Changelog in Linux kernel 6.12.57

 
arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c [+ + +]
Author: Menglong Dong <[email protected]>
Date:   Wed Sep 17 14:09:13 2025 +0800

    arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
    
    [ Upstream commit 35561bab768977c9e05f1f1a9bc00134c85f3e28 ]
    
    The include/generated/asm-offsets.h is generated in Kbuild during
    compiling from arch/SRCARCH/kernel/asm-offsets.c. When we want to
    generate another similar offset header file, circular dependency can
    happen.
    
    For example, we want to generate a offset file include/generated/test.h,
    which is included in include/sched/sched.h. If we generate asm-offsets.h
    first, it will fail, as include/sched/sched.h is included in asm-offsets.c
    and include/generated/test.h doesn't exist; If we generate test.h first,
    it can't success neither, as include/generated/asm-offsets.h is included
    by it.
    
    In x86_64, the macro COMPILE_OFFSETS is used to avoid such circular
    dependency. We can generate asm-offsets.h first, and if the
    COMPILE_OFFSETS is defined, we don't include the "generated/test.h".
    
    And we define the macro COMPILE_OFFSETS for all the asm-offsets.c for this
    purpose.
    
    Signed-off-by: Menglong Dong <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
audit: record fanotify event regardless of presence of rules [+ + +]
Author: Richard Guy Briggs <[email protected]>
Date:   Wed Aug 6 17:04:07 2025 -0400

    audit: record fanotify event regardless of presence of rules
    
    [ Upstream commit ce8370e2e62a903e18be7dd0e0be2eee079501e1 ]
    
    When no audit rules are in place, fanotify event results are
    unconditionally dropped due to an explicit check for the existence of
    any audit rules.  Given this is a report from another security
    sub-system, allow it to be recorded regardless of the existence of any
    audit rules.
    
    To test, install and run the fapolicyd daemon with default config.  Then
    as an unprivileged user, create and run a very simple binary that should
    be denied.  Then check for an event with
            ausearch -m FANOTIFY -ts recent
    
    Link: https://issues.redhat.com/browse/RHEL-9065
    Signed-off-by: Richard Guy Briggs <[email protected]>
    Signed-off-by: Paul Moore <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
bits: add comments and newlines to #if, #else and #endif directives [+ + +]
Author: Vincent Mailhol <[email protected]>
Date:   Fri Oct 31 18:33:15 2025 +0900

    bits: add comments and newlines to #if, #else and #endif directives
    
    [ Upstream commit 31299a5e0211241171b2222c5633aad4763bf700 ]
    
    This is a preparation for the upcoming GENMASK_U*() and BIT_U*()
    changes. After introducing those new macros, there will be a lot of
    scrolling between the #if, #else and #endif.
    
    Add a comment to the #else and #endif preprocessor macros to help keep
    track of which context we are in. Also, add new lines to better
    visually separate the non-asm and asm sections.
    
    Signed-off-by: Vincent Mailhol <[email protected]>
    Reviewed-by: Andy Shevchenko <[email protected]>
    Signed-off-by: Yury Norov <[email protected]>
    Stable-dep-of: 2ba5772e530f ("gpio: idio-16: Define fixed direction of the GPIO lines")
    Signed-off-by: William Breathitt Gray <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

bits: introduce fixed-type GENMASK_U*() [+ + +]
Author: Vincent Mailhol <[email protected]>
Date:   Fri Oct 31 18:33:16 2025 +0900

    bits: introduce fixed-type GENMASK_U*()
    
    [ Upstream commit 19408200c094858d952a90bf4977733dc89a4df5 ]
    
    Add GENMASK_TYPE() which generalizes __GENMASK() to support different
    types, and implement fixed-types versions of GENMASK() based on it.
    The fixed-type version allows more strict checks to the min/max values
    accepted, which is useful for defining registers like implemented by
    i915 and xe drivers with their REG_GENMASK*() macros.
    
    The strict checks rely on shift-count-overflow compiler check to fail
    the build if a number outside of the range allowed is passed.
    Example:
    
      #define FOO_MASK GENMASK_U32(33, 4)
    
    will generate a warning like:
    
      include/linux/bits.h:51:27: error: right shift count >= width of type [-Werror=shift-count-overflow]
         51 |               type_max(t) >> (BITS_PER_TYPE(t) - 1 - (h)))))
            |                           ^~
    
    The result is casted to the corresponding fixed width type. For
    example, GENMASK_U8() returns an u8. Note that because of the C
    promotion rules, GENMASK_U8() and GENMASK_U16() will immediately be
    promoted to int if used in an expression. Regardless, the main goal is
    not to get the correct type, but rather to enforce more checks at
    compile time.
    
    While GENMASK_TYPE() is crafted to cover all variants, including the
    already existing GENMASK(), GENMASK_ULL() and GENMASK_U128(), for the
    moment, only use it for the newly introduced GENMASK_U*(). The
    consolidation will be done in a separate change.
    
    Co-developed-by: Yury Norov <[email protected]>
    Signed-off-by: Lucas De Marchi <[email protected]>
    Acked-by: Jani Nikula <[email protected]>
    Signed-off-by: Vincent Mailhol <[email protected]>
    Reviewed-by: Andy Shevchenko <[email protected]>
    Signed-off-by: Yury Norov <[email protected]>
    Stable-dep-of: 2ba5772e530f ("gpio: idio-16: Define fixed direction of the GPIO lines")
    Signed-off-by: William Breathitt Gray <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
bonding: check xdp prog when set bond mode [+ + +]
Author: Wang Liang <[email protected]>
Date:   Thu Oct 30 14:59:59 2025 +0800

    bonding: check xdp prog when set bond mode
    
    [ Upstream commit 094ee6017ea09c11d6af187935a949df32803ce0 ]
    
    Following operations can trigger a warning[1]:
    
        ip netns add ns1
        ip netns exec ns1 ip link add bond0 type bond mode balance-rr
        ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp
        ip netns exec ns1 ip link set bond0 type bond mode broadcast
        ip netns del ns1
    
    When delete the namespace, dev_xdp_uninstall() is called to remove xdp
    program on bond dev, and bond_xdp_set() will check the bond mode. If bond
    mode is changed after attaching xdp program, the warning may occur.
    
    Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode
    with xdp program attached is not good. Add check for xdp program when set
    bond mode.
    
        [1]
        ------------[ cut here ]------------
        WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930
        Modules linked in:
        CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
        Workqueue: netns cleanup_net
        RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930
        Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ...
        RSP: 0018:ffffc90000063d80 EFLAGS: 00000282
        RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff
        RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48
        RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb
        R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8
        R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000
        FS:  0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0
        Call Trace:
         <TASK>
         ? __warn+0x83/0x130
         ? unregister_netdevice_many_notify+0x8d9/0x930
         ? report_bug+0x18e/0x1a0
         ? handle_bug+0x54/0x90
         ? exc_invalid_op+0x18/0x70
         ? asm_exc_invalid_op+0x1a/0x20
         ? unregister_netdevice_many_notify+0x8d9/0x930
         ? bond_net_exit_batch_rtnl+0x5c/0x90
         cleanup_net+0x237/0x3d0
         process_one_work+0x163/0x390
         worker_thread+0x293/0x3b0
         ? __pfx_worker_thread+0x10/0x10
         kthread+0xec/0x1e0
         ? __pfx_kthread+0x10/0x10
         ? __pfx_kthread+0x10/0x10
         ret_from_fork+0x2f/0x50
         ? __pfx_kthread+0x10/0x10
         ret_from_fork_asm+0x1a/0x30
         </TASK>
        ---[ end trace 0000000000000000 ]---
    
    Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver")
    Signed-off-by: Wang Liang <[email protected]>
    Acked-by: Jussi Maki <[email protected]>
    Reviewed-by: Nikolay Aleksandrov <[email protected]>
    Reviewed-by: Toke Høiland-Jørgensen <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Rajani Kantha <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

bonding: return detailed error when loading native XDP fails [+ + +]
Author: Hangbin Liu <[email protected]>
Date:   Thu Oct 30 14:59:58 2025 +0800

    bonding: return detailed error when loading native XDP fails
    
    [ Upstream commit 22ccb684c1cae37411450e6e86a379cd3c29cb8f ]
    
    Bonding only supports native XDP for specific modes, which can lead to
    confusion for users regarding why XDP loads successfully at times and
    fails at others. This patch enhances error handling by returning detailed
    error messages, providing users with clearer insights into the specific
    reasons for the failure when loading native XDP.
    
    Reviewed-by: Nikolay Aleksandrov <[email protected]>
    Reviewed-by: Toke Høiland-Jørgensen <[email protected]>
    Signed-off-by: Hangbin Liu <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Rajani Kantha <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
btrfs: abort transaction if we fail to update inode in log replay dir fixup [+ + +]
Author: Filipe Manana <[email protected]>
Date:   Wed Sep 3 17:43:04 2025 +0100

    btrfs: abort transaction if we fail to update inode in log replay dir fixup
    
    [ Upstream commit 5a0565cad3ef7cbf4cf43d1dd1e849b156205292 ]
    
    If we fail to update the inode at link_to_fixup_dir(), we don't abort the
    transaction and propagate the error up the call chain, which makes it hard
    to pinpoint the error to the inode update. So abort the transaction if the
    inode update call fails, so that if it happens we known immediately.
    
    Signed-off-by: Filipe Manana <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: abort transaction in the process_one_buffer() log tree walk callback [+ + +]
Author: Filipe Manana <[email protected]>
Date:   Wed Jul 16 15:49:31 2025 +0100

    btrfs: abort transaction in the process_one_buffer() log tree walk callback
    
    [ Upstream commit e6dd405b6671b9753b98d8bdf76f8f0ed36c11cd ]
    
    In the process_one_buffer() log tree walk callback we return errors to the
    log tree walk caller and then the caller aborts the transaction, if we
    have one, or turns the fs into error state if we don't have one. While
    this reduces code it makes it harder to figure out where exactly an error
    came from. So add the transaction aborts after every failure inside the
    process_one_buffer() callback, so that it helps figuring out why failures
    happen.
    
    Reviewed-by: Boris Burkov <[email protected]>
    Reviewed-by: Qu Wenruo <[email protected]>
    Signed-off-by: Filipe Manana <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: abort transaction on specific error places when walking log tree [+ + +]
Author: Filipe Manana <[email protected]>
Date:   Wed Jul 16 14:56:11 2025 +0100

    btrfs: abort transaction on specific error places when walking log tree
    
    [ Upstream commit 6ebd726b104fa99d47c0d45979e6a6109844ac18 ]
    
    We do several things while walking a log tree (for replaying and for
    freeing a log tree) like reading extent buffers and cleaning them up,
    but we don't immediately abort the transaction, or turn the fs into an
    error state, when one of these things fails. Instead we the transaction
    abort or turn the fs into error state in the caller of the entry point
    function that walks a log tree - walk_log_tree() - which means we don't
    get to know exactly where an error came from.
    
    Improve on this by doing a transaction abort / turn fs into error state
    after each such failure so that when it happens we have a better
    understanding where the failure comes from. This deliberately leaves
    the transaction abort / turn fs into error state in the callers of
    walk_log_tree() as to ensure we don't get into an inconsistent state in
    case we forget to do it deeper in call chain. It also deliberately does
    not do it after errors from the calls to the callback defined in
    struct walk_control::process_func(), as we will do it later on another
    patch.
    
    Reviewed-by: Boris Burkov <[email protected]>
    Reviewed-by: Qu Wenruo <[email protected]>
    Signed-off-by: Filipe Manana <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: always drop log root tree reference in btrfs_replay_log() [+ + +]
Author: Filipe Manana <[email protected]>
Date:   Wed Aug 27 12:10:28 2025 +0100

    btrfs: always drop log root tree reference in btrfs_replay_log()
    
    [ Upstream commit 2f5b8095ea47b142c56c09755a8b1e14145a2d30 ]
    
    Currently we have this odd behaviour:
    
    1) At btrfs_replay_log() we drop the reference of the log root tree if
       the call to btrfs_recover_log_trees() failed;
    
    2) But if the call to btrfs_recover_log_trees() did not fail, we don't
       drop the reference in btrfs_replay_log() - we expect that
       btrfs_recover_log_trees() does it in case it returns success.
    
    Let's simplify this and make btrfs_replay_log() always drop the reference
    on the log root tree, not only this simplifies code as it's what makes
    sense since it's btrfs_replay_log() who grabbed the reference in the first
    place.
    
    Signed-off-by: Filipe Manana <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() [+ + +]
Author: Thorsten Blum <[email protected]>
Date:   Mon Sep 1 17:01:44 2025 +0200

    btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
    
    [ Upstream commit a7f3dfb8293c4cee99743132d69863a92e8f4875 ]
    
    Replace max_t() followed by min_t() with a single clamp().
    
    As was pointed by David Laight in
    https://lore.kernel.org/linux-btrfs/20250906122458.75dfc8f0@pumpkin/
    the calculation may overflow u32 when the input value is too large, so
    clamp_t() is not used.  In practice the expected values are in range of
    megabytes to gigabytes (throughput limit) so the bug would not happen.
    
    Signed-off-by: Thorsten Blum <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    [ Use clamp() and add explanation. ]
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: tree-checker: add inode extref checks [+ + +]
Author: Qu Wenruo <[email protected]>
Date:   Tue Sep 16 08:34:05 2025 +0930

    btrfs: tree-checker: add inode extref checks
    
    [ Upstream commit aab9458b9f0019e97fae394c2d6d9d1a03addfb3 ]
    
    Like inode refs, inode extrefs have a variable length name, which means
    we have to do a proper check to make sure no header nor name can exceed
    the item limits.
    
    The check itself is very similar to check_inode_ref(), just a different
    structure (btrfs_inode_extref vs btrfs_inode_ref).
    
    Reviewed-by: Filipe Manana <[email protected]>
    Signed-off-by: Qu Wenruo <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: tree-checker: fix bounds check in check_inode_extref() [+ + +]
Author: Dan Carpenter <[email protected]>
Date:   Wed Oct 8 18:08:58 2025 +0300

    btrfs: tree-checker: fix bounds check in check_inode_extref()
    
    commit e92c2941204de7b62e9c2deecfeb9eaefe54a22a upstream.
    
    The parentheses for the unlikely() annotation were put in the wrong
    place so it means that the condition is basically never true and the
    bounds checking is skipped.
    
    Fixes: aab9458b9f00 ("btrfs: tree-checker: add inode extref checks")
    Signed-off-by: Dan Carpenter <[email protected]>
    Reviewed-by: Qu Wenruo <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

btrfs: use level argument in log tree walk callback replay_one_buffer() [+ + +]
Author: Filipe Manana <[email protected]>
Date:   Thu Aug 28 17:46:18 2025 +0100

    btrfs: use level argument in log tree walk callback replay_one_buffer()
    
    [ Upstream commit 6cb7f0b8c9b0d6a35682335fea88bd26f089306f ]
    
    We already have the extent buffer's level in an argument, there's no need
    to first ensure the extent buffer's data is loaded (by calling
    btrfs_read_extent_buffer()) and then call btrfs_header_level() to check
    the level. So use the level argument and do the check before calling
    btrfs_read_extent_buffer().
    
    Signed-off-by: Filipe Manana <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() [+ + +]
Author: Filipe Manana <[email protected]>
Date:   Mon Sep 22 12:09:14 2025 +0100

    btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
    
    [ Upstream commit 45c222468d33202c07c41c113301a4b9c8451b8f ]
    
    After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a
    full write barrier, smp_wmb(), but we don't need to, all we need is a
    smp_mb__after_atomic().  The use of the smp_wmb() is from the old days
    when we didn't use a bit and used instead an int field in the root to
    signal if cow is forced. After the int field was changed to a bit in
    the root's state (flags field), we forgot to update the memory barrier
    in create_pending_snapshot() to smp_mb__after_atomic(), but we did the
    change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That
    happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer
    data type for the some variants in btrfs_root"). On the reader side, in
    should_cow_block(), we also use the counterpart smp_mb__before_atomic()
    which generates further confusion.
    
    So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't
    even need any barrier at all since create_pending_snapshot() is called
    in the critical section of a transaction commit and therefore no one
    can concurrently join/attach the transaction, or start a new one, until
    the transaction is unblocked. By the time someone starts a new transaction
    and enters should_cow_block(), a lot of implicit memory barriers already
    took place by having acquired several locks such as fs_info->trans_lock
    and extent buffer locks on the root node at least. Nevertlheless, for
    consistency use smp_mb__after_atomic() after setting the force cow bit
    in create_pending_snapshot().
    
    Signed-off-by: Filipe Manana <[email protected]>
    Reviewed-by: David Sterba <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: zoned: refine extent allocator hint selection [+ + +]
Author: Naohiro Aota <[email protected]>
Date:   Wed Jul 16 11:13:15 2025 +0900

    btrfs: zoned: refine extent allocator hint selection
    
    [ Upstream commit 0d703963d297964451783e1a0688ebdf74cd6151 ]
    
    The hint block group selection in the extent allocator is wrong in the
    first place, as it can select the dedicated data relocation block group for
    the normal data allocation.
    
    Since we separated the normal data space_info and the data relocation
    space_info, we can easily identify a block group is for data relocation or
    not. Do not choose it for the normal data allocation.
    
    Reviewed-by: Johannes Thumshirn <[email protected]>
    Signed-off-by: Naohiro Aota <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

btrfs: zoned: return error from btrfs_zone_finish_endio() [+ + +]
Author: Johannes Thumshirn <[email protected]>
Date:   Tue Jul 22 13:39:11 2025 +0200

    btrfs: zoned: return error from btrfs_zone_finish_endio()
    
    [ Upstream commit 3c44cd3c79fcb38a86836dea6ff8fec322a9e68c ]
    
    Now that btrfs_zone_finish_endio_workfn() is directly calling
    do_zone_finish() the only caller of btrfs_zone_finish_endio() is
    btrfs_finish_one_ordered().
    
    btrfs_finish_one_ordered() already has error handling in-place so
    btrfs_zone_finish_endio() can return an error if the block group lookup
    fails.
    
    Also as btrfs_zone_finish_endio() already checks for zoned filesystems and
    returns early, there's no need to do this in the caller.
    
    Reviewed-by: Damien Le Moal <[email protected]>
    Signed-off-by: Johannes Thumshirn <[email protected]>
    Signed-off-by: David Sterba <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
cpuset: Use new excpus for nocpu error check when enabling root partition [+ + +]
Author: Chen Ridong <[email protected]>
Date:   Fri Sep 19 01:12:27 2025 +0000

    cpuset: Use new excpus for nocpu error check when enabling root partition
    
    [ Upstream commit 59d5de3655698679ad8fd2cc82228de4679c4263 ]
    
    A previous patch fixed a bug where new_prs should be assigned before
    checking housekeeping conflicts. This patch addresses another potential
    issue: the nocpu error check currently uses the xcpus which is not updated.
    Although no issue has been observed so far, the check should be performed
    using the new effective exclusive cpus.
    
    The comment has been removed because the function returns an error if
    nocpu checking fails, which is unrelated to the parent.
    
    Signed-off-by: Chen Ridong <[email protected]>
    Reviewed-by: Waiman Long <[email protected]>
    Signed-off-by: Tejun Heo <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
docs: kdoc: handle the obsolescensce of docutils.ErrorString() [+ + +]
Author: Jonathan Corbet <[email protected]>
Date:   Tue Sep 9 13:35:37 2025 -0600

    docs: kdoc: handle the obsolescensce of docutils.ErrorString()
    
    commit 00d95fcc4dee66dfb6980de6f2973b32f973a1eb upstream.
    
    The ErrorString() and SafeString() docutils functions were helpers meant to
    ease the handling of encodings during the Python 3 transition.  There is no
    real need for them after Python 3.6, and docutils 0.22 removes them,
    breaking the docs build
    
    Handle this by just injecting our own one-liner version of ErrorString(),
    and removing the sole SafeString() call entirely.
    
    Reported-by: Zhixu Liu <[email protected]>
    Signed-off-by: Jonathan Corbet <[email protected]>
    Message-ID: <[email protected]>
    [ Salvatore Bonaccorso: Backport to v6.17.y for context changes in
      Documentation/sphinx/kernel_include.py with major refactorings for the v6.18
      development cycle. Backport ErrorString definition as well to
      Documentation/sphinx/kernel_abi.py file for 6.12.y where it is imported
      from docutils before the faccc0ec64e1 ("docs: sphinx/kernel_abi: adjust
      coding style") change. ]
    Suggested-by: Andreas Radke <[email protected]>
    Signed-off-by: Salvatore Bonaccorso <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
EDAC/mc_sysfs: Increase legacy channel support to 16 [+ + +]
Author: Avadhut Naik <[email protected]>
Date:   Tue Sep 16 20:30:17 2025 +0000

    EDAC/mc_sysfs: Increase legacy channel support to 16
    
    [ Upstream commit 6e1c2c6c2c40ce99e0d2633b212f43c702c1a002 ]
    
    Newer AMD systems can support up to 16 channels per EDAC "mc" device.
    These are detected by the EDAC module running on the device, and the
    current EDAC interface is appropriately enumerated.
    
    The legacy EDAC sysfs interface however, provides device attributes for
    channels 0 through 11 only. Consequently, the last four channels, 12
    through 15, will not be enumerated and will not be visible through the
    legacy sysfs interface.
    
    Add additional device attributes to ensure that all 16 channels, if
    present, are enumerated by and visible through the legacy EDAC sysfs
    interface.
    
    Signed-off-by: Avadhut Naik <[email protected]>
    Signed-off-by: Borislav Petkov (AMD) <[email protected]>
    Link: https://lore.kernel.org/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
f2fs: fix to avoid panic once fallocation fails for pinfile [+ + +]
Author: Chao Yu <[email protected]>
Date:   Fri Oct 31 14:17:10 2025 +0800

    f2fs: fix to avoid panic once fallocation fails for pinfile
    
    [ Upstream commit 48ea8b200414ac69ea96f4c231f5c7ef1fbeffef ]
    
    syzbot reports a f2fs bug as below:
    
    ------------[ cut here ]------------
    kernel BUG at fs/f2fs/segment.c:2746!
    CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.13.0-rc2-syzkaller-00018-g7cb1b4663150 #0
    RIP: 0010:get_new_segment fs/f2fs/segment.c:2746 [inline]
    RIP: 0010:new_curseg+0x1f52/0x1f70 fs/f2fs/segment.c:2876
    Call Trace:
     <TASK>
     __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3210
     f2fs_allocate_new_section fs/f2fs/segment.c:3224 [inline]
     f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3238
     f2fs_expand_inode_data+0x696/0xca0 fs/f2fs/file.c:1830
     f2fs_fallocate+0x537/0xa10 fs/f2fs/file.c:1940
     vfs_fallocate+0x569/0x6e0 fs/open.c:327
     do_vfs_ioctl+0x258c/0x2e40 fs/ioctl.c:885
     __do_sys_ioctl fs/ioctl.c:904 [inline]
     __se_sys_ioctl+0x80/0x170 fs/ioctl.c:892
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    Concurrent pinfile allocation may run out of free section, result in
    panic in get_new_segment(), let's expand pin_sem lock coverage to
    include f2fs_gc(), so that we can make sure to reclaim enough free
    space for following allocation.
    
    In addition, do below changes to enhance error path handling:
    - call f2fs_bug_on() only in non-pinfile allocation path in
    get_new_segment().
    - call reset_curseg_fields() to reset all fields of curseg in
    new_curseg()
    
    Fixes: f5a53edcf01e ("f2fs: support aligned pinned file")
    Reported-by: [email protected]
    Closes: https://lore.kernel.org/linux-f2fs-devel/[email protected]
    Signed-off-by: Chao Yu <[email protected]>
    Signed-off-by: Jaegeuk Kim <[email protected]>
    Signed-off-by: Rajani Kantha <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
gpio: idio-16: Define fixed direction of the GPIO lines [+ + +]
Author: William Breathitt Gray <[email protected]>
Date:   Fri Oct 31 18:33:19 2025 +0900

    gpio: idio-16: Define fixed direction of the GPIO lines
    
    [ Upstream commit 2ba5772e530f73eb847fb96ce6c4017894869552 ]
    
    The direction of the IDIO-16 GPIO lines is fixed with the first 16 lines
    as output and the remaining 16 lines as input. Set the gpio_config
    fixed_direction_output member to represent the fixed direction of the
    GPIO lines.
    
    Fixes: db02247827ef ("gpio: idio-16: Migrate to the regmap API")
    Reported-by: Mark Cave-Ayland <[email protected]>
    Closes: https://lore.kernel.org/r/[email protected]
    Suggested-by: Michael Walle <[email protected]>
    Cc: [email protected] # ae495810cffe: gpio: regmap: add the .fixed_direction_output configuration parameter
    Cc: [email protected]
    Reviewed-by: Andy Shevchenko <[email protected]>
    Signed-off-by: William Breathitt Gray <[email protected]>
    Reviewed-by: Linus Walleij <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Bartosz Golaszewski <[email protected]>
    Signed-off-by: William Breathitt Gray <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

gpio: regmap: add the .fixed_direction_output configuration parameter [+ + +]
Author: Ioana Ciornei <[email protected]>
Date:   Fri Oct 31 18:33:18 2025 +0900

    gpio: regmap: add the .fixed_direction_output configuration parameter
    
    [ Upstream commit 00aaae60faf554c27c95e93d47f200a93ff266ef ]
    
    There are GPIO controllers such as the one present in the LX2160ARDB
    QIXIS FPGA which have fixed-direction input and output GPIO lines mixed
    together in a single register. This cannot be modeled using the
    gpio-regmap as-is since there is no way to present the true direction of
    a GPIO line.
    
    In order to make this use case possible, add a new configuration
    parameter - fixed_direction_output - into the gpio_regmap_config
    structure. This will enable user drivers to provide a bitmap that
    represents the fixed direction of the GPIO lines.
    
    Signed-off-by: Ioana Ciornei <[email protected]>
    Acked-by: Bartosz Golaszewski <[email protected]>
    Reviewed-by: Michael Walle <[email protected]>
    Signed-off-by: Bartosz Golaszewski <[email protected]>
    Stable-dep-of: 2ba5772e530f ("gpio: idio-16: Define fixed direction of the GPIO lines")
    Signed-off-by: William Breathitt Gray <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

gpio: regmap: Allow to allocate regmap-irq device [+ + +]
Author: Mathieu Dubois-Briand <[email protected]>
Date:   Fri Oct 31 18:33:17 2025 +0900

    gpio: regmap: Allow to allocate regmap-irq device
    
    [ Upstream commit 553b75d4bfe9264f631d459fe9996744e0672b0e ]
    
    GPIO controller often have support for IRQ: allow to easily allocate
    both gpio-regmap and regmap-irq in one operation.
    
    Reviewed-by: Andy Shevchenko <[email protected]>
    Acked-by: Bartosz Golaszewski <[email protected]>
    Signed-off-by: Mathieu Dubois-Briand <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Lee Jones <[email protected]>
    Stable-dep-of: 2ba5772e530f ("gpio: idio-16: Define fixed direction of the GPIO lines")
    Signed-off-by: William Breathitt Gray <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE [+ + +]
Author: Kees Bakker <[email protected]>
Date:   Thu Oct 30 11:08:31 2025 -0500

    iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
    
    [ Upstream commit 60f030f7418d3f1d94f2fb207fe3080e1844630b ]
    
    There is a WARN_ON_ONCE to catch an unlikely situation when
    domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless
    happens we must avoid using a NULL pointer.
    
    Signed-off-by: Kees Bakker <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Lu Baolu <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>
    Signed-off-by: Amelia Crate <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Linux: Linux 6.12.57 [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Sun Nov 2 22:15:23 2025 +0900

    Linux 6.12.57
    
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Peter Schneider <[email protected]>
    Tested-by: Brett Mastbergen <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Salvatore Bonaccorso <[email protected]>
    Tested-by: Pavel Machek (CIP) <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Tested-by: Dileep Malepu <[email protected]>
    Tested-by: Linux Kernel Functional Testing <[email protected]>
    Tested-by: Ron Economos <[email protected]>
    Tested-by: Brett A C Sheffield <[email protected]>
    Tested-by: Miguel Ojeda <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR [+ + +]
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Mon Oct 27 11:34:51 2025 -0400

    mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
    
    [ Upstream commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc ]
    
    The special C-flag case expects the ADD_ADDR to be received when
    switching to 'fully-established'. But for various reasons, the ADD_ADDR
    could be sent after the "4th ACK", and the special case doesn't work.
    
    On NIPA, the new test validating this special case for the C-flag failed
    a few times, e.g.
    
      102 default limits, server deny join id 0
            syn rx                 [FAIL] got 0 JOIN[s] syn rx expected 2
    
      Server ns stats
      (...)
      MPTcpExtAddAddrTx  1
      MPTcpExtEchoAdd    1
    
      Client ns stats
      (...)
      MPTcpExtAddAddr    1
      MPTcpExtEchoAddTx  1
    
            synack rx              [FAIL] got 0 JOIN[s] synack rx expected 2
            ack rx                 [FAIL] got 0 JOIN[s] ack rx expected 2
            join Rx                [FAIL] see above
            syn tx                 [FAIL] got 0 JOIN[s] syn tx expected 2
            join Tx                [FAIL] see above
    
    I had a suspicion about what the issue could be: the ADD_ADDR might have
    been received after the switch to the 'fully-established' state. The
    issue was not easy to reproduce. The packet capture shown that the
    ADD_ADDR can indeed be sent with a delay, and the client would not try
    to establish subflows to it as expected.
    
    A simple fix is not to mark the endpoints as 'used' in the C-flag case,
    when looking at creating subflows to the remote initial IP address and
    port. In this case, there is no need to try.
    
    Note: newly added fullmesh endpoints will still continue to be used as
    expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case.
    
    Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag")
    Cc: [email protected]
    Reviewed-by: Geliang Tang <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-1-8207030cb0e8@kernel.org
    Signed-off-by: Jakub Kicinski <[email protected]>
    [ applied to pm_netlink.c instead of pm_kernel.c ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
net/sched: sch_qfq: Fix null-deref in agg_dequeue [+ + +]
Author: Xiang Mei <[email protected]>
Date:   Sat Jul 5 14:21:43 2025 -0700

    net/sched: sch_qfq: Fix null-deref in agg_dequeue
    
    commit dd831ac8221e691e9e918585b1003c7071df0379 upstream.
    
    To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)
    when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return
    value before using it, similar to the existing approach in sch_hfsc.c.
    
    To avoid code duplication, the following changes are made:
    
    1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static
    inline function.
    
    2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to
    include/net/pkt_sched.h so that sch_qfq can reuse it.
    
    3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
    
    Signed-off-by: Xiang Mei <[email protected]>
    Reviewed-by: Cong Wang <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
 
perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK [+ + +]
Author: Dapeng Mi <[email protected]>
Date:   Wed Aug 20 10:30:31 2025 +0800

    perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK
    
    [ Upstream commit 2676dbf9f4fb7f6739d1207c0f1deaf63124642a ]
    
    ICL_FIXED_0_ADAPTIVE is missed to be added into INTEL_FIXED_BITS_MASK,
    add it.
    
    With help of this new INTEL_FIXED_BITS_MASK, intel_pmu_enable_fixed() can
    be optimized. The old fixed counter control bits can be unconditionally
    cleared with INTEL_FIXED_BITS_MASK and then set new control bits base on
    new configuration.
    
    Signed-off-by: Dapeng Mi <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Reviewed-by: Kan Liang <[email protected]>
    Tested-by: Yi Lai <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
perf: Have get_perf_callchain() return NULL if crosstask and user are set [+ + +]
Author: Josh Poimboeuf <[email protected]>
Date:   Wed Aug 20 14:03:40 2025 -0400

    perf: Have get_perf_callchain() return NULL if crosstask and user are set
    
    [ Upstream commit 153f9e74dec230f2e070e16fa061bc7adfd2c450 ]
    
    get_perf_callchain() doesn't support cross-task unwinding for user space
    stacks, have it return NULL if both the crosstask and user arguments are
    set.
    
    Signed-off-by: Josh Poimboeuf <[email protected]>
    Signed-off-by: Steven Rostedt (Google) <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

perf: Skip user unwind if the task is a kernel thread [+ + +]
Author: Josh Poimboeuf <[email protected]>
Date:   Wed Aug 20 14:03:43 2025 -0400

    perf: Skip user unwind if the task is a kernel thread
    
    [ Upstream commit 16ed389227651330879e17bd83d43bd234006722 ]
    
    If the task is not a user thread, there's no user stack to unwind.
    
    Signed-off-by: Josh Poimboeuf <[email protected]>
    Signed-off-by: Steven Rostedt (Google) <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL [+ + +]
Author: Steven Rostedt <[email protected]>
Date:   Wed Aug 20 14:03:41 2025 -0400

    perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL
    
    [ Upstream commit 90942f9fac05702065ff82ed0bade0d08168d4ea ]
    
    To determine if a task is a kernel thread or not, it is more reliable to
    use (current->flags & (PF_KTHREAD|PF_USER_WORKERi)) than to rely on
    current->mm being NULL.  That is because some kernel tasks (io_uring
    helpers) may have a mm field.
    
    Signed-off-by: Steven Rostedt (Google) <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
sched_ext: Make qmap dump operation non-destructive [+ + +]
Author: Tejun Heo <[email protected]>
Date:   Tue Sep 23 09:03:26 2025 -1000

    sched_ext: Make qmap dump operation non-destructive
    
    [ Upstream commit d452972858e5cfa4262320ab74fe8f016460b96f ]
    
    The qmap dump operation was destructively consuming queue entries while
    displaying them. As dump can be triggered anytime, this can easily lead to
    stalls. Add a temporary dump_store queue and modify the dump logic to pop
    entries, display them, and then restore them back to the original queue.
    This allows dump operations to be performed without affecting the
    scheduler's queue state.
    
    Note that if racing against new enqueues during dump, ordering can get
    mixed up, but this is acceptable for debugging purposes.
    
    Acked-by: Andrea Righi <[email protected]>
    Signed-off-by: Tejun Heo <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
seccomp: passthrough uprobe systemcall without filtering [+ + +]
Author: Jiri Olsa <[email protected]>
Date:   Sun Jul 20 13:21:30 2025 +0200

    seccomp: passthrough uprobe systemcall without filtering
    
    [ Upstream commit 89d1d8434d246c96309a6068dfcf9e36dc61227b ]
    
    Adding uprobe as another exception to the seccomp filter alongside
    with the uretprobe syscall.
    
    Same as the uretprobe the uprobe syscall is installed by kernel as
    replacement for the breakpoint exception and is limited to x86_64
    arch and isn't expected to ever be supported in i386.
    
    Signed-off-by: Jiri Olsa <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Reviewed-by: Kees Cook <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

 
selftests: mptcp: disable add_addr retrans in endpoint_tests [+ + +]
Author: Geliang Tang <[email protected]>
Date:   Mon Oct 27 10:22:11 2025 -0400

    selftests: mptcp: disable add_addr retrans in endpoint_tests
    
    [ Upstream commit f92199f551e617fae028c5c5905ddd63e3616e18 ]
    
    To prevent test instability in the "delete re-add signal" test caused by
    ADD_ADDR retransmissions, disable retransmissions for this test by setting
    net.mptcp.add_addr_timeout to 0.
    
    Suggested-by: Matthieu Baerts <[email protected]>
    Signed-off-by: Geliang Tang <[email protected]>
    Reviewed-by: Matthieu Baerts (NGI0) <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-6-521fe9957892@kernel.org
    Signed-off-by: Jakub Kicinski <[email protected]>
    Stable-dep-of: c3496c052ac3 ("selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported")
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported [+ + +]
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Mon Oct 27 10:22:12 2025 -0400

    selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
    
    [ Upstream commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 ]
    
    The call to 'continue_if' was missing: it properly marks a subtest as
    'skipped' if the attached condition is not valid.
    
    Without that, the test is wrongly marked as passed on older kernels.
    
    Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd")
    Cc: [email protected]
    Reviewed-by: Geliang Tang <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-4-8207030cb0e8@kernel.org
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
sfc: fix NULL dereferences in ef100_process_design_param() [+ + +]
Author: Edward Cree <[email protected]>
Date:   Thu Oct 30 11:08:34 2025 -0500

    sfc: fix NULL dereferences in ef100_process_design_param()
    
    [ Upstream commit 8241ecec1cdc6699ae197d52d58e76bddd995fa5 ]
    
    Since cited commit, ef100_probe_main() and hence also
     ef100_check_design_params() run before efx->net_dev is created;
     consequently, we cannot netif_set_tso_max_size() or _segs() at this
     point.
    Move those netif calls to ef100_probe_netdev(), and also replace
     netif_err within the design params code with pci_err.
    
    Reported-by: Kyungwook Boo <[email protected]>
    Fixes: 98ff4c7c8ac7 ("sfc: Separate netdev probe/remove from PCI probe/remove")
    Signed-off-by: Edward Cree <[email protected]>
    Reviewed-by: Michal Swiatkowski <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Amelia Crate <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
udmabuf: fix a buf size overflow issue during udmabuf creation [+ + +]
Author: Xiaogang Chen <[email protected]>
Date:   Thu Oct 30 11:08:32 2025 -0500

    udmabuf: fix a buf size overflow issue during udmabuf creation
    
    [ Upstream commit 021ba7f1babd029e714d13a6bf2571b08af96d0f ]
    
    by casting size_limit_mb to u64  when calculate pglimit.
    
    Signed-off-by: Xiaogang Chen<[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
    Signed-off-by: Christian König <[email protected]>
    Signed-off-by: Amelia Crate <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() [+ + +]
Author: Aditya Kumar Singh <[email protected]>
Date:   Thu Oct 30 11:08:33 2025 -0500

    wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()
    
    [ Upstream commit 5a10971c7645a95f5d5dc23c26fbac4bf61801d0 ]
    
    In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different
    radio, it gets deleted from that radio through a call to
    ath12k_mac_unassign_link_vif(). This action frees the arvif pointer.
    Subsequently, there is a check involving arvif, which will result in a
    read-after-free scenario.
    
    Fix this by moving this check after arvif is again assigned via call to
    ath12k_mac_assign_link_vif().
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    
    Closes: https://scan5.scan.coverity.com/#/project-view/63541/10063?selectedIssue=1636423
    Fixes: b5068bc9180d ("wifi: ath12k: Cache vdev configs before vdev create")
    Signed-off-by: Aditya Kumar Singh <[email protected]>
    Acked-by: Jeff Johnson <[email protected]>
    Acked-by: Kalle Valo <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jeff Johnson <[email protected]>
    Signed-off-by: Amelia Crate <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() [+ + +]
Author: Alexander Wetzel <[email protected]>
Date:   Fri Oct 31 09:50:24 2025 +0800

    wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
    
    [ Upstream commit 2c5dee15239f3f3e31aa5c8808f18996c039e2c1 ]
    
    Callers of wdev_chandef() must hold the wiphy mutex.
    
    But the worker cfg80211_propagate_cac_done_wk() never takes the lock.
    Which triggers the warning below with the mesh_peer_connected_dfs
    test from hostapd and not (yet) released mac80211 code changes:
    
    WARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165
    Modules linked in:
    CPU: 0 UID: 0 PID: 495 Comm: kworker/u4:2 Not tainted 6.14.0-rc5-wt-g03960e6f9d47 #33 13c287eeabfe1efea01c0bcc863723ab082e17cf
    Workqueue: cfg80211 cfg80211_propagate_cac_done_wk
    Stack:
     00000000 00000001 ffffff00 6093267c
     00000000 6002ec30 6d577c50 60037608
     00000000 67e8d108 6063717b 00000000
    Call Trace:
     [<6002ec30>] ? _printk+0x0/0x98
     [<6003c2b3>] show_stack+0x10e/0x11a
     [<6002ec30>] ? _printk+0x0/0x98
     [<60037608>] dump_stack_lvl+0x71/0xb8
     [<6063717b>] ? wdev_chandef+0x60/0x165
     [<6003766d>] dump_stack+0x1e/0x20
     [<6005d1b7>] __warn+0x101/0x20f
     [<6005d3a8>] warn_slowpath_fmt+0xe3/0x15d
     [<600b0c5c>] ? mark_lock.part.0+0x0/0x4ec
     [<60751191>] ? __this_cpu_preempt_check+0x0/0x16
     [<600b11a2>] ? mark_held_locks+0x5a/0x6e
     [<6005d2c5>] ? warn_slowpath_fmt+0x0/0x15d
     [<60052e53>] ? unblock_signals+0x3a/0xe7
     [<60052f2d>] ? um_set_signals+0x2d/0x43
     [<60751191>] ? __this_cpu_preempt_check+0x0/0x16
     [<607508b2>] ? lock_is_held_type+0x207/0x21f
     [<6063717b>] wdev_chandef+0x60/0x165
     [<605f89b4>] regulatory_propagate_dfs_state+0x247/0x43f
     [<60052f00>] ? um_set_signals+0x0/0x43
     [<605e6bfd>] cfg80211_propagate_cac_done_wk+0x3a/0x4a
     [<6007e460>] process_scheduled_works+0x3bc/0x60e
     [<6007d0ec>] ? move_linked_works+0x4d/0x81
     [<6007d120>] ? assign_work+0x0/0xaa
     [<6007f81f>] worker_thread+0x220/0x2dc
     [<600786ef>] ? set_pf_worker+0x0/0x57
     [<60087c96>] ? to_kthread+0x0/0x43
     [<6008ab3c>] kthread+0x2d3/0x2e2
     [<6007f5ff>] ? worker_thread+0x0/0x2dc
     [<6006c05b>] ? calculate_sigpending+0x0/0x56
     [<6003b37d>] new_thread_handler+0x4a/0x64
    irq event stamp: 614611
    hardirqs last  enabled at (614621): [<00000000600bc96b>] __up_console_sem+0x82/0xaf
    hardirqs last disabled at (614630): [<00000000600bc92c>] __up_console_sem+0x43/0xaf
    softirqs last  enabled at (614268): [<00000000606c55c6>] __ieee80211_wake_queue+0x933/0x985
    softirqs last disabled at (614266): [<00000000606c52d6>] __ieee80211_wake_queue+0x643/0x985
    
    Fixes: 26ec17a1dc5e ("cfg80211: Fix radar event during another phy CAC")
    Signed-off-by: Alexander Wetzel <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Johannes Berg <[email protected]>
    [ The author recommends that when porting to older kernels, we should use wiphy_lock()
    and wiphy_unlock() instead of guard(). This tip is mentioned in the link:
    https://patch.msgid.link/[email protected]. ]
    Signed-off-by: Alva Lan <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
x86/bugs: Fix reporting of LFENCE retpoline [+ + +]
Author: David Kaplan <[email protected]>
Date:   Mon Sep 15 08:47:05 2025 -0500

    x86/bugs: Fix reporting of LFENCE retpoline
    
    [ Upstream commit d1cc1baef67ac6c09b74629ca053bf3fb812f7dc ]
    
    The LFENCE retpoline mitigation is not secure but the kernel prints
    inconsistent messages about this fact.  The dmesg log says 'Mitigation:
    LFENCE', implying the system is mitigated.  But sysfs reports 'Vulnerable:
    LFENCE' implying the system (correctly) is not mitigated.
    
    Fix this by printing a consistent 'Vulnerable: LFENCE' string everywhere
    when this mitigation is selected.
    
    Signed-off-by: David Kaplan <[email protected]>
    Signed-off-by: Borislav Petkov (AMD) <[email protected]>
    Link: https://lore.kernel.org/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>

x86/bugs: Report correct retbleed mitigation status [+ + +]
Author: David Kaplan <[email protected]>
Date:   Mon Sep 15 08:47:06 2025 -0500

    x86/bugs: Report correct retbleed mitigation status
    
    [ Upstream commit 930f2361fe542a00de9ce6070b1b6edb976f1165 ]
    
    On Intel CPUs, the default retbleed mitigation is IBRS/eIBRS but this
    requires that a similar spectre_v2 mitigation is applied.  If the user
    selects a different spectre_v2 mitigation (like spectre_v2=retpoline) a
    warning is printed but sysfs will still report 'Mitigation: IBRS' or
    'Mitigation: Enhanced IBRS'.  This is incorrect because retbleed is not
    mitigated, and IBRS is not actually set.
    
    Fix this by choosing RETBLEED_MITIGATION_NONE in this scenario so the
    kernel correctly reports the system as vulnerable to retbleed.
    
    Signed-off-by: David Kaplan <[email protected]>
    Signed-off-by: Borislav Petkov (AMD) <[email protected]>
    Link: https://lore.kernel.org/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>