29UVEcKJ3ZLOPbx/ZsDa2MPEz3a3z07hocKIzATRaCHQr19TPlIfd2
 3/oa5q9bchO6N0oD46AM3AyZqutjxEKQvzufFlByvoP4mBaVVE9pRijg69L++6jOJIdbHLOfY
 xCoaYLyeBpeiP1VN009caX9wljcWOYsS3qh+SRqW30jgbN8IsAoTVJrwJ3CyCdcluIQbhzaHA
 Y5flVjJzPNC4UOEPaLM785GIZp7iT+yQrGGbTHWKiJAdyxE8YPtSHhPtA0kfsffklg26v86Tl
 aK44fPEod03MiB5Uof9rnCCcjHgJmhUvMjD6eqDMOKtn3OgxFCpXqMTA2yyATedEPFBgdm56l
 vXj0aRtQ0XhZMyJ9Q4NOOk6Igk32A1pSMozxSZnhZ4x5nxdhiQpGM7zj1yLyf6RVcIS9dYtHZ
 sXnlLaKYQPknZUnnUpK0JPHb1R0nneUJXnk0ApAm8krIfGkerimGNnIunDv0qRGtbzEEGskoz
 vUbJLaNDgImLoW3dp8YdioHmgGWZ/ia2yxYVoMptetMSbeGXqzNaqEKfZAV62WGQ1nzDvadSP
 i+EO3tLxOUe1ya7dJZXlewFU2jtJN1wjTWRIcr2KAp64J073OSlFFguRgbWrHPnHRgrZmT4uW
 /beBoqAsVKaoJith0cldAfiZDIQM6Hnmu9kItGfG8BK/ZEAjIRh0ddH+bbSKlTMJ4L4aXp+kI
 fJFxgc2b72S1fnBfTe8eF/wVjsEsNHWJ2tIOgy7njaXE5IJAZySQhQQj2o1OrkwQJQi0xUT7v
 va8atjZbAyUwjBZk8vQ9xD9HZ0i50Ce81killigYInjGqe4dS9GYNJkZMi1P1qoYleI56Yy9M
 umnj17lJwuyfXPoKR1VEhY6gIZW5Auu4mlbaTqJUHaV3X7e+puk1AomJLHzFvOjTNlSbcAaV5
 glHWcN6MCYmKlmEvTGRBwQPUfKxRM8bMADGqKgwAC9bbvFzYE1m9kFJlQen5eXgrRnU3oVywI
 f41GE80qRH6P5Ea1iS/iB1q4qU=
X-DKIM: signer='gmx.de' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-DKIM: signer='rwarsow@gmx.de' status='pass' reason=''
X-Spam-Score: 0.4 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://docs.mxroute.com/docs/expert-spam-filtering.html
 ---
 Content analysis details:   (0.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: gmx.de]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: gmx.de]
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.234.253.10 listed in zen.spamhaus.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail
                             provider
                             [rwarsow[at]gmx.de]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.0 URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             zen.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: gmx.de]
  0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and
                             EnvelopeFrom freemail headers are
                             different
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
SpamTally: Final spam score: 4

On 28.02.26 18:18, Sasha Levin wrote:
>=20
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>=20
> Responses should be made by Mon Mar  2 05:32:25 PM UTC 2026.
> Anything received after that time might be too late.
>=20
> The whole patch series can be found in one patch at:
>          https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-st=
able-rc.git/patch/?id=3Dlinux-6.19.y&id2=3Dv6.19.5
> or in the git tree and branch at:
>          git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stab=
le-rc.git linux-6.19.y
> and the diffstat can be found below.
>=20

It would be nice to have a download link to an patch-*.gz what Greg=20
usually provides.

ron


From - Sat Feb 28 20:00:52 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221023-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id SNeJEG9Jo2kz6D0AYBR5ng
	(envelope-from <stable+bounces-221023-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:47 +0000
Return-path: <stable+bounces-221023-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:47 +0000
Received: from tor.lore.kernel.org ([172.105.105.114])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221023-hi=josie.lol@vger.kernel.org>)
	id 1vwQUY-00000000Ydh-3yUb
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:47 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by tor.lore.kernel.org (Postfix) with ESMTP id F41C9322D562
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:46:05 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id F05C94BCACA;
	Sat, 28 Feb 2026 17:56:05 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="GMItvBJo"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD5AB47CC8B;
	Sat, 28 Feb 2026 17:56:05 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1772301365; cv=none; b=osPU+5Ay+I9ae3IvJAx3ULCWfp4dHTlTEmijGmxHekKMqlUQCBmAR3q5VipZ3tn9LHVD/+99bWbdPRZFJHyB2wuogBeSruF/zlFmNSXqx1qKggzp9t1ScmYZoXtyOiOlx84gtlSNxPJPuIVWMexne/kXLstTEllP8EDJ/IrqPzE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1772301365; c=relaxed/simple;
	bh=4wwd9lAtfAx/5nuKfXxd7IZ69+OJygCwQdi19XSC14k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SQUh5MlnxPBDGIUb3/iMMYsx6lIztKK5uPmgJBTBJNDGphW60TbouBjidXQU9LGKEWGKq4QWARGncIewk7jK2GdejhWHp9eS6iKfnTcJD0/2MzAhjAH74Scdwy0eitzH0zrZem6OiuhwGbFzpVQAxv7BzIO3xtpkUSF5ePqOa6E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=GMItvBJo; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D4DCC116D0;
	Sat, 28 Feb 2026 17:56:04 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1772301365;
	bh=4wwd9lAtfAx/5nuKfXxd7IZ69+OJygCwQdi19XSC14k=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=GMItvBJoK0FQt6pN0shtNiTMLFMbkBGvcj2DLb9ARW+ZtaU4re/LdMS11ykNyG5uv
	 n6XzHr1OIEPRdF8Ni7hbQ4k1nKWfc8807ODihRWxBwVpzxxudGUcfzWGZNgHxFWBlz
	 kQ0aMEXYG8GL4qoi1c3ZfLEVvvZOYCG+Ql2/pdxFtC2DyUWhV5UBOjuUdhv7/kL7pu
	 7pDmf8JjmQa8lxMogyEO4JdND9MWeBWa0OArQCuZ5dvyKTXnuJefjQFp0rV617M/6X
	 CiZKYZA/s7pZvGnKgHIqJytevM+OOEDFJRCDrmiFVQrWW9GDupnBgN4SkOA2XfJz+o
	 NpSqpcVV9Ly8w==
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev
Cc: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>,
	stable@vger.kernel.org,
	Brian Masney <bmasney@redhat.com>,
	Thierry Reding <treding@nvidia.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.18 554/752] clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc()
Date: Sat, 28 Feb 2026 12:44:25 -0500
Message-ID: <20260228174750.1542406-554-sashal@kernel.org>
X-Mailer: git-send-email 2.51.0
In-Reply-To: <20260228174750.1542406-1-sashal@kernel.org>
References: <20260228174750.1542406-1-sashal@kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-stable: review
X-Patchwork-Hint: Ignore
Content-Transfer-Encoding: 8bit
X-DKIM: signer='kernel.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: -1.2 (-)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://docs.mxroute.com/docs/expert-spam-filtering.html
 ---
 Content analysis details:   (-1.2 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.105.105.114 listed in zen.spamhaus.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -11

From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>

[ Upstream commit fce0d0bd9c20fefd180ea9e8362d619182f97a1d ]

If clk_register() fails, call kfree to release "tegra".

Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/tegra/clk-tegra124-emc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index 2a6db04342815..0f6fb776b2298 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -538,8 +538,10 @@ struct clk *tegra124_clk_register_emc(void __iomem *base, struct device_node *np
 	tegra->hw.init = &init;
 
 	clk = clk_register(NULL, &tegra->hw);
-	if (IS_ERR(clk))
+	if (IS_ERR(clk)) {
+		kfree(tegra);
 		return clk;
+	}
 
 	tegra->prev_parent = clk_hw_get_parent_by_index(
 		&tegra->hw, emc_get_parent(&tegra->hw))->clk;
-- 
2.51.0



From - Sat Feb 28 20:00:56 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221214-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id eKHHAHRJo2n6aD8AYBR5ng
	(envelope-from <stable+bounces-221214-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:52 +0000
Return-path: <stable+bounces-221214-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:52 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221214-hi=josie.lol@vger.kernel.org>)
	id 1vwQUd-00000000Yhz-1gGq
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:51 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id EBF8234C214B
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:51:46 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 25339359A60;
	Sat, 28 Feb 2026 18:13:52 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="EYdNj3bV"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 024A3347FCC;
	Sat, 28 Feb 2026 18:13:52 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1772302432; cv=none; b=epNya6H8sWR3KeSSzfBzAqbRXqwbBR2OR/V11MpvTwGwvOIyPiHspb0Ntdfqdbqtrdv7JQvgqntn/608Ao7aK0NgMeCwfWlEEcL7yfHJErpspwWDv+CeMmBDoo30Er3PAan2LUyr05ihgNRCpxK8VtCrn9ZjxeFSlYdcZcG6WVQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1772302432; c=relaxed/simple;
	bh=vUeFqc4SigPQJZ6Bx9dPgvQ6qYdAUyvXC9qIDH3Zlqc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dzEC3FG4hfRQSgEJFCTuJJ0VosmhfERKxe+Az8vn+bsfI3uW0CZqKdV67Op6l9LGuwS1qVCBcxBfViP9Tr7LhkbOCSlhhMmz64mJI7HSL0C/FMkKzGSlPfU/rnTPAmU9h2snq60GX6OHzLaYz14gWiac1Ibv8pvZL99LUMYVRuc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=EYdNj3bV; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3AF87C116D0;
	Sat, 28 Feb 2026 18:13:51 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1772302431;
	bh=vUeFqc4SigPQJZ6Bx9dPgvQ6qYdAUyvXC9qIDH3Zlqc=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=EYdNj3bVnBahRdLUyKkDMgOvmbNFfsf1M7grnUnZSqLPdLmb0qkE6GMFTzR96Iyy8
	 ACcWMUHqpIz2KHNsEX4HUL//3FxWYNLkZjzdsiuFwKLM+cg+xpgI5uQ/O7IC3w005X
	 qJX5v3sL1z9ZV1IhHh03VMrRD0SYrpRrhCkmKrbfB4/975nlYQxWCS//UKTzTbE569
	 hNVfRFZHx8D12fMRXPYNH9o/380nCZrmtRHcr1YUrmI2ATkMMHw1tiEdpkQRlU+Ye1
	 Nvzf4vRYwX0yY7GUAHpU558J+2zaIpBd0HgyO1n8G3gzfzAqGl5QO/tjMDXnQ2l2c0
	 JoTkk6K/midtw==
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev
Cc: Yao Zi <me@ziyao.cc>,
	stable@vger.kernel.org,
	Nathan Chancellor <nathan@kernel.org>,
	Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 6.1 169/232] MIPS: Work around LLVM bug when gp is used as global register variable
Date: Sat, 28 Feb 2026 13:10:22 -0500
Message-ID: <20260228181127.1592657-169-sashal@kernel.org>
X-Mailer: git-send-email 2.51.0
In-Reply-To: <20260228181127.1592657-1-sashal@kernel.org>
References: <20260228181127.1592657-1-sashal@kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-stable: review
X-Patchwork-Hint: Ignore
Content-Transfer-Encoding: 8bit
X-DKIM: signer='kernel.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: -1.2 (-)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://docs.mxroute.com/docs/expert-spam-filtering.html
 ---
 Content analysis details:   (-1.2 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: gnu.org]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: gnu.org]
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.234.253.10 listed in zen.spamhaus.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  0.0 URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             zen.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: gnu.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -11

From: Yao Zi <me@ziyao.cc>

commit 30bfc2d6a1132a89a5f1c3b96c59cf3e4d076ea3 upstream.

On MIPS, __current_thread_info is defined as global register variable
locating in $gp, and is simply assigned with new address during kernel
relocation.

This however is broken with LLVM, which always restores $gp if it finds
$gp is clobbered in any form, including when intentionally through a
global register variable. This is against GCC's documentation[1], which
requires a callee-saved register used as global register variable not to
be restored if it's clobbered.

As a result, $gp will continue to point to the unrelocated kernel after
the epilog of relocate_kernel(), leading to an early crash in init_idle,

[    0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000000000, epc == ffffffff81afada8, ra == ffffffff81afad90
[    0.000000] Oops[#1]:
[    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G        W           6.19.0-rc5-00262-gd3eeb99bbc99-dirty #188 VOLUNTARY
[    0.000000] Tainted: [W]=WARN
[    0.000000] Hardware name: loongson,loongson64v-4core-virtio
[    0.000000] $ 0   : 0000000000000000 0000000000000000 0000000000000001 0000000000000000
[    0.000000] $ 4   : ffffffff80b80ec0 ffffffff80b53d48 0000000000000000 00000000000f4240
[    0.000000] $ 8   : 0000000000000100 ffffffff81d82f80 ffffffff81d82f80 0000000000000001
[    0.000000] $12   : 0000000000000000 ffffffff81776f58 00000000000005da 0000000000000002
[    0.000000] $16   : ffffffff80b80e40 0000000000000000 ffffffff80b81614 9800000005dfbe80
[    0.000000] $20   : 00000000540000e0 ffffffff81980000 0000000000000000 ffffffff80f81c80
[    0.000000] $24   : 0000000000000a26 ffffffff8114fb90
[    0.000000] $28   : ffffffff80b50000 ffffffff80b53d40 0000000000000000 ffffffff81afad90
[    0.000000] Hi    : 0000000000000000
[    0.000000] Lo    : 0000000000000000
[    0.000000] epc   : ffffffff81afada8 init_idle+0x130/0x270
[    0.000000] ra    : ffffffff81afad90 init_idle+0x118/0x270
[    0.000000] Status: 540000e2	KX SX UX KERNEL EXL
[    0.000000] Cause : 00000008 (ExcCode 02)
[    0.000000] BadVA : 0000000000000000
[    0.000000] PrId  : 00006305 (ICT Loongson-3)
[    0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000)
[    0.000000] Stack : 9800000005dfbf00 ffffffff8178e950 0000000000000000 0000000000000000
[    0.000000]         0000000000000000 ffffffff81970000 000000000000003f ffffffff810a6528
[    0.000000]         0000000000000001 9800000005dfbe80 9800000005dfbf00 ffffffff81980000
[    0.000000]         ffffffff810a6450 ffffffff81afb6c0 0000000000000000 ffffffff810a2258
[    0.000000]         ffffffff81d82ec8 ffffffff8198d010 ffffffff81b67e80 ffffffff8197dd98
[    0.000000]         ffffffff81d81c80 ffffffff81930000 0000000000000040 0000000000000000
[    0.000000]         0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    0.000000]         0000000000000000 000000000000009e ffffffff9fc01000 0000000000000000
[    0.000000]         0000000000000000 0000000000000000 0000000000000000 0000000000000000
[    0.000000]         0000000000000000 ffffffff81ae86dc ffffffff81b3c741 0000000000000002
[    0.000000]         ...
[    0.000000] Call Trace:
[    0.000000] [<ffffffff81afada8>] init_idle+0x130/0x270
[    0.000000] [<ffffffff81afb6c0>] sched_init+0x5c8/0x6c0
[    0.000000] [<ffffffff81ae86dc>] start_kernel+0x27c/0x7a8

This bug has been reported to LLVM[2] and affects version from (at
least) 18 to 21. Let's work around this by using inline assembly to
assign $gp before a fix is widely available.

Cc: stable@vger.kernel.org
Link: https://gcc.gnu.org/onlinedocs/gcc-15.2.0/gcc/Global-Register-Variables.html # [1]
Link: https://github.com/llvm/llvm-project/issues/176546 # [2]
Signed-off-by: Yao Zi <me@ziyao.cc>
Acked-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/kernel/relocate.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
index 58fc8d089402b..dcc2763b39d6e 100644
--- a/arch/mips/kernel/relocate.c
+++ b/arch/mips/kernel/relocate.c
@@ -420,7 +420,20 @@ void *__init relocate_kernel(void)
 			goto out;
 
 		/* The current thread is now within the relocated image */
+#ifndef CONFIG_CC_IS_CLANG
 		__current_thread_info = RELOCATED(&init_thread_union);
+#else
+		/*
+		 * LLVM may wrongly restore $gp ($28) in epilog even if it's
+		 * intentionally modified. Work around this by using inline
+		 * assembly to assign $gp. $gp couldn't be listed as output or
+		 * clobber, or LLVM will still restore its original value.
+		 * See also LLVM upstream issue
+		 * https://github.com/llvm/llvm-project/issues/176546
+		 */
+		asm volatile("move $28, %0" : :
+			     "r" (RELOCATED(&init_thread_union)));
+#endif
 
 		/* Return the new kernel's entry point */
 		kernel_entry = RELOCATED(start_kernel);
-- 
2.51.0



From - Sat Feb 28 20:01:01 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221217-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id oKl5LXhJo2ltBgIAYBR5ng
	(envelope-from <stable+bounces-221217-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:56 +0000
Return-path: <stable+bounces-221217-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:56 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221217-hi=josie.lol@vger.kernel.org>)
	id 1vwQUh-00000000Yok-3vR1
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:56 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id 9C35D3193CC6
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:51:49 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 0A445359A65;
	Sat, 28 Feb 2026 18:13:58 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OviUK1o3"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id DBC8F347FCC;
	Sat, 28 Feb 2026 18:13:57 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1772302437; cv=none; b=Y06Kt+TACgBU8rEc2AwT0YfbDRileK5mVBiuhp0s/qXD30DOYJn9+9FPNv5aqUo3MKHQE2WJzYm/x7Lva13cuakywKoqw+JnUa0SSxixaiZ74NgqZdsBwCYNpo70Vk9f3d/zqGsRLDnifIoUYHH/UW5Wkc4m3/U4OQUitPJmPKA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1772302437; c=relaxed/simple;
	bh=DfD5e4EFW84B3KvN8gHNJyg3DGnxCVok5TMIpODBfoI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=cTwGHCp3Tmc3WTX1P4R3KU/JB5NNOVHVgmb+nrN1TbOuHrYaDUdhFHLaPTyHY+v584KY/hXfqlB67pmvEU3K+gXwg6arbPukzcYcqeUE9BcXJ+lovkjzOwhWp0mJKpP8yIWzwlJwC5Ee9qbXClaWiEVsmjilg6PNWqt8KjMF+zQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OviUK1o3; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1FD98C116D0;
	Sat, 28 Feb 2026 18:13:57 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1772302437;
	bh=DfD5e4EFW84B3KvN8gHNJyg3DGnxCVok5TMIpODBfoI=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=OviUK1o3br28/g4p/ok3ogKNQm2l4d50YNY5hAlQ3+IaIpwLYXf3n1orGQjy4tUHd
	 TMQYhZtxjcZjJRWk0vMY3gn/i/WBWl0jbiBinwcHx7WWQIJsX2pKy5kD5U6pjQ+ZFp
	 RqW7oAJfgeisvThfB6Rvd6Mrp7Jrd1dBAfrv3SELpZElyk2clMb8t5VPdsHKg3ekGG
	 9U39uhqNs11M40eAjG6gMSLxtj8vFJGX+BeBFEcoTRtOdSNLc97AF9xfvasdO6EneB
	 5+w0u7ofPSZ2fl87+jGlJ0fPyplcdw7J3AAVuPNNDmavrLZr53QHSUlpOhxFkn7Sbg
	 hvX3Prw/nhJ6g==
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev
Cc: Chuck Lever <chuck.lever@oracle.com>,
	Xingjing Deng <micro6947@gmail.com>,
	stable@vger.kernel.org,
	Jeff Layton <jlayton@kernel.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 6.1 175/232] SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
Date: Sat, 28 Feb 2026 13:10:28 -0500
Message-ID: <20260228181127.1592657-175-sashal@kernel.org>
X-Mailer: git-send-email 2.51.0
In-Reply-To: <20260228181127.1592657-1-sashal@kernel.org>
References: <20260228181127.1592657-1-sashal@kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-stable: review
X-Patchwork-Hint: Ignore
Content-Transfer-Encoding: 8bit
X-DKIM: signer='kernel.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: -1.2 (-)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://docs.mxroute.com/docs/expert-spam-filtering.html
 ---
 Content analysis details:   (-1.2 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: mech.data]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: state.data]
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.234.253.10 listed in zen.spamhaus.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -11

From: Chuck Lever <chuck.lever@oracle.com>

commit 3e6397b056335cc56ef0e9da36c95946a19f5118 upstream.

The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()
functions allocate memory via gssx_dec_buffer(), which calls
kmemdup(). When a subsequent decode operation fails, these
functions return immediately without freeing previously
allocated buffers, causing memory leaks.

The leak in gssx_dec_ctx() is particularly relevant because
the caller (gssp_accept_sec_context_upcall) initializes several
buffer length fields to non-zero values, resulting in memory
allocation:

    struct gssx_ctx rctxh = {
        .exported_context_token.len = GSSX_max_output_handle_sz,
        .mech.len = GSS_OID_MAX_LEN,
        .src_name.display_name.len = GSSX_max_princ_sz,
        .targ_name.display_name.len = GSSX_max_princ_sz
    };

If, for example, gssx_dec_name() succeeds for src_name but
fails for targ_name, the memory allocated for
exported_context_token, mech, and src_name.display_name
remains unreferenced and cannot be reclaimed.

Add error handling with goto-based cleanup to free any
previously allocated buffers before returning an error.

Reported-by: Xingjing Deng <micro6947@gmail.com>
Closes: https://lore.kernel.org/linux-nfs/CAK+ZN9qttsFDu6h1FoqGadXjMx1QXqPMoYQ=6O9RY4SxVTvKng@mail.gmail.com/
Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/auth_gss/gss_rpc_xdr.c | 82 ++++++++++++++++++++++++-------
 1 file changed, 64 insertions(+), 18 deletions(-)

diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index cb32ab9a83952..ee91f4d641e6f 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -320,29 +320,47 @@ static int gssx_dec_status(struct xdr_stream *xdr,
 
 	/* status->minor_status */
 	p = xdr_inline_decode(xdr, 8);
-	if (unlikely(p == NULL))
-		return -ENOSPC;
+	if (unlikely(p == NULL)) {
+		err = -ENOSPC;
+		goto out_free_mech;
+	}
 	p = xdr_decode_hyper(p, &status->minor_status);
 
 	/* status->major_status_string */
 	err = gssx_dec_buffer(xdr, &status->major_status_string);
 	if (err)
-		return err;
+		goto out_free_mech;
 
 	/* status->minor_status_string */
 	err = gssx_dec_buffer(xdr, &status->minor_status_string);
 	if (err)
-		return err;
+		goto out_free_major_status_string;
 
 	/* status->server_ctx */
 	err = gssx_dec_buffer(xdr, &status->server_ctx);
 	if (err)
-		return err;
+		goto out_free_minor_status_string;
 
 	/* we assume we have no options for now, so simply consume them */
 	/* status->options */
 	err = dummy_dec_opt_array(xdr, &status->options);
+	if (err)
+		goto out_free_server_ctx;
 
+	return 0;
+
+out_free_server_ctx:
+	kfree(status->server_ctx.data);
+	status->server_ctx.data = NULL;
+out_free_minor_status_string:
+	kfree(status->minor_status_string.data);
+	status->minor_status_string.data = NULL;
+out_free_major_status_string:
+	kfree(status->major_status_string.data);
+	status->major_status_string.data = NULL;
+out_free_mech:
+	kfree(status->mech.data);
+	status->mech.data = NULL;
 	return err;
 }
 
@@ -505,28 +523,35 @@ static int gssx_dec_name(struct xdr_stream *xdr,
 	/* name->name_type */
 	err = gssx_dec_buffer(xdr, &dummy_netobj);
 	if (err)
-		return err;
+		goto out_free_display_name;
 
 	/* name->exported_name */
 	err = gssx_dec_buffer(xdr, &dummy_netobj);
 	if (err)
-		return err;
+		goto out_free_display_name;
 
 	/* name->exported_composite_name */
 	err = gssx_dec_buffer(xdr, &dummy_netobj);
 	if (err)
-		return err;
+		goto out_free_display_name;
 
 	/* we assume we have no attributes for now, so simply consume them */
 	/* name->name_attributes */
 	err = dummy_dec_nameattr_array(xdr, &dummy_name_attr_array);
 	if (err)
-		return err;
+		goto out_free_display_name;
 
 	/* we assume we have no options for now, so simply consume them */
 	/* name->extensions */
 	err = dummy_dec_opt_array(xdr, &dummy_option_array);
+	if (err)
+		goto out_free_display_name;
 
+	return 0;
+
+out_free_display_name:
+	kfree(name->display_name.data);
+	name->display_name.data = NULL;
 	return err;
 }
 
@@ -649,32 +674,34 @@ static int gssx_dec_ctx(struct xdr_stream *xdr,
 	/* ctx->state */
 	err = gssx_dec_buffer(xdr, &ctx->state);
 	if (err)
-		return err;
+		goto out_free_exported_context_token;
 
 	/* ctx->need_release */
 	err = gssx_dec_bool(xdr, &ctx->need_release);
 	if (err)
-		return err;
+		goto out_free_state;
 
 	/* ctx->mech */
 	err = gssx_dec_buffer(xdr, &ctx->mech);
 	if (err)
-		return err;
+		goto out_free_state;
 
 	/* ctx->src_name */
 	err = gssx_dec_name(xdr, &ctx->src_name);
 	if (err)
-		return err;
+		goto out_free_mech;
 
 	/* ctx->targ_name */
 	err = gssx_dec_name(xdr, &ctx->targ_name);
 	if (err)
-		return err;
+		goto out_free_src_name;
 
 	/* ctx->lifetime */
 	p = xdr_inline_decode(xdr, 8+8);
-	if (unlikely(p == NULL))
-		return -ENOSPC;
+	if (unlikely(p == NULL)) {
+		err = -ENOSPC;
+		goto out_free_targ_name;
+	}
 	p = xdr_decode_hyper(p, &ctx->lifetime);
 
 	/* ctx->ctx_flags */
@@ -683,17 +710,36 @@ static int gssx_dec_ctx(struct xdr_stream *xdr,
 	/* ctx->locally_initiated */
 	err = gssx_dec_bool(xdr, &ctx->locally_initiated);
 	if (err)
-		return err;
+		goto out_free_targ_name;
 
 	/* ctx->open */
 	err = gssx_dec_bool(xdr, &ctx->open);
 	if (err)
-		return err;
+		goto out_free_targ_name;
 
 	/* we assume we have no options for now, so simply consume them */
 	/* ctx->options */
 	err = dummy_dec_opt_array(xdr, &ctx->options);
+	if (err)
+		goto out_free_targ_name;
+
+	return 0;
 
+out_free_targ_name:
+	kfree(ctx->targ_name.display_name.data);
+	ctx->targ_name.display_name.data = NULL;
+out_free_src_name:
+	kfree(ctx->src_name.display_name.data);
+	ctx->src_name.display_name.data = NULL;
+out_free_mech:
+	kfree(ctx->mech.data);
+	ctx->mech.data = NULL;
+out_free_state:
+	kfree(ctx->state.data);
+	ctx->state.data = NULL;
+out_free_exported_context_token:
+	kfree(ctx->exported_context_token.data);
+	ctx->exported_context_token.data = NULL;
 	return err;
 }
 
-- 
2.51.0



From - Sat Feb 28 20:01:01 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221035-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id SDtEC3lJo2kIHQEAYBR5ng
	(envelope-from <stable+bounces-221035-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:57 +0000
Return-path: <stable+bounces-221035-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:57 +0000
Received: from tor.lore.kernel.org ([172.105.105.114])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221035-hi=josie.lol@vger.kernel.org>)
	id 1vwQUi-00000000Yps-3aFV
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:57 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by tor.lore.kernel.org (Postfix) with ESMTP id 203443241E00
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:46:17 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 73A3D175A6A;
	Sat, 28 Feb 2026 17:56:17 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NtRRZ8X4"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4FE9C175A69;
	Sat, 28 Feb 2026 17:56:17 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1772301377; cv=none; b=ND3Ms+npRhk7SU/XFl2VBVcTkltijiZcM4BtWPccPYgPlt+SUDUPHbnJy9VcCOAj/fuAGI/BNAN6J3oWDae5xBI3NFtpYEmsGQ+fjqwViFo6LGjPTnlRZgOm/iuC9iy7kj8f7tqg0naldQb9FHDB6bYbNeEtFiCRSRfAKJ8oA+0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1772301377; c=relaxed/simple;
	bh=GVG2CccgbtedmWaGhiaA33rg9BGO31x0WCbImzpyZac=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=sz2ty7LRcI5zgrH4F/NfBOYHkWNPBO2Eg4lYvKzLIeqpp+xWje4b6jHr7wrxhGwQQ76Y1MrPI9sQwlWhFdJqvqnBrukmDRFtPQ/+92MzqkaBt+fXzdq5Kv+EuksYpuYT2IH7X4wKILMVT2VaWRBvvsoHDqbmQgdCRXow/iPykGI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NtRRZ8X4; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 675DEC19425;
	Sat, 28 Feb 2026 17:56:16 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1772301377;
	bh=GVG2CccgbtedmWaGhiaA33rg9BGO31x0WCbImzpyZac=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=NtRRZ8X47NRSx3JZnvSk7FCihXZIMUIi1NzY/RiJS4TYCvlAfML1HHxT2AetfIzqb
	 8s5AFDHmcpXIDaRYNj3VbOC8DqS26aQv0l03e0TnEn4vUpjHKRDMoD9e2FN+LbZ5Q5
	 uBqPn2suOyXjoRuGHSNqn6kSe95y8xGELKhruR3d8Ma8E83/YTTL3dD+4Z8TSW+ERG
	 kt+dgBTvK5P3nFZWPEowQOWJFFxoztJDG7jYqRm0AOnkouPby94VL/gzcyYaRkkXYF
	 HKGvTKSyWqVpyFcMO3o3tdQwlLhmbV2CsSmtHW+vyJ6U2GDWkJ1RRcTbNkgKr2QpbC
	 St9gtJA5af2IQ==
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev
Cc: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>,
	Vikash Garodia <vikash.garodia@oss.qualcomm.com>,
	stable@vger.kernel.org,
	Bryan O'Donoghue <bod@kernel.org>,
	Hans Verkuil <hverkuil+cisco@kernel.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.18 566/752] Revert "media: iris: Add sanity check for stop streaming"
Date: Sat, 28 Feb 2026 12:44:37 -0500
Message-ID: <20260228174750.1542406-566-sashal@kernel.org>
X-Mailer: git-send-email 2.51.0
In-Reply-To: <20260228174750.1542406-1-sashal@kernel.org>
References: <20260228174750.1542406-1-sashal@kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-stable: review
X-Patchwork-Hint: Ignore
Content-Transfer-Encoding: 8bit
X-DKIM: signer='kernel.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: -1.2 (-)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://docs.mxroute.com/docs/expert-spam-filtering.html
 ---
 Content analysis details:   (-1.2 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.105.105.114 listed in zen.spamhaus.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -11

From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>

[ Upstream commit 370e19042fb8ac68109f8bdb0fdd8118baf39318 ]

This reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.

Revert the check that skipped stop_streaming when the instance was in
IRIS_INST_ERROR, as it caused multiple regressions:

1. Buffers were not returned to vb2 when the instance was already in
   error state, triggering warnings in the vb2 core because buffer
   completion was skipped.

2. If a session failed early (e.g. unsupported configuration), the
   instance transitioned to IRIS_INST_ERROR. When userspace attempted
   to stop streaming for cleanup, stop_streaming was skipped due to the
   added check, preventing proper teardown and leaving the firmware
   in an inconsistent state.

Fixes: ad699fa78b59 ("media: iris: Add sanity check for stop streaming")
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/iris/iris_vb2.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c
index db8768d8a8f61..139b821f7952f 100644
--- a/drivers/media/platform/qcom/iris/iris_vb2.c
+++ b/drivers/media/platform/qcom/iris/iris_vb2.c
@@ -231,8 +231,6 @@ void iris_vb2_stop_streaming(struct vb2_queue *q)
 		return;
 
 	mutex_lock(&inst->lock);
-	if (inst->state == IRIS_INST_ERROR)
-		goto exit;
 
 	if (!V4L2_TYPE_IS_OUTPUT(q->type) &&
 	    !V4L2_TYPE_IS_CAPTURE(q->type))
@@ -243,10 +241,10 @@ void iris_vb2_stop_streaming(struct vb2_queue *q)
 		goto exit;
 
 exit:
-	if (ret) {
-		iris_helper_buffers_done(inst, q->type, VB2_BUF_STATE_ERROR);
+	iris_helper_buffers_done(inst, q->type, VB2_BUF_STATE_ERROR);
+	if (ret)
 		iris_inst_change_state(inst, IRIS_INST_ERROR);
-	}
+
 	mutex_unlock(&inst->lock);
 }
 
-- 
2.51.0



From - Sat Feb 28 20:01:01 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221034-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id MP6qDXlJo2kE6D0AYBR5ng
	(envelope-from <stable+bounces-221034-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:57 +0000
Return-path: <stable+bounces-221034-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:57 +0000
Received: from tor.lore.kernel.org ([172.105.105.114])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221034-hi=josie.lol@vger.kernel.org>)
	id 1vwQUi-00000000Ypr-3X8A
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:57 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by tor.lore.kernel.org (Postfix) with ESMTP id 56DC63242313
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:46:16 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id A796D175A66;
	Sat, 28 Feb 2026 17:56:16 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fuLRW2r5"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85804175A6A;
	Sat, 28 Feb 2026 17:56:16 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1772301376; cv=none; b=Y9xSOSYWjeBUmZruyFDgfAPo1Rwx3bOpAsOdDjLe//2KE3JLEr9fbaF/3HM+6YkNLsQYn0mRzVxUJd1j9JVZc0ON2tBKjZDzlo6M+eEKkqsxOboJjbBPAvbLAp3RATH6MNJRAeNCtpb9b+eR8fIbPbrgp5YJYVN1nf28y+lWtOE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1772301376; c=relaxed/simple;
	bh=OWCOhCGZi+/pG6EbYCRtEvhHzqHBeIEHKtlrL4Iz5IU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=IPqUm2wkLP+Q2XGfXqYzKqhF3y38h6PsNFmCoP7d456+J2ZTdG5SFmIhOpF0UgCfMGZjOrtGaA1hPIfCUhTQ18XMEFSC9HVGI9Axt/b5iNu/G95lC6i2For7tb1TJTiG0leeumiAhnnPAV3RoEN8BRrc9isCRW8isIadX6RA8Ok=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fuLRW2r5; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DCF2C19423;
	Sat, 28 Feb 2026 17:56:15 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1772301376;
	bh=OWCOhCGZi+/pG6EbYCRtEvhHzqHBeIEHKtlrL4Iz5IU=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=fuLRW2r5d/mxHACWL8o/VHsTnv7bOuko3ewMPt7OoHOthw9p5cw1CeZ4iSltaegd1
	 fvuIC/ZBmh8GRb7qEbkRNzyrhoGs5hTiHYI9mC1PqlI1QWeMFEhFJVzlz8ua9p+gwy
	 YnN8wPRtVvogVj/+RhoUWhHQPvlvIVpb/wguLDz0auOW9NkJM4J4MP2yg0tFk4eLAb
	 cL/Ztxy+edBf6zxlXje7NSivmmDoFpN9jLR7hu3zxUFStwRaB5HS90HS0j0fGbSP2P
	 mTOM6jWmfbkk4ZdqvXD9X1AzH4C5CVk0SoZCfhw3SqHPX+tpn1n5mHC+jzX3eUVgNC
	 KHMUCreAwj2cg==
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev
Cc: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>,
	stable@vger.kernel.org,
	Mecid <mecid@mecomediagroup.de>,
	Renjiang Han <renjiang.han@oss.qualcomm.com>,
	Bryan O'Donoghue <bod@kernel.org>,
	Hans Verkuil <hverkuil+cisco@kernel.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.18 565/752] media: venus: vdec: restrict EOS addr quirk to IRIS2 only
Date: Sat, 28 Feb 2026 12:44:36 -0500
Message-ID: <20260228174750.1542406-565-sashal@kernel.org>
X-Mailer: git-send-email 2.51.0
In-Reply-To: <20260228174750.1542406-1-sashal@kernel.org>
References: <20260228174750.1542406-1-sashal@kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-stable: review
X-Patchwork-Hint: Ignore
Content-Transfer-Encoding: 8bit
X-DKIM: signer='kernel.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: -1.2 (-)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://docs.mxroute.com/docs/expert-spam-filtering.html
 ---
 Content analysis details:   (-1.2 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [172.105.105.114 listed in zen.spamhaus.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -11

From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>

[ Upstream commit 63c072e2937e6c9995df1b6a28523ed2ae68d364 ]

On SM8250 (IRIS2) with firmware older than 1.0.087, the firmware could
not handle a dummy device address for EOS buffers, so a NULL device
address is sent instead. The existing check used IS_V6() alongside a
firmware version gate:

    if (IS_V6(core) && is_fw_rev_or_older(core, 1, 0, 87))
        fdata.device_addr = 0;
    else
	fdata.device_addr = 0xdeadb000;

However, SC7280 which is also V6, uses a firmware string of the form
"1.0.<commit-hash>", which the version parser translates to 1.0.0. This
unintentionally satisfies the `is_fw_rev_or_older(..., 1, 0, 87)`
condition on SC7280. Combined with IS_V6() matching there as well, the
quirk is incorrectly applied to SC7280, causing VP9 decode failures.

Constrain the check to IRIS2 (SM8250) only, which is the only platform
that needed this quirk, by replacing IS_V6() with IS_IRIS2(). This
restores correct behavior on SC7280 (no forced NULL EOS buffer address).

Fixes: 47f867cb1b63 ("media: venus: fix EOS handling in decoder stop command")
Cc: stable@vger.kernel.org
Reported-by: Mecid <mecid@mecomediagroup.de>
Closes: https://github.com/qualcomm-linux/kernel-topics/issues/222
Co-developed-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Tested-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/vdec.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
index ba4d9087bff5d..27cb024427b83 100644
--- a/drivers/media/platform/qcom/venus/vdec.c
+++ b/drivers/media/platform/qcom/venus/vdec.c
@@ -567,7 +567,13 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
 
 		fdata.buffer_type = HFI_BUFFER_INPUT;
 		fdata.flags |= HFI_BUFFERFLAG_EOS;
-		if (IS_V6(inst->core) && is_fw_rev_or_older(inst->core, 1, 0, 87))
+
+		/* Send NULL EOS addr for only IRIS2 (SM8250),for firmware <= 1.0.87.
+		 * SC7280 also reports "1.0.<hash>" parsed as 1.0.0; restricting to IRIS2
+		 * avoids misapplying this quirk and breaking VP9 decode on SC7280.
+		 */
+
+		if (IS_IRIS2(inst->core) && is_fw_rev_or_older(inst->core, 1, 0, 87))
 			fdata.device_addr = 0;
 		else
 			fdata.device_addr = 0xdeadb000;
-- 
2.51.0



From - Sat Feb 28 20:01:20 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <stable+bounces-221037-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id EKRwF3pJo2kORAEAYBR5ng
	(envelope-from <stable+bounces-221037-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Sat, 28 Feb 2026 20:00:58 +0000
Return-path: <stable+bounces-221037-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Sat, 28 Feb 2026 20:00:58 +0000
Received: from tor.lore.kernel.org ([172.105.105.114])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-221037-hi=josie.lol@vger.kernel.org>)
	id 1vwQUk-00000000Yrx-08iZ
	for hi@josie.lol;
	Sat, 28 Feb 2026 20:00:58 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by tor.lore.kernel.org (Postfix) with ESMTP id D22F73243926
	for <hi@josie.lol>; Sat, 28 Feb 2026 19:46:18 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 9A761175A72;
	Sat, 28 Feb 2026 17:56:19 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="tuxASwoV"
X-Original-To: stable@vger.kernel.org
Received: from smt