[PATCH 6.12 000/113] 6.12.60-rc2 review

Greg Kroah-Hartman posted 113 patches 4 days, 6 hours ago
Only 0 patches received!
arch/arm64/kvm/hyp/nvhe/ffa.c |    9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
[PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Greg Kroah-Hartman 4 days, 6 hours ago
This is the start of the stable review cycle for the 6.12.60 release.
There are 113 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 29 Nov 2025 15:03:21 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.60-rc2.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.12.60-rc2

Charles Keepax <ckeepax@opensource.cirrus.com>
    Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup"

Fangzhi Zuo <Jerry.Zuo@amd.com>
    drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched

Charlene Liu <Charlene.Liu@amd.com>
    drm/amd/display: Insert dccg log for easy debug

Charlene Liu <Charlene.Liu@amd.com>
    drm/amd/display: disable DPP RCG before DPP CLK enable

Charlene Liu <Charlene.Liu@amd.com>
    drm/amd/display: avoid reset DTBCLK at clock init

Darrick J. Wong <djwong@kernel.org>
    xfs: fix out of bounds memory read error in symlink repair

Marcelo Moreira <marcelomoreira1905@gmail.com>
    xfs: Replace strncpy with memcpy

Eric Dumazet <edumazet@google.com>
    mptcp: fix a race in mptcp_pm_del_add_timer()

Imre Deak <imre.deak@intel.com>
    drm/i915/dp_mst: Disable Panel Replay

Martin Kaiser <martin@kaiser.cx>
    maple_tree: fix tracepoint string pointers

Jari Ruusu <jariruusu@protonmail.com>
    tty/vt: fix up incorrect backport to stable releases

Henrique Carvalho <henrique.carvalho@suse.com>
    smb: client: fix incomplete backport in cfids_invalidation_worker()

Samuel Zhang <guoqing.zhang@amd.com>
    drm/amdgpu: fix gpu page fault after hibernation on PF passthrough

Zhang Chujun <zhangchujun@cmss.chinamobile.com>
    tracing/tools: Fix incorrcet short option in usage text for --threads

Nishanth Menon <nm@ti.com>
    net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error

René Rebe <rene@exactco.de>
    ALSA: usb-audio: fix uac2 clock source at terminal parser

Heiko Carstens <hca@linux.ibm.com>
    s390/mm: Fix __ptep_rdp() inline assembly

Shuicheng Lin <shuicheng.lin@intel.com>
    drm/xe: Prevent BIT() overflow when handling invalid prefetch region

Wentao Guan <guanwentao@uniontech.com>
    Revert "RDMA/irdma: Update Kconfig"

Marc Zyngier <maz@kernel.org>
    KVM: arm64: Make all 32bit ID registers fully writable

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check

Jakub Horký <jakub.git@horky.net>
    kconfig/nconf: Initialize the default locale at startup

Jakub Horký <jakub.git@horky.net>
    kconfig/mconf: Initialize the default locale at startup

Shahar Shitrit <shshitrit@nvidia.com>
    net: tls: Cancel RX async resync request on rcd_delta overflow

Carlos Llamas <cmllamas@google.com>
    blk-crypto: use BLK_STS_INVAL for alignment errors

Shahar Shitrit <shshitrit@nvidia.com>
    net: tls: Change async resync helpers argument

Po-Hsu Lin <po-hsu.lin@canonical.com>
    selftests: net: use BASH for bareudp testing

Borislav Petkov (AMD) <bp@alien8.de>
    x86/microcode/AMD: Limit Entrysign signature checking to known generations

Bart Van Assche <bvanassche@acm.org>
    scsi: core: Fix a regression triggered by scsi_host_busy()

Steve French <stfrench@microsoft.com>
    cifs: fix typo in enable_gcm_256 module parameter

Rafał Miłecki <rafal@milecki.pl>
    bcma: don't register devices disabled in OF

Michal Luczaj <mhal@rbox.co>
    vsock: Ignore signal/timeout on connect() if already established

Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
    cifs: fix memory leak in smb3_fs_context_parse_param error path

Thomas Weißschuh <linux@weissschuh.net>
    LoongArch: Use UAPI types in ptrace UAPI header

Kuniyuki Iwashima <kuniyu@google.com>
    af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic().

Kuniyuki Iwashima <kuniyu@google.com>
    af_unix: Cache state->msg in unix_stream_read_generic().

Pradyumn Rahar <pradyumn.rahar@oracle.com>
    net/mlx5: Clean up only new IRQ glue on request_irq() failure

Shay Drory <shayd@nvidia.com>
    devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

Jared Kangas <jkangas@redhat.com>
    pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()

Jared Kangas <jkangas@redhat.com>
    pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc

Grzegorz Nitka <grzegorz.nitka@intel.com>
    ice: fix PTP cleanup on driver removal in error path

Emil Tantilov <emil.s.tantilov@intel.com>
    idpf: fix possible vport_config NULL pointer deref in remove

Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
    net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

Haotian Zhang <vulab@iscas.ac.cn>
    platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos

Ido Schimmel <idosch@nvidia.com>
    selftests: net: lib: Do not overwrite error messages

Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
    s390/ctcm: Fix double-kfree

Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
    nvme-multipath: fix lockdep WARN due to partition scan work

Chen Pei <cp0613@linux.alibaba.com>
    tools: riscv: Fixed misalignment of CSR related definitions

Ilya Maximets <i.maximets@ovn.org>
    net: openvswitch: remove never-working support for setting nsh fields

Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
    net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get()

Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
    net: dsa: hellcreek: fix missing error handling in LED registration

Prateek Agarwal <praagarwal@nvidia.com>
    drm/tegra: Add call to put_pid()

Zilin Guan <zilin@seu.edu.cn>
    mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()

Armin Wolf <W_Armin@gmx.de>
    platform/x86: msi-wmi-platform: Fix typo in WMI GUID

Armin Wolf <W_Armin@gmx.de>
    platform/x86: msi-wmi-platform: Only load on MSI devices

Haotian Zhang <vulab@iscas.ac.cn>
    pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()

Jianbo Liu <jianbol@nvidia.com>
    xfrm: Prevent locally generated packets from direct output in tunnel mode

Jianbo Liu <jianbol@nvidia.com>
    xfrm: Determine inner GSO type from packet inner protocol

Yu-Chun Lin <eleanor.lin@realtek.com>
    pinctrl: realtek: Select REGMAP_MMIO for RTD driver

Sabrina Dubroca <sd@queasysnail.net>
    xfrm: set err and extack on failure to create pcpu SA

Sabrina Dubroca <sd@queasysnail.net>
    xfrm: drop SA reference in xfrm_state_update if dir doesn't match

Ivan Lipski <ivan.lipski@amd.com>
    drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5

Fangzhi Zuo <Jerry.Zuo@amd.com>
    drm/amd/display: Fix pbn to kbps Conversion

Mario Limonciello (AMD) <superm1@kernel.org>
    drm/amd/display: Move sleep into each retry for retrieve_link_cap()

Mario Limonciello (AMD) <superm1@kernel.org>
    drm/amd/display: Increase DPCD read retries

Yifan Zha <Yifan.Zha@amd.com>
    drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled

Mario Limonciello <mario.limonciello@amd.com>
    drm/amd: Skip power ungate during suspend for VPE

Robert McClinton <rbmccav@gmail.com>
    drm/radeon: delete radeon_fence_process in is_signaled, no deadlock

Ma Ke <make24@iscas.ac.cn>
    drm/tegra: dc: Fix reference leak in tegra_dc_couple()

Paolo Abeni <pabeni@redhat.com>
    mptcp: do not fallback when OoO is present

Paolo Abeni <pabeni@redhat.com>
    mptcp: decouple mptcp fastclose from tcp close

Paolo Abeni <pabeni@redhat.com>
    mptcp: avoid unneeded subflow-level drops

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    selftests: mptcp: join: userspace: longer timeout

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    selftests: mptcp: join: endpoints: longer timeout

Paolo Abeni <pabeni@redhat.com>
    mptcp: fix premature close in case of fallback

Paolo Abeni <pabeni@redhat.com>
    mptcp: fix duplicate reset on fastclose

Paolo Abeni <pabeni@redhat.com>
    mptcp: fix ack generation for fallback msk

Eric Dumazet <edumazet@google.com>
    mptcp: fix race condition in mptcp_schedule_work()

Huacai Chen <chenhuacai@kernel.org>
    LoongArch: Don't panic if no valid cache info for PCI

Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups

Maciej W. Rozycki <macro@orcam.me.uk>
    MIPS: Malta: Fix !EVA SOC-it PCI MMIO

Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
    scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()

Bart Van Assche <bvanassche@acm.org>
    scsi: sg: Do not sleep in atomic context

Ewan D. Milne <emilne@redhat.com>
    nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

Ewan D. Milne <emilne@redhat.com>
    nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()

Nam Cao <namcao@linutronix.de>
    nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot

Vlastimil Babka <vbabka@suse.cz>
    mm/mempool: fix poisoning order>0 pages with HIGHMEM

Seungjin Bae <eeodqql09@gmail.com>
    Input: pegasus-notetaker - fix potential out-of-bounds access

Dan Carpenter <dan.carpenter@linaro.org>
    Input: imx_sc_key - fix memory corruption on unload

Hans de Goede <hdegoede@redhat.com>
    Input: goodix - add support for ACPI ID GDIX1003

Tzung-Bi Shih <tzungbi@kernel.org>
    Input: cros_ec_keyb - fix an invalid memory access

Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
    Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"

Oleksij Rempel <o.rempel@pengutronix.de>
    net: dsa: microchip: lan937x: Fix RGMII delay tuning

Andrey Vatoropin <a.vatoropin@crpt.ru>
    be2net: pass wrb_params in case of OS2BMC

Yihang Li <liyihang9@h-partners.com>
    ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()

Henrique Carvalho <henrique.carvalho@suse.com>
    smb: client: introduce close_cached_dir_locked()

Maciej W. Rozycki <macro@orcam.me.uk>
    MIPS: mm: Prevent a TLB shutdown on initial uniquification

Niklas Cassel <cassel@kernel.org>
    ata: libata-scsi: Fix system suspend for a security locked drive

Jiayuan Chen <jiayuan.chen@linux.dev>
    mptcp: Fix proto fallback detection with BPF

Jiayuan Chen <jiayuan.chen@linux.dev>
    mptcp: Disallow MPTCP subflows from sockmap

Yongpeng Yang <yangyongpeng@xiaomi.com>
    exfat: check return value of sb_min_blocksize in exfat_read_boot_sector

Mike Yuan <me@yhndnzj.com>
    shmem: fix tmpfs reconfiguration (remount) when noswap is set

Yongpeng Yang <yangyongpeng@xiaomi.com>
    isofs: check the return value of sb_min_blocksize() in isofs_fill_super

Dan Carpenter <dan.carpenter@linaro.org>
    mtdchar: fix integer overflow in read/write ioctls

Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
    mtd: rawnand: cadence: fix DMA device NULL pointer dereference

Quentin Schulz <quentin.schulz@cherry.de>
    arm64: dts: rockchip: disable HS400 on RK3588 Tiger

Quentin Schulz <quentin.schulz@cherry.de>
    arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1

Mykola Kvach <xakep.amatop@gmail.com>
    arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5

Diederik de Haas <diederik@cknow-tech.com>
    arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2

Zhang Heng <zhangheng@kylinos.cn>
    HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155

Mario Limonciello (AMD) <superm1@kernel.org>
    HID: amd_sfh: Stop sensor before starting

Yipeng Zou <zouyipeng@huawei.com>
    timers: Fix NULL function pointer race in timer_shutdown_sync()

Sebastian Ene <sebastianene@google.com>
    KVM: arm64: Check the untrusted offset in FF-A memory share


-------------

Diffstat:

 .../bindings/pinctrl/toshiba,visconti-pinctrl.yaml |  26 +++---
 Documentation/wmi/driver-development-guide.rst     |   1 +
 Makefile                                           |   4 +-
 arch/arm64/boot/dts/rockchip/rk3399-op1.dtsi       |   2 +-
 arch/arm64/boot/dts/rockchip/rk3566-pinetab2.dtsi  |   2 +-
 arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi     |   4 +-
 .../arm64/boot/dts/rockchip/rk3588s-orangepi-5.dts |   4 +-
 arch/arm64/kvm/hyp/nvhe/ffa.c                      |   9 +-
 arch/arm64/kvm/sys_regs.c                          |  63 +++++++------
 arch/loongarch/include/uapi/asm/ptrace.h           |  40 ++++----
 arch/loongarch/pci/pci.c                           |   8 +-
 arch/mips/mm/tlb-r4k.c                             | 102 +++++++++++++--------
 arch/mips/mti-malta/malta-init.c                   |  20 ++--
 arch/s390/include/asm/pgtable.h                    |  12 +--
 arch/s390/mm/pgtable.c                             |   4 +-
 arch/x86/kernel/cpu/microcode/amd.c                |  20 +++-
 block/blk-crypto.c                                 |   2 +-
 drivers/ata/libata-scsi.c                          |  11 ++-
 drivers/bcma/main.c                                |   6 ++
 drivers/gpio/gpiolib-swnode.c                      |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |   3 +-
 drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c         |   3 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c            |   4 +-
 .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c    |  59 +++++-------
 .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c   |  20 ++--
 .../gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c |  60 ++++++++----
 .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c    |   8 ++
 .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c    |  21 +++--
 .../display/dc/link/protocols/link_dp_capability.c |  11 ++-
 drivers/gpu/drm/i915/display/intel_psr.c           |   4 +
 drivers/gpu/drm/nouveau/nvkm/falcon/fw.c           |   2 +
 drivers/gpu/drm/radeon/radeon_fence.c              |   7 --
 drivers/gpu/drm/tegra/dc.c                         |   1 +
 drivers/gpu/drm/tegra/dsi.c                        |   9 --
 drivers/gpu/drm/tegra/uapi.c                       |   7 +-
 drivers/gpu/drm/xe/xe_vm.c                         |   4 +-
 drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c      |   2 +
 drivers/hid/hid-ids.h                              |   4 +-
 drivers/hid/hid-quirks.c                           |  13 ++-
 drivers/infiniband/hw/irdma/Kconfig                |   7 +-
 drivers/input/keyboard/cros_ec_keyb.c              |   6 ++
 drivers/input/keyboard/imx_sc_key.c                |   2 +-
 drivers/input/tablet/pegasus_notetaker.c           |   9 ++
 drivers/input/touchscreen/goodix.c                 |   1 +
 drivers/mtd/mtdchar.c                              |   6 +-
 drivers/mtd/nand/raw/cadence-nand-controller.c     |   3 +-
 drivers/net/dsa/hirschmann/hellcreek_ptp.c         |  14 ++-
 drivers/net/dsa/microchip/lan937x_main.c           |   1 +
 drivers/net/ethernet/emulex/benet/be_main.c        |   7 +-
 drivers/net/ethernet/intel/ice/ice_ptp.c           |  22 ++++-
 drivers/net/ethernet/intel/idpf/idpf_main.c        |   2 +
 .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c |   9 +-
 drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c  |   6 +-
 .../net/ethernet/mellanox/mlxsw/core_linecards.c   |   2 +
 .../net/ethernet/mellanox/mlxsw/spectrum_flower.c  |   6 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |   5 +-
 drivers/net/ethernet/ti/netcp_core.c               |  10 +-
 drivers/nvme/host/fc.c                             |  15 +--
 drivers/nvme/host/multipath.c                      |   2 +-
 drivers/perf/riscv_pmu_sbi.c                       |   2 +-
 drivers/pinctrl/cirrus/pinctrl-cs42l43.c           |  21 ++++-
 drivers/pinctrl/nxp/pinctrl-s32cc.c                |   3 +-
 drivers/pinctrl/realtek/Kconfig                    |   1 +
 drivers/platform/x86/Kconfig                       |   1 +
 .../x86/intel/speed_select_if/isst_if_mmio.c       |   4 +-
 drivers/platform/x86/msi-wmi-platform.c            |  43 ++++++++-
 drivers/s390/net/ctcm_mpc.c                        |   1 -
 drivers/scsi/hosts.c                               |   5 +-
 drivers/scsi/sg.c                                  |  10 +-
 drivers/soc/ti/knav_dma.c                          |  14 +--
 drivers/target/loopback/tcm_loop.c                 |   3 +
 drivers/tty/vt/vt_ioctl.c                          |   4 +-
 fs/exfat/super.c                                   |   5 +-
 fs/isofs/inode.c                                   |   5 +
 fs/smb/client/cached_dir.c                         |  43 ++++++++-
 fs/smb/client/cifsfs.c                             |   2 +-
 fs/smb/client/fs_context.c                         |   4 +
 fs/xfs/scrub/symlink_repair.c                      |   4 +-
 include/linux/ata.h                                |   1 +
 include/net/tls.h                                  |  25 ++---
 include/net/xfrm.h                                 |   3 +-
 kernel/time/timer.c                                |   7 +-
 lib/maple_tree.c                                   |  30 +++---
 mm/mempool.c                                       |  32 +++++--
 mm/shmem.c                                         |  15 ++-
 net/devlink/rate.c                                 |   4 +-
 net/ipv4/esp4_offload.c                            |   6 +-
 net/ipv6/esp6_offload.c                            |   6 +-
 net/mptcp/options.c                                |  54 ++++++++++-
 net/mptcp/pm_netlink.c                             |  20 ++--
 net/mptcp/protocol.c                               |  84 +++++++++++------
 net/mptcp/protocol.h                               |   3 +-
 net/mptcp/subflow.c                                |   8 ++
 net/openvswitch/actions.c                          |  68 +-------------
 net/openvswitch/flow_netlink.c                     |  64 ++-----------
 net/openvswitch/flow_netlink.h                     |   2 -
 net/tls/tls_device.c                               |   4 +-
 net/unix/af_unix.c                                 |  36 ++++----
 net/vmw_vsock/af_vsock.c                           |  40 ++++++--
 net/xfrm/xfrm_output.c                             |   6 +-
 net/xfrm/xfrm_state.c                              |   8 +-
 net/xfrm/xfrm_user.c                               |   5 +-
 scripts/kconfig/mconf.c                            |   3 +
 scripts/kconfig/nconf.c                            |   3 +
 sound/usb/endpoint.c                               |   3 +-
 sound/usb/mixer.c                                  |   2 +-
 tools/arch/riscv/include/asm/csr.h                 |   5 +-
 tools/testing/selftests/net/bareudp.sh             |   2 +-
 .../selftests/net/forwarding/lib_sh_test.sh        |   7 ++
 tools/testing/selftests/net/lib.sh                 |   2 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |  18 ++--
 tools/tracing/latency/latency-collector.c          |   2 +-
 113 files changed, 915 insertions(+), 561 deletions(-)


From gregkh@linuxfoundation.org Thu Nov 27 16:03:46 2025
Message-ID: <20251127150346.182929229@linuxfoundation.org>
User-Agent: quilt/0.69
Date: Thu, 27 Nov 2025 16:03:47 +0100
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: patches@lists.linux.dev, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org, lkft-triage@lists.linaro.org, pavel@denx.de, jonathanh@nvidia.com, f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, rwarsow@gmx.de, conor@kernel.org, hargar@microsoft.com, broonie@kernel.org, achill@achill.org, sr@sladewatkins.com,
 Sebastian Ene <sebastianene@google.com>,
 Will Deacon <will@kernel.org>,
 Marc Zyngier <maz@kernel.org>
X-stable: review
X-Patchwork-Hint: ignore
Subject: [PATCH 6.12 001/113] KVM: arm64: Check the untrusted offset in FF-A memory share
MIME-Version: 1.0

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Ene <sebastianene@google.com>

commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream.

Verify the offset to prevent OOB access in the hypervisor
FF-A buffer in case an untrusted large enough value
[U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
is set from the host kernel.

Signed-off-by: Sebastian Ene <sebastianene@google.com>
Acked-by: Will Deacon <will@kernel.org>
Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/hyp/nvhe/ffa.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -437,7 +437,7 @@ static void __do_ffa_mem_xfer(const u64
 	struct ffa_mem_region_attributes *ep_mem_access;
 	struct ffa_composite_mem_region *reg;
 	struct ffa_mem_region *buf;
-	u32 offset, nr_ranges;
+	u32 offset, nr_ranges, checked_offset;
 	int ret = 0;
 
 	if (addr_mbz || npages_mbz || fraglen > len ||
@@ -474,7 +474,12 @@ static void __do_ffa_mem_xfer(const u64
 		goto out_unlock;
 	}
 
-	if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
+	if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
+		ret = FFA_RET_INVALID_PARAMETERS;
+		goto out_unlock;
+	}
+
+	if (fraglen < checked_offset) {
 		ret = FFA_RET_INVALID_PARAMETERS;
 		goto out_unlock;
 	}


Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Jon Hunter 3 hours ago
On Thu, 27 Nov 2025 16:04:22 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.60 release.
> There are 113 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 29 Nov 2025 15:03:21 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.60-rc2.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

All tests passing for Tegra ...

Test results for stable-v6.12:
    10 builds:	10 pass, 0 fail
    28 boots:	28 pass, 0 fail
    120 tests:	120 pass, 0 fail

Linux version:	6.12.60-rc2-g375669e5645f
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
                tegra194-p3509-0000+p3668-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra210-p3450-0000,
                tegra30-cardhu-a04

Tested-by: Jon Hunter <jonathanh@nvidia.com>

Jon
Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Florian Fainelli 2 days, 3 hours ago

On 11/27/2025 7:04 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.60 release.
> There are 113 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 29 Nov 2025 15:03:21 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.60-rc2.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on 
BMIPS_GENERIC:

Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
-- 
Florian
Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Mark Brown 2 days, 20 hours ago
On Thu, Nov 27, 2025 at 04:04:22PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.60 release.
> There are 113 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Tested-by: Mark Brown <broonie@kernel.org>
Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Ron Economos 3 days, 12 hours ago
On 11/27/25 07:04, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.60 release.
> There are 113 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 29 Nov 2025 15:03:21 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.60-rc2.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Built and booted successfully on RISC-V RV64 (HiFive Unmatched).

Tested-by: Ron Economos <re@w6rz.net>
Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Dileep malepu 3 days, 13 hours ago
On Thu, Nov 27, 2025 at 8:40 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.12.60 release.
> There are 113 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 29 Nov 2025 15:03:21 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.60-rc2.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

[ Please ignore my previous email it was in wrong format ]

Build and Boot Report for 6.12.60-rc-2

The kernel version 6.12.60 was built and boot-tested using qemu-x86_64
and qemu-arm64 with the default configuration (defconfig). The build and boot
processes completed successfully, and the kernel operated as expected
in the virtualized environments without any issues.
No dmesg regressions found.

Build Details :
Builds : arm64, x86_64
Kernel Version: 6.12.60
Configuration : defconfig
Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit : 375669e5645f465d87d534f0be2eef993e3c7bab

Tested-by: Dileep Malepu <dileep.debian@gmail.com>

Best regards,
Dileep Malepu
Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Naresh Kamboju 3 days, 13 hours ago
On Thu, 27 Nov 2025 at 20:36, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.12.60 release.
> There are 113 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 29 Nov 2025 15:03:21 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.60-rc2.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h


Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>

## Build
* kernel: 6.12.60-rc2
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 375669e5645f465d87d534f0be2eef993e3c7bab
* git describe: v6.12.59-114-g375669e5645f
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.12.y/build/v6.12.59-114-g375669e5645f

## Test Regressions (compared to v6.12.56-605-ge6b517276bf6)

## Metric Regressions (compared to v6.12.56-605-ge6b517276bf6)

## Test Fixes (compared to v6.12.56-605-ge6b517276bf6)

## Metric Fixes (compared to v6.12.56-605-ge6b517276bf6)

## Test result summary
total: 121315, pass: 102842, fail: 3825, skip: 14279, xfail: 369

## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 139 total, 137 passed, 2 failed
* arm64: 57 total, 51 passed, 6 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 33 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 40 total, 39 passed, 1 failed
* riscv: 25 total, 24 passed, 1 failed
* s390: 22 total, 21 passed, 1 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 49 total, 46 passed, 3 failed

## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
* rt-tests-cyclicdeadline
* rt-tests-pi-stress
* rt-tests-pmqtest
* rt-tests-rt-migrate-test
* rt-tests-signaltest

--
Linaro LKFT
https://lkft.linaro.org
Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Peter Schneider 4 days ago
Am 27.11.2025 um 16:04 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.12.60 release.
> There are 113 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.

Tested-by: Peter Schneider <pschneider1968@googlemail.com>


Beste Grüße,
Peter Schneider

-- 
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you.                    -- David McCullough Jr.

OpenPGP:  0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
Re: [PATCH 6.12 000/113] 6.12.60-rc2 review
Posted by Brett A C Sheffield 4 days, 4 hours ago
# Librecast Test Results

020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast

CPU/kernel: Linux auntie 6.12.60-rc2-g375669e5645f #134 SMP PREEMPT_DYNAMIC Thu Nov 27 17:19:24 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux

Tested-by: Brett A C Sheffield <bacs@librecast.net>