diff --git a/.gitignore b/.gitignore index b0432edb5..1a277e8da 100644 --- a/.gitignore +++ b/.gitignore @@ -1,10 +1,12 @@ fedoraimaca.x509 -kernel-abi-stablelists-6.12.0-211.7.1.el10_2.tar.xz -kernel-kabi-dw-6.12.0-211.7.1.el10_2.tar.xz -linux-6.12.0-211.7.1.el10_2.tar.xz +kernel-abi-stablelists-6.12.0-211.34.1.el10_2.tar.xz +kernel-kabi-dw-6.12.0-211.34.1.el10_2.tar.xz +linux-6.12.0-211.34.1.el10_2.tar.xz nvidiabfdpu.x509 nvidiagpuoot001.x509 nvidiajetsonsoc.x509 +olima1.x509 +olimaca1.x509 redhatsecureboot501.cer redhatsecureboot504.cer redhatsecurebootca5.cer diff --git a/1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch b/1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch deleted file mode 100644 index 4fbab3c28..000000000 --- a/1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 3da1fdf4efbc490041eb4f836bf596201203f8f2 Mon Sep 17 00:00:00 2001 -From: Asim Viladi Oglu Manizada -Date: Sat, 16 May 2026 21:15:39 +0000 -Subject: smb: client: reject userspace cifs.spnego descriptions - -cifs.spnego key descriptions contain authority-bearing fields such as -pid, uid, creduid, and upcall_target that cifs.upcall treats as -kernel-originating inputs. However, userspace can also create keys of -this type through request_key(2) or add_key(2), allowing those fields to -be supplied without CIFS origin. - -Only accept cifs.spnego descriptions while CIFS is using its private -spnego_cred to request the key. - -Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") -Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix -Reviewed-by: David Howells -Signed-off-by: Asim Viladi Oglu Manizada -Signed-off-by: Steve French ---- - fs/smb/client/cifs_spnego.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c -index 3a41bbada04c76..44c40727568042 100644 ---- a/fs/smb/client/cifs_spnego.c -+++ b/fs/smb/client/cifs_spnego.c -@@ -8,6 +8,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -40,12 +41,27 @@ cifs_spnego_key_destroy(struct key *key) - kfree(key->payload.data[0]); - } - -+static int -+cifs_spnego_key_vet_description(const char *description) -+{ -+ /* -+ * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. -+ * They are only valid when produced by CIFS while using the private -+ * spnego_cred installed below. Do not let userspace create this type -+ * of key through request_key(2)/add_key(2), since the helper treats -+ * pid/uid/creduid/upcall_target as kernel-originating fields. -+ */ -+ if (current_cred() != spnego_cred) -+ return -EPERM; -+ return 0; -+} - - /* - * keytype for CIFS spnego keys - */ - struct key_type cifs_spnego_key_type = { - .name = "cifs.spnego", -+ .vet_description = cifs_spnego_key_vet_description, - .instantiate = cifs_spnego_key_instantiate, - .destroy = cifs_spnego_key_destroy, - .describe = user_describe, --- -cgit 1.3-korg - diff --git a/1106-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch b/1106-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch deleted file mode 100644 index 0d5c8fe86..000000000 --- a/1106-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch +++ /dev/null @@ -1,89 +0,0 @@ -From ff57186b2cc39766672c4c0332323933e5faaa88 Mon Sep 17 00:00:00 2001 -From: William Liu -Date: Tue, 19 Aug 2025 03:36:28 +0000 -Subject: [PATCH] net/sched: Make cake_enqueue return NET_XMIT_CN when past - buffer_limit -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -[ Upstream commit 15de71d06a400f7fdc15bf377a2552b0ec437cf5 ] - -The following setup can trigger a WARNING in htb_activate due to -the condition: !cl->leaf.q->q.qlen - -tc qdisc del dev lo root -tc qdisc add dev lo root handle 1: htb default 1 -tc class add dev lo parent 1: classid 1:1 \ - htb rate 64bit -tc qdisc add dev lo parent 1:1 handle f: \ - cake memlimit 1b -ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 - -This is because the low memlimit leads to a low buffer_limit, which -causes packet dropping. However, cake_enqueue still returns -NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an -empty child qdisc. We should return NET_XMIT_CN when packets are -dropped from the same tin and flow. - -I do not believe return value of NET_XMIT_CN is necessary for packet -drops in the case of ack filtering, as that is meant to optimize -performance, not to signal congestion. - -Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") -Signed-off-by: William Liu -Reviewed-by: Savino Dicanosa -Acked-by: Toke Høiland-Jørgensen -Reviewed-by: Jamal Hadi Salim -Link: https://patch.msgid.link/20250819033601.579821-1-will@willsroot.io -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c -index 2c2e2a67f3b2..6cbe8a7a0e5c 100644 ---- a/net/sched/sch_cake.c -+++ b/net/sched/sch_cake.c -@@ -1745,7 +1745,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - ktime_t now = ktime_get(); - struct cake_tin_data *b; - struct cake_flow *flow; -- u32 idx; -+ u32 idx, tin; - - /* choose flow to insert into */ - idx = cake_classify(sch, &b, skb, q->flow_mode, &ret); -@@ -1755,6 +1755,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - __qdisc_drop(skb, to_free); - return ret; - } -+ tin = (u32)(b - q->tins); - idx--; - flow = &b->flows[idx]; - -@@ -1922,13 +1923,22 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - q->buffer_max_used = q->buffer_used; - - if (q->buffer_used > q->buffer_limit) { -+ bool same_flow = false; - u32 dropped = 0; -+ u32 drop_id; - - while (q->buffer_used > q->buffer_limit) { - dropped++; -- cake_drop(sch, to_free); -+ drop_id = cake_drop(sch, to_free); -+ -+ if ((drop_id >> 16) == tin && -+ (drop_id & 0xFFFF) == idx) -+ same_flow = true; - } - b->drop_overlimit += dropped; -+ -+ if (same_flow) -+ return NET_XMIT_CN; - } - return NET_XMIT_SUCCESS; - } --- -2.50.1 (Apple Git-155) - diff --git a/1107-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch b/1107-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch deleted file mode 100644 index c4e8cd5eb..000000000 --- a/1107-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch +++ /dev/null @@ -1,118 +0,0 @@ - -diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c -index aa9f31e..ef51a9e 100644 ---- a/net/sched/sch_cake.c -+++ b/net/sched/sch_cake.c -@@ -1594,7 +1594,6 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free) - - qdisc_drop_reason(skb, sch, to_free, SKB_DROP_REASON_QDISC_OVERLIMIT); - sch->q.qlen--; -- qdisc_tree_reduce_backlog(sch, 1, len); - - cake_heapify(q, 0); - -@@ -1740,14 +1739,14 @@ static void cake_reconfigure(struct Qdisc *sch); - static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - struct sk_buff **to_free) - { -+ u32 idx, tin, prev_qlen, prev_backlog, drop_id; - struct cake_sched_data *q = qdisc_priv(sch); -- int len = qdisc_pkt_len(skb); -- int ret; -+ int len = qdisc_pkt_len(skb), ret; - struct sk_buff *ack = NULL; - ktime_t now = ktime_get(); - struct cake_tin_data *b; - struct cake_flow *flow; -- u32 idx, tin; -+ bool same_flow = false; - - /* choose flow to insert into */ - idx = cake_classify(sch, &b, skb, q->flow_mode, &ret); -@@ -1820,6 +1819,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - consume_skb(skb); - } else { - /* not splitting */ -+ int ack_pkt_len = 0; -+ - cobalt_set_enqueue_time(skb, now); - get_cobalt_cb(skb)->adjusted_len = cake_overhead(q, skb); - flow_queue_add(flow, skb); -@@ -1830,13 +1831,13 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - if (ack) { - b->ack_drops++; - sch->qstats.drops++; -- b->bytes += qdisc_pkt_len(ack); -- len -= qdisc_pkt_len(ack); -+ ack_pkt_len = qdisc_pkt_len(ack); -+ b->bytes += ack_pkt_len; - q->buffer_used += skb->truesize - ack->truesize; - if (q->rate_flags & CAKE_FLAG_INGRESS) - cake_advance_shaper(q, b, ack, now, true); - -- qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(ack)); -+ qdisc_tree_reduce_backlog(sch, 1, ack_pkt_len); - consume_skb(ack); - } else { - sch->q.qlen++; -@@ -1845,11 +1846,11 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - - /* stats */ - b->packets++; -- b->bytes += len; -- b->backlogs[idx] += len; -- b->tin_backlog += len; -- sch->qstats.backlog += len; -- q->avg_window_bytes += len; -+ b->bytes += len - ack_pkt_len; -+ b->backlogs[idx] += len - ack_pkt_len; -+ b->tin_backlog += len - ack_pkt_len; -+ sch->qstats.backlog += len - ack_pkt_len; -+ q->avg_window_bytes += len - ack_pkt_len; - } - - if (q->overflow_timeout) -@@ -1924,24 +1925,29 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - if (q->buffer_used > q->buffer_max_used) - q->buffer_max_used = q->buffer_used; - -- if (q->buffer_used > q->buffer_limit) { -- bool same_flow = false; -- u32 dropped = 0; -- u32 drop_id; -+ if (q->buffer_used <= q->buffer_limit) -+ return NET_XMIT_SUCCESS; - -- while (q->buffer_used > q->buffer_limit) { -- dropped++; -- drop_id = cake_drop(sch, to_free); -+ prev_qlen = sch->q.qlen; -+ prev_backlog = sch->qstats.backlog; - -- if ((drop_id >> 16) == tin && -- (drop_id & 0xFFFF) == idx) -- same_flow = true; -- } -- b->drop_overlimit += dropped; -+ while (q->buffer_used > q->buffer_limit) { -+ drop_id = cake_drop(sch, to_free); -+ if ((drop_id >> 16) == tin && -+ (drop_id & 0xFFFF) == idx) -+ same_flow = true; -+ } -+ -+ prev_qlen -= sch->q.qlen; -+ prev_backlog -= sch->qstats.backlog; -+ b->drop_overlimit += prev_qlen; - -- if (same_flow) -- return NET_XMIT_CN; -+ if (same_flow) { -+ qdisc_tree_reduce_backlog(sch, prev_qlen - 1, -+ prev_backlog - len); -+ return NET_XMIT_CN; - } -+ qdisc_tree_reduce_backlog(sch, prev_qlen, prev_backlog); - return NET_XMIT_SUCCESS; - } - diff --git a/1108-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch b/1108-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch deleted file mode 100644 index 12594b420..000000000 --- a/1108-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch +++ /dev/null @@ -1,61 +0,0 @@ -From cd7786466db3f8e0004e2383a066b3c805643196 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Fri, 8 Aug 2025 15:41:46 -0700 -Subject: [PATCH] RDMA/bnxt_re: Support extended stats for Thor2 VF - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit 260ce16e579d375ba8f1ac945308343522f98d50 -Author: Ajit Khaparde -Date: Fri May 23 13:29:52 2025 +0530 - - RDMA/bnxt_re: Support extended stats for Thor2 VF - - The driver currently checks if the user is querying VF RoCE statistics. - It will not send the query_roce_stats_ext HWRM command if it is for a - VF. But Thor2 VF can support extended statistics. - Allow query of extended stats for Thor2 VFs. - - Signed-off-by: Ajit Khaparde - Signed-off-by: Shravya KN - Link: https://patch.msgid.link/20250523075952.1267827-1-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Damodharam Ammepalli - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index 457eecb99f96..be34c605d516 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -1113,7 +1113,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - qp_flags |= CMDQ_CREATE_QP_QP_FLAGS_FORCE_COMPLETION; - if (qp->wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE) - qp_flags |= CMDQ_CREATE_QP_QP_FLAGS_VARIABLE_SIZED_WQE_ENABLED; -- if (_is_ext_stats_supported(res->dattr->dev_cap_flags) && !res->is_vf) -+ if (bnxt_ext_stats_supported(res->cctx, res->dattr->dev_cap_flags, res->is_vf)) - qp_flags |= CMDQ_CREATE_QP_QP_FLAGS_EXT_STATS_ENABLED; - - req.qp_flags = cpu_to_le32(qp_flags); -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -index f231e886ad9d..9efd32a3dc55 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -@@ -846,7 +846,12 @@ int bnxt_qplib_qext_stat(struct bnxt_qplib_rcfw *rcfw, u32 fid, - - req.resp_size = sbuf.size / BNXT_QPLIB_CMDQE_UNITS; - req.resp_addr = cpu_to_le64(sbuf.dma_addr); -- req.function_id = cpu_to_le32(fid); -+ if (bnxt_qplib_is_chip_gen_p7(rcfw->res->cctx) && rcfw->res->is_vf) -+ req.function_id = -+ cpu_to_le32(CMDQ_QUERY_ROCE_STATS_EXT_VF_VALID | -+ (fid << CMDQ_QUERY_ROCE_STATS_EXT_VF_NUM_SFT)); -+ else -+ req.function_id = cpu_to_le32(fid); - req.flags = cpu_to_le16(CMDQ_QUERY_ROCE_STATS_EXT_FLAGS_FUNCTION_ID); - - bnxt_qplib_fill_cmdqmsg(&msg, &req, &resp, &sbuf, sizeof(req), --- -2.50.1 (Apple Git-155) - diff --git a/1109-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch b/1109-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch deleted file mode 100644 index 9918d978d..000000000 --- a/1109-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch +++ /dev/null @@ -1,41 +0,0 @@ -From b66389e5f1dea3e149fdf089036021e5ab3fc52d Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Fri, 8 Aug 2025 15:43:05 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix size of uverbs_copy_to() in - BNXT_RE_METHOD_GET_TOGGLE_MEM - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit 09d231ab569ca97478445ccc1ad44ab026de39b1 -Author: Kalesh AP -Date: Fri Jul 4 10:08:55 2025 +0530 - - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM - - Since both "length" and "offset" are of type u32, there is - no functional issue here. - - Reviewed-by: Saravanan Vajravel - Signed-off-by: Shravya KN - Signed-off-by: Kalesh AP - Link: https://patch.msgid.link/20250704043857.19158-2-kalesh-anakkur.purayil@broadcom.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index 063801384b2b..3a627acb82ce 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -4738,7 +4738,7 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD_GET_TOGGLE_MEM)(struct uverbs_attr_bund - return err; - - err = uverbs_copy_to(attrs, BNXT_RE_TOGGLE_MEM_MMAP_OFFSET, -- &offset, sizeof(length)); -+ &offset, sizeof(offset)); - if (err) - return err; - --- -2.50.1 (Apple Git-155) - diff --git a/1110-rdma-bnxt-re-support-2g-message-size.patch b/1110-rdma-bnxt-re-support-2g-message-size.patch deleted file mode 100644 index 29aa83175..000000000 --- a/1110-rdma-bnxt-re-support-2g-message-size.patch +++ /dev/null @@ -1,127 +0,0 @@ -From 36c9223728944bf2e60709bd6c233c9bc0d1b56e Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Fri, 8 Aug 2025 15:43:19 -0700 -Subject: [PATCH] RDMA/bnxt_re: Support 2G message size - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit 0aed817380d620987b2d5c573fdd2f01c30976a4 -Author: Selvin Xavier -Date: Fri Jul 4 10:08:56 2025 +0530 - - RDMA/bnxt_re: Support 2G message size - - bnxt_qplib_put_sges is calculating the length in - a signed int. So handling the 2G message size - is not working since it is considered as negative. - - Use a unsigned number to calculate the total message - length. As per the spec, IB message size shall be - between zero and 2^31 bytes (inclusive). So adding - a check for 2G message size. - - Signed-off-by: Selvin Xavier - Signed-off-by: Shravya KN - Link: https://patch.msgid.link/20250704043857.19158-3-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Saravanan Vajravel - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index be34c605d516..dfe3177123e5 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -1750,9 +1750,9 @@ static void bnxt_qplib_fill_psn_search(struct bnxt_qplib_qp *qp, - } - } - --static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, -- struct bnxt_qplib_swqe *wqe, -- u16 *idx) -+static unsigned int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, -+ struct bnxt_qplib_swqe *wqe, -+ u32 *idx) - { - struct bnxt_qplib_hwq *hwq; - int len, t_len, offt; -@@ -1769,7 +1769,7 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, - il_src = (void *)wqe->sg_list[indx].addr; - t_len += len; - if (t_len > qp->max_inline_data) -- return -ENOMEM; -+ return BNXT_RE_INVAL_MSG_SIZE; - while (len) { - if (pull_dst) { - pull_dst = false; -@@ -1795,9 +1795,9 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, - return t_len; - } - --static u32 bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq, -- struct bnxt_qplib_sge *ssge, -- u16 nsge, u16 *idx) -+static unsigned int bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq, -+ struct bnxt_qplib_sge *ssge, -+ u32 nsge, u32 *idx) - { - struct sq_sge *dsge; - int indx, len = 0; -@@ -1878,14 +1878,12 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, - struct bnxt_qplib_hwq *hwq; - struct bnxt_qplib_swq *swq; - bool sch_handler = false; -+ u32 wqe_idx, slots, idx; - u16 wqe_sz, qdf = 0; - bool msn_update; - void *base_hdr; - void *ext_hdr; - __le32 temp32; -- u32 wqe_idx; -- u32 slots; -- u16 idx; - - hwq = &sq->hwq; - if (qp->state != CMDQ_MODIFY_QP_NEW_STATE_RTS && -@@ -1937,8 +1935,10 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, - else - data_len = bnxt_qplib_put_sges(hwq, wqe->sg_list, wqe->num_sge, - &idx); -- if (data_len < 0) -- goto queue_err; -+ if (data_len > BNXT_RE_MAX_MSG_SIZE) { -+ rc = -EINVAL; -+ goto done; -+ } - /* Make sure we update MSN table only for wired wqes */ - msn_update = true; - /* Specifics */ -@@ -2139,8 +2139,8 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp, - struct bnxt_qplib_hwq *hwq; - struct bnxt_qplib_swq *swq; - bool sch_handler = false; -- u16 wqe_sz, idx; -- u32 wqe_idx; -+ u32 wqe_idx, idx; -+ u16 wqe_sz; - int rc = 0; - - hwq = &rq->hwq; -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -index 0d9487c889ff..ab125f1d949e 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -@@ -346,6 +346,9 @@ struct bnxt_qplib_qp { - u8 tos_dscp; - }; - -+#define BNXT_RE_MAX_MSG_SIZE 0x80000000 -+#define BNXT_RE_INVAL_MSG_SIZE 0xFFFFFFFF -+ - #define BNXT_QPLIB_MAX_CQE_ENTRY_SIZE sizeof(struct cq_base) - - #define CQE_CNT_PER_PG (PAGE_SIZE / BNXT_QPLIB_MAX_CQE_ENTRY_SIZE) --- -2.50.1 (Apple Git-155) - diff --git a/1111-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch b/1111-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch deleted file mode 100644 index 9c2cd36e6..000000000 --- a/1111-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch +++ /dev/null @@ -1,53 +0,0 @@ -From c610161ea1b9940dbfa17cbab72bf8c945145dea Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Fri, 8 Aug 2025 15:43:30 -0700 -Subject: [PATCH] RDMA/bnxt_re: Use macro instead of hard coded value - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit 7788278ff267f831bab39a377beaa7e08d79c2a9 -Author: Kalesh AP -Date: Fri Jul 4 10:08:57 2025 +0530 - - RDMA/bnxt_re: Use macro instead of hard coded value - - 1. Defined a macro for the hard coded value. - 2. "access" field in the request structure is of type "u8". - Updated the mask accordingly. - - Signed-off-by: Kalesh AP - Signed-off-by: Shravya KN - Link: https://patch.msgid.link/20250704043857.19158-4-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Hongguang Gao - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -index 9efd32a3dc55..68981399598d 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -@@ -674,7 +674,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr, - req.log2_pbl_pg_size = cpu_to_le16(((ilog2(PAGE_SIZE) << - CMDQ_REGISTER_MR_LOG2_PBL_PG_SIZE_SFT) & - CMDQ_REGISTER_MR_LOG2_PBL_PG_SIZE_MASK)); -- req.access = (mr->access_flags & 0xFFFF); -+ req.access = (mr->access_flags & BNXT_QPLIB_MR_ACCESS_MASK); - req.va = cpu_to_le64(mr->va); - req.key = cpu_to_le32(mr->lkey); - if (_is_alloc_mr_unified(res->dattr->dev_cap_flags)) -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h -index e626b05038a1..09faf4a1e849 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h -@@ -111,6 +111,7 @@ struct bnxt_qplib_mrw { - struct bnxt_qplib_pd *pd; - int type; - u32 access_flags; -+#define BNXT_QPLIB_MR_ACCESS_MASK 0xFF - #define BNXT_QPLIB_FR_PMR 0x80000000 - u32 lkey; - u32 rkey; --- -2.50.1 (Apple Git-155) - diff --git a/1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch b/1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch deleted file mode 100644 index e50020f62..000000000 --- a/1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 57b1289801efb0d9e4c93131706522d79aee7fe3 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 13:02:23 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix incorrect display of inactivity_cp in - debugfs output - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit 58d7a965bb2b014d467445d38cdb07099b1f0f77 -Author: Gautam R A -Date: Tue May 20 09:29:07 2025 +0530 - - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output - - The inactivity_cp parameter in debugfs was not being read or - written correctly, resulting in "Invalid argument" errors. - - Fixed this by ensuring proper mapping of inactivity_cp in - both the map_cc_config_offset_gen0_ext0 and - bnxt_re_fill_gen0_ext0() functions. - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Signed-off-by: Gautam R A - Link: https://patch.msgid.link/20250520035910.1061918-2-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index af91d16c3c77..a3aad6c3dbec 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -170,6 +170,9 @@ static int map_cc_config_offset_gen0_ext0(u32 offset, struct bnxt_qplib_cc_param - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TCP_CP: - *val = ccparam->tcp_cp; - break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INACTIVITY_CP: -+ *val = ccparam->inact_th; -+ break; - default: - return -EINVAL; - } -@@ -247,7 +250,9 @@ static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offs - ccparam->tcp_cp = val; - break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TX_QUEUE: -+ break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INACTIVITY_CP: -+ ccparam->inact_th = val; - break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TIME_PER_PHASE: - ccparam->time_pph = val; --- -2.50.1 (Apple Git-155) - diff --git a/1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch b/1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch deleted file mode 100644 index 56bf37942..000000000 --- a/1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 5cda728320e19c716ddf48cd704360d164af5775 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:10:02 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix missing error handling for tx_queue - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit e3d57a00d4d1f36689e9eab80b60d5024361efec -Author: Gautam R A -Date: Tue May 20 09:29:08 2025 +0530 - - RDMA/bnxt_re: Fix missing error handling for tx_queue - - bnxt_re_fill_gen0_ext0() did not return an error when - attempting to modify CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TX_QUEUE, - leading to silent failures. - - Fixed this by returning -EOPNOTSUPP for tx_queue modifications and - ensuring proper error propagation in bnxt_re_configure_cc(). - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Signed-off-by: Gautam R A - Link: https://patch.msgid.link/20250520035910.1061918-3-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index a3aad6c3dbec..9f6392155d91 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -206,7 +206,7 @@ static ssize_t bnxt_re_cc_config_get(struct file *filp, char __user *buffer, - return simple_read_from_buffer(buffer, usr_buf_len, ppos, (u8 *)(buf), rc); - } - --static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offset, u32 val) -+static int bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offset, u32 val) - { - u32 modify_mask; - -@@ -250,7 +250,7 @@ static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offs - ccparam->tcp_cp = val; - break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TX_QUEUE: -- break; -+ return -EOPNOTSUPP; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INACTIVITY_CP: - ccparam->inact_th = val; - break; -@@ -263,18 +263,21 @@ static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offs - } - - ccparam->mask = modify_mask; -+ return 0; - } - - static int bnxt_re_configure_cc(struct bnxt_re_dev *rdev, u32 gen_ext, u32 offset, u32 val) - { - struct bnxt_qplib_cc_param ccparam = { }; -+ int rc; - -- /* Supporting only Gen 0 now */ -- if (gen_ext == CC_CONFIG_GEN0_EXT0) -- bnxt_re_fill_gen0_ext0(&ccparam, offset, val); -- else -+ if (gen_ext != CC_CONFIG_GEN0_EXT0) - return -EINVAL; - -+ rc = bnxt_re_fill_gen0_ext0(&ccparam, offset, val); -+ if (rc) -+ return rc; -+ - bnxt_qplib_modify_cc(&rdev->qplib_res, &ccparam); - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch b/1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch deleted file mode 100644 index 3ae40496d..000000000 --- a/1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 7e413faf8726503ba29dc3c9985c2a51b4d39c17 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 15:24:51 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit 990b5c07f677a0b633b41130a70771337c18343e -Author: Kalesh AP -Date: Tue May 20 09:29:09 2025 +0530 - - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc - - Driver currently supports modifying GEN0_EXT0 CC parameters - through debugfs hook. - - Fixed to return -EOPNOTSUPP instead of -EINVAL in bnxt_re_configure_cc() - when the user tries to modify any other CC parameters. - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Signed-off-by: Kalesh AP - Link: https://patch.msgid.link/20250520035910.1061918-4-kalesh-anakkur.purayil@broadcom.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index 9f6392155d91..e632f1661b92 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -272,7 +272,7 @@ static int bnxt_re_configure_cc(struct bnxt_re_dev *rdev, u32 gen_ext, u32 offse - int rc; - - if (gen_ext != CC_CONFIG_GEN0_EXT0) -- return -EINVAL; -+ return -EOPNOTSUPP; - - rc = bnxt_re_fill_gen0_ext0(&ccparam, offset, val); - if (rc) --- -2.50.1 (Apple Git-155) - diff --git a/1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch b/1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch deleted file mode 100644 index c1f244e7c..000000000 --- a/1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 158c90165846bc756b86c514a97a233dc40b6724 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:11:52 -0700 -Subject: [PATCH] RDMA/bnxt_re: convert timeouts to secs_to_jiffies() - -JIRA: https://issues.redhat.com/browse/RHEL-108694 - -commit f873136416293b786e7611d36226c9f5a8f6d20b -Author: Easwar Hariharan -Date: Tue Feb 25 20:17:30 2025 +0000 - - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() - - Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced - secs_to_jiffies(). As the value here is a multiple of 1000, use - secs_to_jiffies() instead of msecs_to_jiffies() to avoid the - multiplication - - This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with - the following Coccinelle rules: - - @depends on patch@ - expression E; - @@ - - -msecs_to_jiffies - +secs_to_jiffies - (E - - * \( 1000 \| MSEC_PER_SEC \) - ) - - Link: https://lkml.kernel.org/r/20250225-converge-secs-to-jiffies-part-two-v3-16-a43967e36c88@linux.microsoft.com - Signed-off-by: Easwar Hariharan - Cc: Carlos Maiolino - Cc: Carlos Maiolino - Cc: Chris Mason - Cc: Christoph Hellwig - Cc: Damien Le Maol - Cc: "Darrick J. Wong" - Cc: David Sterba - Cc: Dick Kennedy - Cc: Dongsheng Yang - Cc: Fabio Estevam - Cc: Frank Li - Cc: Hans de Goede - Cc: Henrique de Moraes Holschuh - Cc: Ilpo Jarvinen - Cc: Ilya Dryomov - Cc: James Bottomley - Cc: James Smart - Cc: Jaroslav Kysela - Cc: Jason Gunthorpe - Cc: Jens Axboe - Cc: Josef Bacik - Cc: Julia Lawall - Cc: Kalesh Anakkur Purayil - Cc: Keith Busch - Cc: Leon Romanovsky - Cc: Marc Kleine-Budde - Cc: Mark Brown - Cc: "Martin K. Petersen" - Cc: Nicolas Palix - Cc: Niklas Cassel - Cc: Oded Gabbay - Cc: Sagi Grimberg - Cc: Sascha Hauer - Cc: Sebastian Reichel - Cc: Selvin Thyparampil Xavier - Cc: Shawn Guo - Cc: Shyam-sundar S-k - Cc: Takashi Iwai - Cc: Takashi Iwai - Cc: Xiubo Li - Signed-off-by: Andrew Morton - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c -index d23074383428..804bc773b4ef 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c -@@ -160,7 +160,7 @@ static int __wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie) - wait_event_timeout(cmdq->waitq, - !crsqe->is_in_used || - test_bit(ERR_DEVICE_DETACHED, &cmdq->flags), -- msecs_to_jiffies(rcfw->max_timeout * 1000)); -+ secs_to_jiffies(rcfw->max_timeout)); - - if (!crsqe->is_in_used) - return 0; --- -2.50.1 (Apple Git-155) - diff --git a/1116-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch b/1116-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch deleted file mode 100644 index 802c7a417..000000000 --- a/1116-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 0a6054968d4fb03613bfa5655cd560f7faca9110 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= -Date: Fri, 20 Mar 2026 15:01:50 +0100 -Subject: [PATCH] net: openvswitch: Avoid releasing netdev before teardown - completes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-155383 - -commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 -Author: Toke Høiland-Jørgensen -Date: Wed Mar 18 16:55:51 2026 +0100 - - net: openvswitch: Avoid releasing netdev before teardown completes - - The patch cited in the Fixes tag below changed the teardown code for - OVS ports to no longer unconditionally take the RTNL. After this change, - the netdev_destroy() callback can proceed immediately to the call_rcu() - invocation if the IFF_OVS_DATAPATH flag is already cleared on the - netdev. - - The ovs_netdev_detach_dev() function clears the flag before completing - the unregistration, and if it gets preempted after clearing the flag (as - can happen on an -rt kernel), netdev_destroy() can complete and the - device can be freed before the unregistration completes. This leads to a - splat like: - - [ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI - [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT - [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 - [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 - [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 - [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 - [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 - [ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 - [ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 - [ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 - [ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 - [ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 - [ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - [ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 - [ 998.393944] PKRU: 55555554 - [ 998.393946] Call Trace: - [ 998.393949] - [ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 - [ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 - [ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] - [ 998.394009] ? __die_body.cold+0x8/0x12 - [ 998.394016] ? die_addr+0x3c/0x60 - [ 998.394027] ? exc_general_protection+0x16d/0x390 - [ 998.394042] ? asm_exc_general_protection+0x26/0x30 - [ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 - [ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] - [ 998.394092] dp_device_event+0x41/0x80 [openvswitch] - [ 998.394102] notifier_call_chain+0x5a/0xd0 - [ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 - [ 998.394110] rtnl_dellink+0x169/0x3e0 - [ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 - [ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 - [ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 - [ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 - [ 998.394132] netlink_rcv_skb+0x50/0x100 - [ 998.394138] netlink_unicast+0x292/0x3f0 - [ 998.394141] netlink_sendmsg+0x21b/0x470 - [ 998.394145] ____sys_sendmsg+0x39d/0x3d0 - [ 998.394149] ___sys_sendmsg+0x9a/0xe0 - [ 998.394156] __sys_sendmsg+0x7a/0xd0 - [ 998.394160] do_syscall_64+0x7f/0x170 - [ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e - [ 998.394165] RIP: 0033:0x7fad61bf4724 - [ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 - [ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e - [ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 - [ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 - [ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f - [ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380 - [ 998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000 - [ 998.394200] - - To fix this, reorder the operations in ovs_netdev_detach_dev() to only - clear the flag after completing the other operations, and introduce an - smp_wmb() to make the ordering requirement explicit. The smp_wmb() is - paired with a full smp_mb() in netdev_destroy() to make sure the - call_rcu() invocation does not happen before the unregister operations - are visible. - - Reported-by: Minxi Hou - Tested-by: Minxi Hou - Fixes: 549822767630 ("net: openvswitch: Avoid needlessly taking the RTNL on vport destroy") - Signed-off-by: Toke Høiland-Jørgensen - Link: https://patch.msgid.link/20260318155554.1133405-1-toke@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8) -Assisted-by: Patchpal -Signed-off-by: Toke Høiland-Jørgensen - -diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c -index 6574f9bcdc02..c688dee96503 100644 ---- a/net/openvswitch/vport-netdev.c -+++ b/net/openvswitch/vport-netdev.c -@@ -151,11 +151,15 @@ static void vport_netdev_free(struct rcu_head *rcu) - void ovs_netdev_detach_dev(struct vport *vport) - { - ASSERT_RTNL(); -- vport->dev->priv_flags &= ~IFF_OVS_DATAPATH; - netdev_rx_handler_unregister(vport->dev); - netdev_upper_dev_unlink(vport->dev, - netdev_master_upper_dev_get(vport->dev)); - dev_set_promiscuity(vport->dev, -1); -+ -+ /* paired with smp_mb() in netdev_destroy() */ -+ smp_wmb(); -+ -+ vport->dev->priv_flags &= ~IFF_OVS_DATAPATH; - } - - static void netdev_destroy(struct vport *vport) -@@ -174,6 +178,9 @@ static void netdev_destroy(struct vport *vport) - rtnl_unlock(); - } - -+ /* paired with smp_wmb() in ovs_netdev_detach_dev() */ -+ smp_mb(); -+ - call_rcu(&vport->rcu, vport_netdev_free); - } - --- -2.50.1 (Apple Git-155) - diff --git a/1117-ionic-fix-persistent-mac-address-override-on-pf.patch b/1117-ionic-fix-persistent-mac-address-override-on-pf.patch deleted file mode 100644 index 73b4632b8..000000000 --- a/1117-ionic-fix-persistent-mac-address-override-on-pf.patch +++ /dev/null @@ -1,63 +0,0 @@ -From e324506b98bf6935e6df4813b989d6a9b333109c Mon Sep 17 00:00:00 2001 -From: Mohammad Heib -Date: Tue, 17 Mar 2026 19:08:06 +0200 -Subject: [PATCH] ionic: fix persistent MAC address override on PF - -[ Upstream commit cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed ] - -The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes -the ionic firmware to update the LIF's identity in its persistent state. -Since the firmware state is maintained across host warm boots and driver -reloads, any MAC change on the Physical Function (PF) becomes "sticky. - -This is problematic because it causes ethtool -P to report the -user-configured MAC as the permanent factory address, which breaks -system management tools that rely on a stable hardware identity. - -While Virtual Functions (VFs) need this hardware-level programming to -properly handle MAC assignments in guest environments, the PF should -maintain standard transient behavior. This patch gates the -ionic_program_mac call using is_virtfn so that PF MAC changes remain -local to the netdev filters and do not overwrite the firmware's -permanent identity block. - -Fixes: 19058be7c48c ("ionic: VF initial random MAC address if no assigned mac") -Signed-off-by: Mohammad Heib -Reviewed-by: Simon Horman -Reviewed-by: Brett Creeley -Link: https://patch.msgid.link/20260317170806.35390-1-mheib@redhat.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index d6bea7152805..8119281b26d0 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -1718,13 +1718,18 @@ static int ionic_set_mac_address(struct net_device *netdev, void *sa) - if (ether_addr_equal(netdev->dev_addr, mac)) - return 0; - -- err = ionic_program_mac(lif, mac); -- if (err < 0) -- return err; -+ /* Only program macs for virtual functions to avoid losing the permanent -+ * Mac across warm reset/reboot. -+ */ -+ if (lif->ionic->pdev->is_virtfn) { -+ err = ionic_program_mac(lif, mac); -+ if (err < 0) -+ return err; - -- if (err > 0) -- netdev_dbg(netdev, "%s: SET and GET ATTR Mac are not equal-due to old FW running\n", -- __func__); -+ if (err > 0) -+ netdev_dbg(netdev, "%s: SET and GET ATTR Mac are not equal-due to old FW running\n", -+ __func__); -+ } - - err = eth_prepare_mac_addr_change(netdev, addr); - if (err) --- -2.50.1 (Apple Git-155) - diff --git a/1118-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch b/1118-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch deleted file mode 100644 index 005fc4ce5..000000000 --- a/1118-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 266f721e430bee90651dbb9be46ba6ff070c0228 Mon Sep 17 00:00:00 2001 -From: Vinay Mulugund -Date: Wed, 11 Mar 2026 12:27:30 +0530 -Subject: [PATCH] net: hv_netvsc: reject RSS hash key programming without RX - indirection table - -JIRA: https://issues.redhat.com/browse/RHEL-145154 - -commit d23564955811da493f34412d7de60fa268c8cb50 -Author: Aditya Garg -Date: Mon Jan 12 02:01:33 2026 -0800 - - net: hv_netvsc: reject RSS hash key programming without RX indirection table - - RSS configuration requires a valid RX indirection table. When the device - reports a single receive queue, rndis_filter_device_add() does not - allocate an indirection table, accepting RSS hash key updates in this - state leads to a hang. - - Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return - -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device - capabilities and prevents incorrect behavior. - - Fixes: 962f3fee83a4 ("netvsc: add ethtool ops to get/set RSS key") - Signed-off-by: Aditya Garg - Reviewed-by: Dipayaan Roy - Reviewed-by: Haiyang Zhang - Link: https://patch.msgid.link/1768212093-1594-1-git-send-email-gargaditya@linux.microsoft.com - Signed-off-by: Jakub Kicinski - (cherry picked from commit d23564955811da493f34412d7de60fa268c8cb50) - -Signed-off-by: Vinay Mulugund - -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 313d258a346e..c4243ee74654 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -1757,6 +1757,9 @@ static int netvsc_set_rxfh(struct net_device *dev, - rxfh->hfunc != ETH_RSS_HASH_TOP) - return -EOPNOTSUPP; - -+ if (!ndc->rx_table_sz) -+ return -EOPNOTSUPP; -+ - rndis_dev = ndev->extension; - if (rxfh->indir) { - for (i = 0; i < ndc->rx_table_sz; i++) --- -2.50.1 (Apple Git-155) - diff --git a/1119-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch b/1119-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch deleted file mode 100644 index e5c642be9..000000000 --- a/1119-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch +++ /dev/null @@ -1,54 +0,0 @@ -From bf9a43aa596c70d0c9c32fa654c39926f1c2ef82 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 26 Mar 2026 17:41:01 +0000 -Subject: [PATCH] scsi: qla2xxx: Fix improper freeing of purex item - -JIRA: https://redhat.atlassian.net/browse/RHEL-161120 -CVE: CVE-2025-68741 - -commit 78b1a242fe612a755f2158fd206ee6bb577d18ca -Author: Zilin Guan -Date: Thu Nov 13 15:12:46 2025 +0000 - - scsi: qla2xxx: Fix improper freeing of purex item - - In qla2xxx_process_purls_iocb(), an item is allocated via - qla27xx_copy_multiple_pkt(), which internally calls - qla24xx_alloc_purex_item(). - - The qla24xx_alloc_purex_item() function may return a pre-allocated item - from a per-adapter pool for small allocations, instead of dynamically - allocating memory with kzalloc(). - - An error handling path in qla2xxx_process_purls_iocb() incorrectly uses - kfree() to release the item. If the item was from the pre-allocated - pool, calling kfree() on it is a bug that can lead to memory corruption. - - Fix this by using the correct deallocation function, - qla24xx_free_purex_item(), which properly handles both dynamically - allocated and pre-allocated items. - - Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") - Signed-off-by: Zilin Guan - Reviewed-by: Himanshu Madhani - Link: https://patch.msgid.link/20251113151246.762510-1-zilin@seu.edu.cn - Signed-off-by: Martin K. Petersen - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 8ee2e337c9e1..6ecf3da765aa 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -1292,7 +1292,7 @@ void qla2xxx_process_purls_iocb(void **pkt, struct rsp_que **rsp) - a.reason = FCNVME_RJT_RC_LOGIC; - a.explanation = FCNVME_RJT_EXP_NONE; - xmt_reject = true; -- kfree(item); -+ qla24xx_free_purex_item(item); - goto out; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1120-smb-client-fix-krb5-mount-with-username-option.patch b/1120-smb-client-fix-krb5-mount-with-username-option.patch deleted file mode 100644 index 003c22be5..000000000 --- a/1120-smb-client-fix-krb5-mount-with-username-option.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 30367bfca94e52eeb59b216f5d8d22054aa4f1a8 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Tue, 24 Mar 2026 10:39:08 -0300 -Subject: [PATCH] smb: client: fix krb5 mount with username option - -JIRA: https://issues.redhat.com/browse/RHEL-158991 - -commit 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 -Author: Paulo Alcantara -Date: Fri Mar 13 00:03:38 2026 -0300 - - smb: client: fix krb5 mount with username option - - Customer reported that some of their krb5 mounts were failing against - a single server as the client was trying to mount the shares with - wrong credentials. It turned out the client was reusing SMB session - from first mount to try mounting the other shares, even though a - different username= option had been specified to the other mounts. - - By using username mount option along with sec=krb5 to search for - principals from keytab is supported by cifs.upcall(8) since - cifs-utils-4.8. So fix this by matching username mount option in - match_session() even with Kerberos. - - For example, the second mount below should fail with -ENOKEY as there - is no 'foobar' principal in keytab (/etc/krb5.keytab). The client - ends up reusing SMB session from first mount to perform the second - one, which is wrong. - - ``` - $ ktutil - ktutil: add_entry -password -p testuser -k 1 -e aes256-cts - Password for testuser@ZELDA.TEST: - ktutil: write_kt /etc/krb5.keytab - ktutil: quit - $ klist -ke - Keytab name: FILE:/etc/krb5.keytab - KVNO Principal - ---- ---------------------------------------------------------------- - 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) - $ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser - $ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar - $ mount -t cifs | grep -Po 'username=\K\w+' - testuser - testuser - ``` - - Reported-by: Oscar Santos - Signed-off-by: Paulo Alcantara (Red Hat) - Cc: David Howells - Cc: linux-cifs@vger.kernel.org - Cc: stable@vger.kernel.org - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index a0b45710bd04..37ad111331b3 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -1952,6 +1952,10 @@ static int match_session(struct cifs_ses *ses, - case Kerberos: - if (!uid_eq(ctx->cred_uid, ses->cred_uid)) - return 0; -+ if (strncmp(ses->user_name ?: "", -+ ctx->username ?: "", -+ CIFS_MAX_USERNAME_LEN)) -+ return 0; - break; - case NTLMv2: - case RawNTLMSSP: --- -2.50.1 (Apple Git-155) - diff --git a/1121-alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch b/1121-alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch deleted file mode 100644 index c592b4de6..000000000 --- a/1121-alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 2b6abddbbd260c6ed60125a41e9aa32cf3e31296 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 25 Feb 2026 14:34:51 +0000 -Subject: [PATCH] ALSA: hda/tas2781: Ignore reset check for SPI device - -JIRA: https://issues.redhat.com/browse/RHEL-148197 - -commit 908ef80e31e4d3bd953a0088fe57640cd9ae7b3e -Author: Baojun Xu -Date: Wed Feb 11 11:09:46 2026 +0800 - - ALSA: hda/tas2781: Ignore reset check for SPI device - - In the SPI driver probe, the device should be in the default state, so the - device status check is not necessary. It should be forced to do the - firmware download as I2C device. - - Signed-off-by: Baojun Xu - Link: https://patch.msgid.link/20260211030946.2330-1-baojun.xu@ti.com - Signed-off-by: Takashi Iwai - -Signed-off-by: CKI Backport Bot - -diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c -index b9a55672bf15..488e35dac952 100644 ---- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c -+++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c -@@ -634,7 +634,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) - struct tasdevice_priv *tas_priv = context; - struct tas2781_hda *tas_hda = dev_get_drvdata(tas_priv->dev); - struct hda_codec *codec = tas_priv->codec; -- int ret, val; -+ int ret; - - pm_runtime_get_sync(tas_priv->dev); - guard(mutex)(&tas_priv->codec_lock); -@@ -673,20 +673,14 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) - tas_priv->rcabin.profile_cfg_id = 0; - - tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; -- ret = tasdevice_spi_dev_read(tas_priv, tas_priv->index, -- TAS2781_REG_CLK_CONFIG, &val); -- if (ret < 0) -- goto out; - -- if (val == TAS2781_REG_CLK_CONFIG_RESET) { -- ret = tasdevice_prmg_load(tas_priv, 0); -- if (ret < 0) { -- dev_err(tas_priv->dev, "FW download failed = %d\n", -- ret); -- goto out; -- } -- tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; -+ ret = tasdevice_prmg_load(tas_priv, 0); -+ if (ret < 0) { -+ dev_err(tas_priv->dev, "FW download failed = %d\n", ret); -+ goto out; - } -+ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; -+ - if (tas_priv->fmw->nr_programs > 0) - tas_priv->tasdevice[tas_priv->index].cur_prog = 0; - if (tas_priv->fmw->nr_configurations > 0) --- -2.50.1 (Apple Git-155) - diff --git a/1122-i40e-drop-udp-tunnel-get-rx-info-call-from-i40e-open.patch b/1122-i40e-drop-udp-tunnel-get-rx-info-call-from-i40e-open.patch deleted file mode 100644 index 201b66d6f..000000000 --- a/1122-i40e-drop-udp-tunnel-get-rx-info-call-from-i40e-open.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 4270afcc8324648b92a33e5450e4d6bc9bf925d9 Mon Sep 17 00:00:00 2001 -From: Mohammad Heib -Date: Mon, 9 Feb 2026 10:10:58 +0200 -Subject: [PATCH] i40e: drop udp_tunnel_get_rx_info() call from i40e_open() - -JIRA: https://issues.redhat.com/browse/RHEL-143670 - -commit 40857194956dcaf3d2b66d6bd113d844c93bef54 -Author: Mohammad Heib -Date: Sun Dec 28 21:40:20 2025 +0200 - - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() - - The i40e driver calls udp_tunnel_get_rx_info() during i40e_open(). - This is redundant because UDP tunnel RX offload state is preserved - across device down/up cycles. The udp_tunnel core handles - synchronization automatically when required. - - Furthermore, recent changes in the udp_tunnel infrastructure require - querying RX info while holding the udp_tunnel lock. Calling it - directly from the ndo_open path violates this requirement, - triggering the following lockdep warning: - - Call Trace: - - ? __udp_tunnel_nic_assert_locked+0x39/0x40 [udp_tunnel] - i40e_open+0x135/0x14f [i40e] - __dev_open+0x121/0x2e0 - __dev_change_flags+0x227/0x270 - dev_change_flags+0x3d/0xb0 - devinet_ioctl+0x56f/0x860 - sock_do_ioctl+0x7b/0x130 - __x64_sys_ioctl+0x91/0xd0 - do_syscall_64+0x90/0x170 - ... - - - Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from - i40e_open() resolve the locking violation. - - Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") - Signed-off-by: Mohammad Heib - Reviewed-by: Aleksandr Loktionov - Reviewed-by: Paul Menzel - Tested-by: Rinitha S (A Contingent worker at Intel) - Signed-off-by: Tony Nguyen - -Signed-off-by: Mohammad Heib - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index f418eef4323b..92df70499b6e 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -9054,7 +9054,6 @@ int i40e_open(struct net_device *netdev) - TCP_FLAG_FIN | - TCP_FLAG_CWR) >> 16); - wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16); -- udp_tunnel_get_rx_info(netdev); - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1123-ice-drop-udp-tunnel-get-rx-info-call-from-ndo-open.patch b/1123-ice-drop-udp-tunnel-get-rx-info-call-from-ndo-open.patch deleted file mode 100644 index 7bf5f8116..000000000 --- a/1123-ice-drop-udp-tunnel-get-rx-info-call-from-ndo-open.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 6c8fced68178676061687969c26e1e61b3c91ecd Mon Sep 17 00:00:00 2001 -From: Mohammad Heib -Date: Mon, 9 Feb 2026 10:10:58 +0200 -Subject: [PATCH] ice: drop udp_tunnel_get_rx_info() call from ndo_open() - -JIRA: https://issues.redhat.com/browse/RHEL-143670 - -commit 234e615bfece9e3e91c50fe49ab9e68ee37c791a -Author: Mohammad Heib -Date: Sun Dec 28 21:40:21 2025 +0200 - - ice: drop udp_tunnel_get_rx_info() call from ndo_open() - - The ice driver calls udp_tunnel_get_rx_info() during ice_open_internal(). - This is redundant because UDP tunnel RX offload state is preserved - across device down/up cycles. The udp_tunnel core handles - synchronization automatically when required. - - Furthermore, recent changes in the udp_tunnel infrastructure require - querying RX info while holding the udp_tunnel lock. Calling it - directly from the ndo_open path violates this requirement, - triggering the following lockdep warning: - - Call Trace: - - ice_open_internal+0x253/0x350 [ice] - __udp_tunnel_nic_assert_locked+0x86/0xb0 [udp_tunnel] - __dev_open+0x2f5/0x880 - __dev_change_flags+0x44c/0x660 - netif_change_flags+0x80/0x160 - devinet_ioctl+0xd21/0x15f0 - inet_ioctl+0x311/0x350 - sock_ioctl+0x114/0x220 - __x64_sys_ioctl+0x131/0x1a0 - ... - - - Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from - ice_open_internal() to resolve the locking violation - - Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") - Signed-off-by: Mohammad Heib - Reviewed-by: Aleksandr Loktionov - Tested-by: Rinitha S (A Contingent worker at Intel) - Signed-off-by: Tony Nguyen - -Signed-off-by: Mohammad Heib - -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index d89ae9e3a168..04f71716a70f 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -9624,9 +9624,6 @@ int ice_open_internal(struct net_device *netdev) - netdev_err(netdev, "Failed to open VSI 0x%04X on switch 0x%04X\n", - vsi->vsi_num, vsi->vsw->sw_id); - -- /* Update existing tunnels information */ -- udp_tunnel_get_rx_info(netdev); -- - return err; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1124-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch b/1124-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch deleted file mode 100644 index a27a03183..000000000 --- a/1124-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 8ea33562256c638f6864f56a0620b1d998e3ade4 Mon Sep 17 00:00:00 2001 -From: Jan Stancek -Date: Mon, 9 Mar 2026 08:47:13 +0100 -Subject: [PATCH] x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths - -JIRA: https://issues.redhat.com/browse/RHEL-132871 -Upstream Status: linux.git - -commit 3d1973a0c76a78a4728cff13648a188ed486cf44 -Author: Jan Stancek -Date: Wed Feb 25 20:30:23 2026 +0100 - - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths - - CONFIG_EFI_SBAT_FILE can be a relative path. When compiling using a different - output directory (O=) the build currently fails because it can't find the - filename set in CONFIG_EFI_SBAT_FILE: - - arch/x86/boot/compressed/sbat.S: Assembler messages: - arch/x86/boot/compressed/sbat.S:6: Error: file not found: kernel.sbat - - Add $(srctree) as include dir for sbat.o. - - [ bp: Massage commit message. ] - - Fixes: 61b57d35396a ("x86/efi: Implement support for embedding SBAT data for x86") - Signed-off-by: Jan Stancek - Signed-off-by: Borislav Petkov (AMD) - Reviewed-by: Vitaly Kuznetsov - Cc: - Link: https://patch.msgid.link/f4eda155b0cef91d4d316b4e92f5771cb0aa7187.1772047658.git.jstancek@redhat.com - -Signed-off-by: Jan Stancek - -diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index c6fa7fa71db4..9f521bff57a4 100644 ---- a/arch/x86/boot/compressed/Makefile -+++ b/arch/x86/boot/compressed/Makefile -@@ -111,6 +111,7 @@ vmlinux-objs-$(CONFIG_EFI_SBAT) += $(obj)/sbat.o - - ifdef CONFIG_EFI_SBAT - $(obj)/sbat.o: $(CONFIG_EFI_SBAT_FILE) -+AFLAGS_sbat.o += -I $(srctree) - endif - - $(obj)/vmlinux: $(vmlinux-objs-y) $(vmlinux-libs-y) FORCE --- -2.50.1 (Apple Git-155) - diff --git a/1125-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch b/1125-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch deleted file mode 100644 index 4f6d5a703..000000000 --- a/1125-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch +++ /dev/null @@ -1,100 +0,0 @@ -From a64542a8df51ed10c2d6ac1cbfd20281cadb6e6a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 7 Apr 2026 09:07:40 +0000 -Subject: [PATCH] net/sched: Only allow act_ct to bind to clsact/ingress qdiscs - and shared blocks - -JIRA: https://redhat.atlassian.net/browse/RHEL-164343 -CVE: CVE-2026-23270 - -commit 11cb63b0d1a0685e0831ae3c77223e002ef18189 -Author: Victor Nogueira -Date: Wed Feb 25 10:43:48 2026 -0300 - - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - - As Paolo said earlier [1]: - - "Since the blamed commit below, classify can return TC_ACT_CONSUMED while - the current skb being held by the defragmentation engine. As reported by - GangMin Kim, if such packet is that may cause a UaF when the defrag engine - later on tries to tuch again such packet." - - act_ct was never meant to be used in the egress path, however some users - are attaching it to egress today [2]. Attempting to reach a middle - ground, we noticed that, while most qdiscs are not handling - TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we - address the issue by only allowing act_ct to bind to clsact/ingress - qdiscs and shared blocks. That way it's still possible to attach act_ct to - egress (albeit only with clsact). - - [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ - [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/ - - Reported-by: GangMin Kim - Fixes: 3f14b377d01d ("net/sched: act_ct: fix skb leak and crash on ooo frags") - CC: stable@vger.kernel.org - Signed-off-by: Victor Nogueira - Acked-by: Jamal Hadi Salim - Link: https://patch.msgid.link/20260225134349.1287037-1-victor@mojatatu.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/include/net/act_api.h b/include/net/act_api.h -index 2894cfff2da3..6b09f4587885 100644 ---- a/include/net/act_api.h -+++ b/include/net/act_api.h -@@ -68,6 +68,7 @@ struct tc_action { - #define TCA_ACT_FLAGS_REPLACE (1U << (TCA_ACT_FLAGS_USER_BITS + 2)) - #define TCA_ACT_FLAGS_NO_RTNL (1U << (TCA_ACT_FLAGS_USER_BITS + 3)) - #define TCA_ACT_FLAGS_AT_INGRESS (1U << (TCA_ACT_FLAGS_USER_BITS + 4)) -+#define TCA_ACT_FLAGS_AT_INGRESS_OR_CLSACT (1U << (TCA_ACT_FLAGS_USER_BITS + 5)) - - /* Update lastuse only if needed, to avoid dirtying a cache line. - * We use a temp variable to avoid fetching jiffies twice. -diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c -index e6ea788da01d..dfae934d26c7 100644 ---- a/net/sched/act_ct.c -+++ b/net/sched/act_ct.c -@@ -1358,6 +1358,12 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla, - return -EINVAL; - } - -+ if (bind && !(flags & TCA_ACT_FLAGS_AT_INGRESS_OR_CLSACT)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Attaching ct to a non ingress/clsact qdisc is unsupported"); -+ return -EOPNOTSUPP; -+ } -+ - err = nla_parse_nested(tb, TCA_CT_MAX, nla, ct_policy, extack); - if (err < 0) - return err; -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 5399a46f58dd..0d76e6917155 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -2228,6 +2228,11 @@ static bool is_qdisc_ingress(__u32 classid) - return (TC_H_MIN(classid) == TC_H_MIN(TC_H_MIN_INGRESS)); - } - -+static bool is_ingress_or_clsact(struct tcf_block *block, struct Qdisc *q) -+{ -+ return tcf_block_shared(block) || (q && !!(q->flags & TCQ_F_INGRESS)); -+} -+ - static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, - struct netlink_ext_ack *extack) - { -@@ -2420,6 +2425,8 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, - flags |= TCA_ACT_FLAGS_NO_RTNL; - if (is_qdisc_ingress(parent)) - flags |= TCA_ACT_FLAGS_AT_INGRESS; -+ if (is_ingress_or_clsact(block, q)) -+ flags |= TCA_ACT_FLAGS_AT_INGRESS_OR_CLSACT; - err = tp->ops->change(net, skb, tp, cl, t->tcm_handle, tca, &fh, - flags, extack); - if (err == 0) { --- -2.50.1 (Apple Git-155) - diff --git a/1126-asoc-sdca-tidy-up-some-memory-allocations.patch b/1126-asoc-sdca-tidy-up-some-memory-allocations.patch deleted file mode 100644 index 9b24e778b..000000000 --- a/1126-asoc-sdca-tidy-up-some-memory-allocations.patch +++ /dev/null @@ -1,71 +0,0 @@ -From aa6ff47bec14a3ff3e61d5156611282ea4af0cd5 Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Thu, 5 Mar 2026 15:06:49 +0100 -Subject: [PATCH] ASoC: SDCA: Tidy up some memory allocations - -JIRA: https://issues.redhat.com/browse/RHEL-85741 - -commit 61d2a7699ab39d448f44919ef15c16187e6f70ec -Author: Charles Keepax -Date: Thu Jan 15 11:46:07 2026 +0000 - - ASoC: SDCA: Tidy up some memory allocations - - It is slightly better to deference the type being allocate for a sizeof - rather than manually using the type. Saves effort if types change in the - future. This results in no functional changes, just tidies up the style - of the code a little. - - Signed-off-by: Charles Keepax - Link: https://patch.msgid.link/20260115114607.271990-1-ckeepax@opensource.cirrus.com - Signed-off-by: Mark Brown - -Signed-off-by: Jaroslav Kysela - -diff --git a/sound/soc/sdca/sdca_fdl.c b/sound/soc/sdca/sdca_fdl.c -index 3180ebd07c40..8bee9f23c473 100644 ---- a/sound/soc/sdca/sdca_fdl.c -+++ b/sound/soc/sdca/sdca_fdl.c -@@ -487,7 +487,7 @@ int sdca_fdl_alloc_state(struct sdca_interrupt *interrupt) - struct device *dev = interrupt->dev; - struct fdl_state *fdl_state; - -- fdl_state = devm_kzalloc(dev, sizeof(struct fdl_state), GFP_KERNEL); -+ fdl_state = devm_kzalloc(dev, sizeof(*fdl_state), GFP_KERNEL); - if (!fdl_state) - return -ENOMEM; - -diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c -index acac066f1d8d..80c71116e6d4 100644 ---- a/sound/soc/sdca/sdca_functions.c -+++ b/sound/soc/sdca/sdca_functions.c -@@ -952,7 +952,7 @@ static int find_sdca_entity_control(struct device *dev, struct sdca_entity *enti - } - - control->values = devm_kcalloc(dev, hweight64(control->cn_list), -- sizeof(int), GFP_KERNEL); -+ sizeof(*control->values), GFP_KERNEL); - if (!control->values) - return -ENOMEM; - -@@ -2048,7 +2048,7 @@ static int find_sdca_filesets(struct device *dev, struct sdw_slave *sdw, - fwnode_property_read_u32_array(function_node, "mipi-sdca-file-set-id-list", - filesets_list, num_sets); - -- sets = devm_kcalloc(dev, num_sets, sizeof(struct sdca_fdl_set), GFP_KERNEL); -+ sets = devm_kcalloc(dev, num_sets, sizeof(*sets), GFP_KERNEL); - if (!sets) - return -ENOMEM; - -@@ -2074,7 +2074,7 @@ static int find_sdca_filesets(struct device *dev, struct sdw_slave *sdw, - dev_dbg(dev, "fileset: %#x\n", filesets_list[i]); - - files = devm_kcalloc(dev, num_entries / mult_fileset, -- sizeof(struct sdca_fdl_file), GFP_KERNEL); -+ sizeof(*files), GFP_KERNEL); - if (!files) - return -ENOMEM; - --- -2.50.1 (Apple Git-155) - diff --git a/1127-asoc-sdca-handle-config-pm-sleep-not-being-set.patch b/1127-asoc-sdca-handle-config-pm-sleep-not-being-set.patch deleted file mode 100644 index 564adb3b3..000000000 --- a/1127-asoc-sdca-handle-config-pm-sleep-not-being-set.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 1351c2e480a0e7b2c42ac6016c7fdf61de18ee68 Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Thu, 5 Mar 2026 15:07:17 +0100 -Subject: [PATCH] ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set - -JIRA: https://issues.redhat.com/browse/RHEL-85741 - -commit 7a3d1b04d938f31e112fe09c0ffc1af830ba1f6d -Author: Charles Keepax -Date: Thu Jan 15 14:11:06 2026 +0000 - - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set - - If CONFIG_PM_SLEEP is not set the completion used will not exist. Update - the code to avoid the build error this introduces, without PM_SLEEP it - should be safe to always run the conditional code. - - Fixes: ffd7e8a10111 ("ASoC: SDCA: Device boot into the system suspend process") - Reported-by: kernel test robot - Closes: https://lore.kernel.org/oe-kbuild-all/202601151803.XY7KryHC-lkp@intel.com/ - Signed-off-by: Charles Keepax - Link: https://patch.msgid.link/20260115141107.564929-1-ckeepax@opensource.cirrus.com - Signed-off-by: Mark Brown - -Signed-off-by: Jaroslav Kysela - -diff --git a/sound/soc/sdca/sdca_interrupts.c b/sound/soc/sdca/sdca_interrupts.c -index cc40732c30cc..d9e22cf40f77 100644 ---- a/sound/soc/sdca/sdca_interrupts.c -+++ b/sound/soc/sdca/sdca_interrupts.c -@@ -198,6 +198,18 @@ static irqreturn_t hid_handler(int irq, void *data) - return irqret; - } - -+#ifdef CONFIG_PM_SLEEP -+static bool no_pm_in_progress(struct device *dev) -+{ -+ return completion_done(&dev->power.completion); -+} -+#else -+static bool no_pm_in_progress(struct device *dev) -+{ -+ return true; -+} -+#endif -+ - static irqreturn_t fdl_owner_handler(int irq, void *data) - { - struct sdca_interrupt *interrupt = data; -@@ -209,7 +221,7 @@ static irqreturn_t fdl_owner_handler(int irq, void *data) - * FDL has to run from the system resume handler, at which point - * we can't wait for the pm runtime. - */ -- if (completion_done(&dev->power.completion)) { -+ if (no_pm_in_progress(dev)) { - ret = pm_runtime_get_sync(dev); - if (ret < 0) { - dev_err(dev, "failed to resume for fdl: %d\n", ret); -@@ -223,7 +235,7 @@ static irqreturn_t fdl_owner_handler(int irq, void *data) - - irqret = IRQ_HANDLED; - error: -- if (completion_done(&dev->power.completion)) -+ if (no_pm_in_progress(dev)) - pm_runtime_put(dev); - return irqret; - } --- -2.50.1 (Apple Git-155) - diff --git a/1128-asoc-sdca-update-counting-of-su-ge-dapm-routes.patch b/1128-asoc-sdca-update-counting-of-su-ge-dapm-routes.patch deleted file mode 100644 index 223b063e6..000000000 --- a/1128-asoc-sdca-update-counting-of-su-ge-dapm-routes.patch +++ /dev/null @@ -1,139 +0,0 @@ -From afcc1ec4a47228eb2f8a8f1f79a9dbf3918a9c16 Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Thu, 5 Mar 2026 15:04:28 +0100 -Subject: [PATCH] ASoC: SDCA: Update counting of SU/GE DAPM routes - -JIRA: https://issues.redhat.com/browse/RHEL-85741 - -commit 1fb720d33eecdb9a90ee340b3000ba378d49f5ca -Author: Charles Keepax -Date: Wed Feb 25 14:01:16 2026 +0000 - - ASoC: SDCA: Update counting of SU/GE DAPM routes - - Device Layer Selector Unit's are controlled by a Group Entity control - rather than by the host directly. For the purposes of the ASoC class - driver the number of input routes to the SU is controlled by the number - of options within the Group Entity Selected Mode Control. ie. One valid - DAPM route for each valid route defined in the Group Entity. - - Currently the code assumes that a Device Layer SU will have a number of - routes equal to the number of potential sources for the SU. ie. it - counts the routes using the SU, but then creates the routes using the - GE. However, this isn't actually true, it is perfectly allowed for the - GE to only define options for some of the potential sources of the SU.o - In such a case the number of routes return will not match those created, - leading to either an overflow of the routes array or undefined routes to - be past to the ASoC core, both of which generally lead to the sound card - failing to probe. - - Update the handling for the counting of routes to count the connected - routes on the GE itself and then ignore the source routes on the SU. - This makes it match the logic generating the routes and ensuring that - both remain in sync. - - Fixes: 2c8b3a8e6aa8 ("ASoC: SDCA: Create DAPM widgets and routes from DisCo") - Reviewed-by: Pierre-Louis Bossart - Signed-off-by: Charles Keepax - Link: https://patch.msgid.link/20260225140118.402695-3-ckeepax@opensource.cirrus.com - Signed-off-by: Mark Brown - -Signed-off-by: Jaroslav Kysela - -diff --git a/sound/soc/sdca/sdca_asoc.c b/sound/soc/sdca/sdca_asoc.c -index 65e87de1563b..49cbf38b7adb 100644 ---- a/sound/soc/sdca/sdca_asoc.c -+++ b/sound/soc/sdca/sdca_asoc.c -@@ -50,6 +50,25 @@ static bool readonly_control(struct sdca_control *control) - return control->has_fixed || control->mode == SDCA_ACCESS_MODE_RO; - } - -+static int ge_count_routes(struct sdca_entity *entity) -+{ -+ int count = 0; -+ int i, j; -+ -+ for (i = 0; i < entity->ge.num_modes; i++) { -+ struct sdca_ge_mode *mode = &entity->ge.modes[i]; -+ -+ for (j = 0; j < mode->num_controls; j++) { -+ struct sdca_ge_control *affected = &mode->controls[j]; -+ -+ if (affected->sel != SDCA_CTL_SU_SELECTOR || affected->val) -+ count++; -+ } -+ } -+ -+ return count; -+} -+ - /** - * sdca_asoc_count_component - count the various component parts - * @dev: Pointer to the device against which allocations will be done. -@@ -73,6 +92,7 @@ int sdca_asoc_count_component(struct device *dev, struct sdca_function_data *fun - int *num_widgets, int *num_routes, int *num_controls, - int *num_dais) - { -+ struct sdca_control *control; - int i, j; - - *num_widgets = function->num_entities - 1; -@@ -82,6 +102,7 @@ int sdca_asoc_count_component(struct device *dev, struct sdca_function_data *fun - - for (i = 0; i < function->num_entities - 1; i++) { - struct sdca_entity *entity = &function->entities[i]; -+ bool skip_primary_routes = false; - - /* Add supply/DAI widget connections */ - switch (entity->type) { -@@ -95,6 +116,17 @@ int sdca_asoc_count_component(struct device *dev, struct sdca_function_data *fun - case SDCA_ENTITY_TYPE_PDE: - *num_routes += entity->pde.num_managed; - break; -+ case SDCA_ENTITY_TYPE_GE: -+ *num_routes += ge_count_routes(entity); -+ skip_primary_routes = true; -+ break; -+ case SDCA_ENTITY_TYPE_SU: -+ control = sdca_selector_find_control(dev, entity, SDCA_CTL_SU_SELECTOR); -+ if (!control) -+ return -EINVAL; -+ -+ skip_primary_routes = (control->layers == SDCA_ACCESS_LAYER_DEVICE); -+ break; - default: - break; - } -@@ -103,7 +135,8 @@ int sdca_asoc_count_component(struct device *dev, struct sdca_function_data *fun - (*num_routes)++; - - /* Add primary entity connections from DisCo */ -- *num_routes += entity->num_sources; -+ if (!skip_primary_routes) -+ *num_routes += entity->num_sources; - - for (j = 0; j < entity->num_controls; j++) { - if (exported_control(entity, &entity->controls[j])) -@@ -406,7 +439,6 @@ static int entity_parse_su_device(struct device *dev, - struct snd_soc_dapm_route **route) - { - struct sdca_control_range *range; -- int num_routes = 0; - int i, j; - - if (!entity->group) { -@@ -442,11 +474,6 @@ static int entity_parse_su_device(struct device *dev, - return -EINVAL; - } - -- if (++num_routes > entity->num_sources) { -- dev_err(dev, "%s: too many input routes\n", entity->label); -- return -EINVAL; -- } -- - term = sdca_range_search(range, SDCA_SELECTED_MODE_INDEX, - mode->val, SDCA_SELECTED_MODE_TERM_TYPE); - if (!term) { --- -2.50.1 (Apple Git-155) - diff --git a/1129-asoc-add-snd-soc-lookup-component-by-name-helper.patch b/1129-asoc-add-snd-soc-lookup-component-by-name-helper.patch deleted file mode 100644 index b9c494a31..000000000 --- a/1129-asoc-add-snd-soc-lookup-component-by-name-helper.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 105ead878dbfc6db2beb895ba2bc03d7ad620811 Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Thu, 5 Mar 2026 15:05:23 +0100 -Subject: [PATCH] ASoC: add snd_soc_lookup_component_by_name helper -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-85741 - -commit 98eb42c7de6b0185c914df4cca61b49ff76821ee -Author: Bard Liao -Date: Wed Feb 25 21:50:02 2026 +0800 - - ASoC: add snd_soc_lookup_component_by_name helper - - Add a helper to help user to get the component by name. - - Signed-off-by: Bard Liao - Reviewed-by: Charles Keepax - Reviewed-by: Péter Ujfalusi - Link: https://patch.msgid.link/20260225135004.2322987-2-yung-chuan.liao@linux.intel.com - Signed-off-by: Mark Brown - -Signed-off-by: Jaroslav Kysela - -diff --git a/include/sound/soc.h b/include/sound/soc.h -index f0d837424b4e..753a4a5aecd6 100644 ---- a/include/sound/soc.h -+++ b/include/sound/soc.h -@@ -465,6 +465,7 @@ struct snd_soc_component *snd_soc_lookup_component_nolocked(struct device *dev, - const char *driver_name); - struct snd_soc_component *snd_soc_lookup_component(struct device *dev, - const char *driver_name); -+struct snd_soc_component *snd_soc_lookup_component_by_name(const char *component_name); - - int soc_new_pcm(struct snd_soc_pcm_runtime *rtd); - #ifdef CONFIG_SND_SOC_COMPRESS -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index 9dd84d73046b..065fef528f02 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -404,6 +404,19 @@ struct snd_soc_component *snd_soc_lookup_component(struct device *dev, - } - EXPORT_SYMBOL_GPL(snd_soc_lookup_component); - -+struct snd_soc_component *snd_soc_lookup_component_by_name(const char *component_name) -+{ -+ struct snd_soc_component *component; -+ -+ guard(mutex)(&client_mutex); -+ for_each_component(component) -+ if (strstr(component->name, component_name)) -+ return component; -+ -+ return NULL; -+} -+EXPORT_SYMBOL_GPL(snd_soc_lookup_component_by_name); -+ - struct snd_soc_pcm_runtime - *snd_soc_get_pcm_runtime(struct snd_soc_card *card, - struct snd_soc_dai_link *dai_link) --- -2.50.1 (Apple Git-155) - diff --git a/1130-asoc-soc-sdw-utils-partial-match-the-codec-name.patch b/1130-asoc-soc-sdw-utils-partial-match-the-codec-name.patch deleted file mode 100644 index c9e0b4244..000000000 --- a/1130-asoc-soc-sdw-utils-partial-match-the-codec-name.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 97fd7dca352424825024946458c26d8729e2f72b Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Thu, 5 Mar 2026 15:05:45 +0100 -Subject: [PATCH] ASoC: soc_sdw_utils: partial match the codec name -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-85741 - -commit c5ae3d8bc968a28aaeefbb772ec42e50cf3a15f0 -Author: Bard Liao -Date: Wed Feb 25 21:50:03 2026 +0800 - - ASoC: soc_sdw_utils: partial match the codec name - - Currently, we can set codec name in the dai info which will be set as - the codec component name in a DAI link. However, the codec name may - not be fixed. For example, there is an index in a SDCA codec name and - that is not fixed. Lookup the fixed codec name string from the component - list to get the right component name to ensure the DAI link will bind - to the right codec component. - - Signed-off-by: Bard Liao - Reviewed-by: Charles Keepax - Reviewed-by: Péter Ujfalusi - Link: https://patch.msgid.link/20260225135004.2322987-3-yung-chuan.liao@linux.intel.com - Signed-off-by: Mark Brown - -Signed-off-by: Jaroslav Kysela - -diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c -index 2f3c9698a0e8..88afb14e1ed3 100644 ---- a/sound/soc/sdw_utils/soc_sdw_utils.c -+++ b/sound/soc/sdw_utils/soc_sdw_utils.c -@@ -1213,8 +1213,18 @@ const char *asoc_sdw_get_codec_name(struct device *dev, - const struct snd_soc_acpi_link_adr *adr_link, - int adr_index) - { -- if (dai_info->codec_name) -- return devm_kstrdup(dev, dai_info->codec_name, GFP_KERNEL); -+ if (dai_info->codec_name) { -+ struct snd_soc_component *component; -+ -+ component = snd_soc_lookup_component_by_name(dai_info->codec_name); -+ if (component) { -+ dev_dbg(dev, "%s found component %s for codec_name %s\n", -+ __func__, component->name, dai_info->codec_name); -+ return devm_kstrdup(dev, component->name, GFP_KERNEL); -+ } else { -+ return devm_kstrdup(dev, dai_info->codec_name, GFP_KERNEL); -+ } -+ } - - return _asoc_sdw_get_codec_name(dev, adr_link, adr_index); - } -@@ -1526,7 +1536,17 @@ int asoc_sdw_parse_sdw_endpoints(struct snd_soc_card *card, - return -EINVAL; - - for (j = 0; j < codec_info->aux_num; j++) { -- soc_aux->dlc.name = codec_info->auxs[j].codec_name; -+ struct snd_soc_component *component; -+ -+ component = snd_soc_lookup_component_by_name(codec_info->auxs[j].codec_name); -+ if (component) { -+ dev_dbg(dev, "%s found component %s for aux name %s\n", -+ __func__, component->name, -+ codec_info->auxs[j].codec_name); -+ soc_aux->dlc.name = component->name; -+ } else { -+ soc_aux->dlc.name = codec_info->auxs[j].codec_name; -+ } - soc_aux++; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1131-asoc-soc-sdw-utils-remove-index-from-sdca-codec-name.patch b/1131-asoc-soc-sdw-utils-remove-index-from-sdca-codec-name.patch deleted file mode 100644 index e9a36a18a..000000000 --- a/1131-asoc-soc-sdw-utils-remove-index-from-sdca-codec-name.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 69e69e240e71e94b8404b33ce9296967a1114258 Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Thu, 5 Mar 2026 15:06:06 +0100 -Subject: [PATCH] ASoC: soc_sdw_utils: remove index from sdca codec name -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-85741 - -commit 34b4fc44e4f904fbb81335d53163ffdcb0180000 -Author: Bard Liao -Date: Wed Feb 25 21:50:04 2026 +0800 - - ASoC: soc_sdw_utils: remove index from sdca codec name - - The index is not fixed and it will lead to the DAI link can't bind the - codec component with the name when the index is different from the - predefined one. - - Signed-off-by: Bard Liao - Reviewed-by: Charles Keepax - Reviewed-by: Péter Ujfalusi - Link: https://patch.msgid.link/20260225135004.2322987-4-yung-chuan.liao@linux.intel.com - Signed-off-by: Mark Brown - -Signed-off-by: Jaroslav Kysela - -diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c -index 88afb14e1ed3..7afd8fa305be 100644 ---- a/sound/soc/sdw_utils/soc_sdw_utils.c -+++ b/sound/soc/sdw_utils/soc_sdw_utils.c -@@ -727,7 +727,7 @@ struct asoc_sdw_codec_info codec_info_list[] = { - .dais = { - { - .direction = {true, false}, -- .codec_name = "snd_soc_sdca.UAJ.1", -+ .codec_name = "snd_soc_sdca.UAJ", - .dai_name = "IT 41", - .dai_type = SOC_SDW_DAI_TYPE_JACK, - .dailink = {SOC_SDW_JACK_OUT_DAI_ID, SOC_SDW_UNUSED_DAI_ID}, -@@ -743,7 +743,7 @@ struct asoc_sdw_codec_info codec_info_list[] = { - }, - { - .direction = {false, true}, -- .codec_name = "snd_soc_sdca.UAJ.1", -+ .codec_name = "snd_soc_sdca.UAJ", - .dai_name = "OT 36", - .dai_type = SOC_SDW_DAI_TYPE_JACK, - .dailink = {SOC_SDW_UNUSED_DAI_ID, SOC_SDW_JACK_IN_DAI_ID}, -@@ -752,7 +752,7 @@ struct asoc_sdw_codec_info codec_info_list[] = { - .dai_num = 3, - .auxs = { - { -- .codec_name = "snd_soc_sdca.HID.2", -+ .codec_name = "snd_soc_sdca.HID", - }, - }, - .aux_num = 1, --- -2.50.1 (Apple Git-155) - diff --git a/1132-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch b/1132-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch deleted file mode 100644 index 36defc7d7..000000000 --- a/1132-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch +++ /dev/null @@ -1,33 +0,0 @@ - -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index 0349e26..dbd06bd 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -3040,12 +3040,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, - bool prefetch = !fault || fault->prefetch; - bool write_fault = fault && fault->write; - -- if (unlikely(is_noslot_pfn(pfn))) { -- vcpu->stat.pf_mmio_spte_created++; -- mark_mmio_spte(vcpu, sptep, gfn, pte_access); -- return RET_PF_EMULATE; -- } -- - if (is_shadow_present_pte(*sptep)) { - if (prefetch && is_last_spte(*sptep, level) && - pfn == spte_to_pfn(*sptep)) -@@ -3069,6 +3063,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, - was_rmapped = 1; - } - -+ if (unlikely(is_noslot_pfn(pfn))) { -+ vcpu->stat.pf_mmio_spte_created++; -+ mark_mmio_spte(vcpu, sptep, gfn, pte_access); -+ if (flush) -+ kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); -+ return RET_PF_EMULATE; -+ } -+ - wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, - false, host_writable, &spte); - diff --git a/1133-kvm-x86-mmu-only-warn-in-direct-mmus-when-overwriting-shadow.patch b/1133-kvm-x86-mmu-only-warn-in-direct-mmus-when-overwriting-shadow.patch deleted file mode 100644 index 0be46b1d7..000000000 --- a/1133-kvm-x86-mmu-only-warn-in-direct-mmus-when-overwriting-shadow.patch +++ /dev/null @@ -1,55 +0,0 @@ -From df83746075778958954aa0460cca55f4b3fc9c02 Mon Sep 17 00:00:00 2001 -From: Sean Christopherson -Date: Thu, 5 Mar 2026 17:42:14 -0800 -Subject: [PATCH] KVM: x86/mmu: Only WARN in direct MMUs when overwriting - shadow-present SPTE - -Adjust KVM's sanity check against overwriting a shadow-present SPTE with a -another SPTE with a different target PFN to only apply to direct MMUs, -i.e. only to MMUs without shadowed gPTEs. While it's impossible for KVM -to overwrite a shadow-present SPTE in response to a guest write, writes -from outside the scope of KVM, e.g. from host userspace, aren't detected -by KVM's write tracking and so can break KVM's shadow paging rules. - - ------------[ cut here ]------------ - pfn != spte_to_pfn(*sptep) - WARNING: arch/x86/kvm/mmu/mmu.c:3069 at mmu_set_spte+0x1e4/0x440 [kvm], CPU#0: vmx_ept_stale_r/872 - Modules linked in: kvm_intel kvm irqbypass - CPU: 0 UID: 1000 PID: 872 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 - RIP: 0010:mmu_set_spte+0x1e4/0x440 [kvm] - Call Trace: - - ept_page_fault+0x535/0x7f0 [kvm] - kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] - kvm_mmu_page_fault+0x8d/0x620 [kvm] - vmx_handle_exit+0x18c/0x5a0 [kvm_intel] - kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] - kvm_vcpu_ioctl+0x2d5/0x980 [kvm] - __x64_sys_ioctl+0x8a/0xd0 - do_syscall_64+0xb5/0x730 - entry_SYSCALL_64_after_hwframe+0x4b/0x53 - - ---[ end trace 0000000000000000 ]--- - -Fixes: 11d45175111d ("KVM: x86/mmu: Warn if PFN changes on shadow-present SPTE in shadow MMU") -Cc: stable@vger.kernel.org -Signed-off-by: Sean Christopherson - -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index 98406d6aa2d6..dd06453d5b72 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -3060,7 +3060,8 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, - child = spte_to_child_sp(pte); - drop_parent_pte(vcpu->kvm, child, sptep); - flush = true; -- } else if (WARN_ON_ONCE(pfn != spte_to_pfn(*sptep))) { -+ } else if (pfn != spte_to_pfn(*sptep)) { -+ WARN_ON_ONCE(vcpu->arch.mmu->root_role.direct); - drop_spte(vcpu->kvm, sptep); - flush = true; - } else --- -2.50.1 (Apple Git-155) - diff --git a/1134-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch b/1134-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch deleted file mode 100644 index 875bb539a..000000000 --- a/1134-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 180018072a6bc00717f4648cf45b1dd27752a4ac Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 15 Apr 2026 14:04:07 +0000 -Subject: [PATCH] nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - -JIRA: https://redhat.atlassian.net/browse/RHEL-168570 -CVE: CVE-2026-31402 - -commit 5133b61aaf437e5f25b1b396b14242a6bb0508e2 -Author: Jeff Layton -Date: Tue Feb 24 11:33:35 2026 -0500 - - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - - The NFSv4.0 replay cache uses a fixed 112-byte inline buffer - (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. - This size was calculated based on OPEN responses and does not account - for LOCK denied responses, which include the conflicting lock owner as - a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). - - When a LOCK operation is denied due to a conflict with an existing lock - that has a large owner, nfsd4_encode_operation() copies the full encoded - response into the undersized replay buffer via read_bytes_from_xdr_buf() - with no bounds check. This results in a slab-out-of-bounds write of up - to 944 bytes past the end of the buffer, corrupting adjacent heap memory. - - This can be triggered remotely by an unauthenticated attacker with two - cooperating NFSv4.0 clients: one sets a lock with a large owner string, - then the other requests a conflicting lock to provoke the denial. - - We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full - opaque, but that would increase the size of every stateowner, when most - lockowners are not that large. - - Instead, fix this by checking the encoded response length against - NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the - response is too large, set rp_buflen to 0 to skip caching the replay - payload. The status is still cached, and the client already received the - correct response on the original request. - - Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") - Cc: stable@kernel.org - Reported-by: Nicholas Carlini - Tested-by: Nicholas Carlini - Signed-off-by: Jeff Layton - Signed-off-by: Chuck Lever - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index bdf18ffb0064..538806e45904 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -5921,9 +5921,14 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) - int len = xdr->buf->len - (op_status_offset + XDR_UNIT); - - so->so_replay.rp_status = op->status; -- so->so_replay.rp_buflen = len; -- read_bytes_from_xdr_buf(xdr->buf, op_status_offset + XDR_UNIT, -+ if (len <= NFSD4_REPLAY_ISIZE) { -+ so->so_replay.rp_buflen = len; -+ read_bytes_from_xdr_buf(xdr->buf, -+ op_status_offset + XDR_UNIT, - so->so_replay.rp_buf, len); -+ } else { -+ so->so_replay.rp_buflen = 0; -+ } - } - status: - op->status = nfsd4_map_status(op->status, -diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h -index 399815d9038f..c63c8abd199a 100644 ---- a/fs/nfsd/state.h -+++ b/fs/nfsd/state.h -@@ -539,11 +539,18 @@ struct nfs4_client_reclaim { - struct xdr_netobj cr_princhash; - }; - --/* A reasonable value for REPLAY_ISIZE was estimated as follows: -- * The OPEN response, typically the largest, requires -- * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + 8(verifier) + -- * 4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) + -- * 20(deleg. space limit) + ~32(deleg. ace) = 112 bytes -+/* -+ * REPLAY_ISIZE is sized for an OPEN response with delegation: -+ * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + -+ * 8(verifier) + 4(deleg. type) + 8(deleg. stateid) + -+ * 4(deleg. recall flag) + 20(deleg. space limit) + -+ * ~32(deleg. ace) = 112 bytes -+ * -+ * Some responses can exceed this. A LOCK denial includes the conflicting -+ * lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses -+ * larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is -+ * saved. Enlarging this constant increases the size of every -+ * nfs4_stateowner. - */ - - #define NFSD4_REPLAY_ISIZE 112 --- -2.50.1 (Apple Git-155) - diff --git a/1135-net-af-can-do-not-leave-a-dangling-sk-pointer-in-can-create.patch b/1135-net-af-can-do-not-leave-a-dangling-sk-pointer-in-can-create.patch deleted file mode 100644 index 9aaed9cbf..000000000 --- a/1135-net-af-can-do-not-leave-a-dangling-sk-pointer-in-can-create.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 8df832e6b945e1ba61467d7f1c9305e314ae92fe Mon Sep 17 00:00:00 2001 -From: Ignat Korchagin -Date: Mon, 14 Oct 2024 16:38:03 +0100 -Subject: [PATCH] net: af_can: do not leave a dangling sk pointer in - can_create() - -[ Upstream commit 811a7ca7320c062e15d0f5b171fe6ad8592d1434 ] - -On error can_create() frees the allocated sk object, but sock_init_data() -has already attached it to the provided sock object. This will leave a -dangling sk pointer in the sock object and may cause use-after-free later. - -Signed-off-by: Ignat Korchagin -Reviewed-by: Vincent Mailhol -Reviewed-by: Kuniyuki Iwashima -Reviewed-by: Marc Kleine-Budde -Link: https://patch.msgid.link/20241014153808.51894-5-ignat@cloudflare.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/net/can/af_can.c b/net/can/af_can.c -index 707576eeeb58..01f3fbb3b67d 100644 ---- a/net/can/af_can.c -+++ b/net/can/af_can.c -@@ -171,6 +171,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol, - /* release sk on errors */ - sock_orphan(sk); - sock_put(sk); -+ sock->sk = NULL; - } - - errout: --- -2.50.1 (Apple Git-155) - diff --git a/1136-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch b/1136-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch deleted file mode 100644 index 7a47e08b3..000000000 --- a/1136-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch +++ /dev/null @@ -1,66 +0,0 @@ -From b9cdc1763c2f19e5d5f025e13cd0ccb71aa44616 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 20 Apr 2026 15:21:10 +0000 -Subject: [PATCH] crypto: asymmetric_keys - prevent overflow in - asymmetric_key_generate_id - -JIRA: https://redhat.atlassian.net/browse/RHEL-169566 -CVE: CVE-2025-68724 - -commit df0845cf447ae1556c3440b8b155de0926cbaa56 -Author: Thorsten Blum -Date: Mon Oct 13 13:40:10 2025 +0200 - - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - - Use check_add_overflow() to guard against potential integer overflows - when adding the binary blob lengths and the size of an asymmetric_key_id - structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a - possible buffer overflow when copying data from potentially malicious - X.509 certificate fields that can be arbitrarily large, such as ASN.1 - INTEGER serial numbers, issuer names, etc. - - Fixes: 7901c1a8effb ("KEYS: Implement binary asymmetric key ID handling") - Signed-off-by: Thorsten Blum - Reviewed-by: Lukas Wunner - Signed-off-by: Herbert Xu - -Signed-off-by: CKI Backport Bot - -diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c -index 43af5fa510c0..7859b0692b42 100644 ---- a/crypto/asymmetric_keys/asymmetric_type.c -+++ b/crypto/asymmetric_keys/asymmetric_type.c -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -151,12 +152,17 @@ struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1, - size_t len_2) - { - struct asymmetric_key_id *kid; -- -- kid = kmalloc(sizeof(struct asymmetric_key_id) + len_1 + len_2, -- GFP_KERNEL); -+ size_t kid_sz; -+ size_t len; -+ -+ if (check_add_overflow(len_1, len_2, &len)) -+ return ERR_PTR(-EOVERFLOW); -+ if (check_add_overflow(sizeof(struct asymmetric_key_id), len, &kid_sz)) -+ return ERR_PTR(-EOVERFLOW); -+ kid = kmalloc(kid_sz, GFP_KERNEL); - if (!kid) - return ERR_PTR(-ENOMEM); -- kid->len = len_1 + len_2; -+ kid->len = len; - memcpy(kid->data, val_1, len_1); - memcpy(kid->data + len_1, val_2, len_2); - return kid; --- -2.50.1 (Apple Git-155) - diff --git a/1137-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch b/1137-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch deleted file mode 100644 index 22be68ac5..000000000 --- a/1137-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From c88e70dc8bfca9a2be74a100387b1b66de973128 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:28 +0300 -Subject: [PATCH] drm/i915/dsc: Add helper to enable the DSC configuration for - a CRTC -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Add a helper to enable the DSC compression configuration for a CRTC. -Follow-up changes will introduce tracking for the same DSC state on the -whole link, which will need to be set whenever DSC is enabled for the -CRTC. Also, according to the above, when querying the DSC state on the -link, both the CRTC's and the link's DSC state must be considered. - -Setting the DSC configuration for a CRTC and querying the DSC -configuration for the link (added by follow-up changes) is better done -via helper functions based on the above, prepare for that here. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-2-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c -index 37faa8f19f6e..297368ff42a5 100644 ---- a/drivers/gpu/drm/i915/display/icl_dsi.c -+++ b/drivers/gpu/drm/i915/display/icl_dsi.c -@@ -1655,7 +1655,7 @@ static int gen11_dsi_dsc_compute_config(struct intel_encoder *encoder, - if (ret) - return ret; - -- crtc_state->dsc.compression_enable = true; -+ intel_dsc_enable_on_crtc(crtc_state); - - return 0; - } -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 7059d55687cf..fc1949e0c4de 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2475,7 +2475,8 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - return ret; - } - -- pipe_config->dsc.compression_enable = true; -+ intel_dsc_enable_on_crtc(pipe_config); -+ - drm_dbg_kms(display->drm, "DP DSC computed with Input Bpp = %d " - "Compressed Bpp = " FXP_Q4_FMT " Slice Count = %d\n", - pipe_config->pipe_bpp, -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c -index bca747e24a7f..803f3b395c79 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.c -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c -@@ -372,6 +372,11 @@ int intel_dsc_compute_params(struct intel_crtc_state *pipe_config) - return 0; - } - -+void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state) -+{ -+ crtc_state->dsc.compression_enable = true; -+} -+ - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder) - { -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.h b/drivers/gpu/drm/i915/display/intel_vdsc.h -index 2139391ff881..8c7c7fb652c3 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.h -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.h -@@ -20,6 +20,7 @@ void intel_uncompressed_joiner_enable(const struct intel_crtc_state *crtc_state) - void intel_dsc_enable(const struct intel_crtc_state *crtc_state); - void intel_dsc_disable(const struct intel_crtc_state *crtc_state); - int intel_dsc_compute_params(struct intel_crtc_state *pipe_config); -+void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state); - void intel_dsc_get_config(struct intel_crtc_state *crtc_state); - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder); --- -2.50.1 (Apple Git-155) - diff --git a/1138-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch b/1138-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch deleted file mode 100644 index 257ae4c4c..000000000 --- a/1138-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 69df31263bcabc527a5b526fb8972cb080a179b3 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:29 +0300 -Subject: [PATCH] drm/i915/dp: Ensure the FEC state stays disabled for UHBR - links -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Atm, in the DP SST case the FEC state is computed before -intel_crtc_state::port_clock is initialized, hence intel_dp_is_uhbr() -will always return false and the FEC state will be always computed -assuming a non-UHBR link. - -This happens to work, since the FEC state is recomputed later in -intel_dp_mtp_tu_compute_config(), where port_clock will be set already, -so intel_crtc_state::fec_enable will be reset as expected for UHBR. This -also depends on link rates being tried in an increasing order (i.e. from -non-UHBR -> UHBR link rates) in dsc_compute_link_config(), thus -intel_crtc_state::fec_enable being set for the non-UHBR rates and -getting reset for the first UHBR rate as expected. - -A follow-up change will reuse intel_dp_fec_compute_config() for the DP -MST state computation, prepare for that here, making sure that the -function determines the correct intel_crtc_state::fec_enable=false state -for UHBR link rates based on the above. - -The DP SST and MST state computation should be further unified to avoid -computing/setting the intel_crtc_state::fec_enable state multiple times, -but that's left for a follow-up change. For now add only code comments -about this. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-3-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index fc1949e0c4de..7c568c23134f 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2368,6 +2368,9 @@ static int intel_edp_dsc_compute_pipe_bpp(struct intel_dp *intel_dp, - static void intel_dp_fec_compute_config(struct intel_dp *intel_dp, - struct intel_crtc_state *crtc_state) - { -+ if (intel_dp_is_uhbr(crtc_state)) -+ return; -+ - if (crtc_state->fec_enable) - return; - -@@ -2379,9 +2382,6 @@ static void intel_dp_fec_compute_config(struct intel_dp *intel_dp, - if (intel_dp_is_edp(intel_dp)) - return; - -- if (intel_dp_is_uhbr(crtc_state)) -- return; -- - crtc_state->fec_enable = true; - } - -@@ -2400,6 +2400,10 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - bool is_mst = intel_crtc_has_type(pipe_config, INTEL_OUTPUT_DP_MST); - int ret; - -+ /* -+ * FIXME: set the FEC enabled state once pipe_config->port_clock is -+ * already known, so the UHBR/non-UHBR mode can be determined. -+ */ - intel_dp_fec_compute_config(intel_dp, pipe_config); - - if (!intel_dp_dsc_supports_format(connector, pipe_config->output_format)) -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index f2266b265304..27e952a67c34 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -293,6 +293,11 @@ int intel_dp_mtp_tu_compute_config(struct intel_dp *intel_dp, - mst_stream_update_slots(crtc_state, mst_state); - } - -+ /* -+ * NOTE: The following must reset crtc_state->fec_enable for UHBR/DSC -+ * after it was set by intel_dp_dsc_compute_config() -> -+ * intel_dp_fec_compute_config(). -+ */ - if (dsc) { - if (!intel_dp_supports_fec(intel_dp, connector, crtc_state)) - return -EINVAL; --- -2.50.1 (Apple Git-155) - diff --git a/1139-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch b/1139-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch deleted file mode 100644 index fda80dfe8..000000000 --- a/1139-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch +++ /dev/null @@ -1,106 +0,0 @@ -From cb6c8f1f6f46ac2cbfb42ce8eb8b18257aeaa91a Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:30 +0300 -Subject: [PATCH] drm/i915/dp: Export helper to determine if FEC on non-UHBR - links is required -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Export the helper function to determine if FEC is required on a non-UHBR -(8b10b) SST or MST link. A follow up change will take this into use for -MST as well. - -While at it determine the output type from the CRTC state, which allows -dropping the intel_dp argument. Also make the function return the -required FEC state, instead of setting this in the CRTC state, which -allows only querying this requirement, without changing the state. - -Also rename the function to intel_dp_needs_8b10b_fec(), to clarify that -the function determines if FEC is required on an 8b10b link (on 128b132b -links FEC is always enabled by the HW implicitly, so the function will -return false for that case). - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-4-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 7c568c23134f..844118735998 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2365,24 +2365,29 @@ static int intel_edp_dsc_compute_pipe_bpp(struct intel_dp *intel_dp, - return 0; - } - --static void intel_dp_fec_compute_config(struct intel_dp *intel_dp, -- struct intel_crtc_state *crtc_state) -+/* -+ * Return whether FEC must be enabled for 8b10b SST or MST links. On 128b132b -+ * links FEC is always enabled implicitly by the HW, so this function returns -+ * false for that case. -+ */ -+bool intel_dp_needs_8b10b_fec(const struct intel_crtc_state *crtc_state, -+ bool dsc_enabled_on_crtc) - { - if (intel_dp_is_uhbr(crtc_state)) -- return; -+ return false; - - if (crtc_state->fec_enable) -- return; -+ return true; - - /* - * Though eDP v1.5 supports FEC with DSC, unlike DP, it is optional. - * Since, FEC is a bandwidth overhead, continue to not enable it for - * eDP. Until, there is a good reason to do so. - */ -- if (intel_dp_is_edp(intel_dp)) -- return; -+ if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP)) -+ return false; - -- crtc_state->fec_enable = true; -+ return dsc_enabled_on_crtc; - } - - int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, -@@ -2404,7 +2409,7 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - * FIXME: set the FEC enabled state once pipe_config->port_clock is - * already known, so the UHBR/non-UHBR mode can be determined. - */ -- intel_dp_fec_compute_config(intel_dp, pipe_config); -+ pipe_config->fec_enable = intel_dp_needs_8b10b_fec(pipe_config, true); - - if (!intel_dp_dsc_supports_format(connector, pipe_config->output_format)) - return -EINVAL; -diff --git a/drivers/gpu/drm/i915/display/intel_dp.h b/drivers/gpu/drm/i915/display/intel_dp.h -index 281ced3a3b39..0537be20fe7b 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.h -+++ b/drivers/gpu/drm/i915/display/intel_dp.h -@@ -73,6 +73,8 @@ void intel_dp_encoder_flush_work(struct drm_encoder *encoder); - int intel_dp_compute_config(struct intel_encoder *encoder, - struct intel_crtc_state *pipe_config, - struct drm_connector_state *conn_state); -+bool intel_dp_needs_8b10b_fec(const struct intel_crtc_state *crtc_state, -+ bool dsc_enabled_on_crtc); - int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - struct intel_crtc_state *pipe_config, - struct drm_connector_state *conn_state, -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index 27e952a67c34..d0590b5ffffd 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -296,7 +296,7 @@ int intel_dp_mtp_tu_compute_config(struct intel_dp *intel_dp, - /* - * NOTE: The following must reset crtc_state->fec_enable for UHBR/DSC - * after it was set by intel_dp_dsc_compute_config() -> -- * intel_dp_fec_compute_config(). -+ * intel_dp_needs_8b10b_fec(). - */ - if (dsc) { - if (!intel_dp_supports_fec(intel_dp, connector, crtc_state)) --- -2.50.1 (Apple Git-155) - diff --git a/1140-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch b/1140-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch deleted file mode 100644 index fee2d6f6e..000000000 --- a/1140-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch +++ /dev/null @@ -1,40 +0,0 @@ -From b762ae48293e2cc2145cdc91eb596d057f1aff11 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:31 +0300 -Subject: [PATCH] drm/i915/dp_mst: Reuse the DP-SST helper function to compute - FEC config -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Reuse the DP-SST helper to compute the state for the FEC enabled state -for DP-MST as well. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-5-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index d0590b5ffffd..0cbb4c3a8e22 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -298,12 +298,10 @@ int intel_dp_mtp_tu_compute_config(struct intel_dp *intel_dp, - * after it was set by intel_dp_dsc_compute_config() -> - * intel_dp_needs_8b10b_fec(). - */ -- if (dsc) { -- if (!intel_dp_supports_fec(intel_dp, connector, crtc_state)) -- return -EINVAL; -- -- crtc_state->fec_enable = !intel_dp_is_uhbr(crtc_state); -- } -+ crtc_state->fec_enable = intel_dp_needs_8b10b_fec(crtc_state, dsc); -+ if (crtc_state->fec_enable && -+ !intel_dp_supports_fec(intel_dp, connector, crtc_state)) -+ return -EINVAL; - - max_dpt_bpp_x16 = fxp_q4_from_int(intel_dp_mst_max_dpt_bpp(crtc_state, dsc)); - if (max_dpt_bpp_x16 && max_bpp_x16 > max_dpt_bpp_x16) { --- -2.50.1 (Apple Git-155) - diff --git a/1141-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch b/1141-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch deleted file mode 100644 index bf9cac3f6..000000000 --- a/1141-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 7c027070e98d7b515e4d3a94b54d288c61cb5918 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:32 +0300 -Subject: [PATCH] drm/i915/dp_mst: Track DSC enabled status on the MST link -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Track whether DSC is enabled on any CRTC on a link. On DP-SST (and DSI) -this will always match the CRTC's DSC state, those links having only a -single stream (aka CRTC). For instance, on DP-MST if DSC is enabled for -CRTC#0, but disabled for CRTC#1, the DSC/FEC state for these CRTCs will -be as follows: - -CRTC#0: - - compression_enable = true - - compression_enabled_on_link = true - - fec_enable = true for 8b10b, false for 128b132b - -CRTC#1: - - compression_enable = false - - compression_enabled_on_link = true - - fec_enable = true for 8b10b, false for 128b132b - -This patch only sets compression_enabled_on_link for CRTC#0 above and -enables FEC on CRTC#0 if DSC was enabled on any other CRTC on the 8b10b -MST link. A follow-up change will make sure that the state of all the -CRTCs (CRTC#1 above) on an MST link is recomputed if DSC gets enabled on -any CRTC, setting compression_enabled_on_link and fec_enable for these. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-6-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h -index 203dd38a9ec4..20747fa4d3da 100644 ---- a/drivers/gpu/drm/i915/display/intel_display_types.h -+++ b/drivers/gpu/drm/i915/display/intel_display_types.h -@@ -1279,6 +1279,8 @@ struct intel_crtc_state { - - /* Display Stream compression state */ - struct { -+ /* Only used for state computation, not read out from the HW. */ -+ bool compression_enabled_on_link; - bool compression_enable; - int num_streams; - /* Compressed Bpp in U6.4 format (first 4 bits for fractional part) */ -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 844118735998..95884af242b3 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2387,7 +2387,7 @@ bool intel_dp_needs_8b10b_fec(const struct intel_crtc_state *crtc_state, - if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP)) - return false; - -- return dsc_enabled_on_crtc; -+ return dsc_enabled_on_crtc || intel_dsc_enabled_on_link(crtc_state); - } - - int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c -index 803f3b395c79..dbf2cf1b896d 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.c -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c -@@ -374,9 +374,20 @@ int intel_dsc_compute_params(struct intel_crtc_state *pipe_config) - - void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state) - { -+ crtc_state->dsc.compression_enabled_on_link = true; - crtc_state->dsc.compression_enable = true; - } - -+bool intel_dsc_enabled_on_link(const struct intel_crtc_state *crtc_state) -+{ -+ struct intel_display *display = to_intel_display(crtc_state); -+ -+ drm_WARN_ON(display->drm, crtc_state->dsc.compression_enable && -+ !crtc_state->dsc.compression_enabled_on_link); -+ -+ return crtc_state->dsc.compression_enabled_on_link; -+} -+ - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder) - { -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.h b/drivers/gpu/drm/i915/display/intel_vdsc.h -index 8c7c7fb652c3..99f64ac54b27 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.h -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.h -@@ -21,6 +21,7 @@ void intel_dsc_enable(const struct intel_crtc_state *crtc_state); - void intel_dsc_disable(const struct intel_crtc_state *crtc_state); - int intel_dsc_compute_params(struct intel_crtc_state *pipe_config); - void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state); -+bool intel_dsc_enabled_on_link(const struct intel_crtc_state *crtc_state); - void intel_dsc_get_config(struct intel_crtc_state *crtc_state); - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder); --- -2.50.1 (Apple Git-155) - diff --git a/1142-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch b/1142-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch deleted file mode 100644 index 9dcfb6ca3..000000000 --- a/1142-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch +++ /dev/null @@ -1,171 +0,0 @@ -From 470b84af457e34cbfa4d2c17dab78746736ab898 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:33 +0300 -Subject: [PATCH] drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets - enabled on the link -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The state of all the CRTCs on an MST link must be recomputed, if DSC -gets enabled on any of the CRTCs on the link. For instance an MST -docking station's Panel Replay capability may depend on whether DSC is -enabled on any of the dock's streams (aka CRTCs). To assist the Panel -Replay state computation for a CRTC based on the above, track in the -CRTC state if DSC is enabled on any CRTC on an MST link. - -The intel_link_bw_limits::force_fec_pipes mask is used for a reason -similar to the above: enable FEC on all CRTCs of a non-UHBR (8b10b) MST -link if DSC is enabled on any of the link's CRTCs. The FEC enabled state -for a CRTC doesn't indicate if DSC is enabled on a UHBR MST link (FEC is -always enabled by the HW for UHBR, hence it's not tracked by the -intel_crtc_state::fec_enable flag for such links, where this flag is -always false). - -Based on the above, to be able to determine the DSC state on both -non-UHBR and UHBR MST links, track the more generic DSC-enabled-on-link -state (instead of the FEC-enabled-on-link state) for each CRTC in -intel_link_bw_limits. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-7-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c -index bbb6ff929d64..a8b4619de347 100644 ---- a/drivers/gpu/drm/i915/display/intel_display.c -+++ b/drivers/gpu/drm/i915/display/intel_display.c -@@ -4603,7 +4603,7 @@ intel_modeset_pipe_config(struct intel_atomic_state *state, - if (ret) - return ret; - -- crtc_state->fec_enable = limits->force_fec_pipes & BIT(crtc->pipe); -+ crtc_state->dsc.compression_enabled_on_link = limits->link_dsc_pipes & BIT(crtc->pipe); - crtc_state->max_link_bpp_x16 = limits->max_bpp_x16[crtc->pipe]; - - if (crtc_state->pipe_bpp > fxp_q4_to_int(crtc_state->max_link_bpp_x16)) { -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index 0cbb4c3a8e22..a845b2612a3f 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -814,14 +814,14 @@ static u8 get_pipes_downstream_of_mst_port(struct intel_atomic_state *state, - return mask; - } - --static int intel_dp_mst_check_fec_change(struct intel_atomic_state *state, -+static int intel_dp_mst_check_dsc_change(struct intel_atomic_state *state, - struct drm_dp_mst_topology_mgr *mst_mgr, - struct intel_link_bw_limits *limits) - { - struct intel_display *display = to_intel_display(state); - struct intel_crtc *crtc; - u8 mst_pipe_mask; -- u8 fec_pipe_mask = 0; -+ u8 dsc_pipe_mask = 0; - int ret; - - mst_pipe_mask = get_pipes_downstream_of_mst_port(state, mst_mgr, NULL); -@@ -834,16 +834,16 @@ static int intel_dp_mst_check_fec_change(struct intel_atomic_state *state, - if (drm_WARN_ON(display->drm, !crtc_state)) - return -EINVAL; - -- if (crtc_state->fec_enable) -- fec_pipe_mask |= BIT(crtc->pipe); -+ if (intel_dsc_enabled_on_link(crtc_state)) -+ dsc_pipe_mask |= BIT(crtc->pipe); - } - -- if (!fec_pipe_mask || mst_pipe_mask == fec_pipe_mask) -+ if (!dsc_pipe_mask || mst_pipe_mask == dsc_pipe_mask) - return 0; - -- limits->force_fec_pipes |= mst_pipe_mask; -+ limits->link_dsc_pipes |= mst_pipe_mask; - -- ret = intel_modeset_pipes_in_mask_early(state, "MST FEC", -+ ret = intel_modeset_pipes_in_mask_early(state, "MST DSC", - mst_pipe_mask); - - return ret ? : -EAGAIN; -@@ -897,7 +897,7 @@ int intel_dp_mst_atomic_check_link(struct intel_atomic_state *state, - int i; - - for_each_new_mst_mgr_in_state(&state->base, mgr, mst_state, i) { -- ret = intel_dp_mst_check_fec_change(state, mgr, limits); -+ ret = intel_dp_mst_check_dsc_change(state, mgr, limits); - if (ret) - return ret; - -diff --git a/drivers/gpu/drm/i915/display/intel_link_bw.c b/drivers/gpu/drm/i915/display/intel_link_bw.c -index f52dee0ea412..d2862de894fa 100644 ---- a/drivers/gpu/drm/i915/display/intel_link_bw.c -+++ b/drivers/gpu/drm/i915/display/intel_link_bw.c -@@ -20,6 +20,7 @@ - #include "intel_dp_tunnel.h" - #include "intel_fdi.h" - #include "intel_link_bw.h" -+#include "intel_vdsc.h" - - static int get_forced_link_bpp_x16(struct intel_atomic_state *state, - const struct intel_crtc *crtc) -@@ -55,7 +56,7 @@ void intel_link_bw_init_limits(struct intel_atomic_state *state, - struct intel_display *display = to_intel_display(state); - enum pipe pipe; - -- limits->force_fec_pipes = 0; -+ limits->link_dsc_pipes = 0; - limits->bpp_limit_reached_pipes = 0; - for_each_pipe(display, pipe) { - struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe); -@@ -65,8 +66,8 @@ void intel_link_bw_init_limits(struct intel_atomic_state *state, - - if (state->base.duplicated && crtc_state) { - limits->max_bpp_x16[pipe] = crtc_state->max_link_bpp_x16; -- if (crtc_state->fec_enable) -- limits->force_fec_pipes |= BIT(pipe); -+ if (intel_dsc_enabled_on_link(crtc_state)) -+ limits->link_dsc_pipes |= BIT(pipe); - } else { - limits->max_bpp_x16[pipe] = INT_MAX; - } -@@ -265,10 +266,10 @@ assert_link_limit_change_valid(struct intel_display *display, - bool bpps_changed = false; - enum pipe pipe; - -- /* FEC can't be forced off after it was forced on. */ -+ /* DSC can't be disabled after it was enabled. */ - if (drm_WARN_ON(display->drm, -- (old_limits->force_fec_pipes & new_limits->force_fec_pipes) != -- old_limits->force_fec_pipes)) -+ (old_limits->link_dsc_pipes & new_limits->link_dsc_pipes) != -+ old_limits->link_dsc_pipes)) - return false; - - for_each_pipe(display, pipe) { -@@ -286,8 +287,8 @@ assert_link_limit_change_valid(struct intel_display *display, - /* At least one limit must change. */ - if (drm_WARN_ON(display->drm, - !bpps_changed && -- new_limits->force_fec_pipes == -- old_limits->force_fec_pipes)) -+ new_limits->link_dsc_pipes == -+ old_limits->link_dsc_pipes)) - return false; - - return true; -diff --git a/drivers/gpu/drm/i915/display/intel_link_bw.h b/drivers/gpu/drm/i915/display/intel_link_bw.h -index 95ab7c50c61d..cb18e171037c 100644 ---- a/drivers/gpu/drm/i915/display/intel_link_bw.h -+++ b/drivers/gpu/drm/i915/display/intel_link_bw.h -@@ -15,7 +15,7 @@ struct intel_connector; - struct intel_crtc_state; - - struct intel_link_bw_limits { -- u8 force_fec_pipes; -+ u8 link_dsc_pipes; - u8 bpp_limit_reached_pipes; - /* in 1/16 bpp units */ - int max_bpp_x16[I915_MAX_PIPES]; --- -2.50.1 (Apple Git-155) - diff --git a/1143-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch b/1143-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch deleted file mode 100644 index 02ca89c5a..000000000 --- a/1143-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch +++ /dev/null @@ -1,248 +0,0 @@ -From c390bf07961b3a39f3417d75850a4e721b87e595 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:34 +0300 -Subject: [PATCH] drm/i915/dp: Fix panel replay when DSC is enabled -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Prevent enabling panel replay if the sink doesn't support this due to -DSC being enabled. - -Panel replay has two modes, updating full frames or only selected -regions of the frame. If the sink doesn't support Panel Replay in full -frame update mode with DSC prevent Panel Replay completely if DSC is -enabled. If the sink doesn't support Panel Replay only in the selective -update mode while DSC is enabled, it will still support Panel Replay in -the full frame update mode, so only prevent selective updates in this -case. - -v2: -- Use Panel Replay instead of PR in debug prints. (Jouni) -- Rebase on change tracking the link DSC state in the crtc state. - -Cc: Jouni Högander -Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14869 -Reviewed-by: Jouni Högander -Signed-off-by: Imre Deak -Link: https://lore.kernel.org/r/20251015161934.262108-8-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h -index 20747fa4d3da..1e0cd81c9474 100644 ---- a/drivers/gpu/drm/i915/display/intel_display_types.h -+++ b/drivers/gpu/drm/i915/display/intel_display_types.h -@@ -955,6 +955,12 @@ struct intel_csc_matrix { - u16 postoff[3]; - }; - -+enum intel_panel_replay_dsc_support { -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED, -+ INTEL_DP_PANEL_REPLAY_DSC_FULL_FRAME_ONLY, -+ INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE, -+}; -+ - struct intel_crtc_state { - /* - * uapi (drm) state. This is the software state shown to userspace. -@@ -1133,6 +1139,8 @@ struct intel_crtc_state { - bool has_panel_replay; - bool wm_level_disabled; - bool pkg_c_latency_used; -+ /* Only used for state verification. */ -+ enum intel_panel_replay_dsc_support panel_replay_dsc_support; - u32 dc3co_exitline; - u16 su_y_granularity; - u8 active_non_psr_pipes; -@@ -1706,6 +1714,7 @@ struct intel_psr { - bool source_panel_replay_support; - bool sink_panel_replay_support; - bool sink_panel_replay_su_support; -+ enum intel_panel_replay_dsc_support sink_panel_replay_dsc_support; - bool panel_replay_enabled; - u32 dc3co_exitline; - u32 dc3co_exit_delay; -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 95884af242b3..215ad690ab07 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -6053,6 +6053,8 @@ intel_dp_detect(struct drm_connector *_connector, - memset(connector->dp.dsc_dpcd, 0, sizeof(connector->dp.dsc_dpcd)); - intel_dp->psr.sink_panel_replay_support = false; - intel_dp->psr.sink_panel_replay_su_support = false; -+ intel_dp->psr.sink_panel_replay_dsc_support = -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED; - - intel_dp_mst_disconnect(intel_dp); - -diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c -index 703e5f6af04c..3e99a65ec988 100644 ---- a/drivers/gpu/drm/i915/display/intel_psr.c -+++ b/drivers/gpu/drm/i915/display/intel_psr.c -@@ -29,6 +29,7 @@ - #include - - #include "i915_reg.h" -+#include "i915_utils.h" - #include "intel_alpm.h" - #include "intel_atomic.h" - #include "intel_crtc.h" -@@ -50,6 +51,7 @@ - #include "intel_snps_phy.h" - #include "intel_step.h" - #include "intel_vblank.h" -+#include "intel_vdsc.h" - #include "intel_vrr.h" - #include "skl_universal_plane.h" - -@@ -580,6 +582,44 @@ static void intel_dp_get_su_granularity(struct intel_dp *intel_dp) - intel_dp->psr.su_y_granularity = y; - } - -+static enum intel_panel_replay_dsc_support -+compute_pr_dsc_support(struct intel_dp *intel_dp) -+{ -+ u8 pr_dsc_mode; -+ u8 val; -+ -+ val = intel_dp->pr_dpcd[INTEL_PR_DPCD_INDEX(DP_PANEL_REPLAY_CAP_CAPABILITY)]; -+ pr_dsc_mode = REG_FIELD_GET8(DP_PANEL_REPLAY_DSC_DECODE_CAPABILITY_IN_PR_MASK, val); -+ -+ switch (pr_dsc_mode) { -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_FULL_FRAME_ONLY: -+ return INTEL_DP_PANEL_REPLAY_DSC_FULL_FRAME_ONLY; -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_SUPPORTED: -+ return INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE; -+ default: -+ MISSING_CASE(pr_dsc_mode); -+ fallthrough; -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_NOT_SUPPORTED: -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_RESERVED: -+ return INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED; -+ } -+} -+ -+static const char *panel_replay_dsc_support_str(enum intel_panel_replay_dsc_support dsc_support) -+{ -+ switch (dsc_support) { -+ case INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED: -+ return "not supported"; -+ case INTEL_DP_PANEL_REPLAY_DSC_FULL_FRAME_ONLY: -+ return "full frame only"; -+ case INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE: -+ return "selective update"; -+ default: -+ MISSING_CASE(dsc_support); -+ return "n/a"; -+ }; -+} -+ - static void _panel_replay_init_dpcd(struct intel_dp *intel_dp) - { - struct intel_display *display = to_intel_display(intel_dp); -@@ -615,10 +655,13 @@ static void _panel_replay_init_dpcd(struct intel_dp *intel_dp) - DP_PANEL_REPLAY_SU_SUPPORT) - intel_dp->psr.sink_panel_replay_su_support = true; - -+ intel_dp->psr.sink_panel_replay_dsc_support = compute_pr_dsc_support(intel_dp); -+ - drm_dbg_kms(display->drm, -- "Panel replay %sis supported by panel\n", -+ "Panel replay %sis supported by panel (in DSC mode: %s)\n", - intel_dp->psr.sink_panel_replay_su_support ? -- "selective_update " : ""); -+ "selective_update " : "", -+ panel_replay_dsc_support_str(intel_dp->psr.sink_panel_replay_dsc_support)); - } - - static void _psr_init_dpcd(struct intel_dp *intel_dp) -@@ -1606,9 +1649,21 @@ static bool intel_sel_update_config_valid(struct intel_dp *intel_dp, - goto unsupported; - } - -- if (crtc_state->has_panel_replay && (DISPLAY_VER(display) < 14 || -- !intel_dp->psr.sink_panel_replay_su_support)) -- goto unsupported; -+ if (crtc_state->has_panel_replay) { -+ if (DISPLAY_VER(display) < 14) -+ goto unsupported; -+ -+ if (!intel_dp->psr.sink_panel_replay_su_support) -+ goto unsupported; -+ -+ if (intel_dsc_enabled_on_link(crtc_state) && -+ intel_dp->psr.sink_panel_replay_dsc_support != -+ INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE) { -+ drm_dbg_kms(display->drm, -+ "Selective update with Panel Replay not enabled because it's not supported with DSC\n"); -+ goto unsupported; -+ } -+ } - - if (crtc_state->crc_enabled) { - drm_dbg_kms(display->drm, -@@ -1685,6 +1740,14 @@ _panel_replay_compute_config(struct intel_dp *intel_dp, - return false; - } - -+ if (intel_dsc_enabled_on_link(crtc_state) && -+ intel_dp->psr.sink_panel_replay_dsc_support == -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED) { -+ drm_dbg_kms(display->drm, -+ "Panel Replay not enabled because it's not supported with DSC\n"); -+ return false; -+ } -+ - if (!intel_dp_is_edp(intel_dp)) - return true; - -@@ -1790,6 +1853,8 @@ void intel_psr_compute_config(struct intel_dp *intel_dp, - return; - } - -+ /* Only used for state verification. */ -+ crtc_state->panel_replay_dsc_support = intel_dp->psr.sink_panel_replay_dsc_support; - crtc_state->has_panel_replay = _panel_replay_compute_config(intel_dp, - crtc_state, - conn_state); -@@ -2991,6 +3056,20 @@ void intel_psr_pre_plane_update(struct intel_atomic_state *state, - } - } - -+static void -+verify_panel_replay_dsc_state(const struct intel_crtc_state *crtc_state) -+{ -+ struct intel_display *display = to_intel_display(crtc_state); -+ -+ if (!crtc_state->has_panel_replay) -+ return; -+ -+ drm_WARN_ON(display->drm, -+ intel_dsc_enabled_on_link(crtc_state) && -+ crtc_state->panel_replay_dsc_support == -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED); -+} -+ - void intel_psr_post_plane_update(struct intel_atomic_state *state, - struct intel_crtc *crtc) - { -@@ -3002,6 +3081,8 @@ void intel_psr_post_plane_update(struct intel_atomic_state *state, - if (!crtc_state->has_psr) - return; - -+ verify_panel_replay_dsc_state(crtc_state); -+ - for_each_intel_encoder_mask_with_psr(state->base.dev, encoder, - crtc_state->uapi.encoder_mask) { - struct intel_dp *intel_dp = enc_to_intel_dp(encoder); -@@ -4031,6 +4112,8 @@ static void intel_psr_sink_capability(struct intel_dp *intel_dp, - seq_printf(m, ", Panel Replay = %s", str_yes_no(psr->sink_panel_replay_support)); - seq_printf(m, ", Panel Replay Selective Update = %s", - str_yes_no(psr->sink_panel_replay_su_support)); -+ seq_printf(m, ", Panel Replay DSC support = %s", -+ panel_replay_dsc_support_str(psr->sink_panel_replay_dsc_support)); - if (intel_dp->pr_dpcd[INTEL_PR_DPCD_INDEX(DP_PANEL_REPLAY_CAP_SUPPORT)] & - DP_PANEL_REPLAY_EARLY_TRANSPORT_SUPPORT) - seq_printf(m, " (Early Transport)"); --- -2.50.1 (Apple Git-155) - diff --git a/1144-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch b/1144-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch deleted file mode 100644 index 3a42b4a2c..000000000 --- a/1144-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch +++ /dev/null @@ -1,65 +0,0 @@ -From af5918335a6b77434c851c87d24e75eb7f93b8cb Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Wed, 15 Apr 2026 22:49:21 -0500 -Subject: [PATCH] Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to - missing sock_hold - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit 598dbba9919c5e36c54fe1709b557d64120cb94b -Author: Hyunwoo Kim -Date: Fri Mar 13 05:26:16 2026 +0900 - - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - - sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately - releases the lock without holding a reference to the socket. A concurrent - close() can free the socket between the lock release and the subsequent - sk->sk_state access, resulting in a use-after-free. - - Other functions in the same file (sco_sock_timeout(), sco_conn_del()) - correctly use sco_sock_hold() to safely hold a reference under the lock. - - Fix by using sco_sock_hold() to take a reference before releasing the - lock, and adding sock_put() on all exit paths. - - Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") - Signed-off-by: Hyunwoo Kim - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 2b937df7a71f..6fc0914c74cb 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -401,7 +401,7 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) - struct sock *sk; - - sco_conn_lock(conn); -- sk = conn->sk; -+ sk = sco_sock_hold(conn); - sco_conn_unlock(conn); - - if (!sk) -@@ -410,11 +410,15 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) - BT_DBG("sk %p len %u", sk, skb->len); - - if (sk->sk_state != BT_CONNECTED) -- goto drop; -+ goto drop_put; - -- if (!sock_queue_rcv_skb(sk, skb)) -+ if (!sock_queue_rcv_skb(sk, skb)) { -+ sock_put(sk); - return; -+ } - -+drop_put: -+ sock_put(sk); - drop: - kfree_skb(skb); - } --- -2.50.1 (Apple Git-155) - diff --git a/1145-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch b/1145-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch deleted file mode 100644 index 209fc0a7d..000000000 --- a/1145-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch +++ /dev/null @@ -1,98 +0,0 @@ -From b53cdfa3715c656f739adda6465bc405c536f37b Mon Sep 17 00:00:00 2001 -From: Vitaly Kuznetsov -Date: Tue, 28 Apr 2026 14:00:04 +0200 -Subject: [PATCH] scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for - Hyper-V vFC - -JIRA: https://redhat.atlassian.net/browse/RHEL-171460 - -commit 9cf351b289fb2be22491fa3964f99126db67aa08 -Author: Li Tian -Date: Mon Apr 6 09:53:44 2026 +0800 - - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC - - The storvsc driver has become stricter in handling SRB status codes - returned by the Hyper-V host. When using Virtual Fibre Channel (vFC) - passthrough, the host may return SRB_STATUS_DATA_OVERRUN for - PERSISTENT_RESERVE_IN commands if the allocation length in the CDB does - not match the host's expected response size. - - Currently, this status is treated as a fatal error, propagating - Host_status=0x07 [DID_ERROR] to the SCSI mid-layer. This causes - userspace storage utilities (such as sg_persist) to fail with transport - errors, even when the host has actually returned the requested - reservation data in the buffer. - - Refactor the existing command-specific workarounds into a new helper - function, storvsc_host_mishandles_cmd(), and add PERSISTENT_RESERVE_IN - to the list of commands where SRB status errors should be suppressed for - vFC devices. This ensures that the SCSI mid-layer processes the returned - data buffer instead of terminating the command. - - Signed-off-by: Li Tian - Reviewed-by: Long Li - Reviewed-by: Laurence Oberman - Link: https://patch.msgid.link/20260406015344.12566-1-litian@redhat.com - Signed-off-by: Martin K. Petersen - -Signed-off-by: Vitaly Kuznetsov - -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index b47cda30e109..11e3aaae77be 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1131,6 +1131,26 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, - kfree(payload); - } - -+/* -+ * The current SCSI handling on the host side does not correctly handle: -+ * INQUIRY with page code 0x80, MODE_SENSE / MODE_SENSE_10 with cmd[2] == 0x1c, -+ * and (for FC) MAINTENANCE_IN / PERSISTENT_RESERVE_IN passthrough. -+ */ -+static bool storvsc_host_mishandles_cmd(u8 opcode, struct hv_device *device) -+{ -+ switch (opcode) { -+ case INQUIRY: -+ case MODE_SENSE: -+ case MODE_SENSE_10: -+ return true; -+ case MAINTENANCE_IN: -+ case PERSISTENT_RESERVE_IN: -+ return hv_dev_is_fc(device); -+ default: -+ return false; -+ } -+} -+ - static void storvsc_on_io_completion(struct storvsc_device *stor_device, - struct vstor_packet *vstor_packet, - struct storvsc_cmd_request *request) -@@ -1141,22 +1161,12 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, - stor_pkt = &request->vstor_packet; - - /* -- * The current SCSI handling on the host side does -- * not correctly handle: -- * INQUIRY command with page code parameter set to 0x80 -- * MODE_SENSE and MODE_SENSE_10 command with cmd[2] == 0x1c -- * MAINTENANCE_IN is not supported by HyperV FC passthrough -- * - * Setup srb and scsi status so this won't be fatal. - * We do this so we can distinguish truly fatal failues - * (srb status == 0x4) and off-line the device in that case. - */ - -- if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) || -- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) || -- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE_10) || -- (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN && -- hv_dev_is_fc(device))) { -+ if (storvsc_host_mishandles_cmd(stor_pkt->vm_srb.cdb[0], device)) { - vstor_packet->vm_srb.scsi_status = 0; - vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS; - } --- -2.50.1 (Apple Git-155) - diff --git a/1146-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch b/1146-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch deleted file mode 100644 index e2a94a024..000000000 --- a/1146-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 288852ae095fabc060f4823784bec8cd5baf2edf Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 12:54:18 +0800 -Subject: [PATCH] crypto: af-alg - fix NULL pointer dereference in scatterwalk - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 - -Upstream Status: 62397b493e14107ae82d8b80938f293d95425bcb - -commit 62397b493e14107ae82d8b80938f293d95425bcb -Author: Norbert Szetei -Date: Wed Mar 25 18:26:13 2026 +0100 - - crypto: af-alg - fix NULL pointer dereference in scatterwalk - - The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) - when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL - exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent - sendmsg() allocates a new SGL and chains it, but fails to clear the end - marker on the previous SGL's last data entry. - - This causes the crypto scatterwalk to hit a premature end, returning NULL - on sg_next() and leading to a kernel panic during dereference. - - Fix this by explicitly unmarking the end of the previous SGL when - performing sg_chain() in af_alg_alloc_tsgl(). - - Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations") - Signed-off-by: Norbert Szetei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 0da7c1ac778a..1594a2dd9222 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -623,8 +623,10 @@ static int af_alg_alloc_tsgl(struct sock *sk) - sg_init_table(sgl->sg, MAX_SGL_ENTS + 1); - sgl->cur = 0; - -- if (sg) -+ if (sg) { -+ sg_unmark_end(sg + MAX_SGL_ENTS - 1); - sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg); -+ } - - list_add_tail(&sgl->list, &ctx->tsgl_list); - } --- -2.50.1 (Apple Git-155) - diff --git a/1147-crypto-algif-aead-revert-to-operating-out-of-place.patch b/1147-crypto-algif-aead-revert-to-operating-out-of-place.patch deleted file mode 100644 index 5ec840229..000000000 --- a/1147-crypto-algif-aead-revert-to-operating-out-of-place.patch +++ /dev/null @@ -1,327 +0,0 @@ -From 290aaf22a335e76982159d1cb5eec8566628fa40 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:52:06 +0800 -Subject: [PATCH] crypto: algif_aead - Revert to operating out-of-place - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 -CVE: CVE-2026-31431 - -Upstream Status: a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 - -commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 -Author: Herbert Xu -Date: Thu Mar 26 15:30:20 2026 +0900 - - crypto: algif_aead - Revert to operating out-of-place - - This mostly reverts commit 72548b093ee3 except for the copying of - the associated data. - - There is no benefit in operating in-place in algif_aead since the - source and destination come from different mappings. Get rid of - all the complexity added for in-place operation and just copy the - AD directly. - - Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst") - Reported-by: Taeyang Lee <0wn@theori.io> - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 1594a2dd9222..b2fe28992ebf 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -637,15 +637,13 @@ static int af_alg_alloc_tsgl(struct sock *sk) - /** - * af_alg_count_tsgl - Count number of TX SG entries - * -- * The counting starts from the beginning of the SGL to @bytes. If -- * an @offset is provided, the counting of the SG entries starts at the @offset. -+ * The counting starts from the beginning of the SGL to @bytes. - * - * @sk: socket of connection to user space - * @bytes: Count the number of SG entries holding given number of bytes. -- * @offset: Start the counting of SG entries from the given offset. - * Return: Number of TX SG entries found given the constraints - */ --unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset) -+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes) - { - const struct alg_sock *ask = alg_sk(sk); - const struct af_alg_ctx *ctx = ask->private; -@@ -660,25 +658,11 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset) - const struct scatterlist *sg = sgl->sg; - - for (i = 0; i < sgl->cur; i++) { -- size_t bytes_count; -- -- /* Skip offset */ -- if (offset >= sg[i].length) { -- offset -= sg[i].length; -- bytes -= sg[i].length; -- continue; -- } -- -- bytes_count = sg[i].length - offset; -- -- offset = 0; - sgl_count++; -- -- /* If we have seen requested number of bytes, stop */ -- if (bytes_count >= bytes) -+ if (sg[i].length >= bytes) - return sgl_count; - -- bytes -= bytes_count; -+ bytes -= sg[i].length; - } - } - -@@ -690,19 +674,14 @@ EXPORT_SYMBOL_GPL(af_alg_count_tsgl); - * af_alg_pull_tsgl - Release the specified buffers from TX SGL - * - * If @dst is non-null, reassign the pages to @dst. The caller must release -- * the pages. If @dst_offset is given only reassign the pages to @dst starting -- * at the @dst_offset (byte). The caller must ensure that @dst is large -- * enough (e.g. by using af_alg_count_tsgl with the same offset). -+ * the pages. - * - * @sk: socket of connection to user space - * @used: Number of bytes to pull from TX SGL - * @dst: If non-NULL, buffer is reassigned to dst SGL instead of releasing. The - * caller must release the buffers in dst. -- * @dst_offset: Reassign the TX SGL from given offset. All buffers before -- * reaching the offset is released. - */ --void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, -- size_t dst_offset) -+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst) - { - struct alg_sock *ask = alg_sk(sk); - struct af_alg_ctx *ctx = ask->private; -@@ -727,18 +706,10 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, - * SG entries in dst. - */ - if (dst) { -- if (dst_offset >= plen) { -- /* discard page before offset */ -- dst_offset -= plen; -- } else { -- /* reassign page to dst after offset */ -- get_page(page); -- sg_set_page(dst + j, page, -- plen - dst_offset, -- sg[i].offset + dst_offset); -- dst_offset = 0; -- j++; -- } -+ /* reassign page to dst after offset */ -+ get_page(page); -+ sg_set_page(dst + j, page, plen, sg[i].offset); -+ j++; - } - - sg[i].length -= plen; -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index 7d58cbbce4af..dff71bd753a7 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -96,9 +96,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - struct aead_tfm *aeadc = pask->private; - struct crypto_aead *tfm = aeadc->aead; - struct crypto_sync_skcipher *null_tfm = aeadc->null_tfm; -- unsigned int i, as = crypto_aead_authsize(tfm); -+ unsigned int as = crypto_aead_authsize(tfm); - struct af_alg_async_req *areq; -- struct af_alg_tsgl *tsgl, *tmp; - struct scatterlist *rsgl_src, *tsgl_src = NULL; - int err = 0; - size_t used = 0; /* [in] TX bufs to be en/decrypted */ -@@ -178,23 +177,24 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - outlen -= less; - } - -+ /* -+ * Create a per request TX SGL for this request which tracks the -+ * SG entries from the global TX SGL. -+ */ - processed = used + ctx->aead_assoclen; -- list_for_each_entry_safe(tsgl, tmp, &ctx->tsgl_list, list) { -- for (i = 0; i < tsgl->cur; i++) { -- struct scatterlist *process_sg = tsgl->sg + i; -- -- if (!(process_sg->length) || !sg_page(process_sg)) -- continue; -- tsgl_src = process_sg; -- break; -- } -- if (tsgl_src) -- break; -- } -- if (processed && !tsgl_src) { -- err = -EFAULT; -+ areq->tsgl_entries = af_alg_count_tsgl(sk, processed); -+ if (!areq->tsgl_entries) -+ areq->tsgl_entries = 1; -+ areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), -+ areq->tsgl_entries), -+ GFP_KERNEL); -+ if (!areq->tsgl) { -+ err = -ENOMEM; - goto free; - } -+ sg_init_table(areq->tsgl, areq->tsgl_entries); -+ af_alg_pull_tsgl(sk, processed, areq->tsgl); -+ tsgl_src = areq->tsgl; - - /* - * Copy of AAD from source to destination -@@ -203,83 +203,18 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - * when user space uses an in-place cipher operation, the kernel - * will copy the data as it does not see whether such in-place operation - * is initiated. -- * -- * To ensure efficiency, the following implementation ensure that the -- * ciphers are invoked to perform a crypto operation in-place. This -- * is achieved by memory management specified as follows. - */ - - /* Use the RX SGL as source (and destination) for crypto op. */ - rsgl_src = areq->first_rsgl.sgl.sgt.sgl; - -- if (ctx->enc) { -- /* -- * Encryption operation - The in-place cipher operation is -- * achieved by the following operation: -- * -- * TX SGL: AAD || PT -- * | | -- * | copy | -- * v v -- * RX SGL: AAD || PT || Tag -- */ -- err = crypto_aead_copy_sgl(null_tfm, tsgl_src, -- areq->first_rsgl.sgl.sgt.sgl, -- processed); -- if (err) -- goto free; -- af_alg_pull_tsgl(sk, processed, NULL, 0); -- } else { -- /* -- * Decryption operation - To achieve an in-place cipher -- * operation, the following SGL structure is used: -- * -- * TX SGL: AAD || CT || Tag -- * | | ^ -- * | copy | | Create SGL link. -- * v v | -- * RX SGL: AAD || CT ----+ -- */ -- -- /* Copy AAD || CT to RX SGL buffer for in-place operation. */ -- err = crypto_aead_copy_sgl(null_tfm, tsgl_src, -- areq->first_rsgl.sgl.sgt.sgl, -- outlen); -- if (err) -- goto free; -- -- /* Create TX SGL for tag and chain it to RX SGL. */ -- areq->tsgl_entries = af_alg_count_tsgl(sk, processed, -- processed - as); -- if (!areq->tsgl_entries) -- areq->tsgl_entries = 1; -- areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), -- areq->tsgl_entries), -- GFP_KERNEL); -- if (!areq->tsgl) { -- err = -ENOMEM; -- goto free; -- } -- sg_init_table(areq->tsgl, areq->tsgl_entries); -- -- /* Release TX SGL, except for tag data and reassign tag data. */ -- af_alg_pull_tsgl(sk, processed, areq->tsgl, processed - as); -- -- /* chain the areq TX SGL holding the tag with RX SGL */ -- if (usedpages) { -- /* RX SGL present */ -- struct af_alg_sgl *sgl_prev = &areq->last_rsgl->sgl; -- struct scatterlist *sg = sgl_prev->sgt.sgl; -- -- sg_unmark_end(sg + sgl_prev->sgt.nents - 1); -- sg_chain(sg, sgl_prev->sgt.nents + 1, areq->tsgl); -- } else -- /* no RX SGL present (e.g. authentication only) */ -- rsgl_src = areq->tsgl; -- } -+ err = crypto_aead_copy_sgl(null_tfm, tsgl_src, rsgl_src, -+ ctx->aead_assoclen); -+ if (err) -+ goto free; - - /* Initialize the crypto operation */ -- aead_request_set_crypt(&areq->cra_u.aead_req, rsgl_src, -+ aead_request_set_crypt(&areq->cra_u.aead_req, tsgl_src, - areq->first_rsgl.sgl.sgt.sgl, used, ctx->iv); - aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen); - aead_request_set_tfm(&areq->cra_u.aead_req, tfm); -@@ -514,7 +449,7 @@ static void aead_sock_destruct(struct sock *sk) - struct crypto_aead *tfm = aeadc->aead; - unsigned int ivlen = crypto_aead_ivsize(tfm); - -- af_alg_pull_tsgl(sk, ctx->used, NULL, 0); -+ af_alg_pull_tsgl(sk, ctx->used, NULL); - sock_kzfree_s(sk, ctx->iv, ivlen); - sock_kfree_s(sk, ctx, ctx->len); - af_alg_release_parent(sk); -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index 125d395c5e00..82735e51be10 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -138,7 +138,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - * Create a per request TX SGL for this request which tracks the - * SG entries from the global TX SGL. - */ -- areq->tsgl_entries = af_alg_count_tsgl(sk, len, 0); -+ areq->tsgl_entries = af_alg_count_tsgl(sk, len); - if (!areq->tsgl_entries) - areq->tsgl_entries = 1; - areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), -@@ -149,7 +149,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - goto free; - } - sg_init_table(areq->tsgl, areq->tsgl_entries); -- af_alg_pull_tsgl(sk, len, areq->tsgl, 0); -+ af_alg_pull_tsgl(sk, len, areq->tsgl); - - /* Initialize the crypto operation */ - skcipher_request_set_tfm(&areq->cra_u.skcipher_req, tfm); -@@ -363,7 +363,7 @@ static void skcipher_sock_destruct(struct sock *sk) - struct alg_sock *pask = alg_sk(psk); - struct crypto_skcipher *tfm = pask->private; - -- af_alg_pull_tsgl(sk, ctx->used, NULL, 0); -+ af_alg_pull_tsgl(sk, ctx->used, NULL); - sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm)); - if (ctx->state) - sock_kzfree_s(sk, ctx->state, crypto_skcipher_statesize(tfm)); -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index f7b3b93f3a49..b32d1ef827e7 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -228,9 +228,8 @@ static inline bool af_alg_readable(struct sock *sk) - return PAGE_SIZE <= af_alg_rcvbuf(sk); - } - --unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset); --void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, -- size_t dst_offset); -+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes); -+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst); - void af_alg_wmem_wakeup(struct sock *sk); - int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min); - int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, --- -2.50.1 (Apple Git-155) - diff --git a/1148-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch b/1148-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch deleted file mode 100644 index 398663de3..000000000 --- a/1148-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch +++ /dev/null @@ -1,73 +0,0 @@ -From ea7f6a374f53f1ecba89d146c138bf71df660ae9 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Fri, 1 May 2026 21:43:21 +0800 -Subject: [PATCH] crypto: af_alg - limit RX SG extraction by receive buffer - budget - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 -CVE: CVE-2026-31677 - -Upstream Status: 8eceab19eba9dcbfd2a0daec72e1bf48aa100170 - -commit 8eceab19eba9dcbfd2a0daec72e1bf48aa100170 -Author: Douya Le -Date: Thu Apr 2 23:34:55 2026 +0800 - - crypto: af_alg - limit RX SG extraction by receive buffer budget - - Make af_alg_get_rsgl() limit each RX scatterlist extraction to the - remaining receive buffer budget. - - af_alg_get_rsgl() currently uses af_alg_readable() only as a gate - before extracting data into the RX scatterlist. Limit each extraction - to the remaining af_alg_rcvbuf(sk) budget so that receive-side - accounting matches the amount of data attached to the request. - - If skcipher cannot obtain enough RX space for at least one chunk while - more data remains to be processed, reject the recvmsg call instead of - rounding the request length down to zero. - - Fixes: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a ("crypto: algif_skcipher - overhaul memory management") - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Co-developed-by: Yuan Tan - Signed-off-by: Yuan Tan - Suggested-by: Xin Liu - Signed-off-by: Douya Le - Signed-off-by: Ren Wei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index b2fe28992ebf..fbb669c9478c 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -1222,6 +1222,8 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, - - seglen = min_t(size_t, (maxsize - len), - msg_data_left(msg)); -+ /* Never pin more pages than the remaining RX accounting budget. */ -+ seglen = min_t(size_t, seglen, af_alg_rcvbuf(sk)); - - if (list_empty(&areq->rsgl_list)) { - rsgl = &areq->first_rsgl; -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index 82735e51be10..ba0a17fd95ac 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -130,6 +130,11 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - * full block size buffers. - */ - if (ctx->more || len < ctx->used) { -+ if (len < bs) { -+ err = -EINVAL; -+ goto free; -+ } -+ - len -= len % bs; - cflags |= CRYPTO_SKCIPHER_REQ_NOTFINAL; - } --- -2.50.1 (Apple Git-155) - diff --git a/1149-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch b/1149-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch deleted file mode 100644 index bdba7c022..000000000 --- a/1149-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 1921edf676419a881548b4779c4556dc936b10f2 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:10:09 +0800 -Subject: [PATCH] crypto: af_alg - Fix page reassignment overflow in - af_alg_pull_tsgl - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 - -Upstream Status: 31d00156e50ecad37f2cb6cbf04aaa9a260505ef - -commit 31d00156e50ecad37f2cb6cbf04aaa9a260505ef -Author: Herbert Xu -Date: Sat Apr 4 08:29:58 2026 +0800 - - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - - When page reassignment was added to af_alg_pull_tsgl the original - loop wasn't updated so it may try to reassign one more page than - necessary. - - Add the check to the reassignment so that this does not happen. - - Also update the comment which still refers to the obsolete offset - argument. - - Reported-by: syzbot+d23888375c2737c17ba5@syzkaller.appspotmail.com - Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management") - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index fbb669c9478c..4c94448e4659 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -705,8 +705,8 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst) - * Assumption: caller created af_alg_count_tsgl(len) - * SG entries in dst. - */ -- if (dst) { -- /* reassign page to dst after offset */ -+ if (dst && plen) { -+ /* reassign page to dst */ - get_page(page); - sg_set_page(dst + j, page, plen, sg[i].offset); - j++; --- -2.50.1 (Apple Git-155) - diff --git a/1150-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch b/1150-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch deleted file mode 100644 index ea0a1031d..000000000 --- a/1150-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 501c9d9404330aa57a3efe128e0e16dc98f4475f Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Fri, 1 May 2026 21:43:58 +0800 -Subject: [PATCH] crypto: authencesn - reject too-short AAD (assoclen<8) to - match ESP/ESN spec - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 -CVE: CVE-2026-23060 - -Upstream Status: 2397e9264676be7794f8f7f1e9763d90bd3c7335 - -commit 2397e9264676be7794f8f7f1e9763d90bd3c7335 -Author: Taeyang Lee <0wn@theori.io> -Date: Fri Jan 16 16:03:58 2026 +0900 - - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - - authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than - the minimum expected length, crypto_authenc_esn_decrypt() can advance past - the end of the destination scatterlist and trigger a NULL pointer dereference - in scatterwalk_map_and_copy(), leading to a kernel panic (DoS). - - Add a minimum AAD length check to fail fast on invalid inputs. - - Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface") - Reported-By: Taeyang Lee <0wn@theori.io> - Signed-off-by: Taeyang Lee <0wn@theori.io> - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index 2cc933e2f790..e08032e80f18 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -185,6 +185,9 @@ static int crypto_authenc_esn_encrypt(struct aead_request *req) - struct scatterlist *src, *dst; - int err; - -+ if (assoclen < 8) -+ return -EINVAL; -+ - sg_init_table(areq_ctx->src, 2); - src = scatterwalk_ffwd(areq_ctx->src, req->src, assoclen); - dst = src; -@@ -275,6 +278,9 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req) - u32 tmp[2]; - int err; - -+ if (assoclen < 8) -+ return -EINVAL; -+ - cryptlen -= authsize; - - if (req->src != dst) { --- -2.50.1 (Apple Git-155) - diff --git a/1151-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch b/1151-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch deleted file mode 100644 index 6c9b64665..000000000 --- a/1151-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch +++ /dev/null @@ -1,172 +0,0 @@ -From 1508578044aa2d26ae287927419505ad8c1ef8f1 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:16:25 +0800 -Subject: [PATCH] crypto: authencesn - Do not place hiseq at end of dst for - out-of-place decryption - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 -CVE: CVE-2026-31431 - -Upstream Status: e02494114ebf7c8b42777c6cd6982f113bfdbec7 - -commit e02494114ebf7c8b42777c6cd6982f113bfdbec7 -Author: Herbert Xu -Date: Fri Mar 27 15:04:17 2026 +0900 - - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - - When decrypting data that is not in-place (src != dst), there is - no need to save the high-order sequence bits in dst as it could - simply be re-copied from the source. - - However, the data to be hashed need to be rearranged accordingly. - - Reported-by: Taeyang Lee <0wn@theori.io> - Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface") - Signed-off-by: Herbert Xu - - Thanks, - - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index e08032e80f18..b262e7e3f8d7 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -158,7 +158,10 @@ static void crypto_authenc_esn_encrypt_done(void *data, int err) - authenc_esn_request_complete(areq, err); - } - --static int crypto_authenc_esn_copy(struct aead_request *req, unsigned int len) -+static int crypto_authenc_esn_copy_sg(struct aead_request *req, -+ struct scatterlist *src, -+ struct scatterlist *dst, -+ unsigned int len) - { - struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req); - struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn); -@@ -167,11 +170,16 @@ static int crypto_authenc_esn_copy(struct aead_request *req, unsigned int len) - skcipher_request_set_sync_tfm(skreq, ctx->null); - skcipher_request_set_callback(skreq, aead_request_flags(req), - NULL, NULL); -- skcipher_request_set_crypt(skreq, req->src, req->dst, len, NULL); -+ skcipher_request_set_crypt(skreq, src, dst, len, NULL); - - return crypto_skcipher_encrypt(skreq); - } - -+static int crypto_authenc_esn_copy(struct aead_request *req, unsigned int len) -+{ -+ return crypto_authenc_esn_copy_sg(req, req->src, req->dst, len); -+} -+ - static int crypto_authenc_esn_encrypt(struct aead_request *req) - { - struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req); -@@ -226,30 +234,39 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req, - u8 *ohash = areq_ctx->tail; - unsigned int cryptlen = req->cryptlen - authsize; - unsigned int assoclen = req->assoclen; -+ struct scatterlist *src = req->src; - struct scatterlist *dst = req->dst; - u8 *ihash = ohash + crypto_ahash_digestsize(auth); - u32 tmp[2]; -+ int err; - - if (!authsize) - goto decrypt; - -- /* Move high-order bits of sequence number back. */ -- scatterwalk_map_and_copy(tmp, dst, 4, 4, 0); -- scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0); -- scatterwalk_map_and_copy(tmp, dst, 0, 8, 1); -+ if (src == dst) { -+ /* Move high-order bits of sequence number back. */ -+ scatterwalk_map_and_copy(tmp, dst, 4, 4, 0); -+ scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0); -+ scatterwalk_map_and_copy(tmp, dst, 0, 8, 1); -+ } else { -+ err = crypto_authenc_esn_copy(req, assoclen); -+ if (err) -+ return err; -+ } - - if (crypto_memneq(ihash, ohash, authsize)) - return -EBADMSG; - - decrypt: - -- sg_init_table(areq_ctx->dst, 2); -+ if (src != dst) -+ src = scatterwalk_ffwd(areq_ctx->src, src, assoclen); - dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen); - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, flags, - req->base.complete, req->base.data); -- skcipher_request_set_crypt(skreq, dst, dst, cryptlen, req->iv); -+ skcipher_request_set_crypt(skreq, src, dst, cryptlen, req->iv); - - return crypto_skcipher_decrypt(skreq); - } -@@ -274,6 +291,7 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req) - unsigned int assoclen = req->assoclen; - unsigned int cryptlen = req->cryptlen; - u8 *ihash = ohash + crypto_ahash_digestsize(auth); -+ struct scatterlist *src = req->src; - struct scatterlist *dst = req->dst; - u32 tmp[2]; - int err; -@@ -281,27 +299,31 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req) - if (assoclen < 8) - return -EINVAL; - -- cryptlen -= authsize; -- -- if (req->src != dst) { -- err = crypto_authenc_esn_copy(req, assoclen + cryptlen); -- if (err) -- return err; -- } -+ if (!authsize) -+ goto tail; - -+ cryptlen -= authsize; - scatterwalk_map_and_copy(ihash, req->src, assoclen + cryptlen, - authsize, 0); - -- if (!authsize) -- goto tail; -- - /* Move high-order bits of sequence number to the end. */ -- scatterwalk_map_and_copy(tmp, dst, 0, 8, 0); -- scatterwalk_map_and_copy(tmp, dst, 4, 4, 1); -- scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 1); -- -- sg_init_table(areq_ctx->dst, 2); -- dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4); -+ scatterwalk_map_and_copy(tmp, src, 0, 8, 0); -+ if (src == dst) { -+ scatterwalk_map_and_copy(tmp, dst, 4, 4, 1); -+ scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 1); -+ dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4); -+ } else { -+ scatterwalk_map_and_copy(tmp, dst, 0, 4, 1); -+ scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen - 4, 4, 1); -+ -+ src = scatterwalk_ffwd(areq_ctx->src, src, 8); -+ dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4); -+ err = crypto_authenc_esn_copy_sg(req, src, dst, -+ assoclen + cryptlen - 8); -+ if (err) -+ return err; -+ dst = req->dst; -+ } - - ahash_request_set_tfm(ahreq, auth); - ahash_request_set_crypt(ahreq, dst, ohash, assoclen + cryptlen); --- -2.50.1 (Apple Git-155) - diff --git a/1152-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch b/1152-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch deleted file mode 100644 index 196bbcc6d..000000000 --- a/1152-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch +++ /dev/null @@ -1,45 +0,0 @@ -From dadc0c1bbccad48022e400debc3341597a0f2cf5 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 19:56:24 +0800 -Subject: [PATCH] crypto: authencesn - Fix src offset when decrypting in-place - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 - -Upstream Status: 1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa - -commit 1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa -Author: Herbert Xu -Date: Wed Apr 15 07:39:06 2026 +0800 - - crypto: authencesn - Fix src offset when decrypting in-place - - The src SG list offset wasn't set properly when decrypting in-place, - fix it. - - Reported-by: Wolfgang Walter - Fixes: e02494114ebf ("crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption") - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index b262e7e3f8d7..d96da934674e 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -259,9 +259,11 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req, - - decrypt: - -- if (src != dst) -- src = scatterwalk_ffwd(areq_ctx->src, src, assoclen); - dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen); -+ if (req->src == req->dst) -+ src = dst; -+ else -+ src = scatterwalk_ffwd(areq_ctx->src, src, assoclen); - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, flags, --- -2.50.1 (Apple Git-155) - diff --git a/1153-crypto-authencesn-reject-short-ahash-digests-during-instance.patch b/1153-crypto-authencesn-reject-short-ahash-digests-during-instance.patch deleted file mode 100644 index f2ce6ea8d..000000000 --- a/1153-crypto-authencesn-reject-short-ahash-digests-during-instance.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 027fb22445c4faad4693db4c096b0674fe09f712 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:02:19 +0800 -Subject: [PATCH] crypto: authencesn - reject short ahash digests during - instance creation - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 - -Upstream Status: cryptodev - -commit 5db6ef9847717329f12c5ea8aba7e9f588a980c0 -Author: Yucheng Lu -Date: Wed Apr 22 21:45:04 2026 +0800 - - crypto: authencesn - reject short ahash digests during instance creation - - authencesn requires either a zero authsize or an authsize of at least - 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of - high-order sequence number data at the end of the authenticated data. - - While crypto_authenc_esn_setauthsize() already rejects explicit - non-zero authsizes in the range 1..3, crypto_authenc_esn_create() - still copied auth->digestsize into inst->alg.maxauthsize without - validating it. The AEAD core then initialized the tfm's default - authsize from that value. - - As a result, selecting an ahash with digest size 1..3, such as - cbcmac(cipher_null), exposed authencesn instances whose default - authsize was invalid even though setauthsize() would have rejected the - same value. AF_ALG could then trigger the ESN tail handling with a - too-short tag and hit an out-of-bounds access. - - Reject authencesn instances whose ahash digest size is in the invalid - non-zero range 1..3 so that no tfm can inherit an unsupported default - authsize. - - Fixes: f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver") - Cc: stable@kernel.org - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Co-developed-by: Yuan Tan - Signed-off-by: Yuan Tan - Suggested-by: Xin Liu - Tested-by: Yuhang Zheng - Reviewed-by: Eric Biggers - Signed-off-by: Yucheng Lu - Signed-off-by: Ren Wei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index d96da934674e..8b94a34c6ab4 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -434,6 +434,11 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, - auth = crypto_spawn_ahash_alg(&ctx->auth); - auth_base = &auth->base; - -+ if (auth->digestsize > 0 && auth->digestsize < 4) { -+ err = -EINVAL; -+ goto err_free_inst; -+ } -+ - err = crypto_grab_skcipher(&ctx->enc, aead_crypto_instance(inst), - crypto_attr_alg_name(tb[2]), 0, mask); - if (err) --- -2.50.1 (Apple Git-155) - diff --git a/1154-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch b/1154-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch deleted file mode 100644 index 17de1ad6d..000000000 --- a/1154-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 51c927390f506ab91a571fff14994406e8a43fb4 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Fri, 1 May 2026 21:45:28 +0800 -Subject: [PATCH] crypto: algif_aead - Fix minimum RX size check for decryption - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 - -Upstream Status: 3d14bd48e3a77091cbce637a12c2ae31b4a1687c - -commit 3d14bd48e3a77091cbce637a12c2ae31b4a1687c -Author: Herbert Xu -Date: Sun Apr 12 13:32:21 2026 +0800 - - crypto: algif_aead - Fix minimum RX size check for decryption - - The check for the minimum receive buffer size did not take the - tag size into account during decryption. Fix this by adding the - required extra length. - - Reported-by: syzbot+aa11561819dc42ebbc7c@syzkaller.appspotmail.com - Reported-by: Daniel Pouzzner - Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index dff71bd753a7..93a7cb4f269c 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -169,7 +169,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - if (usedpages < outlen) { - size_t less = outlen - usedpages; - -- if (used < less) { -+ if (used < less + (ctx->enc ? 0 : as)) { - err = -EINVAL; - goto free; - } --- -2.50.1 (Apple Git-155) - diff --git a/1155-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch b/1155-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch deleted file mode 100644 index d37f8b46c..000000000 --- a/1155-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 5ee3f090629291d2a9c229c0371b6410cd480826 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:03:29 +0800 -Subject: [PATCH] crypto: algif_aead - snapshot IV for async AEAD requests - -JIRA: https://redhat.atlassian.net/browse/RHEL-172216 - -Upstream Status: 5aa58c3a572b3e3b6c786953339f7978b845cc52 - -commit 5aa58c3a572b3e3b6c786953339f7978b845cc52 -Author: Douya Le -Date: Sun Apr 19 16:52:59 2026 +0800 - - crypto: algif_aead - snapshot IV for async AEAD requests - - AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during - request processing. For async requests, later socket activity can - update that shared state before the original request has fully - completed, which can lead to inconsistent IV handling. - - Snapshot the IV into per-request storage when preparing the AEAD - request, so in-flight operations no longer depend on mutable socket - state. - - Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") - Cc: stable@kernel.org - Reported-by: Yuan Tan - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Reported-by: Xin Liu - Co-developed-by: Luxing Yin - Signed-off-by: Luxing Yin - Tested-by: Yucheng Lu - Signed-off-by: Douya Le - Signed-off-by: Ren Wei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index 93a7cb4f269c..fcf86e5c6494 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -97,8 +97,10 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - struct crypto_aead *tfm = aeadc->aead; - struct crypto_sync_skcipher *null_tfm = aeadc->null_tfm; - unsigned int as = crypto_aead_authsize(tfm); -+ unsigned int ivsize = crypto_aead_ivsize(tfm); - struct af_alg_async_req *areq; - struct scatterlist *rsgl_src, *tsgl_src = NULL; -+ void *iv; - int err = 0; - size_t used = 0; /* [in] TX bufs to be en/decrypted */ - size_t outlen = 0; /* [out] RX bufs produced by kernel */ -@@ -150,10 +152,14 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - - /* Allocate cipher request for current operation. */ - areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) + -- crypto_aead_reqsize(tfm)); -+ crypto_aead_reqsize(tfm) + ivsize); - if (IS_ERR(areq)) - return PTR_ERR(areq); - -+ iv = (u8 *)aead_request_ctx(&areq->cra_u.aead_req) + -+ crypto_aead_reqsize(tfm); -+ memcpy(iv, ctx->iv, ivsize); -+ - /* convert iovecs of output buffers into RX SGL */ - err = af_alg_get_rsgl(sk, msg, flags, areq, outlen, &usedpages); - if (err) -@@ -215,7 +221,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - - /* Initialize the crypto operation */ - aead_request_set_crypt(&areq->cra_u.aead_req, tsgl_src, -- areq->first_rsgl.sgl.sgt.sgl, used, ctx->iv); -+ areq->first_rsgl.sgl.sgt.sgl, used, iv); - aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen); - aead_request_set_tfm(&areq->cra_u.aead_req, tfm); - --- -2.50.1 (Apple Git-155) - diff --git a/1156-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/1156-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch deleted file mode 100644 index c22ebfbb0..000000000 --- a/1156-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch +++ /dev/null @@ -1,108 +0,0 @@ -From fec7c33519761c90689c4e41f169885a4dc6e729 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 7 May 2026 19:48:51 +0000 -Subject: [PATCH] xfrm: esp: avoid in-place decrypt on shared skb frags - -JIRA: https://redhat.atlassian.net/browse/RHEL-174522 -CVE: CVE-2026-43284 - -commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 -Author: Kuan-Ting Chen -Date: Mon May 4 23:27:12 2026 +0800 - - xfrm: esp: avoid in-place decrypt on shared skb frags - - MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP - marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), - so later paths that may modify packet data can first make a private - copy. The IPv4/IPv6 datagram append paths did not set this flag when - splicing pages into UDP skbs. - - That leaves an ESP-in-UDP packet made from shared pipe pages looking - like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW - fast path for uncloned skbs without a frag_list and decrypts in place - over data that is not owned privately by the skb. - - Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching - TCP. Also make ESP input fall back to skb_cow_data() when the flag is - present, so ESP does not decrypt externally backed frags in place. - Private nonlinear skb frags still use the existing fast path. - - This intentionally does not change ESP output. In esp_output_head(), - the path that appends the ESP trailer to existing skb tailroom without - calling skb_cow_data() is not reachable for nonlinear skbs: - skb_tailroom() returns zero when skb->data_len is nonzero, while ESP - tailen is positive. Thus ESP output will either use the separate - destination-frag path or fall back to skb_cow_data(). - - Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") - Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") - Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") - Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") - Reported-by: Hyunwoo Kim - Reported-by: Kuan-Ting Chen - Tested-by: Hyunwoo Kim - Cc: stable@vger.kernel.org - Signed-off-by: Kuan-Ting Chen - Signed-off-by: Steffen Klassert - -Signed-off-by: CKI Backport Bot -Signed-off-by: Sabrina Dubroca - -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index b8c7c8b42c0a..0c5cd78991d9 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -869,7 +869,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 14d7d98fa417..58f155e70049 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1236,6 +1236,8 @@ static int __ip_append_data(struct sock *sk, - if (err < 0) - goto error; - copy = err; -+ if (!(flags & MSG_NO_SHARED_FRAGS)) -+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; - wmem_alloc_delta += copy; - } else if (!zc) { - int i = skb_shinfo(skb)->nr_frags; -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 9c4c7b1f2955..0ecbb54bbdf0 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -911,7 +911,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index ca5853d5298a..2ba9df0262c9 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1772,6 +1772,8 @@ static int __ip6_append_data(struct sock *sk, - if (err < 0) - goto error; - copy = err; -+ if (!(flags & MSG_NO_SHARED_FRAGS)) -+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; - wmem_alloc_delta += copy; - } else if (!zc) { - int i = skb_shinfo(skb)->nr_frags; --- -2.50.1 (Apple Git-155) - diff --git a/1157-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch b/1157-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch deleted file mode 100644 index 1f513e9bc..000000000 --- a/1157-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 8d155e2d1c4102f74f82a2bf9c016164bb0f7384 Mon Sep 17 00:00:00 2001 -From: Nathan Rebello -Date: Thu, 2 Apr 2026 04:52:59 -0400 -Subject: [PATCH] usbip: validate number_of_packets in usbip_pack_ret_submit() - -commit 2ab833a16a825373aad2ba7d54b572b277e95b71 upstream. - -When a USB/IP client receives a RET_SUBMIT response, -usbip_pack_ret_submit() unconditionally overwrites -urb->number_of_packets from the network PDU. This value is -subsequently used as the loop bound in usbip_recv_iso() and -usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible -array whose size was fixed at URB allocation time based on the -*original* number_of_packets from the CMD_SUBMIT. - -A malicious USB/IP server can set number_of_packets in the response -to a value larger than what was originally submitted, causing a heap -out-of-bounds write when usbip_recv_iso() writes to -urb->iso_frame_desc[i] beyond the allocated region. - -KASAN confirmed this with kernel 7.0.0-rc5: - - BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 - Write of size 4 at addr ffff888106351d40 by task vhci_rx/69 - - The buggy address is located 0 bytes to the right of - allocated 320-byte region [ffff888106351c00, ffff888106351d40) - -The server side (stub_rx.c) and gadget side (vudc_rx.c) already -validate number_of_packets in the CMD_SUBMIT path since commits -c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle -malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden -CMD_SUBMIT path to handle malicious input"). The server side validates -against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. -On the client side we have the original URB, so we can use the tighter -bound: the response must not exceed the original number_of_packets. - -This mirrors the existing validation of actual_length against -transfer_buffer_length in usbip_recv_xbuff(), which checks the -response value against the original allocation size. - -Kelvin Mbogo's series ("usb: usbip: fix integer overflow in -usbip_recv_iso()", v2) hardens the receive-side functions themselves; -this patch complements that work by catching the bad value at its -source -- in usbip_pack_ret_submit() before the overwrite -- and -using the tighter per-URB allocation bound rather than the global -USBIP_MAX_ISO_PACKETS limit. - -Fix this by checking rpdu->number_of_packets against -urb->number_of_packets in usbip_pack_ret_submit() before the -overwrite. On violation, clamp to zero so that usbip_recv_iso() and -usbip_pad_iso() safely return early. - -Fixes: 1325f85fa49f ("staging: usbip: bugfix add number of packets for isochronous frames") -Cc: stable -Acked-by: Shuah Khan -Signed-off-by: Nathan Rebello -Link: https://patch.msgid.link/20260402085259.234-1-nathan.c.rebello@gmail.com -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c -index a2b2da1255dd..ba9e7c616e12 100644 ---- a/drivers/usb/usbip/usbip_common.c -+++ b/drivers/usb/usbip/usbip_common.c -@@ -470,6 +470,18 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb, - urb->status = rpdu->status; - urb->actual_length = rpdu->actual_length; - urb->start_frame = rpdu->start_frame; -+ /* -+ * The number_of_packets field determines the length of -+ * iso_frame_desc[], which is a flexible array allocated -+ * at URB creation time. A response must never claim more -+ * packets than originally submitted; doing so would cause -+ * an out-of-bounds write in usbip_recv_iso() and -+ * usbip_pad_iso(). Clamp to zero on violation so both -+ * functions safely return early. -+ */ -+ if (rpdu->number_of_packets < 0 || -+ rpdu->number_of_packets > urb->number_of_packets) -+ rpdu->number_of_packets = 0; - urb->number_of_packets = rpdu->number_of_packets; - urb->error_count = rpdu->error_count; - } --- -2.50.1 (Apple Git-155) - diff --git a/1158-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch b/1158-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch deleted file mode 100644 index d77d328c8..000000000 --- a/1158-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch +++ /dev/null @@ -1,54 +0,0 @@ -From c9e16b3352bcbb7a12a4ec6237721659201843f7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Tue, 7 Apr 2026 21:44:30 -0400 -Subject: [PATCH] RDMA/umem: Fix double dma_buf_unpin in failure path - -JIRA: https://redhat.atlassian.net/browse/RHEL-163515 - -commit 104016eb671e19709721c1b0048dd912dc2e96be -Author: Jacob Moroni -Date: Tue Feb 24 23:41:53 2026 +0000 - - RDMA/umem: Fix double dma_buf_unpin in failure path - - In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to - ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf - is immediately unpinned but the umem_dmabuf->pinned flag is still - set. Then, when ib_umem_release() is called, it calls - ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. - - Fix this by removing the immediate unpin upon failure and just let - the ib_umem_release/revoke path handle it. This also ensures the - proper unmap-unpin unwind ordering if the dmabuf_map_pages call - happened to fail due to dma_resv_wait_timeout (and therefore has - a non-NULL umem_dmabuf->sgt). - - Fixes: 1e4df4a21c5a ("RDMA/umem: Allow pinned dmabuf umem usage") - Signed-off-by: Jacob Moroni - Link: https://patch.msgid.link/20260224234153.1207849-1-jmoroni@google.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/core/umem_dmabuf.c b/drivers/infiniband/core/umem_dmabuf.c -index 939da49b0dcc..420ee3a495b5 100644 ---- a/drivers/infiniband/core/umem_dmabuf.c -+++ b/drivers/infiniband/core/umem_dmabuf.c -@@ -218,13 +218,11 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, - - err = ib_umem_dmabuf_map_pages(umem_dmabuf); - if (err) -- goto err_unpin; -+ goto err_release; - dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv); - - return umem_dmabuf; - --err_unpin: -- dma_buf_unpin(umem_dmabuf->attach); - err_release: - dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv); - ib_umem_release(&umem_dmabuf->umem); --- -2.50.1 (Apple Git-155) - diff --git a/1159-ptrace-slightly-saner-get-dumpable-logic.patch b/1159-ptrace-slightly-saner-get-dumpable-logic.patch deleted file mode 100644 index 49f9e8966..000000000 --- a/1159-ptrace-slightly-saner-get-dumpable-logic.patch +++ /dev/null @@ -1,71 +0,0 @@ - -diff --git a/include/linux/sched.h b/include/linux/sched.h -index fb22590..b7b2ea6 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -981,6 +981,9 @@ struct task_struct { - unsigned sched_migrated:1; - unsigned sched_task_hot:1; - -+ /* Save user-dumpable when mm goes away */ -+ RH_KABI_FILL_HOLE(unsigned user_dumpable:1) -+ - /* Force alignment to the next boundary: */ - unsigned :0; - -diff --git a/kernel/exit.c b/kernel/exit.c -index 86df8fa..a310ea8 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -563,6 +563,7 @@ static void exit_mm(void) - */ - smp_mb__after_spinlock(); - local_irq_disable(); -+ current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER); - current->mm = NULL; - membarrier_update_current_mm(NULL); - enter_lazy_tlb(mm, current); -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index d5f89f9..75bcc15 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -272,11 +272,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode) - return ns_capable(ns, CAP_SYS_PTRACE); - } - -+static bool task_still_dumpable(struct task_struct *task, unsigned int mode) -+{ -+ struct mm_struct *mm = task->mm; -+ if (mm) { -+ if (get_dumpable(mm) == SUID_DUMP_USER) -+ return true; -+ return ptrace_has_cap(mm->user_ns, mode); -+ } -+ -+ if (task->user_dumpable) -+ return true; -+ return ptrace_has_cap(&init_user_ns, mode); -+} -+ - /* Returns 0 on success, -errno on denial. */ - static int __ptrace_may_access(struct task_struct *task, unsigned int mode) - { - const struct cred *cred = current_cred(), *tcred; -- struct mm_struct *mm; - kuid_t caller_uid; - kgid_t caller_gid; - -@@ -337,11 +350,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) - * Pairs with a write barrier in commit_creds(). - */ - smp_rmb(); -- mm = task->mm; -- if (mm && -- ((get_dumpable(mm) != SUID_DUMP_USER) && -- !ptrace_has_cap(mm->user_ns, mode))) -- return -EPERM; -+ if (!task_still_dumpable(task, mode)) -+ return -EPERM; - - return security_ptrace_access_check(task, mode); - } diff --git a/1160-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch b/1160-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch deleted file mode 100644 index 096dabdc2..000000000 --- a/1160-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e Mon Sep 17 00:00:00 2001 -From: William Bowling -Date: Wed, 13 May 2026 04:16:35 +0000 -Subject: [PATCH] net: skbuff: preserve shared-frag marker during coalescing - -commit f84eca5817390257cef78013d0112481c503b4a3 upstream. - -skb_try_coalesce() can attach paged frags from @from to @to. If @from -has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same -externally-owned or page-cache-backed frags, but the shared-frag marker -is currently lost. - -That breaks the invariant relied on by later in-place writers. In -particular, ESP input checks skb_has_shared_frag() before deciding -whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP -receive coalescing has moved shared frags into an unmarked skb, ESP can -see skb_has_shared_frag() as false and decrypt in place over page-cache -backed frags. - -Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged -frags. The tailroom copy path does not need the marker because it copies -bytes into @to's linear data rather than transferring frag descriptors. - -Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") -Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") -Signed-off-by: William Bowling -Reviewed-by: Eric Dumazet -Tested-by: Jiayuan Chen -Link: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index a753d01b587b..00d60588fb09 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -6066,6 +6066,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, - from_shinfo->frags, - from_shinfo->nr_frags * sizeof(skb_frag_t)); - to_shinfo->nr_frags += from_shinfo->nr_frags; -+ if (from_shinfo->nr_frags) -+ to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG; - - if (!skb_cloned(from)) - from_shinfo->nr_frags = 0; --- -2.50.1 (Apple Git-155) - diff --git a/1161-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch b/1161-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch deleted file mode 100644 index 36314691b..000000000 --- a/1161-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch +++ /dev/null @@ -1,152 +0,0 @@ -From fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8 Mon Sep 17 00:00:00 2001 -From: Hyunwoo Kim -Date: Sat, 16 May 2026 07:28:53 +0900 -Subject: [PATCH] net: skbuff: propagate shared-frag marker through - frag-transfer helpers - -commit 48f6a5356a33dd78e7144ae1faef95ffc990aae0 upstream. - -Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail -to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when -moving frags from source to destination. __pskb_copy_fclone() defers -the rest of the shinfo metadata to skb_copy_header() after copying -frag descriptors, but that helper only carries over gso_{size,segs, -type} and never touches skb_shinfo()->flags; skb_shift() moves frag -descriptors directly and leaves flags untouched. As a result, the -destination skb keeps a reference to the same externally-owned or -page-cache-backed pages while reporting skb_has_shared_frag() as -false. - -The mismatch is harmful in any in-place writer that uses -skb_has_shared_frag() to decide whether shared pages must be detoured -through skb_cow_data(). ESP input is one such writer (esp4.c, -esp6.c), and a single nft 'dup to ' rule -- or any other -nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d -skb in esp_input() with the marker stripped, letting an unprivileged -user write into the page cache of a root-owned read-only file via -authencesn-ESN stray writes. - -Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors -were actually moved from the source. skb_copy() and skb_copy_expand() -share skb_copy_header() too but linearize all paged data into freshly -allocated head storage and emerge with nr_frags == 0, so -skb_has_shared_frag() returns false on its own; they need no change. - -The same omission exists in skb_gro_receive() and skb_gro_receive_list(). -The former moves the incoming skb's frag descriptors into the -accumulator's last sub-skb via two paths (a direct frag-move loop and -the head_frag + memcpy path); the latter chains the incoming skb whole -onto p's frag_list. Downstream skb_segment() reads only -skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's -shinfo as the nskb -- both p and lp must carry the marker. - -The same omission also exists in tcp_clone_payload(), which builds an -MTU probe skb by moving frag descriptors from skbs on sk_write_queue -into a freshly allocated nskb. The helper falls into the same family -and warrants the same fix for consistency; no TCP TX-side in-place -writer is currently known to reach a user page through this gap, but -a future consumer depending on the marker would regress silently. - -The same omission exists in skb_segment(): the per-iteration flag -merge takes only head_skb's flag, and the inner switch that rebinds -frag_skb to list_skb on head_skb-frags exhaustion does not fold the -new frag_skb's flag into nskb. Fold frag_skb's flag at both sites -so segments drawing frags from frag_list members carry the marker. - -Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") -Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") -Suggested-by: Sabrina Dubroca -Suggested-by: Sultan Alsawaf -Suggested-by: Ben Hutchings -Suggested-by: Lin Ma -Suggested-by: Jingguo Tan -Suggested-by: Aaron Esau -Cc: stable@vger.kernel.org -Signed-off-by: Hyunwoo Kim -Tested-by: Rajat Gupta -Link: https://patch.msgid.link/ageeJfJHwgzmKXbh@v4bel -Signed-off-by: Paolo Abeni -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/core/gro.c b/net/core/gro.c -index ac498c9f82cf..f5c80c2f69df 100644 ---- a/net/core/gro.c -+++ b/net/core/gro.c -@@ -214,10 +214,12 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) - p->data_len += len; - p->truesize += delta_truesize; - p->len += len; -+ skb_shinfo(p)->flags |= skbinfo->flags & SKBFL_SHARED_FRAG; - if (lp != p) { - lp->data_len += len; - lp->truesize += delta_truesize; - lp->len += len; -+ skb_shinfo(lp)->flags |= skbinfo->flags & SKBFL_SHARED_FRAG; - } - NAPI_GRO_CB(skb)->same_flow = 1; - return 0; -@@ -245,6 +247,8 @@ int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb) - p->truesize += skb->truesize; - p->len += skb->len; - -+ skb_shinfo(p)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; -+ - NAPI_GRO_CB(skb)->same_flow = 1; - - return 0; -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 00d60588fb09..aa9e91488473 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2214,6 +2214,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom, - skb_frag_ref(skb, i); - } - skb_shinfo(n)->nr_frags = i; -+ skb_shinfo(n)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; - } - - if (skb_has_frag_list(skb)) { -@@ -4289,6 +4290,8 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen) - tgt->ip_summed = CHECKSUM_PARTIAL; - skb->ip_summed = CHECKSUM_PARTIAL; - -+ skb_shinfo(tgt)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; -+ - skb_len_add(skb, -shiftlen); - skb_len_add(tgt, shiftlen); - -@@ -4899,7 +4902,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, - skb_copy_from_linear_data_offset(head_skb, offset, - skb_put(nskb, hsize), hsize); - -- skb_shinfo(nskb)->flags |= skb_shinfo(head_skb)->flags & -+ skb_shinfo(nskb)->flags |= (skb_shinfo(head_skb)->flags | -+ skb_shinfo(frag_skb)->flags) & - SKBFL_SHARED_FRAG; - - if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) -@@ -4916,6 +4920,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, - nfrags = skb_shinfo(list_skb)->nr_frags; - frag = skb_shinfo(list_skb)->frags; - frag_skb = list_skb; -+ -+ skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG; -+ - if (!skb_headlen(list_skb)) { - BUG_ON(!nfrags); - } else { -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 33c2fb60d056..c76672f544be 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2391,6 +2391,7 @@ static int tcp_clone_payload(struct sock *sk, struct sk_buff *to, - todo = min_t(int, skb_frag_size(fragfrom), - probe_size - len); - len += todo; -+ skb_shinfo(to)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; - if (lastfrag && - skb_frag_page(fragfrom) == skb_frag_page(lastfrag) && - skb_frag_off(fragfrom) == skb_frag_off(lastfrag) + --- -2.50.1 (Apple Git-155) - diff --git a/1162-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch b/1162-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch deleted file mode 100644 index 55c092659..000000000 --- a/1162-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 7e3955b282eae20d61c75e499c75eade51c20060 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Tue, 17 Mar 2026 20:00:26 +0100 -Subject: [PATCH] netfilter: nf_tables: release flowtable after rcu grace - period on error - -[ Upstream commit d73f4b53aaaea4c95f245e491aa5eeb8a21874ce ] - -Call synchronize_rcu() after unregistering the hooks from error path, -since a hook that already refers to this flowtable can be already -registered, exposing this flowtable to packet path and nfnetlink_hook -control plane. - -This error path is rare, it should only happen by reaching the maximum -number hooks or by failing to set up to hardware offload, just call -synchronize_rcu(). - -There is a check for already used device hooks by different flowtable -that could result in EEXIST at this late stage. The hook parser can be -updated to perform this check earlier to this error path really becomes -rarely exercised. - -Uncovered by KASAN reported as use-after-free from nfnetlink_hook path -when dumping hooks. - -Fixes: 3b49e2e94e6e ("netfilter: nf_tables: add flow table netlink frontend") -Reported-by: Yiming Qian -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Florian Westphal -Signed-off-by: Sasha Levin - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 0c12560e94f3..663c06413518 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -8966,6 +8966,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb, - return 0; - - err_flowtable_hooks: -+ synchronize_rcu(); - nft_trans_destroy(trans); - err_flowtable_trans: - nft_hooks_destroy(&flowtable->hook_list); --- -2.50.1 (Apple Git-155) - diff --git a/1163-can-j1939-j1939-session-new-fix-skb-reference-counting.patch b/1163-can-j1939-j1939-session-new-fix-skb-reference-counting.patch deleted file mode 100644 index 8af06b6eb..000000000 --- a/1163-can-j1939-j1939-session-new-fix-skb-reference-counting.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 68fceb143b635cdc59fed3896d5910aff38f345e Mon Sep 17 00:00:00 2001 -From: Dmitry Antipov -Date: Tue, 5 Nov 2024 12:48:23 +0300 -Subject: [PATCH] can: j1939: j1939_session_new(): fix skb reference counting - -[ Upstream commit a8c695005bfe6569acd73d777ca298ddddd66105 ] - -Since j1939_session_skb_queue() does an extra skb_get() for each new -skb, do the same for the initial one in j1939_session_new() to avoid -refcount underflow. - -Reported-by: syzbot+d4e8dc385d9258220c31@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=d4e8dc385d9258220c31 -Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") -Signed-off-by: Dmitry Antipov -Tested-by: Oleksij Rempel -Acked-by: Oleksij Rempel -Link: https://patch.msgid.link/20241105094823.2403806-1-dmantipov@yandex.ru -[mkl: clean up commit message] -Signed-off-by: Marc Kleine-Budde -Signed-off-by: Sasha Levin - -diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c -index 319f47df3330..95f7a7e65a73 100644 ---- a/net/can/j1939/transport.c -+++ b/net/can/j1939/transport.c -@@ -1505,7 +1505,7 @@ static struct j1939_session *j1939_session_new(struct j1939_priv *priv, - session->state = J1939_SESSION_NEW; - - skb_queue_head_init(&session->skb_queue); -- skb_queue_tail(&session->skb_queue, skb); -+ skb_queue_tail(&session->skb_queue, skb_get(skb)); - - skcb = j1939_skb_to_cb(skb); - memcpy(&session->skcb, skcb, sizeof(session->skcb)); --- -2.50.1 (Apple Git-155) - diff --git a/1164-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch b/1164-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch deleted file mode 100644 index bd30e90e4..000000000 --- a/1164-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch +++ /dev/null @@ -1,159 +0,0 @@ -From 3c673dcebb6ae37885e3bf6960cac602bb0ae089 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 21 Apr 2026 10:10:02 +0000 -Subject: [PATCH] ima: don't clear IMA_DIGSIG flag when setting or removing - non-IMA xattr - -JIRA: https://redhat.atlassian.net/browse/RHEL-169737 -CVE: CVE-2025-68183 - -commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd -Author: Coiby Xu -Date: Mon Sep 15 13:55:23 2025 +0800 - - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - - Currently when both IMA and EVM are in fix mode, the IMA signature will - be reset to IMA hash if a program first stores IMA signature in - security.ima and then writes/removes some other security xattr for the - file. - - For example, on Fedora, after booting the kernel with "ima_appraise=fix - evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, - installing/reinstalling a package will not make good reference IMA - signature generated. Instead IMA hash is generated, - - # getfattr -m - -d -e hex /usr/bin/bash - # file: usr/bin/bash - security.ima=0x0404... - - This happens because when setting security.selinux, the IMA_DIGSIG flag - that had been set early was cleared. As a result, IMA hash is generated - when the file is closed. - - Similarly, IMA signature can be cleared on file close after removing - security xattr like security.evm or setting/removing ACL. - - Prevent replacing the IMA file signature with a file hash, by preventing - the IMA_DIGSIG flag from being reset. - - Here's a minimal C reproducer which sets security.selinux as the last - step which can also replaced by removing security.evm or setting ACL, - - #include - #include - #include - #include - #include - #include - - int main() { - const char* file_path = "/usr/sbin/test_binary"; - const char* hex_string = "030204d33204490066306402304"; - int length = strlen(hex_string); - char* ima_attr_value; - int fd; - - fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); - if (fd == -1) { - perror("Error opening file"); - return 1; - } - - ima_attr_value = (char*)malloc(length / 2 ); - for (int i = 0, j = 0; i < length; i += 2, j++) { - sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); - } - - if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { - perror("Error setting extended attribute"); - close(fd); - return 1; - } - - const char* selinux_value= "system_u:object_r:bin_t:s0"; - if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { - perror("Error setting extended attribute"); - close(fd); - return 1; - } - - close(fd); - - return 0; - } - - Signed-off-by: Coiby Xu - Signed-off-by: Mimi Zohar - -Signed-off-by: CKI Backport Bot - -diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c -index 656c709b974f..f7770c24995b 100644 ---- a/security/integrity/ima/ima_appraise.c -+++ b/security/integrity/ima/ima_appraise.c -@@ -671,6 +671,15 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name, - return 0; - } - -+/* -+ * ima_reset_appraise_flags - reset ima_iint_cache flags -+ * -+ * @digsig: whether to clear/set IMA_DIGSIG flag, tristate values -+ * 0: clear IMA_DIGSIG -+ * 1: set IMA_DIGSIG -+ * -1: don't change IMA_DIGSIG -+ * -+ */ - static void ima_reset_appraise_flags(struct inode *inode, int digsig) - { - struct ima_iint_cache *iint; -@@ -683,9 +692,9 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig) - return; - iint->measured_pcrs = 0; - set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags); -- if (digsig) -+ if (digsig == 1) - set_bit(IMA_DIGSIG, &iint->atomic_flags); -- else -+ else if (digsig == 0) - clear_bit(IMA_DIGSIG, &iint->atomic_flags); - } - -@@ -771,6 +780,8 @@ static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry, - digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG); - } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) { - digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG); -+ } else { -+ digsig = -1; - } - if (result == 1 || evm_revalidate_status(xattr_name)) { - ima_reset_appraise_flags(d_backing_inode(dentry), digsig); -@@ -784,7 +795,7 @@ static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, - const char *acl_name, struct posix_acl *kacl) - { - if (evm_revalidate_status(acl_name)) -- ima_reset_appraise_flags(d_backing_inode(dentry), 0); -+ ima_reset_appraise_flags(d_backing_inode(dentry), -1); - - return 0; - } -@@ -792,11 +803,13 @@ static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, - static int ima_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry, - const char *xattr_name) - { -- int result; -+ int result, digsig = -1; - - result = ima_protect_xattr(dentry, xattr_name, NULL, 0); - if (result == 1 || evm_revalidate_status(xattr_name)) { -- ima_reset_appraise_flags(d_backing_inode(dentry), 0); -+ if (!strcmp(xattr_name, XATTR_NAME_IMA)) -+ digsig = 0; -+ ima_reset_appraise_flags(d_backing_inode(dentry), digsig); - if (result == 1) - result = 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1165-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch b/1165-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch deleted file mode 100644 index 5a1ee2d51..000000000 --- a/1165-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 633e8f87dad32263f6a57dccdb873f042c062111 Mon Sep 17 00:00:00 2001 -From: Jenny Guanni Qu -Date: Thu, 12 Mar 2026 14:49:50 +0000 -Subject: [PATCH] netfilter: nf_conntrack_h323: check for zero length in - DecodeQ931() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -[ Upstream commit f173d0f4c0f689173f8cdac79991043a4a89bf66 ] - -In DecodeQ931(), the UserUserIE code path reads a 16-bit length from -the packet, then decrements it by 1 to skip the protocol discriminator -byte before passing it to DecodeH323_UserInformation(). If the encoded -length is 0, the decrement wraps to -1, which is then passed as a -large value to the decoder, leading to an out-of-bounds read. - -Add a check to ensure len is positive after the decrement. - -Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper") -Reported-by: Klaudia Kloc -Reported-by: Dawid Moczadło -Tested-by: Jenny Guanni Qu -Signed-off-by: Jenny Guanni Qu -Signed-off-by: Florian Westphal -Signed-off-by: Sasha Levin - -diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c -index c972e9488e16..7b1497ed97d2 100644 ---- a/net/netfilter/nf_conntrack_h323_asn1.c -+++ b/net/netfilter/nf_conntrack_h323_asn1.c -@@ -924,6 +924,8 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931) - break; - p++; - len--; -+ if (len <= 0) -+ break; - return DecodeH323_UserInformation(buf, p, len, - &q931->UUIE); - } --- -2.50.1 (Apple Git-155) - diff --git a/1166-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch b/1166-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch deleted file mode 100644 index 07773cf9c..000000000 --- a/1166-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch +++ /dev/null @@ -1,16 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" -# reverse of cs10 14af547a198d243a0ef02f489884ffb113e8c54f - -diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h -index f3dada5bf7c1..31c3c5abdca6 100644 ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.4.0.12" -+#define LPFC_DRIVER_VERSION "14.4.0.11" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ diff --git a/1167-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch b/1167-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch deleted file mode 100644 index fc1f9c5c5..000000000 --- a/1167-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch +++ /dev/null @@ -1,329 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" -# reverse of cs10 71f3928a71657839d9362695e7446414fa25ebad - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 8b6386e2e3a5..ad8f5dee23a3 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -634,7 +634,6 @@ struct lpfc_vport { - #define FC_CT_RSPN_ID 0x8 /* RSPN_ID accepted by switch */ - #define FC_CT_RFT_ID 0x10 /* RFT_ID accepted by switch */ - #define FC_CT_RPRT_DEFER 0x20 /* Defer issuing FDMI RPRT */ --#define FC_CT_RSPNI_PNI 0x40 /* RSPNI_PNI accepted by switch */ - - struct list_head fc_nodes; - spinlock_t fc_nodes_list_lock; /* spinlock for fc_nodes list */ -@@ -1079,8 +1078,6 @@ struct lpfc_hba { - - uint32_t nport_event_cnt; /* timestamp for nlplist entry */ - -- unsigned long pni; /* 64-bit Platform Name Identifier */ -- - uint8_t wwnn[8]; - uint8_t wwpn[8]; - uint32_t RandomData[7]; -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index 817b02901c9d..cc8af576f57c 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -1742,28 +1742,6 @@ lpfc_cmpl_ct_cmd_rsnn_nn(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - return; - } - --static void --lpfc_cmpl_ct_cmd_rspni_pni(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_iocbq *rspiocb) --{ -- struct lpfc_vport *vport; -- struct lpfc_dmabuf *outp; -- struct lpfc_sli_ct_request *ctrsp; -- u32 ulp_status; -- -- vport = cmdiocb->vport; -- ulp_status = get_job_ulpstatus(phba, rspiocb); -- -- if (ulp_status == IOSTAT_SUCCESS) { -- outp = cmdiocb->rsp_dmabuf; -- ctrsp = (struct lpfc_sli_ct_request *)outp->virt; -- if (be16_to_cpu(ctrsp->CommandResponse.bits.CmdRsp) == -- SLI_CT_RESPONSE_FS_ACC) -- vport->ct_flags |= FC_CT_RSPNI_PNI; -- } -- lpfc_cmpl_ct(phba, cmdiocb, rspiocb); --} -- - static void - lpfc_cmpl_ct_cmd_da_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) -@@ -1978,8 +1956,6 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode, - bpl->tus.f.bdeSize = RSPN_REQUEST_SZ; - else if (cmdcode == SLI_CTNS_RSNN_NN) - bpl->tus.f.bdeSize = RSNN_REQUEST_SZ; -- else if (cmdcode == SLI_CTNS_RSPNI_PNI) -- bpl->tus.f.bdeSize = RSPNI_REQUEST_SZ; - else if (cmdcode == SLI_CTNS_DA_ID) - bpl->tus.f.bdeSize = DA_ID_REQUEST_SZ; - else if (cmdcode == SLI_CTNS_RFF_ID) -@@ -2101,18 +2077,6 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode, - CtReq->un.rsnn.symbname, size); - cmpl = lpfc_cmpl_ct_cmd_rsnn_nn; - break; -- case SLI_CTNS_RSPNI_PNI: -- vport->ct_flags &= ~FC_CT_RSPNI_PNI; -- CtReq->CommandResponse.bits.CmdRsp = -- cpu_to_be16(SLI_CTNS_RSPNI_PNI); -- CtReq->un.rspni.pni = cpu_to_be64(phba->pni); -- scnprintf(CtReq->un.rspni.symbname, -- sizeof(CtReq->un.rspni.symbname), "OS Host Name::%s", -- phba->os_host_name); -- CtReq->un.rspni.len = strnlen(CtReq->un.rspni.symbname, -- sizeof(CtReq->un.rspni.symbname)); -- cmpl = lpfc_cmpl_ct_cmd_rspni_pni; -- break; - case SLI_CTNS_DA_ID: - /* Implement DA_ID Nameserver request */ - CtReq->CommandResponse.bits.CmdRsp = -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 009d72ed08b0..15c062c1566d 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -650,6 +650,8 @@ lpfc_cmpl_els_flogi_fabric(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - ndlp->nlp_class_sup |= FC_COS_CLASS2; - if (sp->cls3.classValid) - ndlp->nlp_class_sup |= FC_COS_CLASS3; -+ if (sp->cls4.classValid) -+ ndlp->nlp_class_sup |= FC_COS_CLASS4; - ndlp->nlp_maxframe = ((sp->cmn.bbRcvSizeMsb & 0x0F) << 8) | - sp->cmn.bbRcvSizeLsb; - -@@ -1354,14 +1356,6 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - /* Can't do SLI4 class2 without support sequence coalescing */ - sp->cls2.classValid = 0; - sp->cls2.seqDelivery = 0; -- -- /* Fill out Auxiliary Parameter Data */ -- if (phba->pni) { -- sp->aux.flags = -- AUX_PARM_DATA_VALID | AUX_PARM_PNI_VALID; -- sp->aux.pni = cpu_to_be64(phba->pni); -- sp->aux.npiv_cnt = cpu_to_be16(phba->max_vpi - 1); -- } - } else { - /* Historical, setting sequential-delivery bit for SLI3 */ - sp->cls2.seqDelivery = (sp->cls2.classValid) ? 1 : 0; -@@ -5662,6 +5656,7 @@ lpfc_els_rsp_acc(struct lpfc_vport *vport, uint32_t flag, - sp->cls1.classValid = 0; - sp->cls2.classValid = 0; - sp->cls3.classValid = 0; -+ sp->cls4.classValid = 0; - - /* Copy our worldwide names */ - memcpy(&sp->portName, &vport->fc_sparam.portName, -@@ -11515,13 +11510,6 @@ lpfc_issue_els_fdisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - sp->cls2.seqDelivery = 1; - sp->cls3.seqDelivery = 1; - -- /* Fill out Auxiliary Parameter Data */ -- if (phba->pni) { -- sp->aux.flags = -- AUX_PARM_DATA_VALID | AUX_PARM_PNI_VALID; -- sp->aux.pni = cpu_to_be64(phba->pni); -- } -- - pcmd += sizeof(uint32_t); /* CSP Word 2 */ - pcmd += sizeof(uint32_t); /* CSP Word 3 */ - pcmd += sizeof(uint32_t); /* CSP Word 4 */ -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index d0bc07fd58e1..dcf78ea77a7d 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -4373,8 +4373,6 @@ lpfc_mbx_cmpl_ns_reg_login(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) - lpfc_ns_cmd(vport, SLI_CTNS_RNN_ID, 0, 0); - lpfc_ns_cmd(vport, SLI_CTNS_RSNN_NN, 0, 0); - lpfc_ns_cmd(vport, SLI_CTNS_RSPN_ID, 0, 0); -- if (phba->pni) -- lpfc_ns_cmd(vport, SLI_CTNS_RSPNI_PNI, 0, 0); - lpfc_ns_cmd(vport, SLI_CTNS_RFT_ID, 0, 0); - - if ((vport->cfg_enable_fc4_type == LPFC_ENABLE_BOTH) || -diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h -index b2e353590ebb..3bc0efa7453e 100644 ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -168,11 +168,6 @@ struct lpfc_sli_ct_request { - uint8_t len; - uint8_t symbname[255]; - } rspn; -- struct rspni { /* For RSPNI_PNI requests */ -- __be64 pni; -- u8 len; -- u8 symbname[255]; -- } rspni; - struct gff { - uint32_t PortId; - } gff; -@@ -218,8 +213,6 @@ struct lpfc_sli_ct_request { - sizeof(struct da_id)) - #define RSPN_REQUEST_SZ (offsetof(struct lpfc_sli_ct_request, un) + \ - sizeof(struct rspn)) --#define RSPNI_REQUEST_SZ (offsetof(struct lpfc_sli_ct_request, un) + \ -- sizeof(struct rspni)) - - /* - * FsType Definitions -@@ -316,7 +309,6 @@ struct lpfc_sli_ct_request { - #define SLI_CTNS_RIP_NN 0x0235 - #define SLI_CTNS_RIPA_NN 0x0236 - #define SLI_CTNS_RSNN_NN 0x0239 --#define SLI_CTNS_RSPNI_PNI 0x0240 - #define SLI_CTNS_DA_ID 0x0300 - - /* -@@ -520,21 +512,6 @@ struct class_parms { - uint8_t word3Reserved2; /* Fc Word 3, bit 0: 7 */ - }; - --enum aux_parm_flags { -- AUX_PARM_PNI_VALID = 0x20, /* FC Word 0, bit 29 */ -- AUX_PARM_DATA_VALID = 0x40, /* FC Word 0, bit 30 */ --}; -- --struct aux_parm { -- u8 flags; /* FC Word 0, bit 31:24 */ -- u8 ext_feat[3]; /* FC Word 0, bit 23:0 */ -- -- __be64 pni; /* FC Word 1 and 2, platform name identifier */ -- -- __be16 rsvd; /* FC Word 3, bit 31:16 */ -- __be16 npiv_cnt; /* FC Word 3, bit 15:0 */ --} __packed; -- - struct serv_parm { /* Structure is in Big Endian format */ - struct csp cmn; - struct lpfc_name portName; -@@ -542,7 +519,7 @@ struct serv_parm { /* Structure is in Big Endian format */ - struct class_parms cls1; - struct class_parms cls2; - struct class_parms cls3; -- struct aux_parm aux; -+ struct class_parms cls4; - union { - uint8_t vendorVersion[16]; - struct { -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 9e785bbf6785..e16370da3e45 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -432,6 +432,8 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - ndlp->nlp_class_sup |= FC_COS_CLASS2; - if (sp->cls3.classValid) - ndlp->nlp_class_sup |= FC_COS_CLASS3; -+ if (sp->cls4.classValid) -+ ndlp->nlp_class_sup |= FC_COS_CLASS4; - ndlp->nlp_maxframe = - ((sp->cmn.bbRcvSizeMsb & 0x0F) << 8) | sp->cmn.bbRcvSizeLsb; - /* if already logged in, do implicit logout */ -@@ -1415,6 +1417,8 @@ lpfc_cmpl_plogi_plogi_issue(struct lpfc_vport *vport, - ndlp->nlp_class_sup |= FC_COS_CLASS2; - if (sp->cls3.classValid) - ndlp->nlp_class_sup |= FC_COS_CLASS3; -+ if (sp->cls4.classValid) -+ ndlp->nlp_class_sup |= FC_COS_CLASS4; - ndlp->nlp_maxframe = - ((sp->cmn.bbRcvSizeMsb & 0x0F) << 8) | sp->cmn.bbRcvSizeLsb; - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index a4ae0e5c0bfa..8b9fcd9c0d36 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -27,8 +27,6 @@ - #include - #include - #include --#include --#include - - #include - #include -@@ -8441,70 +8439,6 @@ lpfc_set_host_tm(struct lpfc_hba *phba) - return rc; - } - --/** -- * lpfc_get_platform_uuid - Attempts to extract a platform uuid -- * @phba: pointer to lpfc hba data structure. -- * -- * This routine attempts to first read SMBIOS DMI data for the System -- * Information structure offset 08h called System UUID. Else, no platform -- * UUID will be advertised. -- **/ --static void --lpfc_get_platform_uuid(struct lpfc_hba *phba) --{ -- int rc; -- const char *uuid; -- char pni[17] = {0}; /* 16 characters + '\0' */ -- bool is_ff = true, is_00 = true; -- u8 i; -- -- /* First attempt SMBIOS DMI */ -- uuid = dmi_get_system_info(DMI_PRODUCT_UUID); -- if (uuid) { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2088 SMBIOS UUID %s\n", -- uuid); -- } else { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2099 Could not extract UUID\n"); -- } -- -- if (uuid && uuid_is_valid(uuid)) { -- /* Generate PNI from UUID format. -- * -- * 1.) Extract lower 64 bits from UUID format. -- * 2.) Set 3h for NAA Locally Assigned Name Identifier format. -- * -- * e.g. xxxxxxxx-xxxx-xxxx-yyyy-yyyyyyyyyyyy -- * -- * extract the yyyy-yyyyyyyyyyyy portion -- * final PNI 3yyyyyyyyyyyyyyy -- */ -- scnprintf(pni, sizeof(pni), "3%c%c%c%s", -- uuid[20], uuid[21], uuid[22], &uuid[24]); -- -- /* Sanitize the converted PNI */ -- for (i = 1; i < 16 && (is_ff || is_00); i++) { -- if (pni[i] != '0') -- is_00 = false; -- if (pni[i] != 'f' && pni[i] != 'F') -- is_ff = false; -- } -- -- /* Convert from char* to unsigned long */ -- rc = kstrtoul(pni, 16, &phba->pni); -- if (!rc && !is_ff && !is_00) { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2100 PNI 0x%016lx\n", phba->pni); -- } else { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2101 PNI %s generation status %d\n", -- pni, rc); -- phba->pni = 0; -- } -- } --} -- - /** - * lpfc_sli4_hba_setup - SLI4 device initialization PCI function - * @phba: Pointer to HBA context object. -@@ -8588,10 +8522,6 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) - clear_bit(HBA_FCOE_MODE, &phba->hba_flag); - } - -- /* Obtain platform UUID, only for SLI4 FC adapters */ -- if (!test_bit(HBA_FCOE_MODE, &phba->hba_flag)) -- lpfc_get_platform_uuid(phba); -- - if (bf_get(lpfc_mbx_rd_rev_cee_ver, &mqe->un.read_rev) == - LPFC_DCBX_CEE_MODE) - set_bit(HBA_FIP_SUPPORT, &phba->hba_flag); diff --git a/1168-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch b/1168-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch deleted file mode 100644 index 1570e5f75..000000000 --- a/1168-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch +++ /dev/null @@ -1,27 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" -# reverse of cs10 db29ff738106f5cd68a5fd5299f937c124aaef2a - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 15c062c1566d..ef6e4ee9b608 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -2279,8 +2279,7 @@ lpfc_issue_els_plogi(struct lpfc_vport *vport, uint32_t did, uint8_t retry) - - sp->cmn.valid_vendor_ver_level = 0; - memset(sp->un.vendorVersion, 0, sizeof(sp->un.vendorVersion)); -- if (!test_bit(FC_PT2PT, &vport->fc_flag)) -- sp->cmn.bbRcvSizeMsb &= 0xF; -+ sp->cmn.bbRcvSizeMsb &= 0xF; - - /* Check if the destination port supports VMID */ - ndlp->vmid_support = 0; -@@ -5670,8 +5669,7 @@ lpfc_els_rsp_acc(struct lpfc_vport *vport, uint32_t flag, - sp->cmn.valid_vendor_ver_level = 0; - memset(sp->un.vendorVersion, 0, - sizeof(sp->un.vendorVersion)); -- if (!test_bit(FC_PT2PT, &vport->fc_flag)) -- sp->cmn.bbRcvSizeMsb &= 0xF; -+ sp->cmn.bbRcvSizeMsb &= 0xF; - - /* If our firmware supports this feature, convey that - * info to the target using the vendor specific field. diff --git a/1169-revert-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-drop.patch b/1169-revert-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-drop.patch deleted file mode 100644 index c9de2a9a6..000000000 --- a/1169-revert-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-drop.patch +++ /dev/null @@ -1,101 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" -# reverse of cs10 a1229adf21035776936072b77d724e9e79cdf813 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index ef6e4ee9b608..f8df66009c35 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -934,15 +934,10 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - /* Check to see if link went down during discovery */ - if (lpfc_els_chk_latt(vport)) { - /* One additional decrement on node reference count to -- * trigger the release of the node. Make sure the ndlp -- * is marked NLP_DROPPED. -+ * trigger the release of the node - */ -- if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) && -- !test_bit(NLP_DROPPED, &ndlp->nlp_flag) && -- !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { -- set_bit(NLP_DROPPED, &ndlp->nlp_flag); -+ if (!(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) - lpfc_nlp_put(ndlp); -- } - goto out; - } - -@@ -1000,10 +995,9 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - IOERR_LOOP_OPEN_FAILURE))) - lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, - "2858 FLOGI Status:x%x/x%x TMO" -- ":x%x Data x%lx x%x x%lx x%x\n", -+ ":x%x Data x%lx x%x\n", - ulp_status, ulp_word4, tmo, -- phba->hba_flag, phba->fcf.fcf_flag, -- ndlp->nlp_flag, ndlp->fc4_xpt_flags); -+ phba->hba_flag, phba->fcf.fcf_flag); - - /* Check for retry */ - if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { -@@ -1021,17 +1015,14 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - * reference to trigger node release. - */ - if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) && -- !test_bit(NLP_DROPPED, &ndlp->nlp_flag) && -- !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { -- set_bit(NLP_DROPPED, &ndlp->nlp_flag); -+ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) - lpfc_nlp_put(ndlp); -- } - - lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS, - "0150 FLOGI Status:x%x/x%x " -- "xri x%x iotag x%x TMO:x%x refcnt %d\n", -+ "xri x%x TMO:x%x refcnt %d\n", - ulp_status, ulp_word4, cmdiocb->sli4_xritag, -- cmdiocb->iotag, tmo, kref_read(&ndlp->kref)); -+ tmo, kref_read(&ndlp->kref)); - - /* If this is not a loop open failure, bail out */ - if (!(ulp_status == IOSTAT_LOCAL_REJECT && -@@ -1288,19 +1279,6 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - uint32_t tmo, did; - int rc; - -- /* It's possible for lpfc to reissue a FLOGI on an ndlp that is marked -- * NLP_DROPPED. This happens when the FLOGI completed with the XB bit -- * set causing lpfc to reference the ndlp until the XRI_ABORTED CQE is -- * issued. The time window for the XRI_ABORTED CQE can be as much as -- * 2*2*RA_TOV allowing for ndlp reuse of this type when the link is -- * cycling quickly. When true, restore the initial reference and remove -- * the NLP_DROPPED flag as lpfc is retrying. -- */ -- if (test_and_clear_bit(NLP_DROPPED, &ndlp->nlp_flag)) { -- if (!lpfc_nlp_get(ndlp)) -- return 1; -- } -- - cmdsize = (sizeof(uint32_t) + sizeof(struct serv_parm)); - elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, - ndlp->nlp_DID, ELS_CMD_FLOGI); -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index dcf78ea77a7d..1510ed28f5a4 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -424,7 +424,6 @@ lpfc_check_nlp_post_devloss(struct lpfc_vport *vport, - struct lpfc_nodelist *ndlp) - { - if (test_and_clear_bit(NLP_IN_RECOV_POST_DEV_LOSS, &ndlp->save_flags)) { -- clear_bit(NLP_DROPPED, &ndlp->nlp_flag); - lpfc_nlp_get(ndlp); - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY | LOG_NODE, - "8438 Devloss timeout reversed on DID x%x " -@@ -567,8 +566,7 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp) - return fcf_inuse; - } - -- if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -- lpfc_nlp_put(ndlp); -+ lpfc_nlp_put(ndlp); - return fcf_inuse; - } - diff --git a/1170-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch b/1170-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch deleted file mode 100644 index b55002875..000000000 --- a/1170-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch +++ /dev/null @@ -1,231 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" -# reverse of cs10 4cdd701db602453946844b4900c2da8637acc343 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index f8df66009c35..fea93a585fc9 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3390,21 +3390,11 @@ lpfc_cmpl_els_disc_cmd(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - lpfc_cmpl_els_edc(phba, cmdiocb, rspiocb); - return; - } -- - if (ulp_status) { - /* ELS discovery cmd completes with error */ - lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS | LOG_CGN_MGMT, - "4203 ELS cmd x%x error: x%x x%X\n", cmd, - ulp_status, ulp_word4); -- -- /* In the case where the ELS cmd completes with an error and -- * the node does not have RPI registered, the node is -- * outstanding and should put its initial reference. -- */ -- if ((cmd == ELS_CMD_SCR || cmd == ELS_CMD_RDF) && -- !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD) && -- !test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -- lpfc_nlp_put(ndlp); - goto out; - } - -@@ -3473,7 +3463,6 @@ lpfc_issue_els_scr(struct lpfc_vport *vport, uint8_t retry) - uint8_t *pcmd; - uint16_t cmdsize; - struct lpfc_nodelist *ndlp; -- bool node_created = false; - - cmdsize = (sizeof(uint32_t) + sizeof(SCR)); - -@@ -3483,21 +3472,21 @@ lpfc_issue_els_scr(struct lpfc_vport *vport, uint8_t retry) - if (!ndlp) - return 1; - lpfc_enqueue_node(vport, ndlp); -- node_created = true; - } - - elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, - ndlp->nlp_DID, ELS_CMD_SCR); - if (!elsiocb) -- goto out_node_created; -+ return 1; - - if (phba->sli_rev == LPFC_SLI_REV4) { - rc = lpfc_reg_fab_ctrl_node(vport, ndlp); - if (rc) { -+ lpfc_els_free_iocb(phba, elsiocb); - lpfc_printf_vlog(vport, KERN_ERR, LOG_NODE, - "0937 %s: Failed to reg fc node, rc %d\n", - __func__, rc); -- goto out_free_iocb; -+ return 1; - } - } - pcmd = (uint8_t *)elsiocb->cmd_dmabuf->virt; -@@ -3516,27 +3505,23 @@ lpfc_issue_els_scr(struct lpfc_vport *vport, uint8_t retry) - phba->fc_stat.elsXmitSCR++; - elsiocb->cmd_cmpl = lpfc_cmpl_els_disc_cmd; - elsiocb->ndlp = lpfc_nlp_get(ndlp); -- if (!elsiocb->ndlp) -- goto out_free_iocb; -+ if (!elsiocb->ndlp) { -+ lpfc_els_free_iocb(phba, elsiocb); -+ return 1; -+ } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue SCR: did:x%x refcnt %d", - ndlp->nlp_DID, kref_read(&ndlp->kref), 0); - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); -- if (rc == IOCB_ERROR) -- goto out_iocb_error; -+ if (rc == IOCB_ERROR) { -+ lpfc_els_free_iocb(phba, elsiocb); -+ lpfc_nlp_put(ndlp); -+ return 1; -+ } - - return 0; -- --out_iocb_error: -- lpfc_nlp_put(ndlp); --out_free_iocb: -- lpfc_els_free_iocb(phba, elsiocb); --out_node_created: -- if (node_created) -- lpfc_nlp_put(ndlp); -- return 1; - } - - /** -@@ -3749,12 +3734,7 @@ lpfc_issue_els_farpr(struct lpfc_vport *vport, uint32_t nportid, uint8_t retry) - * - * Return code - * 0 - Successfully issued rdf command -- * < 0 - Failed to issue rdf command -- * -EACCES - RDF not required for NPIV_PORT -- * -ENODEV - No fabric controller device available -- * -ENOMEM - No available memory -- * -EIO - The mailbox failed to complete successfully. -- * -+ * 1 - Failed to issue rdf command - **/ - int - lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) -@@ -3765,30 +3745,25 @@ lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) - struct lpfc_nodelist *ndlp; - uint16_t cmdsize; - int rc; -- bool node_created = false; -- int err; - - cmdsize = sizeof(*prdf); - -- /* RDF ELS is not required on an NPIV VN_Port. */ -- if (vport->port_type == LPFC_NPIV_PORT) -- return -EACCES; -- - ndlp = lpfc_findnode_did(vport, Fabric_Cntl_DID); - if (!ndlp) { - ndlp = lpfc_nlp_init(vport, Fabric_Cntl_DID); - if (!ndlp) - return -ENODEV; - lpfc_enqueue_node(vport, ndlp); -- node_created = true; - } - -+ /* RDF ELS is not required on an NPIV VN_Port. */ -+ if (vport->port_type == LPFC_NPIV_PORT) -+ return -EACCES; -+ - elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, - ndlp->nlp_DID, ELS_CMD_RDF); -- if (!elsiocb) { -- err = -ENOMEM; -- goto out_node_created; -- } -+ if (!elsiocb) -+ return -ENOMEM; - - /* Configure the payload for the supported FPIN events. */ - prdf = (struct lpfc_els_rdf_req *)elsiocb->cmd_dmabuf->virt; -@@ -3814,8 +3789,8 @@ lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) - elsiocb->cmd_cmpl = lpfc_cmpl_els_disc_cmd; - elsiocb->ndlp = lpfc_nlp_get(ndlp); - if (!elsiocb->ndlp) { -- err = -EIO; -- goto out_free_iocb; -+ lpfc_els_free_iocb(phba, elsiocb); -+ return -EIO; - } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, -@@ -3824,19 +3799,11 @@ lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { -- err = -EIO; -- goto out_iocb_error; -+ lpfc_els_free_iocb(phba, elsiocb); -+ lpfc_nlp_put(ndlp); -+ return -EIO; - } - return 0; -- --out_iocb_error: -- lpfc_nlp_put(ndlp); --out_free_iocb: -- lpfc_els_free_iocb(phba, elsiocb); --out_node_created: -- if (node_created) -- lpfc_nlp_put(ndlp); -- return err; - } - - /** -@@ -3857,23 +3824,19 @@ static int - lpfc_els_rcv_rdf(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - struct lpfc_nodelist *ndlp) - { -- int rc; -- -- rc = lpfc_els_rsp_acc(vport, ELS_CMD_RDF, cmdiocb, ndlp, NULL); - /* Send LS_ACC */ -- if (rc) { -+ if (lpfc_els_rsp_acc(vport, ELS_CMD_RDF, cmdiocb, ndlp, NULL)) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_CGN_MGMT, -- "1623 Failed to RDF_ACC from x%x for x%x Data: %d\n", -- ndlp->nlp_DID, vport->fc_myDID, rc); -+ "1623 Failed to RDF_ACC from x%x for x%x\n", -+ ndlp->nlp_DID, vport->fc_myDID); - return -EIO; - } - -- rc = lpfc_issue_els_rdf(vport, 0); - /* Issue new RDF for reregistering */ -- if (rc) { -+ if (lpfc_issue_els_rdf(vport, 0)) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_CGN_MGMT, -- "2623 Failed to re register RDF for x%x Data: %d\n", -- vport->fc_myDID, rc); -+ "2623 Failed to re register RDF for x%x\n", -+ vport->fc_myDID); - return -EIO; - } - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index f9682ad0b888..e4f627eeb707 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -3057,6 +3057,12 @@ lpfc_cleanup(struct lpfc_vport *vport) - lpfc_vmid_vport_cleanup(vport); - - list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) { -+ if (ndlp->nlp_DID == Fabric_Cntl_DID && -+ ndlp->nlp_state == NLP_STE_UNUSED_NODE) { -+ lpfc_nlp_put(ndlp); -+ continue; -+ } -+ - /* Fabric Ports not in UNMAPPED state are cleaned up in the - * DEVICE_RM event. - */ diff --git a/1171-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch b/1171-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch deleted file mode 100644 index 256d33ea2..000000000 --- a/1171-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch +++ /dev/null @@ -1,166 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" -# reverse of cs10 6613865f84be09ec32bee8199827f6bc7f9a36b8 - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index ad8f5dee23a3..a3d1ba92c07c 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -312,6 +312,7 @@ struct lpfc_defer_flogi_acc { - u16 rx_id; - u16 ox_id; - struct lpfc_nodelist *ndlp; -+ - }; - - #define LPFC_VMID_TIMER 300 /* timer interval in seconds */ -diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h -index 51cb8571c049..3d47dc7458d1 100644 ---- a/drivers/scsi/lpfc/lpfc_disc.h -+++ b/drivers/scsi/lpfc/lpfc_disc.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2013 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -@@ -208,7 +208,6 @@ enum lpfc_nlp_flag { - NPR list */ - NLP_RM_DFLT_RPI = 26, /* need to remove leftover dflt RPI */ - NLP_NODEV_REMOVE = 27, /* Defer removal till discovery ends */ -- NLP_FLOGI_DFR_ACC = 28, /* FLOGI LS_ACC was Deferred */ - NLP_SC_REQ = 29, /* Target requires authentication */ - NLP_FIRSTBURST = 30, /* Target supports FirstBurst */ - NLP_RPI_REGISTERED = 31 /* nlp_rpi is valid */ -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index fea93a585fc9..79688e12bae2 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1413,12 +1413,11 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - phba->defer_flogi_acc.ox_id; - } - -- /* The LS_ACC completion needs to drop the initial reference. -- * This is a special case for Pt2Pt because both FLOGIs need -- * to complete and lpfc defers the LS_ACC when the remote -- * FLOGI arrives before the driver's FLOGI. -- */ -- set_bit(NLP_FLOGI_DFR_ACC, &ndlp->nlp_flag); -+ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -+ "3354 Xmit deferred FLOGI ACC: rx_id: x%x," -+ " ox_id: x%x, hba_flag x%lx\n", -+ phba->defer_flogi_acc.rx_id, -+ phba->defer_flogi_acc.ox_id, phba->hba_flag); - - /* Send deferred FLOGI ACC */ - lpfc_els_rsp_acc(vport, ELS_CMD_FLOGI, &defer_flogi_acc, -@@ -1434,14 +1433,6 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - phba->defer_flogi_acc.ndlp = NULL; - } - -- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "3354 Xmit deferred FLOGI ACC: rx_id: x%x," -- " ox_id: x%x, ndlp x%px hba_flag x%lx\n", -- phba->defer_flogi_acc.rx_id, -- phba->defer_flogi_acc.ox_id, -- phba->defer_flogi_acc.ndlp, -- phba->hba_flag); -- - vport->fc_myDID = did; - } - -@@ -5310,12 +5301,11 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - IOCB_t *irsp; - LPFC_MBOXQ_t *mbox = NULL; - u32 ulp_status, ulp_word4, tmo, did, iotag; -- u32 cmd; - - if (!vport) { - lpfc_printf_log(phba, KERN_WARNING, LOG_ELS, - "3177 null vport in ELS rsp\n"); -- goto release; -+ goto out; - } - if (cmdiocb->context_un.mbox) - mbox = cmdiocb->context_un.mbox; -@@ -5425,7 +5415,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - * these conditions because it doesn't need the login. - */ - if (phba->sli_rev == LPFC_SLI_REV4 && -- vport->port_type == LPFC_NPIV_PORT && -+ vport && vport->port_type == LPFC_NPIV_PORT && - !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { - if (ndlp->nlp_state != NLP_STE_PLOGI_ISSUE && - ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE && -@@ -5441,27 +5431,6 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - } - } - -- /* The driver's unsolicited deferred FLOGI ACC in Pt2Pt needs to -- * release the initial reference because the put after the free_iocb -- * call removes only the reference from the defer logic. This FLOGI -- * is never registered with the SCSI transport. -- */ -- if (test_bit(FC_PT2PT, &vport->fc_flag) && -- test_and_clear_bit(NLP_FLOGI_DFR_ACC, &ndlp->nlp_flag)) { -- lpfc_printf_vlog(vport, KERN_INFO, -- LOG_ELS | LOG_NODE | LOG_DISCOVERY, -- "3357 Pt2Pt Defer FLOGI ACC ndlp x%px, " -- "nflags x%lx, fc_flag x%lx\n", -- ndlp, ndlp->nlp_flag, -- vport->fc_flag); -- cmd = *((u32 *)cmdiocb->cmd_dmabuf->virt); -- if (cmd == ELS_CMD_ACC) { -- if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -- lpfc_nlp_put(ndlp); -- } -- } -- --release: - /* Release the originating I/O reference. */ - lpfc_els_free_iocb(phba, cmdiocb); - lpfc_nlp_put(ndlp); -@@ -8430,6 +8399,13 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - &wqe->xmit_els_rsp.wqe_com); - - vport->fc_myDID = did; -+ -+ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -+ "3344 Deferring FLOGI ACC: rx_id: x%x," -+ " ox_id: x%x, hba_flag x%lx\n", -+ phba->defer_flogi_acc.rx_id, -+ phba->defer_flogi_acc.ox_id, phba->hba_flag); -+ - phba->defer_flogi_acc.flag = true; - - /* This nlp_get is paired with nlp_puts that reset the -@@ -8438,14 +8414,6 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - * processed or cancelled. - */ - phba->defer_flogi_acc.ndlp = lpfc_nlp_get(ndlp); -- -- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "3344 Deferring FLOGI ACC: rx_id: x%x," -- " ox_id: x%x, ndlp x%px, hba_flag x%lx\n", -- phba->defer_flogi_acc.rx_id, -- phba->defer_flogi_acc.ox_id, -- phba->defer_flogi_acc.ndlp, -- phba->hba_flag); - return 0; - } - -@@ -10386,8 +10354,11 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - * Do not process any unsolicited ELS commands - * if the ndlp is in DEV_LOSS - */ -- if (test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag)) -+ if (test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag)) { -+ if (newnode) -+ lpfc_nlp_put(ndlp); - goto dropit; -+ } - - elsiocb->ndlp = lpfc_nlp_get(ndlp); - if (!elsiocb->ndlp) diff --git a/1172-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch b/1172-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch deleted file mode 100644 index 55c1e865e..000000000 --- a/1172-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch +++ /dev/null @@ -1,51 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" -# reverse of cs10 f695221fbfe2235768a0d33cce97523eb1d12399 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 79688e12bae2..458b46374189 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3263,7 +3263,7 @@ lpfc_reg_fab_ctrl_node(struct lpfc_vport *vport, struct lpfc_nodelist *fc_ndlp) - return -ENOMEM; - } - rc = lpfc_reg_rpi(phba, vport->vpi, fc_ndlp->nlp_DID, -- (u8 *)&ns_ndlp->fc_sparam, mbox, fc_ndlp->nlp_rpi); -+ (u8 *)&vport->fc_sparam, mbox, fc_ndlp->nlp_rpi); - if (rc) { - rc = -EACCES; - goto out; -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index e16370da3e45..99aefc54ac35 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -452,7 +452,18 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - */ - if (!(ndlp->nlp_type & NLP_FABRIC) && - !(phba->nvmet_support)) { -- break; -+ /* Clear ndlp info, since follow up PRLI may have -+ * updated ndlp information -+ */ -+ ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); -+ ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); -+ ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; -+ ndlp->nlp_nvme_info &= ~NLP_NVME_NSLER; -+ clear_bit(NLP_FIRSTBURST, &ndlp->nlp_flag); -+ -+ lpfc_els_rsp_acc(vport, ELS_CMD_PLOGI, cmdiocb, -+ ndlp, NULL); -+ return 1; - } - if (nlp_portwwn != 0 && - nlp_portwwn != wwn_to_u64(sp->portName.u.wwn)) -@@ -474,9 +485,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); - break; - } -- /* Clear ndlp info, since follow up processes may have -- * updated ndlp information -- */ -+ - ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); - ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); - ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; diff --git a/1173-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch b/1173-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch deleted file mode 100644 index 8578ebaf4..000000000 --- a/1173-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch +++ /dev/null @@ -1,22 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" -# reverse of cs10 834ef5ff877b17409e754a04a433e05441938a3d - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 458b46374189..073c4c69d646 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -5158,12 +5158,14 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb) - } else { - buf_ptr1 = elsiocb->cmd_dmabuf; - lpfc_els_free_data(phba, buf_ptr1); -+ elsiocb->cmd_dmabuf = NULL; - } - } - - if (elsiocb->bpl_dmabuf) { - buf_ptr = elsiocb->bpl_dmabuf; - lpfc_els_free_bpl(phba, buf_ptr); -+ elsiocb->bpl_dmabuf = NULL; - } - lpfc_sli_release_iocbq(phba, elsiocb); - return 0; diff --git a/1174-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch b/1174-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch deleted file mode 100644 index 2758a4138..000000000 --- a/1174-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch +++ /dev/null @@ -1,104 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Revise discovery related function headers and comments" -# reverse of cs10 5e8d3ec786a04644f14f881e4017a450c305f786 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 073c4c69d646..f9a08704b78e 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3024,7 +3024,6 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - ndlp->nlp_DID, ulp_status, - ulp_word4); - -- /* Call NLP_EVT_DEVICE_RM if link is down or LOGO is aborted */ - if (lpfc_error_lost_link(vport, ulp_status, ulp_word4)) - skip_recovery = 1; - } -@@ -3307,8 +3306,7 @@ lpfc_reg_fab_ctrl_node(struct lpfc_vport *vport, struct lpfc_nodelist *fc_ndlp) - * - * This routine is a generic completion callback function for Discovery ELS cmd. - * Currently used by the ELS command issuing routines for the ELS State Change -- * Request (SCR), lpfc_issue_els_scr(), Exchange Diagnostic Capabilities (EDC), -- * lpfc_issue_els_edc() and the ELS RDF, lpfc_issue_els_rdf(). -+ * Request (SCR), lpfc_issue_els_scr() and the ELS RDF, lpfc_issue_els_rdf(). - * These commands will be retried once only for ELS timeout errors. - **/ - static void -@@ -3707,7 +3705,10 @@ lpfc_issue_els_farpr(struct lpfc_vport *vport, uint32_t nportid, uint8_t retry) - lpfc_nlp_put(ndlp); - return 1; - } -- -+ /* This will cause the callback-function lpfc_cmpl_els_cmd to -+ * trigger the release of the node. -+ */ -+ /* Don't release reference count as RDF is likely outstanding */ - return 0; - } - -@@ -4298,7 +4299,7 @@ lpfc_issue_els_edc(struct lpfc_vport *vport, uint8_t retry) - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { - /* The additional lpfc_nlp_put will cause the following -- * lpfc_els_free_iocb routine to trigger the release of -+ * lpfc_els_free_iocb routine to trigger the rlease of - * the node. - */ - lpfc_els_free_iocb(phba, elsiocb); -@@ -5125,7 +5126,7 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb) - { - struct lpfc_dmabuf *buf_ptr, *buf_ptr1; - -- /* The I/O iocb is complete. Clear the node and first dmabuf */ -+ /* The I/O iocb is complete. Clear the node and first dmbuf */ - elsiocb->ndlp = NULL; - - /* cmd_dmabuf = cmd, cmd_dmabuf->next = rsp, bpl_dmabuf = bpl */ -@@ -8733,7 +8734,7 @@ lpfc_els_rcv_rls(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - * @cmdiocb: pointer to lpfc command iocb data structure. - * @ndlp: pointer to a node-list data structure. - * -- * This routine processes Read Timeout Value (RTV) IOCB received as an -+ * This routine processes Read Timout Value (RTV) IOCB received as an - * ELS unsolicited event. It first checks the remote port state. If the - * remote port is not in NLP_STE_UNMAPPED_NODE state or NLP_STE_MAPPED_NODE - * state, it invokes the lpfc_els_rsl_reject() routine to send the reject -@@ -10842,7 +10843,7 @@ lpfc_els_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - lpfc_els_unsol_buffer(phba, pring, vport, elsiocb); - /* - * The different unsolicited event handlers would tell us -- * if they are done with "mp" by setting cmd_dmabuf/bpl_dmabuf to NULL. -+ * if they are done with "mp" by setting cmd_dmabuf to NULL. - */ - if (elsiocb->cmd_dmabuf) { - lpfc_in_buf_free(phba, elsiocb->cmd_dmabuf); -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 8b9fcd9c0d36..08d16552c4b7 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -19857,15 +19857,13 @@ lpfc_sli4_remove_rpis(struct lpfc_hba *phba) - } - - /** -- * lpfc_sli4_resume_rpi - Resume traffic relative to an RPI -+ * lpfc_sli4_resume_rpi - Remove the rpi bitmask region - * @ndlp: pointer to lpfc nodelist data structure. - * @cmpl: completion call-back. - * @iocbq: data to load as mbox ctx_u information - * -- * Return codes -- * 0 - successful -- * -ENOMEM - No available memory -- * -EIO - The mailbox failed to complete successfully. -+ * This routine is invoked to remove the memory region that -+ * provided rpi via a bitmask. - **/ - int - lpfc_sli4_resume_rpi(struct lpfc_nodelist *ndlp, -@@ -19895,6 +19893,7 @@ lpfc_sli4_resume_rpi(struct lpfc_nodelist *ndlp, - return -EIO; - } - -+ /* Post all rpi memory regions to the port. */ - lpfc_resume_rpi(mboxq, ndlp); - if (cmpl) { - mboxq->mbox_cmpl = cmpl; diff --git a/1175-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch b/1175-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch deleted file mode 100644 index 6ddf56e66..000000000 --- a/1175-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch +++ /dev/null @@ -1,44 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" -# reverse of cs10 a4b8d188c3e27a0335f85a2cfb877d3f684df5c9 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index f9a08704b78e..9a20a08f4bd9 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -2367,7 +2367,7 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - mode = KERN_INFO; - - /* Warn PRLI status */ -- lpfc_vlog_msg(vport, mode, LOG_ELS, -+ lpfc_printf_vlog(vport, mode, LOG_ELS, - "2754 PRLI DID:%06X Status:x%x/x%x, " - "data: x%x x%x x%lx\n", - ndlp->nlp_DID, ulp_status, -@@ -3597,8 +3597,8 @@ lpfc_issue_els_rscn(struct lpfc_vport *vport, uint8_t retry) - } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, -- "Issue RSCN: did:x%x refcnt %d", -- ndlp->nlp_DID, kref_read(&ndlp->kref), 0); -+ "Issue RSCN: did:x%x", -+ ndlp->nlp_DID, 0, 0); - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index e4f627eeb707..fd4317b9484c 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -9082,9 +9082,9 @@ lpfc_setup_fdmi_mask(struct lpfc_vport *vport) - vport->fdmi_port_mask = LPFC_FDMI2_PORT_ATTR; - } - -- lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, -- "6077 Setup FDMI mask: hba x%x port x%x\n", -- vport->fdmi_hba_mask, vport->fdmi_port_mask); -+ lpfc_printf_log(phba, KERN_INFO, LOG_DISCOVERY, -+ "6077 Setup FDMI mask: hba x%x port x%x\n", -+ vport->fdmi_hba_mask, vport->fdmi_port_mask); - } - - /** diff --git a/1176-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch b/1176-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch deleted file mode 100644 index 3bd8566f1..000000000 --- a/1176-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch +++ /dev/null @@ -1,55 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" -# reverse of cs10 80c5e57a6da70af590e98e8e30455e83bd70d3a2 - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index a3d1ba92c07c..426a0e8d5731 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h -index a1464f8ac331..566dd84e0677 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.h -+++ b/drivers/scsi/lpfc/lpfc_debugfs.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2007-2011 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h -index 3bc0efa7453e..b287d39ad033 100644 ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 99aefc54ac35..1e331b76dff4 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * diff --git a/1177-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch b/1177-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch deleted file mode 100644 index 8e3c38dcf..000000000 --- a/1177-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch +++ /dev/null @@ -1,16 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" -# reverse of cs10 a34163398eef02a5c95e52c2be3e2025799273e7 - -diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h -index 31c3c5abdca6..9ee3a3a4ec4d 100644 ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.4.0.11" -+#define LPFC_DRIVER_VERSION "14.4.0.10" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ diff --git a/1178-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch b/1178-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch deleted file mode 100644 index 726fa6845..000000000 --- a/1178-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch +++ /dev/null @@ -1,89 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" -# reverse of cs10 91f7d8fdec311ec1d75aa4cc8d76ffd65da74689 - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 426a0e8d5731..1293d145b94e 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1333,7 +1333,7 @@ struct lpfc_hba { - unsigned long last_ramp_down_time; - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - struct dentry *hba_debugfs_root; -- unsigned int debugfs_vport_count; -+ atomic_t debugfs_vport_count; - - struct lpfc_debugfs_nvmeio_trc *nvmeio_trc; - atomic_t nvmeio_trc_cnt; -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 92b5b2dbe847..eaedbaff5a78 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -5752,7 +5752,7 @@ static const struct file_operations lpfc_debugfs_op_slow_ring_trc = { - }; - - static struct dentry *lpfc_debugfs_root = NULL; --static unsigned int lpfc_debugfs_hba_count; -+static atomic_t lpfc_debugfs_hba_count; - - /* - * File operations for the iDiag debugfs -@@ -6074,7 +6074,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - /* Setup lpfc root directory */ - if (!lpfc_debugfs_root) { - lpfc_debugfs_root = debugfs_create_dir("lpfc", NULL); -- lpfc_debugfs_hba_count = 0; -+ atomic_set(&lpfc_debugfs_hba_count, 0); - if (IS_ERR(lpfc_debugfs_root)) { - lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, - "0527 Cannot create debugfs lpfc\n"); -@@ -6090,13 +6090,13 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - pport_setup = true; - phba->hba_debugfs_root = - debugfs_create_dir(name, lpfc_debugfs_root); -- phba->debugfs_vport_count = 0; -+ atomic_set(&phba->debugfs_vport_count, 0); - if (IS_ERR(phba->hba_debugfs_root)) { - lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, - "0528 Cannot create debugfs %s\n", name); - return; - } -- lpfc_debugfs_hba_count++; -+ atomic_inc(&lpfc_debugfs_hba_count); - - /* Multi-XRI pools */ - debugfs_create_file("multixripools", 0644, -@@ -6268,7 +6268,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - "0529 Cannot create debugfs %s\n", name); - return; - } -- phba->debugfs_vport_count++; -+ atomic_inc(&phba->debugfs_vport_count); - } - - if (lpfc_debugfs_max_disc_trc) { -@@ -6402,10 +6402,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - if (vport->vport_debugfs_root) { - debugfs_remove(vport->vport_debugfs_root); /* vportX */ - vport->vport_debugfs_root = NULL; -- phba->debugfs_vport_count--; -+ atomic_dec(&phba->debugfs_vport_count); - } - -- if (!phba->debugfs_vport_count) { -+ if (atomic_read(&phba->debugfs_vport_count) == 0) { - kfree(phba->slow_ring_trc); - phba->slow_ring_trc = NULL; - -@@ -6415,10 +6415,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - if (phba->hba_debugfs_root) { - debugfs_remove(phba->hba_debugfs_root); /* fnX */ - phba->hba_debugfs_root = NULL; -- lpfc_debugfs_hba_count--; -+ atomic_dec(&lpfc_debugfs_hba_count); - } - -- if (!lpfc_debugfs_hba_count) { -+ if (atomic_read(&lpfc_debugfs_hba_count) == 0) { - debugfs_remove(lpfc_debugfs_root); /* lpfc */ - lpfc_debugfs_root = NULL; - } diff --git a/1179-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch b/1179-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch deleted file mode 100644 index 19f30a950..000000000 --- a/1179-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch +++ /dev/null @@ -1,680 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Clean up extraneous phba dentries" -# reverse of cs10 0602f03214fe3d617fa735dfdc7aace47c0d2f54 - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 1293d145b94e..9389e3def94e 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -742,6 +742,12 @@ struct lpfc_vport { - struct lpfc_vmid_priority_info vmid_priority; - - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS -+ struct dentry *debug_disc_trc; -+ struct dentry *debug_nodelist; -+ struct dentry *debug_nvmestat; -+ struct dentry *debug_scsistat; -+ struct dentry *debug_ioktime; -+ struct dentry *debug_hdwqstat; - struct dentry *vport_debugfs_root; - struct lpfc_debugfs_trc *disc_trc; - atomic_t disc_trc_cnt; -@@ -1334,8 +1340,29 @@ struct lpfc_hba { - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - struct dentry *hba_debugfs_root; - atomic_t debugfs_vport_count; -- -+ struct dentry *debug_multixri_pools; -+ struct dentry *debug_hbqinfo; -+ struct dentry *debug_dumpHostSlim; -+ struct dentry *debug_dumpHBASlim; -+ struct dentry *debug_InjErrLBA; /* LBA to inject errors at */ -+ struct dentry *debug_InjErrNPortID; /* NPortID to inject errors at */ -+ struct dentry *debug_InjErrWWPN; /* WWPN to inject errors at */ -+ struct dentry *debug_writeGuard; /* inject write guard_tag errors */ -+ struct dentry *debug_writeApp; /* inject write app_tag errors */ -+ struct dentry *debug_writeRef; /* inject write ref_tag errors */ -+ struct dentry *debug_readGuard; /* inject read guard_tag errors */ -+ struct dentry *debug_readApp; /* inject read app_tag errors */ -+ struct dentry *debug_readRef; /* inject read ref_tag errors */ -+ -+ struct dentry *debug_nvmeio_trc; - struct lpfc_debugfs_nvmeio_trc *nvmeio_trc; -+ struct dentry *debug_hdwqinfo; -+#ifdef LPFC_HDWQ_LOCK_STAT -+ struct dentry *debug_lockstat; -+#endif -+ struct dentry *debug_cgn_buffer; -+ struct dentry *debug_rx_monitor; -+ struct dentry *debug_ras_log; - atomic_t nvmeio_trc_cnt; - uint32_t nvmeio_trc_size; - uint32_t nvmeio_trc_output_idx; -@@ -1352,10 +1379,19 @@ struct lpfc_hba { - sector_t lpfc_injerr_lba; - #define LPFC_INJERR_LBA_OFF (sector_t)(-1) - -+ struct dentry *debug_slow_ring_trc; - struct lpfc_debugfs_trc *slow_ring_trc; - atomic_t slow_ring_trc_cnt; - /* iDiag debugfs sub-directory */ - struct dentry *idiag_root; -+ struct dentry *idiag_pci_cfg; -+ struct dentry *idiag_bar_acc; -+ struct dentry *idiag_que_info; -+ struct dentry *idiag_que_acc; -+ struct dentry *idiag_drb_acc; -+ struct dentry *idiag_ctl_acc; -+ struct dentry *idiag_mbx_acc; -+ struct dentry *idiag_ext_acc; - uint8_t lpfc_idiag_last_eq; - #endif - uint16_t nvmeio_trc_on; -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index eaedbaff5a78..691314c68b59 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -6075,11 +6075,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - if (!lpfc_debugfs_root) { - lpfc_debugfs_root = debugfs_create_dir("lpfc", NULL); - atomic_set(&lpfc_debugfs_hba_count, 0); -- if (IS_ERR(lpfc_debugfs_root)) { -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, -- "0527 Cannot create debugfs lpfc\n"); -- return; -- } - } - if (!lpfc_debugfs_start_time) - lpfc_debugfs_start_time = jiffies; -@@ -6090,96 +6085,150 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - pport_setup = true; - phba->hba_debugfs_root = - debugfs_create_dir(name, lpfc_debugfs_root); -- atomic_set(&phba->debugfs_vport_count, 0); -- if (IS_ERR(phba->hba_debugfs_root)) { -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, -- "0528 Cannot create debugfs %s\n", name); -- return; -- } - atomic_inc(&lpfc_debugfs_hba_count); -+ atomic_set(&phba->debugfs_vport_count, 0); - - /* Multi-XRI pools */ -- debugfs_create_file("multixripools", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_multixripools); -+ snprintf(name, sizeof(name), "multixripools"); -+ phba->debug_multixri_pools = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, -+ &lpfc_debugfs_op_multixripools); -+ if (IS_ERR(phba->debug_multixri_pools)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "0527 Cannot create debugfs multixripools\n"); -+ goto debug_failed; -+ } - - /* Congestion Info Buffer */ -- debugfs_create_file("cgn_buffer", 0644, phba->hba_debugfs_root, -- phba, &lpfc_cgn_buffer_op); -+ scnprintf(name, sizeof(name), "cgn_buffer"); -+ phba->debug_cgn_buffer = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_cgn_buffer_op); -+ if (IS_ERR(phba->debug_cgn_buffer)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "6527 Cannot create debugfs " -+ "cgn_buffer\n"); -+ goto debug_failed; -+ } - - /* RX Monitor */ -- debugfs_create_file("rx_monitor", 0644, phba->hba_debugfs_root, -- phba, &lpfc_rx_monitor_op); -+ scnprintf(name, sizeof(name), "rx_monitor"); -+ phba->debug_rx_monitor = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_rx_monitor_op); -+ if (IS_ERR(phba->debug_rx_monitor)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "6528 Cannot create debugfs " -+ "rx_monitor\n"); -+ goto debug_failed; -+ } - - /* RAS log */ -- debugfs_create_file("ras_log", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_ras_log); -+ snprintf(name, sizeof(name), "ras_log"); -+ phba->debug_ras_log = -+ debugfs_create_file(name, 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_ras_log); -+ if (IS_ERR(phba->debug_ras_log)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "6148 Cannot create debugfs" -+ " ras_log\n"); -+ goto debug_failed; -+ } - - /* Setup hbqinfo */ -- debugfs_create_file("hbqinfo", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_op_hbqinfo); -+ snprintf(name, sizeof(name), "hbqinfo"); -+ phba->debug_hbqinfo = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_hbqinfo); - - #ifdef LPFC_HDWQ_LOCK_STAT - /* Setup lockstat */ -- debugfs_create_file("lockstat", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_op_lockstat); -+ snprintf(name, sizeof(name), "lockstat"); -+ phba->debug_lockstat = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_lockstat); -+ if (IS_ERR(phba->debug_lockstat)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "4610 Can't create debugfs lockstat\n"); -+ goto debug_failed; -+ } - #endif -+ -+ /* Setup dumpHBASlim */ - if (phba->sli_rev < LPFC_SLI_REV4) { -- /* Setup dumpHBASlim */ -- debugfs_create_file("dumpHBASlim", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_dumpHBASlim); -- } -+ snprintf(name, sizeof(name), "dumpHBASlim"); -+ phba->debug_dumpHBASlim = -+ debugfs_create_file(name, -+ S_IFREG|S_IRUGO|S_IWUSR, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_dumpHBASlim); -+ } else -+ phba->debug_dumpHBASlim = NULL; - -+ /* Setup dumpHostSlim */ - if (phba->sli_rev < LPFC_SLI_REV4) { -- /* Setup dumpHostSlim */ -- debugfs_create_file("dumpHostSlim", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_dumpHostSlim); -- } -+ snprintf(name, sizeof(name), "dumpHostSlim"); -+ phba->debug_dumpHostSlim = -+ debugfs_create_file(name, -+ S_IFREG|S_IRUGO|S_IWUSR, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_dumpHostSlim); -+ } else -+ phba->debug_dumpHostSlim = NULL; - - /* Setup DIF Error Injections */ -- debugfs_create_file_aux_num("InjErrLBA", 0644, -- phba->hba_debugfs_root, phba, -- InjErrLBA, -- &lpfc_debugfs_op_dif_err); -+ phba->debug_InjErrLBA = -+ debugfs_create_file_aux_num("InjErrLBA", 0644, -+ phba->hba_debugfs_root, -+ phba, InjErrLBA, &lpfc_debugfs_op_dif_err); - phba->lpfc_injerr_lba = LPFC_INJERR_LBA_OFF; - -- debugfs_create_file_aux_num("InjErrNPortID", 0644, -- phba->hba_debugfs_root, phba, -- InjErrNPortID, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("InjErrWWPN", 0644, -- phba->hba_debugfs_root, phba, -- InjErrWWPN, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("writeGuardInjErr", 0644, -- phba->hba_debugfs_root, phba, -- writeGuard, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("writeAppInjErr", 0644, -- phba->hba_debugfs_root, phba, -- writeApp, &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("writeRefInjErr", 0644, -- phba->hba_debugfs_root, phba, -- writeRef, &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("readGuardInjErr", 0644, -- phba->hba_debugfs_root, phba, -- readGuard, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("readAppInjErr", 0644, -- phba->hba_debugfs_root, phba, -- readApp, &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("readRefInjErr", 0644, -- phba->hba_debugfs_root, phba, -- readRef, &lpfc_debugfs_op_dif_err); -+ phba->debug_InjErrNPortID = -+ debugfs_create_file_aux_num("InjErrNPortID", 0644, -+ phba->hba_debugfs_root, -+ phba, InjErrNPortID, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_InjErrWWPN = -+ debugfs_create_file_aux_num("InjErrWWPN", 0644, -+ phba->hba_debugfs_root, -+ phba, InjErrWWPN, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_writeGuard = -+ debugfs_create_file_aux_num("writeGuardInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, writeGuard, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_writeApp = -+ debugfs_create_file_aux_num("writeAppInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, writeApp, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_writeRef = -+ debugfs_create_file_aux_num("writeRefInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, writeRef, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_readGuard = -+ debugfs_create_file_aux_num("readGuardInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, readGuard, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_readApp = -+ debugfs_create_file_aux_num("readAppInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, readApp, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_readRef = -+ debugfs_create_file_aux_num("readRefInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, readRef, &lpfc_debugfs_op_dif_err); - - /* Setup slow ring trace */ - if (lpfc_debugfs_max_slow_ring_trc) { -@@ -6199,9 +6248,11 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - } - } - -- debugfs_create_file("slow_ring_trace", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_slow_ring_trc); -+ snprintf(name, sizeof(name), "slow_ring_trace"); -+ phba->debug_slow_ring_trc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_slow_ring_trc); - if (!phba->slow_ring_trc) { - phba->slow_ring_trc = kcalloc( - lpfc_debugfs_max_slow_ring_trc, -@@ -6211,13 +6262,16 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, - "0416 Cannot create debugfs " - "slow_ring buffer\n"); -- goto out; -+ goto debug_failed; - } - atomic_set(&phba->slow_ring_trc_cnt, 0); - } - -- debugfs_create_file("nvmeio_trc", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_op_nvmeio_trc); -+ snprintf(name, sizeof(name), "nvmeio_trc"); -+ phba->debug_nvmeio_trc = -+ debugfs_create_file(name, 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_nvmeio_trc); - - atomic_set(&phba->nvmeio_trc_cnt, 0); - if (lpfc_debugfs_max_nvmeio_trc) { -@@ -6263,11 +6317,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - if (!vport->vport_debugfs_root) { - vport->vport_debugfs_root = - debugfs_create_dir(name, phba->hba_debugfs_root); -- if (IS_ERR(vport->vport_debugfs_root)) { -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, -- "0529 Cannot create debugfs %s\n", name); -- return; -- } - atomic_inc(&phba->debugfs_vport_count); - } - -@@ -6295,27 +6344,54 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, - "0418 Cannot create debugfs disc trace " - "buffer\n"); -- goto out; -+ goto debug_failed; - } - atomic_set(&vport->disc_trc_cnt, 0); - -- debugfs_create_file("discovery_trace", 0644, vport->vport_debugfs_root, -- vport, &lpfc_debugfs_op_disc_trc); -- -- debugfs_create_file("nodelist", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_nodelist); -- -- debugfs_create_file("nvmestat", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_nvmestat); -- -- debugfs_create_file("scsistat", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_scsistat); -+ snprintf(name, sizeof(name), "discovery_trace"); -+ vport->debug_disc_trc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_disc_trc); -+ snprintf(name, sizeof(name), "nodelist"); -+ vport->debug_nodelist = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_nodelist); -+ -+ snprintf(name, sizeof(name), "nvmestat"); -+ vport->debug_nvmestat = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_nvmestat); -+ -+ snprintf(name, sizeof(name), "scsistat"); -+ vport->debug_scsistat = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_scsistat); -+ if (IS_ERR(vport->debug_scsistat)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "4611 Cannot create debugfs scsistat\n"); -+ goto debug_failed; -+ } - -- debugfs_create_file("ioktime", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_ioktime); -+ snprintf(name, sizeof(name), "ioktime"); -+ vport->debug_ioktime = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_ioktime); -+ if (IS_ERR(vport->debug_ioktime)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "0815 Cannot create debugfs ioktime\n"); -+ goto debug_failed; -+ } - -- debugfs_create_file("hdwqstat", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_hdwqstat); -+ snprintf(name, sizeof(name), "hdwqstat"); -+ vport->debug_hdwqstat = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_hdwqstat); - - /* - * The following section is for additional directories/files for the -@@ -6323,58 +6399,93 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - */ - - if (!pport_setup) -- return; -+ goto debug_failed; - - /* - * iDiag debugfs root entry points for SLI4 device only - */ - if (phba->sli_rev < LPFC_SLI_REV4) -- return; -+ goto debug_failed; - -+ snprintf(name, sizeof(name), "iDiag"); - if (!phba->idiag_root) { - phba->idiag_root = -- debugfs_create_dir("iDiag", phba->hba_debugfs_root); -+ debugfs_create_dir(name, phba->hba_debugfs_root); - /* Initialize iDiag data structure */ - memset(&idiag, 0, sizeof(idiag)); - } - - /* iDiag read PCI config space */ -- debugfs_create_file("pciCfg", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_pciCfg); -- idiag.offset.last_rd = 0; -+ snprintf(name, sizeof(name), "pciCfg"); -+ if (!phba->idiag_pci_cfg) { -+ phba->idiag_pci_cfg = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_pciCfg); -+ idiag.offset.last_rd = 0; -+ } - - /* iDiag PCI BAR access */ -- debugfs_create_file("barAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_barAcc); -- idiag.offset.last_rd = 0; -+ snprintf(name, sizeof(name), "barAcc"); -+ if (!phba->idiag_bar_acc) { -+ phba->idiag_bar_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_barAcc); -+ idiag.offset.last_rd = 0; -+ } - - /* iDiag get PCI function queue information */ -- debugfs_create_file("queInfo", 0444, phba->idiag_root, phba, -- &lpfc_idiag_op_queInfo); -+ snprintf(name, sizeof(name), "queInfo"); -+ if (!phba->idiag_que_info) { -+ phba->idiag_que_info = -+ debugfs_create_file(name, S_IFREG|S_IRUGO, -+ phba->idiag_root, phba, &lpfc_idiag_op_queInfo); -+ } - - /* iDiag access PCI function queue */ -- debugfs_create_file("queAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_queAcc); -+ snprintf(name, sizeof(name), "queAcc"); -+ if (!phba->idiag_que_acc) { -+ phba->idiag_que_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_queAcc); -+ } - - /* iDiag access PCI function doorbell registers */ -- debugfs_create_file("drbAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_drbAcc); -+ snprintf(name, sizeof(name), "drbAcc"); -+ if (!phba->idiag_drb_acc) { -+ phba->idiag_drb_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_drbAcc); -+ } - - /* iDiag access PCI function control registers */ -- debugfs_create_file("ctlAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_ctlAcc); -+ snprintf(name, sizeof(name), "ctlAcc"); -+ if (!phba->idiag_ctl_acc) { -+ phba->idiag_ctl_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_ctlAcc); -+ } - - /* iDiag access mbox commands */ -- debugfs_create_file("mbxAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_mbxAcc); -+ snprintf(name, sizeof(name), "mbxAcc"); -+ if (!phba->idiag_mbx_acc) { -+ phba->idiag_mbx_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_mbxAcc); -+ } - - /* iDiag extents access commands */ - if (phba->sli4_hba.extents_in_use) { -- debugfs_create_file("extAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_extAcc); -+ snprintf(name, sizeof(name), "extAcc"); -+ if (!phba->idiag_ext_acc) { -+ phba->idiag_ext_acc = -+ debugfs_create_file(name, -+ S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, -+ &lpfc_idiag_op_extAcc); -+ } - } --out: -- /* alloc'ed items are kfree'd in lpfc_debugfs_terminate */ -+ -+debug_failed: - return; - #endif - } -@@ -6399,6 +6510,24 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - kfree(vport->disc_trc); - vport->disc_trc = NULL; - -+ debugfs_remove(vport->debug_disc_trc); /* discovery_trace */ -+ vport->debug_disc_trc = NULL; -+ -+ debugfs_remove(vport->debug_nodelist); /* nodelist */ -+ vport->debug_nodelist = NULL; -+ -+ debugfs_remove(vport->debug_nvmestat); /* nvmestat */ -+ vport->debug_nvmestat = NULL; -+ -+ debugfs_remove(vport->debug_scsistat); /* scsistat */ -+ vport->debug_scsistat = NULL; -+ -+ debugfs_remove(vport->debug_ioktime); /* ioktime */ -+ vport->debug_ioktime = NULL; -+ -+ debugfs_remove(vport->debug_hdwqstat); /* hdwqstat */ -+ vport->debug_hdwqstat = NULL; -+ - if (vport->vport_debugfs_root) { - debugfs_remove(vport->vport_debugfs_root); /* vportX */ - vport->vport_debugfs_root = NULL; -@@ -6406,12 +6535,113 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - } - - if (atomic_read(&phba->debugfs_vport_count) == 0) { -+ -+ debugfs_remove(phba->debug_multixri_pools); /* multixripools*/ -+ phba->debug_multixri_pools = NULL; -+ -+ debugfs_remove(phba->debug_hbqinfo); /* hbqinfo */ -+ phba->debug_hbqinfo = NULL; -+ -+ debugfs_remove(phba->debug_cgn_buffer); -+ phba->debug_cgn_buffer = NULL; -+ -+ debugfs_remove(phba->debug_rx_monitor); -+ phba->debug_rx_monitor = NULL; -+ -+ debugfs_remove(phba->debug_ras_log); -+ phba->debug_ras_log = NULL; -+ -+#ifdef LPFC_HDWQ_LOCK_STAT -+ debugfs_remove(phba->debug_lockstat); /* lockstat */ -+ phba->debug_lockstat = NULL; -+#endif -+ debugfs_remove(phba->debug_dumpHBASlim); /* HBASlim */ -+ phba->debug_dumpHBASlim = NULL; -+ -+ debugfs_remove(phba->debug_dumpHostSlim); /* HostSlim */ -+ phba->debug_dumpHostSlim = NULL; -+ -+ debugfs_remove(phba->debug_InjErrLBA); /* InjErrLBA */ -+ phba->debug_InjErrLBA = NULL; -+ -+ debugfs_remove(phba->debug_InjErrNPortID); -+ phba->debug_InjErrNPortID = NULL; -+ -+ debugfs_remove(phba->debug_InjErrWWPN); /* InjErrWWPN */ -+ phba->debug_InjErrWWPN = NULL; -+ -+ debugfs_remove(phba->debug_writeGuard); /* writeGuard */ -+ phba->debug_writeGuard = NULL; -+ -+ debugfs_remove(phba->debug_writeApp); /* writeApp */ -+ phba->debug_writeApp = NULL; -+ -+ debugfs_remove(phba->debug_writeRef); /* writeRef */ -+ phba->debug_writeRef = NULL; -+ -+ debugfs_remove(phba->debug_readGuard); /* readGuard */ -+ phba->debug_readGuard = NULL; -+ -+ debugfs_remove(phba->debug_readApp); /* readApp */ -+ phba->debug_readApp = NULL; -+ -+ debugfs_remove(phba->debug_readRef); /* readRef */ -+ phba->debug_readRef = NULL; -+ - kfree(phba->slow_ring_trc); - phba->slow_ring_trc = NULL; - -+ /* slow_ring_trace */ -+ debugfs_remove(phba->debug_slow_ring_trc); -+ phba->debug_slow_ring_trc = NULL; -+ -+ debugfs_remove(phba->debug_nvmeio_trc); -+ phba->debug_nvmeio_trc = NULL; -+ - kfree(phba->nvmeio_trc); - phba->nvmeio_trc = NULL; - -+ /* -+ * iDiag release -+ */ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ /* iDiag extAcc */ -+ debugfs_remove(phba->idiag_ext_acc); -+ phba->idiag_ext_acc = NULL; -+ -+ /* iDiag mbxAcc */ -+ debugfs_remove(phba->idiag_mbx_acc); -+ phba->idiag_mbx_acc = NULL; -+ -+ /* iDiag ctlAcc */ -+ debugfs_remove(phba->idiag_ctl_acc); -+ phba->idiag_ctl_acc = NULL; -+ -+ /* iDiag drbAcc */ -+ debugfs_remove(phba->idiag_drb_acc); -+ phba->idiag_drb_acc = NULL; -+ -+ /* iDiag queAcc */ -+ debugfs_remove(phba->idiag_que_acc); -+ phba->idiag_que_acc = NULL; -+ -+ /* iDiag queInfo */ -+ debugfs_remove(phba->idiag_que_info); -+ phba->idiag_que_info = NULL; -+ -+ /* iDiag barAcc */ -+ debugfs_remove(phba->idiag_bar_acc); -+ phba->idiag_bar_acc = NULL; -+ -+ /* iDiag pciCfg */ -+ debugfs_remove(phba->idiag_pci_cfg); -+ phba->idiag_pci_cfg = NULL; -+ -+ /* Finally remove the iDiag debugfs root */ -+ debugfs_remove(phba->idiag_root); -+ phba->idiag_root = NULL; -+ } -+ - if (phba->hba_debugfs_root) { - debugfs_remove(phba->hba_debugfs_root); /* fnX */ - phba->hba_debugfs_root = NULL; diff --git a/1180-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch b/1180-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch deleted file mode 100644 index 1f555abd4..000000000 --- a/1180-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch +++ /dev/null @@ -1,195 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" -# reverse of cs10 d19023a336a31f49111b96a266610a4d923f9cad - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 691314c68b59..7c4d7bb3a56f 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -2373,117 +2373,93 @@ lpfc_debugfs_dumpHostSlim_open(struct inode *inode, struct file *file) - - static ssize_t - lpfc_debugfs_dif_err_read(struct file *file, char __user *buf, -- size_t nbytes, loff_t *ppos) -+ size_t nbytes, loff_t *ppos) - { - struct lpfc_hba *phba = file->private_data; - int kind = debugfs_get_aux_num(file); -- char cbuf[32] = {0}; -+ char cbuf[32]; -+ uint64_t tmp = 0; - int cnt = 0; - -- switch (kind) { -- case writeGuard: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_wgrd_cnt); -- break; -- case writeApp: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_wapp_cnt); -- break; -- case writeRef: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_wref_cnt); -- break; -- case readGuard: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_rgrd_cnt); -- break; -- case readApp: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_rapp_cnt); -- break; -- case readRef: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_rref_cnt); -- break; -- case InjErrNPortID: -- cnt = scnprintf(cbuf, sizeof(cbuf), "0x%06x\n", -+ if (kind == writeGuard) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wgrd_cnt); -+ else if (kind == writeApp) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wapp_cnt); -+ else if (kind == writeRef) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wref_cnt); -+ else if (kind == readGuard) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rgrd_cnt); -+ else if (kind == readApp) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rapp_cnt); -+ else if (kind == readRef) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rref_cnt); -+ else if (kind == InjErrNPortID) -+ cnt = scnprintf(cbuf, 32, "0x%06x\n", - phba->lpfc_injerr_nportid); -- break; -- case InjErrWWPN: -- cnt = scnprintf(cbuf, sizeof(cbuf), "0x%016llx\n", -- be64_to_cpu(phba->lpfc_injerr_wwpn.u.wwn_be)); -- break; -- case InjErrLBA: -- if (phba->lpfc_injerr_lba == LPFC_INJERR_LBA_OFF) -- cnt = scnprintf(cbuf, sizeof(cbuf), "off\n"); -+ else if (kind == InjErrWWPN) { -+ memcpy(&tmp, &phba->lpfc_injerr_wwpn, sizeof(struct lpfc_name)); -+ tmp = cpu_to_be64(tmp); -+ cnt = scnprintf(cbuf, 32, "0x%016llx\n", tmp); -+ } else if (kind == InjErrLBA) { -+ if (phba->lpfc_injerr_lba == (sector_t)(-1)) -+ cnt = scnprintf(cbuf, 32, "off\n"); - else -- cnt = scnprintf(cbuf, sizeof(cbuf), "0x%llx\n", -- (uint64_t)phba->lpfc_injerr_lba); -- break; -- default: -- lpfc_log_msg(phba, KERN_WARNING, LOG_INIT, -- "0547 Unknown debugfs error injection entry\n"); -- break; -- } -+ cnt = scnprintf(cbuf, 32, "0x%llx\n", -+ (uint64_t) phba->lpfc_injerr_lba); -+ } else -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "0547 Unknown debugfs error injection entry\n"); - - return simple_read_from_buffer(buf, nbytes, ppos, &cbuf, cnt); - } - - static ssize_t - lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, -- size_t nbytes, loff_t *ppos) -+ size_t nbytes, loff_t *ppos) - { - struct lpfc_hba *phba = file->private_data; - int kind = debugfs_get_aux_num(file); -- char dstbuf[33] = {0}; -- unsigned long long tmp; -- unsigned long size; -+ char dstbuf[33]; -+ uint64_t tmp = 0; -+ int size; - -- size = (nbytes < (sizeof(dstbuf) - 1)) ? nbytes : (sizeof(dstbuf) - 1); -+ memset(dstbuf, 0, 33); -+ size = (nbytes < 32) ? nbytes : 32; - if (copy_from_user(dstbuf, buf, size)) - return -EFAULT; - -- if (kstrtoull(dstbuf, 0, &tmp)) { -- if (kind != InjErrLBA || !strstr(dstbuf, "off")) -- return -EINVAL; -+ if (kind == InjErrLBA) { -+ if ((dstbuf[0] == 'o') && (dstbuf[1] == 'f') && -+ (dstbuf[2] == 'f')) -+ tmp = (uint64_t)(-1); - } - -- switch (kind) { -- case writeGuard: -+ if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp))) -+ return -EINVAL; -+ -+ if (kind == writeGuard) - phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp; -- break; -- case writeApp: -+ else if (kind == writeApp) - phba->lpfc_injerr_wapp_cnt = (uint32_t)tmp; -- break; -- case writeRef: -+ else if (kind == writeRef) - phba->lpfc_injerr_wref_cnt = (uint32_t)tmp; -- break; -- case readGuard: -+ else if (kind == readGuard) - phba->lpfc_injerr_rgrd_cnt = (uint32_t)tmp; -- break; -- case readApp: -+ else if (kind == readApp) - phba->lpfc_injerr_rapp_cnt = (uint32_t)tmp; -- break; -- case readRef: -+ else if (kind == readRef) - phba->lpfc_injerr_rref_cnt = (uint32_t)tmp; -- break; -- case InjErrLBA: -- if (strstr(dstbuf, "off")) -- phba->lpfc_injerr_lba = LPFC_INJERR_LBA_OFF; -- else -- phba->lpfc_injerr_lba = (sector_t)tmp; -- break; -- case InjErrNPortID: -+ else if (kind == InjErrLBA) -+ phba->lpfc_injerr_lba = (sector_t)tmp; -+ else if (kind == InjErrNPortID) - phba->lpfc_injerr_nportid = (uint32_t)(tmp & Mask_DID); -- break; -- case InjErrWWPN: -- phba->lpfc_injerr_wwpn.u.wwn_be = cpu_to_be64(tmp); -- break; -- default: -- lpfc_log_msg(phba, KERN_WARNING, LOG_INIT, -- "0548 Unknown debugfs error injection entry\n"); -- break; -- } -+ else if (kind == InjErrWWPN) { -+ tmp = cpu_to_be64(tmp); -+ memcpy(&phba->lpfc_injerr_wwpn, &tmp, sizeof(struct lpfc_name)); -+ } else -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "0548 Unknown debugfs error injection entry\n"); -+ - return nbytes; - } - -diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h -index b287d39ad033..32298285ea5e 100644 ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -366,7 +366,6 @@ struct lpfc_name { - } s; - uint8_t wwn[8]; - uint64_t name __packed __aligned(4); -- __be64 wwn_be __packed __aligned(4); - } u; - }; - diff --git a/1181-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch b/1181-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch deleted file mode 100644 index 6b311410b..000000000 --- a/1181-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch +++ /dev/null @@ -1,15 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" -# reverse of cs10 1b923bbb0077b6f1679b13b26a46342034b0c794 - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 7c4d7bb3a56f..2db8d9529b8f 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -6280,6 +6280,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - } - phba->nvmeio_trc_on = 1; - phba->nvmeio_trc_output_idx = 0; -+ phba->nvmeio_trc = NULL; - } else { - nvmeio_off: - phba->nvmeio_trc_size = 0; diff --git a/1182-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch b/1182-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch deleted file mode 100644 index b91b60125..000000000 --- a/1182-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch +++ /dev/null @@ -1,17 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" -# reverse of cs10 60dc76d9e94b45301a874cede2364bf4d7a4c16e - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h -index 566dd84e0677..f319f3af0400 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.h -+++ b/drivers/scsi/lpfc/lpfc_debugfs.h -@@ -44,9 +44,6 @@ - /* hbqinfo output buffer size */ - #define LPFC_HBQINFO_SIZE 8192 - --/* hdwqinfo output buffer size */ --#define LPFC_HDWQINFO_SIZE 8192 -- - /* nvmestat output buffer size */ - #define LPFC_NVMESTAT_SIZE 8192 - #define LPFC_IOKTIME_SIZE 8192 diff --git a/1183-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch b/1183-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch deleted file mode 100644 index 3b2fe4178..000000000 --- a/1183-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch +++ /dev/null @@ -1,75 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" -# reverse of cs10 6dcd096ed524a8b9dcc82b80bfcebca892be8ea2 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 9a20a08f4bd9..941027b329a2 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -5338,12 +5338,12 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - ulp_status, ulp_word4, did); - /* ELS response tag completes */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "0110 ELS response tag x%x completes fc_flag x%lx" -+ "0110 ELS response tag x%x completes " - "Data: x%x x%x x%x x%x x%lx x%x x%x x%x %p %p\n", -- iotag, vport->fc_flag, ulp_status, ulp_word4, tmo, -+ iotag, ulp_status, ulp_word4, tmo, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi, kref_read(&ndlp->kref), mbox, ndlp); -- if (mbox && !test_bit(FC_PT2PT, &vport->fc_flag)) { -+ if (mbox) { - if (ulp_status == 0 && - test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) { - if (!lpfc_unreg_rpi(vport, ndlp) && -@@ -5402,10 +5402,6 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - } - out_free_mbox: - lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED); -- } else if (mbox && test_bit(FC_PT2PT, &vport->fc_flag) && -- test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) { -- lpfc_mbx_cmpl_reg_login(phba, mbox); -- clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag); - } - out: - if (ndlp && shost) { -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 1e331b76dff4..5aa21c683ac6 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -326,14 +326,8 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox) - /* Now that REG_RPI completed successfully, - * we can now proceed with sending the PLOGI ACC. - */ -- if (test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) { -- rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI, -- save_iocb, ndlp, login_mbox); -- } else { -- rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI, -- save_iocb, ndlp, NULL); -- } -- -+ rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI, -+ save_iocb, ndlp, NULL); - if (rc) { - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "4576 PLOGI ACC fails pt2pt discovery: " -@@ -341,16 +335,9 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox) - } - } - -- /* If this is a fabric topology, complete the reg_rpi and prli now. -- * For Pt2Pt, the reg_rpi and PRLI are deferred until after the LS_ACC -- * completes. This ensures, in Pt2Pt, that the PLOGI LS_ACC is sent -- * before the PRLI. -- */ -- if (!test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) { -- /* Now process the REG_RPI cmpl */ -- lpfc_mbx_cmpl_reg_login(phba, login_mbox); -- clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag); -- } -+ /* Now process the REG_RPI cmpl */ -+ lpfc_mbx_cmpl_reg_login(phba, login_mbox); -+ clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag); - kfree(save_iocb); - } - diff --git a/1184-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch b/1184-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch deleted file mode 100644 index b25115019..000000000 --- a/1184-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch +++ /dev/null @@ -1,42 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" -# reverse of cs10 df9467ebb13f73db4517d73b5445c0ea4233ab36 - -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index be709f12c6a1..a9c8c6c021b9 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -5936,7 +5936,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport) - /** - * lpfc_reset_flush_io_context - - * @vport: The virtual port (scsi_host) for the flush context -- * @tgt_id: If aborting by Target context - specifies the target id -+ * @tgt_id: If aborting by Target contect - specifies the target id - * @lun_id: If aborting by Lun context - specifies the lun id - * @context: specifies the context level to flush at. - * -@@ -6110,14 +6110,8 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd) - pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; - spin_unlock_irqrestore(&pnode->lock, flags); - } -- status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id, -- LPFC_CTX_TGT); -- if (status != SUCCESS) { -- lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP, -- "0726 Target Reset flush status x%x\n", -- status); -- return status; -- } -+ lpfc_reset_flush_io_context(vport, tgt_id, lun_id, -+ LPFC_CTX_TGT); - return FAST_IO_FAIL; - } - -@@ -6210,7 +6204,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd) - int rc, ret = SUCCESS; - - lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP, -- "3172 SCSI layer issued Host Reset\n"); -+ "3172 SCSI layer issued Host Reset Data:\n"); - - lpfc_offline_prep(phba, LPFC_MBX_WAIT); - lpfc_offline(phba); diff --git a/1185-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch b/1185-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch deleted file mode 100644 index 40f51c3cd..000000000 --- a/1185-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch +++ /dev/null @@ -1,19 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" -# reverse of cs10 14172e24e848ad269867eae4464dd5704c041c92 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 941027b329a2..17390e5075cb 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -11259,11 +11259,6 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, - "0126 FDISC cmpl status: x%x/x%x)\n", - ulp_status, ulp_word4); -- -- /* drop initial reference */ -- if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -- lpfc_nlp_put(ndlp); -- - goto fdisc_failed; - } - diff --git a/1186-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch b/1186-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch deleted file mode 100644 index a41fdc582..000000000 --- a/1186-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch +++ /dev/null @@ -1,38 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" -# reverse of cs10 1073b98315bf10385a9bfdb2859415d38f641dc2 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 17390e5075cb..71e76e681621 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -12007,11 +12007,7 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba, - sglq_entry->state = SGL_FREED; - spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock, - iflag); -- lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI | -- LOG_DISCOVERY | LOG_NODE, -- "0732 ELS XRI ABORT on Node: ndlp=x%px " -- "xri=x%x\n", -- ndlp, xri); -+ - if (ndlp) { - lpfc_set_rrq_active(phba, ndlp, - sglq_entry->sli4_lxritag, -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index fd4317b9484c..0555b85ba9e7 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -3057,6 +3057,13 @@ lpfc_cleanup(struct lpfc_vport *vport) - lpfc_vmid_vport_cleanup(vport); - - list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) { -+ if (vport->port_type != LPFC_PHYSICAL_PORT && -+ ndlp->nlp_DID == Fabric_DID) { -+ /* Just free up ndlp with Fabric_DID for vports */ -+ lpfc_nlp_put(ndlp); -+ continue; -+ } -+ - if (ndlp->nlp_DID == Fabric_Cntl_DID && - ndlp->nlp_state == NLP_STE_UNUSED_NODE) { - lpfc_nlp_put(ndlp); diff --git a/1187-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch b/1187-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch deleted file mode 100644 index f786438f8..000000000 --- a/1187-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch +++ /dev/null @@ -1,24 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" -# reverse of cs10 82a9e6041f61db2763bfbec1e19b17ff5ea1cc8b - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 08d16552c4b7..4ab7edf53103 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -8813,7 +8813,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) - if (unlikely(rc)) { - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "0381 Error %d during queue setup.\n", rc); -- goto out_destroy_queue; -+ goto out_stop_timers; - } - /* Initialize the driver internal SLI layer lists. */ - lpfc_sli4_setup(phba); -@@ -9096,6 +9096,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) - lpfc_free_iocb_list(phba); - out_destroy_queue: - lpfc_sli4_queue_destroy(phba); -+out_stop_timers: - lpfc_stop_hba_timers(phba); - out_free_mbox: - mempool_free(mboxq, phba->mbox_mem_pool); diff --git a/1188-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch b/1188-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch deleted file mode 100644 index 09e2a778b..000000000 --- a/1188-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch +++ /dev/null @@ -1,31 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" -# reverse of cs10 9009d1c6b30ca0c790618ddfa962012b89a46f01 - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 4ab7edf53103..e1fdce8d6bfd 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -12436,11 +12436,19 @@ lpfc_sli_issue_abort_iotag(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - } - - /* -- * Always abort the outstanding WQE and set the IA bit correctly -- * for the context. This is necessary for correctly removing -- * outstanding ndlp reference counts when the CQE completes with -- * the XB bit set. -+ * If we're unloading, don't abort iocb on the ELS ring, but change -+ * the callback so that nothing happens when it finishes. - */ -+ if (test_bit(FC_UNLOADING, &vport->load_flag) && -+ pring->ringno == LPFC_ELS_RING) { -+ if (cmdiocb->cmd_flag & LPFC_IO_FABRIC) -+ cmdiocb->fabric_cmd_cmpl = lpfc_ignore_els_cmpl; -+ else -+ cmdiocb->cmd_cmpl = lpfc_ignore_els_cmpl; -+ return retval; -+ } -+ -+ /* issue ABTS for this IOCB based on iotag */ - abtsiocbp = __lpfc_sli_get_iocbq(phba); - if (abtsiocbp == NULL) - return IOCB_NORESOURCE; diff --git a/1189-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch b/1189-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch deleted file mode 100644 index c3e9c507b..000000000 --- a/1189-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch +++ /dev/null @@ -1,58 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" -# reverse of cs10 65bf58f972704e641faa9302b8ba54512707b9f0 - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 9389e3def94e..e5a9c5a323f8 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -662,12 +662,15 @@ struct lpfc_vport { - uint32_t num_disc_nodes; /* in addition to hba_state */ - uint32_t gidft_inp; /* cnt of outstanding GID_FTs */ - -+ uint32_t fc_nlp_cnt; /* outstanding NODELIST requests */ - uint32_t fc_rscn_id_cnt; /* count of RSCNs payloads in list */ - uint32_t fc_rscn_flush; /* flag use of fc_rscn_id_list */ - struct lpfc_dmabuf *fc_rscn_id_list[FC_MAX_HOLD_RSCN]; - struct lpfc_name fc_nodename; /* fc nodename */ - struct lpfc_name fc_portname; /* fc portname */ - -+ struct lpfc_work_evt disc_timeout_evt; -+ - struct timer_list fc_disctmo; /* Discovery rescue timer */ - uint8_t fc_ns_retry; /* retries for fabric nameserver */ - uint32_t fc_prli_sent; /* cntr for outstanding PRLIs */ -@@ -765,6 +768,7 @@ struct lpfc_vport { - /* There is a single nvme instance per vport. */ - struct nvme_fc_local_port *localport; - uint8_t nvmei_support; /* driver supports NVME Initiator */ -+ uint32_t last_fcp_wqidx; - uint32_t rcv_flogi_cnt; /* How many unsol FLOGIs ACK'd. */ - }; - -@@ -1057,6 +1061,8 @@ struct lpfc_hba { - - struct lpfc_dmabuf hbqslimp; - -+ uint16_t pci_cfg_value; -+ - uint8_t fc_linkspeed; /* Link speed after last READ_LA */ - - uint32_t fc_eventTag; /* event tag for link attention */ -@@ -1083,6 +1089,7 @@ struct lpfc_hba { - - struct lpfc_stats fc_stat; - -+ struct lpfc_nodelist fc_fcpnodev; /* nodelist entry for no device */ - uint32_t nport_event_cnt; /* timestamp for nlplist entry */ - - uint8_t wwnn[8]; -@@ -1223,6 +1230,9 @@ struct lpfc_hba { - uint32_t hbq_count; /* Count of configured HBQs */ - struct hbq_s hbqs[LPFC_MAX_HBQS]; /* local copy of hbq indicies */ - -+ atomic_t fcp_qidx; /* next FCP WQ (RR Policy) */ -+ atomic_t nvme_qidx; /* next NVME WQ (RR Policy) */ -+ - phys_addr_t pci_bar0_map; /* Physical address for PCI BAR0 */ - phys_addr_t pci_bar1_map; /* Physical address for PCI BAR1 */ - phys_addr_t pci_bar2_map; /* Physical address for PCI BAR2 */ diff --git a/1190-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch b/1190-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch deleted file mode 100644 index 2b1a65fe1..000000000 --- a/1190-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch +++ /dev/null @@ -1,16 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Use int type to store negative error codes" -# reverse of cs10 1aeb9b98c42dfb8a653f27359979d2e769a0e492 - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index e1fdce8d6bfd..585c80944832 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -21372,7 +21372,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phba, struct lpfc_sli4_hdw_queue *qp, - struct lpfc_sglq *sglq; - struct lpfc_sli_ring *pring; - unsigned long iflags; -- int ret = 0; -+ uint32_t ret = 0; - - /* NVME_LS and NVME_LS ABTS requests. */ - if (pwqe->cmd_flag & LPFC_IO_NVME_LS) { diff --git a/1191-revert-scsi-lpfc-use-min-to-improve-code.patch b/1191-revert-scsi-lpfc-use-min-to-improve-code.patch deleted file mode 100644 index 720b2faf8..000000000 --- a/1191-revert-scsi-lpfc-use-min-to-improve-code.patch +++ /dev/null @@ -1,38 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: use min() to improve code" -# reverse of cs10 e891063a53bdd334d714e6769e385508722ceef6 - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 0555b85ba9e7..29503ceb8e7a 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -8300,7 +8300,10 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) - phba->cfg_total_seg_cnt, phba->cfg_scsi_seg_cnt, - phba->cfg_nvme_seg_cnt); - -- i = min(phba->cfg_sg_dma_buf_size, SLI4_PAGE_SIZE); -+ if (phba->cfg_sg_dma_buf_size < SLI4_PAGE_SIZE) -+ i = phba->cfg_sg_dma_buf_size; -+ else -+ i = SLI4_PAGE_SIZE; - - phba->lpfc_sg_dma_buf_pool = - dma_pool_create("lpfc_sg_dma_buf_pool", -diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c -index 2dd148fd3ea1..1d7488b9e7b9 100644 ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -1234,8 +1234,12 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport, - if ((phba->cfg_nvme_enable_fb) && - test_bit(NLP_FIRSTBURST, &pnode->nlp_flag)) { - req_len = lpfc_ncmd->nvmeCmd->payload_length; -- wqe->fcp_iwrite.initial_xfer_len = min(req_len, -- pnode->nvme_fb_size); -+ if (req_len < pnode->nvme_fb_size) -+ wqe->fcp_iwrite.initial_xfer_len = -+ req_len; -+ else -+ wqe->fcp_iwrite.initial_xfer_len = -+ pnode->nvme_fb_size; - } else { - wqe->fcp_iwrite.initial_xfer_len = 0; - } diff --git a/1192-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch b/1192-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch deleted file mode 100644 index 382f56188..000000000 --- a/1192-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch +++ /dev/null @@ -1,16 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Fix wrong function reference in a comment" -# reverse of cs10 7feab3ea585404dd34641c698930e7fc6bb8043a - -diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c -index 8653839ee728..3d70cc517573 100644 ---- a/drivers/scsi/lpfc/lpfc_vport.c -+++ b/drivers/scsi/lpfc/lpfc_vport.c -@@ -666,7 +666,7 @@ lpfc_vport_delete(struct fc_vport *fc_vport) - * Take early refcount for outstanding I/O requests we schedule during - * delete processing for unreg_vpi. Always keep this before - * scsi_remove_host() as we can no longer obtain a reference through -- * scsi_host_get() after scsi_remove_host as shost is set to SHOST_DEL. -+ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL. - */ - if (!scsi_host_get(shost)) - return VPORT_INVAL; diff --git a/1193-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch b/1193-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch deleted file mode 100644 index 0c302d2f9..000000000 --- a/1193-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch +++ /dev/null @@ -1,203 +0,0 @@ -Subject: [PATCH] Revert "lpfc: don't use file->f_path.dentry for comparisons" -# reverse of cs10 ba0a8d52eb98a4f44818f9abf664eeeeb8558255 - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 2db8d9529b8f..2c7d876c64c7 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -2375,32 +2375,32 @@ static ssize_t - lpfc_debugfs_dif_err_read(struct file *file, char __user *buf, - size_t nbytes, loff_t *ppos) - { -+ struct dentry *dent = file->f_path.dentry; - struct lpfc_hba *phba = file->private_data; -- int kind = debugfs_get_aux_num(file); - char cbuf[32]; - uint64_t tmp = 0; - int cnt = 0; - -- if (kind == writeGuard) -+ if (dent == phba->debug_writeGuard) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wgrd_cnt); -- else if (kind == writeApp) -+ else if (dent == phba->debug_writeApp) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wapp_cnt); -- else if (kind == writeRef) -+ else if (dent == phba->debug_writeRef) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wref_cnt); -- else if (kind == readGuard) -+ else if (dent == phba->debug_readGuard) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rgrd_cnt); -- else if (kind == readApp) -+ else if (dent == phba->debug_readApp) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rapp_cnt); -- else if (kind == readRef) -+ else if (dent == phba->debug_readRef) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rref_cnt); -- else if (kind == InjErrNPortID) -+ else if (dent == phba->debug_InjErrNPortID) - cnt = scnprintf(cbuf, 32, "0x%06x\n", - phba->lpfc_injerr_nportid); -- else if (kind == InjErrWWPN) { -+ else if (dent == phba->debug_InjErrWWPN) { - memcpy(&tmp, &phba->lpfc_injerr_wwpn, sizeof(struct lpfc_name)); - tmp = cpu_to_be64(tmp); - cnt = scnprintf(cbuf, 32, "0x%016llx\n", tmp); -- } else if (kind == InjErrLBA) { -+ } else if (dent == phba->debug_InjErrLBA) { - if (phba->lpfc_injerr_lba == (sector_t)(-1)) - cnt = scnprintf(cbuf, 32, "off\n"); - else -@@ -2417,8 +2417,8 @@ static ssize_t - lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - size_t nbytes, loff_t *ppos) - { -+ struct dentry *dent = file->f_path.dentry; - struct lpfc_hba *phba = file->private_data; -- int kind = debugfs_get_aux_num(file); - char dstbuf[33]; - uint64_t tmp = 0; - int size; -@@ -2428,7 +2428,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - if (copy_from_user(dstbuf, buf, size)) - return -EFAULT; - -- if (kind == InjErrLBA) { -+ if (dent == phba->debug_InjErrLBA) { - if ((dstbuf[0] == 'o') && (dstbuf[1] == 'f') && - (dstbuf[2] == 'f')) - tmp = (uint64_t)(-1); -@@ -2437,23 +2437,23 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp))) - return -EINVAL; - -- if (kind == writeGuard) -+ if (dent == phba->debug_writeGuard) - phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp; -- else if (kind == writeApp) -+ else if (dent == phba->debug_writeApp) - phba->lpfc_injerr_wapp_cnt = (uint32_t)tmp; -- else if (kind == writeRef) -+ else if (dent == phba->debug_writeRef) - phba->lpfc_injerr_wref_cnt = (uint32_t)tmp; -- else if (kind == readGuard) -+ else if (dent == phba->debug_readGuard) - phba->lpfc_injerr_rgrd_cnt = (uint32_t)tmp; -- else if (kind == readApp) -+ else if (dent == phba->debug_readApp) - phba->lpfc_injerr_rapp_cnt = (uint32_t)tmp; -- else if (kind == readRef) -+ else if (dent == phba->debug_readRef) - phba->lpfc_injerr_rref_cnt = (uint32_t)tmp; -- else if (kind == InjErrLBA) -+ else if (dent == phba->debug_InjErrLBA) - phba->lpfc_injerr_lba = (sector_t)tmp; -- else if (kind == InjErrNPortID) -+ else if (dent == phba->debug_InjErrNPortID) - phba->lpfc_injerr_nportid = (uint32_t)(tmp & Mask_DID); -- else if (kind == InjErrWWPN) { -+ else if (dent == phba->debug_InjErrWWPN) { - tmp = cpu_to_be64(tmp); - memcpy(&phba->lpfc_injerr_wwpn, &tmp, sizeof(struct lpfc_name)); - } else -@@ -6160,51 +6160,60 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - phba->debug_dumpHostSlim = NULL; - - /* Setup DIF Error Injections */ -+ snprintf(name, sizeof(name), "InjErrLBA"); - phba->debug_InjErrLBA = -- debugfs_create_file_aux_num("InjErrLBA", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, InjErrLBA, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - phba->lpfc_injerr_lba = LPFC_INJERR_LBA_OFF; - -+ snprintf(name, sizeof(name), "InjErrNPortID"); - phba->debug_InjErrNPortID = -- debugfs_create_file_aux_num("InjErrNPortID", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, InjErrNPortID, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "InjErrWWPN"); - phba->debug_InjErrWWPN = -- debugfs_create_file_aux_num("InjErrWWPN", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, InjErrWWPN, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "writeGuardInjErr"); - phba->debug_writeGuard = -- debugfs_create_file_aux_num("writeGuardInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, writeGuard, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "writeAppInjErr"); - phba->debug_writeApp = -- debugfs_create_file_aux_num("writeAppInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, writeApp, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "writeRefInjErr"); - phba->debug_writeRef = -- debugfs_create_file_aux_num("writeRefInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, writeRef, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "readGuardInjErr"); - phba->debug_readGuard = -- debugfs_create_file_aux_num("readGuardInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, readGuard, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "readAppInjErr"); - phba->debug_readApp = -- debugfs_create_file_aux_num("readAppInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, readApp, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "readRefInjErr"); - phba->debug_readRef = -- debugfs_create_file_aux_num("readRefInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, readRef, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - - /* Setup slow ring trace */ - if (lpfc_debugfs_max_slow_ring_trc) { -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h -index f319f3af0400..8d2e8d05bbc0 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.h -+++ b/drivers/scsi/lpfc/lpfc_debugfs.h -@@ -322,17 +322,6 @@ enum { - * discovery */ - #endif /* H_LPFC_DEBUG_FS */ - --enum { -- writeGuard = 1, -- writeApp, -- writeRef, -- readGuard, -- readApp, -- readRef, -- InjErrLBA, -- InjErrNPortID, -- InjErrWWPN, --}; - - /* - * Driver debug utility routines outside of debugfs. The debug utility diff --git a/1194-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch b/1194-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch deleted file mode 100644 index bdb9a7b33..000000000 --- a/1194-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch +++ /dev/null @@ -1,68 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" -# reverse of cs10 b681f59c801919396f35f2e33060d37b0732f1d1 - -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index cc8af576f57c..daba94529b45 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 2c7d876c64c7..061a5e4e525d 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2007-2015 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h -index bc709786e6af..dd9f170fbdc8 100644 ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2009-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index a9c8c6c021b9..71188060dc08 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h -index fd6dab157887..e42b44fcc7f6 100644 ---- a/drivers/scsi/lpfc/lpfc_sli4.h -+++ b/drivers/scsi/lpfc/lpfc_sli4.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2009-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * diff --git a/1195-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch b/1195-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch deleted file mode 100644 index 8d87c29db..000000000 --- a/1195-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch +++ /dev/null @@ -1,16 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" -# reverse of cs10 25abc74ff90b76294454ae9d19b06b1cbc489a4b - -diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h -index 9ee3a3a4ec4d..749688aa8a82 100644 ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.4.0.10" -+#define LPFC_DRIVER_VERSION "14.4.0.9" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ diff --git a/1196-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch b/1196-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch deleted file mode 100644 index 53b6b5574..000000000 --- a/1196-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch +++ /dev/null @@ -1,138 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" -# reverse of cs10 5e442a469bde8240d35a7242dd888dc9dab5b9a7 - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 29503ceb8e7a..0876fcf07b5a 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -2627,33 +2627,27 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_BMID: -- m = (typeof(m)){"LP1150", "PCI-X2", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LP1150", "PCI-X2", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_BSMB: - m = (typeof(m)){"LP111", "PCI-X2", - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZEPHYR: -- m = (typeof(m)){"LPe11000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe11000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZEPHYR_SCSP: -- m = (typeof(m)){"LPe11000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe11000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZEPHYR_DCSP: -- m = (typeof(m)){"LP2105", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"LP2105", "PCIe", "FCoE Adapter"}; - GE = 1; - break; - case PCI_DEVICE_ID_ZMID: -- m = (typeof(m)){"LPe1150", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe1150", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZSMB: -- m = (typeof(m)){"LPe111", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe111", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_LP101: - m = (typeof(m)){"LP101", "PCI-X", -@@ -2672,28 +2666,22 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT: -- m = (typeof(m)){"LPe12000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_MID: -- m = (typeof(m)){"LPe1250", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe1250", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_SMB: -- m = (typeof(m)){"LPe121", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe121", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_DCSP: -- m = (typeof(m)){"LPe12002-SP", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12002-SP", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_SCSP: -- m = (typeof(m)){"LPe12000-SP", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12000-SP", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_S: -- m = (typeof(m)){"LPe12000-S", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12000-S", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_PROTEUS_VF: - m = (typeof(m)){"LPev12000", "PCIe IOV", -@@ -2709,25 +2697,22 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - break; - case PCI_DEVICE_ID_TIGERSHARK: - oneConnect = 1; -- m = (typeof(m)){"OCe10100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe10100", "PCIe", "FCoE"}; - break; - case PCI_DEVICE_ID_TOMCAT: - oneConnect = 1; -- m = (typeof(m)){"OCe11100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe11100", "PCIe", "FCoE"}; - break; - case PCI_DEVICE_ID_FALCON: - m = (typeof(m)){"LPSe12002-ML1-E", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ "EmulexSecure Fibre"}; - break; - case PCI_DEVICE_ID_BALIUS: - m = (typeof(m)){"LPVe12002", "PCIe Shared I/O", - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_LANCER_FC: -- m = (typeof(m)){"LPe16000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe16000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_LANCER_FC_VF: - m = (typeof(m)){"LPe16000", "PCIe", -@@ -2735,13 +2720,12 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - break; - case PCI_DEVICE_ID_LANCER_FCOE: - oneConnect = 1; -- m = (typeof(m)){"OCe15100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe15100", "PCIe", "FCoE"}; - break; - case PCI_DEVICE_ID_LANCER_FCOE_VF: - oneConnect = 1; - m = (typeof(m)){"OCe15100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ "Obsolete, Unsupported FCoE"}; - break; - case PCI_DEVICE_ID_LANCER_G6_FC: - m = (typeof(m)){"LPe32000", "PCIe", "Fibre Channel Adapter"}; -@@ -2755,8 +2739,7 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - case PCI_DEVICE_ID_SKYHAWK: - case PCI_DEVICE_ID_SKYHAWK_VF: - oneConnect = 1; -- m = (typeof(m)){"OCe14000", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe14000", "PCIe", "FCoE"}; - break; - default: - m = (typeof(m)){"Unknown", "", ""}; diff --git a/1197-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch b/1197-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch deleted file mode 100644 index 782b4bf3d..000000000 --- a/1197-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch +++ /dev/null @@ -1,102 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" -# reverse of cs10 ee3715dad64c5b70516cac33ed1c31e66dfb1ebd - -diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h -index dd9f170fbdc8..2dedb273b091 100644 ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -1328,9 +1328,6 @@ struct cq_context { - #define LPFC_CQ_CNT_512 0x1 - #define LPFC_CQ_CNT_1024 0x2 - #define LPFC_CQ_CNT_WORD7 0x3 --#define lpfc_cq_context_cqe_sz_SHIFT 25 --#define lpfc_cq_context_cqe_sz_MASK 0x00000003 --#define lpfc_cq_context_cqe_sz_WORD word0 - #define lpfc_cq_context_autovalid_SHIFT 15 - #define lpfc_cq_context_autovalid_MASK 0x00000001 - #define lpfc_cq_context_autovalid_WORD word0 -@@ -1386,9 +1383,9 @@ struct lpfc_mbx_cq_create_set { - #define lpfc_mbx_cq_create_set_valid_SHIFT 29 - #define lpfc_mbx_cq_create_set_valid_MASK 0x00000001 - #define lpfc_mbx_cq_create_set_valid_WORD word1 --#define lpfc_mbx_cq_create_set_cqecnt_SHIFT 27 --#define lpfc_mbx_cq_create_set_cqecnt_MASK 0x00000003 --#define lpfc_mbx_cq_create_set_cqecnt_WORD word1 -+#define lpfc_mbx_cq_create_set_cqe_cnt_SHIFT 27 -+#define lpfc_mbx_cq_create_set_cqe_cnt_MASK 0x00000003 -+#define lpfc_mbx_cq_create_set_cqe_cnt_WORD word1 - #define lpfc_mbx_cq_create_set_cqe_size_SHIFT 25 - #define lpfc_mbx_cq_create_set_cqe_size_MASK 0x00000003 - #define lpfc_mbx_cq_create_set_cqe_size_WORD word1 -@@ -1401,16 +1398,13 @@ struct lpfc_mbx_cq_create_set { - #define lpfc_mbx_cq_create_set_clswm_SHIFT 12 - #define lpfc_mbx_cq_create_set_clswm_MASK 0x00000003 - #define lpfc_mbx_cq_create_set_clswm_WORD word1 --#define lpfc_mbx_cq_create_set_cqe_cnt_hi_SHIFT 0 --#define lpfc_mbx_cq_create_set_cqe_cnt_hi_MASK 0x0000001F --#define lpfc_mbx_cq_create_set_cqe_cnt_hi_WORD word1 - uint32_t word2; - #define lpfc_mbx_cq_create_set_arm_SHIFT 31 - #define lpfc_mbx_cq_create_set_arm_MASK 0x00000001 - #define lpfc_mbx_cq_create_set_arm_WORD word2 --#define lpfc_mbx_cq_create_set_cqe_cnt_lo_SHIFT 16 --#define lpfc_mbx_cq_create_set_cqe_cnt_lo_MASK 0x00007FFF --#define lpfc_mbx_cq_create_set_cqe_cnt_lo_WORD word2 -+#define lpfc_mbx_cq_create_set_cq_cnt_SHIFT 16 -+#define lpfc_mbx_cq_create_set_cq_cnt_MASK 0x00007FFF -+#define lpfc_mbx_cq_create_set_cq_cnt_WORD word2 - #define lpfc_mbx_cq_create_set_num_cq_SHIFT 0 - #define lpfc_mbx_cq_create_set_num_cq_MASK 0x0000FFFF - #define lpfc_mbx_cq_create_set_num_cq_WORD word2 -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 585c80944832..a96e6489594c 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -16476,10 +16476,10 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp, - case 4096: - if (phba->sli4_hba.pc_sli4_params.cqv == - LPFC_Q_CREATE_VERSION_2) { -- bf_set(lpfc_mbx_cq_create_set_cqe_cnt_lo, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, -- cq->entry_count); -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ cq->entry_count); -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, - LPFC_CQ_CNT_WORD7); - break; -@@ -16495,15 +16495,15 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp, - } - fallthrough; /* otherwise default to smallest */ - case 256: -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, LPFC_CQ_CNT_256); - break; - case 512: -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, LPFC_CQ_CNT_512); - break; - case 1024: -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, LPFC_CQ_CNT_1024); - break; - } -diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h -index e42b44fcc7f6..9be3da91c923 100644 ---- a/drivers/scsi/lpfc/lpfc_sli4.h -+++ b/drivers/scsi/lpfc/lpfc_sli4.h -@@ -575,10 +575,8 @@ struct lpfc_pc_sli4_params { - - #define LPFC_CQ_4K_PAGE_SZ 0x1 - #define LPFC_CQ_16K_PAGE_SZ 0x4 --#define LPFC_CQ_32K_PAGE_SZ 0x8 - #define LPFC_WQ_4K_PAGE_SZ 0x1 - #define LPFC_WQ_16K_PAGE_SZ 0x4 --#define LPFC_WQ_32K_PAGE_SZ 0x8 - - struct lpfc_iov { - uint32_t pf_number; diff --git a/1198-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch b/1198-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch deleted file mode 100644 index d050825be..000000000 --- a/1198-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch +++ /dev/null @@ -1,37 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" -# reverse of cs10 034b060b9f17847aeb3475fb2c579a6c87d87667 - -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 71188060dc08..0afc5fe013bc 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -536,8 +536,7 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba *phba, - psb = container_of(iocbq, struct lpfc_io_buf, cur_iocbq); - psb->flags &= ~LPFC_SBUF_XBUSY; - spin_unlock_irqrestore(&phba->hbalock, iflag); -- if (test_bit(HBA_SETUP, &phba->hba_flag) && -- !list_empty(&pring->txq)) -+ if (!list_empty(&pring->txq)) - lpfc_worker_wake_up(phba); - return; - } -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index a96e6489594c..b9a5d377f336 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -5160,6 +5160,7 @@ lpfc_sli4_brdreset(struct lpfc_hba *phba) - phba->link_events = 0; - phba->pport->fc_myDID = 0; - phba->pport->fc_prevDID = 0; -+ clear_bit(HBA_SETUP, &phba->hba_flag); - - spin_lock_irq(&phba->hbalock); - psli->sli_flag &= ~(LPFC_PROCESS_LA); -@@ -5276,7 +5277,6 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba) - "0296 Restart HBA Data: x%x x%x\n", - phba->pport->port_state, psli->sli_flag); - -- clear_bit(HBA_SETUP, &phba->hba_flag); - lpfc_sli4_queue_unset(phba); - - rc = lpfc_sli4_brdreset(phba); diff --git a/1199-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch b/1199-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch deleted file mode 100644 index 97147d0e8..000000000 --- a/1199-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch +++ /dev/null @@ -1,17 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" -# reverse of cs10 68ce87a35f24f9dbfee4c60bc0bcdb3f88734db5 - -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 1510ed28f5a4..d8a0915d1df0 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -183,8 +183,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport) - - /* Don't schedule a worker thread event if the vport is going down. */ - if (test_bit(FC_UNLOADING, &vport->load_flag) || -- (phba->sli_rev == LPFC_SLI_REV4 && -- !test_bit(HBA_SETUP, &phba->hba_flag))) { -+ !test_bit(HBA_SETUP, &phba->hba_flag)) { - - spin_lock_irqsave(&ndlp->lock, iflags); - ndlp->rport = NULL; diff --git a/1200-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch b/1200-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch deleted file mode 100644 index d5ae0f72c..000000000 --- a/1200-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch +++ /dev/null @@ -1,45 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" -# reverse of cs10 f13e1a401181a22b42c52a1c5ef3271a239606e6 - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 71e76e681621..3cbacc923fbd 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -8376,9 +8376,9 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - clear_bit(FC_PUBLIC_LOOP, &vport->fc_flag); - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "3311 Rcv Flogi PS x%x new PS x%x " -- "fc_flag x%lx new fc_flag x%lx, hba_flag x%lx\n", -+ "fc_flag x%lx new fc_flag x%lx\n", - port_state, vport->port_state, -- fc_flag, vport->fc_flag, phba->hba_flag); -+ fc_flag, vport->fc_flag); - - /* - * We temporarily set fc_myDID to make it look like we are -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index d8a0915d1df0..aff0740a5510 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -1266,10 +1266,6 @@ lpfc_linkdown(struct lpfc_hba *phba) - } - phba->defer_flogi_acc.flag = false; - -- /* reinitialize initial HBA flag */ -- clear_bit(HBA_FLOGI_ISSUED, &phba->hba_flag); -- clear_bit(HBA_RHBA_CMPL, &phba->hba_flag); -- - /* Clear external loopback plug detected flag */ - phba->link_flag &= ~LS_EXTERNAL_LOOPBACK; - -@@ -1440,6 +1436,10 @@ lpfc_linkup(struct lpfc_hba *phba) - phba->pport->rcv_flogi_cnt = 0; - spin_unlock_irq(shost->host_lock); - -+ /* reinitialize initial HBA flag */ -+ clear_bit(HBA_FLOGI_ISSUED, &phba->hba_flag); -+ clear_bit(HBA_RHBA_CMPL, &phba->hba_flag); -+ - return 0; - } - diff --git a/1201-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch b/1201-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch deleted file mode 100644 index 283d3260f..000000000 --- a/1201-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch +++ /dev/null @@ -1,50 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" -# reverse of cs10 9cf927d02bc932338017864503fc177d8a0a4f2b - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 0876fcf07b5a..5b848288f522 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -7918,6 +7918,8 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) - int longs; - int extra; - uint64_t wwn; -+ u32 if_type; -+ u32 if_fam; - - phba->sli4_hba.num_present_cpu = lpfc_present_cpu; - phba->sli4_hba.num_possible_cpu = cpumask_last(cpu_possible_mask) + 1; -@@ -8178,11 +8180,28 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) - */ - rc = lpfc_get_sli4_parameters(phba, mboxq); - if (rc) { -- lpfc_log_msg(phba, KERN_WARNING, LOG_INIT, -- "2999 Could not get SLI4 parameters\n"); -- rc = -EIO; -- mempool_free(mboxq, phba->mbox_mem_pool); -- goto out_free_bsmbx; -+ if_type = bf_get(lpfc_sli_intf_if_type, -+ &phba->sli4_hba.sli_intf); -+ if_fam = bf_get(lpfc_sli_intf_sli_family, -+ &phba->sli4_hba.sli_intf); -+ if (phba->sli4_hba.extents_in_use && -+ phba->sli4_hba.rpi_hdrs_in_use) { -+ lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -+ "2999 Unsupported SLI4 Parameters " -+ "Extents and RPI headers enabled.\n"); -+ if (if_type == LPFC_SLI_INTF_IF_TYPE_0 && -+ if_fam == LPFC_SLI_INTF_FAMILY_BE2) { -+ mempool_free(mboxq, phba->mbox_mem_pool); -+ rc = -EIO; -+ goto out_free_bsmbx; -+ } -+ } -+ if (!(if_type == LPFC_SLI_INTF_IF_TYPE_0 && -+ if_fam == LPFC_SLI_INTF_FAMILY_BE2)) { -+ mempool_free(mboxq, phba->mbox_mem_pool); -+ rc = -EIO; -+ goto out_free_bsmbx; -+ } - } - - /* diff --git a/1202-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch b/1202-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch deleted file mode 100644 index d6da3ed8e..000000000 --- a/1202-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch +++ /dev/null @@ -1,39 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" -# reverse of cs10 0c985d88af920e163f033fca2fd907a1ea3199fe - -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index daba94529b45..72ff92ac5321 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -2229,6 +2229,21 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - /* Look for a retryable error */ - if (ulp_status == IOSTAT_LOCAL_REJECT) { - switch ((ulp_word4 & IOERR_PARAM_MASK)) { -+ case IOERR_SLI_ABORTED: -+ case IOERR_SLI_DOWN: -+ /* Driver aborted this IO. No retry as error -+ * is likely Offline->Online or some adapter -+ * error. Recovery will try again, but if port -+ * is not active there's no point to continue -+ * issuing follow up FDMI commands. -+ */ -+ if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)) { -+ free_ndlp = cmdiocb->ndlp; -+ lpfc_ct_free_iocb(phba, cmdiocb); -+ lpfc_nlp_put(free_ndlp); -+ return; -+ } -+ break; - case IOERR_ABORT_IN_PROGRESS: - case IOERR_SEQUENCE_TIMEOUT: - case IOERR_ILLEGAL_FRAME: -@@ -2254,9 +2269,6 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - lpfc_ct_free_iocb(phba, cmdiocb); - lpfc_nlp_put(free_ndlp); - -- if (ulp_status != IOSTAT_SUCCESS) -- return; -- - ndlp = lpfc_findnode_did(vport, FDMI_DID); - if (!ndlp) - return; diff --git a/1203-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch b/1203-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch deleted file mode 100644 index 7ec197406..000000000 --- a/1203-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch +++ /dev/null @@ -1,21 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" -# reverse of cs10 78262dda794a4ef21146664546d2cf058132113d - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 3cbacc923fbd..9ab2e98cf693 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -7860,13 +7860,6 @@ lpfc_rscn_recovery_check(struct lpfc_vport *vport) - - /* Move all affected nodes by pending RSCNs to NPR state. */ - list_for_each_entry_safe(ndlp, n, &vport->fc_nodes, nlp_listp) { -- if (test_bit(FC_UNLOADING, &vport->load_flag)) { -- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "1000 %s Unloading set\n", -- __func__); -- return 0; -- } -- - if ((ndlp->nlp_state == NLP_STE_UNUSED_NODE) || - !lpfc_rscn_payload_check(vport, ndlp->nlp_DID)) - continue; diff --git a/1204-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch b/1204-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch deleted file mode 100644 index 30bd977a3..000000000 --- a/1204-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch +++ /dev/null @@ -1,18 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" -# reverse of cs10 935d1d90f2dfbfeb3fde78b925df9eea248e7523 - -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 0afc5fe013bc..055ed632c14d 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -390,10 +390,6 @@ lpfc_sli4_vport_delete_fcp_xri_aborted(struct lpfc_vport *vport) - if (!(vport->cfg_enable_fc4_type & LPFC_ENABLE_FCP)) - return; - -- /* may be called before queues established if hba_setup fails */ -- if (!phba->sli4_hba.hdwq) -- return; -- - spin_lock_irqsave(&phba->hbalock, iflag); - for (idx = 0; idx < phba->cfg_hdw_queue; idx++) { - qp = &phba->sli4_hba.hdwq[idx]; diff --git a/1205-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch b/1205-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch deleted file mode 100644 index 09785707f..000000000 --- a/1205-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch +++ /dev/null @@ -1,53 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Update debugfs trace ring initialization messages" -# reverse of cs10 0bacc04f93bb5b7334c7197ce716e378e9887081 - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 061a5e4e525d..3fd1aa5cc78c 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -6227,9 +6227,8 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - i++; - } - lpfc_debugfs_max_slow_ring_trc = (1 << i); -- pr_info("lpfc_debugfs_max_slow_ring_trc " -- "changed to %d\n", -- lpfc_debugfs_max_slow_ring_trc); -+ pr_err("lpfc_debugfs_max_disc_trc changed to " -+ "%d\n", lpfc_debugfs_max_disc_trc); - } - } - -@@ -6261,7 +6260,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - atomic_set(&phba->nvmeio_trc_cnt, 0); - if (lpfc_debugfs_max_nvmeio_trc) { - num = lpfc_debugfs_max_nvmeio_trc - 1; -- if (num & lpfc_debugfs_max_nvmeio_trc) { -+ if (num & lpfc_debugfs_max_disc_trc) { - /* Change to be a power of 2 */ - num = lpfc_debugfs_max_nvmeio_trc; - i = 0; -@@ -6270,9 +6269,10 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - i++; - } - lpfc_debugfs_max_nvmeio_trc = (1 << i); -- pr_info("lpfc_debugfs_max_nvmeio_trc changed " -- "to %d\n", -- lpfc_debugfs_max_nvmeio_trc); -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "0575 lpfc_debugfs_max_nvmeio_trc " -+ "changed to %d\n", -+ lpfc_debugfs_max_nvmeio_trc); - } - phba->nvmeio_trc_size = lpfc_debugfs_max_nvmeio_trc; - -@@ -6317,8 +6317,8 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - i++; - } - lpfc_debugfs_max_disc_trc = (1 << i); -- pr_info("lpfc_debugfs_max_disc_trc changed to %d\n", -- lpfc_debugfs_max_disc_trc); -+ pr_err("lpfc_debugfs_max_disc_trc changed to %d\n", -+ lpfc_debugfs_max_disc_trc); - } - } - diff --git a/1206-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch b/1206-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch deleted file mode 100644 index 7f200561d..000000000 --- a/1206-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch +++ /dev/null @@ -1,29 +0,0 @@ -Subject: [PATCH] Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" -# reverse of cs10 dc6d2aecdbfe696ca05464d29ad974e73b02d52c - -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index 72ff92ac5321..12c67cdd7c19 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -264,9 +264,9 @@ lpfc_ct_reject_event(struct lpfc_nodelist *ndlp, - ct_free_mp: - kfree(mp); - ct_exit: -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, -- "6440 Unsol CT: Rsp err %d Data: x%lx\n", -- rc, vport->fc_flag); -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, -+ "6440 Unsol CT: Rsp err %d Data: x%lx\n", -+ rc, vport->fc_flag); - } - - /** -@@ -313,7 +313,7 @@ lpfc_ct_handle_mibreq(struct lpfc_hba *phba, struct lpfc_iocbq *ctiocbq) - - mi_cmd = be16_to_cpu(ct_req->CommandResponse.bits.CmdRsp); - lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, -- "6442 MI Cmd: x%x Not Supported\n", mi_cmd); -+ "6442 MI Cmd : x%x Not Supported\n", mi_cmd); - lpfc_ct_reject_event(ndlp, ct_req, - bf_get(wqe_ctxt_tag, - &ctiocbq->wqe.xmit_els_rsp.wqe_com), diff --git a/1207-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-rhel-only.patch b/1207-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-rhel-only.patch deleted file mode 100644 index 4cc15c9cb..000000000 --- a/1207-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-rhel-only.patch +++ /dev/null @@ -1,31 +0,0 @@ -Subject: [PATCH] scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed -# RHEL-only (no CS10/upstream commit); reconstructed use-after-free guard. - -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index f6fb92f..d8b5896 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -6595,11 +6595,6 @@ lpfc_nlp_get(struct lpfc_nodelist *ndlp) - unsigned long flags; - - if (ndlp) { -- lpfc_debugfs_disc_trc(ndlp->vport, LPFC_DISC_TRC_NODE, -- "node get: did:x%x flg:x%lx refcnt:x%x", -- ndlp->nlp_DID, ndlp->nlp_flag, -- kref_read(&ndlp->kref)); -- - /* The check of ndlp usage to prevent incrementing the - * ndlp reference count that is in the process of being - * released. -@@ -6607,9 +6602,8 @@ lpfc_nlp_get(struct lpfc_nodelist *ndlp) - spin_lock_irqsave(&ndlp->lock, flags); - if (!kref_get_unless_zero(&ndlp->kref)) { - spin_unlock_irqrestore(&ndlp->lock, flags); -- lpfc_printf_vlog(ndlp->vport, KERN_WARNING, LOG_NODE, -- "0276 %s: ndlp:x%px refcnt:%d\n", -- __func__, (void *)ndlp, kref_read(&ndlp->kref)); -+ pr_info("0276 %s: NDLP has zero reference count. " -+ "Exiting\n", __func__); - return NULL; - } - spin_unlock_irqrestore(&ndlp->lock, flags); diff --git a/1208-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch b/1208-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch deleted file mode 100644 index cb5626617..000000000 --- a/1208-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch +++ /dev/null @@ -1,210 +0,0 @@ -From 1aacebe9d4ccb1a89caa9eb9fe3bb24723e80564 Mon Sep 17 00:00:00 2001 -From: Jacob Keller -Date: Mon, 2 Feb 2026 16:16:39 -0800 -Subject: [PATCH] drm/mgag200: fix mgag200_bmc_stop_scanout() - -[ Upstream commit 0e0c8f4d16de92520623aa1ea485cadbf64e6929 ] - -The mgag200_bmc_stop_scanout() function is called by the .atomic_disable() -handler for the MGA G200 VGA BMC encoder. This function performs a few -register writes to inform the BMC of an upcoming mode change, and then -polls to wait until the BMC actually stops. - -The polling is implemented using a busy loop with udelay() and an iteration -timeout of 300, resulting in the function blocking for 300 milliseconds. - -The function gets called ultimately by the output_poll_execute work thread -for the DRM output change polling thread of the mgag200 driver: - -kworker/0:0-mm_ 3528 [000] 4555.315364: - ffffffffaa0e25b3 delay_halt.part.0+0x33 - ffffffffc03f6188 mgag200_bmc_stop_scanout+0x178 - ffffffffc087ae7a disable_outputs+0x12a - ffffffffc087c12a drm_atomic_helper_commit_tail+0x1a - ffffffffc03fa7b6 mgag200_mode_config_helper_atomic_commit_tail+0x26 - ffffffffc087c9c1 commit_tail+0x91 - ffffffffc087d51b drm_atomic_helper_commit+0x11b - ffffffffc0509694 drm_atomic_commit+0xa4 - ffffffffc05105e8 drm_client_modeset_commit_atomic+0x1e8 - ffffffffc0510ce6 drm_client_modeset_commit_locked+0x56 - ffffffffc0510e24 drm_client_modeset_commit+0x24 - ffffffffc088a743 __drm_fb_helper_restore_fbdev_mode_unlocked+0x93 - ffffffffc088a683 drm_fb_helper_hotplug_event+0xe3 - ffffffffc050f8aa drm_client_dev_hotplug+0x9a - ffffffffc088555a output_poll_execute+0x29a - ffffffffa9b35924 process_one_work+0x194 - ffffffffa9b364ee worker_thread+0x2fe - ffffffffa9b3ecad kthread+0xdd - ffffffffa9a08549 ret_from_fork+0x29 - -On a server running ptp4l with the mgag200 driver loaded, we found that -ptp4l would sometimes get blocked from execution because of this busy -waiting loop. - -Every so often, approximately once every 20 minutes -- though with large -variance -- the output_poll_execute() thread would detect some sort of -change that required performing a hotplug event which results in attempting -to stop the BMC scanout, resulting in a 300msec delay on one CPU. - -On this system, ptp4l was pinned to a single CPU. When the -output_poll_execute() thread ran on that CPU, it blocked ptp4l from -executing for its 300 millisecond duration. - -This resulted in PTP service disruptions such as failure to send a SYNC -message on time, failure to handle ANNOUNCE messages on time, and clock -check warnings from the application. All of this despite the application -being configured with FIFO_RT and a higher priority than the background -workqueue tasks. (However, note that the kernel did not use -CONFIG_PREEMPT...) - -It is unclear if the event is due to a faulty VGA connection, another bug, -or actual events causing a change in the connection. At least on the system -under test it is not a one-time event and consistently causes disruption to -the time sensitive applications. - -The function has some helpful comments explaining what steps it is -attempting to take. In particular, step 3a and 3b are explained as such: - - 3a - The third step is to verify if there is an active scan. We are - waiting on a 0 on remhsyncsts (. - - 3b - This step occurs only if the remove is actually scanning. We are - waiting for the end of the frame which is a 1 on remvsyncsts - (). - -The actual steps 3a and 3b are implemented as while loops with a -non-sleeping udelay(). The first step iterates while the tmp value at -position 0 is *not* set. That is, it keeps iterating as long as the bit is -zero. If the bit is already 0 (because there is no active scan), it will -iterate the entire 300 attempts which wastes 300 milliseconds in total. -This is opposite of what the description claims. - -The step 3b logic only executes if we do not iterate over the entire 300 -attempts in the first loop. If it does trigger, it is trying to check and -wait for a 1 on the remvsyncsts. However, again the condition is actually -inverted and it will loop as long as the bit is 1, stopping once it hits -zero (rather than the explained attempt to wait until we see a 1). - -Worse, both loops are implemented using non-sleeping waits which spin -instead of allowing the scheduler to run other processes. If the kernel is -not configured to allow arbitrary preemption, it will waste valuable CPU -time doing nothing. - -There does not appear to be any documentation for the BMC register -interface, beyond what is in the comments here. It seems more probable that -the comment here is correct and the implementation accidentally got -inverted from the intended logic. - -Reading through other DRM driver implementations, it does not appear that -the .atomic_enable or .atomic_disable handlers need to delay instead of -sleep. For example, the ast_astdp_encoder_helper_atomic_disable() function -calls ast_dp_set_phy_sleep() which uses msleep(). The "atomic" in the name -is referring to the atomic modesetting support, which is the support to -enable atomic configuration from userspace, and not to the "atomic context" -of the kernel. There is no reason to use udelay() here if a sleep would be -sufficient. - -Replace the while loops with a read_poll_timeout() based implementation -that will sleep between iterations, and which stops polling once the -condition is met (instead of looping as long as the condition is met). This -aligns with the commented behavior and avoids blocking on the CPU while -doing nothing. - -Note the RREG_DAC is implemented using a statement expression to allow -working properly with the read_poll_timeout family of functions. The other -RREG_ macros ought to be cleaned up to have better semantics, and -several places in the mgag200 driver could make use of RREG_DAC or similar -RREG_* macros should likely be cleaned up for better semantics as well, but -that task has been left as a future cleanup for a non-bugfix. - -Fixes: 414c45310625 ("mgag200: initial g200se driver (v2)") -Suggested-by: Thomas Zimmermann -Signed-off-by: Jacob Keller -Reviewed-by: Thomas Zimmermann -Reviewed-by: Jocelyn Falempe -Signed-off-by: Thomas Zimmermann -Link: https://patch.msgid.link/20260202-jk-mgag200-fix-bad-udelay-v2-1-ce1e9665987d@intel.com -Signed-off-by: Sasha Levin - -diff --git a/drivers/gpu/drm/mgag200/mgag200_bmc.c b/drivers/gpu/drm/mgag200/mgag200_bmc.c -index a689c71ff165..bbdeb791c5b3 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_bmc.c -+++ b/drivers/gpu/drm/mgag200/mgag200_bmc.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0-only - - #include -+#include - - #include - #include -@@ -12,7 +13,7 @@ - void mgag200_bmc_stop_scanout(struct mga_device *mdev) - { - u8 tmp; -- int iter_max; -+ int ret; - - /* - * 1 - The first step is to inform the BMC of an upcoming mode -@@ -42,30 +43,22 @@ void mgag200_bmc_stop_scanout(struct mga_device *mdev) - - /* - * 3a- The third step is to verify if there is an active scan. -- * We are waiting for a 0 on remhsyncsts ). -+ * We are waiting for a 0 on remhsyncsts (). - */ -- iter_max = 300; -- while (!(tmp & 0x1) && iter_max) { -- WREG8(DAC_INDEX, MGA1064_SPAREREG); -- tmp = RREG8(DAC_DATA); -- udelay(1000); -- iter_max--; -- } -+ ret = read_poll_timeout(RREG_DAC, tmp, !(tmp & 0x1), -+ 1000, 300000, false, -+ MGA1064_SPAREREG); -+ if (ret == -ETIMEDOUT) -+ return; - - /* -- * 3b- This step occurs only if the remove is actually -+ * 3b- This step occurs only if the remote BMC is actually - * scanning. We are waiting for the end of the frame which is - * a 1 on remvsyncsts (XSPAREREG<1>) - */ -- if (iter_max) { -- iter_max = 300; -- while ((tmp & 0x2) && iter_max) { -- WREG8(DAC_INDEX, MGA1064_SPAREREG); -- tmp = RREG8(DAC_DATA); -- udelay(1000); -- iter_max--; -- } -- } -+ (void)read_poll_timeout(RREG_DAC, tmp, (tmp & 0x2), -+ 1000, 300000, false, -+ MGA1064_SPAREREG); - } - - void mgag200_bmc_start_scanout(struct mga_device *mdev) -diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h -index 988967eafbf2..c67007348142 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_drv.h -+++ b/drivers/gpu/drm/mgag200/mgag200_drv.h -@@ -112,6 +112,12 @@ - #define DAC_INDEX 0x3c00 - #define DAC_DATA 0x3c0a - -+#define RREG_DAC(reg) \ -+ ({ \ -+ WREG8(DAC_INDEX, reg); \ -+ RREG8(DAC_DATA); \ -+ }) \ -+ - #define WREG_DAC(reg, v) \ - do { \ - WREG8(DAC_INDEX, reg); \ --- -2.50.1 (Apple Git-155) - diff --git a/1209-net-sched-act-csum-validate-nested-vlan-headers.patch b/1209-net-sched-act-csum-validate-nested-vlan-headers.patch deleted file mode 100644 index 1c6e86c20..000000000 --- a/1209-net-sched-act-csum-validate-nested-vlan-headers.patch +++ /dev/null @@ -1,55 +0,0 @@ -From a69738efea0996d05a3c7d2178551b891744df1b Mon Sep 17 00:00:00 2001 -From: Ruide Cao -Date: Thu, 2 Apr 2026 22:46:20 +0800 -Subject: [PATCH] net: sched: act_csum: validate nested VLAN headers - -[ Upstream commit c842743d073bdd683606cb414eb0ca84465dd834 ] - -tcf_csum_act() walks nested VLAN headers directly from skb->data when an -skb still carries in-payload VLAN tags. The current code reads -vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without -first ensuring that the full VLAN header is present in the linear area. - -If only part of an inner VLAN header is linearized, accessing -h_vlan_encapsulated_proto reads past the linear area, and the following -skb_pull(VLAN_HLEN) may violate skb invariants. - -Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and -pulling each nested VLAN header. If the header still is not fully -available, drop the packet through the existing error path. - -Fixes: 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets") -Reported-by: Yifan Wu -Reported-by: Juefei Pu -Co-developed-by: Yuan Tan -Signed-off-by: Yuan Tan -Suggested-by: Xin Liu -Tested-by: Ren Wei -Signed-off-by: Ruide Cao -Signed-off-by: Ren Wei -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/22df2fcb49f410203eafa5d97963dd36089f4ecf.1774892775.git.caoruide123@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c -index 5cc8e407e791..8ea37c2c3c54 100644 ---- a/net/sched/act_csum.c -+++ b/net/sched/act_csum.c -@@ -603,8 +603,12 @@ TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb, - protocol = skb->protocol; - orig_vlan_tag_present = true; - } else { -- struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data; -+ struct vlan_hdr *vlan; - -+ if (!pskb_may_pull(skb, VLAN_HLEN)) -+ goto drop; -+ -+ vlan = (struct vlan_hdr *)skb->data; - protocol = vlan->h_vlan_encapsulated_proto; - skb_pull(skb, VLAN_HLEN); - skb_reset_network_header(skb); --- -2.50.1 (Apple Git-155) - diff --git a/1210-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch b/1210-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch deleted file mode 100644 index 1171ae923..000000000 --- a/1210-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 9eda5478746ef7dc0e4e537b5a5e4b0ca1027091 Mon Sep 17 00:00:00 2001 -From: Zhengchuan Liang -Date: Sat, 4 Apr 2026 17:39:47 +0800 -Subject: [PATCH] netfilter: ip6t_eui64: reject invalid MAC header for all - packets - -[ Upstream commit fdce0b3590f724540795b874b4c8850c90e6b0a8 ] - -`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address -and compares it with the low 64 bits of the IPv6 source address. - -The existing guard only rejects an invalid MAC header when -`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()` -can still reach `eth_hdr(skb)` even when the MAC header is not valid. - -Fix this by removing the `par->fragoff != 0` condition so that packets -with an invalid MAC header are rejected before accessing `eth_hdr(skb)`. - -Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") -Reported-by: Yifan Wu -Reported-by: Juefei Pu -Co-developed-by: Yuan Tan -Signed-off-by: Yuan Tan -Suggested-by: Xin Liu -Tested-by: Ren Wei -Signed-off-by: Zhengchuan Liang -Signed-off-by: Ren Wei -Signed-off-by: Florian Westphal -Signed-off-by: Sasha Levin - -diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c -index d704f7ed300c..da69a27e8332 100644 ---- a/net/ipv6/netfilter/ip6t_eui64.c -+++ b/net/ipv6/netfilter/ip6t_eui64.c -@@ -22,8 +22,7 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par) - unsigned char eui64[8]; - - if (!(skb_mac_header(skb) >= skb->head && -- skb_mac_header(skb) + ETH_HLEN <= skb->data) && -- par->fragoff != 0) { -+ skb_mac_header(skb) + ETH_HLEN <= skb->data)) { - par->hotdrop = true; - return false; - } --- -2.50.1 (Apple Git-155) - diff --git a/1211-cifs-remove-unnecessary-tracing-after-put-tcon.patch b/1211-cifs-remove-unnecessary-tracing-after-put-tcon.patch deleted file mode 100644 index a49924303..000000000 --- a/1211-cifs-remove-unnecessary-tracing-after-put-tcon.patch +++ /dev/null @@ -1,52 +0,0 @@ -From ccfb4a950c79db99c153de111d0b4d05edaf193d Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Wed, 18 Feb 2026 18:34:03 -0300 -Subject: [PATCH] cifs: remove unnecessary tracing after put tcon - -JIRA: https://issues.redhat.com/browse/RHEL-150776 - -commit a5a50f1415692a0fe3bf0ec17f422cac8e158e65 -Author: Shyam Prasad N -Date: Sat Feb 14 13:05:50 2026 +0530 - - cifs: remove unnecessary tracing after put tcon - - This code was recently changed from manually decrementing - tcon ref to using cifs_put_tcon. But even before that change - this tracing happened after decrementing the ref count, which - is wrong. With cifs_put_tcon, tracing already happens inside it. - So just removing the extra tracing here. - - Signed-off-by: Shyam Prasad N - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c -index 1e13dd0a24c3..61c521712f86 100644 ---- a/fs/smb/client/smb2ops.c -+++ b/fs/smb/client/smb2ops.c -@@ -3181,8 +3181,6 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses, - if (tcon && !tcon->ipc) { - /* ipc tcons are not refcounted */ - cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_dfs_refer); -- trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, -- netfs_trace_tcon_ref_dec_dfs_refer); - } - kfree(utf16_path); - kfree(dfs_req); -diff --git a/fs/smb/client/trace.h b/fs/smb/client/trace.h -index 191f02344dcd..9228f95cae2b 100644 ---- a/fs/smb/client/trace.h -+++ b/fs/smb/client/trace.h -@@ -168,7 +168,6 @@ - E_(cifs_trace_rw_credits_zero_in_flight, "ZERO-IN-FLT") - - #define smb3_tcon_ref_traces \ -- EM(netfs_trace_tcon_ref_dec_dfs_refer, "DEC DfsRef") \ - EM(netfs_trace_tcon_ref_free, "FRE ") \ - EM(netfs_trace_tcon_ref_free_fail, "FRE Fail ") \ - EM(netfs_trace_tcon_ref_free_ipc, "FRE Ipc ") \ --- -2.50.1 (Apple Git-155) - diff --git a/1212-cifs-make-default-value-of-retrans-as-zero.patch b/1212-cifs-make-default-value-of-retrans-as-zero.patch deleted file mode 100644 index fd44085a5..000000000 --- a/1212-cifs-make-default-value-of-retrans-as-zero.patch +++ /dev/null @@ -1,41 +0,0 @@ -From e96124d5b440c57a270d3903e7cec81d14fc2e07 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Tue, 28 Apr 2026 18:52:21 -0300 -Subject: [PATCH] cifs: make default value of retrans as zero - -JIRA: https://issues.redhat.com/browse/RHEL-171638 - -commit e3beefd3af09f8e460ddaf39063d3d7664d7ab59 -Author: Shyam Prasad N -Date: Wed Mar 11 10:48:54 2026 +0530 - - cifs: make default value of retrans as zero - - When retrans mount option was introduced, the default value was set - as 1. However, in the light of some bugs that this has exposed recently - we should change it to 0 and retain the old behaviour before this option - was introduced. - - Cc: - Reviewed-by: Bharath SM - Signed-off-by: Shyam Prasad N - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index a5c336f8f2b7..943f4d3610ee 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -2000,7 +2000,7 @@ int smb3_init_fs_context(struct fs_context *fc) - ctx->backupuid_specified = false; /* no backup intent for a user */ - ctx->backupgid_specified = false; /* no backup intent for a group */ - -- ctx->retrans = 1; -+ ctx->retrans = 0; - ctx->reparse_type = CIFS_REPARSE_TYPE_DEFAULT; - ctx->symlink_type = CIFS_SYMLINK_TYPE_DEFAULT; - ctx->nonativesocket = 0; --- -2.50.1 (Apple Git-155) - diff --git a/1213-dpll-zl3073x-add-output-pin-frequency-helper.patch b/1213-dpll-zl3073x-add-output-pin-frequency-helper.patch deleted file mode 100644 index 6517c21e3..000000000 --- a/1213-dpll-zl3073x-add-output-pin-frequency-helper.patch +++ /dev/null @@ -1,158 +0,0 @@ -From 6482a608b65938f2fdacc01e93dd4f62b1f298c7 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:24:19 +0000 -Subject: [PATCH] dpll: zl3073x: Add output pin frequency helper - -JIRA: https://redhat.atlassian.net/browse/RHEL-164429 - -commit 24e4336a87f5c51263535201218889b5f324511f -Author: Ivan Vecera -Date: Thu Feb 5 16:43:49 2026 +0100 - - dpll: zl3073x: Add output pin frequency helper - - Introduce zl3073x_dev_output_pin_freq_get() helper function to compute - the output pin frequency based on synthesizer frequency, output divisor, - and signal format. For N-div signal formats, the N-pin frequency is - additionally divided by esync_n_period. - - Add zl3073x_out_is_ndiv() helper to check if an output is configured - in N-div mode (2_NDIV or 2_NDIV_INV signal formats). - - Refactor zl3073x_dpll_output_pin_frequency_get() callback to use the - new helper, reducing code duplication and enabling reuse of the - frequency calculation logic in other contexts. - - This is a preparatory change for adding current frequency to the - supported frequencies list in pin properties. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260205154350.3180465-2-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index 09bca2d0926d..dddfcacea5c0 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -301,6 +301,36 @@ u8 zl3073x_dev_out_dpll_get(struct zl3073x_dev *zldev, u8 index) - return zl3073x_synth_dpll_get(synth); - } - -+/** -+ * zl3073x_dev_output_pin_freq_get - get output pin frequency -+ * @zldev: pointer to zl3073x device -+ * @id: output pin id -+ * -+ * Computes the output pin frequency based on the synth frequency, output -+ * divisor, and signal format. For N-div formats, N-pin frequency is -+ * additionally divided by esync_n_period. -+ * -+ * Return: frequency of the given output pin in Hz -+ */ -+static inline u32 -+zl3073x_dev_output_pin_freq_get(struct zl3073x_dev *zldev, u8 id) -+{ -+ const struct zl3073x_synth *synth; -+ const struct zl3073x_out *out; -+ u8 out_id; -+ u32 freq; -+ -+ out_id = zl3073x_output_pin_out_get(id); -+ out = zl3073x_out_state_get(zldev, out_id); -+ synth = zl3073x_synth_state_get(zldev, zl3073x_out_synth_get(out)); -+ freq = zl3073x_synth_freq_get(synth) / out->div; -+ -+ if (zl3073x_out_is_ndiv(out) && zl3073x_is_n_pin(id)) -+ freq /= out->esync_n_period; -+ -+ return freq; -+} -+ - /** - * zl3073x_dev_out_is_diff - check if the given output is differential - * @zldev: pointer to zl3073x device -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 897ed682dbf9..78edc36b17fb 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -916,46 +916,9 @@ zl3073x_dpll_output_pin_frequency_get(const struct dpll_pin *dpll_pin, - struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -- struct zl3073x_dev *zldev = zldpll->dev; - struct zl3073x_dpll_pin *pin = pin_priv; -- const struct zl3073x_synth *synth; -- const struct zl3073x_out *out; -- u32 synth_freq; -- u8 out_id; - -- out_id = zl3073x_output_pin_out_get(pin->id); -- out = zl3073x_out_state_get(zldev, out_id); -- -- /* Get attached synth frequency */ -- synth = zl3073x_synth_state_get(zldev, zl3073x_out_synth_get(out)); -- synth_freq = zl3073x_synth_freq_get(synth); -- -- switch (zl3073x_out_signal_format_get(out)) { -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -- /* In case of divided format we have to distiguish between -- * given output pin type. -- * -- * For P-pin the resulting frequency is computed as simple -- * division of synth frequency and output divisor. -- * -- * For N-pin we have to divide additionally by divisor stored -- * in esync_n_period output mailbox register that is used as -- * N-pin divisor for these modes. -- */ -- *frequency = synth_freq / out->div; -- -- if (!zl3073x_dpll_is_p_pin(pin)) -- *frequency = (u32)*frequency / out->esync_n_period; -- -- break; -- default: -- /* In other modes the resulting frequency is computed as -- * division of synth frequency and output divisor. -- */ -- *frequency = synth_freq / out->div; -- break; -- } -+ *frequency = zl3073x_dev_output_pin_freq_get(zldpll->dev, pin->id); - - return 0; - } -diff --git a/drivers/dpll/zl3073x/out.h b/drivers/dpll/zl3073x/out.h -index e8ea7a0e0f07..318f9bb8da3a 100644 ---- a/drivers/dpll/zl3073x/out.h -+++ b/drivers/dpll/zl3073x/out.h -@@ -79,6 +79,23 @@ static inline bool zl3073x_out_is_enabled(const struct zl3073x_out *out) - return !!FIELD_GET(ZL_OUTPUT_CTRL_EN, out->ctrl); - } - -+/** -+ * zl3073x_out_is_ndiv - check if the given output is in N-div mode -+ * @out: pointer to out state -+ * -+ * Return: true if output is in N-div mode, false otherwise -+ */ -+static inline bool zl3073x_out_is_ndiv(const struct zl3073x_out *out) -+{ -+ switch (zl3073x_out_signal_format_get(out)) { -+ case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -+ case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -+ return true; -+ default: -+ return false; -+ } -+} -+ - /** - * zl3073x_out_synth_get - get synth connected to given output - * @out: pointer to out state --- -2.50.1 (Apple Git-155) - diff --git a/1214-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch b/1214-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch deleted file mode 100644 index 916439c51..000000000 --- a/1214-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch +++ /dev/null @@ -1,124 +0,0 @@ -From 6a744fc1c97d1a5dc7def15f6ecadd9e428a6ab8 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:24:20 +0000 -Subject: [PATCH] dpll: zl3073x: Include current frequency in supported - frequencies list - -JIRA: https://redhat.atlassian.net/browse/RHEL-164429 - -commit 85a9aaac4a38a7ce68f30bd7678fca4e8c687fe2 -Author: Ivan Vecera -Date: Thu Feb 5 16:43:50 2026 +0100 - - dpll: zl3073x: Include current frequency in supported frequencies list - - Ensure the current pin frequency is always present in the list of - supported frequencies reported to userspace. Previously, if the - firmware node was missing or didn't include the current operating - frequency in the supported-frequencies-hz property, the pin would - report a frequency that wasn't in its supported list. - - Get the current frequency early in zl3073x_pin_props_get(): - - For input pins: use zl3073x_dev_ref_freq_get() - - For output pins: use zl3073x_dev_output_pin_freq_get() - - Place the current frequency at index 0 of the supported frequencies - array, then append frequencies from the firmware node (if present), - skipping any duplicate of the current frequency. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260205154350.3180465-3-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/prop.c b/drivers/dpll/zl3073x/prop.c -index ad1f099cbe2b..8523dc8c226e 100644 ---- a/drivers/dpll/zl3073x/prop.c -+++ b/drivers/dpll/zl3073x/prop.c -@@ -193,9 +193,10 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - { - struct dpll_pin_frequency *ranges; - struct zl3073x_pin_props *props; -- int i, j, num_freqs, rc; -+ int i, j, num_freqs = 0, rc; -+ u64 *freqs = NULL; - const char *type; -- u64 *freqs; -+ u32 curr_freq; - - props = kzalloc(sizeof(*props), GFP_KERNEL); - if (!props) -@@ -207,6 +208,7 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - props->dpll_props.capabilities = - DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE | - DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE; -+ curr_freq = zl3073x_dev_ref_freq_get(zldev, index); - } else { - u8 out, synth; - u32 f; -@@ -220,6 +222,7 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - synth = zl3073x_dev_out_synth_get(zldev, out); - f = 2 * zl3073x_dev_synth_freq_get(zldev, synth); - props->dpll_props.phase_gran = f ? div_u64(PSEC_PER_SEC, f) : 1; -+ curr_freq = zl3073x_dev_output_pin_freq_get(zldev, index); - } - - props->dpll_props.phase_range.min = S32_MIN; -@@ -230,7 +233,7 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - /* Get firmware node for the given pin */ - rc = zl3073x_prop_pin_fwnode_get(zldev, props, dir, index); - if (rc) -- return props; /* Return if it does not exist */ -+ goto skip_fwnode_props; - - /* Look for label property and store the value as board label */ - fwnode_property_read_string(props->fwnode, "label", -@@ -264,9 +267,10 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - /* Read supported frequencies property if it is specified */ - num_freqs = fwnode_property_count_u64(props->fwnode, - "supported-frequencies-hz"); -- if (num_freqs <= 0) -- /* Return if the property does not exist or number is 0 */ -- return props; -+ if (num_freqs <= 0) { -+ num_freqs = 0; -+ goto skip_fwnode_props; -+ } - - /* The firmware node specifies list of supported frequencies while - * DPLL core pin properties requires list of frequency ranges. -@@ -283,19 +287,25 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - "supported-frequencies-hz", freqs, - num_freqs); - -- /* Allocate frequency ranges list and fill it */ -- ranges = kcalloc(num_freqs, sizeof(*ranges), GFP_KERNEL); -+skip_fwnode_props: -+ /* Allocate frequency ranges list - extra slot for current frequency */ -+ ranges = kcalloc(num_freqs + 1, sizeof(*ranges), GFP_KERNEL); - if (!ranges) { - rc = -ENOMEM; - goto err_alloc_ranges; - } - -- /* Convert list of frequencies to list of frequency ranges but -- * filter-out frequencies that are not representable by device -+ /* Start with current frequency at index 0 */ -+ ranges[0] = (struct dpll_pin_frequency)DPLL_PIN_FREQUENCY(curr_freq); -+ -+ /* Add frequencies from firmware node, skipping current frequency -+ * and filtering out frequencies not representable by device - */ -- for (i = 0, j = 0; i < num_freqs; i++) { -+ for (i = 0, j = 1; i < num_freqs; i++) { - struct dpll_pin_frequency freq = DPLL_PIN_FREQUENCY(freqs[i]); - -+ if (freqs[i] == curr_freq) -+ continue; - if (zl3073x_pin_check_freq(zldev, dir, index, freqs[i])) { - ranges[j] = freq; - j++; --- -2.50.1 (Apple Git-155) - diff --git a/1215-dpll-zl3073x-fix-ref-frequency-setting.patch b/1215-dpll-zl3073x-fix-ref-frequency-setting.patch deleted file mode 100644 index 5be556a15..000000000 --- a/1215-dpll-zl3073x-fix-ref-frequency-setting.patch +++ /dev/null @@ -1,58 +0,0 @@ -From bbc528495d5ec657906c684f5805b3a410941cb6 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:24:21 +0000 -Subject: [PATCH] dpll: zl3073x: Fix ref frequency setting - -JIRA: https://redhat.atlassian.net/browse/RHEL-164429 - -commit a047497f952831e377564b606dcb74a7cb309384 -Author: Ivan Vecera -Date: Mon Feb 16 20:40:07 2026 +0100 - - dpll: zl3073x: Fix ref frequency setting - - The frequency for an input reference is computed as: - - frequency = freq_base * freq_mult * freq_ratio_m / freq_ratio_n - - Before commit 5bc02b190a3fb ("dpll: zl3073x: Cache all reference - properties in zl3073x_ref"), zl3073x_dpll_input_pin_frequency_set() - explicitly wrote 1 to both the REF_RATIO_M and REF_RATIO_N hardware - registers whenever a new frequency was set. This ensured the FEC ratio - was always reset to 1:1 alongside the new base/multiplier values. - - The refactoring in that commit introduced zl3073x_ref_freq_set() to - update the cached ref state, but this helper only sets freq_base and - freq_mult without resetting freq_ratio_m and freq_ratio_n to 1. Because - zl3073x_ref_state_set() uses a compare-and-write strategy, unchanged - ratio fields are never written to the hardware. If the device previously - had non-unity FEC ratio values, they remain in effect after a frequency - change, resulting in an incorrect computed frequency. - - Explicitly set freq_ratio_m and freq_ratio_n to 1 in zl3073x_ref_freq_set() - to restore the original behavior. - - Fixes: 5bc02b190a3fb ("dpll: zl3073x: Cache all reference properties in zl3073x_ref") - Signed-off-by: Ivan Vecera - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20260216194007.680416-1-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index efc7f59cd9f9..0d8618f5ce8d 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -91,6 +91,8 @@ zl3073x_ref_freq_set(struct zl3073x_ref *ref, u32 freq) - - ref->freq_base = base; - ref->freq_mult = mult; -+ ref->freq_ratio_m = 1; -+ ref->freq_ratio_n = 1; - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1216-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch b/1216-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch deleted file mode 100644 index d65625817..000000000 --- a/1216-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch +++ /dev/null @@ -1,175 +0,0 @@ -From 63c8ab56209fe06421d0f0ee0d254c8755d2d0ca Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:24:22 +0000 -Subject: [PATCH] dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for - some chip IDs - -JIRA: https://redhat.atlassian.net/browse/RHEL-164429 - -commit 4cfe066a82cdf9e83e48b16000f55280efc98325 -Author: Ivan Vecera -Date: Fri Feb 20 16:57:54 2026 +0100 - - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs - - The REF_PHASE_OFFSET_COMP register is 48-bit wide on most zl3073x chip - variants, but only 32-bit wide on chip IDs 0x0E30, 0x0E93..0x0E97 and - 0x1F60. The driver unconditionally uses 48-bit read/write operations, - which on 32-bit variants causes reading 2 bytes past the register - boundary (corrupting the value) and writing 2 bytes into the adjacent - register. - - Fix this by storing the chip ID in the device structure during probe - and adding a helper to detect the affected variants. Use the correct - register width for read/write operations and the matching sign extension - bit (31 vs 47) when interpreting the phase compensation value. - - Fixes: 6287262f761e ("dpll: zl3073x: Add support to adjust phase") - Signed-off-by: Ivan Vecera - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20260220155755.448185-1-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 63bd97181b9e..8c5ee28e02f4 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -1026,6 +1026,7 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev, - "Unknown or non-match chip ID: 0x%0x\n", - id); - } -+ zldev->chip_id = id; - - /* Read revision, firmware version and custom config version */ - rc = zl3073x_read_u16(zldev, ZL_REG_REVISION, &revision); -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index dddfcacea5c0..fd2af3c62a7d 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -35,6 +35,7 @@ struct zl3073x_dpll; - * @dev: pointer to device - * @regmap: regmap to access device registers - * @multiop_lock: to serialize multiple register operations -+ * @chip_id: chip ID read from hardware - * @ref: array of input references' invariants - * @out: array of outs' invariants - * @synth: array of synths' invariants -@@ -48,6 +49,7 @@ struct zl3073x_dev { - struct device *dev; - struct regmap *regmap; - struct mutex multiop_lock; -+ u16 chip_id; - - /* Invariants */ - struct zl3073x_ref ref[ZL3073X_NUM_REFS]; -@@ -144,6 +146,32 @@ int zl3073x_write_hwreg_seq(struct zl3073x_dev *zldev, - - int zl3073x_ref_phase_offsets_update(struct zl3073x_dev *zldev, int channel); - -+/** -+ * zl3073x_dev_is_ref_phase_comp_32bit - check ref phase comp register size -+ * @zldev: pointer to zl3073x device -+ * -+ * Some chip IDs have a 32-bit wide ref_phase_offset_comp register instead -+ * of the default 48-bit. -+ * -+ * Return: true if the register is 32-bit, false if 48-bit -+ */ -+static inline bool -+zl3073x_dev_is_ref_phase_comp_32bit(struct zl3073x_dev *zldev) -+{ -+ switch (zldev->chip_id) { -+ case 0x0E30: -+ case 0x0E93: -+ case 0x0E94: -+ case 0x0E95: -+ case 0x0E96: -+ case 0x0E97: -+ case 0x1F60: -+ return true; -+ default: -+ return false; -+ } -+} -+ - static inline bool - zl3073x_is_n_pin(u8 id) - { -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 78edc36b17fb..8ffbede117c6 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -475,8 +475,11 @@ zl3073x_dpll_input_pin_phase_adjust_get(const struct dpll_pin *dpll_pin, - ref_id = zl3073x_input_pin_ref_get(pin->id); - ref = zl3073x_ref_state_get(zldev, ref_id); - -- /* Perform sign extension for 48bit signed value */ -- phase_comp = sign_extend64(ref->phase_comp, 47); -+ /* Perform sign extension based on register width */ -+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev)) -+ phase_comp = sign_extend64(ref->phase_comp, 31); -+ else -+ phase_comp = sign_extend64(ref->phase_comp, 47); - - /* Reverse two's complement negation applied during set and convert - * to 32bit signed int -diff --git a/drivers/dpll/zl3073x/ref.c b/drivers/dpll/zl3073x/ref.c -index aa2de13effa8..6b65e6103999 100644 ---- a/drivers/dpll/zl3073x/ref.c -+++ b/drivers/dpll/zl3073x/ref.c -@@ -121,8 +121,16 @@ int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index) - return rc; - - /* Read phase compensation register */ -- rc = zl3073x_read_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP, -- &ref->phase_comp); -+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev)) { -+ u32 val; -+ -+ rc = zl3073x_read_u32(zldev, ZL_REG_REF_PHASE_OFFSET_COMP_32, -+ &val); -+ ref->phase_comp = val; -+ } else { -+ rc = zl3073x_read_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP, -+ &ref->phase_comp); -+ } - if (rc) - return rc; - -@@ -179,9 +187,16 @@ int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - if (!rc && dref->sync_ctrl != ref->sync_ctrl) - rc = zl3073x_write_u8(zldev, ZL_REG_REF_SYNC_CTRL, - ref->sync_ctrl); -- if (!rc && dref->phase_comp != ref->phase_comp) -- rc = zl3073x_write_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP, -- ref->phase_comp); -+ if (!rc && dref->phase_comp != ref->phase_comp) { -+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev)) -+ rc = zl3073x_write_u32(zldev, -+ ZL_REG_REF_PHASE_OFFSET_COMP_32, -+ ref->phase_comp); -+ else -+ rc = zl3073x_write_u48(zldev, -+ ZL_REG_REF_PHASE_OFFSET_COMP, -+ ref->phase_comp); -+ } - if (rc) - return rc; - -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index d837bee72b17..5573d7188406 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -194,6 +194,7 @@ - #define ZL_REF_CONFIG_DIFF_EN BIT(2) - - #define ZL_REG_REF_PHASE_OFFSET_COMP ZL_REG(10, 0x28, 6) -+#define ZL_REG_REF_PHASE_OFFSET_COMP_32 ZL_REG(10, 0x28, 4) - - #define ZL_REG_REF_SYNC_CTRL ZL_REG(10, 0x2e, 1) - #define ZL_REF_SYNC_CTRL_MODE GENMASK(2, 0) --- -2.50.1 (Apple Git-155) - diff --git a/1217-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch b/1217-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch deleted file mode 100644 index 0cf53bfc9..000000000 --- a/1217-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch +++ /dev/null @@ -1,45 +0,0 @@ -From b8350c49178e346cd8c90a0d950918d1985ec92d Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:24:24 +0000 -Subject: [PATCH] dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() - -JIRA: https://redhat.atlassian.net/browse/RHEL-164429 - -commit 676c7af91fcd740d34e7cb788cbc58e3bcafde39 -Author: Felix Gu -Date: Tue Feb 24 19:04:04 2026 +0800 - - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() - - The devm_add_action_or_reset() function already executes the cleanup - action on failure before returning an error, so the explicit goto error - and subsequent zl3073x_dev_dpll_fini() call causes double cleanup. - - Fixes: ebb1031c5137 ("dpll: zl3073x: Refactor DPLL initialization") - Reviewed-by: Ivan Vecera - Signed-off-by: Felix Gu - Link: https://patch.msgid.link/20260224-dpll-v2-1-d7786414a830@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 8c5ee28e02f4..37f3c33570ee 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -981,11 +981,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) - } - - /* Add devres action to release DPLL related resources */ -- rc = devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev); -- if (rc) -- goto error; -- -- return 0; -+ return devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev); - - error: - zl3073x_dev_dpll_fini(zldev); --- -2.50.1 (Apple Git-155) - diff --git a/1218-io-uring-rsrc-reject-zero-length-fixed-buffer-import.patch b/1218-io-uring-rsrc-reject-zero-length-fixed-buffer-import.patch deleted file mode 100644 index 8bf12c316..000000000 --- a/1218-io-uring-rsrc-reject-zero-length-fixed-buffer-import.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 78752da1c6bff4652005000d2dfb0171e13ca1b5 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 16:51:46 +0000 -Subject: [PATCH] io_uring/rsrc: reject zero-length fixed buffer import - -JIRA: https://redhat.atlassian.net/browse/RHEL-172557 -CVE: CVE-2026-43006 - -commit 111a12b422a8cfa93deabaef26fec48237163214 -Author: Qi Tang -Date: Mon Mar 30 00:49:36 2026 +0800 - - io_uring/rsrc: reject zero-length fixed buffer import - - validate_fixed_range() admits buf_addr at the exact end of the - registered region when len is zero, because the check uses strict - greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() - then computes offset == imu->len, which causes the bvec skip logic - to advance past the last bio_vec entry and read bv_offset from - out-of-bounds slab memory. - - Return early from io_import_fixed() when len is zero. A zero-length - import has no data to transfer and should not walk the bvec array - at all. - - BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 - Read of size 4 at addr ffff888002bcc254 by task poc/103 - Call Trace: - io_import_reg_buf+0x697/0x7f0 - io_write_fixed+0xd9/0x250 - __io_issue_sqe+0xad/0x710 - io_issue_sqe+0x7d/0x1100 - io_submit_sqes+0x86a/0x23c0 - __do_sys_io_uring_enter+0xa98/0x1590 - Allocated by task 103: - The buggy address is located 12 bytes to the right of - allocated 584-byte region [ffff888002bcc000, ffff888002bcc248) - - Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer") - Signed-off-by: Qi Tang - Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com - Signed-off-by: Jens Axboe - -Signed-off-by: CKI Backport Bot - -diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c -index 5b40f7992e41..3f0a7c0efd25 100644 ---- a/io_uring/rsrc.c -+++ b/io_uring/rsrc.c -@@ -1072,6 +1072,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter, - return ret; - if (!(imu->dir & (1 << ddir))) - return -EFAULT; -+ if (unlikely(!len)) { -+ iov_iter_bvec(iter, ddir, NULL, 0, 0); -+ return 0; -+ } - - offset = buf_addr - imu->ubuf; - --- -2.50.1 (Apple Git-155) - diff --git a/1219-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch b/1219-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch deleted file mode 100644 index 80f00c4b5..000000000 --- a/1219-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 2c16e4d64dd91227742dfe196a3e7b0568bef65a Mon Sep 17 00:00:00 2001 -From: Qi Tang -Date: Mon, 30 Mar 2026 00:50:36 +0800 -Subject: [PATCH] netfilter: nf_conntrack_helper: pass helper to expect cleanup - -[ Upstream commit a242a9ae58aa46ff7dae51ce64150a93957abe65 ] - -nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() -to remove expectations belonging to the helper being unregistered. -However, it passes NULL instead of the helper pointer as the data -argument, so expect_iter_me() never matches any expectation and all -of them survive the cleanup. - -After unregister returns, nfnl_cthelper_del() frees the helper -object immediately. Subsequent expectation dumps or packet-driven -init_conntrack() calls then dereference the freed exp->helper, -causing a use-after-free. - -Pass the actual helper pointer so expectations referencing it are -properly destroyed before the helper object is freed. - - BUG: KASAN: slab-use-after-free in string+0x38f/0x430 - Read of size 1 at addr ffff888003b14d20 by task poc/103 - Call Trace: - string+0x38f/0x430 - vsnprintf+0x3cc/0x1170 - seq_printf+0x17a/0x240 - exp_seq_show+0x2e5/0x560 - seq_read_iter+0x419/0x1280 - proc_reg_read+0x1ac/0x270 - vfs_read+0x179/0x930 - ksys_read+0xef/0x1c0 - Freed by task 103: - The buggy address is located 32 bytes inside of - freed 192-byte region [ffff888003b14d00, ffff888003b14dc0) - -Fixes: ac7b84839003 ("netfilter: expect: add and use nf_ct_expect_iterate helpers") -Signed-off-by: Qi Tang -Reviewed-by: Phil Sutter -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin - -diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c -index ceb48c3ca0a4..9d7d36ac8308 100644 ---- a/net/netfilter/nf_conntrack_helper.c -+++ b/net/netfilter/nf_conntrack_helper.c -@@ -419,7 +419,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) - */ - synchronize_rcu(); - -- nf_ct_expect_iterate_destroy(expect_iter_me, NULL); -+ nf_ct_expect_iterate_destroy(expect_iter_me, me); - nf_ct_iterate_destroy(unhelp, me); - } - EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); --- -2.50.1 (Apple Git-155) - diff --git a/1220-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch b/1220-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch deleted file mode 100644 index dfc1c8cc4..000000000 --- a/1220-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 210b53b805eca1a334bcb30d2d1899e7a4a5c927 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 19:07:14 +0000 -Subject: [PATCH] HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-172748 -CVE: CVE-2026-43051 - -commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 -Author: Benoît Sevens -Date: Tue Mar 3 13:58:28 2026 +0000 - - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - - The wacom_intuos_bt_irq() function processes Bluetooth HID reports - without sufficient bounds checking. A maliciously crafted short report - can trigger an out-of-bounds read when copying data into the wacom - structure. - - Specifically, report 0x03 requires at least 22 bytes to safely read - the processed data and battery status, while report 0x04 (which - falls through to 0x03) requires 32 bytes. - - Add explicit length checks for these report IDs and log a warning if - a short report is received. - - Signed-off-by: Benoît Sevens - Reviewed-by: Jason Gerecke - Signed-off-by: Jiri Kosina - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 9b2c710f8da1..da1f0ea85625 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -1208,10 +1208,20 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len) - - switch (data[0]) { - case 0x04: -+ if (len < 32) { -+ dev_warn(wacom->pen_input->dev.parent, -+ "Report 0x04 too short: %zu bytes\n", len); -+ break; -+ } - wacom_intuos_bt_process_data(wacom, data + i); - i += 10; - fallthrough; - case 0x03: -+ if (i == 1 && len < 22) { -+ dev_warn(wacom->pen_input->dev.parent, -+ "Report 0x03 too short: %zu bytes\n", len); -+ break; -+ } - wacom_intuos_bt_process_data(wacom, data + i); - i += 10; - wacom_intuos_bt_process_data(wacom, data + i); --- -2.50.1 (Apple Git-155) - diff --git a/1221-redhat-configs-enable-config-aqtion-on-all-archs.patch b/1221-redhat-configs-enable-config-aqtion-on-all-archs.patch deleted file mode 100644 index bd1a4073f..000000000 --- a/1221-redhat-configs-enable-config-aqtion-on-all-archs.patch +++ /dev/null @@ -1,41 +0,0 @@ -From fc27138508fcc8346d22d229d55424ee4f54d2b5 Mon Sep 17 00:00:00 2001 -From: Michal Schmidt -Date: Tue, 27 Jan 2026 14:57:53 +0100 -Subject: [PATCH] redhat/configs: enable CONFIG_AQTION on all archs - -JIRA: https://issues.redhat.com/browse/RHEL-150852 -Upstream status: Posted https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4391 - -The Aquantia "atlantic" network driver was previously enabled in RHEL -only for x86 and automotive aarch64. We know of at least one -non-automotive aarch64 computer model that needs this driver. - -Let's just enable the driver for all archs, because it's not typical to -have NIC drivers selected for only some of them. - -No more is there a difference between the fedora and rhel config for -CONFIG_AQTION, so put it in common. - -Signed-off-by: Michal Schmidt - -diff --git a/redhat/configs/rhel/automotive/generic/arm/aarch64/CONFIG_AQTION b/redhat/configs/common/generic/CONFIG_AQTION -similarity index 100% -rename from redhat/configs/rhel/automotive/generic/arm/aarch64/CONFIG_AQTION -rename to redhat/configs/common/generic/CONFIG_AQTION -diff --git a/redhat/configs/rhel/generic/CONFIG_AQTION b/redhat/configs/rhel/generic/CONFIG_AQTION -deleted file mode 100644 -index 42dea55ccf3b..000000000000 ---- a/redhat/configs/rhel/generic/CONFIG_AQTION -+++ /dev/null -@@ -1 +0,0 @@ --# CONFIG_AQTION is not set -diff --git a/redhat/configs/rhel/generic/x86/CONFIG_AQTION b/redhat/configs/rhel/generic/x86/CONFIG_AQTION -deleted file mode 100644 -index 7812ca016377..000000000000 ---- a/redhat/configs/rhel/generic/x86/CONFIG_AQTION -+++ /dev/null -@@ -1 +0,0 @@ --CONFIG_AQTION=m --- -2.50.1 (Apple Git-155) - diff --git a/1222-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch b/1222-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch deleted file mode 100644 index d936c7a40..000000000 --- a/1222-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 9fca68c2512a362cad258e4df12a307bb2ee4b8e Mon Sep 17 00:00:00 2001 -From: Pengpeng Hou -Date: Mon, 23 Mar 2026 15:45:51 +0800 -Subject: [PATCH] wifi: brcmfmac: validate bsscfg indices in IF events - -[ Upstream commit 304950a467d83678bd0b0f46331882e2ac23b12d ] - -brcmf_fweh_handle_if_event() validates the firmware-provided interface -index before it touches drvr->iflist[], but it still uses the raw -bsscfgidx field as an array index without a matching range check. - -Reject IF events whose bsscfg index does not fit in drvr->iflist[] -before indexing the interface array. - -Signed-off-by: Pengpeng Hou -Acked-by: Arend van Spriel -Link: https://patch.msgid.link/20260323074551.93530-1-pengpeng@iscas.ac.cn -[add missing wifi prefix] -Signed-off-by: Johannes Berg -Signed-off-by: Sasha Levin - -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c -index f0b6a7607f16..0e4461596466 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c -@@ -152,6 +152,11 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr, - bphy_err(drvr, "invalid interface index: %u\n", ifevent->ifidx); - return; - } -+ if (ifevent->bsscfgidx >= BRCMF_MAX_IFS) { -+ bphy_err(drvr, "invalid bsscfg index: %u\n", -+ ifevent->bsscfgidx); -+ return; -+ } - - ifp = drvr->iflist[ifevent->bsscfgidx]; - --- -2.50.1 (Apple Git-155) - diff --git a/1223-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch b/1223-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch deleted file mode 100644 index 48b4caef7..000000000 --- a/1223-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch +++ /dev/null @@ -1,207 +0,0 @@ -From bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Wed, 25 Mar 2026 14:11:04 +0100 -Subject: [PATCH] netfilter: ctnetlink: ensure safe access to master conntrack - -Holding reference on the expectation is not sufficient, the master -conntrack object can just go away, making exp->master invalid. - -To access exp->master safely: - -- Grab the nf_conntrack_expect_lock, this gets serialized with - clean_from_lists() which also holds this lock when the master - conntrack goes away. - -- Hold reference on master conntrack via nf_conntrack_find_get(). - Not so easy since the master tuple to look up for the master conntrack - is not available in the existing problematic paths. - -This patch goes for extending the nf_conntrack_expect_lock section -to address this issue for simplicity, in the cases that are described -below this is just slightly extending the lock section. - -The add expectation command already holds a reference to the master -conntrack from ctnetlink_create_expect(). - -However, the delete expectation command needs to grab the spinlock -before looking up for the expectation. Expand the existing spinlock -section to address this to cover the expectation lookup. Note that, -the nf_ct_expect_iterate_net() calls already grabs the spinlock while -iterating over the expectation table, which is correct. - -The get expectation command needs to grab the spinlock to ensure master -conntrack does not go away. This also expands the existing spinlock -section to cover the expectation lookup too. I needed to move the -netlink skb allocation out of the spinlock to keep it GFP_KERNEL. - -For the expectation events, the IPEXP_DESTROY event is already delivered -under the spinlock, just move the delivery of IPEXP_NEW under the -spinlock too because the master conntrack event cache is reached through -exp->master. - -While at it, add lockdep notations to help identify what codepaths need -to grab the spinlock. - -Signed-off-by: Florian Westphal -Signed-off-by: Pablo Neira Ayuso - -diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h -index 3384859a8921..8883575adcc1 100644 ---- a/include/net/netfilter/nf_conntrack_core.h -+++ b/include/net/netfilter/nf_conntrack_core.h -@@ -83,6 +83,11 @@ void nf_conntrack_lock(spinlock_t *lock); - - extern spinlock_t nf_conntrack_expect_lock; - -+static inline void lockdep_nfct_expect_lock_held(void) -+{ -+ lockdep_assert_held(&nf_conntrack_expect_lock); -+} -+ - /* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */ - - static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout) -diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c -index 81baf2082604..9df159448b89 100644 ---- a/net/netfilter/nf_conntrack_ecache.c -+++ b/net/netfilter/nf_conntrack_ecache.c -@@ -247,6 +247,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, - struct nf_ct_event_notifier *notify; - struct nf_conntrack_ecache *e; - -+ lockdep_nfct_expect_lock_held(); -+ - rcu_read_lock(); - notify = rcu_dereference(net->ct.nf_conntrack_event_cb); - if (!notify) -diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c -index 64977db12b1d..1cbe5f1108c2 100644 ---- a/net/netfilter/nf_conntrack_expect.c -+++ b/net/netfilter/nf_conntrack_expect.c -@@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, - struct net *net = nf_ct_exp_net(exp); - struct nf_conntrack_net *cnet; - -+ lockdep_nfct_expect_lock_held(); - WARN_ON(!master_help); - WARN_ON(timer_pending(&exp->timeout)); - -@@ -118,6 +119,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, - - bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) - { -+ lockdep_nfct_expect_lock_held(); -+ - if (timer_delete(&exp->timeout)) { - nf_ct_unlink_expect(exp); - nf_ct_expect_put(exp); -@@ -177,6 +180,8 @@ nf_ct_find_expectation(struct net *net, - struct nf_conntrack_expect *i, *exp = NULL; - unsigned int h; - -+ lockdep_nfct_expect_lock_held(); -+ - if (!cnet->expect_count) - return NULL; - -@@ -454,6 +459,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, - unsigned int h; - int ret = 0; - -+ lockdep_nfct_expect_lock_held(); -+ - if (!master_help) { - ret = -ESHUTDOWN; - goto out; -@@ -510,8 +517,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, - - nf_ct_expect_insert(expect); - -- spin_unlock_bh(&nf_conntrack_expect_lock); - nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ - return 0; - out: - spin_unlock_bh(&nf_conntrack_expect_lock); -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index 8477c3736432..89540112d165 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -3355,31 +3355,37 @@ static int ctnetlink_get_expect(struct sk_buff *skb, - if (err < 0) - return err; - -+ skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -+ if (!skb2) -+ return -ENOMEM; -+ -+ spin_lock_bh(&nf_conntrack_expect_lock); - exp = nf_ct_expect_find_get(info->net, &zone, &tuple); -- if (!exp) -+ if (!exp) { -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ kfree_skb(skb2); - return -ENOENT; -+ } - - if (cda[CTA_EXPECT_ID]) { - __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); - - if (id != nf_expect_get_id(exp)) { - nf_ct_expect_put(exp); -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ kfree_skb(skb2); - return -ENOENT; - } - } - -- skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -- if (!skb2) { -- nf_ct_expect_put(exp); -- return -ENOMEM; -- } -- - rcu_read_lock(); - err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, - info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, - exp); - rcu_read_unlock(); - nf_ct_expect_put(exp); -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ - if (err <= 0) { - kfree_skb(skb2); - return -ENOMEM; -@@ -3426,22 +3432,26 @@ static int ctnetlink_del_expect(struct sk_buff *skb, - if (err < 0) - return err; - -+ spin_lock_bh(&nf_conntrack_expect_lock); -+ - /* bump usage count to 2 */ - exp = nf_ct_expect_find_get(info->net, &zone, &tuple); -- if (!exp) -+ if (!exp) { -+ spin_unlock_bh(&nf_conntrack_expect_lock); - return -ENOENT; -+ } - - if (cda[CTA_EXPECT_ID]) { - __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); - - if (id != nf_expect_get_id(exp)) { - nf_ct_expect_put(exp); -+ spin_unlock_bh(&nf_conntrack_expect_lock); - return -ENOENT; - } - } - - /* after list removal, usage count == 1 */ -- spin_lock_bh(&nf_conntrack_expect_lock); - if (timer_delete(&exp->timeout)) { - nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, - nlmsg_report(info->nlh)); --- -2.50.1 (Apple Git-155) - diff --git a/1224-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch b/1224-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch deleted file mode 100644 index 05cad53dd..000000000 --- a/1224-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 8b300f726640c48c3edfe9c453334dd801f4b74e Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Mon, 19 Jan 2026 12:30:42 +0100 -Subject: [PATCH] netfilter: xt_tcpmss: check remaining length before reading - optlen - -[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ] - -Quoting reporter: - In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads - op[i+1] directly without validating the remaining option length. - - If the last byte of the option field is not EOL/NOP (0/1), the code attempts - to index op[i+1]. In the case where i + 1 == optlen, this causes an - out-of-bounds read, accessing memory past the optlen boundary - (either reading beyond the stack buffer _opt or the - following payload). - -Reported-by: sungzii -Signed-off-by: Florian Westphal -Signed-off-by: Sasha Levin - -diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c -index 37704ab01799..0d32d4841cb3 100644 ---- a/net/netfilter/xt_tcpmss.c -+++ b/net/netfilter/xt_tcpmss.c -@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) - return (mssval >= info->mss_min && - mssval <= info->mss_max) ^ info->invert; - } -- if (op[i] < 2) -+ if (op[i] < 2 || i == optlen - 1) - i++; - else - i += op[i+1] ? : 1; --- -2.50.1 (Apple Git-155) - diff --git a/1225-net-fix-rcu-tasks-stall-in-threaded-busypoll.patch b/1225-net-fix-rcu-tasks-stall-in-threaded-busypoll.patch deleted file mode 100644 index b5effc706..000000000 --- a/1225-net-fix-rcu-tasks-stall-in-threaded-busypoll.patch +++ /dev/null @@ -1,120 +0,0 @@ -From 1a86a1f7d88996085934139fa4c063b6299a2dd3 Mon Sep 17 00:00:00 2001 -From: YiFei Zhu -Date: Fri, 27 Feb 2026 22:19:37 +0000 -Subject: [PATCH] net: Fix rcu_tasks stall in threaded busypoll - -I was debugging a NIC driver when I noticed that when I enable -threaded busypoll, bpftrace hangs when starting up. dmesg showed: - - rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 10658 jiffies old. - rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 40793 jiffies old. - rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 131273 jiffies old. - rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 402058 jiffies old. - INFO: rcu_tasks detected stalls on tasks: - 00000000769f52cd: .N nvcsw: 2/2 holdout: 1 idle_cpu: -1/64 - task:napi/eth2-8265 state:R running task stack:0 pid:48300 tgid:48300 ppid:2 task_flags:0x208040 flags:0x00004000 - Call Trace: - - ? napi_threaded_poll_loop+0x27c/0x2c0 - ? __pfx_napi_threaded_poll+0x10/0x10 - ? napi_threaded_poll+0x26/0x80 - ? kthread+0xfa/0x240 - ? __pfx_kthread+0x10/0x10 - ? ret_from_fork+0x31/0x50 - ? __pfx_kthread+0x10/0x10 - ? ret_from_fork_asm+0x1a/0x30 - - -The cause is that in threaded busypoll, the main loop is in -napi_threaded_poll rather than napi_threaded_poll_loop, where the -latter rarely iterates more than once within its loop. For -rcu_softirq_qs_periodic inside napi_threaded_poll_loop to report its -qs state, the last_qs must be 100ms behind, and this can't happen -because napi_threaded_poll_loop rarely iterates in threaded busypoll, -and each time napi_threaded_poll_loop is called last_qs is reset to -latest jiffies. - -This patch changes so that in threaded busypoll, last_qs is saved -in the outer napi_threaded_poll, and whether busy_poll_last_qs -is NULL indicates whether napi_threaded_poll_loop is called for -busypoll. This way last_qs would not reset to latest jiffies on -each invocation of napi_threaded_poll_loop. - -Fixes: c18d4b190a46 ("net: Extend NAPI threaded polling to allow kthread based busy polling") -Cc: stable@vger.kernel.org -Signed-off-by: YiFei Zhu -Reviewed-by: Samiullah Khawaja -Link: https://patch.msgid.link/20260227221937.1060857-1-zhuyifei@google.com -Signed-off-by: Paolo Abeni - -diff --git a/net/core/dev.c b/net/core/dev.c -index c1a9f7fdcffa..4af4cf2d63a4 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -7794,11 +7794,12 @@ static int napi_thread_wait(struct napi_struct *napi) - return -1; - } - --static void napi_threaded_poll_loop(struct napi_struct *napi, bool busy_poll) -+static void napi_threaded_poll_loop(struct napi_struct *napi, -+ unsigned long *busy_poll_last_qs) - { -+ unsigned long last_qs = busy_poll_last_qs ? *busy_poll_last_qs : jiffies; - struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx; - struct softnet_data *sd; -- unsigned long last_qs = jiffies; - - for (;;) { - bool repoll = false; -@@ -7827,12 +7828,12 @@ static void napi_threaded_poll_loop(struct napi_struct *napi, bool busy_poll) - /* When busy poll is enabled, the old packets are not flushed in - * napi_complete_done. So flush them here. - */ -- if (busy_poll) -+ if (busy_poll_last_qs) - gro_flush_normal(&napi->gro, HZ >= 1000); - local_bh_enable(); - - /* Call cond_resched here to avoid watchdog warnings. */ -- if (repoll || busy_poll) { -+ if (repoll || busy_poll_last_qs) { - rcu_softirq_qs_periodic(last_qs); - cond_resched(); - } -@@ -7840,11 +7841,15 @@ static void napi_threaded_poll_loop(struct napi_struct *napi, bool busy_poll) - if (!repoll) - break; - } -+ -+ if (busy_poll_last_qs) -+ *busy_poll_last_qs = last_qs; - } - - static int napi_threaded_poll(void *data) - { - struct napi_struct *napi = data; -+ unsigned long last_qs = jiffies; - bool want_busy_poll; - bool in_busy_poll; - unsigned long val; -@@ -7862,7 +7867,7 @@ static int napi_threaded_poll(void *data) - assign_bit(NAPI_STATE_IN_BUSY_POLL, &napi->state, - want_busy_poll); - -- napi_threaded_poll_loop(napi, want_busy_poll); -+ napi_threaded_poll_loop(napi, want_busy_poll ? &last_qs : NULL); - } - - return 0; -@@ -13175,7 +13180,7 @@ static void run_backlog_napi(unsigned int cpu) - { - struct softnet_data *sd = per_cpu_ptr(&softnet_data, cpu); - -- napi_threaded_poll_loop(&sd->backlog, false); -+ napi_threaded_poll_loop(&sd->backlog, NULL); - } - - static void backlog_napi_setup(unsigned int cpu) --- -2.50.1 (Apple Git-155) - diff --git a/1226-ice-use-netif-get-num-default-rss-queues.patch b/1226-ice-use-netif-get-num-default-rss-queues.patch deleted file mode 100644 index c4a68c7b2..000000000 --- a/1226-ice-use-netif-get-num-default-rss-queues.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 6f111820b89b5076991ab62d7833a48951a09d4c Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 7 May 2026 09:35:56 +0000 -Subject: [PATCH] ice: use netif_get_num_default_rss_queues() - -JIRA: https://redhat.atlassian.net/browse/RHEL-172305 - -commit ee13aa1a2c5a68943a730ddbde300ba11b84229c -Author: Michal Swiatkowski -Date: Thu Oct 30 09:30:53 2025 +0100 - - ice: use netif_get_num_default_rss_queues() - - On some high-core systems (like AMD EPYC Bergamo, Intel Clearwater - Forest) loading ice driver with default values can lead to queue/irq - exhaustion. It will result in no additional resources for SR-IOV. - - In most cases there is no performance reason for more than half - num_cpus(). Limit the default value to it using generic - netif_get_num_default_rss_queues(). - - Still, using ethtool the number of queues can be changed up to - num_online_cpus(). It can be done by calling: - $ethtool -L ethX combined $(nproc) - - This change affects only the default queue amount. - - Reviewed-by: Aleksandr Loktionov - Signed-off-by: Michal Swiatkowski - Tested-by: Rafal Romanowski - Signed-off-by: Tony Nguyen - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/ice/ice_irq.c b/drivers/net/ethernet/intel/ice/ice_irq.c -index 30801fd375f0..1d9b2d646474 100644 ---- a/drivers/net/ethernet/intel/ice/ice_irq.c -+++ b/drivers/net/ethernet/intel/ice/ice_irq.c -@@ -106,9 +106,10 @@ static struct ice_irq_entry *ice_get_irq_res(struct ice_pf *pf, - #define ICE_RDMA_AEQ_MSIX 1 - static int ice_get_default_msix_amount(struct ice_pf *pf) - { -- return ICE_MIN_LAN_OICR_MSIX + num_online_cpus() + -+ return ICE_MIN_LAN_OICR_MSIX + netif_get_num_default_rss_queues() + - (test_bit(ICE_FLAG_FD_ENA, pf->flags) ? ICE_FDIR_MSIX : 0) + -- (ice_is_rdma_ena(pf) ? num_online_cpus() + ICE_RDMA_AEQ_MSIX : 0); -+ (ice_is_rdma_ena(pf) ? netif_get_num_default_rss_queues() + -+ ICE_RDMA_AEQ_MSIX : 0); - } - - /** -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index 32c2f4c315c7..c8e463e73426 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -155,12 +155,14 @@ static void ice_vsi_set_num_desc(struct ice_vsi *vsi) - - static u16 ice_get_rxq_count(struct ice_pf *pf) - { -- return min(ice_get_avail_rxq_count(pf), num_online_cpus()); -+ return min(ice_get_avail_rxq_count(pf), -+ netif_get_num_default_rss_queues()); - } - - static u16 ice_get_txq_count(struct ice_pf *pf) - { -- return min(ice_get_avail_txq_count(pf), num_online_cpus()); -+ return min(ice_get_avail_txq_count(pf), -+ netif_get_num_default_rss_queues()); - } - - /** -@@ -909,13 +911,15 @@ static void ice_vsi_set_rss_params(struct ice_vsi *vsi) - if (vsi->type == ICE_VSI_CHNL) - vsi->rss_size = min_t(u16, vsi->num_rxq, max_rss_size); - else -- vsi->rss_size = min_t(u16, num_online_cpus(), -+ vsi->rss_size = min_t(u16, -+ netif_get_num_default_rss_queues(), - max_rss_size); - vsi->rss_lut_type = ICE_LUT_PF; - break; - case ICE_VSI_SF: - vsi->rss_table_size = ICE_LUT_VSI_SIZE; -- vsi->rss_size = min_t(u16, num_online_cpus(), max_rss_size); -+ vsi->rss_size = min_t(u16, netif_get_num_default_rss_queues(), -+ max_rss_size); - vsi->rss_lut_type = ICE_LUT_VSI; - break; - case ICE_VSI_VF: --- -2.50.1 (Apple Git-155) - diff --git a/1227-ice-set-max-queues-in-alloc-etherdev-mqs.patch b/1227-ice-set-max-queues-in-alloc-etherdev-mqs.patch deleted file mode 100644 index 4eb6839ea..000000000 --- a/1227-ice-set-max-queues-in-alloc-etherdev-mqs.patch +++ /dev/null @@ -1,128 +0,0 @@ -From 7e7d215f3f0eb53e12f2374ecc7cfe68abda3463 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 7 May 2026 09:35:57 +0000 -Subject: [PATCH] ice: set max queues in alloc_etherdev_mqs() - -JIRA: https://redhat.atlassian.net/browse/RHEL-172305 - -commit c7fcd269e1e07b2aa4bb37ffce7543c340796433 -Author: Michal Swiatkowski -Date: Mon Feb 23 13:51:57 2026 +0100 - - ice: set max queues in alloc_etherdev_mqs() - - When allocating netdevice using alloc_etherdev_mqs() the maximum - supported queues number should be passed. The vsi->alloc_txq/rxq is - storing current number of queues, not the maximum ones. - - Use the same function for getting max Tx and Rx queues which is used - during ethtool -l call to set maximum number of queues during netdev - allocation. - - Reproduction steps: - $ethtool -l $pf # says current 16, max 64 - $ethtool -S $pf # fine - $ethtool -L $pf combined 40 # crash - - [491187.472594] Call Trace: - [491187.472829] - [491187.473067] netif_set_xps_queue+0x26/0x40 - [491187.473305] ice_vsi_cfg_txq+0x265/0x3d0 [ice] - [491187.473619] ice_vsi_cfg_lan_txqs+0x68/0xa0 [ice] - [491187.473918] ice_vsi_cfg_lan+0x2b/0xa0 [ice] - [491187.474202] ice_vsi_open+0x71/0x170 [ice] - [491187.474484] ice_vsi_recfg_qs+0x17f/0x230 [ice] - [491187.474759] ? dev_get_min_mp_channel_count+0xab/0xd0 - [491187.474987] ice_set_channels+0x185/0x3d0 [ice] - [491187.475278] ethnl_set_channels+0x26f/0x340 - - Fixes: ee13aa1a2c5a ("ice: use netif_get_num_default_rss_queues()") - Reviewed-by: Przemek Kitszel - Signed-off-by: Michal Swiatkowski - Reviewed-by: Simon Horman - Reviewed-by: Paul Menzel - Tested-by: Alexander Nowlin - Signed-off-by: Tony Nguyen - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h -index 00f75d87c73f..ae1ebf507f29 100644 ---- a/drivers/net/ethernet/intel/ice/ice.h -+++ b/drivers/net/ethernet/intel/ice/ice.h -@@ -839,6 +839,28 @@ static inline void ice_tx_xsk_pool(struct ice_vsi *vsi, u16 qid) - WRITE_ONCE(ring->xsk_pool, ice_get_xp_from_qid(vsi, qid)); - } - -+/** -+ * ice_get_max_txq - return the maximum number of Tx queues for in a PF -+ * @pf: PF structure -+ * -+ * Return: maximum number of Tx queues -+ */ -+static inline int ice_get_max_txq(struct ice_pf *pf) -+{ -+ return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_txq); -+} -+ -+/** -+ * ice_get_max_rxq - return the maximum number of Rx queues for in a PF -+ * @pf: PF structure -+ * -+ * Return: maximum number of Rx queues -+ */ -+static inline int ice_get_max_rxq(struct ice_pf *pf) -+{ -+ return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_rxq); -+} -+ - /** - * ice_get_main_vsi - Get the PF VSI - * @pf: PF instance -diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c -index e9f2618950c8..33c818226565 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ethtool.c -+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c -@@ -3756,24 +3756,6 @@ ice_get_ts_info(struct net_device *dev, struct kernel_ethtool_ts_info *info) - return 0; - } - --/** -- * ice_get_max_txq - return the maximum number of Tx queues for in a PF -- * @pf: PF structure -- */ --static int ice_get_max_txq(struct ice_pf *pf) --{ -- return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_txq); --} -- --/** -- * ice_get_max_rxq - return the maximum number of Rx queues for in a PF -- * @pf: PF structure -- */ --static int ice_get_max_rxq(struct ice_pf *pf) --{ -- return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_rxq); --} -- - /** - * ice_get_combined_cnt - return the current number of combined channels - * @vsi: PF VSI pointer -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index 27c519918fb2..c77c95e4f5c6 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -4699,8 +4699,8 @@ static int ice_cfg_netdev(struct ice_vsi *vsi) - struct net_device *netdev; - u8 mac_addr[ETH_ALEN]; - -- netdev = alloc_etherdev_mqs(sizeof(*np), vsi->alloc_txq, -- vsi->alloc_rxq); -+ netdev = alloc_etherdev_mqs(sizeof(*np), ice_get_max_txq(vsi->back), -+ ice_get_max_rxq(vsi->back)); - if (!netdev) - return -ENOMEM; - --- -2.50.1 (Apple Git-155) - diff --git a/1228-anon-inode-use-a-proper-mode-internally.patch b/1228-anon-inode-use-a-proper-mode-internally.patch deleted file mode 100644 index 3b4e1049f..000000000 --- a/1228-anon-inode-use-a-proper-mode-internally.patch +++ /dev/null @@ -1,132 +0,0 @@ -From ad4c21b7a2a9f224f45989127541560ccf7cdf53 Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 10:39:34 -0400 -Subject: [PATCH] anon_inode: use a proper mode internally - -JIRA: https://issues.redhat.com/browse/RHEL-171616 -Conflicts: - * fs/anon_inodes.c: minor context difference due to RHEL-10 missing unrelated - commit c1feab95e0b2 ("add a string-to-qstr constructor") - * fs/internal.h: minor context difference due to RHEL-10 missing unrelated - commits da06e3c51794 ("fs: don't needlessly acquire f_lock") and - 37c4a9590e1e ("statmount: allow to retrieve idmappings") - -commit cfd86ef7e8e7b9e015707e46479a6b1de141eed0 -Author: Christian Brauner -Date: Mon Apr 7 11:54:15 2025 +0200 - - anon_inode: use a proper mode internally - - This allows the VFS to not trip over anonymous inodes and we can add - asserts based on the mode into the vfs. When we report it to userspace - we can simply hide the mode to avoid regressions. I've audited all - direct callers of alloc_anon_inode() and only secretmen overrides i_mode - and i_op inode operations but it already uses a regular file. - - Link: https://lore.kernel.org/20250407-work-anon_inode-v1-1-53a44c20d44e@kernel.org - Fixes: af153bb63a336 ("vfs: catch invalid modes in may_open()") - Reviewed-by: Jeff Layton - Cc: stable@vger.kernel.org # all LTS kernels - Reported-by: syzbot+5d8e79d323a13aa0b248@syzkaller.appspotmail.com - Closes: https://lore.kernel.org/all/67ed3fb3.050a0220.14623d.0009.GAE@google.com - Signed-off-by: Christian Brauner - -Signed-off-by: Rafael Aquini - -diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c -index 5a070be69922..7c07b22c1d47 100644 ---- a/fs/anon_inodes.c -+++ b/fs/anon_inodes.c -@@ -24,9 +24,43 @@ - - #include - -+#include "internal.h" -+ - static struct vfsmount *anon_inode_mnt __ro_after_init; - static struct inode *anon_inode_inode __ro_after_init; - -+/* -+ * User space expects anonymous inodes to have no file type in st_mode. -+ * -+ * In particular, 'lsof' has this legacy logic: -+ * -+ * type = s->st_mode & S_IFMT; -+ * switch (type) { -+ * ... -+ * case 0: -+ * if (!strcmp(p, "anon_inode")) -+ * Lf->ntype = Ntype = N_ANON_INODE; -+ * -+ * to detect our old anon_inode logic. -+ * -+ * Rather than mess with our internal sane inode data, just fix it -+ * up here in getattr() by masking off the format bits. -+ */ -+int anon_inode_getattr(struct mnt_idmap *idmap, const struct path *path, -+ struct kstat *stat, u32 request_mask, -+ unsigned int query_flags) -+{ -+ struct inode *inode = d_inode(path->dentry); -+ -+ generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat); -+ stat->mode &= ~S_IFMT; -+ return 0; -+} -+ -+static const struct inode_operations anon_inode_operations = { -+ .getattr = anon_inode_getattr, -+}; -+ - /* - * anon_inodefs_dname() is called from d_path(). - */ -@@ -78,6 +112,7 @@ struct inode *anon_inode_make_secure_inode(struct super_block *sb, const char *n - if (IS_ERR(inode)) - return inode; - inode->i_flags &= ~S_PRIVATE; -+ inode->i_op = &anon_inode_operations; - error = security_inode_init_security_anon(inode, &qname, context_inode); - if (error) { - iput(inode); -@@ -326,6 +361,7 @@ static int __init anon_inode_init(void) - anon_inode_inode = alloc_anon_inode(anon_inode_mnt->mnt_sb); - if (IS_ERR(anon_inode_inode)) - panic("anon_inode_init() inode allocation failed (%ld)\n", PTR_ERR(anon_inode_inode)); -+ anon_inode_inode->i_op = &anon_inode_operations; - - return 0; - } -diff --git a/fs/internal.h b/fs/internal.h -index b555366c7974..afa926ccee7e 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -338,3 +338,6 @@ static inline bool path_mounted(const struct path *path) - return path->mnt->mnt_root == path->dentry; - } - void file_f_owner_release(struct file *file); -+int anon_inode_getattr(struct mnt_idmap *idmap, const struct path *path, -+ struct kstat *stat, u32 request_mask, -+ unsigned int query_flags); -diff --git a/fs/libfs.c b/fs/libfs.c -index 7fd661bb935f..4e9de5aa4d7f 100644 ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -1651,7 +1651,13 @@ struct inode *alloc_anon_inode(struct super_block *s) - * that it already _is_ on the dirty list. - */ - inode->i_state = I_DIRTY; -- inode->i_mode = S_IRUSR | S_IWUSR; -+ /* -+ * Historically anonymous inodes didn't have a type at all and -+ * userspace has come to rely on this. Internally they're just -+ * regular files but S_IFREG is masked off when reporting -+ * information to userspace. -+ */ -+ inode->i_mode = S_IFREG | S_IRUSR | S_IWUSR; - inode->i_uid = current_fsuid(); - inode->i_gid = current_fsgid(); - inode->i_flags |= S_PRIVATE; --- -2.50.1 (Apple Git-155) - diff --git a/1229-pidfs-use-anon-inode-getattr.patch b/1229-pidfs-use-anon-inode-getattr.patch deleted file mode 100644 index 0540b9b24..000000000 --- a/1229-pidfs-use-anon-inode-getattr.patch +++ /dev/null @@ -1,65 +0,0 @@ -From a858622b427be763192f8557cc9cafa3076d845b Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 10:39:35 -0400 -Subject: [PATCH] pidfs: use anon_inode_getattr() - -JIRA: https://issues.redhat.com/browse/RHEL-171616 - -commit 37e62dafbfaba467975b0a8c11b9ffaa678f8559 -Author: Christian Brauner -Date: Mon Apr 7 11:54:16 2025 +0200 - - pidfs: use anon_inode_getattr() - - So far pidfs did use it's own version. Just use the generic version. We - use our own wrappers because we're going to be implementing our own - retrieval properties soon. - - Link: https://lore.kernel.org/20250407-work-anon_inode-v1-2-53a44c20d44e@kernel.org - Reviewed-by: Jeff Layton - Signed-off-by: Christian Brauner - -Signed-off-by: Rafael Aquini - -diff --git a/fs/pidfs.c b/fs/pidfs.c -index 4a76e19ba7ed..27d6d9328b57 100644 ---- a/fs/pidfs.c -+++ b/fs/pidfs.c -@@ -571,33 +571,11 @@ static int pidfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - return -EOPNOTSUPP; - } - -- --/* -- * User space expects pidfs inodes to have no file type in st_mode. -- * -- * In particular, 'lsof' has this legacy logic: -- * -- * type = s->st_mode & S_IFMT; -- * switch (type) { -- * ... -- * case 0: -- * if (!strcmp(p, "anon_inode")) -- * Lf->ntype = Ntype = N_ANON_INODE; -- * -- * to detect our old anon_inode logic. -- * -- * Rather than mess with our internal sane inode data, just fix it -- * up here in getattr() by masking off the format bits. -- */ - static int pidfs_getattr(struct mnt_idmap *idmap, const struct path *path, - struct kstat *stat, u32 request_mask, - unsigned int query_flags) - { -- struct inode *inode = d_inode(path->dentry); -- -- generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat); -- stat->mode &= ~S_IFMT; -- return 0; -+ return anon_inode_getattr(idmap, path, stat, request_mask, query_flags); - } - - static const struct inode_operations pidfs_inode_operations = { --- -2.50.1 (Apple Git-155) - diff --git a/1230-anon-inode-explicitly-block-setattr.patch b/1230-anon-inode-explicitly-block-setattr.patch deleted file mode 100644 index 8b2dbda2f..000000000 --- a/1230-anon-inode-explicitly-block-setattr.patch +++ /dev/null @@ -1,93 +0,0 @@ -From b71e05c047c7f227e96201fa4eb9e4929ac96deb Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 10:39:35 -0400 -Subject: [PATCH] anon_inode: explicitly block ->setattr() - -JIRA: https://issues.redhat.com/browse/RHEL-171616 - -commit 22bdf3d6581af6d06ed8a46c6835648421cca0ea -Author: Christian Brauner -Date: Mon Apr 7 11:54:17 2025 +0200 - - anon_inode: explicitly block ->setattr() - - It is currently possible to change the mode and owner of the single - anonymous inode in the kernel: - - int main(int argc, char *argv[]) - { - int ret, sfd; - sigset_t mask; - struct signalfd_siginfo fdsi; - - sigemptyset(&mask); - sigaddset(&mask, SIGINT); - sigaddset(&mask, SIGQUIT); - - ret = sigprocmask(SIG_BLOCK, &mask, NULL); - if (ret < 0) - _exit(1); - - sfd = signalfd(-1, &mask, 0); - if (sfd < 0) - _exit(2); - - ret = fchown(sfd, 5555, 5555); - if (ret < 0) - _exit(3); - - ret = fchmod(sfd, 0777); - if (ret < 0) - _exit(3); - - _exit(4); - } - - This is a bug. It's not really a meaningful one because anonymous inodes - don't really figure into path lookup and they cannot be reopened via - /proc//fd/ and can't be used for lookup itself. So they can - only ever serve as direct references. - - But it is still completely bogus to allow the mode and ownership or any - of the properties of the anonymous inode to be changed. Block this! - - Link: https://lore.kernel.org/20250407-work-anon_inode-v1-3-53a44c20d44e@kernel.org - Reviewed-by: Jeff Layton - Cc: stable@vger.kernel.org # all LTS kernels - Signed-off-by: Christian Brauner - -Signed-off-by: Rafael Aquini - -diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c -index 7c07b22c1d47..344355616d3a 100644 ---- a/fs/anon_inodes.c -+++ b/fs/anon_inodes.c -@@ -57,8 +57,15 @@ int anon_inode_getattr(struct mnt_idmap *idmap, const struct path *path, - return 0; - } - -+int anon_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry, -+ struct iattr *attr) -+{ -+ return -EOPNOTSUPP; -+} -+ - static const struct inode_operations anon_inode_operations = { - .getattr = anon_inode_getattr, -+ .setattr = anon_inode_setattr, - }; - - /* -diff --git a/fs/internal.h b/fs/internal.h -index afa926ccee7e..dd13dfde4adb 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -341,3 +341,5 @@ void file_f_owner_release(struct file *file); - int anon_inode_getattr(struct mnt_idmap *idmap, const struct path *path, - struct kstat *stat, u32 request_mask, - unsigned int query_flags); -+int anon_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry, -+ struct iattr *attr); --- -2.50.1 (Apple Git-155) - diff --git a/1231-pidfs-use-anon-inode-setattr.patch b/1231-pidfs-use-anon-inode-setattr.patch deleted file mode 100644 index bf4d87918..000000000 --- a/1231-pidfs-use-anon-inode-setattr.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 28d6f8e1f875929ce59405c0b04fa0a5ec700a4e Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 10:39:35 -0400 -Subject: [PATCH] pidfs: use anon_inode_setattr() - -JIRA: https://issues.redhat.com/browse/RHEL-171616 - -commit c83b9024966090fe0df92aab16975b8d00089e1f -Author: Christian Brauner -Date: Mon Apr 7 11:54:18 2025 +0200 - - pidfs: use anon_inode_setattr() - - So far pidfs did use it's own version. Just use the generic version. - We use our own wrappers because we're going to be implementing - properties soon. - - Link: https://lore.kernel.org/20250407-work-anon_inode-v1-4-53a44c20d44e@kernel.org - Reviewed-by: Jeff Layton - Signed-off-by: Christian Brauner - -Signed-off-by: Rafael Aquini - -diff --git a/fs/pidfs.c b/fs/pidfs.c -index 27d6d9328b57..d6c0ed79ea24 100644 ---- a/fs/pidfs.c -+++ b/fs/pidfs.c -@@ -568,7 +568,7 @@ static struct vfsmount *pidfs_mnt __ro_after_init; - static int pidfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, - struct iattr *attr) - { -- return -EOPNOTSUPP; -+ return anon_inode_setattr(idmap, dentry, attr); - } - - static int pidfs_getattr(struct mnt_idmap *idmap, const struct path *path, --- -2.50.1 (Apple Git-155) - diff --git a/1232-anon-inode-raise-sb-i-nodev-and-sb-i-noexec.patch b/1232-anon-inode-raise-sb-i-nodev-and-sb-i-noexec.patch deleted file mode 100644 index dda4c52f5..000000000 --- a/1232-anon-inode-raise-sb-i-nodev-and-sb-i-noexec.patch +++ /dev/null @@ -1,51 +0,0 @@ -From d4ba40dd8868449ba10ac26798718c4e0336a241 Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 10:39:36 -0400 -Subject: [PATCH] anon_inode: raise SB_I_NODEV and SB_I_NOEXEC - -JIRA: https://issues.redhat.com/browse/RHEL-171616 - -commit 1ed95281c0c77dbb1540f9855cd3c5f19900f7a5 -Author: Christian Brauner -Date: Mon Apr 7 11:54:19 2025 +0200 - - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC - - It isn't possible to execute anonymous inodes because they cannot be - opened in any way after they have been created. This includes execution: - - execveat(fd_anon_inode, "", NULL, NULL, AT_EMPTY_PATH) - - Anonymous inodes have inode->f_op set to no_open_fops which sets - no_open() which returns ENXIO. That means any call to do_dentry_open() - which is the endpoint of the do_open_execat() will fail. There's no - chance to execute an anonymous inode. Unless a given subsystem overrides - it ofc. - - However, we should still harden this and raise SB_I_NODEV and - SB_I_NOEXEC on the superblock itself so that no one gets any creative - ideas. - - Link: https://lore.kernel.org/20250407-work-anon_inode-v1-5-53a44c20d44e@kernel.org - Reviewed-by: Jeff Layton - Cc: stable@vger.kernel.org # all LTS kernels - Signed-off-by: Christian Brauner - -Signed-off-by: Rafael Aquini - -diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c -index 344355616d3a..b3445f5c8544 100644 ---- a/fs/anon_inodes.c -+++ b/fs/anon_inodes.c -@@ -86,6 +86,8 @@ static int anon_inodefs_init_fs_context(struct fs_context *fc) - struct pseudo_fs_context *ctx = init_pseudo(fc, ANON_INODE_FS_MAGIC); - if (!ctx) - return -ENOMEM; -+ fc->s_iflags |= SB_I_NOEXEC; -+ fc->s_iflags |= SB_I_NODEV; - ctx->dops = &anon_inodefs_dentry_operations; - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1233-fs-add-s-anon-inode.patch b/1233-fs-add-s-anon-inode.patch deleted file mode 100644 index e274854a3..000000000 --- a/1233-fs-add-s-anon-inode.patch +++ /dev/null @@ -1,170 +0,0 @@ -From 0e6f0c4069e34ae66ce960879b5a88ae0ce9aab8 Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 10:39:37 -0400 -Subject: [PATCH] fs: add S_ANON_INODE - -JIRA: https://issues.redhat.com/browse/RHEL-171616 -Conflicts: - * mm/readahead.c: in order to reduce differences and make the porting cleaner - we are folding the hunk from 6348be02eead ("fdget(), trivial conversions") - -commit 19bbfe7b5fcc04d8711e8e1352acc77c1a5c3955 -Author: Christian Brauner -Date: Mon Apr 21 10:27:40 2025 +0200 - - fs: add S_ANON_INODE - - This makes it easy to detect proper anonymous inodes and to ensure that - we can detect them in codepaths such as readahead(). - - Readahead on anonymous inodes didn't work because they didn't have a - proper mode. Now that they have we need to retain EINVAL being returned - otherwise LTP will fail. - - We also need to ensure that ioctls aren't simply fired like they are for - regular files so things like inotify inodes continue to correctly call - their own ioctl handlers as in [1]. - - Reported-by: Xilin Wu - Link: https://lore.kernel.org/3A9139D5CD543962+89831381-31b9-4392-87ec-a84a5b3507d8@radxa.com [1] - Link: https://lore.kernel.org/7a1a7076-ff6b-4cb0-94e7-7218a0a44028@sirena.org.uk - Signed-off-by: Christian Brauner - -Signed-off-by: Rafael Aquini - -diff --git a/fs/ioctl.c b/fs/ioctl.c -index 6e0c954388d4..4dbd5627af8f 100644 ---- a/fs/ioctl.c -+++ b/fs/ioctl.c -@@ -822,7 +822,8 @@ static int do_vfs_ioctl(struct file *filp, unsigned int fd, - return ioctl_fioasync(fd, filp, argp); - - case FIOQSIZE: -- if (S_ISDIR(inode->i_mode) || S_ISREG(inode->i_mode) || -+ if (S_ISDIR(inode->i_mode) || -+ (S_ISREG(inode->i_mode) && !IS_ANON_FILE(inode)) || - S_ISLNK(inode->i_mode)) { - loff_t res = inode_get_bytes(inode); - return copy_to_user(argp, &res, sizeof(res)) ? -@@ -857,7 +858,7 @@ static int do_vfs_ioctl(struct file *filp, unsigned int fd, - return ioctl_file_dedupe_range(filp, argp); - - case FIONREAD: -- if (!S_ISREG(inode->i_mode)) -+ if (!S_ISREG(inode->i_mode) || IS_ANON_FILE(inode)) - return vfs_ioctl(filp, cmd, arg); - - return put_user(i_size_read(inode) - filp->f_pos, -@@ -882,7 +883,7 @@ static int do_vfs_ioctl(struct file *filp, unsigned int fd, - return ioctl_get_fs_sysfs_path(filp, argp); - - default: -- if (S_ISREG(inode->i_mode)) -+ if (S_ISREG(inode->i_mode) && !IS_ANON_FILE(inode)) - return file_ioctl(filp, cmd, argp); - break; - } -diff --git a/fs/libfs.c b/fs/libfs.c -index 4e9de5aa4d7f..c4a305967619 100644 ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -1660,7 +1660,7 @@ struct inode *alloc_anon_inode(struct super_block *s) - inode->i_mode = S_IFREG | S_IRUSR | S_IWUSR; - inode->i_uid = current_fsuid(); - inode->i_gid = current_fsgid(); -- inode->i_flags |= S_PRIVATE; -+ inode->i_flags |= S_PRIVATE | S_ANON_INODE; - simple_inode_init_ts(inode); - return inode; - } -diff --git a/fs/pidfs.c b/fs/pidfs.c -index d6c0ed79ea24..7e10fac8e623 100644 ---- a/fs/pidfs.c -+++ b/fs/pidfs.c -@@ -804,7 +804,7 @@ static int pidfs_init_inode(struct inode *inode, void *data) - const struct pid *pid = data; - - inode->i_private = data; -- inode->i_flags |= S_PRIVATE; -+ inode->i_flags |= S_PRIVATE | S_ANON_INODE; - inode->i_mode |= S_IRWXU; - inode->i_op = &pidfs_inode_operations; - inode->i_fop = &pidfs_file_operations; -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 3e14c4eb64f4..fa47510429f0 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2319,6 +2319,7 @@ struct super_operations { - #define S_CASEFOLD (1 << 15) /* Casefolded file */ - #define S_VERITY (1 << 16) /* Verity file (using fs/verity/) */ - #define S_KERNEL_FILE (1 << 17) /* File is in use by the kernel (eg. fs/cachefiles) */ -+#define S_ANON_INODE (1 << 19) /* Inode is an anonymous inode */ - - /* - * Note that nosuid etc flags are inode-specific: setting some file-system -@@ -2375,6 +2376,7 @@ static inline bool sb_rdonly(const struct super_block *sb) { return sb->s_flags - - #define IS_WHITEOUT(inode) (S_ISCHR(inode->i_mode) && \ - (inode)->i_rdev == WHITEOUT_DEV) -+#define IS_ANON_FILE(inode) ((inode)->i_flags & S_ANON_INODE) - - static inline bool HAS_UNMAPPED_ID(struct mnt_idmap *idmap, - struct inode *inode) -diff --git a/mm/readahead.c b/mm/readahead.c -index 2dbe5993b6aa..a3547f923249 100644 ---- a/mm/readahead.c -+++ b/mm/readahead.c -@@ -678,29 +678,34 @@ EXPORT_SYMBOL_GPL(page_cache_async_ra); - - ssize_t ksys_readahead(int fd, loff_t offset, size_t count) - { -- ssize_t ret; -- struct fd f; -+ struct file *file; -+ const struct inode *inode; - -- ret = -EBADF; -- f = fdget(fd); -- if (!fd_file(f) || !(fd_file(f)->f_mode & FMODE_READ)) -- goto out; -+ CLASS(fd, f)(fd); -+ if (fd_empty(f)) -+ return -EBADF; -+ -+ file = fd_file(f); -+ if (!(file->f_mode & FMODE_READ)) -+ return -EBADF; - - /* - * The readahead() syscall is intended to run only on files - * that can execute readahead. If readahead is not possible - * on this file, then we must return -EINVAL. - */ -- ret = -EINVAL; -- if (!fd_file(f)->f_mapping || !fd_file(f)->f_mapping->a_ops || -- (!S_ISREG(file_inode(fd_file(f))->i_mode) && -- !S_ISBLK(file_inode(fd_file(f))->i_mode))) -- goto out; -- -- ret = vfs_fadvise(fd_file(f), offset, count, POSIX_FADV_WILLNEED); --out: -- fdput(f); -- return ret; -+ if (!file->f_mapping) -+ return -EINVAL; -+ if (!file->f_mapping->a_ops) -+ return -EINVAL; -+ -+ inode = file_inode(file); -+ if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) -+ return -EINVAL; -+ if (IS_ANON_FILE(inode)) -+ return -EINVAL; -+ -+ return vfs_fadvise(fd_file(f), offset, count, POSIX_FADV_WILLNEED); - } - - SYSCALL_DEFINE3(readahead, int, fd, loff_t, offset, size_t, count) --- -2.50.1 (Apple Git-155) - diff --git a/1234-mm-thp-deny-thp-for-files-on-anonymous-inodes.patch b/1234-mm-thp-deny-thp-for-files-on-anonymous-inodes.patch deleted file mode 100644 index ba850dda8..000000000 --- a/1234-mm-thp-deny-thp-for-files-on-anonymous-inodes.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 48e45ffbeff0fbb5ef475a31ae664106312862a6 Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 10:39:39 -0400 -Subject: [PATCH] mm: thp: deny THP for files on anonymous inodes - -JIRA: https://issues.redhat.com/browse/RHEL-171616 -CVE: CVE-2026-23375 - -commit dd085fe9a8ebfc5d10314c60452db38d2b75e609 -Author: Deepanshu Kartikey -Date: Sat Feb 14 05:45:35 2026 +0530 - - mm: thp: deny THP for files on anonymous inodes - - file_thp_enabled() incorrectly allows THP for files on anonymous inodes - (e.g. guest_memfd and secretmem). These files are created via - alloc_file_pseudo(), which does not call get_write_access() and leaves - inode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being - true, they appear as read-only regular files when - CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP - collapse. - - Anonymous inodes can never pass the inode_is_open_for_write() check - since their i_writecount is never incremented through the normal VFS - open path. The right thing to do is to exclude them from THP eligibility - altogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real - filesystem files (e.g. shared libraries), not for pseudo-filesystem - inodes. - - For guest_memfd, this allows khugepaged and MADV_COLLAPSE to create - large folios in the page cache via the collapse path, but the - guest_memfd fault handler does not support large folios. This triggers - WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping(). - - For secretmem, collapse_file() tries to copy page contents through the - direct map, but secretmem pages are removed from the direct map. This - can result in a kernel crash: - - BUG: unable to handle page fault for address: ffff88810284d000 - RIP: 0010:memcpy_orig+0x16/0x130 - Call Trace: - collapse_file - hpage_collapse_scan_file - madvise_collapse - - Secretmem is not affected by the crash on upstream as the memory failure - recovery handles the failed copy gracefully, but it still triggers - confusing false memory failure reports: - - Memory failure: 0x106d96f: recovery action for clean unevictable - LRU page: Recovered - - Check IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all - anonymous inode files. - - Link: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44 - Link: https://lore.kernel.org/linux-mm/CAEvNRgHegcz3ro35ixkDw39ES8=U6rs6S7iP0gkR9enr7HoGtA@mail.gmail.com - Link: https://lkml.kernel.org/r/20260214001535.435626-1-kartikey406@gmail.com - Fixes: 7fbb5e188248 ("mm: remove VM_EXEC requirement for THP eligibility") - Signed-off-by: Deepanshu Kartikey - Reported-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com - Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44 - Tested-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com - Tested-by: Lance Yang - Acked-by: David Hildenbrand (Arm) - Reviewed-by: Barry Song - Reviewed-by: Ackerley Tng - Tested-by: Ackerley Tng - Reviewed-by: Lorenzo Stoakes - Cc: Baolin Wang - Cc: Dev Jain - Cc: Fangrui Song - Cc: Liam Howlett - Cc: Nico Pache - Cc: Ryan Roberts - Cc: Yang Shi - Cc: Zi Yan - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Rafael Aquini - -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 832dafc300cd..3b996dedfeae 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -95,6 +95,9 @@ static inline bool file_thp_enabled(struct vm_area_struct *vma) - - inode = file_inode(vma->vm_file); - -+ if (IS_ANON_FILE(inode)) -+ return false; -+ - return !inode_is_open_for_write(inode) && S_ISREG(inode->i_mode); - } - --- -2.50.1 (Apple Git-155) - diff --git a/1235-dpaa2-switch-prevent-zero-size-ptr-dereference-when-num-ifs-.patch b/1235-dpaa2-switch-prevent-zero-size-ptr-dereference-when-num-ifs-.patch deleted file mode 100644 index 21655e85f..000000000 --- a/1235-dpaa2-switch-prevent-zero-size-ptr-dereference-when-num-ifs-.patch +++ /dev/null @@ -1,59 +0,0 @@ -From a62505231a34f83c11618b0922e5b09739252a2b Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 11 May 2026 19:40:32 +0000 -Subject: [PATCH] dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs - is zero - -JIRA: https://redhat.atlassian.net/browse/RHEL-174253 -CVE: CVE-2026-43205 - -commit ed48a84a72fefb20a82dd90a7caa7807e90c6f66 -Author: Junrui Luo -Date: Wed Jan 28 16:07:34 2026 +0800 - - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero - - The driver allocates arrays for ports, FDBs, and filter blocks using - kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the - device reports zero interfaces (either due to hardware configuration - or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) - instead of NULL. - - Later in dpaa2_switch_probe(), the NAPI initialization unconditionally - accesses ethsw->ports[0]->netdev, which attempts to dereference - ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic. - - Add a check to ensure num_ifs is greater than zero after retrieving - device attributes. This prevents the zero-sized allocations and - subsequent invalid pointer dereference. - - Reported-by: Yuhao Jiang - Reported-by: Junrui Luo - Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface") - Signed-off-by: Junrui Luo - Reviewed-by: Andrew Lunn - Link: https://patch.msgid.link/SYBPR01MB7881BEABA8DA896947962470AF91A@SYBPR01MB7881.ausprd01.prod.outlook.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -index a293b08f36d4..527c78f4d27d 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -@@ -3014,6 +3014,12 @@ static int dpaa2_switch_init(struct fsl_mc_device *sw_dev) - goto err_close; - } - -+ if (!ethsw->sw_attr.num_ifs) { -+ dev_err(dev, "DPSW device has no interfaces\n"); -+ err = -ENODEV; -+ goto err_close; -+ } -+ - err = dpsw_get_api_version(ethsw->mc_io, 0, - ðsw->major, - ðsw->minor); --- -2.50.1 (Apple Git-155) - diff --git a/1236-dpaa2-switch-validate-num-ifs-to-prevent-out-of-bounds-write.patch b/1236-dpaa2-switch-validate-num-ifs-to-prevent-out-of-bounds-write.patch deleted file mode 100644 index b666e803c..000000000 --- a/1236-dpaa2-switch-validate-num-ifs-to-prevent-out-of-bounds-write.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 6548cef4d0e49c99a72be88b236c36a486b38feb Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 11 May 2026 19:40:34 +0000 -Subject: [PATCH] dpaa2-switch: validate num_ifs to prevent out-of-bounds write - -JIRA: https://redhat.atlassian.net/browse/RHEL-174253 -CVE: CVE-2026-43205 - -commit 8a5752c6dcc085a3bfc78589925182e4e98468c5 -Author: Junrui Luo -Date: Tue Feb 24 19:05:56 2026 +0800 - - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - - The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() - but never validates it against DPSW_MAX_IF (64). This value controls - iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices - into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports - num_ifs >= 64, the loop can write past the array bounds. - - Add a bound check for num_ifs in dpaa2_switch_init(). - - dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port - num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all - ports match the flood filter, the loop fills all 64 slots and the control - interface write overflows by one entry. - - The check uses >= because num_ifs == DPSW_MAX_IF is also functionally - broken. - - build_if_id_bitmap() silently drops any ID >= 64: - if (id[i] < DPSW_MAX_IF) - bmap[id[i] / 64] |= ... - - Fixes: 539dda3c5d19 ("staging: dpaa2-switch: properly setup switching domains") - Signed-off-by: Junrui Luo - Reviewed-by: Ioana Ciornei - Link: https://patch.msgid.link/SYBPR01MB78812B47B7F0470B617C408AAF74A@SYBPR01MB7881.ausprd01.prod.outlook.com - Signed-off-by: Paolo Abeni - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -index 527c78f4d27d..2eb47789422e 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c -@@ -3020,6 +3020,13 @@ static int dpaa2_switch_init(struct fsl_mc_device *sw_dev) - goto err_close; - } - -+ if (ethsw->sw_attr.num_ifs >= DPSW_MAX_IF) { -+ dev_err(dev, "DPSW num_ifs %u exceeds max %u\n", -+ ethsw->sw_attr.num_ifs, DPSW_MAX_IF); -+ err = -EINVAL; -+ goto err_close; -+ } -+ - err = dpsw_get_api_version(ethsw->mc_io, 0, - ðsw->major, - ðsw->minor); --- -2.50.1 (Apple Git-155) - diff --git a/1237-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch b/1237-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch deleted file mode 100644 index a079ccfd1..000000000 --- a/1237-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 5ef3d81484dc39a21467dfa1f36da3ada378be74 Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Mon, 11 May 2026 16:41:59 -0400 -Subject: [PATCH] mm/page_alloc: clear page->private in free_pages_prepare() - -JIRA: https://issues.redhat.com/browse/RHEL-174757 -CVE: CVE-2026-43303 -Conflicts: - * minor context difference due to RHEL-10 missing upstream commit - 53fbef56e07d ("mm: introduce memdesc_flags_t") and its series. - -commit ac1ea219590c09572ed5992dc233bbf7bb70fef9 -Author: Mikhail Gavrilov -Date: Sat Feb 7 22:36:14 2026 +0500 - - mm/page_alloc: clear page->private in free_pages_prepare() - - Several subsystems (slub, shmem, ttm, etc.) use page->private but don't - clear it before freeing pages. When these pages are later allocated as - high-order pages and split via split_page(), tail pages retain stale - page->private values. - - This causes a use-after-free in the swap subsystem. The swap code uses - page->private to track swap count continuations, assuming freshly - allocated pages have page->private == 0. When stale values are present, - swap_count_continued() incorrectly assumes the continuation list is valid - and iterates over uninitialized page->lru containing LIST_POISON values, - causing a crash: - - KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] - RIP: 0010:__do_sys_swapoff+0x1151/0x1860 - - Fix this by clearing page->private in free_pages_prepare(), ensuring all - freed pages have clean state regardless of previous use. - - Link: https://lkml.kernel.org/r/20260207173615.146159-1-mikhail.v.gavrilov@gmail.com - Fixes: 3b8000ae185c ("mm/vmalloc: huge vmalloc backing pages should be split rather than compound") - Signed-off-by: Mikhail Gavrilov - Suggested-by: Zi Yan - Acked-by: Zi Yan - Acked-by: David Hildenbrand (Arm) - Reviewed-by: Vlastimil Babka - Cc: Brendan Jackman - Cc: Chris Li - Cc: Hugh Dickins - Cc: Johannes Weiner - Cc: Kairui Song - Cc: Matthew Wilcox (Oracle) - Cc: Michal Hocko - Cc: Nicholas Piggin - Cc: Suren Baghdasaryan - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Rafael Aquini - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 73a45cc33a86..72c979ea3121 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1135,6 +1135,7 @@ __always_inline bool free_pages_prepare(struct page *page, - - page_cpupid_reset_last(page); - page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP; -+ page->private = 0; - reset_page_owner(page, order); - page_table_check_free(page, order); - pgalloc_tag_sub(page, 1 << order); --- -2.50.1 (Apple Git-155) - diff --git a/1238-redhat-kernel-spec-template-disable-objtool-werror-for-gcov-.patch b/1238-redhat-kernel-spec-template-disable-objtool-werror-for-gcov-.patch deleted file mode 100644 index a4263e125..000000000 --- a/1238-redhat-kernel-spec-template-disable-objtool-werror-for-gcov-.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 1689ee487def887a6e105f5bd858545cbafa8ba5 Mon Sep 17 00:00:00 2001 -From: Oleksii Baranov -Date: Tue, 2 Jun 2026 10:12:10 +0200 -Subject: [PATCH] redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov - builds - -JIRA: INTERNAL -Upstream Status: RHEL only - -There is a known issue with the gcov builds related to vmlinux.o: error: -objtool: pvh_start_xen+0x64: relocation to !ENDBR: pvh_start_xen+0x0. -Disabling the WERROR to make that error a warning and pass the build. - -Signed-off-by: Oleksii Baranov - -diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template -index 9f6983c1a6dc..306afba015a4 100644 ---- a/redhat/kernel.spec.template -+++ b/redhat/kernel.spec.template -@@ -2118,6 +2118,13 @@ do - done - rm -f $i.tmp - done -+%if %{with_gcov} -+%{log_msg "Disabling CONFIG_OBJTOOL_WERROR for gcov build"} -+for i in %{all_configs} -+do -+ sed -i "s|CONFIG_OBJTOOL_WERROR=y|# CONFIG_OBJTOOL_WERROR is not set|g" $i -+done -+%endif - %endif - - %if %{signkernel}%{signmodules} --- -2.50.1 (Apple Git-155) - diff --git a/1239-dm-thin-fix-metadata-refcount-underflow.patch b/1239-dm-thin-fix-metadata-refcount-underflow.patch deleted file mode 100644 index aff64b0f0..000000000 --- a/1239-dm-thin-fix-metadata-refcount-underflow.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 323d252a4a378834e4fe68298ca61cfc5dd3a460 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka -Date: Mon, 20 Apr 2026 19:56:44 +0200 -Subject: [PATCH] dm-thin: fix metadata refcount underflow - -commit 09a65adc7d8bbfce06392cb6d375468e2728ead5 upstream. - -There's a bug in dm-thin in the function rebalance_children. If the -internal btree node has one entry, the code tries to copy all btree -entries from the node's child to the node itself and then decrement the -child's reference count. - -If the child node is shared (it has reference count > 1), we won't free -it, so there would be two pointers to each of the grandchildren nodes. -But the reference counts of the grandchildren is not increased, thus the -reference count doesn't match the number of pointers that point to the -grandchildren. This results in "device mapper: space map common: unable -to decrement block" errors. - -Fix this bug by incrementing reference counts on the grandchildren if the -btree node is shared. - -Signed-off-by: Mikulas Patocka -Fixes: 3241b1d3e0aa ("dm: add persistent data library") -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index 942cd47eb52d..aeec5b9a1dd5 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -490,12 +490,20 @@ static int rebalance_children(struct shadow_spine *s, - - if (le32_to_cpu(n->header.nr_entries) == 1) { - struct dm_block *child; -+ int is_shared; - dm_block_t b = value64(n, 0); - -+ r = dm_tm_block_is_shared(info->tm, b, &is_shared); -+ if (r) -+ return r; -+ - r = dm_tm_read_lock(info->tm, b, &btree_node_validator, &child); - if (r) - return r; - -+ if (is_shared) -+ inc_children(info->tm, dm_block_data(child), vt); -+ - memcpy(n, dm_block_data(child), - dm_bm_block_size(dm_tm_get_bm(info->tm))); - --- -2.50.1 (Apple Git-155) - diff --git a/1240-crypto-tegra-disable-softirqs-before-finalizing-request.patch b/1240-crypto-tegra-disable-softirqs-before-finalizing-request.patch deleted file mode 100644 index 53c730b4f..000000000 --- a/1240-crypto-tegra-disable-softirqs-before-finalizing-request.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 93a786612ec17d0146d05b71dbf5931b6ee04400 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 24 Apr 2026 14:07:14 +0000 -Subject: [PATCH] crypto: tegra - Disable softirqs before finalizing request - -JIRA: https://redhat.atlassian.net/browse/RHEL-159000 - -commit 2aeec9af775fb53aa086419b953302c6f4ad4984 -Author: Herbert Xu -Date: Tue Mar 10 18:28:29 2026 +0900 - - crypto: tegra - Disable softirqs before finalizing request - - Softirqs must be disabled when calling the finalization fucntion on - a request. - - Reported-by: Guangwu Zhang - Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") - Signed-off-by: Herbert Xu - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 0e07d0523291..8b91f00b9c31 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -4,6 +4,7 @@ - * Crypto driver to handle block cipher algorithms using NVIDIA Security Engine. - */ - -+#include - #include - #include - #include -@@ -333,7 +334,9 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq) - tegra_key_invalidate_reserved(ctx->se, key2_id, ctx->alg); - - out_finalize: -+ local_bh_disable(); - crypto_finalize_skcipher_request(se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -@@ -1261,7 +1264,9 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - tegra_key_invalidate_reserved(ctx->se, rctx->key_id, ctx->alg); - - out_finalize: -+ local_bh_disable(); - crypto_finalize_aead_request(ctx->se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -@@ -1347,7 +1352,9 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - tegra_key_invalidate_reserved(ctx->se, rctx->key_id, ctx->alg); - - out_finalize: -+ local_bh_disable(); - crypto_finalize_aead_request(ctx->se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -@@ -1745,7 +1752,9 @@ static int tegra_cmac_do_one_req(struct crypto_engine *engine, void *areq) - if (tegra_key_is_reserved(rctx->key_id)) - tegra_key_invalidate_reserved(ctx->se, rctx->key_id, ctx->alg); - -+ local_bh_disable(); - crypto_finalize_hash_request(se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index 42d007b7af45..90bf34eb3578 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -4,6 +4,7 @@ - * Crypto driver to handle HASH algorithms using NVIDIA Security Engine. - */ - -+#include - #include - #include - #include -@@ -543,7 +544,9 @@ static int tegra_sha_do_one_req(struct crypto_engine *engine, void *areq) - } - - out: -+ local_bh_disable(); - crypto_finalize_hash_request(se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1241-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch b/1241-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch deleted file mode 100644 index 22849353a..000000000 --- a/1241-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch +++ /dev/null @@ -1,48 +0,0 @@ -From cd80e4a498a4387b0d597b2edd74c834ae730c5f Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Thu, 7 May 2026 18:00:59 -0500 -Subject: [PATCH] Bluetooth: MGMT: validate LTK enc_size on load - -JIRA: https://issues.redhat.com/browse/RHEL-172460 - -JIRA: https://issues.redhat.com/browse/RHEL-172580 -CVE: CVE-2026-43020 - -commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 -Author: Keenan Dong -Date: Sat Mar 28 16:46:47 2026 +0800 - - Bluetooth: MGMT: validate LTK enc_size on load - - Load Long Term Keys stores the user-provided enc_size and later uses - it to size fixed-size stack operations when replying to LE LTK - requests. An enc_size larger than the 16-byte key buffer can therefore - overflow the reply stack buffer. - - Reject oversized enc_size values while validating the management LTK - record so invalid keys never reach the stored key state. - - Fixes: 346af67b8d11 ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's") - Reported-by: Keenan Dong - Signed-off-by: Keenan Dong - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 9bf95af598a0..66e58fc556a5 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -7248,6 +7248,9 @@ static bool ltk_is_valid(struct mgmt_ltk_info *key) - if (key->initiator != 0x00 && key->initiator != 0x01) - return false; - -+ if (key->enc_size > sizeof(key->val)) -+ return false; -+ - switch (key->addr.type) { - case BDADDR_LE_PUBLIC: - return true; --- -2.50.1 (Apple Git-155) - diff --git a/1242-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch b/1242-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch deleted file mode 100644 index bc5500d1b..000000000 --- a/1242-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch +++ /dev/null @@ -1,149 +0,0 @@ -From bb04e329c1f71a2f22a865df447ae3b215253283 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Thu, 7 May 2026 18:00:58 -0500 -Subject: [PATCH] Bluetooth: SCO: fix race conditions in sco_sock_connect() - -JIRA: https://issues.redhat.com/browse/RHEL-172460 - -JIRA: https://issues.redhat.com/browse/RHEL-172607 -CVE: CVE-2026-43023 - -commit 8a5b0135d4a5d9683203a3d9a12a711ccec5936b -Author: Cen Zhang -Date: Thu Mar 26 23:16:45 2026 +0800 - - Bluetooth: SCO: fix race conditions in sco_sock_connect() - - sco_sock_connect() checks sk_state and sk_type without holding - the socket lock. Two concurrent connect() syscalls on the same - socket can both pass the check and enter sco_connect(), leading - to use-after-free. - - The buggy scenario involves three participants and was confirmed - with additional logging instrumentation: - - Thread A (connect): HCI disconnect: Thread B (connect): - - sco_sock_connect(sk) sco_sock_connect(sk) - sk_state==BT_OPEN sk_state==BT_OPEN - (pass, no lock) (pass, no lock) - sco_connect(sk): sco_connect(sk): - hci_dev_lock hci_dev_lock - hci_connect_sco <- blocked - -> hcon1 - sco_conn_add->conn1 - lock_sock(sk) - sco_chan_add: - conn1->sk = sk - sk->conn = conn1 - sk_state=BT_CONNECT - release_sock - hci_dev_unlock - hci_dev_lock - sco_conn_del: - lock_sock(sk) - sco_chan_del: - sk->conn=NULL - conn1->sk=NULL - sk_state= - BT_CLOSED - SOCK_ZAPPED - release_sock - hci_dev_unlock - (unblocked) - hci_connect_sco - -> hcon2 - sco_conn_add - -> conn2 - lock_sock(sk) - sco_chan_add: - sk->conn=conn2 - sk_state= - BT_CONNECT - // zombie sk! - release_sock - hci_dev_unlock - - Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to - BT_CONNECT. Subsequent cleanup triggers double sock_put() and - use-after-free. Meanwhile conn1 is leaked as it was orphaned - when sco_conn_del() cleared the association. - - Fix this by: - - Moving lock_sock() before the sk_state/sk_type checks in - sco_sock_connect() to serialize concurrent connect attempts - - Fixing the sk_type != SOCK_SEQPACKET check to actually - return the error instead of just assigning it - - Adding a state re-check in sco_connect() after lock_sock() - to catch state changes during the window between the locks - - Adding sco_pi(sk)->conn check in sco_chan_add() to prevent - double-attach of a socket to multiple connections - - Adding hci_conn_drop() on sco_chan_add failure to prevent - HCI connection leaks - - Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm") - Signed-off-by: Cen Zhang - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 6fc0914c74cb..26e3020e6d87 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -298,7 +298,7 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk, - int err = 0; - - sco_conn_lock(conn); -- if (conn->sk) -+ if (conn->sk || sco_pi(sk)->conn) - err = -EBUSY; - else - __sco_chan_add(conn, sk, parent); -@@ -353,9 +353,20 @@ static int sco_connect(struct sock *sk) - - lock_sock(sk); - -+ /* Recheck state after reacquiring the socket lock, as another -+ * thread may have changed it (e.g., closed the socket). -+ */ -+ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { -+ release_sock(sk); -+ hci_conn_drop(hcon); -+ err = -EBADFD; -+ goto unlock; -+ } -+ - err = sco_chan_add(conn, sk, NULL); - if (err) { - release_sock(sk); -+ hci_conn_drop(hcon); - goto unlock; - } - -@@ -656,13 +667,18 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen - addr->sa_family != AF_BLUETOOTH) - return -EINVAL; - -- if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) -+ lock_sock(sk); -+ -+ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { -+ release_sock(sk); - return -EBADFD; -+ } - -- if (sk->sk_type != SOCK_SEQPACKET) -- err = -EINVAL; -+ if (sk->sk_type != SOCK_SEQPACKET) { -+ release_sock(sk); -+ return -EINVAL; -+ } - -- lock_sock(sk); - /* Set destination address and psm */ - bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); - release_sock(sk); --- -2.50.1 (Apple Git-155) - diff --git a/1243-xfs-delete-attr-leaf-freemap-entries-when-empty.patch b/1243-xfs-delete-attr-leaf-freemap-entries-when-empty.patch deleted file mode 100644 index cf47adc0c..000000000 --- a/1243-xfs-delete-attr-leaf-freemap-entries-when-empty.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 21df79956b1623ded470e38baa1058d1c641d896 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 8 May 2026 14:00:52 +0000 -Subject: [PATCH] xfs: delete attr leaf freemap entries when empty - -JIRA: https://redhat.atlassian.net/browse/RHEL-174054 -CVE: CVE-2026-43158 - -commit 6f13c1d2a6271c2e73226864a0e83de2770b6f34 -Author: Darrick J. Wong -Date: Fri Jan 23 09:27:30 2026 -0800 - - xfs: delete attr leaf freemap entries when empty - - Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size - underflow"), Brian Foster observed that it's possible for a small - freemap at the end of the end of the xattr entries array to experience - a size underflow when subtracting the space consumed by an expansion of - the entries array. There are only three freemap entries, which means - that it is not a complete index of all free space in the leaf block. - - This code can leave behind a zero-length freemap entry with a nonzero - base. Subsequent setxattr operations can increase the base up to the - point that it overlaps with another freemap entry. This isn't in and of - itself a problem because the code in _leaf_add that finds free space - ignores any freemap entry with zero size. - - However, there's another bug in the freemap update code in _leaf_add, - which is that it fails to update a freemap entry that begins midway - through the xattr entry that was just appended to the array. That can - result in the freemap containing two entries with the same base but - different sizes (0 for the "pushed-up" entry, nonzero for the entry - that's actually tracking free space). A subsequent _leaf_add can then - allocate xattr namevalue entries on top of the entries array, leading to - data loss. But fixing that is for later. - - For now, eliminate the possibility of confusion by zeroing out the base - of any freemap entry that has zero size. Because the freemap is not - intended to be a complete index of free space, a subsequent failure to - find any free space for a new xattr will trigger block compaction, which - regenerates the freemap. - - It looks like this bug has been in the codebase for quite a long time. - - Cc: # v2.6.12 - Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") - Signed-off-by: "Darrick J. Wong" - Reviewed-by: Christoph Hellwig - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index fddb55605e0c..8577c01c83bd 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -1593,6 +1593,19 @@ xfs_attr3_leaf_add_work( - min_t(uint16_t, ichdr->freemap[i].size, - sizeof(xfs_attr_leaf_entry_t)); - } -+ -+ /* -+ * Don't leave zero-length freemaps with nonzero base lying -+ * around, because we don't want the code in _remove that -+ * matches on base address to get confused and create -+ * overlapping freemaps. If we end up with no freemap entries -+ * then the next _add will compact the leaf block and -+ * regenerate the freemaps. -+ */ -+ if (ichdr->freemap[i].size == 0 && ichdr->freemap[i].base > 0) { -+ ichdr->freemap[i].base = 0; -+ ichdr->holes = 1; -+ } - } - ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index); - } --- -2.50.1 (Apple Git-155) - diff --git a/1244-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch b/1244-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch deleted file mode 100644 index 9f0a189c4..000000000 --- a/1244-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 18713c87fe4f646250400dae3226ffd0659959d5 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 8 May 2026 14:00:54 +0000 -Subject: [PATCH] xfs: fix freemap adjustments when adding xattrs to leaf - blocks - -JIRA: https://redhat.atlassian.net/browse/RHEL-174054 -CVE: CVE-2026-43158 - -commit 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce -Author: Darrick J. Wong -Date: Fri Jan 23 09:27:31 2026 -0800 - - xfs: fix freemap adjustments when adding xattrs to leaf blocks - - xfs/592 and xfs/794 both trip this assertion in the leaf block freemap - adjustment code after ~20 minutes of running on my test VMs: - - ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) - + xfs_attr3_leaf_hdr_size(leaf)); - - Upon enabling quite a lot more debugging code, I narrowed this down to - fsstress trying to set a local extended attribute with namelen=3 and - valuelen=71. This results in an entry size of 80 bytes. - - At the start of xfs_attr3_leaf_add_work, the freemap looks like this: - - i 0 base 448 size 0 rhs 448 count 46 - i 1 base 388 size 132 rhs 448 count 46 - i 2 base 2120 size 4 rhs 448 count 46 - firstused = 520 - - where "rhs" is the first byte past the end of the leaf entry array. - This is inconsistent -- the entries array ends at byte 448, but - freemap[1] says there's free space starting at byte 388! - - By the end of the function, the freemap is in worse shape: - - i 0 base 456 size 0 rhs 456 count 47 - i 1 base 388 size 52 rhs 456 count 47 - i 2 base 2120 size 4 rhs 456 count 47 - firstused = 440 - - Important note: 388 is not aligned with the entries array element size - of 8 bytes. - - Based on the incorrect freemap, the name area starts at byte 440, which - is below the end of the entries array! That's why the assertion - triggers and the filesystem shuts down. - - How did we end up here? First, recall from the previous patch that the - freemap array in an xattr leaf block is not intended to be a - comprehensive map of all free space in the leaf block. In other words, - it's perfectly legal to have a leaf block with: - - * 376 bytes in use by the entries array - * freemap[0] has [base = 376, size = 8] - * freemap[1] has [base = 388, size = 1500] - * the space between 376 and 388 is free, but the freemap stopped - tracking that some time ago - - If we add one xattr, the entries array grows to 384 bytes, and - freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we - add a second xattr, the entries array grows to 392 bytes, and freemap[0] - gets pushed up to [base = 392, size = 0]. This is bad, because - freemap[1] hasn't been updated, and now the entries array and the free - space claim the same space. - - The fix here is to adjust all freemap entries so that none of them - collide with the entries array. Note that this fix relies on commit - 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and - the previous patch that resets zero length freemap entries to have - base = 0. - - Cc: # v2.6.12 - Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") - Signed-off-by: "Darrick J. Wong" - Reviewed-by: Christoph Hellwig - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index 8577c01c83bd..bfcac9036c11 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -1489,6 +1489,7 @@ xfs_attr3_leaf_add_work( - struct xfs_attr_leaf_name_local *name_loc; - struct xfs_attr_leaf_name_remote *name_rmt; - struct xfs_mount *mp; -+ int old_end, new_end; - int tmp; - int i; - -@@ -1581,17 +1582,36 @@ xfs_attr3_leaf_add_work( - if (be16_to_cpu(entry->nameidx) < ichdr->firstused) - ichdr->firstused = be16_to_cpu(entry->nameidx); - -- ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) -- + xfs_attr3_leaf_hdr_size(leaf)); -- tmp = (ichdr->count - 1) * sizeof(xfs_attr_leaf_entry_t) -- + xfs_attr3_leaf_hdr_size(leaf); -+ new_end = ichdr->count * sizeof(struct xfs_attr_leaf_entry) + -+ xfs_attr3_leaf_hdr_size(leaf); -+ old_end = new_end - sizeof(struct xfs_attr_leaf_entry); -+ -+ ASSERT(ichdr->firstused >= new_end); - - for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) { -- if (ichdr->freemap[i].base == tmp) { -- ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t); -+ int diff = 0; -+ -+ if (ichdr->freemap[i].base == old_end) { -+ /* -+ * This freemap entry starts at the old end of the -+ * leaf entry array, so we need to adjust its base -+ * upward to accomodate the larger array. -+ */ -+ diff = sizeof(struct xfs_attr_leaf_entry); -+ } else if (ichdr->freemap[i].size > 0 && -+ ichdr->freemap[i].base < new_end) { -+ /* -+ * This freemap entry starts in the space claimed by -+ * the new leaf entry. Adjust its base upward to -+ * reflect that. -+ */ -+ diff = new_end - ichdr->freemap[i].base; -+ } -+ -+ if (diff) { -+ ichdr->freemap[i].base += diff; - ichdr->freemap[i].size -= -- min_t(uint16_t, ichdr->freemap[i].size, -- sizeof(xfs_attr_leaf_entry_t)); -+ min_t(uint16_t, ichdr->freemap[i].size, diff); - } - - /* --- -2.50.1 (Apple Git-155) - diff --git a/1245-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch b/1245-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch deleted file mode 100644 index 95d3a236f..000000000 --- a/1245-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 72ad184f05e7a77a7043b9e71943ba3031cc683a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 31 Mar 2026 13:17:02 +0000 -Subject: [PATCH] proc: use the same treatment to check proc_lseek as ones for - proc_read_iter et.al - -JIRA: https://redhat.atlassian.net/browse/RHEL-163346 -CVE: CVE-2025-38653 - -commit ff7ec8dc1b646296f8d94c39339e8d3833d16c05 -Author: wangzijie -Date: Sat Jun 7 10:13:53 2025 +0800 - - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al - - Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. - It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in - proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same - manner. - - Link: https://lkml.kernel.org/r/20250607021353.1127963-1-wangzijie1@honor.com - Fixes: 3f61631d47f1 ("take care to handle NULL ->proc_lseek()") - Signed-off-by: wangzijie - Reviewed-by: Alexey Dobriyan - Cc: Alexei Starovoitov - Cc: Al Viro - Cc: "Edgecombe, Rick P" - Cc: Kirill A. Shuemov - Signed-off-by: Andrew Morton - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 9b3b4efe2041..26e118f1dc9e 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -567,6 +567,8 @@ static void pde_set_flags(struct proc_dir_entry *pde) - if (pde->proc_ops->proc_compat_ioctl) - pde->flags |= PROC_ENTRY_proc_compat_ioctl; - #endif -+ if (pde->proc_ops->proc_lseek) -+ pde->flags |= PROC_ENTRY_proc_lseek; - } - - struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, -diff --git a/fs/proc/inode.c b/fs/proc/inode.c -index a3eb3b740f76..73074b9c715a 100644 ---- a/fs/proc/inode.c -+++ b/fs/proc/inode.c -@@ -473,7 +473,7 @@ static int proc_reg_open(struct inode *inode, struct file *file) - typeof_member(struct proc_ops, proc_open) open; - struct pde_opener *pdeo; - -- if (!pde->proc_ops->proc_lseek) -+ if (!pde_has_proc_lseek(pde)) - file->f_mode &= ~FMODE_LSEEK; - - if (pde_is_permanent(pde)) { -diff --git a/fs/proc/internal.h b/fs/proc/internal.h -index 77a517f91821..2c590e4a4022 100644 ---- a/fs/proc/internal.h -+++ b/fs/proc/internal.h -@@ -99,6 +99,11 @@ static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) - #endif - } - -+static inline bool pde_has_proc_lseek(const struct proc_dir_entry *pde) -+{ -+ return pde->flags & PROC_ENTRY_proc_lseek; -+} -+ - extern struct kmem_cache *proc_dir_entry_cache; - void pde_free(struct proc_dir_entry *pde); - -diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h -index ea62201c74c4..703d0c76cc9a 100644 ---- a/include/linux/proc_fs.h -+++ b/include/linux/proc_fs.h -@@ -27,6 +27,7 @@ enum { - - PROC_ENTRY_proc_read_iter = 1U << 1, - PROC_ENTRY_proc_compat_ioctl = 1U << 2, -+ PROC_ENTRY_proc_lseek = 1U << 3, - }; - - struct proc_ops { --- -2.50.1 (Apple Git-155) - diff --git a/1246-proc-fix-missing-pde-set-flags-for-net-proc-files.patch b/1246-proc-fix-missing-pde-set-flags-for-net-proc-files.patch deleted file mode 100644 index 8ee90dcba..000000000 --- a/1246-proc-fix-missing-pde-set-flags-for-net-proc-files.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 5b2ab6d1f5e5488a9faa61f4d560b239dce0e08b Mon Sep 17 00:00:00 2001 -From: Abhi Das -Date: Fri, 17 Apr 2026 13:31:25 -0500 -Subject: [PATCH] proc: fix missing pde_set_flags() for net proc files -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-163346 -CVE: CVE-2025-38653 - -commit 2ce3d282bd5050fca8577defeff08ada0d55d062 -Author: wangzijie -Date: Mon Aug 18 20:31:02 2025 +0800 - - proc: fix missing pde_set_flags() for net proc files - - To avoid potential UAF issues during module removal races, we use - pde_set_flags() to save proc_ops flags in PDE itself before - proc_register(), and then use pde_has_proc_*() helpers instead of directly - dereferencing pde->proc_ops->*. - - However, the pde_set_flags() call was missing when creating net related - proc files. This omission caused incorrect behavior which FMODE_LSEEK was - being cleared inappropriately in proc_reg_open() for net proc files. Lars - reported it in this link[1]. - - Fix this by ensuring pde_set_flags() is called when register proc entry, - and add NULL check for proc_ops in pde_set_flags(). - - [wangzijie1@honor.com: stash pde->proc_ops in a local const variable, per Christian] - Link: https://lkml.kernel.org/r/20250821105806.1453833-1-wangzijie1@honor.com - Link: https://lkml.kernel.org/r/20250818123102.959595-1-wangzijie1@honor.com - Link: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/ [1] - Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al") - Signed-off-by: wangzijie - Reported-by: Lars Wendler - Tested-by: Stefano Brivio - Tested-by: Petr Vaněk - Tested by: Lars Wendler - Cc: Alexei Starovoitov - Cc: Alexey Dobriyan - Cc: Al Viro - Cc: "Edgecombe, Rick P" - Cc: Greg Kroah-Hartman - Cc: Jiri Slaby - Cc: Kirill A. Shutemov - Cc: wangzijie - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Abhi Das - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 26e118f1dc9e..88423b46e5ce 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -362,6 +362,25 @@ static const struct inode_operations proc_dir_inode_operations = { - .setattr = proc_notify_change, - }; - -+static void pde_set_flags(struct proc_dir_entry *pde) -+{ -+ const struct proc_ops *proc_ops = pde->proc_ops; -+ -+ if (!proc_ops) -+ return; -+ -+ if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT) -+ pde->flags |= PROC_ENTRY_PERMANENT; -+ if (proc_ops->proc_read_iter) -+ pde->flags |= PROC_ENTRY_proc_read_iter; -+#ifdef CONFIG_COMPAT -+ if (proc_ops->proc_compat_ioctl) -+ pde->flags |= PROC_ENTRY_proc_compat_ioctl; -+#endif -+ if (proc_ops->proc_lseek) -+ pde->flags |= PROC_ENTRY_proc_lseek; -+} -+ - /* returns the registered entry, or frees dp and returns NULL on failure */ - struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - struct proc_dir_entry *dp) -@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - if (proc_alloc_inum(&dp->low_ino)) - goto out_free_entry; - -+ pde_set_flags(dp); -+ - write_lock(&proc_subdir_lock); - dp->parent = dir; - if (pde_subdir_insert(dir, dp) == false) { -@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, - return p; - } - --static void pde_set_flags(struct proc_dir_entry *pde) --{ -- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) -- pde->flags |= PROC_ENTRY_PERMANENT; -- if (pde->proc_ops->proc_read_iter) -- pde->flags |= PROC_ENTRY_proc_read_iter; --#ifdef CONFIG_COMPAT -- if (pde->proc_ops->proc_compat_ioctl) -- pde->flags |= PROC_ENTRY_proc_compat_ioctl; --#endif -- if (pde->proc_ops->proc_lseek) -- pde->flags |= PROC_ENTRY_proc_lseek; --} -- - struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, - struct proc_dir_entry *parent, - const struct proc_ops *proc_ops, void *data) -@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, - if (!p) - return NULL; - p->proc_ops = proc_ops; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_data); -@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, - p->proc_ops = &proc_seq_ops; - p->seq_ops = ops; - p->state_size = state_size; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_seq_private); -@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, - return NULL; - p->proc_ops = &proc_single_ops; - p->single_show = show; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_single_data); --- -2.50.1 (Apple Git-155) - diff --git a/1247-proc-fix-type-confusion-in-pde-set-flags.patch b/1247-proc-fix-type-confusion-in-pde-set-flags.patch deleted file mode 100644 index a4354cad7..000000000 --- a/1247-proc-fix-type-confusion-in-pde-set-flags.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 51903c441e999d6c7afdf651f0724c26627950d8 Mon Sep 17 00:00:00 2001 -From: Abhi Das -Date: Fri, 17 Apr 2026 13:33:50 -0500 -Subject: [PATCH] proc: fix type confusion in pde_set_flags() - -JIRA: https://redhat.atlassian.net/browse/RHEL-163346 -CVE: CVE-2025-38653 - -commit 0ce9398aa0830f15f92bbed73853f9861c3e74ff -Author: wangzijie -Date: Thu Sep 4 21:57:15 2025 +0800 - - proc: fix type confusion in pde_set_flags() - - Commit 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc - files") missed a key part in the definition of proc_dir_entry: - - union { - const struct proc_ops *proc_ops; - const struct file_operations *proc_dir_ops; - }; - - So dereference of ->proc_ops assumes it is a proc_ops structure results in - type confusion and make NULL check for 'proc_ops' not work for proc dir. - - Add !S_ISDIR(dp->mode) test before calling pde_set_flags() to fix it. - - Link: https://lkml.kernel.org/r/20250904135715.3972782-1-wangzijie1@honor.com - Fixes: 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files") - Signed-off-by: wangzijie - Reported-by: Brad Spengler - Closes: https://lore.kernel.org/all/20250903065758.3678537-1-wangzijie1@honor.com/ - Cc: Alexey Dobriyan - Cc: Al Viro - Cc: Christian Brauner - Cc: Jiri Slaby - Cc: Stefano Brivio - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Abhi Das - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 88423b46e5ce..69150974ad87 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -388,7 +388,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - if (proc_alloc_inum(&dp->low_ino)) - goto out_free_entry; - -- pde_set_flags(dp); -+ if (!S_ISDIR(dp->mode)) -+ pde_set_flags(dp); - - write_lock(&proc_subdir_lock); - dp->parent = dir; --- -2.50.1 (Apple Git-155) - diff --git a/1248-nbd-defer-config-unlock-in-nbd-genl-connect.patch b/1248-nbd-defer-config-unlock-in-nbd-genl-connect.patch deleted file mode 100644 index f606280b7..000000000 --- a/1248-nbd-defer-config-unlock-in-nbd-genl-connect.patch +++ /dev/null @@ -1,74 +0,0 @@ -From f78e5b8575baca940843081e029427cfb2679d32 Mon Sep 17 00:00:00 2001 -From: Ming Lei -Date: Mon, 10 Nov 2025 20:49:20 +0800 -Subject: [PATCH] nbd: defer config unlock in nbd_genl_connect - -JIRA: https://issues.redhat.com/browse/RHEL-144763 - -commit 1649714b930f9ea6233ce0810ba885999da3b5d4 -Author: Zheng Qixing -Date: Mon Nov 10 20:49:20 2025 +0800 - - nbd: defer config unlock in nbd_genl_connect - - There is one use-after-free warning when running NBD_CMD_CONNECT and - NBD_CLEAR_SOCK: - - nbd_genl_connect - nbd_alloc_and_init_config // config_refs=1 - nbd_start_device // config_refs=2 - set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3 - recv_work done // config_refs=2 - NBD_CLEAR_SOCK // config_refs=1 - close nbd // config_refs=0 - refcount_inc -> uaf - - ------------[ cut here ]------------ - refcount_t: addition on 0; use-after-free. - WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 - nbd_genl_connect+0x16d0/0x1ab0 - genl_family_rcv_msg_doit+0x1f3/0x310 - genl_rcv_msg+0x44a/0x790 - - The issue can be easily reproduced by adding a small delay before - refcount_inc(&nbd->config_refs) in nbd_genl_connect(): - - mutex_unlock(&nbd->config_lock); - if (!ret) { - set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); - + printk("before sleep\n"); - + mdelay(5 * 1000); - + printk("after sleep\n"); - refcount_inc(&nbd->config_refs); - nbd_connect_reply(info, nbd->index); - } - - Fixes: e46c7287b1c2 ("nbd: add a basic netlink interface") - Signed-off-by: Zheng Qixing - Reviewed-by: Yu Kuai - Signed-off-by: Jens Axboe - -Signed-off-by: Ming Lei - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 215fc18115b7..a05ff68e58d0 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -2241,12 +2241,13 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) - - ret = nbd_start_device(nbd); - out: -- mutex_unlock(&nbd->config_lock); - if (!ret) { - set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); - refcount_inc(&nbd->config_refs); - nbd_connect_reply(info, nbd->index); - } -+ mutex_unlock(&nbd->config_lock); -+ - nbd_config_put(nbd); - if (put_dev) - nbd_put(nbd); --- -2.50.1 (Apple Git-155) - diff --git a/1249-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch b/1249-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch deleted file mode 100644 index b7a16cdb6..000000000 --- a/1249-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch +++ /dev/null @@ -1,205 +0,0 @@ -From 70b8cf8679755c2013b28e9f61da1576eab4c707 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 27 Apr 2026 15:02:27 +0000 -Subject: [PATCH] crypto: authenc - Correctly pass EINPROGRESS back up to the - caller - -JIRA: https://redhat.atlassian.net/browse/RHEL-130557 - -commit 96feb73def02d175850daa0e7c2c90c876681b5c -Author: Herbert Xu -Date: Wed Sep 24 18:20:17 2025 +0800 - - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - - When authenc is invoked with MAY_BACKLOG, it needs to pass EINPROGRESS - notifications back up to the caller when the underlying algorithm - returns EBUSY synchronously. - - However, if the EBUSY comes from the second part of an authenc call, - i.e., it is asynchronous, both the EBUSY and the subsequent EINPROGRESS - notification must not be passed to the caller. - - Implement this by passing a mask to the function that starts the - second half of authenc and using it to determine whether EBUSY - and EINPROGRESS should be passed to the caller. - - This was a deficiency in the original implementation of authenc - because it was not expected to be used with MAY_BACKLOG. - - Reported-by: Ingo Franzki - Reported-by: Mikulas Patocka - Fixes: 180ce7e81030 ("crypto: authenc - Add EINPROGRESS check") - Signed-off-by: Herbert Xu - -Signed-off-by: CKI Backport Bot - -diff --git a/crypto/authenc.c b/crypto/authenc.c -index 3aaf3ab4e360..d04068af9833 100644 ---- a/crypto/authenc.c -+++ b/crypto/authenc.c -@@ -39,7 +39,7 @@ struct authenc_request_ctx { - - static void authenc_request_complete(struct aead_request *req, int err) - { -- if (err != -EINPROGRESS) -+ if (err != -EINPROGRESS && err != -EBUSY) - aead_request_complete(req, err); - } - -@@ -109,27 +109,42 @@ static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key, - return err; - } - --static void authenc_geniv_ahash_done(void *data, int err) -+static void authenc_geniv_ahash_finish(struct aead_request *req) - { -- struct aead_request *req = data; - struct crypto_aead *authenc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(authenc); - struct authenc_instance_ctx *ictx = aead_instance_ctx(inst); - struct authenc_request_ctx *areq_ctx = aead_request_ctx(req); - struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff); - -- if (err) -- goto out; -- - scatterwalk_map_and_copy(ahreq->result, req->dst, - req->assoclen + req->cryptlen, - crypto_aead_authsize(authenc), 1); -+} - --out: -+static void authenc_geniv_ahash_done(void *data, int err) -+{ -+ struct aead_request *req = data; -+ -+ if (!err) -+ authenc_geniv_ahash_finish(req); - aead_request_complete(req, err); - } - --static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags) -+/* -+ * Used when the ahash request was invoked in the async callback context -+ * of the previous skcipher request. Eat any EINPROGRESS notifications. -+ */ -+static void authenc_geniv_ahash_done2(void *data, int err) -+{ -+ struct aead_request *req = data; -+ -+ if (!err) -+ authenc_geniv_ahash_finish(req); -+ authenc_request_complete(req, err); -+} -+ -+static int crypto_authenc_genicv(struct aead_request *req, unsigned int mask) - { - struct crypto_aead *authenc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(authenc); -@@ -138,6 +153,7 @@ static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags) - struct crypto_ahash *auth = ctx->auth; - struct authenc_request_ctx *areq_ctx = aead_request_ctx(req); - struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff); -+ unsigned int flags = aead_request_flags(req) & ~mask; - u8 *hash = areq_ctx->tail; - int err; - -@@ -145,7 +161,8 @@ static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags) - ahash_request_set_crypt(ahreq, req->dst, hash, - req->assoclen + req->cryptlen); - ahash_request_set_callback(ahreq, flags, -- authenc_geniv_ahash_done, req); -+ mask ? authenc_geniv_ahash_done2 : -+ authenc_geniv_ahash_done, req); - - err = crypto_ahash_digest(ahreq); - if (err) -@@ -161,12 +178,11 @@ static void crypto_authenc_encrypt_done(void *data, int err) - { - struct aead_request *areq = data; - -- if (err) -- goto out; -- -- err = crypto_authenc_genicv(areq, 0); -- --out: -+ if (err) { -+ aead_request_complete(areq, err); -+ return; -+ } -+ err = crypto_authenc_genicv(areq, CRYPTO_TFM_REQ_MAY_SLEEP); - authenc_request_complete(areq, err); - } - -@@ -219,11 +235,18 @@ static int crypto_authenc_encrypt(struct aead_request *req) - if (err) - return err; - -- return crypto_authenc_genicv(req, aead_request_flags(req)); -+ return crypto_authenc_genicv(req, 0); -+} -+ -+static void authenc_decrypt_tail_done(void *data, int err) -+{ -+ struct aead_request *req = data; -+ -+ authenc_request_complete(req, err); - } - - static int crypto_authenc_decrypt_tail(struct aead_request *req, -- unsigned int flags) -+ unsigned int mask) - { - struct crypto_aead *authenc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(authenc); -@@ -234,6 +257,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, - struct skcipher_request *skreq = (void *)(areq_ctx->tail + - ictx->reqoff); - unsigned int authsize = crypto_aead_authsize(authenc); -+ unsigned int flags = aead_request_flags(req) & ~mask; - u8 *ihash = ahreq->result + authsize; - struct scatterlist *src, *dst; - -@@ -250,7 +274,9 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, flags, -- req->base.complete, req->base.data); -+ mask ? authenc_decrypt_tail_done : -+ req->base.complete, -+ mask ? req : req->base.data); - skcipher_request_set_crypt(skreq, src, dst, - req->cryptlen - authsize, req->iv); - -@@ -261,12 +287,11 @@ static void authenc_verify_ahash_done(void *data, int err) - { - struct aead_request *req = data; - -- if (err) -- goto out; -- -- err = crypto_authenc_decrypt_tail(req, 0); -- --out: -+ if (err) { -+ aead_request_complete(req, err); -+ return; -+ } -+ err = crypto_authenc_decrypt_tail(req, CRYPTO_TFM_REQ_MAY_SLEEP); - authenc_request_complete(req, err); - } - -@@ -293,7 +318,7 @@ static int crypto_authenc_decrypt(struct aead_request *req) - if (err) - return err; - -- return crypto_authenc_decrypt_tail(req, aead_request_flags(req)); -+ return crypto_authenc_decrypt_tail(req, 0); - } - - static int crypto_authenc_init_tfm(struct crypto_aead *tfm) --- -2.50.1 (Apple Git-155) - diff --git a/1250-dpll-zl3073x-detect-dpll-channel-count-from-chip-id-at-runti.patch b/1250-dpll-zl3073x-detect-dpll-channel-count-from-chip-id-at-runti.patch deleted file mode 100644 index 09ddef885..000000000 --- a/1250-dpll-zl3073x-detect-dpll-channel-count-from-chip-id-at-runti.patch +++ /dev/null @@ -1,426 +0,0 @@ -From bf31f0732fbaa881f28bf71e012d2aba97e59316 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:50:08 +0200 -Subject: [PATCH] dpll: zl3073x: detect DPLL channel count from chip ID at - runtime - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit 4845f2fff730f0cdf8f7fe6401c8b871891cf1cb -Author: Ivan Vecera -Date: Fri Feb 27 11:52:59 2026 +0100 - - dpll: zl3073x: detect DPLL channel count from chip ID at runtime - - Replace the five per-variant zl3073x_chip_info structures and their - exported symbol definitions with a single consolidated chip ID lookup - table. The chip variant is now detected at runtime by reading the chip - ID register from hardware and looking it up in the table, rather than - being selected at compile time via the bus driver match data. - - Repurpose struct zl3073x_chip_info to hold a single chip ID, its - channel count, and a flags field. Introduce enum zl3073x_flags with - ZL3073X_FLAG_REF_PHASE_COMP_32 to replace the chip_id switch statement - in zl3073x_dev_is_ref_phase_comp_32bit(). Store a pointer to the - detected chip_info entry in struct zl3073x_dev for runtime access. - - This simplifies the bus drivers by removing per-variant .data and - .driver_data references from the I2C/SPI match tables, and makes - adding support for new chip variants a single-line table addition. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260227105300.710272-2-ivecera@redhat.com - Reviewed-by: Simon Horman - Signed-off-by: Paolo Abeni - -(cherry picked from commit 4845f2fff730f0cdf8f7fe6401c8b871891cf1cb) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 37f3c33570ee..c8af34301045 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -20,79 +20,30 @@ - #include "dpll.h" - #include "regs.h" - --/* Chip IDs for zl30731 */ --static const u16 zl30731_ids[] = { -- 0x0E93, -- 0x1E93, -- 0x2E93, -+#define ZL_CHIP_INFO(_id, _nchannels, _flags) \ -+ { .id = (_id), .num_channels = (_nchannels), .flags = (_flags) } -+ -+static const struct zl3073x_chip_info zl3073x_chip_ids[] = { -+ ZL_CHIP_INFO(0x0E30, 2, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E93, 1, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E94, 2, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E95, 3, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E96, 4, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E97, 5, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x1E93, 1, 0), -+ ZL_CHIP_INFO(0x1E94, 2, 0), -+ ZL_CHIP_INFO(0x1E95, 3, 0), -+ ZL_CHIP_INFO(0x1E96, 4, 0), -+ ZL_CHIP_INFO(0x1E97, 5, 0), -+ ZL_CHIP_INFO(0x1F60, 2, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x2E93, 1, 0), -+ ZL_CHIP_INFO(0x2E94, 2, 0), -+ ZL_CHIP_INFO(0x2E95, 3, 0), -+ ZL_CHIP_INFO(0x2E96, 4, 0), -+ ZL_CHIP_INFO(0x2E97, 5, 0), -+ ZL_CHIP_INFO(0x3FC4, 2, 0), - }; - --const struct zl3073x_chip_info zl30731_chip_info = { -- .ids = zl30731_ids, -- .num_ids = ARRAY_SIZE(zl30731_ids), -- .num_channels = 1, --}; --EXPORT_SYMBOL_NS_GPL(zl30731_chip_info, "ZL3073X"); -- --/* Chip IDs for zl30732 */ --static const u16 zl30732_ids[] = { -- 0x0E30, -- 0x0E94, -- 0x1E94, -- 0x1F60, -- 0x2E94, -- 0x3FC4, --}; -- --const struct zl3073x_chip_info zl30732_chip_info = { -- .ids = zl30732_ids, -- .num_ids = ARRAY_SIZE(zl30732_ids), -- .num_channels = 2, --}; --EXPORT_SYMBOL_NS_GPL(zl30732_chip_info, "ZL3073X"); -- --/* Chip IDs for zl30733 */ --static const u16 zl30733_ids[] = { -- 0x0E95, -- 0x1E95, -- 0x2E95, --}; -- --const struct zl3073x_chip_info zl30733_chip_info = { -- .ids = zl30733_ids, -- .num_ids = ARRAY_SIZE(zl30733_ids), -- .num_channels = 3, --}; --EXPORT_SYMBOL_NS_GPL(zl30733_chip_info, "ZL3073X"); -- --/* Chip IDs for zl30734 */ --static const u16 zl30734_ids[] = { -- 0x0E96, -- 0x1E96, -- 0x2E96, --}; -- --const struct zl3073x_chip_info zl30734_chip_info = { -- .ids = zl30734_ids, -- .num_ids = ARRAY_SIZE(zl30734_ids), -- .num_channels = 4, --}; --EXPORT_SYMBOL_NS_GPL(zl30734_chip_info, "ZL3073X"); -- --/* Chip IDs for zl30735 */ --static const u16 zl30735_ids[] = { -- 0x0E97, -- 0x1E97, -- 0x2E97, --}; -- --const struct zl3073x_chip_info zl30735_chip_info = { -- .ids = zl30735_ids, -- .num_ids = ARRAY_SIZE(zl30735_ids), -- .num_channels = 5, --}; --EXPORT_SYMBOL_NS_GPL(zl30735_chip_info, "ZL3073X"); -- - #define ZL_RANGE_OFFSET 0x80 - #define ZL_PAGE_SIZE 0x80 - #define ZL_NUM_PAGES 256 -@@ -942,7 +893,7 @@ static void zl3073x_dev_dpll_fini(void *ptr) - } - - static int --zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) -+zl3073x_devm_dpll_init(struct zl3073x_dev *zldev) - { - struct kthread_worker *kworker; - struct zl3073x_dpll *zldpll; -@@ -952,7 +903,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) - INIT_LIST_HEAD(&zldev->dplls); - - /* Allocate all DPLLs */ -- for (i = 0; i < num_dplls; i++) { -+ for (i = 0; i < zldev->info->num_channels; i++) { - zldpll = zl3073x_dpll_alloc(zldev, i); - if (IS_ERR(zldpll)) { - dev_err_probe(zldev->dev, PTR_ERR(zldpll), -@@ -992,14 +943,12 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) - /** - * zl3073x_dev_probe - initialize zl3073x device - * @zldev: pointer to zl3073x device -- * @chip_info: chip info based on compatible - * - * Common initialization of zl3073x device structure. - * - * Returns: 0 on success, <0 on error - */ --int zl3073x_dev_probe(struct zl3073x_dev *zldev, -- const struct zl3073x_chip_info *chip_info) -+int zl3073x_dev_probe(struct zl3073x_dev *zldev) - { - u16 id, revision, fw_ver; - unsigned int i; -@@ -1011,18 +960,17 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev, - if (rc) - return rc; - -- /* Check it matches */ -- for (i = 0; i < chip_info->num_ids; i++) { -- if (id == chip_info->ids[i]) -+ /* Detect chip variant */ -+ for (i = 0; i < ARRAY_SIZE(zl3073x_chip_ids); i++) { -+ if (zl3073x_chip_ids[i].id == id) - break; - } - -- if (i == chip_info->num_ids) { -+ if (i == ARRAY_SIZE(zl3073x_chip_ids)) - return dev_err_probe(zldev->dev, -ENODEV, -- "Unknown or non-match chip ID: 0x%0x\n", -- id); -- } -- zldev->chip_id = id; -+ "Unknown chip ID: 0x%04x\n", id); -+ -+ zldev->info = &zl3073x_chip_ids[i]; - - /* Read revision, firmware version and custom config version */ - rc = zl3073x_read_u16(zldev, ZL_REG_REVISION, &revision); -@@ -1061,7 +1009,7 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev, - "Failed to initialize mutex\n"); - - /* Register DPLL channels */ -- rc = zl3073x_devm_dpll_init(zldev, chip_info->num_channels); -+ rc = zl3073x_devm_dpll_init(zldev); - if (rc) - return rc; - -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index fd2af3c62a7d..fde5c8371fbd 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -30,12 +30,32 @@ struct zl3073x_dpll; - #define ZL3073X_NUM_PINS (ZL3073X_NUM_INPUT_PINS + \ - ZL3073X_NUM_OUTPUT_PINS) - -+enum zl3073x_flags { -+ ZL3073X_FLAG_REF_PHASE_COMP_32_BIT, -+ ZL3073X_FLAGS_NBITS /* must be last */ -+}; -+ -+#define __ZL3073X_FLAG(name) BIT(ZL3073X_FLAG_ ## name ## _BIT) -+#define ZL3073X_FLAG_REF_PHASE_COMP_32 __ZL3073X_FLAG(REF_PHASE_COMP_32) -+ -+/** -+ * struct zl3073x_chip_info - chip variant identification -+ * @id: chip ID -+ * @num_channels: number of DPLL channels supported by this variant -+ * @flags: chip variant flags -+ */ -+struct zl3073x_chip_info { -+ u16 id; -+ u8 num_channels; -+ unsigned long flags; -+}; -+ - /** - * struct zl3073x_dev - zl3073x device - * @dev: pointer to device - * @regmap: regmap to access device registers -+ * @info: detected chip info - * @multiop_lock: to serialize multiple register operations -- * @chip_id: chip ID read from hardware - * @ref: array of input references' invariants - * @out: array of outs' invariants - * @synth: array of synths' invariants -@@ -46,10 +66,10 @@ struct zl3073x_dpll; - * @phase_avg_factor: phase offset measurement averaging factor - */ - struct zl3073x_dev { -- struct device *dev; -- struct regmap *regmap; -- struct mutex multiop_lock; -- u16 chip_id; -+ struct device *dev; -+ struct regmap *regmap; -+ const struct zl3073x_chip_info *info; -+ struct mutex multiop_lock; - - /* Invariants */ - struct zl3073x_ref ref[ZL3073X_NUM_REFS]; -@@ -68,22 +88,10 @@ struct zl3073x_dev { - u8 phase_avg_factor; - }; - --struct zl3073x_chip_info { -- const u16 *ids; -- size_t num_ids; -- int num_channels; --}; -- --extern const struct zl3073x_chip_info zl30731_chip_info; --extern const struct zl3073x_chip_info zl30732_chip_info; --extern const struct zl3073x_chip_info zl30733_chip_info; --extern const struct zl3073x_chip_info zl30734_chip_info; --extern const struct zl3073x_chip_info zl30735_chip_info; - extern const struct regmap_config zl3073x_regmap_config; - - struct zl3073x_dev *zl3073x_devm_alloc(struct device *dev); --int zl3073x_dev_probe(struct zl3073x_dev *zldev, -- const struct zl3073x_chip_info *chip_info); -+int zl3073x_dev_probe(struct zl3073x_dev *zldev); - - int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full); - void zl3073x_dev_stop(struct zl3073x_dev *zldev); -@@ -158,18 +166,7 @@ int zl3073x_ref_phase_offsets_update(struct zl3073x_dev *zldev, int channel); - static inline bool - zl3073x_dev_is_ref_phase_comp_32bit(struct zl3073x_dev *zldev) - { -- switch (zldev->chip_id) { -- case 0x0E30: -- case 0x0E93: -- case 0x0E94: -- case 0x0E95: -- case 0x0E96: -- case 0x0E97: -- case 0x1F60: -- return true; -- default: -- return false; -- } -+ return zldev->info->flags & ZL3073X_FLAG_REF_PHASE_COMP_32; - } - - static inline bool -diff --git a/drivers/dpll/zl3073x/i2c.c b/drivers/dpll/zl3073x/i2c.c -index 7bbfdd4ed867..979df85826ab 100644 ---- a/drivers/dpll/zl3073x/i2c.c -+++ b/drivers/dpll/zl3073x/i2c.c -@@ -22,40 +22,25 @@ static int zl3073x_i2c_probe(struct i2c_client *client) - return dev_err_probe(dev, PTR_ERR(zldev->regmap), - "Failed to initialize regmap\n"); - -- return zl3073x_dev_probe(zldev, i2c_get_match_data(client)); -+ return zl3073x_dev_probe(zldev); - } - - static const struct i2c_device_id zl3073x_i2c_id[] = { -- { -- .name = "zl30731", -- .driver_data = (kernel_ulong_t)&zl30731_chip_info, -- }, -- { -- .name = "zl30732", -- .driver_data = (kernel_ulong_t)&zl30732_chip_info, -- }, -- { -- .name = "zl30733", -- .driver_data = (kernel_ulong_t)&zl30733_chip_info, -- }, -- { -- .name = "zl30734", -- .driver_data = (kernel_ulong_t)&zl30734_chip_info, -- }, -- { -- .name = "zl30735", -- .driver_data = (kernel_ulong_t)&zl30735_chip_info, -- }, -+ { "zl30731" }, -+ { "zl30732" }, -+ { "zl30733" }, -+ { "zl30734" }, -+ { "zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(i2c, zl3073x_i2c_id); - - static const struct of_device_id zl3073x_i2c_of_match[] = { -- { .compatible = "microchip,zl30731", .data = &zl30731_chip_info }, -- { .compatible = "microchip,zl30732", .data = &zl30732_chip_info }, -- { .compatible = "microchip,zl30733", .data = &zl30733_chip_info }, -- { .compatible = "microchip,zl30734", .data = &zl30734_chip_info }, -- { .compatible = "microchip,zl30735", .data = &zl30735_chip_info }, -+ { .compatible = "microchip,zl30731" }, -+ { .compatible = "microchip,zl30732" }, -+ { .compatible = "microchip,zl30733" }, -+ { .compatible = "microchip,zl30734" }, -+ { .compatible = "microchip,zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(of, zl3073x_i2c_of_match); -diff --git a/drivers/dpll/zl3073x/spi.c b/drivers/dpll/zl3073x/spi.c -index af901b4d6dda..f024f42b78d0 100644 ---- a/drivers/dpll/zl3073x/spi.c -+++ b/drivers/dpll/zl3073x/spi.c -@@ -22,40 +22,25 @@ static int zl3073x_spi_probe(struct spi_device *spi) - return dev_err_probe(dev, PTR_ERR(zldev->regmap), - "Failed to initialize regmap\n"); - -- return zl3073x_dev_probe(zldev, spi_get_device_match_data(spi)); -+ return zl3073x_dev_probe(zldev); - } - - static const struct spi_device_id zl3073x_spi_id[] = { -- { -- .name = "zl30731", -- .driver_data = (kernel_ulong_t)&zl30731_chip_info -- }, -- { -- .name = "zl30732", -- .driver_data = (kernel_ulong_t)&zl30732_chip_info, -- }, -- { -- .name = "zl30733", -- .driver_data = (kernel_ulong_t)&zl30733_chip_info, -- }, -- { -- .name = "zl30734", -- .driver_data = (kernel_ulong_t)&zl30734_chip_info, -- }, -- { -- .name = "zl30735", -- .driver_data = (kernel_ulong_t)&zl30735_chip_info, -- }, -+ { "zl30731" }, -+ { "zl30732" }, -+ { "zl30733" }, -+ { "zl30734" }, -+ { "zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(spi, zl3073x_spi_id); - - static const struct of_device_id zl3073x_spi_of_match[] = { -- { .compatible = "microchip,zl30731", .data = &zl30731_chip_info }, -- { .compatible = "microchip,zl30732", .data = &zl30732_chip_info }, -- { .compatible = "microchip,zl30733", .data = &zl30733_chip_info }, -- { .compatible = "microchip,zl30734", .data = &zl30734_chip_info }, -- { .compatible = "microchip,zl30735", .data = &zl30735_chip_info }, -+ { .compatible = "microchip,zl30731" }, -+ { .compatible = "microchip,zl30732" }, -+ { .compatible = "microchip,zl30733" }, -+ { .compatible = "microchip,zl30734" }, -+ { .compatible = "microchip,zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(of, zl3073x_spi_of_match); --- -2.50.1 (Apple Git-155) - diff --git a/1251-dpll-zl3073x-add-die-temperature-reporting-for-supported-chi.patch b/1251-dpll-zl3073x-add-die-temperature-reporting-for-supported-chi.patch deleted file mode 100644 index 9293f7344..000000000 --- a/1251-dpll-zl3073x-add-die-temperature-reporting-for-supported-chi.patch +++ /dev/null @@ -1,183 +0,0 @@ -From 0320baa880dd1e760bf8d15d5d8da898b265f4ed Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:50:27 +0200 -Subject: [PATCH] dpll: zl3073x: add die temperature reporting for supported - chips - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit 3a97e02b3e91e4d40095ad9bb6e466d8d7c1a1bc -Author: Ivan Vecera -Date: Fri Feb 27 11:53:00 2026 +0100 - - dpll: zl3073x: add die temperature reporting for supported chips - - Some zl3073x chip variants (0x1Exx, 0x2Exx and 0x3FC4) provide a die - temperature status register with 0.1 C resolution. - - Add a ZL3073X_FLAG_DIE_TEMP chip flag to identify these variants and - implement zl3073x_dpll_temp_get() as the dpll_device_ops.temp_get - callback. The register value is converted from 0.1 C units to - millidegrees as expected by the DPLL subsystem. - - To support per-instance ops selection, copy the base dpll_device_ops - into struct zl3073x_dpll and conditionally set .temp_get during device - registration based on the chip flag. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260227105300.710272-3-ivecera@redhat.com - Reviewed-by: Simon Horman - Signed-off-by: Paolo Abeni - -(cherry picked from commit 3a97e02b3e91e4d40095ad9bb6e466d8d7c1a1bc) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index c8af34301045..10e036ccf08f 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -30,18 +30,18 @@ static const struct zl3073x_chip_info zl3073x_chip_ids[] = { - ZL_CHIP_INFO(0x0E95, 3, ZL3073X_FLAG_REF_PHASE_COMP_32), - ZL_CHIP_INFO(0x0E96, 4, ZL3073X_FLAG_REF_PHASE_COMP_32), - ZL_CHIP_INFO(0x0E97, 5, ZL3073X_FLAG_REF_PHASE_COMP_32), -- ZL_CHIP_INFO(0x1E93, 1, 0), -- ZL_CHIP_INFO(0x1E94, 2, 0), -- ZL_CHIP_INFO(0x1E95, 3, 0), -- ZL_CHIP_INFO(0x1E96, 4, 0), -- ZL_CHIP_INFO(0x1E97, 5, 0), -+ ZL_CHIP_INFO(0x1E93, 1, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E94, 2, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E95, 3, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E96, 4, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E97, 5, ZL3073X_FLAG_DIE_TEMP), - ZL_CHIP_INFO(0x1F60, 2, ZL3073X_FLAG_REF_PHASE_COMP_32), -- ZL_CHIP_INFO(0x2E93, 1, 0), -- ZL_CHIP_INFO(0x2E94, 2, 0), -- ZL_CHIP_INFO(0x2E95, 3, 0), -- ZL_CHIP_INFO(0x2E96, 4, 0), -- ZL_CHIP_INFO(0x2E97, 5, 0), -- ZL_CHIP_INFO(0x3FC4, 2, 0), -+ ZL_CHIP_INFO(0x2E93, 1, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E94, 2, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E95, 3, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E96, 4, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E97, 5, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x3FC4, 2, ZL3073X_FLAG_DIE_TEMP), - }; - - #define ZL_RANGE_OFFSET 0x80 -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index fde5c8371fbd..b6f22ee1c0bd 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -32,11 +32,13 @@ struct zl3073x_dpll; - - enum zl3073x_flags { - ZL3073X_FLAG_REF_PHASE_COMP_32_BIT, -+ ZL3073X_FLAG_DIE_TEMP_BIT, - ZL3073X_FLAGS_NBITS /* must be last */ - }; - - #define __ZL3073X_FLAG(name) BIT(ZL3073X_FLAG_ ## name ## _BIT) - #define ZL3073X_FLAG_REF_PHASE_COMP_32 __ZL3073X_FLAG(REF_PHASE_COMP_32) -+#define ZL3073X_FLAG_DIE_TEMP __ZL3073X_FLAG(DIE_TEMP) - - /** - * struct zl3073x_chip_info - chip variant identification -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 8ffbede117c6..31926a74c414 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -1065,6 +1065,25 @@ zl3073x_dpll_output_pin_state_on_dpll_get(const struct dpll_pin *dpll_pin, - return 0; - } - -+static int -+zl3073x_dpll_temp_get(const struct dpll_device *dpll, void *dpll_priv, -+ s32 *temp, struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ u16 val; -+ int rc; -+ -+ rc = zl3073x_read_u16(zldev, ZL_REG_DIE_TEMP_STATUS, &val); -+ if (rc) -+ return rc; -+ -+ /* Register value is in units of 0.1 C, convert to millidegrees */ -+ *temp = (s16)val * 100; -+ -+ return 0; -+} -+ - static int - zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_lock_status *status, -@@ -1671,6 +1690,10 @@ zl3073x_dpll_device_register(struct zl3073x_dpll *zldpll) - zldpll->forced_ref = FIELD_GET(ZL_DPLL_MODE_REFSEL_REF, - dpll_mode_refsel); - -+ zldpll->ops = zl3073x_dpll_device_ops; -+ if (zldev->info->flags & ZL3073X_FLAG_DIE_TEMP) -+ zldpll->ops.temp_get = zl3073x_dpll_temp_get; -+ - zldpll->dpll_dev = dpll_device_get(zldev->clock_id, zldpll->id, - THIS_MODULE, &zldpll->tracker); - if (IS_ERR(zldpll->dpll_dev)) { -@@ -1682,7 +1705,7 @@ zl3073x_dpll_device_register(struct zl3073x_dpll *zldpll) - - rc = dpll_device_register(zldpll->dpll_dev, - zl3073x_prop_dpll_type_get(zldev, zldpll->id), -- &zl3073x_dpll_device_ops, zldpll); -+ &zldpll->ops, zldpll); - if (rc) { - dpll_device_put(zldpll->dpll_dev, &zldpll->tracker); - zldpll->dpll_dev = NULL; -@@ -1705,8 +1728,7 @@ zl3073x_dpll_device_unregister(struct zl3073x_dpll *zldpll) - - cancel_work_sync(&zldpll->change_work); - -- dpll_device_unregister(zldpll->dpll_dev, &zl3073x_dpll_device_ops, -- zldpll); -+ dpll_device_unregister(zldpll->dpll_dev, &zldpll->ops, zldpll); - dpll_device_put(zldpll->dpll_dev, &zldpll->tracker); - zldpll->dpll_dev = NULL; - } -diff --git a/drivers/dpll/zl3073x/dpll.h b/drivers/dpll/zl3073x/dpll.h -index c65c798c3792..278a24f357c9 100644 ---- a/drivers/dpll/zl3073x/dpll.h -+++ b/drivers/dpll/zl3073x/dpll.h -@@ -17,6 +17,7 @@ - * @forced_ref: selected reference in forced reference lock mode - * @check_count: periodic check counter - * @phase_monitor: is phase offset monitor enabled -+ * @ops: DPLL device operations for this instance - * @dpll_dev: pointer to registered DPLL device - * @tracker: tracking object for the acquired reference - * @lock_status: last saved DPLL lock status -@@ -31,6 +32,7 @@ struct zl3073x_dpll { - u8 forced_ref; - u8 check_count; - bool phase_monitor; -+ struct dpll_device_ops ops; - struct dpll_device *dpll_dev; - dpll_tracker tracker; - enum dpll_lock_status lock_status; -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index 5573d7188406..19c598daa784 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -78,6 +78,8 @@ - #define ZL_REG_RESET_STATUS ZL_REG(0, 0x18, 1) - #define ZL_REG_RESET_STATUS_RESET BIT(0) - -+#define ZL_REG_DIE_TEMP_STATUS ZL_REG(0, 0x44, 2) -+ - /************************* - * Register Page 2, Status - *************************/ --- -2.50.1 (Apple Git-155) - diff --git a/1252-dpll-zl3073x-use-struct-group-to-partition-states.patch b/1252-dpll-zl3073x-use-struct-group-to-partition-states.patch deleted file mode 100644 index 07eee22eb..000000000 --- a/1252-dpll-zl3073x-use-struct-group-to-partition-states.patch +++ /dev/null @@ -1,305 +0,0 @@ -From f222542cbe20b882e741d32029bd9d3a2136cb1c Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:50:47 +0200 -Subject: [PATCH] dpll: zl3073x: use struct_group to partition states - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit f327f5a8115e80d954598cf2d5c461873042b7f6 -Author: Ivan Vecera -Date: Sun Mar 15 18:42:19 2026 +0100 - - dpll: zl3073x: use struct_group to partition states - - Organize the zl3073x_out, zl3073x_ref, and zl3073x_synth structures - using struct_group() to partition fields into semantic groups: - - * cfg: mutable configuration written to HW via state_set - * inv: invariant fields set once during state_fetch - * stat: read-only status - - This enables group-level operations in place of field-by-field copies: - - * state_set validates invariants haven't changed (WARN_ON + -EINVAL) - * state_set short-circuits when cfg is unchanged - * state_set copy entire groups in a single assignment instead of - enumerating each field - - Add kernel doc for zl3073x_out_state_set and zl3073x_ref_state_set - documenting the new invariant validation and short-circuit semantics. - - Remove forward declaration of zl3073x_synth_state_set(). - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260315174224.399074-2-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit f327f5a8115e80d954598cf2d5c461873042b7f6) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/out.c b/drivers/dpll/zl3073x/out.c -index 86829a0c1c02..eb5628aebcee 100644 ---- a/drivers/dpll/zl3073x/out.c -+++ b/drivers/dpll/zl3073x/out.c -@@ -106,12 +106,32 @@ const struct zl3073x_out *zl3073x_out_state_get(struct zl3073x_dev *zldev, - return &zldev->out[index]; - } - -+/** -+ * zl3073x_out_state_set - commit output state changes to hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: output index to set state for -+ * @out: desired output state -+ * -+ * Validates that invariant fields have not been modified, skips the HW -+ * write if the mutable configuration is unchanged, and otherwise writes -+ * only the changed cfg fields to hardware via the mailbox interface. -+ * -+ * Return: 0 on success, -EINVAL if invariants changed, <0 on HW error -+ */ - int zl3073x_out_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_out *out) - { - struct zl3073x_out *dout = &zldev->out[index]; - int rc; - -+ /* Reject attempts to change invariant fields (set at fetch only) */ -+ if (WARN_ON(memcmp(&dout->inv, &out->inv, sizeof(out->inv)))) -+ return -EINVAL; -+ -+ /* Skip HW write if configuration hasn't changed */ -+ if (!memcmp(&dout->cfg, &out->cfg, sizeof(out->cfg))) -+ return 0; -+ - guard(mutex)(&zldev->multiop_lock); - - /* Read output configuration into mailbox */ -@@ -146,12 +166,7 @@ int zl3073x_out_state_set(struct zl3073x_dev *zldev, u8 index, - return rc; - - /* After successful commit store new state */ -- dout->div = out->div; -- dout->width = out->width; -- dout->esync_n_period = out->esync_n_period; -- dout->esync_n_width = out->esync_n_width; -- dout->mode = out->mode; -- dout->phase_comp = out->phase_comp; -+ dout->cfg = out->cfg; - - return 0; - } -diff --git a/drivers/dpll/zl3073x/out.h b/drivers/dpll/zl3073x/out.h -index 318f9bb8da3a..edf40432bba5 100644 ---- a/drivers/dpll/zl3073x/out.h -+++ b/drivers/dpll/zl3073x/out.h -@@ -4,6 +4,7 @@ - #define _ZL3073X_OUT_H - - #include -+#include - #include - - #include "regs.h" -@@ -17,17 +18,21 @@ struct zl3073x_dev; - * @esync_n_period: embedded sync or n-pin period (for n-div formats) - * @esync_n_width: embedded sync or n-pin pulse width - * @phase_comp: phase compensation -- * @ctrl: output control - * @mode: output mode -+ * @ctrl: output control - */ - struct zl3073x_out { -- u32 div; -- u32 width; -- u32 esync_n_period; -- u32 esync_n_width; -- s32 phase_comp; -- u8 ctrl; -- u8 mode; -+ struct_group(cfg, /* Config */ -+ u32 div; -+ u32 width; -+ u32 esync_n_period; -+ u32 esync_n_width; -+ s32 phase_comp; -+ u8 mode; -+ ); -+ struct_group(inv, /* Invariants */ -+ u8 ctrl; -+ ); - }; - - int zl3073x_out_state_fetch(struct zl3073x_dev *zldev, u8 index); -diff --git a/drivers/dpll/zl3073x/ref.c b/drivers/dpll/zl3073x/ref.c -index 6b65e6103999..8b4c4807bcc4 100644 ---- a/drivers/dpll/zl3073x/ref.c -+++ b/drivers/dpll/zl3073x/ref.c -@@ -73,14 +73,8 @@ int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index) - struct zl3073x_ref *p_ref = ref - 1; /* P-pin counterpart*/ - - /* Copy the shared items from the P-pin */ -- ref->config = p_ref->config; -- ref->esync_n_div = p_ref->esync_n_div; -- ref->freq_base = p_ref->freq_base; -- ref->freq_mult = p_ref->freq_mult; -- ref->freq_ratio_m = p_ref->freq_ratio_m; -- ref->freq_ratio_n = p_ref->freq_ratio_n; -- ref->phase_comp = p_ref->phase_comp; -- ref->sync_ctrl = p_ref->sync_ctrl; -+ ref->cfg = p_ref->cfg; -+ ref->inv = p_ref->inv; - - return 0; /* Finish - no non-shared items for now */ - } -@@ -154,12 +148,32 @@ zl3073x_ref_state_get(struct zl3073x_dev *zldev, u8 index) - return &zldev->ref[index]; - } - -+/** -+ * zl3073x_ref_state_set - commit input reference state changes to hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: input reference index to set state for -+ * @ref: desired reference state -+ * -+ * Validates that invariant fields have not been modified, skips the HW -+ * write if the mutable configuration is unchanged, and otherwise writes -+ * only the changed cfg fields to hardware via the mailbox interface. -+ * -+ * Return: 0 on success, -EINVAL if invariants changed, <0 on HW error -+ */ - int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_ref *ref) - { - struct zl3073x_ref *dref = &zldev->ref[index]; - int rc; - -+ /* Reject attempts to change invariant fields (set at init only) */ -+ if (WARN_ON(memcmp(&dref->inv, &ref->inv, sizeof(ref->inv)))) -+ return -EINVAL; -+ -+ /* Skip HW write if configuration hasn't changed */ -+ if (!memcmp(&dref->cfg, &ref->cfg, sizeof(ref->cfg))) -+ return 0; -+ - guard(mutex)(&zldev->multiop_lock); - - /* Read reference configuration into mailbox */ -@@ -207,13 +221,7 @@ int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - return rc; - - /* After successful commit store new state */ -- dref->freq_base = ref->freq_base; -- dref->freq_mult = ref->freq_mult; -- dref->freq_ratio_m = ref->freq_ratio_m; -- dref->freq_ratio_n = ref->freq_ratio_n; -- dref->esync_n_div = ref->esync_n_div; -- dref->sync_ctrl = ref->sync_ctrl; -- dref->phase_comp = ref->phase_comp; -+ dref->cfg = ref->cfg; - - return 0; - } -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index 0d8618f5ce8d..ab3a816c2910 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -5,6 +5,7 @@ - - #include - #include -+#include - #include - - #include "regs.h" -@@ -13,28 +14,34 @@ struct zl3073x_dev; - - /** - * struct zl3073x_ref - input reference state -- * @ffo: current fractional frequency offset - * @phase_comp: phase compensation - * @esync_n_div: divisor for embedded sync or n-divided signal formats - * @freq_base: frequency base - * @freq_mult: frequnecy multiplier - * @freq_ratio_m: FEC mode multiplier - * @freq_ratio_n: FEC mode divisor -- * @config: reference config - * @sync_ctrl: reference sync control -+ * @config: reference config -+ * @ffo: current fractional frequency offset - * @mon_status: reference monitor status - */ - struct zl3073x_ref { -- s64 ffo; -- u64 phase_comp; -- u32 esync_n_div; -- u16 freq_base; -- u16 freq_mult; -- u16 freq_ratio_m; -- u16 freq_ratio_n; -- u8 config; -- u8 sync_ctrl; -- u8 mon_status; -+ struct_group(cfg, /* Configuration */ -+ u64 phase_comp; -+ u32 esync_n_div; -+ u16 freq_base; -+ u16 freq_mult; -+ u16 freq_ratio_m; -+ u16 freq_ratio_n; -+ u8 sync_ctrl; -+ ); -+ struct_group(inv, /* Invariants */ -+ u8 config; -+ ); -+ struct_group(stat, /* Status */ -+ s64 ffo; -+ u8 mon_status; -+ ); - }; - - int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index); -diff --git a/drivers/dpll/zl3073x/synth.h b/drivers/dpll/zl3073x/synth.h -index 6c55eb8a888c..89e13ea2e6d9 100644 ---- a/drivers/dpll/zl3073x/synth.h -+++ b/drivers/dpll/zl3073x/synth.h -@@ -5,6 +5,7 @@ - - #include - #include -+#include - #include - - #include "regs.h" -@@ -20,11 +21,13 @@ struct zl3073x_dev; - * @ctrl: synth control - */ - struct zl3073x_synth { -- u32 freq_mult; -- u16 freq_base; -- u16 freq_m; -- u16 freq_n; -- u8 ctrl; -+ struct_group(inv, /* Invariants */ -+ u32 freq_mult; -+ u16 freq_base; -+ u16 freq_m; -+ u16 freq_n; -+ u8 ctrl; -+ ); - }; - - int zl3073x_synth_state_fetch(struct zl3073x_dev *zldev, u8 synth_id); -@@ -32,9 +35,6 @@ int zl3073x_synth_state_fetch(struct zl3073x_dev *zldev, u8 synth_id); - const struct zl3073x_synth *zl3073x_synth_state_get(struct zl3073x_dev *zldev, - u8 synth_id); - --int zl3073x_synth_state_set(struct zl3073x_dev *zldev, u8 synth_id, -- const struct zl3073x_synth *synth); -- - /** - * zl3073x_synth_dpll_get - get DPLL ID the synth is driven by - * @synth: pointer to synth state --- -2.50.1 (Apple Git-155) - diff --git a/1253-dpll-zl3073x-add-zl3073x-ref-state-update-helper.patch b/1253-dpll-zl3073x-add-zl3073x-ref-state-update-helper.patch deleted file mode 100644 index 55ea91c14..000000000 --- a/1253-dpll-zl3073x-add-zl3073x-ref-state-update-helper.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 98b442e23ddaf8448ee6e7ed30dcbeb137a4f7ad Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:51:01 +0200 -Subject: [PATCH] dpll: zl3073x: add zl3073x_ref_state_update helper - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit 05ea2ab3b10075e8fcfcd5e283e486df7055de5e -Author: Ivan Vecera -Date: Sun Mar 15 18:42:20 2026 +0100 - - dpll: zl3073x: add zl3073x_ref_state_update helper - - Extract the per-reference monitor status HW read into a dedicated - zl3073x_ref_state_update() helper in the ref module. Rename - zl3073x_dev_ref_status_update() to zl3073x_dev_ref_states_update() - and use the new helper in it. Call it from zl3073x_ref_state_fetch() - as well so that mon_status is initialized at device startup. This - keeps direct register access and struct field writes behind the ref - module's interface, consistent with the state management pattern - used for other ref operations. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260315174224.399074-3-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 05ea2ab3b10075e8fcfcd5e283e486df7055de5e) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 10e036ccf08f..07626082aae3 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -543,13 +543,12 @@ zl3073x_dev_state_fetch(struct zl3073x_dev *zldev) - } - - static void --zl3073x_dev_ref_status_update(struct zl3073x_dev *zldev) -+zl3073x_dev_ref_states_update(struct zl3073x_dev *zldev) - { - int i, rc; - - for (i = 0; i < ZL3073X_NUM_REFS; i++) { -- rc = zl3073x_read_u8(zldev, ZL_REG_REF_MON_STATUS(i), -- &zldev->ref[i].mon_status); -+ rc = zl3073x_ref_state_update(zldev, i); - if (rc) - dev_warn(zldev->dev, - "Failed to get REF%u status: %pe\n", i, -@@ -679,8 +678,8 @@ zl3073x_dev_periodic_work(struct kthread_work *work) - struct zl3073x_dpll *zldpll; - int rc; - -- /* Update input references status */ -- zl3073x_dev_ref_status_update(zldev); -+ /* Update input references' states */ -+ zl3073x_dev_ref_states_update(zldev); - - /* Update DPLL-to-connected-ref phase offsets registers */ - rc = zl3073x_ref_phase_offsets_update(zldev, -1); -diff --git a/drivers/dpll/zl3073x/ref.c b/drivers/dpll/zl3073x/ref.c -index 8b4c4807bcc4..825ac30bcd6f 100644 ---- a/drivers/dpll/zl3073x/ref.c -+++ b/drivers/dpll/zl3073x/ref.c -@@ -51,6 +51,21 @@ zl3073x_ref_freq_factorize(u32 freq, u16 *base, u16 *mult) - return -EINVAL; - } - -+/** -+ * zl3073x_ref_state_update - update input reference status from HW -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: input reference index -+ * -+ * Return: 0 on success, <0 on error -+ */ -+int zl3073x_ref_state_update(struct zl3073x_dev *zldev, u8 index) -+{ -+ struct zl3073x_ref *ref = &zldev->ref[index]; -+ -+ return zl3073x_read_u8(zldev, ZL_REG_REF_MON_STATUS(index), -+ &ref->mon_status); -+} -+ - /** - * zl3073x_ref_state_fetch - fetch input reference state from hardware - * @zldev: pointer to zl3073x_dev structure -@@ -79,6 +94,11 @@ int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index) - return 0; /* Finish - no non-shared items for now */ - } - -+ /* Read reference status */ -+ rc = zl3073x_ref_state_update(zldev, index); -+ if (rc) -+ return rc; -+ - guard(mutex)(&zldev->multiop_lock); - - /* Read reference configuration */ -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index ab3a816c2910..06d8d4d97ea2 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -52,6 +52,8 @@ const struct zl3073x_ref *zl3073x_ref_state_get(struct zl3073x_dev *zldev, - int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_ref *ref); - -+int zl3073x_ref_state_update(struct zl3073x_dev *zldev, u8 index); -+ - int zl3073x_ref_freq_factorize(u32 freq, u16 *base, u16 *mult); - - /** --- -2.50.1 (Apple Git-155) - diff --git a/1254-dpll-zl3073x-introduce-zl3073x-chan-for-dpll-channel-state.patch b/1254-dpll-zl3073x-introduce-zl3073x-chan-for-dpll-channel-state.patch deleted file mode 100644 index bd31dc929..000000000 --- a/1254-dpll-zl3073x-introduce-zl3073x-chan-for-dpll-channel-state.patch +++ /dev/null @@ -1,563 +0,0 @@ -From 99589ed2ea279188527603207e5beeeeb232c7ed Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:51:15 +0200 -Subject: [PATCH] dpll: zl3073x: introduce zl3073x_chan for DPLL channel state - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit 3032e95987fa0da656ce3a5eb454674e7cc60a12 -Author: Ivan Vecera -Date: Sun Mar 15 18:42:21 2026 +0100 - - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state - - Extract DPLL channel state management into a dedicated zl3073x_chan - module, following the pattern already established by zl3073x_ref, - zl3073x_out and zl3073x_synth. - - The new struct zl3073x_chan caches the raw mode_refsel register value - in a cfg group with inline getters and setters to extract and update - the bitfields. Three standard state management functions are provided: - - - zl3073x_chan_state_fetch: read the mode_refsel register from HW - - zl3073x_chan_state_get: return cached channel state - - zl3073x_chan_state_set: write changed state to HW, skip if unchanged - - The channel state array chan[ZL3073X_MAX_CHANNELS] is added to struct - zl3073x_dev. Channel state is fetched as part of - zl3073x_dev_state_fetch, using the chip-specific channel count. - - The refsel_mode and forced_ref fields are removed from struct - zl3073x_dpll and all direct register accesses in dpll.c are replaced - with the new chan state operations. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260315174224.399074-4-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 3032e95987fa0da656ce3a5eb454674e7cc60a12) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/Makefile b/drivers/dpll/zl3073x/Makefile -index bd324c7fe710..906ec3fbcc20 100644 ---- a/drivers/dpll/zl3073x/Makefile -+++ b/drivers/dpll/zl3073x/Makefile -@@ -1,8 +1,8 @@ - # SPDX-License-Identifier: GPL-2.0 - - obj-$(CONFIG_ZL3073X) += zl3073x.o --zl3073x-objs := core.o devlink.o dpll.o flash.o fw.o \ -- out.o prop.o ref.o synth.o -+zl3073x-objs := chan.o core.o devlink.o dpll.o \ -+ flash.o fw.o out.o prop.o ref.o synth.o - - obj-$(CONFIG_ZL3073X_I2C) += zl3073x_i2c.o - zl3073x_i2c-objs := i2c.o -diff --git a/drivers/dpll/zl3073x/chan.c b/drivers/dpll/zl3073x/chan.c -new file mode 100644 -index 000000000000..8019b8ce7351 ---- /dev/null -+++ b/drivers/dpll/zl3073x/chan.c -@@ -0,0 +1,79 @@ -+// SPDX-License-Identifier: GPL-2.0-only -+ -+#include -+#include -+#include -+ -+#include "chan.h" -+#include "core.h" -+ -+/** -+ * zl3073x_chan_state_fetch - fetch DPLL channel state from hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index to fetch state for -+ * -+ * Reads the mode_refsel register for the given DPLL channel and stores -+ * the raw value for later use. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index) -+{ -+ struct zl3073x_chan *chan = &zldev->chan[index]; -+ int rc; -+ -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(index), -+ &chan->mode_refsel); -+ if (rc) -+ return rc; -+ -+ dev_dbg(zldev->dev, "DPLL%u mode: %u, ref: %u\n", index, -+ zl3073x_chan_mode_get(chan), zl3073x_chan_ref_get(chan)); -+ -+ return 0; -+} -+ -+/** -+ * zl3073x_chan_state_get - get current DPLL channel state -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index to get state for -+ * -+ * Return: pointer to given DPLL channel state -+ */ -+const struct zl3073x_chan *zl3073x_chan_state_get(struct zl3073x_dev *zldev, -+ u8 index) -+{ -+ return &zldev->chan[index]; -+} -+ -+/** -+ * zl3073x_chan_state_set - commit DPLL channel state changes to hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index to set state for -+ * @chan: desired channel state -+ * -+ * Skips the HW write if the configuration is unchanged, and otherwise -+ * writes the mode_refsel register to hardware. -+ * -+ * Return: 0 on success, <0 on HW error -+ */ -+int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, -+ const struct zl3073x_chan *chan) -+{ -+ struct zl3073x_chan *dchan = &zldev->chan[index]; -+ int rc; -+ -+ /* Skip HW write if configuration hasn't changed */ -+ if (!memcmp(&dchan->cfg, &chan->cfg, sizeof(chan->cfg))) -+ return 0; -+ -+ rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(index), -+ chan->mode_refsel); -+ if (rc) -+ return rc; -+ -+ /* After successful write store new state */ -+ dchan->cfg = chan->cfg; -+ -+ return 0; -+} -diff --git a/drivers/dpll/zl3073x/chan.h b/drivers/dpll/zl3073x/chan.h -new file mode 100644 -index 000000000000..3e6ffaef0c74 ---- /dev/null -+++ b/drivers/dpll/zl3073x/chan.h -@@ -0,0 +1,74 @@ -+/* SPDX-License-Identifier: GPL-2.0-only */ -+ -+#ifndef _ZL3073X_CHAN_H -+#define _ZL3073X_CHAN_H -+ -+#include -+#include -+#include -+ -+#include "regs.h" -+ -+struct zl3073x_dev; -+ -+/** -+ * struct zl3073x_chan - DPLL channel state -+ * @mode_refsel: mode and reference selection register value -+ */ -+struct zl3073x_chan { -+ struct_group(cfg, -+ u8 mode_refsel; -+ ); -+}; -+ -+int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index); -+const struct zl3073x_chan *zl3073x_chan_state_get(struct zl3073x_dev *zldev, -+ u8 index); -+int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, -+ const struct zl3073x_chan *chan); -+ -+/** -+ * zl3073x_chan_mode_get - get DPLL channel operating mode -+ * @chan: pointer to channel state -+ * -+ * Return: reference selection mode of the given DPLL channel -+ */ -+static inline u8 zl3073x_chan_mode_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_MODE_REFSEL_MODE, chan->mode_refsel); -+} -+ -+/** -+ * zl3073x_chan_ref_get - get manually selected reference -+ * @chan: pointer to channel state -+ * -+ * Return: reference selected in forced reference lock mode -+ */ -+static inline u8 zl3073x_chan_ref_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_MODE_REFSEL_REF, chan->mode_refsel); -+} -+ -+/** -+ * zl3073x_chan_mode_set - set DPLL channel operating mode -+ * @chan: pointer to channel state -+ * @mode: mode to set -+ */ -+static inline void zl3073x_chan_mode_set(struct zl3073x_chan *chan, u8 mode) -+{ -+ chan->mode_refsel &= ~ZL_DPLL_MODE_REFSEL_MODE; -+ chan->mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_MODE, mode); -+} -+ -+/** -+ * zl3073x_chan_ref_set - set manually selected reference -+ * @chan: pointer to channel state -+ * @ref: reference to set -+ */ -+static inline void zl3073x_chan_ref_set(struct zl3073x_chan *chan, u8 ref) -+{ -+ chan->mode_refsel &= ~ZL_DPLL_MODE_REFSEL_REF; -+ chan->mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); -+} -+ -+#endif /* _ZL3073X_CHAN_H */ -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 07626082aae3..b03e59fa0834 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -539,6 +539,16 @@ zl3073x_dev_state_fetch(struct zl3073x_dev *zldev) - } - } - -+ for (i = 0; i < zldev->info->num_channels; i++) { -+ rc = zl3073x_chan_state_fetch(zldev, i); -+ if (rc) { -+ dev_err(zldev->dev, -+ "Failed to fetch channel state: %pe\n", -+ ERR_PTR(rc)); -+ return rc; -+ } -+ } -+ - return rc; - } - -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index b6f22ee1c0bd..2cfb9dd74aa5 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -9,6 +9,7 @@ - #include - #include - -+#include "chan.h" - #include "out.h" - #include "ref.h" - #include "regs.h" -@@ -61,6 +62,7 @@ struct zl3073x_chip_info { - * @ref: array of input references' invariants - * @out: array of outs' invariants - * @synth: array of synths' invariants -+ * @chan: array of DPLL channels' state - * @dplls: list of DPLLs - * @kworker: thread for periodic work - * @work: periodic work -@@ -77,6 +79,7 @@ struct zl3073x_dev { - struct zl3073x_ref ref[ZL3073X_NUM_REFS]; - struct zl3073x_out out[ZL3073X_NUM_OUTS]; - struct zl3073x_synth synth[ZL3073X_NUM_SYNTHS]; -+ struct zl3073x_chan chan[ZL3073X_MAX_CHANNELS]; - - /* DPLL channels */ - struct list_head dplls; -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 31926a74c414..767af6dd724d 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -259,10 +259,13 @@ static int - zl3073x_dpll_selected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) - { - struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_chan *chan; - u8 state, value; - int rc; - -- switch (zldpll->refsel_mode) { -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ -+ switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_AUTO: - /* For automatic mode read refsel_status register */ - rc = zl3073x_read_u8(zldev, -@@ -282,7 +285,7 @@ zl3073x_dpll_selected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) - break; - case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: - /* For manual mode return stored value */ -- *ref = zldpll->forced_ref; -+ *ref = zl3073x_chan_ref_get(chan); - break; - default: - /* For other modes like NCO, freerun... there is no input ref */ -@@ -307,10 +310,11 @@ static int - zl3073x_dpll_selected_ref_set(struct zl3073x_dpll *zldpll, u8 ref) - { - struct zl3073x_dev *zldev = zldpll->dev; -- u8 mode, mode_refsel; -- int rc; -+ struct zl3073x_chan chan; -+ u8 mode; - -- mode = zldpll->refsel_mode; -+ chan = *zl3073x_chan_state_get(zldev, zldpll->id); -+ mode = zl3073x_chan_mode_get(&chan); - - switch (mode) { - case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -@@ -328,8 +332,8 @@ zl3073x_dpll_selected_ref_set(struct zl3073x_dpll *zldpll, u8 ref) - break; - } - /* Keep selected reference */ -- ref = zldpll->forced_ref; -- } else if (ref == zldpll->forced_ref) { -+ ref = zl3073x_chan_ref_get(&chan); -+ } else if (ref == zl3073x_chan_ref_get(&chan)) { - /* No register update - same mode and same ref */ - return 0; - } -@@ -351,21 +355,10 @@ zl3073x_dpll_selected_ref_set(struct zl3073x_dpll *zldpll, u8 ref) - return -EOPNOTSUPP; - } - -- /* Build mode_refsel value */ -- mode_refsel = FIELD_PREP(ZL_DPLL_MODE_REFSEL_MODE, mode) | -- FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); -- -- /* Update dpll_mode_refsel register */ -- rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(zldpll->id), -- mode_refsel); -- if (rc) -- return rc; -- -- /* Store new mode and forced reference */ -- zldpll->refsel_mode = mode; -- zldpll->forced_ref = ref; -+ zl3073x_chan_mode_set(&chan, mode); -+ zl3073x_chan_ref_set(&chan, ref); - -- return rc; -+ return zl3073x_chan_state_set(zldev, zldpll->id, &chan); - } - - /** -@@ -624,9 +617,11 @@ zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, - { - struct zl3073x_dpll *zldpll = pin->dpll; - struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_chan *chan; - u8 ref, ref_conn; - int rc; - -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); - ref = zl3073x_input_pin_ref_get(pin->id); - - /* Get currently connected reference */ -@@ -643,7 +638,7 @@ zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, - * selectable and its monitor does not report any error then report - * pin as selectable. - */ -- if (zldpll->refsel_mode == ZL_DPLL_MODE_REFSEL_MODE_AUTO && -+ if (zl3073x_chan_mode_get(chan) == ZL_DPLL_MODE_REFSEL_MODE_AUTO && - zl3073x_dev_ref_is_status_ok(zldev, ref) && pin->selectable) { - *state = DPLL_PIN_STATE_SELECTABLE; - return 0; -@@ -678,10 +673,13 @@ zl3073x_dpll_input_pin_state_on_dpll_set(const struct dpll_pin *dpll_pin, - { - struct zl3073x_dpll *zldpll = dpll_priv; - struct zl3073x_dpll_pin *pin = pin_priv; -+ const struct zl3073x_chan *chan; - u8 new_ref; - int rc; - -- switch (zldpll->refsel_mode) { -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ -+ switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: - case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: - case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: -@@ -1092,10 +1090,13 @@ zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - { - struct zl3073x_dpll *zldpll = dpll_priv; - struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_chan *chan; - u8 mon_status, state; - int rc; - -- switch (zldpll->refsel_mode) { -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ -+ switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: - case ZL_DPLL_MODE_REFSEL_MODE_NCO: - /* In FREERUN and NCO modes the DPLL is always unlocked */ -@@ -1140,13 +1141,16 @@ zl3073x_dpll_supported_modes_get(const struct dpll_device *dpll, - struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -+ const struct zl3073x_chan *chan; -+ -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); - - /* We support switching between automatic and manual mode, except in - * a case where the DPLL channel is configured to run in NCO mode. - * In this case, report only the manual mode to which the NCO is mapped - * as the only supported one. - */ -- if (zldpll->refsel_mode != ZL_DPLL_MODE_REFSEL_MODE_NCO) -+ if (zl3073x_chan_mode_get(chan) != ZL_DPLL_MODE_REFSEL_MODE_NCO) - __set_bit(DPLL_MODE_AUTOMATIC, modes); - - __set_bit(DPLL_MODE_MANUAL, modes); -@@ -1159,8 +1163,11 @@ zl3073x_dpll_mode_get(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_mode *mode, struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -+ const struct zl3073x_chan *chan; - -- switch (zldpll->refsel_mode) { -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ -+ switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: - case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: - case ZL_DPLL_MODE_REFSEL_MODE_NCO: -@@ -1239,7 +1246,8 @@ zl3073x_dpll_mode_set(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_mode mode, struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -- u8 hw_mode, mode_refsel, ref; -+ struct zl3073x_chan chan; -+ u8 hw_mode, ref; - int rc; - - rc = zl3073x_dpll_selected_ref_get(zldpll, &ref); -@@ -1287,26 +1295,18 @@ zl3073x_dpll_mode_set(const struct dpll_device *dpll, void *dpll_priv, - hw_mode = ZL_DPLL_MODE_REFSEL_MODE_AUTO; - } - -- /* Build mode_refsel value */ -- mode_refsel = FIELD_PREP(ZL_DPLL_MODE_REFSEL_MODE, hw_mode); -- -+ chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ zl3073x_chan_mode_set(&chan, hw_mode); - if (ZL3073X_DPLL_REF_IS_VALID(ref)) -- mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); -+ zl3073x_chan_ref_set(&chan, ref); - -- /* Update dpll_mode_refsel register */ -- rc = zl3073x_write_u8(zldpll->dev, ZL_REG_DPLL_MODE_REFSEL(zldpll->id), -- mode_refsel); -+ rc = zl3073x_chan_state_set(zldpll->dev, zldpll->id, &chan); - if (rc) { - NL_SET_ERR_MSG_MOD(extack, - "failed to set reference selection mode"); - return rc; - } - -- zldpll->refsel_mode = hw_mode; -- -- if (ZL3073X_DPLL_REF_IS_VALID(ref)) -- zldpll->forced_ref = ref; -- - return 0; - } - -@@ -1559,15 +1559,18 @@ zl3073x_dpll_pin_is_registrable(struct zl3073x_dpll *zldpll, - enum dpll_pin_direction dir, u8 index) - { - struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_chan *chan; - bool is_diff, is_enabled; - const char *name; - -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ - if (dir == DPLL_PIN_DIRECTION_INPUT) { - u8 ref_id = zl3073x_input_pin_ref_get(index); - const struct zl3073x_ref *ref; - - /* Skip the pin if the DPLL is running in NCO mode */ -- if (zldpll->refsel_mode == ZL_DPLL_MODE_REFSEL_MODE_NCO) -+ if (zl3073x_chan_mode_get(chan) == ZL_DPLL_MODE_REFSEL_MODE_NCO) - return false; - - name = "REF"; -@@ -1675,21 +1678,8 @@ static int - zl3073x_dpll_device_register(struct zl3073x_dpll *zldpll) - { - struct zl3073x_dev *zldev = zldpll->dev; -- u8 dpll_mode_refsel; - int rc; - -- /* Read DPLL mode and forcibly selected reference */ -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(zldpll->id), -- &dpll_mode_refsel); -- if (rc) -- return rc; -- -- /* Extract mode and selected input reference */ -- zldpll->refsel_mode = FIELD_GET(ZL_DPLL_MODE_REFSEL_MODE, -- dpll_mode_refsel); -- zldpll->forced_ref = FIELD_GET(ZL_DPLL_MODE_REFSEL_REF, -- dpll_mode_refsel); -- - zldpll->ops = zl3073x_dpll_device_ops; - if (zldev->info->flags & ZL3073X_FLAG_DIE_TEMP) - zldpll->ops.temp_get = zl3073x_dpll_temp_get; -@@ -1844,8 +1834,10 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - struct zl3073x_dev *zldev = zldpll->dev; - enum dpll_lock_status lock_status; - struct device *dev = zldev->dev; -+ const struct zl3073x_chan *chan; - struct zl3073x_dpll_pin *pin; - int rc; -+ u8 mode; - - zldpll->check_count++; - -@@ -1867,8 +1859,10 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - /* Input pin monitoring does make sense only in automatic - * or forced reference modes. - */ -- if (zldpll->refsel_mode != ZL_DPLL_MODE_REFSEL_MODE_AUTO && -- zldpll->refsel_mode != ZL_DPLL_MODE_REFSEL_MODE_REFLOCK) -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ mode = zl3073x_chan_mode_get(chan); -+ if (mode != ZL_DPLL_MODE_REFSEL_MODE_AUTO && -+ mode != ZL_DPLL_MODE_REFSEL_MODE_REFLOCK) - return; - - /* Update phase offset latch registers for this DPLL if the phase -diff --git a/drivers/dpll/zl3073x/dpll.h b/drivers/dpll/zl3073x/dpll.h -index 278a24f357c9..115ee4f67e7a 100644 ---- a/drivers/dpll/zl3073x/dpll.h -+++ b/drivers/dpll/zl3073x/dpll.h -@@ -13,8 +13,6 @@ - * @list: this DPLL list entry - * @dev: pointer to multi-function parent device - * @id: DPLL index -- * @refsel_mode: reference selection mode -- * @forced_ref: selected reference in forced reference lock mode - * @check_count: periodic check counter - * @phase_monitor: is phase offset monitor enabled - * @ops: DPLL device operations for this instance -@@ -28,8 +26,6 @@ struct zl3073x_dpll { - struct list_head list; - struct zl3073x_dev *dev; - u8 id; -- u8 refsel_mode; -- u8 forced_ref; - u8 check_count; - bool phase_monitor; - struct dpll_device_ops ops; --- -2.50.1 (Apple Git-155) - diff --git a/1255-dpll-zl3073x-add-dpll-channel-status-fields-to-zl3073x-chan.patch b/1255-dpll-zl3073x-add-dpll-channel-status-fields-to-zl3073x-chan.patch deleted file mode 100644 index 13eb44b1a..000000000 --- a/1255-dpll-zl3073x-add-dpll-channel-status-fields-to-zl3073x-chan.patch +++ /dev/null @@ -1,288 +0,0 @@ -From 1325513643b0d024227fc1ef13470e2a84989622 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:51:26 +0200 -Subject: [PATCH] dpll: zl3073x: add DPLL channel status fields to zl3073x_chan - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit 41bab554d7e9840e17e4c8c7e93647161c6596bf -Author: Ivan Vecera -Date: Sun Mar 15 18:42:22 2026 +0100 - - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan - - Add mon_status and refsel_status fields to struct zl3073x_chan in a - stat group to cache the 'dpll_mon_status' and 'dpll_refsel_status' - registers. - - Add zl3073x_chan_lock_state_get(), zl3073x_chan_is_ho_ready(), - zl3073x_chan_refsel_state_get() and zl3073x_chan_refsel_ref_get() - inline helpers for reading cached state, and zl3073x_chan_state_update() - for refreshing both registers from hardware. Call it from - zl3073x_chan_state_fetch() as well so that channel status is - initialized at device startup. - - Call zl3073x_dev_chan_states_update() from the periodic work to - keep the cached state up to date and convert - zl3073x_dpll_lock_status_get() and zl3073x_dpll_selected_ref_get() - to use the cached state via the new helpers instead of direct register - reads. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260315174224.399074-5-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 41bab554d7e9840e17e4c8c7e93647161c6596bf) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/chan.c b/drivers/dpll/zl3073x/chan.c -index 8019b8ce7351..71fb60a9859b 100644 ---- a/drivers/dpll/zl3073x/chan.c -+++ b/drivers/dpll/zl3073x/chan.c -@@ -7,6 +7,27 @@ - #include "chan.h" - #include "core.h" - -+/** -+ * zl3073x_chan_state_update - update DPLL channel status from HW -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index -+ * -+ * Return: 0 on success, <0 on error -+ */ -+int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index) -+{ -+ struct zl3073x_chan *chan = &zldev->chan[index]; -+ int rc; -+ -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MON_STATUS(index), -+ &chan->mon_status); -+ if (rc) -+ return rc; -+ -+ return zl3073x_read_u8(zldev, ZL_REG_DPLL_REFSEL_STATUS(index), -+ &chan->refsel_status); -+} -+ - /** - * zl3073x_chan_state_fetch - fetch DPLL channel state from hardware - * @zldev: pointer to zl3073x_dev structure -@@ -30,6 +51,17 @@ int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index) - dev_dbg(zldev->dev, "DPLL%u mode: %u, ref: %u\n", index, - zl3073x_chan_mode_get(chan), zl3073x_chan_ref_get(chan)); - -+ rc = zl3073x_chan_state_update(zldev, index); -+ if (rc) -+ return rc; -+ -+ dev_dbg(zldev->dev, -+ "DPLL%u lock_state: %u, ho: %u, sel_state: %u, sel_ref: %u\n", -+ index, zl3073x_chan_lock_state_get(chan), -+ zl3073x_chan_is_ho_ready(chan) ? 1 : 0, -+ zl3073x_chan_refsel_state_get(chan), -+ zl3073x_chan_refsel_ref_get(chan)); -+ - return 0; - } - -diff --git a/drivers/dpll/zl3073x/chan.h b/drivers/dpll/zl3073x/chan.h -index 3e6ffaef0c74..f73a07610855 100644 ---- a/drivers/dpll/zl3073x/chan.h -+++ b/drivers/dpll/zl3073x/chan.h -@@ -14,11 +14,17 @@ struct zl3073x_dev; - /** - * struct zl3073x_chan - DPLL channel state - * @mode_refsel: mode and reference selection register value -+ * @mon_status: monitor status register value -+ * @refsel_status: reference selection status register value - */ - struct zl3073x_chan { - struct_group(cfg, - u8 mode_refsel; - ); -+ struct_group(stat, -+ u8 mon_status; -+ u8 refsel_status; -+ ); - }; - - int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index); -@@ -27,6 +33,8 @@ const struct zl3073x_chan *zl3073x_chan_state_get(struct zl3073x_dev *zldev, - int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_chan *chan); - -+int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index); -+ - /** - * zl3073x_chan_mode_get - get DPLL channel operating mode - * @chan: pointer to channel state -@@ -71,4 +79,48 @@ static inline void zl3073x_chan_ref_set(struct zl3073x_chan *chan, u8 ref) - chan->mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); - } - -+/** -+ * zl3073x_chan_lock_state_get - get DPLL channel lock state -+ * @chan: pointer to channel state -+ * -+ * Return: lock state of the given DPLL channel -+ */ -+static inline u8 zl3073x_chan_lock_state_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_MON_STATUS_STATE, chan->mon_status); -+} -+ -+/** -+ * zl3073x_chan_is_ho_ready - check if holdover is ready -+ * @chan: pointer to channel state -+ * -+ * Return: true if holdover is ready, false otherwise -+ */ -+static inline bool zl3073x_chan_is_ho_ready(const struct zl3073x_chan *chan) -+{ -+ return !!FIELD_GET(ZL_DPLL_MON_STATUS_HO_READY, chan->mon_status); -+} -+ -+/** -+ * zl3073x_chan_refsel_state_get - get reference selection state -+ * @chan: pointer to channel state -+ * -+ * Return: reference selection state of the given DPLL channel -+ */ -+static inline u8 zl3073x_chan_refsel_state_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_REFSEL_STATUS_STATE, chan->refsel_status); -+} -+ -+/** -+ * zl3073x_chan_refsel_ref_get - get currently selected reference in auto mode -+ * @chan: pointer to channel state -+ * -+ * Return: reference selected by the DPLL in automatic mode -+ */ -+static inline u8 zl3073x_chan_refsel_ref_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_REFSEL_STATUS_REFSEL, chan->refsel_status); -+} -+ - #endif /* _ZL3073X_CHAN_H */ -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index b03e59fa0834..6363002d48d4 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -566,6 +566,20 @@ zl3073x_dev_ref_states_update(struct zl3073x_dev *zldev) - } - } - -+static void -+zl3073x_dev_chan_states_update(struct zl3073x_dev *zldev) -+{ -+ int i, rc; -+ -+ for (i = 0; i < zldev->info->num_channels; i++) { -+ rc = zl3073x_chan_state_update(zldev, i); -+ if (rc) -+ dev_warn(zldev->dev, -+ "Failed to get DPLL%u state: %pe\n", i, -+ ERR_PTR(rc)); -+ } -+} -+ - /** - * zl3073x_ref_phase_offsets_update - update reference phase offsets - * @zldev: pointer to zl3073x_dev structure -@@ -691,6 +705,9 @@ zl3073x_dev_periodic_work(struct kthread_work *work) - /* Update input references' states */ - zl3073x_dev_ref_states_update(zldev); - -+ /* Update DPLL channels' states */ -+ zl3073x_dev_chan_states_update(zldev); -+ - /* Update DPLL-to-connected-ref phase offsets registers */ - rc = zl3073x_ref_phase_offsets_update(zldev, -1); - if (rc) -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 767af6dd724d..33c4f05ec9d3 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -258,28 +258,16 @@ zl3073x_dpll_input_pin_frequency_set(const struct dpll_pin *dpll_pin, - static int - zl3073x_dpll_selected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) - { -- struct zl3073x_dev *zldev = zldpll->dev; - const struct zl3073x_chan *chan; -- u8 state, value; -- int rc; - -- chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); - - switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_AUTO: -- /* For automatic mode read refsel_status register */ -- rc = zl3073x_read_u8(zldev, -- ZL_REG_DPLL_REFSEL_STATUS(zldpll->id), -- &value); -- if (rc) -- return rc; -- -- /* Extract reference state */ -- state = FIELD_GET(ZL_DPLL_REFSEL_STATUS_STATE, value); -- - /* Return the reference only if the DPLL is locked to it */ -- if (state == ZL_DPLL_REFSEL_STATUS_STATE_LOCK) -- *ref = FIELD_GET(ZL_DPLL_REFSEL_STATUS_REFSEL, value); -+ if (zl3073x_chan_refsel_state_get(chan) == -+ ZL_DPLL_REFSEL_STATUS_STATE_LOCK) -+ *ref = zl3073x_chan_refsel_ref_get(chan); - else - *ref = ZL3073X_DPLL_REF_NONE; - break; -@@ -1089,12 +1077,9 @@ zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -- struct zl3073x_dev *zldev = zldpll->dev; - const struct zl3073x_chan *chan; -- u8 mon_status, state; -- int rc; - -- chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); - - switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: -@@ -1107,16 +1092,9 @@ zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - break; - } - -- /* Read DPLL monitor status */ -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MON_STATUS(zldpll->id), -- &mon_status); -- if (rc) -- return rc; -- state = FIELD_GET(ZL_DPLL_MON_STATUS_STATE, mon_status); -- -- switch (state) { -+ switch (zl3073x_chan_lock_state_get(chan)) { - case ZL_DPLL_MON_STATUS_STATE_LOCK: -- if (FIELD_GET(ZL_DPLL_MON_STATUS_HO_READY, mon_status)) -+ if (zl3073x_chan_is_ho_ready(chan)) - *status = DPLL_LOCK_STATUS_LOCKED_HO_ACQ; - else - *status = DPLL_LOCK_STATUS_LOCKED; -@@ -1126,8 +1104,9 @@ zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - *status = DPLL_LOCK_STATUS_HOLDOVER; - break; - default: -- dev_warn(zldev->dev, "Unknown DPLL monitor status: 0x%02x\n", -- mon_status); -+ dev_warn(zldpll->dev->dev, -+ "Unknown DPLL monitor status: 0x%02x\n", -+ chan->mon_status); - *status = DPLL_LOCK_STATUS_UNLOCKED; - break; - } --- -2.50.1 (Apple Git-155) - diff --git a/1256-dpll-zl3073x-add-reference-priority-to-zl3073x-chan.patch b/1256-dpll-zl3073x-add-reference-priority-to-zl3073x-chan.patch deleted file mode 100644 index 4bd741a93..000000000 --- a/1256-dpll-zl3073x-add-reference-priority-to-zl3073x-chan.patch +++ /dev/null @@ -1,713 +0,0 @@ -From 4b33e0ad68ce2edfb7cdce8dc91d166eebf7f54b Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:51:32 +0200 -Subject: [PATCH] dpll: zl3073x: add reference priority to zl3073x_chan - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit f6b075bc3ad545d1c91e181c3f8ea6193d01602f -Author: Ivan Vecera -Date: Sun Mar 15 18:42:23 2026 +0100 - - dpll: zl3073x: add reference priority to zl3073x_chan - - Cache the ZL_REG_DPLL_REF_PRIO registers in the zl3073x_chan cfg group. - These mailbox-based registers store per-reference priority values - (4 bits each, P/N packed) used for automatic reference selection. - - Add ref_prio[] array to struct zl3073x_chan and provide inline helpers - zl3073x_chan_ref_prio_get(), zl3073x_chan_ref_prio_set(), and - zl3073x_chan_ref_is_selectable() for nibble-level access and priority - queries. Extend state_fetch and state_set with DPLL mailbox operations - to read and write the priority registers. - - Replace the ad-hoc zl3073x_dpll_ref_prio_get/set functions in dpll.c - with the cached state pattern, removing direct mailbox access from - the DPLL layer. This also simplifies pin registration since reading - priority from cached state cannot fail. - - Remove the pin->selectable flag from struct zl3073x_dpll_pin and - derive the selectable state from the cached ref priority via - zl3073x_chan_ref_is_selectable(), eliminating a redundant cache. - - Inline zl3073x_dpll_selected_ref_set() into - zl3073x_dpll_input_pin_state_on_dpll_set(), unifying all manual and - automatic mode paths to commit changes through a single - zl3073x_chan_state_set() call at the end of the function. - - Move hardware limit constants from core.h to regs.h so that chan.h - can reference ZL3073X_NUM_REFS for the ref_prio array size. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260315174224.399074-6-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit f6b075bc3ad545d1c91e181c3f8ea6193d01602f) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/chan.c b/drivers/dpll/zl3073x/chan.c -index 71fb60a9859b..2f48ca239149 100644 ---- a/drivers/dpll/zl3073x/chan.c -+++ b/drivers/dpll/zl3073x/chan.c -@@ -1,5 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - -+#include - #include - #include - #include -@@ -33,15 +34,15 @@ int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index) - * @zldev: pointer to zl3073x_dev structure - * @index: DPLL channel index to fetch state for - * -- * Reads the mode_refsel register for the given DPLL channel and stores -- * the raw value for later use. -+ * Reads the mode_refsel register and reference priority registers for -+ * the given DPLL channel and stores the raw values for later use. - * - * Return: 0 on success, <0 on error - */ - int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index) - { - struct zl3073x_chan *chan = &zldev->chan[index]; -- int rc; -+ int rc, i; - - rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(index), - &chan->mode_refsel); -@@ -62,6 +63,22 @@ int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index) - zl3073x_chan_refsel_state_get(chan), - zl3073x_chan_refsel_ref_get(chan)); - -+ guard(mutex)(&zldev->multiop_lock); -+ -+ /* Read DPLL configuration from mailbox */ -+ rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -+ ZL_REG_DPLL_MB_MASK, BIT(index)); -+ if (rc) -+ return rc; -+ -+ /* Read reference priority registers */ -+ for (i = 0; i < ARRAY_SIZE(chan->ref_prio); i++) { -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REF_PRIO(i), -+ &chan->ref_prio[i]); -+ if (rc) -+ return rc; -+ } -+ - return 0; - } - -@@ -85,7 +102,9 @@ const struct zl3073x_chan *zl3073x_chan_state_get(struct zl3073x_dev *zldev, - * @chan: desired channel state - * - * Skips the HW write if the configuration is unchanged, and otherwise -- * writes the mode_refsel register to hardware. -+ * writes only the changed registers to hardware. The mode_refsel register -+ * is written directly, while the reference priority registers are written -+ * via the DPLL mailbox interface. - * - * Return: 0 on success, <0 on HW error - */ -@@ -93,14 +112,49 @@ int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_chan *chan) - { - struct zl3073x_chan *dchan = &zldev->chan[index]; -- int rc; -+ int rc, i; - - /* Skip HW write if configuration hasn't changed */ - if (!memcmp(&dchan->cfg, &chan->cfg, sizeof(chan->cfg))) - return 0; - -- rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(index), -- chan->mode_refsel); -+ /* Direct register write for mode_refsel */ -+ if (dchan->mode_refsel != chan->mode_refsel) { -+ rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(index), -+ chan->mode_refsel); -+ if (rc) -+ return rc; -+ dchan->mode_refsel = chan->mode_refsel; -+ } -+ -+ /* Mailbox write for ref_prio if changed */ -+ if (!memcmp(dchan->ref_prio, chan->ref_prio, sizeof(chan->ref_prio))) { -+ dchan->cfg = chan->cfg; -+ return 0; -+ } -+ -+ guard(mutex)(&zldev->multiop_lock); -+ -+ /* Read DPLL configuration into mailbox */ -+ rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -+ ZL_REG_DPLL_MB_MASK, BIT(index)); -+ if (rc) -+ return rc; -+ -+ /* Update changed ref_prio registers */ -+ for (i = 0; i < ARRAY_SIZE(chan->ref_prio); i++) { -+ if (dchan->ref_prio[i] != chan->ref_prio[i]) { -+ rc = zl3073x_write_u8(zldev, -+ ZL_REG_DPLL_REF_PRIO(i), -+ chan->ref_prio[i]); -+ if (rc) -+ return rc; -+ } -+ } -+ -+ /* Commit DPLL configuration */ -+ rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_WR, -+ ZL_REG_DPLL_MB_MASK, BIT(index)); - if (rc) - return rc; - -diff --git a/drivers/dpll/zl3073x/chan.h b/drivers/dpll/zl3073x/chan.h -index f73a07610855..e0f02d343208 100644 ---- a/drivers/dpll/zl3073x/chan.h -+++ b/drivers/dpll/zl3073x/chan.h -@@ -14,12 +14,14 @@ struct zl3073x_dev; - /** - * struct zl3073x_chan - DPLL channel state - * @mode_refsel: mode and reference selection register value -+ * @ref_prio: reference priority registers (4 bits per ref, P/N packed) - * @mon_status: monitor status register value - * @refsel_status: reference selection status register value - */ - struct zl3073x_chan { - struct_group(cfg, - u8 mode_refsel; -+ u8 ref_prio[ZL3073X_NUM_REFS / 2]; - ); - struct_group(stat, - u8 mon_status; -@@ -79,6 +81,57 @@ static inline void zl3073x_chan_ref_set(struct zl3073x_chan *chan, u8 ref) - chan->mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); - } - -+/** -+ * zl3073x_chan_ref_prio_get - get reference priority -+ * @chan: pointer to channel state -+ * @ref: input reference index -+ * -+ * Return: priority of the given reference <0, 15> -+ */ -+static inline u8 -+zl3073x_chan_ref_prio_get(const struct zl3073x_chan *chan, u8 ref) -+{ -+ u8 val = chan->ref_prio[ref / 2]; -+ -+ if (!(ref & 1)) -+ return FIELD_GET(ZL_DPLL_REF_PRIO_REF_P, val); -+ else -+ return FIELD_GET(ZL_DPLL_REF_PRIO_REF_N, val); -+} -+ -+/** -+ * zl3073x_chan_ref_prio_set - set reference priority -+ * @chan: pointer to channel state -+ * @ref: input reference index -+ * @prio: priority to set -+ */ -+static inline void -+zl3073x_chan_ref_prio_set(struct zl3073x_chan *chan, u8 ref, u8 prio) -+{ -+ u8 *val = &chan->ref_prio[ref / 2]; -+ -+ if (!(ref & 1)) { -+ *val &= ~ZL_DPLL_REF_PRIO_REF_P; -+ *val |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_P, prio); -+ } else { -+ *val &= ~ZL_DPLL_REF_PRIO_REF_N; -+ *val |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_N, prio); -+ } -+} -+ -+/** -+ * zl3073x_chan_ref_is_selectable - check if reference is selectable -+ * @chan: pointer to channel state -+ * @ref: input reference index -+ * -+ * Return: true if the reference priority is not NONE, false otherwise -+ */ -+static inline bool -+zl3073x_chan_ref_is_selectable(const struct zl3073x_chan *chan, u8 ref) -+{ -+ return zl3073x_chan_ref_prio_get(chan, ref) != ZL_DPLL_REF_PRIO_NONE; -+} -+ - /** - * zl3073x_chan_lock_state_get - get DPLL channel lock state - * @chan: pointer to channel state -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index 2cfb9dd74aa5..99440620407d 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -19,17 +19,6 @@ struct device; - struct regmap; - struct zl3073x_dpll; - --/* -- * Hardware limits for ZL3073x chip family -- */ --#define ZL3073X_MAX_CHANNELS 5 --#define ZL3073X_NUM_REFS 10 --#define ZL3073X_NUM_OUTS 10 --#define ZL3073X_NUM_SYNTHS 5 --#define ZL3073X_NUM_INPUT_PINS ZL3073X_NUM_REFS --#define ZL3073X_NUM_OUTPUT_PINS (ZL3073X_NUM_OUTS * 2) --#define ZL3073X_NUM_PINS (ZL3073X_NUM_INPUT_PINS + \ -- ZL3073X_NUM_OUTPUT_PINS) - - enum zl3073x_flags { - ZL3073X_FLAG_REF_PHASE_COMP_32_BIT, -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 33c4f05ec9d3..9ea66a7e26b8 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -34,7 +34,6 @@ - * @dir: pin direction - * @id: pin id - * @prio: pin priority <0, 14> -- * @selectable: pin is selectable in automatic mode - * @esync_control: embedded sync is controllable - * @phase_gran: phase adjustment granularity - * @pin_state: last saved pin state -@@ -50,7 +49,6 @@ struct zl3073x_dpll_pin { - enum dpll_pin_direction dir; - u8 id; - u8 prio; -- bool selectable; - bool esync_control; - s32 phase_gran; - enum dpll_pin_state pin_state; -@@ -284,71 +282,6 @@ zl3073x_dpll_selected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) - return 0; - } - --/** -- * zl3073x_dpll_selected_ref_set - select reference in manual mode -- * @zldpll: pointer to zl3073x_dpll -- * @ref: input reference to be selected -- * -- * Selects the given reference for the DPLL channel it should be -- * locked to. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_selected_ref_set(struct zl3073x_dpll *zldpll, u8 ref) --{ -- struct zl3073x_dev *zldev = zldpll->dev; -- struct zl3073x_chan chan; -- u8 mode; -- -- chan = *zl3073x_chan_state_get(zldev, zldpll->id); -- mode = zl3073x_chan_mode_get(&chan); -- -- switch (mode) { -- case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -- /* Manual mode with ref selected */ -- if (ref == ZL3073X_DPLL_REF_NONE) { -- switch (zldpll->lock_status) { -- case DPLL_LOCK_STATUS_LOCKED_HO_ACQ: -- case DPLL_LOCK_STATUS_HOLDOVER: -- /* Switch to forced holdover */ -- mode = ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER; -- break; -- default: -- /* Switch to freerun */ -- mode = ZL_DPLL_MODE_REFSEL_MODE_FREERUN; -- break; -- } -- /* Keep selected reference */ -- ref = zl3073x_chan_ref_get(&chan); -- } else if (ref == zl3073x_chan_ref_get(&chan)) { -- /* No register update - same mode and same ref */ -- return 0; -- } -- break; -- case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: -- case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: -- /* Manual mode without no ref */ -- if (ref == ZL3073X_DPLL_REF_NONE) -- /* No register update - keep current mode */ -- return 0; -- -- /* Switch to reflock mode and update ref selection */ -- mode = ZL_DPLL_MODE_REFSEL_MODE_REFLOCK; -- break; -- default: -- /* For other modes like automatic or NCO ref cannot be selected -- * manually -- */ -- return -EOPNOTSUPP; -- } -- -- zl3073x_chan_mode_set(&chan, mode); -- zl3073x_chan_ref_set(&chan, ref); -- -- return zl3073x_chan_state_set(zldev, zldpll->id, &chan); --} -- - /** - * zl3073x_dpll_connected_ref_get - get currently connected reference - * @zldpll: pointer to zl3073x_dpll -@@ -497,98 +430,6 @@ zl3073x_dpll_input_pin_phase_adjust_set(const struct dpll_pin *dpll_pin, - return zl3073x_ref_state_set(zldev, ref_id, &ref); - } - --/** -- * zl3073x_dpll_ref_prio_get - get priority for given input pin -- * @pin: pointer to pin -- * @prio: place to store priority -- * -- * Reads current priority for the given input pin and stores the value -- * to @prio. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_ref_prio_get(struct zl3073x_dpll_pin *pin, u8 *prio) --{ -- struct zl3073x_dpll *zldpll = pin->dpll; -- struct zl3073x_dev *zldev = zldpll->dev; -- u8 ref, ref_prio; -- int rc; -- -- guard(mutex)(&zldev->multiop_lock); -- -- /* Read DPLL configuration */ -- rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -- ZL_REG_DPLL_MB_MASK, BIT(zldpll->id)); -- if (rc) -- return rc; -- -- /* Read reference priority - one value for P&N pins (4 bits/pin) */ -- ref = zl3073x_input_pin_ref_get(pin->id); -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REF_PRIO(ref / 2), -- &ref_prio); -- if (rc) -- return rc; -- -- /* Select nibble according pin type */ -- if (zl3073x_dpll_is_p_pin(pin)) -- *prio = FIELD_GET(ZL_DPLL_REF_PRIO_REF_P, ref_prio); -- else -- *prio = FIELD_GET(ZL_DPLL_REF_PRIO_REF_N, ref_prio); -- -- return rc; --} -- --/** -- * zl3073x_dpll_ref_prio_set - set priority for given input pin -- * @pin: pointer to pin -- * @prio: place to store priority -- * -- * Sets priority for the given input pin. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_ref_prio_set(struct zl3073x_dpll_pin *pin, u8 prio) --{ -- struct zl3073x_dpll *zldpll = pin->dpll; -- struct zl3073x_dev *zldev = zldpll->dev; -- u8 ref, ref_prio; -- int rc; -- -- guard(mutex)(&zldev->multiop_lock); -- -- /* Read DPLL configuration into mailbox */ -- rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -- ZL_REG_DPLL_MB_MASK, BIT(zldpll->id)); -- if (rc) -- return rc; -- -- /* Read reference priority - one value shared between P&N pins */ -- ref = zl3073x_input_pin_ref_get(pin->id); -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REF_PRIO(ref / 2), &ref_prio); -- if (rc) -- return rc; -- -- /* Update nibble according pin type */ -- if (zl3073x_dpll_is_p_pin(pin)) { -- ref_prio &= ~ZL_DPLL_REF_PRIO_REF_P; -- ref_prio |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_P, prio); -- } else { -- ref_prio &= ~ZL_DPLL_REF_PRIO_REF_N; -- ref_prio |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_N, prio); -- } -- -- /* Update reference priority */ -- rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_REF_PRIO(ref / 2), ref_prio); -- if (rc) -- return rc; -- -- /* Commit configuration */ -- return zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_WR, -- ZL_REG_DPLL_MB_MASK, BIT(zldpll->id)); --} -- - /** - * zl3073x_dpll_ref_state_get - get status for given input pin - * @pin: pointer to pin -@@ -627,7 +468,8 @@ zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, - * pin as selectable. - */ - if (zl3073x_chan_mode_get(chan) == ZL_DPLL_MODE_REFSEL_MODE_AUTO && -- zl3073x_dev_ref_is_status_ok(zldev, ref) && pin->selectable) { -+ zl3073x_dev_ref_is_status_ok(zldev, ref) && -+ zl3073x_chan_ref_is_selectable(chan, ref)) { - *state = DPLL_PIN_STATE_SELECTABLE; - return 0; - } -@@ -661,71 +503,81 @@ zl3073x_dpll_input_pin_state_on_dpll_set(const struct dpll_pin *dpll_pin, - { - struct zl3073x_dpll *zldpll = dpll_priv; - struct zl3073x_dpll_pin *pin = pin_priv; -- const struct zl3073x_chan *chan; -- u8 new_ref; -+ struct zl3073x_chan chan; -+ u8 mode, ref; - int rc; - -- chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ mode = zl3073x_chan_mode_get(&chan); - -- switch (zl3073x_chan_mode_get(chan)) { -+ switch (mode) { - case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -- case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: -- case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: - if (state == DPLL_PIN_STATE_CONNECTED) { - /* Choose the pin as new selected reference */ -- new_ref = zl3073x_input_pin_ref_get(pin->id); -+ zl3073x_chan_ref_set(&chan, ref); - } else if (state == DPLL_PIN_STATE_DISCONNECTED) { -- /* No reference */ -- new_ref = ZL3073X_DPLL_REF_NONE; -+ /* Choose new mode based on lock status */ -+ switch (zldpll->lock_status) { -+ case DPLL_LOCK_STATUS_LOCKED_HO_ACQ: -+ case DPLL_LOCK_STATUS_HOLDOVER: -+ mode = ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER; -+ break; -+ default: -+ mode = ZL_DPLL_MODE_REFSEL_MODE_FREERUN; -+ break; -+ } -+ zl3073x_chan_mode_set(&chan, mode); - } else { -- NL_SET_ERR_MSG_MOD(extack, -- "Invalid pin state for manual mode"); -- return -EINVAL; -+ goto invalid_state; -+ } -+ break; -+ case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: -+ case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: -+ if (state == DPLL_PIN_STATE_CONNECTED) { -+ /* Choose the pin as new selected reference */ -+ zl3073x_chan_ref_set(&chan, ref); -+ /* Switch to reflock mode */ -+ zl3073x_chan_mode_set(&chan, -+ ZL_DPLL_MODE_REFSEL_MODE_REFLOCK); -+ } else if (state != DPLL_PIN_STATE_DISCONNECTED) { -+ goto invalid_state; - } -- -- rc = zl3073x_dpll_selected_ref_set(zldpll, new_ref); - break; -- - case ZL_DPLL_MODE_REFSEL_MODE_AUTO: - if (state == DPLL_PIN_STATE_SELECTABLE) { -- if (pin->selectable) -+ if (zl3073x_chan_ref_is_selectable(&chan, ref)) - return 0; /* Pin is already selectable */ - - /* Restore pin priority in HW */ -- rc = zl3073x_dpll_ref_prio_set(pin, pin->prio); -- if (rc) -- return rc; -- -- /* Mark pin as selectable */ -- pin->selectable = true; -+ zl3073x_chan_ref_prio_set(&chan, ref, pin->prio); - } else if (state == DPLL_PIN_STATE_DISCONNECTED) { -- if (!pin->selectable) -+ if (!zl3073x_chan_ref_is_selectable(&chan, ref)) - return 0; /* Pin is already disconnected */ - - /* Set pin priority to none in HW */ -- rc = zl3073x_dpll_ref_prio_set(pin, -- ZL_DPLL_REF_PRIO_NONE); -- if (rc) -- return rc; -- -- /* Mark pin as non-selectable */ -- pin->selectable = false; -+ zl3073x_chan_ref_prio_set(&chan, ref, -+ ZL_DPLL_REF_PRIO_NONE); - } else { -- NL_SET_ERR_MSG(extack, -- "Invalid pin state for automatic mode"); -- return -EINVAL; -+ goto invalid_state; - } - break; -- - default: - /* In other modes we cannot change input reference */ - NL_SET_ERR_MSG(extack, - "Pin state cannot be changed in current mode"); -- rc = -EOPNOTSUPP; -- break; -+ return -EOPNOTSUPP; - } - -- return rc; -+ /* Commit DPLL channel changes */ -+ rc = zl3073x_chan_state_set(zldpll->dev, zldpll->id, &chan); -+ if (rc) -+ return rc; -+ -+ return 0; -+invalid_state: -+ NL_SET_ERR_MSG_MOD(extack, "Invalid pin state for this device mode"); -+ return -EINVAL; - } - - static int -@@ -745,15 +597,21 @@ zl3073x_dpll_input_pin_prio_set(const struct dpll_pin *dpll_pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - u32 prio, struct netlink_ext_ack *extack) - { -+ struct zl3073x_dpll *zldpll = dpll_priv; - struct zl3073x_dpll_pin *pin = pin_priv; -+ struct zl3073x_chan chan; -+ u8 ref; - int rc; - - if (prio > ZL_DPLL_REF_PRIO_MAX) - return -EINVAL; - - /* If the pin is selectable then update HW registers */ -- if (pin->selectable) { -- rc = zl3073x_dpll_ref_prio_set(pin, prio); -+ chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ if (zl3073x_chan_ref_is_selectable(&chan, ref)) { -+ zl3073x_chan_ref_prio_set(&chan, ref, prio); -+ rc = zl3073x_chan_state_set(zldpll->dev, zldpll->id, &chan); - if (rc) - return rc; - } -@@ -1235,6 +1093,8 @@ zl3073x_dpll_mode_set(const struct dpll_device *dpll, void *dpll_priv, - return rc; - } - -+ chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ - if (mode == DPLL_MODE_MANUAL) { - /* We are switching from automatic to manual mode: - * - if we have a valid reference selected during auto mode then -@@ -1256,25 +1116,21 @@ zl3073x_dpll_mode_set(const struct dpll_device *dpll, void *dpll_priv, - * it is selectable after switch to automatic mode - * - switch to automatic mode - */ -- struct zl3073x_dpll_pin *pin; -- -- pin = zl3073x_dpll_pin_get_by_ref(zldpll, ref); -- if (pin && !pin->selectable) { -- /* Restore pin priority in HW */ -- rc = zl3073x_dpll_ref_prio_set(pin, pin->prio); -- if (rc) { -- NL_SET_ERR_MSG_MOD(extack, -- "failed to restore pin priority"); -- return rc; -+ if (ZL3073X_DPLL_REF_IS_VALID(ref) && -+ !zl3073x_chan_ref_is_selectable(&chan, ref)) { -+ struct zl3073x_dpll_pin *pin; -+ -+ pin = zl3073x_dpll_pin_get_by_ref(zldpll, ref); -+ if (pin) { -+ /* Restore pin priority in HW */ -+ zl3073x_chan_ref_prio_set(&chan, ref, -+ pin->prio); - } -- -- pin->selectable = true; - } - - hw_mode = ZL_DPLL_MODE_REFSEL_MODE_AUTO; - } - -- chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); - zl3073x_chan_mode_set(&chan, hw_mode); - if (ZL3073X_DPLL_REF_IS_VALID(ref)) - zl3073x_chan_ref_set(&chan, ref); -@@ -1426,18 +1282,16 @@ zl3073x_dpll_pin_register(struct zl3073x_dpll_pin *pin, u32 index) - pin->phase_gran = props->dpll_props.phase_gran; - - if (zl3073x_dpll_is_input_pin(pin)) { -- rc = zl3073x_dpll_ref_prio_get(pin, &pin->prio); -- if (rc) -- goto err_prio_get; -+ const struct zl3073x_chan *chan; -+ u8 ref; -+ -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ pin->prio = zl3073x_chan_ref_prio_get(chan, ref); - -- if (pin->prio == ZL_DPLL_REF_PRIO_NONE) { -- /* Clamp prio to max value & mark pin non-selectable */ -+ if (pin->prio == ZL_DPLL_REF_PRIO_NONE) -+ /* Clamp prio to max value */ - pin->prio = ZL_DPLL_REF_PRIO_MAX; -- pin->selectable = false; -- } else { -- /* Mark pin as selectable */ -- pin->selectable = true; -- } - } - - /* Create or get existing DPLL pin */ -@@ -1466,7 +1320,6 @@ zl3073x_dpll_pin_register(struct zl3073x_dpll_pin *pin, u32 index) - - err_register: - dpll_pin_put(pin->dpll_pin, &pin->tracker); --err_prio_get: - pin->dpll_pin = NULL; - err_pin_get: - zl3073x_pin_props_put(props); -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index 19c598daa784..5ae50cb761a9 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -6,6 +6,18 @@ - #include - #include - -+/* -+ * Hardware limits for ZL3073x chip family -+ */ -+#define ZL3073X_MAX_CHANNELS 5 -+#define ZL3073X_NUM_REFS 10 -+#define ZL3073X_NUM_OUTS 10 -+#define ZL3073X_NUM_SYNTHS 5 -+#define ZL3073X_NUM_INPUT_PINS ZL3073X_NUM_REFS -+#define ZL3073X_NUM_OUTPUT_PINS (ZL3073X_NUM_OUTS * 2) -+#define ZL3073X_NUM_PINS (ZL3073X_NUM_INPUT_PINS + \ -+ ZL3073X_NUM_OUTPUT_PINS) -+ - /* - * Register address structure: - * =========================== --- -2.50.1 (Apple Git-155) - diff --git a/1257-dpll-zl3073x-drop-selected-and-simplify-connected-ref-getter.patch b/1257-dpll-zl3073x-drop-selected-and-simplify-connected-ref-getter.patch deleted file mode 100644 index 55c50a5c2..000000000 --- a/1257-dpll-zl3073x-drop-selected-and-simplify-connected-ref-getter.patch +++ /dev/null @@ -1,188 +0,0 @@ -From 6d8e25eab47b0e42b2df4fee21761986644d4f7b Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:51:39 +0200 -Subject: [PATCH] dpll: zl3073x: drop selected and simplify connected ref - getter - -JIRA: https://issues.redhat.com/browse/RHEL-171979 - -commit acee049a6af2a7b4baabd28f16fb53628ea6e7a5 -Author: Ivan Vecera -Date: Sun Mar 15 18:42:24 2026 +0100 - - dpll: zl3073x: drop selected and simplify connected ref getter - - The HW reports the currently selected reference in the - dpll_refsel_status register regardless of the DPLL mode. Use this to - delete zl3073x_dpll_selected_ref_get() and have callers read the - register directly via the cached channel state. - - Simplify zl3073x_dpll_connected_ref_get() to check refsel_state for - LOCK directly and return the reference index, changing the return - type from int to u8. The redundant ref_is_status_ok check is removed - since the DPLL cannot be in LOCK state with a failed reference. - - In zl3073x_dpll_mode_set(), replace the selected_ref_get() call with - zl3073x_chan_refsel_ref_get() to read the currently selected - reference directly from the cached channel state. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260315174224.399074-7-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit acee049a6af2a7b4baabd28f16fb53628ea6e7a5) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 9ea66a7e26b8..cf7a335baed5 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -243,72 +243,27 @@ zl3073x_dpll_input_pin_frequency_set(const struct dpll_pin *dpll_pin, - return zl3073x_ref_state_set(zldev, ref_id, &ref); - } - --/** -- * zl3073x_dpll_selected_ref_get - get currently selected reference -- * @zldpll: pointer to zl3073x_dpll -- * @ref: place to store selected reference -- * -- * Check for currently selected reference the DPLL should be locked to -- * and stores its index to given @ref. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_selected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) --{ -- const struct zl3073x_chan *chan; -- -- chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -- -- switch (zl3073x_chan_mode_get(chan)) { -- case ZL_DPLL_MODE_REFSEL_MODE_AUTO: -- /* Return the reference only if the DPLL is locked to it */ -- if (zl3073x_chan_refsel_state_get(chan) == -- ZL_DPLL_REFSEL_STATUS_STATE_LOCK) -- *ref = zl3073x_chan_refsel_ref_get(chan); -- else -- *ref = ZL3073X_DPLL_REF_NONE; -- break; -- case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -- /* For manual mode return stored value */ -- *ref = zl3073x_chan_ref_get(chan); -- break; -- default: -- /* For other modes like NCO, freerun... there is no input ref */ -- *ref = ZL3073X_DPLL_REF_NONE; -- break; -- } -- -- return 0; --} -- - /** - * zl3073x_dpll_connected_ref_get - get currently connected reference - * @zldpll: pointer to zl3073x_dpll -- * @ref: place to store selected reference - * -- * Looks for currently connected the DPLL is locked to and stores its index -- * to given @ref. -+ * Looks for currently connected reference the DPLL is locked to. - * -- * Return: 0 on success, <0 on error -+ * Return: reference index if locked, ZL3073X_DPLL_REF_NONE otherwise - */ --static int --zl3073x_dpll_connected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) -+static u8 -+zl3073x_dpll_connected_ref_get(struct zl3073x_dpll *zldpll) - { -- struct zl3073x_dev *zldev = zldpll->dev; -- int rc; -- -- /* Get currently selected input reference */ -- rc = zl3073x_dpll_selected_ref_get(zldpll, ref); -- if (rc) -- return rc; -+ const struct zl3073x_chan *chan = zl3073x_chan_state_get(zldpll->dev, -+ zldpll->id); -+ u8 state; - -- /* If the monitor indicates an error nothing is connected */ -- if (ZL3073X_DPLL_REF_IS_VALID(*ref) && -- !zl3073x_dev_ref_is_status_ok(zldev, *ref)) -- *ref = ZL3073X_DPLL_REF_NONE; -+ /* A reference is connected only when the DPLL is locked to it */ -+ state = zl3073x_chan_refsel_state_get(chan); -+ if (state == ZL_DPLL_REFSEL_STATUS_STATE_LOCK) -+ return zl3073x_chan_refsel_ref_get(chan); - -- return 0; -+ return ZL3073X_DPLL_REF_NONE; - } - - static int -@@ -324,12 +279,9 @@ zl3073x_dpll_input_pin_phase_offset_get(const struct dpll_pin *dpll_pin, - const struct zl3073x_ref *ref; - u8 conn_id, ref_id; - s64 ref_phase; -- int rc; - - /* Get currently connected reference */ -- rc = zl3073x_dpll_connected_ref_get(zldpll, &conn_id); -- if (rc) -- return rc; -+ conn_id = zl3073x_dpll_connected_ref_get(zldpll); - - /* Report phase offset only for currently connected pin if the phase - * monitor feature is disabled and only if the input pin signal is -@@ -367,7 +319,7 @@ zl3073x_dpll_input_pin_phase_offset_get(const struct dpll_pin *dpll_pin, - - *phase_offset = ref_phase * DPLL_PHASE_OFFSET_DIVIDER; - -- return rc; -+ return 0; - } - - static int -@@ -447,18 +399,13 @@ zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, - struct zl3073x_dpll *zldpll = pin->dpll; - struct zl3073x_dev *zldev = zldpll->dev; - const struct zl3073x_chan *chan; -- u8 ref, ref_conn; -- int rc; -+ u8 ref; - - chan = zl3073x_chan_state_get(zldev, zldpll->id); - ref = zl3073x_input_pin_ref_get(pin->id); - -- /* Get currently connected reference */ -- rc = zl3073x_dpll_connected_ref_get(zldpll, &ref_conn); -- if (rc) -- return rc; -- -- if (ref == ref_conn) { -+ /* Check if the pin reference is connected */ -+ if (ref == zl3073x_dpll_connected_ref_get(zldpll)) { - *state = DPLL_PIN_STATE_CONNECTED; - return 0; - } -@@ -1087,13 +1034,8 @@ zl3073x_dpll_mode_set(const struct dpll_device *dpll, void *dpll_priv, - u8 hw_mode, ref; - int rc; - -- rc = zl3073x_dpll_selected_ref_get(zldpll, &ref); -- if (rc) { -- NL_SET_ERR_MSG_MOD(extack, "failed to get selected reference"); -- return rc; -- } -- - chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_chan_refsel_ref_get(&chan); - - if (mode == DPLL_MODE_MANUAL) { - /* We are switching from automatic to manual mode: --- -2.50.1 (Apple Git-155) - diff --git a/1258-dpll-add-frequency-monitoring-to-netlink-spec.patch b/1258-dpll-add-frequency-monitoring-to-netlink-spec.patch deleted file mode 100644 index 189cb6678..000000000 --- a/1258-dpll-add-frequency-monitoring-to-netlink-spec.patch +++ /dev/null @@ -1,211 +0,0 @@ -From cf443396fbf1d5230af6f3e6ff9429f897ac1e2e Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Mon, 13 Apr 2026 17:47:07 +0200 -Subject: [PATCH] dpll: add frequency monitoring to netlink spec - -JIRA: https://issues.redhat.com/browse/RHEL-165161 - -commit 3fdea79c09d169b6ea172b8d36232c3773f39973 -Author: Ivan Vecera -Date: Thu Apr 2 20:40:55 2026 +0200 - - dpll: add frequency monitoring to netlink spec - - Add DPLL_A_FREQUENCY_MONITOR device attribute to allow control over - the frequency monitor feature. The attribute uses the existing - dpll_feature_state enum (enable/disable) and is present in both - device-get reply and device-set request. - - Add DPLL_A_PIN_MEASURED_FREQUENCY pin attribute to expose the measured - input frequency in millihertz (mHz). The attribute is present in the - pin-get reply. Add DPLL_PIN_MEASURED_FREQUENCY_DIVIDER constant to - allow userspace to extract integer and fractional parts. - - Reviewed-by: Vadim Fedorenko - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260402184057.1890514-2-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 3fdea79c09d169b6ea172b8d36232c3773f39973) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/Documentation/driver-api/dpll.rst b/Documentation/driver-api/dpll.rst -index 83118c728ed9..93c191b2d089 100644 ---- a/Documentation/driver-api/dpll.rst -+++ b/Documentation/driver-api/dpll.rst -@@ -250,6 +250,24 @@ in the ``DPLL_A_PIN_PHASE_OFFSET`` attribute. - ``DPLL_A_PHASE_OFFSET_MONITOR`` attr state of a feature - =============================== ======================== - -+Frequency monitor -+================= -+ -+Some DPLL devices may offer the capability to measure the actual -+frequency of all available input pins. The attribute and current feature state -+shall be included in the response message of the ``DPLL_CMD_DEVICE_GET`` -+command for supported DPLL devices. In such cases, users can also control -+the feature using the ``DPLL_CMD_DEVICE_SET`` command by setting the -+``enum dpll_feature_state`` values for the attribute. -+Once enabled the measured input frequency for each input pin shall be -+returned in the ``DPLL_A_PIN_MEASURED_FREQUENCY`` attribute. The value -+is in millihertz (mHz), using ``DPLL_PIN_MEASURED_FREQUENCY_DIVIDER`` -+as the divider. -+ -+ =============================== ======================== -+ ``DPLL_A_FREQUENCY_MONITOR`` attr state of a feature -+ =============================== ======================== -+ - Embedded SYNC - ============= - -@@ -411,6 +429,8 @@ according to attribute purpose. - ``DPLL_A_PIN_STATE`` attr state of pin on the parent - pin - ``DPLL_A_PIN_CAPABILITIES`` attr bitmask of pin capabilities -+ ``DPLL_A_PIN_MEASURED_FREQUENCY`` attr measured frequency of -+ an input pin in mHz - ==================================== ================================== - - ==================================== ================================= -diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml -index ed5866238682..cb5da356bb64 100644 ---- a/Documentation/netlink/specs/dpll.yaml -+++ b/Documentation/netlink/specs/dpll.yaml -@@ -240,6 +240,20 @@ definitions: - integer part of a measured phase offset value. - Value of (DPLL_A_PHASE_OFFSET % DPLL_PHASE_OFFSET_DIVIDER) is a - fractional part of a measured phase offset value. -+ - -+ type: const -+ name: pin-measured-frequency-divider -+ value: 1000 -+ doc: | -+ pin measured frequency divider allows userspace to calculate -+ a value of measured input frequency as a fractional value with -+ three digit decimal precision (millihertz). -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY / -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is an integer part of -+ a measured frequency value. -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY % -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is a fractional part of -+ a measured frequency value. - - - type: enum - name: feature-state -@@ -319,6 +333,13 @@ attribute-sets: - name: phase-offset-avg-factor - type: u32 - doc: Averaging factor applied to calculation of reported phase offset. -+ - -+ name: frequency-monitor -+ type: u32 -+ enum: feature-state -+ doc: Current or desired state of the frequency monitor feature. -+ If enabled, dpll device shall measure all currently available -+ inputs for their actual input frequency. - - - name: pin - enum-name: dpll_a_pin -@@ -456,6 +477,17 @@ attribute-sets: - Value is in PPT (parts per trillion, 10^-12). - Note: This attribute provides higher resolution than the standard - fractional-frequency-offset (which is in PPM). -+ - -+ name: measured-frequency -+ type: u64 -+ doc: | -+ The measured frequency of the input pin in millihertz (mHz). -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY / -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is an integer part (Hz) -+ of a measured frequency value. -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY % -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is a fractional part -+ of a measured frequency value. - - - - name: pin-parent-device -@@ -544,6 +576,7 @@ operations: - - type - - phase-offset-monitor - - phase-offset-avg-factor -+ - frequency-monitor - - dump: - reply: *dev-attrs -@@ -563,6 +596,7 @@ operations: - - mode - - phase-offset-monitor - - phase-offset-avg-factor -+ - frequency-monitor - - - name: device-create-ntf - doc: Notification about device appearing -@@ -643,6 +677,7 @@ operations: - - esync-frequency-supported - - esync-pulse - - reference-sync -+ - measured-frequency - - dump: - request: -diff --git a/drivers/dpll/dpll_nl.c b/drivers/dpll/dpll_nl.c -index 3fb64aab18fa..da92aa8f9bc7 100644 ---- a/drivers/dpll/dpll_nl.c -+++ b/drivers/dpll/dpll_nl.c -@@ -42,11 +42,12 @@ static const struct nla_policy dpll_device_get_nl_policy[DPLL_A_ID + 1] = { - }; - - /* DPLL_CMD_DEVICE_SET - do */ --static const struct nla_policy dpll_device_set_nl_policy[DPLL_A_PHASE_OFFSET_AVG_FACTOR + 1] = { -+static const struct nla_policy dpll_device_set_nl_policy[DPLL_A_FREQUENCY_MONITOR + 1] = { - [DPLL_A_ID] = { .type = NLA_U32, }, - [DPLL_A_MODE] = NLA_POLICY_RANGE(NLA_U32, 1, 2), - [DPLL_A_PHASE_OFFSET_MONITOR] = NLA_POLICY_MAX(NLA_U32, 1), - [DPLL_A_PHASE_OFFSET_AVG_FACTOR] = { .type = NLA_U32, }, -+ [DPLL_A_FREQUENCY_MONITOR] = NLA_POLICY_MAX(NLA_U32, 1), - }; - - /* DPLL_CMD_PIN_ID_GET - do */ -@@ -114,7 +115,7 @@ static const struct genl_split_ops dpll_nl_ops[] = { - .doit = dpll_nl_device_set_doit, - .post_doit = dpll_post_doit, - .policy = dpll_device_set_nl_policy, -- .maxattr = DPLL_A_PHASE_OFFSET_AVG_FACTOR, -+ .maxattr = DPLL_A_FREQUENCY_MONITOR, - .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO, - }, - { -diff --git a/include/uapi/linux/dpll.h b/include/uapi/linux/dpll.h -index 603a88cb665f..93614ccd8a84 100644 ---- a/include/uapi/linux/dpll.h -+++ b/include/uapi/linux/dpll.h -@@ -190,7 +190,8 @@ enum dpll_pin_capabilities { - DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE = 4, - }; - --#define DPLL_PHASE_OFFSET_DIVIDER 1000 -+#define DPLL_PHASE_OFFSET_DIVIDER 1000 -+#define DPLL_PIN_MEASURED_FREQUENCY_DIVIDER 1000 - - /** - * enum dpll_feature_state - Allow control (enable/disable) and status checking -@@ -217,6 +218,7 @@ enum dpll_a { - DPLL_A_CLOCK_QUALITY_LEVEL, - DPLL_A_PHASE_OFFSET_MONITOR, - DPLL_A_PHASE_OFFSET_AVG_FACTOR, -+ DPLL_A_FREQUENCY_MONITOR, - - __DPLL_A_MAX, - DPLL_A_MAX = (__DPLL_A_MAX - 1) -@@ -253,6 +255,7 @@ enum dpll_a_pin { - DPLL_A_PIN_REFERENCE_SYNC, - DPLL_A_PIN_PHASE_ADJUST_GRAN, - DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, -+ DPLL_A_PIN_MEASURED_FREQUENCY, - - __DPLL_A_PIN_MAX, - DPLL_A_PIN_MAX = (__DPLL_A_PIN_MAX - 1) --- -2.50.1 (Apple Git-155) - diff --git a/1259-dpll-add-frequency-monitoring-callback-ops.patch b/1259-dpll-add-frequency-monitoring-callback-ops.patch deleted file mode 100644 index 0f4291409..000000000 --- a/1259-dpll-add-frequency-monitoring-callback-ops.patch +++ /dev/null @@ -1,224 +0,0 @@ -From c549611ebab6cedb1f8d0981320051d4dfb86ccc Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Mon, 13 Apr 2026 17:49:27 +0200 -Subject: [PATCH] dpll: add frequency monitoring callback ops - -JIRA: https://issues.redhat.com/browse/RHEL-165161 - -commit 15ed91aa84ea7bacef3c24286d5136055b4335a8 -Author: Ivan Vecera -Date: Thu Apr 2 20:40:56 2026 +0200 - - dpll: add frequency monitoring callback ops - - Add new callback operations for a dpll device: - - freq_monitor_get(..) - to obtain current state of frequency monitor - feature from dpll device, - - freq_monitor_set(..) - to allow feature configuration. - - Add new callback operation for a dpll pin: - - measured_freq_get(..) - to obtain the measured frequency in mHz. - - Obtain the feature state value using the get callback and provide it to - the user if the device driver implements callbacks. The measured_freq_get - pin callback is only invoked when the frequency monitor is enabled. - The freq_monitor_get device callback is required when measured_freq_get - is provided by the driver. - - Execute the set callback upon user requests. - - Reviewed-by: Vadim Fedorenko - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260402184057.1890514-3-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Conflicts: -- include/linux/dpll.h: context conflict due usage of RH_KABI_* macros - -(cherry picked from commit 15ed91aa84ea7bacef3c24286d5136055b4335a8) -Assisted-by: Patchpal AI -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c -index 842f7334db4d..84e1b637b4e5 100644 ---- a/drivers/dpll/dpll_core.c -+++ b/drivers/dpll/dpll_core.c -@@ -880,7 +880,10 @@ dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, - - if (WARN_ON(!ops) || - WARN_ON(!ops->state_on_dpll_get) || -- WARN_ON(!ops->direction_get)) -+ WARN_ON(!ops->direction_get) || -+ WARN_ON(ops->measured_freq_get && -+ (!dpll_device_ops(dpll)->freq_monitor_get || -+ !dpll_device_ops(dpll)->freq_monitor_set))) - return -EINVAL; - - mutex_lock(&dpll_lock); -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index 83cbd64abf5a..af7ce62ec55c 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -175,6 +175,26 @@ dpll_msg_add_phase_offset_monitor(struct sk_buff *msg, struct dpll_device *dpll, - return 0; - } - -+static int -+dpll_msg_add_freq_monitor(struct sk_buff *msg, struct dpll_device *dpll, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_device_ops *ops = dpll_device_ops(dpll); -+ enum dpll_feature_state state; -+ int ret; -+ -+ if (ops->freq_monitor_set && ops->freq_monitor_get) { -+ ret = ops->freq_monitor_get(dpll, dpll_priv(dpll), -+ &state, extack); -+ if (ret) -+ return ret; -+ if (nla_put_u32(msg, DPLL_A_FREQUENCY_MONITOR, state)) -+ return -EMSGSIZE; -+ } -+ -+ return 0; -+} -+ - static int - dpll_msg_add_phase_offset_avg_factor(struct sk_buff *msg, - struct dpll_device *dpll, -@@ -400,6 +420,38 @@ static int dpll_msg_add_ffo(struct sk_buff *msg, struct dpll_pin *pin, - ffo); - } - -+static int dpll_msg_add_measured_freq(struct sk_buff *msg, struct dpll_pin *pin, -+ struct dpll_pin_ref *ref, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_device_ops *dev_ops = dpll_device_ops(ref->dpll); -+ const struct dpll_pin_ops *ops = dpll_pin_ops(ref); -+ struct dpll_device *dpll = ref->dpll; -+ enum dpll_feature_state state; -+ u64 measured_freq; -+ int ret; -+ -+ if (!ops->measured_freq_get) -+ return 0; -+ ret = dev_ops->freq_monitor_get(dpll, dpll_priv(dpll), -+ &state, extack); -+ if (ret) -+ return ret; -+ if (state == DPLL_FEATURE_STATE_DISABLE) -+ return 0; -+ ret = ops->measured_freq_get(pin, dpll_pin_on_dpll_priv(dpll, pin), -+ dpll, dpll_priv(dpll), &measured_freq, -+ extack); -+ if (ret) -+ return ret; -+ if (nla_put_64bit(msg, DPLL_A_PIN_MEASURED_FREQUENCY, -+ sizeof(measured_freq), &measured_freq, -+ DPLL_A_PIN_PAD)) -+ return -EMSGSIZE; -+ -+ return 0; -+} -+ - static int - dpll_msg_add_pin_freq(struct sk_buff *msg, struct dpll_pin *pin, - struct dpll_pin_ref *ref, struct netlink_ext_ack *extack) -@@ -670,6 +722,9 @@ dpll_cmd_pin_get_one(struct sk_buff *msg, struct dpll_pin *pin, - if (ret) - return ret; - ret = dpll_msg_add_ffo(msg, pin, ref, extack); -+ if (ret) -+ return ret; -+ ret = dpll_msg_add_measured_freq(msg, pin, ref, extack); - if (ret) - return ret; - ret = dpll_msg_add_pin_esync(msg, pin, ref, extack); -@@ -722,6 +777,9 @@ dpll_device_get_one(struct dpll_device *dpll, struct sk_buff *msg, - if (ret) - return ret; - ret = dpll_msg_add_phase_offset_avg_factor(msg, dpll, extack); -+ if (ret) -+ return ret; -+ ret = dpll_msg_add_freq_monitor(msg, dpll, extack); - if (ret) - return ret; - -@@ -948,6 +1006,32 @@ dpll_phase_offset_avg_factor_set(struct dpll_device *dpll, struct nlattr *a, - extack); - } - -+static int -+dpll_freq_monitor_set(struct dpll_device *dpll, struct nlattr *a, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_device_ops *ops = dpll_device_ops(dpll); -+ enum dpll_feature_state state = nla_get_u32(a), old_state; -+ int ret; -+ -+ if (!(ops->freq_monitor_set && ops->freq_monitor_get)) { -+ NL_SET_ERR_MSG_ATTR(extack, a, -+ "dpll device not capable of frequency monitor"); -+ return -EOPNOTSUPP; -+ } -+ ret = ops->freq_monitor_get(dpll, dpll_priv(dpll), &old_state, -+ extack); -+ if (ret) { -+ NL_SET_ERR_MSG(extack, -+ "unable to get current state of frequency monitor"); -+ return ret; -+ } -+ if (state == old_state) -+ return 0; -+ -+ return ops->freq_monitor_set(dpll, dpll_priv(dpll), state, extack); -+} -+ - static int - dpll_pin_freq_set(struct dpll_pin *pin, struct nlattr *a, - struct netlink_ext_ack *extack) -@@ -1878,6 +1962,12 @@ dpll_set_from_nlattr(struct dpll_device *dpll, struct genl_info *info) - if (ret) - return ret; - break; -+ case DPLL_A_FREQUENCY_MONITOR: -+ ret = dpll_freq_monitor_set(dpll, a, -+ info->extack); -+ if (ret) -+ return ret; -+ break; - } - } - -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index 8862389ed50a..441fe25ba4f4 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -54,6 +54,12 @@ struct dpll_device_ops { - int (*phase_offset_avg_factor_get)(const struct dpll_device *dpll, - void *dpll_priv, u32 *factor, - struct netlink_ext_ack *extack); -+ int (*freq_monitor_set)(const struct dpll_device *dpll, void *dpll_priv, -+ enum dpll_feature_state state, -+ struct netlink_ext_ack *extack); -+ int (*freq_monitor_get)(const struct dpll_device *dpll, void *dpll_priv, -+ enum dpll_feature_state *state, -+ struct netlink_ext_ack *extack); - - RH_KABI_RESERVE(1) - RH_KABI_RESERVE(2) -@@ -123,6 +129,10 @@ struct dpll_pin_ops { - int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - s64 *ffo, struct netlink_ext_ack *extack); -+ int (*measured_freq_get)(const struct dpll_pin *pin, void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, u64 *measured_freq, -+ struct netlink_ext_ack *extack); - int (*esync_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - u64 freq, struct netlink_ext_ack *extack); --- -2.50.1 (Apple Git-155) - diff --git a/1260-dpll-zl3073x-implement-frequency-monitoring.patch b/1260-dpll-zl3073x-implement-frequency-monitoring.patch deleted file mode 100644 index a47b1f127..000000000 --- a/1260-dpll-zl3073x-implement-frequency-monitoring.patch +++ /dev/null @@ -1,399 +0,0 @@ -From 7f9d57090a5680a3a47f6695f886ca8feb0e5bac Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:51:52 +0200 -Subject: [PATCH] dpll: zl3073x: implement frequency monitoring - -JIRA: https://issues.redhat.com/browse/RHEL-165161 - -commit bfc923b642874ea6f94763d6060782072944ebd5 -Author: Ivan Vecera -Date: Thu Apr 2 20:40:57 2026 +0200 - - dpll: zl3073x: implement frequency monitoring - - Extract common measurement latch logic from zl3073x_ref_ffo_update() - into a new zl3073x_ref_freq_meas_latch() helper and add - zl3073x_ref_freq_meas_update() that uses it to latch and read absolute - input reference frequencies in Hz. - - Add meas_freq field to struct zl3073x_ref and the corresponding - zl3073x_ref_meas_freq_get() accessor. The measured frequencies are - updated periodically alongside the existing FFO measurements. - - Add freq_monitor boolean to struct zl3073x_dpll and implement the - freq_monitor_set/get device callbacks to enable/disable frequency - monitoring via the DPLL netlink interface. - - Implement measured_freq_get pin callback for input pins that returns the - measured input frequency in mHz. - - Reviewed-by: Petr Oros - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260402184057.1890514-4-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit bfc923b642874ea6f94763d6060782072944ebd5) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 6363002d48d4..cb47a5db061a 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -632,22 +632,21 @@ int zl3073x_ref_phase_offsets_update(struct zl3073x_dev *zldev, int channel) - } - - /** -- * zl3073x_ref_ffo_update - update reference fractional frequency offsets -+ * zl3073x_ref_freq_meas_latch - latch reference frequency measurements - * @zldev: pointer to zl3073x_dev structure -+ * @type: measurement type (ZL_REF_FREQ_MEAS_CTRL_*) - * -- * The function asks device to update fractional frequency offsets latch -- * registers the latest measured values, reads and stores them into -+ * The function waits for the previous measurement to finish, selects all -+ * references and requests a new measurement of the given type. - * - * Return: 0 on success, <0 on error - */ - static int --zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) -+zl3073x_ref_freq_meas_latch(struct zl3073x_dev *zldev, u8 type) - { -- int i, rc; -+ int rc; - -- /* Per datasheet we have to wait for 'ref_freq_meas_ctrl' to be zero -- * to ensure that the measured data are coherent. -- */ -+ /* Wait for previous measurement to finish */ - rc = zl3073x_poll_zero_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, - ZL_REF_FREQ_MEAS_CTRL); - if (rc) -@@ -663,15 +662,64 @@ zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) - if (rc) - return rc; - -- /* Request frequency offset measurement */ -- rc = zl3073x_write_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, -- ZL_REF_FREQ_MEAS_CTRL_REF_FREQ_OFF); -+ /* Request measurement */ -+ rc = zl3073x_write_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, type); - if (rc) - return rc; - - /* Wait for finish */ -- rc = zl3073x_poll_zero_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, -- ZL_REF_FREQ_MEAS_CTRL); -+ return zl3073x_poll_zero_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, -+ ZL_REF_FREQ_MEAS_CTRL); -+} -+ -+/** -+ * zl3073x_ref_freq_meas_update - update measured input reference frequencies -+ * @zldev: pointer to zl3073x_dev structure -+ * -+ * The function asks device to latch measured input reference frequencies -+ * and stores the results in the ref state. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_ref_freq_meas_update(struct zl3073x_dev *zldev) -+{ -+ int i, rc; -+ -+ rc = zl3073x_ref_freq_meas_latch(zldev, ZL_REF_FREQ_MEAS_CTRL_REF_FREQ); -+ if (rc) -+ return rc; -+ -+ /* Read measured frequencies in Hz (unsigned 32-bit, LSB = 1 Hz) */ -+ for (i = 0; i < ZL3073X_NUM_REFS; i++) { -+ u32 value; -+ -+ rc = zl3073x_read_u32(zldev, ZL_REG_REF_FREQ(i), &value); -+ if (rc) -+ return rc; -+ -+ zldev->ref[i].meas_freq = value; -+ } -+ -+ return 0; -+} -+ -+/** -+ * zl3073x_ref_ffo_update - update reference fractional frequency offsets -+ * @zldev: pointer to zl3073x_dev structure -+ * -+ * The function asks device to latch the latest measured fractional -+ * frequency offset values, reads and stores them into the ref state. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) -+{ -+ int i, rc; -+ -+ rc = zl3073x_ref_freq_meas_latch(zldev, -+ ZL_REF_FREQ_MEAS_CTRL_REF_FREQ_OFF); - if (rc) - return rc; - -@@ -714,6 +762,20 @@ zl3073x_dev_periodic_work(struct kthread_work *work) - dev_warn(zldev->dev, "Failed to update phase offsets: %pe\n", - ERR_PTR(rc)); - -+ /* Update measured input reference frequencies if any DPLL has -+ * frequency monitoring enabled. -+ */ -+ list_for_each_entry(zldpll, &zldev->dplls, list) { -+ if (zldpll->freq_monitor) { -+ rc = zl3073x_ref_freq_meas_update(zldev); -+ if (rc) -+ dev_warn(zldev->dev, -+ "Failed to update measured frequencies: %pe\n", -+ ERR_PTR(rc)); -+ break; -+ } -+ } -+ - /* Update references' fractional frequency offsets */ - rc = zl3073x_ref_ffo_update(zldev); - if (rc) -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index cf7a335baed5..2b307a467a7f 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -39,6 +39,7 @@ - * @pin_state: last saved pin state - * @phase_offset: last saved pin phase offset - * @freq_offset: last saved fractional frequency offset -+ * @measured_freq: last saved measured frequency - */ - struct zl3073x_dpll_pin { - struct list_head list; -@@ -54,6 +55,7 @@ struct zl3073x_dpll_pin { - enum dpll_pin_state pin_state; - s64 phase_offset; - s64 freq_offset; -+ u32 measured_freq; - }; - - /* -@@ -202,6 +204,21 @@ zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - return 0; - } - -+static int -+zl3073x_dpll_input_pin_measured_freq_get(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, u64 *measured_freq, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ -+ *measured_freq = pin->measured_freq; -+ *measured_freq *= DPLL_PIN_MEASURED_FREQUENCY_DIVIDER; -+ -+ return 0; -+} -+ - static int - zl3073x_dpll_input_pin_frequency_get(const struct dpll_pin *dpll_pin, - void *pin_priv, -@@ -1116,6 +1133,35 @@ zl3073x_dpll_phase_offset_monitor_set(const struct dpll_device *dpll, - return 0; - } - -+static int -+zl3073x_dpll_freq_monitor_get(const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_feature_state *state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ -+ if (zldpll->freq_monitor) -+ *state = DPLL_FEATURE_STATE_ENABLE; -+ else -+ *state = DPLL_FEATURE_STATE_DISABLE; -+ -+ return 0; -+} -+ -+static int -+zl3073x_dpll_freq_monitor_set(const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_feature_state state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ -+ zldpll->freq_monitor = (state == DPLL_FEATURE_STATE_ENABLE); -+ -+ return 0; -+} -+ - static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { - .direction_get = zl3073x_dpll_pin_direction_get, - .esync_get = zl3073x_dpll_input_pin_esync_get, -@@ -1123,6 +1169,7 @@ static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { - .ffo_get = zl3073x_dpll_input_pin_ffo_get, - .frequency_get = zl3073x_dpll_input_pin_frequency_get, - .frequency_set = zl3073x_dpll_input_pin_frequency_set, -+ .measured_freq_get = zl3073x_dpll_input_pin_measured_freq_get, - .phase_offset_get = zl3073x_dpll_input_pin_phase_offset_get, - .phase_adjust_get = zl3073x_dpll_input_pin_phase_adjust_get, - .phase_adjust_set = zl3073x_dpll_input_pin_phase_adjust_set, -@@ -1151,6 +1198,8 @@ static const struct dpll_device_ops zl3073x_dpll_device_ops = { - .phase_offset_avg_factor_set = zl3073x_dpll_phase_offset_avg_factor_set, - .phase_offset_monitor_get = zl3073x_dpll_phase_offset_monitor_get, - .phase_offset_monitor_set = zl3073x_dpll_phase_offset_monitor_set, -+ .freq_monitor_get = zl3073x_dpll_freq_monitor_get, -+ .freq_monitor_set = zl3073x_dpll_freq_monitor_set, - .supported_modes_get = zl3073x_dpll_supported_modes_get, - }; - -@@ -1572,6 +1621,7 @@ zl3073x_dpll_pin_ffo_check(struct zl3073x_dpll_pin *pin) - struct zl3073x_dev *zldev = zldpll->dev; - const struct zl3073x_ref *ref; - u8 ref_id; -+ s64 ffo; - - /* Get reference monitor status */ - ref_id = zl3073x_input_pin_ref_get(pin->id); -@@ -1582,10 +1632,47 @@ zl3073x_dpll_pin_ffo_check(struct zl3073x_dpll_pin *pin) - return false; - - /* Compare with previous value */ -- if (pin->freq_offset != ref->ffo) { -+ ffo = zl3073x_ref_ffo_get(ref); -+ if (pin->freq_offset != ffo) { - dev_dbg(zldev->dev, "%s freq offset changed: %lld -> %lld\n", -- pin->label, pin->freq_offset, ref->ffo); -- pin->freq_offset = ref->ffo; -+ pin->label, pin->freq_offset, ffo); -+ pin->freq_offset = ffo; -+ -+ return true; -+ } -+ -+ return false; -+} -+ -+/** -+ * zl3073x_dpll_pin_measured_freq_check - check for pin measured frequency -+ * change -+ * @pin: pin to check -+ * -+ * Check for the given pin's measured frequency change. -+ * -+ * Return: true on measured frequency change, false otherwise -+ */ -+static bool -+zl3073x_dpll_pin_measured_freq_check(struct zl3073x_dpll_pin *pin) -+{ -+ struct zl3073x_dpll *zldpll = pin->dpll; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_ref *ref; -+ u8 ref_id; -+ u32 freq; -+ -+ if (!zldpll->freq_monitor) -+ return false; -+ -+ ref_id = zl3073x_input_pin_ref_get(pin->id); -+ ref = zl3073x_ref_state_get(zldev, ref_id); -+ -+ freq = zl3073x_ref_meas_freq_get(ref); -+ if (pin->measured_freq != freq) { -+ dev_dbg(zldev->dev, "%s measured freq changed: %u -> %u\n", -+ pin->label, pin->measured_freq, freq); -+ pin->measured_freq = freq; - - return true; - } -@@ -1677,13 +1764,18 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - pin_changed = true; - } - -- /* Check for phase offset and ffo change once per second */ -+ /* Check for phase offset, ffo, and measured freq change -+ * once per second. -+ */ - if (zldpll->check_count % 2 == 0) { - if (zl3073x_dpll_pin_phase_offset_check(pin)) - pin_changed = true; - - if (zl3073x_dpll_pin_ffo_check(pin)) - pin_changed = true; -+ -+ if (zl3073x_dpll_pin_measured_freq_check(pin)) -+ pin_changed = true; - } - - if (pin_changed) -diff --git a/drivers/dpll/zl3073x/dpll.h b/drivers/dpll/zl3073x/dpll.h -index 115ee4f67e7a..434c32a7db12 100644 ---- a/drivers/dpll/zl3073x/dpll.h -+++ b/drivers/dpll/zl3073x/dpll.h -@@ -15,6 +15,7 @@ - * @id: DPLL index - * @check_count: periodic check counter - * @phase_monitor: is phase offset monitor enabled -+ * @freq_monitor: is frequency monitor enabled - * @ops: DPLL device operations for this instance - * @dpll_dev: pointer to registered DPLL device - * @tracker: tracking object for the acquired reference -@@ -28,6 +29,7 @@ struct zl3073x_dpll { - u8 id; - u8 check_count; - bool phase_monitor; -+ bool freq_monitor; - struct dpll_device_ops ops; - struct dpll_device *dpll_dev; - dpll_tracker tracker; -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index 06d8d4d97ea2..be16be20dbc7 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -23,6 +23,7 @@ struct zl3073x_dev; - * @sync_ctrl: reference sync control - * @config: reference config - * @ffo: current fractional frequency offset -+ * @meas_freq: measured input frequency in Hz - * @mon_status: reference monitor status - */ - struct zl3073x_ref { -@@ -40,6 +41,7 @@ struct zl3073x_ref { - ); - struct_group(stat, /* Status */ - s64 ffo; -+ u32 meas_freq; - u8 mon_status; - ); - }; -@@ -68,6 +70,18 @@ zl3073x_ref_ffo_get(const struct zl3073x_ref *ref) - return ref->ffo; - } - -+/** -+ * zl3073x_ref_meas_freq_get - get measured input frequency -+ * @ref: pointer to ref state -+ * -+ * Return: measured input frequency in Hz -+ */ -+static inline u32 -+zl3073x_ref_meas_freq_get(const struct zl3073x_ref *ref) -+{ -+ return ref->meas_freq; -+} -+ - /** - * zl3073x_ref_freq_get - get given input reference frequency - * @ref: pointer to ref state --- -2.50.1 (Apple Git-155) - diff --git a/1261-dpll-zl3073x-clean-up-esync-get-set-and-use-zl3073x-out-is-n.patch b/1261-dpll-zl3073x-clean-up-esync-get-set-and-use-zl3073x-out-is-n.patch deleted file mode 100644 index c9010d5ce..000000000 --- a/1261-dpll-zl3073x-clean-up-esync-get-set-and-use-zl3073x-out-is-n.patch +++ /dev/null @@ -1,181 +0,0 @@ -From 83c5fcf1f1b2adc253e0eb10ae85ef11ce0ded24 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:55:25 +0200 -Subject: [PATCH] dpll: zl3073x: clean up esync get/set and use - zl3073x_out_is_ndiv() - -JIRA: https://issues.redhat.com/browse/RHEL-157828 - -commit 3c8c39768b10867e4f630080785b602245f01760 -Author: Ivan Vecera -Date: Wed Apr 8 12:27:12 2026 +0200 - - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() - - Return -EOPNOTSUPP early in esync_get callbacks when esync is not - supported instead of conditionally populating the range at the end. - This simplifies the control flow by removing the finish label/goto - in the output variant and the conditional range assignment in both - input and output variants. - - Replace open-coded N-div signal format switch statements with - zl3073x_out_is_ndiv() helper in esync_get, esync_set and - frequency_set callbacks. - - Reviewed-by: Petr Oros - Reviewed-by: Prathosh Satish - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260408102716.443099-2-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 3c8c39768b10867e4f630080785b602245f01760) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 2b307a467a7f..86df28415318 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -133,6 +133,12 @@ zl3073x_dpll_input_pin_esync_get(const struct dpll_pin *dpll_pin, - ref_id = zl3073x_input_pin_ref_get(pin->id); - ref = zl3073x_ref_state_get(zldev, ref_id); - -+ if (!pin->esync_control || zl3073x_ref_freq_get(ref) <= 1) -+ return -EOPNOTSUPP; -+ -+ esync->range = esync_freq_ranges; -+ esync->range_num = ARRAY_SIZE(esync_freq_ranges); -+ - switch (FIELD_GET(ZL_REF_SYNC_CTRL_MODE, ref->sync_ctrl)) { - case ZL_REF_SYNC_CTRL_MODE_50_50_ESYNC_25_75: - esync->freq = ref->esync_n_div == ZL_REF_ESYNC_DIV_1HZ ? 1 : 0; -@@ -144,17 +150,6 @@ zl3073x_dpll_input_pin_esync_get(const struct dpll_pin *dpll_pin, - break; - } - -- /* If the pin supports esync control expose its range but only -- * if the current reference frequency is > 1 Hz. -- */ -- if (pin->esync_control && zl3073x_ref_freq_get(ref) > 1) { -- esync->range = esync_freq_ranges; -- esync->range_num = ARRAY_SIZE(esync_freq_ranges); -- } else { -- esync->range = NULL; -- esync->range_num = 0; -- } -- - return 0; - } - -@@ -599,8 +594,8 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - struct zl3073x_dpll_pin *pin = pin_priv; - const struct zl3073x_synth *synth; - const struct zl3073x_out *out; -+ u32 synth_freq, out_freq; - u8 clock_type, out_id; -- u32 synth_freq; - - out_id = zl3073x_output_pin_out_get(pin->id); - out = zl3073x_out_state_get(zldev, out_id); -@@ -609,17 +604,19 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - * for N-division is also used for the esync divider so both cannot - * be used. - */ -- switch (zl3073x_out_signal_format_get(out)) { -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -+ if (zl3073x_out_is_ndiv(out)) - return -EOPNOTSUPP; -- default: -- break; -- } - - /* Get attached synth frequency */ - synth = zl3073x_synth_state_get(zldev, zl3073x_out_synth_get(out)); - synth_freq = zl3073x_synth_freq_get(synth); -+ out_freq = synth_freq / out->div; -+ -+ if (!pin->esync_control || out_freq <= 1) -+ return -EOPNOTSUPP; -+ -+ esync->range = esync_freq_ranges; -+ esync->range_num = ARRAY_SIZE(esync_freq_ranges); - - clock_type = FIELD_GET(ZL_OUTPUT_MODE_CLOCK_TYPE, out->mode); - if (clock_type != ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC) { -@@ -627,11 +624,11 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - esync->freq = 0; - esync->pulse = 0; - -- goto finish; -+ return 0; - } - - /* Compute esync frequency */ -- esync->freq = synth_freq / out->div / out->esync_n_period; -+ esync->freq = out_freq / out->esync_n_period; - - /* By comparing the esync_pulse_width to the half of the pulse width - * the esync pulse percentage can be determined. -@@ -640,18 +637,6 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - */ - esync->pulse = (50 * out->esync_n_width) / out->div; - --finish: -- /* Set supported esync ranges if the pin supports esync control and -- * if the output frequency is > 1 Hz. -- */ -- if (pin->esync_control && (synth_freq / out->div) > 1) { -- esync->range = esync_freq_ranges; -- esync->range_num = ARRAY_SIZE(esync_freq_ranges); -- } else { -- esync->range = NULL; -- esync->range_num = 0; -- } -- - return 0; - } - -@@ -677,13 +662,8 @@ zl3073x_dpll_output_pin_esync_set(const struct dpll_pin *dpll_pin, - * for N-division is also used for the esync divider so both cannot - * be used. - */ -- switch (zl3073x_out_signal_format_get(&out)) { -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -+ if (zl3073x_out_is_ndiv(&out)) - return -EOPNOTSUPP; -- default: -- break; -- } - - /* Select clock type */ - if (freq) -@@ -745,9 +725,9 @@ zl3073x_dpll_output_pin_frequency_set(const struct dpll_pin *dpll_pin, - struct zl3073x_dev *zldev = zldpll->dev; - struct zl3073x_dpll_pin *pin = pin_priv; - const struct zl3073x_synth *synth; -- u8 out_id, signal_format; - u32 new_div, synth_freq; - struct zl3073x_out out; -+ u8 out_id; - - out_id = zl3073x_output_pin_out_get(pin->id); - out = *zl3073x_out_state_get(zldev, out_id); -@@ -757,12 +737,8 @@ zl3073x_dpll_output_pin_frequency_set(const struct dpll_pin *dpll_pin, - synth_freq = zl3073x_synth_freq_get(synth); - new_div = synth_freq / (u32)frequency; - -- /* Get used signal format for the given output */ -- signal_format = zl3073x_out_signal_format_get(&out); -- - /* Check signal format */ -- if (signal_format != ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV && -- signal_format != ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV) { -+ if (!zl3073x_out_is_ndiv(&out)) { - /* For non N-divided signal formats the frequency is computed - * as division of synth frequency and output divisor. - */ --- -2.50.1 (Apple Git-155) - diff --git a/1262-dpll-zl3073x-use-field-modify-for-clear-and-set-patterns.patch b/1262-dpll-zl3073x-use-field-modify-for-clear-and-set-patterns.patch deleted file mode 100644 index 56292061b..000000000 --- a/1262-dpll-zl3073x-use-field-modify-for-clear-and-set-patterns.patch +++ /dev/null @@ -1,99 +0,0 @@ -From f4680f5c34a8af844573d88340c8b625a0628d25 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:55:32 +0200 -Subject: [PATCH] dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns - -JIRA: https://issues.redhat.com/browse/RHEL-157828 - -commit 737cb6195c40acf67c876f509e209158436cf287 -Author: Ivan Vecera -Date: Wed Apr 8 12:27:13 2026 +0200 - - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns - - Replace open-coded clear-and-set bitfield operations with - FIELD_MODIFY(). - - Reviewed-by: Petr Oros - Reviewed-by: Prathosh Satish - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260408102716.443099-3-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 737cb6195c40acf67c876f509e209158436cf287) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/chan.h b/drivers/dpll/zl3073x/chan.h -index e0f02d343208..481da2133202 100644 ---- a/drivers/dpll/zl3073x/chan.h -+++ b/drivers/dpll/zl3073x/chan.h -@@ -66,8 +66,7 @@ static inline u8 zl3073x_chan_ref_get(const struct zl3073x_chan *chan) - */ - static inline void zl3073x_chan_mode_set(struct zl3073x_chan *chan, u8 mode) - { -- chan->mode_refsel &= ~ZL_DPLL_MODE_REFSEL_MODE; -- chan->mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_MODE, mode); -+ FIELD_MODIFY(ZL_DPLL_MODE_REFSEL_MODE, &chan->mode_refsel, mode); - } - - /** -@@ -77,8 +76,7 @@ static inline void zl3073x_chan_mode_set(struct zl3073x_chan *chan, u8 mode) - */ - static inline void zl3073x_chan_ref_set(struct zl3073x_chan *chan, u8 ref) - { -- chan->mode_refsel &= ~ZL_DPLL_MODE_REFSEL_REF; -- chan->mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); -+ FIELD_MODIFY(ZL_DPLL_MODE_REFSEL_REF, &chan->mode_refsel, ref); - } - - /** -@@ -110,13 +108,10 @@ zl3073x_chan_ref_prio_set(struct zl3073x_chan *chan, u8 ref, u8 prio) - { - u8 *val = &chan->ref_prio[ref / 2]; - -- if (!(ref & 1)) { -- *val &= ~ZL_DPLL_REF_PRIO_REF_P; -- *val |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_P, prio); -- } else { -- *val &= ~ZL_DPLL_REF_PRIO_REF_N; -- *val |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_N, prio); -- } -+ if (!(ref & 1)) -+ FIELD_MODIFY(ZL_DPLL_REF_PRIO_REF_P, val, prio); -+ else -+ FIELD_MODIFY(ZL_DPLL_REF_PRIO_REF_N, val, prio); - } - - /** -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index cb47a5db061a..5f1e70f3e40a 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -805,8 +805,7 @@ int zl3073x_dev_phase_avg_factor_set(struct zl3073x_dev *zldev, u8 factor) - value = (factor + 1) & 0x0f; - - /* Update phase measurement control register */ -- dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR; -- dpll_meas_ctrl |= FIELD_PREP(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, value); -+ FIELD_MODIFY(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, &dpll_meas_ctrl, value); - rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, dpll_meas_ctrl); - if (rc) - return rc; -diff --git a/drivers/dpll/zl3073x/flash.c b/drivers/dpll/zl3073x/flash.c -index 83452a77e3e9..f85535c8ad24 100644 ---- a/drivers/dpll/zl3073x/flash.c -+++ b/drivers/dpll/zl3073x/flash.c -@@ -194,8 +194,7 @@ zl3073x_flash_cmd_wait(struct zl3073x_dev *zldev, u32 operation, - if (rc) - return rc; - -- value &= ~ZL_WRITE_FLASH_OP; -- value |= FIELD_PREP(ZL_WRITE_FLASH_OP, operation); -+ FIELD_MODIFY(ZL_WRITE_FLASH_OP, &value, operation); - - rc = zl3073x_write_u8(zldev, ZL_REG_WRITE_FLASH, value); - if (rc) --- -2.50.1 (Apple Git-155) - diff --git a/1263-dpll-zl3073x-add-ref-sync-and-output-clock-type-helpers.patch b/1263-dpll-zl3073x-add-ref-sync-and-output-clock-type-helpers.patch deleted file mode 100644 index 44beef3e5..000000000 --- a/1263-dpll-zl3073x-add-ref-sync-and-output-clock-type-helpers.patch +++ /dev/null @@ -1,219 +0,0 @@ -From ea098b764d85e9c992398b51e59f4fc69a7351ba Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:55:39 +0200 -Subject: [PATCH] dpll: zl3073x: add ref sync and output clock type helpers - -JIRA: https://issues.redhat.com/browse/RHEL-157828 - -commit 63009eb92b0f379afddbba8dfdf8df087f6d5b62 -Author: Ivan Vecera -Date: Wed Apr 8 12:27:14 2026 +0200 - - dpll: zl3073x: add ref sync and output clock type helpers - - Add ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR and ZL_REF_SYNC_CTRL_PAIR - register definitions. - - Add inline helpers to get and set the sync control mode and sync pair - fields of the reference sync control register: - - zl3073x_ref_sync_mode_get/set() - ZL_REF_SYNC_CTRL_MODE field - zl3073x_ref_sync_pair_get/set() - ZL_REF_SYNC_CTRL_PAIR field - - Add inline helpers to get and set the clock type field of the output - mode register: - - zl3073x_out_clock_type_get/set() - ZL_OUTPUT_MODE_CLOCK_TYPE field - - Convert existing esync callbacks to use the new helpers. - - Reviewed-by: Petr Oros - Reviewed-by: Prathosh Satish - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260408102716.443099-4-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 63009eb92b0f379afddbba8dfdf8df087f6d5b62) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 86df28415318..a151be700e6e 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -139,7 +139,7 @@ zl3073x_dpll_input_pin_esync_get(const struct dpll_pin *dpll_pin, - esync->range = esync_freq_ranges; - esync->range_num = ARRAY_SIZE(esync_freq_ranges); - -- switch (FIELD_GET(ZL_REF_SYNC_CTRL_MODE, ref->sync_ctrl)) { -+ switch (zl3073x_ref_sync_mode_get(ref)) { - case ZL_REF_SYNC_CTRL_MODE_50_50_ESYNC_25_75: - esync->freq = ref->esync_n_div == ZL_REF_ESYNC_DIV_1HZ ? 1 : 0; - esync->pulse = 25; -@@ -175,8 +175,7 @@ zl3073x_dpll_input_pin_esync_set(const struct dpll_pin *dpll_pin, - else - sync_mode = ZL_REF_SYNC_CTRL_MODE_50_50_ESYNC_25_75; - -- ref.sync_ctrl &= ~ZL_REF_SYNC_CTRL_MODE; -- ref.sync_ctrl |= FIELD_PREP(ZL_REF_SYNC_CTRL_MODE, sync_mode); -+ zl3073x_ref_sync_mode_set(&ref, sync_mode); - - if (freq) { - /* 1 Hz is only supported frequency now */ -@@ -595,7 +594,7 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - const struct zl3073x_synth *synth; - const struct zl3073x_out *out; - u32 synth_freq, out_freq; -- u8 clock_type, out_id; -+ u8 out_id; - - out_id = zl3073x_output_pin_out_get(pin->id); - out = zl3073x_out_state_get(zldev, out_id); -@@ -618,8 +617,7 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - esync->range = esync_freq_ranges; - esync->range_num = ARRAY_SIZE(esync_freq_ranges); - -- clock_type = FIELD_GET(ZL_OUTPUT_MODE_CLOCK_TYPE, out->mode); -- if (clock_type != ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC) { -+ if (zl3073x_out_clock_type_get(out) != ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC) { - /* No need to read esync data if it is not enabled */ - esync->freq = 0; - esync->pulse = 0; -@@ -652,8 +650,8 @@ zl3073x_dpll_output_pin_esync_set(const struct dpll_pin *dpll_pin, - struct zl3073x_dpll_pin *pin = pin_priv; - const struct zl3073x_synth *synth; - struct zl3073x_out out; -- u8 clock_type, out_id; - u32 synth_freq; -+ u8 out_id; - - out_id = zl3073x_output_pin_out_get(pin->id); - out = *zl3073x_out_state_get(zldev, out_id); -@@ -665,15 +663,13 @@ zl3073x_dpll_output_pin_esync_set(const struct dpll_pin *dpll_pin, - if (zl3073x_out_is_ndiv(&out)) - return -EOPNOTSUPP; - -- /* Select clock type */ -+ /* Update clock type in output mode */ - if (freq) -- clock_type = ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC; -+ zl3073x_out_clock_type_set(&out, -+ ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC); - else -- clock_type = ZL_OUTPUT_MODE_CLOCK_TYPE_NORMAL; -- -- /* Update clock type in output mode */ -- out.mode &= ~ZL_OUTPUT_MODE_CLOCK_TYPE; -- out.mode |= FIELD_PREP(ZL_OUTPUT_MODE_CLOCK_TYPE, clock_type); -+ zl3073x_out_clock_type_set(&out, -+ ZL_OUTPUT_MODE_CLOCK_TYPE_NORMAL); - - /* If esync is being disabled just write mailbox and finish */ - if (!freq) -diff --git a/drivers/dpll/zl3073x/out.h b/drivers/dpll/zl3073x/out.h -index edf40432bba5..660889c57bff 100644 ---- a/drivers/dpll/zl3073x/out.h -+++ b/drivers/dpll/zl3073x/out.h -@@ -42,6 +42,28 @@ const struct zl3073x_out *zl3073x_out_state_get(struct zl3073x_dev *zldev, - int zl3073x_out_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_out *out); - -+/** -+ * zl3073x_out_clock_type_get - get output clock type -+ * @out: pointer to out state -+ * -+ * Return: clock type of given output (ZL_OUTPUT_MODE_CLOCK_TYPE_*) -+ */ -+static inline u8 zl3073x_out_clock_type_get(const struct zl3073x_out *out) -+{ -+ return FIELD_GET(ZL_OUTPUT_MODE_CLOCK_TYPE, out->mode); -+} -+ -+/** -+ * zl3073x_out_clock_type_set - set output clock type -+ * @out: pointer to out state -+ * @type: clock type (ZL_OUTPUT_MODE_CLOCK_TYPE_*) -+ */ -+static inline void -+zl3073x_out_clock_type_set(struct zl3073x_out *out, u8 type) -+{ -+ FIELD_MODIFY(ZL_OUTPUT_MODE_CLOCK_TYPE, &out->mode, type); -+} -+ - /** - * zl3073x_out_signal_format_get - get output signal format - * @out: pointer to out state -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index be16be20dbc7..55e80e4f0873 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -120,6 +120,52 @@ zl3073x_ref_freq_set(struct zl3073x_ref *ref, u32 freq) - return 0; - } - -+/** -+ * zl3073x_ref_sync_mode_get - get sync control mode -+ * @ref: pointer to ref state -+ * -+ * Return: sync control mode (ZL_REF_SYNC_CTRL_MODE_*) -+ */ -+static inline u8 -+zl3073x_ref_sync_mode_get(const struct zl3073x_ref *ref) -+{ -+ return FIELD_GET(ZL_REF_SYNC_CTRL_MODE, ref->sync_ctrl); -+} -+ -+/** -+ * zl3073x_ref_sync_mode_set - set sync control mode -+ * @ref: pointer to ref state -+ * @mode: sync control mode (ZL_REF_SYNC_CTRL_MODE_*) -+ */ -+static inline void -+zl3073x_ref_sync_mode_set(struct zl3073x_ref *ref, u8 mode) -+{ -+ FIELD_MODIFY(ZL_REF_SYNC_CTRL_MODE, &ref->sync_ctrl, mode); -+} -+ -+/** -+ * zl3073x_ref_sync_pair_get - get sync pair reference index -+ * @ref: pointer to ref state -+ * -+ * Return: paired reference index -+ */ -+static inline u8 -+zl3073x_ref_sync_pair_get(const struct zl3073x_ref *ref) -+{ -+ return FIELD_GET(ZL_REF_SYNC_CTRL_PAIR, ref->sync_ctrl); -+} -+ -+/** -+ * zl3073x_ref_sync_pair_set - set sync pair reference index -+ * @ref: pointer to ref state -+ * @pair: paired reference index -+ */ -+static inline void -+zl3073x_ref_sync_pair_set(struct zl3073x_ref *ref, u8 pair) -+{ -+ FIELD_MODIFY(ZL_REF_SYNC_CTRL_PAIR, &ref->sync_ctrl, pair); -+} -+ - /** - * zl3073x_ref_is_diff - check if the given input reference is differential - * @ref: pointer to ref state -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index 5ae50cb761a9..d425dc67250f 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -213,7 +213,9 @@ - #define ZL_REG_REF_SYNC_CTRL ZL_REG(10, 0x2e, 1) - #define ZL_REF_SYNC_CTRL_MODE GENMASK(2, 0) - #define ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR_OFF 0 -+#define ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR 1 - #define ZL_REF_SYNC_CTRL_MODE_50_50_ESYNC_25_75 2 -+#define ZL_REF_SYNC_CTRL_PAIR GENMASK(7, 4) - - #define ZL_REG_REF_ESYNC_DIV ZL_REG(10, 0x30, 4) - #define ZL_REF_ESYNC_DIV_1HZ 0 --- -2.50.1 (Apple Git-155) - diff --git a/1264-dpll-zl3073x-add-ref-sync-pair-support.patch b/1264-dpll-zl3073x-add-ref-sync-pair-support.patch deleted file mode 100644 index 29824e2c2..000000000 --- a/1264-dpll-zl3073x-add-ref-sync-pair-support.patch +++ /dev/null @@ -1,325 +0,0 @@ -From ef38c6a6c3f4e6f931e21f54c88741a1a0c84f27 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 29 Apr 2026 14:55:45 +0200 -Subject: [PATCH] dpll: zl3073x: add ref-sync pair support - -JIRA: https://issues.redhat.com/browse/RHEL-157828 - -commit 14f269ae699869ddaca7c29c9c6c52288e3bfb73 -Author: Ivan Vecera -Date: Wed Apr 8 12:27:16 2026 +0200 - - dpll: zl3073x: add ref-sync pair support - - Add support for ref-sync pair registration using the 'ref-sync-sources' - phandle property from device tree. A ref-sync pair consists of a clock - reference and a low-frequency sync signal where the DPLL locks to the - clock reference but phase-aligns to the sync reference. - - The implementation: - - Stores fwnode handle in zl3073x_dpll_pin during pin registration - - Adds ref_sync_get/set callbacks to read and write the sync control - mode and pair registers - - Validates ref-sync frequency constraints: sync signal must be 8 kHz - or less, clock reference must be 1 kHz or more and higher than sync - - Excludes sync source from automatic reference selection by setting - its priority to NONE on connect; on disconnect the priority is left - as NONE and the user must explicitly make the pin selectable again - - Iterates ref-sync-sources phandles to register declared pairings - via dpll_pin_ref_sync_pair_add() - - Reviewed-by: Petr Oros - Reviewed-by: Prathosh Satish - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260408102716.443099-6-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 14f269ae699869ddaca7c29c9c6c52288e3bfb73) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index a151be700e6e..55195dcd21d6 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -30,6 +31,7 @@ - * @dpll: DPLL the pin is registered to - * @dpll_pin: pointer to registered dpll_pin - * @tracker: tracking object for the acquired reference -+ * @fwnode: firmware node handle - * @label: package label - * @dir: pin direction - * @id: pin id -@@ -46,6 +48,7 @@ struct zl3073x_dpll_pin { - struct zl3073x_dpll *dpll; - struct dpll_pin *dpll_pin; - dpll_tracker tracker; -+ struct fwnode_handle *fwnode; - char label[8]; - enum dpll_pin_direction dir; - u8 id; -@@ -186,6 +189,109 @@ zl3073x_dpll_input_pin_esync_set(const struct dpll_pin *dpll_pin, - return zl3073x_ref_state_set(zldev, ref_id, &ref); - } - -+static int -+zl3073x_dpll_input_pin_ref_sync_get(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_pin *ref_sync_pin, -+ void *ref_sync_pin_priv, -+ enum dpll_pin_state *state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll_pin *sync_pin = ref_sync_pin_priv; -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ struct zl3073x_dpll *zldpll = pin->dpll; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_ref *ref; -+ u8 ref_id, mode, pair; -+ -+ ref_id = zl3073x_input_pin_ref_get(pin->id); -+ ref = zl3073x_ref_state_get(zldev, ref_id); -+ mode = zl3073x_ref_sync_mode_get(ref); -+ pair = zl3073x_ref_sync_pair_get(ref); -+ -+ if (mode == ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR && -+ pair == zl3073x_input_pin_ref_get(sync_pin->id)) -+ *state = DPLL_PIN_STATE_CONNECTED; -+ else -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ -+ return 0; -+} -+ -+static int -+zl3073x_dpll_input_pin_ref_sync_set(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_pin *ref_sync_pin, -+ void *ref_sync_pin_priv, -+ const enum dpll_pin_state state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll_pin *sync_pin = ref_sync_pin_priv; -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ struct zl3073x_dpll *zldpll = pin->dpll; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ u8 mode, ref_id, sync_ref_id; -+ struct zl3073x_chan chan; -+ struct zl3073x_ref ref; -+ int rc; -+ -+ ref_id = zl3073x_input_pin_ref_get(pin->id); -+ sync_ref_id = zl3073x_input_pin_ref_get(sync_pin->id); -+ ref = *zl3073x_ref_state_get(zldev, ref_id); -+ -+ if (state == DPLL_PIN_STATE_CONNECTED) { -+ const struct zl3073x_ref *sync_ref; -+ u32 ref_freq, sync_freq; -+ -+ sync_ref = zl3073x_ref_state_get(zldev, sync_ref_id); -+ ref_freq = zl3073x_ref_freq_get(&ref); -+ sync_freq = zl3073x_ref_freq_get(sync_ref); -+ -+ /* Sync signal must be 8 kHz or less and clock reference -+ * must be 1 kHz or more and higher than the sync signal. -+ */ -+ if (sync_freq > 8000) { -+ NL_SET_ERR_MSG(extack, -+ "sync frequency must be 8 kHz or less"); -+ return -EINVAL; -+ } -+ if (ref_freq < 1000) { -+ NL_SET_ERR_MSG(extack, -+ "clock frequency must be 1 kHz or more"); -+ return -EINVAL; -+ } -+ if (ref_freq <= sync_freq) { -+ NL_SET_ERR_MSG(extack, -+ "clock frequency must be higher than sync frequency"); -+ return -EINVAL; -+ } -+ -+ zl3073x_ref_sync_pair_set(&ref, sync_ref_id); -+ mode = ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR; -+ } else { -+ mode = ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR_OFF; -+ } -+ -+ zl3073x_ref_sync_mode_set(&ref, mode); -+ -+ rc = zl3073x_ref_state_set(zldev, ref_id, &ref); -+ if (rc) -+ return rc; -+ -+ /* Exclude sync source from automatic reference selection by setting -+ * its priority to NONE. On disconnect the priority is left as NONE -+ * and the user must explicitly make the pin selectable again. -+ */ -+ if (state == DPLL_PIN_STATE_CONNECTED) { -+ chan = *zl3073x_chan_state_get(zldev, zldpll->id); -+ zl3073x_chan_ref_prio_set(&chan, sync_ref_id, -+ ZL_DPLL_REF_PRIO_NONE); -+ return zl3073x_chan_state_set(zldev, zldpll->id, &chan); -+ } -+ -+ return 0; -+} -+ - static int - zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -@@ -1147,6 +1253,8 @@ static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { - .phase_adjust_set = zl3073x_dpll_input_pin_phase_adjust_set, - .prio_get = zl3073x_dpll_input_pin_prio_get, - .prio_set = zl3073x_dpll_input_pin_prio_set, -+ .ref_sync_get = zl3073x_dpll_input_pin_ref_sync_get, -+ .ref_sync_set = zl3073x_dpll_input_pin_ref_sync_set, - .state_on_dpll_get = zl3073x_dpll_input_pin_state_on_dpll_get, - .state_on_dpll_set = zl3073x_dpll_input_pin_state_on_dpll_set, - }; -@@ -1239,8 +1347,11 @@ zl3073x_dpll_pin_register(struct zl3073x_dpll_pin *pin, u32 index) - if (IS_ERR(props)) - return PTR_ERR(props); - -- /* Save package label, esync capability and phase adjust granularity */ -+ /* Save package label, fwnode, esync capability and phase adjust -+ * granularity. -+ */ - strscpy(pin->label, props->package_label); -+ pin->fwnode = fwnode_handle_get(props->fwnode); - pin->esync_control = props->esync_control; - pin->phase_gran = props->dpll_props.phase_gran; - -@@ -1285,6 +1396,8 @@ zl3073x_dpll_pin_register(struct zl3073x_dpll_pin *pin, u32 index) - dpll_pin_put(pin->dpll_pin, &pin->tracker); - pin->dpll_pin = NULL; - err_pin_get: -+ fwnode_handle_put(pin->fwnode); -+ pin->fwnode = NULL; - zl3073x_pin_props_put(props); - - return rc; -@@ -1314,6 +1427,9 @@ zl3073x_dpll_pin_unregister(struct zl3073x_dpll_pin *pin) - - dpll_pin_put(pin->dpll_pin, &pin->tracker); - pin->dpll_pin = NULL; -+ -+ fwnode_handle_put(pin->fwnode); -+ pin->fwnode = NULL; - } - - /** -@@ -1827,6 +1943,88 @@ zl3073x_dpll_free(struct zl3073x_dpll *zldpll) - kfree(zldpll); - } - -+/** -+ * zl3073x_dpll_ref_sync_pair_register - register ref_sync pairs for a pin -+ * @pin: pointer to zl3073x_dpll_pin structure -+ * -+ * Iterates 'ref-sync-sources' phandles in the pin's firmware node and -+ * registers each declared pairing. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_dpll_ref_sync_pair_register(struct zl3073x_dpll_pin *pin) -+{ -+ struct zl3073x_dev *zldev = pin->dpll->dev; -+ struct fwnode_handle *fwnode; -+ struct dpll_pin *sync_pin; -+ dpll_tracker tracker; -+ int n, rc; -+ -+ for (n = 0; ; n++) { -+ /* Get n'th ref-sync source */ -+ fwnode = fwnode_find_reference(pin->fwnode, "ref-sync-sources", -+ n); -+ if (IS_ERR(fwnode)) { -+ rc = PTR_ERR(fwnode); -+ break; -+ } -+ -+ /* Find associated dpll pin */ -+ sync_pin = fwnode_dpll_pin_find(fwnode, &tracker); -+ fwnode_handle_put(fwnode); -+ if (!sync_pin) { -+ dev_warn(zldev->dev, "%s: ref-sync source %d not found", -+ pin->label, n); -+ continue; -+ } -+ -+ /* Register new ref-sync pair */ -+ rc = dpll_pin_ref_sync_pair_add(pin->dpll_pin, sync_pin); -+ dpll_pin_put(sync_pin, &tracker); -+ -+ /* -EBUSY means pairing already exists from another DPLL's -+ * registration. -+ */ -+ if (rc && rc != -EBUSY) { -+ dev_err(zldev->dev, -+ "%s: failed to add ref-sync source %d: %pe", -+ pin->label, n, ERR_PTR(rc)); -+ break; -+ } -+ } -+ -+ return rc != -ENOENT ? rc : 0; -+} -+ -+/** -+ * zl3073x_dpll_ref_sync_pairs_register - register ref_sync pairs for a DPLL -+ * @zldpll: pointer to zl3073x_dpll structure -+ * -+ * Iterates all registered input pins of the given DPLL and establishes -+ * ref_sync pairings declared by 'ref-sync-sources' phandles in the -+ * device tree. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_dpll_ref_sync_pairs_register(struct zl3073x_dpll *zldpll) -+{ -+ struct zl3073x_dpll_pin *pin; -+ int rc; -+ -+ list_for_each_entry(pin, &zldpll->pins, list) { -+ if (!zl3073x_dpll_is_input_pin(pin) || !pin->fwnode) -+ continue; -+ -+ rc = zl3073x_dpll_ref_sync_pair_register(pin); -+ if (rc) -+ return rc; -+ } -+ -+ return 0; -+} -+ - /** - * zl3073x_dpll_register - register DPLL device and all its pins - * @zldpll: pointer to zl3073x_dpll structure -@@ -1850,6 +2048,13 @@ zl3073x_dpll_register(struct zl3073x_dpll *zldpll) - return rc; - } - -+ rc = zl3073x_dpll_ref_sync_pairs_register(zldpll); -+ if (rc) { -+ zl3073x_dpll_pins_unregister(zldpll); -+ zl3073x_dpll_device_unregister(zldpll); -+ return rc; -+ } -+ - return 0; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1265-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch b/1265-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch deleted file mode 100644 index f4f11acb9..000000000 --- a/1265-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch +++ /dev/null @@ -1,233 +0,0 @@ -From 55e372bffed1f937fe3cbac3a2afe058eb4657da Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Sun, 10 May 2026 18:08:11 -0300 -Subject: [PATCH] smb: client: validate the whole DACL before rewriting it in - cifsacl - -JIRA: https://issues.redhat.com/browse/RHEL-172829 -CVE: CVE-2026-31709 - -commit 0a8cf165566ba55a39fd0f4de172119dd646d39a -Author: Michael Bommarito -Date: Sun Apr 19 20:11:31 2026 -0400 - - smb: client: validate the whole DACL before rewriting it in cifsacl - - build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a - server-supplied dacloffset and then use the incoming ACL to rebuild the - chmod/chown security descriptor. - - The original fix only checked that the struct smb_acl header fits before - reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate - header-field OOB read, but the rewrite helpers still walk ACEs based on - pdacl->num_aces with no structural validation of the incoming DACL body. - - A malicious server can return a truncated DACL that still contains a - header, claims one or more ACEs, and then drive - replace_sids_and_copy_aces() or set_chmod_dacl() past the validated - extent while they compare or copy attacker-controlled ACEs. - - Factor the DACL structural checks into validate_dacl(), extend them to - validate each ACE against the DACL bounds, and use the shared validator - before the chmod/chown rebuild paths. parse_dacl() reuses the same - validator so the read-side parser and write-side rewrite paths agree on - what constitutes a well-formed incoming DACL. - - Fixes: bc3e9dd9d104 ("cifs: Change SIDs in ACEs while transferring file ownership.") - Cc: stable@vger.kernel.org - Assisted-by: Claude:claude-opus-4-6 - Assisted-by: Codex:gpt-5-4 - Signed-off-by: Michael Bommarito - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 7e6e473bd4a0..74c320ad5c3a 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -759,6 +759,77 @@ static void dump_ace(struct smb_ace *pace, char *end_of_acl) - } - #endif - -+static int validate_dacl(struct smb_acl *pdacl, char *end_of_acl) -+{ -+ int i, ace_hdr_size, ace_size, min_ace_size; -+ u16 dacl_size, num_aces; -+ char *acl_base, *end_of_dacl; -+ struct smb_ace *pace; -+ -+ if (!pdacl) -+ return 0; -+ -+ if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl)) { -+ cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ return -EINVAL; -+ } -+ -+ dacl_size = le16_to_cpu(pdacl->size); -+ if (dacl_size < sizeof(struct smb_acl) || -+ end_of_acl < (char *)pdacl + dacl_size) { -+ cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ return -EINVAL; -+ } -+ -+ num_aces = le16_to_cpu(pdacl->num_aces); -+ if (!num_aces) -+ return 0; -+ -+ ace_hdr_size = offsetof(struct smb_ace, sid) + -+ offsetof(struct smb_sid, sub_auth); -+ min_ace_size = ace_hdr_size + sizeof(__le32); -+ if (num_aces > (dacl_size - sizeof(struct smb_acl)) / min_ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ return -EINVAL; -+ } -+ -+ end_of_dacl = (char *)pdacl + dacl_size; -+ acl_base = (char *)pdacl; -+ ace_size = sizeof(struct smb_acl); -+ -+ for (i = 0; i < num_aces; ++i) { -+ if (end_of_dacl - acl_base < ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ -+ pace = (struct smb_ace *)(acl_base + ace_size); -+ acl_base = (char *)pace; -+ -+ if (end_of_dacl - acl_base < ace_hdr_size || -+ pace->sid.num_subauth == 0 || -+ pace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ -+ ace_size = ace_hdr_size + sizeof(__le32) * pace->sid.num_subauth; -+ if (end_of_dacl - acl_base < ace_size || -+ le16_to_cpu(pace->size) < ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ -+ ace_size = le16_to_cpu(pace->size); -+ if (end_of_dacl - acl_base < ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ } -+ -+ return 0; -+} -+ - static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - struct smb_sid *pownersid, struct smb_sid *pgrpsid, - struct cifs_fattr *fattr, bool mode_from_special_sid) -@@ -766,7 +837,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - int i; - u16 num_aces = 0; - int acl_size; -- char *acl_base; -+ char *acl_base, *end_of_dacl; - struct smb_ace **ppace; - - /* BB need to add parm so we can store the SID BB */ -@@ -778,12 +849,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - return; - } - -- /* validate that we do not go past end of acl */ -- if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl) || -- end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) { -- cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ if (validate_dacl(pdacl, end_of_acl)) - return; -- } - - cifs_dbg(NOISY, "DACL revision %d size %d num aces %d\n", - le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size), -@@ -794,6 +861,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - user/group/other have no permissions */ - fattr->cf_mode &= ~(0777); - -+ end_of_dacl = (char *)pdacl + le16_to_cpu(pdacl->size); - acl_base = (char *)pdacl; - acl_size = sizeof(struct smb_acl); - -@@ -801,36 +869,16 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - if (num_aces > 0) { - umode_t denied_mode = 0; - -- if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) / -- (offsetof(struct smb_ace, sid) + -- offsetof(struct smb_sid, sub_auth) + sizeof(__le16))) -- return; -- - ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), - GFP_KERNEL); - if (!ppace) - return; - - for (i = 0; i < num_aces; ++i) { -- if (end_of_acl - acl_base < acl_size) -- break; -- - ppace[i] = (struct smb_ace *) (acl_base + acl_size); -- acl_base = (char *)ppace[i]; -- acl_size = offsetof(struct smb_ace, sid) + -- offsetof(struct smb_sid, sub_auth); -- -- if (end_of_acl - acl_base < acl_size || -- ppace[i]->sid.num_subauth == 0 || -- ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || -- (end_of_acl - acl_base < -- acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) || -- (le16_to_cpu(ppace[i]->size) < -- acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth)) -- break; - - #ifdef CONFIG_CIFS_DEBUG2 -- dump_ace(ppace[i], end_of_acl); -+ dump_ace(ppace[i], end_of_dacl); - #endif - if (mode_from_special_sid && - (compare_sids(&(ppace[i]->sid), -@@ -872,6 +920,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - (void *)ppace[i], - sizeof(struct smb_ace)); */ - -+ acl_base = (char *)ppace[i]; - acl_size = le16_to_cpu(ppace[i]->size); - } - -@@ -1295,10 +1344,9 @@ static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); -- if (end_of_acl < (char *)dacl_ptr + le16_to_cpu(dacl_ptr->size)) { -- cifs_dbg(VFS, "Server returned illegal ACL size\n"); -- return -EINVAL; -- } -+ rc = validate_dacl(dacl_ptr, end_of_acl); -+ if (rc) -+ return rc; - } - - owner_sid_ptr = (struct smb_sid *)((char *)pntsd + -@@ -1671,6 +1719,12 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); -+ rc = validate_dacl(dacl_ptr, (char *)pntsd + secdesclen); -+ if (rc) { -+ kfree(pntsd); -+ cifs_put_tlink(tlink); -+ return rc; -+ } - if (mode_from_sid) - nsecdesclen += - le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace); --- -2.50.1 (Apple Git-155) - diff --git a/1266-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch b/1266-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch deleted file mode 100644 index 41c7ef248..000000000 --- a/1266-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch +++ /dev/null @@ -1,50 +0,0 @@ -From d8a6ff81310035796f62a3786a33b7ba906091b0 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Sun, 10 May 2026 18:08:12 -0300 -Subject: [PATCH] smb: client: require a full NFS mode SID before reading mode - bits - -JIRA: https://issues.redhat.com/browse/RHEL-172829 - -commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21 -Author: Michael Bommarito -Date: Mon Apr 20 09:50:58 2026 -0400 - - smb: client: require a full NFS mode SID before reading mode bits - - parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS - mode SID and reads sid.sub_auth[2] to recover the mode bits. - - That assumes the ACE carries three subauthorities, but compare_sids() - only compares min(a, b) subauthorities. A malicious server can return - an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still - matches sid_unix_NFS_mode and then drives the sub_auth[2] read four - bytes past the end of the ACE. - - Require num_subauth >= 3 before treating the ACE as an NFS mode SID. - This keeps the fix local to the special-SID mode path without changing - compare_sids() semantics for the rest of cifsacl. - - Fixes: e2f8fbfb8d09 ("cifs: get mode bits from special sid on stat") - Cc: stable@vger.kernel.org - Assisted-by: Claude:claude-opus-4-6 - Signed-off-by: Michael Bommarito - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 74c320ad5c3a..e6690f8e46a8 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -881,6 +881,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - dump_ace(ppace[i], end_of_dacl); - #endif - if (mode_from_special_sid && -+ ppace[i]->sid.num_subauth >= 3 && - (compare_sids(&(ppace[i]->sid), - &sid_unix_NFS_mode) == 0)) { - /* --- -2.50.1 (Apple Git-155) - diff --git a/1267-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch b/1267-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch deleted file mode 100644 index ac8240202..000000000 --- a/1267-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 59a296878f29e33031dad8c186168e8e5b50e95a Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Sun, 10 May 2026 18:08:12 -0300 -Subject: [PATCH] smb: client: scope end_of_dacl to CIFS_DEBUG2 use in - parse_dacl - -JIRA: https://issues.redhat.com/browse/RHEL-172829 - -commit a55a60886e612bedb0e9a402ba0dca544c4c6a51 -Author: Michael Bommarito -Date: Tue Apr 21 19:40:22 2026 -0400 - - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - - After validate_dacl() was factored out in commit 149822e5541c, the - local end_of_dacl in parse_dacl() is only read by the dump_ace() - call under #ifdef CONFIG_CIFS_DEBUG2. With CIFS_DEBUG2 off the - variable is assigned but never used, which gcc -W=1 flags as - -Wunused-but-set-variable. - - Remove the local and compute the end-of-dacl pointer inline at the - single call site inside the existing CIFS_DEBUG2 guard. No - functional change: when CIFS_DEBUG2 is enabled the argument value - is identical to what the removed local carried; when CIFS_DEBUG2 - is disabled the code was already dead. - - Reported-by: kernel test robot - Closes: https://lore.kernel.org/oe-kbuild-all/202604220046.tGkRxVtS-lkp@intel.com/ - Fixes: 149822e5541c ("smb: client: validate the whole DACL before rewriting it in cifsacl") - Signed-off-by: Michael Bommarito - Assisted-by: Claude:claude-opus-4-7 - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index e6690f8e46a8..717a40fa84aa 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -837,7 +837,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - int i; - u16 num_aces = 0; - int acl_size; -- char *acl_base, *end_of_dacl; -+ char *acl_base; - struct smb_ace **ppace; - - /* BB need to add parm so we can store the SID BB */ -@@ -861,7 +861,6 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - user/group/other have no permissions */ - fattr->cf_mode &= ~(0777); - -- end_of_dacl = (char *)pdacl + le16_to_cpu(pdacl->size); - acl_base = (char *)pdacl; - acl_size = sizeof(struct smb_acl); - -@@ -878,7 +877,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - ppace[i] = (struct smb_ace *) (acl_base + acl_size); - - #ifdef CONFIG_CIFS_DEBUG2 -- dump_ace(ppace[i], end_of_dacl); -+ dump_ace(ppace[i], -+ (char *)pdacl + le16_to_cpu(pdacl->size)); - #endif - if (mode_from_special_sid && - ppace[i]->sid.num_subauth >= 3 && --- -2.50.1 (Apple Git-155) - diff --git a/1268-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch b/1268-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch deleted file mode 100644 index aeb35e307..000000000 --- a/1268-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch +++ /dev/null @@ -1,57 +0,0 @@ -From f1579c843ecda9218102033597e2bafe1ce8ec74 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Sun, 10 May 2026 18:08:12 -0300 -Subject: [PATCH] smb: client: use kzalloc to zero-initialize security - descriptor buffer - -JIRA: https://issues.redhat.com/browse/RHEL-172829 - -commit 5e489c6c47a2ac15edbaca153b9348e42c1eacab -Author: Bjoern Doebel -Date: Thu Apr 30 08:57:17 2026 +0000 - - smb: client: use kzalloc to zero-initialize security descriptor buffer - - Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces - to le16") split struct smb_acl's __le32 num_aces field into __le16 - num_aces and __le16 reserved. The reserved field corresponds to Sbz2 - in the MS-DTYP ACL wire format, which must be zero [1]. - - When building an ACL descriptor in build_sec_desc(), we are using a - kmalloc()'ed descriptor buffer and writing the fields explicitly using - le16() writes now. This never writes to the 2 byte reserved field, - leaving it as uninitialized heap data. - - When the reserved field happens to contain non-zero slab garbage, - Samba rejects the security descriptor with "ndr_pull_security_descriptor - failed: Range Error", causing chmod to fail with EINVAL. - - Change kmalloc() to kzalloc() to ensure the entire buffer is - zero-initialized. - - Fixes: 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16") - Cc: stable@vger.kernel.org - - Signed-off-by: Bjoern Doebel - Assisted-by: Kiro:claude-opus-4.6 - [1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428 - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 717a40fa84aa..03bad2885e96 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -1741,7 +1741,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - * descriptor parameters, and security descriptor itself - */ - nsecdesclen = max_t(u32, nsecdesclen, DEFAULT_SEC_DESC_LEN); -- pnntsd = kmalloc(nsecdesclen, GFP_KERNEL); -+ pnntsd = kzalloc(nsecdesclen, GFP_KERNEL); - if (!pnntsd) { - kfree(pntsd); - cifs_put_tlink(tlink); --- -2.50.1 (Apple Git-155) - diff --git a/1269-smb-client-validate-dacloffset-before-building-dacl-pointers.patch b/1269-smb-client-validate-dacloffset-before-building-dacl-pointers.patch deleted file mode 100644 index 3ed5def6c..000000000 --- a/1269-smb-client-validate-dacloffset-before-building-dacl-pointers.patch +++ /dev/null @@ -1,123 +0,0 @@ -From eff4c8b51d7c82746c2efa0e4ba30576d1082169 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Sun, 10 May 2026 18:08:12 -0300 -Subject: [PATCH] smb: client: validate dacloffset before building DACL - pointers - -JIRA: https://issues.redhat.com/browse/RHEL-172829 - -commit f98b48151cc502ada59d9778f0112d21f2586ca3 -Author: Michael Bommarito -Date: Mon Apr 20 10:47:47 2026 -0400 - - smb: client: validate dacloffset before building DACL pointers - - parse_sec_desc(), build_sec_desc(), and the chown path in - id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd - before proving a DACL header fits inside the returned security - descriptor. - - On 32-bit builds a malicious server can return dacloffset near - U32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip - past the later pointer-based bounds checks. build_sec_desc() and - id_mode_to_cifs_acl() can then dereference DACL fields from the wrapped - pointer in the chmod/chown rewrite paths. - - Validate dacloffset numerically before building any DACL pointer and - reuse the same helper at the three DACL entry points. - - Fixes: bc3e9dd9d104 ("cifs: Change SIDs in ACEs while transferring file ownership.") - Cc: stable@vger.kernel.org - Assisted-by: Claude:claude-opus-4-6 - Signed-off-by: Michael Bommarito - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 03bad2885e96..7ed526d23d14 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -1266,6 +1266,17 @@ static int parse_sid(struct smb_sid *psid, char *end_of_acl) - return 0; - } - -+static bool dacl_offset_valid(unsigned int acl_len, __u32 dacloffset) -+{ -+ if (acl_len < sizeof(struct smb_acl)) -+ return false; -+ -+ if (dacloffset < sizeof(struct smb_ntsd)) -+ return false; -+ -+ return dacloffset <= acl_len - sizeof(struct smb_acl); -+} -+ - - /* Convert CIFS ACL to POSIX form */ - static int parse_sec_desc(struct cifs_sb_info *cifs_sb, -@@ -1286,7 +1297,6 @@ static int parse_sec_desc(struct cifs_sb_info *cifs_sb, - group_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->gsidoffset)); - dacloffset = le32_to_cpu(pntsd->dacloffset); -- dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - cifs_dbg(NOISY, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n", - pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset), - le32_to_cpu(pntsd->gsidoffset), -@@ -1317,11 +1327,18 @@ static int parse_sec_desc(struct cifs_sb_info *cifs_sb, - return rc; - } - -- if (dacloffset) -+ if (dacloffset) { -+ if (!dacl_offset_valid(acl_len, dacloffset)) { -+ cifs_dbg(VFS, "Server returned illegal DACL offset\n"); -+ return -EINVAL; -+ } -+ -+ dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr, - group_sid_ptr, fattr, get_mode_from_special_sid); -- else -+ } else { - cifs_dbg(FYI, "no ACL\n"); /* BB grant all or default perms? */ -+ } - - return rc; - } -@@ -1344,6 +1361,11 @@ static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, - - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { -+ if (!dacl_offset_valid(secdesclen, dacloffset)) { -+ cifs_dbg(VFS, "Server returned illegal DACL offset\n"); -+ return -EINVAL; -+ } -+ - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - rc = validate_dacl(dacl_ptr, end_of_acl); - if (rc) -@@ -1719,6 +1741,12 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2); - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { -+ if (!dacl_offset_valid(secdesclen, dacloffset)) { -+ cifs_dbg(VFS, "Server returned illegal DACL offset\n"); -+ rc = -EINVAL; -+ goto id_mode_to_cifs_acl_exit; -+ } -+ - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - rc = validate_dacl(dacl_ptr, (char *)pntsd + secdesclen); - if (rc) { -@@ -1761,6 +1789,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - rc = ops->set_acl(pnntsd, nsecdesclen, inode, path, aclflag); - cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc); - } -+id_mode_to_cifs_acl_exit: - cifs_put_tlink(tlink); - - kfree(pnntsd); --- -2.50.1 (Apple Git-155) - diff --git a/1270-dpll-add-pin-operational-state.patch b/1270-dpll-add-pin-operational-state.patch deleted file mode 100644 index 029a39ba4..000000000 --- a/1270-dpll-add-pin-operational-state.patch +++ /dev/null @@ -1,294 +0,0 @@ -From 05ce58c7fda9c607fb135c297cbef74db41489c2 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 13 May 2026 11:47:07 +0200 -Subject: [PATCH] dpll: add pin operational state - -JIRA: https://issues.redhat.com/browse/RHEL-173188 - -commit 781c8893a5da8522ae4ded93e5ef3adbe9559300 -Author: Ivan Vecera -Date: Tue Apr 28 17:49:06 2026 +0200 - - dpll: add pin operational state - - Add pin-operstate enum and operstate_on_dpll_get callback to report - the actual hardware status of a pin with respect to its parent DPLL - device. Unlike pin-state (which reflects administrative intent set - by the user), operstate reflects what the hardware is actually doing. - - Defined operational states: - - active: pin is qualified and actively used by the DPLL - - standby: pin is qualified but not actively used by the DPLL - - no-signal: pin does not have a valid signal - - qual-failed: pin signal failed qualification - - The operstate is reported inside the pin-parent-device nested - attribute alongside the existing state and phase-offset attributes. - - Signed-off-by: Ivan Vecera - Reviewed-by: Jiri Pirko - Reviewed-by: Vadim Fedorenko - Reviewed-by: Petr Oros - Link: https://patch.msgid.link/20260428154907.2820654-2-ivecera@redhat.com - Signed-off-by: Paolo Abeni - -(cherry picked from commit 781c8893a5da8522ae4ded93e5ef3adbe9559300) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/Documentation/driver-api/dpll.rst b/Documentation/driver-api/dpll.rst -index 93c191b2d089..37eaef785e30 100644 ---- a/Documentation/driver-api/dpll.rst -+++ b/Documentation/driver-api/dpll.rst -@@ -65,35 +65,43 @@ request, where user provides attributes that result in single pin match. - Pin selection - ============= - --In general, selected pin (the one which signal is driving the dpll --device) can be obtained from ``DPLL_A_PIN_STATE`` attribute, and only --one pin shall be in ``DPLL_PIN_STATE_CONNECTED`` state for any dpll --device. -+Pin state (``DPLL_A_PIN_STATE``) reflects the administrative intent set -+by the user. Pin operational state (``DPLL_A_PIN_OPERSTATE``) reflects -+what the hardware is actually doing with the pin. - - Pin selection can be done either manually or automatically, depending - on hardware capabilities and active dpll device work mode - (``DPLL_A_MODE`` attribute). The consequence is that there are --differences for each mode in terms of available pin states, as well as --for the states the user can request for a dpll device. -+differences for each mode in terms of available pin states the user can -+request for a dpll device. - --In manual mode (``DPLL_MODE_MANUAL``) the user can request or receive --one of following pin states: -+In manual mode (``DPLL_MODE_MANUAL``) the user can request one of -+following pin states: - --- ``DPLL_PIN_STATE_CONNECTED`` - the pin is used to drive dpll device --- ``DPLL_PIN_STATE_DISCONNECTED`` - the pin is not used to drive dpll -+- ``DPLL_PIN_STATE_CONNECTED`` - the pin is selected to drive dpll - device -+- ``DPLL_PIN_STATE_DISCONNECTED`` - the pin is not selected to drive -+ dpll device - --In automatic mode (``DPLL_MODE_AUTOMATIC``) the user can request or --receive one of following pin states: -+In automatic mode (``DPLL_MODE_AUTOMATIC``) the user can request one of -+following pin states: - - - ``DPLL_PIN_STATE_SELECTABLE`` - the pin shall be considered as valid - input for automatic selection algorithm - - ``DPLL_PIN_STATE_DISCONNECTED`` - the pin shall be not considered as - a valid input for automatic selection algorithm - --In automatic mode (``DPLL_MODE_AUTOMATIC``) the user can only receive --pin state ``DPLL_PIN_STATE_CONNECTED`` once automatic selection --algorithm locks a dpll device with one of the inputs. -+The actual hardware status of a pin is reported via the operational -+state (``DPLL_A_PIN_OPERSTATE``) attribute nested under the parent -+device: -+ -+- ``DPLL_PIN_OPERSTATE_ACTIVE`` - pin is qualified and actively used -+ by the DPLL -+- ``DPLL_PIN_OPERSTATE_STANDBY`` - pin is qualified but not actively -+ used by the DPLL -+- ``DPLL_PIN_OPERSTATE_NO_SIGNAL`` - pin does not have a valid signal -+- ``DPLL_PIN_OPERSTATE_QUAL_FAILED`` - pin signal failed qualification -+ checks - - Shared pins - =========== -diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml -index cb5da356bb64..a47d7da54da5 100644 ---- a/Documentation/netlink/specs/dpll.yaml -+++ b/Documentation/netlink/specs/dpll.yaml -@@ -212,6 +212,27 @@ definitions: - name: selectable - doc: pin enabled for automatic input selection - render-max: true -+ - -+ type: enum -+ name: pin-operstate -+ doc: | -+ defines possible operational states of a pin with respect to its -+ parent DPLL device, valid values for DPLL_A_PIN_OPERSTATE attribute -+ entries: -+ - -+ name: active -+ doc: pin is qualified and actively used by the DPLL -+ value: 1 -+ - -+ name: standby -+ doc: pin is qualified but not actively used by the DPLL -+ - -+ name: no-signal -+ doc: pin does not have a valid signal -+ - -+ name: qual-failed -+ doc: pin signal failed qualification (e.g. frequency or phase monitor) -+ render-max: true - - - type: flags - name: pin-capabilities -@@ -488,6 +509,14 @@ attribute-sets: - Value of (DPLL_A_PIN_MEASURED_FREQUENCY % - DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is a fractional part - of a measured frequency value. -+ - -+ name: operstate -+ type: u32 -+ enum: pin-operstate -+ doc: | -+ Operational state of the pin with respect to its parent DPLL -+ device. Unlike state (which reflects the administrative intent), -+ operstate reflects the actual hardware status. - - - - name: pin-parent-device -@@ -501,6 +530,8 @@ attribute-sets: - name: prio - - - name: state -+ - -+ name: operstate - - - name: phase-offset - - -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index af7ce62ec55c..05cf946b4be5 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -324,6 +324,30 @@ dpll_msg_add_pin_on_dpll_state(struct sk_buff *msg, struct dpll_pin *pin, - return 0; - } - -+static int -+dpll_msg_add_pin_operstate(struct sk_buff *msg, struct dpll_pin *pin, -+ struct dpll_pin_ref *ref, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_pin_ops *ops = dpll_pin_ops(ref); -+ struct dpll_device *dpll = ref->dpll; -+ enum dpll_pin_operstate operstate; -+ int ret; -+ -+ if (!ops->operstate_on_dpll_get) -+ return 0; -+ ret = ops->operstate_on_dpll_get(pin, -+ dpll_pin_on_dpll_priv(dpll, pin), -+ dpll, dpll_priv(dpll), -+ &operstate, extack); -+ if (ret) -+ return ret; -+ if (nla_put_u32(msg, DPLL_A_PIN_OPERSTATE, operstate)) -+ return -EMSGSIZE; -+ -+ return 0; -+} -+ - static int - dpll_msg_add_pin_direction(struct sk_buff *msg, struct dpll_pin *pin, - struct dpll_pin_ref *ref, -@@ -650,6 +674,9 @@ dpll_msg_add_pin_dplls(struct sk_buff *msg, struct dpll_pin *pin, - if (ret) - goto nest_cancel; - ret = dpll_msg_add_pin_on_dpll_state(msg, pin, ref, extack); -+ if (ret) -+ goto nest_cancel; -+ ret = dpll_msg_add_pin_operstate(msg, pin, ref, extack); - if (ret) - goto nest_cancel; - ret = dpll_msg_add_pin_prio(msg, pin, ref, extack); -diff --git a/drivers/dpll/dpll_nl.c b/drivers/dpll/dpll_nl.c -index da92aa8f9bc7..64398841cdcb 100644 ---- a/drivers/dpll/dpll_nl.c -+++ b/drivers/dpll/dpll_nl.c -@@ -11,11 +11,12 @@ - #include - - /* Common nested types */ --const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_PHASE_OFFSET + 1] = { -+const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_OPERSTATE + 1] = { - [DPLL_A_PIN_PARENT_ID] = { .type = NLA_U32, }, - [DPLL_A_PIN_DIRECTION] = NLA_POLICY_RANGE(NLA_U32, 1, 2), - [DPLL_A_PIN_PRIO] = { .type = NLA_U32, }, - [DPLL_A_PIN_STATE] = NLA_POLICY_RANGE(NLA_U32, 1, 3), -+ [DPLL_A_PIN_OPERSTATE] = NLA_POLICY_RANGE(NLA_U32, 1, 4), - [DPLL_A_PIN_PHASE_OFFSET] = { .type = NLA_S64, }, - }; - -diff --git a/drivers/dpll/dpll_nl.h b/drivers/dpll/dpll_nl.h -index 3da10cfe9a6e..8cf3b73c2013 100644 ---- a/drivers/dpll/dpll_nl.h -+++ b/drivers/dpll/dpll_nl.h -@@ -12,7 +12,7 @@ - #include - - /* Common nested types */ --extern const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_PHASE_OFFSET + 1]; -+extern const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_OPERSTATE + 1]; - extern const struct nla_policy dpll_pin_parent_pin_nl_policy[DPLL_A_PIN_STATE + 1]; - extern const struct nla_policy dpll_reference_sync_nl_policy[DPLL_A_PIN_STATE + 1]; - -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index 441fe25ba4f4..90249937008c 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -98,6 +98,12 @@ struct dpll_pin_ops { - const struct dpll_device *dpll, - void *dpll_priv, enum dpll_pin_state *state, - struct netlink_ext_ack *extack); -+ int (*operstate_on_dpll_get)(const struct dpll_pin *pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_pin_operstate *operstate, -+ struct netlink_ext_ack *extack); - int (*state_on_pin_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_pin *parent_pin, - void *parent_pin_priv, -diff --git a/include/uapi/linux/dpll.h b/include/uapi/linux/dpll.h -index 93614ccd8a84..aa45b79473de 100644 ---- a/include/uapi/linux/dpll.h -+++ b/include/uapi/linux/dpll.h -@@ -177,6 +177,28 @@ enum dpll_pin_state { - DPLL_PIN_STATE_MAX = (__DPLL_PIN_STATE_MAX - 1) - }; - -+/** -+ * enum dpll_pin_operstate - defines possible operational states of a pin with -+ * respect to its parent DPLL device, valid values for DPLL_A_PIN_OPERSTATE -+ * attribute -+ * @DPLL_PIN_OPERSTATE_ACTIVE: pin is qualified and actively used by the DPLL -+ * @DPLL_PIN_OPERSTATE_STANDBY: pin is qualified but not actively used by the -+ * DPLL -+ * @DPLL_PIN_OPERSTATE_NO_SIGNAL: pin does not have a valid signal -+ * @DPLL_PIN_OPERSTATE_QUAL_FAILED: pin signal failed qualification (e.g. -+ * frequency or phase monitor) -+ */ -+enum dpll_pin_operstate { -+ DPLL_PIN_OPERSTATE_ACTIVE = 1, -+ DPLL_PIN_OPERSTATE_STANDBY, -+ DPLL_PIN_OPERSTATE_NO_SIGNAL, -+ DPLL_PIN_OPERSTATE_QUAL_FAILED, -+ -+ /* private: */ -+ __DPLL_PIN_OPERSTATE_MAX, -+ DPLL_PIN_OPERSTATE_MAX = (__DPLL_PIN_OPERSTATE_MAX - 1) -+}; -+ - /** - * enum dpll_pin_capabilities - defines possible capabilities of a pin, valid - * flags on DPLL_A_PIN_CAPABILITIES attribute -@@ -256,6 +278,7 @@ enum dpll_a_pin { - DPLL_A_PIN_PHASE_ADJUST_GRAN, - DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, - DPLL_A_PIN_MEASURED_FREQUENCY, -+ DPLL_A_PIN_OPERSTATE, - - __DPLL_A_PIN_MAX, - DPLL_A_PIN_MAX = (__DPLL_A_PIN_MAX - 1) --- -2.50.1 (Apple Git-155) - diff --git a/1271-dpll-zl3073x-implement-pin-operational-state-reporting.patch b/1271-dpll-zl3073x-implement-pin-operational-state-reporting.patch deleted file mode 100644 index 41686b64f..000000000 --- a/1271-dpll-zl3073x-implement-pin-operational-state-reporting.patch +++ /dev/null @@ -1,254 +0,0 @@ -From 80d47d653c6ca35a7dbfc6c8abc9486445c1e068 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 13 May 2026 11:48:51 +0200 -Subject: [PATCH] dpll: zl3073x: implement pin operational state reporting - -JIRA: https://issues.redhat.com/browse/RHEL-173188 - -commit c53f8f8dce776e032b1a11fb4d9b6e12bb63d958 -Author: Ivan Vecera -Date: Tue Apr 28 17:49:07 2026 +0200 - - dpll: zl3073x: implement pin operational state reporting - - Implement operstate_on_dpll_get callback for input pins to report - the actual hardware status: - - - active: pin is the currently locked reference - - standby: signal is valid but pin is not actively used - - no-signal: reference monitor reports Loss of Signal (LOS) - - qual-failed: reference monitor reports a qualification failure - (SCM, CFM, GST, PFM, eSync or Split-XO) - - Separate administrative state (state_on_dpll_get) from operational - state: admin state now reports purely the user-requested intent - (connected in reflock mode, selectable in auto mode). - - Switch periodic monitoring to track operstate changes instead of - the mixed admin/oper state that was previously reported. - - Add ref_mon_status bit definitions to regs.h. - - Signed-off-by: Ivan Vecera - Reviewed-by: Petr Oros - Link: https://patch.msgid.link/20260428154907.2820654-3-ivecera@redhat.com - Signed-off-by: Paolo Abeni - -(cherry picked from commit c53f8f8dce776e032b1a11fb4d9b6e12bb63d958) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 55195dcd21d6..2c8bd211e31e 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -38,7 +38,7 @@ - * @prio: pin priority <0, 14> - * @esync_control: embedded sync is controllable - * @phase_gran: phase adjustment granularity -- * @pin_state: last saved pin state -+ * @operstate: last saved operational state - * @phase_offset: last saved pin phase offset - * @freq_offset: last saved fractional frequency offset - * @measured_freq: last saved measured frequency -@@ -55,7 +55,7 @@ struct zl3073x_dpll_pin { - u8 prio; - bool esync_control; - s32 phase_gran; -- enum dpll_pin_state pin_state; -+ enum dpll_pin_operstate operstate; - s64 phase_offset; - s64 freq_offset; - u32 measured_freq; -@@ -500,46 +500,41 @@ zl3073x_dpll_input_pin_phase_adjust_set(const struct dpll_pin *dpll_pin, - } - - /** -- * zl3073x_dpll_ref_state_get - get status for given input pin -+ * zl3073x_dpll_ref_operstate_get - get operational state for input pin - * @pin: pointer to pin -- * @state: place to store status -+ * @operstate: place to store operational state - * -- * Checks current status for the given input pin and stores the value -- * to @state. -+ * Returns the actual hardware state of the pin: whether it is actively -+ * used by the DPLL, has no signal, failed qualification, or is simply -+ * not in use. - * - * Return: 0 on success, <0 on error - */ - static int --zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, -- enum dpll_pin_state *state) -+zl3073x_dpll_ref_operstate_get(struct zl3073x_dpll_pin *pin, -+ enum dpll_pin_operstate *operstate) - { - struct zl3073x_dpll *zldpll = pin->dpll; - struct zl3073x_dev *zldev = zldpll->dev; -- const struct zl3073x_chan *chan; -- u8 ref; -- -- chan = zl3073x_chan_state_get(zldev, zldpll->id); -- ref = zl3073x_input_pin_ref_get(pin->id); -+ const struct zl3073x_ref *ref; -+ u8 ref_id; - -- /* Check if the pin reference is connected */ -- if (ref == zl3073x_dpll_connected_ref_get(zldpll)) { -- *state = DPLL_PIN_STATE_CONNECTED; -- return 0; -- } -+ ref_id = zl3073x_input_pin_ref_get(pin->id); - -- /* If the DPLL is running in automatic mode and the reference is -- * selectable and its monitor does not report any error then report -- * pin as selectable. -- */ -- if (zl3073x_chan_mode_get(chan) == ZL_DPLL_MODE_REFSEL_MODE_AUTO && -- zl3073x_dev_ref_is_status_ok(zldev, ref) && -- zl3073x_chan_ref_is_selectable(chan, ref)) { -- *state = DPLL_PIN_STATE_SELECTABLE; -+ /* Check if this pin is the currently locked reference */ -+ if (ref_id == zl3073x_dpll_connected_ref_get(zldpll)) { -+ *operstate = DPLL_PIN_OPERSTATE_ACTIVE; - return 0; - } - -- /* Otherwise report the pin as disconnected */ -- *state = DPLL_PIN_STATE_DISCONNECTED; -+ /* Check reference monitor status */ -+ ref = zl3073x_ref_state_get(zldev, ref_id); -+ if (ref->mon_status & ZL_REF_MON_STATUS_LOS) -+ *operstate = DPLL_PIN_OPERSTATE_NO_SIGNAL; -+ else if (!zl3073x_ref_is_status_ok(ref)) -+ *operstate = DPLL_PIN_OPERSTATE_QUAL_FAILED; -+ else -+ *operstate = DPLL_PIN_OPERSTATE_STANDBY; - - return 0; - } -@@ -551,10 +546,48 @@ zl3073x_dpll_input_pin_state_on_dpll_get(const struct dpll_pin *dpll_pin, - void *dpll_priv, - enum dpll_pin_state *state, - struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ const struct zl3073x_chan *chan; -+ u8 mode, ref; -+ -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ mode = zl3073x_chan_mode_get(chan); -+ -+ switch (mode) { -+ case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -+ if (ref == zl3073x_chan_ref_get(chan)) -+ *state = DPLL_PIN_STATE_CONNECTED; -+ else -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ break; -+ case ZL_DPLL_MODE_REFSEL_MODE_AUTO: -+ if (zl3073x_chan_ref_is_selectable(chan, ref)) -+ *state = DPLL_PIN_STATE_SELECTABLE; -+ else -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ break; -+ default: -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ break; -+ } -+ -+ return 0; -+} -+ -+static int -+zl3073x_dpll_input_pin_operstate_on_dpll_get(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_pin_operstate *operstate, -+ struct netlink_ext_ack *extack) - { - struct zl3073x_dpll_pin *pin = pin_priv; - -- return zl3073x_dpll_ref_state_get(pin, state); -+ return zl3073x_dpll_ref_operstate_get(pin, operstate); - } - - static int -@@ -1248,6 +1281,7 @@ static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { - .frequency_get = zl3073x_dpll_input_pin_frequency_get, - .frequency_set = zl3073x_dpll_input_pin_frequency_set, - .measured_freq_get = zl3073x_dpll_input_pin_measured_freq_get, -+ .operstate_on_dpll_get = zl3073x_dpll_input_pin_operstate_on_dpll_get, - .phase_offset_get = zl3073x_dpll_input_pin_phase_offset_get, - .phase_adjust_get = zl3073x_dpll_input_pin_phase_adjust_get, - .phase_adjust_set = zl3073x_dpll_input_pin_phase_adjust_set, -@@ -1663,7 +1697,7 @@ zl3073x_dpll_pin_phase_offset_check(struct zl3073x_dpll_pin *pin) - * 2) For other pins use appropriate ref_phase register if the phase - * monitor feature is enabled. - */ -- if (pin->pin_state == DPLL_PIN_STATE_CONNECTED) -+ if (pin->operstate == DPLL_PIN_OPERSTATE_ACTIVE) - reg = ZL_REG_DPLL_PHASE_ERR_DATA(zldpll->id); - else if (zldpll->phase_monitor) - reg = ZL_REG_REF_PHASE(ref_id); -@@ -1828,7 +1862,7 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - } - - list_for_each_entry(pin, &zldpll->pins, list) { -- enum dpll_pin_state state; -+ enum dpll_pin_operstate operstate; - bool pin_changed = false; - - /* Output pins change checks are not necessary because output -@@ -1837,18 +1871,18 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - if (!zl3073x_dpll_is_input_pin(pin)) - continue; - -- rc = zl3073x_dpll_ref_state_get(pin, &state); -+ rc = zl3073x_dpll_ref_operstate_get(pin, &operstate); - if (rc) { - dev_err(dev, -- "Failed to get %s on DPLL%u state: %pe\n", -+ "Failed to get %s on DPLL%u oper state: %pe\n", - pin->label, zldpll->id, ERR_PTR(rc)); - return; - } - -- if (state != pin->pin_state) { -- dev_dbg(dev, "%s state changed: %u->%u\n", pin->label, -- pin->pin_state, state); -- pin->pin_state = state; -+ if (operstate != pin->operstate) { -+ dev_dbg(dev, "%s oper state changed: %u->%u\n", -+ pin->label, pin->operstate, operstate); -+ pin->operstate = operstate; - pin_changed = true; - } - -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index d425dc67250f..8015808bdf54 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -98,7 +98,14 @@ - - #define ZL_REG_REF_MON_STATUS(_idx) \ - ZL_REG_IDX(_idx, 2, 0x02, 1, ZL3073X_NUM_REFS, 1) --#define ZL_REF_MON_STATUS_OK 0 /* all bits zeroed */ -+#define ZL_REF_MON_STATUS_OK 0 -+#define ZL_REF_MON_STATUS_LOS BIT(0) -+#define ZL_REF_MON_STATUS_SCM BIT(1) -+#define ZL_REF_MON_STATUS_CFM BIT(2) -+#define ZL_REF_MON_STATUS_GST BIT(3) -+#define ZL_REF_MON_STATUS_PFM BIT(4) -+#define ZL_REF_MON_STATUS_ESYNC BIT(6) -+#define ZL_REF_MON_STATUS_SPLIT_XO BIT(7) - - #define ZL_REG_DPLL_MON_STATUS(_idx) \ - ZL_REG_IDX(_idx, 2, 0x10, 1, ZL3073X_MAX_CHANNELS, 1) --- -2.50.1 (Apple Git-155) - diff --git a/1272-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch b/1272-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch deleted file mode 100644 index a20359ac6..000000000 --- a/1272-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch +++ /dev/null @@ -1,325 +0,0 @@ -From 071d49d03d957fe6ab483b8447328dc278cbf6f1 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 13 May 2026 11:50:25 +0200 -Subject: [PATCH] dpll: add fractional frequency offset to pin-parent-device - -JIRA: https://issues.redhat.com/browse/RHEL-173193 - -commit 9c11fcb2e9a54d0f1467380831e2e4bb68f7498d -Author: Ivan Vecera -Date: Mon May 11 17:58:15 2026 +0200 - - dpll: add fractional frequency offset to pin-parent-device - - Add both fractional-frequency-offset (PPM) and - fractional-frequency-offset-ppt (PPT) attributes to the - pin-parent-device nested attribute set, alongside the existing - top-level pin attributes. Both carry the same measurement at - different precisions. - - Introduce enum dpll_ffo_type and struct dpll_ffo_param to - distinguish FFO contexts: DPLL_FFO_PORT_RXTX_RATE for the RX vs - TX symbol rate offset reported at the top level, and - DPLL_FFO_PIN_DEVICE for the pin vs parent DPLL offset reported - in the pin-parent-device nest. - - Add a supported_ffo bitmask to struct dpll_pin_ops so drivers - declare which FFO types they support. The core only calls ffo_get - for types the driver has opted into, eliminating the need for - per-driver NULL pointer guards. Validate at pin registration time - that supported_ffo is not set without an ffo_get callback. - - Update mlx5 (DPLL_FFO_PORT_RXTX_RATE) and zl3073x - (DPLL_FFO_PORT_RXTX_RATE) drivers to use the new API. - - Add documentation for both FFO types to dpll.rst. - - Changes v3 -> v4: - - Replace dpll=NULL overloading with enum dpll_ffo_type and - struct dpll_ffo_param (Jakub Kicinski) - - Add supported_ffo opt-in bitmask in dpll_pin_ops for fail-close - driver validation (Jakub Kicinski) - - Add WARN_ON in dpll_pin_register for supported_ffo without - ffo_get callback - - Reviewed-by: Jiri Pirko - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260511155816.99936-2-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 9c11fcb2e9a54d0f1467380831e2e4bb68f7498d) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/Documentation/driver-api/dpll.rst b/Documentation/driver-api/dpll.rst -index 37eaef785e30..bae14766d4f7 100644 ---- a/Documentation/driver-api/dpll.rst -+++ b/Documentation/driver-api/dpll.rst -@@ -258,6 +258,26 @@ in the ``DPLL_A_PIN_PHASE_OFFSET`` attribute. - ``DPLL_A_PHASE_OFFSET_MONITOR`` attr state of a feature - =============================== ======================== - -+Fractional frequency offset -+=========================== -+ -+The fractional frequency offset (FFO) is reported through two attributes -+that carry the same measurement at different precisions: -+ -+- ``DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET`` in PPM (parts per million) -+- ``DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT`` in PPT (parts per trillion) -+ -+Both attributes appear at the top level of a pin and inside each -+``pin-parent-device`` nest. Two FFO types are defined: -+ -+- ``DPLL_FFO_PORT_RXTX_RATE`` - RX vs TX symbol rate offset (top-level) -+- ``DPLL_FFO_PIN_DEVICE`` - pin vs parent DPLL offset (per-parent) -+ -+The driver declares which types it supports via the ``supported_ffo`` -+bitmask in ``struct dpll_pin_ops``. The core only calls the ``ffo_get`` -+callback for types the driver has opted into. The requested type is -+passed to the driver in the ``struct dpll_ffo_param``. -+ - Frequency monitor - ================= - -diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml -index a47d7da54da5..4ba8adcf823c 100644 ---- a/Documentation/netlink/specs/dpll.yaml -+++ b/Documentation/netlink/specs/dpll.yaml -@@ -448,12 +448,14 @@ attribute-sets: - name: fractional-frequency-offset - type: sint - doc: | -- The FFO (Fractional Frequency Offset) between the RX and TX -- symbol rate on the media associated with the pin: -- (rx_frequency-tx_frequency)/rx_frequency -+ The FFO (Fractional Frequency Offset) of the pin. -+ At top level this represents the RX vs TX symbol rate -+ offset on the media associated with the pin. Inside -+ the pin-parent-device nest it represents the frequency -+ offset between the pin and its parent DPLL device. - Value is in PPM (parts per million). -- This may be implemented for example for pin of type -- PIN_TYPE_SYNCE_ETH_PORT. -+ This is a lower-precision version of -+ fractional-frequency-offset-ppt. - - - name: esync-frequency - type: u64 -@@ -492,12 +494,14 @@ attribute-sets: - name: fractional-frequency-offset-ppt - type: sint - doc: | -- The FFO (Fractional Frequency Offset) of the pin with respect to -- the nominal frequency. -- Value = (frequency_measured - frequency_nominal) / frequency_nominal -+ The FFO (Fractional Frequency Offset) of the pin. -+ At top level this represents the RX vs TX symbol rate -+ offset on the media associated with the pin. Inside -+ the pin-parent-device nest it represents the frequency -+ offset between the pin and its parent DPLL device. - Value is in PPT (parts per trillion, 10^-12). -- Note: This attribute provides higher resolution than the standard -- fractional-frequency-offset (which is in PPM). -+ This is a higher-precision version of -+ fractional-frequency-offset. - - - name: measured-frequency - type: u64 -@@ -534,6 +538,10 @@ attribute-sets: - name: operstate - - - name: phase-offset -+ - -+ name: fractional-frequency-offset -+ - -+ name: fractional-frequency-offset-ppt - - - name: pin-parent-pin - subset-of: pin -diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c -index 84e1b637b4e5..8b260a31aa58 100644 ---- a/drivers/dpll/dpll_core.c -+++ b/drivers/dpll/dpll_core.c -@@ -883,7 +883,8 @@ dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, - WARN_ON(!ops->direction_get) || - WARN_ON(ops->measured_freq_get && - (!dpll_device_ops(dpll)->freq_monitor_get || -- !dpll_device_ops(dpll)->freq_monitor_set))) -+ !dpll_device_ops(dpll)->freq_monitor_set)) || -+ WARN_ON(ops->supported_ffo && !ops->ffo_get)) - return -EINVAL; - - mutex_lock(&dpll_lock); -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index 05cf946b4be5..00e8696cb267 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -417,31 +417,28 @@ dpll_msg_add_phase_offset(struct sk_buff *msg, struct dpll_pin *pin, - - static int dpll_msg_add_ffo(struct sk_buff *msg, struct dpll_pin *pin, - struct dpll_pin_ref *ref, -+ enum dpll_ffo_type type, - struct netlink_ext_ack *extack) - { - const struct dpll_pin_ops *ops = dpll_pin_ops(ref); -- struct dpll_device *dpll = ref->dpll; -- s64 ffo; -+ struct dpll_ffo_param ffo = { .type = type }; - int ret; - -- if (!ops->ffo_get) -+ if (!ops->ffo_get || !(ops->supported_ffo & BIT(type))) - return 0; -- ret = ops->ffo_get(pin, dpll_pin_on_dpll_priv(dpll, pin), -- dpll, dpll_priv(dpll), &ffo, extack); -+ ret = ops->ffo_get(pin, dpll_pin_on_dpll_priv(ref->dpll, pin), -+ ref->dpll, dpll_priv(ref->dpll), &ffo, extack); - if (ret) { - if (ret == -ENODATA) - return 0; - return ret; - } -- /* Put the FFO value in PPM to preserve compatibility with older -- * programs. -- */ -- ret = nla_put_sint(msg, DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET, -- div_s64(ffo, 1000000)); -- if (ret) -+ if (nla_put_sint(msg, DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET, -+ div_s64(ffo.ffo, 1000000))) - return -EMSGSIZE; -- return nla_put_sint(msg, DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, -- ffo); -+ return nla_put_sint(msg, -+ DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, -+ ffo.ffo); - } - - static int dpll_msg_add_measured_freq(struct sk_buff *msg, struct dpll_pin *pin, -@@ -686,6 +683,10 @@ dpll_msg_add_pin_dplls(struct sk_buff *msg, struct dpll_pin *pin, - if (ret) - goto nest_cancel; - ret = dpll_msg_add_phase_offset(msg, pin, ref, extack); -+ if (ret) -+ goto nest_cancel; -+ ret = dpll_msg_add_ffo(msg, pin, ref, -+ DPLL_FFO_PIN_DEVICE, extack); - if (ret) - goto nest_cancel; - nla_nest_end(msg, attr); -@@ -748,7 +749,8 @@ dpll_cmd_pin_get_one(struct sk_buff *msg, struct dpll_pin *pin, - ret = dpll_msg_add_pin_phase_adjust(msg, pin, ref, extack); - if (ret) - return ret; -- ret = dpll_msg_add_ffo(msg, pin, ref, extack); -+ ret = dpll_msg_add_ffo(msg, pin, ref, -+ DPLL_FFO_PORT_RXTX_RATE, extack); - if (ret) - return ret; - ret = dpll_msg_add_measured_freq(msg, pin, ref, extack); -diff --git a/drivers/dpll/dpll_nl.c b/drivers/dpll/dpll_nl.c -index 64398841cdcb..268999ddbcb6 100644 ---- a/drivers/dpll/dpll_nl.c -+++ b/drivers/dpll/dpll_nl.c -@@ -18,6 +18,8 @@ const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_OPERSTATE + - [DPLL_A_PIN_STATE] = NLA_POLICY_RANGE(NLA_U32, 1, 3), - [DPLL_A_PIN_OPERSTATE] = NLA_POLICY_RANGE(NLA_U32, 1, 4), - [DPLL_A_PIN_PHASE_OFFSET] = { .type = NLA_S64, }, -+ [DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET] = { .type = NLA_SINT, }, -+ [DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT] = { .type = NLA_SINT, }, - }; - - const struct nla_policy dpll_pin_parent_pin_nl_policy[DPLL_A_PIN_STATE + 1] = { -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 2c8bd211e31e..b159dff2985e 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -295,11 +295,12 @@ zl3073x_dpll_input_pin_ref_sync_set(const struct dpll_pin *dpll_pin, - static int - zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -- s64 *ffo, struct netlink_ext_ack *extack) -+ struct dpll_ffo_param *ffo, -+ struct netlink_ext_ack *extack) - { - struct zl3073x_dpll_pin *pin = pin_priv; - -- *ffo = pin->freq_offset; -+ ffo->ffo = pin->freq_offset; - - return 0; - } -@@ -1274,6 +1275,7 @@ zl3073x_dpll_freq_monitor_set(const struct dpll_device *dpll, - } - - static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { -+ .supported_ffo = BIT(DPLL_FFO_PORT_RXTX_RATE), - .direction_get = zl3073x_dpll_pin_direction_get, - .esync_get = zl3073x_dpll_input_pin_esync_get, - .esync_set = zl3073x_dpll_input_pin_esync_set, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dpll.c b/drivers/net/ethernet/mellanox/mlx5/core/dpll.c -index 3981dd81d4c1..3756c0278122 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/dpll.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/dpll.c -@@ -300,7 +300,8 @@ static int mlx5_dpll_state_on_dpll_set(const struct dpll_pin *pin, - - static int mlx5_dpll_ffo_get(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -- s64 *ffo, struct netlink_ext_ack *extack) -+ struct dpll_ffo_param *ffo, -+ struct netlink_ext_ack *extack) - { - struct mlx5_dpll_synce_status synce_status; - struct mlx5_dpll *mdpll = pin_priv; -@@ -309,10 +310,11 @@ static int mlx5_dpll_ffo_get(const struct dpll_pin *pin, void *pin_priv, - err = mlx5_dpll_synce_status_get(mdpll->mdev, &synce_status); - if (err) - return err; -- return mlx5_dpll_pin_ffo_get(&synce_status, ffo); -+ return mlx5_dpll_pin_ffo_get(&synce_status, &ffo->ffo); - } - - static const struct dpll_pin_ops mlx5_dpll_pins_ops = { -+ .supported_ffo = BIT(DPLL_FFO_PORT_RXTX_RATE), - .direction_get = mlx5_dpll_pin_direction_get, - .state_on_dpll_get = mlx5_dpll_state_on_dpll_get, - .state_on_dpll_set = mlx5_dpll_state_on_dpll_set, -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index 90249937008c..cd21b1f3dff1 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -73,7 +73,20 @@ struct dpll_device_ops { - RH_KABI_RESERVE(10) - }; - -+enum dpll_ffo_type { -+ DPLL_FFO_PORT_RXTX_RATE, -+ DPLL_FFO_PIN_DEVICE, -+ -+ __DPLL_FFO_TYPE_MAX, -+}; -+ -+struct dpll_ffo_param { -+ enum dpll_ffo_type type; -+ s64 ffo; -+}; -+ - struct dpll_pin_ops { -+ unsigned long supported_ffo; - int (*frequency_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - const u64 frequency, -@@ -134,7 +147,8 @@ struct dpll_pin_ops { - struct netlink_ext_ack *extack); - int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -- s64 *ffo, struct netlink_ext_ack *extack); -+ struct dpll_ffo_param *ffo, -+ struct netlink_ext_ack *extack); - int (*measured_freq_get)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, - void *dpll_priv, u64 *measured_freq, --- -2.50.1 (Apple Git-155) - diff --git a/1273-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch b/1273-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch deleted file mode 100644 index 38343d90a..000000000 --- a/1273-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch +++ /dev/null @@ -1,362 +0,0 @@ -From ba5cbd1742d290baabec9f9d37a9a8f3a10ab860 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Wed, 13 May 2026 11:52:05 +0200 -Subject: [PATCH] dpll: zl3073x: report FFO as DPLL vs input reference offset - -JIRA: https://issues.redhat.com/browse/RHEL-173193 - -commit 54e65df8cf18a741745645aed7ae91514d437b43 -Author: Ivan Vecera -Date: Mon May 11 17:58:16 2026 +0200 - - dpll: zl3073x: report FFO as DPLL vs input reference offset - - Replace the per-reference frequency offset measurement (which was - redundant with measured-frequency) with a direct read of the DPLL's - delta frequency offset vs its tracked input reference. - - The new implementation uses the dpll_df_offset_x register with - ref_ofst=1 via the dpll_df_read_x semaphore mechanism. This - provides 2^-48 resolution (~3.5 fE) and reports the actual - frequency difference between the DPLL and its active input. - - Switch supported_ffo from DPLL_FFO_PORT_RXTX_RATE to - DPLL_FFO_PIN_DEVICE so FFO is reported only in the per-parent - context for the active input pin. - - Use atomic64_t for freq_offset to prevent torn reads on 32-bit - architectures between the periodic worker and netlink callbacks. - - Rewrite ffo_check to compare the cached df_offset converted to PPT - instead of using the old per-reference measurement. Remove the - ref_ffo_update periodic measurement and the ref ffo field since - they are no longer needed. - - Changes v3 -> v4: - - Switch to DPLL_FFO_PIN_DEVICE, remove dpll=NULL guard - - Use atomic64_t for freq_offset (torn read on 32-bit) - - Reviewed-by: Petr Oros - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260511155816.99936-3-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -(cherry picked from commit 54e65df8cf18a741745645aed7ae91514d437b43) -Assisted-by: Patchpal -Signed-off-by: Ivan Vecera - -diff --git a/drivers/dpll/zl3073x/chan.c b/drivers/dpll/zl3073x/chan.c -index 2f48ca239149..2fe3c3da84bb 100644 ---- a/drivers/dpll/zl3073x/chan.c -+++ b/drivers/dpll/zl3073x/chan.c -@@ -18,6 +18,7 @@ - int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index) - { - struct zl3073x_chan *chan = &zldev->chan[index]; -+ u64 val; - int rc; - - rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MON_STATUS(index), -@@ -25,8 +26,34 @@ int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index) - if (rc) - return rc; - -- return zl3073x_read_u8(zldev, ZL_REG_DPLL_REFSEL_STATUS(index), -- &chan->refsel_status); -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REFSEL_STATUS(index), -+ &chan->refsel_status); -+ if (rc) -+ return rc; -+ -+ /* Read df_offset vs tracked reference */ -+ rc = zl3073x_poll_zero_u8(zldev, ZL_REG_DPLL_DF_READ(index), -+ ZL_DPLL_DF_READ_SEM); -+ if (rc) -+ return rc; -+ -+ rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_DF_READ(index), -+ ZL_DPLL_DF_READ_SEM | ZL_DPLL_DF_READ_REF_OFST); -+ if (rc) -+ return rc; -+ -+ rc = zl3073x_poll_zero_u8(zldev, ZL_REG_DPLL_DF_READ(index), -+ ZL_DPLL_DF_READ_SEM); -+ if (rc) -+ return rc; -+ -+ rc = zl3073x_read_u48(zldev, ZL_REG_DPLL_DF_OFFSET(index), &val); -+ if (rc) -+ return rc; -+ -+ chan->df_offset = sign_extend64(val, 47); -+ -+ return 0; - } - - /** -diff --git a/drivers/dpll/zl3073x/chan.h b/drivers/dpll/zl3073x/chan.h -index 481da2133202..4353809c6912 100644 ---- a/drivers/dpll/zl3073x/chan.h -+++ b/drivers/dpll/zl3073x/chan.h -@@ -17,6 +17,7 @@ struct zl3073x_dev; - * @ref_prio: reference priority registers (4 bits per ref, P/N packed) - * @mon_status: monitor status register value - * @refsel_status: reference selection status register value -+ * @df_offset: frequency offset vs tracked reference in 2^-48 steps - */ - struct zl3073x_chan { - struct_group(cfg, -@@ -26,6 +27,7 @@ struct zl3073x_chan { - struct_group(stat, - u8 mon_status; - u8 refsel_status; -+ s64 df_offset; - ); - }; - -@@ -37,6 +39,18 @@ int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, - - int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index); - -+/** -+ * zl3073x_chan_df_offset_get - get cached df_offset vs tracked reference -+ * @chan: pointer to channel state -+ * -+ * Return: frequency offset in 2^-48 steps -+ */ -+static inline s64 -+zl3073x_chan_df_offset_get(const struct zl3073x_chan *chan) -+{ -+ return chan->df_offset; -+} -+ - /** - * zl3073x_chan_mode_get - get DPLL channel operating mode - * @chan: pointer to channel state -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 5f1e70f3e40a..b3345060490d 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -704,44 +704,6 @@ zl3073x_ref_freq_meas_update(struct zl3073x_dev *zldev) - return 0; - } - --/** -- * zl3073x_ref_ffo_update - update reference fractional frequency offsets -- * @zldev: pointer to zl3073x_dev structure -- * -- * The function asks device to latch the latest measured fractional -- * frequency offset values, reads and stores them into the ref state. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) --{ -- int i, rc; -- -- rc = zl3073x_ref_freq_meas_latch(zldev, -- ZL_REF_FREQ_MEAS_CTRL_REF_FREQ_OFF); -- if (rc) -- return rc; -- -- /* Read DPLL-to-REFx frequency offset measurements */ -- for (i = 0; i < ZL3073X_NUM_REFS; i++) { -- s32 value; -- -- /* Read value stored in units of 2^-32 signed */ -- rc = zl3073x_read_u32(zldev, ZL_REG_REF_FREQ(i), &value); -- if (rc) -- return rc; -- -- /* Convert to ppt -- * ffo = (10^12 * value) / 2^32 -- * ffo = ( 5^12 * value) / 2^20 -- */ -- zldev->ref[i].ffo = mul_s64_u64_shr(value, 244140625, 20); -- } -- -- return 0; --} -- - static void - zl3073x_dev_periodic_work(struct kthread_work *work) - { -@@ -776,13 +738,6 @@ zl3073x_dev_periodic_work(struct kthread_work *work) - } - } - -- /* Update references' fractional frequency offsets */ -- rc = zl3073x_ref_ffo_update(zldev); -- if (rc) -- dev_warn(zldev->dev, -- "Failed to update fractional frequency offsets: %pe\n", -- ERR_PTR(rc)); -- - list_for_each_entry(zldpll, &zldev->dplls, list) - zl3073x_dpll_changes_check(zldpll); - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index b159dff2985e..6b714ec3b3c9 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -1,5 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - -+#include - #include - #include - #include -@@ -57,7 +58,7 @@ struct zl3073x_dpll_pin { - s32 phase_gran; - enum dpll_pin_operstate operstate; - s64 phase_offset; -- s64 freq_offset; -+ atomic64_t freq_offset; - u32 measured_freq; - }; - -@@ -300,7 +301,10 @@ zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - { - struct zl3073x_dpll_pin *pin = pin_priv; - -- ffo->ffo = pin->freq_offset; -+ if (pin->operstate != DPLL_PIN_OPERSTATE_ACTIVE) -+ return -ENODATA; -+ -+ ffo->ffo = atomic64_read(&pin->freq_offset); - - return 0; - } -@@ -1275,7 +1279,7 @@ zl3073x_dpll_freq_monitor_set(const struct dpll_device *dpll, - } - - static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { -- .supported_ffo = BIT(DPLL_FFO_PORT_RXTX_RATE), -+ .supported_ffo = BIT(DPLL_FFO_PIN_DEVICE), - .direction_get = zl3073x_dpll_pin_direction_get, - .esync_get = zl3073x_dpll_input_pin_esync_get, - .esync_set = zl3073x_dpll_input_pin_esync_set, -@@ -1731,37 +1735,29 @@ zl3073x_dpll_pin_phase_offset_check(struct zl3073x_dpll_pin *pin) - } - - /** -- * zl3073x_dpll_pin_ffo_check - check for pin fractional frequency offset change -+ * zl3073x_dpll_pin_ffo_check - check for FFO change on active pin - * @pin: pin to check - * -- * Check for the given pin's fractional frequency change. -- * -- * Return: true on fractional frequency offset change, false otherwise -+ * Return: true on change, false otherwise - */ - static bool - zl3073x_dpll_pin_ffo_check(struct zl3073x_dpll_pin *pin) - { - struct zl3073x_dpll *zldpll = pin->dpll; - struct zl3073x_dev *zldev = zldpll->dev; -- const struct zl3073x_ref *ref; -- u8 ref_id; -+ const struct zl3073x_chan *chan; - s64 ffo; - -- /* Get reference monitor status */ -- ref_id = zl3073x_input_pin_ref_get(pin->id); -- ref = zl3073x_ref_state_get(zldev, ref_id); -- -- /* Do not report ffo changes if the reference monitor report errors */ -- if (!zl3073x_ref_is_status_ok(ref)) -+ if (pin->operstate != DPLL_PIN_OPERSTATE_ACTIVE) - return false; - -- /* Compare with previous value */ -- ffo = zl3073x_ref_ffo_get(ref); -- if (pin->freq_offset != ffo) { -- dev_dbg(zldev->dev, "%s freq offset changed: %lld -> %lld\n", -- pin->label, pin->freq_offset, ffo); -- pin->freq_offset = ffo; -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ffo = mul_s64_u64_shr(zl3073x_chan_df_offset_get(chan), -+ 244140625, 36); - -+ if (atomic64_xchg(&pin->freq_offset, ffo) != ffo) { -+ dev_dbg(zldev->dev, "%s freq offset changed to: %lld\n", -+ pin->label, ffo); - return true; - } - -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index 55e80e4f0873..e140ca3ea17d 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -22,7 +22,6 @@ struct zl3073x_dev; - * @freq_ratio_n: FEC mode divisor - * @sync_ctrl: reference sync control - * @config: reference config -- * @ffo: current fractional frequency offset - * @meas_freq: measured input frequency in Hz - * @mon_status: reference monitor status - */ -@@ -40,7 +39,6 @@ struct zl3073x_ref { - u8 config; - ); - struct_group(stat, /* Status */ -- s64 ffo; - u32 meas_freq; - u8 mon_status; - ); -@@ -58,18 +56,6 @@ int zl3073x_ref_state_update(struct zl3073x_dev *zldev, u8 index); - - int zl3073x_ref_freq_factorize(u32 freq, u16 *base, u16 *mult); - --/** -- * zl3073x_ref_ffo_get - get current fractional frequency offset -- * @ref: pointer to ref state -- * -- * Return: the latest measured fractional frequency offset -- */ --static inline s64 --zl3073x_ref_ffo_get(const struct zl3073x_ref *ref) --{ -- return ref->ffo; --} -- - /** - * zl3073x_ref_meas_freq_get - get measured input frequency - * @ref: pointer to ref state -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index 8015808bdf54..9578f0009528 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -164,6 +164,11 @@ - #define ZL_DPLL_MODE_REFSEL_MODE_NCO 4 - #define ZL_DPLL_MODE_REFSEL_REF GENMASK(7, 4) - -+#define ZL_REG_DPLL_DF_READ(_idx) \ -+ ZL_REG_IDX(_idx, 5, 0x28, 1, ZL3073X_MAX_CHANNELS, 1) -+#define ZL_DPLL_DF_READ_SEM BIT(4) -+#define ZL_DPLL_DF_READ_REF_OFST BIT(3) -+ - #define ZL_REG_DPLL_MEAS_CTRL ZL_REG(5, 0x50, 1) - #define ZL_DPLL_MEAS_CTRL_EN BIT(0) - #define ZL_DPLL_MEAS_CTRL_AVG_FACTOR GENMASK(7, 4) -@@ -176,6 +181,16 @@ - #define ZL_REG_DPLL_PHASE_ERR_DATA(_idx) \ - ZL_REG_IDX(_idx, 5, 0x55, 6, ZL3073X_MAX_CHANNELS, 6) - -+/******************************* -+ * Register Pages 6-7, DPLL Data -+ *******************************/ -+ -+#define ZL_REG_DPLL_DF_OFFSET_03(_idx) \ -+ ZL_REG_IDX(_idx, 6, 0x00, 6, 4, 0x20) -+#define ZL_REG_DPLL_DF_OFFSET_4 ZL_REG(7, 0x00, 6) -+#define ZL_REG_DPLL_DF_OFFSET(_idx) \ -+ ((_idx) < 4 ? ZL_REG_DPLL_DF_OFFSET_03(_idx) : ZL_REG_DPLL_DF_OFFSET_4) -+ - /*********************************** - * Register Page 9, Synth and Output - ***********************************/ --- -2.50.1 (Apple Git-155) - diff --git a/1274-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch b/1274-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch deleted file mode 100644 index 9ee8a8a7d..000000000 --- a/1274-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch +++ /dev/null @@ -1,500 +0,0 @@ -From 57c78bd2e2dd08897acd35b2bf8bcef322e36f5e Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Thu, 26 Mar 2026 00:17:09 +0100 -Subject: [PATCH] netfilter: flowtable: strictly check for maximum number of - actions - -[ Upstream commit 76522fcdbc3a02b568f5d957f7e66fc194abb893 ] - -The maximum number of flowtable hardware offload actions in IPv6 is: - -* ethernet mangling (4 payload actions, 2 for each ethernet address) -* SNAT (4 payload actions) -* DNAT (4 payload actions) -* Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) - for QinQ. -* Redirect (1 action) - -Which makes 17, while the maximum is 16. But act_ct supports for tunnels -actions too. Note that payload action operates at 32-bit word level, so -mangling an IPv6 address takes 4 payload actions. - -Update flow_action_entry_next() calls to check for the maximum number of -supported actions. - -While at it, rise the maximum number of actions per flow from 16 to 24 -so this works fine with IPv6 setups. - -Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") -Reported-by: Hyunwoo Kim -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin - -diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c -index e06bc36f49fe..4f346f51d7d7 100644 ---- a/net/netfilter/nf_flow_table_offload.c -+++ b/net/netfilter/nf_flow_table_offload.c -@@ -13,6 +13,8 @@ - #include - #include - -+#define NF_FLOW_RULE_ACTION_MAX 24 -+ - static struct workqueue_struct *nf_flow_offload_add_wq; - static struct workqueue_struct *nf_flow_offload_del_wq; - static struct workqueue_struct *nf_flow_offload_stats_wq; -@@ -215,7 +217,12 @@ static void flow_offload_mangle(struct flow_action_entry *entry, - static inline struct flow_action_entry * - flow_action_entry_next(struct nf_flow_rule *flow_rule) - { -- int i = flow_rule->rule->action.num_entries++; -+ int i; -+ -+ if (unlikely(flow_rule->rule->action.num_entries >= NF_FLOW_RULE_ACTION_MAX)) -+ return NULL; -+ -+ i = flow_rule->rule->action.num_entries++; - - return &flow_rule->rule->action.entries[i]; - } -@@ -233,6 +240,9 @@ static int flow_offload_eth_src(struct net *net, - u32 mask, val; - u16 val16; - -+ if (!entry0 || !entry1) -+ return -E2BIG; -+ - this_tuple = &flow->tuplehash[dir].tuple; - - switch (this_tuple->xmit_type) { -@@ -283,6 +293,9 @@ static int flow_offload_eth_dst(struct net *net, - u8 nud_state; - u16 val16; - -+ if (!entry0 || !entry1) -+ return -E2BIG; -+ - this_tuple = &flow->tuplehash[dir].tuple; - - switch (this_tuple->xmit_type) { -@@ -324,16 +337,19 @@ static int flow_offload_eth_dst(struct net *net, - return 0; - } - --static void flow_offload_ipv4_snat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv4_snat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask = ~htonl(0xffffffff); - __be32 addr; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr; -@@ -344,23 +360,27 @@ static void flow_offload_ipv4_snat(struct net *net, - offset = offsetof(struct iphdr, daddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset, - &addr, &mask); -+ return 0; - } - --static void flow_offload_ipv4_dnat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv4_dnat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask = ~htonl(0xffffffff); - __be32 addr; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr; -@@ -371,14 +391,15 @@ static void flow_offload_ipv4_dnat(struct net *net, - offset = offsetof(struct iphdr, saddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset, - &addr, &mask); -+ return 0; - } - --static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, -+static int flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, - unsigned int offset, - const __be32 *addr, const __be32 *mask) - { -@@ -387,15 +408,20 @@ static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, - - for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i++) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -E2BIG; -+ - flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP6, - offset + i * sizeof(u32), &addr[i], mask); - } -+ -+ return 0; - } - --static void flow_offload_ipv6_snat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv6_snat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - u32 mask = ~htonl(0xffffffff); - const __be32 *addr; -@@ -411,16 +437,16 @@ static void flow_offload_ipv6_snat(struct net *net, - offset = offsetof(struct ipv6hdr, daddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - -- flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); -+ return flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); - } - --static void flow_offload_ipv6_dnat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv6_dnat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - u32 mask = ~htonl(0xffffffff); - const __be32 *addr; -@@ -436,10 +462,10 @@ static void flow_offload_ipv6_dnat(struct net *net, - offset = offsetof(struct ipv6hdr, saddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - -- flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); -+ return flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); - } - - static int flow_offload_l4proto(const struct flow_offload *flow) -@@ -461,15 +487,18 @@ static int flow_offload_l4proto(const struct flow_offload *flow) - return type; - } - --static void flow_offload_port_snat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_port_snat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask, port; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port); -@@ -484,22 +513,26 @@ static void flow_offload_port_snat(struct net *net, - mask = ~htonl(0xffff); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, flow_offload_l4proto(flow), offset, - &port, &mask); -+ return 0; - } - --static void flow_offload_port_dnat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_port_dnat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask, port; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port); -@@ -514,20 +547,24 @@ static void flow_offload_port_dnat(struct net *net, - mask = ~htonl(0xffff0000); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, flow_offload_l4proto(flow), offset, - &port, &mask); -+ return 0; - } - --static void flow_offload_ipv4_checksum(struct net *net, -- const struct flow_offload *flow, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv4_checksum(struct net *net, -+ const struct flow_offload *flow, -+ struct nf_flow_rule *flow_rule) - { - u8 protonum = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto; - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - -+ if (!entry) -+ return -E2BIG; -+ - entry->id = FLOW_ACTION_CSUM; - entry->csum_flags = TCA_CSUM_UPDATE_FLAG_IPV4HDR; - -@@ -539,12 +576,14 @@ static void flow_offload_ipv4_checksum(struct net *net, - entry->csum_flags |= TCA_CSUM_UPDATE_FLAG_UDP; - break; - } -+ -+ return 0; - } - --static void flow_offload_redirect(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_redirect(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - const struct flow_offload_tuple *this_tuple, *other_tuple; - struct flow_action_entry *entry; -@@ -562,21 +601,28 @@ static void flow_offload_redirect(struct net *net, - ifindex = other_tuple->iifidx; - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - dev = dev_get_by_index(net, ifindex); - if (!dev) -- return; -+ return -ENODEV; - - entry = flow_action_entry_next(flow_rule); -+ if (!entry) { -+ dev_put(dev); -+ return -E2BIG; -+ } -+ - entry->id = FLOW_ACTION_REDIRECT; - entry->dev = dev; -+ -+ return 0; - } - --static void flow_offload_encap_tunnel(const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_encap_tunnel(const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - const struct flow_offload_tuple *this_tuple; - struct flow_action_entry *entry; -@@ -584,7 +630,7 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, - - this_tuple = &flow->tuplehash[dir].tuple; - if (this_tuple->xmit_type == FLOW_OFFLOAD_XMIT_DIRECT) -- return; -+ return 0; - - dst = this_tuple->dst_cache; - if (dst && dst->lwtstate) { -@@ -593,15 +639,19 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, - tun_info = lwt_tun_info(dst->lwtstate); - if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX)) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -E2BIG; - entry->id = FLOW_ACTION_TUNNEL_ENCAP; - entry->tunnel = tun_info; - } - } -+ -+ return 0; - } - --static void flow_offload_decap_tunnel(const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_decap_tunnel(const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - const struct flow_offload_tuple *other_tuple; - struct flow_action_entry *entry; -@@ -609,7 +659,7 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, - - other_tuple = &flow->tuplehash[!dir].tuple; - if (other_tuple->xmit_type == FLOW_OFFLOAD_XMIT_DIRECT) -- return; -+ return 0; - - dst = other_tuple->dst_cache; - if (dst && dst->lwtstate) { -@@ -618,9 +668,13 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, - tun_info = lwt_tun_info(dst->lwtstate); - if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX)) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -E2BIG; - entry->id = FLOW_ACTION_TUNNEL_DECAP; - } - } -+ -+ return 0; - } - - static int -@@ -632,8 +686,9 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow, - const struct flow_offload_tuple *tuple; - int i; - -- flow_offload_decap_tunnel(flow, dir, flow_rule); -- flow_offload_encap_tunnel(flow, dir, flow_rule); -+ if (flow_offload_decap_tunnel(flow, dir, flow_rule) < 0 || -+ flow_offload_encap_tunnel(flow, dir, flow_rule) < 0) -+ return -1; - - if (flow_offload_eth_src(net, flow, dir, flow_rule) < 0 || - flow_offload_eth_dst(net, flow, dir, flow_rule) < 0) -@@ -649,6 +704,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow, - - if (tuple->encap[i].proto == htons(ETH_P_8021Q)) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -1; - entry->id = FLOW_ACTION_VLAN_POP; - } - } -@@ -662,6 +719,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow, - continue; - - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -1; - - switch (other_tuple->encap[i].proto) { - case htons(ETH_P_PPP_SES): -@@ -687,18 +746,22 @@ int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow, - return -1; - - if (test_bit(NF_FLOW_SNAT, &flow->flags)) { -- flow_offload_ipv4_snat(net, flow, dir, flow_rule); -- flow_offload_port_snat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv4_snat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_snat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - if (test_bit(NF_FLOW_DNAT, &flow->flags)) { -- flow_offload_ipv4_dnat(net, flow, dir, flow_rule); -- flow_offload_port_dnat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv4_dnat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_dnat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - if (test_bit(NF_FLOW_SNAT, &flow->flags) || - test_bit(NF_FLOW_DNAT, &flow->flags)) -- flow_offload_ipv4_checksum(net, flow, flow_rule); -+ if (flow_offload_ipv4_checksum(net, flow, flow_rule) < 0) -+ return -1; - -- flow_offload_redirect(net, flow, dir, flow_rule); -+ if (flow_offload_redirect(net, flow, dir, flow_rule) < 0) -+ return -1; - - return 0; - } -@@ -712,22 +775,23 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow, - return -1; - - if (test_bit(NF_FLOW_SNAT, &flow->flags)) { -- flow_offload_ipv6_snat(net, flow, dir, flow_rule); -- flow_offload_port_snat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv6_snat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_snat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - if (test_bit(NF_FLOW_DNAT, &flow->flags)) { -- flow_offload_ipv6_dnat(net, flow, dir, flow_rule); -- flow_offload_port_dnat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv6_dnat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_dnat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - -- flow_offload_redirect(net, flow, dir, flow_rule); -+ if (flow_offload_redirect(net, flow, dir, flow_rule) < 0) -+ return -1; - - return 0; - } - EXPORT_SYMBOL_GPL(nf_flow_rule_route_ipv6); - --#define NF_FLOW_RULE_ACTION_MAX 16 -- - static struct nf_flow_rule * - nf_flow_offload_rule_alloc(struct net *net, - const struct flow_offload_work *offload, --- -2.50.1 (Apple Git-155) - diff --git a/1275-bluetooth-hci-add-initial-support-for-past.patch b/1275-bluetooth-hci-add-initial-support-for-past.patch deleted file mode 100644 index e682eb00c..000000000 --- a/1275-bluetooth-hci-add-initial-support-for-past.patch +++ /dev/null @@ -1,355 +0,0 @@ -From c33ae38cff3d15c40384b4ecbaccc4c88d3cb741 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Wed, 15 Apr 2026 16:59:13 -0500 -Subject: [PATCH] Bluetooth: HCI: Add initial support for PAST - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit 33b2835f0b7e2a458473b0e3a23b54b92108b6b0 -Author: Luiz Augusto von Dentz -Date: Tue Sep 2 11:11:40 2025 -0400 - - Bluetooth: HCI: Add initial support for PAST - - This adds PAST related commands (HCI_OP_LE_PAST, - HCI_OP_LE_PAST_SET_INFO and HCI_OP_LE_PAST_PARAMS) and events - (HCI_EV_LE_PAST_RECEIVED) along with handling of PAST sender and - receiver features bits including new MGMG settings ( - HCI_EV_LE_PAST_RECEIVED and MGMT_SETTING_PAST_RECEIVER) which - userspace can use to determine if PAST is supported by the - controller. - - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h -index cb4c02d00759..d883ad233ebc 100644 ---- a/include/net/bluetooth/hci.h -+++ b/include/net/bluetooth/hci.h -@@ -647,6 +647,8 @@ enum { - #define HCI_LE_EXT_ADV 0x10 - #define HCI_LE_PERIODIC_ADV 0x20 - #define HCI_LE_CHAN_SEL_ALG2 0x40 -+#define HCI_LE_PAST_SENDER 0x01 -+#define HCI_LE_PAST_RECEIVER 0x02 - #define HCI_LE_CIS_CENTRAL 0x10 - #define HCI_LE_CIS_PERIPHERAL 0x20 - #define HCI_LE_ISO_BROADCASTER 0x40 -@@ -2068,6 +2070,44 @@ struct hci_cp_le_set_privacy_mode { - __u8 mode; - } __packed; - -+#define HCI_OP_LE_PAST 0x205a -+struct hci_cp_le_past { -+ __le16 handle; -+ __le16 service_data; -+ __le16 sync_handle; -+} __packed; -+ -+struct hci_rp_le_past { -+ __u8 status; -+ __le16 handle; -+} __packed; -+ -+#define HCI_OP_LE_PAST_SET_INFO 0x205b -+struct hci_cp_le_past_set_info { -+ __le16 handle; -+ __le16 service_data; -+ __u8 adv_handle; -+} __packed; -+ -+struct hci_rp_le_past_set_info { -+ __u8 status; -+ __le16 handle; -+} __packed; -+ -+#define HCI_OP_LE_PAST_PARAMS 0x205c -+struct hci_cp_le_past_params { -+ __le16 handle; -+ __u8 mode; -+ __le16 skip; -+ __le16 sync_timeout; -+ __u8 cte_type; -+} __packed; -+ -+struct hci_rp_le_past_params { -+ __u8 status; -+ __le16 handle; -+} __packed; -+ - #define HCI_OP_LE_READ_BUFFER_SIZE_V2 0x2060 - struct hci_rp_le_read_buffer_size_v2 { - __u8 status; -@@ -2800,6 +2840,20 @@ struct hci_evt_le_ext_adv_set_term { - __u8 num_evts; - } __packed; - -+#define HCI_EV_LE_PAST_RECEIVED 0x18 -+struct hci_ev_le_past_received { -+ __u8 status; -+ __le16 handle; -+ __le16 service_data; -+ __le16 sync_handle; -+ __u8 sid; -+ __u8 bdaddr_type; -+ bdaddr_t bdaddr; -+ __u8 phy; -+ __le16 interval; -+ __u8 clock_accuracy; -+} __packed; -+ - #define HCI_EVT_LE_CIS_ESTABLISHED 0x19 - struct hci_evt_le_cis_established { - __u8 status; -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 0cb87687837f..1bd12c303e25 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -2053,6 +2053,18 @@ void hci_conn_del_sysfs(struct hci_conn *conn); - #define sync_recv_capable(dev) \ - ((dev)->le_features[3] & HCI_LE_ISO_SYNC_RECEIVER) - #define sync_recv_enabled(dev) (le_enabled(dev) && sync_recv_capable(dev)) -+#define past_sender_capable(dev) \ -+ ((dev)->le_features[3] & HCI_LE_PAST_SENDER) -+#define past_receiver_capable(dev) \ -+ ((dev)->le_features[3] & HCI_LE_PAST_RECEIVER) -+#define past_capable(dev) \ -+ (past_sender_capable(dev) || past_receiver_capable(dev)) -+#define past_sender_enabled(dev) \ -+ (le_enabled(dev) && past_sender_capable(dev)) -+#define past_receiver_enabled(dev) \ -+ (le_enabled(dev) && past_receiver_capable(dev)) -+#define past_enabled(dev) \ -+ (past_sender_enabled(dev) || past_receiver_enabled(dev)) - - #define mws_transport_config_capable(dev) (((dev)->commands[30] & 0x08) && \ - (!hci_test_quirk((dev), HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG))) -diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h -index f5be96f08b9d..8234915854b6 100644 ---- a/include/net/bluetooth/mgmt.h -+++ b/include/net/bluetooth/mgmt.h -@@ -119,6 +119,8 @@ struct mgmt_rp_read_index_list { - #define MGMT_SETTING_ISO_BROADCASTER BIT(20) - #define MGMT_SETTING_ISO_SYNC_RECEIVER BIT(21) - #define MGMT_SETTING_LL_PRIVACY BIT(22) -+#define MGMT_SETTING_PAST_SENDER BIT(23) -+#define MGMT_SETTING_PAST_RECEIVER BIT(24) - - #define MGMT_OP_READ_INFO 0x0004 - #define MGMT_READ_INFO_SIZE 0 -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 3838b90343d9..af34c9938509 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5936,6 +5936,71 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data, - hci_dev_unlock(hdev); - } - -+static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle) -+{ -+ struct hci_cp_le_pa_term_sync cp; -+ -+ memset(&cp, 0, sizeof(cp)); -+ cp.handle = handle; -+ -+ return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp); -+} -+ -+static void hci_le_past_received_evt(struct hci_dev *hdev, void *data, -+ struct sk_buff *skb) -+{ -+ struct hci_ev_le_past_received *ev = data; -+ int mask = hdev->link_mode; -+ __u8 flags = 0; -+ struct hci_conn *pa_sync, *conn; -+ -+ bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); -+ -+ hci_dev_lock(hdev); -+ -+ hci_dev_clear_flag(hdev, HCI_PA_SYNC); -+ -+ conn = hci_conn_hash_lookup_create_pa_sync(hdev); -+ if (!conn) { -+ bt_dev_err(hdev, -+ "Unable to find connection for dst %pMR sid 0x%2.2x", -+ &ev->bdaddr, ev->sid); -+ goto unlock; -+ } -+ -+ conn->sync_handle = le16_to_cpu(ev->sync_handle); -+ conn->sid = HCI_SID_INVALID; -+ -+ mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, PA_LINK, -+ &flags); -+ if (!(mask & HCI_LM_ACCEPT)) { -+ hci_le_pa_term_sync(hdev, ev->sync_handle); -+ goto unlock; -+ } -+ -+ if (!(flags & HCI_PROTO_DEFER)) -+ goto unlock; -+ -+ /* Add connection to indicate PA sync event */ -+ pa_sync = hci_conn_add_unset(hdev, PA_LINK, BDADDR_ANY, -+ HCI_ROLE_SLAVE); -+ -+ if (IS_ERR(pa_sync)) -+ goto unlock; -+ -+ pa_sync->sync_handle = le16_to_cpu(ev->sync_handle); -+ -+ if (ev->status) { -+ set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags); -+ -+ /* Notify iso layer */ -+ hci_connect_cfm(pa_sync, ev->status); -+ } -+ -+unlock: -+ hci_dev_unlock(hdev); -+} -+ - static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data, - struct sk_buff *skb) - { -@@ -6412,16 +6477,6 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data, - hci_dev_unlock(hdev); - } - --static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle) --{ -- struct hci_cp_le_pa_term_sync cp; -- -- memset(&cp, 0, sizeof(cp)); -- cp.handle = handle; -- -- return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp); --} -- - static void hci_le_pa_sync_established_evt(struct hci_dev *hdev, void *data, - struct sk_buff *skb) - { -@@ -7206,6 +7261,10 @@ static const struct hci_le_ev { - /* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */ - HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt, - sizeof(struct hci_evt_le_ext_adv_set_term)), -+ /* [0x18 = HCI_EVT_LE_PAST_RECEIVED] */ -+ HCI_LE_EV(HCI_EV_LE_PAST_RECEIVED, -+ hci_le_past_received_evt, -+ sizeof(struct hci_ev_le_past_received)), - /* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */ - HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_established_evt, - sizeof(struct hci_evt_le_cis_established)), -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index e302afc781a5..d181c89a7b0e 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -4393,6 +4393,9 @@ static int hci_le_set_event_mask_sync(struct hci_dev *hdev) - if (ext_adv_capable(hdev)) - events[2] |= 0x02; /* LE Advertising Set Terminated */ - -+ if (past_receiver_capable(hdev)) -+ events[2] |= 0x80; /* LE PAST Received */ -+ - if (cis_capable(hdev)) { - events[3] |= 0x01; /* LE CIS Established */ - if (cis_peripheral_capable(hdev)) -diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c -index c0ae6c6fbe94..3c568d3d8ac9 100644 ---- a/net/bluetooth/iso.c -+++ b/net/bluetooth/iso.c -@@ -80,6 +80,7 @@ static struct bt_iso_qos default_qos; - static bool check_ucast_qos(struct bt_iso_qos *qos); - static bool check_bcast_qos(struct bt_iso_qos *qos); - static bool iso_match_sid(struct sock *sk, void *data); -+static bool iso_match_sid_past(struct sock *sk, void *data); - static bool iso_match_sync_handle(struct sock *sk, void *data); - static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data); - static void iso_sock_disconn(struct sock *sk); -@@ -2090,6 +2091,16 @@ static bool iso_match_sid(struct sock *sk, void *data) - return ev->sid == iso_pi(sk)->bc_sid; - } - -+static bool iso_match_sid_past(struct sock *sk, void *data) -+{ -+ struct hci_ev_le_past_received *ev = data; -+ -+ if (iso_pi(sk)->bc_sid == HCI_SID_INVALID) -+ return true; -+ -+ return ev->sid == iso_pi(sk)->bc_sid; -+} -+ - static bool iso_match_sync_handle(struct sock *sk, void *data) - { - struct hci_evt_le_big_info_adv_report *ev = data; -@@ -2109,6 +2120,7 @@ static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data) - int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - { - struct hci_ev_le_pa_sync_established *ev1; -+ struct hci_ev_le_past_received *ev1a; - struct hci_evt_le_big_info_adv_report *ev2; - struct hci_ev_le_per_adv_report *ev3; - struct sock *sk; -@@ -2122,6 +2134,7 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - * SID to listen to and once sync is established its handle needs to - * be stored in iso_pi(sk)->sync_handle so it can be matched once - * receiving the BIG Info. -+ * 1a. HCI_EV_LE_PAST_RECEIVED: alternative to 1. - * 2. HCI_EVT_LE_BIG_INFO_ADV_REPORT: When connect_ind is triggered by a - * a BIG Info it attempts to check if there any listening socket with - * the same sync_handle and if it does then attempt to create a sync. -@@ -2141,6 +2154,18 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) - goto done; - } - -+ ev1a = hci_recv_event_data(hdev, HCI_EV_LE_PAST_RECEIVED); -+ if (ev1a) { -+ sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_LISTEN, -+ iso_match_sid_past, ev1a); -+ if (sk && !ev1a->status) { -+ iso_pi(sk)->sync_handle = le16_to_cpu(ev1a->sync_handle); -+ iso_pi(sk)->bc_sid = ev1a->sid; -+ } -+ -+ goto done; -+ } -+ - ev2 = hci_recv_event_data(hdev, HCI_EVT_LE_BIG_INFO_ADV_REPORT); - if (ev2) { - /* Check if BIGInfo report has already been handled */ -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 6fd13a39f48a..7cca24f6ef49 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -852,6 +852,12 @@ static u32 get_supported_settings(struct hci_dev *hdev) - if (ll_privacy_capable(hdev)) - settings |= MGMT_SETTING_LL_PRIVACY; - -+ if (past_sender_capable(hdev)) -+ settings |= MGMT_SETTING_PAST_SENDER; -+ -+ if (past_receiver_capable(hdev)) -+ settings |= MGMT_SETTING_PAST_RECEIVER; -+ - settings |= MGMT_SETTING_PHY_CONFIGURATION; - - return settings; -@@ -937,6 +943,12 @@ static u32 get_current_settings(struct hci_dev *hdev) - if (ll_privacy_enabled(hdev)) - settings |= MGMT_SETTING_LL_PRIVACY; - -+ if (past_sender_enabled(hdev)) -+ settings |= MGMT_SETTING_PAST_SENDER; -+ -+ if (past_receiver_enabled(hdev)) -+ settings |= MGMT_SETTING_PAST_RECEIVER; -+ - return settings; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1276-bluetooth-iso-add-support-to-bind-to-trigger-past.patch b/1276-bluetooth-iso-add-support-to-bind-to-trigger-past.patch deleted file mode 100644 index e165f2899..000000000 --- a/1276-bluetooth-iso-add-support-to-bind-to-trigger-past.patch +++ /dev/null @@ -1,300 +0,0 @@ -From 414511072bcdf8a60a29bf43cca47260006df84b Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Wed, 15 Apr 2026 17:00:08 -0500 -Subject: [PATCH] Bluetooth: ISO: Add support to bind to trigger PAST - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit d3413703d5f8b7d1e6f514f9440ed5da1bc30796 -Author: Luiz Augusto von Dentz -Date: Fri Sep 5 11:34:44 2025 -0400 - - Bluetooth: ISO: Add support to bind to trigger PAST - - This makes it possible to bind to a different destination address - after being connected (BT_CONNECTED, BT_CONNECT2) which then triggers - PAST Sender proceedure to transfer the PA Sync to the destination - address. - - Signed-off-by: Luiz Augusto von Dentz - -Conflicts: - Context difference due to missing network commit: - commit 0e50474fa514 net: Convert proto_ops bind() callbacks to use sockaddr_unsized - -Signed-off-by: David Marlin - -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 8c2235444808..1f74722f3f4d 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -1602,6 +1602,7 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst, - struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid, - struct bt_iso_qos *qos, - __u8 base_len, __u8 *base, u16 timeout); -+int hci_past_bis(struct hci_conn *conn, bdaddr_t *dst, __u8 dst_type); - struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst, - __u8 dst_type, struct bt_iso_qos *qos, - u16 timeout); -diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h -index e352a4e0ef8d..3133f40fa9f9 100644 ---- a/include/net/bluetooth/hci_sync.h -+++ b/include/net/bluetooth/hci_sync.h -@@ -188,3 +188,4 @@ int hci_le_conn_update_sync(struct hci_dev *hdev, struct hci_conn *conn, - - int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn); - int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn); -+int hci_past_sync(struct hci_conn *conn, struct hci_conn *le); -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 6fc0692abf05..4f9dc1435ccc 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -2245,6 +2245,18 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid, - return conn; - } - -+int hci_past_bis(struct hci_conn *conn, bdaddr_t *dst, __u8 dst_type) -+{ -+ struct hci_conn *le; -+ -+ /* Lookup existing LE connection to rebind to */ -+ le = hci_conn_hash_lookup_le(conn->hdev, dst, dst_type); -+ if (!le) -+ return -EINVAL; -+ -+ return hci_past_sync(conn, le); -+} -+ - static void bis_mark_per_adv(struct hci_conn *conn, void *data) - { - struct iso_list_data *d = data; -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index cb573b88505f..13d34c97b4d3 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -7229,3 +7229,95 @@ int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn) - return hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn, - create_big_complete); - } -+ -+struct past_data { -+ struct hci_conn *conn; -+ struct hci_conn *le; -+}; -+ -+static void past_complete(struct hci_dev *hdev, void *data, int err) -+{ -+ struct past_data *past = data; -+ -+ bt_dev_dbg(hdev, "err %d", err); -+ -+ kfree(past); -+} -+ -+static int hci_le_past_set_info_sync(struct hci_dev *hdev, void *data) -+{ -+ struct past_data *past = data; -+ struct hci_cp_le_past_set_info cp; -+ -+ hci_dev_lock(hdev); -+ -+ if (!hci_conn_valid(hdev, past->conn) || -+ !hci_conn_valid(hdev, past->le)) { -+ hci_dev_unlock(hdev); -+ return -ECANCELED; -+ } -+ -+ memset(&cp, 0, sizeof(cp)); -+ cp.handle = cpu_to_le16(past->le->handle); -+ cp.adv_handle = past->conn->iso_qos.bcast.bis; -+ -+ hci_dev_unlock(hdev); -+ -+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_PAST_SET_INFO, -+ sizeof(cp), &cp, HCI_CMD_TIMEOUT); -+} -+ -+static int hci_le_past_sync(struct hci_dev *hdev, void *data) -+{ -+ struct past_data *past = data; -+ struct hci_cp_le_past cp; -+ -+ hci_dev_lock(hdev); -+ -+ if (!hci_conn_valid(hdev, past->conn) || -+ !hci_conn_valid(hdev, past->le)) { -+ hci_dev_unlock(hdev); -+ return -ECANCELED; -+ } -+ -+ memset(&cp, 0, sizeof(cp)); -+ cp.handle = cpu_to_le16(past->le->handle); -+ cp.sync_handle = cpu_to_le16(past->conn->sync_handle); -+ -+ hci_dev_unlock(hdev); -+ -+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_PAST, -+ sizeof(cp), &cp, HCI_CMD_TIMEOUT); -+} -+ -+int hci_past_sync(struct hci_conn *conn, struct hci_conn *le) -+{ -+ struct past_data *data; -+ int err; -+ -+ if (conn->type != BIS_LINK && conn->type != PA_LINK) -+ return -EINVAL; -+ -+ if (!past_sender_capable(conn->hdev)) -+ return -EOPNOTSUPP; -+ -+ data = kmalloc(sizeof(*data), GFP_KERNEL); -+ if (!data) -+ return -ENOMEM; -+ -+ data->conn = conn; -+ data->le = le; -+ -+ if (conn->role == HCI_ROLE_MASTER) -+ err = hci_cmd_sync_queue_once(conn->hdev, -+ hci_le_past_set_info_sync, data, -+ past_complete); -+ else -+ err = hci_cmd_sync_queue_once(conn->hdev, hci_le_past_sync, -+ data, past_complete); -+ -+ if (err) -+ kfree(data); -+ -+ return err; -+} -diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c -index 3c568d3d8ac9..607172b35267 100644 ---- a/net/bluetooth/iso.c -+++ b/net/bluetooth/iso.c -@@ -987,20 +987,14 @@ static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr, - return 0; - } - --static int iso_sock_bind_pa_sk(struct sock *sk, struct sockaddr_iso *sa, -+/* Must be called on the locked socket. */ -+static int iso_sock_rebind_bis(struct sock *sk, struct sockaddr_iso *sa, - int addr_len) - { - int err = 0; - -- if (sk->sk_type != SOCK_SEQPACKET) { -- err = -EINVAL; -- goto done; -- } -- -- if (addr_len != sizeof(*sa) + sizeof(*sa->iso_bc)) { -- err = -EINVAL; -- goto done; -- } -+ if (!test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) -+ return -EBADFD; - - if (sa->iso_bc->bc_num_bis > ISO_MAX_NUM_BIS) { - err = -EINVAL; -@@ -1023,6 +1017,77 @@ static int iso_sock_bind_pa_sk(struct sock *sk, struct sockaddr_iso *sa, - return err; - } - -+static struct hci_dev *iso_conn_get_hdev(struct iso_conn *conn) -+{ -+ struct hci_dev *hdev = NULL; -+ -+ iso_conn_lock(conn); -+ if (conn->hcon) -+ hdev = hci_dev_hold(conn->hcon->hdev); -+ iso_conn_unlock(conn); -+ -+ return hdev; -+} -+ -+/* Must be called on the locked socket. */ -+static int iso_sock_rebind_bc(struct sock *sk, struct sockaddr_iso *sa, -+ int addr_len) -+{ -+ struct hci_dev *hdev; -+ struct hci_conn *bis; -+ int err; -+ -+ if (sk->sk_type != SOCK_SEQPACKET || !iso_pi(sk)->conn) -+ return -EINVAL; -+ -+ /* Check if it is really a Broadcast address being requested */ -+ if (addr_len != sizeof(*sa) + sizeof(*sa->iso_bc)) -+ return -EINVAL; -+ -+ /* Check if the address hasn't changed then perhaps only the number of -+ * bis has changed. -+ */ -+ if (!bacmp(&iso_pi(sk)->dst, &sa->iso_bc->bc_bdaddr) || -+ !bacmp(&sa->iso_bc->bc_bdaddr, BDADDR_ANY)) -+ return iso_sock_rebind_bis(sk, sa, addr_len); -+ -+ /* Check if the address type is of LE type */ -+ if (!bdaddr_type_is_le(sa->iso_bc->bc_bdaddr_type)) -+ return -EINVAL; -+ -+ hdev = iso_conn_get_hdev(iso_pi(sk)->conn); -+ if (!hdev) -+ return -EINVAL; -+ -+ bis = iso_pi(sk)->conn->hcon; -+ -+ /* Release the socket before lookups since that requires hci_dev_lock -+ * which shall not be acquired while holding sock_lock for proper -+ * ordering. -+ */ -+ release_sock(sk); -+ hci_dev_lock(bis->hdev); -+ lock_sock(sk); -+ -+ if (!iso_pi(sk)->conn || iso_pi(sk)->conn->hcon != bis) { -+ /* raced with iso_conn_del() or iso_disconn_sock() */ -+ err = -ENOTCONN; -+ goto unlock; -+ } -+ -+ BT_DBG("sk %p %pMR type %u", sk, &sa->iso_bc->bc_bdaddr, -+ sa->iso_bc->bc_bdaddr_type); -+ -+ err = hci_past_bis(bis, &sa->iso_bc->bc_bdaddr, -+ le_addr_type(sa->iso_bc->bc_bdaddr_type)); -+ -+unlock: -+ hci_dev_unlock(hdev); -+ hci_dev_put(hdev); -+ -+ return err; -+} -+ - static int iso_sock_bind(struct socket *sock, struct sockaddr *addr, - int addr_len) - { -@@ -1038,13 +1103,12 @@ static int iso_sock_bind(struct socket *sock, struct sockaddr *addr, - - lock_sock(sk); - -- /* Allow the user to bind a PA sync socket to a number -- * of BISes to sync to. -- */ -- if ((sk->sk_state == BT_CONNECT2 || -- sk->sk_state == BT_CONNECTED) && -- test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) { -- err = iso_sock_bind_pa_sk(sk, sa, addr_len); -+ if ((sk->sk_state == BT_CONNECT2 || sk->sk_state == BT_CONNECTED) && -+ addr_len > sizeof(*sa)) { -+ /* Allow the user to rebind to a different address using -+ * PAST procedures. -+ */ -+ err = iso_sock_rebind_bc(sk, sa, addr_len); - goto done; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1277-bluetooth-hci-add-support-for-ll-extended-feature-set.patch b/1277-bluetooth-hci-add-support-for-ll-extended-feature-set.patch deleted file mode 100644 index fce45213d..000000000 --- a/1277-bluetooth-hci-add-support-for-ll-extended-feature-set.patch +++ /dev/null @@ -1,437 +0,0 @@ -From 390744e4031283550f4dd646cff099d5952d3683 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Wed, 15 Apr 2026 17:01:26 -0500 -Subject: [PATCH] Bluetooth: HCI: Add support for LL Extended Feature Set -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit a106e50be74b0896583f4d010a69f9806e4194f4 -Author: Luiz Augusto von Dentz -Date: Fri Nov 14 09:29:28 2025 -0500 - - Bluetooth: HCI: Add support for LL Extended Feature Set - - This adds support for emulating LL Extended Feature Set introduced in 6.0 - that adds the following: - - Commands: - - - HCI_LE_Read_All_Local_Supported_­Features(0x2087)(Feature:47,1) - - HCI_LE_Read_All_Remote_Features(0x2088)(Feature:47,2) - - Events: - - - HCI_LE_Read_All_Remote_Features_Complete(0x2b)(Mask bit:42) - - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h -index d883ad233ebc..a27cd3626b87 100644 ---- a/include/net/bluetooth/hci.h -+++ b/include/net/bluetooth/hci.h -@@ -653,6 +653,7 @@ enum { - #define HCI_LE_CIS_PERIPHERAL 0x20 - #define HCI_LE_ISO_BROADCASTER 0x40 - #define HCI_LE_ISO_SYNC_RECEIVER 0x80 -+#define HCI_LE_LL_EXT_FEATURE 0x80 - - /* Connection modes */ - #define HCI_CM_ACTIVE 0x0000 -@@ -2255,6 +2256,19 @@ struct hci_cp_le_set_host_feature { - __u8 bit_value; - } __packed; - -+#define HCI_OP_LE_READ_ALL_LOCAL_FEATURES 0x2087 -+struct hci_rp_le_read_all_local_features { -+ __u8 status; -+ __u8 page; -+ __u8 features[248]; -+} __packed; -+ -+#define HCI_OP_LE_READ_ALL_REMOTE_FEATURES 0x2088 -+struct hci_cp_le_read_all_remote_features { -+ __le16 handle; -+ __u8 pages; -+} __packed; -+ - /* ---- HCI Events ---- */ - struct hci_ev_status { - __u8 status; -@@ -2937,6 +2951,15 @@ struct hci_evt_le_big_info_adv_report { - __u8 encryption; - } __packed; - -+#define HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE 0x2b -+struct hci_evt_le_read_all_remote_features_complete { -+ __u8 status; -+ __le16 handle; -+ __u8 max_pages; -+ __u8 valid_pages; -+ __u8 features[248]; -+} __packed; -+ - #define HCI_EV_VENDOR 0xff - - /* Internal events generated by Bluetooth stack */ -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 858b58206e80..4263e71a23ef 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -378,7 +378,7 @@ struct hci_dev { - __u8 minor_class; - __u8 max_page; - __u8 features[HCI_MAX_PAGES][8]; -- __u8 le_features[8]; -+ __u8 le_features[248]; - __u8 le_accept_list_size; - __u8 le_resolv_list_size; - __u8 le_num_of_adv_sets; -@@ -702,6 +702,7 @@ struct hci_conn { - __u8 attempt; - __u8 dev_class[3]; - __u8 features[HCI_MAX_PAGES][8]; -+ __u8 le_features[248]; - __u16 pkt_type; - __u16 link_policy; - __u8 key_type; -@@ -2067,6 +2068,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn); - (le_enabled(dev) && past_receiver_capable(dev)) - #define past_enabled(dev) \ - (past_sender_enabled(dev) || past_receiver_enabled(dev)) -+#define ll_ext_feature_capable(dev) \ -+ ((dev)->le_features[7] & HCI_LE_LL_EXT_FEATURE) - - #define mws_transport_config_capable(dev) (((dev)->commands[30] & 0x08) && \ - (!hci_test_quirk((dev), HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG))) -diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h -index 3133f40fa9f9..56076bbc981d 100644 ---- a/include/net/bluetooth/hci_sync.h -+++ b/include/net/bluetooth/hci_sync.h -@@ -189,3 +189,5 @@ int hci_le_conn_update_sync(struct hci_dev *hdev, struct hci_conn *conn, - int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn); - int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn); - int hci_past_sync(struct hci_conn *conn, struct hci_conn *le); -+ -+int hci_le_read_remote_features(struct hci_conn *conn); -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 7c4ca14f13e5..a9868f17ef40 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -2886,12 +2886,8 @@ static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status) - hci_dev_lock(hdev); - - conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); -- if (conn) { -- if (conn->state == BT_CONFIG) { -- hci_connect_cfm(conn, status); -- hci_conn_drop(conn); -- } -- } -+ if (conn && conn->state == BT_CONFIG) -+ hci_connect_cfm(conn, status); - - hci_dev_unlock(hdev); - } -@@ -3915,11 +3911,49 @@ static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data, - return rp->status; - } - -+static u8 hci_cc_le_read_all_local_features(struct hci_dev *hdev, void *data, -+ struct sk_buff *skb) -+{ -+ struct hci_rp_le_read_all_local_features *rp = data; -+ -+ bt_dev_dbg(hdev, "status 0x%2.2x", rp->status); -+ -+ if (rp->status) -+ return rp->status; -+ -+ memcpy(hdev->le_features, rp->features, 248); -+ -+ return rp->status; -+} -+ - static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status) - { - bt_dev_dbg(hdev, "status 0x%2.2x", status); - } - -+static void hci_cs_le_read_all_remote_features(struct hci_dev *hdev, u8 status) -+{ -+ struct hci_cp_le_read_remote_features *cp; -+ struct hci_conn *conn; -+ -+ bt_dev_dbg(hdev, "status 0x%2.2x", status); -+ -+ if (!status) -+ return; -+ -+ cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_ALL_REMOTE_FEATURES); -+ if (!cp) -+ return; -+ -+ hci_dev_lock(hdev); -+ -+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); -+ if (conn && conn->state == BT_CONFIG) -+ hci_connect_cfm(conn, status); -+ -+ hci_dev_unlock(hdev); -+} -+ - static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data, - struct sk_buff *skb) - { -@@ -4171,6 +4205,9 @@ static const struct hci_cc { - sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE), - HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path, - sizeof(struct hci_rp_le_setup_iso_path)), -+ HCI_CC(HCI_OP_LE_READ_ALL_LOCAL_FEATURES, -+ hci_cc_le_read_all_local_features, -+ sizeof(struct hci_rp_le_read_all_local_features)), - }; - - static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc, -@@ -4325,6 +4362,8 @@ static const struct hci_cs { - HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn), - HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis), - HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big), -+ HCI_CS(HCI_OP_LE_READ_ALL_REMOTE_FEATURES, -+ hci_cs_le_read_all_remote_features), - }; - - static void hci_cmd_status_evt(struct hci_dev *hdev, void *data, -@@ -5645,6 +5684,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, - struct hci_conn *conn; - struct smp_irk *irk; - u8 addr_type; -+ int err; - - hci_dev_lock(hdev); - -@@ -5775,26 +5815,8 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, - hci_debugfs_create_conn(conn); - hci_conn_add_sysfs(conn); - -- /* The remote features procedure is defined for central -- * role only. So only in case of an initiated connection -- * request the remote features. -- * -- * If the local controller supports peripheral-initiated features -- * exchange, then requesting the remote features in peripheral -- * role is possible. Otherwise just transition into the -- * connected state without requesting the remote features. -- */ -- if (conn->out || -- (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) { -- struct hci_cp_le_read_remote_features cp; -- -- cp.handle = __cpu_to_le16(conn->handle); -- -- hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES, -- sizeof(cp), &cp); -- -- hci_conn_hold(conn); -- } else { -+ err = hci_le_read_remote_features(conn); -+ if (err) { - conn->state = BT_CONNECTED; - hci_connect_cfm(conn, status); - } -@@ -6608,7 +6630,6 @@ static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data, - - conn->state = BT_CONNECTED; - hci_connect_cfm(conn, status); -- hci_conn_drop(conn); - } - } - -@@ -7186,6 +7207,50 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, - hci_dev_unlock(hdev); - } - -+static void hci_le_read_all_remote_features_evt(struct hci_dev *hdev, -+ void *data, struct sk_buff *skb) -+{ -+ struct hci_evt_le_read_all_remote_features_complete *ev = data; -+ struct hci_conn *conn; -+ -+ bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); -+ -+ hci_dev_lock(hdev); -+ -+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); -+ if (!conn) -+ goto unlock; -+ -+ if (!ev->status) -+ memcpy(conn->le_features, ev->features, 248); -+ -+ if (conn->state == BT_CONFIG) { -+ __u8 status; -+ -+ /* If the local controller supports peripheral-initiated -+ * features exchange, but the remote controller does -+ * not, then it is possible that the error code 0x1a -+ * for unsupported remote feature gets returned. -+ * -+ * In this specific case, allow the connection to -+ * transition into connected state and mark it as -+ * successful. -+ */ -+ if (!conn->out && -+ ev->status == HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE && -+ (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) -+ status = 0x00; -+ else -+ status = ev->status; -+ -+ conn->state = BT_CONNECTED; -+ hci_connect_cfm(conn, status); -+ } -+ -+unlock: -+ hci_dev_unlock(hdev); -+} -+ - #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \ - [_op] = { \ - .func = _func, \ -@@ -7291,6 +7356,12 @@ static const struct hci_le_ev { - hci_le_big_info_adv_report_evt, - sizeof(struct hci_evt_le_big_info_adv_report), - HCI_MAX_EVENT_SIZE), -+ /* [0x2b = HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE] */ -+ HCI_LE_EV_VL(HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE, -+ hci_le_read_all_remote_features_evt, -+ sizeof(struct -+ hci_evt_le_read_all_remote_features_complete), -+ HCI_MAX_EVENT_SIZE), - }; - - static void hci_le_meta_evt(struct hci_dev *hdev, void *data, -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index 742ac6ab9755..13b2e9608fdb 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -4011,8 +4011,19 @@ static int hci_le_read_buffer_size_sync(struct hci_dev *hdev) - /* Read LE Local Supported Features */ - static int hci_le_read_local_features_sync(struct hci_dev *hdev) - { -- return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, -- 0, NULL, HCI_CMD_TIMEOUT); -+ int err; -+ -+ err = __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, -+ 0, NULL, HCI_CMD_TIMEOUT); -+ if (err) -+ return err; -+ -+ if (ll_ext_feature_capable(hdev) && hdev->commands[47] & BIT(2)) -+ return __hci_cmd_sync_status(hdev, -+ HCI_OP_LE_READ_ALL_LOCAL_FEATURES, -+ 0, NULL, HCI_CMD_TIMEOUT); -+ -+ return err; - } - - /* Read LE Supported States */ -@@ -7321,3 +7332,90 @@ int hci_past_sync(struct hci_conn *conn, struct hci_conn *le) - - return err; - } -+ -+static void le_read_features_complete(struct hci_dev *hdev, void *data, int err) -+{ -+ struct hci_conn *conn = data; -+ -+ bt_dev_dbg(hdev, "err %d", err); -+ -+ if (err == -ECANCELED) -+ return; -+ -+ hci_conn_drop(conn); -+} -+ -+static int hci_le_read_all_remote_features_sync(struct hci_dev *hdev, -+ void *data) -+{ -+ struct hci_conn *conn = data; -+ struct hci_cp_le_read_all_remote_features cp; -+ -+ memset(&cp, 0, sizeof(cp)); -+ cp.handle = cpu_to_le16(conn->handle); -+ cp.pages = 10; /* Attempt to read all pages */ -+ -+ /* Wait for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE event otherwise -+ * hci_conn_drop may run prematurely causing a disconnection. -+ */ -+ return __hci_cmd_sync_status_sk(hdev, -+ HCI_OP_LE_READ_ALL_REMOTE_FEATURES, -+ sizeof(cp), &cp, -+ HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE, -+ HCI_CMD_TIMEOUT, NULL); -+ -+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_ALL_REMOTE_FEATURES, -+ sizeof(cp), &cp, HCI_CMD_TIMEOUT); -+} -+ -+static int hci_le_read_remote_features_sync(struct hci_dev *hdev, void *data) -+{ -+ struct hci_conn *conn = data; -+ struct hci_cp_le_read_remote_features cp; -+ -+ if (!hci_conn_valid(hdev, conn)) -+ return -ECANCELED; -+ -+ /* Check if LL Extended Feature Set is supported and -+ * HCI_OP_LE_READ_ALL_REMOTE_FEATURES is supported then use that to read -+ * all features. -+ */ -+ if (ll_ext_feature_capable(hdev) && hdev->commands[47] & BIT(3)) -+ return hci_le_read_all_remote_features_sync(hdev, data); -+ -+ memset(&cp, 0, sizeof(cp)); -+ cp.handle = cpu_to_le16(conn->handle); -+ -+ /* Wait for HCI_EV_LE_REMOTE_FEAT_COMPLETE event otherwise -+ * hci_conn_drop may run prematurely causing a disconnection. -+ */ -+ return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_READ_REMOTE_FEATURES, -+ sizeof(cp), &cp, -+ HCI_EV_LE_REMOTE_FEAT_COMPLETE, -+ HCI_CMD_TIMEOUT, NULL); -+} -+ -+int hci_le_read_remote_features(struct hci_conn *conn) -+{ -+ struct hci_dev *hdev = conn->hdev; -+ int err; -+ -+ /* The remote features procedure is defined for central -+ * role only. So only in case of an initiated connection -+ * request the remote features. -+ * -+ * If the local controller supports peripheral-initiated features -+ * exchange, then requesting the remote features in peripheral -+ * role is possible. Otherwise just transition into the -+ * connected state without requesting the remote features. -+ */ -+ if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) -+ err = hci_cmd_sync_queue_once(hdev, -+ hci_le_read_remote_features_sync, -+ hci_conn_hold(conn), -+ le_read_features_complete); -+ else -+ err = -EOPNOTSUPP; -+ -+ return err; -+} --- -2.50.1 (Apple Git-155) - diff --git a/1278-bluetooth-hci-conn-fix-using-conn-le-tx-rx-phy-as-supported-.patch b/1278-bluetooth-hci-conn-fix-using-conn-le-tx-rx-phy-as-supported-.patch deleted file mode 100644 index 383c2f463..000000000 --- a/1278-bluetooth-hci-conn-fix-using-conn-le-tx-rx-phy-as-supported-.patch +++ /dev/null @@ -1,136 +0,0 @@ -From 8c647364b6263e4d076a7c96f55989b5c0be9598 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Wed, 15 Apr 2026 19:43:05 -0500 -Subject: [PATCH] Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as - supported PHYs - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit 129d1ef3c5e60d51678e6359beaba85771a49e46 -Author: Luiz Augusto von Dentz -Date: Wed Dec 10 11:38:08 2025 -0500 - - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs - - conn->le_{tx,rx}_phy is not actually a bitfield as it set by - HCI_EV_LE_PHY_UPDATE_COMPLETE it is actually correspond to the current - PHY in use not what is supported by the controller, so this introduces - different fields (conn->le_{tx,rx}_def_phys) to track what PHYs are - supported by the connection. - - Fixes: eab2404ba798 ("Bluetooth: Add BT_PHY socket option") - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 4263e71a23ef..8aadf4cdead2 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -730,6 +730,8 @@ struct hci_conn { - __u16 le_per_adv_data_offset; - __u8 le_adv_phy; - __u8 le_adv_sec_phy; -+ __u8 le_tx_def_phys; -+ __u8 le_rx_def_phys; - __u8 le_tx_phy; - __u8 le_rx_phy; - __s8 rssi; -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index c3f7828bf9d5..5a4374ccf8e8 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -1008,6 +1008,11 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, - /* conn->src should reflect the local identity address */ - hci_copy_identity_address(hdev, &conn->src, &conn->src_type); - conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; -+ /* Use the controller supported PHYS as default until the -+ * remote features are resolved. -+ */ -+ conn->le_tx_def_phys = hdev->le_tx_def_phys; -+ conn->le_rx_def_phys = hdev->le_tx_def_phys; - break; - case CIS_LINK: - /* conn->src should reflect the local identity address */ -@@ -2928,22 +2933,22 @@ u32 hci_conn_get_phy(struct hci_conn *conn) - break; - - case LE_LINK: -- if (conn->le_tx_phy & HCI_LE_SET_PHY_1M) -+ if (conn->le_tx_def_phys & HCI_LE_SET_PHY_1M) - phys |= BT_PHY_LE_1M_TX; - -- if (conn->le_rx_phy & HCI_LE_SET_PHY_1M) -+ if (conn->le_rx_def_phys & HCI_LE_SET_PHY_1M) - phys |= BT_PHY_LE_1M_RX; - -- if (conn->le_tx_phy & HCI_LE_SET_PHY_2M) -+ if (conn->le_tx_def_phys & HCI_LE_SET_PHY_2M) - phys |= BT_PHY_LE_2M_TX; - -- if (conn->le_rx_phy & HCI_LE_SET_PHY_2M) -+ if (conn->le_rx_def_phys & HCI_LE_SET_PHY_2M) - phys |= BT_PHY_LE_2M_RX; - -- if (conn->le_tx_phy & HCI_LE_SET_PHY_CODED) -+ if (conn->le_tx_def_phys & HCI_LE_SET_PHY_CODED) - phys |= BT_PHY_LE_CODED_TX; - -- if (conn->le_rx_phy & HCI_LE_SET_PHY_CODED) -+ if (conn->le_rx_def_phys & HCI_LE_SET_PHY_CODED) - phys |= BT_PHY_LE_CODED_RX; - - break; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index a9868f17ef40..58075bf72055 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -6607,8 +6607,20 @@ static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data, - - conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle)); - if (conn) { -- if (!ev->status) -- memcpy(conn->features[0], ev->features, 8); -+ if (!ev->status) { -+ memcpy(conn->le_features, ev->features, 8); -+ -+ /* Update supported PHYs */ -+ if (!(conn->le_features[1] & HCI_LE_PHY_2M)) { -+ conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_2M; -+ conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_2M; -+ } -+ -+ if (!(conn->le_features[1] & HCI_LE_PHY_CODED)) { -+ conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_CODED; -+ conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_CODED; -+ } -+ } - - if (conn->state == BT_CONFIG) { - __u8 status; -@@ -7221,9 +7233,21 @@ static void hci_le_read_all_remote_features_evt(struct hci_dev *hdev, - if (!conn) - goto unlock; - -- if (!ev->status) -+ if (!ev->status) { - memcpy(conn->le_features, ev->features, 248); - -+ /* Update supported PHYs */ -+ if (!(conn->le_features[1] & HCI_LE_PHY_2M)) { -+ conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_2M; -+ conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_2M; -+ } -+ -+ if (!(conn->le_features[1] & HCI_LE_PHY_CODED)) { -+ conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_CODED; -+ conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_CODED; -+ } -+ } -+ - if (conn->state == BT_CONFIG) { - __u8 status; - --- -2.50.1 (Apple Git-155) - diff --git a/1279-bluetooth-l2cap-add-support-for-setting-bt-phy.patch b/1279-bluetooth-l2cap-add-support-for-setting-bt-phy.patch deleted file mode 100644 index e50b693d0..000000000 --- a/1279-bluetooth-l2cap-add-support-for-setting-bt-phy.patch +++ /dev/null @@ -1,442 +0,0 @@ -From 81102db981020f3c766c0e7c88bdd2bf7d12ea30 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Wed, 15 Apr 2026 22:50:00 -0500 -Subject: [PATCH] Bluetooth: L2CAP: Add support for setting BT_PHY - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit 132c0779d4a2d08541519cf04783bca52c6ec85c -Author: Luiz Augusto von Dentz -Date: Wed Dec 17 10:50:51 2025 -0500 - - Bluetooth: L2CAP: Add support for setting BT_PHY - - This enables client to use setsockopt(BT_PHY) to set the connection - packet type/PHY: - - Example setting BT_PHY_BR_1M_1SLOT: - - < HCI Command: Change Conne.. (0x01|0x000f) plen 4 - Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) - Packet type: 0x331e - 2-DH1 may not be used - 3-DH1 may not be used - DM1 may be used - DH1 may be used - 2-DH3 may not be used - 3-DH3 may not be used - 2-DH5 may not be used - 3-DH5 may not be used - > HCI Event: Command Status (0x0f) plen 4 - Change Connection Packet Type (0x01|0x000f) ncmd 1 - Status: Success (0x00) - > HCI Event: Connection Packet Typ.. (0x1d) plen 5 - Status: Success (0x00) - Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) - Packet type: 0x331e - 2-DH1 may not be used - 3-DH1 may not be used - DM1 may be used - DH1 may be used - 2-DH3 may not be used - 3-DH3 may not be used - 2-DH5 may not be used - - Example setting BT_PHY_LE_1M_TX and BT_PHY_LE_1M_RX: - - < HCI Command: LE Set PHY (0x08|0x0032) plen 7 - Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) - All PHYs preference: 0x00 - TX PHYs preference: 0x01 - LE 1M - RX PHYs preference: 0x01 - LE 1M - PHY options preference: Reserved (0x0000) - > HCI Event: Command Status (0x0f) plen 4 - LE Set PHY (0x08|0x0032) ncmd 1 - Status: Success (0x00) - > HCI Event: LE Meta Event (0x3e) plen 6 - LE PHY Update Complete (0x0c) - Status: Success (0x00) - Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) - TX PHY: LE 1M (0x01) - RX PHY: LE 1M (0x01) - - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h -index d46ed9011ee5..89a60919050b 100644 ---- a/include/net/bluetooth/bluetooth.h -+++ b/include/net/bluetooth/bluetooth.h -@@ -130,21 +130,30 @@ struct bt_voice { - #define BT_RCVMTU 13 - #define BT_PHY 14 - --#define BT_PHY_BR_1M_1SLOT 0x00000001 --#define BT_PHY_BR_1M_3SLOT 0x00000002 --#define BT_PHY_BR_1M_5SLOT 0x00000004 --#define BT_PHY_EDR_2M_1SLOT 0x00000008 --#define BT_PHY_EDR_2M_3SLOT 0x00000010 --#define BT_PHY_EDR_2M_5SLOT 0x00000020 --#define BT_PHY_EDR_3M_1SLOT 0x00000040 --#define BT_PHY_EDR_3M_3SLOT 0x00000080 --#define BT_PHY_EDR_3M_5SLOT 0x00000100 --#define BT_PHY_LE_1M_TX 0x00000200 --#define BT_PHY_LE_1M_RX 0x00000400 --#define BT_PHY_LE_2M_TX 0x00000800 --#define BT_PHY_LE_2M_RX 0x00001000 --#define BT_PHY_LE_CODED_TX 0x00002000 --#define BT_PHY_LE_CODED_RX 0x00004000 -+#define BT_PHY_BR_1M_1SLOT BIT(0) -+#define BT_PHY_BR_1M_3SLOT BIT(1) -+#define BT_PHY_BR_1M_5SLOT BIT(2) -+#define BT_PHY_EDR_2M_1SLOT BIT(3) -+#define BT_PHY_EDR_2M_3SLOT BIT(4) -+#define BT_PHY_EDR_2M_5SLOT BIT(5) -+#define BT_PHY_EDR_3M_1SLOT BIT(6) -+#define BT_PHY_EDR_3M_3SLOT BIT(7) -+#define BT_PHY_EDR_3M_5SLOT BIT(8) -+#define BT_PHY_LE_1M_TX BIT(9) -+#define BT_PHY_LE_1M_RX BIT(10) -+#define BT_PHY_LE_2M_TX BIT(11) -+#define BT_PHY_LE_2M_RX BIT(12) -+#define BT_PHY_LE_CODED_TX BIT(13) -+#define BT_PHY_LE_CODED_RX BIT(14) -+ -+#define BT_PHY_BREDR_MASK (BT_PHY_BR_1M_1SLOT | BT_PHY_BR_1M_3SLOT | \ -+ BT_PHY_BR_1M_5SLOT | BT_PHY_EDR_2M_1SLOT | \ -+ BT_PHY_EDR_2M_3SLOT | BT_PHY_EDR_2M_5SLOT | \ -+ BT_PHY_EDR_3M_1SLOT | BT_PHY_EDR_3M_3SLOT | \ -+ BT_PHY_EDR_3M_5SLOT) -+#define BT_PHY_LE_MASK (BT_PHY_LE_1M_TX | BT_PHY_LE_1M_RX | \ -+ BT_PHY_LE_2M_TX | BT_PHY_LE_2M_RX | \ -+ BT_PHY_LE_CODED_TX | BT_PHY_LE_CODED_RX) - - #define BT_MODE 15 - -diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h -index 4a731e1bec53..db76c2d1eeaa 100644 ---- a/include/net/bluetooth/hci.h -+++ b/include/net/bluetooth/hci.h -@@ -1885,6 +1885,15 @@ struct hci_cp_le_set_default_phy { - #define HCI_LE_SET_PHY_2M 0x02 - #define HCI_LE_SET_PHY_CODED 0x04 - -+#define HCI_OP_LE_SET_PHY 0x2032 -+struct hci_cp_le_set_phy { -+ __le16 handle; -+ __u8 all_phys; -+ __u8 tx_phys; -+ __u8 rx_phys; -+ __le16 phy_opts; -+} __packed; -+ - #define HCI_OP_LE_SET_EXT_SCAN_PARAMS 0x2041 - struct hci_cp_le_set_ext_scan_params { - __u8 own_addr_type; -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index a7d5beb01b69..a7bffb908c1e 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -2342,6 +2342,7 @@ void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode); - void *hci_recv_event_data(struct hci_dev *hdev, __u8 event); - - u32 hci_conn_get_phy(struct hci_conn *conn); -+int hci_conn_set_phy(struct hci_conn *conn, u32 phys); - - /* ----- HCI Sockets ----- */ - void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb); -diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h -index 56076bbc981d..73e494b2591d 100644 ---- a/include/net/bluetooth/hci_sync.h -+++ b/include/net/bluetooth/hci_sync.h -@@ -191,3 +191,6 @@ int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn); - int hci_past_sync(struct hci_conn *conn, struct hci_conn *le); - - int hci_le_read_remote_features(struct hci_conn *conn); -+ -+int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type); -+int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys); -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 0f512c2c2fd3..48aaccd35954 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -2958,6 +2958,111 @@ u32 hci_conn_get_phy(struct hci_conn *conn) - return phys; - } - -+static u16 bt_phy_pkt_type(struct hci_conn *conn, u32 phys) -+{ -+ u16 pkt_type = conn->pkt_type; -+ -+ if (phys & BT_PHY_BR_1M_3SLOT) -+ pkt_type |= HCI_DM3 | HCI_DH3; -+ else -+ pkt_type &= ~(HCI_DM3 | HCI_DH3); -+ -+ if (phys & BT_PHY_BR_1M_5SLOT) -+ pkt_type |= HCI_DM5 | HCI_DH5; -+ else -+ pkt_type &= ~(HCI_DM5 | HCI_DH5); -+ -+ if (phys & BT_PHY_EDR_2M_1SLOT) -+ pkt_type &= ~HCI_2DH1; -+ else -+ pkt_type |= HCI_2DH1; -+ -+ if (phys & BT_PHY_EDR_2M_3SLOT) -+ pkt_type &= ~HCI_2DH3; -+ else -+ pkt_type |= HCI_2DH3; -+ -+ if (phys & BT_PHY_EDR_2M_5SLOT) -+ pkt_type &= ~HCI_2DH5; -+ else -+ pkt_type |= HCI_2DH5; -+ -+ if (phys & BT_PHY_EDR_3M_1SLOT) -+ pkt_type &= ~HCI_3DH1; -+ else -+ pkt_type |= HCI_3DH1; -+ -+ if (phys & BT_PHY_EDR_3M_3SLOT) -+ pkt_type &= ~HCI_3DH3; -+ else -+ pkt_type |= HCI_3DH3; -+ -+ if (phys & BT_PHY_EDR_3M_5SLOT) -+ pkt_type &= ~HCI_3DH5; -+ else -+ pkt_type |= HCI_3DH5; -+ -+ return pkt_type; -+} -+ -+static int bt_phy_le_phy(u32 phys, u8 *tx_phys, u8 *rx_phys) -+{ -+ if (!tx_phys || !rx_phys) -+ return -EINVAL; -+ -+ *tx_phys = 0; -+ *rx_phys = 0; -+ -+ if (phys & BT_PHY_LE_1M_TX) -+ *tx_phys |= HCI_LE_SET_PHY_1M; -+ -+ if (phys & BT_PHY_LE_1M_RX) -+ *rx_phys |= HCI_LE_SET_PHY_1M; -+ -+ if (phys & BT_PHY_LE_2M_TX) -+ *tx_phys |= HCI_LE_SET_PHY_2M; -+ -+ if (phys & BT_PHY_LE_2M_RX) -+ *rx_phys |= HCI_LE_SET_PHY_2M; -+ -+ if (phys & BT_PHY_LE_CODED_TX) -+ *tx_phys |= HCI_LE_SET_PHY_CODED; -+ -+ if (phys & BT_PHY_LE_CODED_RX) -+ *rx_phys |= HCI_LE_SET_PHY_CODED; -+ -+ return 0; -+} -+ -+int hci_conn_set_phy(struct hci_conn *conn, u32 phys) -+{ -+ u8 tx_phys, rx_phys; -+ -+ switch (conn->type) { -+ case SCO_LINK: -+ case ESCO_LINK: -+ return -EINVAL; -+ case ACL_LINK: -+ /* Only allow setting BR/EDR PHYs if link type is ACL */ -+ if (phys & ~BT_PHY_BREDR_MASK) -+ return -EINVAL; -+ -+ return hci_acl_change_pkt_type(conn, -+ bt_phy_pkt_type(conn, phys)); -+ case LE_LINK: -+ /* Only allow setting LE PHYs if link type is LE */ -+ if (phys & ~BT_PHY_LE_MASK) -+ return -EINVAL; -+ -+ if (bt_phy_le_phy(phys, &tx_phys, &rx_phys)) -+ return -EINVAL; -+ -+ return hci_le_set_phy(conn, tx_phys, rx_phys); -+ default: -+ return -EINVAL; -+ } -+} -+ - static int abort_conn_sync(struct hci_dev *hdev, void *data) - { - struct hci_conn *conn = data; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 58075bf72055..467710a42d45 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -2869,6 +2869,31 @@ static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status) - hci_dev_unlock(hdev); - } - -+static void hci_cs_le_set_phy(struct hci_dev *hdev, u8 status) -+{ -+ struct hci_cp_le_set_phy *cp; -+ struct hci_conn *conn; -+ -+ bt_dev_dbg(hdev, "status 0x%2.2x", status); -+ -+ if (status) -+ return; -+ -+ cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PHY); -+ if (!cp) -+ return; -+ -+ hci_dev_lock(hdev); -+ -+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle)); -+ if (conn) { -+ conn->le_tx_def_phys = cp->tx_phys; -+ conn->le_rx_def_phys = cp->rx_phys; -+ } -+ -+ hci_dev_unlock(hdev); -+} -+ - static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status) - { - struct hci_cp_le_read_remote_features *cp; -@@ -4359,6 +4384,7 @@ static const struct hci_cs { - HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn), - HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features), - HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc), -+ HCI_CS(HCI_OP_LE_SET_PHY, hci_cs_le_set_phy), - HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn), - HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis), - HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big), -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index c5356a6a3588..4f7f15544393 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -7448,3 +7448,75 @@ int hci_le_read_remote_features(struct hci_conn *conn) - - return err; - } -+ -+static void pkt_type_changed(struct hci_dev *hdev, void *data, int err) -+{ -+ struct hci_cp_change_conn_ptype *cp = data; -+ -+ bt_dev_dbg(hdev, "err %d", err); -+ -+ kfree(cp); -+} -+ -+static int hci_change_conn_ptype_sync(struct hci_dev *hdev, void *data) -+{ -+ struct hci_cp_change_conn_ptype *cp = data; -+ -+ return __hci_cmd_sync_status_sk(hdev, HCI_OP_CHANGE_CONN_PTYPE, -+ sizeof(*cp), cp, -+ HCI_EV_PKT_TYPE_CHANGE, -+ HCI_CMD_TIMEOUT, NULL); -+} -+ -+int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type) -+{ -+ struct hci_dev *hdev = conn->hdev; -+ struct hci_cp_change_conn_ptype *cp; -+ -+ cp = kmalloc(sizeof(*cp), GFP_KERNEL); -+ if (!cp) -+ return -ENOMEM; -+ -+ cp->handle = cpu_to_le16(conn->handle); -+ cp->pkt_type = cpu_to_le16(pkt_type); -+ -+ return hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp, -+ pkt_type_changed); -+} -+ -+static void le_phy_update_complete(struct hci_dev *hdev, void *data, int err) -+{ -+ struct hci_cp_le_set_phy *cp = data; -+ -+ bt_dev_dbg(hdev, "err %d", err); -+ -+ kfree(cp); -+} -+ -+static int hci_le_set_phy_sync(struct hci_dev *hdev, void *data) -+{ -+ struct hci_cp_le_set_phy *cp = data; -+ -+ return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_SET_PHY, -+ sizeof(*cp), cp, -+ HCI_EV_LE_PHY_UPDATE_COMPLETE, -+ HCI_CMD_TIMEOUT, NULL); -+} -+ -+int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys) -+{ -+ struct hci_dev *hdev = conn->hdev; -+ struct hci_cp_le_set_phy *cp; -+ -+ cp = kmalloc(sizeof(*cp), GFP_KERNEL); -+ if (!cp) -+ return -ENOMEM; -+ -+ memset(cp, 0, sizeof(*cp)); -+ cp->handle = cpu_to_le16(conn->handle); -+ cp->tx_phys = tx_phys; -+ cp->rx_phys = rx_phys; -+ -+ return hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp, -+ le_phy_update_complete); -+} -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index bca8f9b62fac..82dab62616d0 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -885,7 +885,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, - struct bt_power pwr; - struct l2cap_conn *conn; - int err = 0; -- u32 opt; -+ u32 opt, phys; - u16 mtu; - u8 mode; - -@@ -1066,6 +1066,24 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, - - break; - -+ case BT_PHY: -+ if (sk->sk_state != BT_CONNECTED) { -+ err = -ENOTCONN; -+ break; -+ } -+ -+ err = copy_safe_from_sockptr(&phys, sizeof(phys), optval, -+ optlen); -+ if (err) -+ break; -+ -+ if (!chan->conn) -+ break; -+ -+ conn = chan->conn; -+ err = hci_conn_set_phy(conn->hcon, phys); -+ break; -+ - case BT_MODE: - if (!enable_ecred) { - err = -ENOPROTOOPT; --- -2.50.1 (Apple Git-155) - diff --git a/1280-bluetooth-hci-sync-hci-cmd-sync-queue-once-return-eexist-if-.patch b/1280-bluetooth-hci-sync-hci-cmd-sync-queue-once-return-eexist-if-.patch deleted file mode 100644 index 79c06383f..000000000 --- a/1280-bluetooth-hci-sync-hci-cmd-sync-queue-once-return-eexist-if-.patch +++ /dev/null @@ -1,180 +0,0 @@ -From 73744f2131d220b7c5f7571863c45381764f4559 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Wed, 15 Apr 2026 23:57:05 -0500 -Subject: [PATCH] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST - if exists - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit 2969554bcfccb5c609f6b6cd4a014933f3a66dd0 -Author: Pauli Virtanen -Date: Wed Mar 25 21:07:43 2026 +0200 - - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists - - hci_cmd_sync_queue_once() needs to indicate whether a queue item was - added, so caller can know if callbacks are called, so it can avoid - leaking resources. - - Change the function to return -EEXIST if queue item already exists. - - Modify all callsites to handle that. - - Signed-off-by: Pauli Virtanen - Signed-off-by: Luiz Augusto von Dentz - -Conflicts: Context difference due to missing tree-wide changes: - bf4afc53b77ae Convert 'alloc_obj' family to use the new default GFP_KERNEL argument - 69050f8d6d075 treewide: Replace kmalloc with kmalloc_obj for non-scalar types - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index 4f7f15544393..6291e1ce61f4 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -780,7 +780,7 @@ int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, - void *data, hci_cmd_sync_work_destroy_t destroy) - { - if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) -- return 0; -+ return -EEXIST; - - return hci_cmd_sync_queue(hdev, func, data, destroy); - } -@@ -3255,6 +3255,8 @@ static int update_passive_scan_sync(struct hci_dev *hdev, void *data) - - int hci_update_passive_scan(struct hci_dev *hdev) - { -+ int err; -+ - /* Only queue if it would have any effect */ - if (!test_bit(HCI_UP, &hdev->flags) || - test_bit(HCI_INIT, &hdev->flags) || -@@ -3264,8 +3266,9 @@ int hci_update_passive_scan(struct hci_dev *hdev) - hci_dev_test_flag(hdev, HCI_UNREGISTER)) - return 0; - -- return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, -- NULL); -+ err = hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, -+ NULL); -+ return (err == -EEXIST) ? 0 : err; - } - - int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) -@@ -6958,8 +6961,11 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) - - int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) - { -- return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, -- NULL); -+ int err; -+ -+ err = hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, -+ NULL); -+ return (err == -EEXIST) ? 0 : err; - } - - static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) -@@ -6995,8 +7001,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) - - int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) - { -- return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, -- create_le_conn_complete); -+ int err; -+ -+ err = hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, -+ create_le_conn_complete); -+ return (err == -EEXIST) ? 0 : err; - } - - int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) -@@ -7203,8 +7212,11 @@ static int hci_le_pa_create_sync(struct hci_dev *hdev, void *data) - - int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn) - { -- return hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, conn, -- create_pa_complete); -+ int err; -+ -+ err = hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, conn, -+ create_pa_complete); -+ return (err == -EEXIST) ? 0 : err; - } - - static void create_big_complete(struct hci_dev *hdev, void *data, int err) -@@ -7266,8 +7278,11 @@ static int hci_le_big_create_sync(struct hci_dev *hdev, void *data) - - int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn) - { -- return hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn, -- create_big_complete); -+ int err; -+ -+ err = hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn, -+ create_big_complete); -+ return (err == -EEXIST) ? 0 : err; - } - - struct past_data { -@@ -7359,7 +7374,7 @@ int hci_past_sync(struct hci_conn *conn, struct hci_conn *le) - if (err) - kfree(data); - -- return err; -+ return (err == -EEXIST) ? 0 : err; - } - - static void le_read_features_complete(struct hci_dev *hdev, void *data, int err) -@@ -7446,7 +7461,7 @@ int hci_le_read_remote_features(struct hci_conn *conn) - else - err = -EOPNOTSUPP; - -- return err; -+ return (err == -EEXIST) ? 0 : err; - } - - static void pkt_type_changed(struct hci_dev *hdev, void *data, int err) -@@ -7472,6 +7487,7 @@ int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type) - { - struct hci_dev *hdev = conn->hdev; - struct hci_cp_change_conn_ptype *cp; -+ int err; - - cp = kmalloc(sizeof(*cp), GFP_KERNEL); - if (!cp) -@@ -7480,8 +7496,9 @@ int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type) - cp->handle = cpu_to_le16(conn->handle); - cp->pkt_type = cpu_to_le16(pkt_type); - -- return hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp, -- pkt_type_changed); -+ err = hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp, -+ pkt_type_changed); -+ return (err == -EEXIST) ? 0 : err; - } - - static void le_phy_update_complete(struct hci_dev *hdev, void *data, int err) -@@ -7507,6 +7524,7 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys) - { - struct hci_dev *hdev = conn->hdev; - struct hci_cp_le_set_phy *cp; -+ int err; - - cp = kmalloc(sizeof(*cp), GFP_KERNEL); - if (!cp) -@@ -7517,6 +7535,7 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys) - cp->tx_phys = tx_phys; - cp->rx_phys = rx_phys; - -- return hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp, -- le_phy_update_complete); -+ err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp, -+ le_phy_update_complete); -+ return (err == -EEXIST) ? 0 : err; - } --- -2.50.1 (Apple Git-155) - diff --git a/1281-bluetooth-hci-sync-fix-leaks-when-hci-cmd-sync-queue-once-fa.patch b/1281-bluetooth-hci-sync-fix-leaks-when-hci-cmd-sync-queue-once-fa.patch deleted file mode 100644 index 17088d3b9..000000000 --- a/1281-bluetooth-hci-sync-fix-leaks-when-hci-cmd-sync-queue-once-fa.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 3eed784fc3a9e5477b2948a4fa33f6ce32c33319 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Thu, 16 Apr 2026 00:04:46 -0500 -Subject: [PATCH] Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once - fails - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit aca377208e7f7322bf4e107cdec6e7d7e8aa7a88 -Author: Pauli Virtanen -Date: Wed Mar 25 21:07:44 2026 +0200 - - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails - - When hci_cmd_sync_queue_once() returns with error, the destroy callback - will not be called. - - Fix leaking references / memory on these failures. - - Signed-off-by: Pauli Virtanen - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index 6291e1ce61f4..cac7a8078795 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -7453,13 +7453,16 @@ int hci_le_read_remote_features(struct hci_conn *conn) - * role is possible. Otherwise just transition into the - * connected state without requesting the remote features. - */ -- if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) -+ if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) { - err = hci_cmd_sync_queue_once(hdev, - hci_le_read_remote_features_sync, - hci_conn_hold(conn), - le_read_features_complete); -- else -+ if (err) -+ hci_conn_drop(conn); -+ } else { - err = -EOPNOTSUPP; -+ } - - return (err == -EEXIST) ? 0 : err; - } -@@ -7498,6 +7501,9 @@ int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type) - - err = hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp, - pkt_type_changed); -+ if (err) -+ kfree(cp); -+ - return (err == -EEXIST) ? 0 : err; - } - -@@ -7537,5 +7543,8 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys) - - err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp, - le_phy_update_complete); -+ if (err) -+ kfree(cp); -+ - return (err == -EEXIST) ? 0 : err; - } --- -2.50.1 (Apple Git-155) - diff --git a/1282-bluetooth-hci-sync-fix-uaf-in-le-read-features-complete.patch b/1282-bluetooth-hci-sync-fix-uaf-in-le-read-features-complete.patch deleted file mode 100644 index 9fc9acdf4..000000000 --- a/1282-bluetooth-hci-sync-fix-uaf-in-le-read-features-complete.patch +++ /dev/null @@ -1,243 +0,0 @@ -From b4a37eb54b3d79e24a8ad9cd4a58baecef81189a Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Thu, 16 Apr 2026 00:04:53 -0500 -Subject: [PATCH] Bluetooth: hci_sync: Fix UAF in le_read_features_complete - -JIRA: https://issues.redhat.com/browse/RHEL-157827 - -commit 035c25007c9e698bef3826070ee34bb6d778020c -Author: Luiz Augusto von Dentz -Date: Wed Mar 25 11:11:46 2026 -0400 - - Bluetooth: hci_sync: Fix UAF in le_read_features_complete - - This fixes the following backtrace caused by hci_conn being freed - before le_read_features_complete but after - hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue - is not able to prevent it: - - ================================================================== - BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] - BUG: KASAN: slab-use-after-free in atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline] - BUG: KASAN: slab-use-after-free in hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline] - BUG: KASAN: slab-use-after-free in le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344 - Write of size 4 at addr ffff8880796b0010 by task kworker/u9:0/52 - - CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) - Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 - Workqueue: hci0 hci_cmd_sync_work - Call Trace: - - __dump_stack lib/dump_stack.c:94 [inline] - dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 - print_address_description mm/kasan/report.c:378 [inline] - print_report+0xcd/0x630 mm/kasan/report.c:482 - kasan_report+0xe0/0x110 mm/kasan/report.c:595 - check_region_inline mm/kasan/generic.c:194 [inline] - kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200 - instrument_atomic_read_write include/linux/instrumented.h:96 [inline] - atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline] - hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline] - le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344 - hci_cmd_sync_work+0x1ff/0x430 net/bluetooth/hci_sync.c:334 - process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 - process_scheduled_works kernel/workqueue.c:3340 [inline] - worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 - kthread+0x3c5/0x780 kernel/kthread.c:463 - ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 - ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 - - - Allocated by task 5932: - kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 - kasan_save_track+0x14/0x30 mm/kasan/common.c:77 - poison_kmalloc_redzone mm/kasan/common.c:400 [inline] - __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:417 - kmalloc_noprof include/linux/slab.h:957 [inline] - kzalloc_noprof include/linux/slab.h:1094 [inline] - __hci_conn_add+0xf8/0x1c70 net/bluetooth/hci_conn.c:963 - hci_conn_add_unset+0x76/0x100 net/bluetooth/hci_conn.c:1084 - le_conn_complete_evt+0x639/0x1f20 net/bluetooth/hci_event.c:5714 - hci_le_enh_conn_complete_evt+0x23d/0x380 net/bluetooth/hci_event.c:5861 - hci_le_meta_evt+0x357/0x5e0 net/bluetooth/hci_event.c:7408 - hci_event_func net/bluetooth/hci_event.c:7716 [inline] - hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7773 - hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076 - process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 - process_scheduled_works kernel/workqueue.c:3340 [inline] - worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 - kthread+0x3c5/0x780 kernel/kthread.c:463 - ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 - ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 - - Freed by task 5932: - kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 - kasan_save_track+0x14/0x30 mm/kasan/common.c:77 - __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587 - kasan_save_free_info mm/kasan/kasan.h:406 [inline] - poison_slab_object mm/kasan/common.c:252 [inline] - __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284 - kasan_slab_free include/linux/kasan.h:234 [inline] - slab_free_hook mm/slub.c:2540 [inline] - slab_free mm/slub.c:6663 [inline] - kfree+0x2f8/0x6e0 mm/slub.c:6871 - device_release+0xa4/0x240 drivers/base/core.c:2565 - kobject_cleanup lib/kobject.c:689 [inline] - kobject_release lib/kobject.c:720 [inline] - kref_put include/linux/kref.h:65 [inline] - kobject_put+0x1e7/0x590 lib/kobject.c:737 - put_device drivers/base/core.c:3797 [inline] - device_unregister+0x2f/0xc0 drivers/base/core.c:3920 - hci_conn_del_sysfs+0xb4/0x180 net/bluetooth/hci_sysfs.c:79 - hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline] - hci_conn_del+0x657/0x1180 net/bluetooth/hci_conn.c:1234 - hci_disconn_complete_evt+0x410/0xa00 net/bluetooth/hci_event.c:3451 - hci_event_func net/bluetooth/hci_event.c:7719 [inline] - hci_event_packet+0xa10/0x11c0 net/bluetooth/hci_event.c:7773 - hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076 - process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 - process_scheduled_works kernel/workqueue.c:3340 [inline] - worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 - kthread+0x3c5/0x780 kernel/kthread.c:463 - ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 - ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 - - The buggy address belongs to the object at ffff8880796b0000 - which belongs to the cache kmalloc-8k of size 8192 - The buggy address is located 16 bytes inside of - freed 8192-byte region [ffff8880796b0000, ffff8880796b2000) - - The buggy address belongs to the physical page: - page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x796b0 - head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 - anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) - page_type: f5(slab) - raw: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001 - raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 - head: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001 - head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 - head: 00fff00000000003 ffffea0001e5ac01 00000000ffffffff 00000000ffffffff - head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 - page dumped because: kasan: bad access detected - page_owner tracks the page as allocated - page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5657, tgid 5657 (dhcpcd-run-hook), ts 79819636908, free_ts 79814310558 - set_page_owner include/linux/page_owner.h:32 [inline] - post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1845 - prep_new_page mm/page_alloc.c:1853 [inline] - get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3879 - __alloc_frozen_pages_noprof+0x25f/0x2440 mm/page_alloc.c:5183 - alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416 - alloc_slab_page mm/slub.c:3075 [inline] - allocate_slab mm/slub.c:3248 [inline] - new_slab+0x2c3/0x430 mm/slub.c:3302 - ___slab_alloc+0xe18/0x1c90 mm/slub.c:4651 - __slab_alloc.constprop.0+0x63/0x110 mm/slub.c:4774 - __slab_alloc_node mm/slub.c:4850 [inline] - slab_alloc_node mm/slub.c:5246 [inline] - __kmalloc_cache_noprof+0x477/0x800 mm/slub.c:5766 - kmalloc_noprof include/linux/slab.h:957 [inline] - kzalloc_noprof include/linux/slab.h:1094 [inline] - tomoyo_print_bprm security/tomoyo/audit.c:26 [inline] - tomoyo_init_log+0xc8a/0x2140 security/tomoyo/audit.c:264 - tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198 - tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] - tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63 - tomoyo_environ security/tomoyo/domain.c:672 [inline] - tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888 - tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline] - tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92 - security_bprm_check+0x1b9/0x1e0 security/security.c:794 - search_binary_handler fs/exec.c:1659 [inline] - exec_binprm fs/exec.c:1701 [inline] - bprm_execve fs/exec.c:1753 [inline] - bprm_execve+0x81e/0x1620 fs/exec.c:1729 - do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859 - page last free pid 5657 tgid 5657 stack trace: - reset_page_owner include/linux/page_owner.h:25 [inline] - free_pages_prepare mm/page_alloc.c:1394 [inline] - __free_frozen_pages+0x7df/0x1160 mm/page_alloc.c:2901 - discard_slab mm/slub.c:3346 [inline] - __put_partials+0x130/0x170 mm/slub.c:3886 - qlink_free mm/kasan/quarantine.c:163 [inline] - qlist_free_all+0x4c/0xf0 mm/kasan/quarantine.c:179 - kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286 - __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:352 - kasan_slab_alloc include/linux/kasan.h:252 [inline] - slab_post_alloc_hook mm/slub.c:4948 [inline] - slab_alloc_node mm/slub.c:5258 [inline] - __kmalloc_cache_noprof+0x274/0x800 mm/slub.c:5766 - kmalloc_noprof include/linux/slab.h:957 [inline] - tomoyo_print_header security/tomoyo/audit.c:156 [inline] - tomoyo_init_log+0x197/0x2140 security/tomoyo/audit.c:255 - tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198 - tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] - tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63 - tomoyo_environ security/tomoyo/domain.c:672 [inline] - tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888 - tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline] - tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92 - security_bprm_check+0x1b9/0x1e0 security/security.c:794 - search_binary_handler fs/exec.c:1659 [inline] - exec_binprm fs/exec.c:1701 [inline] - bprm_execve fs/exec.c:1753 [inline] - bprm_execve+0x81e/0x1620 fs/exec.c:1729 - do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859 - do_execve fs/exec.c:1933 [inline] - __do_sys_execve fs/exec.c:2009 [inline] - __se_sys_execve fs/exec.c:2004 [inline] - __x64_sys_execve+0x8e/0xb0 fs/exec.c:2004 - do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] - do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 - - Memory state around the buggy address: - ffff8880796aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - ffff8880796aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - >ffff8880796b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ^ - ffff8880796b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ffff8880796b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ================================================================== - - Fixes: a106e50be74b ("Bluetooth: HCI: Add support for LL Extended Feature Set") - Reported-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com - Tested-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com - Closes: https://syzbot.org/bug?extid=87badbb9094e008e0685 - Signed-off-by: Luiz Augusto von Dentz - Signed-off-by: Pauli Virtanen - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index cac7a8078795..5101efc6a0e4 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -7383,10 +7383,8 @@ static void le_read_features_complete(struct hci_dev *hdev, void *data, int err) - - bt_dev_dbg(hdev, "err %d", err); - -- if (err == -ECANCELED) -- return; -- - hci_conn_drop(conn); -+ hci_conn_put(conn); - } - - static int hci_le_read_all_remote_features_sync(struct hci_dev *hdev, -@@ -7456,10 +7454,12 @@ int hci_le_read_remote_features(struct hci_conn *conn) - if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) { - err = hci_cmd_sync_queue_once(hdev, - hci_le_read_remote_features_sync, -- hci_conn_hold(conn), -+ hci_conn_hold(hci_conn_get(conn)), - le_read_features_complete); -- if (err) -+ if (err) { - hci_conn_drop(conn); -+ hci_conn_put(conn); -+ } - } else { - err = -EOPNOTSUPP; - } --- -2.50.1 (Apple Git-155) - diff --git a/1283-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch b/1283-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch deleted file mode 100644 index a66092e5e..000000000 --- a/1283-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 1f16a5989467930fa2a1bf222fdc20207b917c50 Mon Sep 17 00:00:00 2001 -From: Olga Kornievskaia -Date: Thu, 19 Mar 2026 10:00:42 -0400 -Subject: [PATCH] pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - -JIRA: https://issues.redhat.com/browse/RHEL-157444 - -commit 5248d8474e594d156bee1ed10339cc16e207a28b -Author: Olga Kornievskaia -Date: Mon Jan 26 14:15:39 2026 -0500 - - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - - It is possible to have a task get stuck on waiting on the - NFS_LAYOUT_DRAIN in the following scenario - - 1. cpu a: waiter test NFS_LAYOUT_DRAIN (1) and plh_outstanding (1) - 2. cpu b: atomic_dec_and_test() -> clear bit -> wake up - 3. cpu c: sets NFS_LAYOUT_DRAIN again - 4. cpu a: calls wait_on_bit() sleeps forever. - - To expand on this we have say 2 outstanding pnfs write IO that get - ESTALE which causes both to call pnfs_destroy_layout() and set the - NFS_LAYOUT_DRAIN bit but the 1st one doesn't call the - pnfs_put_layout_hdr() yet (as that would prevent the 2nd ESTALE write - from trying to call pnfs_destroy_layout()). If the 1st ESTALE write - is the one that initially sets the NFS_LAYOUT_DRAIN so that new IO - on this file initiates new LAYOUTGET. Another new write would find - NFS_LAYOUT_DRAIN set and phl_outstanding>0 (step 1) and would - wait_on_bit(). LAYOUTGET completes doing step 2. Now, the 2nd of - ESTALE writes is calling pnfs_destory_layout() and set the - NFS_LAYOUT_DRAIN bit (step 3). Finally, the waiting write wakes up - to check the bit and goes back to sleep. - - The problem revolves around the fact that if NFS_LAYOUT_INVALID_STID - was already set, it should not do the work of - pnfs_mark_layout_stateid_invalid(), thus NFS_LAYOUT_DRAIN will not - be set more than once for an invalid layout. - - Suggested-by: Trond Myklebust - Fixes: 880265c77ac4 ("pNFS: Avoid a live lock condition in pnfs_update_layout()") - Signed-off-by: Olga Kornievskaia - Signed-off-by: Anna Schumaker - -Signed-off-by: Olga Kornievskaia - -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 33bc6db0dc92..b3cb5ee9d821 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -463,7 +463,8 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo, - }; - struct pnfs_layout_segment *lseg, *next; - -- set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags); -+ if (test_and_set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) -+ return !list_empty(&lo->plh_segs); - clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(lo->plh_inode)->flags); - list_for_each_entry_safe(lseg, next, &lo->plh_segs, pls_list) - pnfs_clear_lseg_state(lseg, lseg_list); --- -2.50.1 (Apple Git-155) - diff --git a/1284-smb-client-fix-oob-reads-parsing-symlink-error-response.patch b/1284-smb-client-fix-oob-reads-parsing-symlink-error-response.patch deleted file mode 100644 index 114aa5bac..000000000 --- a/1284-smb-client-fix-oob-reads-parsing-symlink-error-response.patch +++ /dev/null @@ -1,123 +0,0 @@ -From 33e2b5cdb5bd48ccb14dd2e4db98bc07d209dc70 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 28 Apr 2026 12:03:58 +0000 -Subject: [PATCH] smb: client: fix OOB reads parsing symlink error response - -JIRA: https://redhat.atlassian.net/browse/RHEL-171476 -CVE: CVE-2026-31613 - -commit 3df690bba28edec865cf7190be10708ad0ddd67e -Author: Greg Kroah-Hartman -Date: Mon Apr 6 15:49:38 2026 +0200 - - smb: client: fix OOB reads parsing symlink error response - - When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() - returns success without any length validation, leaving the symlink - parsers as the only defense against an untrusted server. - - symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < - end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset - 0. When the server-controlled ErrorDataLength advances p to within 1-7 - bytes of end, the next iteration will read past it. When the matching - context is found, sym->SymLinkErrorTag is read at offset 4 from - p->ErrorContextData with no check that the symlink header itself fits. - - smb2_parse_symlink_response() then bounds-checks the substitute name - using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from - iov_base. That value is computed as sizeof(smb2_err_rsp) + - sizeof(smb2_symlink_err_rsp), which is correct only when - ErrorContextCount == 0. - - With at least one error context the symlink data sits 8 bytes deeper, - and each skipped non-matching context shifts it further by 8 + - ALIGN(ErrorDataLength, 8). The check is too short, allowing the - substitute name read to run past iov_len. The out-of-bound heap bytes - are UTF-16-decoded into the symlink target and returned to userspace via - readlink(2). - - Fix this all up by making the loops test require the full context header - to fit, rejecting sym if its header runs past end, and bound the - substitute name against the actual position of sym->PathBuffer rather - than a fixed offset. - - Because sub_offs and sub_len are 16bits, the pointer math will not - overflow here with the new greater-than. - - Cc: Ronnie Sahlberg - Cc: Shyam Prasad N - Cc: Tom Talpey - Cc: Bharath SM - Cc: linux-cifs@vger.kernel.org - Cc: samba-technical@lists.samba.org - Cc: stable - Reviewed-by: Paulo Alcantara (Red Hat) - Assisted-by: gregkh_clanker_t1000 - Signed-off-by: Greg Kroah-Hartman - Signed-off-by: Steve French - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c -index 1f7f284a7844..b2ddcecd00b9 100644 ---- a/fs/smb/client/smb2file.c -+++ b/fs/smb/client/smb2file.c -@@ -27,10 +27,11 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov) - { - struct smb2_err_rsp *err = iov->iov_base; - struct smb2_symlink_err_rsp *sym = ERR_PTR(-EINVAL); -+ u8 *end = (u8 *)err + iov->iov_len; - u32 len; - - if (err->ErrorContextCount) { -- struct smb2_error_context_rsp *p, *end; -+ struct smb2_error_context_rsp *p; - - len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp, - ErrorContextData) + -@@ -39,8 +40,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov) - return ERR_PTR(-EINVAL); - - p = (struct smb2_error_context_rsp *)err->ErrorData; -- end = (struct smb2_error_context_rsp *)((u8 *)err + iov->iov_len); -- do { -+ while ((u8 *)p + sizeof(*p) <= end) { - if (le32_to_cpu(p->ErrorId) == SMB2_ERROR_ID_DEFAULT) { - sym = (struct smb2_symlink_err_rsp *)p->ErrorContextData; - break; -@@ -50,14 +50,16 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov) - - len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8); - p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len); -- } while (p < end); -+ } - } else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) && - iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) { - sym = (struct smb2_symlink_err_rsp *)err->ErrorData; - } - -- if (!IS_ERR(sym) && (le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG || -- le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK)) -+ if (!IS_ERR(sym) && -+ ((u8 *)sym + sizeof(*sym) > end || -+ le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG || -+ le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK)) - sym = ERR_PTR(-EINVAL); - - return sym; -@@ -128,8 +130,10 @@ int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec - print_len = le16_to_cpu(sym->PrintNameLength); - print_offs = le16_to_cpu(sym->PrintNameOffset); - -- if (iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + sub_offs + sub_len || -- iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + print_offs + print_len) -+ if ((char *)sym->PathBuffer + sub_offs + sub_len > -+ (char *)iov->iov_base + iov->iov_len || -+ (char *)sym->PathBuffer + print_offs + print_len > -+ (char *)iov->iov_base + iov->iov_len) - return -EINVAL; - - return smb2_parse_native_symlink(path, --- -2.50.1 (Apple Git-155) - diff --git a/1285-sched-deadline-fix-dl-server-time-accounting.patch b/1285-sched-deadline-fix-dl-server-time-accounting.patch deleted file mode 100644 index 405ef2d28..000000000 --- a/1285-sched-deadline-fix-dl-server-time-accounting.patch +++ /dev/null @@ -1,164 +0,0 @@ - -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index 350c202..3645a12 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -1166,8 +1166,12 @@ static enum hrtimer_restart dl_server_timer(struct hrtimer *timer, struct sched_ - sched_clock_tick(); - update_rq_clock(rq); - -- if (!dl_se->dl_runtime) -- return HRTIMER_NORESTART; -+ /* -+ * Make sure current has propagated its pending runtime into -+ * any relevant server through calling dl_server_update() and -+ * friends. -+ */ -+ rq->donor->sched_class->update_curr(rq); - - if (dl_se->dl_defer_armed) { - /* -@@ -1543,35 +1547,16 @@ static void update_curr_dl_se(struct rq *rq, struct sched_dl_entity *dl_se, s64 - * as time available for the fair server, avoiding a penalty for the - * rt scheduler that did not consumed that time. - */ --void dl_server_update_idle_time(struct rq *rq, struct task_struct *p) -+void dl_server_update_idle(struct sched_dl_entity *dl_se, s64 delta_exec) - { -- s64 delta_exec; -- -- if (!rq->fair_server.dl_defer) -- return; -- -- /* no need to discount more */ -- if (rq->fair_server.runtime < 0) -- return; -- -- delta_exec = rq_clock_task(rq) - p->se.exec_start; -- if (delta_exec < 0) -- return; -- -- rq->fair_server.runtime -= delta_exec; -- -- if (rq->fair_server.runtime < 0) { -- rq->fair_server.dl_defer_running = 0; -- rq->fair_server.runtime = 0; -- } -- -- p->se.exec_start = rq_clock_task(rq); -+ if (dl_se->dl_server_active && dl_se->dl_runtime && dl_se->dl_defer) -+ update_curr_dl_se(dl_se->rq, dl_se, delta_exec); - } - - void dl_server_update(struct sched_dl_entity *dl_se, s64 delta_exec) - { - /* 0 runtime = fair server disabled */ -- if (dl_se->dl_runtime) -+ if (dl_se->dl_server_active && dl_se->dl_runtime) - update_curr_dl_se(dl_se->rq, dl_se, delta_exec); - } - -@@ -1582,6 +1567,11 @@ void dl_server_start(struct sched_dl_entity *dl_se) - if (!dl_server(dl_se) || dl_se->dl_server_active) - return; - -+ /* -+ * Update the current task to 'now'. -+ */ -+ rq->donor->sched_class->update_curr(rq); -+ - if (WARN_ON_ONCE(!cpu_online(cpu_of(rq)))) - return; - -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index a135883..6e4e7b5 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -1233,8 +1233,7 @@ static void update_curr(struct cfs_rq *cfs_rq) - * against fair_server such that it can account for this time - * and possibly avoid running this period. - */ -- if (dl_server_active(&rq->fair_server)) -- dl_server_update(&rq->fair_server, delta_exec); -+ dl_server_update(&rq->fair_server, delta_exec); - } - - account_cfs_rq_runtime(cfs_rq, delta_exec); -@@ -7001,12 +7000,8 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags) - h_nr_idle = 1; - } - -- if (!rq_h_nr_queued && rq->cfs.h_nr_queued) { -- /* Account for idle runtime */ -- if (!rq->nr_running) -- dl_server_update_idle_time(rq, rq->curr); -+ if (!rq_h_nr_queued && rq->cfs.h_nr_queued) - dl_server_start(&rq->fair_server); -- } - - /* At this point se is NULL and we are at root level*/ - add_nr_running(rq, 1); -diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c -index c39b089..e8cbba8 100644 ---- a/kernel/sched/idle.c -+++ b/kernel/sched/idle.c -@@ -452,9 +452,11 @@ static void wakeup_preempt_idle(struct rq *rq, struct task_struct *p, int flags) - resched_curr(rq); - } - -+static void update_curr_idle(struct rq *rq); -+ - static void put_prev_task_idle(struct rq *rq, struct task_struct *prev, struct task_struct *next) - { -- dl_server_update_idle_time(rq, prev); -+ update_curr_idle(rq); - scx_update_idle(rq, false, true); - } - -@@ -496,6 +498,7 @@ dequeue_task_idle(struct rq *rq, struct task_struct *p, int flags) - */ - static void task_tick_idle(struct rq *rq, struct task_struct *curr, int queued) - { -+ update_curr_idle(rq); - } - - static void switched_to_idle(struct rq *rq, struct task_struct *p) -@@ -511,6 +514,17 @@ prio_changed_idle(struct rq *rq, struct task_struct *p, int oldprio) - - static void update_curr_idle(struct rq *rq) - { -+ struct sched_entity *se = &rq->idle->se; -+ u64 now = rq_clock_task(rq); -+ s64 delta_exec; -+ -+ delta_exec = now - se->exec_start; -+ if (unlikely(delta_exec <= 0)) -+ return; -+ -+ se->exec_start = now; -+ -+ dl_server_update_idle(&rq->fair_server, delta_exec); - } - - /* -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 5461e9a..34813e3 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -406,6 +406,7 @@ extern s64 dl_scaled_delta_exec(struct rq *rq, struct sched_dl_entity *dl_se, s6 - * naturally thottled to once per period, avoiding high context switch - * workloads from spamming the hrtimer program/cancel paths. - */ -+extern void dl_server_update_idle(struct sched_dl_entity *dl_se, s64 delta_exec); - extern void dl_server_update(struct sched_dl_entity *dl_se, s64 delta_exec); - extern void dl_server_start(struct sched_dl_entity *dl_se); - extern void dl_server_stop(struct sched_dl_entity *dl_se); -@@ -413,8 +414,6 @@ extern void dl_server_init(struct sched_dl_entity *dl_se, struct rq *rq, - dl_server_pick_f pick_task); - extern void sched_init_dl_servers(void); - --extern void dl_server_update_idle_time(struct rq *rq, -- struct task_struct *p); - extern void fair_server_init(struct rq *rq); - extern void __dl_server_attach_root(struct sched_dl_entity *dl_se, struct rq *rq); - extern int dl_server_apply_params(struct sched_dl_entity *dl_se, diff --git a/1286-redhat-configs-automotive-disable-config-io-uring.patch b/1286-redhat-configs-automotive-disable-config-io-uring.patch deleted file mode 100644 index b7c2785c3..000000000 --- a/1286-redhat-configs-automotive-disable-config-io-uring.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 65d0f5264af85b67546a34dc94b9b7778ed50e89 Mon Sep 17 00:00:00 2001 -From: Brian Masney -Date: Wed, 20 May 2026 13:50:28 -0400 -Subject: [PATCH] redhat/configs: automotive: disable CONFIG_IO_URING - -JIRA: https://redhat.atlassian.net/browse/RHEL-178183 -Upstream-status: RHEL-only - -Disable CONFIG_IO_URING, and the dependency CONFIG_BLK_DEV_UBLK, since -IO uring is currently not in supported at the moment in automotive. - -Signed-off-by: Brian Masney - -diff --git a/redhat/configs/rhel/automotive/generic/CONFIG_BLK_DEV_UBLK b/redhat/configs/rhel/automotive/generic/CONFIG_BLK_DEV_UBLK -new file mode 100644 -index 000000000000..f773891a920f ---- /dev/null -+++ b/redhat/configs/rhel/automotive/generic/CONFIG_BLK_DEV_UBLK -@@ -0,0 +1 @@ -+# CONFIG_BLK_DEV_UBLK is not set -diff --git a/redhat/configs/rhel/automotive/generic/CONFIG_IO_URING b/redhat/configs/rhel/automotive/generic/CONFIG_IO_URING -new file mode 100644 -index 000000000000..dcae2b3a1327 ---- /dev/null -+++ b/redhat/configs/rhel/automotive/generic/CONFIG_IO_URING -@@ -0,0 +1 @@ -+# CONFIG_IO_URING is not set --- -2.50.1 (Apple Git-155) - diff --git a/1287-rhel-kabi-dpll-adaptation.patch b/1287-rhel-kabi-dpll-adaptation.patch deleted file mode 100644 index 0f03229b0..000000000 --- a/1287-rhel-kabi-dpll-adaptation.patch +++ /dev/null @@ -1,121 +0,0 @@ -Subject: [PATCH] dpll: RHEL 10.2 kABI adaptation (RH_KABI_USE/REPLACE + ffo backward-compat) -# RHEL-z-stream-specific kABI wrapping of the dpll feature additions (0015/0026/0028). -# No CS10/upstream commit produces this exact kABI form; reconstructed to match RHEL. - -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index 00e8696..edd5967 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -424,7 +424,13 @@ static int dpll_msg_add_ffo(struct sk_buff *msg, struct dpll_pin *pin, - struct dpll_ffo_param ffo = { .type = type }; - int ret; - -- if (!ops->ffo_get || !(ops->supported_ffo & BIT(type))) -+ /* RHEL: To maintain backward compatibility with older binary modules, -+ * we must accept a value of zero for .supported_ffo when the type is -+ * DPLL_FFO_PORT_RXTX_RATE. -+ */ -+ if (!ops->ffo_get || -+ !((ops->supported_ffo & BIT(type)) || -+ (!ops->supported_ffo && type == DPLL_FFO_PORT_RXTX_RATE))) - return 0; - ret = ops->ffo_get(pin, dpll_pin_on_dpll_priv(ref->dpll, pin), - ref->dpll, dpll_priv(ref->dpll), &ffo, extack); -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index cd21b1f..d988c09 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -54,15 +54,13 @@ struct dpll_device_ops { - int (*phase_offset_avg_factor_get)(const struct dpll_device *dpll, - void *dpll_priv, u32 *factor, - struct netlink_ext_ack *extack); -- int (*freq_monitor_set)(const struct dpll_device *dpll, void *dpll_priv, -+ -+ RH_KABI_USE(1, int (*freq_monitor_set)(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_feature_state state, -- struct netlink_ext_ack *extack); -- int (*freq_monitor_get)(const struct dpll_device *dpll, void *dpll_priv, -+ struct netlink_ext_ack *extack)) -+ RH_KABI_USE(2, int (*freq_monitor_get)(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_feature_state *state, -- struct netlink_ext_ack *extack); -- -- RH_KABI_RESERVE(1) -- RH_KABI_RESERVE(2) -+ struct netlink_ext_ack *extack)) - RH_KABI_RESERVE(3) - RH_KABI_RESERVE(4) - RH_KABI_RESERVE(5) -@@ -80,13 +78,16 @@ enum dpll_ffo_type { - __DPLL_FFO_TYPE_MAX, - }; - -+/* RHEL: we have to keep 'ffo' field to be first to preserve compatibility -+ * with older .ffo_get() callbacks that accepts 's64 *' as parameter instead -+ * of 'struct dpll_ffo_param *' -+ */ - struct dpll_ffo_param { -- enum dpll_ffo_type type; - s64 ffo; -+ enum dpll_ffo_type type; - }; - - struct dpll_pin_ops { -- unsigned long supported_ffo; - int (*frequency_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - const u64 frequency, -@@ -111,12 +112,6 @@ struct dpll_pin_ops { - const struct dpll_device *dpll, - void *dpll_priv, enum dpll_pin_state *state, - struct netlink_ext_ack *extack); -- int (*operstate_on_dpll_get)(const struct dpll_pin *pin, -- void *pin_priv, -- const struct dpll_device *dpll, -- void *dpll_priv, -- enum dpll_pin_operstate *operstate, -- struct netlink_ext_ack *extack); - int (*state_on_pin_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_pin *parent_pin, - void *parent_pin_priv, -@@ -145,14 +140,13 @@ struct dpll_pin_ops { - const struct dpll_device *dpll, void *dpll_priv, - const s32 phase_adjust, - struct netlink_ext_ack *extack); -- int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, -+ RH_KABI_REPLACE(int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, -+ const struct dpll_device *dpll, void *dpll_priv, -+ s64 *ffo, struct netlink_ext_ack *extack), -+ int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - struct dpll_ffo_param *ffo, -- struct netlink_ext_ack *extack); -- int (*measured_freq_get)(const struct dpll_pin *pin, void *pin_priv, -- const struct dpll_device *dpll, -- void *dpll_priv, u64 *measured_freq, -- struct netlink_ext_ack *extack); -+ struct netlink_ext_ack *extack)) - int (*esync_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - u64 freq, struct netlink_ext_ack *extack); -@@ -171,9 +165,17 @@ struct dpll_pin_ops { - enum dpll_pin_state *state, - struct netlink_ext_ack *extack); - -- RH_KABI_RESERVE(1) -- RH_KABI_RESERVE(2) -- RH_KABI_RESERVE(3) -+ RH_KABI_USE(1, int (*measured_freq_get)(const struct dpll_pin *pin, void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, u64 *measured_freq, -+ struct netlink_ext_ack *extack)) -+ RH_KABI_USE(2, int (*operstate_on_dpll_get)(const struct dpll_pin *pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_pin_operstate *operstate, -+ struct netlink_ext_ack *extack)) -+ RH_KABI_USE(3, unsigned long supported_ffo) - RH_KABI_RESERVE(4) - RH_KABI_RESERVE(5) - RH_KABI_RESERVE(6) diff --git a/1288-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch b/1288-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch deleted file mode 100644 index ce2338920..000000000 --- a/1288-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 3453882f36c40d2339267093676585a89808a73d Mon Sep 17 00:00:00 2001 -From: Xiang Mei -Date: Thu, 26 Mar 2026 00:55:53 -0700 -Subject: [PATCH] net: bonding: fix use-after-free in bond_xmit_broadcast() - -commit 2884bf72fb8f03409e423397319205de48adca16 upstream. - -bond_xmit_broadcast() reuses the original skb for the last slave -(determined by bond_is_last_slave()) and clones it for others. -Concurrent slave enslave/release can mutate the slave list during -RCU-protected iteration, changing which slave is "last" mid-loop. -This causes the original skb to be double-consumed (double-freed). - -Replace the racy bond_is_last_slave() check with a simple index -comparison (i + 1 == slaves_count) against the pre-snapshot slave -count taken via READ_ONCE() before the loop. This preserves the -zero-copy optimization for the last slave while making the "last" -determination stable against concurrent list mutations. - -The UAF can trigger the following crash: - -================================================================== -BUG: KASAN: slab-use-after-free in skb_clone -Read of size 8 at addr ffff888100ef8d40 by task exploit/147 - -CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY -Call Trace: - - dump_stack_lvl (lib/dump_stack.c:123) - print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) - kasan_report (mm/kasan/report.c:597) - skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) - bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) - bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) - dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) - __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) - ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) - ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) - ip6_output (net/ipv6/ip6_output.c:250) - ip6_send_skb (net/ipv6/ip6_output.c:1985) - udp_v6_send_skb (net/ipv6/udp.c:1442) - udpv6_sendmsg (net/ipv6/udp.c:1733) - __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) - __x64_sys_sendto (net/socket.c:2209) - do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) - entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) - - -Allocated by task 147: - -Freed by task 147: - -The buggy address belongs to the object at ffff888100ef8c80 - which belongs to the cache skbuff_head_cache of size 224 -The buggy address is located 192 bytes inside of - freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) - -Memory state around the buggy address: - ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc - ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ->ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc - ^ - ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb - ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb -================================================================== - -Fixes: 4e5bd03ae346 ("net: bonding: fix bond_xmit_broadcast return value error bug") -Reported-by: Weiming Shi -Signed-off-by: Xiang Mei -Link: https://patch.msgid.link/20260326075553.3960562-1-xmei5@asu.edu -Signed-off-by: Paolo Abeni -Signed-off-by: Sasha Levin -Signed-off-by: Kevin Berry -Signed-off-by: Greg Kroah-Hartman - - - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 294d00f..67fd0c4 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -5401,7 +5401,7 @@ static netdev_tx_t bond_xmit_broadcast(struct sk_buff *skb, - if (!(bond_slave_is_up(slave) && slave->link == BOND_LINK_UP)) - continue; - -- if (bond_is_last_slave(bond, slave)) { -+ if (i + 1 == slaves_count) { - skb2 = skb; - skb_used = true; - } else { diff --git a/1289-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch b/1289-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch deleted file mode 100644 index abe85258c..000000000 --- a/1289-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch +++ /dev/null @@ -1,123 +0,0 @@ -From ac9c3524e6b15adece8493a0db2444e83b3de591 Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 20 Mar 2026 15:05:43 +0100 -Subject: [PATCH] s390/pci: Avoid deadlock between PCI error recovery and mlx5 - crdump - -JIRA: https://issues.redhat.com/browse/RHEL-157932 - -commit 0fd20f65df6aa430454a0deed8f43efa91c54835 -Author: Gerd Bayer -Date: Thu Oct 16 11:27:03 2025 +0200 - - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - - Do not block PCI config accesses through pci_cfg_access_lock() when - executing the s390 variant of PCI error recovery: Acquire just - device_lock() instead of pci_dev_lock() as powerpc's EEH and - generig PCI AER processing do. - - During error recovery testing a pair of tasks was reported to be hung: - - mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working - INFO: task kmcheck:72 blocked for more than 122 seconds. - Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 - "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. - task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000 - Call Trace: - [<000000065256f030>] __schedule+0x2a0/0x590 - [<000000065256f356>] schedule+0x36/0xe0 - [<000000065256f572>] schedule_preempt_disabled+0x22/0x30 - [<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8 - [<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core] - [<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core] - [<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398 - [<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0 - INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds. - Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 - "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. - task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000 - Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] - Call Trace: - [<000000065256f030>] __schedule+0x2a0/0x590 - [<000000065256f356>] schedule+0x36/0xe0 - [<0000000652172e28>] pci_wait_cfg+0x80/0xe8 - [<0000000652172f94>] pci_cfg_access_lock+0x74/0x88 - [<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core] - [<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core] - [<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core] - [<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168 - [<0000000652513212>] devlink_health_report+0x19a/0x230 - [<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] - - No kernel log of the exact same error with an upstream kernel is - available - but the very same deadlock situation can be constructed there, - too: - - - task: kmcheck - mlx5_unload_one() tries to acquire devlink lock while the PCI error - recovery code has set pdev->block_cfg_access by way of - pci_cfg_access_lock() - - task: kworker - mlx5_crdump_collect() tries to set block_cfg_access through - pci_cfg_access_lock() while devlink_health_report() had acquired - the devlink lock. - - A similar deadlock situation can be reproduced by requesting a - crdump with - > devlink health dump show pci/ reporter fw_fatal - - while PCI error recovery is executed on the same physical function - by mlx5_core's pci_error_handlers. On s390 this can be injected with - > zpcictl --reset-fw - - Tests with this patch failed to reproduce that second deadlock situation, - the devlink command is rejected with "kernel answers: Permission denied" - - and we get a kernel log message of: - - mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 - - because the config read of VSC_SEMAPHORE is rejected by the underlying - hardware. - - Two prior attempts to address this issue have been discussed and - ultimately rejected [see link], with the primary argument that s390's - implementation of PCI error recovery is imposing restrictions that - neither powerpc's EEH nor PCI AER handling need. Tests show that PCI - error recovery on s390 is running to completion even without blocking - access to PCI config space. - - Link: https://lore.kernel.org/all/20251007144826.2825134-1-gbayer@linux.ibm.com/ - Cc: stable@vger.kernel.org - Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery") - Reviewed-by: Niklas Schnelle - Signed-off-by: Gerd Bayer - Signed-off-by: Heiko Carstens - -Signed-off-by: Mete Durlu - -diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c -index d930416d4c90..da0de34d2e5c 100644 ---- a/arch/s390/pci/pci_event.c -+++ b/arch/s390/pci/pci_event.c -@@ -187,7 +187,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) - * is unbound or probed and that userspace can't access its - * configuration space while we perform recovery. - */ -- pci_dev_lock(pdev); -+ device_lock(&pdev->dev); - if (pdev->error_state == pci_channel_io_perm_failure) { - ers_res = PCI_ERS_RESULT_DISCONNECT; - goto out_unlock; -@@ -254,7 +254,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) - if (driver->err_handler->resume) - driver->err_handler->resume(pdev); - out_unlock: -- pci_dev_unlock(pdev); -+ device_unlock(&pdev->dev); - zpci_report_status(zdev, "recovery", status_str); - - return ers_res; --- -2.50.1 (Apple Git-155) - diff --git a/1290-ice-fix-stats-array-overflow-when-vf-requests-more-queues.patch b/1290-ice-fix-stats-array-overflow-when-vf-requests-more-queues.patch deleted file mode 100644 index 779cbf0f1..000000000 --- a/1290-ice-fix-stats-array-overflow-when-vf-requests-more-queues.patch +++ /dev/null @@ -1,138 +0,0 @@ -From 9837d44c3a8c7908fca4a3e4ef2e753b43b2e7da Mon Sep 17 00:00:00 2001 -From: Michal Schmidt -Date: Mon, 27 Apr 2026 17:18:26 +0200 -Subject: [PATCH] ice: fix stats array overflow when VF requests more queues - -JIRA: https://redhat.atlassian.net/browse/RHEL-163186 - -Upstream status: Posted: https://lore.kernel.org/netdev/20260427151827.43342-1-mschmidt@redhat.com/ - -When a VF increases its queue count via VIRTCHNL_OP_REQUEST_QUEUES, -ice_vc_request_qs_msg() sets vf->num_req_qs and triggers a VF reset. -The reset calls ice_vf_reconfig_vsi(), which does ice_vsi_decfg() -followed by ice_vsi_cfg(). ice_vsi_decfg() does not free the per-ring -stats arrays. Inside ice_vsi_cfg_def(), ice_vsi_set_num_qs() updates -alloc_txq/alloc_rxq to the new larger value, but -ice_vsi_alloc_stat_arrays() returns early because the stats already -exist. ice_vsi_alloc_ring_stats() then iterates using the new larger -alloc_txq and writes beyond the bounds of the old, smaller -tx_ring_stats/rx_ring_stats pointer arrays, corrupting adjacent SLUB -metadata. - -KASAN detects the bug: - ================================================================== - BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice] - Read of size 8 at addr ffff88810affea60 by task kworker/u131:7/221 - - CPU: 24 UID: 0 PID: 221 Comm: kworker/u131:7 Not tainted 7.1.0-rc1+ #1 PREEMPT(lazy) - ... - Workqueue: ice ice_service_task [ice] - Call Trace: - - ... - kasan_report+0xd7/0x120 - ice_vsi_alloc_ring_stats+0x385/0x4a0 [ice] - ice_vsi_cfg_def+0x12e2/0x2060 [ice] - ice_vsi_cfg+0xb5/0x3c0 [ice] - ice_reset_vf+0x858/0xf80 [ice] - ice_vc_request_qs_msg+0x1da/0x290 [ice] - ice_vc_process_vf_msg+0xb15/0x1430 [ice] - __ice_clean_ctrlq+0x70d/0x9d0 [ice] - ice_service_task+0x840/0xf20 [ice] - process_one_work+0x690/0xff0 - worker_thread+0x4d9/0xd20 - kthread+0x322/0x410 - ret_from_fork+0x332/0x660 - ret_from_fork_asm+0x1a/0x30 - - - Allocated by task 2439: - kasan_save_stack+0x1c/0x40 - kasan_save_track+0x10/0x30 - __kasan_kmalloc+0x96/0xb0 - __kmalloc_noprof+0x1d8/0x580 - ice_vsi_cfg_def+0x115c/0x2060 [ice] - ice_vsi_cfg+0xb5/0x3c0 [ice] - ice_vsi_setup+0x180/0x320 [ice] - ice_start_vfs+0x1f3/0x590 [ice] - ice_ena_vfs+0x66d/0x798 [ice] - ice_sriov_configure.cold+0xe4/0x121 [ice] - sriov_numvfs_store+0x279/0x480 - kernfs_fop_write_iter+0x331/0x4f0 - vfs_write+0x4c4/0xe40 - ksys_write+0x10c/0x240 - do_syscall_64+0xd9/0x650 - entry_SYSCALL_64_after_hwframe+0x76/0x7e - - The buggy address belongs to the object at ffff88810affea40 - which belongs to the cache kmalloc-32 of size 32 - The buggy address is located 0 bytes to the right of - allocated 32-byte region [ffff88810affea40, ffff88810affea60) - ... - ================================================================== - -ice_vsi_rebuild() handles this correctly by calling -ice_vsi_realloc_stat_arrays() before reconfiguration, but -ice_vf_reconfig_vsi() was missing this call. - -Fix by calling ice_vsi_realloc_stat_arrays() in ice_vf_reconfig_vsi() -before ice_vsi_decfg(), mirroring the ice_vsi_rebuild() pattern. Set -vsi->req_txq/req_rxq from vf->num_req_qs so the realloc function knows -the target array size. - -See the linked RHEL Jira item for a reproducer. - -Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()") -Closes: https://redhat.atlassian.net/browse/RHEL-164321 -Signed-off-by: Michal Schmidt -Assisted-by: Claude:claude-opus-4-6 semcode -Reviewed-by: Aleksandr Loktionov -Reviewed-by: Simon Horman -Reviewed-by: Przemek Kitszel - -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index 26496eaed981..7bc5a7009cbb 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -3017,7 +3017,7 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi, - * ice_vsi_realloc_stat_arrays - Frees unused stat structures or alloc new ones - * @vsi: VSI pointer - */ --static int -+int - ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi) - { - u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq; -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.h b/drivers/net/ethernet/intel/ice/ice_lib.h -index 2cb1eb98b9da..fce6f633f506 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.h -+++ b/drivers/net/ethernet/intel/ice/ice_lib.h -@@ -66,6 +66,7 @@ int ice_ena_vsi(struct ice_vsi *vsi, bool locked); - void ice_vsi_decfg(struct ice_vsi *vsi); - void ice_dis_vsi(struct ice_vsi *vsi, bool locked); - -+int ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi); - int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags); - int ice_vsi_cfg(struct ice_vsi *vsi); - struct ice_vsi *ice_vsi_alloc(struct ice_pf *pf); -diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -index de9e81ccee66..fd71dd10eb38 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -@@ -268,6 +268,13 @@ static int ice_vf_reconfig_vsi(struct ice_vf *vf) - - vsi->flags = ICE_VSI_FLAG_NO_INIT; - -+ vsi->req_txq = vf->num_req_qs; -+ vsi->req_rxq = vf->num_req_qs; -+ -+ err = ice_vsi_realloc_stat_arrays(vsi); -+ if (err) -+ return err; -+ - ice_vsi_decfg(vsi); - ice_fltr_remove_all(vsi); - --- -2.50.1 (Apple Git-155) - diff --git a/1291-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch b/1291-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch deleted file mode 100644 index f32919e87..000000000 --- a/1291-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 8ac29c454e865adf7b65a4f83d28177e0ecb1dca Mon Sep 17 00:00:00 2001 -From: Ming Lei -Date: Wed, 26 Nov 2025 17:06:31 +0100 -Subject: [PATCH] s390/dasd: Fix gendisk parent after copy pair swap - -JIRA: https://issues.redhat.com/browse/RHEL-144763 - -commit c943bfc6afb8d0e781b9b7406f36caa8bbf95cb9 -Author: Stefan Haberland -Date: Wed Nov 26 17:06:31 2025 +0100 - - s390/dasd: Fix gendisk parent after copy pair swap - - After a copy pair swap the block device's "device" symlink points to - the secondary CCW device, but the gendisk's parent remained the - primary, leaving /sys/block/ under the wrong parent. - - Move the gendisk to the secondary's device with device_move(), keeping - the sysfs topology consistent after the swap. - - Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") - Cc: stable@vger.kernel.org #6.1 - Reviewed-by: Jan Hoeppner - Signed-off-by: Stefan Haberland - Signed-off-by: Jens Axboe - -Signed-off-by: Ming Lei - -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index 1ebe589b5185..78fef8959c78 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -6149,6 +6149,7 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - struct dasd_copy_relation *copy; - struct dasd_block *block; - struct gendisk *gdp; -+ int rc; - - copy = device->copy; - if (!copy) -@@ -6183,6 +6184,13 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - /* swap blocklayer device link */ - gdp = block->gdp; - dasd_add_link_to_gendisk(gdp, secondary); -+ rc = device_move(disk_to_dev(gdp), &secondary->cdev->dev, DPM_ORDER_NONE); -+ if (rc) { -+ dev_err(&primary->cdev->dev, -+ "copy_pair_swap: moving blockdevice parent %s->%s failed (%d)\n", -+ dev_name(&primary->cdev->dev), -+ dev_name(&secondary->cdev->dev), rc); -+ } - - /* re-enable device */ - dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC); --- -2.50.1 (Apple Git-155) - diff --git a/1292-s390-dasd-move-quiesce-state-with-pprc-swap.patch b/1292-s390-dasd-move-quiesce-state-with-pprc-swap.patch deleted file mode 100644 index 7b738ebf2..000000000 --- a/1292-s390-dasd-move-quiesce-state-with-pprc-swap.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 98d247e4eac9e5a06678190715d9f9d86902aa9c Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 27 Mar 2026 13:20:49 +0100 -Subject: [PATCH] s390/dasd: Move quiesce state with pprc swap - -JIRA: https://issues.redhat.com/browse/RHEL-161531 - -commit 40e9cd4ae8ec43b107ed2bff422a8fa39dcf4e4b -Author: Stefan Haberland -Date: Tue Mar 10 15:23:29 2026 +0100 - - s390/dasd: Move quiesce state with pprc swap - - Quiesce and resume is a mechanism to suspend operations on DASD devices. - In the context of a controlled copy pair swap operation, the quiesce - operation is usually issued before the actual swap and a resume - afterwards. - - During the swap operation, the underlying device is exchanged. Therefore, - the quiesce flag must be moved to the secondary device to ensure a - consistent quiesce state after the swap. - - The secondary device itself cannot be suspended separately because there - is no separate block device representation for it. - - Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") - Cc: stable@vger.kernel.org #6.1 - Reviewed-by: Jan Hoeppner - Signed-off-by: Stefan Haberland - Link: https://patch.msgid.link/20260310142330.4080106-2-sth@linux.ibm.com - Signed-off-by: Jens Axboe - -Signed-off-by: Stefan Haberland -Signed-off-by: Mete Durlu - -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index 78fef8959c78..c6d825109f53 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -6192,6 +6192,11 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - dev_name(&secondary->cdev->dev), rc); - } - -+ if (primary->stopped & DASD_STOPPED_QUIESCE) { -+ dasd_device_set_stop_bits(secondary, DASD_STOPPED_QUIESCE); -+ dasd_device_remove_stop_bits(primary, DASD_STOPPED_QUIESCE); -+ } -+ - /* re-enable device */ - dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC); - dasd_device_remove_stop_bits(secondary, DASD_STOPPED_PPRC); --- -2.50.1 (Apple Git-155) - diff --git a/1293-s390-dasd-copy-detected-format-information-to-secondary-devi.patch b/1293-s390-dasd-copy-detected-format-information-to-secondary-devi.patch deleted file mode 100644 index cdd50fdc5..000000000 --- a/1293-s390-dasd-copy-detected-format-information-to-secondary-devi.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 2435d419304a1e5bfc93947d3c6a7902b49aadcc Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 27 Mar 2026 13:20:52 +0100 -Subject: [PATCH] s390/dasd: Copy detected format information to secondary - device - -JIRA: https://issues.redhat.com/browse/RHEL-161531 - -commit 4c527c7e030672efd788d0806d7a68972a7ba3c1 -Author: Stefan Haberland -Date: Tue Mar 10 15:23:30 2026 +0100 - - s390/dasd: Copy detected format information to secondary device - - During online processing for a DASD device an IO operation is started to - determine the format of the device. CDL format contains specifically - sized blocks at the beginning of the disk. - - For a PPRC secondary device no real IO operation is possible therefore - this IO request can not be started and this step is skipped for online - processing of secondary devices. This is generally fine since the - secondary is a copy of the primary device. - - In case of an additional partition detection that is run after a swap - operation the format information is needed to properly drive partition - detection IO. - - Currently the information is not passed leading to IO errors during - partition detection and a wrongly detected partition table which in turn - might lead to data corruption on the disk with the wrong partition table. - - Fix by passing the format information from primary to secondary device. - - Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") - Cc: stable@vger.kernel.org #6.1 - Reviewed-by: Jan Hoeppner - Acked-by: Eduard Shishkin - Signed-off-by: Stefan Haberland - Link: https://patch.msgid.link/20260310142330.4080106-3-sth@linux.ibm.com - Signed-off-by: Jens Axboe - -Signed-off-by: Stefan Haberland -Signed-off-by: Mete Durlu - -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index c6d825109f53..0d874d92a099 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -6145,6 +6145,7 @@ static void copy_pair_set_active(struct dasd_copy_relation *copy, char *new_busi - static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid, - char *sec_busid) - { -+ struct dasd_eckd_private *prim_priv, *sec_priv; - struct dasd_device *primary, *secondary; - struct dasd_copy_relation *copy; - struct dasd_block *block; -@@ -6165,6 +6166,9 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - if (!secondary) - return DASD_COPYPAIRSWAP_SECONDARY; - -+ prim_priv = primary->private; -+ sec_priv = secondary->private; -+ - /* - * usually the device should be quiesced for swap - * for paranoia stop device and requeue requests again -@@ -6197,6 +6201,13 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - dasd_device_remove_stop_bits(primary, DASD_STOPPED_QUIESCE); - } - -+ /* -+ * The secondary device never got through format detection, but since it -+ * is a copy of the primary device, the format is exactly the same; -+ * therefore, the detected layout can simply be copied. -+ */ -+ sec_priv->uses_cdl = prim_priv->uses_cdl; -+ - /* re-enable device */ - dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC); - dasd_device_remove_stop_bits(secondary, DASD_STOPPED_PPRC); --- -2.50.1 (Apple Git-155) - diff --git a/1294-nouveau-gsp-drop-warn-on-in-acpi-probes.patch b/1294-nouveau-gsp-drop-warn-on-in-acpi-probes.patch deleted file mode 100644 index 799325afb..000000000 --- a/1294-nouveau-gsp-drop-warn-on-in-acpi-probes.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 9478c166c46934160135e197b049b5a05753f2ad Mon Sep 17 00:00:00 2001 -From: Dave Airlie -Date: Thu, 21 Nov 2024 11:46:01 +1000 -Subject: [PATCH] nouveau/gsp: drop WARN_ON in ACPI probes - -These WARN_ONs seem to trigger a lot, and we don't seem to have a -plan to fix them, so just drop them, as they are most likely -harmless. - -Cc: stable@vger.kernel.org -Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") -Signed-off-by: Dave Airlie -Link: https://patch.msgid.link/20241121014601.229391-1-airlied@gmail.com -Signed-off-by: Danilo Krummrich - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c -index 7fb13434c051..a575a8dbf727 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c -@@ -737,8 +737,8 @@ r535_gsp_acpi_caps(acpi_handle handle, CAPS_METHOD_DATA *caps) - if (!obj) - goto done; - -- if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || -- WARN_ON(obj->buffer.length != 4)) -+ if (obj->type != ACPI_TYPE_BUFFER || -+ obj->buffer.length != 4) - goto done; - - caps->status = 0; -@@ -773,8 +773,8 @@ r535_gsp_acpi_jt(acpi_handle handle, JT_METHOD_DATA *jt) - if (!obj) - goto done; - -- if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || -- WARN_ON(obj->buffer.length != 4)) -+ if (obj->type != ACPI_TYPE_BUFFER || -+ obj->buffer.length != 4) - goto done; - - jt->status = 0; -@@ -861,8 +861,8 @@ r535_gsp_acpi_dod(acpi_handle handle, DOD_METHOD_DATA *dod) - - _DOD = output.pointer; - -- if (WARN_ON(_DOD->type != ACPI_TYPE_PACKAGE) || -- WARN_ON(_DOD->package.count > ARRAY_SIZE(dod->acpiIdList))) -+ if (_DOD->type != ACPI_TYPE_PACKAGE || -+ _DOD->package.count > ARRAY_SIZE(dod->acpiIdList)) - return; - - for (int i = 0; i < _DOD->package.count; i++) { --- -2.50.1 (Apple Git-155) - diff --git a/1295-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch b/1295-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch deleted file mode 100644 index 9d6b3ed29..000000000 --- a/1295-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch +++ /dev/null @@ -1,77 +0,0 @@ -From c9a44a91015ff6116ef4dfb6e2c752e5366b2d32 Mon Sep 17 00:00:00 2001 -From: Davide Caratti -Date: Mon, 27 Apr 2026 12:58:46 +0200 -Subject: [PATCH] can: raw: fix ro->uniq use-after-free in raw_rcv() - -JIRA: https://redhat.atlassian.net/browse/RHEL-170766 -CVE: CVE-2026-31532 -Upstream Status: net-next.git commit a535a9217ca3f2fccedaafb2fddb4c48f27d36dc - -commit a535a9217ca3f2fccedaafb2fddb4c48f27d36dc -Author: Samuel Page -Date: Wed Apr 8 15:30:13 2026 +0100 - - can: raw: fix ro->uniq use-after-free in raw_rcv() - - raw_release() unregisters raw CAN receive filters via can_rx_unregister(), - but receiver deletion is deferred with call_rcu(). This leaves a window - where raw_rcv() may still be running in an RCU read-side critical section - after raw_release() frees ro->uniq, leading to a use-after-free of the - percpu uniq storage. - - Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific - socket destructor. can_rx_unregister() takes an extra reference to the - socket and only drops it from the RCU callback, so freeing uniq from - sk_destruct ensures the percpu area is not released until the relevant - callbacks have drained. - - Fixes: 514ac99c64b2 ("can: fix multiple delivery of a single CAN frame for overlapping CAN filters") - Cc: stable@vger.kernel.org # v4.1+ - Assisted-by: Bynario AI - Signed-off-by: Samuel Page - Link: https://patch.msgid.link/26ec626d-cae7-4418-9782-7198864d070c@bynar.io - Acked-by: Oliver Hartkopp - [mkl: applied manually] - Signed-off-by: Marc Kleine-Budde - -Signed-off-by: Davide Caratti - -diff --git a/net/can/raw.c b/net/can/raw.c -index 2aab0398e444..c7e392fad11a 100644 ---- a/net/can/raw.c -+++ b/net/can/raw.c -@@ -360,6 +360,14 @@ static int raw_notifier(struct notifier_block *nb, unsigned long msg, - return NOTIFY_DONE; - } - -+static void raw_sock_destruct(struct sock *sk) -+{ -+ struct raw_sock *ro = raw_sk(sk); -+ -+ free_percpu(ro->uniq); -+ can_sock_destruct(sk); -+} -+ - static int raw_init(struct sock *sk) - { - struct raw_sock *ro = raw_sk(sk); -@@ -386,6 +394,8 @@ static int raw_init(struct sock *sk) - if (unlikely(!ro->uniq)) - return -ENOMEM; - -+ sk->sk_destruct = raw_sock_destruct; -+ - /* set notifier */ - spin_lock(&raw_notifier_lock); - list_add_tail(&ro->notifier, &raw_notifier_list); -@@ -433,7 +443,6 @@ static int raw_release(struct socket *sock) - ro->bound = 0; - ro->dev = NULL; - ro->count = 0; -- free_percpu(ro->uniq); - - sock_orphan(sk); - sock->sk = NULL; --- -2.50.1 (Apple Git-155) - diff --git a/1296-erofs-add-gfp-noio-in-the-bio-completion-if-needed.patch b/1296-erofs-add-gfp-noio-in-the-bio-completion-if-needed.patch deleted file mode 100644 index 8c17c37fa..000000000 --- a/1296-erofs-add-gfp-noio-in-the-bio-completion-if-needed.patch +++ /dev/null @@ -1,70 +0,0 @@ -From ce3e488188bb7c00b8ccdba07c6ccfb98d7384a2 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 28 Apr 2026 18:31:31 +0000 -Subject: [PATCH] erofs: add GFP_NOIO in the bio completion if needed - -JIRA: https://redhat.atlassian.net/browse/RHEL-171687 -CVE: CVE-2026-31467 - -commit c23df30915f83e7257c8625b690a1cece94142a0 -Author: Jiucheng Xu -Date: Wed Mar 11 17:11:31 2026 +0800 - - erofs: add GFP_NOIO in the bio completion if needed - - The bio completion path in the process context (e.g. dm-verity) - will directly call into decompression rather than trigger another - workqueue context for minimal scheduling latencies, which can - then call vm_map_ram() with GFP_KERNEL. - - Due to insufficient memory, vm_map_ram() may generate memory - swapping I/O, which can cause submit_bio_wait to deadlock - in some scenarios. - - Trimmed down the call stack, as follows: - - f2fs_submit_read_io - submit_bio //bio_list is initialized. - mmc_blk_mq_recovery - z_erofs_endio - vm_map_ram - __pte_alloc_kernel - __alloc_pages_direct_reclaim - shrink_folio_list - __swap_writepage - submit_bio_wait //bio_list is non-NULL, hang!!! - - Use memalloc_noio_{save,restore}() to wrap up this path. - - Reviewed-by: Gao Xiang - Signed-off-by: Jiucheng Xu - Reviewed-by: Chao Yu - Signed-off-by: Gao Xiang - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index db1f13663cd5..cfde72fcd548 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -1337,6 +1337,7 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, - int bios) - { - struct erofs_sb_info *const sbi = EROFS_SB(io->sb); -+ int gfp_flag; - - /* wake up the caller thread for sync decompression */ - if (io->sync) { -@@ -1370,7 +1371,9 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, - sbi->opt.sync_decompress = EROFS_SYNC_DECOMPRESS_FORCE_ON; - return; - } -+ gfp_flag = memalloc_noio_save(); - z_erofs_decompressqueue_work(&io->u.work); -+ memalloc_noio_restore(gfp_flag); - } - - static void z_erofs_fill_bio_vec(struct bio_vec *bvec, --- -2.50.1 (Apple Git-155) - diff --git a/1297-alsa-6fire-fix-use-after-free-on-disconnect.patch b/1297-alsa-6fire-fix-use-after-free-on-disconnect.patch deleted file mode 100644 index ae880647a..000000000 --- a/1297-alsa-6fire-fix-use-after-free-on-disconnect.patch +++ /dev/null @@ -1,90 +0,0 @@ -From ee288dfa7ea837c1ffe68fd01e54d422e02f0fc4 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:33:31 +0000 -Subject: [PATCH] ALSA: 6fire: fix use-after-free on disconnect - -JIRA: https://redhat.atlassian.net/browse/RHEL-172974 -CVE: CVE-2026-31581 - -commit b9c826916fdce6419b94eb0cd8810fdac18c2386 -Author: Berk Cem Goksel -Date: Fri Apr 10 08:13:41 2026 +0300 - - ALSA: 6fire: fix use-after-free on disconnect - - In usb6fire_chip_abort(), the chip struct is allocated as the card's - private data (via snd_card_new with sizeof(struct sfire_chip)). When - snd_card_free_when_closed() is called and no file handles are open, the - card and embedded chip are freed synchronously. The subsequent - chip->card = NULL write then hits freed slab memory. - - Call trace: - usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] - usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 - usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 - ... - hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 - - Fix by moving the card lifecycle out of usb6fire_chip_abort() and into - usb6fire_chip_disconnect(). The card pointer is saved in a local - before any teardown, snd_card_disconnect() is called first to prevent - new opens, URBs are aborted while chip is still valid, and - snd_card_free_when_closed() is called last so chip is never accessed - after the card may be freed. - - Fixes: a0810c3d6dd2 ("ALSA: 6fire: Release resources at card release") - Cc: stable@vger.kernel.org - Cc: Andrey Konovalov - Signed-off-by: Berk Cem Goksel - Link: https://patch.msgid.link/20260410051341.1069716-1-berkcgoksel@gmail.com - Signed-off-by: Takashi Iwai - -Signed-off-by: CKI Backport Bot - -diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c -index 5ff78814e687..874f6cd503ca 100644 ---- a/sound/usb/6fire/chip.c -+++ b/sound/usb/6fire/chip.c -@@ -53,11 +53,6 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) - usb6fire_comm_abort(chip); - if (chip->control) - usb6fire_control_abort(chip); -- if (chip->card) { -- snd_card_disconnect(chip->card); -- snd_card_free_when_closed(chip->card); -- chip->card = NULL; -- } - } - } - -@@ -168,6 +163,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, - static void usb6fire_chip_disconnect(struct usb_interface *intf) - { - struct sfire_chip *chip; -+ struct snd_card *card; - - chip = usb_get_intfdata(intf); - if (chip) { /* if !chip, fw upload has been performed */ -@@ -178,8 +174,19 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) - chips[chip->regidx] = NULL; - } - -+ /* -+ * Save card pointer before teardown. -+ * snd_card_free_when_closed() may free card (and -+ * the embedded chip) immediately, so it must be -+ * called last and chip must not be accessed after. -+ */ -+ card = chip->card; - chip->shutdown = true; -+ if (card) -+ snd_card_disconnect(card); - usb6fire_chip_abort(chip); -+ if (card) -+ snd_card_free_when_closed(card); - } - } - } --- -2.50.1 (Apple Git-155) - diff --git a/1298-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch b/1298-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch deleted file mode 100644 index 99eb592f8..000000000 --- a/1298-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 1063515ce15ff31065c4e7f8265f4c2fd3c54876 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 26 Mar 2026 15:51:38 +0000 -Subject: [PATCH] ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - -[ Upstream commit 2edfa31769a4add828a7e604b21cb82aaaa05925 ] - -Oskar Kjos reported the following problem. - -ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written -by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes -IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region -as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff -at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr -value. __ip_options_echo() then reads optlen from attacker-controlled -packet data at sptr[rr+1] and copies that many bytes into dopt->__data, -a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). - -To fix this we clear skb2->cb[], as suggested by Oskar Kjos. - -Also add minimal IPv4 header validation (version == 4, ihl >= 5). - -Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.") -Reported-by: Oskar Kjos -Signed-off-by: Eric Dumazet -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/20260326155138.2429480-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 9f1b66bb513c..f0a8350eb52e 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -601,11 +601,16 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - if (!skb2) - return 0; - -+ /* Remove debris left by IPv6 stack. */ -+ memset(IPCB(skb2), 0, sizeof(*IPCB(skb2))); -+ - skb_dst_drop(skb2); - - skb_pull(skb2, offset); - skb_reset_network_header(skb2); - eiph = ip_hdr(skb2); -+ if (eiph->version != 4 || eiph->ihl < 5) -+ goto out; - - /* Try to guess incoming interface */ - rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr, --- -2.50.1 (Apple Git-155) - diff --git a/1299-ipv6-rpl-reserve-mac-len-headroom-when-recompressed-srh-grow.patch b/1299-ipv6-rpl-reserve-mac-len-headroom-when-recompressed-srh-grow.patch deleted file mode 100644 index a4f20b697..000000000 --- a/1299-ipv6-rpl-reserve-mac-len-headroom-when-recompressed-srh-grow.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 4babc2d9fda2df43823b85d08a0180b68f1b0854 Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman -Date: Tue, 21 Apr 2026 15:16:33 +0200 -Subject: [PATCH] ipv6: rpl: reserve mac_len headroom when recompressed SRH - grows - -commit 9e6bf146b55999a095bb14f73a843942456d1adc upstream. - -ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps -the next segment into ipv6_hdr->daddr, recompresses, then pulls the old -header and pushes the new one plus the IPv6 header back. The -recompressed header can be larger than the received one when the swap -reduces the common-prefix length the segments share with daddr (CmprI=0, -CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes). - -pskb_expand_head() was gated on segments_left == 0, so on earlier -segments the push consumed unchecked headroom. Once skb_push() leaves -fewer than skb->mac_len bytes in front of data, -skb_mac_header_rebuild()'s call to: - - skb_set_mac_header(skb, -skb->mac_len); - -will store (data - head) - mac_len into the u16 mac_header field, which -wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB -past skb->head. - -A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two -segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one -pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv. - -Fix this by expanding the head whenever the remaining room is less than -the push size plus mac_len, and request that much extra so the rebuilt -MAC header fits afterwards. - -Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr") -Cc: stable -Reported-by: Anthropic -Signed-off-by: Greg Kroah-Hartman -Link: https://patch.msgid.link/2026042133-gout-unvented-1bd9@gregkh -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c -index 8a30dd83cf0b..d09ae48030b3 100644 ---- a/net/ipv6/exthdrs.c -+++ b/net/ipv6/exthdrs.c -@@ -491,6 +491,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) - struct net *net = dev_net(skb->dev); - struct inet6_dev *idev; - struct ipv6hdr *oldhdr; -+ unsigned int chdr_len; - unsigned char *buf; - int accept_rpl_seg; - int i, err; -@@ -594,8 +595,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) - skb_pull(skb, ((hdr->hdrlen + 1) << 3)); - skb_postpull_rcsum(skb, oldhdr, - sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3)); -- if (unlikely(!hdr->segments_left)) { -- if (pskb_expand_head(skb, sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3), 0, -+ chdr_len = sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3); -+ if (unlikely(!hdr->segments_left || -+ skb_headroom(skb) < chdr_len + skb->mac_len)) { -+ if (pskb_expand_head(skb, chdr_len + skb->mac_len, 0, - GFP_ATOMIC)) { - __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_OUTDISCARDS); - kfree_skb(skb); -@@ -605,7 +608,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) - - oldhdr = ipv6_hdr(skb); - } -- skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr)); -+ skb_push(skb, chdr_len); - skb_reset_network_header(skb); - skb_mac_header_rebuild(skb); - skb_set_transport_header(skb, sizeof(struct ipv6hdr)); --- -2.50.1 (Apple Git-155) - diff --git a/1300-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch b/1300-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch deleted file mode 100644 index fce4e68ff..000000000 --- a/1300-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch +++ /dev/null @@ -1,119 +0,0 @@ -From 95ceb7510d751e76b068573ecbb2030cbd73852b Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 2 Jun 2026 11:09:13 +0200 -Subject: [PATCH] fs: constify file ptr in backing_file accessor helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179440 - -commit 4e301d858af17ae2ce56886296e5458c5a08219a -Author: Amir Goldstein -Date: Sat Jun 7 13:53:03 2025 +0200 - - fs: constify file ptr in backing_file accessor helpers - - Add internal helper backing_file_set_user_path() for the only - two cases that need to modify backing_file fields. - - Signed-off-by: Amir Goldstein - Link: https://lore.kernel.org/20250607115304.2521155-2-amir73il@gmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/backing-file.c b/fs/backing-file.c -index 09a9be945d45..892361c31c3d 100644 ---- a/fs/backing-file.c -+++ b/fs/backing-file.c -@@ -41,7 +41,7 @@ struct file *backing_file_open(const struct path *user_path, int flags, - return f; - - path_get(user_path); -- *backing_file_user_path(f) = *user_path; -+ backing_file_set_user_path(f, user_path); - error = vfs_open(real_path, f); - if (error) { - fput(f); -@@ -65,7 +65,7 @@ struct file *backing_tmpfile_open(const struct path *user_path, int flags, - return f; - - path_get(user_path); -- *backing_file_user_path(f) = *user_path; -+ backing_file_set_user_path(f, user_path); - error = vfs_tmpfile(real_idmap, real_parentpath, f, mode); - if (error) { - fput(f); -diff --git a/fs/file_table.c b/fs/file_table.c -index 15a3593c6ece..9979efb9a380 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -53,17 +53,20 @@ struct backing_file { - }; - }; - --static inline struct backing_file *backing_file(struct file *f) --{ -- return container_of(f, struct backing_file, file); --} -+#define backing_file(f) container_of(f, struct backing_file, file) - --struct path *backing_file_user_path(struct file *f) -+struct path *backing_file_user_path(const struct file *f) - { - return &backing_file(f)->user_path; - } - EXPORT_SYMBOL_GPL(backing_file_user_path); - -+void backing_file_set_user_path(struct file *f, const struct path *path) -+{ -+ backing_file(f)->user_path = *path; -+} -+EXPORT_SYMBOL_GPL(backing_file_set_user_path); -+ - static inline void file_free(struct file *f) - { - security_file_free(f); -diff --git a/fs/internal.h b/fs/internal.h -index dd13dfde4adb..67e2e164c647 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -100,6 +100,7 @@ extern void chroot_fs_refs(const struct path *, const struct path *); - struct file *alloc_empty_file(int flags, const struct cred *cred); - struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); - struct file *alloc_empty_backing_file(int flags, const struct cred *cred); -+void backing_file_set_user_path(struct file *f, const struct path *path); - - static inline void file_put_write_access(struct file *file) - { -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 83ddabaa0ac3..04309befc557 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2793,7 +2793,7 @@ struct file *dentry_open(const struct path *path, int flags, - const struct cred *creds); - struct file *dentry_create(const struct path *path, int flags, umode_t mode, - const struct cred *cred); --struct path *backing_file_user_path(struct file *f); -+struct path *backing_file_user_path(const struct file *f); - - /* - * When mmapping a file on a stackable filesystem (e.g., overlayfs), the file -@@ -2805,14 +2805,14 @@ struct path *backing_file_user_path(struct file *f); - * by fstat() on that same fd. - */ - /* Get the path to display in /proc//maps */ --static inline const struct path *file_user_path(struct file *f) -+static inline const struct path *file_user_path(const struct file *f) - { - if (unlikely(f->f_mode & FMODE_BACKING)) - return backing_file_user_path(f); - return &f->f_path; - } - /* Get the inode whose inode number to display in /proc//maps */ --static inline const struct inode *file_user_inode(struct file *f) -+static inline const struct inode *file_user_inode(const struct file *f) - { - if (unlikely(f->f_mode & FMODE_BACKING)) - return d_inode(backing_file_user_path(f)->dentry); --- -2.50.1 (Apple Git-155) - diff --git a/1301-lsm-split-the-notifier-code-out-into-lsm-notifier-c.patch b/1301-lsm-split-the-notifier-code-out-into-lsm-notifier-c.patch deleted file mode 100644 index 56d7da485..000000000 --- a/1301-lsm-split-the-notifier-code-out-into-lsm-notifier-c.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 6a5de58e1181a41f95ac002a27d95f1dbf5933c9 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Fri, 29 May 2026 17:24:58 +0200 -Subject: [PATCH] lsm: split the notifier code out into lsm_notifier.c - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit a5e7c17c810052e94dae36f1a976a052f4490458 -Author: Paul Moore -Date: Mon Feb 10 19:20:58 2025 -0500 - - lsm: split the notifier code out into lsm_notifier.c - - In an effort to decompose security/security.c somewhat to make it less - twisted and unwieldy, pull out the LSM notifier code into a new file - as it is fairly well self-contained. - - No code changes. - - Reviewed-by: Kees Cook - Reviewed-by: John Johansen - Reviewed-by: Casey Schaufler - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/Makefile b/security/Makefile -index cc0982214b84..c7a3f1cb2fd5 100644 ---- a/security/Makefile -+++ b/security/Makefile -@@ -11,7 +11,7 @@ obj-$(CONFIG_SECURITY) += lsm_syscalls.o - obj-$(CONFIG_MMU) += min_addr.o - - # Object file lists --obj-$(CONFIG_SECURITY) += security.o -+obj-$(CONFIG_SECURITY) += security.o lsm_notifier.o - obj-$(CONFIG_SECURITYFS) += inode.o - obj-$(CONFIG_SECURITY_SELINUX) += selinux/ - obj-$(CONFIG_SECURITY_SMACK) += smack/ -diff --git a/security/lsm_notifier.c b/security/lsm_notifier.c -new file mode 100644 -index 000000000000..c92fad5d57d4 ---- /dev/null -+++ b/security/lsm_notifier.c -@@ -0,0 +1,31 @@ -+// SPDX-License-Identifier: GPL-2.0-or-later -+/* -+ * LSM notifier functions -+ * -+ */ -+ -+#include -+#include -+ -+static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain); -+ -+int call_blocking_lsm_notifier(enum lsm_event event, void *data) -+{ -+ return blocking_notifier_call_chain(&blocking_lsm_notifier_chain, -+ event, data); -+} -+EXPORT_SYMBOL(call_blocking_lsm_notifier); -+ -+int register_blocking_lsm_notifier(struct notifier_block *nb) -+{ -+ return blocking_notifier_chain_register(&blocking_lsm_notifier_chain, -+ nb); -+} -+EXPORT_SYMBOL(register_blocking_lsm_notifier); -+ -+int unregister_blocking_lsm_notifier(struct notifier_block *nb) -+{ -+ return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain, -+ nb); -+} -+EXPORT_SYMBOL(unregister_blocking_lsm_notifier); -diff --git a/security/security.c b/security/security.c -index 4535ba7d0208..9a5f9a2f8ff3 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -91,8 +91,6 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { - [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", - }; - --static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain); -- - static struct kmem_cache *lsm_file_cache; - static struct kmem_cache *lsm_inode_cache; - -@@ -649,27 +647,6 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, - } - } - --int call_blocking_lsm_notifier(enum lsm_event event, void *data) --{ -- return blocking_notifier_call_chain(&blocking_lsm_notifier_chain, -- event, data); --} --EXPORT_SYMBOL(call_blocking_lsm_notifier); -- --int register_blocking_lsm_notifier(struct notifier_block *nb) --{ -- return blocking_notifier_chain_register(&blocking_lsm_notifier_chain, -- nb); --} --EXPORT_SYMBOL(register_blocking_lsm_notifier); -- --int unregister_blocking_lsm_notifier(struct notifier_block *nb) --{ -- return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain, -- nb); --} --EXPORT_SYMBOL(unregister_blocking_lsm_notifier); -- - /** - * lsm_blob_alloc - allocate a composite blob - * @dest: the destination for the blob --- -2.50.1 (Apple Git-155) - diff --git a/1302-lsm-split-the-init-code-out-into-lsm-init-c.patch b/1302-lsm-split-the-init-code-out-into-lsm-init-c.patch deleted file mode 100644 index da63e8af9..000000000 --- a/1302-lsm-split-the-init-code-out-into-lsm-init-c.patch +++ /dev/null @@ -1,1301 +0,0 @@ -From 7aa3fb5951fb2b5d19fe0795285a4d2674f125f5 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Fri, 29 May 2026 17:29:20 +0200 -Subject: [PATCH] lsm: split the init code out into lsm_init.c - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - security/security.c: - - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support - for BPF objects"), which is not backported - - need to also carry over bits from RHEL-only commit 1e3e3bce934f - ("CVE-2025-1272: security: Re-enable lockdown LSM in some - setup_arch()") - -commit 67a4b6a89b99aff0883114e4ecba4b11aedc29a5 -Author: Paul Moore -Date: Thu Feb 6 16:44:10 2025 -0500 - - lsm: split the init code out into lsm_init.c - - Continue to pull code out of security/security.c to help improve - readability by pulling all of the LSM framework initialization - code out into a new file. - - No code changes. - - Reviewed-by: Kees Cook - Reviewed-by: John Johansen - Reviewed-by: Casey Schaufler - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index 090d1d3e19fe..eeb4bfd60b79 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -167,11 +167,10 @@ struct lsm_info { - __used __section(".early_lsm_info.init") \ - __aligned(sizeof(unsigned long)) - -+ - /* DO NOT tamper with these variables outside of the LSM framework */ - extern char *lsm_names; - extern struct lsm_static_calls_table static_calls_table __ro_after_init; --extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; --extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; - - /** - * lsm_get_xattr_slot - Return the next available slot and increment the index -diff --git a/security/Makefile b/security/Makefile -index c7a3f1cb2fd5..b40b3740104c 100644 ---- a/security/Makefile -+++ b/security/Makefile -@@ -11,7 +11,7 @@ obj-$(CONFIG_SECURITY) += lsm_syscalls.o - obj-$(CONFIG_MMU) += min_addr.o - - # Object file lists --obj-$(CONFIG_SECURITY) += security.o lsm_notifier.o -+obj-$(CONFIG_SECURITY) += security.o lsm_notifier.o lsm_init.o - obj-$(CONFIG_SECURITYFS) += inode.o - obj-$(CONFIG_SECURITY_SELINUX) += selinux/ - obj-$(CONFIG_SECURITY_SMACK) += smack/ -diff --git a/security/lsm.h b/security/lsm.h -new file mode 100644 -index 000000000000..0e1731bad4a7 ---- /dev/null -+++ b/security/lsm.h -@@ -0,0 +1,22 @@ -+// SPDX-License-Identifier: GPL-2.0-or-later -+/* -+ * LSM functions -+ */ -+ -+#ifndef _LSM_H_ -+#define _LSM_H_ -+ -+#include -+ -+/* LSM blob configuration */ -+extern struct lsm_blob_sizes blob_sizes; -+ -+/* LSM blob caches */ -+extern struct kmem_cache *lsm_file_cache; -+extern struct kmem_cache *lsm_inode_cache; -+ -+/* LSM blob allocators */ -+int lsm_cred_alloc(struct cred *cred, gfp_t gfp); -+int lsm_task_alloc(struct task_struct *task); -+ -+#endif /* _LSM_H_ */ -diff --git a/security/lsm_init.c b/security/lsm_init.c -new file mode 100644 -index 000000000000..aa64e3437d25 ---- /dev/null -+++ b/security/lsm_init.c -@@ -0,0 +1,542 @@ -+// SPDX-License-Identifier: GPL-2.0-or-later -+/* -+ * LSM initialization functions -+ */ -+ -+#define pr_fmt(fmt) "LSM: " fmt -+ -+#include -+#include -+ -+#include "lsm.h" -+ -+char *lsm_names; -+ -+/* Pointers to LSM sections defined in include/asm-generic/vmlinux.lds.h */ -+extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; -+extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; -+ -+/* Boot-time LSM user choice */ -+static __initconst const char *const builtin_lsm_order = CONFIG_LSM; -+static __initdata const char *chosen_lsm_order; -+static __initdata const char *chosen_major_lsm; -+ -+/* Ordered list of LSMs to initialize. */ -+static __initdata struct lsm_info *ordered_lsms[MAX_LSM_COUNT + 1]; -+static __initdata struct lsm_info *exclusive; -+ -+static __initdata bool debug; -+#define init_debug(...) \ -+ do { \ -+ if (debug) \ -+ pr_info(__VA_ARGS__); \ -+ } while (0) -+ -+static int lsm_append(const char *new, char **result); -+ -+/* Save user chosen LSM */ -+static int __init choose_major_lsm(char *str) -+{ -+ chosen_major_lsm = str; -+ return 1; -+} -+__setup("security=", choose_major_lsm); -+ -+/* Explicitly choose LSM initialization order. */ -+static int __init choose_lsm_order(char *str) -+{ -+ chosen_lsm_order = str; -+ return 1; -+} -+__setup("lsm=", choose_lsm_order); -+ -+/* Enable LSM order debugging. */ -+static int __init enable_debug(char *str) -+{ -+ debug = true; -+ return 1; -+} -+__setup("lsm.debug", enable_debug); -+ -+/* Mark an LSM's enabled flag. */ -+static int lsm_enabled_true __initdata = 1; -+static int lsm_enabled_false __initdata = 0; -+static void __init set_enabled(struct lsm_info *lsm, bool enabled) -+{ -+ /* -+ * When an LSM hasn't configured an enable variable, we can use -+ * a hard-coded location for storing the default enabled state. -+ */ -+ if (!lsm->enabled) { -+ if (enabled) -+ lsm->enabled = &lsm_enabled_true; -+ else -+ lsm->enabled = &lsm_enabled_false; -+ } else if (lsm->enabled == &lsm_enabled_true) { -+ if (!enabled) -+ lsm->enabled = &lsm_enabled_false; -+ } else if (lsm->enabled == &lsm_enabled_false) { -+ if (enabled) -+ lsm->enabled = &lsm_enabled_true; -+ } else { -+ *lsm->enabled = enabled; -+ } -+} -+ -+static inline bool is_enabled(struct lsm_info *lsm) -+{ -+ if (!lsm->enabled) -+ return false; -+ -+ return *lsm->enabled; -+} -+ -+/* Is an LSM already listed in the ordered LSMs list? */ -+static bool __init exists_ordered_lsm(struct lsm_info *lsm) -+{ -+ struct lsm_info **check; -+ -+ for (check = ordered_lsms; *check; check++) -+ if (*check == lsm) -+ return true; -+ -+ return false; -+} -+ -+/* Append an LSM to the list of ordered LSMs to initialize. */ -+static int last_lsm __initdata; -+static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) -+{ -+ /* Ignore duplicate selections. */ -+ if (exists_ordered_lsm(lsm)) -+ return; -+ -+ if (WARN(last_lsm == MAX_LSM_COUNT, "%s: out of LSM static calls!?\n", from)) -+ return; -+ -+ /* Enable this LSM, if it is not already set. */ -+ if (!lsm->enabled) -+ lsm->enabled = &lsm_enabled_true; -+ ordered_lsms[last_lsm++] = lsm; -+ -+ init_debug("%s ordered: %s (%s)\n", from, lsm->name, -+ is_enabled(lsm) ? "enabled" : "disabled"); -+} -+ -+/* Is an LSM allowed to be initialized? */ -+static bool __init lsm_allowed(struct lsm_info *lsm) -+{ -+ /* Skip if the LSM is disabled. */ -+ if (!is_enabled(lsm)) -+ return false; -+ -+ /* Not allowed if another exclusive LSM already initialized. */ -+ if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) { -+ init_debug("exclusive disabled: %s\n", lsm->name); -+ return false; -+ } -+ -+ return true; -+} -+ -+static void __init lsm_set_blob_size(int *need, int *lbs) -+{ -+ int offset; -+ -+ if (*need <= 0) -+ return; -+ -+ offset = ALIGN(*lbs, sizeof(void *)); -+ *lbs = offset + *need; -+ *need = offset; -+} -+ -+static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) -+{ -+ if (!needed) -+ return; -+ -+ lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred); -+ lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file); -+ lsm_set_blob_size(&needed->lbs_ib, &blob_sizes.lbs_ib); -+ /* -+ * The inode blob gets an rcu_head in addition to -+ * what the modules might need. -+ */ -+ if (needed->lbs_inode && blob_sizes.lbs_inode == 0) -+ blob_sizes.lbs_inode = sizeof(struct rcu_head); -+ lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode); -+ lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc); -+ lsm_set_blob_size(&needed->lbs_key, &blob_sizes.lbs_key); -+ lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); -+ lsm_set_blob_size(&needed->lbs_perf_event, &blob_sizes.lbs_perf_event); -+ lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock); -+ lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock); -+ lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task); -+ lsm_set_blob_size(&needed->lbs_tun_dev, &blob_sizes.lbs_tun_dev); -+ lsm_set_blob_size(&needed->lbs_xattr_count, -+ &blob_sizes.lbs_xattr_count); -+ lsm_set_blob_size(&needed->lbs_bdev, &blob_sizes.lbs_bdev); -+} -+ -+/* Prepare LSM for initialization. */ -+static void __init prepare_lsm(struct lsm_info *lsm) -+{ -+ int enabled = lsm_allowed(lsm); -+ -+ /* Record enablement (to handle any following exclusive LSMs). */ -+ set_enabled(lsm, enabled); -+ -+ /* If enabled, do pre-initialization work. */ -+ if (enabled) { -+ if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { -+ exclusive = lsm; -+ init_debug("exclusive chosen: %s\n", lsm->name); -+ } -+ -+ lsm_set_blob_sizes(lsm->blobs); -+ } -+} -+ -+/* Initialize a given LSM, if it is enabled. */ -+static void __init initialize_lsm(struct lsm_info *lsm) -+{ -+ if (is_enabled(lsm)) { -+ int ret; -+ -+ init_debug("initializing %s\n", lsm->name); -+ ret = lsm->init(); -+ WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret); -+ } -+} -+ -+/* -+ * Current index to use while initializing the lsm id list. -+ */ -+u32 lsm_active_cnt __ro_after_init; -+const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; -+ -+/* Populate ordered LSMs list from comma-separated LSM name list. */ -+static void __init ordered_lsm_parse(const char *order, const char *origin) -+{ -+ struct lsm_info *lsm; -+ char *sep, *name, *next; -+ -+ /* LSM_ORDER_FIRST is always first. */ -+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ if (lsm->order == LSM_ORDER_FIRST) -+ append_ordered_lsm(lsm, " first"); -+ } -+ -+ /* Process "security=", if given. */ -+ if (chosen_major_lsm) { -+ struct lsm_info *major; -+ -+ /* -+ * To match the original "security=" behavior, this -+ * explicitly does NOT fallback to another Legacy Major -+ * if the selected one was separately disabled: disable -+ * all non-matching Legacy Major LSMs. -+ */ -+ for (major = __start_lsm_info; major < __end_lsm_info; -+ major++) { -+ if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && -+ strcmp(major->name, chosen_major_lsm) != 0) { -+ set_enabled(major, false); -+ init_debug("security=%s disabled: %s (only one legacy major LSM)\n", -+ chosen_major_lsm, major->name); -+ } -+ } -+ } -+ -+ sep = kstrdup(order, GFP_KERNEL); -+ next = sep; -+ /* Walk the list, looking for matching LSMs. */ -+ while ((name = strsep(&next, ",")) != NULL) { -+ bool found = false; -+ -+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ if (strcmp(lsm->name, name) == 0) { -+ if (lsm->order == LSM_ORDER_MUTABLE) -+ append_ordered_lsm(lsm, origin); -+ found = true; -+ } -+ } -+ -+ if (!found) -+ init_debug("%s ignored: %s (not built into kernel)\n", -+ origin, name); -+ } -+ -+ /* Process "security=", if given. */ -+ if (chosen_major_lsm) { -+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ if (exists_ordered_lsm(lsm)) -+ continue; -+ if (strcmp(lsm->name, chosen_major_lsm) == 0) -+ append_ordered_lsm(lsm, "security="); -+ } -+ } -+ -+ /* LSM_ORDER_LAST is always last. */ -+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ if (lsm->order == LSM_ORDER_LAST) -+ append_ordered_lsm(lsm, " last"); -+ } -+ -+ /* Disable all LSMs not in the ordered list. */ -+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ if (exists_ordered_lsm(lsm)) -+ continue; -+ set_enabled(lsm, false); -+ init_debug("%s skipped: %s (not in requested order)\n", -+ origin, lsm->name); -+ } -+ -+ kfree(sep); -+} -+ -+static void __init report_lsm_order(void) -+{ -+ struct lsm_info **lsm, *early; -+ int first = 0; -+ -+ pr_info("initializing lsm="); -+ -+ /* Report each enabled LSM name, comma separated. */ -+ for (early = __start_early_lsm_info; -+ early < __end_early_lsm_info; early++) -+ if (is_enabled(early)) -+ pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); -+ for (lsm = ordered_lsms; *lsm; lsm++) -+ if (is_enabled(*lsm)) -+ pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); -+ -+ pr_cont("\n"); -+} -+ -+/** -+ * lsm_early_cred - during initialization allocate a composite cred blob -+ * @cred: the cred that needs a blob -+ * -+ * Allocate the cred blob for all the modules -+ */ -+static void __init lsm_early_cred(struct cred *cred) -+{ -+ int rc = lsm_cred_alloc(cred, GFP_KERNEL); -+ -+ if (rc) -+ panic("%s: Early cred alloc failed.\n", __func__); -+} -+ -+/** -+ * lsm_early_task - during initialization allocate a composite task blob -+ * @task: the task that needs a blob -+ * -+ * Allocate the task blob for all the modules -+ */ -+static void __init lsm_early_task(struct task_struct *task) -+{ -+ int rc = lsm_task_alloc(task); -+ -+ if (rc) -+ panic("%s: Early task alloc failed.\n", __func__); -+} -+ -+static void __init ordered_lsm_init(void) -+{ -+ struct lsm_info **lsm; -+ -+ if (chosen_lsm_order) { -+ if (chosen_major_lsm) { -+ pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", -+ chosen_major_lsm, chosen_lsm_order); -+ chosen_major_lsm = NULL; -+ } -+ ordered_lsm_parse(chosen_lsm_order, "cmdline"); -+ } else -+ ordered_lsm_parse(builtin_lsm_order, "builtin"); -+ -+ for (lsm = ordered_lsms; *lsm; lsm++) -+ prepare_lsm(*lsm); -+ -+ report_lsm_order(); -+ -+ init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); -+ init_debug("file blob size = %d\n", blob_sizes.lbs_file); -+ init_debug("ib blob size = %d\n", blob_sizes.lbs_ib); -+ init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); -+ init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); -+#ifdef CONFIG_KEYS -+ init_debug("key blob size = %d\n", blob_sizes.lbs_key); -+#endif /* CONFIG_KEYS */ -+ init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); -+ init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); -+ init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); -+ init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event); -+ init_debug("task blob size = %d\n", blob_sizes.lbs_task); -+ init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev); -+ init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); -+ init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev); -+ -+ /* -+ * Create any kmem_caches needed for blobs -+ */ -+ if (blob_sizes.lbs_file) -+ lsm_file_cache = kmem_cache_create("lsm_file_cache", -+ blob_sizes.lbs_file, 0, -+ SLAB_PANIC, NULL); -+ if (blob_sizes.lbs_inode) -+ lsm_inode_cache = kmem_cache_create("lsm_inode_cache", -+ blob_sizes.lbs_inode, 0, -+ SLAB_PANIC, NULL); -+ -+ lsm_early_cred((struct cred *) current->cred); -+ lsm_early_task(current); -+ for (lsm = ordered_lsms; *lsm; lsm++) -+ initialize_lsm(*lsm); -+} -+ -+static bool match_last_lsm(const char *list, const char *lsm) -+{ -+ const char *last; -+ -+ if (WARN_ON(!list || !lsm)) -+ return false; -+ last = strrchr(list, ','); -+ if (last) -+ /* Pass the comma, strcmp() will check for '\0' */ -+ last++; -+ else -+ last = list; -+ return !strcmp(last, lsm); -+} -+ -+static int lsm_append(const char *new, char **result) -+{ -+ char *cp; -+ -+ if (*result == NULL) { -+ *result = kstrdup(new, GFP_KERNEL); -+ if (*result == NULL) -+ return -ENOMEM; -+ } else { -+ /* Check if it is the last registered name */ -+ if (match_last_lsm(*result, new)) -+ return 0; -+ cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new); -+ if (cp == NULL) -+ return -ENOMEM; -+ kfree(*result); -+ *result = cp; -+ } -+ return 0; -+} -+ -+static void __init lsm_static_call_init(struct security_hook_list *hl) -+{ -+ struct lsm_static_call *scall = hl->scalls; -+ int i; -+ -+ for (i = 0; i < MAX_LSM_COUNT; i++) { -+ /* Update the first static call that is not used yet */ -+ if (!scall->hl) { -+ __static_call_update(scall->key, scall->trampoline, -+ hl->hook.lsm_func_addr); -+ scall->hl = hl; -+ static_branch_enable(scall->active); -+ return; -+ } -+ scall++; -+ } -+ panic("%s - Ran out of static slots.\n", __func__); -+} -+ -+/** -+ * security_add_hooks - Add a modules hooks to the hook lists. -+ * @hooks: the hooks to add -+ * @count: the number of hooks to add -+ * @lsmid: the identification information for the security module -+ * -+ * Each LSM has to register its hooks with the infrastructure. -+ */ -+void __init security_add_hooks(struct security_hook_list *hooks, int count, -+ const struct lsm_id *lsmid) -+{ -+ int i; -+ -+ /* -+ * A security module may call security_add_hooks() more -+ * than once during initialization, and LSM initialization -+ * is serialized. Landlock is one such case. -+ * Look at the previous entry, if there is one, for duplication. -+ */ -+ if (lsm_active_cnt == 0 || lsm_idlist[lsm_active_cnt - 1] != lsmid) { -+ if (lsm_active_cnt >= MAX_LSM_COUNT) -+ panic("%s Too many LSMs registered.\n", __func__); -+ lsm_idlist[lsm_active_cnt++] = lsmid; -+ } -+ -+ for (i = 0; i < count; i++) { -+ hooks[i].lsmid = lsmid; -+ lsm_static_call_init(&hooks[i]); -+ } -+ -+ /* -+ * Don't try to append during early_security_init(), we'll come back -+ * and fix this up afterwards. -+ */ -+ if (slab_is_available()) { -+ if (lsm_append(lsmid->name, &lsm_names) < 0) -+ panic("%s - Cannot get early memory.\n", __func__); -+ } -+} -+ -+int __init early_security_init(void) -+{ -+ struct lsm_info *lsm; -+ static bool early_security_initialized; -+ -+ if (early_security_initialized) -+ return 0; -+ -+ for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { -+ if (!lsm->enabled) -+ lsm->enabled = &lsm_enabled_true; -+ prepare_lsm(lsm); -+ initialize_lsm(lsm); -+ } -+ -+ early_security_initialized = true; -+ return 0; -+} -+ -+/** -+ * security_init - initializes the security framework -+ * -+ * This should be called early in the kernel initialization sequence. -+ */ -+int __init security_init(void) -+{ -+ struct lsm_info *lsm; -+ -+ init_debug("legacy security=%s\n", chosen_major_lsm ? : " *unspecified*"); -+ init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order); -+ init_debug("boot arg lsm=%s\n", chosen_lsm_order ? : " *unspecified*"); -+ -+ /* -+ * Append the names of the early LSM modules now that kmalloc() is -+ * available -+ */ -+ for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { -+ init_debug(" early started: %s (%s)\n", lsm->name, -+ is_enabled(lsm) ? "enabled" : "disabled"); -+ if (lsm->enabled) -+ lsm_append(lsm->name, &lsm_names); -+ } -+ -+ /* Load LSMs in specified order. */ -+ ordered_lsm_init(); -+ -+ return 0; -+} -diff --git a/security/security.c b/security/security.c -index 9a5f9a2f8ff3..6040891f4588 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -33,24 +33,7 @@ - #include - #include - --#define SECURITY_HOOK_ACTIVE_KEY(HOOK, IDX) security_hook_active_##HOOK##_##IDX -- --/* -- * Identifier for the LSM static calls. -- * HOOK is an LSM hook as defined in linux/lsm_hookdefs.h -- * IDX is the index of the static call. 0 <= NUM < MAX_LSM_COUNT -- */ --#define LSM_STATIC_CALL(HOOK, IDX) lsm_static_call_##HOOK##_##IDX -- --/* -- * Call the macro M for each LSM hook MAX_LSM_COUNT times. -- */ --#define LSM_LOOP_UNROLL(M, ...) \ --do { \ -- UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__) \ --} while (0) -- --#define LSM_DEFINE_UNROLL(M, ...) UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__) -+#include "lsm.h" - - /* - * These are descriptions of the reasons that can be passed to the -@@ -91,21 +74,29 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { - [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", - }; - --static struct kmem_cache *lsm_file_cache; --static struct kmem_cache *lsm_inode_cache; -+struct lsm_blob_sizes blob_sizes; - --char *lsm_names; --static struct lsm_blob_sizes blob_sizes __ro_after_init; -+struct kmem_cache *lsm_file_cache; -+struct kmem_cache *lsm_inode_cache; - --/* Boot-time LSM user choice */ --static __initdata const char *chosen_lsm_order; --static __initdata const char *chosen_major_lsm; -+#define SECURITY_HOOK_ACTIVE_KEY(HOOK, IDX) security_hook_active_##HOOK##_##IDX - --static __initconst const char *const builtin_lsm_order = CONFIG_LSM; -+/* -+ * Identifier for the LSM static calls. -+ * HOOK is an LSM hook as defined in linux/lsm_hookdefs.h -+ * IDX is the index of the static call. 0 <= NUM < MAX_LSM_COUNT -+ */ -+#define LSM_STATIC_CALL(HOOK, IDX) lsm_static_call_##HOOK##_##IDX -+ -+/* -+ * Call the macro M for each LSM hook MAX_LSM_COUNT times. -+ */ -+#define LSM_LOOP_UNROLL(M, ...) \ -+do { \ -+ UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__) \ -+} while (0) - --/* Ordered list of LSMs to initialize. */ --static __initdata struct lsm_info *ordered_lsms[MAX_LSM_COUNT + 1]; --static __initdata struct lsm_info *exclusive; -+#define LSM_DEFINE_UNROLL(M, ...) UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__) - - #ifdef CONFIG_HAVE_STATIC_CALL - #define LSM_HOOK_TRAMP(NAME, NUM) \ -@@ -156,495 +147,25 @@ struct lsm_static_calls_table - #undef INIT_LSM_STATIC_CALL - }; - --static __initdata bool debug; --#define init_debug(...) \ -- do { \ -- if (debug) \ -- pr_info(__VA_ARGS__); \ -- } while (0) -- --static bool __init is_enabled(struct lsm_info *lsm) --{ -- if (!lsm->enabled) -- return false; -- -- return *lsm->enabled; --} -- --/* Mark an LSM's enabled flag. */ --static int lsm_enabled_true __initdata = 1; --static int lsm_enabled_false __initdata = 0; --static void __init set_enabled(struct lsm_info *lsm, bool enabled) --{ -- /* -- * When an LSM hasn't configured an enable variable, we can use -- * a hard-coded location for storing the default enabled state. -- */ -- if (!lsm->enabled) { -- if (enabled) -- lsm->enabled = &lsm_enabled_true; -- else -- lsm->enabled = &lsm_enabled_false; -- } else if (lsm->enabled == &lsm_enabled_true) { -- if (!enabled) -- lsm->enabled = &lsm_enabled_false; -- } else if (lsm->enabled == &lsm_enabled_false) { -- if (enabled) -- lsm->enabled = &lsm_enabled_true; -- } else { -- *lsm->enabled = enabled; -- } --} -- --/* Is an LSM already listed in the ordered LSMs list? */ --static bool __init exists_ordered_lsm(struct lsm_info *lsm) --{ -- struct lsm_info **check; -- -- for (check = ordered_lsms; *check; check++) -- if (*check == lsm) -- return true; -- -- return false; --} -- --/* Append an LSM to the list of ordered LSMs to initialize. */ --static int last_lsm __initdata; --static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) --{ -- /* Ignore duplicate selections. */ -- if (exists_ordered_lsm(lsm)) -- return; -- -- if (WARN(last_lsm == MAX_LSM_COUNT, "%s: out of LSM static calls!?\n", from)) -- return; -- -- /* Enable this LSM, if it is not already set. */ -- if (!lsm->enabled) -- lsm->enabled = &lsm_enabled_true; -- ordered_lsms[last_lsm++] = lsm; -- -- init_debug("%s ordered: %s (%s)\n", from, lsm->name, -- is_enabled(lsm) ? "enabled" : "disabled"); --} -- --/* Is an LSM allowed to be initialized? */ --static bool __init lsm_allowed(struct lsm_info *lsm) --{ -- /* Skip if the LSM is disabled. */ -- if (!is_enabled(lsm)) -- return false; -- -- /* Not allowed if another exclusive LSM already initialized. */ -- if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) { -- init_debug("exclusive disabled: %s\n", lsm->name); -- return false; -- } -- -- return true; --} -- --static void __init lsm_set_blob_size(int *need, int *lbs) --{ -- int offset; -- -- if (*need <= 0) -- return; -- -- offset = ALIGN(*lbs, sizeof(void *)); -- *lbs = offset + *need; -- *need = offset; --} -- --static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) --{ -- if (!needed) -- return; -- -- lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred); -- lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file); -- lsm_set_blob_size(&needed->lbs_ib, &blob_sizes.lbs_ib); -- /* -- * The inode blob gets an rcu_head in addition to -- * what the modules might need. -- */ -- if (needed->lbs_inode && blob_sizes.lbs_inode == 0) -- blob_sizes.lbs_inode = sizeof(struct rcu_head); -- lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode); -- lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc); -- lsm_set_blob_size(&needed->lbs_key, &blob_sizes.lbs_key); -- lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); -- lsm_set_blob_size(&needed->lbs_perf_event, &blob_sizes.lbs_perf_event); -- lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock); -- lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock); -- lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task); -- lsm_set_blob_size(&needed->lbs_tun_dev, &blob_sizes.lbs_tun_dev); -- lsm_set_blob_size(&needed->lbs_xattr_count, -- &blob_sizes.lbs_xattr_count); -- lsm_set_blob_size(&needed->lbs_bdev, &blob_sizes.lbs_bdev); --} -- --/* Prepare LSM for initialization. */ --static void __init prepare_lsm(struct lsm_info *lsm) --{ -- int enabled = lsm_allowed(lsm); -- -- /* Record enablement (to handle any following exclusive LSMs). */ -- set_enabled(lsm, enabled); -- -- /* If enabled, do pre-initialization work. */ -- if (enabled) { -- if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { -- exclusive = lsm; -- init_debug("exclusive chosen: %s\n", lsm->name); -- } -- -- lsm_set_blob_sizes(lsm->blobs); -- } --} -- --/* Initialize a given LSM, if it is enabled. */ --static void __init initialize_lsm(struct lsm_info *lsm) --{ -- if (is_enabled(lsm)) { -- int ret; -- -- init_debug("initializing %s\n", lsm->name); -- ret = lsm->init(); -- WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret); -- } --} -- --/* -- * Current index to use while initializing the lsm id list. -- */ --u32 lsm_active_cnt __ro_after_init; --const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; -- --/* Populate ordered LSMs list from comma-separated LSM name list. */ --static void __init ordered_lsm_parse(const char *order, const char *origin) --{ -- struct lsm_info *lsm; -- char *sep, *name, *next; -- -- /* LSM_ORDER_FIRST is always first. */ -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -- if (lsm->order == LSM_ORDER_FIRST) -- append_ordered_lsm(lsm, " first"); -- } -- -- /* Process "security=", if given. */ -- if (chosen_major_lsm) { -- struct lsm_info *major; -- -- /* -- * To match the original "security=" behavior, this -- * explicitly does NOT fallback to another Legacy Major -- * if the selected one was separately disabled: disable -- * all non-matching Legacy Major LSMs. -- */ -- for (major = __start_lsm_info; major < __end_lsm_info; -- major++) { -- if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && -- strcmp(major->name, chosen_major_lsm) != 0) { -- set_enabled(major, false); -- init_debug("security=%s disabled: %s (only one legacy major LSM)\n", -- chosen_major_lsm, major->name); -- } -- } -- } -- -- sep = kstrdup(order, GFP_KERNEL); -- next = sep; -- /* Walk the list, looking for matching LSMs. */ -- while ((name = strsep(&next, ",")) != NULL) { -- bool found = false; -- -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -- if (strcmp(lsm->name, name) == 0) { -- if (lsm->order == LSM_ORDER_MUTABLE) -- append_ordered_lsm(lsm, origin); -- found = true; -- } -- } -- -- if (!found) -- init_debug("%s ignored: %s (not built into kernel)\n", -- origin, name); -- } -- -- /* Process "security=", if given. */ -- if (chosen_major_lsm) { -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -- if (exists_ordered_lsm(lsm)) -- continue; -- if (strcmp(lsm->name, chosen_major_lsm) == 0) -- append_ordered_lsm(lsm, "security="); -- } -- } -- -- /* LSM_ORDER_LAST is always last. */ -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -- if (lsm->order == LSM_ORDER_LAST) -- append_ordered_lsm(lsm, " last"); -- } -- -- /* Disable all LSMs not in the ordered list. */ -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -- if (exists_ordered_lsm(lsm)) -- continue; -- set_enabled(lsm, false); -- init_debug("%s skipped: %s (not in requested order)\n", -- origin, lsm->name); -- } -- -- kfree(sep); --} -- --static void __init lsm_static_call_init(struct security_hook_list *hl) --{ -- struct lsm_static_call *scall = hl->scalls; -- int i; -- -- for (i = 0; i < MAX_LSM_COUNT; i++) { -- /* Update the first static call that is not used yet */ -- if (!scall->hl) { -- __static_call_update(scall->key, scall->trampoline, -- hl->hook.lsm_func_addr); -- scall->hl = hl; -- static_branch_enable(scall->active); -- return; -- } -- scall++; -- } -- panic("%s - Ran out of static slots.\n", __func__); --} -- --static void __init lsm_early_cred(struct cred *cred); --static void __init lsm_early_task(struct task_struct *task); -- --static int lsm_append(const char *new, char **result); -- --static void __init report_lsm_order(void) --{ -- struct lsm_info **lsm, *early; -- int first = 0; -- -- pr_info("initializing lsm="); -- -- /* Report each enabled LSM name, comma separated. */ -- for (early = __start_early_lsm_info; -- early < __end_early_lsm_info; early++) -- if (is_enabled(early)) -- pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); -- for (lsm = ordered_lsms; *lsm; lsm++) -- if (is_enabled(*lsm)) -- pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); -- -- pr_cont("\n"); --} -- --static void __init ordered_lsm_init(void) --{ -- struct lsm_info **lsm; -- -- if (chosen_lsm_order) { -- if (chosen_major_lsm) { -- pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", -- chosen_major_lsm, chosen_lsm_order); -- chosen_major_lsm = NULL; -- } -- ordered_lsm_parse(chosen_lsm_order, "cmdline"); -- } else -- ordered_lsm_parse(builtin_lsm_order, "builtin"); -- -- for (lsm = ordered_lsms; *lsm; lsm++) -- prepare_lsm(*lsm); -- -- report_lsm_order(); -- -- init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); -- init_debug("file blob size = %d\n", blob_sizes.lbs_file); -- init_debug("ib blob size = %d\n", blob_sizes.lbs_ib); -- init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); -- init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); --#ifdef CONFIG_KEYS -- init_debug("key blob size = %d\n", blob_sizes.lbs_key); --#endif /* CONFIG_KEYS */ -- init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); -- init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); -- init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); -- init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event); -- init_debug("task blob size = %d\n", blob_sizes.lbs_task); -- init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev); -- init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); -- init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev); -- -- /* -- * Create any kmem_caches needed for blobs -- */ -- if (blob_sizes.lbs_file) -- lsm_file_cache = kmem_cache_create("lsm_file_cache", -- blob_sizes.lbs_file, 0, -- SLAB_PANIC, NULL); -- if (blob_sizes.lbs_inode) -- lsm_inode_cache = kmem_cache_create("lsm_inode_cache", -- blob_sizes.lbs_inode, 0, -- SLAB_PANIC, NULL); -- -- lsm_early_cred((struct cred *) current->cred); -- lsm_early_task(current); -- for (lsm = ordered_lsms; *lsm; lsm++) -- initialize_lsm(*lsm); --} -- --int __init early_security_init(void) --{ -- struct lsm_info *lsm; -- static bool early_security_initialized; -- -- if (early_security_initialized) -- return 0; -- -- for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { -- if (!lsm->enabled) -- lsm->enabled = &lsm_enabled_true; -- prepare_lsm(lsm); -- initialize_lsm(lsm); -- } -- -- early_security_initialized = true; -- return 0; --} -- - /** -- * security_init - initializes the security framework -+ * lsm_file_alloc - allocate a composite file blob -+ * @file: the file that needs a blob - * -- * This should be called early in the kernel initialization sequence. -- */ --int __init security_init(void) --{ -- struct lsm_info *lsm; -- -- init_debug("legacy security=%s\n", chosen_major_lsm ? : " *unspecified*"); -- init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order); -- init_debug("boot arg lsm=%s\n", chosen_lsm_order ? : " *unspecified*"); -- -- /* -- * Append the names of the early LSM modules now that kmalloc() is -- * available -- */ -- for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { -- init_debug(" early started: %s (%s)\n", lsm->name, -- is_enabled(lsm) ? "enabled" : "disabled"); -- if (lsm->enabled) -- lsm_append(lsm->name, &lsm_names); -- } -- -- /* Load LSMs in specified order. */ -- ordered_lsm_init(); -- -- return 0; --} -- --/* Save user chosen LSM */ --static int __init choose_major_lsm(char *str) --{ -- chosen_major_lsm = str; -- return 1; --} --__setup("security=", choose_major_lsm); -- --/* Explicitly choose LSM initialization order. */ --static int __init choose_lsm_order(char *str) --{ -- chosen_lsm_order = str; -- return 1; --} --__setup("lsm=", choose_lsm_order); -- --/* Enable LSM order debugging. */ --static int __init enable_debug(char *str) --{ -- debug = true; -- return 1; --} --__setup("lsm.debug", enable_debug); -- --static bool match_last_lsm(const char *list, const char *lsm) --{ -- const char *last; -- -- if (WARN_ON(!list || !lsm)) -- return false; -- last = strrchr(list, ','); -- if (last) -- /* Pass the comma, strcmp() will check for '\0' */ -- last++; -- else -- last = list; -- return !strcmp(last, lsm); --} -- --static int lsm_append(const char *new, char **result) --{ -- char *cp; -- -- if (*result == NULL) { -- *result = kstrdup(new, GFP_KERNEL); -- if (*result == NULL) -- return -ENOMEM; -- } else { -- /* Check if it is the last registered name */ -- if (match_last_lsm(*result, new)) -- return 0; -- cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new); -- if (cp == NULL) -- return -ENOMEM; -- kfree(*result); -- *result = cp; -- } -- return 0; --} -- --/** -- * security_add_hooks - Add a modules hooks to the hook lists. -- * @hooks: the hooks to add -- * @count: the number of hooks to add -- * @lsmid: the identification information for the security module -+ * Allocate the file blob for all the modules - * -- * Each LSM has to register its hooks with the infrastructure. -+ * Returns 0, or -ENOMEM if memory can't be allocated. - */ --void __init security_add_hooks(struct security_hook_list *hooks, int count, -- const struct lsm_id *lsmid) -+static int lsm_file_alloc(struct file *file) - { -- int i; -- -- /* -- * A security module may call security_add_hooks() more -- * than once during initialization, and LSM initialization -- * is serialized. Landlock is one such case. -- * Look at the previous entry, if there is one, for duplication. -- */ -- if (lsm_active_cnt == 0 || lsm_idlist[lsm_active_cnt - 1] != lsmid) { -- if (lsm_active_cnt >= MAX_LSM_COUNT) -- panic("%s Too many LSMs registered.\n", __func__); -- lsm_idlist[lsm_active_cnt++] = lsmid; -- } -- -- for (i = 0; i < count; i++) { -- hooks[i].lsmid = lsmid; -- lsm_static_call_init(&hooks[i]); -+ if (!lsm_file_cache) { -+ file->f_security = NULL; -+ return 0; - } - -- /* -- * Don't try to append during early_security_init(), we'll come back -- * and fix this up afterwards. -- */ -- if (slab_is_available()) { -- if (lsm_append(lsmid->name, &lsm_names) < 0) -- panic("%s - Cannot get early memory.\n", __func__); -- } -+ file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL); -+ if (file->f_security == NULL) -+ return -ENOMEM; -+ return 0; - } - - /** -@@ -679,46 +200,11 @@ static int lsm_blob_alloc(void **dest, size_t size, gfp_t gfp) - * - * Returns 0, or -ENOMEM if memory can't be allocated. - */ --static int lsm_cred_alloc(struct cred *cred, gfp_t gfp) -+int lsm_cred_alloc(struct cred *cred, gfp_t gfp) - { - return lsm_blob_alloc(&cred->security, blob_sizes.lbs_cred, gfp); - } - --/** -- * lsm_early_cred - during initialization allocate a composite cred blob -- * @cred: the cred that needs a blob -- * -- * Allocate the cred blob for all the modules -- */ --static void __init lsm_early_cred(struct cred *cred) --{ -- int rc = lsm_cred_alloc(cred, GFP_KERNEL); -- -- if (rc) -- panic("%s: Early cred alloc failed.\n", __func__); --} -- --/** -- * lsm_file_alloc - allocate a composite file blob -- * @file: the file that needs a blob -- * -- * Allocate the file blob for all the modules -- * -- * Returns 0, or -ENOMEM if memory can't be allocated. -- */ --static int lsm_file_alloc(struct file *file) --{ -- if (!lsm_file_cache) { -- file->f_security = NULL; -- return 0; -- } -- -- file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL); -- if (file->f_security == NULL) -- return -ENOMEM; -- return 0; --} -- - /** - * lsm_inode_alloc - allocate a composite inode blob - * @inode: the inode that needs a blob -@@ -749,7 +235,7 @@ static int lsm_inode_alloc(struct inode *inode, gfp_t gfp) - * - * Returns 0, or -ENOMEM if memory can't be allocated. - */ --static int lsm_task_alloc(struct task_struct *task) -+int lsm_task_alloc(struct task_struct *task) - { - return lsm_blob_alloc(&task->security, blob_sizes.lbs_task, GFP_KERNEL); - } -@@ -818,20 +304,6 @@ static int lsm_bdev_alloc(struct block_device *bdev) - return 0; - } - --/** -- * lsm_early_task - during initialization allocate a composite task blob -- * @task: the task that needs a blob -- * -- * Allocate the task blob for all the modules -- */ --static void __init lsm_early_task(struct task_struct *task) --{ -- int rc = lsm_task_alloc(task); -- -- if (rc) -- panic("%s: Early task alloc failed.\n", __func__); --} -- - /** - * lsm_superblock_alloc - allocate a composite superblock blob - * @sb: the superblock that needs a blob --- -2.50.1 (Apple Git-155) - diff --git a/1303-lsm-consolidate-lsm-allowed-and-prepare-lsm-into-lsm-prepare.patch b/1303-lsm-consolidate-lsm-allowed-and-prepare-lsm-into-lsm-prepare.patch deleted file mode 100644 index 5bece84b3..000000000 --- a/1303-lsm-consolidate-lsm-allowed-and-prepare-lsm-into-lsm-prepare.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 204c54d19e2c1e71bf75a49bb07d965bee634401 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Fri, 29 May 2026 17:43:36 +0200 -Subject: [PATCH] lsm: consolidate lsm_allowed() and prepare_lsm() into - lsm_prepare() - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for - BPF objects"), which is not backported - -commit e02578561d47567be26e603c6d27c10a5aa4c2c4 -Author: Paul Moore -Date: Tue Feb 11 12:19:47 2025 -0500 - - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() - - Simplify and consolidate the lsm_allowed() and prepare_lsm() functions - into a new function, lsm_prepare(). - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index aa64e3437d25..719835ec8f0a 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -123,22 +123,6 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) - is_enabled(lsm) ? "enabled" : "disabled"); - } - --/* Is an LSM allowed to be initialized? */ --static bool __init lsm_allowed(struct lsm_info *lsm) --{ -- /* Skip if the LSM is disabled. */ -- if (!is_enabled(lsm)) -- return false; -- -- /* Not allowed if another exclusive LSM already initialized. */ -- if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) { -- init_debug("exclusive disabled: %s\n", lsm->name); -- return false; -- } -- -- return true; --} -- - static void __init lsm_set_blob_size(int *need, int *lbs) - { - int offset; -@@ -151,51 +135,50 @@ static void __init lsm_set_blob_size(int *need, int *lbs) - *need = offset; - } - --static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) -+/** -+ * lsm_prepare - Prepare the LSM framework for a new LSM -+ * @lsm: LSM definition -+ */ -+static void __init lsm_prepare(struct lsm_info *lsm) - { -- if (!needed) -+ struct lsm_blob_sizes *blobs; -+ -+ if (!is_enabled(lsm)) { -+ set_enabled(lsm, false); - return; -+ } else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) { -+ init_debug("exclusive disabled: %s\n", lsm->name); -+ set_enabled(lsm, false); -+ return; -+ } - -- lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred); -- lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file); -- lsm_set_blob_size(&needed->lbs_ib, &blob_sizes.lbs_ib); -- /* -- * The inode blob gets an rcu_head in addition to -- * what the modules might need. -- */ -- if (needed->lbs_inode && blob_sizes.lbs_inode == 0) -+ /* Mark the LSM as enabled. */ -+ set_enabled(lsm, true); -+ if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { -+ init_debug("exclusive chosen: %s\n", lsm->name); -+ exclusive = lsm; -+ } -+ -+ /* Register the LSM blob sizes. */ -+ blobs = lsm->blobs; -+ lsm_set_blob_size(&blobs->lbs_cred, &blob_sizes.lbs_cred); -+ lsm_set_blob_size(&blobs->lbs_file, &blob_sizes.lbs_file); -+ lsm_set_blob_size(&blobs->lbs_ib, &blob_sizes.lbs_ib); -+ /* inode blob gets an rcu_head in addition to LSM blobs. */ -+ if (blobs->lbs_inode && blob_sizes.lbs_inode == 0) - blob_sizes.lbs_inode = sizeof(struct rcu_head); -- lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode); -- lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc); -- lsm_set_blob_size(&needed->lbs_key, &blob_sizes.lbs_key); -- lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); -- lsm_set_blob_size(&needed->lbs_perf_event, &blob_sizes.lbs_perf_event); -- lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock); -- lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock); -- lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task); -- lsm_set_blob_size(&needed->lbs_tun_dev, &blob_sizes.lbs_tun_dev); -- lsm_set_blob_size(&needed->lbs_xattr_count, -+ lsm_set_blob_size(&blobs->lbs_inode, &blob_sizes.lbs_inode); -+ lsm_set_blob_size(&blobs->lbs_ipc, &blob_sizes.lbs_ipc); -+ lsm_set_blob_size(&blobs->lbs_key, &blob_sizes.lbs_key); -+ lsm_set_blob_size(&blobs->lbs_msg_msg, &blob_sizes.lbs_msg_msg); -+ lsm_set_blob_size(&blobs->lbs_perf_event, &blob_sizes.lbs_perf_event); -+ lsm_set_blob_size(&blobs->lbs_sock, &blob_sizes.lbs_sock); -+ lsm_set_blob_size(&blobs->lbs_superblock, &blob_sizes.lbs_superblock); -+ lsm_set_blob_size(&blobs->lbs_task, &blob_sizes.lbs_task); -+ lsm_set_blob_size(&blobs->lbs_tun_dev, &blob_sizes.lbs_tun_dev); -+ lsm_set_blob_size(&blobs->lbs_xattr_count, - &blob_sizes.lbs_xattr_count); -- lsm_set_blob_size(&needed->lbs_bdev, &blob_sizes.lbs_bdev); --} -- --/* Prepare LSM for initialization. */ --static void __init prepare_lsm(struct lsm_info *lsm) --{ -- int enabled = lsm_allowed(lsm); -- -- /* Record enablement (to handle any following exclusive LSMs). */ -- set_enabled(lsm, enabled); -- -- /* If enabled, do pre-initialization work. */ -- if (enabled) { -- if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { -- exclusive = lsm; -- init_debug("exclusive chosen: %s\n", lsm->name); -- } -- -- lsm_set_blob_sizes(lsm->blobs); -- } -+ lsm_set_blob_size(&blobs->lbs_bdev, &blob_sizes.lbs_bdev); - } - - /* Initialize a given LSM, if it is enabled. */ -@@ -358,7 +341,7 @@ static void __init ordered_lsm_init(void) - ordered_lsm_parse(builtin_lsm_order, "builtin"); - - for (lsm = ordered_lsms; *lsm; lsm++) -- prepare_lsm(*lsm); -+ lsm_prepare(*lsm); - - report_lsm_order(); - -@@ -503,7 +486,7 @@ int __init early_security_init(void) - for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { - if (!lsm->enabled) - lsm->enabled = &lsm_enabled_true; -- prepare_lsm(lsm); -+ lsm_prepare(lsm); - initialize_lsm(lsm); - } - --- -2.50.1 (Apple Git-155) - diff --git a/1304-lsm-introduce-looping-macros-for-the-initialization-code.patch b/1304-lsm-introduce-looping-macros-for-the-initialization-code.patch deleted file mode 100644 index 255dbb2be..000000000 --- a/1304-lsm-introduce-looping-macros-for-the-initialization-code.patch +++ /dev/null @@ -1,172 +0,0 @@ -From 92ed776aa54bac14d013ad9b08ad44b7ed8af0ea Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Fri, 29 May 2026 18:31:38 +0200 -Subject: [PATCH] lsm: introduce looping macros for the initialization code - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 37f788f65528611f4482e2135d11ca34afb25828 -Author: Paul Moore -Date: Wed Apr 9 17:59:42 2025 -0400 - - lsm: introduce looping macros for the initialization code - - There are three common for loop patterns in the LSM initialization code - to loop through the ordered LSM list and the registered "early" LSMs. - This patch implements these loop patterns as macros to help simplify the - code and reduce the chance for errors. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 719835ec8f0a..2424975ca0eb 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -32,6 +32,15 @@ static __initdata bool debug; - pr_info(__VA_ARGS__); \ - } while (0) - -+#define lsm_order_for_each(iter) \ -+ for ((iter) = ordered_lsms; *(iter); (iter)++) -+#define lsm_for_each_raw(iter) \ -+ for ((iter) = __start_lsm_info; \ -+ (iter) < __end_lsm_info; (iter)++) -+#define lsm_early_for_each_raw(iter) \ -+ for ((iter) = __start_early_lsm_info; \ -+ (iter) < __end_early_lsm_info; (iter)++) -+ - static int lsm_append(const char *new, char **result); - - /* Save user chosen LSM */ -@@ -96,9 +105,10 @@ static bool __init exists_ordered_lsm(struct lsm_info *lsm) - { - struct lsm_info **check; - -- for (check = ordered_lsms; *check; check++) -+ lsm_order_for_each(check) { - if (*check == lsm) - return true; -+ } - - return false; - } -@@ -206,7 +216,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - char *sep, *name, *next; - - /* LSM_ORDER_FIRST is always first. */ -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ lsm_for_each_raw(lsm) { - if (lsm->order == LSM_ORDER_FIRST) - append_ordered_lsm(lsm, " first"); - } -@@ -221,8 +231,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - * if the selected one was separately disabled: disable - * all non-matching Legacy Major LSMs. - */ -- for (major = __start_lsm_info; major < __end_lsm_info; -- major++) { -+ lsm_for_each_raw(major) { - if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && - strcmp(major->name, chosen_major_lsm) != 0) { - set_enabled(major, false); -@@ -238,7 +247,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - while ((name = strsep(&next, ",")) != NULL) { - bool found = false; - -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ lsm_for_each_raw(lsm) { - if (strcmp(lsm->name, name) == 0) { - if (lsm->order == LSM_ORDER_MUTABLE) - append_ordered_lsm(lsm, origin); -@@ -253,7 +262,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - - /* Process "security=", if given. */ - if (chosen_major_lsm) { -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ lsm_for_each_raw(lsm) { - if (exists_ordered_lsm(lsm)) - continue; - if (strcmp(lsm->name, chosen_major_lsm) == 0) -@@ -262,13 +271,13 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - } - - /* LSM_ORDER_LAST is always last. */ -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ lsm_for_each_raw(lsm) { - if (lsm->order == LSM_ORDER_LAST) - append_ordered_lsm(lsm, " last"); - } - - /* Disable all LSMs not in the ordered list. */ -- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { -+ lsm_for_each_raw(lsm) { - if (exists_ordered_lsm(lsm)) - continue; - set_enabled(lsm, false); -@@ -287,13 +296,14 @@ static void __init report_lsm_order(void) - pr_info("initializing lsm="); - - /* Report each enabled LSM name, comma separated. */ -- for (early = __start_early_lsm_info; -- early < __end_early_lsm_info; early++) -+ lsm_early_for_each_raw(early) { - if (is_enabled(early)) - pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); -- for (lsm = ordered_lsms; *lsm; lsm++) -+ } -+ lsm_order_for_each(lsm) { - if (is_enabled(*lsm)) - pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); -+ } - - pr_cont("\n"); - } -@@ -340,8 +350,9 @@ static void __init ordered_lsm_init(void) - } else - ordered_lsm_parse(builtin_lsm_order, "builtin"); - -- for (lsm = ordered_lsms; *lsm; lsm++) -+ lsm_order_for_each(lsm) { - lsm_prepare(*lsm); -+ } - - report_lsm_order(); - -@@ -376,8 +387,9 @@ static void __init ordered_lsm_init(void) - - lsm_early_cred((struct cred *) current->cred); - lsm_early_task(current); -- for (lsm = ordered_lsms; *lsm; lsm++) -+ lsm_order_for_each(lsm) { - initialize_lsm(*lsm); -+ } - } - - static bool match_last_lsm(const char *list, const char *lsm) -@@ -483,7 +495,7 @@ int __init early_security_init(void) - if (early_security_initialized) - return 0; - -- for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { -+ lsm_early_for_each_raw(lsm) { - if (!lsm->enabled) - lsm->enabled = &lsm_enabled_true; - lsm_prepare(lsm); -@@ -511,7 +523,7 @@ int __init security_init(void) - * Append the names of the early LSM modules now that kmalloc() is - * available - */ -- for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { -+ lsm_early_for_each_raw(lsm) { - init_debug(" early started: %s (%s)\n", lsm->name, - is_enabled(lsm) ? "enabled" : "disabled"); - if (lsm->enabled) --- -2.50.1 (Apple Git-155) - diff --git a/1305-lsm-integrate-report-lsm-order-code-into-caller.patch b/1305-lsm-integrate-report-lsm-order-code-into-caller.patch deleted file mode 100644 index b7d321e3c..000000000 --- a/1305-lsm-integrate-report-lsm-order-code-into-caller.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 4190f2549074d006122a76cdcb2a5b361d59d650 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:20:31 +0200 -Subject: [PATCH] lsm: integrate report_lsm_order() code into caller - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit cb1513db7a6ed82d22853608d78bbf72ad8c67c1 -Author: Paul Moore -Date: Sat Jul 12 16:10:15 2025 -0400 - - lsm: integrate report_lsm_order() code into caller - - With only one caller of report_lsm_order(), insert the function's code - directly into the caller and ger rid of report_lsm_order(). - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 2424975ca0eb..fc40d37c3321 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -288,26 +288,6 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - kfree(sep); - } - --static void __init report_lsm_order(void) --{ -- struct lsm_info **lsm, *early; -- int first = 0; -- -- pr_info("initializing lsm="); -- -- /* Report each enabled LSM name, comma separated. */ -- lsm_early_for_each_raw(early) { -- if (is_enabled(early)) -- pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); -- } -- lsm_order_for_each(lsm) { -- if (is_enabled(*lsm)) -- pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); -- } -- -- pr_cont("\n"); --} -- - /** - * lsm_early_cred - during initialization allocate a composite cred blob - * @cred: the cred that needs a blob -@@ -338,7 +318,9 @@ static void __init lsm_early_task(struct task_struct *task) - - static void __init ordered_lsm_init(void) - { -+ unsigned int first = 0; - struct lsm_info **lsm; -+ struct lsm_info *early; - - if (chosen_lsm_order) { - if (chosen_major_lsm) { -@@ -354,7 +336,16 @@ static void __init ordered_lsm_init(void) - lsm_prepare(*lsm); - } - -- report_lsm_order(); -+ pr_info("initializing lsm="); -+ lsm_early_for_each_raw(early) { -+ if (is_enabled(early)) -+ pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); -+ } -+ lsm_order_for_each(lsm) { -+ if (is_enabled(*lsm)) -+ pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); -+ } -+ pr_cont("\n"); - - init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); - init_debug("file blob size = %d\n", blob_sizes.lbs_file); --- -2.50.1 (Apple Git-155) - diff --git a/1306-lsm-integrate-lsm-early-cred-and-lsm-early-task-into-caller.patch b/1306-lsm-integrate-lsm-early-cred-and-lsm-early-task-into-caller.patch deleted file mode 100644 index 885a0733a..000000000 --- a/1306-lsm-integrate-lsm-early-cred-and-lsm-early-task-into-caller.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 7a7bb4c213345231e80b7545d00bcee30e62fd94 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:20:32 +0200 -Subject: [PATCH] lsm: integrate lsm_early_cred() and lsm_early_task() into - caller - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 92ed3500c9a91f43e094c9b8fb4bab9976565d74 -Author: Paul Moore -Date: Sat Jul 12 16:27:39 2025 -0400 - - lsm: integrate lsm_early_cred() and lsm_early_task() into caller - - With only one caller of lsm_early_cred() and lsm_early_task(), insert - the functions' code directly into the caller and ger rid of the two - functions. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index fc40d37c3321..19eac2b39f2b 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -288,34 +288,6 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - kfree(sep); - } - --/** -- * lsm_early_cred - during initialization allocate a composite cred blob -- * @cred: the cred that needs a blob -- * -- * Allocate the cred blob for all the modules -- */ --static void __init lsm_early_cred(struct cred *cred) --{ -- int rc = lsm_cred_alloc(cred, GFP_KERNEL); -- -- if (rc) -- panic("%s: Early cred alloc failed.\n", __func__); --} -- --/** -- * lsm_early_task - during initialization allocate a composite task blob -- * @task: the task that needs a blob -- * -- * Allocate the task blob for all the modules -- */ --static void __init lsm_early_task(struct task_struct *task) --{ -- int rc = lsm_task_alloc(task); -- -- if (rc) -- panic("%s: Early task alloc failed.\n", __func__); --} -- - static void __init ordered_lsm_init(void) - { - unsigned int first = 0; -@@ -376,8 +348,11 @@ static void __init ordered_lsm_init(void) - blob_sizes.lbs_inode, 0, - SLAB_PANIC, NULL); - -- lsm_early_cred((struct cred *) current->cred); -- lsm_early_task(current); -+ if (lsm_cred_alloc((struct cred __rcu *)current->cred, GFP_KERNEL)) -+ panic("%s: early cred alloc failed.\n", __func__); -+ if (lsm_task_alloc(current)) -+ panic("%s: early task alloc failed.\n", __func__); -+ - lsm_order_for_each(lsm) { - initialize_lsm(*lsm); - } --- -2.50.1 (Apple Git-155) - diff --git a/1307-lsm-rename-ordered-lsm-init-to-lsm-init-ordered.patch b/1307-lsm-rename-ordered-lsm-init-to-lsm-init-ordered.patch deleted file mode 100644 index 1cc768124..000000000 --- a/1307-lsm-rename-ordered-lsm-init-to-lsm-init-ordered.patch +++ /dev/null @@ -1,63 +0,0 @@ -From c2e5c69d0c70768dc6cd10ab0a5704ebb2545967 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:20:32 +0200 -Subject: [PATCH] lsm: rename ordered_lsm_init() to lsm_init_ordered() - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit faabedcd6e88ca1f65ef45d711d2e0c7288fd551 -Author: Paul Moore -Date: Tue Feb 11 12:59:30 2025 -0500 - - lsm: rename ordered_lsm_init() to lsm_init_ordered() - - The new name more closely fits the rest of the naming scheme in - security/lsm_init.c. This patch also adds a trivial comment block to - the top of the function. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 19eac2b39f2b..a590a785f724 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -288,7 +288,10 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - kfree(sep); - } - --static void __init ordered_lsm_init(void) -+/** -+ * lsm_init_ordered - Initialize the ordered LSMs -+ */ -+static void __init lsm_init_ordered(void) - { - unsigned int first = 0; - struct lsm_info **lsm; -@@ -336,9 +339,6 @@ static void __init ordered_lsm_init(void) - init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); - init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev); - -- /* -- * Create any kmem_caches needed for blobs -- */ - if (blob_sizes.lbs_file) - lsm_file_cache = kmem_cache_create("lsm_file_cache", - blob_sizes.lbs_file, 0, -@@ -497,7 +497,7 @@ int __init security_init(void) - } - - /* Load LSMs in specified order. */ -- ordered_lsm_init(); -+ lsm_init_ordered(); - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1308-lsm-replace-the-name-field-with-a-pointer-to-the-lsm-id-stru.patch b/1308-lsm-replace-the-name-field-with-a-pointer-to-the-lsm-id-stru.patch deleted file mode 100644 index e512fdcbe..000000000 --- a/1308-lsm-replace-the-name-field-with-a-pointer-to-the-lsm-id-stru.patch +++ /dev/null @@ -1,363 +0,0 @@ -From 369918c7a55af0dc1d94780d5fde14536636ace1 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:20:33 +0200 -Subject: [PATCH] lsm: replace the name field with a pointer to the lsm_id - struct - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 9f9dc69e06ecbc61e7a50b823b82a78daf130dc0 -Author: Paul Moore -Date: Wed Feb 12 14:45:06 2025 -0500 - - lsm: replace the name field with a pointer to the lsm_id struct - - Reduce the duplication between the lsm_id struct and the DEFINE_LSM() - definition by linking the lsm_id struct directly into the individual - LSM's DEFINE_LSM() instance. - - Linking the lsm_id into the LSM definition also allows us to simplify - the security_add_hooks() function by removing the code which populates - the lsm_idlist[] array and moving it into the normal LSM startup code - where the LSM list is parsed and the individual LSMs are enabled, - making for a cleaner implementation with less overhead at boot. - - Reviewed-by: Kees Cook - Reviewed-by: John Johansen - Reviewed-by: Casey Schaufler - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index eeb4bfd60b79..4cd17c9a229f 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -149,7 +149,7 @@ enum lsm_order { - }; - - struct lsm_info { -- const char *name; /* Required. */ -+ const struct lsm_id *id; - enum lsm_order order; /* Optional: default is LSM_ORDER_MUTABLE */ - unsigned long flags; /* Optional: flags describing LSM */ - int *enabled; /* Optional: controlled by CONFIG_LSM */ -diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c -index 248d68624b35..6b5742e60454 100644 ---- a/security/apparmor/lsm.c -+++ b/security/apparmor/lsm.c -@@ -2275,7 +2275,7 @@ static int __init apparmor_init(void) - } - - DEFINE_LSM(apparmor) = { -- .name = "apparmor", -+ .id = &apparmor_lsmid, - .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, - .enabled = &apparmor_enabled, - .blobs = &apparmor_blob_sizes, -diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c -index db759025abe1..40efde233f3a 100644 ---- a/security/bpf/hooks.c -+++ b/security/bpf/hooks.c -@@ -33,7 +33,7 @@ struct lsm_blob_sizes bpf_lsm_blob_sizes __ro_after_init = { - }; - - DEFINE_LSM(bpf) = { -- .name = "bpf", -+ .id = &bpf_lsmid, - .init = bpf_lsm_init, - .blobs = &bpf_lsm_blob_sizes - }; -diff --git a/security/commoncap.c b/security/commoncap.c -index cefad323a0b1..7d0b5a58d4e1 100644 ---- a/security/commoncap.c -+++ b/security/commoncap.c -@@ -1470,7 +1470,7 @@ static int __init capability_init(void) - } - - DEFINE_LSM(capability) = { -- .name = "capability", -+ .id = &capability_lsmid, - .order = LSM_ORDER_FIRST, - .init = capability_init, - }; -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index 377e57e9084f..bb0f8631195e 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -1175,7 +1175,7 @@ struct lsm_blob_sizes evm_blob_sizes __ro_after_init = { - }; - - DEFINE_LSM(evm) = { -- .name = "evm", -+ .id = &evm_lsmid, - .init = init_evm_lsm, - .order = LSM_ORDER_LAST, - .blobs = &evm_blob_sizes, -diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c -index 66aa7bc8d76d..c60a9b1082d4 100644 ---- a/security/integrity/ima/ima_main.c -+++ b/security/integrity/ima/ima_main.c -@@ -1222,7 +1222,7 @@ struct lsm_blob_sizes ima_blob_sizes __ro_after_init = { - }; - - DEFINE_LSM(ima) = { -- .name = "ima", -+ .id = &ima_lsmid, - .init = init_ima_lsm, - .order = LSM_ORDER_LAST, - .blobs = &ima_blob_sizes, -diff --git a/security/ipe/ipe.c b/security/ipe/ipe.c -index 4317134cb0da..2426441181dc 100644 ---- a/security/ipe/ipe.c -+++ b/security/ipe/ipe.c -@@ -92,7 +92,7 @@ static int __init ipe_init(void) - } - - DEFINE_LSM(ipe) = { -- .name = "ipe", -+ .id = &ipe_lsmid, - .init = ipe_init, - .blobs = &ipe_blobs, - }; -diff --git a/security/landlock/setup.c b/security/landlock/setup.c -index 28519a45b11f..460c5b79d957 100644 ---- a/security/landlock/setup.c -+++ b/security/landlock/setup.c -@@ -43,7 +43,7 @@ static int __init landlock_init(void) - } - - DEFINE_LSM(LANDLOCK_NAME) = { -- .name = LANDLOCK_NAME, -+ .id = &landlock_lsmid, - .init = landlock_init, - .blobs = &landlock_blob_sizes, - }; -diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c -index 02144ec39f43..92c9618e38ad 100644 ---- a/security/loadpin/loadpin.c -+++ b/security/loadpin/loadpin.c -@@ -271,7 +271,7 @@ static int __init loadpin_init(void) - } - - DEFINE_LSM(loadpin) = { -- .name = "loadpin", -+ .id = &loadpin_lsmid, - .init = loadpin_init, - }; - -diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c -index ddf496f7fca5..c27aaee60da3 100644 ---- a/security/lockdown/lockdown.c -+++ b/security/lockdown/lockdown.c -@@ -169,6 +169,6 @@ DEFINE_EARLY_LSM(lockdown) = { - #else - DEFINE_LSM(lockdown) = { - #endif -- .name = "lockdown", -+ .id = &lockdown_lsmid, - .init = lockdown_lsm_init, - }; -diff --git a/security/lsm_init.c b/security/lsm_init.c -index a590a785f724..e5faf6be44fb 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -127,9 +127,10 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) - /* Enable this LSM, if it is not already set. */ - if (!lsm->enabled) - lsm->enabled = &lsm_enabled_true; -- ordered_lsms[last_lsm++] = lsm; -+ ordered_lsms[last_lsm] = lsm; -+ lsm_idlist[last_lsm++] = lsm->id; - -- init_debug("%s ordered: %s (%s)\n", from, lsm->name, -+ init_debug("%s ordered: %s (%s)\n", from, lsm->id->name, - is_enabled(lsm) ? "enabled" : "disabled"); - } - -@@ -157,7 +158,7 @@ static void __init lsm_prepare(struct lsm_info *lsm) - set_enabled(lsm, false); - return; - } else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) { -- init_debug("exclusive disabled: %s\n", lsm->name); -+ init_debug("exclusive disabled: %s\n", lsm->id->name); - set_enabled(lsm, false); - return; - } -@@ -165,7 +166,7 @@ static void __init lsm_prepare(struct lsm_info *lsm) - /* Mark the LSM as enabled. */ - set_enabled(lsm, true); - if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { -- init_debug("exclusive chosen: %s\n", lsm->name); -+ init_debug("exclusive chosen: %s\n", lsm->id->name); - exclusive = lsm; - } - -@@ -197,9 +198,9 @@ static void __init initialize_lsm(struct lsm_info *lsm) - if (is_enabled(lsm)) { - int ret; - -- init_debug("initializing %s\n", lsm->name); -+ init_debug("initializing %s\n", lsm->id->name); - ret = lsm->init(); -- WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret); -+ WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret); - } - } - -@@ -233,10 +234,10 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - */ - lsm_for_each_raw(major) { - if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && -- strcmp(major->name, chosen_major_lsm) != 0) { -+ strcmp(major->id->name, chosen_major_lsm) != 0) { - set_enabled(major, false); - init_debug("security=%s disabled: %s (only one legacy major LSM)\n", -- chosen_major_lsm, major->name); -+ chosen_major_lsm, major->id->name); - } - } - } -@@ -248,7 +249,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - bool found = false; - - lsm_for_each_raw(lsm) { -- if (strcmp(lsm->name, name) == 0) { -+ if (strcmp(lsm->id->name, name) == 0) { - if (lsm->order == LSM_ORDER_MUTABLE) - append_ordered_lsm(lsm, origin); - found = true; -@@ -265,7 +266,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - lsm_for_each_raw(lsm) { - if (exists_ordered_lsm(lsm)) - continue; -- if (strcmp(lsm->name, chosen_major_lsm) == 0) -+ if (strcmp(lsm->id->name, chosen_major_lsm) == 0) - append_ordered_lsm(lsm, "security="); - } - } -@@ -282,7 +283,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - continue; - set_enabled(lsm, false); - init_debug("%s skipped: %s (not in requested order)\n", -- origin, lsm->name); -+ origin, lsm->id->name); - } - - kfree(sep); -@@ -314,11 +315,13 @@ static void __init lsm_init_ordered(void) - pr_info("initializing lsm="); - lsm_early_for_each_raw(early) { - if (is_enabled(early)) -- pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); -+ pr_cont("%s%s", -+ first++ == 0 ? "" : ",", early->id->name); - } - lsm_order_for_each(lsm) { - if (is_enabled(*lsm)) -- pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); -+ pr_cont("%s%s", -+ first++ == 0 ? "" : ",", (*lsm)->id->name); - } - pr_cont("\n"); - -@@ -426,18 +429,6 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, - { - int i; - -- /* -- * A security module may call security_add_hooks() more -- * than once during initialization, and LSM initialization -- * is serialized. Landlock is one such case. -- * Look at the previous entry, if there is one, for duplication. -- */ -- if (lsm_active_cnt == 0 || lsm_idlist[lsm_active_cnt - 1] != lsmid) { -- if (lsm_active_cnt >= MAX_LSM_COUNT) -- panic("%s Too many LSMs registered.\n", __func__); -- lsm_idlist[lsm_active_cnt++] = lsmid; -- } -- - for (i = 0; i < count; i++) { - hooks[i].lsmid = lsmid; - lsm_static_call_init(&hooks[i]); -@@ -490,10 +481,10 @@ int __init security_init(void) - * available - */ - lsm_early_for_each_raw(lsm) { -- init_debug(" early started: %s (%s)\n", lsm->name, -+ init_debug(" early started: %s (%s)\n", lsm->id->name, - is_enabled(lsm) ? "enabled" : "disabled"); - if (lsm->enabled) -- lsm_append(lsm->name, &lsm_names); -+ lsm_append(lsm->id->name, &lsm_names); - } - - /* Load LSMs in specified order. */ -diff --git a/security/safesetid/lsm.c b/security/safesetid/lsm.c -index 1ba564f097f5..9a7c68d4e642 100644 ---- a/security/safesetid/lsm.c -+++ b/security/safesetid/lsm.c -@@ -287,6 +287,6 @@ static int __init safesetid_security_init(void) - } - - DEFINE_LSM(safesetid_security_init) = { -+ .id = &safesetid_lsmid, - .init = safesetid_security_init, -- .name = "safesetid", - }; -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 1bc947e2b0e7..a2323c6daafe 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -7480,7 +7480,7 @@ void selinux_complete_init(void) - /* SELinux requires early initialization in order to label - all processes and objects when they are created. */ - DEFINE_LSM(selinux) = { -- .name = "selinux", -+ .id = &selinux_lsmid, - .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, - .enabled = &selinux_enabled_boot, - .blobs = &selinux_blob_sizes, -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 7c8b06e974bb..43546723f600 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -5318,7 +5318,7 @@ static __init int smack_init(void) - * all processes and objects when they are created. - */ - DEFINE_LSM(smack) = { -- .name = "smack", -+ .id = &smack_lsmid, - .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, - .blobs = &smack_blob_sizes, - .init = smack_init, -diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c -index fa08d78162bb..3c6964ea7ace 100644 ---- a/security/tomoyo/tomoyo.c -+++ b/security/tomoyo/tomoyo.c -@@ -615,7 +615,7 @@ static int __init tomoyo_init(void) - } - - DEFINE_LSM(tomoyo) = { -- .name = "tomoyo", -+ .id = &tomoyo_lsmid, - .enabled = &tomoyo_enabled, - .flags = LSM_FLAG_LEGACY_MAJOR, - .blobs = &tomoyo_blob_sizes, -diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c -index 54bd5f535ac1..f546176dd2fc 100644 ---- a/security/yama/yama_lsm.c -+++ b/security/yama/yama_lsm.c -@@ -483,6 +483,6 @@ static int __init yama_init(void) - } - - DEFINE_LSM(yama) = { -- .name = "yama", -+ .id = &yama_lsmid, - .init = yama_init, - }; --- -2.50.1 (Apple Git-155) - diff --git a/1309-lsm-rename-the-lsm-order-variables-for-consistency.patch b/1309-lsm-rename-the-lsm-order-variables-for-consistency.patch deleted file mode 100644 index 1488024d2..000000000 --- a/1309-lsm-rename-the-lsm-order-variables-for-consistency.patch +++ /dev/null @@ -1,226 +0,0 @@ -From f212d5ad65c47cf954187a1d3ed14db6127b3727 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:20:33 +0200 -Subject: [PATCH] lsm: rename the lsm order variables for consistency - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 592b104f9b516b2c22cb23a2f4c34486fdb21bae -Author: Paul Moore -Date: Tue Feb 11 17:13:26 2025 -0500 - - lsm: rename the lsm order variables for consistency - - Rename the builtin_lsm_order variable to lsm_order_builtin, - chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to - lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive - to lsm_exclusive. - - This patch also renames the associated kernel command line parsing - functions and adds some basic function comment blocks. The parsing - function choose_major_lsm() was renamed to lsm_choose_security(), - choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to - lsm_debug_enable(). - - Reviewed-by: Kees Cook - Reviewed-by: John Johansen - Reviewed-by: Casey Schaufler - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index e5faf6be44fb..171b2b047bdc 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -16,14 +16,14 @@ char *lsm_names; - extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; - extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; - --/* Boot-time LSM user choice */ --static __initconst const char *const builtin_lsm_order = CONFIG_LSM; --static __initdata const char *chosen_lsm_order; --static __initdata const char *chosen_major_lsm; -+/* Build and boot-time LSM ordering. */ -+static __initconst const char *const lsm_order_builtin = CONFIG_LSM; -+static __initdata const char *lsm_order_cmdline; -+static __initdata const char *lsm_order_legacy; - - /* Ordered list of LSMs to initialize. */ --static __initdata struct lsm_info *ordered_lsms[MAX_LSM_COUNT + 1]; --static __initdata struct lsm_info *exclusive; -+static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1]; -+static __initdata struct lsm_info *lsm_exclusive; - - static __initdata bool debug; - #define init_debug(...) \ -@@ -33,7 +33,7 @@ static __initdata bool debug; - } while (0) - - #define lsm_order_for_each(iter) \ -- for ((iter) = ordered_lsms; *(iter); (iter)++) -+ for ((iter) = lsm_order; *(iter); (iter)++) - #define lsm_for_each_raw(iter) \ - for ((iter) = __start_lsm_info; \ - (iter) < __end_lsm_info; (iter)++) -@@ -41,31 +41,41 @@ static __initdata bool debug; - for ((iter) = __start_early_lsm_info; \ - (iter) < __end_early_lsm_info; (iter)++) - --static int lsm_append(const char *new, char **result); -- --/* Save user chosen LSM */ --static int __init choose_major_lsm(char *str) -+/** -+ * lsm_choose_security - Legacy "major" LSM selection -+ * @str: kernel command line parameter -+ */ -+static int __init lsm_choose_security(char *str) - { -- chosen_major_lsm = str; -+ lsm_order_legacy = str; - return 1; - } --__setup("security=", choose_major_lsm); -+__setup("security=", lsm_choose_security); - --/* Explicitly choose LSM initialization order. */ --static int __init choose_lsm_order(char *str) -+/** -+ * lsm_choose_lsm - Modern LSM selection -+ * @str: kernel command line parameter -+ */ -+static int __init lsm_choose_lsm(char *str) - { -- chosen_lsm_order = str; -+ lsm_order_cmdline = str; - return 1; - } --__setup("lsm=", choose_lsm_order); -+__setup("lsm=", lsm_choose_lsm); - --/* Enable LSM order debugging. */ --static int __init enable_debug(char *str) -+/** -+ * lsm_debug_enable - Enable LSM framework debugging -+ * @str: kernel command line parameter -+ * -+ * Currently we only provide debug info during LSM initialization, but we may -+ * want to expand this in the future. -+ */ -+static int __init lsm_debug_enable(char *str) - { - debug = true; - return 1; - } --__setup("lsm.debug", enable_debug); -+__setup("lsm.debug", lsm_debug_enable); - - /* Mark an LSM's enabled flag. */ - static int lsm_enabled_true __initdata = 1; -@@ -127,7 +137,7 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) - /* Enable this LSM, if it is not already set. */ - if (!lsm->enabled) - lsm->enabled = &lsm_enabled_true; -- ordered_lsms[last_lsm] = lsm; -+ lsm_order[last_lsm] = lsm; - lsm_idlist[last_lsm++] = lsm->id; - - init_debug("%s ordered: %s (%s)\n", from, lsm->id->name, -@@ -157,7 +167,7 @@ static void __init lsm_prepare(struct lsm_info *lsm) - if (!is_enabled(lsm)) { - set_enabled(lsm, false); - return; -- } else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) { -+ } else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && lsm_exclusive) { - init_debug("exclusive disabled: %s\n", lsm->id->name); - set_enabled(lsm, false); - return; -@@ -165,9 +175,9 @@ static void __init lsm_prepare(struct lsm_info *lsm) - - /* Mark the LSM as enabled. */ - set_enabled(lsm, true); -- if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { -+ if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !lsm_exclusive) { - init_debug("exclusive chosen: %s\n", lsm->id->name); -- exclusive = lsm; -+ lsm_exclusive = lsm; - } - - /* Register the LSM blob sizes. */ -@@ -223,7 +233,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - } - - /* Process "security=", if given. */ -- if (chosen_major_lsm) { -+ if (lsm_order_legacy) { - struct lsm_info *major; - - /* -@@ -234,10 +244,10 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - */ - lsm_for_each_raw(major) { - if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && -- strcmp(major->id->name, chosen_major_lsm) != 0) { -+ strcmp(major->id->name, lsm_order_legacy) != 0) { - set_enabled(major, false); - init_debug("security=%s disabled: %s (only one legacy major LSM)\n", -- chosen_major_lsm, major->id->name); -+ lsm_order_legacy, major->id->name); - } - } - } -@@ -262,11 +272,11 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - } - - /* Process "security=", if given. */ -- if (chosen_major_lsm) { -+ if (lsm_order_legacy) { - lsm_for_each_raw(lsm) { - if (exists_ordered_lsm(lsm)) - continue; -- if (strcmp(lsm->id->name, chosen_major_lsm) == 0) -+ if (strcmp(lsm->id->name, lsm_order_legacy) == 0) - append_ordered_lsm(lsm, "security="); - } - } -@@ -298,15 +308,15 @@ static void __init lsm_init_ordered(void) - struct lsm_info **lsm; - struct lsm_info *early; - -- if (chosen_lsm_order) { -- if (chosen_major_lsm) { -+ if (lsm_order_cmdline) { -+ if (lsm_order_legacy) { - pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", -- chosen_major_lsm, chosen_lsm_order); -- chosen_major_lsm = NULL; -+ lsm_order_legacy, lsm_order_cmdline); -+ lsm_order_legacy = NULL; - } -- ordered_lsm_parse(chosen_lsm_order, "cmdline"); -+ ordered_lsm_parse(lsm_order_cmdline, "cmdline"); - } else -- ordered_lsm_parse(builtin_lsm_order, "builtin"); -+ ordered_lsm_parse(lsm_order_builtin, "builtin"); - - lsm_order_for_each(lsm) { - lsm_prepare(*lsm); -@@ -472,9 +482,9 @@ int __init security_init(void) - { - struct lsm_info *lsm; - -- init_debug("legacy security=%s\n", chosen_major_lsm ? : " *unspecified*"); -- init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order); -- init_debug("boot arg lsm=%s\n", chosen_lsm_order ? : " *unspecified*"); -+ init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*"); -+ init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin); -+ init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*"); - - /* - * Append the names of the early LSM modules now that kmalloc() is --- -2.50.1 (Apple Git-155) - diff --git a/1310-lsm-rework-lsm-active-cnt-and-lsm-idlist.patch b/1310-lsm-rework-lsm-active-cnt-and-lsm-idlist.patch deleted file mode 100644 index d16321382..000000000 --- a/1310-lsm-rework-lsm-active-cnt-and-lsm-idlist.patch +++ /dev/null @@ -1,102 +0,0 @@ -From c4c061449d1ae617402680b00ab006b1e0ee2c2c Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:20:34 +0200 -Subject: [PATCH] lsm: rework lsm_active_cnt and lsm_idlist[] - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 250898ca335f337bc032a9693dc0a30a1cb85825 -Author: Paul Moore -Date: Wed Feb 12 15:36:51 2025 -0500 - - lsm: rework lsm_active_cnt and lsm_idlist[] - - Move the LSM active count and lsm_id list declarations out of a header - that is visible across the kernel and into a header that is limited to - the LSM framework. This not only helps keep the include/linux headers - smaller and cleaner, it helps prevent misuse of these variables. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/include/linux/security.h b/include/linux/security.h -index 3254f74457f7..2db88ddbe9a9 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -167,8 +167,6 @@ struct lsm_prop { - }; - - extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1]; --extern u32 lsm_active_cnt; --extern const struct lsm_id *lsm_idlist[]; - - /* These functions are in security/commoncap.c */ - extern int cap_capable(const struct cred *cred, struct user_namespace *ns, -diff --git a/security/lsm.h b/security/lsm.h -index 0e1731bad4a7..dbe755c45e57 100644 ---- a/security/lsm.h -+++ b/security/lsm.h -@@ -7,6 +7,11 @@ - #define _LSM_H_ - - #include -+#include -+ -+/* List of configured LSMs */ -+extern unsigned int lsm_active_cnt; -+extern const struct lsm_id *lsm_idlist[]; - - /* LSM blob configuration */ - extern struct lsm_blob_sizes blob_sizes; -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 171b2b047bdc..e7afc74caa2b 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -214,12 +214,6 @@ static void __init initialize_lsm(struct lsm_info *lsm) - } - } - --/* -- * Current index to use while initializing the lsm id list. -- */ --u32 lsm_active_cnt __ro_after_init; --const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; -- - /* Populate ordered LSMs list from comma-separated LSM name list. */ - static void __init ordered_lsm_parse(const char *order, const char *origin) - { -diff --git a/security/lsm_syscalls.c b/security/lsm_syscalls.c -index 8440948a690c..5648b1f0ce9c 100644 ---- a/security/lsm_syscalls.c -+++ b/security/lsm_syscalls.c -@@ -17,6 +17,8 @@ - #include - #include - -+#include "lsm.h" -+ - /** - * lsm_name_to_attr - map an LSM attribute name to its ID - * @name: name of the attribute -diff --git a/security/security.c b/security/security.c -index 6040891f4588..6f20f44c8d13 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -74,6 +74,9 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { - [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", - }; - -+unsigned int lsm_active_cnt __ro_after_init; -+const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; -+ - struct lsm_blob_sizes blob_sizes; - - struct kmem_cache *lsm_file_cache; --- -2.50.1 (Apple Git-155) - diff --git a/1311-lsm-get-rid-of-the-lsm-names-list-and-do-some-cleanup.patch b/1311-lsm-get-rid-of-the-lsm-names-list-and-do-some-cleanup.patch deleted file mode 100644 index e658520c6..000000000 --- a/1311-lsm-get-rid-of-the-lsm-names-list-and-do-some-cleanup.patch +++ /dev/null @@ -1,184 +0,0 @@ -From e84cf2768df37393453e8bb645555e360761056c Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:20:34 +0200 -Subject: [PATCH] lsm: get rid of the lsm_names list and do some cleanup - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 935d508d4d7ab9d19c603bd7eb2937249551d507 -Author: Paul Moore -Date: Thu Feb 13 17:34:12 2025 -0500 - - lsm: get rid of the lsm_names list and do some cleanup - - The LSM currently has a lot of code to maintain a list of the currently - active LSMs in a human readable string, with the only user being the - "/sys/kernel/security/lsm" code. Let's drop all of that code and - generate the string on first use and then cache it for subsequent use. - - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index 4cd17c9a229f..bc477fb20d02 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -169,7 +169,6 @@ struct lsm_info { - - - /* DO NOT tamper with these variables outside of the LSM framework */ --extern char *lsm_names; - extern struct lsm_static_calls_table static_calls_table __ro_after_init; - - /** -diff --git a/security/inode.c b/security/inode.c -index da3ab44c8e57..6f3caab37ab2 100644 ---- a/security/inode.c -+++ b/security/inode.c -@@ -22,6 +22,8 @@ - #include - #include - -+#include "lsm.h" -+ - static struct vfsmount *mount; - static int mount_count; - -@@ -339,12 +341,49 @@ void securityfs_recursive_remove(struct dentry *dentry) - EXPORT_SYMBOL_GPL(securityfs_recursive_remove); - - #ifdef CONFIG_SECURITY -+#include -+ - static struct dentry *lsm_dentry; -+ - static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count, - loff_t *ppos) - { -- return simple_read_from_buffer(buf, count, ppos, lsm_names, -- strlen(lsm_names)); -+ int i; -+ static char *str; -+ static size_t len; -+ static DEFINE_SPINLOCK(lock); -+ -+ /* NOTE: we never free or modify the string once it is set */ -+ -+ if (unlikely(!str || !len)) { -+ char *str_tmp; -+ size_t len_tmp = 0; -+ -+ for (i = 0; i < lsm_active_cnt; i++) -+ /* the '+ 1' accounts for either a comma or a NUL */ -+ len_tmp += strlen(lsm_idlist[i]->name) + 1; -+ -+ str_tmp = kmalloc(len_tmp, GFP_KERNEL); -+ if (!str_tmp) -+ return -ENOMEM; -+ str_tmp[0] = '\0'; -+ -+ for (i = 0; i < lsm_active_cnt; i++) { -+ if (i > 0) -+ strcat(str_tmp, ","); -+ strcat(str_tmp, lsm_idlist[i]->name); -+ } -+ -+ spin_lock(&lock); -+ if (!str) { -+ str = str_tmp; -+ len = len_tmp - 1; -+ } else -+ kfree(str_tmp); -+ spin_unlock(&lock); -+ } -+ -+ return simple_read_from_buffer(buf, count, ppos, str, len); - } - - static const struct file_operations lsm_ops = { -diff --git a/security/lsm_init.c b/security/lsm_init.c -index e7afc74caa2b..7c244a309a35 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -10,8 +10,6 @@ - - #include "lsm.h" - --char *lsm_names; -- - /* Pointers to LSM sections defined in include/asm-generic/vmlinux.lds.h */ - extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; - extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; -@@ -365,42 +363,6 @@ static void __init lsm_init_ordered(void) - } - } - --static bool match_last_lsm(const char *list, const char *lsm) --{ -- const char *last; -- -- if (WARN_ON(!list || !lsm)) -- return false; -- last = strrchr(list, ','); -- if (last) -- /* Pass the comma, strcmp() will check for '\0' */ -- last++; -- else -- last = list; -- return !strcmp(last, lsm); --} -- --static int lsm_append(const char *new, char **result) --{ -- char *cp; -- -- if (*result == NULL) { -- *result = kstrdup(new, GFP_KERNEL); -- if (*result == NULL) -- return -ENOMEM; -- } else { -- /* Check if it is the last registered name */ -- if (match_last_lsm(*result, new)) -- return 0; -- cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new); -- if (cp == NULL) -- return -ENOMEM; -- kfree(*result); -- *result = cp; -- } -- return 0; --} -- - static void __init lsm_static_call_init(struct security_hook_list *hl) - { - struct lsm_static_call *scall = hl->scalls; -@@ -437,15 +399,6 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, - hooks[i].lsmid = lsmid; - lsm_static_call_init(&hooks[i]); - } -- -- /* -- * Don't try to append during early_security_init(), we'll come back -- * and fix this up afterwards. -- */ -- if (slab_is_available()) { -- if (lsm_append(lsmid->name, &lsm_names) < 0) -- panic("%s - Cannot get early memory.\n", __func__); -- } - } - - int __init early_security_init(void) -@@ -487,8 +440,6 @@ int __init security_init(void) - lsm_early_for_each_raw(lsm) { - init_debug(" early started: %s (%s)\n", lsm->id->name, - is_enabled(lsm) ? "enabled" : "disabled"); -- if (lsm->enabled) -- lsm_append(lsm->id->name, &lsm_names); - } - - /* Load LSMs in specified order. */ --- -2.50.1 (Apple Git-155) - diff --git a/1312-lsm-rework-the-lsm-enable-disable-setter-getter-functions.patch b/1312-lsm-rework-the-lsm-enable-disable-setter-getter-functions.patch deleted file mode 100644 index 6ecb5432e..000000000 --- a/1312-lsm-rework-the-lsm-enable-disable-setter-getter-functions.patch +++ /dev/null @@ -1,179 +0,0 @@ -From d52cc6c688625151f1b39aa7b2b5c532b47a2211 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:26:49 +0200 -Subject: [PATCH] lsm: rework the LSM enable/disable setter/getter functions - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 2d67172612fd9df2c4d08533515ef483cb526dd9 -Author: Paul Moore -Date: Thu Apr 10 22:04:26 2025 -0400 - - lsm: rework the LSM enable/disable setter/getter functions - - In addition to style changes, rename set_enabled() to lsm_enabled_set() - and is_enabled() to lsm_is_enabled() to better fit within the LSM - initialization code. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 7c244a309a35..9929d1a61634 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -10,6 +10,10 @@ - - #include "lsm.h" - -+/* LSM enabled constants. */ -+static __initdata int lsm_enabled_true = 1; -+static __initdata int lsm_enabled_false = 0; -+ - /* Pointers to LSM sections defined in include/asm-generic/vmlinux.lds.h */ - extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; - extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; -@@ -75,37 +79,33 @@ static int __init lsm_debug_enable(char *str) - } - __setup("lsm.debug", lsm_debug_enable); - --/* Mark an LSM's enabled flag. */ --static int lsm_enabled_true __initdata = 1; --static int lsm_enabled_false __initdata = 0; --static void __init set_enabled(struct lsm_info *lsm, bool enabled) -+/** -+ * lsm_enabled_set - Mark a LSM as enabled -+ * @lsm: LSM definition -+ * @enabled: enabled flag -+ */ -+static void __init lsm_enabled_set(struct lsm_info *lsm, bool enabled) - { - /* - * When an LSM hasn't configured an enable variable, we can use - * a hard-coded location for storing the default enabled state. - */ -- if (!lsm->enabled) { -- if (enabled) -- lsm->enabled = &lsm_enabled_true; -- else -- lsm->enabled = &lsm_enabled_false; -- } else if (lsm->enabled == &lsm_enabled_true) { -- if (!enabled) -- lsm->enabled = &lsm_enabled_false; -- } else if (lsm->enabled == &lsm_enabled_false) { -- if (enabled) -- lsm->enabled = &lsm_enabled_true; -+ if (!lsm->enabled || -+ lsm->enabled == &lsm_enabled_true || -+ lsm->enabled == &lsm_enabled_false) { -+ lsm->enabled = enabled ? &lsm_enabled_true : &lsm_enabled_false; - } else { - *lsm->enabled = enabled; - } - } - --static inline bool is_enabled(struct lsm_info *lsm) -+/** -+ * lsm_is_enabled - Determine if a LSM is enabled -+ * @lsm: LSM definition -+ */ -+static inline bool lsm_is_enabled(struct lsm_info *lsm) - { -- if (!lsm->enabled) -- return false; -- -- return *lsm->enabled; -+ return (lsm->enabled ? *lsm->enabled : false); - } - - /* Is an LSM already listed in the ordered LSMs list? */ -@@ -139,7 +139,7 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) - lsm_idlist[last_lsm++] = lsm->id; - - init_debug("%s ordered: %s (%s)\n", from, lsm->id->name, -- is_enabled(lsm) ? "enabled" : "disabled"); -+ lsm_is_enabled(lsm) ? "enabled" : "disabled"); - } - - static void __init lsm_set_blob_size(int *need, int *lbs) -@@ -162,17 +162,17 @@ static void __init lsm_prepare(struct lsm_info *lsm) - { - struct lsm_blob_sizes *blobs; - -- if (!is_enabled(lsm)) { -- set_enabled(lsm, false); -+ if (!lsm_is_enabled(lsm)) { -+ lsm_enabled_set(lsm, false); - return; - } else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && lsm_exclusive) { - init_debug("exclusive disabled: %s\n", lsm->id->name); -- set_enabled(lsm, false); -+ lsm_enabled_set(lsm, false); - return; - } - - /* Mark the LSM as enabled. */ -- set_enabled(lsm, true); -+ lsm_enabled_set(lsm, true); - if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !lsm_exclusive) { - init_debug("exclusive chosen: %s\n", lsm->id->name); - lsm_exclusive = lsm; -@@ -203,7 +203,7 @@ static void __init lsm_prepare(struct lsm_info *lsm) - /* Initialize a given LSM, if it is enabled. */ - static void __init initialize_lsm(struct lsm_info *lsm) - { -- if (is_enabled(lsm)) { -+ if (lsm_is_enabled(lsm)) { - int ret; - - init_debug("initializing %s\n", lsm->id->name); -@@ -237,7 +237,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - lsm_for_each_raw(major) { - if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && - strcmp(major->id->name, lsm_order_legacy) != 0) { -- set_enabled(major, false); -+ lsm_enabled_set(major, false); - init_debug("security=%s disabled: %s (only one legacy major LSM)\n", - lsm_order_legacy, major->id->name); - } -@@ -283,7 +283,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - lsm_for_each_raw(lsm) { - if (exists_ordered_lsm(lsm)) - continue; -- set_enabled(lsm, false); -+ lsm_enabled_set(lsm, false); - init_debug("%s skipped: %s (not in requested order)\n", - origin, lsm->id->name); - } -@@ -316,12 +316,12 @@ static void __init lsm_init_ordered(void) - - pr_info("initializing lsm="); - lsm_early_for_each_raw(early) { -- if (is_enabled(early)) -+ if (lsm_is_enabled(early)) - pr_cont("%s%s", - first++ == 0 ? "" : ",", early->id->name); - } - lsm_order_for_each(lsm) { -- if (is_enabled(*lsm)) -+ if (lsm_is_enabled(*lsm)) - pr_cont("%s%s", - first++ == 0 ? "" : ",", (*lsm)->id->name); - } -@@ -439,7 +439,7 @@ int __init security_init(void) - */ - lsm_early_for_each_raw(lsm) { - init_debug(" early started: %s (%s)\n", lsm->id->name, -- is_enabled(lsm) ? "enabled" : "disabled"); -+ lsm_is_enabled(lsm) ? "enabled" : "disabled"); - } - - /* Load LSMs in specified order. */ --- -2.50.1 (Apple Git-155) - diff --git a/1313-lsm-rename-exists-ordered-lsm-to-lsm-order-exists.patch b/1313-lsm-rename-exists-ordered-lsm-to-lsm-order-exists.patch deleted file mode 100644 index fefdf29e2..000000000 --- a/1313-lsm-rename-exists-ordered-lsm-to-lsm-order-exists.patch +++ /dev/null @@ -1,71 +0,0 @@ -From f5d2029482544f20f0ef5652593a120262b8a96e Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:26:50 +0200 -Subject: [PATCH] lsm: rename exists_ordered_lsm() to lsm_order_exists() - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit a748372a282ae1e23d5d4b14a3e190c28764cfd2 -Author: Paul Moore -Date: Sun Jul 13 17:37:56 2025 -0400 - - lsm: rename exists_ordered_lsm() to lsm_order_exists() - - Also add a header comment block to the function. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 9929d1a61634..bee12c553820 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -108,8 +108,11 @@ static inline bool lsm_is_enabled(struct lsm_info *lsm) - return (lsm->enabled ? *lsm->enabled : false); - } - --/* Is an LSM already listed in the ordered LSMs list? */ --static bool __init exists_ordered_lsm(struct lsm_info *lsm) -+/** -+ * lsm_order_exists - Determine if a LSM exists in the ordered list -+ * @lsm: LSM definition -+ */ -+static bool __init lsm_order_exists(struct lsm_info *lsm) - { - struct lsm_info **check; - -@@ -126,7 +129,7 @@ static int last_lsm __initdata; - static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) - { - /* Ignore duplicate selections. */ -- if (exists_ordered_lsm(lsm)) -+ if (lsm_order_exists(lsm)) - return; - - if (WARN(last_lsm == MAX_LSM_COUNT, "%s: out of LSM static calls!?\n", from)) -@@ -266,7 +269,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - /* Process "security=", if given. */ - if (lsm_order_legacy) { - lsm_for_each_raw(lsm) { -- if (exists_ordered_lsm(lsm)) -+ if (lsm_order_exists(lsm)) - continue; - if (strcmp(lsm->id->name, lsm_order_legacy) == 0) - append_ordered_lsm(lsm, "security="); -@@ -281,7 +284,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - - /* Disable all LSMs not in the ordered list. */ - lsm_for_each_raw(lsm) { -- if (exists_ordered_lsm(lsm)) -+ if (lsm_order_exists(lsm)) - continue; - lsm_enabled_set(lsm, false); - init_debug("%s skipped: %s (not in requested order)\n", --- -2.50.1 (Apple Git-155) - diff --git a/1314-lsm-rename-rework-append-ordered-lsm-into-lsm-order-append.patch b/1314-lsm-rename-rework-append-ordered-lsm-into-lsm-order-append.patch deleted file mode 100644 index 4e2e87084..000000000 --- a/1314-lsm-rename-rework-append-ordered-lsm-into-lsm-order-append.patch +++ /dev/null @@ -1,170 +0,0 @@ -From 2fad39b00bffc92249f43dfa2db89c89b640bcc2 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:26:50 +0200 -Subject: [PATCH] lsm: rename/rework append_ordered_lsm() into - lsm_order_append() - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 24a9c58978ee368cbd796a03cb6e8ade6e0b6f5f -Author: Paul Moore -Date: Wed Jul 16 15:04:10 2025 -0400 - - lsm: rename/rework append_ordered_lsm() into lsm_order_append() - - Rename append_ordered_lsm() to lsm_order_append() to better match - convention and do some rework. The rework includes moving the - LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() - in order to consolidate the individual LSM append/activation code, - and adding logic to skip appending explicitly disabled LSMs to the - active LSM list. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index bee12c553820..30ed62311565 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -124,24 +124,48 @@ static bool __init lsm_order_exists(struct lsm_info *lsm) - return false; - } - --/* Append an LSM to the list of ordered LSMs to initialize. */ --static int last_lsm __initdata; --static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) -+/** -+ * lsm_order_append - Append a LSM to the ordered list -+ * @lsm: LSM definition -+ * @src: source of the addition -+ * -+ * Append @lsm to the enabled LSM array after ensuring that it hasn't been -+ * explicitly disabled, is a duplicate entry, or would run afoul of the -+ * LSM_FLAG_EXCLUSIVE logic. -+ */ -+static void __init lsm_order_append(struct lsm_info *lsm, const char *src) - { - /* Ignore duplicate selections. */ - if (lsm_order_exists(lsm)) - return; - -- if (WARN(last_lsm == MAX_LSM_COUNT, "%s: out of LSM static calls!?\n", from)) -- return; -+ /* Skip explicitly disabled LSMs. */ -+ if (lsm->enabled && !lsm_is_enabled(lsm)) -+ goto out; - -- /* Enable this LSM, if it is not already set. */ -- if (!lsm->enabled) -- lsm->enabled = &lsm_enabled_true; -- lsm_order[last_lsm] = lsm; -- lsm_idlist[last_lsm++] = lsm->id; -+ if (WARN(lsm_active_cnt == MAX_LSM_COUNT, -+ "%s: out of LSM static calls!?\n", src)) { -+ lsm_enabled_set(lsm, false); -+ goto out; -+ } -+ -+ if (lsm->flags & LSM_FLAG_EXCLUSIVE) { -+ if (lsm_exclusive) { -+ init_debug("exclusive disabled: %s\n", lsm->id->name); -+ lsm_enabled_set(lsm, false); -+ goto out; -+ } else { -+ init_debug("exclusive chosen: %s\n", lsm->id->name); -+ lsm_exclusive = lsm; -+ } -+ } - -- init_debug("%s ordered: %s (%s)\n", from, lsm->id->name, -+ lsm_enabled_set(lsm, true); -+ lsm_order[lsm_active_cnt] = lsm; -+ lsm_idlist[lsm_active_cnt++] = lsm->id; -+ -+out: -+ init_debug("%s ordered: %s (%s)\n", src, lsm->id->name, - lsm_is_enabled(lsm) ? "enabled" : "disabled"); - } - -@@ -163,26 +187,12 @@ static void __init lsm_set_blob_size(int *need, int *lbs) - */ - static void __init lsm_prepare(struct lsm_info *lsm) - { -- struct lsm_blob_sizes *blobs; -+ struct lsm_blob_sizes *blobs = lsm->blobs; - -- if (!lsm_is_enabled(lsm)) { -- lsm_enabled_set(lsm, false); -- return; -- } else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && lsm_exclusive) { -- init_debug("exclusive disabled: %s\n", lsm->id->name); -- lsm_enabled_set(lsm, false); -+ if (!blobs) - return; -- } -- -- /* Mark the LSM as enabled. */ -- lsm_enabled_set(lsm, true); -- if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !lsm_exclusive) { -- init_debug("exclusive chosen: %s\n", lsm->id->name); -- lsm_exclusive = lsm; -- } - - /* Register the LSM blob sizes. */ -- blobs = lsm->blobs; - lsm_set_blob_size(&blobs->lbs_cred, &blob_sizes.lbs_cred); - lsm_set_blob_size(&blobs->lbs_file, &blob_sizes.lbs_file); - lsm_set_blob_size(&blobs->lbs_ib, &blob_sizes.lbs_ib); -@@ -224,7 +234,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - /* LSM_ORDER_FIRST is always first. */ - lsm_for_each_raw(lsm) { - if (lsm->order == LSM_ORDER_FIRST) -- append_ordered_lsm(lsm, " first"); -+ lsm_order_append(lsm, " first"); - } - - /* Process "security=", if given. */ -@@ -256,7 +266,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - lsm_for_each_raw(lsm) { - if (strcmp(lsm->id->name, name) == 0) { - if (lsm->order == LSM_ORDER_MUTABLE) -- append_ordered_lsm(lsm, origin); -+ lsm_order_append(lsm, origin); - found = true; - } - } -@@ -272,14 +282,14 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) - if (lsm_order_exists(lsm)) - continue; - if (strcmp(lsm->id->name, lsm_order_legacy) == 0) -- append_ordered_lsm(lsm, "security="); -+ lsm_order_append(lsm, "security="); - } - } - - /* LSM_ORDER_LAST is always last. */ - lsm_for_each_raw(lsm) { - if (lsm->order == LSM_ORDER_LAST) -- append_ordered_lsm(lsm, " last"); -+ lsm_order_append(lsm, " last"); - } - - /* Disable all LSMs not in the ordered list. */ -@@ -413,8 +423,8 @@ int __init early_security_init(void) - return 0; - - lsm_early_for_each_raw(lsm) { -- if (!lsm->enabled) -- lsm->enabled = &lsm_enabled_true; -+ lsm_enabled_set(lsm, true); -+ lsm_order_append(lsm, "early"); - lsm_prepare(lsm); - initialize_lsm(lsm); - } --- -2.50.1 (Apple Git-155) - diff --git a/1315-lsm-rename-rework-ordered-lsm-parse-to-lsm-order-parse.patch b/1315-lsm-rename-rework-ordered-lsm-parse-to-lsm-order-parse.patch deleted file mode 100644 index 83b467c4e..000000000 --- a/1315-lsm-rename-rework-ordered-lsm-parse-to-lsm-order-parse.patch +++ /dev/null @@ -1,166 +0,0 @@ -From 9a0e65bba0a4f8b08943349600337bc08612db41 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:26:51 +0200 -Subject: [PATCH] lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 752db06571816a3870b17814882425318b5ec0ef -Author: Paul Moore -Date: Sun Jul 13 17:51:12 2025 -0400 - - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() - - Rename ordered_lsm_parse() to lsm_order_parse() for the sake of - consistency with the other LSM initialization routines, and also - do some minor rework of the function. Aside from some minor style - decisions, the majority of the rework involved shuffling the order - of the LSM_FLAG_LEGACY and LSM_ORDER_FIRST code so that the - LSM_FLAG_LEGACY checks are handled first; it is important to note - that this doesn't affect the order in which the LSMs are registered. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 30ed62311565..d159981ad0a2 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -225,83 +225,75 @@ static void __init initialize_lsm(struct lsm_info *lsm) - } - } - --/* Populate ordered LSMs list from comma-separated LSM name list. */ --static void __init ordered_lsm_parse(const char *order, const char *origin) -+/** -+ * lsm_order_parse - Parse the comma delimited LSM list -+ * @list: LSM list -+ * @src: source of the list -+ */ -+static void __init lsm_order_parse(const char *list, const char *src) - { - struct lsm_info *lsm; - char *sep, *name, *next; - -- /* LSM_ORDER_FIRST is always first. */ -- lsm_for_each_raw(lsm) { -- if (lsm->order == LSM_ORDER_FIRST) -- lsm_order_append(lsm, " first"); -- } -- -- /* Process "security=", if given. */ -+ /* Handle any Legacy LSM exclusions if one was specified. */ - if (lsm_order_legacy) { -- struct lsm_info *major; -- - /* -- * To match the original "security=" behavior, this -- * explicitly does NOT fallback to another Legacy Major -- * if the selected one was separately disabled: disable -- * all non-matching Legacy Major LSMs. -+ * To match the original "security=" behavior, this explicitly -+ * does NOT fallback to another Legacy Major if the selected -+ * one was separately disabled: disable all non-matching -+ * Legacy Major LSMs. - */ -- lsm_for_each_raw(major) { -- if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && -- strcmp(major->id->name, lsm_order_legacy) != 0) { -- lsm_enabled_set(major, false); -+ lsm_for_each_raw(lsm) { -+ if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) && -+ strcmp(lsm->id->name, lsm_order_legacy)) { -+ lsm_enabled_set(lsm, false); - init_debug("security=%s disabled: %s (only one legacy major LSM)\n", -- lsm_order_legacy, major->id->name); -+ lsm_order_legacy, lsm->id->name); - } - } - } - -- sep = kstrdup(order, GFP_KERNEL); -+ /* LSM_ORDER_FIRST */ -+ lsm_for_each_raw(lsm) { -+ if (lsm->order == LSM_ORDER_FIRST) -+ lsm_order_append(lsm, "first"); -+ } -+ -+ /* Normal or "mutable" LSMs */ -+ sep = kstrdup(list, GFP_KERNEL); - next = sep; - /* Walk the list, looking for matching LSMs. */ - while ((name = strsep(&next, ",")) != NULL) { -- bool found = false; -- - lsm_for_each_raw(lsm) { -- if (strcmp(lsm->id->name, name) == 0) { -- if (lsm->order == LSM_ORDER_MUTABLE) -- lsm_order_append(lsm, origin); -- found = true; -- } -+ if (!strcmp(lsm->id->name, name) && -+ lsm->order == LSM_ORDER_MUTABLE) -+ lsm_order_append(lsm, src); - } -- -- if (!found) -- init_debug("%s ignored: %s (not built into kernel)\n", -- origin, name); - } -+ kfree(sep); - -- /* Process "security=", if given. */ -+ /* Legacy LSM if specified. */ - if (lsm_order_legacy) { - lsm_for_each_raw(lsm) { -- if (lsm_order_exists(lsm)) -- continue; -- if (strcmp(lsm->id->name, lsm_order_legacy) == 0) -- lsm_order_append(lsm, "security="); -+ if (!strcmp(lsm->id->name, lsm_order_legacy)) -+ lsm_order_append(lsm, src); - } - } - -- /* LSM_ORDER_LAST is always last. */ -+ /* LSM_ORDER_LAST */ - lsm_for_each_raw(lsm) { - if (lsm->order == LSM_ORDER_LAST) -- lsm_order_append(lsm, " last"); -+ lsm_order_append(lsm, "last"); - } - -- /* Disable all LSMs not in the ordered list. */ -+ /* Disable all LSMs not previously enabled. */ - lsm_for_each_raw(lsm) { - if (lsm_order_exists(lsm)) - continue; - lsm_enabled_set(lsm, false); - init_debug("%s skipped: %s (not in requested order)\n", -- origin, lsm->id->name); -+ src, lsm->id->name); - } -- -- kfree(sep); - } - - /** -@@ -319,9 +311,9 @@ static void __init lsm_init_ordered(void) - lsm_order_legacy, lsm_order_cmdline); - lsm_order_legacy = NULL; - } -- ordered_lsm_parse(lsm_order_cmdline, "cmdline"); -+ lsm_order_parse(lsm_order_cmdline, "cmdline"); - } else -- ordered_lsm_parse(lsm_order_builtin, "builtin"); -+ lsm_order_parse(lsm_order_builtin, "builtin"); - - lsm_order_for_each(lsm) { - lsm_prepare(*lsm); --- -2.50.1 (Apple Git-155) - diff --git a/1316-lsm-cleanup-the-lsm-blob-size-code.patch b/1316-lsm-cleanup-the-lsm-blob-size-code.patch deleted file mode 100644 index ca971a2b9..000000000 --- a/1316-lsm-cleanup-the-lsm-blob-size-code.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 7cbba38d94b554ea452c90264ea4f7b03ef18498 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Fri, 29 May 2026 18:37:27 +0200 -Subject: [PATCH] lsm: cleanup the LSM blob size code - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for - BPF objects"), which is not backported - -commit 291271e691740003021cf5b48fa7cf7e3371eaa7 -Author: Paul Moore -Date: Tue Feb 11 17:49:11 2025 -0500 - - lsm: cleanup the LSM blob size code - - Convert the lsm_blob_size fields to unsigned integers as there is no - current need for them to be negative, change "lsm_set_blob_size()" to - "lsm_blob_size_update()" to better reflect reality, and perform some - other minor cleanups to the associated code. - - Reviewed-by: Kees Cook - Reviewed-by: John Johansen - Reviewed-by: Casey Schaufler - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index bc477fb20d02..a7ecb0791a0f 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -102,20 +102,20 @@ struct security_hook_list { - * Security blob size or offset data. - */ - struct lsm_blob_sizes { -- int lbs_cred; -- int lbs_file; -- int lbs_ib; -- int lbs_inode; -- int lbs_sock; -- int lbs_superblock; -- int lbs_ipc; -- int lbs_key; -- int lbs_msg_msg; -- int lbs_perf_event; -- int lbs_task; -- int lbs_xattr_count; /* number of xattr slots in new_xattrs array */ -- int lbs_tun_dev; -- int lbs_bdev; -+ unsigned int lbs_cred; -+ unsigned int lbs_file; -+ unsigned int lbs_ib; -+ unsigned int lbs_inode; -+ unsigned int lbs_sock; -+ unsigned int lbs_superblock; -+ unsigned int lbs_ipc; -+ unsigned int lbs_key; -+ unsigned int lbs_msg_msg; -+ unsigned int lbs_perf_event; -+ unsigned int lbs_task; -+ unsigned int lbs_xattr_count; /* num xattr slots in new_xattrs array */ -+ unsigned int lbs_tun_dev; -+ unsigned int lbs_bdev; - }; - - /* -diff --git a/security/lsm_init.c b/security/lsm_init.c -index d159981ad0a2..bc9191b53305 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -169,16 +169,22 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src) - lsm_is_enabled(lsm) ? "enabled" : "disabled"); - } - --static void __init lsm_set_blob_size(int *need, int *lbs) -+/** -+ * lsm_blob_size_update - Update the LSM blob size and offset information -+ * @sz_req: the requested additional blob size -+ * @sz_cur: the existing blob size -+ */ -+static void __init lsm_blob_size_update(unsigned int *sz_req, -+ unsigned int *sz_cur) - { -- int offset; -+ unsigned int offset; - -- if (*need <= 0) -+ if (*sz_req == 0) - return; - -- offset = ALIGN(*lbs, sizeof(void *)); -- *lbs = offset + *need; -- *need = offset; -+ offset = ALIGN(*sz_cur, sizeof(void *)); -+ *sz_cur = offset + *sz_req; -+ *sz_req = offset; - } - - /** -@@ -193,24 +199,27 @@ static void __init lsm_prepare(struct lsm_info *lsm) - return; - - /* Register the LSM blob sizes. */ -- lsm_set_blob_size(&blobs->lbs_cred, &blob_sizes.lbs_cred); -- lsm_set_blob_size(&blobs->lbs_file, &blob_sizes.lbs_file); -- lsm_set_blob_size(&blobs->lbs_ib, &blob_sizes.lbs_ib); -+ blobs = lsm->blobs; -+ lsm_blob_size_update(&blobs->lbs_cred, &blob_sizes.lbs_cred); -+ lsm_blob_size_update(&blobs->lbs_file, &blob_sizes.lbs_file); -+ lsm_blob_size_update(&blobs->lbs_ib, &blob_sizes.lbs_ib); - /* inode blob gets an rcu_head in addition to LSM blobs. */ - if (blobs->lbs_inode && blob_sizes.lbs_inode == 0) - blob_sizes.lbs_inode = sizeof(struct rcu_head); -- lsm_set_blob_size(&blobs->lbs_inode, &blob_sizes.lbs_inode); -- lsm_set_blob_size(&blobs->lbs_ipc, &blob_sizes.lbs_ipc); -- lsm_set_blob_size(&blobs->lbs_key, &blob_sizes.lbs_key); -- lsm_set_blob_size(&blobs->lbs_msg_msg, &blob_sizes.lbs_msg_msg); -- lsm_set_blob_size(&blobs->lbs_perf_event, &blob_sizes.lbs_perf_event); -- lsm_set_blob_size(&blobs->lbs_sock, &blob_sizes.lbs_sock); -- lsm_set_blob_size(&blobs->lbs_superblock, &blob_sizes.lbs_superblock); -- lsm_set_blob_size(&blobs->lbs_task, &blob_sizes.lbs_task); -- lsm_set_blob_size(&blobs->lbs_tun_dev, &blob_sizes.lbs_tun_dev); -- lsm_set_blob_size(&blobs->lbs_xattr_count, -- &blob_sizes.lbs_xattr_count); -- lsm_set_blob_size(&blobs->lbs_bdev, &blob_sizes.lbs_bdev); -+ lsm_blob_size_update(&blobs->lbs_inode, &blob_sizes.lbs_inode); -+ lsm_blob_size_update(&blobs->lbs_ipc, &blob_sizes.lbs_ipc); -+ lsm_blob_size_update(&blobs->lbs_key, &blob_sizes.lbs_key); -+ lsm_blob_size_update(&blobs->lbs_msg_msg, &blob_sizes.lbs_msg_msg); -+ lsm_blob_size_update(&blobs->lbs_perf_event, -+ &blob_sizes.lbs_perf_event); -+ lsm_blob_size_update(&blobs->lbs_sock, &blob_sizes.lbs_sock); -+ lsm_blob_size_update(&blobs->lbs_superblock, -+ &blob_sizes.lbs_superblock); -+ lsm_blob_size_update(&blobs->lbs_task, &blob_sizes.lbs_task); -+ lsm_blob_size_update(&blobs->lbs_tun_dev, &blob_sizes.lbs_tun_dev); -+ lsm_blob_size_update(&blobs->lbs_xattr_count, -+ &blob_sizes.lbs_xattr_count); -+ lsm_blob_size_update(&blobs->lbs_bdev, &blob_sizes.lbs_bdev); - } - - /* Initialize a given LSM, if it is enabled. */ --- -2.50.1 (Apple Git-155) - diff --git a/1317-lsm-cleanup-initialize-lsm-and-rename-to-lsm-init-single.patch b/1317-lsm-cleanup-initialize-lsm-and-rename-to-lsm-init-single.patch deleted file mode 100644 index 0d033d6eb..000000000 --- a/1317-lsm-cleanup-initialize-lsm-and-rename-to-lsm-init-single.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 800c1228fa046d32687562f80731aa1cda374657 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:28:42 +0200 -Subject: [PATCH] lsm: cleanup initialize_lsm() and rename to lsm_init_single() - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 27be5600fe852c52d5b70f4ac9406879b39c864e -Author: Paul Moore -Date: Tue Feb 11 18:24:04 2025 -0500 - - lsm: cleanup initialize_lsm() and rename to lsm_init_single() - - Rename initialize_lsm() to be more consistent with the rest of the LSM - initialization changes and rework the function itself to better fit - with the "exit on fail" coding pattern. - - Reviewed-by: Kees Cook - Reviewed-by: John Johansen - Reviewed-by: Casey Schaufler - Reviewed-by: Mimi Zohar - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index bc9191b53305..8cf53a48f37c 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -169,6 +169,7 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src) - lsm_is_enabled(lsm) ? "enabled" : "disabled"); - } - -+ - /** - * lsm_blob_size_update - Update the LSM blob size and offset information - * @sz_req: the requested additional blob size -@@ -222,16 +223,20 @@ static void __init lsm_prepare(struct lsm_info *lsm) - lsm_blob_size_update(&blobs->lbs_bdev, &blob_sizes.lbs_bdev); - } - --/* Initialize a given LSM, if it is enabled. */ --static void __init initialize_lsm(struct lsm_info *lsm) -+/** -+ * lsm_init_single - Initialize a given LSM -+ * @lsm: LSM definition -+ */ -+static void __init lsm_init_single(struct lsm_info *lsm) - { -- if (lsm_is_enabled(lsm)) { -- int ret; -+ int ret; - -- init_debug("initializing %s\n", lsm->id->name); -- ret = lsm->init(); -- WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret); -- } -+ if (!lsm_is_enabled(lsm)) -+ return; -+ -+ init_debug("initializing %s\n", lsm->id->name); -+ ret = lsm->init(); -+ WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret); - } - - /** -@@ -373,7 +378,7 @@ static void __init lsm_init_ordered(void) - panic("%s: early task alloc failed.\n", __func__); - - lsm_order_for_each(lsm) { -- initialize_lsm(*lsm); -+ lsm_init_single(*lsm); - } - } - -@@ -427,7 +432,7 @@ int __init early_security_init(void) - lsm_enabled_set(lsm, true); - lsm_order_append(lsm, "early"); - lsm_prepare(lsm); -- initialize_lsm(lsm); -+ lsm_init_single(lsm); - } - - early_security_initialized = true; --- -2.50.1 (Apple Git-155) - diff --git a/1318-lsm-fold-lsm-init-ordered-into-security-init.patch b/1318-lsm-fold-lsm-init-ordered-into-security-init.patch deleted file mode 100644 index e5fbcde97..000000000 --- a/1318-lsm-fold-lsm-init-ordered-into-security-init.patch +++ /dev/null @@ -1,236 +0,0 @@ -From 4b0683928d38d0fd4d8ce409bb75adfb669b9eb7 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:28:42 +0200 -Subject: [PATCH] lsm: fold lsm_init_ordered() into security_init() - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for - BPF objects"), which is not backported - -commit 45a41d1394aa2ed0305f0560f93bb87be7192481 -Author: Paul Moore -Date: Wed Feb 12 18:10:37 2025 -0500 - - lsm: fold lsm_init_ordered() into security_init() - - With only security_init() calling lsm_init_ordered, it makes little - sense to keep lsm_init_ordered() as a standalone function. Fold - lsm_init_ordered() into security_init(). - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 8cf53a48f37c..560ce78f3493 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -18,6 +18,9 @@ static __initdata int lsm_enabled_false = 0; - extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; - extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; - -+/* Number of "early" LSMs */ -+static __initdata unsigned int lsm_count_early; -+ - /* Build and boot-time LSM ordering. */ - static __initconst const char *const lsm_order_builtin = CONFIG_LSM; - static __initdata const char *lsm_order_cmdline; -@@ -169,7 +172,6 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src) - lsm_is_enabled(lsm) ? "enabled" : "disabled"); - } - -- - /** - * lsm_blob_size_update - Update the LSM blob size and offset information - * @sz_req: the requested additional blob size -@@ -310,78 +312,6 @@ static void __init lsm_order_parse(const char *list, const char *src) - } - } - --/** -- * lsm_init_ordered - Initialize the ordered LSMs -- */ --static void __init lsm_init_ordered(void) --{ -- unsigned int first = 0; -- struct lsm_info **lsm; -- struct lsm_info *early; -- -- if (lsm_order_cmdline) { -- if (lsm_order_legacy) { -- pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", -- lsm_order_legacy, lsm_order_cmdline); -- lsm_order_legacy = NULL; -- } -- lsm_order_parse(lsm_order_cmdline, "cmdline"); -- } else -- lsm_order_parse(lsm_order_builtin, "builtin"); -- -- lsm_order_for_each(lsm) { -- lsm_prepare(*lsm); -- } -- -- pr_info("initializing lsm="); -- lsm_early_for_each_raw(early) { -- if (lsm_is_enabled(early)) -- pr_cont("%s%s", -- first++ == 0 ? "" : ",", early->id->name); -- } -- lsm_order_for_each(lsm) { -- if (lsm_is_enabled(*lsm)) -- pr_cont("%s%s", -- first++ == 0 ? "" : ",", (*lsm)->id->name); -- } -- pr_cont("\n"); -- -- init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); -- init_debug("file blob size = %d\n", blob_sizes.lbs_file); -- init_debug("ib blob size = %d\n", blob_sizes.lbs_ib); -- init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); -- init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); --#ifdef CONFIG_KEYS -- init_debug("key blob size = %d\n", blob_sizes.lbs_key); --#endif /* CONFIG_KEYS */ -- init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); -- init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); -- init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); -- init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event); -- init_debug("task blob size = %d\n", blob_sizes.lbs_task); -- init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev); -- init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); -- init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev); -- -- if (blob_sizes.lbs_file) -- lsm_file_cache = kmem_cache_create("lsm_file_cache", -- blob_sizes.lbs_file, 0, -- SLAB_PANIC, NULL); -- if (blob_sizes.lbs_inode) -- lsm_inode_cache = kmem_cache_create("lsm_inode_cache", -- blob_sizes.lbs_inode, 0, -- SLAB_PANIC, NULL); -- -- if (lsm_cred_alloc((struct cred __rcu *)current->cred, GFP_KERNEL)) -- panic("%s: early cred alloc failed.\n", __func__); -- if (lsm_task_alloc(current)) -- panic("%s: early task alloc failed.\n", __func__); -- -- lsm_order_for_each(lsm) { -- lsm_init_single(*lsm); -- } --} -- - static void __init lsm_static_call_init(struct security_hook_list *hl) - { - struct lsm_static_call *scall = hl->scalls; -@@ -433,6 +363,7 @@ int __init early_security_init(void) - lsm_order_append(lsm, "early"); - lsm_prepare(lsm); - lsm_init_single(lsm); -+ lsm_count_early++; - } - - early_security_initialized = true; -@@ -440,29 +371,85 @@ int __init early_security_init(void) - } - - /** -- * security_init - initializes the security framework -+ * security_init - Initializes the LSM framework - * - * This should be called early in the kernel initialization sequence. - */ - int __init security_init(void) - { -- struct lsm_info *lsm; -+ unsigned int cnt; -+ struct lsm_info **lsm; -+ struct lsm_info *early; -+ unsigned int first = 0; - - init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*"); - init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin); - init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*"); - -- /* -- * Append the names of the early LSM modules now that kmalloc() is -- * available -- */ -- lsm_early_for_each_raw(lsm) { -- init_debug(" early started: %s (%s)\n", lsm->id->name, -- lsm_is_enabled(lsm) ? "enabled" : "disabled"); -+ if (lsm_order_cmdline) { -+ if (lsm_order_legacy) { -+ pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", -+ lsm_order_legacy, lsm_order_cmdline); -+ lsm_order_legacy = NULL; -+ } -+ lsm_order_parse(lsm_order_cmdline, "cmdline"); -+ } else -+ lsm_order_parse(lsm_order_builtin, "builtin"); -+ -+ lsm_order_for_each(lsm) -+ lsm_prepare(*lsm); -+ -+ pr_info("initializing lsm="); -+ lsm_early_for_each_raw(early) { -+ if (lsm_is_enabled(early)) -+ pr_cont("%s%s", -+ first++ == 0 ? "" : ",", early->id->name); -+ } -+ lsm_order_for_each(lsm) { -+ if (lsm_is_enabled(*lsm)) -+ pr_cont("%s%s", -+ first++ == 0 ? "" : ",", (*lsm)->id->name); - } -+ pr_cont("\n"); -+ -+ init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); -+ init_debug("file blob size = %d\n", blob_sizes.lbs_file); -+ init_debug("ib blob size = %d\n", blob_sizes.lbs_ib); -+ init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); -+ init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); -+#ifdef CONFIG_KEYS -+ init_debug("key blob size = %d\n", blob_sizes.lbs_key); -+#endif /* CONFIG_KEYS */ -+ init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); -+ init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); -+ init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); -+ init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event); -+ init_debug("task blob size = %d\n", blob_sizes.lbs_task); -+ init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev); -+ init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); -+ init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev); -+ -+ if (blob_sizes.lbs_file) -+ lsm_file_cache = kmem_cache_create("lsm_file_cache", -+ blob_sizes.lbs_file, 0, -+ SLAB_PANIC, NULL); -+ if (blob_sizes.lbs_inode) -+ lsm_inode_cache = kmem_cache_create("lsm_inode_cache", -+ blob_sizes.lbs_inode, 0, -+ SLAB_PANIC, NULL); - -- /* Load LSMs in specified order. */ -- lsm_init_ordered(); -+ if (lsm_cred_alloc((struct cred __rcu *)current->cred, GFP_KERNEL)) -+ panic("%s: early cred alloc failed.\n", __func__); -+ if (lsm_task_alloc(current)) -+ panic("%s: early task alloc failed.\n", __func__); -+ -+ cnt = 0; -+ lsm_order_for_each(lsm) { -+ /* skip the "early" LSMs as they have already been setup */ -+ if (cnt++ < lsm_count_early) -+ continue; -+ lsm_init_single(*lsm); -+ } - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1319-lsm-add-tweak-function-header-comment-blocks-in-lsm-init-c.patch b/1319-lsm-add-tweak-function-header-comment-blocks-in-lsm-init-c.patch deleted file mode 100644 index ab172dd4e..000000000 --- a/1319-lsm-add-tweak-function-header-comment-blocks-in-lsm-init-c.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 5a8181960a7f242505b8b6782253a87545aec9d3 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:28:43 +0200 -Subject: [PATCH] lsm: add/tweak function header comment blocks in lsm_init.c - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 - -commit 450705334f698990804b470437f3014cee979486 -Author: Paul Moore -Date: Wed Feb 12 18:17:03 2025 -0500 - - lsm: add/tweak function header comment blocks in lsm_init.c - - Add function header comments for lsm_static_call_init() and - early_security_init(), tweak the existing comment block for - security_add_hooks(). - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm_init.c b/security/lsm_init.c -index 560ce78f3493..a7eeeca2cb67 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -312,6 +312,10 @@ static void __init lsm_order_parse(const char *list, const char *src) - } - } - -+/** -+ * lsm_static_call_init - Initialize a LSM's static calls -+ * @hl: LSM hook list -+ */ - static void __init lsm_static_call_init(struct security_hook_list *hl) - { - struct lsm_static_call *scall = hl->scalls; -@@ -332,12 +336,12 @@ static void __init lsm_static_call_init(struct security_hook_list *hl) - } - - /** -- * security_add_hooks - Add a modules hooks to the hook lists. -- * @hooks: the hooks to add -- * @count: the number of hooks to add -- * @lsmid: the identification information for the security module -+ * security_add_hooks - Add a LSM's hooks to the LSM framework's hook lists -+ * @hooks: LSM hooks to add -+ * @count: number of hooks to add -+ * @lsmid: identification information for the LSM - * -- * Each LSM has to register its hooks with the infrastructure. -+ * Each LSM has to register its hooks with the LSM framework. - */ - void __init security_add_hooks(struct security_hook_list *hooks, int count, - const struct lsm_id *lsmid) -@@ -350,6 +354,9 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, - } - } - -+/** -+ * early_security_init - Initialize the early LSMs -+ */ - int __init early_security_init(void) - { - struct lsm_info *lsm; --- -2.50.1 (Apple Git-155) - diff --git a/1320-lsm-cleanup-the-debug-and-console-output-in-lsm-init-c.patch b/1320-lsm-cleanup-the-debug-and-console-output-in-lsm-init-c.patch deleted file mode 100644 index 9620f5e79..000000000 --- a/1320-lsm-cleanup-the-debug-and-console-output-in-lsm-init-c.patch +++ /dev/null @@ -1,299 +0,0 @@ -From 455eabf0b6cf32582a8f485f2628a4e0a90fe398 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 1 Jun 2026 10:30:41 +0200 -Subject: [PATCH] lsm: cleanup the debug and console output in lsm_init.c - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for - BPF objects"), which is not backported - -commit 5137e583ba2635b82667dc63cb35305750420411 -Author: Paul Moore -Date: Wed Feb 12 18:20:01 2025 -0500 - - lsm: cleanup the debug and console output in lsm_init.c - - Move away from an init specific init_debug() macro to a more general - lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available - both before and after init. In the process we do a number of minor - changes to improve the LSM initialization output and cleanup the code - somewhat. - - Reviewed-by: Casey Schaufler - Reviewed-by: John Johansen - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/lsm.h b/security/lsm.h -index dbe755c45e57..8dc267977ae0 100644 ---- a/security/lsm.h -+++ b/security/lsm.h -@@ -6,9 +6,20 @@ - #ifndef _LSM_H_ - #define _LSM_H_ - -+#include - #include - #include - -+/* LSM debugging */ -+extern bool lsm_debug; -+#define lsm_pr(...) pr_info(__VA_ARGS__) -+#define lsm_pr_cont(...) pr_cont(__VA_ARGS__) -+#define lsm_pr_dbg(...) \ -+ do { \ -+ if (lsm_debug) \ -+ pr_info(__VA_ARGS__); \ -+ } while (0) -+ - /* List of configured LSMs */ - extern unsigned int lsm_active_cnt; - extern const struct lsm_id *lsm_idlist[]; -diff --git a/security/lsm_init.c b/security/lsm_init.c -index a7eeeca2cb67..bef21da72c16 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -30,13 +30,6 @@ static __initdata const char *lsm_order_legacy; - static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1]; - static __initdata struct lsm_info *lsm_exclusive; - --static __initdata bool debug; --#define init_debug(...) \ -- do { \ -- if (debug) \ -- pr_info(__VA_ARGS__); \ -- } while (0) -- - #define lsm_order_for_each(iter) \ - for ((iter) = lsm_order; *(iter); (iter)++) - #define lsm_for_each_raw(iter) \ -@@ -77,7 +70,7 @@ __setup("lsm=", lsm_choose_lsm); - */ - static int __init lsm_debug_enable(char *str) - { -- debug = true; -+ lsm_debug = true; - return 1; - } - __setup("lsm.debug", lsm_debug_enable); -@@ -143,22 +136,28 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src) - return; - - /* Skip explicitly disabled LSMs. */ -- if (lsm->enabled && !lsm_is_enabled(lsm)) -- goto out; -+ if (lsm->enabled && !lsm_is_enabled(lsm)) { -+ lsm_pr_dbg("skip previously disabled LSM %s:%s\n", -+ src, lsm->id->name); -+ return; -+ } - -- if (WARN(lsm_active_cnt == MAX_LSM_COUNT, -- "%s: out of LSM static calls!?\n", src)) { -+ if (lsm_active_cnt == MAX_LSM_COUNT) { -+ pr_warn("exceeded maximum LSM count on %s:%s\n", -+ src, lsm->id->name); - lsm_enabled_set(lsm, false); -- goto out; -+ return; - } - - if (lsm->flags & LSM_FLAG_EXCLUSIVE) { - if (lsm_exclusive) { -- init_debug("exclusive disabled: %s\n", lsm->id->name); -+ lsm_pr_dbg("skip exclusive LSM conflict %s:%s\n", -+ src, lsm->id->name); - lsm_enabled_set(lsm, false); -- goto out; -+ return; - } else { -- init_debug("exclusive chosen: %s\n", lsm->id->name); -+ lsm_pr_dbg("select exclusive LSM %s:%s\n", -+ src, lsm->id->name); - lsm_exclusive = lsm; - } - } -@@ -167,9 +166,7 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src) - lsm_order[lsm_active_cnt] = lsm; - lsm_idlist[lsm_active_cnt++] = lsm->id; - --out: -- init_debug("%s ordered: %s (%s)\n", src, lsm->id->name, -- lsm_is_enabled(lsm) ? "enabled" : "disabled"); -+ lsm_pr_dbg("enabling LSM %s:%s\n", src, lsm->id->name); - } - - /** -@@ -236,7 +233,7 @@ static void __init lsm_init_single(struct lsm_info *lsm) - if (!lsm_is_enabled(lsm)) - return; - -- init_debug("initializing %s\n", lsm->id->name); -+ lsm_pr_dbg("initializing %s\n", lsm->id->name); - ret = lsm->init(); - WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret); - } -@@ -263,8 +260,8 @@ static void __init lsm_order_parse(const char *list, const char *src) - if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) && - strcmp(lsm->id->name, lsm_order_legacy)) { - lsm_enabled_set(lsm, false); -- init_debug("security=%s disabled: %s (only one legacy major LSM)\n", -- lsm_order_legacy, lsm->id->name); -+ lsm_pr_dbg("skip legacy LSM conflict %s:%s\n", -+ src, lsm->id->name); - } - } - } -@@ -307,8 +304,7 @@ static void __init lsm_order_parse(const char *list, const char *src) - if (lsm_order_exists(lsm)) - continue; - lsm_enabled_set(lsm, false); -- init_debug("%s skipped: %s (not in requested order)\n", -- src, lsm->id->name); -+ lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name); - } - } - -@@ -316,7 +312,7 @@ static void __init lsm_order_parse(const char *list, const char *src) - * lsm_static_call_init - Initialize a LSM's static calls - * @hl: LSM hook list - */ --static void __init lsm_static_call_init(struct security_hook_list *hl) -+static int __init lsm_static_call_init(struct security_hook_list *hl) - { - struct lsm_static_call *scall = hl->scalls; - int i; -@@ -328,11 +324,12 @@ static void __init lsm_static_call_init(struct security_hook_list *hl) - hl->hook.lsm_func_addr); - scall->hl = hl; - static_branch_enable(scall->active); -- return; -+ return 0; - } - scall++; - } -- panic("%s - Ran out of static slots.\n", __func__); -+ -+ return -ENOSPC; - } - - /** -@@ -350,7 +347,9 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, - - for (i = 0; i < count; i++) { - hooks[i].lsmid = lsmid; -- lsm_static_call_init(&hooks[i]); -+ if (lsm_static_call_init(&hooks[i])) -+ panic("exhausted LSM callback slots with LSM %s\n", -+ lsmid->name); - } - } - -@@ -386,19 +385,16 @@ int __init security_init(void) - { - unsigned int cnt; - struct lsm_info **lsm; -- struct lsm_info *early; -- unsigned int first = 0; - -- init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*"); -- init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin); -- init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*"); -+ if (lsm_debug) { -+ lsm_pr("built-in LSM list: %s\n", lsm_order_builtin); -+ lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy); -+ lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline); -+ } - - if (lsm_order_cmdline) { -- if (lsm_order_legacy) { -- pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", -- lsm_order_legacy, lsm_order_cmdline); -+ if (lsm_order_legacy) - lsm_order_legacy = NULL; -- } - lsm_order_parse(lsm_order_cmdline, "cmdline"); - } else - lsm_order_parse(lsm_order_builtin, "builtin"); -@@ -406,35 +402,22 @@ int __init security_init(void) - lsm_order_for_each(lsm) - lsm_prepare(*lsm); - -- pr_info("initializing lsm="); -- lsm_early_for_each_raw(early) { -- if (lsm_is_enabled(early)) -- pr_cont("%s%s", -- first++ == 0 ? "" : ",", early->id->name); -- } -- lsm_order_for_each(lsm) { -- if (lsm_is_enabled(*lsm)) -- pr_cont("%s%s", -- first++ == 0 ? "" : ",", (*lsm)->id->name); -+ if (lsm_debug) { -+ lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred); -+ lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file); -+ lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib); -+ lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode); -+ lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc); -+ lsm_pr("blob(key) size %d\n", blob_sizes.lbs_key); -+ lsm_pr("blob(msg_msg)_size %d\n", blob_sizes.lbs_msg_msg); -+ lsm_pr("blob(sock) size %d\n", blob_sizes.lbs_sock); -+ lsm_pr("blob(superblock) size %d\n", blob_sizes.lbs_superblock); -+ lsm_pr("blob(perf_event) size %d\n", blob_sizes.lbs_perf_event); -+ lsm_pr("blob(task) size %d\n", blob_sizes.lbs_task); -+ lsm_pr("blob(tun_dev) size %d\n", blob_sizes.lbs_tun_dev); -+ lsm_pr("blob(xattr) count %d\n", blob_sizes.lbs_xattr_count); -+ lsm_pr("blob(bdev) size %d\n", blob_sizes.lbs_bdev); - } -- pr_cont("\n"); -- -- init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); -- init_debug("file blob size = %d\n", blob_sizes.lbs_file); -- init_debug("ib blob size = %d\n", blob_sizes.lbs_ib); -- init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); -- init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); --#ifdef CONFIG_KEYS -- init_debug("key blob size = %d\n", blob_sizes.lbs_key); --#endif /* CONFIG_KEYS */ -- init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); -- init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); -- init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); -- init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event); -- init_debug("task blob size = %d\n", blob_sizes.lbs_task); -- init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev); -- init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); -- init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev); - - if (blob_sizes.lbs_file) - lsm_file_cache = kmem_cache_create("lsm_file_cache", -@@ -446,9 +429,9 @@ int __init security_init(void) - SLAB_PANIC, NULL); - - if (lsm_cred_alloc((struct cred __rcu *)current->cred, GFP_KERNEL)) -- panic("%s: early cred alloc failed.\n", __func__); -+ panic("early LSM cred alloc failed\n"); - if (lsm_task_alloc(current)) -- panic("%s: early task alloc failed.\n", __func__); -+ panic("early LSM task alloc failed\n"); - - cnt = 0; - lsm_order_for_each(lsm) { -diff --git a/security/security.c b/security/security.c -index 6f20f44c8d13..56c48725e334 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -74,6 +74,8 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { - [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", - }; - -+bool lsm_debug __ro_after_init; -+ - unsigned int lsm_active_cnt __ro_after_init; - const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; - --- -2.50.1 (Apple Git-155) - diff --git a/1321-fs-prepare-for-adding-lsm-blob-to-backing-file.patch b/1321-fs-prepare-for-adding-lsm-blob-to-backing-file.patch deleted file mode 100644 index 32aa1b0a5..000000000 --- a/1321-fs-prepare-for-adding-lsm-blob-to-backing-file.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 1367930b371086acec799dd7062ce70dae049608 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 2 Jun 2026 10:09:51 +0200 -Subject: [PATCH] fs: prepare for adding LSM blob to backing_file - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - fs/file_table.c: trivial context fuzz - -commit 880bd496ec72a6dcb00cb70c430ef752ba242ae7 -Author: Amir Goldstein -Date: Mon Mar 30 10:27:51 2026 +0200 - - fs: prepare for adding LSM blob to backing_file - - In preparation to adding LSM blob to backing_file struct, factor out - helpers init_backing_file() and backing_file_free(). - - Cc: stable@vger.kernel.org - Cc: linux-fsdevel@vger.kernel.org - Cc: linux-unionfs@vger.kernel.org - Cc: linux-erofs@lists.ozlabs.org - Signed-off-by: Amir Goldstein - Reviewed-by: Serge Hallyn - [PM: use the term "LSM blob", fix comment style to match file] - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file_table.c b/fs/file_table.c -index 9979efb9a380..4b4d50a1d9da 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -67,6 +67,12 @@ void backing_file_set_user_path(struct file *f, const struct path *path) - } - EXPORT_SYMBOL_GPL(backing_file_set_user_path); - -+static inline void backing_file_free(struct backing_file *ff) -+{ -+ path_put(&ff->user_path); -+ kmem_cache_free(bfilp_cachep, ff); -+} -+ - static inline void file_free(struct file *f) - { - security_file_free(f); -@@ -74,8 +80,7 @@ static inline void file_free(struct file *f) - percpu_counter_dec(&nr_files); - put_cred(f->f_cred); - if (unlikely(f->f_mode & FMODE_BACKING)) { -- path_put(backing_file_user_path(f)); -- kmem_cache_free(bfilp_cachep, backing_file(f)); -+ backing_file_free(backing_file(f)); - } else { - kmem_cache_free(filp_cachep, f); - } -@@ -278,6 +283,12 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) - return f; - } - -+static int init_backing_file(struct backing_file *ff) -+{ -+ memset(&ff->user_path, 0, sizeof(ff->user_path)); -+ return 0; -+} -+ - /* - * Variant of alloc_empty_file() that allocates a backing_file container - * and doesn't check and modify nr_files. -@@ -300,7 +311,14 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred) - return ERR_PTR(error); - } - -+ /* The f_mode flags must be set before fput(). */ - ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT; -+ error = init_backing_file(ff); -+ if (unlikely(error)) { -+ fput(&ff->file); -+ return ERR_PTR(error); -+ } -+ - return &ff->file; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1322-lsm-add-backing-file-lsm-hooks.patch b/1322-lsm-add-backing-file-lsm-hooks.patch deleted file mode 100644 index 4d044d1f4..000000000 --- a/1322-lsm-add-backing-file-lsm-hooks.patch +++ /dev/null @@ -1,569 +0,0 @@ -From c2685f8b7b4392f68d8492a331de2f544cc80a8b Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 2 Jun 2026 10:36:28 +0200 -Subject: [PATCH] lsm: add backing_file LSM hooks - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - fs/backing-file.c: adjust backing_file_mmap() to downstream state (missing - scoped guards) - - fs/erofs/ishare.c: hunk dropped, files not in RHEL10 - - fs/overlayfs/dir.c: adjust to different indentation - - fs/overlayfs/file.c: adjust to different indentation - -commit 6af36aeb147a06dea47c49859cd6ca5659aeb987 -Author: Paul Moore -Date: Fri Dec 19 13:18:22 2025 -0500 - - lsm: add backing_file LSM hooks - - Stacked filesystems such as overlayfs do not currently provide the - necessary mechanisms for LSMs to properly enforce access controls on the - mmap() and mprotect() operations. In order to resolve this gap, a LSM - security blob is being added to the backing_file struct and the following - new LSM hooks are being created: - - security_backing_file_alloc() - security_backing_file_free() - security_mmap_backing_file() - - The first two hooks are to manage the lifecycle of the LSM security blob - in the backing_file struct, while the third provides a new mmap() access - control point for the underlying backing file. It is also expected that - LSMs will likely want to update their security_file_mprotect() callback - to address issues with their mprotect() controls, but that does not - require a change to the security_file_mprotect() LSM hook. - - There are a three other small changes to support these new LSM hooks: - * Pass the user file associated with a backing file down to - alloc_empty_backing_file() so it can be included in the - security_backing_file_alloc() hook. - * Add getter and setter functions for the backing_file struct LSM blob - as the backing_file struct remains private to fs/file_table.c. - * Constify the file struct field in the LSM common_audit_data struct to - better support LSMs that need to pass a const file struct pointer into - the common LSM audit code. - - Thanks to Arnd Bergmann for identifying the missing EXPORT_SYMBOL_GPL() - and supplying a fixup. - - Cc: stable@vger.kernel.org - Cc: linux-fsdevel@vger.kernel.org - Cc: linux-unionfs@vger.kernel.org - Cc: linux-erofs@lists.ozlabs.org - Reviewed-by: Amir Goldstein - Reviewed-by: Serge Hallyn - Reviewed-by: Christian Brauner - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/backing-file.c b/fs/backing-file.c -index 892361c31c3d..bb7ecb0fc3ae 100644 ---- a/fs/backing-file.c -+++ b/fs/backing-file.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #include "internal.h" - -@@ -29,14 +30,15 @@ - * returned file into a container structure that also stores the stacked - * file's path, which can be retrieved using backing_file_user_path(). - */ --struct file *backing_file_open(const struct path *user_path, int flags, -+struct file *backing_file_open(const struct file *user_file, int flags, - const struct path *real_path, - const struct cred *cred) - { -+ const struct path *user_path = &user_file->f_path; - struct file *f; - int error; - -- f = alloc_empty_backing_file(flags, cred); -+ f = alloc_empty_backing_file(flags, cred, user_file); - if (IS_ERR(f)) - return f; - -@@ -52,15 +54,16 @@ struct file *backing_file_open(const struct path *user_path, int flags, - } - EXPORT_SYMBOL_GPL(backing_file_open); - --struct file *backing_tmpfile_open(const struct path *user_path, int flags, -+struct file *backing_tmpfile_open(const struct file *user_file, int flags, - const struct path *real_parentpath, - umode_t mode, const struct cred *cred) - { - struct mnt_idmap *real_idmap = mnt_idmap(real_parentpath->mnt); -+ const struct path *user_path = &user_file->f_path; - struct file *f; - int error; - -- f = alloc_empty_backing_file(flags, cred); -+ f = alloc_empty_backing_file(flags, cred, user_file); - if (IS_ERR(f)) - return f; - -@@ -339,6 +342,11 @@ int backing_file_mmap(struct file *file, struct vm_area_struct *vma, - vma_set_file(vma, file); - - old_cred = override_creds(ctx->cred); -+ ret = security_mmap_backing_file(vma, file, ctx->user_file); -+ if (ret) { -+ revert_creds(old_cred); -+ return ret; -+ } - ret = call_mmap(vma->vm_file, vma); - revert_creds(old_cred); - -diff --git a/fs/file_table.c b/fs/file_table.c -index 4b4d50a1d9da..0a7f25596d57 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -51,6 +51,9 @@ struct backing_file { - struct path user_path; - freeptr_t bf_freeptr; - }; -+#ifdef CONFIG_SECURITY -+ void *security; -+#endif - }; - - #define backing_file(f) container_of(f, struct backing_file, file) -@@ -67,8 +70,21 @@ void backing_file_set_user_path(struct file *f, const struct path *path) - } - EXPORT_SYMBOL_GPL(backing_file_set_user_path); - -+#ifdef CONFIG_SECURITY -+void *backing_file_security(const struct file *f) -+{ -+ return backing_file(f)->security; -+} -+ -+void backing_file_set_security(struct file *f, void *security) -+{ -+ backing_file(f)->security = security; -+} -+#endif /* CONFIG_SECURITY */ -+ - static inline void backing_file_free(struct backing_file *ff) - { -+ security_backing_file_free(&ff->file); - path_put(&ff->user_path); - kmem_cache_free(bfilp_cachep, ff); - } -@@ -283,10 +299,12 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) - return f; - } - --static int init_backing_file(struct backing_file *ff) -+static int init_backing_file(struct backing_file *ff, -+ const struct file *user_file) - { - memset(&ff->user_path, 0, sizeof(ff->user_path)); -- return 0; -+ backing_file_set_security(&ff->file, NULL); -+ return security_backing_file_alloc(&ff->file, user_file); - } - - /* -@@ -296,7 +314,8 @@ static int init_backing_file(struct backing_file *ff) - * This is only for kernel internal use, and the allocate file must not be - * installed into file tables or such. - */ --struct file *alloc_empty_backing_file(int flags, const struct cred *cred) -+struct file *alloc_empty_backing_file(int flags, const struct cred *cred, -+ const struct file *user_file) - { - struct backing_file *ff; - int error; -@@ -313,7 +332,7 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred) - - /* The f_mode flags must be set before fput(). */ - ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT; -- error = init_backing_file(ff); -+ error = init_backing_file(ff, user_file); - if (unlikely(error)) { - fput(&ff->file); - return ERR_PTR(error); -diff --git a/fs/fuse/passthrough.c b/fs/fuse/passthrough.c -index bbac547dfcb3..91a43c4939ec 100644 ---- a/fs/fuse/passthrough.c -+++ b/fs/fuse/passthrough.c -@@ -321,7 +321,7 @@ struct fuse_backing *fuse_passthrough_open(struct file *file, - goto out; - - /* Allocate backing file per fuse file to store fuse path */ -- backing_file = backing_file_open(&file->f_path, file->f_flags, -+ backing_file = backing_file_open(file, file->f_flags, - &fb->file->f_path, fb->cred); - err = PTR_ERR(backing_file); - if (IS_ERR(backing_file)) { -diff --git a/fs/internal.h b/fs/internal.h -index 67e2e164c647..049c800a3b16 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -99,7 +99,8 @@ extern void chroot_fs_refs(const struct path *, const struct path *); - */ - struct file *alloc_empty_file(int flags, const struct cred *cred); - struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); --struct file *alloc_empty_backing_file(int flags, const struct cred *cred); -+struct file *alloc_empty_backing_file(int flags, const struct cred *cred, -+ const struct file *user_file); - void backing_file_set_user_path(struct file *f, const struct path *path); - - static inline void file_put_write_access(struct file *file) -diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c -index ab65e98a1def..1c8009bf194b 100644 ---- a/fs/overlayfs/dir.c -+++ b/fs/overlayfs/dir.c -@@ -1320,7 +1320,7 @@ static int ovl_create_tmpfile(struct file *file, struct dentry *dentry, - goto out_revert_creds; - - ovl_path_upper(dentry->d_parent, &realparentpath); -- realfile = backing_tmpfile_open(&file->f_path, flags, &realparentpath, -+ realfile = backing_tmpfile_open(file, flags, &realparentpath, - mode, current_cred()); - err = PTR_ERR_OR_ZERO(realfile); - pr_debug("tmpfile/open(%pd2, 0%o) = %i\n", realparentpath.dentry, mode, err); -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 4444c78e2e0c..84aad9d19bdd 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -48,7 +48,7 @@ static struct file *ovl_open_realfile(const struct file *file, - if (!inode_owner_or_capable(real_idmap, realinode)) - flags &= ~O_NOATIME; - -- realfile = backing_file_open(&file->f_path, flags, realpath, -+ realfile = backing_file_open(file, flags, realpath, - current_cred()); - } - revert_creds(old_cred); -diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h -index 2eed0ffb5e8f..cd18acd7ac5b 100644 ---- a/include/linux/backing-file.h -+++ b/include/linux/backing-file.h -@@ -19,10 +19,10 @@ struct backing_file_ctx { - void (*end_write)(struct file *, loff_t, ssize_t); - }; - --struct file *backing_file_open(const struct path *user_path, int flags, -+struct file *backing_file_open(const struct file *user_file, int flags, - const struct path *real_path, - const struct cred *cred); --struct file *backing_tmpfile_open(const struct path *user_path, int flags, -+struct file *backing_tmpfile_open(const struct file *user_file, int flags, - const struct path *real_parentpath, - umode_t mode, const struct cred *cred); - ssize_t backing_file_read_iter(struct file *file, struct iov_iter *iter, -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 04309befc557..975afa36e9aa 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2795,6 +2795,19 @@ struct file *dentry_create(const struct path *path, int flags, umode_t mode, - const struct cred *cred); - struct path *backing_file_user_path(const struct file *f); - -+#ifdef CONFIG_SECURITY -+void *backing_file_security(const struct file *f); -+void backing_file_set_security(struct file *f, void *security); -+#else -+static inline void *backing_file_security(const struct file *f) -+{ -+ return NULL; -+} -+static inline void backing_file_set_security(struct file *f, void *security) -+{ -+} -+#endif /* CONFIG_SECURITY */ -+ - /* - * When mmapping a file on a stackable filesystem (e.g., overlayfs), the file - * stored in ->vm_file is a backing file whose f_inode is on the underlying -diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h -index 97a8b21eb033..c0a2839253fa 100644 ---- a/include/linux/lsm_audit.h -+++ b/include/linux/lsm_audit.h -@@ -93,7 +93,7 @@ struct common_audit_data { - #endif - char *kmod_name; - struct lsm_ioctlop_audit *op; -- struct file *file; -+ const struct file *file; - struct lsm_ibpkey_audit *ibpkey; - struct lsm_ibendport_audit *ibendport; - int reason; -diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h -index 27d599bde74a..e06665ae5102 100644 ---- a/include/linux/lsm_hook_defs.h -+++ b/include/linux/lsm_hook_defs.h -@@ -189,6 +189,9 @@ LSM_HOOK(int, 0, file_permission, struct file *file, int mask) - LSM_HOOK(int, 0, file_alloc_security, struct file *file) - LSM_HOOK(void, LSM_RET_VOID, file_release, struct file *file) - LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file) -+LSM_HOOK(int, 0, backing_file_alloc, struct file *backing_file, -+ const struct file *user_file) -+LSM_HOOK(void, LSM_RET_VOID, backing_file_free, struct file *backing_file) - LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, - unsigned long arg) - LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, -@@ -196,6 +199,8 @@ LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, - LSM_HOOK(int, 0, mmap_addr, unsigned long addr) - LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, - unsigned long prot, unsigned long flags) -+LSM_HOOK(int, 0, mmap_backing_file, struct vm_area_struct *vma, -+ struct file *backing_file, struct file *user_file) - LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, - unsigned long reqprot, unsigned long prot) - LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index a7ecb0791a0f..f1c6db9c0cff 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -104,6 +104,7 @@ struct security_hook_list { - struct lsm_blob_sizes { - unsigned int lbs_cred; - unsigned int lbs_file; -+ unsigned int lbs_backing_file; - unsigned int lbs_ib; - unsigned int lbs_inode; - unsigned int lbs_sock; -diff --git a/include/linux/security.h b/include/linux/security.h -index 2db88ddbe9a9..0a2ef373267b 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -487,11 +487,17 @@ int security_file_permission(struct file *file, int mask); - int security_file_alloc(struct file *file); - void security_file_release(struct file *file); - void security_file_free(struct file *file); -+int security_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file); -+void security_backing_file_free(struct file *backing_file); - int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg); - int security_file_ioctl_compat(struct file *file, unsigned int cmd, - unsigned long arg); - int security_mmap_file(struct file *file, unsigned long prot, - unsigned long flags); -+int security_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file); - int security_mmap_addr(unsigned long addr); - int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, - unsigned long prot); -@@ -1147,6 +1153,15 @@ static inline void security_file_release(struct file *file) - static inline void security_file_free(struct file *file) - { } - -+static inline int security_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file) -+{ -+ return 0; -+} -+ -+static inline void security_backing_file_free(struct file *backing_file) -+{ } -+ - static inline int security_file_ioctl(struct file *file, unsigned int cmd, - unsigned long arg) - { -@@ -1166,6 +1181,13 @@ static inline int security_mmap_file(struct file *file, unsigned long prot, - return 0; - } - -+static inline int security_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file) -+{ -+ return 0; -+} -+ - static inline int security_mmap_addr(unsigned long addr) - { - return cap_mmap_addr(addr); -diff --git a/security/lsm.h b/security/lsm.h -index 8dc267977ae0..c3a1a9cd121e 100644 ---- a/security/lsm.h -+++ b/security/lsm.h -@@ -29,6 +29,7 @@ extern struct lsm_blob_sizes blob_sizes; - - /* LSM blob caches */ - extern struct kmem_cache *lsm_file_cache; -+extern struct kmem_cache *lsm_backing_file_cache; - extern struct kmem_cache *lsm_inode_cache; - - /* LSM blob allocators */ -diff --git a/security/lsm_init.c b/security/lsm_init.c -index bef21da72c16..31bc9e2d0f5d 100644 ---- a/security/lsm_init.c -+++ b/security/lsm_init.c -@@ -202,6 +202,8 @@ static void __init lsm_prepare(struct lsm_info *lsm) - blobs = lsm->blobs; - lsm_blob_size_update(&blobs->lbs_cred, &blob_sizes.lbs_cred); - lsm_blob_size_update(&blobs->lbs_file, &blob_sizes.lbs_file); -+ lsm_blob_size_update(&blobs->lbs_backing_file, -+ &blob_sizes.lbs_backing_file); - lsm_blob_size_update(&blobs->lbs_ib, &blob_sizes.lbs_ib); - /* inode blob gets an rcu_head in addition to LSM blobs. */ - if (blobs->lbs_inode && blob_sizes.lbs_inode == 0) -@@ -405,6 +407,8 @@ int __init security_init(void) - if (lsm_debug) { - lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred); - lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file); -+ lsm_pr("blob(backing_file) size %d\n", -+ blob_sizes.lbs_backing_file); - lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib); - lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode); - lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc); -@@ -423,6 +427,11 @@ int __init security_init(void) - lsm_file_cache = kmem_cache_create("lsm_file_cache", - blob_sizes.lbs_file, 0, - SLAB_PANIC, NULL); -+ if (blob_sizes.lbs_backing_file) -+ lsm_backing_file_cache = kmem_cache_create( -+ "lsm_backing_file_cache", -+ blob_sizes.lbs_backing_file, -+ 0, SLAB_PANIC, NULL); - if (blob_sizes.lbs_inode) - lsm_inode_cache = kmem_cache_create("lsm_inode_cache", - blob_sizes.lbs_inode, 0, -diff --git a/security/security.c b/security/security.c -index 56c48725e334..d9a645d0038e 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -82,6 +82,7 @@ const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; - struct lsm_blob_sizes blob_sizes; - - struct kmem_cache *lsm_file_cache; -+struct kmem_cache *lsm_backing_file_cache; - struct kmem_cache *lsm_inode_cache; - - #define SECURITY_HOOK_ACTIVE_KEY(HOOK, IDX) security_hook_active_##HOOK##_##IDX -@@ -173,6 +174,30 @@ static int lsm_file_alloc(struct file *file) - return 0; - } - -+/** -+ * lsm_backing_file_alloc - allocate a composite backing file blob -+ * @backing_file: the backing file -+ * -+ * Allocate the backing file blob for all the modules. -+ * -+ * Returns 0, or -ENOMEM if memory can't be allocated. -+ */ -+static int lsm_backing_file_alloc(struct file *backing_file) -+{ -+ void *blob; -+ -+ if (!lsm_backing_file_cache) { -+ backing_file_set_security(backing_file, NULL); -+ return 0; -+ } -+ -+ blob = kmem_cache_zalloc(lsm_backing_file_cache, GFP_KERNEL); -+ backing_file_set_security(backing_file, blob); -+ if (!blob) -+ return -ENOMEM; -+ return 0; -+} -+ - /** - * lsm_blob_alloc - allocate a composite blob - * @dest: the destination for the blob -@@ -2350,6 +2375,57 @@ void security_file_free(struct file *file) - } - } - -+/** -+ * security_backing_file_alloc() - Allocate and setup a backing file blob -+ * @backing_file: the backing file -+ * @user_file: the associated user visible file -+ * -+ * Allocate a backing file LSM blob and perform any necessary initialization of -+ * the LSM blob. There will be some operations where the LSM will not have -+ * access to @user_file after this point, so any important state associated -+ * with @user_file that is important to the LSM should be captured in the -+ * backing file's LSM blob. -+ * -+ * LSM's should avoid taking a reference to @user_file in this hook as it will -+ * result in problems later when the system attempts to drop/put the file -+ * references due to a circular dependency. -+ * -+ * Return: Return 0 if the hook is successful, negative values otherwise. -+ */ -+int security_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file) -+{ -+ int rc; -+ -+ rc = lsm_backing_file_alloc(backing_file); -+ if (rc) -+ return rc; -+ rc = call_int_hook(backing_file_alloc, backing_file, user_file); -+ if (unlikely(rc)) -+ security_backing_file_free(backing_file); -+ -+ return rc; -+} -+ -+/** -+ * security_backing_file_free() - Free a backing file blob -+ * @backing_file: the backing file -+ * -+ * Free any LSM state associate with a backing file's LSM blob, including the -+ * blob itself. -+ */ -+void security_backing_file_free(struct file *backing_file) -+{ -+ void *blob = backing_file_security(backing_file); -+ -+ call_void_hook(backing_file_free, backing_file); -+ -+ if (blob) { -+ backing_file_set_security(backing_file, NULL); -+ kmem_cache_free(lsm_backing_file_cache, blob); -+ } -+} -+ - /** - * security_file_ioctl() - Check if an ioctl is allowed - * @file: associated file -@@ -2438,6 +2514,32 @@ int security_mmap_file(struct file *file, unsigned long prot, - flags); - } - -+/** -+ * security_mmap_backing_file - Check if mmap'ing a backing file is allowed -+ * @vma: the vm_area_struct for the mmap'd region -+ * @backing_file: the backing file being mmap'd -+ * @user_file: the user file being mmap'd -+ * -+ * Check permissions for a mmap operation on a stacked filesystem. This hook -+ * is called after the security_mmap_file() and is responsible for authorizing -+ * the mmap on @backing_file. It is important to note that the mmap operation -+ * on @user_file has already been authorized and the @vma->vm_file has been -+ * set to @backing_file. -+ * -+ * Return: Returns 0 if permission is granted. -+ */ -+int security_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file) -+{ -+ /* recommended by the stackable filesystem devs */ -+ if (WARN_ON_ONCE(!(backing_file->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ return call_int_hook(mmap_backing_file, vma, backing_file, user_file); -+} -+EXPORT_SYMBOL_GPL(security_mmap_backing_file); -+ - /** - * security_mmap_addr() - Check if mmap'ing an address is allowed - * @addr: address --- -2.50.1 (Apple Git-155) - diff --git a/1323-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch b/1323-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch deleted file mode 100644 index 27084237d..000000000 --- a/1323-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch +++ /dev/null @@ -1,429 +0,0 @@ -From d3989d6fe668083ccd03e1cc73a46b9ed88edd54 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 2 Jun 2026 10:26:36 +0200 -Subject: [PATCH] selinux: fix overlayfs mmap() and mprotect() access checks - -JIRA: https://issues.redhat.com/browse/RHEL-179440 -CVE: CVE-2026-46054 -Conflicts: - - security/selinux/hooks.c: trivial context fuzz - -commit 82544d36b1729153c8aeb179e84750f0c085d3b1 -Author: Paul Moore -Date: Thu Jan 1 17:19:18 2026 -0500 - - selinux: fix overlayfs mmap() and mprotect() access checks - - The existing SELinux security model for overlayfs is to allow access if - the current task is able to access the top level file (the "user" file) - and the mounter's credentials are sufficient to access the lower - level file (the "backing" file). Unfortunately, the current code does - not properly enforce these access controls for both mmap() and mprotect() - operations on overlayfs filesystems. - - This patch makes use of the newly created security_mmap_backing_file() - LSM hook to provide the missing backing file enforcement for mmap() - operations, and leverages the backing file API and new LSM blob to - provide the necessary information to properly enforce the mprotect() - access controls. - - Cc: stable@vger.kernel.org - Acked-by: Amir Goldstein - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index a2323c6daafe..853cf9cee2ec 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -1724,49 +1724,72 @@ static inline int file_path_has_perm(const struct cred *cred, - static int bpf_fd_pass(const struct file *file, u32 sid); - #endif - --/* Check whether a task can use an open file descriptor to -- access an inode in a given way. Check access to the -- descriptor itself, and then use dentry_has_perm to -- check a particular permission to the file. -- Access to the descriptor is implicitly granted if it -- has the same SID as the process. If av is zero, then -- access to the file is not checked, e.g. for cases -- where only the descriptor is affected like seek. */ --static int file_has_perm(const struct cred *cred, -- struct file *file, -- u32 av) -+static int __file_has_perm(const struct cred *cred, const struct file *file, -+ u32 av, bool bf_user_file) -+ - { -- struct file_security_struct *fsec = selinux_file(file); -- struct inode *inode = file_inode(file); - struct common_audit_data ad; -- u32 sid = cred_sid(cred); -+ struct inode *inode; -+ u32 ssid = cred_sid(cred); -+ u32 tsid_fd; - int rc; - -- ad.type = LSM_AUDIT_DATA_FILE; -- ad.u.file = file; -+ if (bf_user_file) { -+ struct backing_file_security_struct *bfsec; -+ const struct path *path; - -- if (sid != fsec->sid) { -- rc = avc_has_perm(sid, fsec->sid, -- SECCLASS_FD, -- FD__USE, -- &ad); -+ if (WARN_ON(!(file->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ bfsec = selinux_backing_file(file); -+ path = backing_file_user_path(file); -+ tsid_fd = bfsec->uf_sid; -+ inode = d_inode(path->dentry); -+ -+ ad.type = LSM_AUDIT_DATA_PATH; -+ ad.u.path = *path; -+ } else { -+ struct file_security_struct *fsec = selinux_file(file); -+ -+ tsid_fd = fsec->sid; -+ inode = file_inode(file); -+ -+ ad.type = LSM_AUDIT_DATA_FILE; -+ ad.u.file = file; -+ } -+ -+ if (ssid != tsid_fd) { -+ rc = avc_has_perm(ssid, tsid_fd, SECCLASS_FD, FD__USE, &ad); - if (rc) -- goto out; -+ return rc; - } - - #ifdef CONFIG_BPF_SYSCALL -- rc = bpf_fd_pass(file, cred_sid(cred)); -+ /* regardless of backing vs user file, use the underlying file here */ -+ rc = bpf_fd_pass(file, ssid); - if (rc) - return rc; - #endif - - /* av is zero if only checking access to the descriptor. */ -- rc = 0; - if (av) -- rc = inode_has_perm(cred, inode, av, &ad); -+ return inode_has_perm(cred, inode, av, &ad); - --out: -- return rc; -+ return 0; -+} -+ -+/* Check whether a task can use an open file descriptor to -+ access an inode in a given way. Check access to the -+ descriptor itself, and then use dentry_has_perm to -+ check a particular permission to the file. -+ Access to the descriptor is implicitly granted if it -+ has the same SID as the process. If av is zero, then -+ access to the file is not checked, e.g. for cases -+ where only the descriptor is affected like seek. */ -+static inline int file_has_perm(const struct cred *cred, -+ const struct file *file, u32 av) -+{ -+ return __file_has_perm(cred, file, av, false); - } - - /* -@@ -3656,6 +3679,17 @@ static int selinux_file_alloc_security(struct file *file) - return 0; - } - -+static int selinux_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file) -+{ -+ struct backing_file_security_struct *bfsec; -+ -+ bfsec = selinux_backing_file(backing_file); -+ bfsec->uf_sid = selinux_file(user_file)->sid; -+ -+ return 0; -+} -+ - /* - * Check whether a task has the ioctl permission and cmd - * operation to an inode. -@@ -3773,42 +3807,55 @@ static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd, - - static int default_noexec __ro_after_init; - --static int file_map_prot_check(struct file *file, unsigned long prot, int shared) -+static int __file_map_prot_check(const struct cred *cred, -+ const struct file *file, unsigned long prot, -+ bool shared, bool bf_user_file) - { -- const struct cred *cred = current_cred(); -- u32 sid = cred_sid(cred); -- int rc = 0; -+ struct inode *inode = NULL; -+ bool prot_exec = prot & PROT_EXEC; -+ bool prot_write = prot & PROT_WRITE; -+ -+ if (file) { -+ if (bf_user_file) -+ inode = d_inode(backing_file_user_path(file)->dentry); -+ else -+ inode = file_inode(file); -+ } -+ -+ if (default_noexec && prot_exec && -+ (!file || IS_PRIVATE(inode) || (!shared && prot_write))) { -+ int rc; -+ u32 sid = cred_sid(cred); - -- if (default_noexec && -- (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || -- (!shared && (prot & PROT_WRITE)))) { - /* -- * We are making executable an anonymous mapping or a -- * private file mapping that will also be writable. -- * This has an additional check. -+ * We are making executable an anonymous mapping or a private -+ * file mapping that will also be writable. - */ -- rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, -- PROCESS__EXECMEM, NULL); -+ rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__EXECMEM, -+ NULL); - if (rc) -- goto error; -+ return rc; - } - - if (file) { -- /* read access is always possible with a mapping */ -+ /* "read" always possible, "write" only if shared */ - u32 av = FILE__READ; -- -- /* write access only matters if the mapping is shared */ -- if (shared && (prot & PROT_WRITE)) -+ if (shared && prot_write) - av |= FILE__WRITE; -- -- if (prot & PROT_EXEC) -+ if (prot_exec) - av |= FILE__EXECUTE; - -- return file_has_perm(cred, file, av); -+ return __file_has_perm(cred, file, av, bf_user_file); - } - --error: -- return rc; -+ return 0; -+} -+ -+static inline int file_map_prot_check(const struct cred *cred, -+ const struct file *file, -+ unsigned long prot, bool shared) -+{ -+ return __file_map_prot_check(cred, file, prot, shared, false); - } - - static int selinux_mmap_addr(unsigned long addr) -@@ -3824,36 +3871,80 @@ static int selinux_mmap_addr(unsigned long addr) - return rc; - } - --static int selinux_mmap_file(struct file *file, -- unsigned long reqprot __always_unused, -- unsigned long prot, unsigned long flags) -+static int selinux_mmap_file_common(const struct cred *cred, struct file *file, -+ unsigned long prot, bool shared) - { -- struct common_audit_data ad; -- int rc; -- - if (file) { -+ int rc; -+ struct common_audit_data ad; -+ - ad.type = LSM_AUDIT_DATA_FILE; - ad.u.file = file; -- rc = inode_has_perm(current_cred(), file_inode(file), -- FILE__MAP, &ad); -+ rc = inode_has_perm(cred, file_inode(file), FILE__MAP, &ad); - if (rc) - return rc; - } - -- return file_map_prot_check(file, prot, -- (flags & MAP_TYPE) == MAP_SHARED); -+ return file_map_prot_check(cred, file, prot, shared); -+} -+ -+static int selinux_mmap_file(struct file *file, -+ unsigned long reqprot __always_unused, -+ unsigned long prot, unsigned long flags) -+{ -+ return selinux_mmap_file_common(current_cred(), file, prot, -+ (flags & MAP_TYPE) == MAP_SHARED); -+} -+ -+/** -+ * selinux_mmap_backing_file - Check mmap permissions on a backing file -+ * @vma: memory region -+ * @backing_file: stacked filesystem backing file -+ * @user_file: user visible file -+ * -+ * This is called after selinux_mmap_file() on stacked filesystems, and it -+ * is this function's responsibility to verify access to @backing_file and -+ * setup the SELinux state for possible later use in the mprotect() code path. -+ * -+ * By the time this function is called, mmap() access to @user_file has already -+ * been authorized and @vma->vm_file has been set to point to @backing_file. -+ * -+ * Return zero on success, negative values otherwise. -+ */ -+static int selinux_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file __always_unused) -+{ -+ unsigned long prot = 0; -+ -+ /* translate vma->vm_flags perms into PROT perms */ -+ if (vma->vm_flags & VM_READ) -+ prot |= PROT_READ; -+ if (vma->vm_flags & VM_WRITE) -+ prot |= PROT_WRITE; -+ if (vma->vm_flags & VM_EXEC) -+ prot |= PROT_EXEC; -+ -+ return selinux_mmap_file_common(backing_file->f_cred, backing_file, -+ prot, vma->vm_flags & VM_SHARED); - } - - static int selinux_file_mprotect(struct vm_area_struct *vma, - unsigned long reqprot __always_unused, - unsigned long prot) - { -+ int rc; - const struct cred *cred = current_cred(); - u32 sid = cred_sid(cred); -+ const struct file *file = vma->vm_file; -+ bool backing_file; -+ bool shared = vma->vm_flags & VM_SHARED; -+ -+ /* check if we need to trigger the "backing files are awful" mode */ -+ backing_file = file && (file->f_mode & FMODE_BACKING); - - if (default_noexec && - (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) { -- int rc = 0; - /* - * We don't use the vma_is_initial_heap() helper as it has - * a history of problems and is currently broken on systems -@@ -3867,11 +3958,15 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, - vma->vm_end <= vma->vm_mm->brk) { - rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, - PROCESS__EXECHEAP, NULL); -- } else if (!vma->vm_file && (vma_is_initial_stack(vma) || -+ if (rc) -+ return rc; -+ } else if (!file && (vma_is_initial_stack(vma) || - vma_is_stack_for_current(vma))) { - rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, - PROCESS__EXECSTACK, NULL); -- } else if (vma->vm_file && vma->anon_vma) { -+ if (rc) -+ return rc; -+ } else if (file && vma->anon_vma) { - /* - * We are making executable a file mapping that has - * had some COW done. Since pages might have been -@@ -3879,13 +3974,29 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, - * modified content. This typically should only - * occur for text relocations. - */ -- rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD); -+ rc = __file_has_perm(cred, file, FILE__EXECMOD, -+ backing_file); -+ if (rc) -+ return rc; -+ if (backing_file) { -+ rc = file_has_perm(file->f_cred, file, -+ FILE__EXECMOD); -+ if (rc) -+ return rc; -+ } - } -+ } -+ -+ rc = __file_map_prot_check(cred, file, prot, shared, backing_file); -+ if (rc) -+ return rc; -+ if (backing_file) { -+ rc = file_map_prot_check(file->f_cred, file, prot, shared); - if (rc) - return rc; - } - -- return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED); -+ return 0; - } - - static int selinux_file_lock(struct file *file, unsigned int cmd) -@@ -6996,6 +7107,7 @@ static void selinux_bpf_token_free(struct bpf_token *token) - struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = { - .lbs_cred = sizeof(struct task_security_struct), - .lbs_file = sizeof(struct file_security_struct), -+ .lbs_backing_file = sizeof(struct backing_file_security_struct), - .lbs_inode = sizeof(struct inode_security_struct), - .lbs_ipc = sizeof(struct ipc_security_struct), - .lbs_key = sizeof(struct key_security_struct), -@@ -7201,9 +7313,11 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { - - LSM_HOOK_INIT(file_permission, selinux_file_permission), - LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), -+ LSM_HOOK_INIT(backing_file_alloc, selinux_backing_file_alloc), - LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), - LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat), - LSM_HOOK_INIT(mmap_file, selinux_mmap_file), -+ LSM_HOOK_INIT(mmap_backing_file, selinux_mmap_backing_file), - LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr), - LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect), - LSM_HOOK_INIT(file_lock, selinux_file_lock), -diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h -index c88cae81ee4c..dc42282a2c05 100644 ---- a/security/selinux/include/objsec.h -+++ b/security/selinux/include/objsec.h -@@ -61,6 +61,10 @@ struct file_security_struct { - u32 pseqno; /* Policy seqno at the time of file open */ - }; - -+struct backing_file_security_struct { -+ u32 uf_sid; /* associated user file fsec->sid */ -+}; -+ - struct superblock_security_struct { - u32 sid; /* SID of file system superblock */ - u32 def_sid; /* default SID for labeling */ -@@ -159,6 +163,13 @@ static inline struct file_security_struct *selinux_file(const struct file *file) - return file->f_security + selinux_blob_sizes.lbs_file; - } - -+static inline struct backing_file_security_struct * -+selinux_backing_file(const struct file *backing_file) -+{ -+ void *blob = backing_file_security(backing_file); -+ return blob + selinux_blob_sizes.lbs_backing_file; -+} -+ - static inline struct inode_security_struct * - selinux_inode(const struct inode *inode) - { --- -2.50.1 (Apple Git-155) - diff --git a/1324-scripts-sorttable-fix-orc-sort-cmp-to-maintain-symmetry-and-.patch b/1324-scripts-sorttable-fix-orc-sort-cmp-to-maintain-symmetry-and-.patch deleted file mode 100644 index 4b323b74e..000000000 --- a/1324-scripts-sorttable-fix-orc-sort-cmp-to-maintain-symmetry-and-.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 7a4465d25de718e57ced42030bc7194017ee4f64 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:33:16 +0200 -Subject: [PATCH] scripts/sorttable: fix orc_sort_cmp() to maintain symmetry - and transitivity - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 0210d251162f4033350a94a43f95b1c39ec84a90 -Author: Kuan-Wei Chiu -Date: Thu Dec 26 22:03:32 2024 +0800 - - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity - - The orc_sort_cmp() function, used with qsort(), previously violated the - symmetry and transitivity rules required by the C standard. Specifically, - when both entries are ORC_TYPE_UNDEFINED, it could result in both a < b - and b < a, which breaks the required symmetry and transitivity. This can - lead to undefined behavior and incorrect sorting results, potentially - causing memory corruption in glibc implementations [1]. - - Symmetry: If x < y, then y > x. - Transitivity: If x < y and y < z, then x < z. - - Fix the comparison logic to return 0 when both entries are - ORC_TYPE_UNDEFINED, ensuring compliance with qsort() requirements. - - Link: https://www.qualys.com/2024/01/30/qsort.txt [1] - Link: https://lkml.kernel.org/r/20241226140332.2670689-1-visitorckw@gmail.com - Fixes: 57fa18994285 ("scripts/sorttable: Implement build-time ORC unwind table sorting") - Fixes: fb799447ae29 ("x86,objtool: Split UNWIND_HINT_EMPTY in two") - Signed-off-by: Kuan-Wei Chiu - Cc: Ching-Chun (Jim) Huang - Cc: - Cc: Ingo Molnar - Cc: Josh Poimboeuf - Cc: Peter Zijlstra - Cc: Shile Zhang - Cc: Steven Rostedt - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 7bd0184380d3..a7c5445baf00 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -110,7 +110,7 @@ static inline unsigned long orc_ip(const int *ip) - - static int orc_sort_cmp(const void *_a, const void *_b) - { -- struct orc_entry *orc_a; -+ struct orc_entry *orc_a, *orc_b; - const int *a = g_orc_ip_table + *(int *)_a; - const int *b = g_orc_ip_table + *(int *)_b; - unsigned long a_val = orc_ip(a); -@@ -128,6 +128,9 @@ static int orc_sort_cmp(const void *_a, const void *_b) - * whitelisted .o files which didn't get objtool generation. - */ - orc_a = g_orc_table + (a - g_orc_ip_table); -+ orc_b = g_orc_table + (b - g_orc_ip_table); -+ if (orc_a->type == ORC_TYPE_UNDEFINED && orc_b->type == ORC_TYPE_UNDEFINED) -+ return 0; - return orc_a->type == ORC_TYPE_UNDEFINED ? -1 : 1; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1325-scripts-sorttable-remove-unused-macro-defines.patch b/1325-scripts-sorttable-remove-unused-macro-defines.patch deleted file mode 100644 index eb19dc108..000000000 --- a/1325-scripts-sorttable-remove-unused-macro-defines.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 90e4b4c6300522c4494664bc95285cb94e137b17 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:21:58 +0200 -Subject: [PATCH] scripts/sorttable: Remove unused macro defines - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 28b24394c6e9a3166fcb4480cba054562526657c -Author: Steven Rostedt -Date: Sun Jan 5 11:22:12 2025 -0500 - - scripts/sorttable: Remove unused macro defines - - The code of sorttable.h was copied from the recordmcount.h which defined - a bunch of Elf MACROs so that they could be used between 32bit and 64bit - functions. But there's several MACROs that sorttable.h does not use but - was copied over. Remove them to clean up the code. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162344.128870118@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index a7c5445baf00..14d0c4d843e8 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -27,19 +27,10 @@ - #undef Elf_Ehdr - #undef Elf_Shdr - #undef Elf_Rel --#undef Elf_Rela - #undef Elf_Sym --#undef ELF_R_SYM --#undef Elf_r_sym --#undef ELF_R_INFO --#undef Elf_r_info --#undef ELF_ST_BIND - #undef ELF_ST_TYPE --#undef fn_ELF_R_SYM --#undef fn_ELF_R_INFO - #undef uint_t - #undef _r --#undef _w - - #ifdef SORTTABLE_64 - # define extable_ent_size 16 -@@ -52,19 +43,10 @@ - # define Elf_Ehdr Elf64_Ehdr - # define Elf_Shdr Elf64_Shdr - # define Elf_Rel Elf64_Rel --# define Elf_Rela Elf64_Rela - # define Elf_Sym Elf64_Sym --# define ELF_R_SYM ELF64_R_SYM --# define Elf_r_sym Elf64_r_sym --# define ELF_R_INFO ELF64_R_INFO --# define Elf_r_info Elf64_r_info --# define ELF_ST_BIND ELF64_ST_BIND - # define ELF_ST_TYPE ELF64_ST_TYPE --# define fn_ELF_R_SYM fn_ELF64_R_SYM --# define fn_ELF_R_INFO fn_ELF64_R_INFO - # define uint_t uint64_t - # define _r r8 --# define _w w8 - #else - # define extable_ent_size 8 - # define compare_extable compare_extable_32 -@@ -76,19 +58,10 @@ - # define Elf_Ehdr Elf32_Ehdr - # define Elf_Shdr Elf32_Shdr - # define Elf_Rel Elf32_Rel --# define Elf_Rela Elf32_Rela - # define Elf_Sym Elf32_Sym --# define ELF_R_SYM ELF32_R_SYM --# define Elf_r_sym Elf32_r_sym --# define ELF_R_INFO ELF32_R_INFO --# define Elf_r_info Elf32_r_info --# define ELF_ST_BIND ELF32_ST_BIND - # define ELF_ST_TYPE ELF32_ST_TYPE --# define fn_ELF_R_SYM fn_ELF32_R_SYM --# define fn_ELF_R_INFO fn_ELF32_R_INFO - # define uint_t uint32_t - # define _r r --# define _w w - #endif - - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) --- -2.50.1 (Apple Git-155) - diff --git a/1326-scripts-sorttable-remove-unused-write-functions.patch b/1326-scripts-sorttable-remove-unused-write-functions.patch deleted file mode 100644 index 90cee9f42..000000000 --- a/1326-scripts-sorttable-remove-unused-write-functions.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 3e1ec2703946dbf8d8f658865fc5c601e3a2cdea Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:02 +0200 -Subject: [PATCH] scripts/sorttable: Remove unused write functions - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 4f48a28b37d594dab38092514a42ae9f4b781553 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:13 2025 -0500 - - scripts/sorttable: Remove unused write functions - - The code of sorttable.h was copied from the recordmcount.h which defined - various write functions for different sizes (2, 4, 8 byte lengths). But - sorttable only uses the 4 byte writes. Remove the extra versions as they - are not used. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162344.314385504@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 83cdb843d92f..4dcdbf7a5e26 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -68,8 +68,6 @@ static uint32_t (*r)(const uint32_t *); - static uint16_t (*r2)(const uint16_t *); - static uint64_t (*r8)(const uint64_t *); - static void (*w)(uint32_t, uint32_t *); --static void (*w2)(uint16_t, uint16_t *); --static void (*w8)(uint64_t, uint64_t *); - typedef void (*table_sort_t)(char *, int); - - /* -@@ -146,31 +144,11 @@ static void wbe(uint32_t val, uint32_t *x) - put_unaligned_be32(val, x); - } - --static void w2be(uint16_t val, uint16_t *x) --{ -- put_unaligned_be16(val, x); --} -- --static void w8be(uint64_t val, uint64_t *x) --{ -- put_unaligned_be64(val, x); --} -- - static void wle(uint32_t val, uint32_t *x) - { - put_unaligned_le32(val, x); - } - --static void w2le(uint16_t val, uint16_t *x) --{ -- put_unaligned_le16(val, x); --} -- --static void w8le(uint64_t val, uint64_t *x) --{ -- put_unaligned_le64(val, x); --} -- - /* - * Move reserved section indices SHN_LORESERVE..SHN_HIRESERVE out of - * the way to -256..-1, to avoid conflicting with real section -@@ -277,16 +255,12 @@ static int do_file(char const *const fname, void *addr) - r2 = r2le; - r8 = r8le; - w = wle; -- w2 = w2le; -- w8 = w8le; - break; - case ELFDATA2MSB: - r = rbe; - r2 = r2be; - r8 = r8be; - w = wbe; -- w2 = w2be; -- w8 = w8be; - break; - default: - fprintf(stderr, "unrecognized ELF data encoding %d: %s\n", --- -2.50.1 (Apple Git-155) - diff --git a/1327-scripts-sorttable-remove-unneeded-elf-rel.patch b/1327-scripts-sorttable-remove-unneeded-elf-rel.patch deleted file mode 100644 index 2c8e7c604..000000000 --- a/1327-scripts-sorttable-remove-unneeded-elf-rel.patch +++ /dev/null @@ -1,118 +0,0 @@ -From b0006591a4fb4d08bab55e02d904a225bb97f803 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:06 +0200 -Subject: [PATCH] scripts/sorttable: Remove unneeded Elf_Rel - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 6f2c2f93a190467cebd6ebd03feb49514fead5ca -Author: Steven Rostedt -Date: Sun Jan 5 11:22:14 2025 -0500 - - scripts/sorttable: Remove unneeded Elf_Rel - - The code had references to initialize the Elf_Rel relocation tables, but - it was never used. Remove it. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162344.515342233@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 14d0c4d843e8..18d07fdb2716 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -26,7 +26,6 @@ - #undef Elf_Addr - #undef Elf_Ehdr - #undef Elf_Shdr --#undef Elf_Rel - #undef Elf_Sym - #undef ELF_ST_TYPE - #undef uint_t -@@ -42,7 +41,6 @@ - # define Elf_Addr Elf64_Addr - # define Elf_Ehdr Elf64_Ehdr - # define Elf_Shdr Elf64_Shdr --# define Elf_Rel Elf64_Rel - # define Elf_Sym Elf64_Sym - # define ELF_ST_TYPE ELF64_ST_TYPE - # define uint_t uint64_t -@@ -57,7 +55,6 @@ - # define Elf_Addr Elf32_Addr - # define Elf_Ehdr Elf32_Ehdr - # define Elf_Shdr Elf32_Shdr --# define Elf_Rel Elf32_Rel - # define Elf_Sym Elf32_Sym - # define ELF_ST_TYPE ELF32_ST_TYPE - # define uint_t uint32_t -@@ -248,14 +245,10 @@ static int do_sort(Elf_Ehdr *ehdr, - Elf32_Word *symtab_shndx = NULL; - Elf_Sym *sort_needed_sym = NULL; - Elf_Shdr *sort_needed_sec; -- Elf_Rel *relocs = NULL; -- int relocs_size = 0; - uint32_t *sort_needed_loc; - const char *secstrings; - const char *strtab; - char *extab_image; -- int extab_index = 0; -- int i; - int idx; - unsigned int shnum; - unsigned int shstrndx; -@@ -279,23 +272,15 @@ static int do_sort(Elf_Ehdr *ehdr, - if (shnum == SHN_UNDEF) - shnum = _r(&shdr[0].sh_size); - -- for (i = 0, s = shdr; s < shdr + shnum; i++, s++) { -+ for (s = shdr; s < shdr + shnum; s++) { - idx = r(&s->sh_name); -- if (!strcmp(secstrings + idx, "__ex_table")) { -+ if (!strcmp(secstrings + idx, "__ex_table")) - extab_sec = s; -- extab_index = i; -- } - if (!strcmp(secstrings + idx, ".symtab")) - symtab_sec = s; - if (!strcmp(secstrings + idx, ".strtab")) - strtab_sec = s; - -- if ((r(&s->sh_type) == SHT_REL || -- r(&s->sh_type) == SHT_RELA) && -- r(&s->sh_info) == extab_index) { -- relocs = (void *)ehdr + _r(&s->sh_offset); -- relocs_size = _r(&s->sh_size); -- } - if (r(&s->sh_type) == SHT_SYMTAB_SHNDX) - symtab_shndx = (Elf32_Word *)((const char *)ehdr + - _r(&s->sh_offset)); -@@ -397,10 +382,6 @@ static int do_sort(Elf_Ehdr *ehdr, - extable_ent_size, compare_extable); - } - -- /* If there were relocations, we no longer need them. */ -- if (relocs) -- memset(relocs, 0, relocs_size); -- - /* find the flag main_extable_sort_needed */ - for (sym = (void *)ehdr + _r(&symtab_sec->sh_offset); - sym < sym + _r(&symtab_sec->sh_size) / sizeof(Elf_Sym); --- -2.50.1 (Apple Git-155) - diff --git a/1328-scripts-sorttable-have-the-orc-code-use-the-r-functions-to-r.patch b/1328-scripts-sorttable-have-the-orc-code-use-the-r-functions-to-r.patch deleted file mode 100644 index 9055c2e6f..000000000 --- a/1328-scripts-sorttable-have-the-orc-code-use-the-r-functions-to-r.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 8b98d95b2f3df8cdec1154dcce05f292bdde59d0 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:10 +0200 -Subject: [PATCH] scripts/sorttable: Have the ORC code use the _r() functions - to read - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 66990c003306c240d570b3ba274ec4f68cf18c91 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:15 2025 -0500 - - scripts/sorttable: Have the ORC code use the _r() functions to read - - The ORC code reads the section information directly from the file. This - currently works because the default read function is for 64bit little - endian machines. But if for some reason that ever changes, this will - break. Instead of having a surprise breakage, use the _r() functions that - will read the values from the file properly. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162344.721480386@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 18d07fdb2716..58f7ab5f5644 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -299,14 +299,14 @@ static int do_sort(Elf_Ehdr *ehdr, - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) - /* locate the ORC unwind tables */ - if (!strcmp(secstrings + idx, ".orc_unwind_ip")) { -- orc_ip_size = s->sh_size; -+ orc_ip_size = _r(&s->sh_size); - g_orc_ip_table = (int *)((void *)ehdr + -- s->sh_offset); -+ _r(&s->sh_offset)); - } - if (!strcmp(secstrings + idx, ".orc_unwind")) { -- orc_size = s->sh_size; -+ orc_size = _r(&s->sh_size); - g_orc_table = (struct orc_entry *)((void *)ehdr + -- s->sh_offset); -+ _r(&s->sh_offset)); - } - #endif - } /* for loop */ --- -2.50.1 (Apple Git-155) - diff --git a/1329-scripts-sorttable-make-compare-extable-into-two-functions.patch b/1329-scripts-sorttable-make-compare-extable-into-two-functions.patch deleted file mode 100644 index 05ae6405a..000000000 --- a/1329-scripts-sorttable-make-compare-extable-into-two-functions.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 3f3c4e53bd362a76e3a097c1dac3c8975cb99926 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:13 +0200 -Subject: [PATCH] scripts/sorttable: Make compare_extable() into two functions - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 7ffc0d0819f438779ed592e2e2e3576f43ce14f0 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:16 2025 -0500 - - scripts/sorttable: Make compare_extable() into two functions - - Instead of having the compare_extable() part of the sorttable.h header - where it get's defined twice, since it is a very simple function, just - define it twice in sorttable.c, and then it can use the proper read - functions for the word size and endianess and the Elf_Addr macro can be - removed from sorttable.h. - - Also add a micro optimization. Instead of: - - if (a < b) - return -1; - if (a > b) - return 1; - return 0; - - That can be shorten to: - - if (a < b) - return -1; - return a > b; - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162344.945299671@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 4dcdbf7a5e26..3e2c17e91485 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -173,6 +173,26 @@ static inline unsigned int get_secindex(unsigned int shndx, - return r(&symtab_shndx_start[sym_offs]); - } - -+static int compare_extable_32(const void *a, const void *b) -+{ -+ Elf32_Addr av = r(a); -+ Elf32_Addr bv = r(b); -+ -+ if (av < bv) -+ return -1; -+ return av > bv; -+} -+ -+static int compare_extable_64(const void *a, const void *b) -+{ -+ Elf64_Addr av = r8(a); -+ Elf64_Addr bv = r8(b); -+ -+ if (av < bv) -+ return -1; -+ return av > bv; -+} -+ - /* 32 bit and 64 bit are very similar */ - #include "sorttable.h" - #define SORTTABLE_64 -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 58f7ab5f5644..36655ff16b39 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -23,7 +23,6 @@ - #undef sort_mcount_loc - #undef elf_mcount_loc - #undef do_sort --#undef Elf_Addr - #undef Elf_Ehdr - #undef Elf_Shdr - #undef Elf_Sym -@@ -38,7 +37,6 @@ - # define sort_mcount_loc sort_mcount_loc_64 - # define elf_mcount_loc elf_mcount_loc_64 - # define do_sort do_sort_64 --# define Elf_Addr Elf64_Addr - # define Elf_Ehdr Elf64_Ehdr - # define Elf_Shdr Elf64_Shdr - # define Elf_Sym Elf64_Sym -@@ -52,7 +50,6 @@ - # define sort_mcount_loc sort_mcount_loc_32 - # define elf_mcount_loc elf_mcount_loc_32 - # define do_sort do_sort_32 --# define Elf_Addr Elf32_Addr - # define Elf_Ehdr Elf32_Ehdr - # define Elf_Shdr Elf32_Shdr - # define Elf_Sym Elf32_Sym -@@ -160,17 +157,6 @@ static void *sort_orctable(void *arg) - } - #endif - --static int compare_extable(const void *a, const void *b) --{ -- Elf_Addr av = _r(a); -- Elf_Addr bv = _r(b); -- -- if (av < bv) -- return -1; -- if (av > bv) -- return 1; -- return 0; --} - #ifdef MCOUNT_SORT_ENABLED - pthread_t mcount_sort_thread; - --- -2.50.1 (Apple Git-155) - diff --git a/1330-scripts-sorttable-convert-elf-ehdr-to-union.patch b/1330-scripts-sorttable-convert-elf-ehdr-to-union.patch deleted file mode 100644 index 847f24707..000000000 --- a/1330-scripts-sorttable-convert-elf-ehdr-to-union.patch +++ /dev/null @@ -1,212 +0,0 @@ -From a9cb56b10f496e1e39543627f47eecda2d65213f Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:16 +0200 -Subject: [PATCH] scripts/sorttable: Convert Elf_Ehdr to union - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 157fb5b3cfd2cb5950314f926a76e567fc1921c5 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:17 2025 -0500 - - scripts/sorttable: Convert Elf_Ehdr to union - - In order to remove the double #include of sorttable.h for 64 and 32 bit - to create duplicate functions for both, replace the Elf_Ehdr macro with a - union that defines both Elf64_Ehdr and Elf32_Ehdr, with field e64 for the - 64bit version, and e32 for the 32bit version. - - Then a macro etype can be used instead to get to the proper value. - - This will eventually be replaced with just single functions that can - handle both 32bit and 64bit ELF parsing. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162345.148224465@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 3e2c17e91485..67cbbfc8214d 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -64,6 +64,11 @@ - #define EM_LOONGARCH 258 - #endif - -+typedef union { -+ Elf32_Ehdr e32; -+ Elf64_Ehdr e64; -+} Elf_Ehdr; -+ - static uint32_t (*r)(const uint32_t *); - static uint16_t (*r2)(const uint16_t *); - static uint64_t (*r8)(const uint64_t *); -@@ -266,10 +271,10 @@ static void sort_relative_table_with_data(char *extab_image, int image_size) - static int do_file(char const *const fname, void *addr) - { - int rc = -1; -- Elf32_Ehdr *ehdr = addr; -+ Elf_Ehdr *ehdr = addr; - table_sort_t custom_sort = NULL; - -- switch (ehdr->e_ident[EI_DATA]) { -+ switch (ehdr->e32.e_ident[EI_DATA]) { - case ELFDATA2LSB: - r = rle; - r2 = r2le; -@@ -284,18 +289,18 @@ static int do_file(char const *const fname, void *addr) - break; - default: - fprintf(stderr, "unrecognized ELF data encoding %d: %s\n", -- ehdr->e_ident[EI_DATA], fname); -+ ehdr->e32.e_ident[EI_DATA], fname); - return -1; - } - -- if (memcmp(ELFMAG, ehdr->e_ident, SELFMAG) != 0 || -- (r2(&ehdr->e_type) != ET_EXEC && r2(&ehdr->e_type) != ET_DYN) || -- ehdr->e_ident[EI_VERSION] != EV_CURRENT) { -+ if (memcmp(ELFMAG, ehdr->e32.e_ident, SELFMAG) != 0 || -+ (r2(&ehdr->e32.e_type) != ET_EXEC && r2(&ehdr->e32.e_type) != ET_DYN) || -+ ehdr->e32.e_ident[EI_VERSION] != EV_CURRENT) { - fprintf(stderr, "unrecognized ET_EXEC/ET_DYN file %s\n", fname); - return -1; - } - -- switch (r2(&ehdr->e_machine)) { -+ switch (r2(&ehdr->e32.e_machine)) { - case EM_386: - case EM_AARCH64: - case EM_LOONGARCH: -@@ -318,14 +323,14 @@ static int do_file(char const *const fname, void *addr) - break; - default: - fprintf(stderr, "unrecognized e_machine %d %s\n", -- r2(&ehdr->e_machine), fname); -+ r2(&ehdr->e32.e_machine), fname); - return -1; - } - -- switch (ehdr->e_ident[EI_CLASS]) { -+ switch (ehdr->e32.e_ident[EI_CLASS]) { - case ELFCLASS32: -- if (r2(&ehdr->e_ehsize) != sizeof(Elf32_Ehdr) || -- r2(&ehdr->e_shentsize) != sizeof(Elf32_Shdr)) { -+ if (r2(&ehdr->e32.e_ehsize) != sizeof(Elf32_Ehdr) || -+ r2(&ehdr->e32.e_shentsize) != sizeof(Elf32_Shdr)) { - fprintf(stderr, - "unrecognized ET_EXEC/ET_DYN file: %s\n", fname); - break; -@@ -334,20 +339,19 @@ static int do_file(char const *const fname, void *addr) - break; - case ELFCLASS64: - { -- Elf64_Ehdr *const ghdr = (Elf64_Ehdr *)ehdr; -- if (r2(&ghdr->e_ehsize) != sizeof(Elf64_Ehdr) || -- r2(&ghdr->e_shentsize) != sizeof(Elf64_Shdr)) { -+ if (r2(&ehdr->e64.e_ehsize) != sizeof(Elf64_Ehdr) || -+ r2(&ehdr->e64.e_shentsize) != sizeof(Elf64_Shdr)) { - fprintf(stderr, - "unrecognized ET_EXEC/ET_DYN file: %s\n", - fname); - break; - } -- rc = do_sort_64(ghdr, fname, custom_sort); -+ rc = do_sort_64(ehdr, fname, custom_sort); - } - break; - default: - fprintf(stderr, "unrecognized ELF class %d %s\n", -- ehdr->e_ident[EI_CLASS], fname); -+ ehdr->e32.e_ident[EI_CLASS], fname); - break; - } - -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 36655ff16b39..be8b529498fb 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -23,12 +23,12 @@ - #undef sort_mcount_loc - #undef elf_mcount_loc - #undef do_sort --#undef Elf_Ehdr - #undef Elf_Shdr - #undef Elf_Sym - #undef ELF_ST_TYPE - #undef uint_t - #undef _r -+#undef etype - - #ifdef SORTTABLE_64 - # define extable_ent_size 16 -@@ -37,12 +37,12 @@ - # define sort_mcount_loc sort_mcount_loc_64 - # define elf_mcount_loc elf_mcount_loc_64 - # define do_sort do_sort_64 --# define Elf_Ehdr Elf64_Ehdr - # define Elf_Shdr Elf64_Shdr - # define Elf_Sym Elf64_Sym - # define ELF_ST_TYPE ELF64_ST_TYPE - # define uint_t uint64_t - # define _r r8 -+# define etype e64 - #else - # define extable_ent_size 8 - # define compare_extable compare_extable_32 -@@ -50,12 +50,12 @@ - # define sort_mcount_loc sort_mcount_loc_32 - # define elf_mcount_loc elf_mcount_loc_32 - # define do_sort do_sort_32 --# define Elf_Ehdr Elf32_Ehdr - # define Elf_Shdr Elf32_Shdr - # define Elf_Sym Elf32_Sym - # define ELF_ST_TYPE ELF32_ST_TYPE - # define uint_t uint32_t - # define _r r -+# define etype e32 - #endif - - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -@@ -222,7 +222,7 @@ static int do_sort(Elf_Ehdr *ehdr, - table_sort_t custom_sort) - { - int rc = -1; -- Elf_Shdr *s, *shdr = (Elf_Shdr *)((char *)ehdr + _r(&ehdr->e_shoff)); -+ Elf_Shdr *s, *shdr = (Elf_Shdr *)((char *)ehdr + _r(&ehdr->etype.e_shoff)); - Elf_Shdr *strtab_sec = NULL; - Elf_Shdr *symtab_sec = NULL; - Elf_Shdr *extab_sec = NULL; -@@ -249,12 +249,12 @@ static int do_sort(Elf_Ehdr *ehdr, - unsigned int orc_num_entries = 0; - #endif - -- shstrndx = r2(&ehdr->e_shstrndx); -+ shstrndx = r2(&ehdr->etype.e_shstrndx); - if (shstrndx == SHN_XINDEX) - shstrndx = r(&shdr[0].sh_link); - secstrings = (const char *)ehdr + _r(&shdr[shstrndx].sh_offset); - -- shnum = r2(&ehdr->e_shnum); -+ shnum = r2(&ehdr->etype.e_shnum); - if (shnum == SHN_UNDEF) - shnum = _r(&shdr[0].sh_size); - --- -2.50.1 (Apple Git-155) - diff --git a/1331-scripts-sorttable-replace-elf-shdr-macro-with-a-union.patch b/1331-scripts-sorttable-replace-elf-shdr-macro-with-a-union.patch deleted file mode 100644 index 6fc73c9f3..000000000 --- a/1331-scripts-sorttable-replace-elf-shdr-macro-with-a-union.patch +++ /dev/null @@ -1,257 +0,0 @@ -From e5bf3a68ca49663c4c12c03dbbb236a86ae7ef45 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:20 +0200 -Subject: [PATCH] scripts/sorttable: Replace Elf_Shdr Macro with a union - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 545f6cf8f4c9a268e0bab2637f1d279679befdbf -Author: Steven Rostedt -Date: Sun Jan 5 11:22:18 2025 -0500 - - scripts/sorttable: Replace Elf_Shdr Macro with a union - - In order to remove the double #include of sorttable.h for 64 and 32 bit - to create duplicate functions for both, replace the Elf_Shdr macro with a - union that defines both Elf64_Shdr and Elf32_Shdr, with field e64 for the - 64bit version, and e32 for the 32bit version. - - It can then use the macro etype to get the proper value. - - This will eventually be replaced with just single functions that can - handle both 32bit and 64bit ELF parsing. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162345.339462681@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 67cbbfc8214d..94497b8ab04c 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -69,6 +69,11 @@ typedef union { - Elf64_Ehdr e64; - } Elf_Ehdr; - -+typedef union { -+ Elf32_Shdr e32; -+ Elf64_Shdr e64; -+} Elf_Shdr; -+ - static uint32_t (*r)(const uint32_t *); - static uint16_t (*r2)(const uint16_t *); - static uint64_t (*r8)(const uint64_t *); -@@ -198,6 +203,11 @@ static int compare_extable_64(const void *a, const void *b) - return av > bv; - } - -+static inline void *get_index(void *start, int entsize, int index) -+{ -+ return start + (entsize * index); -+} -+ - /* 32 bit and 64 bit are very similar */ - #include "sorttable.h" - #define SORTTABLE_64 -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index be8b529498fb..3daf37bb6b9a 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -23,7 +23,6 @@ - #undef sort_mcount_loc - #undef elf_mcount_loc - #undef do_sort --#undef Elf_Shdr - #undef Elf_Sym - #undef ELF_ST_TYPE - #undef uint_t -@@ -37,7 +36,6 @@ - # define sort_mcount_loc sort_mcount_loc_64 - # define elf_mcount_loc elf_mcount_loc_64 - # define do_sort do_sort_64 --# define Elf_Shdr Elf64_Shdr - # define Elf_Sym Elf64_Sym - # define ELF_ST_TYPE ELF64_ST_TYPE - # define uint_t uint64_t -@@ -50,7 +48,6 @@ - # define sort_mcount_loc sort_mcount_loc_32 - # define elf_mcount_loc elf_mcount_loc_32 - # define do_sort do_sort_32 --# define Elf_Shdr Elf32_Shdr - # define Elf_Sym Elf32_Sym - # define ELF_ST_TYPE ELF32_ST_TYPE - # define uint_t uint32_t -@@ -171,8 +168,8 @@ struct elf_mcount_loc { - static void *sort_mcount_loc(void *arg) - { - struct elf_mcount_loc *emloc = (struct elf_mcount_loc *)arg; -- uint_t offset = emloc->start_mcount_loc - _r(&(emloc->init_data_sec)->sh_addr) -- + _r(&(emloc->init_data_sec)->sh_offset); -+ uint_t offset = emloc->start_mcount_loc - _r(&(emloc->init_data_sec)->etype.sh_addr) -+ + _r(&(emloc->init_data_sec)->etype.sh_offset); - uint_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; - unsigned char *start_loc = (void *)emloc->ehdr + offset; - -@@ -222,10 +219,11 @@ static int do_sort(Elf_Ehdr *ehdr, - table_sort_t custom_sort) - { - int rc = -1; -- Elf_Shdr *s, *shdr = (Elf_Shdr *)((char *)ehdr + _r(&ehdr->etype.e_shoff)); -+ Elf_Shdr *shdr_start; - Elf_Shdr *strtab_sec = NULL; - Elf_Shdr *symtab_sec = NULL; - Elf_Shdr *extab_sec = NULL; -+ Elf_Shdr *string_sec; - Elf_Sym *sym; - const Elf_Sym *symtab; - Elf32_Word *symtab_shndx = NULL; -@@ -235,7 +233,10 @@ static int do_sort(Elf_Ehdr *ehdr, - const char *secstrings; - const char *strtab; - char *extab_image; -+ int sort_need_index; -+ int shentsize; - int idx; -+ int i; - unsigned int shnum; - unsigned int shstrndx; - #ifdef MCOUNT_SORT_ENABLED -@@ -249,34 +250,40 @@ static int do_sort(Elf_Ehdr *ehdr, - unsigned int orc_num_entries = 0; - #endif - -+ shdr_start = (Elf_Shdr *)((char *)ehdr + _r(&ehdr->etype.e_shoff)); -+ shentsize = r2(&ehdr->etype.e_shentsize); -+ - shstrndx = r2(&ehdr->etype.e_shstrndx); - if (shstrndx == SHN_XINDEX) -- shstrndx = r(&shdr[0].sh_link); -- secstrings = (const char *)ehdr + _r(&shdr[shstrndx].sh_offset); -+ shstrndx = r(&shdr_start->etype.sh_link); -+ string_sec = get_index(shdr_start, shentsize, shstrndx); -+ secstrings = (const char *)ehdr + _r(&string_sec->etype.sh_offset); - - shnum = r2(&ehdr->etype.e_shnum); - if (shnum == SHN_UNDEF) -- shnum = _r(&shdr[0].sh_size); -+ shnum = _r(&shdr_start->etype.sh_size); -+ -+ for (i = 0; i < shnum; i++) { -+ Elf_Shdr *shdr = get_index(shdr_start, shentsize, i); - -- for (s = shdr; s < shdr + shnum; s++) { -- idx = r(&s->sh_name); -+ idx = r(&shdr->etype.sh_name); - if (!strcmp(secstrings + idx, "__ex_table")) -- extab_sec = s; -+ extab_sec = shdr; - if (!strcmp(secstrings + idx, ".symtab")) -- symtab_sec = s; -+ symtab_sec = shdr; - if (!strcmp(secstrings + idx, ".strtab")) -- strtab_sec = s; -+ strtab_sec = shdr; - -- if (r(&s->sh_type) == SHT_SYMTAB_SHNDX) -+ if (r(&shdr->etype.sh_type) == SHT_SYMTAB_SHNDX) - symtab_shndx = (Elf32_Word *)((const char *)ehdr + -- _r(&s->sh_offset)); -+ _r(&shdr->etype.sh_offset)); - - #ifdef MCOUNT_SORT_ENABLED - /* locate the .init.data section in vmlinux */ - if (!strcmp(secstrings + idx, ".init.data")) { - get_mcount_loc(&_start_mcount_loc, &_stop_mcount_loc); - mstruct.ehdr = ehdr; -- mstruct.init_data_sec = s; -+ mstruct.init_data_sec = shdr; - mstruct.start_mcount_loc = _start_mcount_loc; - mstruct.stop_mcount_loc = _stop_mcount_loc; - } -@@ -285,14 +292,14 @@ static int do_sort(Elf_Ehdr *ehdr, - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) - /* locate the ORC unwind tables */ - if (!strcmp(secstrings + idx, ".orc_unwind_ip")) { -- orc_ip_size = _r(&s->sh_size); -+ orc_ip_size = _r(&shdr->etype.sh_size); - g_orc_ip_table = (int *)((void *)ehdr + -- _r(&s->sh_offset)); -+ _r(&shdr->etype.sh_offset)); - } - if (!strcmp(secstrings + idx, ".orc_unwind")) { -- orc_size = _r(&s->sh_size); -+ orc_size = _r(&shdr->etype.sh_size); - g_orc_table = (struct orc_entry *)((void *)ehdr + -- _r(&s->sh_offset)); -+ _r(&shdr->etype.sh_offset)); - } - #endif - } /* for loop */ -@@ -355,22 +362,22 @@ static int do_sort(Elf_Ehdr *ehdr, - goto out; - } - -- extab_image = (void *)ehdr + _r(&extab_sec->sh_offset); -- strtab = (const char *)ehdr + _r(&strtab_sec->sh_offset); -+ extab_image = (void *)ehdr + _r(&extab_sec->etype.sh_offset); -+ strtab = (const char *)ehdr + _r(&strtab_sec->etype.sh_offset); - symtab = (const Elf_Sym *)((const char *)ehdr + -- _r(&symtab_sec->sh_offset)); -+ _r(&symtab_sec->etype.sh_offset)); - - if (custom_sort) { -- custom_sort(extab_image, _r(&extab_sec->sh_size)); -+ custom_sort(extab_image, _r(&extab_sec->etype.sh_size)); - } else { -- int num_entries = _r(&extab_sec->sh_size) / extable_ent_size; -+ int num_entries = _r(&extab_sec->etype.sh_size) / extable_ent_size; - qsort(extab_image, num_entries, - extable_ent_size, compare_extable); - } - - /* find the flag main_extable_sort_needed */ -- for (sym = (void *)ehdr + _r(&symtab_sec->sh_offset); -- sym < sym + _r(&symtab_sec->sh_size) / sizeof(Elf_Sym); -+ for (sym = (void *)ehdr + _r(&symtab_sec->etype.sh_offset); -+ sym < sym + _r(&symtab_sec->etype.sh_size) / sizeof(Elf_Sym); - sym++) { - if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT) - continue; -@@ -388,13 +395,14 @@ static int do_sort(Elf_Ehdr *ehdr, - goto out; - } - -- sort_needed_sec = &shdr[get_secindex(r2(&sym->st_shndx), -- sort_needed_sym - symtab, -- symtab_shndx)]; -+ sort_need_index = get_secindex(r2(&sym->st_shndx), -+ sort_needed_sym - symtab, -+ symtab_shndx); -+ sort_needed_sec = get_index(shdr_start, shentsize, sort_need_index); - sort_needed_loc = (void *)ehdr + -- _r(&sort_needed_sec->sh_offset) + -+ _r(&sort_needed_sec->etype.sh_offset) + - _r(&sort_needed_sym->st_value) - -- _r(&sort_needed_sec->sh_addr); -+ _r(&sort_needed_sec->etype.sh_addr); - - /* extable has been sorted, clear the flag */ - w(0, sort_needed_loc); --- -2.50.1 (Apple Git-155) - diff --git a/1332-scripts-sorttable-convert-elf-sym-macro-over-to-a-union.patch b/1332-scripts-sorttable-convert-elf-sym-macro-over-to-a-union.patch deleted file mode 100644 index 8ed4ac56f..000000000 --- a/1332-scripts-sorttable-convert-elf-sym-macro-over-to-a-union.patch +++ /dev/null @@ -1,141 +0,0 @@ -From d95dcd72b2a2511fa93a2b185611cba7f4624f7c Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:23 +0200 -Subject: [PATCH] scripts/sorttable: Convert Elf_Sym MACRO over to a union - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 200d015e73b4da69bcd8212a7c58695452b12bad -Author: Steven Rostedt -Date: Sun Jan 5 11:22:19 2025 -0500 - - scripts/sorttable: Convert Elf_Sym MACRO over to a union - - In order to remove the double #include of sorttable.h for 64 and 32 bit - to create duplicate functions for both, replace the Elf_Sym macro with a - union that defines both Elf64_Sym and Elf32_Sym, with field e64 for the - 64bit version, and e32 for the 32bit version. - - It can then use the macro etype to get the proper value. - - This will eventually be replaced with just single functions that can - handle both 32bit and 64bit ELF parsing. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162345.528626969@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 94497b8ab04c..57792cf2aa89 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -74,6 +74,11 @@ typedef union { - Elf64_Shdr e64; - } Elf_Shdr; - -+typedef union { -+ Elf32_Sym e32; -+ Elf64_Sym e64; -+} Elf_Sym; -+ - static uint32_t (*r)(const uint32_t *); - static uint16_t (*r2)(const uint16_t *); - static uint64_t (*r8)(const uint64_t *); -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 3daf37bb6b9a..cd4429c8a9f4 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -23,7 +23,6 @@ - #undef sort_mcount_loc - #undef elf_mcount_loc - #undef do_sort --#undef Elf_Sym - #undef ELF_ST_TYPE - #undef uint_t - #undef _r -@@ -36,7 +35,6 @@ - # define sort_mcount_loc sort_mcount_loc_64 - # define elf_mcount_loc elf_mcount_loc_64 - # define do_sort do_sort_64 --# define Elf_Sym Elf64_Sym - # define ELF_ST_TYPE ELF64_ST_TYPE - # define uint_t uint64_t - # define _r r8 -@@ -48,7 +46,6 @@ - # define sort_mcount_loc sort_mcount_loc_32 - # define elf_mcount_loc elf_mcount_loc_32 - # define do_sort do_sort_32 --# define Elf_Sym Elf32_Sym - # define ELF_ST_TYPE ELF32_ST_TYPE - # define uint_t uint32_t - # define _r r -@@ -230,10 +227,13 @@ static int do_sort(Elf_Ehdr *ehdr, - Elf_Sym *sort_needed_sym = NULL; - Elf_Shdr *sort_needed_sec; - uint32_t *sort_needed_loc; -+ void *sym_start; -+ void *sym_end; - const char *secstrings; - const char *strtab; - char *extab_image; - int sort_need_index; -+ int symentsize; - int shentsize; - int idx; - int i; -@@ -376,12 +376,15 @@ static int do_sort(Elf_Ehdr *ehdr, - } - - /* find the flag main_extable_sort_needed */ -- for (sym = (void *)ehdr + _r(&symtab_sec->etype.sh_offset); -- sym < sym + _r(&symtab_sec->etype.sh_size) / sizeof(Elf_Sym); -- sym++) { -- if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT) -+ sym_start = (void *)ehdr + _r(&symtab_sec->etype.sh_offset); -+ sym_end = sym_start + _r(&symtab_sec->etype.sh_size); -+ symentsize = _r(&symtab_sec->etype.sh_entsize); -+ -+ for (sym = sym_start; (void *)sym + symentsize < sym_end; -+ sym = (void *)sym + symentsize) { -+ if (ELF_ST_TYPE(sym->etype.st_info) != STT_OBJECT) - continue; -- if (!strcmp(strtab + r(&sym->st_name), -+ if (!strcmp(strtab + r(&sym->etype.st_name), - "main_extable_sort_needed")) { - sort_needed_sym = sym; - break; -@@ -395,13 +398,13 @@ static int do_sort(Elf_Ehdr *ehdr, - goto out; - } - -- sort_need_index = get_secindex(r2(&sym->st_shndx), -- sort_needed_sym - symtab, -+ sort_need_index = get_secindex(r2(&sym->etype.st_shndx), -+ ((void *)sort_needed_sym - (void *)symtab) / symentsize, - symtab_shndx); - sort_needed_sec = get_index(shdr_start, shentsize, sort_need_index); - sort_needed_loc = (void *)ehdr + - _r(&sort_needed_sec->etype.sh_offset) + -- _r(&sort_needed_sym->st_value) - -+ _r(&sort_needed_sym->etype.st_value) - - _r(&sort_needed_sec->etype.sh_addr); - - /* extable has been sorted, clear the flag */ --- -2.50.1 (Apple Git-155) - diff --git a/1333-scripts-sorttable-add-helper-functions-for-elf-ehdr.patch b/1333-scripts-sorttable-add-helper-functions-for-elf-ehdr.patch deleted file mode 100644 index 6086840a7..000000000 --- a/1333-scripts-sorttable-add-helper-functions-for-elf-ehdr.patch +++ /dev/null @@ -1,139 +0,0 @@ -From 1278ee787a87aaaa378d44f173cdae2fb07501ae Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:33 +0200 -Subject: [PATCH] scripts/sorttable: Add helper functions for Elf_Ehdr - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 1dfb59a228dde59ad7d99b2fa2104e90004995c7 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:20 2025 -0500 - - scripts/sorttable: Add helper functions for Elf_Ehdr - - In order to remove the double #include of sorttable.h for 64 and 32 bit - to create duplicate functions, add helper functions for Elf_Ehdr. This - will create a function pointer for each helper that will get assigned to - the appropriate function to handle either the 64bit or 32bit version. - - This also moves the _r()/r() wrappers for the Elf_Ehdr references that - handle endian and size differences between the different architectures, - into the helper function and out of the open code which is more error - prone. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162345.736369526@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 57792cf2aa89..5dfa734eff09 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -85,6 +85,31 @@ static uint64_t (*r8)(const uint64_t *); - static void (*w)(uint32_t, uint32_t *); - typedef void (*table_sort_t)(char *, int); - -+static uint64_t ehdr64_shoff(Elf_Ehdr *ehdr) -+{ -+ return r8(&ehdr->e64.e_shoff); -+} -+ -+static uint64_t ehdr32_shoff(Elf_Ehdr *ehdr) -+{ -+ return r(&ehdr->e32.e_shoff); -+} -+ -+#define EHDR_HALF(fn_name) \ -+static uint16_t ehdr64_##fn_name(Elf_Ehdr *ehdr) \ -+{ \ -+ return r2(&ehdr->e64.e_##fn_name); \ -+} \ -+ \ -+static uint16_t ehdr32_##fn_name(Elf_Ehdr *ehdr) \ -+{ \ -+ return r2(&ehdr->e32.e_##fn_name); \ -+} -+ -+EHDR_HALF(shentsize) -+EHDR_HALF(shstrndx) -+EHDR_HALF(shnum) -+ - /* - * Get the whole file as a programming convenience in order to avoid - * malloc+lseek+read+free of many pieces. If successful, then mmap -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index cd4429c8a9f4..97278c973bc9 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -27,6 +27,10 @@ - #undef uint_t - #undef _r - #undef etype -+#undef ehdr_shoff -+#undef ehdr_shentsize -+#undef ehdr_shstrndx -+#undef ehdr_shnum - - #ifdef SORTTABLE_64 - # define extable_ent_size 16 -@@ -39,6 +43,10 @@ - # define uint_t uint64_t - # define _r r8 - # define etype e64 -+# define ehdr_shoff ehdr64_shoff -+# define ehdr_shentsize ehdr64_shentsize -+# define ehdr_shstrndx ehdr64_shstrndx -+# define ehdr_shnum ehdr64_shnum - #else - # define extable_ent_size 8 - # define compare_extable compare_extable_32 -@@ -50,6 +58,10 @@ - # define uint_t uint32_t - # define _r r - # define etype e32 -+# define ehdr_shoff ehdr32_shoff -+# define ehdr_shentsize ehdr32_shentsize -+# define ehdr_shstrndx ehdr32_shstrndx -+# define ehdr_shnum ehdr32_shnum - #endif - - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -@@ -250,16 +262,16 @@ static int do_sort(Elf_Ehdr *ehdr, - unsigned int orc_num_entries = 0; - #endif - -- shdr_start = (Elf_Shdr *)((char *)ehdr + _r(&ehdr->etype.e_shoff)); -- shentsize = r2(&ehdr->etype.e_shentsize); -+ shdr_start = (Elf_Shdr *)((char *)ehdr + ehdr_shoff(ehdr)); -+ shentsize = ehdr_shentsize(ehdr); - -- shstrndx = r2(&ehdr->etype.e_shstrndx); -+ shstrndx = ehdr_shstrndx(ehdr); - if (shstrndx == SHN_XINDEX) - shstrndx = r(&shdr_start->etype.sh_link); - string_sec = get_index(shdr_start, shentsize, shstrndx); - secstrings = (const char *)ehdr + _r(&string_sec->etype.sh_offset); - -- shnum = r2(&ehdr->etype.e_shnum); -+ shnum = ehdr_shnum(ehdr); - if (shnum == SHN_UNDEF) - shnum = _r(&shdr_start->etype.sh_size); - --- -2.50.1 (Apple Git-155) - diff --git a/1334-scripts-sorttable-add-helper-functions-for-elf-shdr.patch b/1334-scripts-sorttable-add-helper-functions-for-elf-shdr.patch deleted file mode 100644 index ed19f852b..000000000 --- a/1334-scripts-sorttable-add-helper-functions-for-elf-shdr.patch +++ /dev/null @@ -1,253 +0,0 @@ -From a5efd249d8b52767833dcd9ca0b7f8f5470cf289 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:40 +0200 -Subject: [PATCH] scripts/sorttable: Add helper functions for Elf_Shdr - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 67afb7f504400e5b4e5ff895459fbb3eb63d4450 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:21 2025 -0500 - - scripts/sorttable: Add helper functions for Elf_Shdr - - In order to remove the double #include of sorttable.h for 64 and 32 bit - to create duplicate functions, add helper functions for Elf_Shdr. This - will create a function pointer for each helper that will get assigned to - the appropriate function to handle either the 64bit or 32bit version. - - This also moves the _r()/r() wrappers for the Elf_Shdr references that - handle endian and size differences between the different architectures, - into the helper function and out of the open code which is more error - prone. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162345.940924221@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 5dfa734eff09..b2b96ff261d6 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -110,6 +110,48 @@ EHDR_HALF(shentsize) - EHDR_HALF(shstrndx) - EHDR_HALF(shnum) - -+#define SHDR_WORD(fn_name) \ -+static uint32_t shdr64_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return r(&shdr->e64.sh_##fn_name); \ -+} \ -+ \ -+static uint32_t shdr32_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return r(&shdr->e32.sh_##fn_name); \ -+} -+ -+#define SHDR_ADDR(fn_name) \ -+static uint64_t shdr64_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return r8(&shdr->e64.sh_##fn_name); \ -+} \ -+ \ -+static uint64_t shdr32_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return r(&shdr->e32.sh_##fn_name); \ -+} -+ -+#define SHDR_WORD(fn_name) \ -+static uint32_t shdr64_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return r(&shdr->e64.sh_##fn_name); \ -+} \ -+ \ -+static uint32_t shdr32_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return r(&shdr->e32.sh_##fn_name); \ -+} -+ -+SHDR_ADDR(addr) -+SHDR_ADDR(offset) -+SHDR_ADDR(size) -+SHDR_ADDR(entsize) -+ -+SHDR_WORD(link) -+SHDR_WORD(name) -+SHDR_WORD(type) -+ - /* - * Get the whole file as a programming convenience in order to avoid - * malloc+lseek+read+free of many pieces. If successful, then mmap -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index 97278c973bc9..af3a5f0209a3 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -31,6 +31,13 @@ - #undef ehdr_shentsize - #undef ehdr_shstrndx - #undef ehdr_shnum -+#undef shdr_addr -+#undef shdr_offset -+#undef shdr_link -+#undef shdr_size -+#undef shdr_name -+#undef shdr_type -+#undef shdr_entsize - - #ifdef SORTTABLE_64 - # define extable_ent_size 16 -@@ -47,6 +54,13 @@ - # define ehdr_shentsize ehdr64_shentsize - # define ehdr_shstrndx ehdr64_shstrndx - # define ehdr_shnum ehdr64_shnum -+# define shdr_addr shdr64_addr -+# define shdr_offset shdr64_offset -+# define shdr_link shdr64_link -+# define shdr_size shdr64_size -+# define shdr_name shdr64_name -+# define shdr_type shdr64_type -+# define shdr_entsize shdr64_entsize - #else - # define extable_ent_size 8 - # define compare_extable compare_extable_32 -@@ -62,6 +76,13 @@ - # define ehdr_shentsize ehdr32_shentsize - # define ehdr_shstrndx ehdr32_shstrndx - # define ehdr_shnum ehdr32_shnum -+# define shdr_addr shdr32_addr -+# define shdr_offset shdr32_offset -+# define shdr_link shdr32_link -+# define shdr_size shdr32_size -+# define shdr_name shdr32_name -+# define shdr_type shdr32_type -+# define shdr_entsize shdr32_entsize - #endif - - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -@@ -177,8 +198,8 @@ struct elf_mcount_loc { - static void *sort_mcount_loc(void *arg) - { - struct elf_mcount_loc *emloc = (struct elf_mcount_loc *)arg; -- uint_t offset = emloc->start_mcount_loc - _r(&(emloc->init_data_sec)->etype.sh_addr) -- + _r(&(emloc->init_data_sec)->etype.sh_offset); -+ uint_t offset = emloc->start_mcount_loc - shdr_addr(emloc->init_data_sec) -+ + shdr_offset(emloc->init_data_sec); - uint_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; - unsigned char *start_loc = (void *)emloc->ehdr + offset; - -@@ -267,18 +288,18 @@ static int do_sort(Elf_Ehdr *ehdr, - - shstrndx = ehdr_shstrndx(ehdr); - if (shstrndx == SHN_XINDEX) -- shstrndx = r(&shdr_start->etype.sh_link); -+ shstrndx = shdr_link(shdr_start); - string_sec = get_index(shdr_start, shentsize, shstrndx); -- secstrings = (const char *)ehdr + _r(&string_sec->etype.sh_offset); -+ secstrings = (const char *)ehdr + shdr_offset(string_sec); - - shnum = ehdr_shnum(ehdr); - if (shnum == SHN_UNDEF) -- shnum = _r(&shdr_start->etype.sh_size); -+ shnum = shdr_size(shdr_start); - - for (i = 0; i < shnum; i++) { - Elf_Shdr *shdr = get_index(shdr_start, shentsize, i); - -- idx = r(&shdr->etype.sh_name); -+ idx = shdr_name(shdr); - if (!strcmp(secstrings + idx, "__ex_table")) - extab_sec = shdr; - if (!strcmp(secstrings + idx, ".symtab")) -@@ -286,9 +307,9 @@ static int do_sort(Elf_Ehdr *ehdr, - if (!strcmp(secstrings + idx, ".strtab")) - strtab_sec = shdr; - -- if (r(&shdr->etype.sh_type) == SHT_SYMTAB_SHNDX) -+ if (shdr_type(shdr) == SHT_SYMTAB_SHNDX) - symtab_shndx = (Elf32_Word *)((const char *)ehdr + -- _r(&shdr->etype.sh_offset)); -+ shdr_offset(shdr)); - - #ifdef MCOUNT_SORT_ENABLED - /* locate the .init.data section in vmlinux */ -@@ -304,14 +325,14 @@ static int do_sort(Elf_Ehdr *ehdr, - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) - /* locate the ORC unwind tables */ - if (!strcmp(secstrings + idx, ".orc_unwind_ip")) { -- orc_ip_size = _r(&shdr->etype.sh_size); -+ orc_ip_size = shdr_size(shdr); - g_orc_ip_table = (int *)((void *)ehdr + -- _r(&shdr->etype.sh_offset)); -+ shdr_offset(shdr)); - } - if (!strcmp(secstrings + idx, ".orc_unwind")) { -- orc_size = _r(&shdr->etype.sh_size); -+ orc_size = shdr_size(shdr); - g_orc_table = (struct orc_entry *)((void *)ehdr + -- _r(&shdr->etype.sh_offset)); -+ shdr_offset(shdr)); - } - #endif - } /* for loop */ -@@ -374,23 +395,22 @@ static int do_sort(Elf_Ehdr *ehdr, - goto out; - } - -- extab_image = (void *)ehdr + _r(&extab_sec->etype.sh_offset); -- strtab = (const char *)ehdr + _r(&strtab_sec->etype.sh_offset); -- symtab = (const Elf_Sym *)((const char *)ehdr + -- _r(&symtab_sec->etype.sh_offset)); -+ extab_image = (void *)ehdr + shdr_offset(extab_sec); -+ strtab = (const char *)ehdr + shdr_offset(strtab_sec); -+ symtab = (const Elf_Sym *)((const char *)ehdr + shdr_offset(symtab_sec)); - - if (custom_sort) { -- custom_sort(extab_image, _r(&extab_sec->etype.sh_size)); -+ custom_sort(extab_image, shdr_size(extab_sec)); - } else { -- int num_entries = _r(&extab_sec->etype.sh_size) / extable_ent_size; -+ int num_entries = shdr_size(extab_sec) / extable_ent_size; - qsort(extab_image, num_entries, - extable_ent_size, compare_extable); - } - - /* find the flag main_extable_sort_needed */ -- sym_start = (void *)ehdr + _r(&symtab_sec->etype.sh_offset); -- sym_end = sym_start + _r(&symtab_sec->etype.sh_size); -- symentsize = _r(&symtab_sec->etype.sh_entsize); -+ sym_start = (void *)ehdr + shdr_offset(symtab_sec); -+ sym_end = sym_start + shdr_size(symtab_sec); -+ symentsize = shdr_entsize(symtab_sec); - - for (sym = sym_start; (void *)sym + symentsize < sym_end; - sym = (void *)sym + symentsize) { -@@ -415,9 +435,9 @@ static int do_sort(Elf_Ehdr *ehdr, - symtab_shndx); - sort_needed_sec = get_index(shdr_start, shentsize, sort_need_index); - sort_needed_loc = (void *)ehdr + -- _r(&sort_needed_sec->etype.sh_offset) + -+ shdr_offset(sort_needed_sec) + - _r(&sort_needed_sym->etype.st_value) - -- _r(&sort_needed_sec->etype.sh_addr); -+ shdr_addr(sort_needed_sec); - - /* extable has been sorted, clear the flag */ - w(0, sort_needed_loc); --- -2.50.1 (Apple Git-155) - diff --git a/1335-scripts-sorttable-add-helper-functions-for-elf-sym.patch b/1335-scripts-sorttable-add-helper-functions-for-elf-sym.patch deleted file mode 100644 index 7d5abcf2c..000000000 --- a/1335-scripts-sorttable-add-helper-functions-for-elf-sym.patch +++ /dev/null @@ -1,203 +0,0 @@ -From 133d6f7d2c3e689e3191bf973e07819dda085f60 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:43 +0200 -Subject: [PATCH] scripts/sorttable: Add helper functions for Elf_Sym - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 17bed33ac12f011f4695059960e1b1d6457229a7 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:22 2025 -0500 - - scripts/sorttable: Add helper functions for Elf_Sym - - In order to remove the double #include of sorttable.h for 64 and 32 bit - to create duplicate functions, add helper functions for Elf_Sym. This - will create a function pointer for each helper that will get assigned to - the appropriate function to handle either the 64bit or 32bit version. - - This also removes the last references of etype and _r() macros from the - sorttable.h file as their references are now just defined in the - appropriate architecture version of the helper functions. All read - functions now exist in the helper functions which makes it easier to - maintain, as the helper functions define the necessary architecture sizes. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162346.185740651@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index b2b96ff261d6..20615de18276 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -152,6 +152,53 @@ SHDR_WORD(link) - SHDR_WORD(name) - SHDR_WORD(type) - -+#define SYM_ADDR(fn_name) \ -+static uint64_t sym64_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return r8(&sym->e64.st_##fn_name); \ -+} \ -+ \ -+static uint64_t sym32_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return r(&sym->e32.st_##fn_name); \ -+} -+ -+#define SYM_WORD(fn_name) \ -+static uint32_t sym64_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return r(&sym->e64.st_##fn_name); \ -+} \ -+ \ -+static uint32_t sym32_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return r(&sym->e32.st_##fn_name); \ -+} -+ -+#define SYM_HALF(fn_name) \ -+static uint16_t sym64_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return r2(&sym->e64.st_##fn_name); \ -+} \ -+ \ -+static uint16_t sym32_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return r2(&sym->e32.st_##fn_name); \ -+} -+ -+static uint8_t sym64_type(Elf_Sym *sym) -+{ -+ return ELF64_ST_TYPE(sym->e64.st_info); -+} -+ -+static uint8_t sym32_type(Elf_Sym *sym) -+{ -+ return ELF32_ST_TYPE(sym->e32.st_info); -+} -+ -+SYM_ADDR(value) -+SYM_WORD(name) -+SYM_HALF(shndx) -+ - /* - * Get the whole file as a programming convenience in order to avoid - * malloc+lseek+read+free of many pieces. If successful, then mmap -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index af3a5f0209a3..ef7e5161db31 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -23,10 +23,7 @@ - #undef sort_mcount_loc - #undef elf_mcount_loc - #undef do_sort --#undef ELF_ST_TYPE - #undef uint_t --#undef _r --#undef etype - #undef ehdr_shoff - #undef ehdr_shentsize - #undef ehdr_shstrndx -@@ -38,6 +35,10 @@ - #undef shdr_name - #undef shdr_type - #undef shdr_entsize -+#undef sym_type -+#undef sym_name -+#undef sym_value -+#undef sym_shndx - - #ifdef SORTTABLE_64 - # define extable_ent_size 16 -@@ -46,10 +47,7 @@ - # define sort_mcount_loc sort_mcount_loc_64 - # define elf_mcount_loc elf_mcount_loc_64 - # define do_sort do_sort_64 --# define ELF_ST_TYPE ELF64_ST_TYPE - # define uint_t uint64_t --# define _r r8 --# define etype e64 - # define ehdr_shoff ehdr64_shoff - # define ehdr_shentsize ehdr64_shentsize - # define ehdr_shstrndx ehdr64_shstrndx -@@ -61,6 +59,10 @@ - # define shdr_name shdr64_name - # define shdr_type shdr64_type - # define shdr_entsize shdr64_entsize -+# define sym_type sym64_type -+# define sym_name sym64_name -+# define sym_value sym64_value -+# define sym_shndx sym64_shndx - #else - # define extable_ent_size 8 - # define compare_extable compare_extable_32 -@@ -68,10 +70,7 @@ - # define sort_mcount_loc sort_mcount_loc_32 - # define elf_mcount_loc elf_mcount_loc_32 - # define do_sort do_sort_32 --# define ELF_ST_TYPE ELF32_ST_TYPE - # define uint_t uint32_t --# define _r r --# define etype e32 - # define ehdr_shoff ehdr32_shoff - # define ehdr_shentsize ehdr32_shentsize - # define ehdr_shstrndx ehdr32_shstrndx -@@ -83,6 +82,10 @@ - # define shdr_name shdr32_name - # define shdr_type shdr32_type - # define shdr_entsize shdr32_entsize -+# define sym_type sym32_type -+# define sym_name sym32_name -+# define sym_value sym32_value -+# define sym_shndx sym32_shndx - #endif - - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -@@ -414,9 +417,9 @@ static int do_sort(Elf_Ehdr *ehdr, - - for (sym = sym_start; (void *)sym + symentsize < sym_end; - sym = (void *)sym + symentsize) { -- if (ELF_ST_TYPE(sym->etype.st_info) != STT_OBJECT) -+ if (sym_type(sym) != STT_OBJECT) - continue; -- if (!strcmp(strtab + r(&sym->etype.st_name), -+ if (!strcmp(strtab + sym_name(sym), - "main_extable_sort_needed")) { - sort_needed_sym = sym; - break; -@@ -430,14 +433,13 @@ static int do_sort(Elf_Ehdr *ehdr, - goto out; - } - -- sort_need_index = get_secindex(r2(&sym->etype.st_shndx), -+ sort_need_index = get_secindex(sym_shndx(sym), - ((void *)sort_needed_sym - (void *)symtab) / symentsize, - symtab_shndx); - sort_needed_sec = get_index(shdr_start, shentsize, sort_need_index); - sort_needed_loc = (void *)ehdr + - shdr_offset(sort_needed_sec) + -- _r(&sort_needed_sym->etype.st_value) - -- shdr_addr(sort_needed_sec); -+ sym_value(sort_needed_sym) - shdr_addr(sort_needed_sec); - - /* extable has been sorted, clear the flag */ - w(0, sort_needed_loc); --- -2.50.1 (Apple Git-155) - diff --git a/1336-scripts-sorttable-use-uint64-t-for-mcount-sorting.patch b/1336-scripts-sorttable-use-uint64-t-for-mcount-sorting.patch deleted file mode 100644 index e6521ae69..000000000 --- a/1336-scripts-sorttable-use-uint64-t-for-mcount-sorting.patch +++ /dev/null @@ -1,140 +0,0 @@ -From daa2ce334210ed3ebb054d2f8097312ac7a60ae4 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:22:46 +0200 -Subject: [PATCH] scripts/sorttable: Use uint64_t for mcount sorting - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 1b649e6ab8dc9188d82c64069493afe66ca0edad -Author: Steven Rostedt -Date: Sun Jan 5 11:22:23 2025 -0500 - - scripts/sorttable: Use uint64_t for mcount sorting - - The mcount sorting defines uint_t to uint64_t on 64bit architectures and - uint32_t on 32bit architectures. It can work with just using uint64_t as - that will hold the values of both, and they are not used to point into the - ELF file. - - sizeof(uint_t) is used for defining the size of the mcount_loc section. - Instead of using a type, define long_size and use that instead. This will - allow the header code to be moved into the C file as generic functions and - not need to include sorttable.h twice, once for 64bit and once for 32bit. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162346.373528925@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -index ef7e5161db31..17a8541a10d6 100644 ---- a/scripts/sorttable.h -+++ b/scripts/sorttable.h -@@ -23,7 +23,6 @@ - #undef sort_mcount_loc - #undef elf_mcount_loc - #undef do_sort --#undef uint_t - #undef ehdr_shoff - #undef ehdr_shentsize - #undef ehdr_shstrndx -@@ -39,6 +38,7 @@ - #undef sym_name - #undef sym_value - #undef sym_shndx -+#undef long_size - - #ifdef SORTTABLE_64 - # define extable_ent_size 16 -@@ -47,7 +47,6 @@ - # define sort_mcount_loc sort_mcount_loc_64 - # define elf_mcount_loc elf_mcount_loc_64 - # define do_sort do_sort_64 --# define uint_t uint64_t - # define ehdr_shoff ehdr64_shoff - # define ehdr_shentsize ehdr64_shentsize - # define ehdr_shstrndx ehdr64_shstrndx -@@ -63,6 +62,7 @@ - # define sym_name sym64_name - # define sym_value sym64_value - # define sym_shndx sym64_shndx -+# define long_size 8 - #else - # define extable_ent_size 8 - # define compare_extable compare_extable_32 -@@ -70,7 +70,6 @@ - # define sort_mcount_loc sort_mcount_loc_32 - # define elf_mcount_loc elf_mcount_loc_32 - # define do_sort do_sort_32 --# define uint_t uint32_t - # define ehdr_shoff ehdr32_shoff - # define ehdr_shentsize ehdr32_shentsize - # define ehdr_shstrndx ehdr32_shstrndx -@@ -86,6 +85,7 @@ - # define sym_name sym32_name - # define sym_value sym32_value - # define sym_shndx sym32_shndx -+# define long_size 4 - #endif - - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -@@ -193,25 +193,25 @@ pthread_t mcount_sort_thread; - struct elf_mcount_loc { - Elf_Ehdr *ehdr; - Elf_Shdr *init_data_sec; -- uint_t start_mcount_loc; -- uint_t stop_mcount_loc; -+ uint64_t start_mcount_loc; -+ uint64_t stop_mcount_loc; - }; - - /* Sort the addresses stored between __start_mcount_loc to __stop_mcount_loc in vmlinux */ - static void *sort_mcount_loc(void *arg) - { - struct elf_mcount_loc *emloc = (struct elf_mcount_loc *)arg; -- uint_t offset = emloc->start_mcount_loc - shdr_addr(emloc->init_data_sec) -+ uint64_t offset = emloc->start_mcount_loc - shdr_addr(emloc->init_data_sec) - + shdr_offset(emloc->init_data_sec); -- uint_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; -+ uint64_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; - unsigned char *start_loc = (void *)emloc->ehdr + offset; - -- qsort(start_loc, count/sizeof(uint_t), sizeof(uint_t), compare_extable); -+ qsort(start_loc, count/long_size, long_size, compare_extable); - return NULL; - } - - /* Get the address of __start_mcount_loc and __stop_mcount_loc in System.map */ --static void get_mcount_loc(uint_t *_start, uint_t *_stop) -+static void get_mcount_loc(uint64_t *_start, uint64_t *_stop) - { - FILE *file_start, *file_stop; - char start_buff[20]; -@@ -277,8 +277,8 @@ static int do_sort(Elf_Ehdr *ehdr, - unsigned int shstrndx; - #ifdef MCOUNT_SORT_ENABLED - struct elf_mcount_loc mstruct = {0}; -- uint_t _start_mcount_loc = 0; -- uint_t _stop_mcount_loc = 0; -+ uint64_t _start_mcount_loc = 0; -+ uint64_t _stop_mcount_loc = 0; - #endif - #if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) - unsigned int orc_ip_size = 0; --- -2.50.1 (Apple Git-155) - diff --git a/1337-scripts-sorttable-move-code-from-sorttable-h-into-sorttable-.patch b/1337-scripts-sorttable-move-code-from-sorttable-h-into-sorttable-.patch deleted file mode 100644 index bb310e3be..000000000 --- a/1337-scripts-sorttable-move-code-from-sorttable-h-into-sorttable-.patch +++ /dev/null @@ -1,1056 +0,0 @@ -From db0c9930bcabee5c191d0ccad767575ae169f3e1 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:36:28 +0200 -Subject: [PATCH] scripts/sorttable: Move code from sorttable.h into - sorttable.c - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 58d87678a0f46c6120904b4326aaf5ebf4454c69 -Author: Steven Rostedt -Date: Tue Jan 7 22:32:17 2025 -0500 - - scripts/sorttable: Move code from sorttable.h into sorttable.c - - Instead of having the main code live in a header file and included twice - with MACROs that define the Elf structures for 64 bit or 32 bit, move the - code in the C file now that the Elf structures are defined in a union that - has both. All accesses to the Elf structure fields are done through helper - function pointers. If the file being parsed if for a 64 bit architecture, - all the helper functions point to the 64 bit versions to retrieve the Elf - fields. The same is true if the architecture is 32 bit, where the function - pointers will point to the 32 bit helper functions. - - Note, when the value of a field can be either 32 bit or 64 bit, a 64 bit - is always returned, as it works for the 32 bit code as well. - - This makes the code easier to read and maintain, and it now all exists in - sorttable.c and sorttable.h may be removed. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Stephen Rothwell - Link: https://lore.kernel.org/20250107223217.6f7f96a5@gandalf.local.home - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 20615de18276..ff9b60fc0dd8 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -327,10 +327,423 @@ static inline void *get_index(void *start, int entsize, int index) - return start + (entsize * index); - } - --/* 32 bit and 64 bit are very similar */ --#include "sorttable.h" --#define SORTTABLE_64 --#include "sorttable.h" -+ -+static int (*compare_extable)(const void *a, const void *b); -+static uint64_t (*ehdr_shoff)(Elf_Ehdr *ehdr); -+static uint16_t (*ehdr_shstrndx)(Elf_Ehdr *ehdr); -+static uint16_t (*ehdr_shentsize)(Elf_Ehdr *ehdr); -+static uint16_t (*ehdr_shnum)(Elf_Ehdr *ehdr); -+static uint64_t (*shdr_addr)(Elf_Shdr *shdr); -+static uint64_t (*shdr_offset)(Elf_Shdr *shdr); -+static uint64_t (*shdr_size)(Elf_Shdr *shdr); -+static uint64_t (*shdr_entsize)(Elf_Shdr *shdr); -+static uint32_t (*shdr_link)(Elf_Shdr *shdr); -+static uint32_t (*shdr_name)(Elf_Shdr *shdr); -+static uint32_t (*shdr_type)(Elf_Shdr *shdr); -+static uint8_t (*sym_type)(Elf_Sym *sym); -+static uint32_t (*sym_name)(Elf_Sym *sym); -+static uint64_t (*sym_value)(Elf_Sym *sym); -+static uint16_t (*sym_shndx)(Elf_Sym *sym); -+ -+static int extable_ent_size; -+static int long_size; -+ -+ -+#ifdef UNWINDER_ORC_ENABLED -+/* ORC unwinder only support X86_64 */ -+#include -+ -+#define ERRSTR_MAXSZ 256 -+ -+static char g_err[ERRSTR_MAXSZ]; -+static int *g_orc_ip_table; -+static struct orc_entry *g_orc_table; -+ -+static pthread_t orc_sort_thread; -+ -+static inline unsigned long orc_ip(const int *ip) -+{ -+ return (unsigned long)ip + *ip; -+} -+ -+static int orc_sort_cmp(const void *_a, const void *_b) -+{ -+ struct orc_entry *orc_a, *orc_b; -+ const int *a = g_orc_ip_table + *(int *)_a; -+ const int *b = g_orc_ip_table + *(int *)_b; -+ unsigned long a_val = orc_ip(a); -+ unsigned long b_val = orc_ip(b); -+ -+ if (a_val > b_val) -+ return 1; -+ if (a_val < b_val) -+ return -1; -+ -+ /* -+ * The "weak" section terminator entries need to always be on the left -+ * to ensure the lookup code skips them in favor of real entries. -+ * These terminator entries exist to handle any gaps created by -+ * whitelisted .o files which didn't get objtool generation. -+ */ -+ orc_a = g_orc_table + (a - g_orc_ip_table); -+ orc_b = g_orc_table + (b - g_orc_ip_table); -+ if (orc_a->type == ORC_TYPE_UNDEFINED && orc_b->type == ORC_TYPE_UNDEFINED) -+ return 0; -+ return orc_a->type == ORC_TYPE_UNDEFINED ? -1 : 1; -+} -+ -+static void *sort_orctable(void *arg) -+{ -+ int i; -+ int *idxs = NULL; -+ int *tmp_orc_ip_table = NULL; -+ struct orc_entry *tmp_orc_table = NULL; -+ unsigned int *orc_ip_size = (unsigned int *)arg; -+ unsigned int num_entries = *orc_ip_size / sizeof(int); -+ unsigned int orc_size = num_entries * sizeof(struct orc_entry); -+ -+ idxs = (int *)malloc(*orc_ip_size); -+ if (!idxs) { -+ snprintf(g_err, ERRSTR_MAXSZ, "malloc idxs: %s", -+ strerror(errno)); -+ pthread_exit(g_err); -+ } -+ -+ tmp_orc_ip_table = (int *)malloc(*orc_ip_size); -+ if (!tmp_orc_ip_table) { -+ snprintf(g_err, ERRSTR_MAXSZ, "malloc tmp_orc_ip_table: %s", -+ strerror(errno)); -+ pthread_exit(g_err); -+ } -+ -+ tmp_orc_table = (struct orc_entry *)malloc(orc_size); -+ if (!tmp_orc_table) { -+ snprintf(g_err, ERRSTR_MAXSZ, "malloc tmp_orc_table: %s", -+ strerror(errno)); -+ pthread_exit(g_err); -+ } -+ -+ /* initialize indices array, convert ip_table to absolute address */ -+ for (i = 0; i < num_entries; i++) { -+ idxs[i] = i; -+ tmp_orc_ip_table[i] = g_orc_ip_table[i] + i * sizeof(int); -+ } -+ memcpy(tmp_orc_table, g_orc_table, orc_size); -+ -+ qsort(idxs, num_entries, sizeof(int), orc_sort_cmp); -+ -+ for (i = 0; i < num_entries; i++) { -+ if (idxs[i] == i) -+ continue; -+ -+ /* convert back to relative address */ -+ g_orc_ip_table[i] = tmp_orc_ip_table[idxs[i]] - i * sizeof(int); -+ g_orc_table[i] = tmp_orc_table[idxs[i]]; -+ } -+ -+ free(idxs); -+ free(tmp_orc_ip_table); -+ free(tmp_orc_table); -+ pthread_exit(NULL); -+} -+#endif -+ -+#ifdef MCOUNT_SORT_ENABLED -+static pthread_t mcount_sort_thread; -+ -+struct elf_mcount_loc { -+ Elf_Ehdr *ehdr; -+ Elf_Shdr *init_data_sec; -+ uint64_t start_mcount_loc; -+ uint64_t stop_mcount_loc; -+}; -+ -+/* Sort the addresses stored between __start_mcount_loc to __stop_mcount_loc in vmlinux */ -+static void *sort_mcount_loc(void *arg) -+{ -+ struct elf_mcount_loc *emloc = (struct elf_mcount_loc *)arg; -+ uint64_t offset = emloc->start_mcount_loc - shdr_addr(emloc->init_data_sec) -+ + shdr_offset(emloc->init_data_sec); -+ uint64_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; -+ unsigned char *start_loc = (void *)emloc->ehdr + offset; -+ -+ qsort(start_loc, count/long_size, long_size, compare_extable); -+ return NULL; -+} -+ -+/* Get the address of __start_mcount_loc and __stop_mcount_loc in System.map */ -+static void get_mcount_loc(uint64_t *_start, uint64_t *_stop) -+{ -+ FILE *file_start, *file_stop; -+ char start_buff[20]; -+ char stop_buff[20]; -+ int len = 0; -+ -+ file_start = popen(" grep start_mcount System.map | awk '{print $1}' ", "r"); -+ if (!file_start) { -+ fprintf(stderr, "get start_mcount_loc error!"); -+ return; -+ } -+ -+ file_stop = popen(" grep stop_mcount System.map | awk '{print $1}' ", "r"); -+ if (!file_stop) { -+ fprintf(stderr, "get stop_mcount_loc error!"); -+ pclose(file_start); -+ return; -+ } -+ -+ while (fgets(start_buff, sizeof(start_buff), file_start) != NULL) { -+ len = strlen(start_buff); -+ start_buff[len - 1] = '\0'; -+ } -+ *_start = strtoul(start_buff, NULL, 16); -+ -+ while (fgets(stop_buff, sizeof(stop_buff), file_stop) != NULL) { -+ len = strlen(stop_buff); -+ stop_buff[len - 1] = '\0'; -+ } -+ *_stop = strtoul(stop_buff, NULL, 16); -+ -+ pclose(file_start); -+ pclose(file_stop); -+} -+#endif -+static int do_sort(Elf_Ehdr *ehdr, -+ char const *const fname, -+ table_sort_t custom_sort) -+{ -+ int rc = -1; -+ Elf_Shdr *shdr_start; -+ Elf_Shdr *strtab_sec = NULL; -+ Elf_Shdr *symtab_sec = NULL; -+ Elf_Shdr *extab_sec = NULL; -+ Elf_Shdr *string_sec; -+ Elf_Sym *sym; -+ const Elf_Sym *symtab; -+ Elf32_Word *symtab_shndx = NULL; -+ Elf_Sym *sort_needed_sym = NULL; -+ Elf_Shdr *sort_needed_sec; -+ uint32_t *sort_needed_loc; -+ void *sym_start; -+ void *sym_end; -+ const char *secstrings; -+ const char *strtab; -+ char *extab_image; -+ int sort_need_index; -+ int symentsize; -+ int shentsize; -+ int idx; -+ int i; -+ unsigned int shnum; -+ unsigned int shstrndx; -+#ifdef MCOUNT_SORT_ENABLED -+ struct elf_mcount_loc mstruct = {0}; -+ uint64_t _start_mcount_loc = 0; -+ uint64_t _stop_mcount_loc = 0; -+#endif -+#ifdef UNWINDER_ORC_ENABLED -+ unsigned int orc_ip_size = 0; -+ unsigned int orc_size = 0; -+ unsigned int orc_num_entries = 0; -+#endif -+ -+ shdr_start = (Elf_Shdr *)((char *)ehdr + ehdr_shoff(ehdr)); -+ shentsize = ehdr_shentsize(ehdr); -+ -+ shstrndx = ehdr_shstrndx(ehdr); -+ if (shstrndx == SHN_XINDEX) -+ shstrndx = shdr_link(shdr_start); -+ string_sec = get_index(shdr_start, shentsize, shstrndx); -+ secstrings = (const char *)ehdr + shdr_offset(string_sec); -+ -+ shnum = ehdr_shnum(ehdr); -+ if (shnum == SHN_UNDEF) -+ shnum = shdr_size(shdr_start); -+ -+ for (i = 0; i < shnum; i++) { -+ Elf_Shdr *shdr = get_index(shdr_start, shentsize, i); -+ -+ idx = shdr_name(shdr); -+ if (!strcmp(secstrings + idx, "__ex_table")) -+ extab_sec = shdr; -+ if (!strcmp(secstrings + idx, ".symtab")) -+ symtab_sec = shdr; -+ if (!strcmp(secstrings + idx, ".strtab")) -+ strtab_sec = shdr; -+ -+ if (shdr_type(shdr) == SHT_SYMTAB_SHNDX) -+ symtab_shndx = (Elf32_Word *)((const char *)ehdr + -+ shdr_offset(shdr)); -+ -+#ifdef MCOUNT_SORT_ENABLED -+ /* locate the .init.data section in vmlinux */ -+ if (!strcmp(secstrings + idx, ".init.data")) { -+ get_mcount_loc(&_start_mcount_loc, &_stop_mcount_loc); -+ mstruct.ehdr = ehdr; -+ mstruct.init_data_sec = shdr; -+ mstruct.start_mcount_loc = _start_mcount_loc; -+ mstruct.stop_mcount_loc = _stop_mcount_loc; -+ } -+#endif -+ -+#ifdef UNWINDER_ORC_ENABLED -+ /* locate the ORC unwind tables */ -+ if (!strcmp(secstrings + idx, ".orc_unwind_ip")) { -+ orc_ip_size = shdr_size(shdr); -+ g_orc_ip_table = (int *)((void *)ehdr + -+ shdr_offset(shdr)); -+ } -+ if (!strcmp(secstrings + idx, ".orc_unwind")) { -+ orc_size = shdr_size(shdr); -+ g_orc_table = (struct orc_entry *)((void *)ehdr + -+ shdr_offset(shdr)); -+ } -+#endif -+ } /* for loop */ -+ -+#ifdef UNWINDER_ORC_ENABLED -+ if (!g_orc_ip_table || !g_orc_table) { -+ fprintf(stderr, -+ "incomplete ORC unwind tables in file: %s\n", fname); -+ goto out; -+ } -+ -+ orc_num_entries = orc_ip_size / sizeof(int); -+ if (orc_ip_size % sizeof(int) != 0 || -+ orc_size % sizeof(struct orc_entry) != 0 || -+ orc_num_entries != orc_size / sizeof(struct orc_entry)) { -+ fprintf(stderr, -+ "inconsistent ORC unwind table entries in file: %s\n", -+ fname); -+ goto out; -+ } -+ -+ /* create thread to sort ORC unwind tables concurrently */ -+ if (pthread_create(&orc_sort_thread, NULL, -+ sort_orctable, &orc_ip_size)) { -+ fprintf(stderr, -+ "pthread_create orc_sort_thread failed '%s': %s\n", -+ strerror(errno), fname); -+ goto out; -+ } -+#endif -+ -+#ifdef MCOUNT_SORT_ENABLED -+ if (!mstruct.init_data_sec || !_start_mcount_loc || !_stop_mcount_loc) { -+ fprintf(stderr, -+ "incomplete mcount's sort in file: %s\n", -+ fname); -+ goto out; -+ } -+ -+ /* create thread to sort mcount_loc concurrently */ -+ if (pthread_create(&mcount_sort_thread, NULL, &sort_mcount_loc, &mstruct)) { -+ fprintf(stderr, -+ "pthread_create mcount_sort_thread failed '%s': %s\n", -+ strerror(errno), fname); -+ goto out; -+ } -+#endif -+ if (!extab_sec) { -+ fprintf(stderr, "no __ex_table in file: %s\n", fname); -+ goto out; -+ } -+ -+ if (!symtab_sec) { -+ fprintf(stderr, "no .symtab in file: %s\n", fname); -+ goto out; -+ } -+ -+ if (!strtab_sec) { -+ fprintf(stderr, "no .strtab in file: %s\n", fname); -+ goto out; -+ } -+ -+ extab_image = (void *)ehdr + shdr_offset(extab_sec); -+ strtab = (const char *)ehdr + shdr_offset(strtab_sec); -+ symtab = (const Elf_Sym *)((const char *)ehdr + shdr_offset(symtab_sec)); -+ -+ if (custom_sort) { -+ custom_sort(extab_image, shdr_size(extab_sec)); -+ } else { -+ int num_entries = shdr_size(extab_sec) / extable_ent_size; -+ qsort(extab_image, num_entries, -+ extable_ent_size, compare_extable); -+ } -+ -+ /* find the flag main_extable_sort_needed */ -+ sym_start = (void *)ehdr + shdr_offset(symtab_sec); -+ sym_end = sym_start + shdr_size(symtab_sec); -+ symentsize = shdr_entsize(symtab_sec); -+ -+ for (sym = sym_start; (void *)sym + symentsize < sym_end; -+ sym = (void *)sym + symentsize) { -+ if (sym_type(sym) != STT_OBJECT) -+ continue; -+ if (!strcmp(strtab + sym_name(sym), -+ "main_extable_sort_needed")) { -+ sort_needed_sym = sym; -+ break; -+ } -+ } -+ -+ if (!sort_needed_sym) { -+ fprintf(stderr, -+ "no main_extable_sort_needed symbol in file: %s\n", -+ fname); -+ goto out; -+ } -+ -+ sort_need_index = get_secindex(sym_shndx(sym), -+ ((void *)sort_needed_sym - (void *)symtab) / symentsize, -+ symtab_shndx); -+ sort_needed_sec = get_index(shdr_start, shentsize, sort_need_index); -+ sort_needed_loc = (void *)ehdr + -+ shdr_offset(sort_needed_sec) + -+ sym_value(sort_needed_sym) - shdr_addr(sort_needed_sec); -+ -+ /* extable has been sorted, clear the flag */ -+ w(0, sort_needed_loc); -+ rc = 0; -+ -+out: -+#ifdef UNWINDER_ORC_ENABLED -+ if (orc_sort_thread) { -+ void *retval = NULL; -+ /* wait for ORC tables sort done */ -+ rc = pthread_join(orc_sort_thread, &retval); -+ if (rc) { -+ fprintf(stderr, -+ "pthread_join failed '%s': %s\n", -+ strerror(errno), fname); -+ } else if (retval) { -+ rc = -1; -+ fprintf(stderr, -+ "failed to sort ORC tables '%s': %s\n", -+ (char *)retval, fname); -+ } -+ } -+#endif -+ -+#ifdef MCOUNT_SORT_ENABLED -+ if (mcount_sort_thread) { -+ void *retval = NULL; -+ /* wait for mcount sort done */ -+ rc = pthread_join(mcount_sort_thread, &retval); -+ if (rc) { -+ fprintf(stderr, -+ "pthread_join failed '%s': %s\n", -+ strerror(errno), fname); -+ } else if (retval) { -+ rc = -1; -+ fprintf(stderr, -+ "failed to sort mcount '%s': %s\n", -+ (char *)retval, fname); -+ } -+ } -+#endif -+ return rc; -+} - - static int compare_relative_table(const void *a, const void *b) - { -@@ -399,7 +812,6 @@ static void sort_relative_table_with_data(char *extab_image, int image_size) - - static int do_file(char const *const fname, void *addr) - { -- int rc = -1; - Elf_Ehdr *ehdr = addr; - table_sort_t custom_sort = NULL; - -@@ -462,29 +874,64 @@ static int do_file(char const *const fname, void *addr) - r2(&ehdr->e32.e_shentsize) != sizeof(Elf32_Shdr)) { - fprintf(stderr, - "unrecognized ET_EXEC/ET_DYN file: %s\n", fname); -- break; -+ return -1; - } -- rc = do_sort_32(ehdr, fname, custom_sort); -+ -+ compare_extable = compare_extable_32; -+ ehdr_shoff = ehdr32_shoff; -+ ehdr_shentsize = ehdr32_shentsize; -+ ehdr_shstrndx = ehdr32_shstrndx; -+ ehdr_shnum = ehdr32_shnum; -+ shdr_addr = shdr32_addr; -+ shdr_offset = shdr32_offset; -+ shdr_link = shdr32_link; -+ shdr_size = shdr32_size; -+ shdr_name = shdr32_name; -+ shdr_type = shdr32_type; -+ shdr_entsize = shdr32_entsize; -+ sym_type = sym32_type; -+ sym_name = sym32_name; -+ sym_value = sym32_value; -+ sym_shndx = sym32_shndx; -+ long_size = 4; -+ extable_ent_size = 8; - break; - case ELFCLASS64: -- { - if (r2(&ehdr->e64.e_ehsize) != sizeof(Elf64_Ehdr) || - r2(&ehdr->e64.e_shentsize) != sizeof(Elf64_Shdr)) { - fprintf(stderr, - "unrecognized ET_EXEC/ET_DYN file: %s\n", - fname); -- break; -- } -- rc = do_sort_64(ehdr, fname, custom_sort); -+ return -1; - } -+ -+ compare_extable = compare_extable_64; -+ ehdr_shoff = ehdr64_shoff; -+ ehdr_shentsize = ehdr64_shentsize; -+ ehdr_shstrndx = ehdr64_shstrndx; -+ ehdr_shnum = ehdr64_shnum; -+ shdr_addr = shdr64_addr; -+ shdr_offset = shdr64_offset; -+ shdr_link = shdr64_link; -+ shdr_size = shdr64_size; -+ shdr_name = shdr64_name; -+ shdr_type = shdr64_type; -+ shdr_entsize = shdr64_entsize; -+ sym_type = sym64_type; -+ sym_name = sym64_name; -+ sym_value = sym64_value; -+ sym_shndx = sym64_shndx; -+ long_size = 8; -+ extable_ent_size = 16; -+ - break; - default: - fprintf(stderr, "unrecognized ELF class %d %s\n", - ehdr->e32.e_ident[EI_CLASS], fname); -- break; -+ return -1; - } - -- return rc; -+ return do_sort(ehdr, fname, custom_sort); - } - - int main(int argc, char *argv[]) -diff --git a/scripts/sorttable.h b/scripts/sorttable.h -deleted file mode 100644 -index 17a8541a10d6..000000000000 ---- a/scripts/sorttable.h -+++ /dev/null -@@ -1,485 +0,0 @@ --/* SPDX-License-Identifier: GPL-2.0-only */ --/* -- * sorttable.h -- * -- * Added ORC unwind tables sort support and other updates: -- * Copyright (C) 1999-2019 Alibaba Group Holding Limited. by: -- * Shile Zhang -- * -- * Copyright 2011 - 2012 Cavium, Inc. -- * -- * Some of code was taken out of arch/x86/kernel/unwind_orc.c, written by: -- * Copyright (C) 2017 Josh Poimboeuf -- * -- * Some of this code was taken out of recordmcount.h written by: -- * -- * Copyright 2009 John F. Reiser . All rights reserved. -- * Copyright 2010 Steven Rostedt , Red Hat Inc. -- */ -- --#undef extable_ent_size --#undef compare_extable --#undef get_mcount_loc --#undef sort_mcount_loc --#undef elf_mcount_loc --#undef do_sort --#undef ehdr_shoff --#undef ehdr_shentsize --#undef ehdr_shstrndx --#undef ehdr_shnum --#undef shdr_addr --#undef shdr_offset --#undef shdr_link --#undef shdr_size --#undef shdr_name --#undef shdr_type --#undef shdr_entsize --#undef sym_type --#undef sym_name --#undef sym_value --#undef sym_shndx --#undef long_size -- --#ifdef SORTTABLE_64 --# define extable_ent_size 16 --# define compare_extable compare_extable_64 --# define get_mcount_loc get_mcount_loc_64 --# define sort_mcount_loc sort_mcount_loc_64 --# define elf_mcount_loc elf_mcount_loc_64 --# define do_sort do_sort_64 --# define ehdr_shoff ehdr64_shoff --# define ehdr_shentsize ehdr64_shentsize --# define ehdr_shstrndx ehdr64_shstrndx --# define ehdr_shnum ehdr64_shnum --# define shdr_addr shdr64_addr --# define shdr_offset shdr64_offset --# define shdr_link shdr64_link --# define shdr_size shdr64_size --# define shdr_name shdr64_name --# define shdr_type shdr64_type --# define shdr_entsize shdr64_entsize --# define sym_type sym64_type --# define sym_name sym64_name --# define sym_value sym64_value --# define sym_shndx sym64_shndx --# define long_size 8 --#else --# define extable_ent_size 8 --# define compare_extable compare_extable_32 --# define get_mcount_loc get_mcount_loc_32 --# define sort_mcount_loc sort_mcount_loc_32 --# define elf_mcount_loc elf_mcount_loc_32 --# define do_sort do_sort_32 --# define ehdr_shoff ehdr32_shoff --# define ehdr_shentsize ehdr32_shentsize --# define ehdr_shstrndx ehdr32_shstrndx --# define ehdr_shnum ehdr32_shnum --# define shdr_addr shdr32_addr --# define shdr_offset shdr32_offset --# define shdr_link shdr32_link --# define shdr_size shdr32_size --# define shdr_name shdr32_name --# define shdr_type shdr32_type --# define shdr_entsize shdr32_entsize --# define sym_type sym32_type --# define sym_name sym32_name --# define sym_value sym32_value --# define sym_shndx sym32_shndx --# define long_size 4 --#endif -- --#if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) --/* ORC unwinder only support X86_64 */ --#include -- --#define ERRSTR_MAXSZ 256 -- --char g_err[ERRSTR_MAXSZ]; --int *g_orc_ip_table; --struct orc_entry *g_orc_table; -- --pthread_t orc_sort_thread; -- --static inline unsigned long orc_ip(const int *ip) --{ -- return (unsigned long)ip + *ip; --} -- --static int orc_sort_cmp(const void *_a, const void *_b) --{ -- struct orc_entry *orc_a, *orc_b; -- const int *a = g_orc_ip_table + *(int *)_a; -- const int *b = g_orc_ip_table + *(int *)_b; -- unsigned long a_val = orc_ip(a); -- unsigned long b_val = orc_ip(b); -- -- if (a_val > b_val) -- return 1; -- if (a_val < b_val) -- return -1; -- -- /* -- * The "weak" section terminator entries need to always be on the left -- * to ensure the lookup code skips them in favor of real entries. -- * These terminator entries exist to handle any gaps created by -- * whitelisted .o files which didn't get objtool generation. -- */ -- orc_a = g_orc_table + (a - g_orc_ip_table); -- orc_b = g_orc_table + (b - g_orc_ip_table); -- if (orc_a->type == ORC_TYPE_UNDEFINED && orc_b->type == ORC_TYPE_UNDEFINED) -- return 0; -- return orc_a->type == ORC_TYPE_UNDEFINED ? -1 : 1; --} -- --static void *sort_orctable(void *arg) --{ -- int i; -- int *idxs = NULL; -- int *tmp_orc_ip_table = NULL; -- struct orc_entry *tmp_orc_table = NULL; -- unsigned int *orc_ip_size = (unsigned int *)arg; -- unsigned int num_entries = *orc_ip_size / sizeof(int); -- unsigned int orc_size = num_entries * sizeof(struct orc_entry); -- -- idxs = (int *)malloc(*orc_ip_size); -- if (!idxs) { -- snprintf(g_err, ERRSTR_MAXSZ, "malloc idxs: %s", -- strerror(errno)); -- pthread_exit(g_err); -- } -- -- tmp_orc_ip_table = (int *)malloc(*orc_ip_size); -- if (!tmp_orc_ip_table) { -- snprintf(g_err, ERRSTR_MAXSZ, "malloc tmp_orc_ip_table: %s", -- strerror(errno)); -- pthread_exit(g_err); -- } -- -- tmp_orc_table = (struct orc_entry *)malloc(orc_size); -- if (!tmp_orc_table) { -- snprintf(g_err, ERRSTR_MAXSZ, "malloc tmp_orc_table: %s", -- strerror(errno)); -- pthread_exit(g_err); -- } -- -- /* initialize indices array, convert ip_table to absolute address */ -- for (i = 0; i < num_entries; i++) { -- idxs[i] = i; -- tmp_orc_ip_table[i] = g_orc_ip_table[i] + i * sizeof(int); -- } -- memcpy(tmp_orc_table, g_orc_table, orc_size); -- -- qsort(idxs, num_entries, sizeof(int), orc_sort_cmp); -- -- for (i = 0; i < num_entries; i++) { -- if (idxs[i] == i) -- continue; -- -- /* convert back to relative address */ -- g_orc_ip_table[i] = tmp_orc_ip_table[idxs[i]] - i * sizeof(int); -- g_orc_table[i] = tmp_orc_table[idxs[i]]; -- } -- -- free(idxs); -- free(tmp_orc_ip_table); -- free(tmp_orc_table); -- pthread_exit(NULL); --} --#endif -- --#ifdef MCOUNT_SORT_ENABLED --pthread_t mcount_sort_thread; -- --struct elf_mcount_loc { -- Elf_Ehdr *ehdr; -- Elf_Shdr *init_data_sec; -- uint64_t start_mcount_loc; -- uint64_t stop_mcount_loc; --}; -- --/* Sort the addresses stored between __start_mcount_loc to __stop_mcount_loc in vmlinux */ --static void *sort_mcount_loc(void *arg) --{ -- struct elf_mcount_loc *emloc = (struct elf_mcount_loc *)arg; -- uint64_t offset = emloc->start_mcount_loc - shdr_addr(emloc->init_data_sec) -- + shdr_offset(emloc->init_data_sec); -- uint64_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; -- unsigned char *start_loc = (void *)emloc->ehdr + offset; -- -- qsort(start_loc, count/long_size, long_size, compare_extable); -- return NULL; --} -- --/* Get the address of __start_mcount_loc and __stop_mcount_loc in System.map */ --static void get_mcount_loc(uint64_t *_start, uint64_t *_stop) --{ -- FILE *file_start, *file_stop; -- char start_buff[20]; -- char stop_buff[20]; -- int len = 0; -- -- file_start = popen(" grep start_mcount System.map | awk '{print $1}' ", "r"); -- if (!file_start) { -- fprintf(stderr, "get start_mcount_loc error!"); -- return; -- } -- -- file_stop = popen(" grep stop_mcount System.map | awk '{print $1}' ", "r"); -- if (!file_stop) { -- fprintf(stderr, "get stop_mcount_loc error!"); -- pclose(file_start); -- return; -- } -- -- while (fgets(start_buff, sizeof(start_buff), file_start) != NULL) { -- len = strlen(start_buff); -- start_buff[len - 1] = '\0'; -- } -- *_start = strtoul(start_buff, NULL, 16); -- -- while (fgets(stop_buff, sizeof(stop_buff), file_stop) != NULL) { -- len = strlen(stop_buff); -- stop_buff[len - 1] = '\0'; -- } -- *_stop = strtoul(stop_buff, NULL, 16); -- -- pclose(file_start); -- pclose(file_stop); --} --#endif --static int do_sort(Elf_Ehdr *ehdr, -- char const *const fname, -- table_sort_t custom_sort) --{ -- int rc = -1; -- Elf_Shdr *shdr_start; -- Elf_Shdr *strtab_sec = NULL; -- Elf_Shdr *symtab_sec = NULL; -- Elf_Shdr *extab_sec = NULL; -- Elf_Shdr *string_sec; -- Elf_Sym *sym; -- const Elf_Sym *symtab; -- Elf32_Word *symtab_shndx = NULL; -- Elf_Sym *sort_needed_sym = NULL; -- Elf_Shdr *sort_needed_sec; -- uint32_t *sort_needed_loc; -- void *sym_start; -- void *sym_end; -- const char *secstrings; -- const char *strtab; -- char *extab_image; -- int sort_need_index; -- int symentsize; -- int shentsize; -- int idx; -- int i; -- unsigned int shnum; -- unsigned int shstrndx; --#ifdef MCOUNT_SORT_ENABLED -- struct elf_mcount_loc mstruct = {0}; -- uint64_t _start_mcount_loc = 0; -- uint64_t _stop_mcount_loc = 0; --#endif --#if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -- unsigned int orc_ip_size = 0; -- unsigned int orc_size = 0; -- unsigned int orc_num_entries = 0; --#endif -- -- shdr_start = (Elf_Shdr *)((char *)ehdr + ehdr_shoff(ehdr)); -- shentsize = ehdr_shentsize(ehdr); -- -- shstrndx = ehdr_shstrndx(ehdr); -- if (shstrndx == SHN_XINDEX) -- shstrndx = shdr_link(shdr_start); -- string_sec = get_index(shdr_start, shentsize, shstrndx); -- secstrings = (const char *)ehdr + shdr_offset(string_sec); -- -- shnum = ehdr_shnum(ehdr); -- if (shnum == SHN_UNDEF) -- shnum = shdr_size(shdr_start); -- -- for (i = 0; i < shnum; i++) { -- Elf_Shdr *shdr = get_index(shdr_start, shentsize, i); -- -- idx = shdr_name(shdr); -- if (!strcmp(secstrings + idx, "__ex_table")) -- extab_sec = shdr; -- if (!strcmp(secstrings + idx, ".symtab")) -- symtab_sec = shdr; -- if (!strcmp(secstrings + idx, ".strtab")) -- strtab_sec = shdr; -- -- if (shdr_type(shdr) == SHT_SYMTAB_SHNDX) -- symtab_shndx = (Elf32_Word *)((const char *)ehdr + -- shdr_offset(shdr)); -- --#ifdef MCOUNT_SORT_ENABLED -- /* locate the .init.data section in vmlinux */ -- if (!strcmp(secstrings + idx, ".init.data")) { -- get_mcount_loc(&_start_mcount_loc, &_stop_mcount_loc); -- mstruct.ehdr = ehdr; -- mstruct.init_data_sec = shdr; -- mstruct.start_mcount_loc = _start_mcount_loc; -- mstruct.stop_mcount_loc = _stop_mcount_loc; -- } --#endif -- --#if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -- /* locate the ORC unwind tables */ -- if (!strcmp(secstrings + idx, ".orc_unwind_ip")) { -- orc_ip_size = shdr_size(shdr); -- g_orc_ip_table = (int *)((void *)ehdr + -- shdr_offset(shdr)); -- } -- if (!strcmp(secstrings + idx, ".orc_unwind")) { -- orc_size = shdr_size(shdr); -- g_orc_table = (struct orc_entry *)((void *)ehdr + -- shdr_offset(shdr)); -- } --#endif -- } /* for loop */ -- --#if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -- if (!g_orc_ip_table || !g_orc_table) { -- fprintf(stderr, -- "incomplete ORC unwind tables in file: %s\n", fname); -- goto out; -- } -- -- orc_num_entries = orc_ip_size / sizeof(int); -- if (orc_ip_size % sizeof(int) != 0 || -- orc_size % sizeof(struct orc_entry) != 0 || -- orc_num_entries != orc_size / sizeof(struct orc_entry)) { -- fprintf(stderr, -- "inconsistent ORC unwind table entries in file: %s\n", -- fname); -- goto out; -- } -- -- /* create thread to sort ORC unwind tables concurrently */ -- if (pthread_create(&orc_sort_thread, NULL, -- sort_orctable, &orc_ip_size)) { -- fprintf(stderr, -- "pthread_create orc_sort_thread failed '%s': %s\n", -- strerror(errno), fname); -- goto out; -- } --#endif -- --#ifdef MCOUNT_SORT_ENABLED -- if (!mstruct.init_data_sec || !_start_mcount_loc || !_stop_mcount_loc) { -- fprintf(stderr, -- "incomplete mcount's sort in file: %s\n", -- fname); -- goto out; -- } -- -- /* create thread to sort mcount_loc concurrently */ -- if (pthread_create(&mcount_sort_thread, NULL, &sort_mcount_loc, &mstruct)) { -- fprintf(stderr, -- "pthread_create mcount_sort_thread failed '%s': %s\n", -- strerror(errno), fname); -- goto out; -- } --#endif -- if (!extab_sec) { -- fprintf(stderr, "no __ex_table in file: %s\n", fname); -- goto out; -- } -- -- if (!symtab_sec) { -- fprintf(stderr, "no .symtab in file: %s\n", fname); -- goto out; -- } -- -- if (!strtab_sec) { -- fprintf(stderr, "no .strtab in file: %s\n", fname); -- goto out; -- } -- -- extab_image = (void *)ehdr + shdr_offset(extab_sec); -- strtab = (const char *)ehdr + shdr_offset(strtab_sec); -- symtab = (const Elf_Sym *)((const char *)ehdr + shdr_offset(symtab_sec)); -- -- if (custom_sort) { -- custom_sort(extab_image, shdr_size(extab_sec)); -- } else { -- int num_entries = shdr_size(extab_sec) / extable_ent_size; -- qsort(extab_image, num_entries, -- extable_ent_size, compare_extable); -- } -- -- /* find the flag main_extable_sort_needed */ -- sym_start = (void *)ehdr + shdr_offset(symtab_sec); -- sym_end = sym_start + shdr_size(symtab_sec); -- symentsize = shdr_entsize(symtab_sec); -- -- for (sym = sym_start; (void *)sym + symentsize < sym_end; -- sym = (void *)sym + symentsize) { -- if (sym_type(sym) != STT_OBJECT) -- continue; -- if (!strcmp(strtab + sym_name(sym), -- "main_extable_sort_needed")) { -- sort_needed_sym = sym; -- break; -- } -- } -- -- if (!sort_needed_sym) { -- fprintf(stderr, -- "no main_extable_sort_needed symbol in file: %s\n", -- fname); -- goto out; -- } -- -- sort_need_index = get_secindex(sym_shndx(sym), -- ((void *)sort_needed_sym - (void *)symtab) / symentsize, -- symtab_shndx); -- sort_needed_sec = get_index(shdr_start, shentsize, sort_need_index); -- sort_needed_loc = (void *)ehdr + -- shdr_offset(sort_needed_sec) + -- sym_value(sort_needed_sym) - shdr_addr(sort_needed_sec); -- -- /* extable has been sorted, clear the flag */ -- w(0, sort_needed_loc); -- rc = 0; -- --out: --#if defined(SORTTABLE_64) && defined(UNWINDER_ORC_ENABLED) -- if (orc_sort_thread) { -- void *retval = NULL; -- /* wait for ORC tables sort done */ -- rc = pthread_join(orc_sort_thread, &retval); -- if (rc) { -- fprintf(stderr, -- "pthread_join failed '%s': %s\n", -- strerror(errno), fname); -- } else if (retval) { -- rc = -1; -- fprintf(stderr, -- "failed to sort ORC tables '%s': %s\n", -- (char *)retval, fname); -- } -- } --#endif -- --#ifdef MCOUNT_SORT_ENABLED -- if (mcount_sort_thread) { -- void *retval = NULL; -- /* wait for mcount sort done */ -- rc = pthread_join(mcount_sort_thread, &retval); -- if (rc) { -- fprintf(stderr, -- "pthread_join failed '%s': %s\n", -- strerror(errno), fname); -- } else if (retval) { -- rc = -1; -- fprintf(stderr, -- "failed to sort mcount '%s': %s\n", -- (char *)retval, fname); -- } -- } --#endif -- return rc; --} --- -2.50.1 (Apple Git-155) - diff --git a/1338-scripts-sorttable-get-start-stop-mcount-loc-from-elf-file-di.patch b/1338-scripts-sorttable-get-start-stop-mcount-loc-from-elf-file-di.patch deleted file mode 100644 index 12e798419..000000000 --- a/1338-scripts-sorttable-get-start-stop-mcount-loc-from-elf-file-di.patch +++ /dev/null @@ -1,196 +0,0 @@ -From 0e6fd4e629cfcaf1a4f04e2c9e39e8b5776890a2 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:36:32 +0200 -Subject: [PATCH] scripts/sorttable: Get start/stop_mcount_loc from ELF file - directly - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 4acda8edefa1ce66d3de845f1c12745721cd14c3 -Author: Steven Rostedt -Date: Sun Jan 5 11:22:25 2025 -0500 - - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - - The get_mcount_loc() does a cheesy trick to find the start_mcount_loc and - stop_mcount_loc values. That trick is: - - file_start = popen(" grep start_mcount System.map | awk '{print $1}' ", "r"); - - and - - file_stop = popen(" grep stop_mcount System.map | awk '{print $1}' ", "r"); - - Those values are stored in the Elf symbol table. Use that to capture those - values. Using the symbol table is more efficient and more robust. The - above could fail if another variable had "start_mcount" or "stop_mcount" - as part of its name. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Link: https://lore.kernel.org/20250105162346.817157047@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index ff9b60fc0dd8..656c1e9b5ad9 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -472,42 +472,41 @@ static void *sort_mcount_loc(void *arg) - } - - /* Get the address of __start_mcount_loc and __stop_mcount_loc in System.map */ --static void get_mcount_loc(uint64_t *_start, uint64_t *_stop) -+static void get_mcount_loc(struct elf_mcount_loc *emloc, Elf_Shdr *symtab_sec, -+ const char *strtab) - { -- FILE *file_start, *file_stop; -- char start_buff[20]; -- char stop_buff[20]; -- int len = 0; -+ Elf_Sym *sym, *end_sym; -+ int symentsize = shdr_entsize(symtab_sec); -+ int found = 0; -+ -+ sym = (void *)emloc->ehdr + shdr_offset(symtab_sec); -+ end_sym = (void *)sym + shdr_size(symtab_sec); -+ -+ while (sym < end_sym) { -+ if (!strcmp(strtab + sym_name(sym), "__start_mcount_loc")) { -+ emloc->start_mcount_loc = sym_value(sym); -+ if (++found == 2) -+ break; -+ } else if (!strcmp(strtab + sym_name(sym), "__stop_mcount_loc")) { -+ emloc->stop_mcount_loc = sym_value(sym); -+ if (++found == 2) -+ break; -+ } -+ sym = (void *)sym + symentsize; -+ } - -- file_start = popen(" grep start_mcount System.map | awk '{print $1}' ", "r"); -- if (!file_start) { -+ if (!emloc->start_mcount_loc) { - fprintf(stderr, "get start_mcount_loc error!"); - return; - } - -- file_stop = popen(" grep stop_mcount System.map | awk '{print $1}' ", "r"); -- if (!file_stop) { -+ if (!emloc->stop_mcount_loc) { - fprintf(stderr, "get stop_mcount_loc error!"); -- pclose(file_start); - return; - } -- -- while (fgets(start_buff, sizeof(start_buff), file_start) != NULL) { -- len = strlen(start_buff); -- start_buff[len - 1] = '\0'; -- } -- *_start = strtoul(start_buff, NULL, 16); -- -- while (fgets(stop_buff, sizeof(stop_buff), file_stop) != NULL) { -- len = strlen(stop_buff); -- stop_buff[len - 1] = '\0'; -- } -- *_stop = strtoul(stop_buff, NULL, 16); -- -- pclose(file_start); -- pclose(file_stop); - } - #endif -+ - static int do_sort(Elf_Ehdr *ehdr, - char const *const fname, - table_sort_t custom_sort) -@@ -538,8 +537,6 @@ static int do_sort(Elf_Ehdr *ehdr, - unsigned int shstrndx; - #ifdef MCOUNT_SORT_ENABLED - struct elf_mcount_loc mstruct = {0}; -- uint64_t _start_mcount_loc = 0; -- uint64_t _stop_mcount_loc = 0; - #endif - #ifdef UNWINDER_ORC_ENABLED - unsigned int orc_ip_size = 0; -@@ -577,13 +574,8 @@ static int do_sort(Elf_Ehdr *ehdr, - - #ifdef MCOUNT_SORT_ENABLED - /* locate the .init.data section in vmlinux */ -- if (!strcmp(secstrings + idx, ".init.data")) { -- get_mcount_loc(&_start_mcount_loc, &_stop_mcount_loc); -- mstruct.ehdr = ehdr; -+ if (!strcmp(secstrings + idx, ".init.data")) - mstruct.init_data_sec = shdr; -- mstruct.start_mcount_loc = _start_mcount_loc; -- mstruct.stop_mcount_loc = _stop_mcount_loc; -- } - #endif - - #ifdef UNWINDER_ORC_ENABLED -@@ -627,23 +619,6 @@ static int do_sort(Elf_Ehdr *ehdr, - goto out; - } - #endif -- --#ifdef MCOUNT_SORT_ENABLED -- if (!mstruct.init_data_sec || !_start_mcount_loc || !_stop_mcount_loc) { -- fprintf(stderr, -- "incomplete mcount's sort in file: %s\n", -- fname); -- goto out; -- } -- -- /* create thread to sort mcount_loc concurrently */ -- if (pthread_create(&mcount_sort_thread, NULL, &sort_mcount_loc, &mstruct)) { -- fprintf(stderr, -- "pthread_create mcount_sort_thread failed '%s': %s\n", -- strerror(errno), fname); -- goto out; -- } --#endif - if (!extab_sec) { - fprintf(stderr, "no __ex_table in file: %s\n", fname); - goto out; -@@ -663,6 +638,26 @@ static int do_sort(Elf_Ehdr *ehdr, - strtab = (const char *)ehdr + shdr_offset(strtab_sec); - symtab = (const Elf_Sym *)((const char *)ehdr + shdr_offset(symtab_sec)); - -+#ifdef MCOUNT_SORT_ENABLED -+ mstruct.ehdr = ehdr; -+ get_mcount_loc(&mstruct, symtab_sec, strtab); -+ -+ if (!mstruct.init_data_sec || !mstruct.start_mcount_loc || !mstruct.stop_mcount_loc) { -+ fprintf(stderr, -+ "incomplete mcount's sort in file: %s\n", -+ fname); -+ goto out; -+ } -+ -+ /* create thread to sort mcount_loc concurrently */ -+ if (pthread_create(&mcount_sort_thread, NULL, &sort_mcount_loc, &mstruct)) { -+ fprintf(stderr, -+ "pthread_create mcount_sort_thread failed '%s': %s\n", -+ strerror(errno), fname); -+ goto out; -+ } -+#endif -+ - if (custom_sort) { - custom_sort(extab_image, shdr_size(extab_sec)); - } else { --- -2.50.1 (Apple Git-155) - diff --git a/1339-scripts-sorttable-use-a-structure-of-function-pointers-for-e.patch b/1339-scripts-sorttable-use-a-structure-of-function-pointers-for-e.patch deleted file mode 100644 index d865eab1c..000000000 --- a/1339-scripts-sorttable-use-a-structure-of-function-pointers-for-e.patch +++ /dev/null @@ -1,327 +0,0 @@ -From 1ca873e533dd7f3f3abd7518a7c356fa7bb6ef91 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:52:42 +0200 -Subject: [PATCH] scripts/sorttable: Use a structure of function pointers for - elf helpers - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 1e5f6771c247b28135307058d2cfe3b0153733dc -Author: Steven Rostedt -Date: Fri Jan 10 07:54:59 2025 -0500 - - scripts/sorttable: Use a structure of function pointers for elf helpers - - Instead of having a series of function pointers that gets assigned to the - Elf64 or Elf32 versions, put them all into a single structure and use - that. Add the helper function that chooses the structure into the macros - that build the different versions of the elf functions. - - Link: https://lore.kernel.org/all/CAHk-=wiafEyX7UgOeZgvd6fvuByE5WXUPh9599kwOc_d-pdeug@mail.gmail.com/ - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Stephen Rothwell - Link: https://lore.kernel.org/20250110075459.13d4b94c@gandalf.local.home - Suggested-by: Linus Torvalds - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 656c1e9b5ad9..9f41575afd7a 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -85,6 +85,25 @@ static uint64_t (*r8)(const uint64_t *); - static void (*w)(uint32_t, uint32_t *); - typedef void (*table_sort_t)(char *, int); - -+static struct elf_funcs { -+ int (*compare_extable)(const void *a, const void *b); -+ uint64_t (*ehdr_shoff)(Elf_Ehdr *ehdr); -+ uint16_t (*ehdr_shstrndx)(Elf_Ehdr *ehdr); -+ uint16_t (*ehdr_shentsize)(Elf_Ehdr *ehdr); -+ uint16_t (*ehdr_shnum)(Elf_Ehdr *ehdr); -+ uint64_t (*shdr_addr)(Elf_Shdr *shdr); -+ uint64_t (*shdr_offset)(Elf_Shdr *shdr); -+ uint64_t (*shdr_size)(Elf_Shdr *shdr); -+ uint64_t (*shdr_entsize)(Elf_Shdr *shdr); -+ uint32_t (*shdr_link)(Elf_Shdr *shdr); -+ uint32_t (*shdr_name)(Elf_Shdr *shdr); -+ uint32_t (*shdr_type)(Elf_Shdr *shdr); -+ uint8_t (*sym_type)(Elf_Sym *sym); -+ uint32_t (*sym_name)(Elf_Sym *sym); -+ uint64_t (*sym_value)(Elf_Sym *sym); -+ uint16_t (*sym_shndx)(Elf_Sym *sym); -+} e; -+ - static uint64_t ehdr64_shoff(Elf_Ehdr *ehdr) - { - return r8(&ehdr->e64.e_shoff); -@@ -95,6 +114,11 @@ static uint64_t ehdr32_shoff(Elf_Ehdr *ehdr) - return r(&ehdr->e32.e_shoff); - } - -+static uint64_t ehdr_shoff(Elf_Ehdr *ehdr) -+{ -+ return e.ehdr_shoff(ehdr); -+} -+ - #define EHDR_HALF(fn_name) \ - static uint16_t ehdr64_##fn_name(Elf_Ehdr *ehdr) \ - { \ -@@ -104,6 +128,11 @@ static uint16_t ehdr64_##fn_name(Elf_Ehdr *ehdr) \ - static uint16_t ehdr32_##fn_name(Elf_Ehdr *ehdr) \ - { \ - return r2(&ehdr->e32.e_##fn_name); \ -+} \ -+ \ -+static uint16_t ehdr_##fn_name(Elf_Ehdr *ehdr) \ -+{ \ -+ return e.ehdr_##fn_name(ehdr); \ - } - - EHDR_HALF(shentsize) -@@ -119,6 +148,11 @@ static uint32_t shdr64_##fn_name(Elf_Shdr *shdr) \ - static uint32_t shdr32_##fn_name(Elf_Shdr *shdr) \ - { \ - return r(&shdr->e32.sh_##fn_name); \ -+} \ -+ \ -+static uint32_t shdr_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return e.shdr_##fn_name(shdr); \ - } - - #define SHDR_ADDR(fn_name) \ -@@ -130,6 +164,11 @@ static uint64_t shdr64_##fn_name(Elf_Shdr *shdr) \ - static uint64_t shdr32_##fn_name(Elf_Shdr *shdr) \ - { \ - return r(&shdr->e32.sh_##fn_name); \ -+} \ -+ \ -+static uint64_t shdr_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return e.shdr_##fn_name(shdr); \ - } - - #define SHDR_WORD(fn_name) \ -@@ -141,6 +180,10 @@ static uint32_t shdr64_##fn_name(Elf_Shdr *shdr) \ - static uint32_t shdr32_##fn_name(Elf_Shdr *shdr) \ - { \ - return r(&shdr->e32.sh_##fn_name); \ -+} \ -+static uint32_t shdr_##fn_name(Elf_Shdr *shdr) \ -+{ \ -+ return e.shdr_##fn_name(shdr); \ - } - - SHDR_ADDR(addr) -@@ -161,6 +204,11 @@ static uint64_t sym64_##fn_name(Elf_Sym *sym) \ - static uint64_t sym32_##fn_name(Elf_Sym *sym) \ - { \ - return r(&sym->e32.st_##fn_name); \ -+} \ -+ \ -+static uint64_t sym_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return e.sym_##fn_name(sym); \ - } - - #define SYM_WORD(fn_name) \ -@@ -172,6 +220,11 @@ static uint32_t sym64_##fn_name(Elf_Sym *sym) \ - static uint32_t sym32_##fn_name(Elf_Sym *sym) \ - { \ - return r(&sym->e32.st_##fn_name); \ -+} \ -+ \ -+static uint32_t sym_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return e.sym_##fn_name(sym); \ - } - - #define SYM_HALF(fn_name) \ -@@ -183,6 +236,11 @@ static uint16_t sym64_##fn_name(Elf_Sym *sym) \ - static uint16_t sym32_##fn_name(Elf_Sym *sym) \ - { \ - return r2(&sym->e32.st_##fn_name); \ -+} \ -+ \ -+static uint16_t sym_##fn_name(Elf_Sym *sym) \ -+{ \ -+ return e.sym_##fn_name(sym); \ - } - - static uint8_t sym64_type(Elf_Sym *sym) -@@ -195,6 +253,11 @@ static uint8_t sym32_type(Elf_Sym *sym) - return ELF32_ST_TYPE(sym->e32.st_info); - } - -+static uint8_t sym_type(Elf_Sym *sym) -+{ -+ return e.sym_type(sym); -+} -+ - SYM_ADDR(value) - SYM_WORD(name) - SYM_HALF(shndx) -@@ -322,29 +385,16 @@ static int compare_extable_64(const void *a, const void *b) - return av > bv; - } - -+static int compare_extable(const void *a, const void *b) -+{ -+ return e.compare_extable(a, b); -+} -+ - static inline void *get_index(void *start, int entsize, int index) - { - return start + (entsize * index); - } - -- --static int (*compare_extable)(const void *a, const void *b); --static uint64_t (*ehdr_shoff)(Elf_Ehdr *ehdr); --static uint16_t (*ehdr_shstrndx)(Elf_Ehdr *ehdr); --static uint16_t (*ehdr_shentsize)(Elf_Ehdr *ehdr); --static uint16_t (*ehdr_shnum)(Elf_Ehdr *ehdr); --static uint64_t (*shdr_addr)(Elf_Shdr *shdr); --static uint64_t (*shdr_offset)(Elf_Shdr *shdr); --static uint64_t (*shdr_size)(Elf_Shdr *shdr); --static uint64_t (*shdr_entsize)(Elf_Shdr *shdr); --static uint32_t (*shdr_link)(Elf_Shdr *shdr); --static uint32_t (*shdr_name)(Elf_Shdr *shdr); --static uint32_t (*shdr_type)(Elf_Shdr *shdr); --static uint8_t (*sym_type)(Elf_Sym *sym); --static uint32_t (*sym_name)(Elf_Sym *sym); --static uint64_t (*sym_value)(Elf_Sym *sym); --static uint16_t (*sym_shndx)(Elf_Sym *sym); -- - static int extable_ent_size; - static int long_size; - -@@ -864,7 +914,30 @@ static int do_file(char const *const fname, void *addr) - } - - switch (ehdr->e32.e_ident[EI_CLASS]) { -- case ELFCLASS32: -+ case ELFCLASS32: { -+ struct elf_funcs efuncs = { -+ .compare_extable = compare_extable_32, -+ .ehdr_shoff = ehdr32_shoff, -+ .ehdr_shentsize = ehdr32_shentsize, -+ .ehdr_shstrndx = ehdr32_shstrndx, -+ .ehdr_shnum = ehdr32_shnum, -+ .shdr_addr = shdr32_addr, -+ .shdr_offset = shdr32_offset, -+ .shdr_link = shdr32_link, -+ .shdr_size = shdr32_size, -+ .shdr_name = shdr32_name, -+ .shdr_type = shdr32_type, -+ .shdr_entsize = shdr32_entsize, -+ .sym_type = sym32_type, -+ .sym_name = sym32_name, -+ .sym_value = sym32_value, -+ .sym_shndx = sym32_shndx, -+ }; -+ -+ e = efuncs; -+ long_size = 4; -+ extable_ent_size = 8; -+ - if (r2(&ehdr->e32.e_ehsize) != sizeof(Elf32_Ehdr) || - r2(&ehdr->e32.e_shentsize) != sizeof(Elf32_Shdr)) { - fprintf(stderr, -@@ -872,26 +945,32 @@ static int do_file(char const *const fname, void *addr) - return -1; - } - -- compare_extable = compare_extable_32; -- ehdr_shoff = ehdr32_shoff; -- ehdr_shentsize = ehdr32_shentsize; -- ehdr_shstrndx = ehdr32_shstrndx; -- ehdr_shnum = ehdr32_shnum; -- shdr_addr = shdr32_addr; -- shdr_offset = shdr32_offset; -- shdr_link = shdr32_link; -- shdr_size = shdr32_size; -- shdr_name = shdr32_name; -- shdr_type = shdr32_type; -- shdr_entsize = shdr32_entsize; -- sym_type = sym32_type; -- sym_name = sym32_name; -- sym_value = sym32_value; -- sym_shndx = sym32_shndx; -- long_size = 4; -- extable_ent_size = 8; -+ } - break; -- case ELFCLASS64: -+ case ELFCLASS64: { -+ struct elf_funcs efuncs = { -+ .compare_extable = compare_extable_64, -+ .ehdr_shoff = ehdr64_shoff, -+ .ehdr_shentsize = ehdr64_shentsize, -+ .ehdr_shstrndx = ehdr64_shstrndx, -+ .ehdr_shnum = ehdr64_shnum, -+ .shdr_addr = shdr64_addr, -+ .shdr_offset = shdr64_offset, -+ .shdr_link = shdr64_link, -+ .shdr_size = shdr64_size, -+ .shdr_name = shdr64_name, -+ .shdr_type = shdr64_type, -+ .shdr_entsize = shdr64_entsize, -+ .sym_type = sym64_type, -+ .sym_name = sym64_name, -+ .sym_value = sym64_value, -+ .sym_shndx = sym64_shndx, -+ }; -+ -+ e = efuncs; -+ long_size = 8; -+ extable_ent_size = 16; -+ - if (r2(&ehdr->e64.e_ehsize) != sizeof(Elf64_Ehdr) || - r2(&ehdr->e64.e_shentsize) != sizeof(Elf64_Shdr)) { - fprintf(stderr, -@@ -900,25 +979,7 @@ static int do_file(char const *const fname, void *addr) - return -1; - } - -- compare_extable = compare_extable_64; -- ehdr_shoff = ehdr64_shoff; -- ehdr_shentsize = ehdr64_shentsize; -- ehdr_shstrndx = ehdr64_shstrndx; -- ehdr_shnum = ehdr64_shnum; -- shdr_addr = shdr64_addr; -- shdr_offset = shdr64_offset; -- shdr_link = shdr64_link; -- shdr_size = shdr64_size; -- shdr_name = shdr64_name; -- shdr_type = shdr64_type; -- shdr_entsize = shdr64_entsize; -- sym_type = sym64_type; -- sym_name = sym64_name; -- sym_value = sym64_value; -- sym_shndx = sym64_shndx; -- long_size = 8; -- extable_ent_size = 16; -- -+ } - break; - default: - fprintf(stderr, "unrecognized ELF class %d %s\n", --- -2.50.1 (Apple Git-155) - diff --git a/1340-arm64-scripts-sorttable-implement-sorting-mcount-loc-at-boot.patch b/1340-arm64-scripts-sorttable-implement-sorting-mcount-loc-at-boot.patch deleted file mode 100644 index 92d2fdeed..000000000 --- a/1340-arm64-scripts-sorttable-implement-sorting-mcount-loc-at-boot.patch +++ /dev/null @@ -1,373 +0,0 @@ -From 4b605df96d9249250134a81573caa2ab136e0ce8 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:55:45 +0200 -Subject: [PATCH] arm64: scripts/sorttable: Implement sorting mcount_loc at - boot for arm64 - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -Conflicts: Context change from missing commit a762e9267dca ("ftrace: -Add CONFIG_HAVE_FTRACE_GRAPH_FUNC") - -commit b3d09d06e052e1d754645acea4e4d1e96f81c934 -Author: Steven Rostedt -Date: Tue Feb 18 14:59:19 2025 -0500 - - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - - The mcount_loc section holds the addresses of the functions that get - patched by ftrace when enabling function callbacks. It can contain tens of - thousands of entries. These addresses must be sorted. If they are not - sorted at compile time, they are sorted at boot. Sorting at boot does take - some time and does have a small impact on boot performance. - - x86 and arm32 have the addresses in the mcount_loc section of the ELF - file. But for arm64, the section just contains zeros. The .rela.dyn - Elf_Rela section holds the addresses and they get patched at boot during - the relocation phase. - - In order to sort these addresses, the Elf_Rela needs to be updated instead - of the location in the binary that holds the mcount_loc section. Have the - sorttable code, allocate an array to hold the functions, load the - addresses from the Elf_Rela entries, sort them, then put them back in - order into the Elf_rela entries so that they will be sorted at boot up - without having to sort them during boot up. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Heiko Carstens - Cc: Will Deacon - Cc: Vasily Gorbik - Cc: Alexander Gordeev - Link: https://lore.kernel.org/20250218200022.373319428@goodmis.org - Acked-by: Catalin Marinas - Signed-off-by: Steven Rostedt (Google) - -(cherry picked from commit b3d09d06e052e1d754645acea4e4d1e96f81c934) -Assisted-by: Patchpal -Signed-off-by: Jerome Marchand - -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 534daec407ef..add6005c5e8b 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -219,6 +219,7 @@ config ARM64 - if DYNAMIC_FTRACE_WITH_ARGS - select HAVE_SAMPLE_FTRACE_DIRECT - select HAVE_SAMPLE_FTRACE_DIRECT_MULTI -+ select HAVE_BUILDTIME_MCOUNT_SORT - select HAVE_EFFICIENT_UNALIGNED_ACCESS - select HAVE_GUP_FAST - select HAVE_FTRACE_MCOUNT_RECORD -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 9f41575afd7a..4a34c275123e 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -79,10 +80,16 @@ typedef union { - Elf64_Sym e64; - } Elf_Sym; - -+typedef union { -+ Elf32_Rela e32; -+ Elf64_Rela e64; -+} Elf_Rela; -+ - static uint32_t (*r)(const uint32_t *); - static uint16_t (*r2)(const uint16_t *); - static uint64_t (*r8)(const uint64_t *); - static void (*w)(uint32_t, uint32_t *); -+static void (*w8)(uint64_t, uint64_t *); - typedef void (*table_sort_t)(char *, int); - - static struct elf_funcs { -@@ -102,6 +109,10 @@ static struct elf_funcs { - uint32_t (*sym_name)(Elf_Sym *sym); - uint64_t (*sym_value)(Elf_Sym *sym); - uint16_t (*sym_shndx)(Elf_Sym *sym); -+ uint64_t (*rela_offset)(Elf_Rela *rela); -+ uint64_t (*rela_info)(Elf_Rela *rela); -+ uint64_t (*rela_addend)(Elf_Rela *rela); -+ void (*rela_write_addend)(Elf_Rela *rela, uint64_t val); - } e; - - static uint64_t ehdr64_shoff(Elf_Ehdr *ehdr) -@@ -262,6 +273,38 @@ SYM_ADDR(value) - SYM_WORD(name) - SYM_HALF(shndx) - -+#define __maybe_unused __attribute__((__unused__)) -+ -+#define RELA_ADDR(fn_name) \ -+static uint64_t rela64_##fn_name(Elf_Rela *rela) \ -+{ \ -+ return r8((uint64_t *)&rela->e64.r_##fn_name); \ -+} \ -+ \ -+static uint64_t rela32_##fn_name(Elf_Rela *rela) \ -+{ \ -+ return r((uint32_t *)&rela->e32.r_##fn_name); \ -+} \ -+ \ -+static uint64_t __maybe_unused rela_##fn_name(Elf_Rela *rela) \ -+{ \ -+ return e.rela_##fn_name(rela); \ -+} -+ -+RELA_ADDR(offset) -+RELA_ADDR(info) -+RELA_ADDR(addend) -+ -+static void rela64_write_addend(Elf_Rela *rela, uint64_t val) -+{ -+ w8(val, (uint64_t *)&rela->e64.r_addend); -+} -+ -+static void rela32_write_addend(Elf_Rela *rela, uint64_t val) -+{ -+ w(val, (uint32_t *)&rela->e32.r_addend); -+} -+ - /* - * Get the whole file as a programming convenience in order to avoid - * malloc+lseek+read+free of many pieces. If successful, then mmap -@@ -341,6 +384,16 @@ static void wle(uint32_t val, uint32_t *x) - put_unaligned_le32(val, x); - } - -+static void w8be(uint64_t val, uint64_t *x) -+{ -+ put_unaligned_be64(val, x); -+} -+ -+static void w8le(uint64_t val, uint64_t *x) -+{ -+ put_unaligned_le64(val, x); -+} -+ - /* - * Move reserved section indices SHN_LORESERVE..SHN_HIRESERVE out of - * the way to -256..-1, to avoid conflicting with real section -@@ -398,13 +451,12 @@ static inline void *get_index(void *start, int entsize, int index) - static int extable_ent_size; - static int long_size; - -+#define ERRSTR_MAXSZ 256 - - #ifdef UNWINDER_ORC_ENABLED - /* ORC unwinder only support X86_64 */ - #include - --#define ERRSTR_MAXSZ 256 -- - static char g_err[ERRSTR_MAXSZ]; - static int *g_orc_ip_table; - static struct orc_entry *g_orc_table; -@@ -499,7 +551,19 @@ static void *sort_orctable(void *arg) - #endif - - #ifdef MCOUNT_SORT_ENABLED -+ -+/* Only used for sorting mcount table */ -+static void rela_write_addend(Elf_Rela *rela, uint64_t val) -+{ -+ e.rela_write_addend(rela, val); -+} -+ - static pthread_t mcount_sort_thread; -+static bool sort_reloc; -+ -+static long rela_type; -+ -+static char m_err[ERRSTR_MAXSZ]; - - struct elf_mcount_loc { - Elf_Ehdr *ehdr; -@@ -508,6 +572,103 @@ struct elf_mcount_loc { - uint64_t stop_mcount_loc; - }; - -+/* Sort the relocations not the address itself */ -+static void *sort_relocs(Elf_Ehdr *ehdr, uint64_t start_loc, uint64_t size) -+{ -+ Elf_Shdr *shdr_start; -+ Elf_Rela *rel; -+ unsigned int shnum; -+ unsigned int count; -+ int shentsize; -+ void *vals; -+ void *ptr; -+ -+ shdr_start = (Elf_Shdr *)((char *)ehdr + ehdr_shoff(ehdr)); -+ shentsize = ehdr_shentsize(ehdr); -+ -+ vals = malloc(long_size * size); -+ if (!vals) { -+ snprintf(m_err, ERRSTR_MAXSZ, "Failed to allocate sort array"); -+ pthread_exit(m_err); -+ return NULL; -+ } -+ -+ ptr = vals; -+ -+ shnum = ehdr_shnum(ehdr); -+ if (shnum == SHN_UNDEF) -+ shnum = shdr_size(shdr_start); -+ -+ for (int i = 0; i < shnum; i++) { -+ Elf_Shdr *shdr = get_index(shdr_start, shentsize, i); -+ void *end; -+ -+ if (shdr_type(shdr) != SHT_RELA) -+ continue; -+ -+ rel = (void *)ehdr + shdr_offset(shdr); -+ end = (void *)rel + shdr_size(shdr); -+ -+ for (; (void *)rel < end; rel = (void *)rel + shdr_entsize(shdr)) { -+ uint64_t offset = rela_offset(rel); -+ -+ if (offset >= start_loc && offset < start_loc + size) { -+ if (ptr + long_size > vals + size) { -+ free(vals); -+ snprintf(m_err, ERRSTR_MAXSZ, -+ "Too many relocations"); -+ pthread_exit(m_err); -+ return NULL; -+ } -+ -+ /* Make sure this has the correct type */ -+ if (rela_info(rel) != rela_type) { -+ free(vals); -+ snprintf(m_err, ERRSTR_MAXSZ, -+ "rela has type %lx but expected %lx\n", -+ (long)rela_info(rel), rela_type); -+ pthread_exit(m_err); -+ return NULL; -+ } -+ -+ if (long_size == 4) -+ *(uint32_t *)ptr = rela_addend(rel); -+ else -+ *(uint64_t *)ptr = rela_addend(rel); -+ ptr += long_size; -+ } -+ } -+ } -+ count = ptr - vals; -+ qsort(vals, count / long_size, long_size, compare_extable); -+ -+ ptr = vals; -+ for (int i = 0; i < shnum; i++) { -+ Elf_Shdr *shdr = get_index(shdr_start, shentsize, i); -+ void *end; -+ -+ if (shdr_type(shdr) != SHT_RELA) -+ continue; -+ -+ rel = (void *)ehdr + shdr_offset(shdr); -+ end = (void *)rel + shdr_size(shdr); -+ -+ for (; (void *)rel < end; rel = (void *)rel + shdr_entsize(shdr)) { -+ uint64_t offset = rela_offset(rel); -+ -+ if (offset >= start_loc && offset < start_loc + size) { -+ if (long_size == 4) -+ rela_write_addend(rel, *(uint32_t *)ptr); -+ else -+ rela_write_addend(rel, *(uint64_t *)ptr); -+ ptr += long_size; -+ } -+ } -+ } -+ free(vals); -+ return NULL; -+} -+ - /* Sort the addresses stored between __start_mcount_loc to __stop_mcount_loc in vmlinux */ - static void *sort_mcount_loc(void *arg) - { -@@ -517,6 +678,9 @@ static void *sort_mcount_loc(void *arg) - uint64_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; - unsigned char *start_loc = (void *)emloc->ehdr + offset; - -+ if (sort_reloc) -+ return sort_relocs(emloc->ehdr, emloc->start_mcount_loc, count); -+ - qsort(start_loc, count/long_size, long_size, compare_extable); - return NULL; - } -@@ -866,12 +1030,14 @@ static int do_file(char const *const fname, void *addr) - r2 = r2le; - r8 = r8le; - w = wle; -+ w8 = w8le; - break; - case ELFDATA2MSB: - r = rbe; - r2 = r2be; - r8 = r8be; - w = wbe; -+ w8 = w8be; - break; - default: - fprintf(stderr, "unrecognized ELF data encoding %d: %s\n", -@@ -887,8 +1053,13 @@ static int do_file(char const *const fname, void *addr) - } - - switch (r2(&ehdr->e32.e_machine)) { -- case EM_386: - case EM_AARCH64: -+#ifdef MCOUNT_SORT_ENABLED -+ sort_reloc = true; -+ rela_type = 0x403; -+#endif -+ /* fallthrough */ -+ case EM_386: - case EM_LOONGARCH: - case EM_RISCV: - case EM_S390: -@@ -932,6 +1103,10 @@ static int do_file(char const *const fname, void *addr) - .sym_name = sym32_name, - .sym_value = sym32_value, - .sym_shndx = sym32_shndx, -+ .rela_offset = rela32_offset, -+ .rela_info = rela32_info, -+ .rela_addend = rela32_addend, -+ .rela_write_addend = rela32_write_addend, - }; - - e = efuncs; -@@ -965,6 +1140,10 @@ static int do_file(char const *const fname, void *addr) - .sym_name = sym64_name, - .sym_value = sym64_value, - .sym_shndx = sym64_shndx, -+ .rela_offset = rela64_offset, -+ .rela_info = rela64_info, -+ .rela_addend = rela64_addend, -+ .rela_write_addend = rela64_write_addend, - }; - - e = efuncs; --- -2.50.1 (Apple Git-155) - diff --git a/1341-scripts-sorttable-have-mcount-rela-sort-use-direct-values.patch b/1341-scripts-sorttable-have-mcount-rela-sort-use-direct-values.patch deleted file mode 100644 index 54846d32e..000000000 --- a/1341-scripts-sorttable-have-mcount-rela-sort-use-direct-values.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 93c8c28c2ce439d598d5fd49d10a4bd5cb0401ea Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:57:27 +0200 -Subject: [PATCH] scripts/sorttable: Have mcount rela sort use direct values - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit a0265659322540d656727b9e132edfb6f06b6c1a -Author: Steven Rostedt -Date: Tue Feb 18 14:59:20 2025 -0500 - - scripts/sorttable: Have mcount rela sort use direct values - - The mcount_loc sorting for when the values are stored in the Elf_Rela - entries uses the compare_extable() function to do the compares in the - qsort(). That function does handle byte swapping if the machine being - compiled for is a different endian than the host machine. But the - sort_relocs() function sorts an array that pulled in the values from the - Elf_Rela section and has already done the swapping. - - Create two new compare functions that will sort the direct values. One - will sort 32 bit values and the other will sort the 64 bit value. One of - these will be assigned to a compare_values function pointer and that will - be used for sorting the Elf_Rela mcount values. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Heiko Carstens - Cc: Catalin Marinas - Cc: Will Deacon - Cc: Vasily Gorbik - Cc: Alexander Gordeev - Link: https://lore.kernel.org/20250218200022.538888594@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 4a34c275123e..f62a91d8af0a 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -552,6 +552,28 @@ static void *sort_orctable(void *arg) - - #ifdef MCOUNT_SORT_ENABLED - -+static int compare_values_64(const void *a, const void *b) -+{ -+ uint64_t av = *(uint64_t *)a; -+ uint64_t bv = *(uint64_t *)b; -+ -+ if (av < bv) -+ return -1; -+ return av > bv; -+} -+ -+static int compare_values_32(const void *a, const void *b) -+{ -+ uint32_t av = *(uint32_t *)a; -+ uint32_t bv = *(uint32_t *)b; -+ -+ if (av < bv) -+ return -1; -+ return av > bv; -+} -+ -+static int (*compare_values)(const void *a, const void *b); -+ - /* Only used for sorting mcount table */ - static void rela_write_addend(Elf_Rela *rela, uint64_t val) - { -@@ -583,6 +605,8 @@ static void *sort_relocs(Elf_Ehdr *ehdr, uint64_t start_loc, uint64_t size) - void *vals; - void *ptr; - -+ compare_values = long_size == 4 ? compare_values_32 : compare_values_64; -+ - shdr_start = (Elf_Shdr *)((char *)ehdr + ehdr_shoff(ehdr)); - shentsize = ehdr_shentsize(ehdr); - -@@ -640,7 +664,7 @@ static void *sort_relocs(Elf_Ehdr *ehdr, uint64_t start_loc, uint64_t size) - } - } - count = ptr - vals; -- qsort(vals, count / long_size, long_size, compare_extable); -+ qsort(vals, count / long_size, long_size, compare_values); - - ptr = vals; - for (int i = 0; i < shnum; i++) { --- -2.50.1 (Apple Git-155) - diff --git a/1342-scripts-sorttable-always-use-an-array-for-the-mcount-loc-sor.patch b/1342-scripts-sorttable-always-use-an-array-for-the-mcount-loc-sor.patch deleted file mode 100644 index a7ac286da..000000000 --- a/1342-scripts-sorttable-always-use-an-array-for-the-mcount-loc-sor.patch +++ /dev/null @@ -1,239 +0,0 @@ -From d39567e1f737a3f1959b0597eeeba7bdf25d0249 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:57:34 +0200 -Subject: [PATCH] scripts/sorttable: Always use an array for the mcount_loc - sorting - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 5fb964f5ba53afda0e2b6dbc00b8205461ffe04a -Author: Steven Rostedt -Date: Tue Feb 18 14:59:21 2025 -0500 - - scripts/sorttable: Always use an array for the mcount_loc sorting - - The sorting of the mcount_loc section is done directly to the section for - x86 and arm32 but it uses a separate array for arm64 as arm64 has the - values for the mcount_loc stored in the rela sections of the vmlinux ELF - file. - - In order to use the same code to remove weak functions, always use a - separate array to do the sorting. This requires splitting up the filling - of the array into one function and the placing the contents of the array - back into the rela sections or into the mcount_loc section into a separate - file. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Heiko Carstens - Cc: Catalin Marinas - Cc: Will Deacon - Cc: Vasily Gorbik - Cc: Alexander Gordeev - Link: https://lore.kernel.org/20250218200022.710676551@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index f62a91d8af0a..ec02a2852efb 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -594,31 +594,19 @@ struct elf_mcount_loc { - uint64_t stop_mcount_loc; - }; - --/* Sort the relocations not the address itself */ --static void *sort_relocs(Elf_Ehdr *ehdr, uint64_t start_loc, uint64_t size) -+/* Fill the array with the content of the relocs */ -+static int fill_relocs(void *ptr, uint64_t size, Elf_Ehdr *ehdr, uint64_t start_loc) - { - Elf_Shdr *shdr_start; - Elf_Rela *rel; - unsigned int shnum; -- unsigned int count; -+ unsigned int count = 0; - int shentsize; -- void *vals; -- void *ptr; -- -- compare_values = long_size == 4 ? compare_values_32 : compare_values_64; -+ void *array_end = ptr + size; - - shdr_start = (Elf_Shdr *)((char *)ehdr + ehdr_shoff(ehdr)); - shentsize = ehdr_shentsize(ehdr); - -- vals = malloc(long_size * size); -- if (!vals) { -- snprintf(m_err, ERRSTR_MAXSZ, "Failed to allocate sort array"); -- pthread_exit(m_err); -- return NULL; -- } -- -- ptr = vals; -- - shnum = ehdr_shnum(ehdr); - if (shnum == SHN_UNDEF) - shnum = shdr_size(shdr_start); -@@ -637,22 +625,18 @@ static void *sort_relocs(Elf_Ehdr *ehdr, uint64_t start_loc, uint64_t size) - uint64_t offset = rela_offset(rel); - - if (offset >= start_loc && offset < start_loc + size) { -- if (ptr + long_size > vals + size) { -- free(vals); -+ if (ptr + long_size > array_end) { - snprintf(m_err, ERRSTR_MAXSZ, - "Too many relocations"); -- pthread_exit(m_err); -- return NULL; -+ return -1; - } - - /* Make sure this has the correct type */ - if (rela_info(rel) != rela_type) { -- free(vals); - snprintf(m_err, ERRSTR_MAXSZ, - "rela has type %lx but expected %lx\n", - (long)rela_info(rel), rela_type); -- pthread_exit(m_err); -- return NULL; -+ return -1; - } - - if (long_size == 4) -@@ -660,13 +644,28 @@ static void *sort_relocs(Elf_Ehdr *ehdr, uint64_t start_loc, uint64_t size) - else - *(uint64_t *)ptr = rela_addend(rel); - ptr += long_size; -+ count++; - } - } - } -- count = ptr - vals; -- qsort(vals, count / long_size, long_size, compare_values); -+ return count; -+} -+ -+/* Put the sorted vals back into the relocation elements */ -+static void replace_relocs(void *ptr, uint64_t size, Elf_Ehdr *ehdr, uint64_t start_loc) -+{ -+ Elf_Shdr *shdr_start; -+ Elf_Rela *rel; -+ unsigned int shnum; -+ int shentsize; -+ -+ shdr_start = (Elf_Shdr *)((char *)ehdr + ehdr_shoff(ehdr)); -+ shentsize = ehdr_shentsize(ehdr); -+ -+ shnum = ehdr_shnum(ehdr); -+ if (shnum == SHN_UNDEF) -+ shnum = shdr_size(shdr_start); - -- ptr = vals; - for (int i = 0; i < shnum; i++) { - Elf_Shdr *shdr = get_index(shdr_start, shentsize, i); - void *end; -@@ -689,8 +688,32 @@ static void *sort_relocs(Elf_Ehdr *ehdr, uint64_t start_loc, uint64_t size) - } - } - } -- free(vals); -- return NULL; -+} -+ -+static int fill_addrs(void *ptr, uint64_t size, void *addrs) -+{ -+ void *end = ptr + size; -+ int count = 0; -+ -+ for (; ptr < end; ptr += long_size, addrs += long_size, count++) { -+ if (long_size == 4) -+ *(uint32_t *)ptr = r(addrs); -+ else -+ *(uint64_t *)ptr = r8(addrs); -+ } -+ return count; -+} -+ -+static void replace_addrs(void *ptr, uint64_t size, void *addrs) -+{ -+ void *end = ptr + size; -+ -+ for (; ptr < end; ptr += long_size, addrs += long_size) { -+ if (long_size == 4) -+ w(*(uint32_t *)ptr, addrs); -+ else -+ w8(*(uint64_t *)ptr, addrs); -+ } - } - - /* Sort the addresses stored between __start_mcount_loc to __stop_mcount_loc in vmlinux */ -@@ -699,14 +722,49 @@ static void *sort_mcount_loc(void *arg) - struct elf_mcount_loc *emloc = (struct elf_mcount_loc *)arg; - uint64_t offset = emloc->start_mcount_loc - shdr_addr(emloc->init_data_sec) - + shdr_offset(emloc->init_data_sec); -- uint64_t count = emloc->stop_mcount_loc - emloc->start_mcount_loc; -+ uint64_t size = emloc->stop_mcount_loc - emloc->start_mcount_loc; - unsigned char *start_loc = (void *)emloc->ehdr + offset; -+ Elf_Ehdr *ehdr = emloc->ehdr; -+ void *e_msg = NULL; -+ void *vals; -+ int count; -+ -+ vals = malloc(long_size * size); -+ if (!vals) { -+ snprintf(m_err, ERRSTR_MAXSZ, "Failed to allocate sort array"); -+ pthread_exit(m_err); -+ } - - if (sort_reloc) -- return sort_relocs(emloc->ehdr, emloc->start_mcount_loc, count); -+ count = fill_relocs(vals, size, ehdr, emloc->start_mcount_loc); -+ else -+ count = fill_addrs(vals, size, start_loc); -+ -+ if (count < 0) { -+ e_msg = m_err; -+ goto out; -+ } -+ -+ if (count != size / long_size) { -+ snprintf(m_err, ERRSTR_MAXSZ, "Expected %u mcount elements but found %u\n", -+ (int)(size / long_size), count); -+ e_msg = m_err; -+ goto out; -+ } -+ -+ compare_values = long_size == 4 ? compare_values_32 : compare_values_64; -+ -+ qsort(vals, count, long_size, compare_values); -+ -+ if (sort_reloc) -+ replace_relocs(vals, size, ehdr, emloc->start_mcount_loc); -+ else -+ replace_addrs(vals, size, start_loc); -+ -+out: -+ free(vals); - -- qsort(start_loc, count/long_size, long_size, compare_extable); -- return NULL; -+ pthread_exit(e_msg); - } - - /* Get the address of __start_mcount_loc and __stop_mcount_loc in System.map */ --- -2.50.1 (Apple Git-155) - diff --git a/1343-scripts-sorttable-zero-out-weak-functions-in-mcount-loc-tabl.patch b/1343-scripts-sorttable-zero-out-weak-functions-in-mcount-loc-tabl.patch deleted file mode 100644 index f681ccbb4..000000000 --- a/1343-scripts-sorttable-zero-out-weak-functions-in-mcount-loc-tabl.patch +++ /dev/null @@ -1,316 +0,0 @@ -From 8cde64d5091653560e13e7cd34a385258372db58 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Mon, 1 Jun 2026 15:57:38 +0200 -Subject: [PATCH] scripts/sorttable: Zero out weak functions in mcount_loc - table - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit ef378c3b8233855497a414b9d67bf22592c928a4 -Author: Steven Rostedt -Date: Tue Feb 18 14:59:22 2025 -0500 - - scripts/sorttable: Zero out weak functions in mcount_loc table - - When a function is annotated as "weak" and is overridden, the code is not - removed. If it is traced, the fentry/mcount location in the weak function - will be referenced by the "__mcount_loc" section. This will then be added - to the available_filter_functions list. Since only the address of the - functions are listed, to find the name to show, a search of kallsyms is - used. - - Since kallsyms will return the function by simply finding the function - that the address is after but before the next function, an address of a - weak function will show up as the function before it. This is because - kallsyms does not save names of weak functions. This has caused issues in - the past, as now the traced weak function will be listed in - available_filter_functions with the name of the function before it. - - At best, this will cause the previous function's name to be listed twice. - At worse, if the previous function was marked notrace, it will now show up - as a function that can be traced. Note that it only shows up that it can - be traced but will not be if enabled, which causes confusion. - - https://lore.kernel.org/all/20220412094923.0abe90955e5db486b7bca279@kernel.org/ - - The commit b39181f7c6907 ("ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid - adding weak function") was a workaround to this by checking the function - address before printing its name. If the address was too far from the - function given by the name then instead of printing the name it would - print: __ftrace_invalid_address___ - - The real issue is that these invalid addresses are listed in the ftrace - table look up which available_filter_functions is derived from. A place - holder must be listed in that file because set_ftrace_filter may take a - series of indexes into that file instead of names to be able to do O(1) - lookups to enable filtering (many tools use this method). - - Even if kallsyms saved the size of the function, it does not remove the - need of having these place holders. The real solution is to not add a weak - function into the ftrace table in the first place. - - To solve this, the sorttable.c code that sorts the mcount regions during - the build is modified to take a "nm -S vmlinux" input, sort it, and any - function listed in the mcount_loc section that is not within a boundary of - the function list given by nm is considered a weak function and is zeroed - out. - - Note, this does not mean they will remain zero when booting as KASLR - will still shift those addresses. To handle this, the entries in the - mcount_loc section will be ignored if they are zero or match the - kaslr_offset() value. - - Before: - - ~# grep __ftrace_invalid_address___ /sys/kernel/tracing/available_filter_functions | wc -l - 551 - - After: - - ~# grep __ftrace_invalid_address___ /sys/kernel/tracing/available_filter_functions | wc -l - 0 - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Heiko Carstens - Cc: Catalin Marinas - Cc: Will Deacon - Cc: Vasily Gorbik - Cc: Alexander Gordeev - Link: https://lore.kernel.org/20250218200022.883095980@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 57b8fad660cf..792c57d1f0b9 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -7052,6 +7052,7 @@ static int ftrace_process_locs(struct module *mod, - unsigned long count; - unsigned long *p; - unsigned long addr; -+ unsigned long kaslr; - unsigned long flags = 0; /* Shut up gcc */ - int ret = -ENOMEM; - -@@ -7100,6 +7101,9 @@ static int ftrace_process_locs(struct module *mod, - ftrace_pages->next = start_pg; - } - -+ /* For zeroed locations that were shifted for core kernel */ -+ kaslr = !mod ? kaslr_offset() : 0; -+ - p = start; - pg = start_pg; - while (p < end) { -@@ -7111,7 +7115,7 @@ static int ftrace_process_locs(struct module *mod, - * object files to satisfy alignments. - * Skip any NULL pointers. - */ -- if (!addr) { -+ if (!addr || addr == kaslr) { - skipped++; - continue; - } -diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh -index cdf16029fc58..8619ae612997 100755 ---- a/scripts/link-vmlinux.sh -+++ b/scripts/link-vmlinux.sh -@@ -174,12 +174,14 @@ mksysmap() - - sorttable() - { -- ${objtree}/scripts/sorttable ${1} -+ ${NM} -S ${1} > .tmp_vmlinux.nm-sort -+ ${objtree}/scripts/sorttable -s .tmp_vmlinux.nm-sort ${1} - } - - cleanup() - { - rm -f .btf.* -+ rm -f .tmp_vmlinux.nm-sort - rm -f System.map - rm -f vmlinux - rm -f vmlinux.map -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index ec02a2852efb..23c7e0e6c024 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -580,6 +580,98 @@ static void rela_write_addend(Elf_Rela *rela, uint64_t val) - e.rela_write_addend(rela, val); - } - -+struct func_info { -+ uint64_t addr; -+ uint64_t size; -+}; -+ -+/* List of functions created by: nm -S vmlinux */ -+static struct func_info *function_list; -+static int function_list_size; -+ -+/* Allocate functions in 1k blocks */ -+#define FUNC_BLK_SIZE 1024 -+#define FUNC_BLK_MASK (FUNC_BLK_SIZE - 1) -+ -+static int add_field(uint64_t addr, uint64_t size) -+{ -+ struct func_info *fi; -+ int fsize = function_list_size; -+ -+ if (!(fsize & FUNC_BLK_MASK)) { -+ fsize += FUNC_BLK_SIZE; -+ fi = realloc(function_list, fsize * sizeof(struct func_info)); -+ if (!fi) -+ return -1; -+ function_list = fi; -+ } -+ fi = &function_list[function_list_size++]; -+ fi->addr = addr; -+ fi->size = size; -+ return 0; -+} -+ -+/* Only return match if the address lies inside the function size */ -+static int cmp_func_addr(const void *K, const void *A) -+{ -+ uint64_t key = *(const uint64_t *)K; -+ const struct func_info *a = A; -+ -+ if (key < a->addr) -+ return -1; -+ return key >= a->addr + a->size; -+} -+ -+/* Find the function in function list that is bounded by the function size */ -+static int find_func(uint64_t key) -+{ -+ return bsearch(&key, function_list, function_list_size, -+ sizeof(struct func_info), cmp_func_addr) != NULL; -+} -+ -+static int cmp_funcs(const void *A, const void *B) -+{ -+ const struct func_info *a = A; -+ const struct func_info *b = B; -+ -+ if (a->addr < b->addr) -+ return -1; -+ return a->addr > b->addr; -+} -+ -+static int parse_symbols(const char *fname) -+{ -+ FILE *fp; -+ char addr_str[20]; /* Only need 17, but round up to next int size */ -+ char size_str[20]; -+ char type; -+ -+ fp = fopen(fname, "r"); -+ if (!fp) { -+ perror(fname); -+ return -1; -+ } -+ -+ while (fscanf(fp, "%16s %16s %c %*s\n", addr_str, size_str, &type) == 3) { -+ uint64_t addr; -+ uint64_t size; -+ -+ /* Only care about functions */ -+ if (type != 't' && type != 'T' && type != 'W') -+ continue; -+ -+ addr = strtoull(addr_str, NULL, 16); -+ size = strtoull(size_str, NULL, 16); -+ if (add_field(addr, size) < 0) -+ return -1; -+ } -+ fclose(fp); -+ -+ qsort(function_list, function_list_size, sizeof(struct func_info), cmp_funcs); -+ -+ return 0; -+} -+ - static pthread_t mcount_sort_thread; - static bool sort_reloc; - -@@ -752,6 +844,21 @@ static void *sort_mcount_loc(void *arg) - goto out; - } - -+ /* zero out any locations not found by function list */ -+ if (function_list_size) { -+ for (void *ptr = vals; ptr < vals + size; ptr += long_size) { -+ uint64_t key; -+ -+ key = long_size == 4 ? r((uint32_t *)ptr) : r8((uint64_t *)ptr); -+ if (!find_func(key)) { -+ if (long_size == 4) -+ *(uint32_t *)ptr = 0; -+ else -+ *(uint64_t *)ptr = 0; -+ } -+ } -+ } -+ - compare_values = long_size == 4 ? compare_values_32 : compare_values_64; - - qsort(vals, count, long_size, compare_values); -@@ -801,6 +908,8 @@ static void get_mcount_loc(struct elf_mcount_loc *emloc, Elf_Shdr *symtab_sec, - return; - } - } -+#else /* MCOUNT_SORT_ENABLED */ -+static inline int parse_symbols(const char *fname) { return 0; } - #endif - - static int do_sort(Elf_Ehdr *ehdr, -@@ -1256,14 +1365,29 @@ int main(int argc, char *argv[]) - int i, n_error = 0; /* gcc-4.3.0 false positive complaint */ - size_t size = 0; - void *addr = NULL; -+ int c; -+ -+ while ((c = getopt(argc, argv, "s:")) >= 0) { -+ switch (c) { -+ case 's': -+ if (parse_symbols(optarg) < 0) { -+ fprintf(stderr, "Could not parse %s\n", optarg); -+ return -1; -+ } -+ break; -+ default: -+ fprintf(stderr, "usage: sorttable [-s nm-file] vmlinux...\n"); -+ return 0; -+ } -+ } - -- if (argc < 2) { -+ if ((argc - optind) < 1) { - fprintf(stderr, "usage: sorttable vmlinux...\n"); - return 0; - } - - /* Process each file in turn, allowing deep failure. */ -- for (i = 1; i < argc; i++) { -+ for (i = optind; i < argc; i++) { - addr = mmap_file(argv[i], &size); - if (!addr) { - ++n_error; --- -2.50.1 (Apple Git-155) - diff --git a/1344-ftrace-update-the-mcount-loc-check-of-skipped-entries.patch b/1344-ftrace-update-the-mcount-loc-check-of-skipped-entries.patch deleted file mode 100644 index 810e50aac..000000000 --- a/1344-ftrace-update-the-mcount-loc-check-of-skipped-entries.patch +++ /dev/null @@ -1,78 +0,0 @@ -From fb85259106c9afdbf7808aecc128d41aacab22ea Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:40:50 +0200 -Subject: [PATCH] ftrace: Update the mcount_loc check of skipped entries - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 4a3efc6baff931da9a85c6d2e42c87bd9a827399 -Author: Steven Rostedt -Date: Tue Feb 18 14:59:23 2025 -0500 - - ftrace: Update the mcount_loc check of skipped entries - - Now that weak functions turn into skipped entries, update the check to - make sure the amount that was allocated would fit both the entries that - were allocated as well as those that were skipped. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Heiko Carstens - Cc: Catalin Marinas - Cc: Will Deacon - Cc: Vasily Gorbik - Cc: Alexander Gordeev - Link: https://lore.kernel.org/20250218200023.055162048@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 792c57d1f0b9..4956ad9f9a20 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -7159,7 +7159,28 @@ static int ftrace_process_locs(struct module *mod, - - /* We should have used all pages unless we skipped some */ - if (pg_unuse) { -- WARN_ON(!skipped); -+ unsigned long pg_remaining, remaining = 0; -+ unsigned long skip; -+ -+ /* Count the number of entries unused and compare it to skipped. */ -+ pg_remaining = (ENTRIES_PER_PAGE << pg->order) - pg->index; -+ -+ if (!WARN(skipped < pg_remaining, "Extra allocated pages for ftrace")) { -+ -+ skip = skipped - pg_remaining; -+ -+ for (pg = pg_unuse; pg; pg = pg->next) -+ remaining += 1 << pg->order; -+ -+ skip = DIV_ROUND_UP(skip, ENTRIES_PER_PAGE); -+ -+ /* -+ * Check to see if the number of pages remaining would -+ * just fit the number of entries skipped. -+ */ -+ WARN(skip != remaining, "Extra allocated pages for ftrace: %lu with %lu skipped", -+ remaining, skipped); -+ } - /* Need to synchronize with ftrace_location_range() */ - synchronize_rcu(); - ftrace_free_pages(pg_unuse); --- -2.50.1 (Apple Git-155) - diff --git a/1345-ftrace-have-ftrace-pages-output-reflect-freed-pages.patch b/1345-ftrace-have-ftrace-pages-output-reflect-freed-pages.patch deleted file mode 100644 index 0f6099acd..000000000 --- a/1345-ftrace-have-ftrace-pages-output-reflect-freed-pages.patch +++ /dev/null @@ -1,115 +0,0 @@ -From d705caa45a6f9061420687f3d7d86f28e35881e2 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:40:54 +0200 -Subject: [PATCH] ftrace: Have ftrace pages output reflect freed pages - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 264143c4e54412095f4b615e65bf736fc3c60af0 -Author: Steven Rostedt -Date: Tue Feb 18 14:59:24 2025 -0500 - - ftrace: Have ftrace pages output reflect freed pages - - The amount of memory that ftrace uses to save the descriptors to manage - the functions it can trace is shown at output. But if there are a lot of - functions that are skipped because they were weak or the architecture - added holes into the tables, then the extra pages that were allocated are - freed. But these freed pages are not reflected in the numbers shown, and - they can even be inconsistent with what is reported: - - ftrace: allocating 57482 entries in 225 pages - ftrace: allocated 224 pages with 3 groups - - The above shows the number of original entries that are in the mcount_loc - section and the pages needed to save them (225), but the second output - reflects the number of pages that were actually used. The two should be - consistent as: - - ftrace: allocating 56739 entries in 224 pages - ftrace: allocated 224 pages with 3 groups - - The above also shows the accurate number of entires that were actually - stored and does not include the entries that were removed. - - Cc: bpf - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Peter Zijlstra - Cc: Linus Torvalds - Cc: Masahiro Yamada - Cc: Nathan Chancellor - Cc: Nicolas Schier - Cc: Zheng Yejian - Cc: Martin Kelly - Cc: Christophe Leroy - Cc: Josh Poimboeuf - Cc: Heiko Carstens - Cc: Catalin Marinas - Cc: Will Deacon - Cc: Vasily Gorbik - Cc: Alexander Gordeev - Link: https://lore.kernel.org/20250218200023.221100846@goodmis.org - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 4956ad9f9a20..5e131970a70e 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -7054,6 +7054,7 @@ static int ftrace_process_locs(struct module *mod, - unsigned long addr; - unsigned long kaslr; - unsigned long flags = 0; /* Shut up gcc */ -+ unsigned long pages; - int ret = -ENOMEM; - - count = end - start; -@@ -7061,6 +7062,8 @@ static int ftrace_process_locs(struct module *mod, - if (!count) - return 0; - -+ pages = DIV_ROUND_UP(count, ENTRIES_PER_PAGE); -+ - /* - * Sorting mcount in vmlinux at build time depend on - * CONFIG_BUILDTIME_MCOUNT_SORT, while mcount loc in -@@ -7172,6 +7175,8 @@ static int ftrace_process_locs(struct module *mod, - for (pg = pg_unuse; pg; pg = pg->next) - remaining += 1 << pg->order; - -+ pages -= remaining; -+ - skip = DIV_ROUND_UP(skip, ENTRIES_PER_PAGE); - - /* -@@ -7185,6 +7190,13 @@ static int ftrace_process_locs(struct module *mod, - synchronize_rcu(); - ftrace_free_pages(pg_unuse); - } -+ -+ if (!mod) { -+ count -= skipped; -+ pr_info("ftrace: allocating %ld entries in %ld pages\n", -+ count, pages); -+ } -+ - return ret; - } - -@@ -7836,9 +7848,6 @@ void __init ftrace_init(void) - goto failed; - } - -- pr_info("ftrace: allocating %ld entries in %ld pages\n", -- count, DIV_ROUND_UP(count, ENTRIES_PER_PAGE)); -- - ret = ftrace_process_locs(NULL, - __start_mcount_loc, - __stop_mcount_loc); --- -2.50.1 (Apple Git-155) - diff --git a/1346-ftrace-do-not-over-allocate-ftrace-memory.patch b/1346-ftrace-do-not-over-allocate-ftrace-memory.patch deleted file mode 100644 index 5f2d5c4ef..000000000 --- a/1346-ftrace-do-not-over-allocate-ftrace-memory.patch +++ /dev/null @@ -1,166 +0,0 @@ -From 7a2ec4e50744d195d6a66868ef6f3fb39f15b8b7 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:56:18 +0200 -Subject: [PATCH] ftrace: Do not over-allocate ftrace memory - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit be55257fab181b93af38f8c4b1b3cb453a78d742 -Author: Guenter Roeck -Date: Tue Jan 13 07:22:42 2026 -0800 - - ftrace: Do not over-allocate ftrace memory - - The pg_remaining calculation in ftrace_process_locs() assumes that - ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the - allocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE - (integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g. - 4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages) - have significantly more capacity than 256 * 170. This leads to pg_remaining - being underestimated, which in turn makes skip (derived from skipped - - pg_remaining) larger than expected, causing the WARN(skip != remaining) - to trigger. - - Extra allocated pages for ftrace: 2 with 654 skipped - WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0 - - A similar problem in ftrace_allocate_records() can result in allocating - too many pages. This can trigger the second warning in - ftrace_process_locs(). - - Extra allocated pages for ftrace - WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580 - - Use the actual capacity of a page group to determine the number of pages - to allocate. Have ftrace_allocate_pages() return the number of allocated - pages to avoid having to calculate it. Use the actual page group capacity - when validating the number of unused pages due to skipped entries. - Drop the definition of ENTRIES_PER_PAGE since it is no longer used. - - Cc: stable@vger.kernel.org - Fixes: 4a3efc6baff93 ("ftrace: Update the mcount_loc check of skipped entries") - Link: https://patch.msgid.link/20260113152243.3557219-1-linux@roeck-us.net - Signed-off-by: Guenter Roeck - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 5e131970a70e..877f943832c9 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -1122,7 +1122,6 @@ struct ftrace_page { - }; - - #define ENTRY_SIZE sizeof(struct dyn_ftrace) --#define ENTRIES_PER_PAGE (PAGE_SIZE / ENTRY_SIZE) - - static struct ftrace_page *ftrace_pages_start; - static struct ftrace_page *ftrace_pages; -@@ -3754,7 +3753,8 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs) - return 0; - } - --static int ftrace_allocate_records(struct ftrace_page *pg, int count) -+static int ftrace_allocate_records(struct ftrace_page *pg, int count, -+ unsigned long *num_pages) - { - int order; - int pages; -@@ -3764,7 +3764,7 @@ static int ftrace_allocate_records(struct ftrace_page *pg, int count) - return -EINVAL; - - /* We want to fill as much as possible, with no empty pages */ -- pages = DIV_ROUND_UP(count, ENTRIES_PER_PAGE); -+ pages = DIV_ROUND_UP(count * ENTRY_SIZE, PAGE_SIZE); - order = fls(pages) - 1; - - again: -@@ -3779,6 +3779,7 @@ static int ftrace_allocate_records(struct ftrace_page *pg, int count) - } - - ftrace_number_of_pages += 1 << order; -+ *num_pages += 1 << order; - ftrace_number_of_groups++; - - cnt = (PAGE_SIZE << order) / ENTRY_SIZE; -@@ -3807,12 +3808,14 @@ static void ftrace_free_pages(struct ftrace_page *pages) - } - - static struct ftrace_page * --ftrace_allocate_pages(unsigned long num_to_init) -+ftrace_allocate_pages(unsigned long num_to_init, unsigned long *num_pages) - { - struct ftrace_page *start_pg; - struct ftrace_page *pg; - int cnt; - -+ *num_pages = 0; -+ - if (!num_to_init) - return NULL; - -@@ -3826,7 +3829,7 @@ ftrace_allocate_pages(unsigned long num_to_init) - * waste as little space as possible. - */ - for (;;) { -- cnt = ftrace_allocate_records(pg, num_to_init); -+ cnt = ftrace_allocate_records(pg, num_to_init, num_pages); - if (cnt < 0) - goto free_pages; - -@@ -7062,8 +7065,6 @@ static int ftrace_process_locs(struct module *mod, - if (!count) - return 0; - -- pages = DIV_ROUND_UP(count, ENTRIES_PER_PAGE); -- - /* - * Sorting mcount in vmlinux at build time depend on - * CONFIG_BUILDTIME_MCOUNT_SORT, while mcount loc in -@@ -7076,7 +7077,7 @@ static int ftrace_process_locs(struct module *mod, - test_is_sorted(start, count); - } - -- start_pg = ftrace_allocate_pages(count); -+ start_pg = ftrace_allocate_pages(count, &pages); - if (!start_pg) - return -ENOMEM; - -@@ -7163,27 +7164,27 @@ static int ftrace_process_locs(struct module *mod, - /* We should have used all pages unless we skipped some */ - if (pg_unuse) { - unsigned long pg_remaining, remaining = 0; -- unsigned long skip; -+ long skip; - - /* Count the number of entries unused and compare it to skipped. */ -- pg_remaining = (ENTRIES_PER_PAGE << pg->order) - pg->index; -+ pg_remaining = (PAGE_SIZE << pg->order) / ENTRY_SIZE - pg->index; - - if (!WARN(skipped < pg_remaining, "Extra allocated pages for ftrace")) { - - skip = skipped - pg_remaining; - -- for (pg = pg_unuse; pg; pg = pg->next) -+ for (pg = pg_unuse; pg && skip > 0; pg = pg->next) { - remaining += 1 << pg->order; -+ skip -= (PAGE_SIZE << pg->order) / ENTRY_SIZE; -+ } - - pages -= remaining; - -- skip = DIV_ROUND_UP(skip, ENTRIES_PER_PAGE); -- - /* - * Check to see if the number of pages remaining would - * just fit the number of entries skipped. - */ -- WARN(skip != remaining, "Extra allocated pages for ftrace: %lu with %lu skipped", -+ WARN(pg || skip > 0, "Extra allocated pages for ftrace: %lu with %lu skipped", - remaining, skipped); - } - /* Need to synchronize with ftrace_location_range() */ --- -2.50.1 (Apple Git-155) - diff --git a/1347-ftrace-test-mcount-loc-addr-before-calling-ftrace-call-addr.patch b/1347-ftrace-test-mcount-loc-addr-before-calling-ftrace-call-addr.patch deleted file mode 100644 index bee66c4c1..000000000 --- a/1347-ftrace-test-mcount-loc-addr-before-calling-ftrace-call-addr.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 611153910e7701fddefdbc91f75953b89e698331 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:56:21 +0200 -Subject: [PATCH] ftrace: Test mcount_loc addr before calling - ftrace_call_addr() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 6eeca746fa5f1dd03c6ee05cb03f5eb1ddda1c81 -Author: Steven Rostedt -Date: Tue Feb 25 13:20:05 2025 -0500 - - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - - The addresses in the mcount_loc can be zeroed and then moved by KASLR - making them invalid addresses. ftrace_call_addr() for ARM 64 expects a - valid address to kernel text. If the addr read from the mcount_loc section - is invalid, it must not call ftrace_call_addr(). Move the addr check - before calling ftrace_call_addr() in ftrace_process_locs(). - - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Masahiro Yamada - Cc: Catalin Marinas - Cc: Will Deacon - Cc: Mark Brown - Link: https://lore.kernel.org/20250225182054.290128736@goodmis.org - Fixes: ef378c3b8233 ("scripts/sorttable: Zero out weak functions in mcount_loc table") - Reported-by: Nathan Chancellor - Reported-by: "Arnd Bergmann" - Tested-by: Nathan Chancellor - Closes: https://lore.kernel.org/all/20250225025631.GA271248@ax162/ - Closes: https://lore.kernel.org/all/91523154-072b-437b-bbdc-0b70e9783fd0@app.fastmail.com/ - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 877f943832c9..59069b58fcd4 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -7112,7 +7112,9 @@ static int ftrace_process_locs(struct module *mod, - pg = start_pg; - while (p < end) { - unsigned long end_offset; -- addr = ftrace_call_adjust(*p++); -+ -+ addr = *p++; -+ - /* - * Some architecture linkers will pad between - * the different mcount_loc sections of different -@@ -7124,6 +7126,8 @@ static int ftrace_process_locs(struct module *mod, - continue; - } - -+ addr = ftrace_call_adjust(addr); -+ - end_offset = (pg->index+1) * sizeof(pg->records[0]); - if (end_offset > PAGE_SIZE << pg->order) { - /* We should have allocated enough */ --- -2.50.1 (Apple Git-155) - diff --git a/1348-ftrace-check-against-is-kernel-text-instead-of-kaslr-offset.patch b/1348-ftrace-check-against-is-kernel-text-instead-of-kaslr-offset.patch deleted file mode 100644 index 8e6c1e91e..000000000 --- a/1348-ftrace-check-against-is-kernel-text-instead-of-kaslr-offset.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 4460650d8c24b8689e42d47abeff7fe520f911a3 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:56:25 +0200 -Subject: [PATCH] ftrace: Check against is_kernel_text() instead of - kaslr_offset() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit da0f622b344be769ed61e7c1caf95cd0cdb47964 -Author: Steven Rostedt -Date: Tue Feb 25 13:20:06 2025 -0500 - - ftrace: Check against is_kernel_text() instead of kaslr_offset() - - As kaslr_offset() is architecture dependent and also may not be defined by - all architectures, when zeroing out unused weak functions, do not check - against kaslr_offset(), but instead check if the address is within the - kernel text sections. If KASLR added a shift to the zeroed out function, - it would still not be located in the kernel text. This is a more robust - way to test if the text is valid or not. - - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Masahiro Yamada - Cc: Catalin Marinas - Cc: Will Deacon - Cc: "Arnd Bergmann" - Link: https://lore.kernel.org/20250225182054.471759017@goodmis.org - Fixes: ef378c3b8233 ("scripts/sorttable: Zero out weak functions in mcount_loc table") - Reported-by: Nathan Chancellor - Reported-by: Mark Brown - Tested-by: Nathan Chancellor - Closes: https://lore.kernel.org/all/20250224180805.GA1536711@ax162/ - Closes: https://lore.kernel.org/all/5225b07b-a9b2-4558-9d5f-aa60b19f6317@sirena.org.uk/ - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 59069b58fcd4..63ed9688f491 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -7055,7 +7055,6 @@ static int ftrace_process_locs(struct module *mod, - unsigned long count; - unsigned long *p; - unsigned long addr; -- unsigned long kaslr; - unsigned long flags = 0; /* Shut up gcc */ - unsigned long pages; - int ret = -ENOMEM; -@@ -7105,9 +7104,6 @@ static int ftrace_process_locs(struct module *mod, - ftrace_pages->next = start_pg; - } - -- /* For zeroed locations that were shifted for core kernel */ -- kaslr = !mod ? kaslr_offset() : 0; -- - p = start; - pg = start_pg; - while (p < end) { -@@ -7121,7 +7117,18 @@ static int ftrace_process_locs(struct module *mod, - * object files to satisfy alignments. - * Skip any NULL pointers. - */ -- if (!addr || addr == kaslr) { -+ if (!addr) { -+ skipped++; -+ continue; -+ } -+ -+ /* -+ * If this is core kernel, make sure the address is in core -+ * or inittext, as weak functions get zeroed and KASLR can -+ * move them to something other than zero. It just will not -+ * move it to an area where kernel text is. -+ */ -+ if (!mod && !(is_kernel_text(addr) || is_kernel_inittext(addr))) { - skipped++; - continue; - } --- -2.50.1 (Apple Git-155) - diff --git a/1349-scripts-sorttable-use-normal-sort-if-theres-no-relocs-in-the.patch b/1349-scripts-sorttable-use-normal-sort-if-theres-no-relocs-in-the.patch deleted file mode 100644 index 641a18ea1..000000000 --- a/1349-scripts-sorttable-use-normal-sort-if-theres-no-relocs-in-the.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 5c8bd640b0ee1f1e0d7137f122996180f9bd5590 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:56:27 +0200 -Subject: [PATCH] scripts/sorttable: Use normal sort if theres no relocs in the - mcount section - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 46514b3c2c17c67cefe84b0c1a59e0aaf6093131 -Author: Steven Rostedt -Date: Tue Feb 25 13:20:07 2025 -0500 - - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - - When ARM 64 is compiled with gcc, the mcount_loc section will be filled - with zeros and the addresses will be located in the Elf_Rela sections. To - sort the mcount_loc section, the addresses from the Elf_Rela need to be - placed into an array and that is sorted. - - But when ARM 64 is compiled with clang, it does it the same way as other - architectures and leaves the addresses as is in the mcount_loc section. - - To handle both cases, ARM 64 will first try to sort the Elf_Rela section, - and if it doesn't find any functions, it will then fall back to the - sorting of the addresses in the mcount_loc section itself. - - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Masahiro Yamada - Cc: Catalin Marinas - Cc: Will Deacon - Cc: Mark Brown - Link: https://lore.kernel.org/20250225182054.648398403@goodmis.org - Fixes: b3d09d06e052 ("arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64") - Reported-by: "Arnd Bergmann" - Tested-by: Nathan Chancellor - Closes: https://lore.kernel.org/all/893cd8f1-8585-4d25-bf0f-4197bf872465@app.fastmail.com/ - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 23c7e0e6c024..07ad8116bc8d 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -827,9 +827,14 @@ static void *sort_mcount_loc(void *arg) - pthread_exit(m_err); - } - -- if (sort_reloc) -+ if (sort_reloc) { - count = fill_relocs(vals, size, ehdr, emloc->start_mcount_loc); -- else -+ /* gcc may use relocs to save the addresses, but clang does not. */ -+ if (!count) { -+ count = fill_addrs(vals, size, start_loc); -+ sort_reloc = 0; -+ } -+ } else - count = fill_addrs(vals, size, start_loc); - - if (count < 0) { --- -2.50.1 (Apple Git-155) - diff --git a/1350-scripts-sorttable-allow-matches-to-functions-before-function.patch b/1350-scripts-sorttable-allow-matches-to-functions-before-function.patch deleted file mode 100644 index 6ec1be00b..000000000 --- a/1350-scripts-sorttable-allow-matches-to-functions-before-function.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 7d08b5aa28b2bdd1d1bedbd6e8722bf3799dce71 Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:56:31 +0200 -Subject: [PATCH] scripts/sorttable: Allow matches to functions before function - entry - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit dc208c69c033d3caba0509da1ae065d2b5ff165f -Author: Steven Rostedt -Date: Tue Feb 25 13:20:08 2025 -0500 - - scripts/sorttable: Allow matches to functions before function entry - - ARM 64 uses -fpatchable-function-entry=4,2 which adds padding before the - function and the addresses in the mcount_loc point there instead of the - function entry that is returned by nm. In order to find a function from nm - to make sure it's not an unused weak function, the entries in the - mcount_loc section needs to match the entries from nm. Since it can be an - instruction before the entry, add a before_func variable that ARM 64 can - set to 8, and if the mcount_loc entry is within 8 bytes of the nm function - entry, then it will be considered a match. - - Cc: Masami Hiramatsu - Cc: Mark Rutland - Cc: Mathieu Desnoyers - Cc: Andrew Morton - Cc: Masahiro Yamada - Cc: Catalin Marinas - Cc: Will Deacon - Cc: "Arnd Bergmann" - Cc: Mark Brown - Link: https://lore.kernel.org/20250225182054.815536219@goodmis.org - Fixes: ef378c3b82338 ("scripts/sorttable: Zero out weak functions in mcount_loc table") - Tested-by: Nathan Chancellor - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 07ad8116bc8d..7b4b3714b1af 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -611,13 +611,16 @@ static int add_field(uint64_t addr, uint64_t size) - return 0; - } - -+/* Used for when mcount/fentry is before the function entry */ -+static int before_func; -+ - /* Only return match if the address lies inside the function size */ - static int cmp_func_addr(const void *K, const void *A) - { - uint64_t key = *(const uint64_t *)K; - const struct func_info *a = A; - -- if (key < a->addr) -+ if (key + before_func < a->addr) - return -1; - return key >= a->addr + a->size; - } -@@ -1253,6 +1256,8 @@ static int do_file(char const *const fname, void *addr) - #ifdef MCOUNT_SORT_ENABLED - sort_reloc = true; - rela_type = 0x403; -+ /* arm64 uses patchable function entry placing before function */ -+ before_func = 8; - #endif - /* fallthrough */ - case EM_386: --- -2.50.1 (Apple Git-155) - diff --git a/1351-scripts-sorttable-fix-endianness-handling-in-build-time-mcou.patch b/1351-scripts-sorttable-fix-endianness-handling-in-build-time-mcou.patch deleted file mode 100644 index e7882bc56..000000000 --- a/1351-scripts-sorttable-fix-endianness-handling-in-build-time-mcou.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 3436470d40a0906b91d65287931fc22524334dba Mon Sep 17 00:00:00 2001 -From: Jerome Marchand -Date: Tue, 2 Jun 2026 15:56:34 +0200 -Subject: [PATCH] scripts/sorttable: Fix endianness handling in build-time - mcount sort - -JIRA: https://redhat.atlassian.net/browse/RHEL-180193 - -commit 023f124a64174c47e18340ded7e2a39b96eb9523 -Author: Vasily Gorbik -Date: Wed Apr 2 03:15:35 2025 +0200 - - scripts/sorttable: Fix endianness handling in build-time mcount sort - - Kernel cross-compilation with BUILDTIME_MCOUNT_SORT produces zeroed - mcount values if the build-host endianness does not match the ELF - file endianness. - - The mcount values array is converted from ELF file - endianness to build-host endianness during initialization in - fill_relocs()/fill_addrs(). Avoid extra conversion of these values during - weak-function zeroing; otherwise, they do not match nm-parsed addresses - and all mcount values are zeroed out. - - Cc: Masami Hiramatsu - Cc: Catalin Marinas - Cc: Nathan Chancellor - Cc: Heiko Carstens - Cc: Alexander Gordeev - Link: https://lore.kernel.org/patch.git-dca31444b0f1.your-ad-here.call-01743554658-ext-8692@work.hours - Fixes: ef378c3b8233 ("scripts/sorttable: Zero out weak functions in mcount_loc table") - Reported-by: Ilya Leoshkevich - Reported-by: Ihor Solodrai - Closes: https://lore.kernel.org/all/your-ad-here.call-01743522822-ext-4975@work.hours/ - Signed-off-by: Vasily Gorbik - Signed-off-by: Steven Rostedt (Google) - -Signed-off-by: Jerome Marchand - -diff --git a/scripts/sorttable.c b/scripts/sorttable.c -index 7b4b3714b1af..deed676bfe38 100644 ---- a/scripts/sorttable.c -+++ b/scripts/sorttable.c -@@ -857,7 +857,7 @@ static void *sort_mcount_loc(void *arg) - for (void *ptr = vals; ptr < vals + size; ptr += long_size) { - uint64_t key; - -- key = long_size == 4 ? r((uint32_t *)ptr) : r8((uint64_t *)ptr); -+ key = long_size == 4 ? *(uint32_t *)ptr : *(uint64_t *)ptr; - if (!find_func(key)) { - if (long_size == 4) - *(uint32_t *)ptr = 0; --- -2.50.1 (Apple Git-155) - diff --git a/1352-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch b/1352-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch deleted file mode 100644 index 16f06a1d9..000000000 --- a/1352-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 274bd4477e9c0ac5f42dcc960f4841bc5d2e5171 Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 13 Mar 2026 16:12:26 +0100 -Subject: [PATCH] s390/ap: Expose ap_bindings_complete_count counter via sysfs - -JIRA: https://issues.redhat.com/browse/RHEL-155896 - -commit 51d921a613b1e89a47c2c262bbef1d7b0b032ac7 -Author: Harald Freudenberger -Date: Fri Oct 17 16:51:52 2025 +0200 - - s390/ap: Expose ap_bindings_complete_count counter via sysfs - - The AP bus udev event BINDINGS=complete is sent out when the - first time all devices detected by the AP bus scan have been - bound to device drivers. This is the ideal time to for example - change the AP bus masks apmask and aqmask to re-establish a - persistent change on the decision about which cards/domains - should be available for the host and which should go into the - pool for kvm guests. - - However, if exactly this initial udev event is sent out early - in the boot process a udev rule may not have been established - yet and thus this event will never be recognized. To have - some indication about if the AP bus binding complete has - already happened, the internal ap_bindings_complete_count - counter is exposed via sysfs with this patch. - - Suggested-by: Matthew Rosato - Signed-off-by: Harald Freudenberger - Tested-by: Matthew Rosato - Signed-off-by: Heiko Carstens - -Signed-off-by: Mete Durlu - -diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c -index 15f663e3343a..7345b8c179c7 100644 ---- a/drivers/s390/crypto/ap_bus.c -+++ b/drivers/s390/crypto/ap_bus.c -@@ -1584,6 +1584,15 @@ static ssize_t bindings_show(const struct bus_type *bus, char *buf) - - static BUS_ATTR_RO(bindings); - -+static ssize_t bindings_complete_count_show(const struct bus_type *bus, -+ char *buf) -+{ -+ return sysfs_emit(buf, "%llu\n", -+ atomic64_read(&ap_bindings_complete_count)); -+} -+ -+static BUS_ATTR_RO(bindings_complete_count); -+ - static ssize_t features_show(const struct bus_type *bus, char *buf) - { - int n = 0; -@@ -1624,6 +1633,7 @@ static struct attribute *ap_bus_attrs[] = { - &bus_attr_aqmask.attr, - &bus_attr_scans.attr, - &bus_attr_bindings.attr, -+ &bus_attr_bindings_complete_count.attr, - &bus_attr_features.attr, - NULL, - }; --- -2.50.1 (Apple Git-155) - diff --git a/1353-rxrpc-fix-rxgk-token-loading-to-check-bounds.patch b/1353-rxrpc-fix-rxgk-token-loading-to-check-bounds.patch deleted file mode 100644 index 9fbc7c4e7..000000000 --- a/1353-rxrpc-fix-rxgk-token-loading-to-check-bounds.patch +++ /dev/null @@ -1,135 +0,0 @@ -From f8d027e5525d00e6de81cebce1912c9e9d18de2a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 28 Apr 2026 11:23:37 +0000 -Subject: [PATCH] rxrpc: Fix RxGK token loading to check bounds - -JIRA: https://redhat.atlassian.net/browse/RHEL-171420 -CVE: CVE-2026-31641 - -commit d179a868dd755b0cfcf7582e00943d702b9943b8 -Author: Oleh Konko -Date: Wed Apr 8 13:12:33 2026 +0100 - - rxrpc: Fix RxGK token loading to check bounds - - rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length - from the XDR token as u32 values and passes each through round_up(x, 4) - before using the rounded value for validation and allocation. When the raw - length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and - kzalloc both use 0 while the subsequent memcpy still copies the original - ~4 GiB value, producing a heap buffer overflow reachable from an - unprivileged add_key() call. - - Fix this by: - - (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket - lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with - the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX. - - (2) Sizing the flexible-array allocation from the validated raw key - length via struct_size_t() instead of the rounded value. - - (3) Caching the raw lengths so that the later field assignments and - memcpy calls do not re-read from the token, eliminating a class of - TOCTOU re-parse. - - The control path (valid token with lengths within bounds) is unaffected. - - Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class") - Signed-off-by: Oleh Konko - Signed-off-by: David Howells - Reviewed-by: Jeffrey Altman - cc: Marc Dionne - cc: Simon Horman - cc: linux-afs@lists.infradead.org - cc: stable@kernel.org - Link: https://patch.msgid.link/20260408121252.2249051-6-dhowells@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c -index 9fdc1f031c9d..6ff2c504dd41 100644 ---- a/net/rxrpc/key.c -+++ b/net/rxrpc/key.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -171,7 +172,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep, - size_t plen; - const __be32 *ticket, *key; - s64 tmp; -- u32 tktlen, keylen; -+ size_t raw_keylen, raw_tktlen, keylen, tktlen; - - _enter(",{%x,%x,%x,%x},%x", - ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), -@@ -181,18 +182,22 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep, - goto reject; - - key = xdr + (6 * 2 + 1); -- keylen = ntohl(key[-1]); -- _debug("keylen: %x", keylen); -- keylen = round_up(keylen, 4); -+ raw_keylen = ntohl(key[-1]); -+ _debug("keylen: %zx", raw_keylen); -+ if (raw_keylen > AFSTOKEN_GK_KEY_MAX) -+ goto reject; -+ keylen = round_up(raw_keylen, 4); - if ((6 * 2 + 2) * 4 + keylen > toklen) - goto reject; - - ticket = xdr + (6 * 2 + 1 + (keylen / 4) + 1); -- tktlen = ntohl(ticket[-1]); -- _debug("tktlen: %x", tktlen); -- tktlen = round_up(tktlen, 4); -+ raw_tktlen = ntohl(ticket[-1]); -+ _debug("tktlen: %zx", raw_tktlen); -+ if (raw_tktlen > AFSTOKEN_GK_TOKEN_MAX) -+ goto reject; -+ tktlen = round_up(raw_tktlen, 4); - if ((6 * 2 + 2) * 4 + keylen + tktlen != toklen) { -- kleave(" = -EKEYREJECTED [%x!=%x, %x,%x]", -+ kleave(" = -EKEYREJECTED [%zx!=%x, %zx,%zx]", - (6 * 2 + 2) * 4 + keylen + tktlen, toklen, - keylen, tktlen); - goto reject; -@@ -206,7 +211,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep, - if (!token) - goto nomem; - -- token->rxgk = kzalloc(sizeof(*token->rxgk) + keylen, GFP_KERNEL); -+ token->rxgk = kzalloc(struct_size_t(struct rxgk_key, _key, raw_keylen), GFP_KERNEL); - if (!token->rxgk) - goto nomem_token; - -@@ -221,9 +226,9 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep, - token->rxgk->enctype = tmp = xdr_dec64(xdr + 5 * 2); - if (tmp < 0 || tmp > UINT_MAX) - goto reject_token; -- token->rxgk->key.len = ntohl(key[-1]); -+ token->rxgk->key.len = raw_keylen; - token->rxgk->key.data = token->rxgk->_key; -- token->rxgk->ticket.len = ntohl(ticket[-1]); -+ token->rxgk->ticket.len = raw_tktlen; - - if (token->rxgk->endtime != 0) { - expiry = rxrpc_s64_to_time64(token->rxgk->endtime); -@@ -236,8 +241,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep, - memcpy(token->rxgk->key.data, key, token->rxgk->key.len); - - /* Pad the ticket so that we can use it directly in XDR */ -- token->rxgk->ticket.data = kzalloc(round_up(token->rxgk->ticket.len, 4), -- GFP_KERNEL); -+ token->rxgk->ticket.data = kzalloc(tktlen, GFP_KERNEL); - if (!token->rxgk->ticket.data) - goto nomem_yrxgk; - memcpy(token->rxgk->ticket.data, ticket, token->rxgk->ticket.len); --- -2.50.1 (Apple Git-155) - diff --git a/1354-xen-privcmd-fix-double-free-via-vma-splitting.patch b/1354-xen-privcmd-fix-double-free-via-vma-splitting.patch deleted file mode 100644 index 9da1bf693..000000000 --- a/1354-xen-privcmd-fix-double-free-via-vma-splitting.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 2894a351fe2ea8684919d36df3188b9a35e3926f Mon Sep 17 00:00:00 2001 -From: Juergen Gross -Date: Fri, 10 Apr 2026 09:20:04 +0200 -Subject: [PATCH] xen/privcmd: fix double free via VMA splitting - -commit 24daca4fc07f3ff8cd0e3f629cd982187f48436a upstream. - -privcmd_vm_ops defines .close (privcmd_close), but neither .may_split -nor .open. When userspace does a partial munmap() on a privcmd mapping, -the kernel splits the VMA via __split_vma(). Since may_split is NULL, -the split is allowed. vm_area_dup() copies vm_private_data (a pages -array allocated in alloc_empty_pages()) into the new VMA without any -fixup, because there is no .open callback. - -Both VMAs now point to the same pages array. When the unmapped portion -is closed, privcmd_close() calls: - - xen_unmap_domain_gfn_range() - - xen_free_unpopulated_pages() - - kvfree(pages) - -The surviving VMA still holds the dangling pointer. When it is later -destroyed, the same sequence runs again, which leads to a double free. - -Fix this issue by adding a .may_split callback denying the VMA split. - -This is XSA-487 / CVE-2026-31787 - -Fixes: d71f513985c2 ("xen: privcmd: support autotranslated physmap guests.") -Reported-by: Atharva Vartak -Suggested-by: Atharva Vartak -Signed-off-by: Juergen Gross -Reviewed-by: Jan Beulich -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c -index d7d9d427e51a..115b54c3805b 100644 ---- a/drivers/xen/privcmd.c -+++ b/drivers/xen/privcmd.c -@@ -1639,6 +1639,12 @@ static void privcmd_close(struct vm_area_struct *vma) - kvfree(pages); - } - -+static int privcmd_may_split(struct vm_area_struct *area, unsigned long addr) -+{ -+ /* Forbid splitting, avoids double free via privcmd_close(). */ -+ return -EINVAL; -+} -+ - static vm_fault_t privcmd_fault(struct vm_fault *vmf) - { - printk(KERN_DEBUG "privcmd_fault: vma=%p %lx-%lx, pgoff=%lx, uv=%p\n", -@@ -1650,6 +1656,7 @@ static vm_fault_t privcmd_fault(struct vm_fault *vmf) - - static const struct vm_operations_struct privcmd_vm_ops = { - .close = privcmd_close, -+ .may_split = privcmd_may_split, - .fault = privcmd_fault - }; - --- -2.50.1 (Apple Git-155) - diff --git a/1355-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch b/1355-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch deleted file mode 100644 index 7d840c273..000000000 --- a/1355-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 4bdf131363bf22e4cfb8dbaaf0cf38ae0e18dfe7 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Thu, 7 May 2026 18:01:01 -0500 -Subject: [PATCH] Bluetooth: hci_sync: fix stack buffer overflow in - hci_le_big_create_sync -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-172460 - -JIRA: https://issues.redhat.com/browse/RHEL-172865 -CVE: CVE-2026-31772 - -commit bc39a094730ce062fa034a529c93147c096cb488 -Author: hkbinbin -Date: Tue Mar 31 05:39:16 2026 +0000 - - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync - - hci_le_big_create_sync() uses DEFINE_FLEX to allocate a - struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) - BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) - entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller - hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31, - the memcpy that copies conn->bis into cp->bis writes up to 14 bytes - past the stack buffer, corrupting adjacent stack memory. - - This is trivially reproducible: binding an ISO socket with - bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will - eventually trigger hci_le_big_create_sync() from the HCI command - sync worker, causing a KASAN-detectable stack-out-of-bounds write: - - BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0 - Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71 - - Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to - HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that - conn->bis can actually carry. - - Fixes: 42ecf1947135 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending") - Cc: stable@vger.kernel.org - Signed-off-by: hkbinbin - Reviewed-by: Paul Menzel - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index 092118b12e18..9096f6ba940b 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -7241,7 +7241,8 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err) - - static int hci_le_big_create_sync(struct hci_dev *hdev, void *data) - { -- DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, 0x11); -+ DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, -+ HCI_MAX_ISO_BIS); - struct hci_conn *conn = data; - struct bt_iso_qos *qos = &conn->iso_qos; - int err; --- -2.50.1 (Apple Git-155) - diff --git a/1356-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch b/1356-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch deleted file mode 100644 index 4ec00005c..000000000 --- a/1356-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a Mon Sep 17 00:00:00 2001 -From: Juergen Gross -Date: Fri, 27 Mar 2026 14:13:38 +0100 -Subject: [PATCH] Buffer overflow in drivers/xen/sys-hypervisor.c - -commit 27fdbab4221b375de54bf91919798d88520c6e28 upstream. - -The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is -neither NUL terminated nor a string. - -The first causes a buffer overflow as sprintf in buildid_show will -read and copy till it finds a NUL. - -00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| -00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| -00000017 - -So use a memcpy instead of sprintf to have the correct value: - -00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| -00000010 b9 a8 01 42 |...B| -00000014 - -(the above have a hack to embed a zero inside and check it's -returned correctly). - -This is XSA-485 / CVE-2026-31786 - -Fixes: 84b7625728ea ("xen: add sysfs node for hypervisor build id") -Signed-off-by: Frediano Ziglio -Reviewed-by: Juergen Gross -Signed-off-by: Juergen Gross -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c -index 2f880374b463..c1a0ca1b1b5f 100644 ---- a/drivers/xen/sys-hypervisor.c -+++ b/drivers/xen/sys-hypervisor.c -@@ -366,6 +366,8 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer) - ret = sprintf(buffer, ""); - return ret; - } -+ if (ret > PAGE_SIZE) -+ return -ENOSPC; - - buildid = kmalloc(sizeof(*buildid) + ret, GFP_KERNEL); - if (!buildid) -@@ -373,8 +375,10 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer) - - buildid->len = ret; - ret = HYPERVISOR_xen_version(XENVER_build_id, buildid); -- if (ret > 0) -- ret = sprintf(buffer, "%s", buildid->buf); -+ if (ret > 0) { -+ /* Build id is binary, not a string. */ -+ memcpy(buffer, buildid->buf, ret); -+ } - kfree(buildid); - - return ret; --- -2.50.1 (Apple Git-155) - diff --git a/1357-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch b/1357-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch deleted file mode 100644 index 2dcb7832e..000000000 --- a/1357-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch +++ /dev/null @@ -1,91 +0,0 @@ -From a3d5e28fb3f0f40b12dff60955e3961c64e679ff Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 12 May 2026 14:05:16 +0000 -Subject: [PATCH] can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - -JIRA: https://redhat.atlassian.net/browse/RHEL-175537 -CVE: CVE-2026-31474 - -commit 424e95d62110cdbc8fd12b40918f37e408e35a92 -Author: Oliver Hartkopp -Date: Thu Mar 19 16:47:45 2026 +0100 - - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - - isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access - to so->tx.buf. isotp_release() waits for ISOTP_IDLE via - wait_event_interruptible() and then calls kfree(so->tx.buf). - - If a signal interrupts the wait_event_interruptible() inside close() - while tx.state is ISOTP_SENDING, the loop exits early and release - proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) - while sendmsg may still be reading so->tx.buf for the final CAN frame - in isotp_fill_dataframe(). - - The so->tx.buf can be allocated once when the standard tx.buf length needs - to be extended. Move the kfree() of this potentially extended tx.buf to - sk_destruct time when either isotp_sendmsg() and isotp_release() are done. - - Fixes: 96d1c81e6a04 ("can: isotp: add module parameter for maximum pdu size") - Cc: stable@vger.kernel.org - Reported-by: Ali Norouzi - Co-developed-by: Ali Norouzi - Signed-off-by: Ali Norouzi - Signed-off-by: Oliver Hartkopp - Link: https://patch.msgid.link/20260319-fix-can-gw-and-can-isotp-v2-2-c45d52c6d2d8@pengutronix.de - Signed-off-by: Marc Kleine-Budde - -Signed-off-by: CKI Backport Bot - -diff --git a/net/can/isotp.c b/net/can/isotp.c -index 515ab62b0943..23efb4d79228 100644 ---- a/net/can/isotp.c -+++ b/net/can/isotp.c -@@ -1230,12 +1230,6 @@ static int isotp_release(struct socket *sock) - so->ifindex = 0; - so->bound = 0; - -- if (so->rx.buf != so->rx.sbuf) -- kfree(so->rx.buf); -- -- if (so->tx.buf != so->tx.sbuf) -- kfree(so->tx.buf); -- - sock_orphan(sk); - sock->sk = NULL; - -@@ -1603,6 +1597,21 @@ static int isotp_notifier(struct notifier_block *nb, unsigned long msg, - return NOTIFY_DONE; - } - -+static void isotp_sock_destruct(struct sock *sk) -+{ -+ struct isotp_sock *so = isotp_sk(sk); -+ -+ /* do the standard CAN sock destruct work */ -+ can_sock_destruct(sk); -+ -+ /* free potential extended PDU buffers */ -+ if (so->rx.buf != so->rx.sbuf) -+ kfree(so->rx.buf); -+ -+ if (so->tx.buf != so->tx.sbuf) -+ kfree(so->tx.buf); -+} -+ - static int isotp_init(struct sock *sk) - { - struct isotp_sock *so = isotp_sk(sk); -@@ -1647,6 +1656,9 @@ static int isotp_init(struct sock *sk) - list_add_tail(&so->notifier, &isotp_notifier_list); - spin_unlock(&isotp_notifier_lock); - -+ /* re-assign default can_sock_destruct() reference */ -+ sk->sk_destruct = isotp_sock_destruct; -+ - return 0; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1358-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-dropped-dur.patch b/1358-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-dropped-dur.patch deleted file mode 100644 index 2f2beb85f..000000000 --- a/1358-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-dropped-dur.patch +++ /dev/null @@ -1,126 +0,0 @@ -From a1229adf21035776936072b77d724e9e79cdf813 Mon Sep 17 00:00:00 2001 -From: Paul Ely -Date: Wed, 3 Dec 2025 20:18:59 -0500 -Subject: [PATCH] scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED - during FLOGI - -JIRA: https://issues.redhat.com/browse/RHEL-127898 - -commit 07caedc6a3887938813727beafea40f07c497705 -Author: Justin Tee -Date: Thu Nov 6 14:46:36 2025 -0800 - - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI - - It's possible for an unstable link to repeatedly bounce allowing a FLOGI - retry, but then bounce again forcing an abort of the FLOGI. Ensure that - the initial reference count on the FLOGI ndlp is restored in this faulty - link scenario. - - Signed-off-by: Justin Tee - Link: https://patch.msgid.link/20251106224639.139176-8-justintee8345@gmail.com - Signed-off-by: Martin K. Petersen - -Signed-off-by: Paul Ely - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index f8df66009c35..ef6e4ee9b608 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -934,10 +934,15 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - /* Check to see if link went down during discovery */ - if (lpfc_els_chk_latt(vport)) { - /* One additional decrement on node reference count to -- * trigger the release of the node -+ * trigger the release of the node. Make sure the ndlp -+ * is marked NLP_DROPPED. - */ -- if (!(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) -+ if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) && -+ !test_bit(NLP_DROPPED, &ndlp->nlp_flag) && -+ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { -+ set_bit(NLP_DROPPED, &ndlp->nlp_flag); - lpfc_nlp_put(ndlp); -+ } - goto out; - } - -@@ -995,9 +1000,10 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - IOERR_LOOP_OPEN_FAILURE))) - lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, - "2858 FLOGI Status:x%x/x%x TMO" -- ":x%x Data x%lx x%x\n", -+ ":x%x Data x%lx x%x x%lx x%x\n", - ulp_status, ulp_word4, tmo, -- phba->hba_flag, phba->fcf.fcf_flag); -+ phba->hba_flag, phba->fcf.fcf_flag, -+ ndlp->nlp_flag, ndlp->fc4_xpt_flags); - - /* Check for retry */ - if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { -@@ -1015,14 +1021,17 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - * reference to trigger node release. - */ - if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) && -- !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) -+ !test_bit(NLP_DROPPED, &ndlp->nlp_flag) && -+ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { -+ set_bit(NLP_DROPPED, &ndlp->nlp_flag); - lpfc_nlp_put(ndlp); -+ } - - lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS, - "0150 FLOGI Status:x%x/x%x " -- "xri x%x TMO:x%x refcnt %d\n", -+ "xri x%x iotag x%x TMO:x%x refcnt %d\n", - ulp_status, ulp_word4, cmdiocb->sli4_xritag, -- tmo, kref_read(&ndlp->kref)); -+ cmdiocb->iotag, tmo, kref_read(&ndlp->kref)); - - /* If this is not a loop open failure, bail out */ - if (!(ulp_status == IOSTAT_LOCAL_REJECT && -@@ -1279,6 +1288,19 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - uint32_t tmo, did; - int rc; - -+ /* It's possible for lpfc to reissue a FLOGI on an ndlp that is marked -+ * NLP_DROPPED. This happens when the FLOGI completed with the XB bit -+ * set causing lpfc to reference the ndlp until the XRI_ABORTED CQE is -+ * issued. The time window for the XRI_ABORTED CQE can be as much as -+ * 2*2*RA_TOV allowing for ndlp reuse of this type when the link is -+ * cycling quickly. When true, restore the initial reference and remove -+ * the NLP_DROPPED flag as lpfc is retrying. -+ */ -+ if (test_and_clear_bit(NLP_DROPPED, &ndlp->nlp_flag)) { -+ if (!lpfc_nlp_get(ndlp)) -+ return 1; -+ } -+ - cmdsize = (sizeof(uint32_t) + sizeof(struct serv_parm)); - elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, - ndlp->nlp_DID, ELS_CMD_FLOGI); -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 1510ed28f5a4..dcf78ea77a7d 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -424,6 +424,7 @@ lpfc_check_nlp_post_devloss(struct lpfc_vport *vport, - struct lpfc_nodelist *ndlp) - { - if (test_and_clear_bit(NLP_IN_RECOV_POST_DEV_LOSS, &ndlp->save_flags)) { -+ clear_bit(NLP_DROPPED, &ndlp->nlp_flag); - lpfc_nlp_get(ndlp); - lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY | LOG_NODE, - "8438 Devloss timeout reversed on DID x%x " -@@ -566,7 +567,8 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp) - return fcf_inuse; - } - -- lpfc_nlp_put(ndlp); -+ if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -+ lpfc_nlp_put(ndlp); - return fcf_inuse; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1359-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch b/1359-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch deleted file mode 100644 index b28becf3d..000000000 --- a/1359-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 22386453397f34a0238d452c87184b741aaaee80 Mon Sep 17 00:00:00 2001 -From: David Marlin -Date: Thu, 7 May 2026 18:01:01 -0500 -Subject: [PATCH] Bluetooth: hci_event: fix potential UAF in SSP passkey - handlers - -JIRA: https://issues.redhat.com/browse/RHEL-172460 - -commit 85fa3512048793076eef658f66489112dcc91993 -Author: Shuvam Pandey -Date: Thu Apr 9 00:32:30 2026 +0545 - - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - - hci_conn lookup and field access must be covered by hdev lock in - hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise - the connection can be freed concurrently. - - Extend the hci_dev_lock critical section to cover all conn usage in both - handlers. - - Keep the existing keypress notification behavior unchanged by routing - the early exits through a common unlock path. - - Fixes: 92a25256f142 ("Bluetooth: mgmt: Implement support for passkey notification") - Cc: stable@vger.kernel.org - Signed-off-by: Shuvam Pandey - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: David Marlin - -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 3ebc5e6d45d9..6500f7a327f6 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5498,9 +5498,11 @@ static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data, - - bt_dev_dbg(hdev, ""); - -+ hci_dev_lock(hdev); -+ - conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); - if (!conn) -- return; -+ goto unlock; - - conn->passkey_notify = __le32_to_cpu(ev->passkey); - conn->passkey_entered = 0; -@@ -5509,6 +5511,9 @@ static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data, - mgmt_user_passkey_notify(hdev, &conn->dst, conn->type, - conn->dst_type, conn->passkey_notify, - conn->passkey_entered); -+ -+unlock: -+ hci_dev_unlock(hdev); - } - - static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data, -@@ -5519,14 +5524,16 @@ static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data, - - bt_dev_dbg(hdev, ""); - -+ hci_dev_lock(hdev); -+ - conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); - if (!conn) -- return; -+ goto unlock; - - switch (ev->type) { - case HCI_KEYPRESS_STARTED: - conn->passkey_entered = 0; -- return; -+ goto unlock; - - case HCI_KEYPRESS_ENTERED: - conn->passkey_entered++; -@@ -5541,13 +5548,16 @@ static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data, - break; - - case HCI_KEYPRESS_COMPLETED: -- return; -+ goto unlock; - } - - if (hci_dev_test_flag(hdev, HCI_MGMT)) - mgmt_user_passkey_notify(hdev, &conn->dst, conn->type, - conn->dst_type, conn->passkey_notify, - conn->passkey_entered); -+ -+unlock: -+ hci_dev_unlock(hdev); - } - - static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data, --- -2.50.1 (Apple Git-155) - diff --git a/1360-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch b/1360-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch deleted file mode 100644 index 92e47eb59..000000000 --- a/1360-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 887ece6c23b49d02a6678e7a8d5ad213d75883ce Mon Sep 17 00:00:00 2001 -From: Benjamin Berg -Date: Tue, 5 May 2026 15:15:40 +0200 -Subject: [PATCH] wifi: mac80211: use safe list iteration in radar detect work - -commit ac8eb3e18f41e2cc8492cc1d358bcb786c850270 upstream. - -The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to -be freed and removed from the list. Guard against this to avoid a -slab-use-after-free error. - -Cc: stable@vger.kernel.org -Fixes: bca8bc0399ac ("wifi: mac80211: handle ieee80211_radar_detected() for MLO") -Signed-off-by: Benjamin Berg -Link: https://patch.msgid.link/20260505151539.236d63a1b736.I35dbb9e96a2d4a480be208770fdd99ba3b817b79@changeid -Signed-off-by: Johannes Berg -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index 77638e965726..5bb9e1d2479f 100644 ---- a/net/mac80211/util.c -+++ b/net/mac80211/util.c -@@ -3504,11 +3504,11 @@ void ieee80211_dfs_radar_detected_work(struct wiphy *wiphy, - struct ieee80211_local *local = - container_of(work, struct ieee80211_local, radar_detected_work); - struct cfg80211_chan_def chandef; -- struct ieee80211_chanctx *ctx; -+ struct ieee80211_chanctx *ctx, *tmp; - - lockdep_assert_wiphy(local->hw.wiphy); - -- list_for_each_entry(ctx, &local->chanctx_list, list) { -+ list_for_each_entry_safe(ctx, tmp, &local->chanctx_list, list) { - if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER) - continue; - --- -2.50.1 (Apple Git-155) - diff --git a/1361-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch b/1361-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch deleted file mode 100644 index b3defedde..000000000 --- a/1361-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 1739fc31b4de06c5c78ce0741182770fb079091e Mon Sep 17 00:00:00 2001 -From: Catherine -Date: Fri, 24 Apr 2026 21:14:36 +0800 -Subject: [PATCH] wifi: mac80211: drop stray 'static' from fast-RX rx_result - -commit 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba upstream. - -ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but -its per-invocation rx_result is declared static. Concurrent callers then -share one instance and can overwrite each other's result between -ieee80211_rx_mesh_data() and the switch on res. - -That can make a packet that was queued or consumed by -ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make -a packet that should continue return as queued. - -Make res an automatic variable so each invocation keeps its own result. - -Fixes: 3468e1e0c639 ("wifi: mac80211: add mesh fast-rx support") -Cc: stable@vger.kernel.org -Signed-off-by: Catherine -Link: https://patch.msgid.link/20260424131435.83212-2-enderaoelyther@gmail.com -Signed-off-by: Johannes Berg -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index e4a3ce716f6b..590702838392 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -4882,7 +4882,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, - struct sk_buff *skb = rx->skb; - struct ieee80211_hdr *hdr = (void *)skb->data; - struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); -- static ieee80211_rx_result res; -+ ieee80211_rx_result res; - int orig_len = skb->len; - int hdrlen = ieee80211_hdrlen(hdr->frame_control); - int snap_offs = hdrlen; --- -2.50.1 (Apple Git-155) - diff --git a/1362-wifi-mac80211-remove-station-if-connection-prep-fails.patch b/1362-wifi-mac80211-remove-station-if-connection-prep-fails.patch deleted file mode 100644 index 11f664fd6..000000000 --- a/1362-wifi-mac80211-remove-station-if-connection-prep-fails.patch +++ /dev/null @@ -1,59 +0,0 @@ -From afcbaed89cdc1a001b43270cbf5394bb4804270a Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Tue, 5 May 2026 15:15:34 +0200 -Subject: [PATCH] wifi: mac80211: remove station if connection prep fails - -commit 283fc9e44ff5b5ac967439b4951b80bd4299f4e4 upstream. - -If connection preparation fails for MLO connections, then the -interface is completely reset to non-MLD. In this case, we must -not keep the station since it's related to the link of the vif -being removed. Delete an existing station. Any "new_sta" is -already being removed, so that doesn't need changes. - -This fixes a use-after-free/double-free in debugfs if that's -enabled, because a vif going from MLD (and to MLD, but that's -not relevant here) recreates its entire debugfs. - -Cc: stable@vger.kernel.org -Fixes: 81151ce462e5 ("wifi: mac80211: support MLO authentication/association with one link") -Reviewed-by: Miriam Rachel Korenblit -Link: https://patch.msgid.link/20260505151533.c4e52deb06ad.Iafe56cec7de8512626169496b134bce3a6c17010@changeid -Signed-off-by: Johannes Berg -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index f3138d1..11caa4e 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -8890,7 +8890,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - struct ieee80211_bss *bss = (void *)cbss->priv; - struct sta_info *new_sta = NULL; - struct ieee80211_link_data *link; -- bool have_sta = false; -+ struct sta_info *have_sta = NULL; - bool mlo; - int err; - u16 new_links; -@@ -8909,11 +8909,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - mlo = false; - } - -- if (assoc) { -- rcu_read_lock(); -+ if (assoc) - have_sta = sta_info_get(sdata, ap_mld_addr); -- rcu_read_unlock(); -- } - - if (mlo && !have_sta && - WARN_ON(sdata->vif.valid_links || sdata->vif.active_links)) -@@ -9072,6 +9069,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - out_release_chan: - ieee80211_link_release_channel(link); - out_err: -+ if (mlo && have_sta) -+ WARN_ON(__sta_info_destroy(have_sta)); - ieee80211_vif_set_links(sdata, 0, 0); - return err; - } diff --git a/1363-bnxt-en-fix-rss-context-delete-logic.patch b/1363-bnxt-en-fix-rss-context-delete-logic.patch deleted file mode 100644 index 77c242f22..000000000 --- a/1363-bnxt-en-fix-rss-context-delete-logic.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 6427dde01daa725ddd17ac84c033dba89b75011a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 29 May 2026 08:33:51 +0000 -Subject: [PATCH] bnxt_en: Fix RSS context delete logic - -JIRA: https://redhat.atlassian.net/browse/RHEL-180316 -CVE: CVE-2026-43260 -Backported from tree(s): linux - -commit e123d9302d223767bd910bfbcfe607bae909f8ac -Author: Pavan Chebbi -Date: Thu Feb 19 10:53:11 2026 -0800 - - bnxt_en: Fix RSS context delete logic - - We need to free the corresponding RSS context VNIC - in FW everytime an RSS context is deleted in driver. - Commit 667ac333dbb7 added a check to delete the VNIC - in FW only when netif_running() is true to help delete - RSS contexts with interface down. - - Having that condition will make the driver leak VNICs - in FW whenever close() happens with active RSS contexts. - On the subsequent open(), as part of RSS context restoration, - we will end up trying to create extra VNICs for which we - did not make any reservation. FW can fail this request, - thereby making us lose active RSS contexts. - - Suppose an RSS context is deleted already and we try to - process a delete request again, then the HWRM functions - will check for validity of the request and they simply - return if the resource is already freed. So, even for - delete-when-down cases, netif_running() check is not - necessary. - - Remove the netif_running() condition check when deleting - an RSS context. - - Reported-by: Jakub Kicinski - Fixes: 667ac333dbb7 ("eth: bnxt: allow deleting RSS contexts when the device is down") - Reviewed-by: Andy Gospodarek - Signed-off-by: Pavan Chebbi - Signed-off-by: Michael Chan - Link: https://patch.msgid.link/20260219185313.2682148-2-michael.chan@broadcom.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index d212468cf8aa..3a88c43cdf2b 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -10734,12 +10734,10 @@ void bnxt_del_one_rss_ctx(struct bnxt *bp, struct bnxt_rss_ctx *rss_ctx, - struct bnxt_ntuple_filter *ntp_fltr; - int i; - -- if (netif_running(bp->dev)) { -- bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic); -- for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) { -- if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID) -- bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i); -- } -+ bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic); -+ for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) { -+ if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID) -+ bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i); - } - if (!all) - return; --- -2.50.1 (Apple Git-155) - diff --git a/1364-objtool-klp-fix-unexported-static-call-key-access-for-manual.patch b/1364-objtool-klp-fix-unexported-static-call-key-access-for-manual.patch deleted file mode 100644 index 9e3a759e4..000000000 --- a/1364-objtool-klp-fix-unexported-static-call-key-access-for-manual.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 38c161cc88e827fd254aad30a0b7b19bbd85c014 Mon Sep 17 00:00:00 2001 -From: Yannick Cote -Date: Fri, 15 May 2026 23:45:14 +0000 -Subject: [PATCH] objtool/klp: Fix unexported static call key access for - manually built livepatch modules - -JIRA: https://redhat.atlassian.net/browse/RHEL-152189 - -commit f495054bd12e2abe5068e243bdf344b704c303c6 -Author: Josh Poimboeuf -Date: Mon Feb 2 11:00:17 2026 -0800 - - objtool/klp: Fix unexported static call key access for manually built livepatch modules - - Enabling CONFIG_MEM_ALLOC_PROFILING_DEBUG with CONFIG_SAMPLE_LIVEPATCH - results in the following error: - - samples/livepatch/livepatch-shadow-fix1.o: error: objtool: static_call: can't find static_call_key symbol: __SCK__WARN_trap - - This is caused an extra file->klp sanity check which was added by commit - 164c9201e1da ("objtool: Add base objtool support for livepatch - modules"). That check was intended to ensure that livepatch modules - built with klp-build always have full access to their static call keys. - - However, it failed to account for the fact that manually built livepatch - modules (i.e., not built with klp-build) might need access to unexported - static call keys, for which read-only access is typically allowed for - modules. - - While the livepatch-shadow-fix1 module doesn't explicitly use any static - calls, it does have a memory allocation, which can cause - CONFIG_MEM_ALLOC_PROFILING_DEBUG to insert a WARN() call. And WARN() is - now an unexported static call as of commit 860238af7a33 ("x86_64/bug: - Inline the UD1"). - - Fix it by removing the overzealous file->klp check, restoring the - original behavior for manually built livepatch modules. - - Fixes: 164c9201e1da ("objtool: Add base objtool support for livepatch modules") - Reported-by: Arnd Bergmann - Acked-by: Song Liu - Tested-by: Arnd Bergmann - Link: https://patch.msgid.link/0bd3ae9a53c3d743417fe842b740a7720e2bcd1c.1770058775.git.jpoimboe@kernel.org - Signed-off-by: Josh Poimboeuf - -Signed-off-by: Yannick Cote - -diff --git a/tools/objtool/check.c b/tools/objtool/check.c -index 55072399820d..e63670bab6c2 100644 ---- a/tools/objtool/check.c -+++ b/tools/objtool/check.c -@@ -683,7 +683,7 @@ static int create_static_call_sections(struct objtool_file *file) - - key_sym = find_symbol_by_name(file->elf, tmp); - if (!key_sym) { -- if (!opts.module || file->klp) { -+ if (!opts.module) { - ERROR("static_call: can't find static_call_key symbol: %s", tmp); - return -1; - } --- -2.50.1 (Apple Git-155) - diff --git a/1365-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch b/1365-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch deleted file mode 100644 index 330080775..000000000 --- a/1365-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 60728887dfafe77e619af7c32215ceccf1d342e3 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 19:29:37 +0000 -Subject: [PATCH] rbd: eliminate a race in lock_dwork draining on unmap - -JIRA: https://redhat.atlassian.net/browse/RHEL-180187 -Backported from tree(s): linux - -commit 9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90 -Author: Ilya Dryomov -Date: Tue May 19 23:07:26 2026 +0200 - - rbd: eliminate a race in lock_dwork draining on unmap - - Given how rbd_lock_add_request() and rbd_img_exclusive_lock() are - written, lock_dwork may be (re)queued more than it's actually needed: - for example in case a new I/O request comes in while we are in the - middle of rbd_acquire_lock() on behalf of another I/O request. This is - expected and with rbd_release_lock() preemptively canceling lock_dwork - is benign under normal operation. - - A more problematic example is maybe_kick_acquire(): - - if (have_requests || delayed_work_pending(&rbd_dev->lock_dwork)) { - dout("%s rbd_dev %p kicking lock_dwork\n", __func__, rbd_dev); - mod_delayed_work(rbd_dev->task_wq, &rbd_dev->lock_dwork, 0); - } - - It's not unrealistic for lock_dwork to get canceled right after - delayed_work_pending() returns true and for mod_delayed_work() to - requeue it right there anyway. This is a classic TOCTOU race. - - When it comes to unmapping the image, there is an implicit assumption - of no self-initiated exclusive lock activity past the point of return - from rbd_dev_image_unlock() which unlocks the lock if it happens to be - held. This unlock is assumed to be final and lock_dwork (as well as - all other exclusive lock tasks, really) isn't expected to get queued - again. However, lock_dwork is canceled only in cancel_tasks_sync() - (i.e. later in the unmap sequence) and on top of that the cancellation - can get in effect nullified by maybe_kick_acquire(). This may result - in rbd_acquire_lock() executing after rbd_dev_device_release() and - rbd_dev_image_release() run and free and/or reset a bunch of things. - One of the possible failure modes then is a violated - - rbd_assert(rbd_image_format_valid(rbd_dev->image_format)); - - in rbd_dev_header_info() which is called via rbd_dev_refresh() from - rbd_post_acquire_action(). - - Redo exclusive lock task draining to provide saner semantics and try - to meet the assumptions around rbd_dev_image_unlock(). - - Cc: stable@vger.kernel.org - Signed-off-by: Ilya Dryomov - Reviewed-by: Viacheslav Dubeyko - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index af0e21149dbc..6e57a51a71eb 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -4547,24 +4547,12 @@ static int rbd_register_watch(struct rbd_device *rbd_dev) - return ret; - } - --static void cancel_tasks_sync(struct rbd_device *rbd_dev) --{ -- dout("%s rbd_dev %p\n", __func__, rbd_dev); -- -- cancel_work_sync(&rbd_dev->acquired_lock_work); -- cancel_work_sync(&rbd_dev->released_lock_work); -- cancel_delayed_work_sync(&rbd_dev->lock_dwork); -- cancel_work_sync(&rbd_dev->unlock_work); --} -- - /* - * header_rwsem must not be held to avoid a deadlock with - * rbd_dev_refresh() when flushing notifies. - */ - static void rbd_unregister_watch(struct rbd_device *rbd_dev) - { -- cancel_tasks_sync(rbd_dev); -- - mutex_lock(&rbd_dev->watch_mutex); - if (rbd_dev->watch_state == RBD_WATCH_STATE_REGISTERED) - __rbd_unregister_watch(rbd_dev); -@@ -6539,10 +6527,18 @@ static int rbd_add_parse_args(const char *buf, - - static void rbd_dev_image_unlock(struct rbd_device *rbd_dev) - { -+ dout("%s rbd_dev %p\n", __func__, rbd_dev); -+ -+ disable_delayed_work_sync(&rbd_dev->lock_dwork); -+ disable_work_sync(&rbd_dev->unlock_work); -+ - down_write(&rbd_dev->lock_rwsem); - if (__rbd_is_lock_owner(rbd_dev)) - __rbd_release_lock(rbd_dev); - up_write(&rbd_dev->lock_rwsem); -+ -+ flush_work(&rbd_dev->acquired_lock_work); -+ flush_work(&rbd_dev->released_lock_work); - } - - /* --- -2.50.1 (Apple Git-155) - diff --git a/1366-ibmveth-disable-gso-for-packets-with-small-mss.patch b/1366-ibmveth-disable-gso-for-packets-with-small-mss.patch deleted file mode 100644 index 1e2a46218..000000000 --- a/1366-ibmveth-disable-gso-for-packets-with-small-mss.patch +++ /dev/null @@ -1,107 +0,0 @@ -From b38e69cdb077b6213147efc33e96ff2e15b5a947 Mon Sep 17 00:00:00 2001 -From: Mamatha Inamdar -Date: Fri, 15 May 2026 06:11:36 -0400 -Subject: [PATCH] ibmveth: Disable GSO for packets with small MSS - -JIRA: https://issues.redhat.com/browse/RHEL-175521 - -commit cc427d24ac6442ffdeafd157a63c7c5b73ed4de4 -Author: Mingming Cao -Date: Fri Apr 24 09:29:17 2026 -0700 - - ibmveth: Disable GSO for packets with small MSS - - Some physical adapters on Power systems do not support segmentation - offload when the MSS is less than 224 bytes. Attempting to send such - packets causes the adapter to freeze, stopping all traffic until - manually reset. - - Implement ndo_features_check to disable GSO for packets with small MSS - values. The network stack will perform software segmentation instead. - - The 224-byte minimum matches ibmvnic - commit ("ibmvnic: Enforce stronger sanity checks - on GSO packets") - which uses the same physical adapters in SEA configurations. - - The issue occurs specifically when the hardware attempts to perform - segmentation (gso_segs > 1) with a small MSS. Single-segment GSO packets - (gso_segs == 1) do not trigger the problematic LSO code path and are - transmitted normally without segmentation. - - Add an ndo_features_check callback to disable GSO when MSS < 224 bytes. - Also call vlan_features_check() to ensure proper handling of VLAN packets, - particularly QinQ (802.1ad) configurations where the hardware parser may - not support certain offload features. - - Validated using iptables to force small MSS values. Without the fix, - the adapter freezes. With the fix, packets are segmented in software - and transmission succeeds. Comprehensive regression testing completedd - (MSS tests, performance, stability). - - Fixes: 8641dd85799f ("ibmveth: Add support for TSO") - Cc: stable@vger.kernel.org - Reviewed-by: Brian King - Tested-by: Shaik Abdulla - Tested-by: Naveed Ahmed - Signed-off-by: Mingming Cao - Link: https://patch.msgid.link/20260424162917.65725-1-mmc@linux.ibm.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Mamatha Inamdar - -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index 7f94e84d0955..02a95cf57bd0 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1756,6 +1756,27 @@ static int ibmveth_set_mac_addr(struct net_device *dev, void *p) - return 0; - } - -+static netdev_features_t ibmveth_features_check(struct sk_buff *skb, -+ struct net_device *dev, -+ netdev_features_t features) -+{ -+ /* Some physical adapters do not support segmentation offload with -+ * MSS < 224. Disable GSO for such packets to avoid adapter freeze. -+ * Note: Single-segment packets (gso_segs == 1) don't need this check -+ * as they bypass the LSO path and are transmitted without segmentation. -+ */ -+ if (skb_is_gso(skb)) { -+ if (skb_shinfo(skb)->gso_size < IBMVETH_MIN_LSO_MSS) { -+ netdev_warn_once(dev, -+ "MSS %u too small for LSO, disabling GSO\n", -+ skb_shinfo(skb)->gso_size); -+ features &= ~NETIF_F_GSO_MASK; -+ } -+ } -+ -+ return vlan_features_check(skb, features); -+} -+ - static const struct net_device_ops ibmveth_netdev_ops = { - .ndo_open = ibmveth_open, - .ndo_stop = ibmveth_close, -@@ -1767,6 +1788,7 @@ static const struct net_device_ops ibmveth_netdev_ops = { - .ndo_set_features = ibmveth_set_features, - .ndo_validate_addr = eth_validate_addr, - .ndo_set_mac_address = ibmveth_set_mac_addr, -+ .ndo_features_check = ibmveth_features_check, - #ifdef CONFIG_NET_POLL_CONTROLLER - .ndo_poll_controller = ibmveth_poll_controller, - #endif -diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h -index dc8aae1309f8..059ca498b2d0 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.h -+++ b/drivers/net/ethernet/ibm/ibmveth.h -@@ -37,6 +37,7 @@ - #define IBMVETH_ILLAN_IPV4_TCP_CSUM 0x0000000000000002UL - #define IBMVETH_ILLAN_ACTIVE_TRUNK 0x0000000000000001UL - -+#define IBMVETH_MIN_LSO_MSS 224 /* Minimum MSS for LSO */ - /* hcall macros */ - #define h_register_logical_lan(ua, buflst, rxq, fltlst, mac) \ - plpar_hcall_norets(H_REGISTER_LOGICAL_LAN, ua, buflst, rxq, fltlst, mac) --- -2.50.1 (Apple Git-155) - diff --git a/1367-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch b/1367-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch deleted file mode 100644 index 07060249a..000000000 --- a/1367-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 9f9e1223ef56442c1767dfd2ae175a74d8b7d20a Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Thu, 16 Apr 2026 18:13:59 +0200 -Subject: [PATCH] s390/mm: Add missing secure storage access fixups for donated - memory - -JIRA: https://redhat.atlassian.net/browse/RHEL-168792 -Conflicts: Minor change when accessing folio flags which -were made a struct in 6.18 but are still an integer in 6.12 - -commit b00be77302d7ec4ad0367bb236494fce7172b730 -Author: Janosch Frank -Date: Wed Mar 4 10:18:37 2026 +0000 - - s390/mm: Add missing secure storage access fixups for donated memory - - There are special cases where secure storage access exceptions happen - in a kernel context for pages that don't have the PG_arch_1 bit - set. That bit is set for non-exported guest secure storage (memory) - but is absent on storage donated to the Ultravisor since the kernel - isn't allowed to export donated pages. - - Prior to this patch we would try to export the page by calling - arch_make_folio_accessible() which would instantly return since the - arch bit is absent signifying that the page was already exported and - no further action is necessary. This leads to secure storage access - exception loops which can never be resolved. - - With this patch we unconditionally try to export and if that fails we - fixup. - - Fixes: 084ea4d611a3 ("s390/mm: add (non)secure page access exceptions handlers") - Reported-by: Heiko Carstens - Suggested-by: Heiko Carstens - Reviewed-by: Claudio Imbrenda - Tested-by: Christian Borntraeger - Signed-off-by: Janosch Frank - Signed-off-by: Christian Borntraeger - -Signed-off-by: Janosch Frank -Signed-off-by: Mete Durlu - -diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c -index d0cfbc4bdfd7..7dd16ff7efd0 100644 ---- a/arch/s390/mm/fault.c -+++ b/arch/s390/mm/fault.c -@@ -428,10 +428,17 @@ void do_secure_storage_access(struct pt_regs *regs) - folio = phys_to_folio(addr); - if (unlikely(!folio_try_get(folio))) - return; -- rc = arch_make_folio_accessible(folio); -+ rc = uv_convert_from_secure(folio_to_phys(folio)); -+ if (!rc) -+ clear_bit(PG_arch_1, &folio->flags); - folio_put(folio); -+ /* -+ * There are some valid fixup types for kernel -+ * accesses to donated secure memory. zeropad is one -+ * of them. -+ */ - if (rc) -- BUG(); -+ return handle_fault_error_nolock(regs, 0); - } else { - mm = current->mm; - mmap_read_lock(mm); --- -2.50.1 (Apple Git-155) - diff --git a/1368-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch b/1368-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch deleted file mode 100644 index 39552a6df..000000000 --- a/1368-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch +++ /dev/null @@ -1,103 +0,0 @@ -From eb9c6aeb512f877cf397deb1e4526f646c70e4a7 Mon Sep 17 00:00:00 2001 -From: Jiayuan Chen -Date: Mon, 6 Apr 2026 11:15:10 +0800 -Subject: [PATCH] mptcp: fix slab-use-after-free in __inet_lookup_established - -commit 9b55b253907e7431210483519c5ad711a37dafa1 upstream. - -The ehash table lookups are lockless and rely on -SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability -during RCU read-side critical sections. Both tcp_prot and -tcpv6_prot have their slab caches created with this flag -via proto_register(). - -However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into -tcpv6_prot_override during inet_init() (fs_initcall, level 5), -before inet6_init() (module_init/device_initcall, level 6) has -called proto_register(&tcpv6_prot). At that point, -tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab -remains NULL permanently. - -This causes MPTCP v6 subflow child sockets to be allocated via -kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab -cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so -when these sockets are freed without SOCK_RCU_FREE (which is -cleared for child sockets by design), the memory can be -immediately reused. Concurrent ehash lookups under -rcu_read_lock can then access freed memory, triggering a -slab-use-after-free in __inet_lookup_established. - -Fix this by splitting the IPv6-specific initialization out of -mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called -from mptcp_proto_v6_init() before protocol registration. This -ensures tcpv6_prot_override.slab correctly inherits the -SLAB_TYPESAFE_BY_RCU slab cache. - -Fixes: b19bc2945b40 ("mptcp: implement delegated actions") -Cc: stable@vger.kernel.org -Signed-off-by: Jiayuan Chen -Reviewed-by: Matthieu Baerts (NGI0) -Link: https://patch.msgid.link/20260406031512.189159-1-jiayuan.chen@linux.dev -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index e682d52a06b7..1a223af18907 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -4338,6 +4338,8 @@ int __init mptcp_proto_v6_init(void) - { - int err; - -+ mptcp_subflow_v6_init(); -+ - mptcp_v6_prot = mptcp_prot; - strscpy(mptcp_v6_prot.name, "MPTCPv6", sizeof(mptcp_v6_prot.name)); - mptcp_v6_prot.slab = NULL; -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index 669991bbae75..391a8026cb48 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -821,6 +821,7 @@ static inline void mptcp_subflow_tcp_fallback(struct sock *sk, - void __init mptcp_proto_init(void); - #if IS_ENABLED(CONFIG_MPTCP_IPV6) - int __init mptcp_proto_v6_init(void); -+void __init mptcp_subflow_v6_init(void); - #endif - - struct sock *mptcp_sk_clone_init(const struct sock *sk, -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 1618483b05e8..0f70f5360c6b 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -2147,7 +2147,15 @@ void __init mptcp_subflow_init(void) - tcp_prot_override.psock_update_sk_prot = NULL; - #endif - -+ mptcp_diag_subflow_init(&subflow_ulp_ops); -+ -+ if (tcp_register_ulp(&subflow_ulp_ops) != 0) -+ panic("MPTCP: failed to register subflows to ULP\n"); -+} -+ - #if IS_ENABLED(CONFIG_MPTCP_IPV6) -+void __init mptcp_subflow_v6_init(void) -+{ - /* In struct mptcp_subflow_request_sock, we assume the TCP request sock - * structures for v4 and v6 have the same size. It should not changed in - * the future but better to make sure to be warned if it is no longer -@@ -2186,10 +2194,5 @@ void __init mptcp_subflow_init(void) - /* Disable sockmap processing for subflows */ - tcpv6_prot_override.psock_update_sk_prot = NULL; - #endif --#endif -- -- mptcp_diag_subflow_init(&subflow_ulp_ops); -- -- if (tcp_register_ulp(&subflow_ulp_ops) != 0) -- panic("MPTCP: failed to register subflows to ULP\n"); - } -+#endif --- -2.50.1 (Apple Git-155) - diff --git a/1369-watchdog-wdat-wdt-fix-acpi-table-leak-in-probe-function.patch b/1369-watchdog-wdat-wdt-fix-acpi-table-leak-in-probe-function.patch deleted file mode 100644 index 0d4a0eb3b..000000000 --- a/1369-watchdog-wdat-wdt-fix-acpi-table-leak-in-probe-function.patch +++ /dev/null @@ -1,164 +0,0 @@ -From 1bc19c992fa29f855aacbc998609799d0570889a Mon Sep 17 00:00:00 2001 -From: David Arcari -Date: Tue, 7 Apr 2026 08:14:39 -0400 -Subject: [PATCH] watchdog: wdat_wdt: Fix ACPI table leak in probe function - -JIRA: https://issues.redhat.com/browse/RHEL-164699 - -commit 25c0b472eab8379683d4eef681185c104bed8ffd -Author: Haotian Zhang -Date: Thu Nov 13 10:30:32 2025 +0800 - - watchdog: wdat_wdt: Fix ACPI table leak in probe function - - wdat_wdt_probe() calls acpi_get_table() to obtain the WDAT ACPI table but - never calls acpi_put_table() on any paths. This causes a permanent ACPI - table memory leak. - - Add a single cleanup path which calls acpi_put_table() to ensure - the ACPI table is always released. - - Fixes: 058dfc767008 ("ACPI / watchdog: Add support for WDAT hardware watchdog") - Suggested-by: Guenter Roeck - Signed-off-by: Haotian Zhang - Reviewed-by: Guenter Roeck - Signed-off-by: Guenter Roeck - Signed-off-by: Wim Van Sebroeck - -(cherry picked from commit 25c0b472eab8379683d4eef681185c104bed8ffd) -Assisted-by: Patchpal -Signed-off-by: David Arcari - -diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c -index 650fdc7996e1..dd3c2d69c9df 100644 ---- a/drivers/watchdog/wdat_wdt.c -+++ b/drivers/watchdog/wdat_wdt.c -@@ -326,19 +326,27 @@ static int wdat_wdt_probe(struct platform_device *pdev) - return -ENODEV; - - wdat = devm_kzalloc(dev, sizeof(*wdat), GFP_KERNEL); -- if (!wdat) -- return -ENOMEM; -+ if (!wdat) { -+ ret = -ENOMEM; -+ goto out_put_table; -+ } - - regs = devm_kcalloc(dev, pdev->num_resources, sizeof(*regs), - GFP_KERNEL); -- if (!regs) -- return -ENOMEM; -+ if (!regs) { -+ ret = -ENOMEM; -+ goto out_put_table; -+ } - - /* WDAT specification wants to have >= 1ms period */ -- if (tbl->timer_period < 1) -- return -EINVAL; -- if (tbl->min_count > tbl->max_count) -- return -EINVAL; -+ if (tbl->timer_period < 1) { -+ ret = -EINVAL; -+ goto out_put_table; -+ } -+ if (tbl->min_count > tbl->max_count) { -+ ret = -EINVAL; -+ goto out_put_table; -+ } - - wdat->period = tbl->timer_period; - wdat->wdd.min_timeout = DIV_ROUND_UP(wdat->period * tbl->min_count, 1000); -@@ -355,15 +363,20 @@ static int wdat_wdt_probe(struct platform_device *pdev) - res = &pdev->resource[i]; - if (resource_type(res) == IORESOURCE_MEM) { - reg = devm_ioremap_resource(dev, res); -- if (IS_ERR(reg)) -- return PTR_ERR(reg); -+ if (IS_ERR(reg)) { -+ ret = PTR_ERR(reg); -+ goto out_put_table; -+ } - } else if (resource_type(res) == IORESOURCE_IO) { - reg = devm_ioport_map(dev, res->start, 1); -- if (!reg) -- return -ENOMEM; -+ if (!reg) { -+ ret = -ENOMEM; -+ goto out_put_table; -+ } - } else { - dev_err(dev, "Unsupported resource\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto out_put_table; - } - - regs[i] = reg; -@@ -385,8 +398,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) - } - - instr = devm_kzalloc(dev, sizeof(*instr), GFP_KERNEL); -- if (!instr) -- return -ENOMEM; -+ if (!instr) { -+ ret = -ENOMEM; -+ goto out_put_table; -+ } - - INIT_LIST_HEAD(&instr->node); - instr->entry = entries[i]; -@@ -417,7 +432,8 @@ static int wdat_wdt_probe(struct platform_device *pdev) - - if (!instr->reg) { - dev_err(dev, "I/O resource not found\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto out_put_table; - } - - instructions = wdat->instructions[action]; -@@ -425,8 +441,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) - instructions = devm_kzalloc(dev, - sizeof(*instructions), - GFP_KERNEL); -- if (!instructions) -- return -ENOMEM; -+ if (!instructions) { -+ ret = -ENOMEM; -+ goto out_put_table; -+ } - - INIT_LIST_HEAD(instructions); - wdat->instructions[action] = instructions; -@@ -443,7 +461,7 @@ static int wdat_wdt_probe(struct platform_device *pdev) - - ret = wdat_wdt_enable_reboot(wdat); - if (ret) -- return ret; -+ goto out_put_table; - - platform_set_drvdata(pdev, wdat); - -@@ -460,12 +478,16 @@ static int wdat_wdt_probe(struct platform_device *pdev) - - ret = wdat_wdt_set_timeout(&wdat->wdd, timeout); - if (ret) -- return ret; -+ goto out_put_table; - - watchdog_set_nowayout(&wdat->wdd, nowayout); - watchdog_stop_on_reboot(&wdat->wdd); - watchdog_stop_on_unregister(&wdat->wdd); -- return devm_watchdog_register_device(dev, &wdat->wdd); -+ ret = devm_watchdog_register_device(dev, &wdat->wdd); -+ -+out_put_table: -+ acpi_put_table((struct acpi_table_header *)tbl); -+ return ret; - } - - static int wdat_wdt_suspend_noirq(struct device *dev) --- -2.50.1 (Apple Git-155) - diff --git a/1370-net-mana-fix-use-after-free-in-add-adev-error-path.patch b/1370-net-mana-fix-use-after-free-in-add-adev-error-path.patch deleted file mode 100644 index 8c265a91b..000000000 --- a/1370-net-mana-fix-use-after-free-in-add-adev-error-path.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 43f5b19fd190fea20d052bc84741b28031d5baa9 Mon Sep 17 00:00:00 2001 -From: Guangshuo Li -Date: Tue, 31 Mar 2026 13:09:32 -0400 -Subject: [PATCH] net: mana: fix use-after-free in add_adev() error path - -[ Upstream commit c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70f ] - -If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls -auxiliary_device_uninit(adev). - -The auxiliary device has its release callback set to adev_release(), -which frees the containing struct mana_adev. Since adev is embedded in -struct mana_adev, the subsequent fall-through to init_fail and access -to adev->id may result in a use-after-free. - -Fix this by saving the allocated auxiliary device id in a local -variable before calling auxiliary_device_add(), and use that saved id -in the cleanup path after auxiliary_device_uninit(). - -Fixes: a69839d4327d ("net: mana: Add support for auxiliary device") -Cc: stable@vger.kernel.org -Reviewed-by: Long Li -Signed-off-by: Guangshuo Li -Link: https://patch.msgid.link/20260323165730.945365-1-lgs201920130244@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c -index 396b5f1..5276e2d 100644 ---- a/drivers/net/ethernet/microsoft/mana/mana_en.c -+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c -@@ -3355,6 +3355,7 @@ static int add_adev(struct gdma_dev *gd, const char *name) - struct auxiliary_device *adev; - struct mana_adev *madev; - int ret; -+ int id; - - madev = kzalloc(sizeof(*madev), GFP_KERNEL); - if (!madev) -@@ -3364,7 +3365,8 @@ static int add_adev(struct gdma_dev *gd, const char *name) - ret = mana_adev_idx_alloc(); - if (ret < 0) - goto idx_fail; -- adev->id = ret; -+ id = ret; -+ adev->id = id; - - adev->name = name; - adev->dev.parent = gd->gdma_context->dev; -@@ -3390,7 +3392,7 @@ add_fail: - auxiliary_device_uninit(adev); - - init_fail: -- mana_adev_idx_free(adev->id); -+ mana_adev_idx_free(id); - - idx_fail: - kfree(madev); diff --git a/1371-crypto-caam-fix-overflow-on-long-hmac-keys.patch b/1371-crypto-caam-fix-overflow-on-long-hmac-keys.patch deleted file mode 100644 index 945ea8408..000000000 --- a/1371-crypto-caam-fix-overflow-on-long-hmac-keys.patch +++ /dev/null @@ -1,43 +0,0 @@ -From c2fb4984fe09fc176fe4c12d5e3edf626df6511d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Horia=20Geant=C4=83?= -Date: Tue, 17 Mar 2026 12:25:14 +0200 -Subject: [PATCH] crypto: caam - fix overflow on long hmac keys -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -[ Upstream commit 80688afb9c35b3934ce2d6be9973758915e2e0ef ] - -When a key longer than block size is supplied, it is copied and then -hashed into the real key. The memory allocated for the copy needs to -be rounded to DMA cache alignment, as otherwise the hashed key may -corrupt neighbouring memory. - -The copying is performed using kmemdup, however this leads to an overflow: -reading more bytes (aligned_len - keylen) from the keylen source buffer. -Fix this by replacing kmemdup with kmalloc, followed by memcpy. - -Fixes: 199354d7fb6e ("crypto: caam - Remove GFP_DMA and add DMA alignment padding") -Signed-off-by: Horia Geantă -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin - -diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c -index ece9f1e5a689..9ef8ee77c52a 100644 ---- a/drivers/crypto/caam/caamalg_qi2.c -+++ b/drivers/crypto/caam/caamalg_qi2.c -@@ -3325,9 +3325,10 @@ static int ahash_setkey(struct crypto_ahash *ahash, const u8 *key, - if (aligned_len < keylen) - return -EOVERFLOW; - -- hashed_key = kmemdup(key, aligned_len, GFP_KERNEL); -+ hashed_key = kmalloc(aligned_len, GFP_KERNEL); - if (!hashed_key) - return -ENOMEM; -+ memcpy(hashed_key, key, keylen); - ret = hash_digest_key(ctx, &keylen, hashed_key, digestsize); - if (ret) - goto bad_free_key; --- -2.50.1 (Apple Git-155) - diff --git a/1372-exit-prevent-preemption-of-oopsing-task-dead-task.patch b/1372-exit-prevent-preemption-of-oopsing-task-dead-task.patch deleted file mode 100644 index 79882282e..000000000 --- a/1372-exit-prevent-preemption-of-oopsing-task-dead-task.patch +++ /dev/null @@ -1,59 +0,0 @@ -From e3a2695b21d64968b1ef7a928f88e2262ac2fb9b Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 15:09:40 +0000 -Subject: [PATCH] exit: prevent preemption of oopsing TASK_DEAD task - -JIRA: https://redhat.atlassian.net/browse/RHEL-180014 -CVE: CVE-2026-46173 -Backported from tree(s): linux - -commit c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891 -Author: Jann Horn -Date: Mon May 11 08:55:11 2026 -0700 - - exit: prevent preemption of oopsing TASK_DEAD task - - When an already-exiting task oopses, make_task_dead() currently calls - do_task_dead() with preemption enabled. That is forbidden: - do_task_dead() calls __schedule(), which has a comment saying "WARNING: - must be called with preemption disabled!". - - If an oopsing task is preempted in do_task_dead(), between becoming - TASK_DEAD and entering the scheduler explicitly, bad things happen: - finish_task_switch() assumes that once the scheduler has switched away - from a TASK_DEAD task, the task can never run again and its stack is no - longer needed; but that assumption apparently doesn't hold if the dead - task was preempted (the SM_PREEMPT case). - - This means that the scheduler ends up repeatedly dropping references on - the dead task's stack, which can lead to use-after-free or double-free - of the entire task stack; in other words, two tasks can end up running - on the same stack, resulting in various kinds of memory corruption. - - (This does not just affect "recursively oopsing" tasks; it is enough to - oops once during task exit, for example in a file_operations::release - handler) - - Fixes: 7f80a2fd7db9 ("exit: Stop poorly open coding do_task_dead in make_task_dead") - Cc: stable@kernel.org - Signed-off-by: Jann Horn - Acked-by: Peter Zijlstra - Signed-off-by: Linus Torvalds - -Signed-off-by: CKI Backport Bot - -diff --git a/kernel/exit.c b/kernel/exit.c -index a310ea845726..4ccfdf5e2964 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -1048,6 +1048,7 @@ void __noreturn make_task_dead(int signr) - futex_exit_recursive(tsk); - tsk->exit_state = EXIT_DEAD; - refcount_inc(&tsk->rcu_users); -+ preempt_disable(); - do_task_dead(); - } - --- -2.50.1 (Apple Git-155) - diff --git a/1373-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch b/1373-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch deleted file mode 100644 index cd363b591..000000000 --- a/1373-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch +++ /dev/null @@ -1,220 +0,0 @@ -From 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b Mon Sep 17 00:00:00 2001 -From: Rajat Gupta -Date: Sun, 31 May 2026 08:32:21 -0400 -Subject: [PATCH] net/sched: fix pedit partial COW leading to page cache - corruption -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -[ Upstream commit 899ee91156e57784090c5565e4f31bd7dbffbc5a ] - -tcf_pedit_act() computes the COW range for skb_ensure_writable() -once before the key loop using tcfp_off_max_hint, but the hint does -not account for the runtime header offset added by typed keys. This -can leave part of the write region un-COW'd. - -Fix by moving skb_ensure_writable() inside the per-key loop where -the actual write offset is known, and add overflow checking on the -offset arithmetic. For negative offsets (e.g. Ethernet header edits -at ingress), use skb_cow() to COW the headroom instead. Guard -offset_valid() against INT_MIN, where negation is undefined. - -Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable") -Reported-by: Yiming Qian -Reported-by: Keenan Dong -Reported-by: Han Guidong <2045gemini@gmail.com> -Reported-by: Zhang Cen -Reviewed-by: Han Guidong <2045gemini@gmail.com> -Tested-by: Han Guidong <2045gemini@gmail.com> -Reviewed-by: Davide Caratti -Tested-by: Davide Caratti -Reviewed-by: Toke Høiland-Jørgensen -Tested-by: Toke Høiland-Jørgensen -Reviewed-by: Victor Nogueira -Tested-by: Victor Nogueira -Acked-by: Jamal Hadi Salim -Signed-off-by: Rajat Gupta -Link: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h -index 83fe399..a26d4cd 100644 ---- a/include/net/tc_act/tc_pedit.h -+++ b/include/net/tc_act/tc_pedit.h -@@ -14,7 +14,6 @@ struct tcf_pedit_key_ex { - struct tcf_pedit_parms { - struct tc_pedit_key *tcfp_keys; - struct tcf_pedit_key_ex *tcfp_keys_ex; -- u32 tcfp_off_max_hint; - unsigned char tcfp_nkeys; - unsigned char tcfp_flags; - struct rcu_head rcu; -diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index fc0a35a..fad1d9c 100644 ---- a/net/sched/act_pedit.c -+++ b/net/sched/act_pedit.c -@@ -16,6 +16,8 @@ - #include - #include - #include -+#include -+#include - #include - #include - #include -@@ -242,7 +244,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, - goto out_free_ex; - } - -- nparms->tcfp_off_max_hint = 0; - nparms->tcfp_flags = parm->flags; - nparms->tcfp_nkeys = parm->nkeys; - -@@ -268,14 +269,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, - BITS_PER_TYPE(int) - 1, - nparms->tcfp_keys[i].shift); - -- /* The AT option can read a single byte, we can bound the actual -- * value with uchar max. -- */ -- cur += (0xff & offmask) >> nparms->tcfp_keys[i].shift; -- -- /* Each key touches 4 bytes starting from the computed offset */ -- nparms->tcfp_off_max_hint = -- max(nparms->tcfp_off_max_hint, cur + 4); - } - - p = to_pedit(*a); -@@ -318,15 +311,12 @@ static void tcf_pedit_cleanup(struct tc_action *a) - call_rcu(&parms->rcu, tcf_pedit_cleanup_rcu); - } - --static bool offset_valid(struct sk_buff *skb, int offset) -+static bool offset_valid(struct sk_buff *skb, int offset, int len) - { -- if (offset > 0 && offset > skb->len) -- return false; -- -- if (offset < 0 && -offset > skb_headroom(skb)) -+ if (offset < -(int)skb_headroom(skb)) - return false; - -- return true; -+ return offset <= (int)skb->len - len; - } - - static int pedit_l4_skb_offset(struct sk_buff *skb, int *hoffset, const int header_type) -@@ -393,18 +383,10 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - struct tcf_pedit_key_ex *tkey_ex; - struct tcf_pedit_parms *parms; - struct tc_pedit_key *tkey; -- u32 max_offset; - int i; - - parms = rcu_dereference_bh(p->parms); - -- max_offset = (skb_transport_header_was_set(skb) ? -- skb_transport_offset(skb) : -- skb_network_offset(skb)) + -- parms->tcfp_off_max_hint; -- if (skb_ensure_writable(skb, min(skb->len, max_offset))) -- goto done; -- - tcf_lastuse_update(&p->tcf_tm); - tcf_action_update_bstats(&p->common, skb); - -@@ -412,10 +394,11 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - tkey_ex = parms->tcfp_keys_ex; - - for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) { -+ int write_offset, write_len; - int offset = tkey->off; - int hoffset = 0; -- u32 *ptr, hdata; -- u32 val; -+ u32 cur_val, val; -+ u32 *ptr; - int rc; - - if (tkey_ex) { -@@ -433,13 +416,15 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - - if (tkey->offmask) { - u8 *d, _d; -+ int at_offset; - -- if (!offset_valid(skb, hoffset + tkey->at)) { -+ if (check_add_overflow(hoffset, (int)tkey->at, &at_offset) || -+ !offset_valid(skb, at_offset, sizeof(_d))) { - pr_info_ratelimited("tc action pedit 'at' offset %d out of bounds\n", - hoffset + tkey->at); - goto bad; - } -- d = skb_header_pointer(skb, hoffset + tkey->at, -+ d = skb_header_pointer(skb, at_offset, - sizeof(_d), &_d); - if (!d) - goto bad; -@@ -451,31 +436,51 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - } - } - -- if (!offset_valid(skb, hoffset + offset)) { -- pr_info_ratelimited("tc action pedit offset %d out of bounds\n", hoffset + offset); -+ if (check_add_overflow(hoffset, offset, &write_offset)) { -+ pr_info_ratelimited("tc action pedit offset overflow\n"); - goto bad; - } - -- ptr = skb_header_pointer(skb, hoffset + offset, -- sizeof(hdata), &hdata); -- if (!ptr) -+ if (!offset_valid(skb, write_offset, sizeof(*ptr))) { -+ pr_info_ratelimited("tc action pedit offset %d out of bounds\n", -+ write_offset); - goto bad; -+ } -+ -+ if (write_offset < 0) { -+ if (skb_cow(skb, -write_offset)) -+ goto bad; -+ if (write_offset + (int)sizeof(*ptr) > 0) { -+ if (skb_ensure_writable(skb, -+ min_t(int, skb->len, -+ write_offset + (int)sizeof(*ptr)))) -+ goto bad; -+ } -+ } else { -+ if (check_add_overflow(write_offset, (int)sizeof(*ptr), -+ &write_len)) -+ goto bad; -+ if (skb_ensure_writable(skb, min_t(int, skb->len, -+ write_len))) -+ goto bad; -+ } -+ -+ ptr = (u32 *)(skb->data + write_offset); -+ cur_val = get_unaligned(ptr); - /* just do it, baby */ - switch (cmd) { - case TCA_PEDIT_KEY_EX_CMD_SET: - val = tkey->val; - break; - case TCA_PEDIT_KEY_EX_CMD_ADD: -- val = (*ptr + tkey->val) & ~tkey->mask; -+ val = (cur_val + tkey->val) & ~tkey->mask; - break; - default: - pr_info_ratelimited("tc action pedit bad command (%d)\n", cmd); - goto bad; - } - -- *ptr = ((*ptr & tkey->mask) ^ val); -- if (ptr == &hdata) -- skb_store_bits(skb, hoffset + offset, ptr, 4); -+ put_unaligned((cur_val & tkey->mask) ^ val, ptr); - } - - goto done; diff --git a/1374-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch b/1374-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch deleted file mode 100644 index ceabba226..000000000 --- a/1374-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch +++ /dev/null @@ -1,54 +0,0 @@ -From b7b72e88046328c9fdc638fe887d4240257dd5dc Mon Sep 17 00:00:00 2001 -From: Hyunwoo Kim -Date: Mon, 1 Jun 2026 23:53:26 +0900 -Subject: [PATCH] KVM: arm64: vgic-its: Drop the translation cache reference - only for the erased entry - -commit 13031fb6b8357fbbcded2a7f4cba73e4781ee594 upstream. - -vgic_its_invalidate_cache() walks the per-ITS translation cache with -xa_for_each() and drops the cache's reference on each entry with -vgic_put_irq(). It puts the iterated pointer, though, rather than the -value returned by xa_erase(). - -The function is called from contexts that do not exclude one another: the -ITS command handlers hold its_lock, the GITS_CTLR write path holds -cmd_lock, and the path that clears EnableLPIs in a redistributor's -GICR_CTLR holds neither. Two or more of them can drain the same cache -concurrently, and if each one observes the same entry, erases it and then -puts it, the single reference the cache holds on that entry is dropped -more than once. The entry can then be freed while an ITE still maps it. - -xa_erase() is atomic and returns the previous entry, so put only the entry -that this context actually removed. The cache reference is then dropped -exactly once per entry even when the invalidations run concurrently, and -the behavior is unchanged when only one context runs. - -Fixes: 8201d1028caa ("KVM: arm64: vgic-its: Maintain a translation cache per ITS") -Signed-off-by: Hyunwoo Kim -Reviewed-by: Oliver Upton -Link: https://patch.msgid.link/ah2c5lu4JbUg7dj-@v4bel -Signed-off-by: Marc Zyngier -Cc: stable@vger.kernel.org -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c -index 5f6583b9abe3..dcd6b23ad2e1 100644 ---- a/arch/arm64/kvm/vgic/vgic-its.c -+++ b/arch/arm64/kvm/vgic/vgic-its.c -@@ -590,8 +590,10 @@ static void vgic_its_invalidate_cache(struct vgic_its *its) - unsigned long idx; - - xa_for_each(&its->translation_cache, idx, irq) { -- xa_erase(&its->translation_cache, idx); -- vgic_put_irq(kvm, irq); -+ /* Only the context that erases the entry drops its cache ref. */ -+ irq = xa_erase(&its->translation_cache, idx); -+ if (irq) -+ vgic_put_irq(kvm, irq); - } - } - --- -2.50.1 (Apple Git-155) - diff --git a/1375-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch b/1375-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch deleted file mode 100644 index c2b0f3e18..000000000 --- a/1375-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch +++ /dev/null @@ -1,63 +0,0 @@ -From e41953e7d118e2702bcb217879c173d9d1d3cd4e Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 26 Mar 2026 20:26:08 +0000 -Subject: [PATCH] ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - -[ Upstream commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 ] - -Sashiko AI-review observed: - - In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet - where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 - and passed to icmp6_send(), it uses IP6CB(skb2). - - IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso - offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm - at offset 18. - - If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao - would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called - and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). - - This would scan the inner, attacker-controlled IPv6 packet starting at that - offset, potentially returning a fake TLV without checking if the remaining - packet length can hold the full 18-byte struct ipv6_destopt_hao. - - Could mip6_addr_swap() then perform a 16-byte swap that extends past the end - of the packet data into skb_shared_info? - - Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and - ip6ip6_err() to prevent this? - -This patch implements the first suggestion. - -I am not sure if ip6ip6_err() needs to be changed. -A separate patch would be better anyway. - -Fixes: ca15a078bd90 ("sit: generate icmpv6 error when receiving icmpv4 error") -Reported-by: Ido Schimmel -Closes: https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com -Signed-off-by: Eric Dumazet -Cc: Oskar Kjos -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/20260326202608.2976021-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c -index e43b49f1ddbb..387400829b20 100644 ---- a/net/ipv6/icmp.c -+++ b/net/ipv6/icmp.c -@@ -681,6 +681,9 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type, - if (!skb2) - return 1; - -+ /* Remove debris left by IPv4 stack. */ -+ memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); -+ - skb_dst_drop(skb2); - skb_pull(skb2, nhs); - skb_reset_network_header(skb2); --- -2.50.1 (Apple Git-155) - diff --git a/1376-rdma-mana-validate-rx-hash-key-len.patch b/1376-rdma-mana-validate-rx-hash-key-len.patch deleted file mode 100644 index 3767362ae..000000000 --- a/1376-rdma-mana-validate-rx-hash-key-len.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 11c1431d641e0e4e0529e96957995820600c7287 Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Tue, 28 Apr 2026 13:17:37 -0300 -Subject: [PATCH] RDMA/mana: Validate rx_hash_key_len - -commit 6dd2d4ad9c8429523b1c220c5132bd551c006425 upstream. - -Sashiko points out that rx_hash_key_len comes from a uAPI structure and is -blindly passed to memcpy, allowing the userspace to trash kernel -memory. Bounds check it so the memcpy cannot overflow. - -Cc: stable@vger.kernel.org -Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") -Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1 -Link: https://patch.msgid.link/r/4-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com -Reviewed-by: Long Li -Signed-off-by: Jason Gunthorpe -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c -index 2741eec6f26f..f3394ded785c 100644 ---- a/drivers/infiniband/hw/mana/qp.c -+++ b/drivers/infiniband/hw/mana/qp.c -@@ -21,6 +21,9 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev, - - gc = mdev_to_gc(dev); - -+ if (rx_hash_key_len > sizeof(req->hashkey)) -+ return -EINVAL; -+ - req_buf_size = struct_size(req, indir_tab, MANA_INDIRECT_TABLE_DEF_SIZE); - req = kzalloc(req_buf_size, GFP_KERNEL); - if (!req) --- -2.50.1 (Apple Git-155) - diff --git a/1377-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch b/1377-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch deleted file mode 100644 index b9e29e1b8..000000000 --- a/1377-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 57d67f7ed0069067f1452835c7ec175e2a7f7631 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 17:25:12 +0000 -Subject: [PATCH] nvmet-tcp: fix race between ICReq handling and queue teardown - -JIRA: https://redhat.atlassian.net/browse/RHEL-180107 -CVE: CVE-2026-46135 -Backported from tree(s): linux - -commit 5293a8882c549fab4a878bc76b0b6c951f980a61 -Author: Chaitanya Kulkarni -Date: Wed Apr 8 00:51:31 2026 -0700 - - nvmet-tcp: fix race between ICReq handling and queue teardown - - nvmet_tcp_handle_icreq() updates queue->state after sending an - Initialization Connection Response (ICResp), but it does so without - serializing against target-side queue teardown. - - If an NVMe/TCP host sends an Initialization Connection Request - (ICReq) and immediately closes the connection, target-side teardown - may start in softirq context before io_work drains the already - buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() - sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue - reference under state_lock. - - If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can - still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the - DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and - allows a later socket state change to re-enter teardown and issue a - second kref_put() on an already released queue. - - The ICResp send failure path has the same problem. If teardown has - already moved the queue to DISCONNECTING, a send error can still - overwrite the state with NVMET_TCP_Q_FAILED, again reopening the - window for a second teardown path to drop the queue reference. - - Fix this by serializing both post-send state transitions with - state_lock and bailing out if teardown has already started. - - Use -ESHUTDOWN as an internal sentinel for that bail-out path rather - than propagating it as a transport error like -ECONNRESET. Keep - nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before - honoring that sentinel so receive-side parsing stays quiesced until the - existing release path completes. - - Fixes: c46a6465bac2 ("nvmet-tcp: add NVMe over TCP target driver") - Cc: stable@vger.kernel.org - Reported-by: Shivam Kumar - Tested-by: Shivam Kumar - Signed-off-by: Chaitanya Kulkarni - Signed-off-by: Keith Busch - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index 63ffbb853351..0442cb7d2b56 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -407,6 +407,19 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) - - static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status) - { -+ /* -+ * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path. -+ * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has -+ * already been consumed and queue teardown has started. -+ * -+ * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues -+ * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work() -+ * cancels it, the queue must not keep that old receive state. -+ * Otherwise the next nvmet_tcp_io_work() run can reach -+ * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again. -+ * -+ * That is why queue->rcv_state needs to be updated before we return. -+ */ - queue->rcv_state = NVMET_TCP_RECV_ERR; - if (status == -EPIPE || status == -ECONNRESET) - kernel_sock_shutdown(queue->sock, SHUT_RDWR); -@@ -923,11 +936,24 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) - iov.iov_len = sizeof(*icresp); - ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len); - if (ret < 0) { -+ spin_lock_bh(&queue->state_lock); -+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) { -+ spin_unlock_bh(&queue->state_lock); -+ return -ESHUTDOWN; -+ } - queue->state = NVMET_TCP_Q_FAILED; -+ spin_unlock_bh(&queue->state_lock); - return ret; /* queue removal will cleanup */ - } - -+ spin_lock_bh(&queue->state_lock); -+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) { -+ spin_unlock_bh(&queue->state_lock); -+ /* Tell nvmet_tcp_socket_error() teardown is in progress. */ -+ return -ESHUTDOWN; -+ } - queue->state = NVMET_TCP_Q_LIVE; -+ spin_unlock_bh(&queue->state_lock); - nvmet_prepare_receive_pdu(queue); - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/1378-rxrpc-fix-response-authenticator-parser-oob-read.patch b/1378-rxrpc-fix-response-authenticator-parser-oob-read.patch deleted file mode 100644 index 0bb434f00..000000000 --- a/1378-rxrpc-fix-response-authenticator-parser-oob-read.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 773433ec58bc8fd361d7c27607f00d18869322ab Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 28 Apr 2026 11:53:43 +0000 -Subject: [PATCH] rxrpc: fix RESPONSE authenticator parser OOB read - -JIRA: https://redhat.atlassian.net/browse/RHEL-171457 -CVE: CVE-2026-31636 - -commit 3e3138007887504ee9206d0bfb5acb062c600025 -Author: Keenan Dong -Date: Wed Apr 8 13:12:40 2026 +0100 - - rxrpc: fix RESPONSE authenticator parser OOB read - - rxgk_verify_authenticator() copies auth_len bytes into a temporary - buffer and then passes p + auth_len as the parser limit to - rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the - parser end pointer by a factor of four and lets malformed RESPONSE - authenticators read past the kmalloc() buffer. - - Decoded from the original latest-net reproduction logs with - scripts/decode_stacktrace.sh: - - BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() - Call Trace: - dump_stack_lvl() [lib/dump_stack.c:123] - print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482] - kasan_report() [mm/kasan/report.c:597] - rxgk_verify_response() - [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167 - net/rxrpc/rxgk.c:1274] - rxrpc_process_connection() - [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 - net/rxrpc/conn_event.c:386] - process_one_work() [kernel/workqueue.c:3281] - worker_thread() - [kernel/workqueue.c:3353 kernel/workqueue.c:3440] - kthread() [kernel/kthread.c:436] - ret_from_fork() [arch/x86/kernel/process.c:164] - - Allocated by task 54: - rxgk_verify_response() - [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155 - net/rxrpc/rxgk.c:1274] - rxrpc_process_connection() - [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 - net/rxrpc/conn_event.c:386] - - Convert the byte count to __be32 units before constructing the parser - limit. - - Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") - Signed-off-by: Keenan Dong - Signed-off-by: David Howells - cc: Marc Dionne - cc: Simon Horman - cc: Willy Tarreau - cc: linux-afs@lists.infradead.org - cc: stable@kernel.org - Link: https://patch.msgid.link/20260408121252.2249051-13-dhowells@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c -index dce5a3d8a964..8d17b49e4f13 100644 ---- a/net/rxrpc/rxgk.c -+++ b/net/rxrpc/rxgk.c -@@ -1164,7 +1164,8 @@ static int rxgk_verify_authenticator(struct rxrpc_connection *conn, - } - - p = auth; -- ret = rxgk_do_verify_authenticator(conn, krb5, skb, p, p + auth_len); -+ ret = rxgk_do_verify_authenticator(conn, krb5, skb, p, -+ p + auth_len / sizeof(*p)); - error: - kfree(auth); - return ret; --- -2.50.1 (Apple Git-155) - diff --git a/1379-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch b/1379-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch deleted file mode 100644 index 1e5f4f725..000000000 --- a/1379-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch +++ /dev/null @@ -1,208 +0,0 @@ -From e14687fd732e40bafca7fc88be4be89a80e96d5e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Tue, 7 Apr 2026 21:43:30 -0400 -Subject: [PATCH] RDMA/iwcm: Fix workqueue list corruption by removing - work_list - -JIRA: https://redhat.atlassian.net/browse/RHEL-163515 - -commit 7874eeacfa42177565c01d5198726671acf7adf2 -Author: Jacob Moroni -Date: Mon Jan 12 02:00:06 2026 +0000 - - RDMA/iwcm: Fix workqueue list corruption by removing work_list - - The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") - changed the work submission logic to unconditionally call - queue_work() with the expectation that queue_work() would - have no effect if work was already pending. The problem is - that a free list of struct iwcm_work is used (for which - struct work_struct is embedded), so each call to queue_work() - is basically unique and therefore does indeed queue the work. - - This causes a problem in the work handler which walks the work_list - until it's empty to process entries. This means that a single - run of the work handler could process item N+1 and release it - back to the free list while the actual workqueue entry is still - queued. It could then get reused (INIT_WORK...) and lead to - list corruption in the workqueue logic. - - Fix this by just removing the work_list. The workqueue already - does this for us. - - This fixes the following error that was observed when stress - testing with ucmatose on an Intel E830 in iWARP mode: - - [ 151.465780] list_del corruption. next->prev should be ffff9f0915c69c08, but was ffff9f0a1116be08. (next=ffff9f0a15b11c08) - [ 151.466639] ------------[ cut here ]------------ - [ 151.466986] kernel BUG at lib/list_debug.c:67! - [ 151.467349] Oops: invalid opcode: 0000 [#1] SMP NOPTI - [ 151.467753] CPU: 14 UID: 0 PID: 2306 Comm: kworker/u64:18 Not tainted 6.19.0-rc4+ #1 PREEMPT(voluntary) - [ 151.468466] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 - [ 151.469192] Workqueue: 0x0 (iw_cm_wq) - [ 151.469478] RIP: 0010:__list_del_entry_valid_or_report+0xf0/0x100 - [ 151.469942] Code: c7 58 5f 4c b2 e8 10 50 aa ff 0f 0b 48 89 ef e8 36 57 cb ff 48 8b 55 08 48 89 e9 48 89 de 48 c7 c7 a8 5f 4c b2 e8 f0 4f aa ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 - [ 151.471323] RSP: 0000:ffffb15644e7bd68 EFLAGS: 00010046 - [ 151.471712] RAX: 000000000000006d RBX: ffff9f0915c69c08 RCX: 0000000000000027 - [ 151.472243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f0a37d9c600 - [ 151.472768] RBP: ffff9f0a15b11c08 R08: 0000000000000000 R09: c0000000ffff7fff - [ 151.473294] R10: 0000000000000001 R11: ffffb15644e7bba8 R12: ffff9f092339ee68 - [ 151.473817] R13: ffff9f0900059c28 R14: ffff9f092339ee78 R15: 0000000000000000 - [ 151.474344] FS: 0000000000000000(0000) GS:ffff9f0a847b5000(0000) knlGS:0000000000000000 - [ 151.474934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - [ 151.475362] CR2: 0000559e233a9088 CR3: 000000020296b004 CR4: 0000000000770ef0 - [ 151.475895] PKRU: 55555554 - [ 151.476118] Call Trace: - [ 151.476331] - [ 151.476497] move_linked_works+0x49/0xa0 - [ 151.476792] __pwq_activate_work.isra.46+0x2f/0xa0 - [ 151.477151] pwq_dec_nr_in_flight+0x1e0/0x2f0 - [ 151.477479] process_scheduled_works+0x1c8/0x410 - [ 151.477823] worker_thread+0x125/0x260 - [ 151.478108] ? __pfx_worker_thread+0x10/0x10 - [ 151.478430] kthread+0xfe/0x240 - [ 151.478671] ? __pfx_kthread+0x10/0x10 - [ 151.478955] ? __pfx_kthread+0x10/0x10 - [ 151.479240] ret_from_fork+0x208/0x270 - [ 151.479523] ? __pfx_kthread+0x10/0x10 - [ 151.479806] ret_from_fork_asm+0x1a/0x30 - [ 151.480103] - - Fixes: e1168f09b331 ("RDMA/iwcm: Simplify cm_event_handler()") - Signed-off-by: Jacob Moroni - Link: https://patch.msgid.link/20260112020006.1352438-1-jmoroni@google.com - Reviewed-by: Bart Van Assche - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c -index 62410578dec3..eb942ab9c405 100644 ---- a/drivers/infiniband/core/iwcm.c -+++ b/drivers/infiniband/core/iwcm.c -@@ -95,7 +95,6 @@ static struct workqueue_struct *iwcm_wq; - struct iwcm_work { - struct work_struct work; - struct iwcm_id_private *cm_id; -- struct list_head list; - struct iw_cm_event event; - struct list_head free_list; - }; -@@ -178,7 +177,6 @@ static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count) - return -ENOMEM; - } - work->cm_id = cm_id_priv; -- INIT_LIST_HEAD(&work->list); - put_work(work); - } - return 0; -@@ -213,7 +211,6 @@ static void free_cm_id(struct iwcm_id_private *cm_id_priv) - static bool iwcm_deref_id(struct iwcm_id_private *cm_id_priv) - { - if (refcount_dec_and_test(&cm_id_priv->refcount)) { -- BUG_ON(!list_empty(&cm_id_priv->work_list)); - free_cm_id(cm_id_priv); - return true; - } -@@ -260,7 +257,6 @@ struct iw_cm_id *iw_create_cm_id(struct ib_device *device, - refcount_set(&cm_id_priv->refcount, 1); - init_waitqueue_head(&cm_id_priv->connect_wait); - init_completion(&cm_id_priv->destroy_comp); -- INIT_LIST_HEAD(&cm_id_priv->work_list); - INIT_LIST_HEAD(&cm_id_priv->work_free_list); - - return &cm_id_priv->id; -@@ -1007,13 +1003,13 @@ static int process_event(struct iwcm_id_private *cm_id_priv, - } - - /* -- * Process events on the work_list for the cm_id. If the callback -- * function requests that the cm_id be deleted, a flag is set in the -- * cm_id flags to indicate that when the last reference is -- * removed, the cm_id is to be destroyed. This is necessary to -- * distinguish between an object that will be destroyed by the app -- * thread asleep on the destroy_comp list vs. an object destroyed -- * here synchronously when the last reference is removed. -+ * Process events for the cm_id. If the callback function requests -+ * that the cm_id be deleted, a flag is set in the cm_id flags to -+ * indicate that when the last reference is removed, the cm_id is -+ * to be destroyed. This is necessary to distinguish between an -+ * object that will be destroyed by the app thread asleep on the -+ * destroy_comp list vs. an object destroyed here synchronously -+ * when the last reference is removed. - */ - static void cm_work_handler(struct work_struct *_work) - { -@@ -1024,35 +1020,26 @@ static void cm_work_handler(struct work_struct *_work) - int ret = 0; - - spin_lock_irqsave(&cm_id_priv->lock, flags); -- while (!list_empty(&cm_id_priv->work_list)) { -- work = list_first_entry(&cm_id_priv->work_list, -- struct iwcm_work, list); -- list_del_init(&work->list); -- levent = work->event; -- put_work(work); -- spin_unlock_irqrestore(&cm_id_priv->lock, flags); -- -- if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { -- ret = process_event(cm_id_priv, &levent); -- if (ret) { -- destroy_cm_id(&cm_id_priv->id); -- WARN_ON_ONCE(iwcm_deref_id(cm_id_priv)); -- } -- } else -- pr_debug("dropping event %d\n", levent.event); -- if (iwcm_deref_id(cm_id_priv)) -- return; -- spin_lock_irqsave(&cm_id_priv->lock, flags); -- } -+ levent = work->event; -+ put_work(work); - spin_unlock_irqrestore(&cm_id_priv->lock, flags); -+ -+ if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { -+ ret = process_event(cm_id_priv, &levent); -+ if (ret) { -+ destroy_cm_id(&cm_id_priv->id); -+ WARN_ON_ONCE(iwcm_deref_id(cm_id_priv)); -+ } -+ } else -+ pr_debug("dropping event %d\n", levent.event); -+ if (iwcm_deref_id(cm_id_priv)) -+ return; - } - - /* - * This function is called on interrupt context. Schedule events on - * the iwcm_wq thread to allow callback functions to downcall into -- * the CM and/or block. Events are queued to a per-CM_ID -- * work_list. If this is the first event on the work_list, the work -- * element is also queued on the iwcm_wq thread. -+ * the CM and/or block. - * - * Each event holds a reference on the cm_id. Until the last posted - * event has been delivered and processed, the cm_id cannot be -@@ -1094,7 +1081,6 @@ static int cm_event_handler(struct iw_cm_id *cm_id, - } - - refcount_inc(&cm_id_priv->refcount); -- list_add_tail(&work->list, &cm_id_priv->work_list); - queue_work(iwcm_wq, &work->work); - out: - spin_unlock_irqrestore(&cm_id_priv->lock, flags); -diff --git a/drivers/infiniband/core/iwcm.h b/drivers/infiniband/core/iwcm.h -index bf74639be128..b56fb12edece 100644 ---- a/drivers/infiniband/core/iwcm.h -+++ b/drivers/infiniband/core/iwcm.h -@@ -50,7 +50,6 @@ struct iwcm_id_private { - struct ib_qp *qp; - struct completion destroy_comp; - wait_queue_head_t connect_wait; -- struct list_head work_list; - spinlock_t lock; - refcount_t refcount; - struct list_head work_free_list; --- -2.50.1 (Apple Git-155) - diff --git a/1380-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch b/1380-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch deleted file mode 100644 index 29adb1410..000000000 --- a/1380-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 9cc0c6b1ba8cd5c55aef043e1384de0a8b4efa71 Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Sun, 17 May 2026 21:23:44 -0400 -Subject: [PATCH] RDMA/mana: Remove user triggerable WARN_ON() in - mana_ib_create_qp_rss() - -[ Upstream commit 159f2efabc89d3f931d38f2d35876535d4abf0a3 ] - -Sashiko points out that the user can specify WQs sharing the same CQ as a -part of the uAPI and this will trigger the WARN_ON() then go on to corrupt -the kernel. - -Just reject it outright and fail the QP creation. - -Cc: stable@vger.kernel.org -Fixes: c15d7802a424 ("RDMA/mana_ib: Add CQ interrupt support for RAW QP") -Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1 -Link: https://patch.msgid.link/r/5-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com -Reviewed-by: Long Li -Signed-off-by: Jason Gunthorpe -[ adjusted context ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c -index 1becc87..e3c3c7e 100644 ---- a/drivers/infiniband/hw/mana/cq.c -+++ b/drivers/infiniband/hw/mana/cq.c -@@ -140,8 +140,9 @@ int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq) - - if (cq->queue.id >= gc->max_num_cqs) - return -EINVAL; -- /* Create CQ table entry */ -- WARN_ON(gc->cq_table[cq->queue.id]); -+ /* Create CQ table entry, sharing a CQ between WQs is not supported */ -+ if (gc->cq_table[cq->queue.id]) -+ return -EINVAL; - if (cq->queue.kmem) - gdma_cq = cq->queue.kmem; - else diff --git a/1381-scsi-qla2xxx-completely-fix-fcport-double-free.patch b/1381-scsi-qla2xxx-completely-fix-fcport-double-free.patch deleted file mode 100644 index c8cb92a93..000000000 --- a/1381-scsi-qla2xxx-completely-fix-fcport-double-free.patch +++ /dev/null @@ -1,42 +0,0 @@ -From c0b7da13a04bd70ef6070bfb9ea85f582294560a Mon Sep 17 00:00:00 2001 -From: Vladimir Riabchun -Date: Tue, 10 Feb 2026 11:08:22 +0100 -Subject: [PATCH] scsi: qla2xxx: Completely fix fcport double free - -In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). -When an error happens, this function is called by qla2x00_sp_release(), -when kref_put() releases the first and the last reference. - -qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). -Doing it one more time after kref_put() is a bad idea. - -Fixes: 82f522ae0d97 ("scsi: qla2xxx: Fix double free of fcport") -Fixes: 4895009c4bb7 ("scsi: qla2xxx: Prevent command send on chip reset") -Signed-off-by: Vladimir Riabchun -Signed-off-by: Farhat Abbas -Link: https://patch.msgid.link/aYsDln9NFQQsPDgg@vova-pc -Signed-off-by: Martin K. Petersen - -diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c -index 9038f6723444..dbe3cd4e274c 100644 ---- a/drivers/scsi/qla2xxx/qla_iocb.c -+++ b/drivers/scsi/qla2xxx/qla_iocb.c -@@ -2751,7 +2751,6 @@ qla24xx_els_dcmd_iocb(scsi_qla_host_t *vha, int els_opcode, - if (!elsio->u.els_logo.els_logo_pyld) { - /* ref: INIT */ - kref_put(&sp->cmd_kref, qla2x00_sp_release); -- qla2x00_free_fcport(fcport); - return QLA_FUNCTION_FAILED; - } - -@@ -2776,7 +2775,6 @@ qla24xx_els_dcmd_iocb(scsi_qla_host_t *vha, int els_opcode, - if (rval != QLA_SUCCESS) { - /* ref: INIT */ - kref_put(&sp->cmd_kref, qla2x00_sp_release); -- qla2x00_free_fcport(fcport); - return QLA_FUNCTION_FAILED; - } - --- -2.50.1 (Apple Git-155) - diff --git a/1382-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch b/1382-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch deleted file mode 100644 index 3c3eee7bd..000000000 --- a/1382-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch +++ /dev/null @@ -1,307 +0,0 @@ -From 492819afce989204328bb5fd0e7a2fc82fdcb3ac Mon Sep 17 00:00:00 2001 -From: Paolo Abeni -Date: Mon, 30 Mar 2026 19:24:36 +0200 -Subject: [PATCH] tcp: fix potential race in tcp_v6_syn_recv_sock() - -JIRA: https://issues.redhat.com/browse/RHEL-152718 -Conflicts: ipv6_fl_list still belongs to struct ipv6_pinfo, as rhel-10 \ - lacks the upstream commit 1c17f4373d4d ("ipv6: Move ipv6_fl_list from \ - ipv6_pinfo to inet_sock."). Adapt the tcp_v6_mapped_child_init() chunck - to init such field properly. - -Upstream commit: -commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae -Author: Eric Dumazet -Date: Tue Feb 17 16:12:05 2026 +0000 - - tcp: fix potential race in tcp_v6_syn_recv_sock() - - Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() - is done too late. - - After tcp_v4_syn_recv_sock(), the child socket is already visible - from TCP ehash table and other cpus might use it. - - Since newinet->pinet6 is still pointing to the listener ipv6_pinfo - bad things can happen as syzbot found. - - Move the problematic code in tcp_v6_mapped_child_init() - and call this new helper from tcp_v4_syn_recv_sock() before - the ehash insertion. - - This allows the removal of one tcp_sync_mss(), since - tcp_v4_syn_recv_sock() will call it with the correct - context. - - Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") - Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com - Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/ - Signed-off-by: Eric Dumazet - Reviewed-by: Kuniyuki Iwashima - Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Paolo Abeni - -diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h -index 4dc8646..b607c8e 100644 ---- a/include/net/inet_connection_sock.h -+++ b/include/net/inet_connection_sock.h -@@ -42,7 +42,9 @@ struct inet_connection_sock_af_ops { - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req); -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)); - u16 net_header_len; - u16 sockaddr_len; - int (*setsockopt)(struct sock *sk, int level, int optname, -diff --git a/include/net/tcp.h b/include/net/tcp.h -index a910e50..6a472ed 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -465,7 +465,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req); -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)); - int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb); - int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); - int tcp_connect(struct sock *sk); -diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c -index 1948d15..3976c82 100644 ---- a/net/ipv4/syncookies.c -+++ b/net/ipv4/syncookies.c -@@ -202,7 +202,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, - bool own_req; - - child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, -- NULL, &own_req); -+ NULL, &own_req, NULL); - if (child) { - refcount_set(&req->rsk_refcnt, 1); - sock_rps_save_rxhash(child, skb); -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index 8f3cbc2..9c1173f 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -247,7 +247,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, - bool own_req; - - child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, -- NULL, &own_req); -+ NULL, &own_req, NULL); - if (!child) - return NULL; - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 7f2f7b9..6ff7aaa 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1739,7 +1739,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct inet_request_sock *ireq; - bool found_dup_sk = false; -@@ -1795,6 +1797,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - } - sk_setup_caps(newsk, dst); - -+#if IS_ENABLED(CONFIG_IPV6) -+ if (opt_child_init) -+ opt_child_init(newsk, sk); -+#endif - tcp_ca_openreq_child(newsk, dst); - - tcp_sync_mss(newsk, dst_mtu(dst)); -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 8ff8f5c..bc1393d 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -862,7 +862,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, - * socket is created, wait for troubles. - */ - child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, -- req, &own_req); -+ req, &own_req, NULL); - if (!child) - goto listen_overflow; - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 66f08ab..15059ba 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1343,11 +1343,48 @@ static void tcp_v6_restore_cb(struct sk_buff *skb) - sizeof(struct inet6_skb_parm)); - } - -+/* Called from tcp_v4_syn_recv_sock() for v6_mapped children. */ -+static void tcp_v6_mapped_child_init(struct sock *newsk, const struct sock *sk) -+{ -+ struct inet_sock *newinet = inet_sk(newsk); -+ struct ipv6_pinfo *newnp; -+ -+ newinet->pinet6 = newnp = tcp_inet6_sk(newsk); -+ -+ memcpy(newnp, tcp_inet6_sk(sk), sizeof(struct ipv6_pinfo)); -+ -+ newnp->saddr = newsk->sk_v6_rcv_saddr; -+ -+ inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; -+ if (sk_is_mptcp(newsk)) -+ mptcpv6_handle_mapped(newsk, true); -+ newsk->sk_backlog_rcv = tcp_v4_do_rcv; -+#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO) -+ tcp_sk(newsk)->af_specific = &tcp_sock_ipv6_mapped_specific; -+#endif -+ -+ newnp->ipv6_mc_list = NULL; -+ newnp->ipv6_ac_list = NULL; -+ newnp->ipv6_fl_list = NULL; -+ newnp->pktoptions = NULL; -+ newnp->opt = NULL; -+ -+ /* tcp_v4_syn_recv_sock() has initialized newinet->mc_{index,ttl} */ -+ newnp->mcast_oif = newinet->mc_index; -+ newnp->mcast_hops = newinet->mc_ttl; -+ -+ newnp->rcv_flowinfo = 0; -+ if (inet6_test_bit(REPFLOW, sk)) -+ newnp->flow_label = 0; -+} -+ - static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct inet_request_sock *ireq; - struct ipv6_pinfo *newnp; -@@ -1363,60 +1400,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - #endif - struct flowi6 fl6; - -- if (skb->protocol == htons(ETH_P_IP)) { -- /* -- * v6 mapped -- */ -- -- newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst, -- req_unhash, own_req); -- -- if (!newsk) -- return NULL; -- -- inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk); -- -- newnp = tcp_inet6_sk(newsk); -- newtp = tcp_sk(newsk); -- -- memcpy(newnp, np, sizeof(struct ipv6_pinfo)); -- -- newnp->saddr = newsk->sk_v6_rcv_saddr; -- -- inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; -- if (sk_is_mptcp(newsk)) -- mptcpv6_handle_mapped(newsk, true); -- newsk->sk_backlog_rcv = tcp_v4_do_rcv; --#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO) -- newtp->af_specific = &tcp_sock_ipv6_mapped_specific; --#endif -- -- newnp->ipv6_mc_list = NULL; -- newnp->ipv6_ac_list = NULL; -- newnp->ipv6_fl_list = NULL; -- newnp->pktoptions = NULL; -- newnp->opt = NULL; -- newnp->mcast_oif = inet_iif(skb); -- newnp->mcast_hops = ip_hdr(skb)->ttl; -- newnp->rcv_flowinfo = 0; -- if (inet6_test_bit(REPFLOW, sk)) -- newnp->flow_label = 0; -- -- /* -- * No need to charge this sock to the relevant IPv6 refcnt debug socks count -- * here, tcp_create_openreq_child now does this for us, see the comment in -- * that function for the gory details. -acme -- */ -- -- /* It is tricky place. Until this moment IPv4 tcp -- worked with IPv6 icsk.icsk_af_ops. -- Sync it now. -- */ -- tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie); -- -- return newsk; -- } -- -+ if (skb->protocol == htons(ETH_P_IP)) -+ return tcp_v4_syn_recv_sock(sk, skb, req, dst, -+ req_unhash, own_req, -+ tcp_v6_mapped_child_init); - ireq = inet_rsk(req); - - if (sk_acceptq_is_full(sk)) -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index 69b531b..040a7f1 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -809,7 +809,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk); - struct mptcp_subflow_request_sock *subflow_req; -@@ -856,7 +858,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - - create_child: - child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, -- req_unhash, own_req); -+ req_unhash, own_req, opt_child_init); - - if (child && *own_req) { - struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child); -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 848db1a..1271644 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -125,7 +125,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct smc_sock *smc; - struct sock *child; -@@ -143,7 +145,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, - - /* passthrough to original syn recv sock fct */ - child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, -- own_req); -+ own_req, opt_child_init); - /* child must not inherit smc or its ops */ - if (child) { - rcu_assign_sk_user_data(child, NULL); diff --git a/1383-selinux-rhel-only-hotfix-for-execmem-regression.patch b/1383-selinux-rhel-only-hotfix-for-execmem-regression.patch deleted file mode 100644 index 2a6113c14..000000000 --- a/1383-selinux-rhel-only-hotfix-for-execmem-regression.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 7afc16c3e0cf718250da44444c47d04836225bb4 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 16 Jun 2026 10:06:13 +0200 -Subject: [PATCH] selinux: RHEL-only hotfix for execmem regression -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-185115 -Upstream Status: RHEL10-only - -As discovered by image-mode/CoreOS testing, the fixes for CVE-2026-46054 -caused a regression that results in unexpected execmem denials in -specific scenarios involving overlayfs (or another stacked filesystem). - -Specifically in case of image mode / CoreOS there is often (always?) an -overlayfs filesystem mounted during early boot (before SELinux policy is -loaded), which means that overlayfs captures the kernel’s SELinux -context as part of the mounter credentials, which are later used by -overlayfs+SELinux to verify that file accesses through the overlay mount -don’t give the mounter a way to access underlying files it otherwise -wouldn’t have access to. This verification would normally pass, as the -policy grants the kernel context almost unrestricted access to the -filesystem. However, the new checks added to fix CVE-2026-46054 -erroneously include the execmem check for the mounter and in the policy -kernel_t doesn’t have the execmem permission, so mmapping an overlay -file with MAP_PRIVATE and PROT_WRITE|PROT_EXEC would now result in a -SELinux denial. - -Fix this by passing a boolean through the helper functions that allows -to distinguish the direct permission check from the mounter check and -skipping the execmem check in the mounter case. - -This is a transient RHEL-only fix to allow the CVE fix to go through -without breaking image mode/CoreOS deployments. Once an optimal solution -is figured out and applied upstream, this commit will be reverted and -replaced with the upstream fix (at least in Y-streams). I expect the -upstream solution to be functionally equivalent, though probably -cosmetically different. - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 853cf9cee2ec..2ad4a39f0ea8 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -3809,7 +3809,7 @@ static int default_noexec __ro_after_init; - - static int __file_map_prot_check(const struct cred *cred, - const struct file *file, unsigned long prot, -- bool shared, bool bf_user_file) -+ bool shared, bool mounter, bool bf_user_file) - { - struct inode *inode = NULL; - bool prot_exec = prot & PROT_EXEC; -@@ -3823,7 +3823,7 @@ static int __file_map_prot_check(const struct cred *cred, - } - - if (default_noexec && prot_exec && -- (!file || IS_PRIVATE(inode) || (!shared && prot_write))) { -+ (!file || IS_PRIVATE(inode) || (!shared && prot_write)) && !mounter) { - int rc; - u32 sid = cred_sid(cred); - -@@ -3853,9 +3853,9 @@ static int __file_map_prot_check(const struct cred *cred, - - static inline int file_map_prot_check(const struct cred *cred, - const struct file *file, -- unsigned long prot, bool shared) -+ unsigned long prot, bool shared, bool mounter) - { -- return __file_map_prot_check(cred, file, prot, shared, false); -+ return __file_map_prot_check(cred, file, prot, shared, mounter, false); - } - - static int selinux_mmap_addr(unsigned long addr) -@@ -3872,7 +3872,7 @@ static int selinux_mmap_addr(unsigned long addr) - } - - static int selinux_mmap_file_common(const struct cred *cred, struct file *file, -- unsigned long prot, bool shared) -+ unsigned long prot, bool shared, bool mounter) - { - if (file) { - int rc; -@@ -3885,7 +3885,7 @@ static int selinux_mmap_file_common(const struct cred *cred, struct file *file, - return rc; - } - -- return file_map_prot_check(cred, file, prot, shared); -+ return file_map_prot_check(cred, file, prot, shared, mounter); - } - - static int selinux_mmap_file(struct file *file, -@@ -3893,7 +3893,8 @@ static int selinux_mmap_file(struct file *file, - unsigned long prot, unsigned long flags) - { - return selinux_mmap_file_common(current_cred(), file, prot, -- (flags & MAP_TYPE) == MAP_SHARED); -+ (flags & MAP_TYPE) == MAP_SHARED, -+ false); - } - - /** -@@ -3926,7 +3927,8 @@ static int selinux_mmap_backing_file(struct vm_area_struct *vma, - prot |= PROT_EXEC; - - return selinux_mmap_file_common(backing_file->f_cred, backing_file, -- prot, vma->vm_flags & VM_SHARED); -+ prot, vma->vm_flags & VM_SHARED, -+ true); - } - - static int selinux_file_mprotect(struct vm_area_struct *vma, -@@ -3987,11 +3989,11 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, - } - } - -- rc = __file_map_prot_check(cred, file, prot, shared, backing_file); -+ rc = __file_map_prot_check(cred, file, prot, shared, false, backing_file); - if (rc) - return rc; - if (backing_file) { -- rc = file_map_prot_check(file->f_cred, file, prot, shared); -+ rc = file_map_prot_check(file->f_cred, file, prot, shared, true); - if (rc) - return rc; - } --- -2.50.1 (Apple Git-155) - diff --git a/1384-ipv4-account-for-fraggap-on-the-paged-allocation-path.patch b/1384-ipv4-account-for-fraggap-on-the-paged-allocation-path.patch deleted file mode 100644 index e63402fe7..000000000 --- a/1384-ipv4-account-for-fraggap-on-the-paged-allocation-path.patch +++ /dev/null @@ -1,56 +0,0 @@ -From eca856950f7cb1a221e02b99d758409f2c5cec42 Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:38:29 +0900 -Subject: [PATCH] ipv4: account for fraggap on the paged allocation path - -In __ip_append_data(), when the paged-allocation branch is taken, -alloclen and pagedlen are computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap, but the fraggap bytes carried over -from the previous skb are copied into the new skb's linear area at -offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The -linear area is therefore undersized by fraggap bytes while pagedlen is -overstated by the same amount. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. - -Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 58f155e..7625bcc 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1123,8 +1123,8 @@ alloc_new_skb: - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - - alloclen += alloc_extra; -@@ -1171,9 +1171,6 @@ alloc_new_skb: - } - - copy = datalen - transhdrlen - fraggap - pagedlen; -- /* [!] NOTE: copy will be negative if pagedlen>0 -- * because then the equation reduces to -fraggap. -- */ - if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) { - err = -EFAULT; - kfree_skb(skb); diff --git a/1385-ipv6-account-for-fraggap-on-the-paged-allocation-path.patch b/1385-ipv6-account-for-fraggap-on-the-paged-allocation-path.patch deleted file mode 100644 index c9a75ee88..000000000 --- a/1385-ipv6-account-for-fraggap-on-the-paged-allocation-path.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 736b380e28d0480c7bc3e022f1950f31fe53a7c5 Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:46:17 +0900 -Subject: [PATCH] ipv6: account for fraggap on the paged allocation path - -In __ip6_append_data(), when the paged-allocation branch is taken -(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are -computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap (datalen = length + fraggap). When -fraggap is non-zero, this is not the first skb and transhdrlen is zero. -The fraggap bytes carried over from the previous skb are copied just past -the fragment headers in the new skb's linear area. The linear area is -therefore undersized by fraggap bytes while pagedlen is overstated by the -same amount, and the copy writes past skb->end into the trailing -skb_shared_info. - -An unprivileged user can trigger this via a UDPv6 socket using -MSG_MORE together with MSG_SPLICE_PAGES. - -The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: -avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix -__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative -copy value caused -EINVAL to be returned. That later commit allowed -MSG_SPLICE_PAGES to proceed in this case, making the corruption -triggerable. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. -Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES -case, remove the MSG_SPLICE_PAGES exception from the negative copy check. - -Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 9f1e0e4f7464..368e4fa3b43c 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1667,8 +1667,8 @@ static int __ip6_append_data(struct sock *sk, - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - alloclen += alloc_extra; - -@@ -1683,10 +1683,7 @@ static int __ip6_append_data(struct sock *sk, - fraglen = datalen + fragheaderlen; - - copy = datalen - transhdrlen - fraggap - pagedlen; -- /* [!] NOTE: copy may be negative if pagedlen>0 -- * because then the equation may reduces to -fraggap. -- */ -- if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) { -+ if (copy < 0) { - err = -EINVAL; - goto error; - } --- -2.50.1 (Apple Git-155) - diff --git a/1386-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch b/1386-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch deleted file mode 100644 index f76dd5f19..000000000 --- a/1386-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch +++ /dev/null @@ -1,110 +0,0 @@ -From a10f13521226dba6ce396abb8b1b91570f5b61ec Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Mon, 20 Apr 2026 14:32:13 +0200 -Subject: [PATCH] ALSA: usb-audio: Add sanity check for OOB writes at silencing - -JIRA: https://issues.redhat.com/browse/RHEL-168082 - -commit fba2105a157fffcf19825e4eea498346738c9948 -Author: Takashi Iwai -Date: Mon Feb 16 15:12:07 2026 +0100 - - ALSA: usb-audio: Add sanity check for OOB writes at silencing - - At silencing the playback URB packets in the implicit fb mode before - the actual playback, we blindly assume that the received packets fit - with the buffer size. But when the setup in the capture stream - differs from the playback stream (e.g. due to the USB core limitation - of max packet size), such an inconsistency may lead to OOB writes to - the buffer, resulting in a crash. - - For addressing it, add a sanity check of the transfer buffer size at - prepare_silent_urb(), and stop the data copy if the received data - overflows. Also, report back the transfer error properly from there, - too. - - Note that this doesn't fix the root cause of the playback error - itself, but this merely covers the kernel Oops. - - Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 - Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de - Signed-off-by: Takashi Iwai - -Signed-off-by: Jaroslav Kysela - -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index 08cc2ee5707d..6e443f762de8 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -275,8 +275,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) - return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; - } - --static void prepare_silent_urb(struct snd_usb_endpoint *ep, -- struct snd_urb_ctx *ctx) -+static int prepare_silent_urb(struct snd_usb_endpoint *ep, -+ struct snd_urb_ctx *ctx) - { - struct urb *urb = ctx->urb; - unsigned int offs = 0; -@@ -289,28 +289,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, - extra = sizeof(packet_length); - - for (i = 0; i < ctx->packets; ++i) { -- unsigned int offset; -- unsigned int length; -- int counts; -- -- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); -- length = counts * ep->stride; /* number of silent bytes */ -- offset = offs * ep->stride + extra * i; -- urb->iso_frame_desc[i].offset = offset; -+ int length; -+ -+ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); -+ if (length < 0) -+ return length; -+ length *= ep->stride; /* number of silent bytes */ -+ if (offs + length + extra > ctx->buffer_size) -+ break; -+ urb->iso_frame_desc[i].offset = offs; - urb->iso_frame_desc[i].length = length + extra; - if (extra) { - packet_length = cpu_to_le32(length); -- memcpy(urb->transfer_buffer + offset, -+ memcpy(urb->transfer_buffer + offs, - &packet_length, sizeof(packet_length)); -+ offs += extra; - } -- memset(urb->transfer_buffer + offset + extra, -+ memset(urb->transfer_buffer + offs, - ep->silence_value, length); -- offs += counts; -+ offs += length; - } - -- urb->number_of_packets = ctx->packets; -- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; -+ if (!offs) -+ return -EPIPE; -+ -+ urb->number_of_packets = i; -+ urb->transfer_buffer_length = offs; - ctx->queued = 0; -+ return 0; - } - - /* -@@ -332,8 +338,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, - if (data_subs && ep->prepare_data_urb) - return ep->prepare_data_urb(data_subs, urb, in_stream_lock); - /* no data provider, so send silence */ -- prepare_silent_urb(ep, ctx); -- break; -+ return prepare_silent_urb(ep, ctx); - - case SND_USB_ENDPOINT_TYPE_SYNC: - if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { --- -2.50.1 (Apple Git-155) - diff --git a/1387-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch b/1387-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch deleted file mode 100644 index 0ec10f33a..000000000 --- a/1387-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch +++ /dev/null @@ -1,137 +0,0 @@ -From aef881da47f3c07173c5357b36a45fc4b754eb55 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 27 May 2026 17:21:48 +0000 -Subject: [PATCH] ALSA: aloop: Fix peer runtime UAF during format-change stop -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-179311 -CVE: CVE-2026-46090 -Backported from tree(s): linux - -commit e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff -Author: Cássio Gabriel -Date: Fri Apr 24 09:48:41 2026 -0300 - - ALSA: aloop: Fix peer runtime UAF during format-change stop - - loopback_check_format() may stop the capture side when playback starts - with parameters that no longer match a running capture stream. Commit - 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved - the peer lookup under cable->lock, but the actual snd_pcm_stop() still - runs after dropping that lock. - - A concurrent close can clear the capture entry from cable->streams[] and - detach or free its runtime while the playback trigger path still holds a - stale peer substream pointer. - - Keep a per-cable count of in-flight peer stops before dropping - cable->lock, and make free_cable() wait for those stops before - detaching the runtime. This preserves the existing behavior while - making the peer runtime lifetime explicit. - - Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com - Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f - Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback") - Cc: stable@vger.kernel.org - Suggested-by: Takashi Iwai - Signed-off-by: Cássio Gabriel - Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com - Signed-off-by: Takashi Iwai - -Signed-off-by: CKI Backport Bot - -diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c -index aa0d2fcb1a18..a37a1695f51c 100644 ---- a/sound/drivers/aloop.c -+++ b/sound/drivers/aloop.c -@@ -99,6 +99,9 @@ struct loopback_ops { - struct loopback_cable { - spinlock_t lock; - struct loopback_pcm *streams[2]; -+ /* in-flight peer stops running outside cable->lock */ -+ atomic_t stop_count; -+ wait_queue_head_t stop_wait; - struct snd_pcm_hardware hw; - /* flags */ - unsigned int valid; -@@ -366,8 +369,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream) - return 0; - if (stream == SNDRV_PCM_STREAM_CAPTURE) - return -EIO; -- else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) -+ else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) { -+ /* close must not free the peer runtime below */ -+ atomic_inc(&cable->stop_count); - stop_capture = true; -+ } - } - - setup = get_setup(dpcm_play); -@@ -396,8 +402,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream) - } - } - -- if (stop_capture) -+ if (stop_capture) { - snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING); -+ if (atomic_dec_and_test(&cable->stop_count)) -+ wake_up(&cable->stop_wait); -+ } - - return 0; - } -@@ -1049,23 +1058,29 @@ static void free_cable(struct snd_pcm_substream *substream) - struct loopback *loopback = substream->private_data; - int dev = get_cable_index(substream); - struct loopback_cable *cable; -+ struct loopback_pcm *dpcm; -+ bool other_alive; - - cable = loopback->cables[substream->number][dev]; - if (!cable) - return; -- if (cable->streams[!substream->stream]) { -- /* other stream is still alive */ -- guard(spinlock_irq)(&cable->lock); -- cable->streams[substream->stream] = NULL; -- } else { -- struct loopback_pcm *dpcm = substream->runtime->private_data; - -- if (cable->ops && cable->ops->close_cable && dpcm) -- cable->ops->close_cable(dpcm); -- /* free the cable */ -- loopback->cables[substream->number][dev] = NULL; -- kfree(cable); -+ scoped_guard(spinlock_irq, &cable->lock) { -+ cable->streams[substream->stream] = NULL; -+ other_alive = cable->streams[!substream->stream]; - } -+ -+ /* Pair with the stop_count increment in loopback_check_format(). */ -+ wait_event(cable->stop_wait, !atomic_read(&cable->stop_count)); -+ if (other_alive) -+ return; -+ -+ dpcm = substream->runtime->private_data; -+ if (cable->ops && cable->ops->close_cable && dpcm) -+ cable->ops->close_cable(dpcm); -+ /* free the cable */ -+ loopback->cables[substream->number][dev] = NULL; -+ kfree(cable); - } - - static int loopback_jiffies_timer_open(struct loopback_pcm *dpcm) -@@ -1260,6 +1275,8 @@ static int loopback_open(struct snd_pcm_substream *substream) - goto unlock; - } - spin_lock_init(&cable->lock); -+ atomic_set(&cable->stop_count, 0); -+ init_waitqueue_head(&cable->stop_wait); - cable->hw = loopback_pcm_hardware; - if (loopback->timer_source) - cable->ops = &loopback_snd_timer_ops; --- -2.50.1 (Apple Git-155) - diff --git a/1388-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch b/1388-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch deleted file mode 100644 index 8d54e15bc..000000000 --- a/1388-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0 Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Tue, 28 Apr 2026 13:17:43 -0300 -Subject: [PATCH] RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() - error path - -commit e38e86995df27f1f854063dab1f0c6a513db3faf upstream. - -Sashiko points out that pvrdma_uar_free() is already called within -pvrdma_dealloc_ucontext(), so calling it before triggers a double free. - -Cc: stable@vger.kernel.org -Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") -Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=4 -Link: https://patch.msgid.link/r/10-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com -Signed-off-by: Jason Gunthorpe -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -index 9f54aa90a35a..dde1910dd8b1 100644 ---- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -@@ -350,7 +350,7 @@ int pvrdma_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata) - uresp.qp_tab_size = vdev->dsr->caps.max_qp; - ret = ib_copy_to_udata(udata, &uresp, sizeof(uresp)); - if (ret) { -- pvrdma_uar_free(vdev, &context->uar); -+ /* pvrdma_dealloc_ucontext() also frees the UAR */ - pvrdma_dealloc_ucontext(&context->ibucontext); - return -EFAULT; - } --- -2.50.1 (Apple Git-155) - diff --git a/1389-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch b/1389-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch deleted file mode 100644 index 879961997..000000000 --- a/1389-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch +++ /dev/null @@ -1,166 +0,0 @@ -From 93e4b63cd923391c972220739a5fcc7bc01a4cb7 Mon Sep 17 00:00:00 2001 -From: Nilesh Javali -Date: Thu, 19 Mar 2026 15:01:53 +0530 -Subject: [PATCH] scsi: qla2xxx: Add support to report MPI FW state - -JIRA: https://redhat.atlassian.net/browse/RHEL-157286 - -Upstream Status: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git - -commit 0e124af675ebabddacfeb0958abd443265dddf13 -Author: Nilesh Javali -Date: Thu Mar 5 15:03:37 2026 +0530 - - scsi: qla2xxx: Add support to report MPI FW state - - MPI firmware state was returned as 0. Get MPI FW state to proceed with - flash image validation. - - A new sysfs node 'mpi_fw_state' is added to report MPI firmware state: - - /sys/class/scsi_host/hostXX/mpi_fw_state - - Fixes: d74181ca110e ("scsi: qla2xxx: Add bsg interface to support firmware img validation") - Signed-off-by: Nilesh Javali - Link: https://patch.msgid.link/20260305093337.2007205-1-njavali@marvell.com - Signed-off-by: Martin K. Petersen - -Signed-off-by: Nilesh Javali - -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index 2e584a8bf66b..6a05ce195aa0 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -1638,7 +1638,7 @@ qla2x00_fw_state_show(struct device *dev, struct device_attribute *attr, - { - scsi_qla_host_t *vha = shost_priv(class_to_shost(dev)); - int rval = QLA_FUNCTION_FAILED; -- uint16_t state[6]; -+ uint16_t state[16]; - uint32_t pstate; - - if (IS_QLAFX00(vha->hw)) { -@@ -2402,6 +2402,63 @@ qla2x00_dport_diagnostics_show(struct device *dev, - vha->dport_data[0], vha->dport_data[1], - vha->dport_data[2], vha->dport_data[3]); - } -+ -+static ssize_t -+qla2x00_mpi_fw_state_show(struct device *dev, struct device_attribute *attr, -+ char *buf) -+{ -+ scsi_qla_host_t *vha = shost_priv(class_to_shost(dev)); -+ int rval = QLA_FUNCTION_FAILED; -+ u16 state[16]; -+ u16 mpi_state; -+ struct qla_hw_data *ha = vha->hw; -+ -+ if (!(IS_QLA27XX(ha) || IS_QLA28XX(ha))) -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI state reporting is not supported for this HBA.\n"); -+ -+ memset(state, 0, sizeof(state)); -+ -+ mutex_lock(&vha->hw->optrom_mutex); -+ if (qla2x00_chip_is_down(vha)) { -+ mutex_unlock(&vha->hw->optrom_mutex); -+ ql_dbg(ql_dbg_user, vha, 0x70df, -+ "ISP reset is in progress, failing mpi_fw_state.\n"); -+ return -EBUSY; -+ } else if (vha->hw->flags.eeh_busy) { -+ mutex_unlock(&vha->hw->optrom_mutex); -+ ql_dbg(ql_dbg_user, vha, 0x70ea, -+ "HBA in PCI error state, failing mpi_fw_state.\n"); -+ return -EBUSY; -+ } -+ -+ rval = qla2x00_get_firmware_state(vha, state); -+ mutex_unlock(&vha->hw->optrom_mutex); -+ if (rval != QLA_SUCCESS) { -+ ql_dbg(ql_dbg_user, vha, 0x70eb, -+ "MB Command to retrieve MPI state failed (%d), failing mpi_fw_state.\n", -+ rval); -+ return -EIO; -+ } -+ -+ mpi_state = state[11]; -+ -+ if (!(mpi_state & BIT_15)) -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI firmware state reporting is not supported by this firmware. (0x%02x)\n", -+ mpi_state); -+ -+ if (!(mpi_state & BIT_8)) -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI firmware is disabled. (0x%02x)\n", -+ mpi_state); -+ -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI firmware is enabled, state is %s. (0x%02x)\n", -+ mpi_state & BIT_9 ? "active" : "inactive", -+ mpi_state); -+} -+ - static DEVICE_ATTR(dport_diagnostics, 0444, - qla2x00_dport_diagnostics_show, NULL); - -@@ -2469,6 +2526,8 @@ static DEVICE_ATTR(port_speed, 0644, qla2x00_port_speed_show, - qla2x00_port_speed_store); - static DEVICE_ATTR(port_no, 0444, qla2x00_port_no_show, NULL); - static DEVICE_ATTR(fw_attr, 0444, qla2x00_fw_attr_show, NULL); -+static DEVICE_ATTR(mpi_fw_state, 0444, qla2x00_mpi_fw_state_show, NULL); -+ - - static struct attribute *qla2x00_host_attrs[] = { - &dev_attr_driver_version.attr.attr, -@@ -2517,6 +2576,7 @@ static struct attribute *qla2x00_host_attrs[] = { - &dev_attr_qlini_mode.attr, - &dev_attr_ql2xiniexchg.attr, - &dev_attr_ql2xexchoffld.attr, -+ &dev_attr_mpi_fw_state.attr, - NULL, - }; - -diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c -index 93ca7319bd6a..bee76b8d9e35 100644 ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -4916,7 +4916,7 @@ qla2x00_fw_ready(scsi_qla_host_t *vha) - unsigned long wtime, mtime, cs84xx_time; - uint16_t min_wait; /* Minimum wait time if loop is down */ - uint16_t wait_time; /* Wait time if loop is coming ready */ -- uint16_t state[6]; -+ uint16_t state[16]; - struct qla_hw_data *ha = vha->hw; - - if (IS_QLAFX00(vha->hw)) -diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c -index d0f09f0a2459..e3ee26058901 100644 ---- a/drivers/scsi/qla2xxx/qla_mbx.c -+++ b/drivers/scsi/qla2xxx/qla_mbx.c -@@ -2266,6 +2266,13 @@ qla2x00_get_firmware_state(scsi_qla_host_t *vha, uint16_t *states) - mcp->in_mb = MBX_6|MBX_5|MBX_4|MBX_3|MBX_2|MBX_1|MBX_0; - else - mcp->in_mb = MBX_1|MBX_0; -+ -+ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) { -+ mcp->mb[12] = 0; -+ mcp->out_mb |= MBX_12; -+ mcp->in_mb |= MBX_12; -+ } -+ - mcp->tov = MBX_TOV_SECONDS; - mcp->flags = 0; - rval = qla2x00_mailbox_command(vha, mcp); -@@ -2278,6 +2285,8 @@ qla2x00_get_firmware_state(scsi_qla_host_t *vha, uint16_t *states) - states[3] = mcp->mb[4]; - states[4] = mcp->mb[5]; - states[5] = mcp->mb[6]; /* DPORT status */ -+ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) -+ states[11] = mcp->mb[12]; /* MPI state. */ - } - - if (rval != QLA_SUCCESS) { --- -2.50.1 (Apple Git-155) - diff --git a/1390-crypto-tegra-remove-unneeded-crypto-engine-stop-call.patch b/1390-crypto-tegra-remove-unneeded-crypto-engine-stop-call.patch deleted file mode 100644 index fca9e8400..000000000 --- a/1390-crypto-tegra-remove-unneeded-crypto-engine-stop-call.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 2f96df36f51ba409638b0111c4b1d7b30a88008c Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - remove unneeded crypto_engine_stop() call - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into the upstream linux.git - -commit 6ef46fec4171433fd9a3162b88ec2ce808676193 -Author: Ovidiu Panait -Date: Sun Oct 20 22:25:31 2024 +0300 - - crypto: tegra - remove unneeded crypto_engine_stop() call - - The explicit crypto_engine_stop() call is not needed, as it is already - called internally by crypto_engine_exit(). - - Signed-off-by: Ovidiu Panait - Acked-by: Thierry Reding - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c -index db5890c7f098..15ed363d09c9 100644 ---- a/drivers/crypto/tegra/tegra-se-main.c -+++ b/drivers/crypto/tegra/tegra-se-main.c -@@ -320,7 +320,6 @@ static int tegra_se_probe(struct platform_device *pdev) - - ret = tegra_se_host1x_register(se); - if (ret) { -- crypto_engine_stop(se->engine); - crypto_engine_exit(se->engine); - return dev_err_probe(dev, ret, "failed to init host1x params\n"); - } -@@ -332,7 +331,6 @@ static void tegra_se_remove(struct platform_device *pdev) - { - struct tegra_se *se = platform_get_drvdata(pdev); - -- crypto_engine_stop(se->engine); - crypto_engine_exit(se->engine); - host1x_client_unregister(&se->client); - } --- -2.50.1 (Apple Git-155) - diff --git a/1391-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch b/1391-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch deleted file mode 100644 index 39ac125a7..000000000 --- a/1391-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 219a1eb51634836cdf22208c1b6589c3533f89fd Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - use API helpers to setup fallback request - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into the upstream linux.git - -commit c1024581ff2c34db4fdfe857b29f606e5117eb12 -Author: Ovidiu Panait -Date: Mon Apr 7 15:36:04 2025 +0300 - - crypto: tegra - use API helpers to setup fallback request - - Rather than setting up the fallback request by hand, use - ahash_request_set_callback() and ahash_request_set_crypt() API helpers - to properly setup the new request. - - Signed-off-by: Ovidiu Panait - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index 90bf34eb3578..e3fe5911a324 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -118,8 +118,9 @@ static int tegra_sha_fallback_init(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); - - return crypto_ahash_init(&rctx->fallback_req); - } -@@ -131,10 +132,10 @@ static int tegra_sha_fallback_update(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- rctx->fallback_req.nbytes = req->nbytes; -- rctx->fallback_req.src = req->src; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, req->src, NULL, req->nbytes); - - return crypto_ahash_update(&rctx->fallback_req); - } -@@ -146,9 +147,10 @@ static int tegra_sha_fallback_final(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- rctx->fallback_req.result = req->result; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, NULL, req->result, 0); - - return crypto_ahash_final(&rctx->fallback_req); - } -@@ -160,12 +162,11 @@ static int tegra_sha_fallback_finup(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- -- rctx->fallback_req.nbytes = req->nbytes; -- rctx->fallback_req.src = req->src; -- rctx->fallback_req.result = req->result; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, req->src, req->result, -+ req->nbytes); - - return crypto_ahash_finup(&rctx->fallback_req); - } -@@ -177,12 +178,11 @@ static int tegra_sha_fallback_digest(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- -- rctx->fallback_req.nbytes = req->nbytes; -- rctx->fallback_req.src = req->src; -- rctx->fallback_req.result = req->result; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, req->src, req->result, -+ req->nbytes); - - return crypto_ahash_digest(&rctx->fallback_req); - } -@@ -194,8 +194,9 @@ static int tegra_sha_fallback_import(struct ahash_request *req, const void *in) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); - - return crypto_ahash_import(&rctx->fallback_req, in); - } -@@ -207,8 +208,9 @@ static int tegra_sha_fallback_export(struct ahash_request *req, void *out) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); - - return crypto_ahash_export(&rctx->fallback_req, out); - } --- -2.50.1 (Apple Git-155) - diff --git a/1392-crypto-tegra-remove-the-use-of-dev-err-probe.patch b/1392-crypto-tegra-remove-the-use-of-dev-err-probe.patch deleted file mode 100644 index 211ee6342..000000000 --- a/1392-crypto-tegra-remove-the-use-of-dev-err-probe.patch +++ /dev/null @@ -1,46 +0,0 @@ -From d7e26cf1c6ec1ec012332f9b1ef126087c968d13 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - Remove the use of dev_err_probe() - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into the upstream linux.git - -commit 8595bcb09b05a6c712c35f03ef701e7785895b51 -Author: Liao Yuanhong -Date: Wed Aug 20 20:37:52 2025 +0800 - - crypto: tegra - Remove the use of dev_err_probe() - - Logging messages that show some type of "out of memory" error are generally - unnecessary as there is a generic message and a stack dump done by the - memory subsystem. These messages generally increase kernel size without - much added value[1]. - - The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, - remove the useless call to dev_err_probe(), and just return the value - instead. - - [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ - - Signed-off-by: Liao Yuanhong - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c -index 15ed363d09c9..4e7115b247e7 100644 ---- a/drivers/crypto/tegra/tegra-se-main.c -+++ b/drivers/crypto/tegra/tegra-se-main.c -@@ -310,7 +310,7 @@ static int tegra_se_probe(struct platform_device *pdev) - - se->engine = crypto_engine_alloc_init(dev, 0); - if (!se->engine) -- return dev_err_probe(dev, -ENOMEM, "failed to init crypto engine\n"); -+ return -ENOMEM; - - ret = crypto_engine_start(se->engine); - if (ret) { --- -2.50.1 (Apple Git-155) - diff --git a/1393-crypto-tegra-use-int-type-to-store-negative-error-codes.patch b/1393-crypto-tegra-use-int-type-to-store-negative-error-codes.patch deleted file mode 100644 index a0f9250b7..000000000 --- a/1393-crypto-tegra-use-int-type-to-store-negative-error-codes.patch +++ /dev/null @@ -1,43 +0,0 @@ -From a1d28aa82ab3b030bc0df6b55781f5b0f6d621cc Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - Use int type to store negative error codes - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into the upstream linux.git - -commit a710a71cd8ad294937e03b352cd71deb7ad08700 -Author: Qianfeng Rong -Date: Wed Sep 3 21:25:37 2025 +0800 - - crypto: tegra - Use int type to store negative error codes - - Change the 'ret' variable in tegra_sha_do_update() from unsigned int to - int, as it needs to store either negative error codes or zero returned - by tegra_se_host1x_submit(). - - No effect on runtime. - - Signed-off-by: Qianfeng Rong - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index e3fe5911a324..79f1e5c9b729 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -401,8 +401,9 @@ static int tegra_sha_do_update(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(req)); - struct tegra_sha_reqctx *rctx = ahash_request_ctx(req); - struct tegra_se *se = ctx->se; -- unsigned int nblks, nresidue, size, ret; -+ unsigned int nblks, nresidue, size; - u32 *cpuvaddr = se->cmdbuf->addr; -+ int ret; - - nresidue = (req->nbytes + rctx->residue.size) % rctx->blk_size; - nblks = (req->nbytes + rctx->residue.size) / rctx->blk_size; --- -2.50.1 (Apple Git-155) - diff --git a/1394-crypto-tegra-add-missing-crypto-alg-async.patch b/1394-crypto-tegra-add-missing-crypto-alg-async.patch deleted file mode 100644 index 33689f4d7..000000000 --- a/1394-crypto-tegra-add-missing-crypto-alg-async.patch +++ /dev/null @@ -1,224 +0,0 @@ -From cc5bf4cbc38613252229691b5e3a5a4c5aea92af Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - Add missing CRYPTO_ALG_ASYNC - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into the upstream linux.git -CVE: CVE-2026-31739 - -commit 4b56770d345524fc2acc143a2b85539cf7d74bc1 -Author: Eric Biggers -Date: Mon Mar 16 13:21:19 2026 -0700 - - crypto: tegra - Add missing CRYPTO_ALG_ASYNC - - The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its - asynchronous algorithms, causing the crypto API to select them for users - that request only synchronous algorithms. This causes crashes (at - least). Fix this by adding the flag like what the other drivers do. - Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just - get ignored and overridden by the registration function anyway. - - Reported-by: Zorro Lang - Closes: https://lore.kernel.org/r/20260314080937.pghb4aa7d4je3mhh@dell-per750-06-vm-08.rhts.eng.pek2.redhat.com - Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") - Cc: stable@vger.kernel.org - Cc: Akhil R - Signed-off-by: Eric Biggers - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 8b91f00b9c31..30c78afe3dea 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -532,7 +532,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "cbc(aes)", - .cra_driver_name = "cbc-aes-tegra", - .cra_priority = 500, -- .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_ASYNC, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = 0xf, -@@ -553,7 +553,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "ecb(aes)", - .cra_driver_name = "ecb-aes-tegra", - .cra_priority = 500, -- .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_ASYNC, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = 0xf, -@@ -575,7 +575,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "ctr(aes)", - .cra_driver_name = "ctr-aes-tegra", - .cra_priority = 500, -- .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_ASYNC, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = 1, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = 0xf, -@@ -597,6 +597,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "xts(aes)", - .cra_driver_name = "xts-aes-tegra", - .cra_priority = 500, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = (__alignof__(u64) - 1), -@@ -1931,6 +1932,7 @@ static struct tegra_se_alg tegra_aead_algs[] = { - .cra_name = "gcm(aes)", - .cra_driver_name = "gcm-aes-tegra", - .cra_priority = 500, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = 1, - .cra_ctxsize = sizeof(struct tegra_aead_ctx), - .cra_alignmask = 0xf, -@@ -1953,6 +1955,7 @@ static struct tegra_se_alg tegra_aead_algs[] = { - .cra_name = "ccm(aes)", - .cra_driver_name = "ccm-aes-tegra", - .cra_priority = 500, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = 1, - .cra_ctxsize = sizeof(struct tegra_aead_ctx), - .cra_alignmask = 0xf, -@@ -1980,7 +1983,7 @@ static struct tegra_se_alg tegra_cmac_algs[] = { - .cra_name = "cmac(aes)", - .cra_driver_name = "tegra-se-cmac", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_cmac_ctx), - .cra_alignmask = 0, -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index 79f1e5c9b729..23d549801612 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -764,7 +764,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha1", - .cra_driver_name = "tegra-se-sha1", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA1_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -789,7 +789,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha224", - .cra_driver_name = "tegra-se-sha224", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA224_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -814,7 +814,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha256", - .cra_driver_name = "tegra-se-sha256", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA256_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -839,7 +839,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha384", - .cra_driver_name = "tegra-se-sha384", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA384_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -864,7 +864,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha512", - .cra_driver_name = "tegra-se-sha512", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA512_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -889,7 +889,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-224", - .cra_driver_name = "tegra-se-sha3-224", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_224_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -914,7 +914,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-256", - .cra_driver_name = "tegra-se-sha3-256", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_256_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -939,7 +939,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-384", - .cra_driver_name = "tegra-se-sha3-384", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_384_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -964,7 +964,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-512", - .cra_driver_name = "tegra-se-sha3-512", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_512_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -991,7 +991,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha224)", - .cra_driver_name = "tegra-se-hmac-sha224", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA224_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -1018,7 +1019,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha256)", - .cra_driver_name = "tegra-se-hmac-sha256", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA256_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -1045,7 +1047,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha384)", - .cra_driver_name = "tegra-se-hmac-sha384", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA384_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -1072,7 +1075,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha512)", - .cra_driver_name = "tegra-se-hmac-sha512", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA512_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, --- -2.50.1 (Apple Git-155) - diff --git a/1395-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch b/1395-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch deleted file mode 100644 index 4e670e226..000000000 --- a/1395-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch +++ /dev/null @@ -1,48 +0,0 @@ -From c5fe58117093d6c4612c61902602e27df0ebe69a Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - Don't touch bo refcount in host1x bo - pin/unpin - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into the upstream linux.git - -commit f8c9c57d750346abd213ffed2ae3cacb0268e9f1 -Author: Mikko Perttunen -Date: Fri May 15 11:34:52 2026 +0900 - - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin - - Since commit "gpu: host1x: Allow entries in BO caches to be freed", - host1x_bo_pin() and host1x_bo_unpin() handle the bo's refcount - themselves. .pin/.unpin callbacks should not adjust it. - - Signed-off-by: Mikko Perttunen - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c -index 4e7115b247e7..f0b6c4f0548f 100644 ---- a/drivers/crypto/tegra/tegra-se-main.c -+++ b/drivers/crypto/tegra/tegra-se-main.c -@@ -52,7 +52,7 @@ tegra_se_cmdbuf_pin(struct device *dev, struct host1x_bo *bo, enum dma_data_dire - return ERR_PTR(-ENOMEM); - - kref_init(&map->ref); -- map->bo = host1x_bo_get(bo); -+ map->bo = bo; - map->direction = direction; - map->dev = dev; - -@@ -93,7 +93,6 @@ static void tegra_se_cmdbuf_unpin(struct host1x_bo_mapping *map) - dma_unmap_sgtable(map->dev, map->sgt, map->direction, 0); - sg_free_table(map->sgt); - kfree(map->sgt); -- host1x_bo_put(map->bo); - - kfree(map); - } --- -2.50.1 (Apple Git-155) - diff --git a/1396-crypto-tegra-fix-dma-free-coherent-size-error.patch b/1396-crypto-tegra-fix-dma-free-coherent-size-error.patch deleted file mode 100644 index ee0f2ec87..000000000 --- a/1396-crypto-tegra-fix-dma-free-coherent-size-error.patch +++ /dev/null @@ -1,127 +0,0 @@ -From 5a7dc49ebe22d776913e8fd4fd3c835d1ac57db8 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - Fix dma_free_coherent size error - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into herbert/crypto-2.6.git - -commit 03215b8457784540acc741e6331e355b62c6c8ab -Author: Herbert Xu -Date: Tue May 19 12:22:18 2026 +0800 - - crypto: tegra - Fix dma_free_coherent size error - - When freeing a coherent DMA buffer, the size must match the value - that was used during the allocation. - - Unfortunately the size field in the tegra driver gets overwritten - by this point so it no longer matches and creates a warning. - - Fix this by saving a copy of the size on the stack. - - Note that the ccm function actually mixes up the inbuf and outbuf - sizes, but it doesn't matter because the two sizes are actually - equal. - - Fixes: 1cb328da4e8f ("crypto: tegra - Do not use fixed size buffers") - Reporeted-by: Patrick Talbert - Signed-off-by: Herbert Xu - Reviewed-by: Vladislav Dronov - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 30c78afe3dea..5086e7f140c3 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -1201,6 +1201,7 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - struct crypto_aead *tfm = crypto_aead_reqtfm(req); - struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm); - struct tegra_se *se = ctx->se; -+ unsigned int bufsize; - int ret; - - ret = tegra_ccm_crypt_init(req, se, rctx); -@@ -1210,14 +1211,15 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - rctx->key_id = ctx->key_id; - - /* Allocate buffers required */ -- rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100; -- rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size, -+ bufsize = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100; -+ rctx->inbuf.size = bufsize; -+ rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->inbuf.addr, GFP_KERNEL); - if (!rctx->inbuf.buf) - goto out_finalize; - -- rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100; -- rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size, -+ rctx->outbuf.size = bufsize; -+ rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->outbuf.addr, GFP_KERNEL); - if (!rctx->outbuf.buf) { - ret = -ENOMEM; -@@ -1254,11 +1256,11 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - } - - out: -- dma_free_coherent(ctx->se->dev, rctx->inbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->outbuf.buf, rctx->outbuf.addr); - - out_free_inbuf: -- dma_free_coherent(ctx->se->dev, rctx->outbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->inbuf.buf, rctx->inbuf.addr); - - if (tegra_key_is_reserved(rctx->key_id)) -@@ -1278,6 +1280,7 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - struct crypto_aead *tfm = crypto_aead_reqtfm(req); - struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm); - struct tegra_aead_reqctx *rctx = aead_request_ctx(req); -+ unsigned int bufsize; - int ret; - - rctx->src_sg = req->src; -@@ -1296,16 +1299,17 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - rctx->key_id = ctx->key_id; - - /* Allocate buffers required */ -- rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; -- rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size, -+ bufsize = rctx->assoclen + rctx->authsize + rctx->cryptlen; -+ rctx->inbuf.size = bufsize; -+ rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->inbuf.addr, GFP_KERNEL); - if (!rctx->inbuf.buf) { - ret = -ENOMEM; - goto out_finalize; - } - -- rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; -- rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size, -+ rctx->outbuf.size = bufsize; -+ rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->outbuf.addr, GFP_KERNEL); - if (!rctx->outbuf.buf) { - ret = -ENOMEM; -@@ -1342,11 +1346,11 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - ret = tegra_gcm_do_verify(ctx->se, rctx); - - out: -- dma_free_coherent(ctx->se->dev, rctx->outbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->outbuf.buf, rctx->outbuf.addr); - - out_free_inbuf: -- dma_free_coherent(ctx->se->dev, rctx->inbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->inbuf.buf, rctx->inbuf.addr); - - if (tegra_key_is_reserved(rctx->key_id)) --- -2.50.1 (Apple Git-155) - diff --git a/1397-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch b/1397-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch deleted file mode 100644 index f3ceb1e9c..000000000 --- a/1397-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch +++ /dev/null @@ -1,52 +0,0 @@ -From c6c84318cd97fe4fdbc511248e126bf2d5eaceba Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:23:19 +0200 -Subject: [PATCH] crypto: tegra - Return ENOMEM when input buffer allocation - fails for ccm - -JIRA: https://redhat.atlassian.net/browse/RHEL-176465 -Upstream Status: merged into herbert/crypto-2.6.git - -commit 690a5f9e5c972a580565ce544ed1627ccf1e84de -Author: Herbert Xu -Date: Wed May 20 10:51:14 2026 +0800 - - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm - - Ensure the ENOMEM error value is set when the input buffer allocation - fails in tegra_ccm_do_one_req. - - Fixes: 1e245948ca0c ("crypto: tegra - finalize crypto req on error") - Reported-by: Vladislav Dronov - Signed-off-by: Herbert Xu - Reviewed-by: Vladislav Dronov - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 5086e7f140c3..9094c03e991f 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -1215,16 +1215,15 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - rctx->inbuf.size = bufsize; - rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->inbuf.addr, GFP_KERNEL); -+ ret = -ENOMEM; - if (!rctx->inbuf.buf) - goto out_finalize; - - rctx->outbuf.size = bufsize; - rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->outbuf.addr, GFP_KERNEL); -- if (!rctx->outbuf.buf) { -- ret = -ENOMEM; -+ if (!rctx->outbuf.buf) - goto out_free_inbuf; -- } - - if (!ctx->key_id) { - ret = tegra_key_submit_reserved_aes(ctx->se, ctx->key, --- -2.50.1 (Apple Git-155) - diff --git a/1398-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch b/1398-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch deleted file mode 100644 index 194bb8956..000000000 --- a/1398-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch +++ /dev/null @@ -1,41 +0,0 @@ -From bc2cf5935b4665172235341163315905197ae91d Mon Sep 17 00:00:00 2001 -From: Junrui Luo -Date: Fri, 24 Apr 2026 13:51:02 +0800 -Subject: [PATCH] RDMA/mlx5: Fix error path fall-through in - mlx5_ib_dev_res_srq_init() - -commit c488df06bd552bb8b6e14fa0cfd5ad986c6e9525 upstream. - -mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When -ib_create_srq() fails for s1, the error branch destroys s0 but falls -through and unconditionally assigns the freed s0 and the ERR_PTR s1 to -devr->s0 and devr->s1. - -This leads to several problems: the lock-free fast path checks -"if (devr->s1) return 0;" and treats the ERR_PTR as already initialised; -users in mlx5_ib_create_qp() dereference the freed SRQ or ERR_PTR via -to_msrq(devr->s0)->msrq.srqn; and mlx5_ib_dev_res_cleanup() dereferences -the ERR_PTR and double-frees s0 on teardown. - -Fix by adding the same `goto unlock` in the s1 failure path. - -Cc: stable@vger.kernel.org -Fixes: 5895e70f2e6e ("IB/mlx5: Allocate resources just before first QP/SRQ is created") -Link: https://patch.msgid.link/r/SYBPR01MB7881E1E0970268BD69C0BA75AF2B2@SYBPR01MB7881.ausprd01.prod.outlook.com -Reported-by: Yuhao Jiang -Signed-off-by: Junrui Luo -Signed-off-by: Jason Gunthorpe -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 4077815..082a7e9 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -3121,6 +3121,7 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) - "Couldn't create SRQ 1 for res init, err=%pe\n", - s1); - ib_destroy_srq(s0); -+ goto unlock; - } - - devr->s0 = s0; diff --git a/1399-rxrpc-fix-potential-uaf-after-skb-unshare-failure.patch b/1399-rxrpc-fix-potential-uaf-after-skb-unshare-failure.patch deleted file mode 100644 index 4ffad7e70..000000000 --- a/1399-rxrpc-fix-potential-uaf-after-skb-unshare-failure.patch +++ /dev/null @@ -1,186 +0,0 @@ -From b8d88f6d6f316bb8cea7643117c5f075875b12df Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 27 May 2026 21:45:04 +0000 -Subject: [PATCH] rxrpc: Fix potential UAF after skb_unshare() failure - -JIRA: https://redhat.atlassian.net/browse/RHEL-179565 -CVE: CVE-2026-45998 -Backported from tree(s): linux - -commit 1f2740150f904bfa60e4bad74d65add3ccb5e7f8 -Author: David Howells -Date: Wed Apr 22 17:14:32 2026 +0100 - - rxrpc: Fix potential UAF after skb_unshare() failure - - If skb_unshare() fails to unshare a packet due to allocation failure in - rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread()) - will be NULL'd out. This will likely cause the call to - trace_rxrpc_rx_done() to oops. - - Fix this by moving the unsharing down to where rxrpc_input_call_event() - calls rxrpc_input_call_packet(). There are a number of places prior to - that where we ignore DATA packets for a variety of reasons (such as the - call already being complete) for which an unshare is then avoided. - - And with that, rxrpc_input_packet() doesn't need to take a pointer to the - pointer to the packet, so change that to just a pointer. - - Fixes: 2d1faf7a0ca3 ("rxrpc: Simplify skbuff accounting in receive path") - Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com - Signed-off-by: David Howells - cc: Marc Dionne - cc: Jeffrey Altman - cc: Simon Horman - cc: linux-afs@lists.infradead.org - cc: stable@kernel.org - Link: https://patch.msgid.link/20260422161438.2593376-4-dhowells@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h -index de6f6d2..863956a 100644 ---- a/include/trace/events/rxrpc.h -+++ b/include/trace/events/rxrpc.h -@@ -161,8 +161,6 @@ - E_(rxrpc_call_poke_timer_now, "Timer-now") - - #define rxrpc_skb_traces \ -- EM(rxrpc_skb_eaten_by_unshare, "ETN unshare ") \ -- EM(rxrpc_skb_eaten_by_unshare_nomem, "ETN unshar-nm") \ - EM(rxrpc_skb_get_call_rx, "GET call-rx ") \ - EM(rxrpc_skb_get_conn_secured, "GET conn-secd") \ - EM(rxrpc_skb_get_conn_work, "GET conn-work") \ -@@ -188,6 +186,7 @@ - EM(rxrpc_skb_put_purge, "PUT purge ") \ - EM(rxrpc_skb_put_purge_oob, "PUT purge-oob") \ - EM(rxrpc_skb_put_response, "PUT response ") \ -+ EM(rxrpc_skb_put_response_copy, "PUT resp-cpy ") \ - EM(rxrpc_skb_put_rotate, "PUT rotate ") \ - EM(rxrpc_skb_put_unknown, "PUT unknown ") \ - EM(rxrpc_skb_see_conn_work, "SEE conn-work") \ -@@ -196,6 +195,7 @@ - EM(rxrpc_skb_see_recvmsg_oob, "SEE recvm-oob") \ - EM(rxrpc_skb_see_reject, "SEE reject ") \ - EM(rxrpc_skb_see_rotate, "SEE rotate ") \ -+ EM(rxrpc_skb_see_unshare_nomem, "SEE unshar-nm") \ - E_(rxrpc_skb_see_version, "SEE version ") - - #define rxrpc_local_traces \ -diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index 5b7342d..2baa99b 100644 ---- a/net/rxrpc/ar-internal.h -+++ b/net/rxrpc/ar-internal.h -@@ -1479,7 +1479,6 @@ int rxrpc_server_keyring(struct rxrpc_sock *, sockptr_t, int); - void rxrpc_kernel_data_consumed(struct rxrpc_call *, struct sk_buff *); - void rxrpc_new_skb(struct sk_buff *, enum rxrpc_skb_trace); - void rxrpc_see_skb(struct sk_buff *, enum rxrpc_skb_trace); --void rxrpc_eaten_skb(struct sk_buff *, enum rxrpc_skb_trace); - void rxrpc_get_skb(struct sk_buff *, enum rxrpc_skb_trace); - void rxrpc_free_skb(struct sk_buff *, enum rxrpc_skb_trace); - void rxrpc_purge_queue(struct sk_buff_head *); -diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c -index fec59d9..cc8f9df 100644 ---- a/net/rxrpc/call_event.c -+++ b/net/rxrpc/call_event.c -@@ -332,7 +332,24 @@ bool rxrpc_input_call_event(struct rxrpc_call *call) - - saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK; - -- rxrpc_input_call_packet(call, skb); -+ if (sp->hdr.securityIndex != 0 && -+ skb_cloned(skb)) { -+ /* Unshare the packet so that it can be -+ * modified by in-place decryption. -+ */ -+ struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC); -+ -+ if (nskb) { -+ rxrpc_new_skb(nskb, rxrpc_skb_new_unshared); -+ rxrpc_input_call_packet(call, nskb); -+ rxrpc_free_skb(nskb, rxrpc_skb_put_call_rx); -+ } else { -+ /* OOM - Drop the packet. */ -+ rxrpc_see_skb(skb, rxrpc_skb_see_unshare_nomem); -+ } -+ } else { -+ rxrpc_input_call_packet(call, skb); -+ } - rxrpc_free_skb(skb, rxrpc_skb_put_call_rx); - did_receive = true; - } -diff --git a/net/rxrpc/io_thread.c b/net/rxrpc/io_thread.c -index e939ecf..6ff30af 100644 ---- a/net/rxrpc/io_thread.c -+++ b/net/rxrpc/io_thread.c -@@ -192,13 +192,12 @@ static bool rxrpc_extract_abort(struct sk_buff *skb) - /* - * Process packets received on the local endpoint - */ --static bool rxrpc_input_packet(struct rxrpc_local *local, struct sk_buff **_skb) -+static bool rxrpc_input_packet(struct rxrpc_local *local, struct sk_buff *skb) - { - struct rxrpc_connection *conn; - struct sockaddr_rxrpc peer_srx; - struct rxrpc_skb_priv *sp; - struct rxrpc_peer *peer = NULL; -- struct sk_buff *skb = *_skb; - bool ret = false; - - skb_pull(skb, sizeof(struct udphdr)); -@@ -244,25 +243,6 @@ static bool rxrpc_input_packet(struct rxrpc_local *local, struct sk_buff **_skb) - return rxrpc_bad_message(skb, rxrpc_badmsg_zero_call); - if (sp->hdr.seq == 0) - return rxrpc_bad_message(skb, rxrpc_badmsg_zero_seq); -- -- /* Unshare the packet so that it can be modified for in-place -- * decryption. -- */ -- if (sp->hdr.securityIndex != 0) { -- skb = skb_unshare(skb, GFP_ATOMIC); -- if (!skb) { -- rxrpc_eaten_skb(*_skb, rxrpc_skb_eaten_by_unshare_nomem); -- *_skb = NULL; -- return just_discard; -- } -- -- if (skb != *_skb) { -- rxrpc_eaten_skb(*_skb, rxrpc_skb_eaten_by_unshare); -- *_skb = skb; -- rxrpc_new_skb(skb, rxrpc_skb_new_unshared); -- sp = rxrpc_skb(skb); -- } -- } - break; - - case RXRPC_PACKET_TYPE_CHALLENGE: -@@ -493,7 +473,7 @@ int rxrpc_io_thread(void *data) - switch (skb->mark) { - case RXRPC_SKB_MARK_PACKET: - skb->priority = 0; -- if (!rxrpc_input_packet(local, &skb)) -+ if (!rxrpc_input_packet(local, skb)) - rxrpc_reject_packet(local, skb); - trace_rxrpc_rx_done(skb->mark, skb->priority); - rxrpc_free_skb(skb, rxrpc_skb_put_input); -diff --git a/net/rxrpc/skbuff.c b/net/rxrpc/skbuff.c -index 3bcd6ee..e2169d1 100644 ---- a/net/rxrpc/skbuff.c -+++ b/net/rxrpc/skbuff.c -@@ -46,15 +46,6 @@ void rxrpc_get_skb(struct sk_buff *skb, enum rxrpc_skb_trace why) - skb_get(skb); - } - --/* -- * Note the dropping of a ref on a socket buffer by the core. -- */ --void rxrpc_eaten_skb(struct sk_buff *skb, enum rxrpc_skb_trace why) --{ -- int n = atomic_inc_return(&rxrpc_n_rx_skbs); -- trace_rxrpc_skb(skb, 0, n, why); --} -- - /* - * Note the destruction of a socket buffer. - */ diff --git a/1400-rxrpc-fix-rxrpc-input-call-event-to-only-unshare-data-packet.patch b/1400-rxrpc-fix-rxrpc-input-call-event-to-only-unshare-data-packet.patch deleted file mode 100644 index ce2a0b342..000000000 --- a/1400-rxrpc-fix-rxrpc-input-call-event-to-only-unshare-data-packet.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 3598448f9c9742ef3e28f20e8050dacc046c9941 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 27 May 2026 21:45:06 +0000 -Subject: [PATCH] rxrpc: Fix rxrpc_input_call_event() to only unshare DATA - packets - -JIRA: https://redhat.atlassian.net/browse/RHEL-179565 -CVE: CVE-2026-45998 -Backported from tree(s): linux - -commit 55b2984c96c37f909bbfe8851f13152693951382 -Author: David Howells -Date: Thu Apr 23 21:09:06 2026 +0100 - - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - - Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK, - ABORT, etc.. - - And with that, rxrpc_input_packet() doesn't need to take a pointer to the - pointer to the packet, so change that to just a pointer. - - Fixes: 1f2740150f90 ("rxrpc: Fix potential UAF after skb_unshare() failure") - Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com - Signed-off-by: David Howells - cc: Marc Dionne - cc: Jeffrey Altman - cc: Simon Horman - cc: linux-afs@lists.infradead.org - cc: stable@kernel.org - Link: https://patch.msgid.link/20260423200909.3049438-2-dhowells@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c -index cc8f9df..fdd6832 100644 ---- a/net/rxrpc/call_event.c -+++ b/net/rxrpc/call_event.c -@@ -332,7 +332,8 @@ bool rxrpc_input_call_event(struct rxrpc_call *call) - - saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK; - -- if (sp->hdr.securityIndex != 0 && -+ if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA && -+ sp->hdr.securityIndex != 0 && - skb_cloned(skb)) { - /* Unshare the packet so that it can be - * modified by in-place decryption. diff --git a/1401-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch b/1401-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch deleted file mode 100644 index daf23ae64..000000000 --- a/1401-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 97b8798760568e666030571c7fff4b2d93ce1f7b Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 13:34:21 +0000 -Subject: [PATCH] drm/gem: Fix inconsistent plane dimension calculation in - drm_gem_fb_init_with_funcs() - -JIRA: https://redhat.atlassian.net/browse/RHEL-179911 -CVE: CVE-2026-46209 -Backported from tree(s): linux - -commit 3d4c2268bd7243c3780fe32bf24ff876da272acf -Author: Ashutosh Desai -Date: Mon Apr 20 01:36:37 2026 +0000 - - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - - drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions - using plain integer division: - - unsigned int width = mode_cmd->width / (i ? info->hsub : 1); - unsigned int height = mode_cmd->height / (i ? info->vsub : 1); - - However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses - drm_format_info_plane_width/height() which round up dimensions via - DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object - size check for certain pixel format and dimension combinations. - - For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the - GEM size validation path sees height=0 instead of height=1. The - expression (height - 1) then wraps to UINT_MAX as an unsigned int, - causing min_size to overflow and wrap back to a small value. A tiny - GEM object therefore passes the size guard, yet when the GPU accesses - the chroma plane it will read or write memory beyond the object's - bounds. - - Fix by replacing the open-coded divisions with drm_format_info_plane_width() - and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match - the calculation already used in framebuffer_check(). - - Fixes: 4c3dbb2c312c ("drm: Add GEM backed framebuffer library") - Cc: stable@vger.kernel.org # v4.14+ - Reviewed-by: Thomas Zimmermann - Signed-off-by: Ashutosh Desai - Signed-off-by: Thomas Zimmermann - Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c -index 4bc89d3..daa5471 100644 ---- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c -+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c -@@ -171,8 +171,8 @@ int drm_gem_fb_init_with_funcs(struct drm_device *dev, - } - - for (i = 0; i < info->num_planes; i++) { -- unsigned int width = mode_cmd->width / (i ? info->hsub : 1); -- unsigned int height = mode_cmd->height / (i ? info->vsub : 1); -+ unsigned int width = drm_format_info_plane_width(info, mode_cmd->width, i); -+ unsigned int height = drm_format_info_plane_height(info, mode_cmd->height, i); - unsigned int min_size; - - objs[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]); diff --git a/1402-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch b/1402-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch deleted file mode 100644 index fe79bfebb..000000000 --- a/1402-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch +++ /dev/null @@ -1,58 +0,0 @@ -From f13fa4268ca4f296019b22954e6153e50f87350f Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Wed, 20 May 2026 11:48:57 +0200 -Subject: [PATCH] netfilter: nft_inner: Fix IPv6 inner_thoff desync -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-168848 -Upstream Status: commit b6a91f68ebfe - -commit b6a91f68ebfed9c38e0e9150f58a9b85da07181c -Author: Yizhou Zhao -Date: Tue May 12 01:30:41 2026 +0800 - - netfilter: nft_inner: Fix IPv6 inner_thoff desync - - In nft_inner_parse_l2l3(), when processing inner IPv6 packets, - ipv6_find_hdr() correctly computes the transport header offset - traversing all extension headers, but the result is immediately - overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only - accounts for the IPv6 base header. This creates a desync between - inner_thoff (wrong — points to extension header start) and l4proto - (correct — e.g., IPPROTO_TCP), enabling transport header forgery - and potential firewall bypass. This issue affects stable versions - from Linux 6.2. - - For comparison, the normal (non-inner) IPv6 path correctly - preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite - ensures that ipv6_find_hdr()'s calculated transport header offset is - preserved, thereby fixing the desynchronization. - - Fixes: 3a07327d10a0 ("netfilter: nft_inner: support for inner tunnel header matching") - Cc: stable@vger.kernel.org - Reported-by: Yizhou Zhao - Reported-by: Yuxiang Yang - Reported-by: Xuewei Feng - Reported-by: Qi Li - Reported-by: Ke Xu - Assisted-by: GLM:5.1 Z.ai - Signed-off-by: Yizhou Zhao - Reviewed-by: Fernando Fernandez Mancera - Signed-off-by: Pablo Neira Ayuso - -Signed-off-by: Florian Westphal - -diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c -index c4569d4..1b3e7a9 100644 ---- a/net/netfilter/nft_inner.c -+++ b/net/netfilter/nft_inner.c -@@ -163,7 +163,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv, - return -1; - - if (fragoff == 0) { -- thoff = nhoff + sizeof(_ip6h); - ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH; - ctx->inner_thoff = thoff; - ctx->l4proto = l4proto; diff --git a/1403-asoc-sdca-fix-null-pointer-dereference-in-sdca-dev-unregiste.patch b/1403-asoc-sdca-fix-null-pointer-dereference-in-sdca-dev-unregiste.patch deleted file mode 100644 index 4d85019a5..000000000 --- a/1403-asoc-sdca-fix-null-pointer-dereference-in-sdca-dev-unregiste.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 9a4895059bb6a8505098a9f75de187fd15631fc8 Mon Sep 17 00:00:00 2001 -From: Kean Ren -Date: Thu, 11 Jun 2026 10:37:57 +0800 -Subject: [PATCH] ASoC: SDCA: fix NULL pointer dereference in - sdca_dev_unregister_functions - -[ Upstream commit e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd ] - -sdca_dev_unregister_functions() iterates over all SDCA function -descriptors and calls sdca_dev_unregister() on each func_dev without -checking for NULL. When a function registration has failed partway -through, or the device cleanup races with probe deferral, func_dev -entries may be NULL, leading to a kernel oops: - - BUG: kernel NULL pointer dereference, address: 0000000000000040 - RIP: 0010:device_del+0x1e/0x3e0 - Call Trace: - sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca] - release_nodes+0x35/0xb0 - devres_release_all+0x90/0x100 - device_unbind_cleanup+0xe/0x80 - device_release_driver_internal+0x1c1/0x200 - bus_remove_device+0xc6/0x130 - device_del+0x161/0x3e0 - device_unregister+0x17/0x60 - sdw_delete_slave+0xb6/0xd0 [soundwire_bus] - sdw_bus_master_delete+0x1e/0x50 [soundwire_bus] - ... - sof_probe_work+0x19/0x30 [snd_sof] - -This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) -with the SOF audio driver probe failing due to missing Panther Lake -firmware, causing the subsequent cleanup of SoundWire devices to -trigger the crash. - -Fix this with three changes: - -1) Add a NULL guard in sdca_dev_unregister() so that callers do not - need to pre-validate the pointer (defense in depth). - -2) In sdca_dev_unregister_functions(), skip NULL func_dev entries - and clear func_dev to NULL after unregistration, making the - function idempotent and safe against double-invocation. - -3) In sdca_dev_register_functions(), roll back all previously - registered functions when a later one fails, so the function - array is never left in a partially-populated state. - -Fixes: 4496d1c65bad ("ASoC: SDCA: add function devices") -Signed-off-by: Kean Ren -Reviewed-by: Charles Keepax -Link: https://patch.msgid.link/20260611023757.1553960-1-rh_king@163.com -Signed-off-by: Mark Brown -Signed-off-by: Sasha Levin - -diff --git a/sound/soc/sdca/sdca_function_device.c b/sound/soc/sdca/sdca_function_device.c -index c6cc880..b206158 100644 ---- a/sound/soc/sdca/sdca_function_device.c -+++ b/sound/soc/sdca/sdca_function_device.c -@@ -82,6 +82,9 @@ static struct sdca_dev *sdca_dev_register(struct device *parent, - - static void sdca_dev_unregister(struct sdca_dev *sdev) - { -+ if (!sdev) -+ return; -+ - auxiliary_device_delete(&sdev->auxdev); - auxiliary_device_uninit(&sdev->auxdev); - } -@@ -90,14 +93,24 @@ int sdca_dev_register_functions(struct sdw_slave *slave) - { - struct sdca_device_data *sdca_data = &slave->sdca_data; - int i; -+ int ret; - - for (i = 0; i < sdca_data->num_functions; i++) { - struct sdca_dev *func_dev; - - func_dev = sdca_dev_register(&slave->dev, - &sdca_data->function[i]); -- if (IS_ERR(func_dev)) -- return PTR_ERR(func_dev); -+ if (IS_ERR(func_dev)) { -+ ret = PTR_ERR(func_dev); -+ /* -+ * Unregister functions that were successfully -+ * registered before this failure. This also -+ * sets func_dev to NULL so the caller will not -+ * try to unregister them again. -+ */ -+ sdca_dev_unregister_functions(slave); -+ return ret; -+ } - - sdca_data->function[i].func_dev = func_dev; - } -@@ -111,7 +124,12 @@ void sdca_dev_unregister_functions(struct sdw_slave *slave) - struct sdca_device_data *sdca_data = &slave->sdca_data; - int i; - -- for (i = 0; i < sdca_data->num_functions; i++) -+ for (i = 0; i < sdca_data->num_functions; i++) { -+ if (!sdca_data->function[i].func_dev) -+ continue; -+ - sdca_dev_unregister(sdca_data->function[i].func_dev); -+ sdca_data->function[i].func_dev = NULL; -+ } - } - EXPORT_SYMBOL_NS(sdca_dev_unregister_functions, "SND_SOC_SDCA"); diff --git a/1404-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch b/1404-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch deleted file mode 100644 index d68ffb3a9..000000000 --- a/1404-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 48c0f60921a07b8020b0c90fc8082673e0e9cb59 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:06:53 +0200 -Subject: [PATCH] crypto: testmgr - allow - authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-182119 -Upstream Status: Posted https://lore.kernel.org/linux-crypto/20260603155008.736872-1-idryomov@gmail.com/ - -hmac(sha256), hmac(sha384) and cts(cbc(aes)) algorithms have been -marked as FIPS allowed for years. Mark the respective authenc() -constructions per RFC 8009 ("AES Encryption with HMAC-SHA2 for -Kerberos 5") as such as well. - -SP 800-57 Part 3 Rev. 1 from Jan 2015 [1] links the draft of what -became RFC 8009 in Oct 2016 as approved in section 6.3 Procurement -Guidance (item/recommendation 3). - -[1] https://csrc.nist.gov/pubs/sp/800/57/pt3/r1/final - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/testmgr.c b/crypto/testmgr.c -index 8330187..de1c9bc 100644 ---- a/crypto/testmgr.c -+++ b/crypto/testmgr.c -@@ -4451,6 +4451,7 @@ static const struct alg_test_desc alg_test_descs[] = { - }, { - .alg = "authenc(hmac(sha256),cts(cbc(aes)))", - .test = alg_test_aead, -+ .fips_allowed = 1, - .suite = { - .aead = __VECS(krb5_test_aes128_cts_hmac_sha256_128) - } -@@ -4477,6 +4478,7 @@ static const struct alg_test_desc alg_test_descs[] = { - }, { - .alg = "authenc(hmac(sha384),cts(cbc(aes)))", - .test = alg_test_aead, -+ .fips_allowed = 1, - .suite = { - .aead = __VECS(krb5_test_aes256_cts_hmac_sha384_192) - } diff --git a/1405-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch b/1405-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch deleted file mode 100644 index b8ca12aba..000000000 --- a/1405-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch +++ /dev/null @@ -1,57 +0,0 @@ -From d681e9e0ec7d613a8af38985083b59595930c5fb Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:24:21 +0200 -Subject: [PATCH] crypto: krb5enc - fix sleepable flag handling in encrypt - dispatch - -JIRA: https://redhat.atlassian.net/browse/RHEL-182119 - -commit 2ef3bac16fb5e9eee4fb1d722578a79b751ea58a -Author: Wesley Atwell -Date: Mon Mar 9 00:26:24 2026 -0600 - - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch - - krb5enc_encrypt_ahash_done() continues encryption from an ahash - completion callback by calling krb5enc_dispatch_encrypt(). - - That helper takes a flags argument for this continuation path, but it - ignored that argument and reused aead_request_flags(req) when setting - up the skcipher subrequest callback. This can incorrectly preserve - CRYPTO_TFM_REQ_MAY_SLEEP when the encrypt step is started from callback - context. - - Preserve the original request flags but clear - CRYPTO_TFM_REQ_MAY_SLEEP for the callback continuation path, and use - the caller-supplied flags when setting up the skcipher subrequest. - - Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm") - Assisted-by: Codex:GPT-5 - Signed-off-by: Wesley Atwell - Signed-off-by: Herbert Xu - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/krb5enc.c b/crypto/krb5enc.c -index d07769b..5bd5f42 100644 ---- a/crypto/krb5enc.c -+++ b/crypto/krb5enc.c -@@ -154,7 +154,7 @@ static int krb5enc_dispatch_encrypt(struct aead_request *req, - dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); - - skcipher_request_set_tfm(skreq, enc); -- skcipher_request_set_callback(skreq, aead_request_flags(req), -+ skcipher_request_set_callback(skreq, flags, - krb5enc_encrypt_done, req); - skcipher_request_set_crypt(skreq, src, dst, req->cryptlen, req->iv); - -@@ -192,7 +192,8 @@ static void krb5enc_encrypt_ahash_done(void *data, int err) - - krb5enc_insert_checksum(req, ahreq->result); - -- err = krb5enc_dispatch_encrypt(req, 0); -+ err = krb5enc_dispatch_encrypt(req, -+ aead_request_flags(req) & ~CRYPTO_TFM_REQ_MAY_SLEEP); - if (err != -EINPROGRESS) - aead_request_complete(req, err); - } diff --git a/1406-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch b/1406-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch deleted file mode 100644 index ff6f4cf17..000000000 --- a/1406-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch +++ /dev/null @@ -1,164 +0,0 @@ -From 55ecb8636f05d99e611b025ec58ad54350df0640 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:24:35 +0200 -Subject: [PATCH] crypto: krb5enc - fix async decrypt skipping hash - verification - -JIRA: https://redhat.atlassian.net/browse/RHEL-182119 - -commit 3bfbf5f0a99c991769ec562721285df7ab69240b -Author: Dudu Lu -Date: Mon Apr 20 12:40:27 2026 +0800 - - crypto: krb5enc - fix async decrypt skipping hash verification - - krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher - callback, which is the caller's own completion handler. When the - skcipher completes asynchronously, this signals "done" to the caller - without executing krb5enc_dispatch_decrypt_hash(), completely bypassing - the integrity verification (hash check). - - Compare with the encrypt path which correctly uses - krb5enc_encrypt_done as an intermediate callback to chain into the - hash computation on async completion. - - Fix by adding krb5enc_decrypt_done as an intermediate callback that - chains into krb5enc_dispatch_decrypt_hash() upon async skcipher - completion, matching the encrypt path's callback pattern. - - Also fix EBUSY/EINPROGRESS handling throughout: remove - krb5enc_request_complete() which incorrectly swallowed EINPROGRESS - notifications that must be passed up to callers waiting on backlogged - requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done - for the dispatch_encrypt return value. - - Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm") - Signed-off-by: Dudu Lu - - Unset MAY_BACKLOG on the async completion path so the user won't - see back-to-back EINPROGRESS notifications. - - Signed-off-by: Herbert Xu - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/krb5enc.c b/crypto/krb5enc.c -index 5bd5f42..3fecc14 100644 ---- a/crypto/krb5enc.c -+++ b/crypto/krb5enc.c -@@ -39,12 +39,6 @@ struct krb5enc_request_ctx { - char tail[]; - }; - --static void krb5enc_request_complete(struct aead_request *req, int err) --{ -- if (err != -EINPROGRESS) -- aead_request_complete(req, err); --} -- - /** - * crypto_krb5enc_extractkeys - Extract Ke and Ki keys from the key blob. - * @keys: Where to put the key sizes and pointers -@@ -127,7 +121,7 @@ static void krb5enc_encrypt_done(void *data, int err) - { - struct aead_request *req = data; - -- krb5enc_request_complete(req, err); -+ aead_request_complete(req, err); - } - - /* -@@ -188,14 +182,16 @@ static void krb5enc_encrypt_ahash_done(void *data, int err) - struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff); - - if (err) -- return krb5enc_request_complete(req, err); -+ goto out; - - krb5enc_insert_checksum(req, ahreq->result); - -- err = krb5enc_dispatch_encrypt(req, -- aead_request_flags(req) & ~CRYPTO_TFM_REQ_MAY_SLEEP); -- if (err != -EINPROGRESS) -- aead_request_complete(req, err); -+ err = krb5enc_dispatch_encrypt(req, 0); -+ if (err == -EINPROGRESS) -+ return; -+ -+out: -+ aead_request_complete(req, err); - } - - /* -@@ -265,17 +261,16 @@ static void krb5enc_decrypt_hash_done(void *data, int err) - { - struct aead_request *req = data; - -- if (err) -- return krb5enc_request_complete(req, err); -- -- err = krb5enc_verify_hash(req); -- krb5enc_request_complete(req, err); -+ if (!err) -+ err = krb5enc_verify_hash(req); -+ aead_request_complete(req, err); - } - - /* - * Dispatch the hashing of the plaintext after we've done the decryption. - */ --static int krb5enc_dispatch_decrypt_hash(struct aead_request *req) -+static int krb5enc_dispatch_decrypt_hash(struct aead_request *req, -+ unsigned int flags) - { - struct crypto_aead *krb5enc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(krb5enc); -@@ -291,7 +286,7 @@ static int krb5enc_dispatch_decrypt_hash(struct aead_request *req) - ahash_request_set_tfm(ahreq, auth); - ahash_request_set_crypt(ahreq, req->dst, hash, - req->assoclen + req->cryptlen - authsize); -- ahash_request_set_callback(ahreq, aead_request_flags(req), -+ ahash_request_set_callback(ahreq, flags, - krb5enc_decrypt_hash_done, req); - - err = crypto_ahash_digest(ahreq); -@@ -301,6 +296,21 @@ static int krb5enc_dispatch_decrypt_hash(struct aead_request *req) - return krb5enc_verify_hash(req); - } - -+static void krb5enc_decrypt_done(void *data, int err) -+{ -+ struct aead_request *req = data; -+ -+ if (err) -+ goto out; -+ -+ err = krb5enc_dispatch_decrypt_hash(req, 0); -+ if (err == -EINPROGRESS) -+ return; -+ -+out: -+ aead_request_complete(req, err); -+} -+ - /* - * Dispatch the decryption of the ciphertext. - */ -@@ -324,7 +334,7 @@ static int krb5enc_dispatch_decrypt(struct aead_request *req) - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, aead_request_flags(req), -- req->base.complete, req->base.data); -+ krb5enc_decrypt_done, req); - skcipher_request_set_crypt(skreq, src, dst, - req->cryptlen - authsize, req->iv); - -@@ -339,7 +349,7 @@ static int krb5enc_decrypt(struct aead_request *req) - if (err < 0) - return err; - -- return krb5enc_dispatch_decrypt_hash(req); -+ return krb5enc_dispatch_decrypt_hash(req, aead_request_flags(req)); - } - - static int krb5enc_init_tfm(struct crypto_aead *tfm) diff --git a/1407-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch b/1407-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch deleted file mode 100644 index f941935ce..000000000 --- a/1407-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 91e2b13c3f9a470daee57990a7022cee6d8389d8 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:24:44 +0200 -Subject: [PATCH] crypto: krb5 - filter out async aead implementations at alloc - -JIRA: https://redhat.atlassian.net/browse/RHEL-182119 -Upstream Status: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git - -commit 6c9dddeb582fde005360f4fe02c760d45ca05fb5 -Author: Michael Bommarito -Date: Sun May 10 19:24:55 2026 -0400 - - crypto: krb5 - filter out async aead implementations at alloc - - krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and - rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL - completion callback and treat any negative return from - crypto_aead_{encrypt,decrypt}() as terminal, falling through to - kfree_sensitive(buffer). When the encrypt_name resolves to an - async AEAD instance the request returns -EINPROGRESS, the buffer - is freed while the backend's worker still holds a pointer, and the - worker dereferences the freed slab on completion. - - KASAN report under UML+SLUB with a synthetic async aead backend - bound to krb5->encrypt_name: - - BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 - - The helpers were written synchronously, so filter the async - instances out at allocation time instead of plumbing - crypto_wait_req() through every call site. - - Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and - net/ceph/crypto.c on systems with an async AEAD provider bound to - the krb5 enctype name. - - Fixes: 00244da40f78 ("crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions") - Fixes: 6c3c0e86c2ac ("crypto/krb5: Implement the AES enctypes from rfc8009") - Cc: stable@vger.kernel.org - Suggested-by: Herbert Xu - Assisted-by: Claude:claude-opus-4-7 - Signed-off-by: Michael Bommarito - Signed-off-by: Herbert Xu - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/krb5/krb5_api.c b/crypto/krb5/krb5_api.c -index 23026d4..2b20284 100644 ---- a/crypto/krb5/krb5_api.c -+++ b/crypto/krb5/krb5_api.c -@@ -165,7 +165,7 @@ struct crypto_aead *krb5_prepare_encryption(const struct krb5_enctype *krb5, - struct crypto_aead *ci = NULL; - int ret = -ENOMEM; - -- ci = crypto_alloc_aead(krb5->encrypt_name, 0, 0); -+ ci = crypto_alloc_aead(krb5->encrypt_name, 0, CRYPTO_ALG_ASYNC); - if (IS_ERR(ci)) { - ret = PTR_ERR(ci); - if (ret == -ENOENT) diff --git a/1408-arm64-cputype-add-c1-pro-definitions.patch b/1408-arm64-cputype-add-c1-pro-definitions.patch deleted file mode 100644 index 2be15e68d..000000000 --- a/1408-arm64-cputype-add-c1-pro-definitions.patch +++ /dev/null @@ -1,42 +0,0 @@ -From ee5ce483d42809b6c9e5bb25c33601e54229128f Mon Sep 17 00:00:00 2001 -From: Catalin Marinas -Date: Tue, 21 Apr 2026 11:00:16 +0100 -Subject: [PATCH] arm64: cputype: Add C1-Pro definitions - -commit 2c99561016c591f4c3d5ad7d22a61b8726e79735 upstream. - -Add cputype definitions for C1-Pro. These will be used for errata -detection in subsequent patches. - -These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in -issue 07 of the C1-Pro TRM: - - https://documentation-service.arm.com/static/6930126730f8f55a656570af - -Acked-by: Mark Rutland -Cc: Will Deacon -Cc: James Morse -Reviewed-by: Will Deacon -Signed-off-by: Catalin Marinas -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index a580531..c2add67 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -98,6 +98,7 @@ - #define ARM_CPU_PART_CORTEX_A725 0xD87 - #define ARM_CPU_PART_CORTEX_A720AE 0xD89 - #define ARM_CPU_PART_NEOVERSE_N3 0xD8E -+#define ARM_CPU_PART_C1_PRO 0xD8B - - #define APM_CPU_PART_XGENE 0x000 - #define APM_CPU_VAR_POTENZA 0x00 -@@ -188,6 +189,7 @@ - #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) - #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) - #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) -+#define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) - #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) - #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) - #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) diff --git a/1409-arm64-cputype-add-c1-premium-definitions.patch b/1409-arm64-cputype-add-c1-premium-definitions.patch deleted file mode 100644 index 33f2e5f00..000000000 --- a/1409-arm64-cputype-add-c1-premium-definitions.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 2125f57780e4d81424f47d9ec432ac733e9a2fb2 Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Tue, 16 Jun 2026 06:15:49 +0100 -Subject: [PATCH] arm64: cputype: Add C1-Premium definitions - -commit d28413bfc5a255957241f1df5d7fd0c2cd74fe18 upstream. - -Add cputype definitions for C1-Premium. These will be used for errata -detection in subsequent patches. - -These values can be found in the C1-Premium TRM: - - https://developer.arm.com/documentation/109416/0100/ - -... in section A.5.1 ("MIDR_EL1, Main ID Register"). - -Signed-off-by: Mark Rutland -Cc: Catalin Marinas -Cc: Will Deacon -Signed-off-by: Will Deacon -[Mark: backport to v6.12.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index c2add67..4efa7c9 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -99,6 +99,7 @@ - #define ARM_CPU_PART_CORTEX_A720AE 0xD89 - #define ARM_CPU_PART_NEOVERSE_N3 0xD8E - #define ARM_CPU_PART_C1_PRO 0xD8B -+#define ARM_CPU_PART_C1_PREMIUM 0xD90 - - #define APM_CPU_PART_XGENE 0x000 - #define APM_CPU_VAR_POTENZA 0x00 -@@ -189,6 +190,7 @@ - #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) - #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) - #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) -+#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) - #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) - #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) - #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) diff --git a/1410-arm64-cputype-add-c1-ultra-definitions.patch b/1410-arm64-cputype-add-c1-ultra-definitions.patch deleted file mode 100644 index 0965ea487..000000000 --- a/1410-arm64-cputype-add-c1-ultra-definitions.patch +++ /dev/null @@ -1,48 +0,0 @@ -From cce1ef3711fd5a41144c4d7d6125f0b244982ca8 Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Tue, 16 Jun 2026 06:15:48 +0100 -Subject: [PATCH] arm64: cputype: Add C1-Ultra definitions - -commit 60349e64a6c65f9f0aa118af711b3c7e137f07ff upstream. - -Add cputype definitions for C1-Ultra. These will be used for errata -detection in subsequent patches. - -These values can be found in the C1-Ultra TRM: - - https://developer.arm.com/documentation/108014/0100/ - -... in section A.5.1 ("MIDR_EL1, Main ID Register"). - -Signed-off-by: Mark Rutland -Cc: Catalin Marinas -Cc: Will Deacon -Signed-off-by: Will Deacon -[Mark: backport to v6.12.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index 4efa7c9..55565b7 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -97,6 +97,7 @@ - #define ARM_CPU_PART_CORTEX_X925 0xD85 - #define ARM_CPU_PART_CORTEX_A725 0xD87 - #define ARM_CPU_PART_CORTEX_A720AE 0xD89 -+#define ARM_CPU_PART_C1_ULTRA 0xD8C - #define ARM_CPU_PART_NEOVERSE_N3 0xD8E - #define ARM_CPU_PART_C1_PRO 0xD8B - #define ARM_CPU_PART_C1_PREMIUM 0xD90 -@@ -189,9 +190,10 @@ - #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) - #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) - #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) -+#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) - #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) --#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) - #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) -+#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) - #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) - #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) - #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) diff --git a/1411-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch b/1411-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch deleted file mode 100644 index c16a4e443..000000000 --- a/1411-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch +++ /dev/null @@ -1,268 +0,0 @@ -From 4e7c80742e6dada9f8b9ad63f3a49c03af07ecb8 Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Tue, 16 Jun 2026 06:15:50 +0100 -Subject: [PATCH] arm64: errata: Mitigate TLBI errata on various Arm CPUs - -commit cfd391e74134db664feb499d43af286380b10ba8 upstream. - -A number of CPUs developed by Arm suffer from errata whereby a broadcast -TLBI;DSB sequence may complete before the global observation of writes -which are translated by an affected TLB entry. - -These errata ONLY affect the completion of memory accesses which have -been translated by an invalidated TLB entry, and these errata DO NOT -affect the actual invalidation of TLB entries. TLB entries are removed -correctly. - -This issue has been assigned CVE ID CVE-2025-10263. - -To mitigate this issue, Arm recommends that software follows any -affected TLBI;DSB sequence with an additional TLBI;DSB, which will -ensure that all memory write effects affected by the first TLBI have -been globally observed. The additional TLBI can use any operation that -is broadcast to affected CPUs, and the additional DSB can use any option -that is sufficient to complete the additional TLBI. - -The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate -the issue. Enable this workaround for affected CPUs, and update the -silicon errata documentation accordingly. - -Note that due to the manner in which Arm develops IP and tracks errata, -some CPUs share a common erratum number. - -Signed-off-by: Mark Rutland -Cc: Catalin Marinas -Cc: Will Deacon -Signed-off-by: Will Deacon -[Mark: backport to v6.12.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst -index a7ec570..e06d991 100644 ---- a/Documentation/arch/arm64/silicon-errata.rst -+++ b/Documentation/arch/arm64/silicon-errata.rst -@@ -128,16 +128,28 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A76 | #3324349 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A77 | #1491015 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A78C | #3324346,3324347| ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 | -@@ -146,6 +158,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | -@@ -158,20 +172,32 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X1 | #3324344 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X1C | #3324346 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X2 | #2119858 | ARM64_ERRATUM_2119858 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X2 | #2224489 | ARM64_ERRATUM_2224489 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X2 | #3324338 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X3 | #3324335 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X4 | #3194386 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N1 | #1349291 | N/A | -@@ -182,6 +208,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N1 | #3324349 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N2 | #2139208 | ARM64_ERRATUM_2139208 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N2 | #2067961 | ARM64_ERRATUM_2067961 | -@@ -190,18 +218,34 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V1 | #1619801 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | C1-Pro | #4193714 | ARM64_ERRATUM_4193714 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | MMU-500 | #841119,826419 | ARM_SMMU_MMU_500_CPRE_ERRATA| - | | | #562869,1047329 | | - +----------------+-----------------+-----------------+-----------------------------+ -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 7d2f7f2..6cdcc7a 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1155,6 +1155,54 @@ config ARM64_ERRATUM_3194386 - - If unsure, say Y. - -+config ARM64_ERRATUM_4193714 -+ bool "C1-Pro: 4193714: SME DVMSync early acknowledgement" -+ depends on ARM64_SME -+ default y -+ help -+ Enable workaround for C1-Pro acknowledging the DVMSync before -+ the SME memory accesses are complete. This will cause TLB -+ maintenance for processes using SME to also issue an IPI to -+ the affected CPUs. -+ -+ If unsure, say Y. -+ -+config ARM64_ERRATUM_4118414 -+ bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" -+ default y -+ select ARM64_WORKAROUND_REPEAT_TLBI -+ help -+ This option adds a workaround for the following errata: -+ -+ * ARM C1-Premium erratum 4193780 -+ * ARM C1-Ultra erratum 4193780 -+ * ARM Cortex-A76 erratum 4193800 -+ * ARM Cortex-A76AE erratum 4193801 -+ * ARM Cortex-A77 erratum 4193798 -+ * ARM Cortex-A78 erratum 4193791 -+ * ARM Cortex-A78AE erratum 4193793 -+ * ARM Cortex-A78C erratum 4193794 -+ * ARM Cortex-A710 erratum 4193788 -+ * ARM Cortex-X1 erratum 4193791 -+ * ARM Cortex-X1C erratum 4193792 -+ * ARM Cortex-X2 erratum 4193788 -+ * ARM Cortex-X3 erratum 4193786 -+ * ARM Cortex-X4 erratum 4118414 -+ * ARM Cortex-X925 erratum 4193781 -+ * ARM Neoverse-N1 erratum 4193800 -+ * ARM Neoverse-N2 erratum 4193789 -+ * ARM Neoverse-V1 erratum 4193790 -+ * ARM Neoverse-V2 erratum 4193787 -+ * ARM Neoverse-V3 erratum 4193784 -+ * ARM Neoverse-V3AE erratum 4193784 -+ -+ On affected cores, some memory accesses might not be completed by -+ broadcast TLB invalidation. -+ -+ This issue is also known as CVE-2025-10263. -+ -+ If unsure, say Y. -+ - config CAVIUM_ERRATUM_22375 - bool "Cavium erratum 22375, 24313" - default y -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 46cd811..80a920d 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -278,7 +278,35 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { - ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1), - }, - #endif -- {}, -+#ifdef CONFIG_ARM64_ERRATUM_4118414 -+ { -+ ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) { -+ MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM), -+ MIDR_ALL_VERSIONS(MIDR_C1_ULTRA), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X4), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X925), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), -+ {} -+ })), -+ }, -+#endif -+ {} - }; - #endif - -@@ -614,7 +642,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = { - #endif - #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI - { -- .desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009", -+ .desc = "Broken broadcast TLBI completion", - .capability = ARM64_WORKAROUND_REPEAT_TLBI, - .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, - .matches = cpucap_multi_entry_cap_matches, diff --git a/1412-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch b/1412-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch deleted file mode 100644 index 736a3d6a1..000000000 --- a/1412-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch +++ /dev/null @@ -1,73 +0,0 @@ -From fd0781fcbf4d867807bb3f9432f5582e5619f7df Mon Sep 17 00:00:00 2001 -From: Shanker Donthineni -Date: Tue, 16 Jun 2026 06:15:51 +0100 -Subject: [PATCH] arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - -commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 upstream. - -NVIDIA Olympus cores are affected by the TLBI completion issue tracked as -CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses -ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB -sequence and ensure affected memory write effects are globally observed. - -Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same -mitigation is enabled on affected Olympus systems. Also document the -NVIDIA Olympus erratum in the arm64 silicon errata table and list it in -the Kconfig help text. - -Signed-off-by: Shanker Donthineni -Cc: Catalin Marinas -Cc: Will Deacon -Cc: Mark Rutland -Acked-by: Mark Rutland -Signed-off-by: Will Deacon -[Mark: backport to v6.12.y] -Signed-off-by: Shanker Donthineni -Signed-off-by: Greg Kroah-Hartman - -diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst -index e06d991..bf898b7 100644 ---- a/Documentation/arch/arm64/silicon-errata.rst -+++ b/Documentation/arch/arm64/silicon-errata.rst -@@ -288,6 +288,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM | - +----------------+-----------------+-----------------+-----------------------------+ -+| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | NVIDIA | T241 GICv3/4.x | T241-FABRIC-4 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - +----------------+-----------------+-----------------+-----------------------------+ -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 6cdcc7a..6f7bbe2 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1168,7 +1168,7 @@ config ARM64_ERRATUM_4193714 - If unsure, say Y. - - config ARM64_ERRATUM_4118414 -- bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" -+ bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" - default y - select ARM64_WORKAROUND_REPEAT_TLBI - help -@@ -1195,6 +1195,7 @@ config ARM64_ERRATUM_4118414 - * ARM Neoverse-V2 erratum 4193787 - * ARM Neoverse-V3 erratum 4193784 - * ARM Neoverse-V3AE erratum 4193784 -+ * NVIDIA Olympus erratum T410-OLY-1029 - - On affected cores, some memory accesses might not be completed by - broadcast TLB invalidation. -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 80a920d..06d9a92 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -302,6 +302,7 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), -+ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), - {} - })), - }, diff --git a/1413-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch b/1413-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch deleted file mode 100644 index ed49d786f..000000000 --- a/1413-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 2321cb9e80eaeedbc22ede60ee03404fe521cd56 Mon Sep 17 00:00:00 2001 -From: Will Deacon -Date: Tue, 16 Jun 2026 06:15:52 +0100 -Subject: [PATCH] arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt - 100 CPU - -commit 1940e70a8144bf75e6df26bf6f600862ea7f7ea1 upstream. - -Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM -Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a -Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and -therefore suffers from all the same errata.". - -So enable the workaround for the latest broadcast TLB invalidation bug -on these parts. - -Signed-off-by: Will Deacon -[Mark: backport to v6.12.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst -index bf898b7..e9558e8 100644 ---- a/Documentation/arch/arm64/silicon-errata.rst -+++ b/Documentation/arch/arm64/silicon-errata.rst -@@ -131,7 +131,7 @@ stable kernels. - | ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 | --+----------------+-----------------+-----------------+-----------------------------+ -+++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A77 | #1491015 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | -@@ -195,7 +195,7 @@ stable kernels. - | ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 | --+----------------+-----------------+-----------------+-----------------------------+ -+----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 | -@@ -237,13 +237,11 @@ stable kernels. - | ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | --+----------------+-----------------+-----------------+-----------------------------+ -+----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | C1-Pro | #4193714 | ARM64_ERRATUM_4193714 | --+----------------+-----------------+-----------------+-----------------------------+ - | ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | MMU-500 | #841119,826419 | ARM_SMMU_MMU_500_CPRE_ERRATA| -@@ -351,3 +349,5 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | Microsoft | Azure Cobalt 100| #3324339 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 6f7bbe2..49506a7 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1155,18 +1155,6 @@ config ARM64_ERRATUM_3194386 - - If unsure, say Y. - --config ARM64_ERRATUM_4193714 -- bool "C1-Pro: 4193714: SME DVMSync early acknowledgement" -- depends on ARM64_SME -- default y -- help -- Enable workaround for C1-Pro acknowledging the DVMSync before -- the SME memory accesses are complete. This will cause TLB -- maintenance for processes using SME to also issue an IPI to -- the affected CPUs. -- -- If unsure, say Y. -- - config ARM64_ERRATUM_4118414 - bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" - default y -@@ -1195,6 +1183,7 @@ config ARM64_ERRATUM_4118414 - * ARM Neoverse-V2 erratum 4193787 - * ARM Neoverse-V3 erratum 4193784 - * ARM Neoverse-V3AE erratum 4193784 -+ * Microsoft Azure Cobalt 100 4193789 - * NVIDIA Olympus erratum T410-OLY-1029 - - On affected cores, some memory accesses might not be completed by -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 06d9a92..72caeca 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -303,6 +303,7 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), - MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), -+ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), - {} - })), - }, diff --git a/1414-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepa.patch b/1414-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepa.patch deleted file mode 100644 index d42c7e7b9..000000000 --- a/1414-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepa.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439 Mon Sep 17 00:00:00 2001 -From: Fredric Cover -Date: Mon, 30 Mar 2026 13:11:27 -0700 -Subject: [PATCH] fs/smb/client: fix out-of-bounds read in - cifs_sanitize_prepath - -[ Upstream commit 78ec5bf2f589ec7fd8f169394bfeca541b077317 ] - -When cifs_sanitize_prepath is called with an empty string or a string -containing only delimiters (e.g., "/"), the current logic attempts to -check *(cursor2 - 1) before cursor2 has advanced. This results in an -out-of-bounds read. - -This patch adds an early exit check after stripping prepended -delimiters. If no path content remains, the function returns NULL. - -The bug was identified via manual audit and verified using a -standalone test case compiled with AddressSanitizer, which -triggered a SEGV on affected inputs. - -Signed-off-by: Fredric Cover -Reviewed-by: Henrique Carvalho <[2]henrique.carvalho@suse.com> -Signed-off-by: Steve French -Signed-off-by: Sasha Levin - -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index c1a0363..287c847 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -589,6 +589,10 @@ char *cifs_sanitize_prepath(char *prepath, gfp_t gfp) - while (IS_DELIM(*cursor1)) - cursor1++; - -+ /* exit in case of only delimiters */ -+ if (!*cursor1) -+ return NULL; -+ - /* copy the first letter */ - *cursor2 = *cursor1; - diff --git a/1421-net-page-pool-avoid-false-positive-warning-if-napi-was-never.patch b/1421-net-page-pool-avoid-false-positive-warning-if-napi-was-never.patch deleted file mode 100644 index 8167c50b9..000000000 --- a/1421-net-page-pool-avoid-false-positive-warning-if-napi-was-never.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 942ef6b142b4e78e63c115e806f67ab31b8106d6 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 30 Mar 2026 08:07:00 +0000 -Subject: [PATCH] net: page_pool: avoid false positive warning if NAPI was - never added - -JIRA: https://redhat.atlassian.net/browse/RHEL-162141 - -commit c1e00bc4be06cacee6307cedb9b55bbaddb5044d -Author: Jakub Kicinski -Date: Thu Feb 6 14:56:37 2025 -0800 - - net: page_pool: avoid false positive warning if NAPI was never added - - We expect NAPI to be in disabled state when page pool is torn down. - But it is also legal if the NAPI is completely uninitialized. - - Reviewed-by: Mina Almasry - Link: https://patch.msgid.link/20250206225638.1387810-4-kuba@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/net/core/dev.h b/net/core/dev.h -index ddf018a0d..f4fc420f7 100644 ---- a/net/core/dev.h -+++ b/net/core/dev.h -@@ -347,6 +347,18 @@ void xdp_do_check_flushed(struct napi_struct *napi); - static inline void xdp_do_check_flushed(struct napi_struct *napi) { } - #endif - -+/* Best effort check that NAPI is not idle (can't be scheduled to run) */ -+static inline void napi_assert_will_not_race(const struct napi_struct *napi) -+{ -+ /* uninitialized instance, can't race */ -+ if (!napi->poll_list.next) -+ return; -+ -+ /* SCHED bit is set on disabled instances */ -+ WARN_ON(!test_bit(NAPI_STATE_SCHED, &napi->state)); -+ WARN_ON(READ_ONCE(napi->list_owner) != -1); -+} -+ - void kick_defer_list_purge(struct softnet_data *sd, unsigned int cpu); - - #define XMIT_RECURSION_LIMIT 8 -diff --git a/net/core/page_pool.c b/net/core/page_pool.c -index 06531b7b7..15b08364d 100644 ---- a/net/core/page_pool.c -+++ b/net/core/page_pool.c -@@ -26,6 +26,7 @@ - - #include - -+#include RH_KABI_HIDE_INCLUDE("dev.h") - #include "mp_dmabuf_devmem.h" - #include "netmem_priv.h" - #include "page_pool_priv.h" -@@ -1196,11 +1197,7 @@ void page_pool_disable_direct_recycling(struct page_pool *pool) - if (!pool->p.napi) - return; - -- /* To avoid races with recycling and additional barriers make sure -- * pool and NAPI are unlinked when NAPI is disabled. -- */ -- WARN_ON(!test_bit(NAPI_STATE_SCHED, &pool->p.napi->state)); -- WARN_ON(READ_ONCE(pool->p.napi->list_owner) != -1); -+ napi_assert_will_not_race(pool->p.napi); - - mutex_lock(&page_pools_lock); - WRITE_ONCE(pool->p.napi, NULL); diff --git a/1422-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch b/1422-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch deleted file mode 100644 index 47e9a3bd6..000000000 --- a/1422-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch +++ /dev/null @@ -1,82 +0,0 @@ -From f975a0955276579e2176a134366ed586071c7c6a Mon Sep 17 00:00:00 2001 -From: Dipayaan Roy -Date: Tue, 24 Feb 2026 04:38:36 -0800 -Subject: [PATCH] net: mana: Fix double destroy_workqueue on service rescan PCI - path - -While testing corner cases in the driver, a use-after-free crash -was found on the service rescan PCI path. - -When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() -destroys gc->service_wq. If the subsequent mana_gd_resume() fails -with -ETIMEDOUT or -EPROTO, the code falls through to -mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). -This invokes the PCI .remove callback (mana_gd_remove), which calls -mana_gd_cleanup() a second time, attempting to destroy the already- -freed workqueue. Fix this by NULL-checking gc->service_wq in -mana_gd_cleanup() and setting it to NULL after destruction. - -Call stack of issue for reference: -[Sat Feb 21 18:53:48 2026] Call Trace: -[Sat Feb 21 18:53:48 2026] -[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] -[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] -[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 -[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 -[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 -[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 -[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 -[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 -[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] -[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] -[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 -[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 -[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 -[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 -[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 -[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 -[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 -[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 -[Sat Feb 21 18:53:48 2026] - -Fixes: 505cc26bcae0 ("net: mana: Add support for auxiliary device servicing events") -Reviewed-by: Haiyang Zhang -Signed-off-by: Dipayaan Roy -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/aZ2bzL64NagfyHpg@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c -index 0055c231acf6..3926d18f1840 100644 ---- a/drivers/net/ethernet/microsoft/mana/gdma_main.c -+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c -@@ -1946,7 +1946,10 @@ static void mana_gd_cleanup(struct pci_dev *pdev) - - mana_gd_remove_irqs(pdev); - -- destroy_workqueue(gc->service_wq); -+ if (gc->service_wq) { -+ destroy_workqueue(gc->service_wq); -+ gc->service_wq = NULL; -+ } - dev_dbg(&pdev->dev, "mana gdma cleanup successful\n"); - } - -diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c -index 9b5a72ada5c4..f69e42651359 100644 ---- a/drivers/net/ethernet/microsoft/mana/mana_en.c -+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c -@@ -3762,7 +3762,9 @@ void mana_rdma_remove(struct gdma_dev *gd) - } - - WRITE_ONCE(gd->rdma_teardown, true); -- flush_workqueue(gc->service_wq); -+ -+ if (gc->service_wq) -+ flush_workqueue(gc->service_wq); - - if (gd->adev) - remove_adev(gd); --- -2.50.1 (Apple Git-155) - diff --git a/1423-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch b/1423-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch deleted file mode 100644 index 59712dd91..000000000 --- a/1423-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 87c2302813abc55c46485711a678e3c312b00666 Mon Sep 17 00:00:00 2001 -From: Shiraz Saleem -Date: Mon, 9 Mar 2026 10:24:43 -0700 -Subject: [PATCH] net/mana: Null service_wq on setup error to prevent double - destroy - -In mana_gd_setup() error path, set gc->service_wq to NULL after -destroy_workqueue() to match the cleanup in mana_gd_cleanup(). -This prevents a use-after-free if the workqueue pointer is checked -after a failed setup. - -Fixes: f975a0955276 ("net: mana: Fix double destroy_workqueue on service rescan PCI path") -Signed-off-by: Shiraz Saleem -Signed-off-by: Konstantin Taranov -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20260309172443.688392-1-kotaranov@linux.microsoft.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c -index 37d2f108a839..786186c9a115 100644 ---- a/drivers/net/ethernet/microsoft/mana/gdma_main.c -+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c -@@ -1934,6 +1934,7 @@ static int mana_gd_setup(struct pci_dev *pdev) - mana_gd_remove_irqs(pdev); - free_workqueue: - destroy_workqueue(gc->service_wq); -+ gc->service_wq = NULL; - dev_err(&pdev->dev, "%s failed (error %d)\n", __func__, err); - return err; - } --- -2.50.1 (Apple Git-155) - diff --git a/1424-net-ipv6-ioam6-prevent-schema-length-wraparound-in-trace-fil.patch b/1424-net-ipv6-ioam6-prevent-schema-length-wraparound-in-trace-fil.patch deleted file mode 100644 index 0ef00550f..000000000 --- a/1424-net-ipv6-ioam6-prevent-schema-length-wraparound-in-trace-fil.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 77695a69baca9b99d95fad09fc78c2318736604f Mon Sep 17 00:00:00 2001 -From: Pengpeng Hou -Date: Wed, 25 Mar 2026 15:41:52 +0800 -Subject: [PATCH] net/ipv6: ioam6: prevent schema length wraparound in trace - fill - -[ Upstream commit 5e67ba9bb531e1ec6599a82a065dea9040b9ce50 ] - -ioam6_fill_trace_data() stores the schema contribution to the trace -length in a u8. With bit 22 enabled and the largest schema payload, -sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the -remaining-space check. __ioam6_fill_trace_data() then positions the -write cursor without reserving the schema area but still copies the -4-byte schema header and the full schema payload, overrunning the trace -buffer. - -Keep sclen in an unsigned int so the remaining-space check and the write -cursor calculation both see the full schema length. - -Fixes: 8c6f6fa67726 ("ipv6: ioam: IOAM Generic Netlink API") -Signed-off-by: Pengpeng Hou -Reviewed-by: Justin Iurman -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin - -diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c -index a4b7b60..bdffb79 100644 ---- a/net/ipv6/ioam6.c -+++ b/net/ipv6/ioam6.c -@@ -698,7 +698,7 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb, - struct ioam6_namespace *ns, - struct ioam6_trace_hdr *trace, - struct ioam6_schema *sc, -- u8 sclen, bool is_input) -+ unsigned int sclen, bool is_input) - { - struct net_device *dev = skb_dst_dev(skb); - struct timespec64 ts; -@@ -929,7 +929,7 @@ void ioam6_fill_trace_data(struct sk_buff *skb, - bool is_input) - { - struct ioam6_schema *sc; -- u8 sclen = 0; -+ unsigned int sclen = 0; - - /* Skip if Overflow flag is set - */ diff --git a/1425-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch b/1425-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch deleted file mode 100644 index 12ab2dba7..000000000 --- a/1425-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 1d724378d2b1c0a475bc1743dbba105ded1b7a9d Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 3 Jun 2026 19:00:19 +0000 -Subject: [PATCH] procfs: fix missing RCU protection when reading real_parent - in do_task_stat() - -JIRA: https://redhat.atlassian.net/browse/RHEL-181905 -CVE: CVE-2026-46259 -Backported from tree(s): linux - -commit 76149d53502cf17ef3ae454ff384551236fba867 -Author: Jinliang Zheng -Date: Wed Jan 28 16:30:07 2026 +0800 - - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - - When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent - without proper RCU protection, which leads to: - - cpu 0 cpu 1 - ----- ----- - do_task_stat - var = task->real_parent - release_task - call_rcu(delayed_put_task_struct) - task_tgid_nr_ns(var) - rcu_read_lock <--- Too late to protect task->real_parent! - task_pid_ptr <--- UAF! - rcu_read_unlock - - This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add - proper RCU protection for accessing task->real_parent. - - Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com - Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") - Signed-off-by: Jinliang Zheng - Acked-by: Oleg Nesterov - Cc: David Hildenbrand - Cc: Ingo Molnar - Cc: Lorenzo Stoakes - Cc: Mateusz Guzik - Cc: ruippan - Cc: Usama Arif - Signed-off-by: Andrew Morton - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/proc/array.c b/fs/proc/array.c -index d6a0369caa93..11704686c097 100644 ---- a/fs/proc/array.c -+++ b/fs/proc/array.c -@@ -531,7 +531,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, - } - - sid = task_session_nr_ns(task, ns); -- ppid = task_tgid_nr_ns(task->real_parent, ns); -+ ppid = task_ppid_nr_ns(task, ns); - pgid = task_pgrp_nr_ns(task, ns); - - unlock_task_sighand(task, &flags); --- -2.50.1 (Apple Git-155) - diff --git a/1426-tg3-fix-race-for-querying-speed-duplex.patch b/1426-tg3-fix-race-for-querying-speed-duplex.patch deleted file mode 100644 index 0384a3f8a..000000000 --- a/1426-tg3-fix-race-for-querying-speed-duplex.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 61ea0d078a3ccf72afe38e00b891dbe48cf25c87 Mon Sep 17 00:00:00 2001 -From: Thomas Walsh -Date: Fri, 5 Jun 2026 17:21:58 -0400 -Subject: [PATCH] tg3: Fix race for querying speed/duplex - -JIRA: https://redhat.atlassian.net/browse/RHEL-182561 - -commit bb417456c7814d1493d98b7dd9c040bf3ce3b4ed -Author: Thomas Bogendoerfer -Date: Wed Mar 25 12:20:53 2026 +0100 - - tg3: Fix race for querying speed/duplex - - When driver signals carrier up via netif_carrier_on() its internal - link_up state isn't updated immediately. This leads to inconsistent - speed/duplex in /proc/net/bonding/bondX where the speed and duplex - is shown as unknown while ethtool shows correct values. Fix this by - using netif_carrier_ok() for link checking in get_ksettings function. - - Fixes: 84421b99cedc ("tg3: Update link_up flag for phylib devices") - Signed-off-by: Thomas Bogendoerfer - Reviewed-by: Pavan Chebbi - Signed-off-by: David S. Miller - -Signed-off-by: Thomas Walsh - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 98abd0491abe..39754ee9d393 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -12289,7 +12289,7 @@ static int tg3_get_link_ksettings(struct net_device *dev, - ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.advertising, - advertising); - -- if (netif_running(dev) && tp->link_up) { -+ if (netif_running(dev) && netif_carrier_ok(dev)) { - cmd->base.speed = tp->link_config.active_speed; - cmd->base.duplex = tp->link_config.active_duplex; - ethtool_convert_legacy_u32_to_link_mode( --- -2.50.1 (Apple Git-155) - diff --git a/1427-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch b/1427-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch deleted file mode 100644 index 6b8bf372b..000000000 --- a/1427-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 14dc02b7c9eabd99199d9668ba1c0b4a29ed9a27 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Wed, 1 Jul 2026 15:54:57 -0300 -Subject: [PATCH] smb: client: fix off-by-8 bounds check in check_wsl_eas() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180047 - -commit 3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b -Author: Greg Kroah-Hartman -Date: Mon Apr 6 15:49:37 2026 +0200 - - smb: client: fix off-by-8 bounds check in check_wsl_eas() - - The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA - name and value, but ea_data sits at offset sizeof(struct - smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp() - later reads ea->ea_data[0..nlen-1] and the value bytes follow at - ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1 - + vlen. Isn't pointer math fun? - - The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the - 8-byte header is in bounds, but since the last EA is placed within 8 - bytes of the end of the response, the name and value bytes are read past - the end of iov. - - Fix this mess all up by using ea->ea_data as the base for the bounds - check. - - An "untrusted" server can use this to leak up to 8 bytes of kernel heap - into the EA name comparison and influence which WSL xattr the data is - interpreted as. - - Cc: Ronnie Sahlberg - Cc: Shyam Prasad N - Cc: Tom Talpey - Cc: Bharath SM - Cc: linux-cifs@vger.kernel.org - Cc: samba-technical@lists.samba.org - Cc: stable - Assisted-by: gregkh_clanker_t1000 - Reviewed-by: Paulo Alcantara (Red Hat) - Signed-off-by: Greg Kroah-Hartman - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index ea05bb4b82a1..715ff58f1742 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -128,7 +128,7 @@ static int check_wsl_eas(struct kvec *rsp_iov) - nlen = ea->ea_name_length; - vlen = le16_to_cpu(ea->ea_value_length); - if (nlen != SMB2_WSL_XATTR_NAME_LEN || -- (u8 *)ea + nlen + 1 + vlen > end) -+ (u8 *)ea->ea_data + nlen + 1 + vlen > end) - return -EINVAL; - - switch (vlen) { --- -2.50.1 (Apple Git-155) - diff --git a/1428-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch b/1428-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch deleted file mode 100644 index c232a6405..000000000 --- a/1428-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch +++ /dev/null @@ -1,73 +0,0 @@ -From b4c153a8f7b3cf32752c8c0a81193535507baba7 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Wed, 1 Jul 2026 15:55:06 -0300 -Subject: [PATCH] smb/client: fix out-of-bounds read in smb2_compound_op() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180047 -CVE: CVE-2026-46155 - -commit 8d09328dfda089675e4c049f3f256064a1d1996b -Author: Zisen Ye -Date: Wed May 6 11:49:08 2026 +0800 - - smb/client: fix out-of-bounds read in smb2_compound_op() - - If a server sends a truncated response but a large OutputBufferLength, and - terminates the EA list early, check_wsl_eas() returns success without - validating that the entire OutputBufferLength fits within iov_len. - - Then smb2_compound_op() does: - memcpy(idata->wsl.eas, data[0], size[0]); - - Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], - memcpy can read beyond the end of the rsp_iov allocation and leak adjacent - kernel heap memory. - - Link: https://lore.kernel.org/linux-cifs/d998240c-aca9-420d-9dbd-f5ba24af19e0@chenxiaosong.com/ - Fixes: ea41367b2a60 ("smb: client: introduce SMB2_OP_QUERY_WSL_EA") - Cc: stable@vger.kernel.org - Signed-off-by: Zisen Ye - Reviewed-by: ChenXiaoSong - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 715ff58f1742..2cdd46228e31 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -111,7 +111,7 @@ static int check_wsl_eas(struct kvec *rsp_iov) - u32 outlen, next; - u16 vlen; - u8 nlen; -- u8 *end; -+ u8 *ea_end, *iov_end; - - outlen = le32_to_cpu(rsp->OutputBufferLength); - if (outlen < SMB2_WSL_MIN_QUERY_EA_RESP_SIZE || -@@ -120,15 +120,19 @@ static int check_wsl_eas(struct kvec *rsp_iov) - - ea = (void *)((u8 *)rsp_iov->iov_base + - le16_to_cpu(rsp->OutputBufferOffset)); -- end = (u8 *)rsp_iov->iov_base + rsp_iov->iov_len; -+ ea_end = (u8 *)ea + outlen; -+ iov_end = (u8 *)rsp_iov->iov_base + rsp_iov->iov_len; -+ if (ea_end > iov_end) -+ return -EINVAL; -+ - for (;;) { -- if ((u8 *)ea > end - sizeof(*ea)) -+ if ((u8 *)ea > ea_end - sizeof(*ea)) - return -EINVAL; - - nlen = ea->ea_name_length; - vlen = le16_to_cpu(ea->ea_value_length); - if (nlen != SMB2_WSL_XATTR_NAME_LEN || -- (u8 *)ea->ea_data + nlen + 1 + vlen > end) -+ (u8 *)ea->ea_data + nlen + 1 + vlen > ea_end) - return -EINVAL; - - switch (vlen) { --- -2.50.1 (Apple Git-155) - diff --git a/1429-epoll-annotate-racy-check.patch b/1429-epoll-annotate-racy-check.patch deleted file mode 100644 index b698c2631..000000000 --- a/1429-epoll-annotate-racy-check.patch +++ /dev/null @@ -1,66 +0,0 @@ -From bde1be0c6e5eeb145576344159be1f51cb8d5d8b Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:53:22 +0800 -Subject: [PATCH] epoll: annotate racy check - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a -Author: Christian Brauner -Date: Wed Sep 25 11:05:16 2024 +0200 - - epoll: annotate racy check - - Epoll relies on a racy fastpath check during __fput() in - eventpoll_release() to avoid the hit of pointlessly acquiring a - semaphore. Annotate that race by using WRITE_ONCE() and READ_ONCE(). - - Link: https://lore.kernel.org/r/66edfb3c.050a0220.3195df.001a.GAE@google.com - Link: https://lore.kernel.org/r/20240925-fungieren-anbauen-79b334b00542@brauner - Reviewed-by: Jan Kara - Reported-by: syzbot+3b6b32dc50537a49bb4a@syzkaller.appspotmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index a7efeb499e4b..616f97e9b75b 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -852,7 +852,8 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - to_free = NULL; - head = file->f_ep; - if (head->first == &epi->fllink && !epi->fllink.next) { -- file->f_ep = NULL; -+ /* See eventpoll_release() for details. */ -+ WRITE_ONCE(file->f_ep, NULL); - if (!is_file_epoll(file)) { - struct epitems_head *v; - v = container_of(head, struct epitems_head, epitems); -@@ -1630,7 +1631,8 @@ static int attach_epitem(struct file *file, struct epitem *epi) - spin_unlock(&file->f_lock); - goto allocate; - } -- file->f_ep = head; -+ /* See eventpoll_release() for details. */ -+ WRITE_ONCE(file->f_ep, head); - to_free = NULL; - } - hlist_add_head_rcu(&epi->fllink, file->f_ep); -diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h -index 3337745d81bd..0c0d00fcd131 100644 ---- a/include/linux/eventpoll.h -+++ b/include/linux/eventpoll.h -@@ -42,7 +42,7 @@ static inline void eventpoll_release(struct file *file) - * because the file in on the way to be removed and nobody ( but - * eventpoll ) has still a reference to this file. - */ -- if (likely(!file->f_ep)) -+ if (likely(!READ_ONCE(file->f_ep))) - return; - - /* --- -2.50.1 (Apple Git-155) - diff --git a/1430-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch b/1430-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch deleted file mode 100644 index f2bdc8dc7..000000000 --- a/1430-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 2b62eb17ec16b6a7d341497e48e331f84280cd58 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:54:24 +0800 -Subject: [PATCH] eventpoll: defer struct eventpoll free to RCU grace period - -JIRA: https://redhat.atlassian.net/browse/RHEL-173837 -Upstream status: Linus - -CVE: CVE-2026-43074 - -commit 07712db80857d5d09ae08f3df85a708ecfc3b61f -Author: Nicholas Carlini -Date: Tue Mar 31 15:25:32 2026 +0200 - - eventpoll: defer struct eventpoll free to RCU grace period - - In certain situations, ep_free() in eventpoll.c will kfree the epi->ep - eventpoll struct while it still being used by another concurrent thread. - Defer the kfree() to an RCU callback to prevent UAF. - - Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion") - Signed-off-by: Nicholas Carlini - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 616f97e9b75b..0368ab69138a 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -225,6 +225,9 @@ struct eventpoll { - */ - refcount_t refcount; - -+ /* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */ -+ struct rcu_head rcu; -+ - #ifdef CONFIG_NET_RX_BUSY_POLL - /* used to track busy poll napi_id */ - unsigned int napi_id; -@@ -818,7 +821,8 @@ static void ep_free(struct eventpoll *ep) - mutex_destroy(&ep->mtx); - free_uid(ep->user); - wakeup_source_unregister(ep->ws); -- kfree(ep); -+ /* ep_get_upwards_depth_proc() may still hold epi->ep under RCU */ -+ kfree_rcu(ep, rcu); - } - - /* --- -2.50.1 (Apple Git-155) - diff --git a/1431-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch b/1431-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch deleted file mode 100644 index 126527bc2..000000000 --- a/1431-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 1fe6204c6ea38fc1d370d9bbb9fd6a800104e5c8 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:54:59 +0800 -Subject: [PATCH] eventpoll: use hlist_is_singular_node() in __ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b -Author: Christian Brauner -Date: Thu Apr 23 11:56:04 2026 +0200 - - eventpoll: use hlist_is_singular_node() in __ep_remove() - - Replace the open-coded "epi is the only entry in file->f_ep" check - with hlist_is_singular_node(). Same semantics, and the helper avoids - the head-cacheline access in the common false case. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-1-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 0368ab69138a..2dd87800bfbf 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -855,7 +855,7 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - - to_free = NULL; - head = file->f_ep; -- if (head->first == &epi->fllink && !epi->fllink.next) { -+ if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ - WRITE_ONCE(file->f_ep, NULL); - if (!is_file_epoll(file)) { --- -2.50.1 (Apple Git-155) - diff --git a/1432-eventpoll-split-ep-remove.patch b/1432-eventpoll-split-ep-remove.patch deleted file mode 100644 index a872525c2..000000000 --- a/1432-eventpoll-split-ep-remove.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 83db11e5ba3c57104945247e11c1891355a12fb6 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:55:51 +0800 -Subject: [PATCH] eventpoll: split __ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0 -Author: Christian Brauner -Date: Thu Apr 23 11:56:05 2026 +0200 - - eventpoll: split __ep_remove() - - Split __ep_remove() to delineate file removal from epoll item removal. - - Suggested-by: Linus Torvalds - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 2dd87800bfbf..001c87b6ddab 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -825,6 +825,9 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file); -+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi); -+ - /* - * Removes a "struct epitem" from the eventpoll RB tree and deallocates - * all the associated resources. Must be called with "mtx" held. -@@ -836,8 +839,6 @@ static void ep_free(struct eventpoll *ep) - static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - { - struct file *file = epi->ffd.file; -- struct epitems_head *to_free; -- struct hlist_head *head; - - lockdep_assert_irqs_enabled(); - -@@ -853,8 +854,21 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - return false; - } - -- to_free = NULL; -- head = file->f_ep; -+ __ep_remove_file(ep, epi, file); -+ return __ep_remove_epi(ep, epi); -+} -+ -+/* -+ * Called with &file->f_lock held, -+ * returns with it released -+ */ -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) -+{ -+ struct epitems_head *to_free = NULL; -+ struct hlist_head *head = file->f_ep; -+ -+ lockdep_assert_held(&ep->mtx); -+ - if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ - WRITE_ONCE(file->f_ep, NULL); -@@ -868,6 +882,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - hlist_del_rcu(&epi->fllink); - spin_unlock(&file->f_lock); - free_ephead(to_free); -+} -+ -+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) -+{ -+ lockdep_assert_held(&ep->mtx); - - rb_erase_cached(&epi->rbn, &ep->rbr); - --- -2.50.1 (Apple Git-155) - diff --git a/1433-eventpoll-kill-ep-remove.patch b/1433-eventpoll-kill-ep-remove.patch deleted file mode 100644 index 3d7e6632d..000000000 --- a/1433-eventpoll-kill-ep-remove.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 9a9a41f8aa46741f965703f520542e9e8fdbe59f Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:56:21 +0800 -Subject: [PATCH] eventpoll: kill __ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330 -Author: Christian Brauner -Date: Thu Apr 23 11:56:06 2026 +0200 - - eventpoll: kill __ep_remove() - - Remove the boolean conditional in __ep_remove() and restructure the code - so the check for racing with eventpoll_release_file() are only done in - the ep_remove_safe() path where they belong. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-3-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 001c87b6ddab..cb75868ba1de 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -825,49 +825,18 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file); --static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi); -- --/* -- * Removes a "struct epitem" from the eventpoll RB tree and deallocates -- * all the associated resources. Must be called with "mtx" held. -- * If the dying flag is set, do the removal only if force is true. -- * This prevents ep_clear_and_put() from dropping all the ep references -- * while running concurrently with eventpoll_release_file(). -- * Returns true if the eventpoll can be disposed. -- */ --static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) --{ -- struct file *file = epi->ffd.file; -- -- lockdep_assert_irqs_enabled(); -- -- /* -- * Removes poll wait queue hooks. -- */ -- ep_unregister_pollwait(ep, epi); -- -- /* Remove the current item from the list of epoll hooks */ -- spin_lock(&file->f_lock); -- if (epi->dying && !force) { -- spin_unlock(&file->f_lock); -- return false; -- } -- -- __ep_remove_file(ep, epi, file); -- return __ep_remove_epi(ep, epi); --} -- - /* - * Called with &file->f_lock held, - * returns with it released - */ --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, -+ struct file *file) - { - struct epitems_head *to_free = NULL; - struct hlist_head *head = file->f_ep; - - lockdep_assert_held(&ep->mtx); -+ lockdep_assert_held(&file->f_lock); - - if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ -@@ -914,7 +883,25 @@ static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - */ - static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) - { -- if (__ep_remove(ep, epi, false)) -+ struct file *file = epi->ffd.file; -+ -+ lockdep_assert_irqs_enabled(); -+ lockdep_assert_held(&ep->mtx); -+ -+ ep_unregister_pollwait(ep, epi); -+ -+ /* sync with eventpoll_release_file() */ -+ if (unlikely(READ_ONCE(epi->dying))) -+ return; -+ -+ spin_lock(&file->f_lock); -+ if (epi->dying) { -+ spin_unlock(&file->f_lock); -+ return; -+ } -+ __ep_remove_file(ep, epi, file); -+ -+ if (__ep_remove_epi(ep, epi)) - WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - -@@ -1146,7 +1133,7 @@ void eventpoll_release_file(struct file *file) - spin_lock(&file->f_lock); - if (file->f_ep && file->f_ep->first) { - epi = hlist_entry(file->f_ep->first, struct epitem, fllink); -- epi->dying = true; -+ WRITE_ONCE(epi->dying, true); - spin_unlock(&file->f_lock); - - /* -@@ -1155,7 +1142,13 @@ void eventpoll_release_file(struct file *file) - */ - ep = epi->ep; - mutex_lock(&ep->mtx); -- dispose = __ep_remove(ep, epi, true); -+ -+ ep_unregister_pollwait(ep, epi); -+ -+ spin_lock(&file->f_lock); -+ __ep_remove_file(ep, epi, file); -+ dispose = __ep_remove_epi(ep, epi); -+ - mutex_unlock(&ep->mtx); - - if (dispose && ep_refcount_dec_and_test(ep)) --- -2.50.1 (Apple Git-155) - diff --git a/1434-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch b/1434-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch deleted file mode 100644 index 23c3da7fc..000000000 --- a/1434-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 4e16f36e52dfe03056ec8c4daaef79b1715bb341 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:58:37 +0800 -Subject: [PATCH] eventpoll: rename ep_remove_safe() back to ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 0bade234723e40e4937be912e105785d6a51464e -Author: Christian Brauner -Date: Thu Apr 23 11:56:07 2026 +0200 - - eventpoll: rename ep_remove_safe() back to ep_remove() - - The current name is just confusing and doesn't clarify anything. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index cb75868ba1de..efc9e3e1e3f5 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -881,7 +881,7 @@ static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - /* - * ep_remove variant for callers owing an additional reference to the ep - */ --static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) -+static void ep_remove(struct eventpoll *ep, struct epitem *epi) - { - struct file *file = epi->ffd.file; - -@@ -928,7 +928,7 @@ static void ep_clear_and_put(struct eventpoll *ep) - - /* - * Walks through the whole tree and try to free each "struct epitem". -- * Note that ep_remove_safe() will not remove the epitem in case of a -+ * Note that ep_remove() will not remove the epitem in case of a - * racing eventpoll_release_file(); the latter will do the removal. - * At this point we are sure no poll callbacks will be lingering around. - * Since we still own a reference to the eventpoll struct, the loop can't -@@ -937,7 +937,7 @@ static void ep_clear_and_put(struct eventpoll *ep) - for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = next) { - next = rb_next(rbp); - epi = rb_entry(rbp, struct epitem, rbn); -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - cond_resched(); - } - -@@ -1714,21 +1714,21 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, - mutex_unlock(&tep->mtx); - - /* -- * ep_remove_safe() calls in the later error paths can't lead to -+ * ep_remove() calls in the later error paths can't lead to - * ep_free() as the ep file itself still holds an ep reference. - */ - ep_get(ep); - - /* now check if we've created too many backpaths */ - if (unlikely(full_check && reverse_path_check())) { -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - return -EINVAL; - } - - if (epi->event.events & EPOLLWAKEUP) { - error = ep_create_wakeup_source(epi); - if (error) { -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - return error; - } - } -@@ -1752,7 +1752,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, - * high memory pressure. - */ - if (unlikely(!epq.epi)) { -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - return -ENOMEM; - } - -@@ -2415,7 +2415,7 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, - * The eventpoll itself is still alive: the refcount - * can't go to zero here. - */ -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - error = 0; - } else { - error = -ENOENT; --- -2.50.1 (Apple Git-155) - diff --git a/1435-eventpoll-move-epi-fget-up.patch b/1435-eventpoll-move-epi-fget-up.patch deleted file mode 100644 index f2838812b..000000000 --- a/1435-eventpoll-move-epi-fget-up.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 8c1707336e5674c16c2a24c9cdf2b5018b166a09 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:00:26 +0800 -Subject: [PATCH] eventpoll: move epi_fget() up - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 86e87059e6d1fd5115a31949726450ed03c1073b -Author: Christian Brauner -Date: Thu Apr 23 11:56:08 2026 +0200 - - eventpoll: move epi_fget() up - - We'll need it when removing files so move it up. No functional change. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-5-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index efc9e3e1e3f5..ded53c6fbd6f 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -825,6 +825,34 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - -+/* -+ * The ffd.file pointer may be in the process of being torn down due to -+ * being closed, but we may not have finished eventpoll_release() yet. -+ * -+ * Normally, even with the atomic_long_inc_not_zero, the file may have -+ * been free'd and then gotten re-allocated to something else (since -+ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -+ * -+ * But for epoll, users hold the ep->mtx mutex, and as such any file in -+ * the process of being free'd will block in eventpoll_release_file() -+ * and thus the underlying file allocation will not be free'd, and the -+ * file re-use cannot happen. -+ * -+ * For the same reason we can avoid a rcu_read_lock() around the -+ * operation - 'ffd.file' cannot go away even if the refcount has -+ * reached zero (but we must still not call out to ->poll() functions -+ * etc). -+ */ -+static struct file *epi_fget(const struct epitem *epi) -+{ -+ struct file *file; -+ -+ file = epi->ffd.file; -+ if (!file_ref_get(&file->f_ref)) -+ file = NULL; -+ return file; -+} -+ - /* - * Called with &file->f_lock held, - * returns with it released -@@ -1017,34 +1045,6 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep - return res; - } - --/* -- * The ffd.file pointer may be in the process of being torn down due to -- * being closed, but we may not have finished eventpoll_release() yet. -- * -- * Normally, even with the atomic_long_inc_not_zero, the file may have -- * been free'd and then gotten re-allocated to something else (since -- * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -- * -- * But for epoll, users hold the ep->mtx mutex, and as such any file in -- * the process of being free'd will block in eventpoll_release_file() -- * and thus the underlying file allocation will not be free'd, and the -- * file re-use cannot happen. -- * -- * For the same reason we can avoid a rcu_read_lock() around the -- * operation - 'ffd.file' cannot go away even if the refcount has -- * reached zero (but we must still not call out to ->poll() functions -- * etc). -- */ --static struct file *epi_fget(const struct epitem *epi) --{ -- struct file *file; -- -- file = epi->ffd.file; -- if (!file_ref_get(&file->f_ref)) -- file = NULL; -- return file; --} -- - /* - * Differs from ep_eventpoll_poll() in that internal callers already have - * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested() --- -2.50.1 (Apple Git-155) - diff --git a/1436-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch b/1436-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch deleted file mode 100644 index 985802699..000000000 --- a/1436-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 6175a9a692e559e7f0635d3a32d20fe94bae8280 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:57:24 +0800 -Subject: [PATCH] eventpoll: drop vestigial __ prefix from - ep_remove_{file,epi}() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -Conflict: I don't know how this commit is present when commit - d3608d9e2f5a ("eventpoll: fix ep_remove struct eventpoll / - struct file UAF") is applied since its time stamp is later than - the afore mentioned commit. I've applied it here purely to avoid - the subsequent conflict. - -commit 0feaf644f7180c4a91b6b405a881afbfd958f1cf -Author: Christian Brauner -Date: Fri Apr 24 00:23:18 2026 +0200 - - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - - With __ep_remove() gone, the double-underscore on __ep_remove_file() - and __ep_remove_epi() no longer contrasts with a __-less parent and - just reads as noise. Rename both to ep_remove_file() and - ep_remove_epi(). No functional change. - - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index ded53c6fbd6f..1246c0517aa6 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -857,7 +857,7 @@ static struct file *epi_fget(const struct epitem *epi) - * Called with &file->f_lock held, - * returns with it released - */ --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, -+static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - struct file *file) - { - struct epitems_head *to_free = NULL; -@@ -881,7 +881,7 @@ static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, - free_ephead(to_free); - } - --static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) -+static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - { - lockdep_assert_held(&ep->mtx); - -@@ -927,9 +927,9 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - spin_unlock(&file->f_lock); - return; - } -- __ep_remove_file(ep, epi, file); -+ ep_remove_file(ep, epi, file); - -- if (__ep_remove_epi(ep, epi)) -+ if (ep_remove_epi(ep, epi)) - WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - -@@ -1146,8 +1146,8 @@ void eventpoll_release_file(struct file *file) - ep_unregister_pollwait(ep, epi); - - spin_lock(&file->f_lock); -- __ep_remove_file(ep, epi, file); -- dispose = __ep_remove_epi(ep, epi); -+ ep_remove_file(ep, epi, file); -+ dispose = ep_remove_epi(ep, epi); - - mutex_unlock(&ep->mtx); - --- -2.50.1 (Apple Git-155) - diff --git a/1437-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch b/1437-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch deleted file mode 100644 index 2f4872c14..000000000 --- a/1437-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 5c53e2d149e55d3ee64fb03387d2f81d59477774 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:00:59 +0800 -Subject: [PATCH] eventpoll: fix ep_remove struct eventpoll / struct file UAF - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -CVE: CVE-2026-46242 - -commit a6dc643c69311677c574a0f17a3f4d66a5f3744b -Author: Christian Brauner -Date: Thu Apr 23 11:56:09 2026 +0200 - - eventpoll: fix ep_remove struct eventpoll / struct file UAF - - ep_remove() (via ep_remove_file()) cleared file->f_ep under - file->f_lock but then kept using @file inside the critical section - (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). - A concurrent __fput() taking the eventpoll_release() fastpath in - that window observed the transient NULL, skipped - eventpoll_release_file() and ran to f_op->release / file_free(). - - For the epoll-watches-epoll case, f_op->release is - ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which - kfree()s the watched struct eventpoll. Its embedded ->refs - hlist_head is exactly where epi->fllink.pprev points, so the - subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed - kmalloc-192 memory. - - In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot - backing @file could be recycled by alloc_empty_file() -- - reinitializing f_lock and f_ep -- while ep_remove() is still - nominally inside that lock. The upshot is an attacker-controllable - kmem_cache_free() against the wrong slab cache. - - Pin @file via epi_fget() at the top of ep_remove() and gate the - critical section on the pin succeeding. With the pin held @file - cannot reach refcount zero, which holds __fput() off and - transitively keeps the watched struct eventpoll alive across the - hlist_del_rcu() and the f_lock use, closing both UAFs. - - If the pin fails @file has already reached refcount zero and its - __fput() is in flight. Because we bailed before clearing f_ep, - that path takes the eventpoll_release() slow path into - eventpoll_release_file() and blocks on ep->mtx until the waiter - side's ep_clear_and_put() drops it. The bailed epi's share of - ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() - in ep_clear_and_put() cannot free the eventpoll out from under - eventpoll_release_file(); the orphaned epi is then cleaned up - there. - - A successful pin also proves we are not racing - eventpoll_release_file() on this epi, so drop the now-redundant - re-check of epi->dying under f_lock. The cheap lockless - READ_ONCE(epi->dying) fast-path bailout stays. - - Fixes: 58c9b016e128 ("epoll: use refcount to reduce ep_mutex contention") - Reported-by: Jaeyoung Chung - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-6-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 1246c0517aa6..f46906640a9b 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -911,22 +911,26 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - */ - static void ep_remove(struct eventpoll *ep, struct epitem *epi) - { -- struct file *file = epi->ffd.file; -+ struct file *file __free(fput) = NULL; - - lockdep_assert_irqs_enabled(); - lockdep_assert_held(&ep->mtx); - - ep_unregister_pollwait(ep, epi); - -- /* sync with eventpoll_release_file() */ -+ /* cheap sync with eventpoll_release_file() */ - if (unlikely(READ_ONCE(epi->dying))) - return; - -- spin_lock(&file->f_lock); -- if (epi->dying) { -- spin_unlock(&file->f_lock); -+ /* -+ * If we manage to grab a reference it means we're not in -+ * eventpoll_release_file() and aren't going to be. -+ */ -+ file = epi_fget(epi); -+ if (!file) - return; -- } -+ -+ spin_lock(&file->f_lock); - ep_remove_file(ep, epi, file); - - if (ep_remove_epi(ep, epi)) --- -2.50.1 (Apple Git-155) - diff --git a/1438-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch b/1438-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch deleted file mode 100644 index 9c82bdf39..000000000 --- a/1438-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch +++ /dev/null @@ -1,70 +0,0 @@ -From e0bf480728b83ec6ceb66975bfbac514195873c8 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:01:51 +0800 -Subject: [PATCH] eventpoll: move f_lock acquisition into ep_remove_file() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit d30deeb8b0cf6259785c1fb79b87905d281b0a5a -Author: Christian Brauner -Date: Thu Apr 23 11:56:10 2026 +0200 - - eventpoll: move f_lock acquisition into ep_remove_file() - - Let the helper own its critical section end-to-end: take &file->f_lock - at the top, read file->f_ep inside the lock, release on exit. Callers - (ep_remove() and eventpoll_release_file()) no longer need to wrap the - call, and the function-comment lock-handoff contract is gone. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-7-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index f46906640a9b..9798ab5f7663 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -854,18 +854,18 @@ static struct file *epi_fget(const struct epitem *epi) - } - - /* -- * Called with &file->f_lock held, -- * returns with it released -+ * Takes &file->f_lock; returns with it released. - */ - static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - struct file *file) - { - struct epitems_head *to_free = NULL; -- struct hlist_head *head = file->f_ep; -+ struct hlist_head *head; - - lockdep_assert_held(&ep->mtx); -- lockdep_assert_held(&file->f_lock); - -+ spin_lock(&file->f_lock); -+ head = file->f_ep; - if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ - WRITE_ONCE(file->f_ep, NULL); -@@ -930,7 +930,6 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - if (!file) - return; - -- spin_lock(&file->f_lock); - ep_remove_file(ep, epi, file); - - if (ep_remove_epi(ep, epi)) -@@ -1149,7 +1148,6 @@ void eventpoll_release_file(struct file *file) - - ep_unregister_pollwait(ep, epi); - -- spin_lock(&file->f_lock); - ep_remove_file(ep, epi, file); - dispose = ep_remove_epi(ep, epi); - --- -2.50.1 (Apple Git-155) - diff --git a/1439-eventpoll-refresh-eventpoll-release-fast-path-comment.patch b/1439-eventpoll-refresh-eventpoll-release-fast-path-comment.patch deleted file mode 100644 index deabbe282..000000000 --- a/1439-eventpoll-refresh-eventpoll-release-fast-path-comment.patch +++ /dev/null @@ -1,66 +0,0 @@ -From eab8e8be1be2430b6712fc1a6c8925d240a40031 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:02:27 +0800 -Subject: [PATCH] eventpoll: refresh eventpoll_release() fast-path comment - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 33e92e9ecf48c08cb4807e9a36f9eb01619c1a1e -Author: Christian Brauner -Date: Thu Apr 23 11:56:11 2026 +0200 - - eventpoll: refresh eventpoll_release() fast-path comment - - The old comment justified the lockless READ_ONCE(file->f_ep) check - with "False positives simply cannot happen because the file is on - the way to be removed and nobody ( but eventpoll ) has still a - reference to this file." That reasoning was the root of the UAF - fixed in "eventpoll: fix ep_remove struct eventpoll / struct file - UAF": __ep_remove() could clear f_ep while another close raced - past the fast path and freed the watched eventpoll / recycled the - struct file slot. - - With ep_remove() now pinning @file via epi_fget() across the f_ep - clear and hlist_del_rcu(), the invariant is re-established for the - right reason: anyone who might clear f_ep holds @file alive for - the duration, so a NULL observation really does mean no - concurrent eventpoll path has work left on this file. Refresh the - comment accordingly so the next reader doesn't inherit the broken - model. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-8-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h -index 0c0d00fcd131..be762281355a 100644 ---- a/include/linux/eventpoll.h -+++ b/include/linux/eventpoll.h -@@ -35,12 +35,16 @@ static inline void eventpoll_release(struct file *file) - { - - /* -- * Fast check to avoid the get/release of the semaphore. Since -- * we're doing this outside the semaphore lock, it might return -- * false negatives, but we don't care. It'll help in 99.99% of cases -- * to avoid the semaphore lock. False positives simply cannot happen -- * because the file in on the way to be removed and nobody ( but -- * eventpoll ) has still a reference to this file. -+ * Fast check to skip the slow path in the common case where the -+ * file was never attached to an epoll. Safe without file->f_lock -+ * because every f_ep writer excludes a concurrent __fput() on -+ * @file: -+ * - ep_insert() requires the file alive (refcount > 0); -+ * - ep_remove() holds @file pinned via epi_fget() across the -+ * write; -+ * - eventpoll_release_file() runs from __fput() itself. -+ * We are in __fput() here, so none of those can race us: a NULL -+ * observation truly means no epoll path has work left on @file. - */ - if (likely(!READ_ONCE(file->f_ep))) - return; --- -2.50.1 (Apple Git-155) - diff --git a/1440-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch b/1440-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch deleted file mode 100644 index 336fd9baa..000000000 --- a/1440-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 38a78d49b434ce9f29afdfaa870142ecb121800f Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:03:04 +0800 -Subject: [PATCH] eventpoll: drop dead bool return from ep_remove_epi() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 3a4551ea9c042502019b1d8a986e962cb9015366 -Author: Christian Brauner -Date: Thu Apr 23 11:56:12 2026 +0200 - - eventpoll: drop dead bool return from ep_remove_epi() - - ep_remove_epi() always returns true -- the "can be disposed" - answer was meaningful back when the dying-check lived inside the - pre-split __ep_remove(), but after that check moved to ep_remove() - the return value is just noise. Both callers gate on it - unconditionally: - - if (ep_remove_epi(ep, epi)) - WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - - dispose = ep_remove_epi(ep, epi); - ... - if (dispose && ep_refcount_dec_and_test(ep)) - ep_free(ep); - - Make ep_remove_epi() return void, drop the dispose local in - eventpoll_release_file(), and the useless conditionals at both - callers. No functional change. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-9-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 9798ab5f7663..761bd85f213e 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -881,7 +881,7 @@ static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - free_ephead(to_free); - } - --static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) -+static void ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - { - lockdep_assert_held(&ep->mtx); - -@@ -903,7 +903,6 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - kfree_rcu(epi, rcu); - - percpu_counter_dec(&ep->user->epoll_watches); -- return true; - } - - /* -@@ -931,9 +930,8 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - return; - - ep_remove_file(ep, epi, file); -- -- if (ep_remove_epi(ep, epi)) -- WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); -+ ep_remove_epi(ep, epi); -+ WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - - static void ep_clear_and_put(struct eventpoll *ep) -@@ -1125,7 +1123,6 @@ void eventpoll_release_file(struct file *file) - { - struct eventpoll *ep; - struct epitem *epi; -- bool dispose; - - /* - * Use the 'dying' flag to prevent a concurrent ep_clear_and_put() from -@@ -1149,11 +1146,11 @@ void eventpoll_release_file(struct file *file) - ep_unregister_pollwait(ep, epi); - - ep_remove_file(ep, epi, file); -- dispose = ep_remove_epi(ep, epi); -+ ep_remove_epi(ep, epi); - - mutex_unlock(&ep->mtx); - -- if (dispose && ep_refcount_dec_and_test(ep)) -+ if (ep_refcount_dec_and_test(ep)) - ep_free(ep); - goto again; - } --- -2.50.1 (Apple Git-155) - diff --git a/1441-eventpoll-fix-semi-unbounded-recursion.patch b/1441-eventpoll-fix-semi-unbounded-recursion.patch deleted file mode 100644 index 428583af9..000000000 --- a/1441-eventpoll-fix-semi-unbounded-recursion.patch +++ /dev/null @@ -1,176 +0,0 @@ -From 6ee3e28a7271944ba136a37d07ca35f0f7e3903b Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:03:26 +0800 -Subject: [PATCH] eventpoll: Fix semi-unbounded recursion - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -CVE: CVE-2025-38614 - -commit f2e467a48287c868818085aa35389a224d226732 -Author: Jann Horn -Date: Fri Jul 11 18:33:36 2025 +0200 - - eventpoll: Fix semi-unbounded recursion - - Ensure that epoll instances can never form a graph deeper than - EP_MAX_NESTS+1 links. - - Currently, ep_loop_check_proc() ensures that the graph is loop-free and - does some recursion depth checks, but those recursion depth checks don't - limit the depth of the resulting tree for two reasons: - - - They don't look upwards in the tree. - - If there are multiple downwards paths of different lengths, only one of - the paths is actually considered for the depth check since commit - 28d82dc1c4ed ("epoll: limit paths"). - - Essentially, the current recursion depth check in ep_loop_check_proc() just - serves to prevent it from recursing too deeply while checking for loops. - - A more thorough check is done in reverse_path_check() after the new graph - edge has already been created; this checks, among other things, that no - paths going upwards from any non-epoll file with a length of more than 5 - edges exist. However, this check does not apply to non-epoll files. - - As a result, it is possible to recurse to a depth of at least roughly 500, - tested on v6.15. (I am unsure if deeper recursion is possible; and this may - have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion - problem").) - - To fix it: - - 1. In ep_loop_check_proc(), note the subtree depth of each visited node, - and use subtree depths for the total depth calculation even when a subtree - has already been visited. - 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum - depth of an upwards walk. - 3. In ep_loop_check(), use these values to limit the total path length - between epoll nodes to EP_MAX_NESTS edges. - - Fixes: 22bacca48a17 ("epoll: prevent creating circular epoll structures") - Cc: stable@vger.kernel.org - Signed-off-by: Jann Horn - Link: https://lore.kernel.org/20250711-epoll-recursion-fix-v1-1-fb2457c33292@google.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 761bd85f213e..88b501a5e709 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -218,6 +218,7 @@ struct eventpoll { - /* used to optimize loop detection check */ - u64 gen; - struct hlist_head refs; -+ u8 loop_check_depth; - - /* - * usage count, used together with epitem->dying to -@@ -2135,23 +2136,24 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - } - - /** -- * ep_loop_check_proc - verify that adding an epoll file inside another -- * epoll structure does not violate the constraints, in -- * terms of closed loops, or too deep chains (which can -- * result in excessive stack usage). -+ * ep_loop_check_proc - verify that adding an epoll file @ep inside another -+ * epoll file does not create closed loops, and -+ * determine the depth of the subtree starting at @ep - * - * @ep: the &struct eventpoll to be currently checked. - * @depth: Current depth of the path being checked. - * -- * Return: %zero if adding the epoll @file inside current epoll -- * structure @ep does not violate the constraints, or %-1 otherwise. -+ * Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. - */ - static int ep_loop_check_proc(struct eventpoll *ep, int depth) - { -- int error = 0; -+ int result = 0; - struct rb_node *rbp; - struct epitem *epi; - -+ if (ep->gen == loop_check_gen) -+ return ep->loop_check_depth; -+ - mutex_lock_nested(&ep->mtx, depth + 1); - ep->gen = loop_check_gen; - for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = rb_next(rbp)) { -@@ -2159,13 +2161,11 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - if (unlikely(is_file_epoll(epi->ffd.file))) { - struct eventpoll *ep_tovisit; - ep_tovisit = epi->ffd.file->private_data; -- if (ep_tovisit->gen == loop_check_gen) -- continue; - if (ep_tovisit == inserting_into || depth > EP_MAX_NESTS) -- error = -1; -+ result = INT_MAX; - else -- error = ep_loop_check_proc(ep_tovisit, depth + 1); -- if (error != 0) -+ result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1); -+ if (result > EP_MAX_NESTS) - break; - } else { - /* -@@ -2179,9 +2179,27 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - list_file(epi->ffd.file); - } - } -+ ep->loop_check_depth = result; - mutex_unlock(&ep->mtx); - -- return error; -+ return result; -+} -+ -+/** -+ * ep_get_upwards_depth_proc - determine depth of @ep when traversed upwards -+ */ -+static int ep_get_upwards_depth_proc(struct eventpoll *ep, int depth) -+{ -+ int result = 0; -+ struct epitem *epi; -+ -+ if (ep->gen == loop_check_gen) -+ return ep->loop_check_depth; -+ hlist_for_each_entry_rcu(epi, &ep->refs, fllink) -+ result = max(result, ep_get_upwards_depth_proc(epi->ep, depth + 1) + 1); -+ ep->gen = loop_check_gen; -+ ep->loop_check_depth = result; -+ return result; - } - - /** -@@ -2197,8 +2215,22 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - */ - static int ep_loop_check(struct eventpoll *ep, struct eventpoll *to) - { -+ int depth, upwards_depth; -+ - inserting_into = ep; -- return ep_loop_check_proc(to, 0); -+ /* -+ * Check how deep down we can get from @to, and whether it is possible -+ * to loop up to @ep. -+ */ -+ depth = ep_loop_check_proc(to, 0); -+ if (depth > EP_MAX_NESTS) -+ return -1; -+ /* Check how far up we can go from @ep. */ -+ rcu_read_lock(); -+ upwards_depth = ep_get_upwards_depth_proc(ep, 0); -+ rcu_read_unlock(); -+ -+ return (depth+1+upwards_depth > EP_MAX_NESTS) ? -1 : 0; - } - - static void clear_tfile_check_list(void) --- -2.50.1 (Apple Git-155) - diff --git a/1442-eventpoll-drop-vestigial-epi-dying-flag.patch b/1442-eventpoll-drop-vestigial-epi-dying-flag.patch deleted file mode 100644 index 499dae72e..000000000 --- a/1442-eventpoll-drop-vestigial-epi-dying-flag.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 3724dc6414c5da5c393e58e0e5863fdb95166922 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:03:26 +0800 -Subject: [PATCH] eventpoll: drop vestigial epi->dying flag - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 07422c948f4bdf15567a129a0983f7c12e57ba8e -Author: Christian Brauner -Date: Thu Apr 23 11:56:13 2026 +0200 - - eventpoll: drop vestigial epi->dying flag - - With ep_remove() now pinning @file via epi_fget() across the - f_ep clear and hlist_del_rcu(), the dying flag no longer - orchestrates anything: it was set in eventpoll_release_file() - (which only runs from __fput(), i.e. after @file's refcount has - reached zero) and read in __ep_remove() / ep_remove() as a cheap - bail before attempting the same synchronization epi_fget() now - provides unconditionally. - - The implication is simple: epi->dying == true always coincides - with file_ref_get(&file->f_ref) == false, because __fput() is - reachable only once the refcount hits zero and the refcount is - monotone in that state. The READ_ONCE(epi->dying) in ep_remove() - therefore selects exactly the same callers that epi_fget() would - reject, just one atomic cheaper. That's not worth a struct - field, a second coordination mechanism, and the comments on - both. - - Refresh the eventpoll_release_file() comment to describe what - actually makes the path race-free now (the pin in ep_remove()). - No functional change: the correctness argument is unchanged, - only the mechanism is now a single one instead of two. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-10-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 88b501a5e709..5228ff9c8742 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -148,13 +148,6 @@ struct epitem { - /* The file descriptor information this item refers to */ - struct epoll_filefd ffd; - -- /* -- * Protected by file->f_lock, true for to-be-released epitem already -- * removed from the "struct file" items list; together with -- * eventpoll->refcount orchestrates "struct eventpoll" disposal -- */ -- bool dying; -- - /* List containing poll wait queues */ - struct eppoll_entry *pwqlist; - -@@ -220,10 +213,7 @@ struct eventpoll { - struct hlist_head refs; - u8 loop_check_depth; - -- /* -- * usage count, used together with epitem->dying to -- * orchestrate the disposal of this struct -- */ -+ /* usage count, orchestrates "struct eventpoll" disposal */ - refcount_t refcount; - - /* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */ -@@ -918,13 +908,10 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - - ep_unregister_pollwait(ep, epi); - -- /* cheap sync with eventpoll_release_file() */ -- if (unlikely(READ_ONCE(epi->dying))) -- return; -- - /* - * If we manage to grab a reference it means we're not in -- * eventpoll_release_file() and aren't going to be. -+ * eventpoll_release_file() and aren't going to be: once @file's -+ * refcount has reached zero, file_ref_get() cannot bring it back. - */ - file = epi_fget(epi); - if (!file) -@@ -1126,15 +1113,15 @@ void eventpoll_release_file(struct file *file) - struct epitem *epi; - - /* -- * Use the 'dying' flag to prevent a concurrent ep_clear_and_put() from -- * touching the epitems list before eventpoll_release_file() can access -- * the ep->mtx. -+ * A concurrent ep_remove() cannot outrace us: it pins @file via -+ * epi_fget(), which fails once __fput() has dropped the refcount -+ * to zero -- the path we're on. So any racing ep_remove() bails -+ * and leaves the epi for us to clean up here. - */ - again: - spin_lock(&file->f_lock); - if (file->f_ep && file->f_ep->first) { - epi = hlist_entry(file->f_ep->first, struct epitem, fllink); -- WRITE_ONCE(epi->dying, true); - spin_unlock(&file->f_lock); - - /* --- -2.50.1 (Apple Git-155) - diff --git a/1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch b/1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch deleted file mode 100644 index 85940ba18..000000000 --- a/1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 2eb0a1e08ebad5be00433093449abf025450ca6d Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Wed, 17 Jun 2026 12:08:43 +0800 -Subject: [PATCH] eventpoll: Fix integer overflow in ep_loop_check_proc() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit fdcfce93073d990ed4b71752e31ad1c1d6e9d58b -Author: Jann Horn -Date: Mon Feb 23 20:59:33 2026 +0100 - - eventpoll: Fix integer overflow in ep_loop_check_proc() - - If a recursive call to ep_loop_check_proc() hits the `result = INT_MAX`, - an integer overflow will occur in the calling ep_loop_check_proc() at - `result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1)`, - breaking the recursion depth check. - - Fix it by using a different placeholder value that can't lead to an - overflow. - - Reported-by: Guenter Roeck - Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion") - Cc: stable@vger.kernel.org - Signed-off-by: Jann Horn - Link: https://patch.msgid.link/20260223-epoll-int-overflow-v1-1-452f35132224@google.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 5228ff9c8742..cb21dfe9ee0a 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -2130,7 +2130,8 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - * @ep: the &struct eventpoll to be currently checked. - * @depth: Current depth of the path being checked. - * -- * Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. -+ * Return: depth of the subtree, or a value bigger than EP_MAX_NESTS if we found -+ * a loop or went too deep. - */ - static int ep_loop_check_proc(struct eventpoll *ep, int depth) - { -@@ -2149,7 +2150,7 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - struct eventpoll *ep_tovisit; - ep_tovisit = epi->ffd.file->private_data; - if (ep_tovisit == inserting_into || depth > EP_MAX_NESTS) -- result = INT_MAX; -+ result = EP_MAX_NESTS+1; - else - result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1); - if (result > EP_MAX_NESTS) --- -2.50.1 (Apple Git-155) - diff --git a/1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch b/1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch deleted file mode 100644 index bc6f290ea..000000000 --- a/1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 39c9ab147e5bc9cf20d146d78c59afc7a0ab488d Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Thu, 18 Jun 2026 11:30:35 +0800 -Subject: [PATCH] eventpoll: refresh epi_fget() / ep_remove_file() comments - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linux - -commit a573cb40f9819c3fe81a43eb10170f8fc8eddc5e -Author: Christian Brauner -Date: Fri Apr 24 15:46:35 2026 +0200 - - eventpoll: refresh epi_fget() / ep_remove_file() comments - - Two comments drifted from the code they sit on. - - epi_fget()'s block comment still referenced atomic_long_inc_not_zero, - which has been file_ref_get() for a while, and described only one of - the function's two roles: safe dereference of epi->ffd.file under - ep->mtx. Since commit a6dc643c6931 ("eventpoll: fix ep_remove struct - eventpoll / struct file UAF") the refcount bump also serves as a pin - that blocks __fput() from starting, which is what lets ep_remove() - touch file->f_lock and file->f_ep without racing - eventpoll_release_file(). Update the block to name both roles and the - commit that introduced the pin role. - - ep_remove_file()'s one-line "See eventpoll_release() for details" - pointed at an inline in include/linux/eventpoll.h but said nothing - about what those details were. Replace it with a short explanation: - we publish NULL so the eventpoll_release() fastpath can skip the slow - path, and this is safe because every f_ep writer either holds a pin - via epi_fget() or is __fput() itself. - - Comment-only; no functional change. - - Signed-off-by: Christian Brauner (Amutable) - Link: https://patch.msgid.link/20260424-work-epoll-rework-v1-4-249ed00a20f3@kernel.org - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index cb21dfe9ee0a..9bde520ac74b 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -817,22 +817,23 @@ static void ep_free(struct eventpoll *ep) - } - - /* -- * The ffd.file pointer may be in the process of being torn down due to -- * being closed, but we may not have finished eventpoll_release() yet. -+ * Pin @epi->ffd.file for operations that require both safe dereference -+ * and exclusion from __fput(). - * -- * Normally, even with the atomic_long_inc_not_zero, the file may have -- * been free'd and then gotten re-allocated to something else (since -- * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -+ * struct file uses SLAB_TYPESAFE_BY_RCU, so a freed slot can be -+ * reassigned at any time. The bare load of epi->ffd.file is safe here -+ * because the caller holds ep->mtx and eventpoll_release_file() blocks -+ * on that mutex while tearing down the epi, so the backing file -+ * allocation cannot be freed and reused under us. An rcu_read_lock() -+ * is therefore unnecessary for the load. - * -- * But for epoll, users hold the ep->mtx mutex, and as such any file in -- * the process of being free'd will block in eventpoll_release_file() -- * and thus the underlying file allocation will not be free'd, and the -- * file re-use cannot happen. -- * -- * For the same reason we can avoid a rcu_read_lock() around the -- * operation - 'ffd.file' cannot go away even if the refcount has -- * reached zero (but we must still not call out to ->poll() functions -- * etc). -+ * A successful file_ref_get() additionally blocks __fput() from -+ * starting on this file: once the refcount has reached zero it cannot -+ * come back. ep_remove() relies on that to touch file->f_lock and -+ * file->f_ep without racing eventpoll_release_file() (see commit -+ * a6dc643c6931). A NULL return means __fput() is already in flight; -+ * the caller must bail without touching the file, and -+ * eventpoll_release_file() will clean the epi up from its side. - */ - static struct file *epi_fget(const struct epitem *epi) - { -@@ -858,7 +859,13 @@ static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - spin_lock(&file->f_lock); - head = file->f_ep; - if (hlist_is_singular_node(&epi->fllink, head)) { -- /* See eventpoll_release() for details. */ -+ /* -+ * Last watcher: publish NULL so the eventpoll_release() -+ * fastpath in include/linux/eventpoll.h can skip the slow -+ * path on a future __fput(). Safe because every f_ep writer -+ * either holds a pin on @file via epi_fget() or is __fput() -+ * itself -- see the comment in eventpoll_release(). -+ */ - WRITE_ONCE(file->f_ep, NULL); - if (!is_file_epoll(file)) { - struct epitems_head *v; --- -2.50.1 (Apple Git-155) - diff --git a/1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch b/1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch deleted file mode 100644 index 46aa7ba93..000000000 --- a/1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 6187a172d6ed57d6b2c327836e4407c6456e639d Mon Sep 17 00:00:00 2001 -From: Ben Morris -Date: Thu, 7 May 2026 17:14:55 -0700 -Subject: [PATCH] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in - SCTP_SENDALL - -commit abb5f36771cc4c05899b34000829a787572a8817 upstream. - -The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with -list_for_each_entry_safe(), which caches the next entry in @tmp before -the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may -drop the socket lock inside sctp_wait_for_sndbuf(). - -While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the -association cached in @tmp, migrating it to a new endpoint via -sctp_sock_migrate() (list_del_init() + list_add_tail() to -newep->asocs), and optionally close the new socket which frees the -association via kfree_rcu(). The cached @tmp can also be freed by a -network ABORT for that association, processed in softirq while the -lock is dropped. - -sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock -via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing -revalidates @tmp. After a successful return, the iterator advances to -the stale @tmp, yielding either a use-after-free (if the peeled socket -was closed) or a list-walk onto the new endpoint's list head (type -confusion of &newep->asocs as a struct sctp_association *). - -Both are reachable from CapEff=0; the type-confusion path gives -controlled indirect call via the outqueue.sched->init_sid pointer. - -Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() -returns. @asoc is known to still be on ep->asocs at that point: the -only callers that list_del an association from ep->asocs are -sctp_association_free() (which sets asoc->base.dead) and -sctp_assoc_migrate() (which changes asoc->base.sk), and -sctp_wait_for_sndbuf() checks both under the lock before any -successful return; a tripped check propagates as err < 0 and the loop -bails before the re-derive. - -The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the -loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so -the @tmp cached by list_for_each_entry_safe() still covers the -lock-held free that ba59fb027307 ("sctp: walk the list of asoc -safely") was added for. - -Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") -Cc: stable@vger.kernel.org -Signed-off-by: Ben Morris -Acked-by: Xin Long -Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index b6956b25b33d..c8038b4b67c7 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -1986,6 +1986,15 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) - goto out_unlock; - - iov_iter_revert(&msg->msg_iter, err); -+ -+ /* sctp_sendmsg_to_asoc() may have released the socket -+ * lock (sctp_wait_for_sndbuf), during which other -+ * associations on ep->asocs could have been peeled -+ * off or freed. @asoc itself is revalidated by the -+ * base.dead and base.sk checks in sctp_wait_for_sndbuf, -+ * so re-derive the cached cursor from it. -+ */ -+ tmp = list_next_entry(asoc, asocs); - } - - goto out_unlock; --- -2.50.1 (Apple Git-155) - diff --git a/1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch b/1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch deleted file mode 100644 index 11010b35a..000000000 --- a/1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch +++ /dev/null @@ -1,227 +0,0 @@ -From 06bfb66a7c8b45e3fed01351a4b087410ae5ef39 Mon Sep 17 00:00:00 2001 -From: Jamal Hadi Salim -Date: Fri, 28 Nov 2025 10:19:19 -0500 -Subject: [PATCH] net/sched: ets: Always remove class from active list before - deleting in ets_qdisc_change - -[ Upstream commit ce052b9402e461a9aded599f5b47e76bc727f7de ] - -zdi-disclosures@trendmicro.com says: - -The vulnerability is a race condition between `ets_qdisc_dequeue` and -`ets_qdisc_change`. It leads to UAF on `struct Qdisc` object. -Attacker requires the capability to create new user and network namespace -in order to trigger the bug. -See my additional commentary at the end of the analysis. - -Analysis: - -static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - struct netlink_ext_ack *extack) -{ -... - - // (1) this lock is preventing .change handler (`ets_qdisc_change`) - //to race with .dequeue handler (`ets_qdisc_dequeue`) - sch_tree_lock(sch); - - for (i = nbands; i < oldbands; i++) { - if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) - list_del_init(&q->classes[i].alist); - qdisc_purge_queue(q->classes[i].qdisc); - } - - WRITE_ONCE(q->nbands, nbands); - for (i = nstrict; i < q->nstrict; i++) { - if (q->classes[i].qdisc->q.qlen) { - // (2) the class is added to the q->active - list_add_tail(&q->classes[i].alist, &q->active); - q->classes[i].deficit = quanta[i]; - } - } - WRITE_ONCE(q->nstrict, nstrict); - memcpy(q->prio2band, priomap, sizeof(priomap)); - - for (i = 0; i < q->nbands; i++) - WRITE_ONCE(q->classes[i].quantum, quanta[i]); - - for (i = oldbands; i < q->nbands; i++) { - q->classes[i].qdisc = queues[i]; - if (q->classes[i].qdisc != &noop_qdisc) - qdisc_hash_add(q->classes[i].qdisc, true); - } - - // (3) the qdisc is unlocked, now dequeue can be called in parallel - // to the rest of .change handler - sch_tree_unlock(sch); - - ets_offload_change(sch); - for (i = q->nbands; i < oldbands; i++) { - // (4) we're reducing the refcount for our class's qdisc and - // freeing it - qdisc_put(q->classes[i].qdisc); - // (5) If we call .dequeue between (4) and (5), we will have - // a strong UAF and we can control RIP - q->classes[i].qdisc = NULL; - WRITE_ONCE(q->classes[i].quantum, 0); - q->classes[i].deficit = 0; - gnet_stats_basic_sync_init(&q->classes[i].bstats); - memset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats)); - } - return 0; -} - -Comment: -This happens because some of the classes have their qdiscs assigned to -NULL, but remain in the active list. This commit fixes this issue by always -removing the class from the active list before deleting and freeing its -associated qdisc - -Reproducer Steps -(trimmed version of what was sent by zdi-disclosures@trendmicro.com) - -``` -DEV="${DEV:-lo}" -ROOT_HANDLE="${ROOT_HANDLE:-1:}" -BAND2_HANDLE="${BAND2_HANDLE:-20:}" # child under 1:2 -PING_BYTES="${PING_BYTES:-48}" -PING_COUNT="${PING_COUNT:-200000}" -PING_DST="${PING_DST:-127.0.0.1}" - -SLOW_TBF_RATE="${SLOW_TBF_RATE:-8bit}" -SLOW_TBF_BURST="${SLOW_TBF_BURST:-100b}" -SLOW_TBF_LAT="${SLOW_TBF_LAT:-1s}" - -cleanup() { - tc qdisc del dev "$DEV" root 2>/dev/null -} -trap cleanup EXIT - -ip link set "$DEV" up - -tc qdisc del dev "$DEV" root 2>/dev/null || true - -tc qdisc add dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2 - -tc qdisc add dev "$DEV" parent 1:2 handle "$BAND2_HANDLE" \ - tbf rate "$SLOW_TBF_RATE" burst "$SLOW_TBF_BURST" latency "$SLOW_TBF_LAT" - -tc filter add dev "$DEV" parent 1: protocol all prio 1 u32 match u32 0 0 flowid 1:2 -tc -s qdisc ls dev $DEV - -ping -I "$DEV" -f -c "$PING_COUNT" -s "$PING_BYTES" -W 0.001 "$PING_DST" \ - >/dev/null 2>&1 & -tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 0 -tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2 -tc -s qdisc ls dev $DEV -tc qdisc del dev "$DEV" parent 1:2 || true -tc -s qdisc ls dev $DEV -tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 1 strict 1 -``` - -KASAN report -``` -================================================================== -BUG: KASAN: slab-use-after-free in ets_qdisc_dequeue+0x1071/0x11b0 kernel/net/sched/sch_ets.c:481 -Read of size 8 at addr ffff8880502fc018 by task ping/12308 -> -CPU: 0 UID: 0 PID: 12308 Comm: ping Not tainted 6.18.0-rc4-dirty #1 PREEMPT(full) -Hardware name: QEMU Ubuntu 25.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 -Call Trace: - - __dump_stack kernel/lib/dump_stack.c:94 - dump_stack_lvl+0x100/0x190 kernel/lib/dump_stack.c:120 - print_address_description kernel/mm/kasan/report.c:378 - print_report+0x156/0x4c9 kernel/mm/kasan/report.c:482 - kasan_report+0xdf/0x110 kernel/mm/kasan/report.c:595 - ets_qdisc_dequeue+0x1071/0x11b0 kernel/net/sched/sch_ets.c:481 - dequeue_skb kernel/net/sched/sch_generic.c:294 - qdisc_restart kernel/net/sched/sch_generic.c:399 - __qdisc_run+0x1c9/0x1b00 kernel/net/sched/sch_generic.c:417 - __dev_xmit_skb kernel/net/core/dev.c:4221 - __dev_queue_xmit+0x2848/0x4410 kernel/net/core/dev.c:4729 - dev_queue_xmit kernel/./include/linux/netdevice.h:3365 -[...] - -Allocated by task 17115: - kasan_save_stack+0x30/0x50 kernel/mm/kasan/common.c:56 - kasan_save_track+0x14/0x30 kernel/mm/kasan/common.c:77 - poison_kmalloc_redzone kernel/mm/kasan/common.c:400 - __kasan_kmalloc+0xaa/0xb0 kernel/mm/kasan/common.c:417 - kasan_kmalloc kernel/./include/linux/kasan.h:262 - __do_kmalloc_node kernel/mm/slub.c:5642 - __kmalloc_node_noprof+0x34e/0x990 kernel/mm/slub.c:5648 - kmalloc_node_noprof kernel/./include/linux/slab.h:987 - qdisc_alloc+0xb8/0xc30 kernel/net/sched/sch_generic.c:950 - qdisc_create_dflt+0x93/0x490 kernel/net/sched/sch_generic.c:1012 - ets_class_graft+0x4fd/0x800 kernel/net/sched/sch_ets.c:261 - qdisc_graft+0x3e4/0x1780 kernel/net/sched/sch_api.c:1196 -[...] - -Freed by task 9905: - kasan_save_stack+0x30/0x50 kernel/mm/kasan/common.c:56 - kasan_save_track+0x14/0x30 kernel/mm/kasan/common.c:77 - __kasan_save_free_info+0x3b/0x70 kernel/mm/kasan/generic.c:587 - kasan_save_free_info kernel/mm/kasan/kasan.h:406 - poison_slab_object kernel/mm/kasan/common.c:252 - __kasan_slab_free+0x5f/0x80 kernel/mm/kasan/common.c:284 - kasan_slab_free kernel/./include/linux/kasan.h:234 - slab_free_hook kernel/mm/slub.c:2539 - slab_free kernel/mm/slub.c:6630 - kfree+0x144/0x700 kernel/mm/slub.c:6837 - rcu_do_batch kernel/kernel/rcu/tree.c:2605 - rcu_core+0x7c0/0x1500 kernel/kernel/rcu/tree.c:2861 - handle_softirqs+0x1ea/0x8a0 kernel/kernel/softirq.c:622 - __do_softirq kernel/kernel/softirq.c:656 -[...] - -Commentary: - -1. Maher Azzouzi working with Trend Micro Zero Day Initiative was reported as -the person who found the issue. I requested to get a proper email to add to the -reported-by tag but got no response. For this reason i will credit the person -i exchanged emails with i.e zdi-disclosures@trendmicro.com - -2. Neither i nor Victor who did a much more thorough testing was able to -reproduce a UAF with the PoC or other approaches we tried. We were both able to -reproduce a null ptr deref. After exchange with zdi-disclosures@trendmicro.com -they sent a small change to be made to the code to add an extra delay which -was able to simulate the UAF. i.e, this: - qdisc_put(q->classes[i].qdisc); - mdelay(90); - q->classes[i].qdisc = NULL; - -I was informed by Thomas Gleixner(tglx@linutronix.de) that adding delays was -acceptable approach for demonstrating the bug, quote: -"Adding such delays is common exploit validation practice" -The equivalent delay could happen "by virt scheduling the vCPU out, SMIs, -NMIs, PREEMPT_RT enabled kernel" - -3. I asked the OP to test and report back but got no response and after a -few days gave up and proceeded to submit this fix. - -Fixes: de6d25924c2a ("net/sched: sch_ets: don't peek at classes beyond 'nbands'") -Reported-by: zdi-disclosures@trendmicro.com -Tested-by: Victor Nogueira -Signed-off-by: Jamal Hadi Salim -Reviewed-by: Davide Caratti -Link: https://patch.msgid.link/20251128151919.576920-1-jhs@mojatatu.com -Signed-off-by: Paolo Abeni -Signed-off-by: Sasha Levin - -diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c -index 82635dd2cfa5..ae46643e596d 100644 ---- a/net/sched/sch_ets.c -+++ b/net/sched/sch_ets.c -@@ -652,7 +652,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - sch_tree_lock(sch); - - for (i = nbands; i < oldbands; i++) { -- if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) -+ if (cl_is_active(&q->classes[i])) - list_del_init(&q->classes[i].alist); - qdisc_purge_queue(q->classes[i].qdisc); - } --- -2.50.1 (Apple Git-155) - diff --git a/1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch b/1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch deleted file mode 100644 index df33630b1..000000000 --- a/1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 06c19c967b845b63172601fe459667d973b7e6b7 Mon Sep 17 00:00:00 2001 -From: Sean Christopherson -Date: Tue, 5 May 2026 08:59:56 +0200 -Subject: [PATCH] KVM: x86: Fix shadow paging use-after-free due to unexpected - GFN - -commit 0cb2af2ea66ad8ff195c156ea690f11216285bdf upstream. - -The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus -the SPTE index. This assumption breaks for shadow paging if the guest -page tables are modified between VM entries (similar to commit -aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even -when creating an MMIO SPTE", 2026-03-27). The flow is as follows: - -- a PDE is installed for a 2MB mapping, and a page in that area is - accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; - the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because - the guest's mapping is a huge page (and thus contiguous). - -- the PDE mapping is changed from outside the guest. - -- the guest accesses another page in the same 2MB area. KVM installs - a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN - (i.e. based on the new mapping, as changed in the previous step) but - that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore - the rmap entry cannot be found and removed when the kvm_mmu_page - is zapped. - -- the memslot that covers the first 2MB mapping is deleted, and the - kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() - only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, - and fails to find the rmap entry that was recorded by step 3. - -- any operation that causes an rmap walk for the same page accessed - by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. - This includes dirty logging or MMU notifier invalidations (e.g., from - MADV_DONTNEED). - -The underlying issue is that KVM's walking of shadow PTEs assumes that -if a SPTE is present when KVM wants to install a non-leaf SPTE, then the -existing kvm_mmu_page must be for the correct gfn. Because the only way -for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... -which shouldn't happen, but *actually* only happens in response to a -guest write. - -That bug dates back literally forever, as even the first version of KVM -assumes that the GFN matches and walks into the "wrong" shadow page. -However, that was only an imprecision until 2032a93d66fa ("KVM: MMU: -Don't allocate gfns page for direct mmu pages") came along. - -Fix it by checking for a target gfn mismatch and zapping the existing -SPTE. That way the old SP and rmap entries are gone, KVM installs -the rmap in the right location, and everyone is happy. - -Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") -Fixes: 6aa8b732ca01 ("kvm: userspace interface") -Reported-by: Alexander Bulekov -Reported-by: Fred Griffoul -Cc: stable@vger.kernel.org -Signed-off-by: Sean Christopherson -Link: https://patch.msgid.link/20260503201029.106481-1-pbonzini@redhat.com/ -Signed-off-by: Paolo Bonzini -Signed-off-by: Sasha Levin - -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index e82da76e1..274223ef0 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -182,6 +182,8 @@ static struct kmem_cache *pte_list_desc_cache; - struct kmem_cache *mmu_page_header_cache; - - static void mmu_spte_set(u64 *sptep, u64 spte); -+static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp, -+ u64 *spte, struct list_head *invalid_list); - - struct kvm_mmu_role_regs { - const unsigned long cr0; -@@ -1283,19 +1285,6 @@ static void drop_spte(struct kvm *kvm, u64 *sptep) - rmap_remove(kvm, sptep); - } - --static void drop_large_spte(struct kvm *kvm, u64 *sptep, bool flush) --{ -- struct kvm_mmu_page *sp; -- -- sp = sptep_to_sp(sptep); -- WARN_ON_ONCE(sp->role.level == PG_LEVEL_4K); -- -- drop_spte(kvm, sptep); -- -- if (flush) -- kvm_flush_remote_tlbs_sptep(kvm, sptep); --} -- - /* - * Write-protect on the specified @sptep, @pt_protect indicates whether - * spte write-protection is caused by protecting shadow page table. -@@ -2462,7 +2451,8 @@ static struct kvm_mmu_page *kvm_mmu_get_child_sp(struct kvm_vcpu *vcpu, - { - union kvm_mmu_page_role role; - -- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep)) -+ if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) && -+ spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn) - return ERR_PTR(-EEXIST); - - role = kvm_mmu_child_role(sptep, direct, access); -@@ -2540,13 +2530,16 @@ static void __link_shadow_page(struct kvm *kvm, - - BUILD_BUG_ON(VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK); - -- /* -- * If an SPTE is present already, it must be a leaf and therefore -- * a large one. Drop it, and flush the TLB if needed, before -- * installing sp. -- */ -- if (is_shadow_present_pte(*sptep)) -- drop_large_spte(kvm, sptep, flush); -+ if (is_shadow_present_pte(*sptep)) { -+ struct kvm_mmu_page *parent_sp; -+ LIST_HEAD(invalid_list); -+ -+ parent_sp = sptep_to_sp(sptep); -+ WARN_ON_ONCE(parent_sp->role.level == PG_LEVEL_4K); -+ -+ mmu_page_zap_pte(kvm, parent_sp, sptep, &invalid_list); -+ kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, true); -+ } - - spte = make_nonleaf_spte(sp->spt, sp_ad_disabled(sp)); - diff --git a/1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch b/1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch deleted file mode 100644 index 52375295b..000000000 --- a/1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 2ad3afa40ac6aa340dada122f9abfa46c0a6eb35 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Fri, 26 Jun 2026 13:24:04 +0200 -Subject: [PATCH] KVM: x86: Fix shadow paging use-after-free due to unexpected - role - -commit 81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb upstream. - -Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due -to unexpected GFN") fixed a shadow paging mismatch between stored and -computed GFNs; the bug could be triggered by changing a PDE mapping from -outside the guest, and then deleting a memslot. The rmap_remove() -call would miss entries created after the PDE change because the GFN -of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. - -A similar hole however remains if the modified PDE points to a non-leaf -page. In this case the gfn can be made to match, but the role does not -match: the original large 2MB page creates a kvm_mmu_page with direct=1, -while the new 4KB needs a kvm_mmu_page with direct=0. However, -kvm_mmu_get_child_sp() does not compare the role, and therefore reuses -the page. - -The next step is installing a leaf (4KB) SPTE on the new path which -records an rmap entry under the gfn resolved by the walk. But when -that child is zapped its parent kvm_mmu_page has direct=1 and -kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as -sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] -in older kernels). It therefore fails to remove the recorded entry. - -When the memslot is dropped the shadow page is freed but the rmap -entry survives, as in the scenario that was already fixed. Code that -later walks that gfn (dirty logging, MMU notifier invalidation, and -so on) dereferences an sptep that lies in the freed page, causing the -use-after-free. - -Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") -Reported-by: Hyunwoo Kim -Signed-off-by: Paolo Bonzini -Signed-off-by: Sasha Levin - -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index 274223ef0..641589165 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -2449,13 +2449,15 @@ static struct kvm_mmu_page *kvm_mmu_get_child_sp(struct kvm_vcpu *vcpu, - u64 *sptep, gfn_t gfn, - bool direct, unsigned int access) - { -- union kvm_mmu_page_role role; -+ union kvm_mmu_page_role role = kvm_mmu_child_role(sptep, direct, access); - -- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) && -- spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn) -+ if (is_shadow_present_pte(*sptep) && -+ !is_large_pte(*sptep) && -+ spte_to_child_sp(*sptep) && -+ spte_to_child_sp(*sptep)->gfn == gfn && -+ spte_to_child_sp(*sptep)->role.word == role.word) - return ERR_PTR(-EEXIST); - -- role = kvm_mmu_child_role(sptep, direct, access); - return kvm_mmu_get_shadow_page(vcpu, gfn, role); - } - diff --git a/1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch b/1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch deleted file mode 100644 index 61ed42bdf..000000000 --- a/1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 622d621bf4f92efbab9f783c7b3068020a577061 Mon Sep 17 00:00:00 2001 -From: Nigel Croxon -Date: Thu, 7 May 2026 06:08:27 -0400 -Subject: [PATCH] md/bitmap: fix GPF in write_page caused by resize race - -JIRA: https://issues.redhat.com/browse/RHEL-129337 - -CVE: CVE-2026-43163 - -commit 46ef85f854dfa9d5226b3c1c46493d79556c9589 -Author: Jack Wang -Date: Tue Jan 20 11:24:56 2026 +0100 - -md/bitmap: fix GPF in write_page caused by resize race - -A General Protection Fault occurs in write_page() during array resize: -RIP: 0010:write_page+0x22b/0x3c0 [md_mod] - -This is a use-after-free race between bitmap_daemon_work() and -__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap` -without locking, while the resize path frees that storage via -md_bitmap_file_unmap(). `quiesce()` does not stop the md thread, -allowing concurrent access to freed pages. - -Fix by holding `mddev->bitmap_info.mutex` during the bitmap update. - -Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com -Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u -Cc: stable@vger.kernel.org -Fixes: d60b479d177a ("md/bitmap: add bitmap_resize function to allow bitmap resizing.") -Signed-off-by: Jack Wang -Signed-off-by: Yu Kuai -(cherry picked from commit 46ef85f854dfa9d5226b3c1c46493d79556c9589) -Signed-off-by: Nigel Croxon - -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 84b7e2af6dba..7bb56d0491a2 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -2453,6 +2453,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks, - memcpy(page_address(store.sb_page), - page_address(bitmap->storage.sb_page), - sizeof(bitmap_super_t)); -+ mutex_lock(&bitmap->mddev->bitmap_info.mutex); - spin_lock_irq(&bitmap->counts.lock); - md_bitmap_file_unmap(&bitmap->storage); - bitmap->storage = store; -@@ -2560,7 +2561,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks, - set_page_attr(bitmap, i, BITMAP_PAGE_DIRTY); - } - spin_unlock_irq(&bitmap->counts.lock); -- -+ mutex_unlock(&bitmap->mddev->bitmap_info.mutex); - if (!init) { - __bitmap_unplug(bitmap); - bitmap->mddev->pers->quiesce(bitmap->mddev, 0); --- -2.50.1 (Apple Git-155) - diff --git a/1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch b/1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch deleted file mode 100644 index 389d75644..000000000 --- a/1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 7bba8926cefe321fdcbe281278ddaeb0a8f8cc2b Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Tue, 28 Apr 2026 15:46:48 -0400 -Subject: [PATCH] rtmutex: Use waiter::task instead of current in - remove_waiter() - -JIRA: https://redhat.atlassian.net/browse/RHEL-171746 - -commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 -Author: Keenan Dong -Date: Wed, 8 Apr 2026 16:46:00 +0800 - - rtmutex: Use waiter::task instead of current in remove_waiter() - - remove_waiter() is used by the slowlock paths, but it is also used for - proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from - futex_requeue(). - - In the latter case waiter::task is not current, but remove_waiter() - operates on current for the dequeue operation. That results in several - problems: - - 1) the rbtree dequeue happens without waiter::task::pi_lock being held - - 2) the waiter task's pi_blocked_on state is not cleared, which leaves a - dangling pointer primed for UAF around. - - 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter - task - - Use waiter::task instead of current in all related operations in - remove_waiter() to cure those problems. - - [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the - changelog ] - - Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock") - Reported-by: Yuan Tan - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Reported-by: Xin Liu - Signed-off-by: Keenan Dong - Signed-off-by: Thomas Gleixner - Cc: stable@vger.kernel.org - -Signed-off-by: Waiman Long - -diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c -index 4a8df1800cbb..e6f305dea2a6 100644 ---- a/kernel/locking/rtmutex.c -+++ b/kernel/locking/rtmutex.c -@@ -1534,20 +1534,23 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock, - * - * Must be called with lock->wait_lock held and interrupts disabled. It must - * have just failed to try_to_take_rt_mutex(). -+ * -+ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current ! - */ - static void __sched remove_waiter(struct rt_mutex_base *lock, - struct rt_mutex_waiter *waiter) - { - bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock)); - struct task_struct *owner = rt_mutex_owner(lock); -+ struct task_struct *waiter_task = waiter->task; - struct rt_mutex_base *next_lock; - - lockdep_assert_held(&lock->wait_lock); - -- raw_spin_lock(¤t->pi_lock); -- rt_mutex_dequeue(lock, waiter); -- current->pi_blocked_on = NULL; -- raw_spin_unlock(¤t->pi_lock); -+ scoped_guard(raw_spinlock, &waiter_task->pi_lock) { -+ rt_mutex_dequeue(lock, waiter); -+ waiter_task->pi_blocked_on = NULL; -+ } - - /* - * Only update priority if the waiter was the highest priority -@@ -1583,7 +1586,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, - raw_spin_unlock_irq(&lock->wait_lock); - - rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock, -- next_lock, NULL, current); -+ next_lock, NULL, waiter_task); - - raw_spin_lock_irq(&lock->wait_lock); - } --- -2.50.1 (Apple Git-155) - diff --git a/1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch b/1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch deleted file mode 100644 index d077011a0..000000000 --- a/1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 5799f9bd7fee40370b93ab1ddf001cdc7017c14d Mon Sep 17 00:00:00 2001 -From: Davidlohr Bueso -Date: Tue, 16 Jun 2026 15:06:01 -0400 -Subject: [PATCH] locking/rtmutex: Skip remove_waiter() when waiter is not - enqueued - -[ Upstream commit 40a25d59e85b3c8709ac2424d44f65610467871e ] - -syzbot triggered the following splat in remove_waiter() via -FUTEX_CMP_REQUEUE_PI: - - KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] - class_raw_spinlock_constructor - remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 - rt_mutex_start_proxy_lock+0x103/0x120 - futex_requeue+0x10e4/0x20d0 - __x64_sys_futex+0x34f/0x4d0 - -task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, -leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead -of current in remove_waiter()") made this fatal. - -Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() -upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock -return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() -(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to -account for try_to_take_rt_mutex(). - -Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") -Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com -Signed-off-by: Davidlohr Bueso -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org -Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ -Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman - -diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c -index 8fdbd2931801..7110ee98391e 100644 ---- a/kernel/locking/rtmutex.c -+++ b/kernel/locking/rtmutex.c -@@ -1550,6 +1550,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, - - lockdep_assert_held(&lock->wait_lock); - -+ if (!waiter_task) /* never enqueued */ -+ return; -+ - scoped_guard(raw_spinlock, &waiter_task->pi_lock) { - rt_mutex_dequeue(lock, waiter); - waiter_task->pi_blocked_on = NULL; -diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c -index 2bc14c049a64..091b109acdc5 100644 ---- a/kernel/locking/rtmutex_api.c -+++ b/kernel/locking/rtmutex_api.c -@@ -347,7 +347,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock, - - raw_spin_lock_irq(&lock->wait_lock); - ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q); -- if (unlikely(ret)) -+ if (unlikely(ret < 0)) - remove_waiter(lock, waiter); - preempt_disable(); - raw_spin_unlock_irq(&lock->wait_lock); --- -2.50.1 (Apple Git-155) - diff --git a/1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch b/1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch deleted file mode 100644 index c8d3af944..000000000 --- a/1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 74e144274af39935b0f410c0ee4d2b91c3730414 Mon Sep 17 00:00:00 2001 -From: Ji'an Zhou -Date: Tue, 2 Jun 2026 09:12:04 +0000 -Subject: [PATCH] futex/requeue: Prevent NULL pointer dereference in - remove_waiter() on self-deadlock - -When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the -target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting -waiter->task. - -The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences -the NULL waiter->task, causing a kernel crash. - -Add a self-deadlock check for non-top waiters before calling -rt_mutex_start_proxy_lock(), analogous to the top-waiter check in -futex_lock_pi_atomic(). - -Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") -Signed-off-by: Ji'an Zhou -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org - -diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c -index b597cb3d17fc..1d99a84dc9ad 100644 ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -643,6 +643,12 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1, - continue; - } - -+ /* Self-deadlock: non-top waiter already owns the PI futex. */ -+ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { -+ ret = -EDEADLK; -+ break; -+ } -+ - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, - this->rt_waiter, - this->task); --- -2.50.1 (Apple Git-155) - diff --git a/1455-futex-requeue-revert-prevent-null-pointer-dereference.patch b/1455-futex-requeue-revert-prevent-null-pointer-dereference.patch deleted file mode 100644 index 1aeddd19c..000000000 --- a/1455-futex-requeue-revert-prevent-null-pointer-dereference.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 39def6d250d370298f86c116f4ac60093cefadaa Mon Sep 17 00:00:00 2001 -From: Sebastian Andrzej Siewior -Date: Wed, 1 Jul 2026 15:11:50 +0200 -Subject: [PATCH] futex/requeue: Revert "Prevent NULL pointer dereference in - remove_waiter() on self-deadlock"" - -The commit cited below should not have been merged. It attemted to fix an -existing problem ansd thereby introduced new problems by keeping the -pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it. - -Based on the commit description the intention was to handle the case -when task_blocks_on_rt_mutex() returns -EDEADLK and the following -remove_waiter() dereferences the NULL pointer in waiter->task. - -That is already handled by Davidlohr in commit 40a25d59e85b3 -("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and -requires no further acting. - -Revert the commit breaking the "waiter == owner" case again. - -Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock") -Reported-by: Michael Bommarito -Signed-off-by: Sebastian Andrzej Siewior -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org -Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de -Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com - -diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c -index 7384672916fb..79823ad13683 100644 ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -645,12 +645,6 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1, - continue; - } - -- /* Self-deadlock: non-top waiter already owns the PI futex. */ -- if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { -- ret = -EDEADLK; -- break; -- } -- - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, - this->rt_waiter, - this->task); --- -2.50.1 (Apple Git-155) - diff --git a/1456-xfrm-esp-restore-combined-single-frag-length-gate.patch b/1456-xfrm-esp-restore-combined-single-frag-length-gate.patch deleted file mode 100644 index c89982551..000000000 --- a/1456-xfrm-esp-restore-combined-single-frag-length-gate.patch +++ /dev/null @@ -1,61 +0,0 @@ -From b84091ceddc9f133229dceab3ccc930bf27f9cba Mon Sep 17 00:00:00 2001 -From: Jingguo Tan -Date: Mon, 18 May 2026 17:06:48 +0800 -Subject: [PATCH] xfrm: esp: restore combined single-frag length gate - -commit dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40 upstream. - -The ESP out-of-place fast path appends the trailer in esp_output_head() -before esp_output_tail() allocates the destination page frag. The -head-side gate currently checks skb->data_len and tailen separately, but -the tail code allocates a single destination frag from the combined -post-trailer skb->data_len. - -Reject the page-frag fast path when the combined aligned length exceeds a -page. Otherwise skb_page_frag_refill() may fall back to a single page while -the destination sg still spans the combined skb->data_len. - -Restore this combined-length page gate for both IPv4 and IPv6. - -Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page") -Cc: stable@vger.kernel.org -Signed-off-by: Lin Ma -Signed-off-by: Chenyuan Mi -Signed-off-by: Jingguo Tan -Reviewed-by: Sabrina Dubroca -Signed-off-by: Steffen Klassert -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index 2f548900e238..6c8c789ded0e 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -419,8 +419,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * - return err; - } - -- if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE || -- ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE) -+ if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) > -+ PAGE_SIZE) - goto cow; - - if (!skb_cloned(skb)) { -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index a797d5740d9b..80981596236a 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -448,8 +448,8 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info - return err; - } - -- if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE || -- ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE) -+ if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) > -+ PAGE_SIZE) - goto cow; - - if (!skb_cloned(skb)) { --- -2.50.1 (Apple Git-155) - diff --git a/1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch b/1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch deleted file mode 100644 index 8603d44bc..000000000 --- a/1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch +++ /dev/null @@ -1,109 +0,0 @@ -From d950b01691adb16980f23b10c7535b17ced653c7 Mon Sep 17 00:00:00 2001 -From: Carlos Maiolino -Date: Fri, 10 Jul 2026 08:59:28 +0200 -Subject: [PATCH] xfs: resample the data fork mapping after cycling ILOCK - -JIRA: https://redhat.atlassian.net/browse/RHEL-193944 -Upstream Status: git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git -commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 -Author: Darrick J. Wong - - xfs: resample the data fork mapping after cycling ILOCK - - xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, - a data fork mapping, and a cow fork mapping. Unfortunately, these two - helpers cycle the ILOCK to grab a transaction, which means that the - mappings are stale as soon as we reacquire the ILOCK. Currently we - refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but - we don't refresh the data fork mapping beforehand, which means that the - xfs_bmap_trim_cow in that function queries the refcount btree about the - wrong physical blocks and returns an inaccurate value in *shared. - - If *shared is now false, the directio write proceeds with a stale data - fork mapping. Fix this by querying the data fork mapping if the - sequence counter changes across the ILOCK cycle. - - Cc: hch@lst.de - Cc: stable@vger.kernel.org # v4.11 - Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin") - Signed-off-by: "Darrick J. Wong" - Reviewed-by: Christoph Hellwig - Reviewed-by: Carlos Maiolino - Signed-off-by: Carlos Maiolino - -Signed-off-by: Carlos Maiolino ---- - fs/xfs/xfs_reflink.c | 36 ++++++++++++++++++++++++++++++++++++ - 1 file changed, 36 insertions(+) - -diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c -index c077e2673676..05ec77b6561c 100644 ---- a/fs/xfs/xfs_reflink.c -+++ b/fs/xfs/xfs_reflink.c -@@ -440,6 +440,7 @@ xfs_reflink_fill_cow_hole( - struct xfs_mount *mp = ip->i_mount; - struct xfs_trans *tp; - xfs_filblks_t resaligned; -+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); - unsigned int dblocks = 0, rblocks = 0; - int nimaps; - int error; -@@ -465,6 +466,22 @@ xfs_reflink_fill_cow_hole( - - *lockmode = XFS_ILOCK_EXCL; - -+ /* -+ * The data fork mapping may have changed while we dropped the ILOCK -+ * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full -+ * CoW cycle including xfs_reflink_end_cow(), which remaps this offset -+ * and drops the refcount of the old shared block). Re-read it so the -+ * shared-status recheck below and the caller's in-place iomap both -+ * operate on the current mapping rather than a stale physical block. -+ */ -+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { -+ nimaps = 1; -+ error = xfs_bmapi_read(ip, imap->br_startoff, -+ imap->br_blockcount, imap, &nimaps, 0); -+ if (error) -+ goto out_trans_cancel; -+ } -+ - error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found); - if (error || !*shared) - goto out_trans_cancel; -@@ -511,6 +528,8 @@ xfs_reflink_fill_delalloc( - bool found; - - do { -+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); -+ - xfs_iunlock(ip, *lockmode); - *lockmode = 0; - -@@ -521,6 +540,23 @@ xfs_reflink_fill_delalloc( - - *lockmode = XFS_ILOCK_EXCL; - -+ /* -+ * The data fork mapping may have changed while we dropped the -+ * ILOCK (a racing O_DIRECT writer under IOLOCK_SHARED can -+ * complete a full CoW cycle including xfs_reflink_end_cow(), -+ * which remaps this offset and drops the refcount of the old -+ * shared block). Re-read it so the shared-status recheck -+ * below and the caller's in-place iomap both operate on the -+ * current mapping rather than a stale physical block. -+ */ -+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { -+ nimaps = 1; -+ error = xfs_bmapi_read(ip, imap->br_startoff, -+ imap->br_blockcount, imap, &nimaps, 0); -+ if (error) -+ goto out_trans_cancel; -+ } -+ - error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, - &found); - if (error || !*shared) --- -GitLab - diff --git a/1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch b/1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch deleted file mode 100644 index e873f1b3b..000000000 --- a/1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch +++ /dev/null @@ -1,42 +0,0 @@ -From bb01d8f1f385bc9034ca114d3508c7fdea24fc9a Mon Sep 17 00:00:00 2001 -From: Paul Moses -Date: Wed, 1 Apr 2026 03:07:49 -0500 -Subject: [PATCH] crypto: ccp - copy IV using skcipher ivsize - -[ Upstream commit a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 ] - -AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. - -ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV -buffer while RFC3686 skciphers expose an 8-byte IV, so the restore -overruns the provided buffer. - -Use crypto_skcipher_ivsize() to copy only the algorithm's IV length. - -Fixes: 2b789435d7f3 ("crypto: ccp - CCP AES crypto API support") -Signed-off-by: Paul Moses -Reviewed-by: Tom Lendacky -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin - -diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c -index d11daaf47f06..871886826cf0 100644 ---- a/drivers/crypto/ccp/ccp-crypto-aes.c -+++ b/drivers/crypto/ccp/ccp-crypto-aes.c -@@ -29,8 +29,11 @@ static int ccp_aes_complete(struct crypto_async_request *async_req, int ret) - if (ret) - return ret; - -- if (ctx->u.aes.mode != CCP_AES_MODE_ECB) -- memcpy(req->iv, rctx->iv, AES_BLOCK_SIZE); -+ if (ctx->u.aes.mode != CCP_AES_MODE_ECB) { -+ size_t ivsize = crypto_skcipher_ivsize(crypto_skcipher_reqtfm(req)); -+ -+ memcpy(req->iv, rctx->iv, ivsize); -+ } - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/Makefile.rhelver b/Makefile.rhelver index 3b68c7355..d1c9acc5b 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 2 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 211.7.1 +RHEL_RELEASE = 211.34.1 # # RHEL_REBASE_NUM diff --git a/gating.yaml b/gating.yaml index 3239293cb..3bd511200 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,18 +4,10 @@ product_versions: decision_context: osci_compose_gate rules: - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-64k-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-64k-debug-aarch64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-debug-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-debug-ppc64le.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-debug-s390x.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-debug-x86_64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-ppc64le.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-64k-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-64k-debug-aarch64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-debug-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-debug-x86_64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-x86_64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-s390x.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-x86_64.tier1.functional} diff --git a/kernel.changelog b/kernel.changelog index 1d44816fc..7b520ed97 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,433 @@ +* Mon Jul 13 2026 CKI KWF Bot [6.12.0-211.34.1.el10_2] +- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} +- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] +- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] +Resolves: RHEL-178326, RHEL-188463, RHEL-193945 + +* Thu Jul 09 2026 CKI KWF Bot [6.12.0-211.33.1.el10_2] +- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} +- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} +- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} +- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} +- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} +Resolves: RHEL-174092, RHEL-193153, RHEL-193250 + +* Tue Jul 07 2026 CKI KWF Bot [6.12.0-211.32.1.el10_2] +- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} +- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} +- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} +- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} +Resolves: RHEL-179854, RHEL-183007, RHEL-186698, RHEL-192407 + +* Mon Jul 06 2026 CKI KWF Bot [6.12.0-211.31.1.el10_2] +- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] +- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] +- eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] +- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} +- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] +- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] +- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] +- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} +- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] +- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] +- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] +- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] +- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] +- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] +- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} +- epoll: annotate racy check (Ian Kent) [RHEL-180776] +- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} +- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] +- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] +- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} +- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} +- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} +- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} +- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] +Resolves: RHEL-162140, RHEL-173832, RHEL-174786, RHEL-180048, RHEL-180277, RHEL-180776, RHEL-181902, RHEL-182770 + +* Wed Jul 01 2026 CKI KWF Bot [6.12.0-211.30.1.el10_2] +- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] +- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] +- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} +- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} +- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} +- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} +- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} +- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} +- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} +- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} +- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] +- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] +- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] +- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] +- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] +- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} +- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} +- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} +- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} +- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} +Resolves: RHEL-179566, RHEL-179912, RHEL-181936, RHEL-182537, RHEL-183592, RHEL-183965, RHEL-185110, RHEL-189491, RHEL-191349 + +* Mon Jun 29 2026 CKI KWF Bot [6.12.0-211.29.1.el10_2] +- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} +- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] +- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] +- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] +- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} +- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] +- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] +- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] +- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] +- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] +- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} +- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} +- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} +Resolves: RHEL-173937, RHEL-179317, RHEL-179965, RHEL-180001, RHEL-181887, RHEL-182759 + +* Thu Jun 25 2026 CKI KWF Bot [6.12.0-211.28.1.el10_2] +- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] +- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} +- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} +- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} +- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} +- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} +Resolves: RHEL-171456, RHEL-174242, RHEL-179665, RHEL-179755, RHEL-180155, RHEL-185117 + +* Mon Jun 22 2026 CKI KWF Bot [6.12.0-211.27.1.el10_2] +- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} +- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} +- ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} +Resolves: RHEL-172675, RHEL-180090, RHEL-180106 + +* Thu Jun 18 2026 CKI KWF Bot [6.12.0-211.26.1.el10_2] +- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} +- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} +- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} +- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} +Resolves: RHEL-172772, RHEL-177380, RHEL-179769, RHEL-180009 + +* Wed Jun 17 2026 CKI KWF Bot [6.12.0-211.25.1.el10_2] +- gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) +- redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] +- watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] +- mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} +Resolves: RHEL-171510, RHEL-182299 + +* Mon Jun 15 2026 CKI KWF Bot [6.12.0-211.24.1.el10_2] +- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] +- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] +- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] +- objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] +- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} +- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} +- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} +- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} +- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} +- scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] +- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} +- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} +- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} +- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} +- rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} +Resolves: RHEL-171419, RHEL-171774, RHEL-172492, RHEL-172516, RHEL-172862, RHEL-175533, RHEL-178495, RHEL-179358, RHEL-179723, RHEL-180022, RHEL-180060, RHEL-180126, RHEL-180307, RHEL-183127, RHEL-183319 + +* Thu Jun 11 2026 CKI KWF Bot [6.12.0-211.23.1.el10_2] +- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] +Resolves: RHEL-166047 + +* Wed Jun 10 2026 CKI KWF Bot [6.12.0-211.22.1.el10_2] +- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov) +- scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] +- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] +- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] +- ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] +- ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] +- ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] +- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] +- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] +- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} +- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] +- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} +- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} +- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} +- erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} +- can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} +- nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] +Resolves: RHEL-167788, RHEL-170764, RHEL-171686, RHEL-172651, RHEL-172973, RHEL-178413, RHEL-179437, RHEL-180932 + +* Thu Jun 04 2026 CKI KWF Bot [6.12.0-211.21.1.el10_2] +- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] +- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] +- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] +- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] +- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] +- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} +Resolves: RHEL-166855, RHEL-168073, RHEL-176473, RHEL-177518 + +* Tue Jun 02 2026 CKI KWF Bot [6.12.0-211.20.1.el10_2] +- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} +- redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] +- sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] +- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} +- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] +Resolves: RHEL-157466, RHEL-171475, RHEL-173950, RHEL-178932, RHEL-179469 + +* Thu May 28 2026 CKI KWF Bot [6.12.0-211.19.1.el10_2] +- Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} +- Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] +- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] +- Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] +- Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] +- Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] +- Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] +- Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] +- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} +- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] +- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] +- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] +- dpll: add pin operational state (Ivan Vecera) [RHEL-175821] +- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] +- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] +- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] +- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] +- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} +- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] +- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] +- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] +- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] +- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] +- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] +- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] +- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] +- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] +- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] +- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] +- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] +- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] +- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] +- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] +- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] +- nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} +- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} +- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} +- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} +Resolves: RHEL-163345, RHEL-166953, RHEL-167277, RHEL-167837, RHEL-171302, RHEL-172827, RHEL-172930, RHEL-175821, RHEL-175824, RHEL-176903, RHEL-176915 + +* Thu May 21 2026 CKI KWF Bot [6.12.0-211.18.1.el10_2] +- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} +- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} +- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} +- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} +- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] +Resolves: RHEL-133872, RHEL-172577, RHEL-172603, RHEL-174051 + +* Wed May 20 2026 CKI KWF Bot [6.12.0-211.17.1.el10_2] +- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] +- redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) +- mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} +- dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} +- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} +- mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} +- fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] +- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] +- pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] +- anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] +- pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] +- anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] +- ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] +- ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] +- net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] +- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} +- netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} +- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} +- redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] +- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} +- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} +- io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} +- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] +- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] +- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] +- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] +- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] +- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] +- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] +- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} +- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} +- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] +- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] +- Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] +- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] +- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} +- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} +- can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} +- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} +Resolves: RHEL-150180, RHEL-160469, RHEL-162260, RHEL-164434, RHEL-166991, RHEL-169625, RHEL-169738, RHEL-169786, RHEL-170809, RHEL-171142, RHEL-171159, RHEL-171617, RHEL-171637, RHEL-171944, RHEL-172556, RHEL-172625, RHEL-172745, RHEL-173857, RHEL-173872, RHEL-174217, RHEL-174258, RHEL-174331, RHEL-174756 + +* Mon May 18 2026 CKI KWF Bot [6.12.0-211.16.1.el10_2] +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} +- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} +- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} +- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} +- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} +Resolves: RHEL-171434, RHEL-174029, RHEL-176053, RHEL-176449 + +* Mon May 11 2026 Patrick Talbert [6.12.0-211.15.1.el10_2] +- xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} +Resolves: RHEL-174546 + +* Mon May 04 2026 Patrick Talbert [6.12.0-211.14.1.el10_2] +- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] +- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] +- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] +- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] +- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} +- crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} +- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] +- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} +- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} +- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] +Resolves: RHEL-172213 + +* Thu Apr 30 2026 CKI KWF Bot [6.12.0-211.13.1.el10_2] +- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] +- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} +Resolves: RHEL-170974, RHEL-171531 + +* Mon Apr 27 2026 CKI KWF Bot [6.12.0-211.12.1.el10_2] +- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] +- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] +- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] +- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] +- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] +- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] +- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] +- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} +- net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} +Resolves: RHEL-162253, RHEL-166932, RHEL-169354 + +* Thu Apr 23 2026 CKI KWF Bot [6.12.0-211.11.1.el10_2] +- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} +- KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} +- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} +Resolves: RHEL-153716, RHEL-168569 + +* Thu Apr 23 2026 CKI KWF Bot [6.12.0-211.10.1.el10_2] +- ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] +- ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] +- ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] +- ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] +- ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] +- ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] +- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} +Resolves: RHEL-157332, RHEL-163717 + +* Mon Apr 20 2026 CKI KWF Bot [6.12.0-211.9.1.el10_2] +- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] +Resolves: RHEL-157855 + +* Thu Apr 16 2026 CKI KWF Bot [6.12.0-211.8.1.el10_2] +- ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] +- i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] +- ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] +- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] +- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} +- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] +- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] +- net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] +- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] +- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] +- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] +- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] +- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] +- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] +- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] +- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] +- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} +- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} +Resolves: RHEL-150456, RHEL-155205, RHEL-155971, RHEL-157285, RHEL-157946, RHEL-158206, RHEL-158990, RHEL-159227, RHEL-165081 + * Wed Apr 01 2026 CKI KWF Bot [6.12.0-211.7.1.el10_2] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] diff --git a/kernel.spec b/kernel.spec index 6ecc9ca9d..ea6887009 100644 --- a/kernel.spec +++ b/kernel.spec @@ -178,13 +178,13 @@ Summary: The Linux kernel %define patchversion 6.12 %define pkgrelease 211.34.1 %define kversion 6 -%define tarfile_release 6.12.0-211.7.1.el10_2 +%define tarfile_release 6.12.0-211.34.1.el10_2 # This is needed to do merge window version magic %define patchlevel 12 # This allows pkg_release to have configurable %%{?dist} tag %define specrelease 211.34.1%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 6.12.0-211.7.1.el10_2 +%define kabiversion 6.12.0-211.34.1.el10_2 # If this variable is set to 1, a bpf selftests build failure will cause a # fatal kernel package build error @@ -1138,353 +1138,7 @@ Patch2007: 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch Patch2008: 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch Patch2009: 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch Patch2010: 0001-Keep-fs-btrfs-files-in-modules-package.patch -Patch1105: 1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch -Patch1106: 1106-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch -Patch1107: 1107-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch -Patch1108: 1108-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch -Patch1109: 1109-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch -Patch1110: 1110-rdma-bnxt-re-support-2g-message-size.patch -Patch1111: 1111-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch -Patch1112: 1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch -Patch1113: 1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch -Patch1114: 1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch -Patch1115: 1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch -Patch1116: 1116-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch -Patch1117: 1117-ionic-fix-persistent-mac-address-override-on-pf.patch -Patch1118: 1118-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch -Patch1119: 1119-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch -Patch1120: 1120-smb-client-fix-krb5-mount-with-username-option.patch -Patch1121: 1121-alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch -Patch1122: 1122-i40e-drop-udp-tunnel-get-rx-info-call-from-i40e-open.patch -Patch1123: 1123-ice-drop-udp-tunnel-get-rx-info-call-from-ndo-open.patch -Patch1124: 1124-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch -Patch1125: 1125-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch -Patch1126: 1126-asoc-sdca-tidy-up-some-memory-allocations.patch -Patch1127: 1127-asoc-sdca-handle-config-pm-sleep-not-being-set.patch -Patch1128: 1128-asoc-sdca-update-counting-of-su-ge-dapm-routes.patch -Patch1129: 1129-asoc-add-snd-soc-lookup-component-by-name-helper.patch -Patch1130: 1130-asoc-soc-sdw-utils-partial-match-the-codec-name.patch -Patch1131: 1131-asoc-soc-sdw-utils-remove-index-from-sdca-codec-name.patch -Patch1132: 1132-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch -Patch1133: 1133-kvm-x86-mmu-only-warn-in-direct-mmus-when-overwriting-shadow.patch -Patch1134: 1134-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch -Patch1135: 1135-net-af-can-do-not-leave-a-dangling-sk-pointer-in-can-create.patch -Patch1136: 1136-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch -Patch1137: 1137-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch -Patch1138: 1138-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch -Patch1139: 1139-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch -Patch1140: 1140-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch -Patch1141: 1141-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch -Patch1142: 1142-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch -Patch1143: 1143-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch -Patch1144: 1144-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch -Patch1145: 1145-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch -Patch1146: 1146-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch -Patch1147: 1147-crypto-algif-aead-revert-to-operating-out-of-place.patch -Patch1148: 1148-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch -Patch1149: 1149-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch -Patch1150: 1150-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch -Patch1151: 1151-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch -Patch1152: 1152-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch -Patch1153: 1153-crypto-authencesn-reject-short-ahash-digests-during-instance.patch -Patch1154: 1154-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch -Patch1155: 1155-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch -Patch1156: 1156-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch -Patch1157: 1157-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch -Patch1158: 1158-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch -Patch1159: 1159-ptrace-slightly-saner-get-dumpable-logic.patch -Patch1160: 1160-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch -Patch1161: 1161-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch -Patch1162: 1162-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch -Patch1163: 1163-can-j1939-j1939-session-new-fix-skb-reference-counting.patch -Patch1164: 1164-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch -Patch1165: 1165-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch -Patch1166: 1166-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch -Patch1167: 1167-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch -Patch1168: 1168-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch -Patch1169: 1169-revert-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-drop.patch -Patch1170: 1170-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch -Patch1171: 1171-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch -Patch1172: 1172-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch -Patch1173: 1173-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch -Patch1174: 1174-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch -Patch1175: 1175-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch -Patch1176: 1176-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch -Patch1177: 1177-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch -Patch1178: 1178-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch -Patch1179: 1179-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch -Patch1180: 1180-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch -Patch1181: 1181-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch -Patch1182: 1182-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch -Patch1183: 1183-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch -Patch1184: 1184-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch -Patch1185: 1185-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch -Patch1186: 1186-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch -Patch1187: 1187-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch -Patch1188: 1188-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch -Patch1189: 1189-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch -Patch1190: 1190-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch -Patch1191: 1191-revert-scsi-lpfc-use-min-to-improve-code.patch -Patch1192: 1192-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch -Patch1193: 1193-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch -Patch1194: 1194-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch -Patch1195: 1195-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch -Patch1196: 1196-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch -Patch1197: 1197-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch -Patch1198: 1198-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch -Patch1199: 1199-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch -Patch1200: 1200-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch -Patch1201: 1201-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch -Patch1202: 1202-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch -Patch1203: 1203-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch -Patch1204: 1204-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch -Patch1205: 1205-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch -Patch1206: 1206-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch -Patch1207: 1207-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-rhel-only.patch -Patch1208: 1208-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch -Patch1209: 1209-net-sched-act-csum-validate-nested-vlan-headers.patch -Patch1210: 1210-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch -Patch1211: 1211-cifs-remove-unnecessary-tracing-after-put-tcon.patch -Patch1212: 1212-cifs-make-default-value-of-retrans-as-zero.patch -Patch1213: 1213-dpll-zl3073x-add-output-pin-frequency-helper.patch -Patch1214: 1214-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch -Patch1215: 1215-dpll-zl3073x-fix-ref-frequency-setting.patch -Patch1216: 1216-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch -Patch1217: 1217-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch -Patch1218: 1218-io-uring-rsrc-reject-zero-length-fixed-buffer-import.patch -Patch1219: 1219-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch -Patch1220: 1220-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch -Patch1221: 1221-redhat-configs-enable-config-aqtion-on-all-archs.patch -Patch1222: 1222-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch -Patch1223: 1223-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch -Patch1224: 1224-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch -Patch1225: 1225-net-fix-rcu-tasks-stall-in-threaded-busypoll.patch -Patch1226: 1226-ice-use-netif-get-num-default-rss-queues.patch -Patch1227: 1227-ice-set-max-queues-in-alloc-etherdev-mqs.patch -Patch1228: 1228-anon-inode-use-a-proper-mode-internally.patch -Patch1229: 1229-pidfs-use-anon-inode-getattr.patch -Patch1230: 1230-anon-inode-explicitly-block-setattr.patch -Patch1231: 1231-pidfs-use-anon-inode-setattr.patch -Patch1232: 1232-anon-inode-raise-sb-i-nodev-and-sb-i-noexec.patch -Patch1233: 1233-fs-add-s-anon-inode.patch -Patch1234: 1234-mm-thp-deny-thp-for-files-on-anonymous-inodes.patch -Patch1235: 1235-dpaa2-switch-prevent-zero-size-ptr-dereference-when-num-ifs-.patch -Patch1236: 1236-dpaa2-switch-validate-num-ifs-to-prevent-out-of-bounds-write.patch -Patch1237: 1237-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch -Patch1238: 1238-redhat-kernel-spec-template-disable-objtool-werror-for-gcov-.patch -Patch1239: 1239-dm-thin-fix-metadata-refcount-underflow.patch -Patch1240: 1240-crypto-tegra-disable-softirqs-before-finalizing-request.patch -Patch1241: 1241-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch -Patch1242: 1242-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch -Patch1243: 1243-xfs-delete-attr-leaf-freemap-entries-when-empty.patch -Patch1244: 1244-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch -Patch1245: 1245-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch -Patch1246: 1246-proc-fix-missing-pde-set-flags-for-net-proc-files.patch -Patch1247: 1247-proc-fix-type-confusion-in-pde-set-flags.patch -Patch1248: 1248-nbd-defer-config-unlock-in-nbd-genl-connect.patch -Patch1249: 1249-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch -Patch1250: 1250-dpll-zl3073x-detect-dpll-channel-count-from-chip-id-at-runti.patch -Patch1251: 1251-dpll-zl3073x-add-die-temperature-reporting-for-supported-chi.patch -Patch1252: 1252-dpll-zl3073x-use-struct-group-to-partition-states.patch -Patch1253: 1253-dpll-zl3073x-add-zl3073x-ref-state-update-helper.patch -Patch1254: 1254-dpll-zl3073x-introduce-zl3073x-chan-for-dpll-channel-state.patch -Patch1255: 1255-dpll-zl3073x-add-dpll-channel-status-fields-to-zl3073x-chan.patch -Patch1256: 1256-dpll-zl3073x-add-reference-priority-to-zl3073x-chan.patch -Patch1257: 1257-dpll-zl3073x-drop-selected-and-simplify-connected-ref-getter.patch -Patch1258: 1258-dpll-add-frequency-monitoring-to-netlink-spec.patch -Patch1259: 1259-dpll-add-frequency-monitoring-callback-ops.patch -Patch1260: 1260-dpll-zl3073x-implement-frequency-monitoring.patch -Patch1261: 1261-dpll-zl3073x-clean-up-esync-get-set-and-use-zl3073x-out-is-n.patch -Patch1262: 1262-dpll-zl3073x-use-field-modify-for-clear-and-set-patterns.patch -Patch1263: 1263-dpll-zl3073x-add-ref-sync-and-output-clock-type-helpers.patch -Patch1264: 1264-dpll-zl3073x-add-ref-sync-pair-support.patch -Patch1265: 1265-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch -Patch1266: 1266-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch -Patch1267: 1267-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch -Patch1268: 1268-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch -Patch1269: 1269-smb-client-validate-dacloffset-before-building-dacl-pointers.patch -Patch1270: 1270-dpll-add-pin-operational-state.patch -Patch1271: 1271-dpll-zl3073x-implement-pin-operational-state-reporting.patch -Patch1272: 1272-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch -Patch1273: 1273-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch -Patch1274: 1274-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch -Patch1275: 1275-bluetooth-hci-add-initial-support-for-past.patch -Patch1276: 1276-bluetooth-iso-add-support-to-bind-to-trigger-past.patch -Patch1277: 1277-bluetooth-hci-add-support-for-ll-extended-feature-set.patch -Patch1278: 1278-bluetooth-hci-conn-fix-using-conn-le-tx-rx-phy-as-supported-.patch -Patch1279: 1279-bluetooth-l2cap-add-support-for-setting-bt-phy.patch -Patch1280: 1280-bluetooth-hci-sync-hci-cmd-sync-queue-once-return-eexist-if-.patch -Patch1281: 1281-bluetooth-hci-sync-fix-leaks-when-hci-cmd-sync-queue-once-fa.patch -Patch1282: 1282-bluetooth-hci-sync-fix-uaf-in-le-read-features-complete.patch -Patch1283: 1283-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch -Patch1284: 1284-smb-client-fix-oob-reads-parsing-symlink-error-response.patch -Patch1285: 1285-sched-deadline-fix-dl-server-time-accounting.patch -Patch1286: 1286-redhat-configs-automotive-disable-config-io-uring.patch -Patch1287: 1287-rhel-kabi-dpll-adaptation.patch -Patch1288: 1288-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch -Patch1289: 1289-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch -Patch1290: 1290-ice-fix-stats-array-overflow-when-vf-requests-more-queues.patch -Patch1291: 1291-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch -Patch1292: 1292-s390-dasd-move-quiesce-state-with-pprc-swap.patch -Patch1293: 1293-s390-dasd-copy-detected-format-information-to-secondary-devi.patch -Patch1294: 1294-nouveau-gsp-drop-warn-on-in-acpi-probes.patch -Patch1295: 1295-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch -Patch1296: 1296-erofs-add-gfp-noio-in-the-bio-completion-if-needed.patch -Patch1297: 1297-alsa-6fire-fix-use-after-free-on-disconnect.patch -Patch1298: 1298-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch -Patch1299: 1299-ipv6-rpl-reserve-mac-len-headroom-when-recompressed-srh-grow.patch -Patch1300: 1300-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch -Patch1301: 1301-lsm-split-the-notifier-code-out-into-lsm-notifier-c.patch -Patch1302: 1302-lsm-split-the-init-code-out-into-lsm-init-c.patch -Patch1303: 1303-lsm-consolidate-lsm-allowed-and-prepare-lsm-into-lsm-prepare.patch -Patch1304: 1304-lsm-introduce-looping-macros-for-the-initialization-code.patch -Patch1305: 1305-lsm-integrate-report-lsm-order-code-into-caller.patch -Patch1306: 1306-lsm-integrate-lsm-early-cred-and-lsm-early-task-into-caller.patch -Patch1307: 1307-lsm-rename-ordered-lsm-init-to-lsm-init-ordered.patch -Patch1308: 1308-lsm-replace-the-name-field-with-a-pointer-to-the-lsm-id-stru.patch -Patch1309: 1309-lsm-rename-the-lsm-order-variables-for-consistency.patch -Patch1310: 1310-lsm-rework-lsm-active-cnt-and-lsm-idlist.patch -Patch1311: 1311-lsm-get-rid-of-the-lsm-names-list-and-do-some-cleanup.patch -Patch1312: 1312-lsm-rework-the-lsm-enable-disable-setter-getter-functions.patch -Patch1313: 1313-lsm-rename-exists-ordered-lsm-to-lsm-order-exists.patch -Patch1314: 1314-lsm-rename-rework-append-ordered-lsm-into-lsm-order-append.patch -Patch1315: 1315-lsm-rename-rework-ordered-lsm-parse-to-lsm-order-parse.patch -Patch1316: 1316-lsm-cleanup-the-lsm-blob-size-code.patch -Patch1317: 1317-lsm-cleanup-initialize-lsm-and-rename-to-lsm-init-single.patch -Patch1318: 1318-lsm-fold-lsm-init-ordered-into-security-init.patch -Patch1319: 1319-lsm-add-tweak-function-header-comment-blocks-in-lsm-init-c.patch -Patch1320: 1320-lsm-cleanup-the-debug-and-console-output-in-lsm-init-c.patch -Patch1321: 1321-fs-prepare-for-adding-lsm-blob-to-backing-file.patch -Patch1322: 1322-lsm-add-backing-file-lsm-hooks.patch -Patch1323: 1323-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch -Patch1324: 1324-scripts-sorttable-fix-orc-sort-cmp-to-maintain-symmetry-and-.patch -Patch1325: 1325-scripts-sorttable-remove-unused-macro-defines.patch -Patch1326: 1326-scripts-sorttable-remove-unused-write-functions.patch -Patch1327: 1327-scripts-sorttable-remove-unneeded-elf-rel.patch -Patch1328: 1328-scripts-sorttable-have-the-orc-code-use-the-r-functions-to-r.patch -Patch1329: 1329-scripts-sorttable-make-compare-extable-into-two-functions.patch -Patch1330: 1330-scripts-sorttable-convert-elf-ehdr-to-union.patch -Patch1331: 1331-scripts-sorttable-replace-elf-shdr-macro-with-a-union.patch -Patch1332: 1332-scripts-sorttable-convert-elf-sym-macro-over-to-a-union.patch -Patch1333: 1333-scripts-sorttable-add-helper-functions-for-elf-ehdr.patch -Patch1334: 1334-scripts-sorttable-add-helper-functions-for-elf-shdr.patch -Patch1335: 1335-scripts-sorttable-add-helper-functions-for-elf-sym.patch -Patch1336: 1336-scripts-sorttable-use-uint64-t-for-mcount-sorting.patch -Patch1337: 1337-scripts-sorttable-move-code-from-sorttable-h-into-sorttable-.patch -Patch1338: 1338-scripts-sorttable-get-start-stop-mcount-loc-from-elf-file-di.patch -Patch1339: 1339-scripts-sorttable-use-a-structure-of-function-pointers-for-e.patch -Patch1340: 1340-arm64-scripts-sorttable-implement-sorting-mcount-loc-at-boot.patch -Patch1341: 1341-scripts-sorttable-have-mcount-rela-sort-use-direct-values.patch -Patch1342: 1342-scripts-sorttable-always-use-an-array-for-the-mcount-loc-sor.patch -Patch1343: 1343-scripts-sorttable-zero-out-weak-functions-in-mcount-loc-tabl.patch -Patch1344: 1344-ftrace-update-the-mcount-loc-check-of-skipped-entries.patch -Patch1345: 1345-ftrace-have-ftrace-pages-output-reflect-freed-pages.patch -Patch1346: 1346-ftrace-do-not-over-allocate-ftrace-memory.patch -Patch1347: 1347-ftrace-test-mcount-loc-addr-before-calling-ftrace-call-addr.patch -Patch1348: 1348-ftrace-check-against-is-kernel-text-instead-of-kaslr-offset.patch -Patch1349: 1349-scripts-sorttable-use-normal-sort-if-theres-no-relocs-in-the.patch -Patch1350: 1350-scripts-sorttable-allow-matches-to-functions-before-function.patch -Patch1351: 1351-scripts-sorttable-fix-endianness-handling-in-build-time-mcou.patch -Patch1352: 1352-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch -Patch1353: 1353-rxrpc-fix-rxgk-token-loading-to-check-bounds.patch -Patch1354: 1354-xen-privcmd-fix-double-free-via-vma-splitting.patch -Patch1355: 1355-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch -Patch1356: 1356-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch -Patch1357: 1357-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch -Patch1358: 1358-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-dropped-dur.patch -Patch1359: 1359-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch -Patch1360: 1360-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch -Patch1361: 1361-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch -Patch1362: 1362-wifi-mac80211-remove-station-if-connection-prep-fails.patch -Patch1363: 1363-bnxt-en-fix-rss-context-delete-logic.patch -Patch1364: 1364-objtool-klp-fix-unexported-static-call-key-access-for-manual.patch -Patch1365: 1365-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch -Patch1366: 1366-ibmveth-disable-gso-for-packets-with-small-mss.patch -Patch1367: 1367-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch -Patch1368: 1368-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch -Patch1369: 1369-watchdog-wdat-wdt-fix-acpi-table-leak-in-probe-function.patch -Patch1370: 1370-net-mana-fix-use-after-free-in-add-adev-error-path.patch -Patch1371: 1371-crypto-caam-fix-overflow-on-long-hmac-keys.patch -Patch1372: 1372-exit-prevent-preemption-of-oopsing-task-dead-task.patch -Patch1373: 1373-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch -Patch1374: 1374-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch -Patch1375: 1375-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch -Patch1376: 1376-rdma-mana-validate-rx-hash-key-len.patch -Patch1377: 1377-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch -Patch1378: 1378-rxrpc-fix-response-authenticator-parser-oob-read.patch -Patch1379: 1379-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch -Patch1380: 1380-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch -Patch1381: 1381-scsi-qla2xxx-completely-fix-fcport-double-free.patch -Patch1382: 1382-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch -Patch1383: 1383-selinux-rhel-only-hotfix-for-execmem-regression.patch -Patch1384: 1384-ipv4-account-for-fraggap-on-the-paged-allocation-path.patch -Patch1385: 1385-ipv6-account-for-fraggap-on-the-paged-allocation-path.patch -Patch1386: 1386-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch -Patch1387: 1387-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch -Patch1388: 1388-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch -Patch1389: 1389-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch -Patch1390: 1390-crypto-tegra-remove-unneeded-crypto-engine-stop-call.patch -Patch1391: 1391-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch -Patch1392: 1392-crypto-tegra-remove-the-use-of-dev-err-probe.patch -Patch1393: 1393-crypto-tegra-use-int-type-to-store-negative-error-codes.patch -Patch1394: 1394-crypto-tegra-add-missing-crypto-alg-async.patch -Patch1395: 1395-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch -Patch1396: 1396-crypto-tegra-fix-dma-free-coherent-size-error.patch -Patch1397: 1397-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch -Patch1398: 1398-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch -Patch1399: 1399-rxrpc-fix-potential-uaf-after-skb-unshare-failure.patch -Patch1400: 1400-rxrpc-fix-rxrpc-input-call-event-to-only-unshare-data-packet.patch -Patch1401: 1401-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch -Patch1402: 1402-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch -Patch1403: 1403-asoc-sdca-fix-null-pointer-dereference-in-sdca-dev-unregiste.patch -Patch1404: 1404-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch -Patch1405: 1405-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch -Patch1406: 1406-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch -Patch1407: 1407-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch -Patch1408: 1408-arm64-cputype-add-c1-pro-definitions.patch -Patch1409: 1409-arm64-cputype-add-c1-premium-definitions.patch -Patch1410: 1410-arm64-cputype-add-c1-ultra-definitions.patch -Patch1411: 1411-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch -Patch1412: 1412-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch -Patch1413: 1413-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch -Patch1414: 1414-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepa.patch -Patch1421: 1421-net-page-pool-avoid-false-positive-warning-if-napi-was-never.patch -Patch1422: 1422-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch -Patch1423: 1423-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch -Patch1424: 1424-net-ipv6-ioam6-prevent-schema-length-wraparound-in-trace-fil.patch -Patch1425: 1425-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch -Patch1426: 1426-tg3-fix-race-for-querying-speed-duplex.patch -Patch1427: 1427-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch -Patch1428: 1428-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch -Patch1429: 1429-epoll-annotate-racy-check.patch -Patch1430: 1430-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch -Patch1431: 1431-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch -Patch1432: 1432-eventpoll-split-ep-remove.patch -Patch1433: 1433-eventpoll-kill-ep-remove.patch -Patch1434: 1434-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch -Patch1435: 1435-eventpoll-move-epi-fget-up.patch -Patch1436: 1436-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch -Patch1437: 1437-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch -Patch1438: 1438-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch -Patch1439: 1439-eventpoll-refresh-eventpoll-release-fast-path-comment.patch -Patch1440: 1440-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch -Patch1441: 1441-eventpoll-fix-semi-unbounded-recursion.patch -Patch1442: 1442-eventpoll-drop-vestigial-epi-dying-flag.patch -Patch1443: 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch -Patch1444: 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch -Patch1447: 1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch -Patch1448: 1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch -Patch1449: 1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch -Patch1450: 1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch -Patch1451: 1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch -Patch1452: 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch -Patch1453: 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch -Patch1454: 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch -Patch1455: 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch -Patch1456: 1456-xfrm-esp-restore-combined-single-frag-length-gate.patch -Patch1457: 1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch -Patch1458: 1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch # END OF PATCH DEFINITIONS %description @@ -2344,354 +1998,8 @@ ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch ApplyPatch 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch ApplyPatch 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch ApplyPatch 0001-Keep-fs-btrfs-files-in-modules-package.patch -ApplyPatch 1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch %{log_msg "End of patch applications"} -ApplyPatch 1106-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch -ApplyPatch 1107-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch -ApplyPatch 1108-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch -ApplyPatch 1109-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch -ApplyPatch 1110-rdma-bnxt-re-support-2g-message-size.patch -ApplyPatch 1111-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch -ApplyPatch 1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch -ApplyPatch 1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch -ApplyPatch 1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch -ApplyPatch 1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch -ApplyPatch 1116-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch -ApplyPatch 1117-ionic-fix-persistent-mac-address-override-on-pf.patch -ApplyPatch 1118-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch -ApplyPatch 1119-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch -ApplyPatch 1120-smb-client-fix-krb5-mount-with-username-option.patch -ApplyPatch 1121-alsa-hda-tas2781-ignore-reset-check-for-spi-device.patch -ApplyPatch 1122-i40e-drop-udp-tunnel-get-rx-info-call-from-i40e-open.patch -ApplyPatch 1123-ice-drop-udp-tunnel-get-rx-info-call-from-ndo-open.patch -ApplyPatch 1124-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch -ApplyPatch 1125-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch -ApplyPatch 1126-asoc-sdca-tidy-up-some-memory-allocations.patch -ApplyPatch 1127-asoc-sdca-handle-config-pm-sleep-not-being-set.patch -ApplyPatch 1128-asoc-sdca-update-counting-of-su-ge-dapm-routes.patch -ApplyPatch 1129-asoc-add-snd-soc-lookup-component-by-name-helper.patch -ApplyPatch 1130-asoc-soc-sdw-utils-partial-match-the-codec-name.patch -ApplyPatch 1131-asoc-soc-sdw-utils-remove-index-from-sdca-codec-name.patch -ApplyPatch 1132-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch -ApplyPatch 1133-kvm-x86-mmu-only-warn-in-direct-mmus-when-overwriting-shadow.patch -ApplyPatch 1134-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch -ApplyPatch 1135-net-af-can-do-not-leave-a-dangling-sk-pointer-in-can-create.patch -ApplyPatch 1136-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch -ApplyPatch 1137-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch -ApplyPatch 1138-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch -ApplyPatch 1139-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch -ApplyPatch 1140-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch -ApplyPatch 1141-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch -ApplyPatch 1142-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch -ApplyPatch 1143-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch -ApplyPatch 1144-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch -ApplyPatch 1145-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch -ApplyPatch 1146-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch -ApplyPatch 1147-crypto-algif-aead-revert-to-operating-out-of-place.patch -ApplyPatch 1148-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch -ApplyPatch 1149-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch -ApplyPatch 1150-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch -ApplyPatch 1151-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch -ApplyPatch 1152-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch -ApplyPatch 1153-crypto-authencesn-reject-short-ahash-digests-during-instance.patch -ApplyPatch 1154-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch -ApplyPatch 1155-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch -ApplyPatch 1156-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch -ApplyPatch 1157-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch -ApplyPatch 1158-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch -ApplyPatch 1159-ptrace-slightly-saner-get-dumpable-logic.patch -ApplyPatch 1160-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch -ApplyPatch 1161-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch -ApplyPatch 1162-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch -ApplyPatch 1163-can-j1939-j1939-session-new-fix-skb-reference-counting.patch -ApplyPatch 1164-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch -ApplyPatch 1165-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch -ApplyPatch 1166-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch -ApplyPatch 1167-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch -ApplyPatch 1168-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch -ApplyPatch 1169-revert-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-drop.patch -ApplyPatch 1170-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch -ApplyPatch 1171-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch -ApplyPatch 1172-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch -ApplyPatch 1173-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch -ApplyPatch 1174-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch -ApplyPatch 1175-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch -ApplyPatch 1176-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch -ApplyPatch 1177-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch -ApplyPatch 1178-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch -ApplyPatch 1179-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch -ApplyPatch 1180-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch -ApplyPatch 1181-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch -ApplyPatch 1182-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch -ApplyPatch 1183-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch -ApplyPatch 1184-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch -ApplyPatch 1185-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch -ApplyPatch 1186-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch -ApplyPatch 1187-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch -ApplyPatch 1188-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch -ApplyPatch 1189-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch -ApplyPatch 1190-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch -ApplyPatch 1191-revert-scsi-lpfc-use-min-to-improve-code.patch -ApplyPatch 1192-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch -ApplyPatch 1193-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch -ApplyPatch 1194-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch -ApplyPatch 1195-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch -ApplyPatch 1196-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch -ApplyPatch 1197-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch -ApplyPatch 1198-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch -ApplyPatch 1199-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch -ApplyPatch 1200-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch -ApplyPatch 1201-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch -ApplyPatch 1202-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch -ApplyPatch 1203-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch -ApplyPatch 1204-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch -ApplyPatch 1205-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch -ApplyPatch 1206-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch -ApplyPatch 1207-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-rhel-only.patch -ApplyPatch 1208-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch -ApplyPatch 1209-net-sched-act-csum-validate-nested-vlan-headers.patch -ApplyPatch 1210-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch -ApplyPatch 1211-cifs-remove-unnecessary-tracing-after-put-tcon.patch -ApplyPatch 1212-cifs-make-default-value-of-retrans-as-zero.patch -ApplyPatch 1213-dpll-zl3073x-add-output-pin-frequency-helper.patch -ApplyPatch 1214-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch -ApplyPatch 1215-dpll-zl3073x-fix-ref-frequency-setting.patch -ApplyPatch 1216-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch -ApplyPatch 1217-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch -ApplyPatch 1218-io-uring-rsrc-reject-zero-length-fixed-buffer-import.patch -ApplyPatch 1219-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch -ApplyPatch 1220-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch -ApplyPatch 1221-redhat-configs-enable-config-aqtion-on-all-archs.patch -ApplyPatch 1222-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch -ApplyPatch 1223-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch -ApplyPatch 1224-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch -ApplyPatch 1225-net-fix-rcu-tasks-stall-in-threaded-busypoll.patch -ApplyPatch 1226-ice-use-netif-get-num-default-rss-queues.patch -ApplyPatch 1227-ice-set-max-queues-in-alloc-etherdev-mqs.patch -ApplyPatch 1228-anon-inode-use-a-proper-mode-internally.patch -ApplyPatch 1229-pidfs-use-anon-inode-getattr.patch -ApplyPatch 1230-anon-inode-explicitly-block-setattr.patch -ApplyPatch 1231-pidfs-use-anon-inode-setattr.patch -ApplyPatch 1232-anon-inode-raise-sb-i-nodev-and-sb-i-noexec.patch -ApplyPatch 1233-fs-add-s-anon-inode.patch -ApplyPatch 1234-mm-thp-deny-thp-for-files-on-anonymous-inodes.patch -ApplyPatch 1235-dpaa2-switch-prevent-zero-size-ptr-dereference-when-num-ifs-.patch -ApplyPatch 1236-dpaa2-switch-validate-num-ifs-to-prevent-out-of-bounds-write.patch -ApplyPatch 1237-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch -ApplyPatch 1238-redhat-kernel-spec-template-disable-objtool-werror-for-gcov-.patch -ApplyPatch 1239-dm-thin-fix-metadata-refcount-underflow.patch -ApplyPatch 1240-crypto-tegra-disable-softirqs-before-finalizing-request.patch -ApplyPatch 1241-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch -ApplyPatch 1242-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch -ApplyPatch 1243-xfs-delete-attr-leaf-freemap-entries-when-empty.patch -ApplyPatch 1244-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch -ApplyPatch 1245-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch -ApplyPatch 1246-proc-fix-missing-pde-set-flags-for-net-proc-files.patch -ApplyPatch 1247-proc-fix-type-confusion-in-pde-set-flags.patch -ApplyPatch 1248-nbd-defer-config-unlock-in-nbd-genl-connect.patch -ApplyPatch 1249-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch -ApplyPatch 1250-dpll-zl3073x-detect-dpll-channel-count-from-chip-id-at-runti.patch -ApplyPatch 1251-dpll-zl3073x-add-die-temperature-reporting-for-supported-chi.patch -ApplyPatch 1252-dpll-zl3073x-use-struct-group-to-partition-states.patch -ApplyPatch 1253-dpll-zl3073x-add-zl3073x-ref-state-update-helper.patch -ApplyPatch 1254-dpll-zl3073x-introduce-zl3073x-chan-for-dpll-channel-state.patch -ApplyPatch 1255-dpll-zl3073x-add-dpll-channel-status-fields-to-zl3073x-chan.patch -ApplyPatch 1256-dpll-zl3073x-add-reference-priority-to-zl3073x-chan.patch -ApplyPatch 1257-dpll-zl3073x-drop-selected-and-simplify-connected-ref-getter.patch -ApplyPatch 1258-dpll-add-frequency-monitoring-to-netlink-spec.patch -ApplyPatch 1259-dpll-add-frequency-monitoring-callback-ops.patch -ApplyPatch 1260-dpll-zl3073x-implement-frequency-monitoring.patch -ApplyPatch 1261-dpll-zl3073x-clean-up-esync-get-set-and-use-zl3073x-out-is-n.patch -ApplyPatch 1262-dpll-zl3073x-use-field-modify-for-clear-and-set-patterns.patch -ApplyPatch 1263-dpll-zl3073x-add-ref-sync-and-output-clock-type-helpers.patch -ApplyPatch 1264-dpll-zl3073x-add-ref-sync-pair-support.patch -ApplyPatch 1265-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch -ApplyPatch 1266-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch -ApplyPatch 1267-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch -ApplyPatch 1268-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch -ApplyPatch 1269-smb-client-validate-dacloffset-before-building-dacl-pointers.patch -ApplyPatch 1270-dpll-add-pin-operational-state.patch -ApplyPatch 1271-dpll-zl3073x-implement-pin-operational-state-reporting.patch -ApplyPatch 1272-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch -ApplyPatch 1273-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch -ApplyPatch 1274-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch -ApplyPatch 1275-bluetooth-hci-add-initial-support-for-past.patch -ApplyPatch 1276-bluetooth-iso-add-support-to-bind-to-trigger-past.patch -ApplyPatch 1277-bluetooth-hci-add-support-for-ll-extended-feature-set.patch -ApplyPatch 1278-bluetooth-hci-conn-fix-using-conn-le-tx-rx-phy-as-supported-.patch -ApplyPatch 1279-bluetooth-l2cap-add-support-for-setting-bt-phy.patch -ApplyPatch 1280-bluetooth-hci-sync-hci-cmd-sync-queue-once-return-eexist-if-.patch -ApplyPatch 1281-bluetooth-hci-sync-fix-leaks-when-hci-cmd-sync-queue-once-fa.patch -ApplyPatch 1282-bluetooth-hci-sync-fix-uaf-in-le-read-features-complete.patch -ApplyPatch 1283-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch -ApplyPatch 1284-smb-client-fix-oob-reads-parsing-symlink-error-response.patch -ApplyPatch 1285-sched-deadline-fix-dl-server-time-accounting.patch -ApplyPatch 1286-redhat-configs-automotive-disable-config-io-uring.patch -ApplyPatch 1287-rhel-kabi-dpll-adaptation.patch -ApplyPatch 1288-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch -ApplyPatch 1289-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch -ApplyPatch 1290-ice-fix-stats-array-overflow-when-vf-requests-more-queues.patch -ApplyPatch 1291-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch -ApplyPatch 1292-s390-dasd-move-quiesce-state-with-pprc-swap.patch -ApplyPatch 1293-s390-dasd-copy-detected-format-information-to-secondary-devi.patch -ApplyPatch 1294-nouveau-gsp-drop-warn-on-in-acpi-probes.patch -ApplyPatch 1295-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch -ApplyPatch 1296-erofs-add-gfp-noio-in-the-bio-completion-if-needed.patch -ApplyPatch 1297-alsa-6fire-fix-use-after-free-on-disconnect.patch -ApplyPatch 1298-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch -ApplyPatch 1299-ipv6-rpl-reserve-mac-len-headroom-when-recompressed-srh-grow.patch -ApplyPatch 1300-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch -ApplyPatch 1301-lsm-split-the-notifier-code-out-into-lsm-notifier-c.patch -ApplyPatch 1302-lsm-split-the-init-code-out-into-lsm-init-c.patch -ApplyPatch 1303-lsm-consolidate-lsm-allowed-and-prepare-lsm-into-lsm-prepare.patch -ApplyPatch 1304-lsm-introduce-looping-macros-for-the-initialization-code.patch -ApplyPatch 1305-lsm-integrate-report-lsm-order-code-into-caller.patch -ApplyPatch 1306-lsm-integrate-lsm-early-cred-and-lsm-early-task-into-caller.patch -ApplyPatch 1307-lsm-rename-ordered-lsm-init-to-lsm-init-ordered.patch -ApplyPatch 1308-lsm-replace-the-name-field-with-a-pointer-to-the-lsm-id-stru.patch -ApplyPatch 1309-lsm-rename-the-lsm-order-variables-for-consistency.patch -ApplyPatch 1310-lsm-rework-lsm-active-cnt-and-lsm-idlist.patch -ApplyPatch 1311-lsm-get-rid-of-the-lsm-names-list-and-do-some-cleanup.patch -ApplyPatch 1312-lsm-rework-the-lsm-enable-disable-setter-getter-functions.patch -ApplyPatch 1313-lsm-rename-exists-ordered-lsm-to-lsm-order-exists.patch -ApplyPatch 1314-lsm-rename-rework-append-ordered-lsm-into-lsm-order-append.patch -ApplyPatch 1315-lsm-rename-rework-ordered-lsm-parse-to-lsm-order-parse.patch -ApplyPatch 1316-lsm-cleanup-the-lsm-blob-size-code.patch -ApplyPatch 1317-lsm-cleanup-initialize-lsm-and-rename-to-lsm-init-single.patch -ApplyPatch 1318-lsm-fold-lsm-init-ordered-into-security-init.patch -ApplyPatch 1319-lsm-add-tweak-function-header-comment-blocks-in-lsm-init-c.patch -ApplyPatch 1320-lsm-cleanup-the-debug-and-console-output-in-lsm-init-c.patch -ApplyPatch 1321-fs-prepare-for-adding-lsm-blob-to-backing-file.patch -ApplyPatch 1322-lsm-add-backing-file-lsm-hooks.patch -ApplyPatch 1323-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch -ApplyPatch 1324-scripts-sorttable-fix-orc-sort-cmp-to-maintain-symmetry-and-.patch -ApplyPatch 1325-scripts-sorttable-remove-unused-macro-defines.patch -ApplyPatch 1326-scripts-sorttable-remove-unused-write-functions.patch -ApplyPatch 1327-scripts-sorttable-remove-unneeded-elf-rel.patch -ApplyPatch 1328-scripts-sorttable-have-the-orc-code-use-the-r-functions-to-r.patch -ApplyPatch 1329-scripts-sorttable-make-compare-extable-into-two-functions.patch -ApplyPatch 1330-scripts-sorttable-convert-elf-ehdr-to-union.patch -ApplyPatch 1331-scripts-sorttable-replace-elf-shdr-macro-with-a-union.patch -ApplyPatch 1332-scripts-sorttable-convert-elf-sym-macro-over-to-a-union.patch -ApplyPatch 1333-scripts-sorttable-add-helper-functions-for-elf-ehdr.patch -ApplyPatch 1334-scripts-sorttable-add-helper-functions-for-elf-shdr.patch -ApplyPatch 1335-scripts-sorttable-add-helper-functions-for-elf-sym.patch -ApplyPatch 1336-scripts-sorttable-use-uint64-t-for-mcount-sorting.patch -ApplyPatch 1337-scripts-sorttable-move-code-from-sorttable-h-into-sorttable-.patch -ApplyPatch 1338-scripts-sorttable-get-start-stop-mcount-loc-from-elf-file-di.patch -ApplyPatch 1339-scripts-sorttable-use-a-structure-of-function-pointers-for-e.patch -ApplyPatch 1340-arm64-scripts-sorttable-implement-sorting-mcount-loc-at-boot.patch -ApplyPatch 1341-scripts-sorttable-have-mcount-rela-sort-use-direct-values.patch -ApplyPatch 1342-scripts-sorttable-always-use-an-array-for-the-mcount-loc-sor.patch -ApplyPatch 1343-scripts-sorttable-zero-out-weak-functions-in-mcount-loc-tabl.patch -ApplyPatch 1344-ftrace-update-the-mcount-loc-check-of-skipped-entries.patch -ApplyPatch 1345-ftrace-have-ftrace-pages-output-reflect-freed-pages.patch -ApplyPatch 1346-ftrace-do-not-over-allocate-ftrace-memory.patch -ApplyPatch 1347-ftrace-test-mcount-loc-addr-before-calling-ftrace-call-addr.patch -ApplyPatch 1348-ftrace-check-against-is-kernel-text-instead-of-kaslr-offset.patch -ApplyPatch 1349-scripts-sorttable-use-normal-sort-if-theres-no-relocs-in-the.patch -ApplyPatch 1350-scripts-sorttable-allow-matches-to-functions-before-function.patch -ApplyPatch 1351-scripts-sorttable-fix-endianness-handling-in-build-time-mcou.patch -ApplyPatch 1352-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch -ApplyPatch 1353-rxrpc-fix-rxgk-token-loading-to-check-bounds.patch -ApplyPatch 1354-xen-privcmd-fix-double-free-via-vma-splitting.patch -ApplyPatch 1355-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch -ApplyPatch 1356-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch -ApplyPatch 1357-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch -ApplyPatch 1358-scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp-dropped-dur.patch -ApplyPatch 1359-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch -ApplyPatch 1360-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch -ApplyPatch 1361-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch -ApplyPatch 1362-wifi-mac80211-remove-station-if-connection-prep-fails.patch -ApplyPatch 1363-bnxt-en-fix-rss-context-delete-logic.patch -ApplyPatch 1364-objtool-klp-fix-unexported-static-call-key-access-for-manual.patch -ApplyPatch 1365-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch -ApplyPatch 1366-ibmveth-disable-gso-for-packets-with-small-mss.patch -ApplyPatch 1367-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch -ApplyPatch 1368-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch -ApplyPatch 1369-watchdog-wdat-wdt-fix-acpi-table-leak-in-probe-function.patch -ApplyPatch 1370-net-mana-fix-use-after-free-in-add-adev-error-path.patch -ApplyPatch 1371-crypto-caam-fix-overflow-on-long-hmac-keys.patch -ApplyPatch 1372-exit-prevent-preemption-of-oopsing-task-dead-task.patch -ApplyPatch 1373-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch -ApplyPatch 1374-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch -ApplyPatch 1375-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch -ApplyPatch 1376-rdma-mana-validate-rx-hash-key-len.patch -ApplyPatch 1377-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch -ApplyPatch 1378-rxrpc-fix-response-authenticator-parser-oob-read.patch -ApplyPatch 1379-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch -ApplyPatch 1380-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch -ApplyPatch 1381-scsi-qla2xxx-completely-fix-fcport-double-free.patch -ApplyPatch 1382-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch -ApplyPatch 1383-selinux-rhel-only-hotfix-for-execmem-regression.patch -ApplyPatch 1384-ipv4-account-for-fraggap-on-the-paged-allocation-path.patch -ApplyPatch 1385-ipv6-account-for-fraggap-on-the-paged-allocation-path.patch -ApplyPatch 1386-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch -ApplyPatch 1387-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch -ApplyPatch 1388-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch -ApplyPatch 1389-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch -ApplyPatch 1390-crypto-tegra-remove-unneeded-crypto-engine-stop-call.patch -ApplyPatch 1391-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch -ApplyPatch 1392-crypto-tegra-remove-the-use-of-dev-err-probe.patch -ApplyPatch 1393-crypto-tegra-use-int-type-to-store-negative-error-codes.patch -ApplyPatch 1394-crypto-tegra-add-missing-crypto-alg-async.patch -ApplyPatch 1395-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch -ApplyPatch 1396-crypto-tegra-fix-dma-free-coherent-size-error.patch -ApplyPatch 1397-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch -ApplyPatch 1398-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch -ApplyPatch 1399-rxrpc-fix-potential-uaf-after-skb-unshare-failure.patch -ApplyPatch 1400-rxrpc-fix-rxrpc-input-call-event-to-only-unshare-data-packet.patch -ApplyPatch 1401-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch -ApplyPatch 1402-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch -ApplyPatch 1403-asoc-sdca-fix-null-pointer-dereference-in-sdca-dev-unregiste.patch -ApplyPatch 1404-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch -ApplyPatch 1405-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch -ApplyPatch 1406-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch -ApplyPatch 1407-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch -ApplyPatch 1408-arm64-cputype-add-c1-pro-definitions.patch -ApplyPatch 1409-arm64-cputype-add-c1-premium-definitions.patch -ApplyPatch 1410-arm64-cputype-add-c1-ultra-definitions.patch -ApplyPatch 1411-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch -ApplyPatch 1412-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch -ApplyPatch 1413-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch -ApplyPatch 1414-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepa.patch -ApplyPatch 1421-net-page-pool-avoid-false-positive-warning-if-napi-was-never.patch -ApplyPatch 1422-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch -ApplyPatch 1423-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch -ApplyPatch 1424-net-ipv6-ioam6-prevent-schema-length-wraparound-in-trace-fil.patch -ApplyPatch 1425-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch -ApplyPatch 1426-tg3-fix-race-for-querying-speed-duplex.patch -ApplyPatch 1427-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch -ApplyPatch 1428-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch -ApplyPatch 1429-epoll-annotate-racy-check.patch -ApplyPatch 1430-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch -ApplyPatch 1431-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch -ApplyPatch 1432-eventpoll-split-ep-remove.patch -ApplyPatch 1433-eventpoll-kill-ep-remove.patch -ApplyPatch 1434-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch -ApplyPatch 1435-eventpoll-move-epi-fget-up.patch -ApplyPatch 1436-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch -ApplyPatch 1437-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch -ApplyPatch 1438-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch -ApplyPatch 1439-eventpoll-refresh-eventpoll-release-fast-path-comment.patch -ApplyPatch 1440-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch -ApplyPatch 1441-eventpoll-fix-semi-unbounded-recursion.patch -ApplyPatch 1442-eventpoll-drop-vestigial-epi-dying-flag.patch -ApplyPatch 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch -ApplyPatch 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch -ApplyPatch 1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch -ApplyPatch 1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch -ApplyPatch 1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch -ApplyPatch 1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch -ApplyPatch 1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch -ApplyPatch 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch -ApplyPatch 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch -ApplyPatch 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch -ApplyPatch 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch -ApplyPatch 1456-xfrm-esp-restore-combined-single-frag-length-gate.patch -ApplyPatch 1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch -ApplyPatch 1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -2795,6 +2103,13 @@ do done rm -f $i.tmp done +%if %{with_gcov} +%{log_msg "Disabling CONFIG_OBJTOOL_WERROR for gcov build"} +for i in %{all_configs} +do + sed -i "s|CONFIG_OBJTOOL_WERROR=y|# CONFIG_OBJTOOL_WERROR is not set|g" $i +done +%endif %endif %if %{signkernel}%{signmodules} @@ -5196,21 +4511,28 @@ fi\ # # %changelog -* Wed Jul 15 2026 Andrew Lukoshko - 6.12.0-211.34.1 -- Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) -- RHEL changelog for 211.34.1 follows: +* Fri Jul 17 2026 Eduard Abdullin - 6.12.0-211.34.1 +- Debrand for AlmaLinux OS +- Use AlmaLinux OS secure boot cert + +* Fri Jul 17 2026 Neal Gompa - 6.12.0-211.34.1 +- Enable Btrfs support for all kernel variants + +* Fri Jul 17 2026 Andrew Lukoshko - 6.12.0-211.34.1 +- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 +- mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 +- megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 +- qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 +- qla4xxx: bring back deprecated PCI ids +- be2iscsi: bring back deprecated PCI ids +- kernel/rh_messages.h: enable all disabled pci devices by moving to + unmaintained * Mon Jul 13 2026 CKI KWF Bot [6.12.0-211.34.1.el10_2] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] -* Mon Jul 13 2026 Andrew Lukoshko - 6.12.0-211.33.1 -- Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) -- The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 - (1445, 1446) are superseded by RHEL's copies and dropped -- RHEL changelog for 211.33.1 follows: - * Thu Jul 09 2026 CKI KWF Bot [6.12.0-211.33.1.el10_2] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} @@ -5218,29 +4540,12 @@ fi\ - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} -* Thu Jul 09 2026 Andrew Lukoshko - 6.12.0-211.32.1 -- Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) -- The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are - superseded by RHEL's copies and dropped -- RHEL changelog for 211.32.1 follows: - * Tue Jul 07 2026 CKI KWF Bot [6.12.0-211.32.1.el10_2] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} -* Wed Jul 08 2026 Andrew Lukoshko - 6.12.0-211.31.2 -- Bring back the rtmutex self-deadlock NULL pointer dereference fixes in - remove_waiter() ahead of RHEL, upstream 3bfdc63936dd + 40a25d59e85b (1445, 1446) - -* Wed Jul 08 2026 Andrew Lukoshko - 6.12.0-211.31.1 -- Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) -- The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by - RHEL's eventpoll series carrying the same fix and is dropped -- Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) -- RHEL changelog for 211.31.1 follows: - * Mon Jul 06 2026 CKI KWF Bot [6.12.0-211.31.1.el10_2] - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] @@ -5267,28 +4572,6 @@ fi\ - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] -* Tue Jul 08 2026 Andrew Lukoshko - 6.12.0-211.30.4 -- Fix rtmutex self-deadlock NULL pointer dereference in remove_waiter() ahead of - RHEL, upstream 3bfdc63936dd + 40a25d59e85b (1418, 1420); the futex_requeue guard - 74e144274af3 was dropped, reverted upstream by 39def6d250d3 (the NULL deref is - fully handled by 40a25d59e85b) - -* Mon Jul 06 2026 Andrew Lukoshko - 6.12.0-211.30.3 -- Fix CVE-2026-46242: eventpoll ep_remove struct eventpoll / struct file - use-after-free, adapted from upstream a6dc643c6931 ahead of RHEL (1417) - -* Fri Jul 03 2026 Andrew Lukoshko - 6.12.0-211.30.2 -- Fix KVM x86 shadow paging use-after-free due to unexpected GFN ahead of RHEL (1415) -- Fix KVM x86 shadow paging use-after-free due to unexpected role ahead of RHEL (1416) - -* Fri Jul 03 2026 Andrew Lukoshko - 6.12.0-211.30.1 -- Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) -- RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 - fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are - retained and RHEL's duplicate copies omitted -- CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) -- RHEL changelog for 211.30.1 follows: - * Wed Jul 01 2026 CKI KWF Bot [6.12.0-211.30.1.el10_2] - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] @@ -5311,11 +4594,6 @@ fi\ - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} -* Wed Jul 01 2026 Andrew Lukoshko - 6.12.0-211.29.1 -- Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) -- Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) -- RHEL changelog for 211.29.1 follows: - * Mon Jun 29 2026 CKI KWF Bot [6.12.0-211.29.1.el10_2] - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] @@ -5331,16 +4609,6 @@ fi\ - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} -* Tue Jun 30 2026 Andrew Lukoshko - 6.12.0-211.28.2 -- Add upstream ipv4/ipv6 fraggap paged-allocation fixes (1384-1385) - eca856950f7c ipv4: account for fraggap on the paged allocation path - 736b380e28d0 ipv6: account for fraggap on the paged allocation path - -* Fri Jun 26 2026 Andrew Lukoshko - 6.12.0-211.28.1 -- Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) -- Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) -- RHEL changelog for 211.27.1..211.28.1 follows: - * Thu Jun 25 2026 CKI KWF Bot [6.12.0-211.28.1.el10_2] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} @@ -5354,14 +4622,6 @@ fi\ - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} -* Tue Jun 23 2026 Andrew Lukoshko - 6.12.0-211.26.1 -- Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1374) - -* Mon Jun 22 2026 Andrew Lukoshko - 6.12.0-211.26.1 -- Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) -- Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) -- RHEL changelog for 211.23.1..211.26.1 follows: - * Thu Jun 18 2026 CKI KWF Bot [6.12.0-211.26.1.el10_2] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} @@ -5394,11 +4654,8 @@ fi\ * Thu Jun 11 2026 CKI KWF Bot [6.12.0-211.23.1.el10_2] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] -* Wed Jun 11 2026 Andrew Lukoshko - 6.12.0-211.22.1 -- Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) -- RHEL changelog for 211.21.1..211.22.1 follows: - * Wed Jun 10 2026 CKI KWF Bot [6.12.0-211.22.1.el10_2] +- redhat: Fix rebuild changelog generation for automotive (Oleksii Baranov) - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] @@ -5466,11 +4723,6 @@ fi\ - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} -* Sun Jun 07 2026 Andrew Lukoshko - 6.12.0-211.20.1 -- Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) -- smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) -- RHEL changelog for 211.19.1..211.20.1 follows: - * Tue Jun 02 2026 CKI KWF Bot [6.12.0-211.20.1.el10_2] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] @@ -5518,10 +4770,6 @@ fi\ - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} -* Sun Jun 07 2026 Andrew Lukoshko - 6.12.0-211.18.1 -- Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) -- RHEL changelog for 211.17.1..211.18.1 follows: - * Thu May 21 2026 CKI KWF Bot [6.12.0-211.18.1.el10_2] - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} @@ -5609,12 +4857,6 @@ fi\ - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} -* Sun Jun 07 2026 Andrew Lukoshko - 6.12.0-211.16.1 -- Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) -- Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) -- Keep the smb cifs.spnego ahead-fix (1105) -- RHEL changelog for 211.8.1..211.16.1 follows: - * Mon May 18 2026 CKI KWF Bot [6.12.0-211.16.1.el10_2] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} @@ -5689,59 +4931,6 @@ fi\ - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} -* Thu May 28 2026 Andrew Lukoshko - 6.12.0-211.7.4 -- net: skbuff: propagate shared-frag marker through frag-transfer helpers - (refresh to upstream v5: now also covers skb_segment() and - tcp_clone_payload(); CVE-2026-46300 "Fragnesia") -- smb: client: reject userspace cifs.spnego descriptions (upstream commit - 3da1fdf4efbc) - -* Tue May 19 2026 Andrew Lukoshko - 6.12.0-211.7.3 -- xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) -- rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) -- net: skbuff: propagate shared-frag marker through frag-transfer helpers - (CVE-2026-46300 "Fragnesia") -- ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe - replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - -* Thu Apr 30 2026 Eduard Abdullin - 6.12.0-211.7.1 -- Debrand for AlmaLinux OS -- Use AlmaLinux OS secure boot cert - -* Thu Apr 30 2026 Neal Gompa - 6.12.0-211.7.1 -- Enable Btrfs support for all kernel variants - -* Thu Apr 30 2026 Andrew Lukoshko - 6.12.0-211.7.1 -- crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec -- crypto: scatterwalk - Backport memcpy_sglist() -- crypto: algif_aead - use memcpy_sglist() instead of null skcipher -- crypto: algif_aead - Revert to operating out-of-place -- crypto: algif_aead - snapshot IV for async AEAD requests -- crypto: authenc - use memcpy_sglist() instead of null skcipher -- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption -- crypto: authencesn - Fix src offset when decrypting in-place -- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl -- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 -- mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 -- megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 -- qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 -- qla4xxx: bring back deprecated PCI ids -- be2iscsi: bring back deprecated PCI ids -- kernel/rh_messages.h: enable all disabled pci devices by moving to - unmaintained - -* Tue Apr 14 2026 Andrew Lukoshko [6.12.0-211.7.1.el10_2] -- Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) -- kabi: enable check-kabi (Čestmír Kalina) -- kabi: add symbols to stablelist (Čestmír Kalina) -- Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) -- Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) -- Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) -- Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) -- Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) -- Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) -- Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - * Wed Apr 01 2026 CKI KWF Bot [6.12.0-211.7.1.el10_2] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] diff --git a/sources b/sources index bc0374195..ec2ca6966 100644 --- a/sources +++ b/sources @@ -1,10 +1,12 @@ SHA512 (fedoraimaca.x509) = e04809394f4472c17e86d7024dee34f03fb68e82a85502fd5b00535202c72e57626a8376b2cf991b7e1e46404aa5ab8d189ebf320e0dd37d49e7efbc925c7a2e -SHA512 (kernel-abi-stablelists-6.12.0-211.7.1.el10_2.tar.xz) = 6b9fe86277f9ec0eb36d00072f07c4b4b00e5defafd20b452775774d62b1f0f18e1e3944c9ac75b87b12766f9db6be0218820a70db9f9e75bae6617124a32987 -SHA512 (kernel-kabi-dw-6.12.0-211.7.1.el10_2.tar.xz) = 2c1fba48a87f1c4457fd7f4ba03b2c837e1e7ae4ff244478af5a8eae74334c2d3bad6d60128b1ab9fb485dbceacd8cd9550ef944b8491c063599dc81e31d3ad9 -SHA512 (linux-6.12.0-211.7.1.el10_2.tar.xz) = 69904b430476a12fc2308928d16801a4254396777f06aa16426ebe53ff1ac056456948be1c20a246b76772764bcbfc8b7ab9d9b907bd6078abb8f2a93013daf2 +SHA512 (kernel-abi-stablelists-6.12.0-211.34.1.el10_2.tar.xz) = 3866e09c54c7fda99741913617c9000b11d1e1555d584d3a72cf021d02fc81e89e1fd1cfbdd91d2ad1648da9d8fd07ab17d352a726f650eb2195f7cdcc5f3962 +SHA512 (kernel-kabi-dw-6.12.0-211.34.1.el10_2.tar.xz) = 7f89e69f121aa3cad12a639cda10c7ac19ba4e65882da631481ce36684048d22e97b1be80ad96bde03467223093977abc293232c134d50023a3ee8ee9aeb2aec +SHA512 (linux-6.12.0-211.34.1.el10_2.tar.xz) = 19fef0fe35ef9e377e9b8673cd3e5faacd4936d7c2b0acec38f2a06e6d9d3164199c49f85b161b9dc41776440e02a0fd4e7bec8fc70e7088d1b699ccea86ca4e SHA512 (nvidiabfdpu.x509) = d9f4fbafcec66803c5944df1f97d4348968141c968e6537252c9854c89dca8ea3be225a9c40abbbf2b7d4d3cfd8c5012cd2d34d90443fbc0277b7a018622ac4f SHA512 (nvidiagpuoot001.x509) = b42f836e1cfa07890cb6ca13de9c3950e306c9ec7686c4c09f050bb68869f5d82962b2cd5f3aa0eb7a0f3a3ae54e9c480eafbac5df53aa92c295ff511a8c59fe SHA512 (nvidiajetsonsoc.x509) = 3c6d4f0800b3fae3c3cc3e5361de31df233e230ea96f0fdd3dcc713e6a71e27309f60e7a98d1a4a90d470f336ce311f22fcc88f219429272e96339717fe001dd +SHA512 (olima1.x509) = 123c26c1d698cc8523845c6e1103b9c72abf855acd225d37baf1f3388a47f912166d6d786fb367fe46de39e011b586ad7f3963aa2e8923da30a6ea9ae0d76ad3 +SHA512 (olimaca1.x509) = 3a779415fad29d6f7250ec97ab1f0a5eb62c351b724feee06b22e17f065bf74a558f32cc524d3222c4485635ae5b9cd5287855c94010fe743b51a4d954340c4c SHA512 (redhatsecureboot501.cer) = eb2c2d342680d4c3453d3e4f30abdd1f6b0e98292e1be0410d0163afd01552a863b70ffaabeecd6e3981cd4d167198091a837c7d70f96a3a06de2d28b3355308 SHA512 (redhatsecurebootca5.cer) = 0285fd7cb1755b399cdd2d848d9eba51b72ef2dd8ea5d40d7061c29685a12e15bf8eb083cb2f8c14eb69d248cb3af2c2332e06f80e19ed4cc029070198c0d522 SHA512 (rheldup3.x509) = ebf56d821acb5c17bb1842a8ddc8f1014a9e112ef7569531eedbabc82c6b5740e2709f96c5ebc87ba837e8085d0b090a9e63ddd06507692b41dae54a2b48d21b