The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 7094b84863e5832cb1cd9c4b9d648904775b6bd9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025091347-favorably-couch-3e8f@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 7094b84863e5832cb1cd9c4b9d648904775b6bd9 Mon Sep 17 00:00:00 2001
From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org>
Date: Mon, 8 Sep 2025 23:27:27 +0200
Subject: [PATCH] netlink: specs: mptcp: fix if-idx attribute type
This attribute is used as a signed number in the code in pm_netlink.c:
nla_put_s32(skb, MPTCP_ATTR_IF_IDX, ssk->sk_bound_dev_if))
The specs should then reflect that. Note that other 'if-idx' attributes
from the same .yaml file use a signed number as well.
Fixes: bc8aeb2045e2 ("Documentation: netlink: add a YAML spec for mptcp")
Cc: stable(a)vger.kernel.org
Reviewed-by: Geliang Tang <geliang(a)kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
Link: https://patch.msgid.link/20250908-net-mptcp-misc-fixes-6-17-rc5-v1-1-5f2168…
Signed-off-by: Jakub Kicinski <kuba(a)kernel.org>
diff --git a/Documentation/netlink/specs/mptcp_pm.yaml b/Documentation/netlink/specs/mptcp_pm.yaml
index 02f1ddcfbf1c..d15335684ec3 100644
--- a/Documentation/netlink/specs/mptcp_pm.yaml
+++ b/Documentation/netlink/specs/mptcp_pm.yaml
@@ -256,7 +256,7 @@ attribute-sets:
type: u32
-
name: if-idx
- type: u32
+ type: s32
-
name: reset-reason
type: u32
Dear Stable Kernel Maintainers,
I am writing to request the backport of the following patches to stable kernel versions 6.6.y,
addressing a deadlock issue in RCU Tasks related to do_exit() on preemptible systems.
Issue Description:
The kernel may experience deadlocks due to shared locking between exit_tasks_rcu_start() and
rcu_tasks_postscan() via synchronize_srcu(), when multiple processes exit concurrently. The problem
manifests as stalls in the RCU tasks grace period. This issue manifest as a deadlock in WSL kernel
which uses the stable kernel 6.6.87 (Please see the issue on https://github.com/microsoft/WSL/issues/13480)
Patches to Apply:
Patch 1:
Subject: rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks
Commit ID: 6b70399f9ef3809f6e308fd99dd78b072c1bd05c
Justification: Introduces per-CPU lists for exiting tasks, replacing SRCU-based waits and
eliminating deadlocks during concurrent exits.
Patch 2:
Subject: rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
Commit ID: 1612160b91272f5b1596f499584d6064bf5be794
Justification: Ensures all exiting tasks are properly gathered and synchronized, preventing
missed synchronizations and further deadlocks.
Patch 3:
Subject: rcu-tasks: Maintain real-time response in rcu_tasks_postscan()
Commit ID: 0bb11a372fc8d7006b4d0f42a2882939747bdbff
Justification: Periodically enables interrupts during per-CPU list traversal to maintain
system responsiveness, especially when many tasks are present.
Kernel version: latest kernel version in 6.6.y branch
Thank you for your consideration.
Best regards,
Tahera Fahimi
This series backports four commits to bring include/linux/overflow.h in
line with v5.15.193:
- 4578be130a64 ("overflow: Correct check_shl_overflow() comment")
- 4eb6bd55cfb2 ("compiler.h: drop fallback overflow checkers")
- 53f2cd86a81c ("overflow: Allow mixed type arguments")
- ed6e37e30826 ("tracing: Define the is_signed_type() macro once")
The motivation is to fix build failures such as:
drivers/net/ethernet/intel/e1000e/ethtool.c: In function ‘e1000_set_eeprom’:
./include/linux/overflow.h:71:15: error: comparison of distinct pointer types lacks a cast [-Werror]
71 | (void) (&__a == __d); \
| ^~
drivers/net/ethernet/intel/e1000e/ethtool.c:582:6: note: in expansion of macro ‘check_add_overflow’
582 | if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) ||
| ^~~~~~~~~~~~~~~~~~
This regression was triggered by commit ce8829d3d44b ("e1000e: fix heap
overflow in e1000_set_eeprom").
check_add_overflow() requires the first two operands and the result
pointer to be of identical type. On 64-bit builds, using size_t for the
result conflicted with the u32 fields eeprom->offset and eeprom->len,
resulting in type check failures.
Bart Van Assche (1):
tracing: Define the is_signed_type() macro once
Kees Cook (1):
overflow: Allow mixed type arguments
Keith Busch (1):
overflow: Correct check_shl_overflow() comment
Nick Desaulniers (1):
compiler.h: drop fallback overflow checkers
include/linux/compiler-clang.h | 13 --
include/linux/compiler-gcc.h | 4 -
include/linux/compiler.h | 6 +
include/linux/overflow.h | 209 ++++++-----------------------
include/linux/trace_events.h | 2 -
tools/include/linux/compiler-gcc.h | 4 -
tools/include/linux/overflow.h | 140 +------------------
7 files changed, 52 insertions(+), 326 deletions(-)
---
Changes in v3:
- Fixed SHA1 of commits mentioned in cover letter
Changes in v2:
- Added missing sign-off in all patches
--
2.47.3
The comedi_buf_munge() function performs a modulo operation
`async->munge_chan %= async->cmd.chanlist_len` without first
checking if chanlist_len is zero. If a user program submits
a command with chanlist_len set to zero, this causes a
divide-by-zero error when the device processes data in the
interrupt handler path.
Add a check for zero chanlist_len at the beginning of the
function, similar to the existing checks for !map and
CMDF_RAWDATA flag. When chanlist_len is zero, update
munge_count and return early, indicating the data was
handled without munging.
This prevents potential kernel panics from malformed user commands.
Reported-by: syzbot+f6c3c066162d2c43a66c(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f6c3c066162d2c43a66c
Cc: stable(a)vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com>
---
drivers/comedi/comedi_buf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/comedi/comedi_buf.c b/drivers/comedi/comedi_buf.c
index 002c0e76baff..786f888299ce 100644
--- a/drivers/comedi/comedi_buf.c
+++ b/drivers/comedi/comedi_buf.c
@@ -321,6 +321,11 @@ static unsigned int comedi_buf_munge(struct comedi_subdevice *s,
async->munge_count += num_bytes;
return num_bytes;
}
+
+ if (async->cmd.chanlist_len == 0) {
+ async->munge_count += num_bytes;
+ return num_bytes;
+ }
/* don't munge partial samples */
num_bytes -= num_bytes % num_sample_bytes;
--
2.43.0
The patch titled
Subject: mm/hugetlb: fix folio is still mapped when deleted
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-hugetlb-fix-folio-is-still-mapped-when-deleted.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Jinjiang Tu <tujinjiang(a)huawei.com>
Subject: mm/hugetlb: fix folio is still mapped when deleted
Date: Fri, 12 Sep 2025 15:41:39 +0800
Migration may be raced with fallocating hole. remove_inode_single_folio
will unmap the folio if the folio is still mapped. However, it's called
without folio lock. If the folio is migrated and the mapped pte has been
converted to migration entry, folio_mapped() returns false, and won't
unmap it. Due to extra refcount held by remove_inode_single_folio,
migration fails, restores migration entry to normal pte, and the folio is
mapped again. As a result, we triggered BUG in filemap_unaccount_folio.
The log is as follows:
BUG: Bad page cache in process hugetlb pfn:156c00
page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00
head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0
aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"
flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)
page_type: f4(hugetlb)
page dumped because: still mapped when deleted
CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
Call Trace:
<TASK>
dump_stack_lvl+0x4f/0x70
filemap_unaccount_folio+0xc4/0x1c0
__filemap_remove_folio+0x38/0x1c0
filemap_remove_folio+0x41/0xd0
remove_inode_hugepages+0x142/0x250
hugetlbfs_fallocate+0x471/0x5a0
vfs_fallocate+0x149/0x380
Hold folio lock before checking if the folio is mapped to avold race with
migration.
Link: https://lkml.kernel.org/r/20250912074139.3575005-1-tujinjiang@huawei.com
Fixes: 4aae8d1c051e ("mm/hugetlbfs: unmap pages if page fault raced with hole punch")
Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com>
Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org>
Cc: Muchun Song <muchun.song(a)linux.dev>
Cc: Oscar Salvador <osalvador(a)suse.de>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/hugetlbfs/inode.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/fs/hugetlbfs/inode.c~mm-hugetlb-fix-folio-is-still-mapped-when-deleted
+++ a/fs/hugetlbfs/inode.c
@@ -517,14 +517,16 @@ static bool remove_inode_single_folio(st
/*
* If folio is mapped, it was faulted in after being
- * unmapped in caller. Unmap (again) while holding
- * the fault mutex. The mutex will prevent faults
- * until we finish removing the folio.
+ * unmapped in caller or hugetlb_vmdelete_list() skips
+ * unmapping it due to fail to grab lock. Unmap (again)
+ * while holding the fault mutex. The mutex will prevent
+ * faults until we finish removing the folio. Hold folio
+ * lock to guarantee no concurrent migration.
*/
+ folio_lock(folio);
if (unlikely(folio_mapped(folio)))
hugetlb_unmap_file_folio(h, mapping, folio, index);
- folio_lock(folio);
/*
* We must remove the folio from page cache before removing
* the region/ reserve map (hugetlb_unreserve_pages). In
_
Patches currently in -mm which might be from tujinjiang(a)huawei.com are
mm-hugetlb-fix-folio-is-still-mapped-when-deleted.patch
filemap-optimize-folio-refount-update-in-filemap_map_pages.patch