Merge tag 'configfs-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux
Pull configfs fix from Breno Leitao:
- Fix the build of the configfs selftest on 32-bit architectures,
broken since the test was added in the v7.4 merge window.
The harness casts the ASSERT_NE() operands to intmax_t, so handing it
the pointer returned by mkdtemp() triggers gcc's pointer-to-int-cast
warning on 32-bit, and the test builds with -Werror.
KernelCI's 32-bit arm kselftest builds hit this.
* tag 'configfs-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
selftests/configfs: fix the build on 32-bit architectures
Merge tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull udf, ext2, isofs and quota fixes from Jan Kara:
- Some disk format validation improvements for udf
- Fix isofs handling of dates before 1900
- Fix ext2 inadvertedly syncing buffer on every directory modification
- Fix ext2 O_DSYNC handling for direct IO
- A couple of smaller ext2 fixes
- Fix tmpfs quotas for root filesystem
- Unify my email addresses in MAINTAINERS file
* tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
udf: Fix incorrect error code in udf_current_aext()
udf: Simplify udf_table_prealloc_blocks()
udf: don't use eloc after the end of the unallocated space table
udf: fix preallocation discarding before an empty allocation extent
udf: check the unallocated space table when it is loaded
udf: don't let the extent type hide an exhausted free-space table extent
ext2: preserve IOMAP_F_DIRTY for extending direct writes
[9 lines not shown]
Merge tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull fsnotify fixes from Jan Kara:
"Two small fixes for fsnotify"
* tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
inotify: do not coalesce rename events
fsnotify: preserve 64-bit pre-content ranges
Merge tag 'xfs-fixes-7.4-rc2' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux
Pull xfs fixes from Carlos Maiolino:
"The most notable fix here IMO is for xfs's pNFS support (mostly
related to LAYOUTCOMMIT) and for that it contains several patches.
Besides that, this contains bug fixes for different subsystems in xfs.
The last patch is mostly a refactor than a bug fix, but the refactor
is done to prevent a nasty journal transaction state corruption to
happen"
* tag 'xfs-fixes-7.4-rc2' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux:
xfs: kill xfs_trans_set/clear_context() helpers
xfs: fix recovery of partial attr removals
xfs: make pNFS LAYOUTCOMMIT stable the way fdatasync does
xfs: add datasync and log_flushed arguments to xfs_log_force_inode()
xfs: take the invalidate lock while mapping a pNFS layout
xfs: clamp the pNFS layout range to the maximum file size
xfs: cap the block count of xfs_iomap_write_direct() at one extent
[12 lines not shown]
Merge tag 'ovl-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fix a self deadlock of a fanotify permission event listener that also
watches the layers, when it reads an overlay directory
- Three casefold fixes, found by Chris Mason's AI review
- Fix a decode of a modified file handle with nfs_export=on, which
could read the stale lower data of a copied up file, also found by
Chris Mason's AI review
- Fix an overlay selftest after an errno change
* tag 'ovl-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
selftests/fscontext_ns: expect EINVAL for overlay descendant userns create
ovl: look up the index by the decoded origin
ovl: inherit FMODE_NONOTIFY when reading directory layers
[4 lines not shown]
Merge tag 'xsa526-xsa528-7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"Fix three UAF issues that can be hit in the Xen netback and blkback
drivers when a guest is forcing a teardown of a PV device"
* tag 'xsa526-xsa528-7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen-blkback: Avoid UAF when reading I/O statistics
xen-netback: defer xenvif_mcast_addr_list_free()
xen-netback: Fix UAF when reading statistics data
xen-blkback: Avoid UAF when reading I/O statistics
Reading I/O statistics via sysfs concurrently with tearing down a
frontend device might result in UAF or a NULL dereference, as the
reading of the statistics data is not synchronized with freeing the
data.
Use a rwlock for synchronizing.
This is XSA-528 / CVE-2026-100082
Fixes: db6fbc106786 ("xen/blkback: make st_ statistics per ring")
Reported-by: Yehyeong Lee <yhlee at isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross at suse.com>
Acked-by: Roger Pau Monné <roger at xenproject.org>
xen-netback: defer xenvif_mcast_addr_list_free()
In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).
Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().
This is XSA-527 / CVE-2026-100081.
Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect")
Reported-by: kerhunt <kerhunt at proton.me>
Signed-off-by: Jan Beulich <jbeulich at suse.com>
Reviewed-by: Juergen Gross <jgross at suse.com>
xen-netback: Fix UAF when reading statistics data
The network statistic data in the driver is protected by RCU.
Unfortunately when tearing down the queues after an error during
connecting to the frontend (e.g. due to illegal Xenstore data filled
in by the guest), the statistic data is being freed without
synchronizing the RCU state. In case the data is being read via sysfs
in this phase, access to already freed memory or memory being in new
use is possible.
Fix that by calling synchronize_net() before freeing the queue data.
This is XSA-526 / CVE-2026-100080
Reported-by: Yehyeong Lee <yhlee at isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross at suse.com>
Merge tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Bluetooth, IPsec, WiFi and CAN.
Current release - regressions:
- eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced
Previous releases - regressions:
- core:
- use a dedicated flag to track disabled napi instances
- frags: limit the truesize of a reassembly queue
- reject a negative TCP header offset in qdisc_pkt_len_segs_init()y
- tcp:
- reject unhashed sockets during established lookups
- free ireq->ipv6_opt after an RCU grace period
[63 lines not shown]
Merge tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull platform driver fixes from Ilpo Järvinen:
- arm64: asus-glymur-ec: Resolve config loop due to THERMAL symbol
- uniwill-laptop: Add .hw_offloaded() to avoid leds subsystem warning
about missing callback
* tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
platform/x86: uniwill-laptop: Implement .hw_offloaded trigger callback
platform: arm64: drop the vacuous THERMAL dependency from EC_ASUS_GLYMUR
Merge tag 'chrome-platform-firmware-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome platform firmware fixes from Tzung-Bi Shih:
- Don't skip CBMEM entries outside of known memory resources
- Fix a Coccinelle warning for error-pointer handling in coreboot-cfr
* tag 'chrome-platform-firmware-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
firmware: coreboot: Fix CFR error-pointer handling warning
firmware: coreboot: Don't skip CBMEM entries outside of known memory
Merge tag 'hwmon-for-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- acpi_power_meter: Check for 32-bit and 64-bit unknown ACPI values,
Fix missing locking in sysfs show callbacks and resume, and Prevent
spurious power alarm when power is unknown
- aquacomputer_d5next: Avoid truncating scaled sensor readings, Check
maxcollection when probing AQUAERO devices, and reject short status
reports
- asus_rog_ryujin: Fix pump control source on the Ryujin III, and Fix
timeout when reading 0% duty cycle
- asus_wmi_sensors: Avoid global struct mutation
- chipcap2: Series of fixes addressing various bugs in the driver
[56 lines not shown]
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull virtio fixes from Michael Tsirkin:
"vhost, virtio, and vdpa bugfixes.
Just a bunch of fixes all over the place"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (38 commits)
virtio_pci: don't take the MSI mutex under cpu_hotplug_lock
virtio_ring: Initialize id field in packed indirect descriptors
vhost-scsi: fix page reference leak in misaligned I/O fallback
vduse: fix VA/PA confusion in the coherent page fault path
hwrng: virtio - prevent use-after-free after a failed restore
virtio: use consistent virtqueue terminology
virtio_balloon: initialize wakeup_lock before virtqueues are set up
MAINTAINERS: add missing virtio/vdpa/vduse/vhost headers
vhost-vdpa: initialize state before publishing cdev
vhost: reject backend enable without a kick file
vhost-scsi: reject delayed virtqueue setup
[10 lines not shown]
Merge tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core
Pull core memory management fixes from David Hildenbrand:
"Here's a bigger set of MM fixes that we didn't manage to have ready
for -rc1. All fixes are stable-worthy; the majority fixes nasty
long-standing bugs instead of being purely hotfixes.
We have some more of these kinds of stable-worthy fixes in the
pipeline, but we'll focus on the really urgent fixes as we get closer
to the release.
(Leaving urgent MM fixes lurking for various weeks is not good, but
having too many changes close to the release is also not good, it's
tricky ...)
Most issues were reported by Anthropic. Others were found while
reworking proposed fixes, and of course some of the fixes were just
reported and fixed on the mailing list.
[53 lines not shown]
Merge tag 'mm-nonmm-hotfixes-stable-2026-11-04-20-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull non-MM fixes from Andrew Morton:
"22 patches. 17 are cc:stable.
Most are OCFS2 fixes. These address extended-attribute corruption,
missing attributes and kernel BUGs, along with crashes during cluster
configuration, lock migration, recovery and unmount. Extent movement
is also fixed to validate its range against a stable file size.
Three FAT changes prevent a failed-write/FIBMAP race from spuriously
making the filesystem read-only, correct directory link counts after
rename, and speed up file expansion. The reported QEMU benchmarks show
particularly large improvements on synchronous mounts.
A taint-string fix prevents an out-of-bounds read which can expose
slab contents in the kernel log. There are also build fixes for
OpenRISC modules on CPUs without hardware multiply and for Clang 24"
[22 lines not shown]
Merge tag 'mm-hotfixes-stable-2026-11-04-20-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM fixes from Andrew Morton:
- "mm: avoid losing atomic VMA flags" (Lorenzo Stoakes):
Preserve guard-page and soft-dirty state across VMA changes. Prevent
fork and THP collapse from losing guard markers, and keep changes
visible to applications which track modified memory.
- "MAINTAINERS: MM updates" (David Hildenbrand):
Start routing more MM components through mm/core.git and add Zi Yan
as a THP co-maintainer. Update component coverage and integration
branches as part of the transition to separate MM component trees.
- "mm/hugetlb: fix mremap bugs" (Li Zhe):
Fix hugetlb mremap deadlocks and truncated move lengths. Prevent
[80 lines not shown]
udf: Fix incorrect error code in udf_current_aext()
There are two places in udf_current_aext() that return -1 instead of
proper error code. Fix them.
Signed-off-by: Jan Kara <jack at suse.cz>
udf: Simplify udf_table_prealloc_blocks()
Simplify handling when the specified extent is not found in the table
of free blocks.
Signed-off-by: Jan Kara <jack at suse.cz>
udf: fix preallocation discarding before an empty allocation extent
udf_discard_prealloc() finds the last extent of a file by peeking at
the next one with udf_next_aext() and stopping when that returns 0.
The peek reads into eloc and elen, and the code then uses them as the
last extent. But when udf_next_aext() returns 0 they hold no defined
value: if the extent list ends in a continuation descriptor that leads
to an empty allocation extent, they describe that continuation, i.e.
the block of the empty allocation extent, one block long.
The kernel creates such lists itself: when udf_delete_aext() removes
the only descriptor of the last allocation extent in a list, it leaves
that allocation extent empty and the continuation to it in place.
If the last extent is a preallocation, udf_discard_prealloc() deletes
it with udf_delete_aext(), which finds the following allocation extent
empty, so it also removes the continuation and frees that allocation
extent's block. udf_discard_prealloc() then frees eloc and elen: that
block a second time, instead of the preallocated blocks. On a space
[15 lines not shown]
udf: check the unallocated space table when it is loaded
udf_table_new_block() hands out the first block of the extent closest
to its goal and trusts that the extent covers at least one whole block
inside the partition. Nothing checks that. A zero-length extent makes
it return the block the extent points at, which need not be free, and
the subtraction of one block then underflows the length into the type
bits, turning the entry into a bogus continuation. An extent running
past the end of the partition makes it return blocks behind the
partition.
Such tables are not only found on crafted images: until the previous
commit, udf_table_new_block() itself left zero-length extents behind
in tables written by mkudffs, and then converted them into extents
running past the partition.
Check every extent once when the table is loaded, and refuse
read-write access if one is empty, is not a whole number of blocks, or
does not lie inside the partition, in the same way as for other
[26 lines not shown]
udf: don't use eloc after the end of the unallocated space table
When udf_next_aext() returns 0, its eloc, elen and etype outputs hold
no defined value. Two walks of the unallocated space table still use
eloc after the walk has reached the end of the table.
udf_table_prealloc_blocks() looks for a free extent starting at
first_block and decides whether it found one by comparing eloc with
first_block after the walk. If the table's list ends in a continuation
descriptor that leads to an empty allocation extent, eloc is then the
block of that allocation extent, which is in use, and if that is
first_block, the block is handed out as preallocation. Once
udf_discard_prealloc() no longer frees the wrong block, this is what
still makes fsx in generic/091 and generic/263 read back bad data on a
table, in about one run in four. Only take the extent if the walk
stopped at it.
When udf_table_free_blocks() cannot merge the freed blocks into an
existing extent, it appends a new one and sets only its block number,
[12 lines not shown]
udf: don't let the extent type hide an exhausted free-space table extent
udf_table_new_block() takes the first block of the free-space table
extent closest to the goal. It keeps that extent's type and length
together in goal_elen, subtracts one block, and deletes the extent only
if goal_elen then reaches zero. UDF 2.60 section 2.3.7.1 requires the
free-space extents of an Unallocated Space Entry to be of type 1
(allocated but not recorded), and mkudffs writes them that way. For
such an extent the type bits keep goal_elen non-zero, so taking its last
block leaves a type-1 extent of length zero behind, starting at the
block after the extent, which is in use.
The next allocation that picks this empty extent returns that in-use
block. Subtracting a block from 0x40000000 then borrows from the type
bits, and the extent becomes type 0 with a length of 2^30 - blocksize:
about a gigabyte of "free" space overlapping live metadata, the other
table extents and whatever lies behind the partition. From then on
blocks are handed out twice, or past the end of the partition.
[31 lines not shown]
tcp: ipv6: free ireq->ipv6_opt after an RCU grace period
ireq->ipv6_opt is only set by calipso_req_setattr(), when a CALIPSO
NetLabel mapping is configured.
Request socket migration (net.ipv4.tcp_migrate_req=1, or a
BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program) clones the request
socket with inet_reqsk_clone(), so that the old request socket and
its clone share the same ipv6_opt, then reqsk_migrate_reset() clears
the pointer in the old one.
Another cpu holding a reference on the old request socket can still
be using these options, sending a SYNACK from tcp_v6_send_synack()
or creating a child in tcp_v6_syn_recv_sock(), when the clone
is freed. tcp_v6_reqsk_destructor() frees ipv6_opt with a plain
kfree(), leading to a use-after-free.
Both readers already run under RCU, like their IPv4 counterparts.
Use kfree_rcu() in tcp_v6_reqsk_destructor(), as commit e3f33b0a1d89
[13 lines not shown]
mptcp: pm: kernel: use RCU to free endpoint listeners
mptcp_pm_nl_create_listen_socket() starts the TCP listener directly
instead of going through mptcp_listen(). It consequently misses setting
SOCK_RCU_FREE on the parent MPTCP socket.
tcp_child_process() can invoke the listener's subflow_data_ready()
callback without holding the MPTCP parent lock or a reference to the
parent. An authenticated MP_JOIN racing with endpoint teardown can
therefore access the parent after its last reference has been dropped.
The ADD_ADDR error path can also close an already published listener.
Set SOCK_RCU_FREE before __inet_listen_sk() publishes the TCP listener,
matching mptcp_listen(). This protects the parent on every subsequent
close path, including a failed endpoint addition.
Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port")
Cc: stable at vger.kernel.org
Signed-off-by: Kyle Zeng <kylebot at openai.com>
[3 lines not shown]
tcp: initialize send sequence numbers before deferring TFO
TCP_FASTOPEN_CONNECT can return from connect() before tcp_connect_init()
when a cached cookie or cookieless Fast Open allows deferring the SYN.
At this point write_seq contains the initial sequence number, while
snd_una and snd_nxt have not been initialized to that sequence number.
Consequently, inet_diag and /proc/net/tcp{,6} report the initial
sequence number as the send queue length despite no SYN or payload being
queued.
Initialize snd_una and snd_nxt to write_seq before marking the
connection as deferred. Both sequence-based queue lengths then remain
zero until the first write starts the connection and runs
tcp_connect_init().
Fixes: 19f6d3f3c842 ("net/tcp-fastopen: Add new API support")
Signed-off-by: Qingfang Deng <qingfang.deng at linux.dev>
Reviewed-by: Eric Dumazet <edumazet at kernel.org>
[5 lines not shown]
net: bridge: disable MRP ports before the FDB flush in del_nbp()
del_nbp() flushes the port's FDB entries before it unregisters the RX
handler. For a normal port, br_stp_disable_port() moves the port to
BR_STATE_DISABLED before this cleanup.
That does not hold for an MRP ring port. br_set_state() ignores state
changes while BR_MRP_AWARE_BIT is set, so br_stp_disable_port() leaves
the port state alone. br_mrp_port_del() then restores forwarding when
the bridge is up before clearing the bit. A frame received between
br_fdb_cleanup_by_dst() and netdev_rx_handler_unregister() can therefore
create a new FDB entry referencing the dying port. Nothing removes that
entry before destroy_nbp_rcu() frees the port, so a later frame to the
learned MAC can be forwarded through the freed port.
Remove the MRP and CFM instances before disabling the port, so that
br_stp_disable_port() actually transitions it to BR_STATE_DISABLED.
With CONFIG_BRIDGE_VLAN_FILTERING=y, synchronize_net() in
nbp_vlan_group_unpublish() also drains receive paths that could still
[29 lines not shown]
net: stmmac: set XDP metadata length on the page_pool RX path
stmmac_rx() initializes the XDP buffer with the metadata area valid, so
an XDP program can reserve metadata with bpf_xdp_adjust_meta() and write
it in [xdp->data_meta, xdp->data), for example to export the RX hardware
timestamp obtained from the metadata kfunc. When such a frame is passed
to the stack, the skb is built in place around the same page with
napi_build_skb(), but skb_metadata_set() is never called.
napi_build_skb() clears skb_shared_info up to dataref, which includes
meta_len, so skb_metadata_len() stays zero. The stack and TC BPF then see
an empty metadata range even though the bytes are present in the skb
headroom. The AF_XDP zero-copy path already records the length in
stmmac_construct_skb_zc().
Record the metadata length after reserving the headroom and adding the
frame data. No copy is needed because the skb is built over the buffer the
XDP program wrote to. With the length recorded, the software VLAN
stripping path can move the metadata together with the MAC header, as it
[9 lines not shown]
bonding: fix missing down path on speed/duplex failure after FAIL->UP
In bond_miimon_commit(), when a slave is proposed as BOND_LINK_UP but
bond_update_speed_duplex() fails in bonding mode that needs speed/duplex
(802.3ad, tlb, alb), the slave is set to BOND_LINK_DOWN directly. This
bypasses bond_set_slave_link_state(), bond_miimon_link_change() and
failover.
This is fine for slave that coming from BOND_LINK_BACK, which was never
brought up and is not in use. But since commit 1899bb325149 ("bonding:
fix state transition issue in link monitoring") the commit phase also
handles BOND_LINK_FAIL -> BOND_LINK_UP which means a slave that is still
in use and may be curr_active_slave.
If the link recovers within downdelay and goes down again before the
commit phase reads speed/duplex, the slave is silently marked down while
remaining the active slave in worst cases. In alb/tlb the bond MAC stays
on the dead port, no failover happens and TLB/RLB state is not cleaned,
so the bond stops passing traffic until that link comes back even though
[34 lines not shown]
ip6mr: Serialize multicast router socket ownership
MRT6_TABLE checks whether the socket owns its current table before
acquiring RTNL. MRT6_INIT also looks up its table before taking RTNL.
Consequently, concurrent TABLE and INIT calls can initialize the old
table and then change the socket's selected table. Another INIT can
register the same socket in the new table.
rawv6_close() calls ip6mr_sk_done(), which clears only the first table
owned by the socket. After the socket's RCU-delayed free, the other
table retains a dangling mroute_sk pointer. A subsequent multicast cache
report passes that pointer to sock_queue_rcv_skb_reason(). This produces
a KASAN slab-use-after-free in sk_filter_trim_cap().
Look up the selected table in ip6mr_sk_init() after acquiring RTNL.
Likewise, re-read the current table and check its owner under RTNL in
MRT6_TABLE before updating the selection. This preserves the single-table
ownership invariant shared with ip6mr_sk_done(), without changing the
locking of the other multicast socket options.
[6 lines not shown]
