6.18-stable patches added patches: btrfs-make-sure-extent_buffer_reading-is-cleared-under-refs_lock.patch cifs-consolidate-time_last_write-stamp-into-_cifsfileinfo_put.patch ice-fix-broken-rx-on-vfs.patch media-verisilicon-fix-kernel-panic-due-to-__initconst-misuse.patch net-fix-backlog_unlock_irq_restore-vs-config_preempt_rt.patch netfs-afs-fix-symlink-reading.patch netfs-fix-missing-alloc-tagging-of-direct-mempool-allocations.patch workqueue-fix-devm_alloc_workqueue-va_list-misuse.patch
diff --git a/queue-6.18/btrfs-make-sure-extent_buffer_reading-is-cleared-under-refs_lock.patch b/queue-6.18/btrfs-make-sure-extent_buffer_reading-is-cleared-under-refs_lock.patch new file mode 100644 index 0000000..4a6be3d --- /dev/null +++ b/queue-6.18/btrfs-make-sure-extent_buffer_reading-is-cleared-under-refs_lock.patch
@@ -0,0 +1,222 @@ +From 690c2accacb1aca91ab8186d15dee56da8723f31 Mon Sep 17 00:00:00 2001 +From: Qu Wenruo <wqu@suse.com> +Date: Sat, 20 Jun 2026 14:37:02 +0930 +Subject: btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock + +From: Qu Wenruo <wqu@suse.com> + +commit 690c2accacb1aca91ab8186d15dee56da8723f31 upstream. + +[FALSE ALERTS] +There is a bug report that the warning inside +invalidate_and_check_btree_folios() got triggered during btrfs/298: + + BTRFS info (device sdd): first mount of filesystem f9bf732a-a19b-44b9-99a7-614ddff168e2 + BTRFS info (device sdd): using crc32c checksum algorithm + BTRFS error (device sdd): failed to find fsid cb2fdb42-b638-4f2f-badd-4127467ba674 when attempting to open seed devices + BTRFS error (device sdd): failed to read chunk tree: -2 + ------------[ cut here ]------------ + WARNING: disk-io.c:3342 at invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs], CPU#4: mount/125993 + CPU: 4 UID: 0 PID: 125993 Comm: mount Tainted: G W OE 7.1.0-rc7-custom+ #1 PREEMPT(full) + Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025 + Call trace: + invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs] (P) + open_ctree+0x1f50/0x23b0 [btrfs] + btrfs_get_tree+0x89c/0xc48 [btrfs] + vfs_get_tree+0x30/0x110 + vfs_cmd_create+0x58/0xe8 + __arm64_sys_fsconfig+0x39c/0x518 + invoke_syscall.constprop.0+0x48/0x120 + el0_svc_common.constprop.0+0x40/0xe8 + do_el0_svc+0x24/0x38 + el0_svc+0x50/0x310 + el0t_64_sync_handler+0xa0/0xe8 + el0t_64_sync+0x198/0x1a0 + ---[ end trace 0000000000000000 ]--- + BTRFS warning (device sdd): unable to release extent buffer 365985792 owner 3 gen 17 refs 3 flags 0x5 + +[CAUSE] +In that invalidate_and_check_btree_folios() we wait for the eb to finish +its read, then check if it's only held by us and the btree inode. + +If not, then do a warning as it may be still held, and could cause +problems. + +But there is a small window where the check can lead to false alerts: + + Thread A (Read endio) | Thread B (Unmount) +----------------------------------+------------------------------------- + end_bbio_meta_read() | + | The eb has one extra ref held | + | by the reader, and has | + | EXTENT_BUFFER_READING flag set | invalidate_and_check_btree_folios() + | | | + |- clear_extent_buffer_reading() | | + | | |- wait_on_bit_io(); + | | | The EXTENT_BUFFER_READING flag is + | | | cleared + | | |- if (refcount_read(eb->refs) > 2) + | | The eb is held by the read, us + | | and btree inode, thus it + | | will trigger the warning + |- free_extent_buffer() | + +[FIX] +Introduce a helper, free_extent_buffer_clear_reading(). + +If the new parameter, @clear_reading, is set, we will hold the spinlock +at the beginning of free_extent_buffer_clear_reading() to make sure the +EXTENT_BUFFER_READING flag is cleared inside the same critical section +of decreasing refs. + +Now free_extent_buffer() will just call +free_extent_buffer_clear_reading() with @clear_reading set to false, so +no behavior change. + +But for end_bbio_meta_read(), it will not clear_extent_buffer_reading() +directly, but pass @clear_reading as true. + +Then inside invalidate_and_check_btree_folios(), hold the refs_lock +before reading refs. +So that we eliminate the race window completely. + +Reported-by: Su Yue <glass.su@suse.com> +Link: https://lore.kernel.org/linux-btrfs/DC0C775E-13B3-47D9-9AB2-895BB11C029D@suse.com/ +Fixes: 83f7e52b7ed1 ("btrfs: warn about extent buffer that can not be released") +Reviewed-by: Filipe Manana <fdmanana@suse.com> +Signed-off-by: Qu Wenruo <wqu@suse.com> +Signed-off-by: David Sterba <dsterba@suse.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/btrfs/disk-io.c | 16 ++++++++++++++-- + fs/btrfs/extent_io.c | 43 +++++++++++++++++++++++++++++++++---------- + 2 files changed, 47 insertions(+), 12 deletions(-) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3279,6 +3279,8 @@ static void invalidate_and_check_btree_f + */ + rcu_read_lock(); + xa_for_each(&fs_info->buffer_tree, index, eb) { ++ unsigned int refs; ++ + /* Increase the ref so that the eb won't disappear. */ + if (!refcount_inc_not_zero(&eb->refs)) + continue; +@@ -3289,16 +3291,26 @@ static void invalidate_and_check_btree_f + wait_on_bit_io(&eb->bflags, EXTENT_BUFFER_READING, + TASK_UNINTERRUPTIBLE); + /* ++ * We hold the spinlock to make sure above ++ * EXTENT_BUFFER_READING flag is cleared with the held ++ * ref dropped. ++ * Or we can hit a race window and lead to false alerts. ++ */ ++ spin_lock(&eb->refs_lock); ++ refs = refcount_read(&eb->refs); ++ spin_unlock(&eb->refs_lock); ++ ++ /* + * The refs threshold is 2, one held by us at the beginning + * of the loop, one for the ownership in the buffer tree. + */ +- if (unlikely(refcount_read(&eb->refs) > 2 || extent_buffer_under_io(eb))) { ++ if (unlikely(refs > 2 || extent_buffer_under_io(eb))) { + WARN_ON_ONCE(IS_ENABLED(CONFIG_BTRFS_DEBUG)); + btrfs_warn(fs_info, + "unable to release extent buffer %llu owner %llu gen %llu refs %u flags 0x%lx", + eb->start, btrfs_header_owner(eb), + btrfs_header_generation(eb), +- refcount_read(&eb->refs), eb->bflags); ++ refs, eb->bflags); + } + free_extent_buffer(eb); + rcu_read_lock(); +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -3726,12 +3726,31 @@ static int release_extent_buffer(struct + return 0; + } + +-void free_extent_buffer(struct extent_buffer *eb) ++static void clear_extent_buffer_reading(struct extent_buffer *eb) ++{ ++ clear_and_wake_up_bit(EXTENT_BUFFER_READING, &eb->bflags); ++} ++ ++static void free_extent_buffer_clear_reading(struct extent_buffer *eb, ++ bool clear_reading) + { + int refs; ++ + if (!eb) + return; + ++ /* ++ * We want to clear EXTENT_BUFFER_READING flag and decrease refs ++ * in the same critical section. ++ * This will make sure invalidate_and_check_btree_folios() won't ++ * see an eb with EXTENT_BUFFER_READING cleared but refs not yet ++ * decreased. ++ */ ++ if (clear_reading) { ++ spin_lock(&eb->refs_lock); ++ clear_extent_buffer_reading(eb); ++ } ++ + refs = refcount_read(&eb->refs); + while (1) { + if (test_bit(EXTENT_BUFFER_UNMAPPED, &eb->bflags)) { +@@ -3742,11 +3761,16 @@ void free_extent_buffer(struct extent_bu + } + + /* Optimization to avoid locking eb->refs_lock. */ +- if (atomic_try_cmpxchg(&eb->refs.refs, &refs, refs - 1)) ++ if (atomic_try_cmpxchg(&eb->refs.refs, &refs, refs - 1)) { ++ if (clear_reading) ++ spin_unlock(&eb->refs_lock); + return; ++ } + } + +- spin_lock(&eb->refs_lock); ++ if (!clear_reading) ++ spin_lock(&eb->refs_lock); ++ + if (refcount_read(&eb->refs) == 2 && + test_bit(EXTENT_BUFFER_STALE, &eb->bflags) && + !extent_buffer_under_io(eb) && +@@ -3760,6 +3784,11 @@ void free_extent_buffer(struct extent_bu + release_extent_buffer(eb); + } + ++void free_extent_buffer(struct extent_buffer *eb) ++{ ++ return free_extent_buffer_clear_reading(eb, false); ++} ++ + void free_extent_buffer_stale(struct extent_buffer *eb) + { + if (!eb) +@@ -3896,11 +3925,6 @@ void set_extent_buffer_uptodate(struct e + btrfs_meta_folio_set_uptodate(eb->folios[i], eb); + } + +-static void clear_extent_buffer_reading(struct extent_buffer *eb) +-{ +- clear_and_wake_up_bit(EXTENT_BUFFER_READING, &eb->bflags); +-} +- + static void end_bbio_meta_read(struct btrfs_bio *bbio) + { + struct extent_buffer *eb = bbio->private; +@@ -3924,8 +3948,7 @@ static void end_bbio_meta_read(struct bt + else + clear_extent_buffer_uptodate(eb); + +- clear_extent_buffer_reading(eb); +- free_extent_buffer(eb); ++ free_extent_buffer_clear_reading(eb, true); + + bio_put(&bbio->bio); + }
diff --git a/queue-6.18/cifs-consolidate-time_last_write-stamp-into-_cifsfileinfo_put.patch b/queue-6.18/cifs-consolidate-time_last_write-stamp-into-_cifsfileinfo_put.patch new file mode 100644 index 0000000..c287ad1 --- /dev/null +++ b/queue-6.18/cifs-consolidate-time_last_write-stamp-into-_cifsfileinfo_put.patch
@@ -0,0 +1,194 @@ +From 0e3ea5445c228048f937ad5a944c27859a78f971 Mon Sep 17 00:00:00 2001 +From: Frank Sorenson <sorenson@redhat.com> +Date: Fri, 24 Jul 2026 11:30:35 -0500 +Subject: cifs: consolidate time_last_write stamp into _cifsFileInfo_put() + +From: Frank Sorenson <sorenson@redhat.com> + +commit 0e3ea5445c228048f937ad5a944c27859a78f971 upstream. + +The time_last_write stamp was scattered across cifs_close(), +smb2_deferred_work_close(), and the three drain functions in misc.c. +This missed the case where background I/O holds the final reference +after userspace close() returns, and required explicit maintenance at +each close-path site. + +Move the smp_store_release() into _cifsFileInfo_put(), immediately +before releasing open_file_lock. This single location covers all +close paths unconditionally: normal close, background I/O dropping the +final reference, deferred close via timer or external drain. The +spinlock's store-release/load-acquire pairing with is_inode_writable() +already provides the ordering guarantee documented in +is_size_safe_to_change(). + +Remove the now-redundant stamps from cifs_close(), +smb2_deferred_work_close(), and all six stamp sites in the misc.c +deferred-close drain functions. + +Fixes: e8a8d54c2d50 ("cifs: prevent readdir from changing file size due to stale directory metadata") +Signed-off-by: Frank Sorenson <sorenson@redhat.com> +Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/smb/client/file.c | 37 ++++++++++++++++--------------------- + fs/smb/client/misc.c | 51 ++++++--------------------------------------------- + 2 files changed, 22 insertions(+), 66 deletions(-) + +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -906,6 +906,14 @@ void _cifsFileInfo_put(struct cifsFileIn + cifs_set_oplock_level(cifsi, 0); + } + ++ if (OPEN_FMODE(cifs_file->f_flags) & FMODE_WRITE) { ++ /* Stamp while open_file_lock is held; covers all close paths ++ * including background I/O. Pairs with smp_load_acquire() in ++ * is_size_safe_to_change(). ++ */ ++ smp_store_release(&cifsi->time_last_write, jiffies); ++ } ++ + spin_unlock(&cifsi->open_file_lock); + spin_unlock(&tcon->open_file_lock); + +@@ -1420,15 +1428,6 @@ void smb2_deferred_work_close(struct wor + cifs_del_deferred_close(cfile); + cfile->deferred_close_scheduled = false; + spin_unlock(&cinode->deferred_lock); +- /* +- * Refresh time_last_write immediately before the actual server close +- * so the protection window is anchored to the real close time, not +- * the earlier userspace close time stored by cifs_close(). +- */ +- if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&cinode->time_last_write, jiffies); +- } + _cifsFileInfo_put(cfile, true, false); + } + +@@ -1457,10 +1456,6 @@ int cifs_close(struct inode *inode, stru + if (file->private_data != NULL) { + cfile = file->private_data; + file->private_data = NULL; +- if (file->f_mode & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&cinode->time_last_write, jiffies); +- } + dclose = kmalloc(sizeof(struct cifs_deferred_close), GFP_KERNEL); + if ((cfile->status_file_deleted == false) && + (smb2_can_defer_close(inode, dclose))) { +@@ -3171,13 +3166,13 @@ bool is_size_safe_to_change(struct cifsI + * No writable handles open. Check whether we are within the attribute + * cache validity window of a recent local modification. + * +- * For the close() path: cifs_close() calls smp_store_release() on +- * time_last_write before _cifsFileInfo_put() removes the handle under +- * open_file_lock. That spin_unlock() is a store-release that pairs +- * with the spin_lock() (load-acquire) in is_inode_writable() above, +- * so if is_inode_writable() returned false the smp_load_acquire() +- * below is guaranteed to observe any time_last_write update from a +- * concurrent close(). ++ * For the close() path: _cifsFileInfo_put() stamps time_last_write ++ * (via smp_store_release()) before releasing open_file_lock. That ++ * spin_unlock() is a store-release that pairs with the spin_lock() ++ * (load-acquire) in is_inode_writable() above, so if ++ * is_inode_writable() returned false the smp_load_acquire() below is ++ * guaranteed to observe any time_last_write update from a concurrent ++ * close(), covering all close paths including background I/O. + * + * For the setattr/truncate paths: those callers use smp_store_release() + * directly; the smp_load_acquire() below pairs with that store. There +@@ -3192,7 +3187,7 @@ bool is_size_safe_to_change(struct cifsI + * jiffies is still close to INITIAL_JIFFIES on 32-bit systems. + */ + if (from_readdir) { +- /* Pairs with smp_store_release() at close and truncate sites. */ ++ /* Pairs with smp_store_release() in _cifsFileInfo_put() and setattr. */ + tlw = smp_load_acquire(&cifsInode->time_last_write); + if (tlw && time_before(jiffies, tlw + cifs_sb->ctx->acregmax)) + return false; +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -804,24 +804,11 @@ cifs_close_deferred_file(struct cifsInod + } + spin_unlock(&cifs_inode->open_file_lock); + +- if (failed_cfile) { +- if (OPEN_FMODE(failed_cfile->f_flags) & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&CIFS_I(d_inode(failed_cfile->dentry))->time_last_write, +- jiffies); +- } ++ if (failed_cfile) + _cifsFileInfo_put(failed_cfile, false, false); +- } + + list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { +- struct cifsFileInfo *cfile = tmp_list->cfile; +- +- if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, +- jiffies); +- } +- _cifsFileInfo_put(cfile, false, false); ++ _cifsFileInfo_put(tmp_list->cfile, false, false); + list_del(&tmp_list->list); + kfree(tmp_list); + } +@@ -855,24 +842,11 @@ cifs_close_all_deferred_files(struct cif + } + spin_unlock(&tcon->open_file_lock); + +- if (failed_cfile) { +- if (OPEN_FMODE(failed_cfile->f_flags) & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&CIFS_I(d_inode(failed_cfile->dentry))->time_last_write, +- jiffies); +- } ++ if (failed_cfile) + _cifsFileInfo_put(failed_cfile, true, false); +- } + + list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { +- struct cifsFileInfo *cfile = tmp_list->cfile; +- +- if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, +- jiffies); +- } +- _cifsFileInfo_put(cfile, true, false); ++ _cifsFileInfo_put(tmp_list->cfile, true, false); + list_del(&tmp_list->list); + kfree(tmp_list); + } +@@ -942,24 +916,11 @@ void cifs_close_deferred_file_under_dent + } + spin_unlock(&tcon->open_file_lock); + +- if (failed_cfile) { +- if (OPEN_FMODE(failed_cfile->f_flags) & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&CIFS_I(d_inode(failed_cfile->dentry))->time_last_write, +- jiffies); +- } ++ if (failed_cfile) + _cifsFileInfo_put(failed_cfile, true, false); +- } + + list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { +- struct cifsFileInfo *cfile = tmp_list->cfile; +- +- if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { +- /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ +- smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, +- jiffies); +- } +- _cifsFileInfo_put(cfile, true, false); ++ _cifsFileInfo_put(tmp_list->cfile, true, false); + list_del(&tmp_list->list); + kfree(tmp_list); + }
diff --git a/queue-6.18/ice-fix-broken-rx-on-vfs.patch b/queue-6.18/ice-fix-broken-rx-on-vfs.patch new file mode 100644 index 0000000..29e323e --- /dev/null +++ b/queue-6.18/ice-fix-broken-rx-on-vfs.patch
@@ -0,0 +1,47 @@ +From 436fa8e7d1a119ec90f39e7c2ce0f3a146652899 Mon Sep 17 00:00:00 2001 +From: Alexander Lobakin <aleksander.lobakin@intel.com> +Date: Mon, 24 Nov 2025 18:07:35 +0100 +Subject: ice: fix broken Rx on VFs + +From: Alexander Lobakin <aleksander.lobakin@intel.com> + +commit 436fa8e7d1a119ec90f39e7c2ce0f3a146652899 upstream. + +Since the tagged commit, ice stopped respecting Rx buffer length +passed from VFs. +At that point, the buffer length was hardcoded in ice, so VFs still +worked up to some point (until, for example, a VF wanted an MTU +larger than its PF). +The next commit 93f53db9f9dc ("ice: switch to Page Pool"), broke +Rx on VFs completely since ice started accounting per-queue buffer +lengths again, but now VF queues always had their length zeroed, as +ice was already ignoring what iavf was passing to it. + +Restore the line that initializes the buffer length on VF queues +basing on the virtchnl messages. + +Fixes: 3a4f419f7509 ("ice: drop page splitting and recycling") +Reported-by: Jakub Slepecki <jakub.slepecki@intel.com> +Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> +Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com> +Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> +Tested-by: Jakub Slepecki <jakub.slepecki@intel.com> +Link: https://patch.msgid.link/20251124170735.3077425-1-aleksander.lobakin@intel.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/net/ethernet/intel/ice/virt/queues.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/intel/ice/virt/queues.c ++++ b/drivers/net/ethernet/intel/ice/virt/queues.c +@@ -863,6 +863,9 @@ int ice_vc_cfg_qs_msg(struct ice_vf *vf, + (qpi->rxq.databuffer_size > ((16 * 1024) - 128) || + qpi->rxq.databuffer_size < 128)) + goto error_param; ++ ++ ring->rx_buf_len = qpi->rxq.databuffer_size; ++ + if (qpi->rxq.max_pkt_size > max_frame_size || + qpi->rxq.max_pkt_size < 64) + goto error_param;
diff --git a/queue-6.18/media-verisilicon-fix-kernel-panic-due-to-__initconst-misuse.patch b/queue-6.18/media-verisilicon-fix-kernel-panic-due-to-__initconst-misuse.patch new file mode 100644 index 0000000..975397a --- /dev/null +++ b/queue-6.18/media-verisilicon-fix-kernel-panic-due-to-__initconst-misuse.patch
@@ -0,0 +1,60 @@ +From e8d97c270cb46a2a88739019d0f8547adc7d97da Mon Sep 17 00:00:00 2001 +From: Ming Qian <ming.qian@oss.nxp.com> +Date: Fri, 6 Mar 2026 11:10:57 +0800 +Subject: media: verisilicon: Fix kernel panic due to __initconst misuse + +From: Ming Qian <ming.qian@oss.nxp.com> + +commit e8d97c270cb46a2a88739019d0f8547adc7d97da upstream. + +Fix a kernel panic when probing the driver as a module: + + Unable to handle kernel paging request at virtual address + ffffd9c18eb05000 + of_find_matching_node_and_match+0x5c/0x1a0 + hantro_probe+0x2f4/0x7d0 [hantro_vpu] + +The imx8mq_vpu_shared_resources array is referenced by variant +structures through their shared_devices field. When built as a +module, __initconst causes this data to be freed after module +init, but it's later accessed during probe, causing a page fault. + +The imx8mq_vpu_shared_resources is referenced from non-init code, +so keeping __initconst or __initconst_or_module here is wrong. + +Drop the __initconst annotation and let it live in the normal .rodata +section. + +A bug of __initconst called from regular non-init probe code +leading to bugs during probe deferrals or during unbind-bind cycles. + +Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> +Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/ +Reported-by: Franz Schnyder <franz.schnyder@toradex.com> +Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/ +Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC") +Suggested-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> +Suggested-by: Marco Felsch <m.felsch@pengutronix.de> +Reviewed-by: Marco Felsch <m.felsch@pengutronix.de> +Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> +Reviewed-by: Frank Li <Frank.Li@nxp.com> +Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> +Cc: stable@kernel.org +Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> +Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/media/platform/verisilicon/imx8m_vpu_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c ++++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c +@@ -343,7 +343,7 @@ const struct hantro_variant imx8mq_vpu_v + .num_regs = ARRAY_SIZE(imx8mq_reg_names) + }; + +-static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = { ++static const struct of_device_id imx8mq_vpu_shared_resources[] = { + { .compatible = "nxp,imx8mq-vpu-g1", }, + { .compatible = "nxp,imx8mq-vpu-g2", }, + { /* sentinel */ }
diff --git a/queue-6.18/net-fix-backlog_unlock_irq_restore-vs-config_preempt_rt.patch b/queue-6.18/net-fix-backlog_unlock_irq_restore-vs-config_preempt_rt.patch new file mode 100644 index 0000000..8b708eb --- /dev/null +++ b/queue-6.18/net-fix-backlog_unlock_irq_restore-vs-config_preempt_rt.patch
@@ -0,0 +1,78 @@ +From 26f29b14916964043bc25b55ad1b9f5e9a12ca53 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet <edumazet@google.com> +Date: Fri, 13 Feb 2026 12:04:27 +0000 +Subject: net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT + +From: Eric Dumazet <edumazet@google.com> + +commit 26f29b14916964043bc25b55ad1b9f5e9a12ca53 upstream. + +CONFIG_PREEMPT_RT is special, make this clear in backlog_lock_irq_save() +and backlog_unlock_irq_restore(). + +The issue shows up with CONFIG_DEBUG_IRQFLAGS=y + +raw_local_irq_restore() called with IRQs enabled + WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20 kernel/locking/irqflag-debug.c:10, CPU#1: aoe_tx0/1321 +Modules linked in: +CPU: 1 UID: 0 PID: 1321 Comm: aoe_tx0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 + RIP: 0010:warn_bogus_irq_restore+0xc/0x20 kernel/locking/irqflag-debug.c:10 +Call Trace: + <TASK> + backlog_unlock_irq_restore net/core/dev.c:253 [inline] + enqueue_to_backlog+0x525/0xcf0 net/core/dev.c:5347 + netif_rx_internal+0x120/0x550 net/core/dev.c:5659 + __netif_rx+0xa9/0x110 net/core/dev.c:5679 + loopback_xmit+0x43a/0x660 drivers/net/loopback.c:90 + __netdev_start_xmit include/linux/netdevice.h:5275 [inline] + netdev_start_xmit include/linux/netdevice.h:5284 [inline] + xmit_one net/core/dev.c:3864 [inline] + dev_hard_start_xmit+0x2df/0x830 net/core/dev.c:3880 + __dev_queue_xmit+0x16f4/0x3990 net/core/dev.c:4829 + dev_queue_xmit include/linux/netdevice.h:3384 [inline] + +Fixes: 27a01c1969a5 ("net: fully inline backlog_unlock_irq_restore()") +Signed-off-by: Eric Dumazet <edumazet@google.com> +Link: https://patch.msgid.link/20260213120427.2914544-1-edumazet@google.com +Signed-off-by: Paolo Abeni <pabeni@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + net/core/dev.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -231,10 +231,13 @@ static bool use_backlog_threads(void) + static inline void backlog_lock_irq_save(struct softnet_data *sd, + unsigned long *flags) + { +- if (IS_ENABLED(CONFIG_RPS) || use_backlog_threads()) ++ if (IS_ENABLED(CONFIG_PREEMPT_RT)) { + spin_lock_irqsave(&sd->input_pkt_queue.lock, *flags); +- else ++ } else { + local_irq_save(*flags); ++ if (IS_ENABLED(CONFIG_RPS) || use_backlog_threads()) ++ spin_lock(&sd->input_pkt_queue.lock); ++ } + } + + static inline void backlog_lock_irq_disable(struct softnet_data *sd) +@@ -248,9 +251,13 @@ static inline void backlog_lock_irq_disa + static inline void backlog_unlock_irq_restore(struct softnet_data *sd, + unsigned long flags) + { +- if (IS_ENABLED(CONFIG_RPS) || use_backlog_threads()) +- spin_unlock(&sd->input_pkt_queue.lock); +- local_irq_restore(flags); ++ if (IS_ENABLED(CONFIG_PREEMPT_RT)) { ++ spin_unlock_irqrestore(&sd->input_pkt_queue.lock, flags); ++ } else { ++ if (IS_ENABLED(CONFIG_RPS) || use_backlog_threads()) ++ spin_unlock(&sd->input_pkt_queue.lock); ++ local_irq_restore(flags); ++ } + } + + static inline void backlog_unlock_irq_enable(struct softnet_data *sd)
diff --git a/queue-6.18/netfs-afs-fix-symlink-reading.patch b/queue-6.18/netfs-afs-fix-symlink-reading.patch new file mode 100644 index 0000000..28bc813 --- /dev/null +++ b/queue-6.18/netfs-afs-fix-symlink-reading.patch
@@ -0,0 +1,45 @@ +From c51e89c5b5db3e1927738fad7cd18b66dde68aed Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Tue, 15 Sep 2026 17:21:59 +0100 +Subject: netfs, afs: Fix symlink reading + +From: David Howells <dhowells@redhat.com> + +commit c51e89c5b5db3e1927738fad7cd18b66dde68aed upstream. + +Fix the reading of symlinks from the cache in afs by making netfslib trim +the amount read down to i_size. The problem is that afs sets the size of +the iterator to the size of the buffer (PAGE_SIZE) so that the cache can +round the read size up to the cache's DIO size. + +Note that this also impacts the reading of AFS mountpoints as they're just +stored as symlinks with an odd file mode. + +Link: https://patch.msgid.link/3912795.1789489319@warthog.procyon.org.uk +Fixes: c0410adf3da6 ("afs: Fix the locking used by afs_get_link()") +Reviewed-by: Paulo Alcantara <pc@manguebit.org> +cc: Paulo Alcantara <pc@manguebit.org> +cc: Marc Dionne <marc.dionne@auristor.com> +cc: linux-afs@lists.infradead.org +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/netfs/read_collect.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/netfs/read_collect.c ++++ b/fs/netfs/read_collect.c +@@ -409,6 +409,11 @@ static void netfs_rreq_assess_single(str + netfs_single_mark_inode_dirty(rreq->inode); + } + ++ /* To do DIO, the cache has to round the size up, so we need to undo ++ * the rounding. ++ */ ++ rreq->transferred = min(rreq->transferred, rreq->i_size); ++ + if (rreq->iocb) { + rreq->iocb->ki_pos += rreq->transferred; + if (rreq->iocb->ki_complete) {
diff --git a/queue-6.18/netfs-fix-missing-alloc-tagging-of-direct-mempool-allocations.patch b/queue-6.18/netfs-fix-missing-alloc-tagging-of-direct-mempool-allocations.patch new file mode 100644 index 0000000..15fefbc --- /dev/null +++ b/queue-6.18/netfs-fix-missing-alloc-tagging-of-direct-mempool-allocations.patch
@@ -0,0 +1,104 @@ +From b78b728e21c32ec4c330b299f657fb1eb02dffc2 Mon Sep 17 00:00:00 2001 +From: Hao Ge <hao.ge@linux.dev> +Date: Wed, 23 Sep 2026 14:37:59 +0800 +Subject: netfs: Fix missing alloc tagging of direct mempool allocations + +From: Hao Ge <hao.ge@linux.dev> + +commit b78b728e21c32ec4c330b299f657fb1eb02dffc2 upstream. + +Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by +adding a mempool") added a mempool for the folio_queues and made the +request, subrequest and folio_queue allocations distinguish between +writeback and everything else. Writeback is part of memory reclaim +and must not fail due to ENOMEM, so it allocates under GFP_NOFS +through mempool_alloc(), which may dip into the pool's reserve and, +if that runs empty, wait for elements to be returned. The +GFP_KERNEL paths, which can return -ENOMEM to their callers, invoke +the pool's ->alloc() callback directly instead. + +The direct call, however, skips the alloc_hooks() wrapper that the +mempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab() +and mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof() +and rely on current->alloc_tag having been set by the caller. With +CONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to + + current->alloc_tag not set + WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook + alloc_tag was not set + WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook + +at allocation and free time respectively, as reported when reading +files on a CIFS mount. The allocations are also missing from +/proc/allocinfo. + +Wrap the direct ->alloc() invocations in alloc_hooks() with a new +mempool_alloc_noreserve() helper in include/linux/mempool.h, next to +the other alloc_hooks()-wrapped macros such as mempool_alloc(). The +GFP_KERNEL paths keep their failable allocation semantics, they just +get tagged now. + +Fixes: 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") +Reported-by: Erhard Furtner <erhard_f@mailbox.org> +Closes: https://lore.kernel.org/all/0b004319-9ef7-437c-a4dd-174d6a9a83db@mailbox.org/ +Tested-by: Erhard Furtner <erhard_f@mailbox.org> +Suggested-by: Suren Baghdasaryan <surenb@google.com> +Cc: stable@vger.kernel.org +Signed-off-by: Hao Ge <hao.ge@linux.dev> +Link: https://patch.msgid.link/20260923063759.34667-1-hao.ge@linux.dev +Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> +Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/netfs/objects.c | 4 ++-- + fs/netfs/rolling_buffer.c | 2 +- + include/linux/mempool.h | 7 +++++++ + 3 files changed, 10 insertions(+), 3 deletions(-) + +--- a/fs/netfs/objects.c ++++ b/fs/netfs/objects.c +@@ -34,7 +34,7 @@ struct netfs_io_request *netfs_alloc_req + + rreq = mempool_alloc(mempool, gfp); + } else { +- rreq = mempool->alloc(gfp, mempool->pool_data); ++ rreq = mempool_alloc_noreserve(mempool, gfp); + if (!rreq) + return ERR_PTR(-ENOMEM); + } +@@ -206,7 +206,7 @@ struct netfs_io_subrequest *netfs_alloc_ + struct kmem_cache *cache = mempool->pool_data; + + if (rreq->gfp == GFP_KERNEL) +- subreq = mempool->alloc(rreq->gfp, mempool->pool_data); ++ subreq = mempool_alloc_noreserve(mempool, rreq->gfp); + else + subreq = mempool_alloc(mempool, rreq->gfp); + if (!subreq) +--- a/fs/netfs/rolling_buffer.c ++++ b/fs/netfs/rolling_buffer.c +@@ -29,7 +29,7 @@ struct folio_queue *netfs_folioq_alloc(u + struct folio_queue *fq; + + if (gfp == GFP_KERNEL) +- fq = netfs_folioq_pool.alloc(gfp, netfs_folioq_pool.pool_data); ++ fq = mempool_alloc_noreserve(&netfs_folioq_pool, gfp); + else + fq = mempool_alloc(&netfs_folioq_pool, gfp); + if (fq) { +--- a/include/linux/mempool.h ++++ b/include/linux/mempool.h +@@ -67,6 +67,13 @@ extern void *mempool_alloc_noprof(mempoo + #define mempool_alloc(...) \ + alloc_hooks(mempool_alloc_noprof(__VA_ARGS__)) + ++/* ++ * Allocate a new element without dipping into the pool's reserves or ++ * waiting. Returns NULL on failure. ++ */ ++#define mempool_alloc_noreserve(_pool, _gfp) \ ++ alloc_hooks((_pool)->alloc(_gfp, (_pool)->pool_data)) ++ + extern void *mempool_alloc_preallocated(mempool_t *pool) __malloc; + extern void mempool_free(void *element, mempool_t *pool); +
diff --git a/queue-6.18/series b/queue-6.18/series index aee3898..2e47656 100644 --- a/queue-6.18/series +++ b/queue-6.18/series
@@ -602,3 +602,11 @@ drm-vc4-fix-binner-slot-allocation-failing-on-an-idl.patch x86-cpu-amd-fix-amd-tlbi-erratum-1718.patch drm-panthor-validate-userspace-queue-count-against-initialized-firmware-slot-count.patch +btrfs-make-sure-extent_buffer_reading-is-cleared-under-refs_lock.patch +cifs-consolidate-time_last_write-stamp-into-_cifsfileinfo_put.patch +netfs-afs-fix-symlink-reading.patch +media-verisilicon-fix-kernel-panic-due-to-__initconst-misuse.patch +net-fix-backlog_unlock_irq_restore-vs-config_preempt_rt.patch +netfs-fix-missing-alloc-tagging-of-direct-mempool-allocations.patch +workqueue-fix-devm_alloc_workqueue-va_list-misuse.patch +ice-fix-broken-rx-on-vfs.patch
diff --git a/queue-6.18/workqueue-fix-devm_alloc_workqueue-va_list-misuse.patch b/queue-6.18/workqueue-fix-devm_alloc_workqueue-va_list-misuse.patch new file mode 100644 index 0000000..340c0ca --- /dev/null +++ b/queue-6.18/workqueue-fix-devm_alloc_workqueue-va_list-misuse.patch
@@ -0,0 +1,134 @@ +From 0de4cb473aed57ee4ba7e0551ad27bddc19fc519 Mon Sep 17 00:00:00 2001 +From: Breno Leitao <leitao@debian.org> +Date: Tue, 28 Apr 2026 08:10:43 -0700 +Subject: workqueue: fix devm_alloc_workqueue() va_list misuse + +From: Breno Leitao <leitao@debian.org> + +commit 0de4cb473aed57ee4ba7e0551ad27bddc19fc519 upstream. + +devm_alloc_workqueue() built a va_list and passed it as a single +positional argument to the variadic alloc_workqueue() macro: + + va_start(args, max_active); + wq = alloc_workqueue(fmt, flags, max_active, args); + va_end(args); + +C does not allow forwarding a va_list through a ... parameter. +alloc_workqueue() expands to alloc_workqueue_noprof(), which runs +its own va_start() over its ... params, so the inner +vsnprintf(wq->name, sizeof(wq->name), fmt, args) in +__alloc_workqueue() received the outer va_list object as the first +variadic slot rather than the caller's actual format arguments. + +Add a new static helper alloc_workqueue_va() that wraps +__alloc_workqueue() and runs wq_init_lockdep() on success, and +fold both alloc_workqueue_noprof() and devm_alloc_workqueue_noprof() +onto it as suggested by Tejun. + +The wq_init_lockdep() step is required on the devm path +too, otherwise __flush_workqueue()'s on-stack +COMPLETION_INITIALIZER_ONSTACK_MAP would NULL-deref wq->lockdep_map. + +No caller changes are required. devm_alloc_ordered_workqueue() is +a macro forwarding to devm_alloc_workqueue() and inherits the fix. +Two in-tree callers actively trigger the broken path on every probe: + + drivers/power/supply/mt6370-charger.c:889 + drivers/power/supply/max77705_charger.c:649 + +both of which use devm_alloc_ordered_workqueue(dev, "%s", 0, +dev_name(dev)). + +A standalone reproducer module is available at[1]. + +Link: https://github.com/leitao/debug/blob/main/workqueue/valist/wq_va_test.c [1] +Fixes: 1dfc9d60a69e ("workqueue: devres: Add device-managed allocate workqueue") +Signed-off-by: Breno Leitao <leitao@debian.org> +Signed-off-by: Tejun Heo <tj@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + include/linux/workqueue.h | 6 ++++-- + kernel/workqueue.c | 28 +++++++++++++++++++--------- + 2 files changed, 23 insertions(+), 11 deletions(-) + +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -529,8 +529,10 @@ alloc_workqueue_noprof(const char *fmt, + * Pointer to the allocated workqueue on success, %NULL on failure. + */ + __printf(2, 5) struct workqueue_struct * +-devm_alloc_workqueue(struct device *dev, const char *fmt, unsigned int flags, +- int max_active, ...); ++devm_alloc_workqueue_noprof(struct device *dev, const char *fmt, ++ unsigned int flags, int max_active, ...); ++#define devm_alloc_workqueue(...) \ ++ alloc_hooks(devm_alloc_workqueue_noprof(__VA_ARGS__)) + + #ifdef CONFIG_LOCKDEP + /** +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -5875,6 +5875,20 @@ err_destroy: + return NULL; + } + ++static struct workqueue_struct *alloc_workqueue_va(const char *fmt, ++ unsigned int flags, ++ int max_active, ++ va_list args) ++{ ++ struct workqueue_struct *wq; ++ ++ wq = __alloc_workqueue(fmt, flags, max_active, args); ++ if (wq) ++ wq_init_lockdep(wq); ++ ++ return wq; ++} ++ + __printf(1, 4) + struct workqueue_struct *alloc_workqueue_noprof(const char *fmt, + unsigned int flags, +@@ -5884,12 +5898,8 @@ struct workqueue_struct *alloc_workqueue + va_list args; + + va_start(args, max_active); +- wq = __alloc_workqueue(fmt, flags, max_active, args); ++ wq = alloc_workqueue_va(fmt, flags, max_active, args); + va_end(args); +- if (!wq) +- return NULL; +- +- wq_init_lockdep(wq); + + return wq; + } +@@ -5901,15 +5911,15 @@ static void devm_workqueue_release(void + } + + __printf(2, 5) struct workqueue_struct * +-devm_alloc_workqueue(struct device *dev, const char *fmt, unsigned int flags, +- int max_active, ...) ++devm_alloc_workqueue_noprof(struct device *dev, const char *fmt, ++ unsigned int flags, int max_active, ...) + { + struct workqueue_struct *wq; + va_list args; + int ret; + + va_start(args, max_active); +- wq = alloc_workqueue(fmt, flags, max_active, args); ++ wq = alloc_workqueue_va(fmt, flags, max_active, args); + va_end(args); + if (!wq) + return NULL; +@@ -5920,7 +5930,7 @@ devm_alloc_workqueue(struct device *dev, + + return wq; + } +-EXPORT_SYMBOL_GPL(devm_alloc_workqueue); ++EXPORT_SYMBOL_GPL(devm_alloc_workqueue_noprof); + + #ifdef CONFIG_LOCKDEP + __printf(1, 5)