)]}' { "log": [ { "commit": "62eb3a91400779644531389ecdc40af0620e91f4", "tree": "0d7c8be92bdb0453622ee62eea857e895b2d54c0", "parents": [ "bd0bc52873451a03da2b184ae661c933b45a34e1" ], "author": { "name": "Miri Amarilio", "email": "mirilio@google.com", "time": "Thu Jul 09 18:58:20 2026 +0000" }, "committer": { "name": "Miri Amarilio", "email": "mirilio@google.com", "time": "Fri Jul 10 14:44:04 2026 -0700" }, "message": "Enable CONFIG_MEMORY_FAILURE on ARM\n\nBUG\u003db/532225242\nTEST\u003dpresubmit, validation\nRELEASE_NOTE\u003dEnabled CONFIG_MEMORY_FAILURE in the Linux kernel for ARM64. This should improve memory errors handling when running CUDA workloads.\n\ncos-patch: bug\nChange-Id: Idf9f7a953fbdd8481b2ce78e42d196feeb673944\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/167648\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\n" }, { "commit": "bd0bc52873451a03da2b184ae661c933b45a34e1", "tree": "15e4f991185967a2fb0eb9a9bd3f9e1448f1f5d7", "parents": [ "e1d779f9a514b8e89a4661da858601d143841c0c" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Mar 17 20:00:26 2026 +0100" }, "committer": { "name": "Chenglong Tang", "email": "chenglongtang@google.com", "time": "Wed Apr 15 22:10:40 2026 -0700" }, "message": "netfilter: nf_tables: release flowtable after rcu grace period on error\n\n[ Upstream commit d73f4b53aaaea4c95f245e491aa5eeb8a21874ce ]\n\nCall synchronize_rcu() after unregistering the hooks from error path,\nsince a hook that already refers to this flowtable can be already\nregistered, exposing this flowtable to packet path and nfnetlink_hook\ncontrol plane.\n\nThis error path is rare, it should only happen by reaching the maximum\nnumber hooks or by failing to set up to hardware offload, just call\nsynchronize_rcu().\n\nThere is a check for already used device hooks by different flowtable\nthat could result in EEXIST at this late stage. The hook parser can be\nupdated to perform this check earlier to this error path really becomes\nrarely exercised.\n\nUncovered by KASAN reported as use-after-free from nfnetlink_hook path\nwhen dumping hooks.\n\nBUG\u003db/500321842\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-7e3955b in the Linux kernel.\n\nFixes: 3b49e2e94e6e (\"netfilter: nf_tables: add flow table netlink frontend\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nChange-Id: Ie828d439c7a56b916c762820ac98e9d1685af437\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/144543\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "e1d779f9a514b8e89a4661da858601d143841c0c", "tree": "b5ab05a70b064524945241c7269e1d0e4789921b", "parents": [ "350c271d1b528bc4fe572d2cadd2a16c3a758e41" ], "author": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Thu Apr 09 10:55:48 2026 -0700" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Apr 10 16:42:16 2026 -0700" }, "message": "cchost.config: add baked in command line\n\nThe exact command line value we want at this point is not known yet, so\nfill it with a placeholder. The placeholder is intended to be very high\nentropy to give us flexibility when we edit the bzImage in-place later.\n\nBUG\u003db/465210631\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dNone\n\nChange-Id: I01f64b014d42dd0df672cce6cc6dbafe774a295f\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/143664\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n" }, { "commit": "350c271d1b528bc4fe572d2cadd2a16c3a758e41", "tree": "ace4d859f2845306a681a744a0bd470b886d502b", "parents": [ "95e3317c03816d2a958f9aee05d52d08c50b7e2c" ], "author": { "name": "Link Lin", "email": "linkl@google.com", "time": "Mon Mar 30 12:33:53 2026 -0700" }, "committer": { "name": "Kevin Berry", "email": "kpberry@google.com", "time": "Wed Apr 01 16:46:43 2026 -0700" }, "message": "virtio_pci: fix array index mismatch in vp_del_vqs\n\nThe Issue: During the teardown of the virtio_balloon module (e.g., via rmmod virtio_balloon), a kernel NULL pointer dereference occurs. The crash cascades into an unchecked list_del() and triggers the following kernel panic:\n[12261.808190] Call trace:\n[12261.808471] __list_del_entry_valid_or_report+0x18/0xe0\n[12261.809064] vp_del_vqs+0x12c/0x270\n[12261.809462] remove_common+0x80/0x98 [virtio_balloon]\n[12261.810034] virtballoon_remove+0xfc/0x158 [virtio_balloon]\n[12261.810663] virtio_dev_remove+0x68/0xf8\n[12261.811108] device_release_driver_internal+0x17c/0x278\n[12261.811701] driver_detach+0xd4/0x138\n[12261.812117] bus_remove_driver+0x90/0xd0\n[12261.812562] driver_unregister+0x40/0x70\n[12261.813006] unregister_virtio_driver+0x20/0x38\n[12261.813518] cleanup_module+0x20/0x7a8 [virtio_balloon]\n[12261.814109] __arm64_sys_delete_module+0x278/0x3d0\n[12261.814654] invoke_syscall+0x5c/0x120\n[12261.815086] el0_svc_common+0x90/0xf8\n[12261.815506] do_el0_svc+0x2c/0x48\n[12261.815883] el0_svc+0x3c/0xa8\n[12261.816235] el0t_64_sync_handler+0x8c/0x108\n[12261.816724] el0t_64_sync+0x198/0x1a0\n[12261.817141] Code: d503233f a9bf7bfd 910003fd aa0003e1 (f9400003)\n[12261.817874] SMP: stopping secondary CPUs\n[12261.818614] Starting crashdump kernel...\n[12261.819053] Bye!\n\nThe Root Cause: In vp_find_vqs_msix() and vp_find_vqs_intx(), the PCI device\u0027s virtqueue info array vp_dev-\u003evqs is erroneously populated using the virtqueue configuration array index i. However, during teardown, vp_del_vqs() looks up the info structure using vq-\u003eindex, which corresponds to queue_idx (incremented only when a queue is instantiated).\nWhen a virtio device conditionally skips a queue, i and queue_idx diverge. The debug log proves what the issue is during instantiation and later removal:\n\n[ 2.334426] DEBUG: Created intx virtqueue \u0027inflate\u0027 (queue_idx: 0, Config index i: 0, info ptr: ffff935fc1dbbee0)\n[ 2.347020] DEBUG: Created intx virtqueue \u0027deflate\u0027 (queue_idx: 1, Config index i: 1, info ptr: ffff935fc1dbb7a0)\n[ 2.361307] DEBUG: Created intx virtqueue \u0027stats\u0027 (queue_idx: 2, Config index i: 2, info ptr: ffff935fc1dbbdc0)\n[ 2.372745] DEBUG: Created intx virtqueue \u0027reporting_vq\u0027 (queue_idx: 3, Config index i: 4, info ptr: ffff935fc1dbb860)\n[ 435.481126] DEBUG: Removing virtqueue \u0027inflate\u0027 (index: 0, info ptr: ffff935fc1dbbee0)\n[ 435.504159] DEBUG: Removing virtqueue \u0027deflate\u0027 (index: 1, info ptr: ffff935fc1dbb7a0)\n[ 435.525601] DEBUG: Removing virtqueue \u0027stats\u0027 (index: 2, info ptr: ffff935fc1dbbdc0)\n[ 435.546626] DEBUG: Removing virtqueue \u0027reporting_vq\u0027 (index: 3, info ptr: ffff935fc1dbb860)\n\nThe reporting queue gets an index i\u003d4, but a queue_idx\u003d3. During teardown, vp_del_vqs() checks vp_dev-\u003evqs[3], hitting an uninstantiated NULL slot.\n\nThe Fix: This change fixes the divergence of queue_idx and i by explicitly using \u0026vp_dev-\u003evqs[vq_idx] instead of the configuration index. This guarantees vp_dev-\u003evqs is always populated using the queue\u0027s successfully instantiated index, preventing offsetting and the resulting NULL pointer dereference.\n\nFixes: fd27ef6b44be (\"virtio_pci: add admin vq wrapper and some helpers\")\nBug: b/477623032\nTEST\u003dtested rmmod virtio_balloon with FS kernel on an E4 VM\nRELEASE_NOTE\u003dFixes a kernel panic in virtio_pci teardown when virtually queues are conditionally skipped.\n\nChange-Id: I0d5ea76630af7a6778350294477112009cd64189\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/141563\nReviewed-by: Chetan Sharma \u003cqoogle@google.com\u003e\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "95e3317c03816d2a958f9aee05d52d08c50b7e2c", "tree": "f34795a7693ee72cebcb8bb0c409c615d4630f6d", "parents": [ "ef4e393c358e8c7675d8c2a260cbca1163ead2a3" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Mar 05 21:32:00 2026 +0100" }, "committer": { "name": "Miri Amarilio", "email": "mirilio@google.com", "time": "Mon Mar 30 11:34:38 2026 -0700" }, "message": "netfilter: nf_tables: always walk all pending catchall elements\n\n[ Upstream commit 7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9 ]\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]\n\nBUG\u003db/495779852\nTEST\u003dPresubmit\nRELEASE_NOTE\u003dFixed KCTF-7cb9a23 in the Linux kernel.\n\ncos-patch: security-high\nFixes: 628bd3e49cba (\"netfilter: nf_tables: drop map element references from preparation phase\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nChange-Id: I9f3b7acab7f39cecd34616c403ed7cfa7e8a3f66\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/141103\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "ef4e393c358e8c7675d8c2a260cbca1163ead2a3", "tree": "78ab4d7e7d1216fbf33bea18b0658073ec784f96", "parents": [ "c7e836fbadeb665919787304e0a92f0246c63643" ], "author": { "name": "Joanne Koong", "email": "joannelkoong@gmail.com", "time": "Mon Sep 23 10:13:11 2024 -0700" }, "committer": { "name": "Kevin Berry", "email": "kpberry@google.com", "time": "Fri Mar 27 17:06:50 2026 -0700" }, "message": "fuse: enable dynamic configuration of fuse max pages limit (FUSE_MAX_MAX_PAGES)\n\nIntroduce the capability to dynamically configure the max pages limit\n(FUSE_MAX_MAX_PAGES) through a sysctl. This allows system administrators\nto dynamically set the maximum number of pages that can be used for\nservicing requests in fuse.\n\nPreviously, this is gated by FUSE_MAX_MAX_PAGES which is statically set\nto 256 pages. One result of this is that the buffer size for a write\nrequest is limited to 1 MiB on a 4k-page system.\n\nThe default value for this sysctl is the original limit (256 pages).\n\n$ sysctl -a | grep max_pages_limit\nfs.fuse.max_pages_limit \u003d 256\n\n$ sysctl -n fs.fuse.max_pages_limit\n256\n\n$ echo 1024 | sudo tee /proc/sys/fs/fuse/max_pages_limit\n1024\n\n$ sysctl -n fs.fuse.max_pages_limit\n1024\n\n$ echo 65536 | sudo tee /proc/sys/fs/fuse/max_pages_limit\ntee: /proc/sys/fs/fuse/max_pages_limit: Invalid argument\n\n$ echo 0 | sudo tee /proc/sys/fs/fuse/max_pages_limit\ntee: /proc/sys/fs/fuse/max_pages_limit: Invalid argument\n\n$ echo 65535 | sudo tee /proc/sys/fs/fuse/max_pages_limit\n65535\n\n$ sysctl -n fs.fuse.max_pages_limit\n65535\n\nBUG\u003db/496012319\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dEnabled dynamic configuration of FUSE max pages limit.\n\ncos-patch: bug\nSigned-off-by: Joanne Koong \u003cjoannelkoong@gmail.com\u003e\nReviewed-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nReviewed-by: Sweet Tea Dorminy \u003csweettea-kernel@dorminy.me\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\nChange-Id: I49200c2f1fbecd8ea4a498595381ef5cc0ab3545\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/139702\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Derek Taylor \u003cddtaylor@google.com\u003e\n" }, { "commit": "c7e836fbadeb665919787304e0a92f0246c63643", "tree": "02e0769b7ccf1f0ea1e5bc89a2825e1fc189b6cd", "parents": [ "0859a6ab754d7a2654c37159fd8d0dc41eab923f", "6f232446a62980e51f537db1c655e686d869b9ed" ], "author": { "name": "COS Kernel Merge Bot", "email": "cloud-image-merge-automation@prod.google.com", "time": "Sat Mar 14 02:35:39 2026 -0700" }, "committer": { "name": "Kevin Berry", "email": "kpberry@google.com", "time": "Thu Mar 26 09:59:49 2026 -0700" }, "message": "merge-upstream/v6.12.77 from branch/tag: upstream/v6.12.77 into branch: cos-6.12\n\nWe drop the patch for 9fb6fef0fb4912 (\"resource: Add resource set range\nand size helpers\") since it\u0027s included in the merge.\n\nChangelog:\n-------------------------------------------------------------\n\nAkhilesh Patil (1):\n hwmon: (aht10) Add support for dht20\n\nAl Viro (1):\n xattr: switch to CLASS(fd)\n\nAlban Bedel (1):\n can: mcp251x: fix deadlock in error path of mcp251x_open\n\nAlexandre Courbot (1):\n rust: kunit: fix warning when !CONFIG_PRINTK\n\nAllison Henderson (1):\n net/rds: Fix circular locking dependency in rds_tcp_tune\n\nAndrew Cooper (1):\n x86/fred: Correct speculative safety in fred_extint()\n\nAndrii Nakryiko (1):\n uprobes: switch to RCU Tasks Trace flavor for better performance\n\nAnup Patel (1):\n mailbox: Allow controller specific mapping using fwnode\n\nAriel Silver (1):\n wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration\n\nBaokun Li (8):\n ext4: add ext4_try_lock_group() to skip busy groups\n ext4: factor out __ext4_mb_scan_group()\n ext4: factor out ext4_mb_might_prefetch()\n ext4: factor out ext4_mb_scan_group()\n ext4: convert free groups order lists to xarrays\n ext4: refactor choose group to scan group\n ext4: implement linear-like traversal across order xarrays\n ext4: fix potential null deref in ext4_mb_init()\n\nBart Van Assche (5):\n drm/amdgpu: Unlock a mutex before destroying it\n drm/amdgpu: Fix locking bugs in error paths\n hwmon: (it87) Check the it87_lock() return value\n wifi: cw1200: Fix locking in error paths\n wifi: wlcore: Fix a locking bug\n\nBjorn Helgaas (1):\n PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value\n\nBrad Spengler (1):\n drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release\n\nBreno Leitao (2):\n ima: kexec: silence RCU list traversal warning\n uprobes: Fix incorrect lockdep condition in filter_chain()\n\nBrian Howard (1):\n HID: multitouch: add quirks for Lenovo Yoga Book 9i\n\nBrian Vazquez (1):\n idpf: change IRQ naming to match netdev and ethtool queue numbering\n\nCharles Haithcock (1):\n i2c: i801: Revert \"i2c: i801: replace acpi_lock with I2C bus lock\"\n\nChintan Vankar (1):\n net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table\n\nChristian Brauner (1):\n namespace: fix proc mount iteration\n\nChristoph Böhmwalder (1):\n drbd: fix null-pointer dereference on local read error\n\nDamien Le Moal (13):\n PCI: endpoint: Introduce pci_epc_function_is_valid()\n PCI: endpoint: Introduce pci_epc_mem_map()/unmap()\n PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr() operation\n ata: libata-scsi: Refactor ata_scsi_simulate()\n ata: libata-scsi: Refactor ata_scsiop_read_cap()\n ata: libata-scsi: Refactor ata_scsiop_maint_in()\n ata: libata-scsi: Document all VPD page inquiry actors\n ata: libata-scsi: Remove struct ata_scsi_args\n ata: libata: Remove ATA_DFLAG_ZAC device flag\n ata: libata: Introduce ata_port_eh_scheduled()\n ata: libata-scsi: avoid Non-NCQ command starvation\n ata: libata-core: fix cancellation of a port deferred qc work\n ata: libata-eh: correctly handle deferred qc timeouts\n\nDaniil Dulov (1):\n wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()\n\nDavid Sterba (1):\n btrfs: drop unused parameter fs_info from do_reclaim_sweep()\n\nDavid Thomson (1):\n xen/acpi-processor: fix _CST detection using undersized evaluation buffer\n\nDavide Caratti (1):\n net/sched: ets: fix divide by zero in the offload path\n\nEric Dumazet (2):\n indirect_call_wrapper: do not reevaluate function pointer\n net_sched: sch_fq: clear q-\u003eband_pkt_count[] in fq_reset()\n\nEric Naim (1):\n ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)\n\nEthan Nelson-Moore (1):\n net: arcnet: com20020-pci: fix support for 2.5Mbit cards\n\nFelix Gu (2):\n drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()\n pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()\n\nFernando Fernandez Mancera (2):\n net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n\nFilipe Manana (2):\n btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()\n btrfs: fix reclaimed bytes accounting after automatic block group reclaim\n\nFlorian Eckert (2):\n pinctrl: equilibrium: rename irq_chip function callbacks\n pinctrl: equilibrium: fix warning trace on load\n\nFlorian Westphal (1):\n netfilter: nft_set_pipapo: split gc into unlink and reclaim phase\n\nFrancesco Lavra (1):\n drm/solomon: Fix page start when updating rectangle in page addressing mode\n\nFuad Tabba (2):\n KVM: arm64: Hide S1POE from guests when not supported by the host\n bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing\n\nGeoffrey D. Bennett (3):\n ALSA: scarlett2: Fix redeclaration of loop variable\n ALSA: scarlett2: Fix DSP filter control array handling\n ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices\n\nGreg Kroah-Hartman (12):\n nfc: pn533: properly drop the usb interface reference on disconnect\n net: usb: kaweth: validate USB endpoints\n net: usb: kalmia: validate USB endpoints\n net: usb: pegasus: validate USB endpoints\n can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message\n can: usb: f81604: correctly anchor the urb in the read bulk callback\n can: ucan: Fix infinite loop from zero-length messages\n can: usb: etas_es58x: correctly anchor the urb in the read bulk callback\n can: usb: f81604: handle short interrupt urb messages properly\n can: usb: f81604: handle bulk write errors properly\n HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them\n Linux 6.12.77\n\nGuenter Roeck (3):\n dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler\n tracing: Add NULL pointer check to trigger_data_free()\n ata: libata-eh: Fix detection of deferred qc timeouts\n\nGui-Dong Han (1):\n hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race\n\nHao Yu (1):\n hwmon: (aht10) Fix initialization commands for AHT20\n\nHarshit Mogalapalli (2):\n ima: verify the previous kernel\u0027s IMA buffer lies in addressable RAM\n of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()\n\nHeiko Carstens (2):\n s390/idle: Fix cpu idle exit cpu time accounting\n s390/vtime: Fix virtual timer forwarding\n\nHenrique Carvalho (1):\n smb: client: fix cifs_pick_channel when channels are equally loaded\n\nHongyu Xie (1):\n usb: cdns3: remove redundant if branch\n\nHuacai Chen (1):\n net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz\n\nIan Forbes (1):\n drm/vmwgfx: Return the correct value in vmw_translate_ptr functions\n\nIan Ray (2):\n HID: multitouch: new class MT_CLS_EGALAX_P80H84\n net: nfc: nci: Fix zero-length proprietary notifications\n\nIlpo Järvinen (2):\n resource: Add resource set range and size helpers\n PCI: Use resource_set_range() that correctly sets -\u003eend\n\nJakub Kicinski (4):\n ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()\n nfc: nci: free skb on nci_transceive early error paths\n nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback\n nfc: rawsock: cancel tx_work before socket teardown\n\nJamal Hadi Salim (1):\n net/sched: act_ife: Fix metalist update behavior\n\nJan Kara (1):\n ext4: always allocate blocks only from groups inode can use\n\nJann Horn (1):\n eventpoll: Fix integer overflow in ep_loop_check_proc()\n\nJason Gunthorpe (2):\n IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()\n RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()\n\nJens Axboe (1):\n media: dvb-core: fix wrong reinitialization of ringbuffer on reopen\n\nJeongjun Park (2):\n drm/exynos: vidi: fix to avoid directly dereferencing user pointer\n drm/exynos: vidi: use ctx-\u003elock to protect struct vidi_context member variables related to memory alloc/free\n\nJiayuan Chen (3):\n atm: lec: fix null-ptr-deref in lec_arp_clear_vccs\n bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded\n net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n\nJinhui Guo (1):\n iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode\n\nJohan Hovold (4):\n memory: mtk-smi: fix device leaks on common probe\n memory: mtk-smi: fix device leak on larb probe\n drm/tegra: dsi: fix device leak on probe\n clk: tegra: tegra124-emc: fix device leak on set_rate()\n\nJohannes Berg (1):\n wifi: radiotap: reject radiotap with unknown bits\n\nJohannes Thumshirn (1):\n btrfs: zoned: fix alloc_offset calculation for partly conventional block groups\n\nJohn Johansen (6):\n apparmor: fix: limit the number of levels of policy namespaces\n apparmor: Fix double free of ns_name in aa_replace_profiles()\n apparmor: fix unprivileged local user can do privileged policy management\n apparmor: fix differential encoding verification\n apparmor: fix race on rawdata dereference\n apparmor: fix race between freeing data and fs accessing it\n\nJonathan Teh (1):\n platform/x86: thinkpad_acpi: Fix errors reading battery thresholds\n\nJoonwon Kang (1):\n mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()\n\nJun Seo (1):\n ALSA: usb-audio: Use correct version for UAC3 header validation\n\nJunxiao Bi (1):\n scsi: core: Fix refcount leak for tagset_refcnt\n\nKohei Enju (2):\n bpf: Fix stack-out-of-bounds write in devmap\n iavf: fix netdev-\u003emax_mtu to respect actual hardware limit\n\nKoichiro Den (1):\n net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nKrishna chaitanya chundru (1):\n PCI: qcom: Don\u0027t wait for link if we can detect Link Up\n\nKuninori Morimoto (1):\n ALSA: pci: hda: use snd_kcontrol_chip()\n\nKuniyuki Iwashima (1):\n nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().\n\nKurt Borja (1):\n platform/x86: dell-wmi: Add audio/mic mute key codes\n\nLang Xu (1):\n bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\nLars Ellenberg (1):\n drbd: fix \"LOGIC BUG\" in drbd_al_begin_io_nonblock()\n\nLarysa Zaremba (5):\n xdp: use modulo operation to calculate XDP frag tailroom\n xsk: introduce helper to determine rxq-\u003efrag_size\n i40e: fix registering XDP RxQ info\n i40e: use xdp.frame_sz as XDP RxQ info frag_size\n xdp: produce a warning when calculated tailroom is negative\n\nLewis Mason (1):\n ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)\n\nLorenzo Bianconi (4):\n wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()\n wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()\n wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()\n net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()\n\nMD Danish Anwar (1):\n net: ti: icssg-prueth: Fix ping failure after offload mode setup when link speed is not 1G\n\nMaciej Fijalkowski (2):\n xsk: Get rid of xdp_buff_xsk::xskb_list_node\n xsk: s/free_list_node/list_node/\n\nMarco Crivellari (2):\n workqueue: Add system_percpu_wq and system_dfl_wq\n Input: synaptics_i2c - replace use of system_wq with system_dfl_wq\n\nMario Limonciello (1):\n drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()\n\nMark Harmstone (5):\n btrfs: fix incorrect key offset in error message in check_dev_extent_item()\n btrfs: fix objectid value in error message in check_extent_data_ref()\n btrfs: fix warning in scrub_verify_one_metadata()\n btrfs: print correct subvol num if active swapfile prevents deletion\n btrfs: fix compat mask in error messages in btrfs_check_features()\n\nMassimiliano Pellizzer (5):\n apparmor: validate DFA start states are in bounds in unpack_pdb\n apparmor: fix memory leak in verify_header\n apparmor: replace recursive profile removal with iterative approach\n apparmor: fix side-effect bug in match_char() macro usage\n apparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nMathias Krause (1):\n scsi: lpfc: Properly set WC for DPP mapping\n\nMathieu Desnoyers (1):\n rseq: Clarify rseq registration rseq_size bound check comment\n\nMatthew Brost (1):\n drm/xe: Do not preempt fence signaling CS instructions\n\nMatthias Fend (2):\n media: dw9714: move power sequences to dedicated functions\n media: dw9714: add support for powerdown pin\n\nMatthieu Baerts (NGI0) (1):\n selftests: mptcp: join: check removing signal+subflow endp\n\nMieczyslaw Nalewaj (1):\n net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value\n\nMike Rapoport (Microsoft) (1):\n x86/efi: defer freeing of boot services memory\n\nMing Lei (1):\n nvme: fix admin queue leak on controller reset\n\nMinseong Kim (1):\n Input: synaptics_i2c - guard polling restart in resume\n\nMiquel Sabaté Solà (1):\n btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros\n\nNam Cao (1):\n irqchip/sifive-plic: Fix frozen interrupt due to affinity setting\n\nNamjae Jeon (2):\n ksmbd: check return value of xa_store() in krb5_authenticate\n ksmbd: add chann_lock to protect ksmbd_chann_list xarray\n\nNaohiro Aota (4):\n btrfs: zoned: fixup last alloc pointer after extent removal for RAID1\n btrfs: zoned: fixup last alloc pointer after extent removal for DUP\n btrfs: zoned: fix stripe width calculation\n btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10\n\nNaresh Solanki (1):\n hwmon: (max6639) : Configure based on DT property\n\nNathan Chancellor (1):\n ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang \u003c 18\n\nNikhil P. Rao (2):\n xsk: Fix fragment node deletion to prevent buffer leak\n xsk: Fix zero-copy AF_XDP fragment drop\n\nNiklas Cassel (6):\n PCI: dwc: ep: Use align addr function for dw_pcie_ep_raise_{msi,msix}_irq()\n PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry\n PCI: dw-rockchip: Don\u0027t wait for link since we can detect Link Up\n Revert \"PCI: dw-rockchip: Don\u0027t wait for link since we can detect Link Up\"\n Revert \"PCI: qcom: Don\u0027t wait for link if we can detect Link Up\"\n ata: libata: cancel pending work after clearing deferred_qc\n\nOliver Hartkopp (1):\n can: bcm: fix locking for bcm_op runtime updates\n\nOlivier Sobrie (1):\n hwmon: (max6639) fix inverted polarity\n\nOvidiu Panait (1):\n net: stmmac: Fix error handling in VLAN add and delete paths\n\nPaolo Abeni (1):\n selftests: mptcp: more stable simult_flows tests\n\nPaulo Alcantara (1):\n smb: client: fix broken multichannel with krb5+signing\n\nPeng Fan (2):\n mailbox: Use dev_err when there is error\n mailbox: Use guard/scoped_guard for con_mutex\n\nPeter Wang (1):\n scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume\n\nPeter Zijlstra (1):\n perf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\nPhillip Lougher (1):\n Squashfs: check metadata block offset is within range\n\nPrithvi Tambewagh (1):\n scsi: target: Fix recursive locking in __configfs_open_file()\n\nQing Wang (1):\n tracing: Fix WARN_ON in tracing_buffers_mmap_close\n\nQu Wenruo (1):\n btrfs: always fallback to buffered write if the inode requires checksum\n\nRaju Rangoju (2):\n amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds\n amd-xgbe: fix sleep while atomic on suspend/resume\n\nRicardo Ribalda (1):\n media: dw9714: Fix powerup sequence\n\nRichard Fitzgerald (1):\n ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()\n\nSalomon Dushimirimana (1):\n scsi: pm8001: Fix use-after-free in pm8001_queue_command()\n\nSean Christopherson (1):\n KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()\n\nSebastian Andrzej Siewior (1):\n LoongArch/orc: Use RCU in all users of __module_address().\n\nSebastian Krzyszkowiak (1):\n wifi: rsi: Don\u0027t default to -EOPNOTSUPP in rsi_mac80211_config\n\nShawn Lin (2):\n arm64: dts: rockchip: Fix rk356x PCIe range mappings\n arm64: dts: rockchip: Fix rk3588 PCIe range mappings\n\nShuicheng Lin (1):\n drm/xe/reg_sr: Fix leak on xa_store failure\n\nShuvam Pandey (1):\n kunit: tool: copy caller args in run_kernel to prevent mutation\n\nStefan Hajnoczi (1):\n nvme: reject invalid pr_read_keys() num_keys values\n\nSteven Chen (4):\n ima: rename variable the seq_file \"file\" to \"ima_kexec_file\"\n ima: define and call ima_alloc_kexec_file_buf()\n kexec: define functions to map and unmap segments\n ima: kexec: define functions to copy IMA log at soft boot\n\nSun Jian (1):\n selftests/harness: order TEST_F and XFAIL_ADD constructors\n\nSun YangKai (1):\n btrfs: fix periodic reclaim condition\n\nSungwoo Kim (1):\n nvme: fix memory allocation in nvme_pr_read_keys()\n\nTakashi Iwai (4):\n ALSA: usb-audio: Cap the packet size pre-calculations\n ALSA: usb-audio: Use inclusive terms\n ALSA: hda/conexant: Add quirk for HP ZBook Studio G4\n ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314\n\nThomas Gleixner (1):\n i40e: Fix preempt count leak in napi poll tracepoint\n\nThomas Richard (TI) (1):\n usb: cdns3: fix role switching during resume\n\nThomas Weißschuh (1):\n ARM: clean up the memset64() C wrapper\n\nThorsten Blum (3):\n drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user\n platform/x86: dell-wmi-sysman: Don\u0027t hex dump plaintext password data\n smb: client: Don\u0027t log plaintext credentials in cifs_set_cifscreds\n\nThéo Lebrun (1):\n usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()\n\nTiezhu Yang (3):\n LoongArch: Remove unnecessary checks for ORC unwinder\n LoongArch: Handle percpu handler address for ORC unwinder\n LoongArch: Remove some extern variables in source files\n\nTudor Ambarus (3):\n mailbox: don\u0027t protect of_parse_phandle_with_args with con_mutex\n mailbox: sort headers alphabetically\n mailbox: remove unused header files\n\nVahagn Vardanian (1):\n wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()\n\nVictor Nogueira (1):\n net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\n\nVimlesh Kumar (4):\n octeon_ep: Relocate counter updates before NAPI\n octeon_ep: avoid compiler and IQ/OQ reordering\n octeon_ep_vf: Relocate counter updates before NAPI\n octeon_ep_vf: avoid compiler and IQ/OQ reordering\n\nVitaly Lifshits (1):\n e1000e: clear DPG_EN after reset to avoid autonomous power-gating\n\nWaiman Long (1):\n cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier()\n\nWake Liu (1):\n kselftest/harness: Use helper to avoid zero-size memset warning\n\nWentao Liang (1):\n drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()\n\nYang Erkun (1):\n ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT\n\nYazen Ghannam (1):\n x86/acpi/boot: Correct acpi_is_processor_usable() check again\n\nYifan Wu (1):\n selftest/arm64: Fix sve2p1_sigill() to hwcap test\n\nYujie Liu (1):\n drm/sched: Fix kernel-doc warning for drm_sched_job_done()\n\nYung Chih Su (1):\n net: ipv4: fix ARM64 alignment fault in multipath hash seed\n\nZhang Yi (1):\n ext4: don\u0027t set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O\n\nZhangGuoDong (2):\n smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()\n smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()\n\nZilin Guan (1):\n media: tegra-video: Fix memory leak in __tegra_channel_try_format()\n\nBUG\u003db/492704033\nTEST\u003dtryjob, validation and K8s e2e\nRELEASE_NOTE\u003dUpdated the Linux kernel to v6.12.77.\n\nChange-Id: Iec2349514015e524c728b49a1882d53ad23b08d1\nSigned-off-by: COS Kernel Merge Bot \u003ccloud-image-merge-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/138001\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nReviewed-by: Daniel Velasquez \u003crdvelasquez@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "0859a6ab754d7a2654c37159fd8d0dc41eab923f", "tree": "35cf476d1bdbfc35b666a5210c98464aff16d83f", "parents": [ "8ecb3fb8b4bed2db662e41f5991ae84debec7939" ], "author": { "name": "Angel Adetula", "email": "angeladetula@google.com", "time": "Mon Mar 23 18:31:25 2026 +0000" }, "committer": { "name": "Angel Adetula", "email": "angeladetula@google.com", "time": "Wed Mar 25 09:10:22 2026 -0700" }, "message": "cos-kernel: move config fragments to separate files\n\nMove kernel configuration fragments and their descriptions from the\neclass to individual .config files. This improves the maintainability\nand readability of cos-kernel.eclass by replacing long configuration\nstrings with a dynamic loader.\n\nBUG\u003d\nTEST\u003dpresubmit, local kernel emerge\nRELEASE_NOTES\u003dNone\n\nChange-Id: I125f490c77ecccf9a6b0ef87d5845c8595e13e0b\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/139286\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\n" }, { "commit": "8ecb3fb8b4bed2db662e41f5991ae84debec7939", "tree": "5525f068778a05856a8b26e1a7488985a2175b08", "parents": [ "4529d7ab34eba0548f4958e9e7e60410a437facb" ], "author": { "name": "Kevin Berry", "email": "kpberry@google.com", "time": "Wed Mar 11 05:54:57 2026 +0000" }, "committer": { "name": "Kevin Berry", "email": "kpberry@google.com", "time": "Tue Mar 24 11:12:59 2026 -0700" }, "message": "idpf: Add null check patches\n\nBUG\u003db/469825621\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dNone\n\ncos-patch: bug\nSigned-off-by: Kevin Berry \u003ckpberry@google.com\u003e\nChange-Id: Ic81ff373b5d4ceafded1604f3b0c5538ba6627a4\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137221\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-by: Li Li \u003cboolli@google.com\u003e\n" }, { "commit": "4529d7ab34eba0548f4958e9e7e60410a437facb", "tree": "69819c8df3365f2fb70de881eedc5e195a4cbb95", "parents": [ "788077df45931035984615c9958e274d89bd7e1f" ], "author": { "name": "Yuan Tan", "email": "tanyuan98@outlook.com", "time": "Mon Mar 09 03:41:46 2026 -0700" }, "committer": { "name": "Dom Huh", "email": "domhuh@google.com", "time": "Mon Mar 23 10:50:04 2026 -0700" }, "message": "netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels\n\n[ Upstream commit 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf ]\n\nIDLETIMER revision 0 rules reuse existing timers by label and always call\nmod_timer() on timer-\u003etimer.\n\nIf the label was created first by revision 1 with XT_IDLETIMER_ALARM,\nthe object uses alarm timer semantics and timer-\u003etimer is never initialized.\nReusing that object from revision 0 causes mod_timer() on an uninitialized\ntimer_list, triggering debugobjects warnings and possible panic when\npanic_on_warn\u003d1.\n\nFix this by rejecting revision 0 rule insertion when an existing timer with\nthe same label is of ALARM type.\n\nBUG\u003db/494228396\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-329f0b9 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 68983a354a65 (\"netfilter: xtables: Add snapshot of hardidletimer target\")\nCo-developed-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nChange-Id: I8cde52413bc884b0d5fb8d40bb1a2a9fa7a73986\nSigned-off-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nCo-developed-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nSigned-off-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003ctanyuan98@outlook.com\u003e\nSigned-off-by: Xin Liu \u003cdstsmallbird@foxmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/139241\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\n" }, { "commit": "788077df45931035984615c9958e274d89bd7e1f", "tree": "61467cc79c286d0e97128e47b30b8d4d9f94d8f0", "parents": [ "8f01bd7cad431636ba9b859cd3fb0f169e55a58c" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Feb 24 13:29:09 2026 +0100" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Thu Mar 19 17:28:55 2026 -0700" }, "message": "perf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\n[ Upstream commit c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae ]\n\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\npossible callchains. Specifically the software events can end up running\nit with only preemption disabled.\n\nThis opens up a race vs perf_event_exit_event() and friends that will go\nand free various things the overflow path expects to be present, like\nthe BPF program.\n\nBUG\u003db/492076241\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-c9bc175 in the Linux kernel.\n\ncos-patch: security-high\nFixes: 592903cdcbf6 (\"perf_counter: add an event_list\")\nReported-by: Simond Hu \u003ccmdhh1767@gmail.com\u003e\nChange-Id: Ia7da9a567882708c419a94709ce599a537ab5cb1\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nTested-by: Simond Hu \u003ccmdhh1767@gmail.com\u003e\nLink: https://patch.msgid.link/20260224122909.GV1395416@noisy.programming.kicks-ass.net\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 5c48fdc4b4623533d86e279f51531a7ba212eb87)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/138781\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Dom Huh \u003cdomhuh@google.com\u003e\n" }, { "commit": "8f01bd7cad431636ba9b859cd3fb0f169e55a58c", "tree": "43025c6764203b83530e8728f017b3f916a2f65e", "parents": [ "ff6e7c064f96e867e26d16e4383100b430575e84" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Sun Mar 01 16:10:51 2026 -0800" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix race between freeing data and fs accessing it\n\ncommit 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 upstream.\n\nAppArmor was putting the reference to i_private data on its end after\nremoving the original entry from the file system. However the inode\ncan aand does live beyond that point and it is possible that some of\nthe fs call back functions will be invoked after the reference has\nbeen put, which results in a race between freeing the data and\naccessing it through the fs.\n\nWhile the rawdata/loaddata is the most likely candidate to fail the\nrace, as it has the fewest references. If properly crafted it might be\npossible to trigger a race for the other types stored in i_private.\n\nFix this by moving the put of i_private referenced data to the correct\nplace which is during inode eviction.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: c961ee5f21b20 (\"apparmor: convert from securityfs to apparmorfs for policy ns files\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Maxime Bélair \u003cmaxime.belair@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I609b901d5aee9aff6b28dc6b52eb1ca8e879eecd\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit eecce026399917f6efa532c56bc7a3e9dd6ee68b)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137851\nReviewed-by: He Gao \u003chegao@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "ff6e7c064f96e867e26d16e4383100b430575e84", "tree": "1583aae300e4b8fe1248948499e11f7b53b54507", "parents": [ "35f25e085d2437c644e09ea03c6710bbf711481f" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Tue Feb 24 10:20:02 2026 -0800" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix race on rawdata dereference\n\ncommit a0b7091c4de45a7325c8780e6934a894f92ac86b upstream.\n\nThere is a race condition that leads to a use-after-free situation:\nbecause the rawdata inodes are not refcounted, an attacker can start\nopen()ing one of the rawdata files, and at the same time remove the\nlast reference to this rawdata (by removing the corresponding profile,\nfor example), which frees its struct aa_loaddata; as a result, when\nseq_rawdata_open() is reached, i_private is a dangling pointer and\nfreed memory is accessed.\n\nThe rawdata inodes weren\u0027t refcounted to avoid a circular refcount and\nwere supposed to be held by the profile rawdata reference. However\nduring profile removal there is a window where the vfs and profile\ndestruction race, resulting in the use after free.\n\nFix this by moving to a double refcount scheme. Where the profile\nrefcount on rawdata is used to break the circular dependency. Allowing\nfor freeing of the rawdata once all inode references to the rawdata\nare put.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: 5d5182cae401 (\"apparmor: move to per loaddata files, instead of replicating in profiles\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Maxime Bélair \u003cmaxime.belair@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nChange-Id: I8077a29654c3997104d65154bbfeb040cca672d7\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit f9761add6d100962a23996cb68f3d6abdd4d1815)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137850\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n" }, { "commit": "35f25e085d2437c644e09ea03c6710bbf711481f", "tree": "171130d8f4d488a2c97492efb14216ed88e1dd31", "parents": [ "cb2a70cd852b6cbeb4386055554ddb62cfcec439" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri Oct 17 01:53:00 2025 -0700" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix differential encoding verification\n\ncommit 39440b137546a3aa383cfdabc605fb73811b6093 upstream.\n\nDifferential encoding allows loops to be created if it is abused. To\nprevent this the unpack should verify that a diff-encode chain\nterminates.\n\nUnfortunately the differential encode verification had two bugs.\n\n1. it conflated states that had gone through check and already been\n marked, with states that were currently being checked and marked.\n This means that loops in the current chain being verified are treated\n as a chain that has already been verified.\n\n2. the order bailout on already checked states compared current chain\n check iterators j,k instead of using the outer loop iterator i.\n Meaning a step backwards in states in the current chain verification\n was being mistaken for moving to an already verified state.\n\nMove to a double mark scheme where already verified states get a\ndifferent mark, than the current chain being kept. This enables us\nto also drop the backwards verification check that was the cause of\nthe second error as any already verified state is already marked.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: 031dcc8f4e84 (\"apparmor: dfa add support for state differential encoding\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I9dfaee7a1c4378889c09ea074a39ec4dd985e4fe\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 34fc60b125ed1d4eb002c76b0664bf0619492167)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137849\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n" }, { "commit": "cb2a70cd852b6cbeb4386055554ddb62cfcec439", "tree": "6ea8699f4b9820328fc9b6c45f25ce608e70a034", "parents": [ "390d86854b7dc65ae2b66e2566e60ba9f31974e4" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri Nov 07 08:36:04 2025 -0800" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix unprivileged local user can do privileged policy management\n\ncommit 6601e13e82841879406bf9f369032656f441a425 upstream.\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: b7fd2c0340eac (\"apparmor: add per policy ns .load, .replace, .remove interface files\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: Ibc8c76cf2669f2d670ded67a4b112403c2e2e51a\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 0fc63dd9170643d15c25681fca792539e23f4640)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137848\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n" }, { "commit": "390d86854b7dc65ae2b66e2566e60ba9f31974e4", "tree": "5df4ee5240c6dd4558e270e0e50c4599512dc0fe", "parents": [ "93eb4dfb07e3b52855af82b1fe54c7aeeea31cd2" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Wed Sep 10 06:22:17 2025 -0700" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: Fix double free of ns_name in aa_replace_profiles()\n\ncommit 5df0c44e8f5f619d3beb871207aded7c78414502 upstream.\n\nif ns_name is NULL after\n1071 error \u003d aa_unpack(udata, \u0026lh, \u0026ns_name);\n\nand if ent-\u003ens_name contains an ns_name in\n1089 } else if (ent-\u003ens_name) {\n\nthen ns_name is assigned the ent-\u003ens_name\n1095 ns_name \u003d ent-\u003ens_name;\n\nhowever ent-\u003ens_name is freed at\n1262 aa_load_ent_free(ent);\n\nand then again when freeing ns_name at\n1270 kfree(ns_name);\n\nFix this by NULLing out ent-\u003ens_name after it is transferred to ns_name\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: 145a0ef21c8e9 (\"apparmor: fix blob compression when ns is forced on a policy load\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I78eeec0a5a0ea22cf6a363dd806a9c273631dfff\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 86feeccd6b93ed94bd6655f30de80f163f8d5a45)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137847\nReviewed-by: He Gao \u003chegao@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "93eb4dfb07e3b52855af82b1fe54c7aeeea31cd2", "tree": "24f733211c32c6235be16bba15ea2f451b962b5b", "parents": [ "fcab2f1cb1a9bca288713b839bf3c6b9dae3792c" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 29 16:51:11 2026 +0100" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\ncommit d352873bbefa7eb39995239d0b44ccdf8aaa79a4 upstream.\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k \u003d DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u003e\u003d state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[ 57.179855] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 57.181563] Call Trace:\n[ 57.181572] \u003cTASK\u003e\n[ 57.181577] dump_stack_lvl+0x5e/0x80\n[ 57.181596] print_report+0xc8/0x270\n[ 57.181605] ? verify_dfa+0x59a/0x660\n[ 57.181608] kasan_report+0x118/0x150\n[ 57.181620] ? verify_dfa+0x59a/0x660\n[ 57.181623] verify_dfa+0x59a/0x660\n[ 57.181627] aa_dfa_unpack+0x1610/0x1740\n[ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470\n[ 57.181640] unpack_pdb+0x86d/0x46b0\n[ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181656] ? aa_unpack_nameX+0x1a8/0x300\n[ 57.181659] aa_unpack+0x20b0/0x4c30\n[ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181664] ? stack_depot_save_flags+0x33/0x700\n[ 57.181681] ? kasan_save_track+0x4f/0x80\n[ 57.181683] ? kasan_save_track+0x3e/0x80\n[ 57.181686] ? __kasan_kmalloc+0x93/0xb0\n[ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130\n[ 57.181697] ? policy_update+0x154/0x330\n[ 57.181704] aa_replace_profiles+0x15a/0x1dd0\n[ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181712] ? aa_loaddata_alloc+0x77/0x140\n[ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181717] ? _copy_from_user+0x2a/0x70\n[ 57.181730] policy_update+0x17a/0x330\n[ 57.181733] profile_replace+0x153/0x1a0\n[ 57.181735] ? rw_verify_area+0x93/0x2d0\n[ 57.181740] vfs_write+0x235/0xab0\n[ 57.181745] ksys_write+0xb0/0x170\n[ 57.181748] do_syscall_64+0x8e/0x660\n[ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: 031dcc8f4e84 (\"apparmor: dfa add support for state differential encoding\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I47b1cf919dbd347eccb1d4cfa43518e1b2756ba2\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 76b4d36c5122866452d34d8f79985e191f9c3831)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137846\nReviewed-by: He Gao \u003chegao@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "fcab2f1cb1a9bca288713b839bf3c6b9dae3792c", "tree": "25a4821656a23c75665dc0ca8693bbb7e367c04e", "parents": [ "66c406ba2d8839ac937474f82f71485499647d7e" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 29 17:08:25 2026 +0100" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix side-effect bug in match_char() macro usage\n\ncommit 8756b68edae37ff546c02091989a4ceab3f20abd upstream.\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[ 94.984676] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 94.986329] Call Trace:\n[ 94.986341] \u003cTASK\u003e\n[ 94.986347] dump_stack_lvl+0x5e/0x80\n[ 94.986374] print_report+0xc8/0x270\n[ 94.986384] ? aa_dfa_match+0x5ae/0x760\n[ 94.986388] kasan_report+0x118/0x150\n[ 94.986401] ? aa_dfa_match+0x5ae/0x760\n[ 94.986405] aa_dfa_match+0x5ae/0x760\n[ 94.986408] __aa_path_perm+0x131/0x400\n[ 94.986418] aa_path_perm+0x219/0x2f0\n[ 94.986424] apparmor_file_open+0x345/0x570\n[ 94.986431] security_file_open+0x5c/0x140\n[ 94.986442] do_dentry_open+0x2f6/0x1120\n[ 94.986450] vfs_open+0x38/0x2b0\n[ 94.986453] ? may_open+0x1e2/0x2b0\n[ 94.986466] path_openat+0x231b/0x2b30\n[ 94.986469] ? __x64_sys_openat+0xf8/0x130\n[ 94.986477] do_file_open+0x19d/0x360\n[ 94.986487] do_sys_openat2+0x98/0x100\n[ 94.986491] __x64_sys_openat+0xf8/0x130\n[ 94.986499] do_syscall_64+0x8e/0x660\n[ 94.986515] ? count_memcg_events+0x15f/0x3c0\n[ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986540] ? handle_mm_fault+0x1639/0x1ef0\n[ 94.986551] ? vma_start_read+0xf0/0x320\n[ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0\n[ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986588] ? irqentry_exit+0x3c/0x590\n[ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: 074c1cd798cb (\"apparmor: dfa move character match into a macro\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I416e337bf138695b540509096ce0a6b6dbf27a15\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit b73c1dff8a9d7eeaebabf8097a5b2de192f40913)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137845\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n" }, { "commit": "66c406ba2d8839ac937474f82f71485499647d7e", "tree": "263ad3c0386773417044c56be236c5648b997238", "parents": [ "63381b42e4b0ae36bce19ae09b9f5db33bab0387" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Tue Mar 03 11:08:02 2026 -0800" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix: limit the number of levels of policy namespaces\n\ncommit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.\n\nCurrently the number of policy namespaces is not bounded relying on\nthe user namespace limit. However policy namespaces aren\u0027t strictly\ntied to user namespaces and it is possible to create them and nest\nthem arbitrarily deep which can be used to exhaust system resource.\n\nHard cap policy namespaces to the same depth as user namespaces.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: c88d4c7b049e8 (\"AppArmor: core policy routines\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Ryan Lee \u003cryan.lee@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I04ef058ea898a5e00440a3f11bfda0325d29423e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 853ce31ca72097d23991a06876a2ccb5cb64b603)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137844\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n" }, { "commit": "63381b42e4b0ae36bce19ae09b9f5db33bab0387", "tree": "3fae69b2cc6360f60d7b3d837b1ce63d09c350e7", "parents": [ "ac989c5f0a2bac71c142be4c001a14684195c0bb" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Tue Jan 13 09:09:43 2026 +0100" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: replace recursive profile removal with iterative approach\n\ncommit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream.\n\nThe profile removal code uses recursion when removing nested profiles,\nwhich can lead to kernel stack exhaustion and system crashes.\n\nReproducer:\n $ pf\u003d\u0027a\u0027; for ((i\u003d0; i\u003c1024; i++)); do\n echo -e \"profile $pf { \\n }\" | apparmor_parser -K -a;\n pf\u003d\"$pf//x\";\n done\n $ echo -n a \u003e /sys/kernel/security/apparmor/.remove\n\nReplace the recursive __aa_profile_list_release() approach with an\niterative approach in __remove_profile(). The function repeatedly\nfinds and removes leaf profiles until the entire subtree is removed,\nmaintaining the same removal semantic without recursion.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: c88d4c7b049e (\"AppArmor: core policy routines\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I3571b963b19c0b3623f96bde816d66e7bc4732d7\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 999bd704b0b641527a5ed46f0d969deff8cfa68b)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137843\nReviewed-by: He Gao \u003chegao@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "ac989c5f0a2bac71c142be4c001a14684195c0bb", "tree": "2ed67e1082a872c399653963a9cd43ff62faa984", "parents": [ "70d7e379f56b5c17fdec2c93942b9392ac36b19a" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Tue Jan 20 15:24:04 2026 +0100" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: fix memory leak in verify_header\n\ncommit e38c55d9f834e5b848bfed0f5c586aaf45acb825 upstream.\n\nThe function sets `*ns \u003d NULL` on every call, leaking the namespace\nstring allocated in previous iterations when multiple profiles are\nunpacked. This also breaks namespace consistency checking since *ns\nis always NULL when the comparison is made.\n\nRemove the incorrect assignment.\nThe caller (aa_unpack) initializes *ns to NULL once before the loop,\nwhich is sufficient.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: dd51c8485763 (\"apparmor: provide base for multiple profiles to be replaced at once\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I9abac5156dafbf9f8930cbb3617b9a54503e531b\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 786e2c2a87d9c505f33321d1fd23a176aa8ddeb1)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137842\nReviewed-by: He Gao \u003chegao@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n" }, { "commit": "70d7e379f56b5c17fdec2c93942b9392ac36b19a", "tree": "72a83065afd910ccdb640ff748b8ccbd35b65144", "parents": [ "75a018b19010df0c745c1908e75920ac6b9a840d" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 15 15:30:50 2026 +0100" }, "committer": { "name": "Robert Kolchmeyer", "email": "rkolchmeyer@google.com", "time": "Fri Mar 13 13:34:30 2026 -0700" }, "message": "apparmor: validate DFA start states are in bounds in unpack_pdb\n\ncommit 9063d7e2615f4a7ab321de6b520e23d370e58816 upstream.\n\nStart states are read from untrusted data and used as indexes into the\nDFA state tables. The aa_dfa_next() function call in unpack_pdb() will\naccess dfa-\u003etables[YYTD_ID_BASE][start], and if the start state exceeds\nthe number of states in the DFA, this results in an out-of-bound read.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360\n Read of size 4 at addr ffff88811956fb90 by task su/1097\n ...\n\nReject policies with out-of-bounds start states during unpacking\nto prevent the issue.\n\nBUG\u003dNone\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed the \"CrackArmor\" vulnerability in the Linux kernel.\n\ncos-patch: security-high\nFixes: ad5ff3db53c6 (\"AppArmor: Add ability to load extended policy\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nChange-Id: I498fc9c79fcc3f304e717059dced3d4ac5cf9f5c\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/137841\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: He Gao \u003chegao@google.com\u003e\n" }, { "commit": "6f232446a62980e51f537db1c655e686d869b9ed", "tree": "c3928b3ac556e6dac291c98cbc52251957031115", "parents": [ "1ba82a3bbc09822ecd143885dbb0236e073adc08" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:49 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:49 2026 +0100" }, "message": "Linux 6.12.77\n\nLink: https://lore.kernel.org/r/20260312201018.128816016@linuxfoundation.org\nTested-by: Brett A C Sheffield \u003cbacs@librecast.net\u003e\nTested-by: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nTested-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1ba82a3bbc09822ecd143885dbb0236e073adc08", "tree": "645917b8df9fa8e5f70e2c714b01a8bdd891ba09", "parents": [ "0d12453818c35e1ded84633152c6b05002ae48b9" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Mar 05 18:48:05 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:49 2026 +0100" }, "message": "ata: libata-eh: Fix detection of deferred qc timeouts\n\ncommit ee0e6e69a772d601e152e5368a1da25d656122a8 upstream.\n\nIf the ata_qc_for_each_raw() loop finishes without finding a matching SCSI\ncommand for any QC, the variable qc will hold a pointer to the last element\nexamined, which has the tag i \u003d\u003d ATA_MAX_QUEUE - 1. This qc can match the\nport deferred QC (ap-\u003edeferred_qc).\n\nIf that happens, the condition qc \u003d\u003d ap-\u003edeferred_qc evaluates to true\ndespite the loop not breaking with a match on the SCSI command for this QC.\nIn that case, the error handler mistakenly intercepts a command that has\nnot been issued yet and that has not timed out, and thus erroneously\nreturning a timeout error.\n\nFix the problem by checking for i \u003c ATA_MAX_QUEUE in addition to\nqc \u003d\u003d ap-\u003edeferred_qc.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y.\n\nAssisted-by: Gemini:gemini-3.1-pro\nFixes: eddb98ad9364 (\"ata: libata-eh: correctly handle deferred qc timeouts\")\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n[cassel: modified commit log as suggested by Damien]\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0d12453818c35e1ded84633152c6b05002ae48b9", "tree": "93a665868719b2dffdbc5ba8eb0de7469e1c622d", "parents": [ "d2459cba1d9977af5e09efbe2f3379b03966d367" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Mar 03 11:03:42 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:49 2026 +0100" }, "message": "ata: libata: cancel pending work after clearing deferred_qc\n\ncommit aac9b27f7c1f2b2cf7f50a9ca633ecbbcaf22af9 upstream.\n\nSyzbot reported a WARN_ON() in ata_scsi_deferred_qc_work(), caused by\nap-\u003eops-\u003eqc_defer() returning non-zero before issuing the deferred qc.\n\nata_scsi_schedule_deferred_qc() is called during each command completion.\nThis function will check if there is a deferred QC, and if\nap-\u003eops-\u003eqc_defer() returns zero, meaning that it is possible to queue the\ndeferred qc at this time (without being deferred), then it will queue the\nwork which will issue the deferred qc.\n\nOnce the work get to run, which can potentially be a very long time after\nthe work was scheduled, there is a WARN_ON() if ap-\u003eops-\u003eqc_defer() returns\nnon-zero.\n\nWhile we hold the ap-\u003elock both when assigning and clearing deferred_qc,\nand the work itself holds the ap-\u003elock, the code currently does not cancel\nthe work after clearing the deferred qc.\n\nThis means that the following scenario can happen:\n1) One or several NCQ commands are queued.\n2) A non-NCQ command is queued, gets stored in ap-\u003edeferred_qc.\n3) Last NCQ command gets completed, work is queued to issue the deferred\n qc.\n4) Timeout or error happens, ap-\u003edeferred_qc is cleared. The queued work is\n currently NOT canceled.\n5) Port is reset.\n6) One or several NCQ commands are queued.\n7) A non-NCQ command is queued, gets stored in ap-\u003edeferred_qc.\n8) Work is finally run. Yet at this time, there is still NCQ commands in\n flight.\n\nThe work in 8) really belongs to the non-NCQ command in 2), not to the\nnon-NCQ command in 7). The reason why the work is executed when it is not\nsupposed to, is because it was never canceled when ap-\u003edeferred_qc was\ncleared in 4). Thus, ensure that we always cancel the work after clearing\nap-\u003edeferred_qc.\n\nAnother potential fix would have been to let ata_scsi_deferred_qc_work() do\nnothing if ap-\u003eops-\u003eqc_defer() returns non-zero. However, canceling the\nwork when clearing ap-\u003edeferred_qc seems slightly more logical, as we hold\nthe ap-\u003elock when clearing ap-\u003edeferred_qc, so we know that the work cannot\nbe holding the lock. (The function could be waiting for the lock, but that\nis okay since it will do nothing if ap-\u003edeferred_qc is not set.)\n\nReported-by: syzbot+bcaf842a1e8ead8dfb89@syzkaller.appspotmail.com\nFixes: 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\")\nFixes: eddb98ad9364 (\"ata: libata-eh: correctly handle deferred qc timeouts\")\nReviewed-by: Igor Pylypiv \u003cipylypiv@google.com\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d2459cba1d9977af5e09efbe2f3379b03966d367", "tree": "568235be3078bc521c5412d92a104091f275bc50", "parents": [ "42ea6c476b2739c9acdf7120bd2d6ef9d0d78456" ], "author": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri Feb 20 13:43:00 2026 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:49 2026 +0100" }, "message": "ata: libata-eh: correctly handle deferred qc timeouts\n\ncommit eddb98ad9364b4e778768785d46cfab04ce52100 upstream.\n\nA deferred qc may timeout while waiting for the device queue to drain\nto be submitted. In such case, since the qc is not active,\nata_scsi_cmd_error_handler() ends up calling scsi_eh_finish_cmd(),\nwhich frees the qc. But as the port deferred_qc field still references\nthis finished/freed qc, the deferred qc work may eventually attempt to\ncall ata_qc_issue() against this invalid qc, leading to errors such as\nreported by UBSAN (syzbot run):\n\nUBSAN: shift-out-of-bounds in drivers/ata/libata-core.c:5166:24\nshift exponent 4210818301 is too large for 64-bit type \u0027long long unsigned int\u0027\n...\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\n ubsan_epilogue+0xa/0x30 lib/ubsan.c:233\n __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494\n ata_qc_issue.cold+0x38/0x9f drivers/ata/libata-core.c:5166\n ata_scsi_deferred_qc_work+0x154/0x1f0 drivers/ata/libata-scsi.c:1679\n process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275\n process_scheduled_works kernel/workqueue.c:3358 [inline]\n worker_thread+0x5da/0xe40 kernel/workqueue.c:3439\n kthread+0x370/0x450 kernel/kthread.c:467\n ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nFix this by checking if the qc of a timed out SCSI command is a deferred\none, and in such case, clear the port deferred_qc field and finish the\nSCSI command with DID_TIME_OUT.\n\nReported-by: syzbot+1f77b8ca15336fff21ff@syzkaller.appspotmail.com\nFixes: 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\")\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Hannes Reinecke \u003chare@suse.de\u003e\nReviewed-by: Igor Pylypiv \u003cipylypiv@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "42ea6c476b2739c9acdf7120bd2d6ef9d0d78456", "tree": "1f2edff707556e129562a6b6683d81177f25e82b", "parents": [ "08d9175578d6a8e9b81921898fbf01aa669cd2be" ], "author": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri Feb 20 12:09:12 2026 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:49 2026 +0100" }, "message": "ata: libata-core: fix cancellation of a port deferred qc work\n\ncommit 55db009926634b20955bd8abbee921adbc8d2cb4 upstream.\n\ncancel_work_sync() is a sleeping function so it cannot be called with\nthe spin lock of a port being held. Move the call to this function in\nata_port_detach() after EH completes, with the port lock released,\ntogether with other work cancellation calls.\n\nFixes: 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\")\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Hannes Reinecke \u003chare@suse.de\u003e\nReviewed-by: Igor Pylypiv \u003cipylypiv@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "08d9175578d6a8e9b81921898fbf01aa669cd2be", "tree": "c274e454ad21f73f8fa5fe7f0b0c8da7f43ac7ab", "parents": [ "eecce026399917f6efa532c56bc7a3e9dd6ee68b" ], "author": { "name": "Baokun Li", "email": "libaokun1@huawei.com", "time": "Mon Aug 25 11:38:30 2025 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "ext4: fix potential null deref in ext4_mb_init()\n\ncommit 3c3fac6bc0a9c00dbe65d8dc0d3a282afe4d3188 upstream.\n\nIn ext4_mb_init(), ext4_mb_avg_fragment_size_destroy() may be called\nwhen sbi-\u003es_mb_avg_fragment_size remains uninitialized (e.g., if groupinfo\nslab cache allocation fails). Since ext4_mb_avg_fragment_size_destroy()\nlacks null pointer checking, this leads to a null pointer dereference.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nEXT4-fs: no memory for groupinfo slab cache\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0002 [#1] SMP PTI\nCPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none)\nRIP: 0010:_raw_spin_lock_irqsave+0x1b/0x40\nCall Trace:\n \u003cTASK\u003e\n xa_destroy+0x61/0x130\n ext4_mb_init+0x483/0x540\n __ext4_fill_super+0x116d/0x17b0\n ext4_fill_super+0xd3/0x280\n get_tree_bdev_flags+0x132/0x1d0\n vfs_get_tree+0x29/0xd0\n do_new_mount+0x197/0x300\n __x64_sys_mount+0x116/0x150\n do_syscall_64+0x50/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nTherefore, add necessary null check to ext4_mb_avg_fragment_size_destroy()\nto prevent this issue. The same fix is also applied to\next4_mb_largest_free_orders_destroy().\n\nReported-by: syzbot+1713b1aa266195b916c2@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d1713b1aa266195b916c2\nCc: stable@kernel.org\nFixes: f7eaacbb4e54 (\"ext4: convert free groups order lists to xarrays\")\nSigned-off-by: Baokun Li \u003clibaokun1@huawei.com\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nReviewed-by: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "eecce026399917f6efa532c56bc7a3e9dd6ee68b", "tree": "2a9cb5d0b7eb54a360bd65dcdc3158f97ce81243", "parents": [ "f9761add6d100962a23996cb68f3d6abdd4d1815" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Sun Mar 01 16:10:51 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "apparmor: fix race between freeing data and fs accessing it\n\ncommit 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 upstream.\n\nAppArmor was putting the reference to i_private data on its end after\nremoving the original entry from the file system. However the inode\ncan aand does live beyond that point and it is possible that some of\nthe fs call back functions will be invoked after the reference has\nbeen put, which results in a race between freeing the data and\naccessing it through the fs.\n\nWhile the rawdata/loaddata is the most likely candidate to fail the\nrace, as it has the fewest references. If properly crafted it might be\npossible to trigger a race for the other types stored in i_private.\n\nFix this by moving the put of i_private referenced data to the correct\nplace which is during inode eviction.\n\nFixes: c961ee5f21b20 (\"apparmor: convert from securityfs to apparmorfs for policy ns files\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Maxime Bélair \u003cmaxime.belair@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f9761add6d100962a23996cb68f3d6abdd4d1815", "tree": "2e20c4c0540aac948b0f54e312eb2e9c7450a514", "parents": [ "34fc60b125ed1d4eb002c76b0664bf0619492167" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Tue Feb 24 10:20:02 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "apparmor: fix race on rawdata dereference\n\ncommit a0b7091c4de45a7325c8780e6934a894f92ac86b upstream.\n\nThere is a race condition that leads to a use-after-free situation:\nbecause the rawdata inodes are not refcounted, an attacker can start\nopen()ing one of the rawdata files, and at the same time remove the\nlast reference to this rawdata (by removing the corresponding profile,\nfor example), which frees its struct aa_loaddata; as a result, when\nseq_rawdata_open() is reached, i_private is a dangling pointer and\nfreed memory is accessed.\n\nThe rawdata inodes weren\u0027t refcounted to avoid a circular refcount and\nwere supposed to be held by the profile rawdata reference. However\nduring profile removal there is a window where the vfs and profile\ndestruction race, resulting in the use after free.\n\nFix this by moving to a double refcount scheme. Where the profile\nrefcount on rawdata is used to break the circular dependency. Allowing\nfor freeing of the rawdata once all inode references to the rawdata\nare put.\n\nFixes: 5d5182cae401 (\"apparmor: move to per loaddata files, instead of replicating in profiles\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Maxime Bélair \u003cmaxime.belair@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "34fc60b125ed1d4eb002c76b0664bf0619492167", "tree": "814d950f810981569e05b86507fd8df4f43c318c", "parents": [ "0fc63dd9170643d15c25681fca792539e23f4640" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri Oct 17 01:53:00 2025 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "apparmor: fix differential encoding verification\n\ncommit 39440b137546a3aa383cfdabc605fb73811b6093 upstream.\n\nDifferential encoding allows loops to be created if it is abused. To\nprevent this the unpack should verify that a diff-encode chain\nterminates.\n\nUnfortunately the differential encode verification had two bugs.\n\n1. it conflated states that had gone through check and already been\n marked, with states that were currently being checked and marked.\n This means that loops in the current chain being verified are treated\n as a chain that has already been verified.\n\n2. the order bailout on already checked states compared current chain\n check iterators j,k instead of using the outer loop iterator i.\n Meaning a step backwards in states in the current chain verification\n was being mistaken for moving to an already verified state.\n\nMove to a double mark scheme where already verified states get a\ndifferent mark, than the current chain being kept. This enables us\nto also drop the backwards verification check that was the cause of\nthe second error as any already verified state is already marked.\n\nFixes: 031dcc8f4e84 (\"apparmor: dfa add support for state differential encoding\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0fc63dd9170643d15c25681fca792539e23f4640", "tree": "3b76c817ed0f0c54d831828d8ccb085ed76d4ae0", "parents": [ "86feeccd6b93ed94bd6655f30de80f163f8d5a45" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri Nov 07 08:36:04 2025 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "apparmor: fix unprivileged local user can do privileged policy management\n\ncommit 6601e13e82841879406bf9f369032656f441a425 upstream.\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.\n\nFixes: b7fd2c0340eac (\"apparmor: add per policy ns .load, .replace, .remove interface files\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "86feeccd6b93ed94bd6655f30de80f163f8d5a45", "tree": "e1b9bc5cbc674f113dfa482212e82fcfdfb7b38e", "parents": [ "76b4d36c5122866452d34d8f79985e191f9c3831" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Wed Sep 10 06:22:17 2025 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "apparmor: Fix double free of ns_name in aa_replace_profiles()\n\ncommit 5df0c44e8f5f619d3beb871207aded7c78414502 upstream.\n\nif ns_name is NULL after\n1071 error \u003d aa_unpack(udata, \u0026lh, \u0026ns_name);\n\nand if ent-\u003ens_name contains an ns_name in\n1089 } else if (ent-\u003ens_name) {\n\nthen ns_name is assigned the ent-\u003ens_name\n1095 ns_name \u003d ent-\u003ens_name;\n\nhowever ent-\u003ens_name is freed at\n1262 aa_load_ent_free(ent);\n\nand then again when freeing ns_name at\n1270 kfree(ns_name);\n\nFix this by NULLing out ent-\u003ens_name after it is transferred to ns_name\n\nFixes: 145a0ef21c8e9 (\"apparmor: fix blob compression when ns is forced on a policy load\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "76b4d36c5122866452d34d8f79985e191f9c3831", "tree": "0d698db42a8738d36a0782f382b1eb3f42e9f0e9", "parents": [ "b73c1dff8a9d7eeaebabf8097a5b2de192f40913" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 29 16:51:11 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "apparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\ncommit d352873bbefa7eb39995239d0b44ccdf8aaa79a4 upstream.\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k \u003d DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u003e\u003d state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[ 57.179855] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 57.181563] Call Trace:\n[ 57.181572] \u003cTASK\u003e\n[ 57.181577] dump_stack_lvl+0x5e/0x80\n[ 57.181596] print_report+0xc8/0x270\n[ 57.181605] ? verify_dfa+0x59a/0x660\n[ 57.181608] kasan_report+0x118/0x150\n[ 57.181620] ? verify_dfa+0x59a/0x660\n[ 57.181623] verify_dfa+0x59a/0x660\n[ 57.181627] aa_dfa_unpack+0x1610/0x1740\n[ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470\n[ 57.181640] unpack_pdb+0x86d/0x46b0\n[ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181656] ? aa_unpack_nameX+0x1a8/0x300\n[ 57.181659] aa_unpack+0x20b0/0x4c30\n[ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181664] ? stack_depot_save_flags+0x33/0x700\n[ 57.181681] ? kasan_save_track+0x4f/0x80\n[ 57.181683] ? kasan_save_track+0x3e/0x80\n[ 57.181686] ? __kasan_kmalloc+0x93/0xb0\n[ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130\n[ 57.181697] ? policy_update+0x154/0x330\n[ 57.181704] aa_replace_profiles+0x15a/0x1dd0\n[ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181712] ? aa_loaddata_alloc+0x77/0x140\n[ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181717] ? _copy_from_user+0x2a/0x70\n[ 57.181730] policy_update+0x17a/0x330\n[ 57.181733] profile_replace+0x153/0x1a0\n[ 57.181735] ? rw_verify_area+0x93/0x2d0\n[ 57.181740] vfs_write+0x235/0xab0\n[ 57.181745] ksys_write+0xb0/0x170\n[ 57.181748] do_syscall_64+0x8e/0x660\n[ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally.\n\nFixes: 031dcc8f4e84 (\"apparmor: dfa add support for state differential encoding\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b73c1dff8a9d7eeaebabf8097a5b2de192f40913", "tree": "a2c8cc0efed616c5cfabb4ed795f8ffb9a6ee6de", "parents": [ "853ce31ca72097d23991a06876a2ccb5cb64b603" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 29 17:08:25 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:48 2026 +0100" }, "message": "apparmor: fix side-effect bug in match_char() macro usage\n\ncommit 8756b68edae37ff546c02091989a4ceab3f20abd upstream.\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[ 94.984676] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 94.986329] Call Trace:\n[ 94.986341] \u003cTASK\u003e\n[ 94.986347] dump_stack_lvl+0x5e/0x80\n[ 94.986374] print_report+0xc8/0x270\n[ 94.986384] ? aa_dfa_match+0x5ae/0x760\n[ 94.986388] kasan_report+0x118/0x150\n[ 94.986401] ? aa_dfa_match+0x5ae/0x760\n[ 94.986405] aa_dfa_match+0x5ae/0x760\n[ 94.986408] __aa_path_perm+0x131/0x400\n[ 94.986418] aa_path_perm+0x219/0x2f0\n[ 94.986424] apparmor_file_open+0x345/0x570\n[ 94.986431] security_file_open+0x5c/0x140\n[ 94.986442] do_dentry_open+0x2f6/0x1120\n[ 94.986450] vfs_open+0x38/0x2b0\n[ 94.986453] ? may_open+0x1e2/0x2b0\n[ 94.986466] path_openat+0x231b/0x2b30\n[ 94.986469] ? __x64_sys_openat+0xf8/0x130\n[ 94.986477] do_file_open+0x19d/0x360\n[ 94.986487] do_sys_openat2+0x98/0x100\n[ 94.986491] __x64_sys_openat+0xf8/0x130\n[ 94.986499] do_syscall_64+0x8e/0x660\n[ 94.986515] ? count_memcg_events+0x15f/0x3c0\n[ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986540] ? handle_mm_fault+0x1639/0x1ef0\n[ 94.986551] ? vma_start_read+0xf0/0x320\n[ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0\n[ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986588] ? irqentry_exit+0x3c/0x590\n[ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop.\n\nFixes: 074c1cd798cb (\"apparmor: dfa move character match into a macro\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "853ce31ca72097d23991a06876a2ccb5cb64b603", "tree": "0f80f4f3589592670117e8d181491aa247dbb60f", "parents": [ "999bd704b0b641527a5ed46f0d969deff8cfa68b" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Tue Mar 03 11:08:02 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "apparmor: fix: limit the number of levels of policy namespaces\n\ncommit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.\n\nCurrently the number of policy namespaces is not bounded relying on\nthe user namespace limit. However policy namespaces aren\u0027t strictly\ntied to user namespaces and it is possible to create them and nest\nthem arbitrarily deep which can be used to exhaust system resource.\n\nHard cap policy namespaces to the same depth as user namespaces.\n\nFixes: c88d4c7b049e8 (\"AppArmor: core policy routines\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Ryan Lee \u003cryan.lee@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "999bd704b0b641527a5ed46f0d969deff8cfa68b", "tree": "96abf10c800fb52262b623f2967756c8617072cc", "parents": [ "786e2c2a87d9c505f33321d1fd23a176aa8ddeb1" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Tue Jan 13 09:09:43 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "apparmor: replace recursive profile removal with iterative approach\n\ncommit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream.\n\nThe profile removal code uses recursion when removing nested profiles,\nwhich can lead to kernel stack exhaustion and system crashes.\n\nReproducer:\n $ pf\u003d\u0027a\u0027; for ((i\u003d0; i\u003c1024; i++)); do\n echo -e \"profile $pf { \\n }\" | apparmor_parser -K -a;\n pf\u003d\"$pf//x\";\n done\n $ echo -n a \u003e /sys/kernel/security/apparmor/.remove\n\nReplace the recursive __aa_profile_list_release() approach with an\niterative approach in __remove_profile(). The function repeatedly\nfinds and removes leaf profiles until the entire subtree is removed,\nmaintaining the same removal semantic without recursion.\n\nFixes: c88d4c7b049e (\"AppArmor: core policy routines\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "786e2c2a87d9c505f33321d1fd23a176aa8ddeb1", "tree": "e3a22be90bbce88b4f23e884946a652302535225", "parents": [ "15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Tue Jan 20 15:24:04 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "apparmor: fix memory leak in verify_header\n\ncommit e38c55d9f834e5b848bfed0f5c586aaf45acb825 upstream.\n\nThe function sets `*ns \u003d NULL` on every call, leaking the namespace\nstring allocated in previous iterations when multiple profiles are\nunpacked. This also breaks namespace consistency checking since *ns\nis always NULL when the comparison is made.\n\nRemove the incorrect assignment.\nThe caller (aa_unpack) initializes *ns to NULL once before the loop,\nwhich is sufficient.\n\nFixes: dd51c8485763 (\"apparmor: provide base for multiple profiles to be replaced at once\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "15c3eb8916e7db01cb246d04a1fe6f0fdc065b0c", "tree": "bec82cc906d9cba6f41b45880466f627e27b801a", "parents": [ "524ce8b4ea8f64900b6c52b6a28df74f6bc0801e" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 15 15:30:50 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "apparmor: validate DFA start states are in bounds in unpack_pdb\n\ncommit 9063d7e2615f4a7ab321de6b520e23d370e58816 upstream.\n\nStart states are read from untrusted data and used as indexes into the\nDFA state tables. The aa_dfa_next() function call in unpack_pdb() will\naccess dfa-\u003etables[YYTD_ID_BASE][start], and if the start state exceeds\nthe number of states in the DFA, this results in an out-of-bound read.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360\n Read of size 4 at addr ffff88811956fb90 by task su/1097\n ...\n\nReject policies with out-of-bounds start states during unpacking\nto prevent the issue.\n\nFixes: ad5ff3db53c6 (\"AppArmor: Add ability to load extended policy\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "524ce8b4ea8f64900b6c52b6a28df74f6bc0801e", "tree": "852ff24ad78b4067c43f14ae6f86b0fced899acd", "parents": [ "42b380f97d65e76e7b310facd525f730272daf57" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Wed Feb 25 10:43:48 2026 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\n\ncommit 11cb63b0d1a0685e0831ae3c77223e002ef18189 upstream.\n\nAs Paolo said earlier [1]:\n\n\"Since the blamed commit below, classify can return TC_ACT_CONSUMED while\nthe current skb being held by the defragmentation engine. As reported by\nGangMin Kim, if such packet is that may cause a UaF when the defrag engine\nlater on tries to tuch again such packet.\"\n\nact_ct was never meant to be used in the egress path, however some users\nare attaching it to egress today [2]. Attempting to reach a middle\nground, we noticed that, while most qdiscs are not handling\nTC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we\naddress the issue by only allowing act_ct to bind to clsact/ingress\nqdiscs and shared blocks. That way it\u0027s still possible to attach act_ct to\negress (albeit only with clsact).\n\n[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/\n[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/\n\nReported-by: GangMin Kim \u003ckm.kim1503@gmail.com\u003e\nFixes: 3f14b377d01d (\"net/sched: act_ct: fix skb leak and crash on ooo frags\")\nCC: stable@vger.kernel.org\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260225134349.1287037-1-victor@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "42b380f97d65e76e7b310facd525f730272daf57", "tree": "5c2c466b0d3e50aad998154026c11126d31b73fd", "parents": [ "1cf22986da18fb14d884f90aaf0aada5fbc86d8e" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Mar 05 11:33:39 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "tracing: Add NULL pointer check to trigger_data_free()\n\n[ Upstream commit 457965c13f0837a289c9164b842d0860133f6274 ]\n\nIf trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()\njumps to the out_free error path. While kfree() safely handles a NULL\npointer, trigger_data_free() does not. This causes a NULL pointer\ndereference in trigger_data_free() when evaluating\ndata-\u003ecmd_ops-\u003eset_filter.\n\nFix the problem by adding a NULL pointer check to trigger_data_free().\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y.\n\nCc: Miaoqian Lin \u003clinmq006@gmail.com\u003e\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nLink: https://patch.msgid.link/20260305193339.2810953-1-linux@roeck-us.net\nFixes: 0550069cc25f (\"tracing: Properly process error handling in event_hist_trigger_parse()\")\nAssisted-by: Gemini:gemini-3.1-pro\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "1cf22986da18fb14d884f90aaf0aada5fbc86d8e", "tree": "7569c136bdf35c684bbc4a2e3693c755620dfbf6", "parents": [ "c7c790a07697148c41e2d03eb28efe132adda749" ], "author": { "name": "Yifan Wu", "email": "wuyifan50@huawei.com", "time": "Thu Mar 05 09:36:37 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "selftest/arm64: Fix sve2p1_sigill() to hwcap test\n\n[ Upstream commit d87c828daa7ead9763416f75cc416496969cf1dc ]\n\nThe FEAT_SVE2p1 is indicated by ID_AA64ZFR0_EL1.SVEver. However,\nthe BFADD requires the FEAT_SVE_B16B16, which is indicated by\nID_AA64ZFR0_EL1.B16B16. This could cause the test to incorrectly\nfail on a CPU that supports FEAT_SVE2.1 but not FEAT_SVE_B16B16.\n\nLD1Q Gather load quadwords which is decoded from SVE encodings and\nimplied by FEAT_SVE2p1.\n\nFixes: c5195b027d29 (\"kselftest/arm64: Add SVE 2.1 to hwcap test\")\nSigned-off-by: Yifan Wu \u003cwuyifan50@huawei.com\u003e\nReviewed-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "c7c790a07697148c41e2d03eb28efe132adda749", "tree": "db89fe88cc88d582ae76d2f400ed4fdad39155c5", "parents": [ "581e209d1ff01da4c2c4586f0c885d32b91496e0" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:50 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:47 2026 +0100" }, "message": "xdp: produce a warning when calculated tailroom is negative\n\n[ Upstream commit 8821e857759be9db3cde337ad328b71fe5c8a55f ]\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver\u0027s XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case, but due\nto tailroom being stored as an unsigned int, it is reported to be somewhere\nnear UINT_MAX, resulting in a tail being grown, even if the requested\noffset is too much (it is around 2K in the abovementioned test). This later\nleads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/0x6b0\n[ 7340.430672] ? __do_sys_clone3+0xd9/0x120\n[ 7340.431212] ? switch_fpu_return+0x4e/0xd0\n[ 7340.431761] ? arch_exit_to_user_mode_prepare.isra.0+0xa1/0xc0\n[ 7340.432498] ? do_syscall_64+0xbb/0x6b0\n[ 7340.433015] ? __handle_mm_fault+0x445/0x690\n[ 7340.433582] ? count_memcg_events+0xd6/0x210\n[ 7340.434151] ? handle_mm_fault+0x212/0x340\n[ 7340.434697] ? do_user_addr_fault+0x2b4/0x7b0\n[ 7340.435271] ? clear_bhb_loop+0x30/0x80\n[ 7340.435788] ? clear_bhb_loop+0x30/0x80\n[ 7340.436299] ? clear_bhb_loop+0x30/0x80\n[ 7340.436812] ? clear_bhb_loop+0x30/0x80\n[ 7340.437323] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 7340.437973] RIP: 0033:0x7f4161b14169\n[ 7340.438468] Code: Unable to access opcode bytes at 0x7f4161b1413f.\n[ 7340.439242] RSP: 002b:00007ffc6ebfa770 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca\n[ 7340.440173] RAX: fffffffffffffe00 RBX: 00000000000005a1 RCX: 00007f4161b14169\n[ 7340.441061] RDX: 00000000000005a1 RSI: 0000000000000109 RDI: 00007f415bfff990\n[ 7340.441943] RBP: 00007ffc6ebfa7a0 R08: 0000000000000000 R09: 00000000ffffffff\n[ 7340.442824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[ 7340.443707] R13: 0000000000000000 R14: 00007f415bfff990 R15: 00007f415bfff6c0\n[ 7340.444586] \u003c/TASK\u003e\n[ 7340.444922] Modules linked in: rfkill intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit libnvdimm kvm_intel vfat fat kvm snd_pcm irqbypass rapl iTCO_wdt snd_timer intel_pmc_bxt iTCO_vendor_support snd ixgbevf virtio_net soundcore i2c_i801 pcspkr libeth_xdp net_failover i2c_smbus lpc_ich failover libeth virtio_balloon joydev 9p fuse loop zram lz4hc_compress lz4_compress 9pnet_virtio 9pnet netfs ghash_clmulni_intel serio_raw qemu_fw_cfg\n[ 7340.449650] ---[ end trace 0000000000000000 ]---\n\nThe issue can be fixed in all in-tree drivers, but we cannot just trust OOT\ndrivers to not do this. Therefore, make tailroom a signed int and produce a\nwarning when it is negative to prevent such mistakes in the future.\n\nFixes: bf25146a5595 (\"bpf: add frags support to the bpf_xdp_adjust_tail() API\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-10-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "581e209d1ff01da4c2c4586f0c885d32b91496e0", "tree": "134307456eca52d54bade48eb935c18affc57fec", "parents": [ "7f46fd89d863377e386a0f847aea7e5a42b7fa56" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:47 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:46 2026 +0100" }, "message": "i40e: use xdp.frame_sz as XDP RxQ info frag_size\n\n[ Upstream commit c69d22c6c46a1d792ba8af3d8d6356fdc0e6f538 ]\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buffer size instead\nof DMA write size. Different assumptions in i40e driver configuration lead\nto negative tailroom.\n\nSet frag_size to the same value as frame_sz in shared pages mode, use new\nhelper to set frag_size when AF_XDP ZC is active.\n\nFixes: a045d2f2d03d (\"i40e: set xdp_rxq_info::frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-7-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "7f46fd89d863377e386a0f847aea7e5a42b7fa56", "tree": "6116bcb0e173ce82c8cbf057479b28b65b1a3736", "parents": [ "addccd49c541703e5e3c8ba3bef6868e582c4ad1" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:46 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:46 2026 +0100" }, "message": "i40e: fix registering XDP RxQ info\n\n[ Upstream commit 8f497dc8a61429cc004720aa8e713743355d80cf ]\n\nCurrent way of handling XDP RxQ info in i40e has a problem, where frag_size\nis not updated when xsk_buff_pool is detached or when MTU is changed, this\nleads to growing tail always failing for multi-buffer packets.\n\nCouple XDP RxQ info registering with buffer allocations and unregistering\nwith cleaning the ring.\n\nFixes: a045d2f2d03d (\"i40e: set xdp_rxq_info::frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-6-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "addccd49c541703e5e3c8ba3bef6868e582c4ad1", "tree": "546a0d647de7ffdb10e3983e687cb3562ac75669", "parents": [ "c12b63c87250743a1be9f988f113ff2420e70b2a" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:43 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:46 2026 +0100" }, "message": "xsk: introduce helper to determine rxq-\u003efrag_size\n\n[ Upstream commit 16394d80539937d348dd3b9ea32415c54e67a81b ]\n\nrxq-\u003efrag_size is basically a step between consecutive strictly aligned\nframes. In ZC mode, chunk size fits exactly, but if chunks are unaligned,\nthere is no safe way to determine accessible space to grow tailroom.\n\nReport frag_size to be zero, if chunks are unaligned, chunk_size otherwise.\n\nFixes: 24ea50127ecf (\"xsk: support mbuf on ZC RX\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-3-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "c12b63c87250743a1be9f988f113ff2420e70b2a", "tree": "df78f6f39cf65c44767e86be14c6422419a6e12e", "parents": [ "91a89d3bdc2f63d983adc13d1771631663c5dc1b" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:42 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:46 2026 +0100" }, "message": "xdp: use modulo operation to calculate XDP frag tailroom\n\n[ Upstream commit 88b6b7f7b216108a09887b074395fa7b751880b1 ]\n\nThe current formula for calculating XDP tailroom in mbuf packets works only\nif each frag has its own page (if rxq-\u003efrag_size is PAGE_SIZE), this\ndefeats the purpose of the parameter overall and without any indication\nleads to negative calculated tailroom on at least half of frags, if shared\npages are used.\n\nThere are not many drivers that set rxq-\u003efrag_size. Among them:\n* i40e and enetc always split page uniformly between frags, use shared\n pages\n* ice uses page_pool frags via libeth, those are power-of-2 and uniformly\n distributed across page\n* idpf has variable frag_size with XDP on, so current API is not applicable\n* mlx5, mtk and mvneta use PAGE_SIZE or 0 as frag_size for page_pool\n\nAs for AF_XDP ZC, only ice, i40e and idpf declare frag_size for it. Modulo\noperation yields good results for aligned chunks, they are all power-of-2,\nbetween 2K and PAGE_SIZE. Formula without modulo fails when chunk_size is\n2K. Buffers in unaligned mode are not distributed uniformly, so modulo\noperation would not work.\n\nTo accommodate unaligned buffers, we could define frag_size as\ndata + tailroom, and hence do not subtract offset when calculating\ntailroom, but this would necessitate more changes in the drivers.\n\nDefine rxq-\u003efrag_size as an even portion of a page that fully belongs to a\nsingle frag. When calculating tailroom, locate the data start within such\nportion by performing a modulo operation on page offset.\n\nFixes: bf25146a5595 (\"bpf: add frags support to the bpf_xdp_adjust_tail() API\")\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-2-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "91a89d3bdc2f63d983adc13d1771631663c5dc1b", "tree": "e63446dd802cb7b2e83632fb989d20dde634bfcf", "parents": [ "f7c9f8e3607440fe39300efbaf46cf7b5eecb23f" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Wed Mar 04 09:06:02 2026 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:46 2026 +0100" }, "message": "net/sched: act_ife: Fix metalist update behavior\n\n[ Upstream commit e2cedd400c3ec0302ffca2490e8751772906ac23 ]\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \u003cIRQ\u003e\n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.\n\nFixes: aa9fd9a325d51 (\"sched: act: ife: update parameters via rcu handling\")\nReported-by: Ruitong Liu \u003ccnitlrt@gmail.com\u003e\nTested-by: Ruitong Liu \u003ccnitlrt@gmail.com\u003e\nCo-developed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260304140603.76500-1-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "f7c9f8e3607440fe39300efbaf46cf7b5eecb23f", "tree": "6b7c7087ad29b7a10281c13ec5307f473a0fe1e6", "parents": [ "f0373e9317bc904e7bdb123d3106fe4f3cea2fb7" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Wed Mar 04 19:38:13 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:46 2026 +0100" }, "message": "net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n\n[ Upstream commit 21ec92774d1536f71bdc90b0e3d052eff99cf093 ]\n\nWhen a standalone IPv6 nexthop object is created with a loopback device\n(e.g., \"ip -6 nexthop add id 100 dev lo\"), fib6_nh_init() misclassifies\nit as a reject route. This is because nexthop objects have no destination\nprefix (fc_dst\u003d::), causing fib6_is_reject() to match any loopback\nnexthop. The reject path skips fib_nh_common_init(), leaving\nnhc_pcpu_rth_output unallocated. If an IPv4 route later references this\nnexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and\npanics.\n\nSimplify the check in fib6_nh_init() to only match explicit reject\nroutes (RTF_REJECT) instead of using fib6_is_reject(). The loopback\npromotion heuristic in fib6_is_reject() is handled separately by\nip6_route_info_create_nh(). After this change, the three cases behave\nas follows:\n\n1. Explicit reject route (\"ip -6 route add unreachable 2001:db8::/64\"):\n RTF_REJECT is set, enters reject path, skips fib_nh_common_init().\n No behavior change.\n\n2. Implicit loopback reject route (\"ip -6 route add 2001:db8::/32 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. ip6_route_info_create_nh() still promotes it to reject\n afterward. nhc_pcpu_rth_output is allocated but unused, which is\n harmless.\n\n3. Standalone nexthop object (\"ip -6 nexthop add id 100 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. nhc_pcpu_rth_output is properly allocated, fixing the crash\n when IPv4 routes reference this nexthop.\n\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nFixes: 493ced1ac47c (\"ipv4: Allow routes to use nexthop objects\")\nReported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260304113817.294966-2-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "f0373e9317bc904e7bdb123d3106fe4f3cea2fb7", "tree": "52f30d379fbc91c03d094b6953603c05895cec8f", "parents": [ "aa73deb3b6b730ec280d45b3f423bfa9e17bc122" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Wed Mar 04 13:03:57 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:46 2026 +0100" }, "message": "net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n\n[ Upstream commit 168ff39e4758897d2eee4756977d036d52884c7e ]\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If an IPv6 packet is injected into the interface,\nroute_shortcircuit() is called and a NULL pointer dereference happens on\nneigh_lookup().\n\n BUG: kernel NULL pointer dereference, address: 0000000000000380\n Oops: Oops: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x20/0x270\n [...]\n Call Trace:\n \u003cTASK\u003e\n vxlan_xmit+0x638/0x1ef0 [vxlan]\n dev_hard_start_xmit+0x9e/0x2e0\n __dev_queue_xmit+0xbee/0x14e0\n packet_sendmsg+0x116f/0x1930\n __sys_sendto+0x1f5/0x200\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x12f/0x1590\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFix this by adding an early check on route_shortcircuit() when protocol\nis ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because\nVXLAN can be built-in even when IPv6 is built as a module.\n\nFixes: e15a00aafa4b (\"vxlan: add ipv6 route short circuit support\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260304120357.9778-2-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "aa73deb3b6b730ec280d45b3f423bfa9e17bc122", "tree": "a370786b137a860783d0a9e50e3e8fbd800ec3ec", "parents": [ "4614301b900adba02c685bec9c7e5932eb83a676" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Wed Mar 04 13:03:56 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n\n[ Upstream commit e5e890630533bdc15b26a34bb8e7ef539bdf1322 ]\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. Then, if neigh_suppress is enabled and an ICMPv6\nNeighbor Discovery packet reaches the bridge, br_do_suppress_nd() will\ndereference ipv6_stub-\u003end_tbl which is NULL, passing it to\nneigh_lookup(). This causes a kernel NULL pointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000268\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x16/0xe0\n [...]\n Call Trace:\n \u003cIRQ\u003e\n ? neigh_lookup+0x16/0xe0\n br_do_suppress_nd+0x160/0x290 [bridge]\n br_handle_frame_finish+0x500/0x620 [bridge]\n br_handle_frame+0x353/0x440 [bridge]\n __netif_receive_skb_core.constprop.0+0x298/0x1110\n __netif_receive_skb_one_core+0x3d/0xa0\n process_backlog+0xa0/0x140\n __napi_poll+0x2c/0x170\n net_rx_action+0x2c4/0x3a0\n handle_softirqs+0xd0/0x270\n do_softirq+0x3f/0x60\n\nFix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in\nthe callers. This is in essence disabling NS/NA suppression when IPv6 is\ndisabled.\n\nFixes: ed842faeb2bd (\"bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports\")\nReported-by: Guruprasad C P \u003cgurucp2005@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp\u003dutE2H2VTX5nqfgs7LDxQ@mail.gmail.com/\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260304120357.9778-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "4614301b900adba02c685bec9c7e5932eb83a676", "tree": "ef9501848ab9fad7050f374e0009a751458443ee", "parents": [ "0b7cd6fa9affca49c70f324594a02ecf1bc7f15d" ], "author": { "name": "Sun Jian", "email": "sun.jian.kdev@gmail.com", "time": "Wed Feb 25 19:14:50 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "selftests/harness: order TEST_F and XFAIL_ADD constructors\n\n[ Upstream commit 6be2681514261324c8ee8a1c6f76cefdf700220f ]\n\nTEST_F() allocates and registers its struct __test_metadata via mmap()\ninside its constructor, and only then assigns the\n_##fixture_##test##_object pointer.\n\nXFAIL_ADD() runs in a constructor too and reads\n_##fixture_##test##_object to initialize xfail-\u003etest. If XFAIL_ADD runs\nfirst, xfail-\u003etest can be NULL and the expected failure will be reported\nas FAIL.\n\nUse constructor priorities to ensure TEST_F registration runs before\nXFAIL_ADD, without adding extra state or runtime lookups.\n\nFixes: 2709473c9386 (\"selftests: kselftest_harness: support using xfail\")\nSigned-off-by: Sun Jian \u003csun.jian.kdev@gmail.com\u003e\nLink: https://patch.msgid.link/20260225111451.347923-1-sun.jian.kdev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "0b7cd6fa9affca49c70f324594a02ecf1bc7f15d", "tree": "7584334b4839ff74a287c8bcac62efff94d5750e", "parents": [ "b73dfe1ea7be7a072482434643b517d7726f4c8d" ], "author": { "name": "Wake Liu", "email": "wakel@google.com", "time": "Wed Dec 24 16:41:20 2025 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "kselftest/harness: Use helper to avoid zero-size memset warning\n\n[ Upstream commit 19b8a76cd99bde6d299e60490f3e62b8d3df3997 ]\n\nWhen building kselftests with a toolchain that enables source\nfortification (e.g., Android\u0027s build environment, which uses\n-D_FORTIFY_SOURCE\u003d3), a build failure occurs in tests that use an\nempty FIXTURE().\n\nThe root cause is that an empty fixture struct results in\n`sizeof(self_private)` evaluating to 0. The compiler\u0027s fortification\nchecks then detect the `memset()` call with a compile-time constant size\nof 0, issuing a `-Wuser-defined-warnings` which is promoted to an error\nby `-Werror`.\n\nAn initial attempt to guard the call with `if (sizeof(self_private) \u003e 0)`\nwas insufficient. The compiler\u0027s static analysis is aggressive enough\nto flag the `memset(..., 0)` pattern before evaluating the conditional,\nthus still triggering the error.\n\nTo resolve this robustly, this change introduces a `static inline`\nhelper function, `__kselftest_memset_safe()`. This function wraps the\nsize check and the `memset()` call. By replacing the direct `memset()`\nin the `__TEST_F_IMPL` macro with a call to this helper, we create an\nabstraction boundary. This prevents the compiler\u0027s static analyzer from\n\"seeing\" the problematic pattern at the macro expansion site, resolving\nthe build failure.\n\nBuild Context:\nCompiler: Android (14488419, +pgo, +bolt, +lto, +mlgo, based on r584948) clang version 22.0.0 (https://android.googlesource.com/toolchain/llvm-project 2d65e4108033380e6fe8e08b1f1826cd2bfb0c99)\nRelevant Options: -O2 -Wall -Werror -D_FORTIFY_SOURCE\u003d3 -target i686-linux-android10000\n\nTest: m kselftest_futex_futex_requeue_pi\n\nRemoved Gerrit Change-Id\nShuah Khan \u003cskhan@linuxfoundation.org\u003e\n\nLink: https://lore.kernel.org/r/20251224084120.249417-1-wakel@google.com\nSigned-off-by: Wake Liu \u003cwakel@google.com\u003e\nSigned-off-by: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nStable-dep-of: 6be268151426 (\"selftests/harness: order TEST_F and XFAIL_ADD constructors\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "b73dfe1ea7be7a072482434643b517d7726f4c8d", "tree": "b08567e63f547fc57140ab90e3ce1d64b1707701", "parents": [ "c12d570d71920903a1a0468b7d13b085203d0c93" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Mar 03 18:56:39 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()\n\n[ Upstream commit 0abc73c8a40fd64ac1739c90bb4f42c418d27a5e ]\n\nReset eBPF program pointer to old_prog and do not decrease its ref-count\nif mtk_open routine in mtk_xdp_setup() fails.\n\nFixes: 7c26c20da5d42 (\"net: ethernet: mtk_eth_soc: add basic XDP support\")\nSuggested-by: Paolo Valerio \u003cpvalerio@redhat.com\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260303-mtk-xdp-prog-ptr-fix-v2-1-97b6dbbe240f@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "c12d570d71920903a1a0468b7d13b085203d0c93", "tree": "5af377cac1ed7186a903cda7bf8912fc5ba10aac", "parents": [ "dcba62d4fadedd7b22a6719ae486559dd2254023" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 03 16:31:32 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "netfilter: nft_set_pipapo: split gc into unlink and reclaim phase\n\n[ Upstream commit 9df95785d3d8302f7c066050117b04cd3c2048c2 ]\n\nYiming Qian reports Use-after-free in the pipapo set type:\n Under a large number of expired elements, commit-time GC can run for a very\n long time in a non-preemptible context, triggering soft lockup warnings and\n RCU stall reports (local denial of service).\n\nWe must split GC in an unlink and a reclaim phase.\n\nWe cannot queue elements for freeing until pointers have been swapped.\nExpired elements are still exposed to both the packet path and userspace\ndumpers via the live copy of the data structure.\n\ncall_rcu() does not protect us: dump operations or element lookups starting\nafter call_rcu has fired can still observe the free\u0027d element, unless the\ncommit phase has made enough progress to swap the clone and live pointers\nbefore any new reader has picked up the old version.\n\nThis a similar approach as done recently for the rbtree backend in commit\n35f83a75529a (\"netfilter: nft_set_rbtree: don\u0027t gc elements on insert\").\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "dcba62d4fadedd7b22a6719ae486559dd2254023", "tree": "273cd2b26cb52aebcb4c638f92bfc93837bb4571", "parents": [ "78141b8832e16d80d09cbefb4258612db0777a24" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Tue Mar 03 14:58:25 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "net: stmmac: Fix error handling in VLAN add and delete paths\n\n[ Upstream commit 35dfedce442c4060cfe5b98368bc9643fb995716 ]\n\nstmmac_vlan_rx_add_vid() updates active_vlans and the VLAN hash\nregister before writing the HW filter entry. If the filter write\nfails, it leaves a stale VID in active_vlans and the hash register.\n\nstmmac_vlan_rx_kill_vid() has the reverse problem: it clears\nactive_vlans before removing the HW filter. On failure, the VID is\ngone from active_vlans but still present in the HW filter table.\n\nTo fix this, reorder the operations to update the hash table first,\nthen attempt the HW filter operation. If the HW filter fails, roll\nback both the active_vlans bitmap and the hash table by calling\nstmmac_vlan_update() again.\n\nFixes: ed64639bc1e0 (\"net: stmmac: Add support for VLAN Rx filtering\")\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nLink: https://patch.msgid.link/20260303145828.7845-2-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "78141b8832e16d80d09cbefb4258612db0777a24", "tree": "879d18167bc0a06c49ca13330829cddc0a45d99a", "parents": [ "0beea51b28b2fbced5cc91a1c0d2848dd5eb550f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:45 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "nfc: rawsock: cancel tx_work before socket teardown\n\n[ Upstream commit d793458c45df2aed498d7f74145eab7ee22d25aa ]\n\nIn rawsock_release(), cancel any pending tx_work and purge the write\nqueue before orphaning the socket. rawsock_tx_work runs on the system\nworkqueue and calls nfc_data_exchange which dereferences the NCI\ndevice. Without synchronization, tx_work can race with socket and\ndevice teardown when a process is killed (e.g. by SIGKILL), leading\nto use-after-free or leaked references.\n\nSet SEND_SHUTDOWN first so that if tx_work is already running it will\nsee the flag and skip transmitting, then use cancel_work_sync to wait\nfor any in-progress execution to finish, and finally purge any\nremaining queued skbs.\n\nFixes: 23b7869c0fd0 (\"NFC: add the NFC socket raw protocol\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-6-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "0beea51b28b2fbced5cc91a1c0d2848dd5eb550f", "tree": "5e0bd87e0913cabaf1559a9870ee4b7dd171b7ba", "parents": [ "3245801d44a44c090acefe19a12d22d12cac45c5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:44 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:45 2026 +0100" }, "message": "nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback\n\n[ Upstream commit 0efdc02f4f6d52f8ca5d5889560f325a836ce0a8 ]\n\nMove clear_bit(NCI_DATA_EXCHANGE) before invoking the data exchange\ncallback in nci_data_exchange_complete().\n\nThe callback (e.g. rawsock_data_exchange_complete) may immediately\nschedule another data exchange via schedule_work(tx_work). On a\nmulti-CPU system, tx_work can run and reach nci_transceive() before\nthe current nci_data_exchange_complete() clears the flag, causing\ntest_and_set_bit(NCI_DATA_EXCHANGE) to return -EBUSY and the new\ntransfer to fail.\n\nThis causes intermittent flakes in nci/nci_dev in NIPA:\n\n # # RUN NCI.NCI1_0.t4t_tag_read ...\n # # t4t_tag_read: Test terminated by timeout\n # # FAIL NCI.NCI1_0.t4t_tag_read\n # not ok 3 NCI.NCI1_0.t4t_tag_read\n\nFixes: 38f04c6b1b68 (\"NFC: protect nci_data_exchange transactions\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-5-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "3245801d44a44c090acefe19a12d22d12cac45c5", "tree": "c9481f11a447af97e97a61cd71f2fce77c46a0db", "parents": [ "0196f36ad01e46f2fc2991d4cee7ece497fa1aed" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 08:23:41 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "nfc: nci: free skb on nci_transceive early error paths\n\n[ Upstream commit 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c ]\n\nnci_transceive() takes ownership of the skb passed by the caller,\nbut the -EPROTO, -EINVAL, and -EBUSY error paths return without\nfreeing it.\n\nDue to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes\nthe nci/nci_dev selftest hits the error path occasionally in NIPA,\nand kmemleak detects leaks:\n\nunreferenced object 0xff11000015ce6a40 (size 640):\n comm \"nci_dev\", pid 3954, jiffies 4295441246\n hex dump (first 32 bytes):\n 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk\n 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk\n backtrace (crc 7c40cc2a):\n kmem_cache_alloc_node_noprof+0x492/0x630\n __alloc_skb+0x11e/0x5f0\n alloc_skb_with_frags+0xc6/0x8f0\n sock_alloc_send_pskb+0x326/0x3f0\n nfc_alloc_send_skb+0x94/0x1d0\n rawsock_sendmsg+0x162/0x4c0\n do_syscall_64+0x117/0xfc0\n\nFixes: 6a2968aaf50c (\"NFC: basic NCI protocol implementation\")\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260303162346.2071888-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "0196f36ad01e46f2fc2991d4cee7ece497fa1aed", "tree": "c858a3d42b75cea98ddc2ce0bde0176ab7c81fff", "parents": [ "2451949f0584d2183c1a1accfbd4a286c0a21d67" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Mar 04 01:56:40 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "net_sched: sch_fq: clear q-\u003eband_pkt_count[] in fq_reset()\n\n[ Upstream commit a4c2b8be2e5329e7fac6e8f64ddcb8958155cfcb ]\n\nWhen/if a NIC resets, queues are deactivated by dev_deactivate_many(),\nthen reactivated when the reset operation completes.\n\nfq_reset() removes all the skbs from various queues.\n\nIf we do not clear q-\u003eband_pkt_count[], these counters keep growing\nand can eventually reach sch-\u003elimit, preventing new packets to be queued.\n\nMany thanks to Praveen for discovering the root cause.\n\nFixes: 29f834aa326e (\"net_sched: sch_fq: add 3 bands and WRR scheduling\")\nDiagnosed-by: Praveen Kaligineedi \u003cpkaligineedi@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260304015640.961780-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "2451949f0584d2183c1a1accfbd4a286c0a21d67", "tree": "bcdf5a2e98cdf4057f5172922c9266e351489a59", "parents": [ "5bc4e69306ed7ae02232eb4c0b23ed621a26d504" ], "author": { "name": "Ian Ray", "email": "ian.ray@gehealthcare.com", "time": "Mon Mar 02 18:32:37 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "net: nfc: nci: Fix zero-length proprietary notifications\n\n[ Upstream commit f7d92f11bd33a6eb49c7c812255ef4ab13681f0f ]\n\nNCI NFC controllers may have proprietary OIDs with zero-length payload.\nOne example is: drivers/nfc/nxp-nci/core.c, NXP_NCI_RF_TXLDO_ERROR_NTF.\n\nAllow a zero length payload in proprietary notifications *only*.\n\nBefore:\n\n-- \u003e8 --\nkernel: nci: nci_recv_frame: len 3\n-- \u003e8 --\n\nAfter:\n\n-- \u003e8 --\nkernel: nci: nci_recv_frame: len 3\nkernel: nci: nci_ntf_packet: NCI RX: MT\u003dntf, PBF\u003d0, GID\u003d0x1, OID\u003d0x23, plen\u003d0\nkernel: nci: nci_ntf_packet: unknown ntf opcode 0x123\nkernel: nfc nfc0: NFC: RF transmitter couldn\u0027t start. Bad power and/or configuration?\n-- \u003e8 --\n\nAfter fixing the hardware:\n\n-- \u003e8 --\nkernel: nci: nci_recv_frame: len 27\nkernel: nci: nci_ntf_packet: NCI RX: MT\u003dntf, PBF\u003d0, GID\u003d0x1, OID\u003d0x5, plen\u003d24\nkernel: nci: nci_rf_intf_activated_ntf_packet: rf_discovery_id 1\n-- \u003e8 --\n\nFixes: d24b03535e5e (\"nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\")\nSigned-off-by: Ian Ray \u003cian.ray@gehealthcare.com\u003e\nLink: https://patch.msgid.link/20260302163238.140576-1-ian.ray@gehealthcare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "5bc4e69306ed7ae02232eb4c0b23ed621a26d504", "tree": "776a48024faeee5cb21b21f66079c29253a2aa9c", "parents": [ "5c38a7ed9a9f8d4d474133b179c042e287c4fb74" ], "author": { "name": "Koichiro Den", "email": "den@valinux.co.jp", "time": "Sat Feb 28 23:53:07 2026 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\n[ Upstream commit 7f083faf59d14c04e01ec05a7507f036c965acf8 ]\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc-\u003eseqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n iperf3 -ub0 -c $peer -t 0 \u0026\n while :; do\n ethtool -L eth0 combined 1\n ethtool -L eth0 combined 2\n done\n\nWith KASAN enabled, this leads to reports like:\n\n BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n ...\n Call Trace:\n \u003cTASK\u003e\n ...\n __qdisc_run+0x133f/0x1760\n __dev_queue_xmit+0x248f/0x3550\n ip_finish_output2+0xa42/0x2110\n ip_output+0x1a7/0x410\n ip_send_skb+0x2e6/0x480\n udp_send_skb+0xb0a/0x1590\n udp_sendmsg+0x13c9/0x1fc0\n ...\n \u003c/TASK\u003e\n\n Allocated by task 1270 on cpu 5 at 44.558414s:\n ...\n alloc_skb_with_frags+0x84/0x7c0\n sock_alloc_send_pskb+0x69a/0x830\n __ip_append_data+0x1b86/0x48c0\n ip_make_skb+0x1e8/0x2b0\n udp_sendmsg+0x13a6/0x1fc0\n ...\n\n Freed by task 1306 on cpu 3 at 44.558445s:\n ...\n kmem_cache_free+0x117/0x5e0\n pfifo_fast_reset+0x14d/0x580\n qdisc_reset+0x9e/0x5f0\n netif_set_real_num_tx_queues+0x303/0x840\n virtnet_set_channels+0x1bf/0x260 [virtio_net]\n ethnl_set_channels+0x684/0xae0\n ethnl_default_set_doit+0x31a/0x890\n ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc-\u003eseqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling.\n\nFixes: 6b3ba9146fe6 (\"net: sched: allow qdiscs to handle locking\")\nSigned-off-by: Koichiro Den \u003cden@valinux.co.jp\u003e\nLink: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "5c38a7ed9a9f8d4d474133b179c042e287c4fb74", "tree": "401821afc699e79fc12f39753e4716b14e100ce2", "parents": [ "d7040a5da9527cc23a3a9e7247d831a78ccee97e" ], "author": { "name": "Olivier Sobrie", "email": "olivier@sobrie.be", "time": "Wed Mar 04 22:20:39 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "hwmon: (max6639) fix inverted polarity\n\n[ Upstream commit 170a4b21f49b3dcff3115b4c90758f0a0d77375a ]\n\nAccording to MAX6639 documentation:\n\n D1: PWM Output Polarity. PWM output is low at\n 100% duty cycle when this bit is set to zero. PWM\n output is high at 100% duty cycle when this bit is set\n to 1.\n\nUp to commit 0f33272b60ed (\"hwmon: (max6639) : Update hwmon init using\ninfo structure\"), the polarity was set to high (0x2) when no platform\ndata was set. After the patch, the polarity register wasn\u0027t set anymore\nif no platform data was specified. Nowadays, since commit 7506ebcd662b\n(\"hwmon: (max6639) : Configure based on DT property\"), it is always set\nto low which doesn\u0027t match with the comment above and change the\nbehavior compared to versions prior 0f33272b60ed.\n\nFixes: 0f33272b60ed (\"hwmon: (max6639) : Update hwmon init using info structure\")\nSigned-off-by: Olivier Sobrie \u003colivier@sobrie.be\u003e\nLink: https://lore.kernel.org/r/20260304212039.570274-1-olivier@sobrie.be\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "d7040a5da9527cc23a3a9e7247d831a78ccee97e", "tree": "d82c1f1b637e2c9268eff1382eb0d5967e4fc01a", "parents": [ "15fb6d627484ee39ed73e202ef4720e1fa5c898e" ], "author": { "name": "Naresh Solanki", "email": "naresh.solanki@9elements.com", "time": "Mon Oct 07 14:34:24 2024 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "hwmon: (max6639) : Configure based on DT property\n\n[ Upstream commit 7506ebcd662b868780774d191a7c024c18c557a8 ]\n\nRemove platform data \u0026 initialize with defaults\nconfiguration \u0026 overwrite based on DT properties.\n\nSigned-off-by: Naresh Solanki \u003cnaresh.solanki@9elements.com\u003e\nMessage-ID: \u003c20241007090426.811736-1-naresh.solanki@9elements.com\u003e\n[groeck: Dropped some unnecessary empty lines]\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nStable-dep-of: 170a4b21f49b (\"hwmon: (max6639) fix inverted polarity\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "15fb6d627484ee39ed73e202ef4720e1fa5c898e", "tree": "3985fee441afe9d09b7572ba9d43f53052591e14", "parents": [ "a0167a4984ca0ac4195e869b157f22e2e54d2f68" ], "author": { "name": "Sungwoo Kim", "email": "iam@sung-woo.kim", "time": "Fri Feb 27 19:19:28 2026 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "nvme: fix memory allocation in nvme_pr_read_keys()\n\n[ Upstream commit c3320153769f05fd7fe9d840cb555dd3080ae424 ]\n\nnvme_pr_read_keys() takes num_keys from userspace and uses it to\ncalculate the allocation size for rse via struct_size(). The upper\nlimit is PR_KEYS_MAX (64K).\n\nA malicious or buggy userspace can pass a large num_keys value that\nresults in a 4MB allocation attempt at most, causing a warning in\nthe page allocator when the order exceeds MAX_PAGE_ORDER.\n\nTo fix this, use kvzalloc() instead of kzalloc().\n\nThis bug has the same reasoning and fix with the patch below:\nhttps://lore.kernel.org/linux-block/20251212013510.3576091-1-kartikey406@gmail.com/\n\nWarning log:\nWARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272\nModules linked in:\nCPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216\nCode: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 \u003c0f\u003e 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d\nRSP: 0018:ffffc90000fcf450 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0\nRDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0\nRBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001\nR10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000\nR13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620\nFS: 0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486\n alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557\n ___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598\n __kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629\n __do_kmalloc_node mm/slub.c:5645 [inline]\n __kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669\n kmalloc_noprof include/linux/slab.h:961 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n nvme_pr_read_keys+0x8f/0x4c0 drivers/nvme/host/pr.c:245\n blkdev_pr_read_keys block/ioctl.c:456 [inline]\n blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730\n blkdev_ioctl+0x299/0x700 block/ioctl.c:786\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583\n x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fb893d3108d\nCode: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3108d\nRDX: 0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003\nRBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007ffff61f3128 R14: 00007fb893dae530 R15: 0000000000000001\n \u003c/TASK\u003e\n\nFixes: 5fd96a4e15de (nvme: Add pr_ops read_keys support)\nAcked-by: Chao Shi \u003ccshi008@fiu.edu\u003e\nAcked-by: Weidong Zhu \u003cweizhu@fiu.edu\u003e\nAcked-by: Dave Tian \u003cdaveti@purdue.edu\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Hannes Reinecke \u003chare@suse.de\u003e\nSigned-off-by: Sungwoo Kim \u003ciam@sung-woo.kim\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "a0167a4984ca0ac4195e869b157f22e2e54d2f68", "tree": "08b9a947fa7ba8f4ce21d67fa446ad2fd0e2b609", "parents": [ "549b68ba830ff0c5bc848179ddf7ccce582842b4" ], "author": { "name": "Stefan Hajnoczi", "email": "stefanha@redhat.com", "time": "Mon Dec 01 16:43:27 2025 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:44 2026 +0100" }, "message": "nvme: reject invalid pr_read_keys() num_keys values\n\n[ Upstream commit 38ec8469f39e0e96e7dd9b76f05e0f8eb78be681 ]\n\nThe pr_read_keys() interface has a u32 num_keys parameter. The NVMe\nReservation Report command has a u32 maximum length. Reject num_keys\nvalues that are too large to fit.\n\nThis will become important when pr_read_keys() is exposed to untrusted\nuserspace via an \u003clinux/pr.h\u003e ioctl.\n\nSigned-off-by: Stefan Hajnoczi \u003cstefanha@redhat.com\u003e\nReviewed-by: Hannes Reinecke \u003chare@suse.de\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nStable-dep-of: c3320153769f (\"nvme: fix memory allocation in nvme_pr_read_keys()\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "549b68ba830ff0c5bc848179ddf7ccce582842b4", "tree": "f0a8f68f46d7df7cb4140b53f37f3a2e55c44d1e", "parents": [ "9507f9953a2a5647eb42668d0c243fdbd7e72954" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Wed Feb 04 17:28:11 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "drm/xe/reg_sr: Fix leak on xa_store failure\n\n[ Upstream commit 3091723785def05ebfe6a50866f87a044ae314ba ]\n\nFree the newly allocated entry when xa_store() fails to avoid a memory\nleak on the error path.\n\nv2: use goto fail_free. (Bala)\n\nFixes: e5283bd4dfec (\"drm/xe/reg_sr: Remove register pool\")\nCc: Balasubramani Vivekanandan \u003cbalasubramani.vivekanandan@intel.com\u003e\nCc: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nReviewed-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nLink: https://patch.msgid.link/20260204172810.1486719-2-shuicheng.lin@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 6bc6fec71ac45f52db609af4e62bdb96b9f5fadb)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "9507f9953a2a5647eb42668d0c243fdbd7e72954", "tree": "1bdf067862dd00888dd9e8f1a74809ad7ec01a2b", "parents": [ "1e6eaf2150ef4594c458638a6cc077ffe28a31ac" ], "author": { "name": "Charles Haithcock", "email": "chaithco@redhat.com", "time": "Fri Feb 27 18:41:15 2026 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "i2c: i801: Revert \"i2c: i801: replace acpi_lock with I2C bus lock\"\n\n[ Upstream commit cfc69c2e6c699c96949f7b0455195b0bfb7dc715 ]\n\nThis reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1.\n\nUnder rare circumstances, multiple udev threads can collect i801 device\ninfo on boot and walk i801_acpi_io_handler somewhat concurrently. The\nfirst will note the area is reserved by acpi to prevent further touches.\nThis ultimately causes the area to be deregistered. The second will\nenter i801_acpi_io_handler after the area is unregistered but before a\ncheck can be made that the area is unregistered. i2c_lock_bus relies on\nthe now unregistered area containing lock_ops to lock the bus. The end\nresult is a kernel panic on boot with the following backtrace;\n\n[ 14.971872] ioatdma 0000:09:00.2: enabling device (0100 -\u003e 0102)\n[ 14.971873] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 14.971880] #PF: supervisor read access in kernel mode\n[ 14.971884] #PF: error_code(0x0000) - not-present page\n[ 14.971887] PGD 0 P4D 0\n[ 14.971894] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 14.971900] CPU: 5 PID: 956 Comm: systemd-udevd Not tainted 5.14.0-611.5.1.el9_7.x86_64 #1\n[ 14.971905] Hardware name: XXXXXXXXXXXXXXXXXXXXXXX BIOS 1.20.10.SV91 01/30/2023\n[ 14.971908] RIP: 0010:i801_acpi_io_handler+0x2d/0xb0 [i2c_i801]\n[ 14.971929] Code: 00 00 49 8b 40 20 41 57 41 56 4d 8b b8 30 04 00 00 49 89 ce 41 55 41 89 d5 41 54 49 89 f4 be 02 00 00 00 55 4c 89 c5 53 89 fb \u003c48\u003e 8b 00 4c 89 c7 e8 18 61 54 e9 80 bd 80 04 00 00 00 75 09 4c 3b\n[ 14.971933] RSP: 0018:ffffbaa841483838 EFLAGS: 00010282\n[ 14.971938] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9685e01ba568\n[ 14.971941] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000000\n[ 14.971944] RBP: ffff9685ca22f028 R08: ffff9685ca22f028 R09: ffff9685ca22f028\n[ 14.971948] R10: 000000000000000b R11: 0000000000000580 R12: 0000000000000580\n[ 14.971951] R13: 0000000000000008 R14: ffff9685e01ba568 R15: ffff9685c222f000\n[ 14.971954] FS: 00007f8287c0ab40(0000) GS:ffff96a47f940000(0000) knlGS:0000000000000000\n[ 14.971959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 14.971963] CR2: 0000000000000000 CR3: 0000000168090001 CR4: 00000000003706f0\n[ 14.971966] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 14.971968] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 14.971972] Call Trace:\n[ 14.971977] \u003cTASK\u003e\n[ 14.971981] ? show_trace_log_lvl+0x1c4/0x2df\n[ 14.971994] ? show_trace_log_lvl+0x1c4/0x2df\n[ 14.972003] ? acpi_ev_address_space_dispatch+0x16e/0x3c0\n[ 14.972014] ? __die_body.cold+0x8/0xd\n[ 14.972021] ? page_fault_oops+0x132/0x170\n[ 14.972028] ? exc_page_fault+0x61/0x150\n[ 14.972036] ? asm_exc_page_fault+0x22/0x30\n[ 14.972045] ? i801_acpi_io_handler+0x2d/0xb0 [i2c_i801]\n[ 14.972061] acpi_ev_address_space_dispatch+0x16e/0x3c0\n[ 14.972069] ? __pfx_i801_acpi_io_handler+0x10/0x10 [i2c_i801]\n[ 14.972085] acpi_ex_access_region+0x5b/0xd0\n[ 14.972093] acpi_ex_field_datum_io+0x73/0x2e0\n[ 14.972100] acpi_ex_read_data_from_field+0x8e/0x230\n[ 14.972106] acpi_ex_resolve_node_to_value+0x23d/0x310\n[ 14.972114] acpi_ds_evaluate_name_path+0xad/0x110\n[ 14.972121] acpi_ds_exec_end_op+0x321/0x510\n[ 14.972127] acpi_ps_parse_loop+0xf7/0x680\n[ 14.972136] acpi_ps_parse_aml+0x17a/0x3d0\n[ 14.972143] acpi_ps_execute_method+0x137/0x270\n[ 14.972150] acpi_ns_evaluate+0x1f4/0x2e0\n[ 14.972158] acpi_evaluate_object+0x134/0x2f0\n[ 14.972164] acpi_evaluate_integer+0x50/0xe0\n[ 14.972173] ? vsnprintf+0x24b/0x570\n[ 14.972181] acpi_ac_get_state.part.0+0x23/0x70\n[ 14.972189] get_ac_property+0x4e/0x60\n[ 14.972195] power_supply_show_property+0x90/0x1f0\n[ 14.972205] add_prop_uevent+0x29/0x90\n[ 14.972213] power_supply_uevent+0x109/0x1d0\n[ 14.972222] dev_uevent+0x10e/0x2f0\n[ 14.972228] uevent_show+0x8e/0x100\n[ 14.972236] dev_attr_show+0x19/0x40\n[ 14.972246] sysfs_kf_seq_show+0x9b/0x100\n[ 14.972253] seq_read_iter+0x120/0x4b0\n[ 14.972262] ? selinux_file_permission+0x106/0x150\n[ 14.972273] vfs_read+0x24f/0x3a0\n[ 14.972284] ksys_read+0x5f/0xe0\n[ 14.972291] do_syscall_64+0x5f/0xe0\n...\n\nThe kernel panic is mitigated by setting limiting the count of udev\nchildren to 1. Revert to using the acpi_lock to continue protecting\nmarking the area as owned by firmware without relying on a lock in\na potentially unmapped region of memory.\n\nFixes: f707d6b9e7c1 (\"i2c: i801: replace acpi_lock with I2C bus lock\")\nSigned-off-by: Charles Haithcock \u003cchaithco@redhat.com\u003e\n[wsa: added Fixes-tag and updated comment stating the importance of the lock]\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "1e6eaf2150ef4594c458638a6cc077ffe28a31ac", "tree": "3f7fb330ddb2dcbbfd6ff90099fb50b04ed2079d", "parents": [ "d6bdc685e19fa9bc9cc09ec0c3a9dccf000b2841" ], "author": { "name": "Yujie Liu", "email": "yujie.liu@intel.com", "time": "Fri Feb 27 16:24:52 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "drm/sched: Fix kernel-doc warning for drm_sched_job_done()\n\n[ Upstream commit 61ded1083b264ff67ca8c2de822c66b6febaf9a8 ]\n\nThere is a kernel-doc warning for the scheduler:\n\nWarning: drivers/gpu/drm/scheduler/sched_main.c:367 function parameter \u0027result\u0027 not described in \u0027drm_sched_job_done\u0027\n\nFix the warning by describing the undocumented error code.\n\nFixes: 539f9ee4b52a (\"drm/scheduler: properly forward fence errors\")\nSigned-off-by: Yujie Liu \u003cyujie.liu@intel.com\u003e\n[phasta: Flesh out commit message]\nSigned-off-by: Philipp Stanner \u003cphasta@kernel.org\u003e\nLink: https://patch.msgid.link/20260227082452.1802922-1-yujie.liu@intel.com\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "d6bdc685e19fa9bc9cc09ec0c3a9dccf000b2841", "tree": "2283c48a42658af94c8ad933f226e313c587a490", "parents": [ "4bdc94d45d5459f0149085dfc1efe733c8e14f11" ], "author": { "name": "Raju Rangoju", "email": "Raju.Rangoju@amd.com", "time": "Mon Mar 02 09:51:24 2026 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "amd-xgbe: fix sleep while atomic on suspend/resume\n\n[ Upstream commit e2f27363aa6d983504c6836dd0975535e2e9dba0 ]\n\nThe xgbe_powerdown() and xgbe_powerup() functions use spinlocks\n(spin_lock_irqsave) while calling functions that may sleep:\n- napi_disable() can sleep waiting for NAPI polling to complete\n- flush_workqueue() can sleep waiting for pending work items\n\nThis causes a \"BUG: scheduling while atomic\" error during suspend/resume\ncycles on systems using the AMD XGBE Ethernet controller.\n\nThe spinlock protection in these functions is unnecessary as these\nfunctions are called from suspend/resume paths which are already serialized\nby the PM core\n\nFix this by removing the spinlock. Since only code that takes this lock\nis xgbe_powerdown() and xgbe_powerup(), remove it completely.\n\nFixes: c5aa9e3b8156 (\"amd-xgbe: Initial AMD 10GbE platform driver\")\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260302042124.1386445-1-Raju.Rangoju@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "4bdc94d45d5459f0149085dfc1efe733c8e14f11", "tree": "5a65e85c316a9e641a1a0ee9cb15a5e26e2431f9", "parents": [ "3310fc11fc47387d1dd4759b0bc961643ea11c7f" ], "author": { "name": "Yung Chih Su", "email": "yuuchihsu@gmail.com", "time": "Mon Mar 02 14:02:47 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "net: ipv4: fix ARM64 alignment fault in multipath hash seed\n\n[ Upstream commit 4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f ]\n\n`struct sysctl_fib_multipath_hash_seed` contains two u32 fields\n(user_seed and mp_seed), making it an 8-byte structure with a 4-byte\nalignment requirement.\n\nIn `fib_multipath_hash_from_keys()`, the code evaluates the entire\nstruct atomically via `READ_ONCE()`:\n\n mp_seed \u003d READ_ONCE(net-\u003eipv4.sysctl_fib_multipath_hash_seed).mp_seed;\n\nWhile this silently works on GCC by falling back to unaligned regular\nloads which the ARM64 kernel tolerates, it causes a fatal kernel panic\nwhen compiled with Clang and LTO enabled.\n\nCommit e35123d83ee3 (\"arm64: lto: Strengthen READ_ONCE() to acquire\nwhen CONFIG_LTO\u003dy\") strengthens `READ_ONCE()` to use Load-Acquire\ninstructions (`ldar` / `ldapr`) to prevent compiler reordering bugs\nunder Clang LTO. Since the macro evaluates the full 8-byte struct,\nClang emits a 64-bit `ldar` instruction. ARM64 architecture strictly\nrequires `ldar` to be naturally aligned, thus executing it on a 4-byte\naligned address triggers a strict Alignment Fault (FSC \u003d 0x21).\n\nFix the read side by moving the `READ_ONCE()` directly to the `u32`\nmember, which emits a safe 32-bit `ldar Wn`.\n\nFurthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire\nstruct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis\nshows that Clang splits this 8-byte write into two separate 32-bit\n`str` instructions. While this avoids an alignment fault, it destroys\natomicity and exposes a tear-write vulnerability. Fix this by\nexplicitly splitting the write into two 32-bit `WRITE_ONCE()`\noperations.\n\nFinally, add the missing `READ_ONCE()` when reading `user_seed` in\n`proc_fib_multipath_hash_seed()` to ensure proper pairing and\nconcurrency safety.\n\nFixes: 4ee2a8cace3f (\"net: ipv4: Add a sysctl to set multipath hash seed\")\nSigned-off-by: Yung Chih Su \u003cyuuchihsu@gmail.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260302060247.7066-1-yuuchihsu@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "3310fc11fc47387d1dd4759b0bc961643ea11c7f", "tree": "571617e76e087ae25c6ef80fefa75ed62b4487ac", "parents": [ "827c92c15ac8d050a7634b823e2e012fc46b405a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sun Mar 01 11:45:48 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()\n\n[ Upstream commit 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a ]\n\nl3mdev_master_dev_rcu() can return NULL when the slave device is being\nun-slaved from a VRF. All other callers deal with this, but we lost\nthe fallback to loopback in ip6_rt_pcpu_alloc() -\u003e ip6_rt_get_dev_rcu()\nwith commit 4832c30d5458 (\"net: ipv6: put host and anycast routes on\ndevice with address\").\n\n KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]\n RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418)\n Call Trace:\n ip6_pol_route (net/ipv6/route.c:2318)\n fib6_rule_lookup (net/ipv6/fib6_rules.c:115)\n ip6_route_output_flags (net/ipv6/route.c:2607)\n vrf_process_v6_outbound (drivers/net/vrf.c:437)\n\nI was tempted to rework the un-slaving code to clear the flag first\nand insert synchronize_rcu() before we remove the upper. But looks like\nthe explicit fallback to loopback_dev is an established pattern.\nAnd I guess avoiding the synchronize_rcu() is nice, too.\n\nFixes: 4832c30d5458 (\"net: ipv6: put host and anycast routes on device with address\")\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260301194548.927324-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "827c92c15ac8d050a7634b823e2e012fc46b405a", "tree": "f0f8ccba4ed1a2082785629141b2bb46025605b9", "parents": [ "20a126dbd61e6032ae8a81ceec8a1c5c7b95e2cd" ], "author": { "name": "ZhangGuoDong", "email": "zhangguodong@kylinos.cn", "time": "Tue Mar 03 15:13:12 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()\n\n[ Upstream commit 9621b996e4db1dbc2b3dc5d5910b7d6179397320 ]\n\nSMB311_posix_query_info() is currently unused, but it may still be used in\nsome stable versions, so these changes are submitted as a separate patch.\n\nUse `sizeof(struct smb311_posix_qinfo)` instead of sizeof its pointer,\nso the allocated buffer matches the actual struct size.\n\nFixes: b1bc1874b885 (\"smb311: Add support for SMB311 query info (non-compounded)\")\nReported-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: ZhangGuoDong \u003czhangguodong@kylinos.cn\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "20a126dbd61e6032ae8a81ceec8a1c5c7b95e2cd", "tree": "c3324448651b4bc5cde3e28fe295817bd603911b", "parents": [ "cfcfa0ca0212162aa472551266038e8fd6768cff" ], "author": { "name": "ZhangGuoDong", "email": "zhangguodong@kylinos.cn", "time": "Tue Mar 03 15:13:11 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:43 2026 +0100" }, "message": "smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()\n\n[ Upstream commit 12c43a062acb0ac137fc2a4a106d4d084b8c5416 ]\n\nUse `sizeof(struct smb311_posix_qinfo)` instead of sizeof its pointer,\nso the allocated buffer matches the actual struct size.\n\nFixes: 6a5f6592a0b6 (\"SMB311: Add support for query info using posix extensions (level 100)\")\nReported-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: ZhangGuoDong \u003czhangguodong@kylinos.cn\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "cfcfa0ca0212162aa472551266038e8fd6768cff", "tree": "2787ff4d3be3fe54dfbcd6986dfe384cf4a3364f", "parents": [ "3dfab6040c10eff72a1e8dfd53ff60205bcd0378" ], "author": { "name": "Lang Xu", "email": "xulang@uniontech.com", "time": "Tue Mar 03 17:52:17 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:42 2026 +0100" }, "message": "bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\n[ Upstream commit 56145d237385ca0e7ca9ff7b226aaf2eb8ef368b ]\n\nThe root cause of this bug is that when \u0027bpf_link_put\u0027 reduces the\nrefcount of \u0027shim_link-\u003elink.link\u0027 to zero, the resource is considered\nreleased but may still be referenced via \u0027tr-\u003eprogs_hlist\u0027 in\n\u0027cgroup_shim_find\u0027. The actual cleanup of \u0027tr-\u003eprogs_hlist\u0027 in\n\u0027bpf_shim_tramp_link_release\u0027 is deferred. During this window, another\nprocess can cause a use-after-free via \u0027bpf_trampoline_link_cgroup_shim\u0027.\n\nBased on Martin KaFai Lau\u0027s suggestions, I have created a simple patch.\n\nTo fix this:\n Add an atomic non-zero check in \u0027bpf_trampoline_link_cgroup_shim\u0027.\n Only increment the refcount if it is not already zero.\n\nTesting:\n I verified the fix by adding a delay in\n \u0027bpf_shim_tramp_link_release\u0027 to make the bug easier to trigger:\n\nstatic void bpf_shim_tramp_link_release(struct bpf_link *link)\n{\n\t/* ... */\n\tif (!shim_link-\u003etrampoline)\n\t\treturn;\n\n+\tmsleep(100);\n\tWARN_ON_ONCE(bpf_trampoline_unlink_prog(\u0026shim_link-\u003elink,\n\t\tshim_link-\u003etrampoline, NULL));\n\tbpf_trampoline_put(shim_link-\u003etrampoline);\n}\n\nBefore the patch, running a PoC easily reproduced the crash(almost 100%)\nwith a call trace similar to KaiyanM\u0027s report.\nAfter the patch, the bug no longer occurs even after millions of\niterations.\n\nFixes: 69fd337a975c (\"bpf: per-cgroup lsm flavor\")\nReported-by: Kaiyan Mei \u003cM202472210@hust.edu.cn\u003e\nCloses: https://lore.kernel.org/bpf/3c4ebb0b.46ff8.19abab8abe2.Coremail.kaiyanm@hust.edu.cn/\nSigned-off-by: Lang Xu \u003cxulang@uniontech.com\u003e\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nLink: https://patch.msgid.link/279EEE1BA1DDB49D+20260303095217.34436-1-xulang@uniontech.com\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "3dfab6040c10eff72a1e8dfd53ff60205bcd0378", "tree": "275ff0d0f04bf0be50efe54ff61b8a96184d313f", "parents": [ "27e9019fe1993b1928a4bd7a1fa18691e58feff0" ], "author": { "name": "Kohei Enju", "email": "kohei@enjuk.jp", "time": "Tue Feb 10 15:57:14 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:42 2026 +0100" }, "message": "iavf: fix netdev-\u003emax_mtu to respect actual hardware limit\n\n[ Upstream commit b84852170153671bb0fa6737a6e48370addd8e1a ]\n\niavf sets LIBIE_MAX_MTU as netdev-\u003emax_mtu, ignoring vf_res-\u003emax_mtu\nfrom PF [1]. This allows setting an MTU beyond the actual hardware\nlimit, causing TX queue timeouts [2].\n\nSet correct netdev-\u003emax_mtu using vf_res-\u003emax_mtu from the PF.\n\nNote that currently PF drivers such as ice/i40e set the frame size in\nvf_res-\u003emax_mtu, not MTU. Convert vf_res-\u003emax_mtu to MTU before setting\nnetdev-\u003emax_mtu.\n\n[1]\n # ip -j -d link show $DEV | jq \u0027.[0].max_mtu\u0027\n 16356\n\n[2]\n iavf 0000:00:05.0 enp0s5: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5692 ms\n iavf 0000:00:05.0 enp0s5: NIC Link is Up Speed is 10 Gbps Full Duplex\n iavf 0000:00:05.0 enp0s5: NETDEV WATCHDOG: CPU: 6: transmit queue 3 timed out 5312 ms\n iavf 0000:00:05.0 enp0s5: NIC Link is Up Speed is 10 Gbps Full Duplex\n ...\n\nFixes: 5fa4caff59f2 (\"iavf: switch to Page Pool\")\nSigned-off-by: Kohei Enju \u003ckohei@enjuk.jp\u003e\nReviewed-by: Alexander Lobakin \u003caleksander.lobakin@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "27e9019fe1993b1928a4bd7a1fa18691e58feff0", "tree": "0570341ba55db5eeda857fe6831c5df7029fc5ea", "parents": [ "8519e6883a942e510f33a0e634e27bcc3a844a40" ], "author": { "name": "David Thomson", "email": "dt@linux-mail.net", "time": "Tue Feb 24 09:37:11 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:42 2026 +0100" }, "message": "xen/acpi-processor: fix _CST detection using undersized evaluation buffer\n\n[ Upstream commit 8b57227d59a86fc06d4f09de08f98133680f2cae ]\n\nread_acpi_id() attempts to evaluate _CST using a stack buffer of\nsizeof(union acpi_object) (48 bytes), but _CST returns a nested Package\nof sub-Packages (one per C-state, each containing a register descriptor,\ntype, latency, and power) requiring hundreds of bytes. The evaluation\nalways fails with AE_BUFFER_OVERFLOW.\n\nOn modern systems using FFH/MWAIT entry (where pblk is zero), this\ncauses the function to return before setting the acpi_id_cst_present\nbit. In check_acpi_ids(), flags.power is then zero for all Phase 2 CPUs\n(physical CPUs beyond dom0\u0027s vCPU count), so push_cxx_to_hypervisor() is\nnever called for them.\n\nOn a system with dom0_max_vcpus\u003d2 and 8 physical CPUs, only PCPUs 0-1\nreceive C-state data. PCPUs 2-7 are stuck in C0/C1 idle, unable to\nenter C2/C3. This costs measurable wall power (4W observed on an Intel\nCore Ultra 7 265K with Xen 4.20).\n\nThe function never uses the _CST return value -- it only needs to know\nwhether _CST exists. Replace the broken acpi_evaluate_object() call with\nacpi_has_method(), which correctly detects _CST presence using\nacpi_get_handle() without any buffer allocation. This brings C-state\ndetection to parity with the P-state path, which already works correctly\nfor Phase 2 CPUs.\n\nFixes: 59a568029181 (\"xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.\")\nSigned-off-by: David Thomson \u003cdt@linux-mail.net\u003e\nReviewed-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nMessage-ID: \u003c20260224093707.19679-1-dt@linux-mail.net\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "8519e6883a942e510f33a0e634e27bcc3a844a40", "tree": "e25de35043dc8a7c0b20201745de2bf70e731eb6", "parents": [ "1f8b8f0db008af2f8fd16829cb3d6d04329b0238" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Feb 27 13:23:36 2026 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:42 2026 +0100" }, "message": "net/rds: Fix circular locking dependency in rds_tcp_tune\n\n[ Upstream commit 6a877ececd6daa002a9a0002cd0fbca6592a9244 ]\n\nsyzbot reported a circular locking dependency in rds_tcp_tune() where\nsk_net_refcnt_upgrade() is called while holding the socket lock:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWARNING: possible circular locking dependency detected\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nkworker/u10:8/15040 is trying to acquire lock:\nffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},\nat: __kmalloc_cache_noprof+0x4b/0x6f0\n\nbut task is already holding lock:\nffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},\nat: rds_tcp_tune+0xd7/0x930\n\nThe issue occurs because sk_net_refcnt_upgrade() performs memory\nallocation (via get_net_track() -\u003e ref_tracker_alloc()) while the\nsocket lock is held, creating a circular dependency with fs_reclaim.\n\nFix this by moving sk_net_refcnt_upgrade() outside the socket lock\ncritical section. This is safe because the fields modified by the\nsk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not\naccessed by any concurrent code path at this point.\n\nv2:\n - Corrected fixes tag\n - check patch line wrap nits\n - ai commentary nits\n\nReported-by: syzbot+2e2cf5331207053b8106@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d2e2cf5331207053b8106\nFixes: 3a58f13a881e (\"net: rds: acquire refcount on TCP sockets\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260227202336.167757-1-achender@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "1f8b8f0db008af2f8fd16829cb3d6d04329b0238", "tree": "17dd6d45f2eb7c2ab8f35df7fcb1c0962fd3fc58", "parents": [ "7b692dff8df0ba5feb8df00f27d906d6eb1fe627" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Feb 27 17:26:03 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:42 2026 +0100" }, "message": "indirect_call_wrapper: do not reevaluate function pointer\n\n[ Upstream commit 710f5c76580306cdb9ec51fac8fcf6a8faff7821 ]\n\nWe have an increasing number of READ_ONCE(xxx-\u003efunction)\ncombined with INDIRECT_CALL_[1234]() helpers.\n\nUnfortunately this forces INDIRECT_CALL_[1234]() to read\nxxx-\u003efunction many times, which is not what we wanted.\n\nFix these macros so that xxx-\u003efunction value is not reloaded.\n\n$ scripts/bloat-o-meter -t vmlinux.0 vmlinux\nadd/remove: 0/0 grow/shrink: 1/65 up/down: 122/-1084 (-962)\nFunction old new delta\nip_push_pending_frames 59 181 +122\nip6_finish_output 687 681 -6\n__udp_enqueue_schedule_skb 1078 1072 -6\nioam6_output 2319 2312 -7\nxfrm4_rcv_encap_finish2 64 56 -8\nxfrm4_output 297 289 -8\nvrf_ip_local_out 278 270 -8\nvrf_ip6_local_out 278 270 -8\nseg6_input_finish 64 56 -8\nrpl_output 700 692 -8\nipmr_forward_finish 124 116 -8\nip_forward_finish 143 135 -8\nip6mr_forward2_finish 100 92 -8\nip6_forward_finish 73 65 -8\ninput_action_end_bpf 1091 1083 -8\ndst_input 52 44 -8\n__xfrm6_output 801 793 -8\n__xfrm4_output 83 75 -8\nbpf_input 500 491 -9\n__tcp_check_space 530 521 -9\ninput_action_end_dt6 291 280 -11\nvti6_tnl_xmit 1634 1622 -12\nbpf_xmit 1203 1191 -12\nrpl_input 497 483 -14\nrawv6_send_hdrinc 1355 1341 -14\nndisc_send_skb 1030 1016 -14\nipv6_srh_rcv 1377 1363 -14\nip_send_unicast_reply 1253 1239 -14\nip_rcv_finish 226 212 -14\nip6_rcv_finish 300 286 -14\ninput_action_end_x_core 205 191 -14\ninput_action_end_x 355 341 -14\ninput_action_end_t 205 191 -14\ninput_action_end_dx6_finish 127 113 -14\ninput_action_end_dx4_finish 373 359 -14\ninput_action_end_dt4 426 412 -14\ninput_action_end_core 186 172 -14\ninput_action_end_b6_encap 292 278 -14\ninput_action_end_b6 198 184 -14\nigmp6_send 1332 1318 -14\nip_sublist_rcv 864 848 -16\nip6_sublist_rcv 1091 1075 -16\nipv6_rpl_srh_rcv 1937 1920 -17\nxfrm_policy_queue_process 1246 1228 -18\nseg6_output_core 903 885 -18\nmld_sendpack 856 836 -20\nNF_HOOK 756 736 -20\nvti_tunnel_xmit 1447 1426 -21\ninput_action_end_dx6 664 642 -22\ninput_action_end 1502 1480 -22\nsock_sendmsg_nosec 134 111 -23\nip6mr_forward2 388 364 -24\nsock_recvmsg_nosec 134 109 -25\nseg6_input_core 836 810 -26\nip_send_skb 172 146 -26\nip_local_out 140 114 -26\nip6_local_out 140 114 -26\n__sock_sendmsg 162 136 -26\n__ip_queue_xmit 1196 1170 -26\n__ip_finish_output 405 379 -26\nipmr_queue_fwd_xmit 373 346 -27\nsock_recvmsg 173 145 -28\nip6_xmit 1635 1607 -28\nxfrm_output_resume 1418 1389 -29\nip_build_and_send_pkt 625 591 -34\ndst_output 504 432 -72\nTotal: Before\u003d25217686, After\u003d25216724, chg -0.00%\n\nFixes: 283c16a2dfd3 (\"indirect call wrappers: helpers to speed-up indirect calls of builtin\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260227172603.1700433-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "7b692dff8df0ba5feb8df00f27d906d6eb1fe627", "tree": "dbf4f0000e1ea651ef3e66eb5fcdc3e7a9b44178", "parents": [ "3356464e50e1ee15ba3c324ef6cc5a475c2e96e4" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Thu Feb 26 20:11:16 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:42 2026 +0100" }, "message": "wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()\n\n[ Upstream commit 4e10a730d1b511ff49723371ed6d694dd1b2c785 ]\n\nCheck frame length before accessing the mgmt fields in\nmt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob\naccess.\n\nFixes: 577dbc6c656d (\"mt76: mt7915: enable offloading of sequence number assignment\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-3-b0f6d1ad4850@kernel.org\n[fix check to also cover mgmt-\u003eu.action.u.addba_req.capab,\ncorrect Fixes tag]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "3356464e50e1ee15ba3c324ef6cc5a475c2e96e4", "tree": "4d246b0b0af26b04f0834afa9a38a7087e301205", "parents": [ "ca1adc04fc2cb1d9f1842e429debe6a520d54966" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Thu Feb 26 20:11:15 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:42 2026 +0100" }, "message": "wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()\n\n[ Upstream commit c41a9abd6ae31d130e8f332e7c8800c4c866234b ]\n\nCheck frame length before accessing the mgmt fields in\nmt7925_mac_write_txwi_80211 in order to avoid a possible oob access.\n\nFixes: c948b5da6bbec (\"wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-2-b0f6d1ad4850@kernel.org\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "ca1adc04fc2cb1d9f1842e429debe6a520d54966", "tree": "a9104d1aabd9f5bf24ebaf217828ed8a065bffda", "parents": [ "5feeea59ed142e15c3284d0b1a364c6786bf3487" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Thu Feb 26 20:11:14 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()\n\n[ Upstream commit 60862846308627e9e15546bb647a00de44deb27b ]\n\nCheck frame length before accessing the mgmt fields in\nmt7996_mac_write_txwi_80211 in order to avoid a possible oob access.\n\nFixes: 98686cd21624c (\"wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-1-b0f6d1ad4850@kernel.org\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "5feeea59ed142e15c3284d0b1a364c6786bf3487", "tree": "d47d8c4e660f741d7b630fae7e1c6861442c78a6", "parents": [ "35e173d7b87861f522422621b3eb2dc1778703e6" ], "author": { "name": "Bart Van Assche", "email": "bvanassche@acm.org", "time": "Mon Feb 23 14:00:25 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "wifi: wlcore: Fix a locking bug\n\n[ Upstream commit 72c6df8f284b3a49812ce2ac136727ace70acc7c ]\n\nMake sure that wl-\u003emutex is locked before it is unlocked. This has been\ndetected by the Clang thread-safety analyzer.\n\nFixes: 45aa7f071b06 (\"wlcore: Use generic runtime pm calls for wowlan elp configuration\")\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nLink: https://patch.msgid.link/20260223220102.2158611-26-bart.vanassche@linux.dev\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "35e173d7b87861f522422621b3eb2dc1778703e6", "tree": "3ae25f0a9bcdea6633dcadd17c07f00e20df5ded", "parents": [ "02973ef983cb6e3ba6c76e4b1227c804371a019c" ], "author": { "name": "Bart Van Assche", "email": "bvanassche@acm.org", "time": "Mon Feb 23 14:00:24 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "wifi: cw1200: Fix locking in error paths\n\n[ Upstream commit d98c24617a831e92e7224a07dcaed2dd0b02af96 ]\n\ncw1200_wow_suspend() must only return with priv-\u003econf_mutex locked if it\nreturns zero. This mutex must be unlocked if an error is returned. Add\nmutex_unlock() calls to the error paths from which that call is missing.\nThis has been detected by the Clang thread-safety analyzer.\n\nFixes: a910e4a94f69 (\"cw1200: add driver for the ST-E CW1100 \u0026 CW1200 WLAN chipsets\")\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nLink: https://patch.msgid.link/20260223220102.2158611-25-bart.vanassche@linux.dev\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "02973ef983cb6e3ba6c76e4b1227c804371a019c", "tree": "d964882458d6d1b0c14efa9de0f7fe457e846d1e", "parents": [ "4f3acd77273c65796306771077ba40b0cb95e4d4" ], "author": { "name": "Vimlesh Kumar", "email": "vimleshk@marvell.com", "time": "Fri Feb 27 09:14:00 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "octeon_ep_vf: avoid compiler and IQ/OQ reordering\n\n[ Upstream commit 6c73126ecd1080351b468fe43353b2f705487f44 ]\n\nUtilize READ_ONCE and WRITE_ONCE APIs for IO queue Tx/Rx\nvariable access to prevent compiler optimization and reordering.\nAdditionally, ensure IO queue OUT/IN_CNT registers are flushed\nby performing a read-back after writing.\n\nThe compiler could reorder reads/writes to pkts_pending, last_pkt_count,\netc., causing stale values to be used when calculating packets to process\nor register updates to send to hardware. The Octeon hardware requires a\nread-back after writing to OUT_CNT/IN_CNT registers to ensure the write\nhas been flushed through any posted write buffers before the interrupt\nresend bit is set. Without this, we have observed cases where the hardware\ndidn\u0027t properly update its internal state.\n\nwmb/rmb only provides ordering guarantees but doesn\u0027t prevent the compiler\nfrom performing optimizations like caching in registers, load tearing etc.\n\nFixes: 1cd3b407977c3 (\"octeon_ep_vf: add Tx/Rx processing and interrupt support\")\nSigned-off-by: Sathesh Edara \u003csedara@marvell.com\u003e\nSigned-off-by: Shinas Rasheed \u003csrasheed@marvell.com\u003e\nSigned-off-by: Vimlesh Kumar \u003cvimleshk@marvell.com\u003e\nLink: https://patch.msgid.link/20260227091402.1773833-5-vimleshk@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "4f3acd77273c65796306771077ba40b0cb95e4d4", "tree": "fda1385d4bac89f49ac274ede6b925e56efcf4ed", "parents": [ "496163a7292e6b8b8d6c9a403f94d64bd97543e1" ], "author": { "name": "Vimlesh Kumar", "email": "vimleshk@marvell.com", "time": "Fri Feb 27 09:13:59 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "octeon_ep_vf: Relocate counter updates before NAPI\n\n[ Upstream commit 2ae7d20fb24f598f60faa8f6ecc856dac782261a ]\n\nRelocate IQ/OQ IN/OUT_CNTS updates to occur before NAPI completion.\nMoving the IQ/OQ counter updates before napi_complete_done ensures\n1. Counter registers are updated before re-enabling interrupts.\n2. Prevents a race where new packets arrive but counters aren\u0027t properly\n synchronized.\n\nFixes: 1cd3b407977c3 (\"octeon_ep_vf: add Tx/Rx processing and interrupt support\")\nSigned-off-by: Sathesh Edara \u003csedara@marvell.com\u003e\nSigned-off-by: Shinas Rasheed \u003csrasheed@marvell.com\u003e\nSigned-off-by: Vimlesh Kumar \u003cvimleshk@marvell.com\u003e\nLink: https://patch.msgid.link/20260227091402.1773833-4-vimleshk@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "496163a7292e6b8b8d6c9a403f94d64bd97543e1", "tree": "acfcb522a4f7e156592a4af2e065a14ca87c606e", "parents": [ "799cc585326f25dd95f3deab6721e6bd785e2b36" ], "author": { "name": "Vimlesh Kumar", "email": "vimleshk@marvell.com", "time": "Fri Feb 27 09:13:58 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "octeon_ep: avoid compiler and IQ/OQ reordering\n\n[ Upstream commit 43b3160cb639079a15daeb5f080120afbfbfc918 ]\n\nUtilize READ_ONCE and WRITE_ONCE APIs for IO queue Tx/Rx\nvariable access to prevent compiler optimization and reordering.\nAdditionally, ensure IO queue OUT/IN_CNT registers are flushed\nby performing a read-back after writing.\n\nThe compiler could reorder reads/writes to pkts_pending, last_pkt_count,\netc., causing stale values to be used when calculating packets to process\nor register updates to send to hardware. The Octeon hardware requires a\nread-back after writing to OUT_CNT/IN_CNT registers to ensure the write\nhas been flushed through any posted write buffers before the interrupt\nresend bit is set. Without this, we have observed cases where the hardware\ndidn\u0027t properly update its internal state.\n\nwmb/rmb only provides ordering guarantees but doesn\u0027t prevent the compiler\nfrom performing optimizations like caching in registers, load tearing etc.\n\nFixes: 37d79d0596062 (\"octeon_ep: add Tx/Rx processing and interrupt support\")\nSigned-off-by: Sathesh Edara \u003csedara@marvell.com\u003e\nSigned-off-by: Shinas Rasheed \u003csrasheed@marvell.com\u003e\nSigned-off-by: Vimlesh Kumar \u003cvimleshk@marvell.com\u003e\nLink: https://patch.msgid.link/20260227091402.1773833-3-vimleshk@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "799cc585326f25dd95f3deab6721e6bd785e2b36", "tree": "0b1c6426c6efe277b55162284bf8ba58051bbfb6", "parents": [ "d36ad7e126c6a0c5f699583309ccc37e3a3263ea" ], "author": { "name": "Vimlesh Kumar", "email": "vimleshk@marvell.com", "time": "Fri Feb 27 09:13:57 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "octeon_ep: Relocate counter updates before NAPI\n\n[ Upstream commit 18c04a808c436d629d5812ce883e3822a5f5a47f ]\n\nRelocate IQ/OQ IN/OUT_CNTS updates to occur before NAPI completion,\nand replace napi_complete with napi_complete_done.\n\nMoving the IQ/OQ counter updates before napi_complete_done ensures\n1. Counter registers are updated before re-enabling interrupts.\n2. Prevents a race where new packets arrive but counters aren\u0027t properly\n synchronized.\nnapi_complete_done (vs napi_complete) allows for better\ninterrupt coalescing.\n\nFixes: 37d79d0596062 (\"octeon_ep: add Tx/Rx processing and interrupt support\")\nSigned-off-by: Sathesh Edara \u003csedara@marvell.com\u003e\nSigned-off-by: Shinas Rasheed \u003csrasheed@marvell.com\u003e\nSigned-off-by: Vimlesh Kumar \u003cvimleshk@marvell.com\u003e\nLink: https://patch.msgid.link/20260227091402.1773833-2-vimleshk@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "d36ad7e126c6a0c5f699583309ccc37e3a3263ea", "tree": "ce93e3b1fde96b112a25f74e4ee4a84ac04c245d", "parents": [ "fcb74331c483cdade3007fbe7bfbc60d152841c8" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Thu Feb 26 16:03:01 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:41 2026 +0100" }, "message": "bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded\n\n[ Upstream commit 479d589b40b836442bbdadc3fdb37f001bb67f26 ]\n\nbond_option_mode_set() already rejects mode changes that would make a\nloaded XDP program incompatible via bond_xdp_check(). However,\nbond_option_xmit_hash_policy_set() has no such guard.\n\nFor 802.3ad and balance-xor modes, bond_xdp_check() returns false when\nxmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually\nabsent due to hardware offload. This means a user can:\n\n1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode\n with a compatible xmit_hash_policy (e.g. layer2+3).\n2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.\n\nThis leaves bond-\u003exdp_prog set but bond_xdp_check() now returning false\nfor the same device. When the bond is later destroyed, dev_xdp_uninstall()\ncalls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits\nthe bond_xdp_check() guard and returns -EOPNOTSUPP, triggering:\n\nWARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL))\n\nFix this by rejecting xmit_hash_policy changes to vlan+srcmac when an\nXDP program is loaded on a bond in 802.3ad or balance-xor mode.\n\ncommit 39a0876d595b (\"net, bonding: Disallow vlan+srcmac with XDP\")\nintroduced bond_xdp_check() which returns false for 802.3ad/balance-xor\nmodes when xmit_hash_policy is vlan+srcmac. The check was wired into\nbond_xdp_set() to reject XDP attachment with an incompatible policy, but\nthe symmetric path -- preventing xmit_hash_policy from being changed to an\nincompatible value after XDP is already loaded -- was left unguarded in\nbond_option_xmit_hash_policy_set().\n\nNote:\ncommit 094ee6017ea0 (\"bonding: check xdp prog when set bond mode\")\nlater added a similar guard to bond_option_mode_set(), but\nbond_option_xmit_hash_policy_set() remained unprotected.\n\nReported-by: syzbot+5a287bcdc08104bc3132@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/6995aff6.050a0220.2eeac1.014e.GAE@google.com/T/\nFixes: 39a0876d595b (\"net, bonding: Disallow vlan+srcmac with XDP\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nLink: https://patch.msgid.link/20260226080306.98766-2-jiayuan.chen@linux.dev\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "fcb74331c483cdade3007fbe7bfbc60d152841c8", "tree": "8b91ae511f9247d10422f460e09232c7c9c4b189", "parents": [ "6c8d7984cb255eaee7549c3b770c111ae6b66596" ], "author": { "name": "Mieczyslaw Nalewaj", "email": "namiltd@yahoo.com", "time": "Sun Mar 01 18:13:14 2026 -0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value\n\n[ Upstream commit 7cbe98f7bef965241a5908d50d557008cf998aee ]\n\nFunction rtl8365mb_phy_ocp_write() always returns 0, even when an error\noccurs during register access. This patch fixes the return value to\npropagate the actual error code from regmap operations.\n\nLink: https://lore.kernel.org/netdev/a2dfde3c-d46f-434b-9d16-1e251e449068@yahoo.com/\nFixes: 2796728460b8 (\"net: dsa: realtek: rtl8365mb: serialize indirect PHY register access\")\nSigned-off-by: Mieczyslaw Nalewaj \u003cnamiltd@yahoo.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Luiz Angelo Daros de Luca \u003cluizluca@gmail.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20260301-realtek_namiltd_fix1-v1-1-43a6bb707f9c@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "6c8d7984cb255eaee7549c3b770c111ae6b66596", "tree": "0610d32bb381a731b61e65eaddfb5de5fbe4f8e7", "parents": [ "8891bffb532af056bea7d55c651f23abb0a1c06a" ], "author": { "name": "Shuvam Pandey", "email": "shuvampandey1@gmail.com", "time": "Thu Feb 26 21:14:10 2026 +0545" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "kunit: tool: copy caller args in run_kernel to prevent mutation\n\n[ Upstream commit 40804c4974b8df2adab72f6475d343eaff72b7f6 ]\n\nrun_kernel() appended KUnit flags directly to the caller-provided args\nlist. When exec_tests() calls run_kernel() repeatedly (e.g. with\n--run_isolated), each call mutated the same list, causing later runs\nto inherit stale filter_glob values and duplicate kunit.enable flags.\n\nFix this by copying args at the start of run_kernel(). Add a regression\ntest that calls run_kernel() twice with the same list and verifies the\noriginal remains unchanged.\n\nFixes: ff9e09a3762f (\"kunit: tool: support running each suite/test separately\")\nSigned-off-by: Shuvam Pandey \u003cshuvampandey1@gmail.com\u003e\nReviewed-by: David Gow \u003cdavid@davidgow.net\u003e\nSigned-off-by: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "8891bffb532af056bea7d55c651f23abb0a1c06a", "tree": "70b42b637e7ce2669d4bd5300af44c3cfe456c38", "parents": [ "1a42ea28e01b11a6d4247abe1512edb69bec2d19" ], "author": { "name": "Alexandre Courbot", "email": "acourbot@nvidia.com", "time": "Tue Feb 24 19:37:56 2026 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "rust: kunit: fix warning when !CONFIG_PRINTK\n\n[ Upstream commit 7dd34dfc8dfa92a7244242098110388367996ac3 ]\n\nIf `CONFIG_PRINTK` is not set, then the following warnings are issued\nduring build:\n\n warning: unused variable: `args`\n --\u003e ../rust/kernel/kunit.rs:16:12\n |\n 16 | pub fn err(args: fmt::Arguments\u003c\u0027_\u003e) {\n | ^^^^ help: if this is intentional, prefix it with an underscore: `_args`\n |\n \u003d note: `#[warn(unused_variables)]` (part of `#[warn(unused)]`) on by default\n\n warning: unused variable: `args`\n --\u003e ../rust/kernel/kunit.rs:32:13\n |\n 32 | pub fn info(args: fmt::Arguments\u003c\u0027_\u003e) {\n | ^^^^ help: if this is intentional, prefix it with an underscore: `_args`\n\nFix this by adding a no-op assignment using `args` when `CONFIG_PRINTK`\nis not set.\n\nFixes: a66d733da801 (\"rust: support running Rust documentation tests as KUnit ones\")\nSigned-off-by: Alexandre Courbot \u003cacourbot@nvidia.com\u003e\nReviewed-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nReviewed-by: David Gow \u003cdavid@davidgow.net\u003e\nSigned-off-by: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "1a42ea28e01b11a6d4247abe1512edb69bec2d19", "tree": "936f0cb5e8dbf38e6bb7b83da6f04139395ab6e0", "parents": [ "b64fbd718cf42feb75502bf25d0d16eb671aea45" ], "author": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jan 14 16:45:46 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "drm/xe: Do not preempt fence signaling CS instructions\n\n[ Upstream commit cdc8a1e11f4d5b480ec750e28010c357185b95a6 ]\n\nIf a batch buffer is complete, it makes little sense to preempt the\nfence signaling instructions in the ring, as the largest portion of the\nwork (the batch buffer) is already done and fence signaling consists of\nonly a few instructions. If these instructions are preempted, the GuC\nwould need to perform a context switch just to signal the fence, which\nis costly and delays fence signaling. Avoid this scenario by disabling\npreemption immediately after the BB start instruction and re-enabling it\nafter executing the fence signaling instructions.\n\nFixes: dd08ebf6c352 (\"drm/xe: Introduce a new DRM driver for Intel GPUs\")\nCc: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nCc: Carlos Santa \u003ccarlos.santa@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nLink: https://patch.msgid.link/20260115004546.58060-1-matthew.brost@intel.com\n(cherry picked from commit 2bcbf2dcde0c839a73af664a3c77d4e77d58a3eb)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "b64fbd718cf42feb75502bf25d0d16eb671aea45", "tree": "dc709aa7cf9ada4c2e8796ebfa265a3aad1b6bc4", "parents": [ "38063cc435b69d56e76f947c10d336fcb2953508" ], "author": { "name": "Sebastian Krzyszkowiak", "email": "sebastian.krzyszkowiak@puri.sm", "time": "Sat Feb 21 17:28:04 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "wifi: rsi: Don\u0027t default to -EOPNOTSUPP in rsi_mac80211_config\n\n[ Upstream commit d973b1039ccde6b241b438d53297edce4de45b5c ]\n\nThis triggers a WARN_ON in ieee80211_hw_conf_init and isn\u0027t the expected\nbehavior from the driver - other drivers default to 0 too.\n\nFixes: 0a44dfc07074 (\"wifi: mac80211: simplify non-chanctx drivers\")\nSigned-off-by: Sebastian Krzyszkowiak \u003csebastian.krzyszkowiak@puri.sm\u003e\nLink: https://patch.msgid.link/20260221-rsi-config-ret-v1-1-9a8f805e2f31@puri.sm\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "38063cc435b69d56e76f947c10d336fcb2953508", "tree": "501a980bf2ec3ff0ef5525475fd67e12ffeac9f8", "parents": [ "8bcf2d847adb82b2c617456f6da17ac5e6c75285" ], "author": { "name": "Alban Bedel", "email": "alban.bedel@lht.dlh.de", "time": "Mon Feb 09 15:47:05 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "can: mcp251x: fix deadlock in error path of mcp251x_open\n\n[ Upstream commit ab3f894de216f4a62adc3b57e9191888cbf26885 ]\n\nThe mcp251x_open() function call free_irq() in its error path with the\nmpc_lock mutex held. But if an interrupt already occurred the\ninterrupt handler will be waiting for the mpc_lock and free_irq() will\ndeadlock waiting for the handler to finish.\n\nThis issue is similar to the one fixed in commit 7dd9c26bd6cf (\"can:\nmcp251x: fix deadlock if an interrupt occurs during mcp251x_open\") but\nfor the error path.\n\nTo solve this issue move the call to free_irq() after the lock is\nreleased. Setting `priv-\u003eforce_quit \u003d 1` beforehand ensure that the IRQ\nhandler will exit right away once it acquired the lock.\n\nSigned-off-by: Alban Bedel \u003calban.bedel@lht.dlh.de\u003e\nLink: https://patch.msgid.link/20260209144706.2261954-1-alban.bedel@lht.dlh.de\nFixes: bf66f3736a94 (\"can: mcp251x: Move to threaded interrupts instead of workqueues.\")\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "8bcf2d847adb82b2c617456f6da17ac5e6c75285", "tree": "29c6b7fffea0a2ca9a4299e85a44342a73d8724e", "parents": [ "c8e57b713c17ddb52150b14b0808abd8bc3ce038" ], "author": { "name": "Oliver Hartkopp", "email": "socketcan@hartkopp.net", "time": "Wed Feb 18 11:58:06 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "can: bcm: fix locking for bcm_op runtime updates\n\n[ Upstream commit c35636e91e392e1540949bbc67932167cb48bc3a ]\n\nCommit c2aba69d0c36 (\"can: bcm: add locking for bcm_op runtime updates\")\nadded a locking for some variables that can be modified at runtime when\nupdating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().\n\nUsually the RX_SETUP only handles and filters incoming traffic with one\nexception: When the RX_RTR_FRAME flag is set a predefined CAN frame is\nsent when a specific RTR frame is received. Therefore the rx bcm_op uses\nbcm_can_tx() which uses the bcm_tx_lock that was only initialized in\nbcm_tx_setup(). Add the missing spin_lock_init() when allocating the\nbcm_op in bcm_rx_setup() to handle the RTR case properly.\n\nFixes: c2aba69d0c36 (\"can: bcm: add locking for bcm_op runtime updates\")\nReported-by: syzbot+5b11eccc403dd1cea9f8@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/linux-can/699466e4.a70a0220.2c38d7.00ff.GAE@google.com/\nSigned-off-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nLink: https://patch.msgid.link/20260218-bcm_spin_lock_init-v1-1-592634c8a5b5@hartkopp.net\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "c8e57b713c17ddb52150b14b0808abd8bc3ce038", "tree": "de981d93110a9fbcebe8d688255a0fe78dfae79e", "parents": [ "ff4d5a3e77f7be94d3b87377a81d41704e936ba8" ], "author": { "name": "Raju Rangoju", "email": "Raju.Rangoju@amd.com", "time": "Thu Feb 26 22:37:53 2026 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:40 2026 +0100" }, "message": "amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds\n\n[ Upstream commit 9439a661c2e80485406ce2c90b107ca17858382d ]\n\nExtend the MAC_TCR_SS (Speed Select) register field width from 2 bits\nto 3 bits to properly support all speed settings.\n\nThe MAC_TCR register\u0027s SS field encoding requires 3 bits to represent\nall supported speeds:\n - 0x00: 10Gbps (XGMII)\n - 0x02: 2.5Gbps (GMII) / 100Mbps\n - 0x03: 1Gbps / 10Mbps\n - 0x06: 2.5Gbps (XGMII) - P100a only\n\nWith only 2 bits, values 0x04-0x07 cannot be represented, which breaks\n2.5G XGMII mode on newer platforms and causes incorrect speed select\nvalues to be programmed.\n\nFixes: 07445f3c7ca1 (\"amd-xgbe: Add support for 10 Mbps speed\")\nCo-developed-by: Guruvendra Punugupati \u003cGuruvendra.Punugupati@amd.com\u003e\nSigned-off-by: Guruvendra Punugupati \u003cGuruvendra.Punugupati@amd.com\u003e\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260226170753.250312-1-Raju.Rangoju@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "ff4d5a3e77f7be94d3b87377a81d41704e936ba8", "tree": "2428be9324d1ba8e19b19c907b5a47d74ebdea78", "parents": [ "2d9f57ea29a1f1772373b98a509b44d49fda609e" ], "author": { "name": "MD Danish Anwar", "email": "danishanwar@ti.com", "time": "Thu Feb 26 15:53:56 2026 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:39 2026 +0100" }, "message": "net: ti: icssg-prueth: Fix ping failure after offload mode setup when link speed is not 1G\n\n[ Upstream commit 147792c395db870756a0dc87ce656c75ae7ab7e8 ]\n\nWhen both eth interfaces with links up are added to a bridge or hsr\ninterface, ping fails if the link speed is not 1Gbps (e.g., 100Mbps).\n\nThe issue is seen because when switching to offload (bridge/hsr) mode,\nprueth_emac_restart() restarts the firmware and clears DRAM with\nmemset_io(), setting all memory to 0. This includes PORT_LINK_SPEED_OFFSET\nwhich firmware reads for link speed. The value 0 corresponds to\nFW_LINK_SPEED_1G (0x00), so for 1Gbps links the default value is correct\nand ping works. For 100Mbps links, the firmware needs FW_LINK_SPEED_100M\n(0x01) but gets 0 instead, causing ping to fail. The function\nemac_adjust_link() is called to reconfigure, but it detects no state change\n(emac-\u003elink is still 1, speed/duplex match PHY) so new_state remains false\nand icssg_config_set_speed() is never called to correct the firmware speed\nvalue.\n\nThe fix resets emac-\u003elink to 0 before calling emac_adjust_link() in\nprueth_emac_common_start(). This forces new_state\u003dtrue, ensuring\nicssg_config_set_speed() is called to write the correct speed value to\nfirmware memory.\n\nFixes: 06feac15406f (\"net: ti: icssg-prueth: Fix emac link speed handling\")\nSigned-off-by: MD Danish Anwar \u003cdanishanwar@ti.com\u003e\nLink: https://patch.msgid.link/20260226102356.2141871-1-danishanwar@ti.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "2d9f57ea29a1f1772373b98a509b44d49fda609e", "tree": "c5a659e7e626cdc5947c2e7dd12c88611cd0f2c8", "parents": [ "fa4412cdc5178a48799bafcb8af28fd2fbf3d703" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Wed Feb 25 20:32:40 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:39 2026 +0100" }, "message": "atm: lec: fix null-ptr-deref in lec_arp_clear_vccs\n\n[ Upstream commit 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb ]\n\nsyzkaller reported a null-ptr-deref in lec_arp_clear_vccs().\nThis issue can be easily reproduced using the syzkaller reproducer.\n\nIn the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by\nmultiple lec_arp_table entries (e.g., via entry-\u003evcc or entry-\u003erecv_vcc).\nWhen the underlying VCC is closed, lec_vcc_close() iterates over all\nARP entries and calls lec_arp_clear_vccs() for each matched entry.\n\nFor example, when lec_vcc_close() iterates through the hlists in\npriv-\u003elec_arp_empty_ones or other ARP tables:\n\n1. In the first iteration, for the first matched ARP entry sharing the VCC,\nlec_arp_clear_vccs() frees the associated vpriv (which is vcc-\u003euser_back)\nand sets vcc-\u003euser_back to NULL.\n2. In the second iteration, for the next matched ARP entry sharing the same\nVCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from\nvcc-\u003euser_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it\nvia `vcc-\u003epop \u003d vpriv-\u003eold_pop`, leading to a null-ptr-deref crash.\n\nFix this by adding a null check for vpriv before dereferencing\nit. If vpriv is already NULL, it means the VCC has been cleared\nby a previous call, so we can safely skip the cleanup and just\nclear the entry\u0027s vcc/recv_vcc pointers.\n\nThe entire cleanup block (including vcc_release_async()) is placed inside\nthe vpriv guard because a NULL vpriv indicates the VCC has already been\nfully released by a prior iteration — repeating the teardown would\nredundantly set flags and trigger callbacks on an already-closing socket.\n\nThe Fixes tag points to the initial commit because the entry-\u003evcc path has\nbeen vulnerable since the original code. The entry-\u003erecv_vcc path was later\nadded by commit 8d9f73c0ad2f (\"atm: fix a memory leak of vcc-\u003euser_back\")\nwith the same pattern, and both paths are fixed here.\n\nReported-by: syzbot+72e3ea390c305de0e259@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/68c95a83.050a0220.3c6139.0e5c.GAE@google.com/T/\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSuggested-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nLink: https://patch.msgid.link/20260225123250.189289-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "fa4412cdc5178a48799bafcb8af28fd2fbf3d703", "tree": "0797d7b0416b1b56663ac0f7a58e6843cf5e546c", "parents": [ "3f2793713c13effea1e383e4caab3a63fc961e1e" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Feb 26 21:58:12 2026 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Mar 13 17:20:39 2026 +0100" }, "message": "dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler\n\n[ Upstream commit 74badb9c20b1a9c02a95c735c6d3cd6121679c93 ]\n\nCommit 31a7a0bbeb00 (\"dpaa2-switch: add bounds check for if_id in IRQ\nhandler\") introduces a range check for if_id to avoid an out-of-bounds\naccess. If an out-of-bounds if_id is detected, the interrupt status is\nnot cleared. This may result in an interrupt storm.\n\nClear the interrupt status after detecting an out-of-bounds if_id to avoid\nthe problem.\n\nFound by an experimental AI code review agent at Google.\n\nFixes: 31a7a0bbeb00 (\"dpaa2-switch: add bounds check for if_id in IRQ handler\")\nCc: Junrui Luo \u003cmoonafterrain@outlook.com\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nReviewed-by: Ioana Ciornei \u003cioana.ciornei@nxp.com\u003e\nLink: https://patch.msgid.link/20260227055812.1777915-1-linux@roeck-us.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" } ], "next": "3f2793713c13effea1e383e4caab3a63fc961e1e" }