This is a note to let you know that I've just added the patch titled
fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fbdev-defio-disconnect-deferred-i-o-from-the-lifetime-of-struct-fb_info.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From [email protected] Tue May 5 13:03:20
>2026
From: Sasha Levin <[email protected]>
Date: Tue, 5 May 2026 03:31:29 -0400
Subject: fbdev: defio: Disconnect deferred I/O from the lifetime of struct
fb_info
To: [email protected]
Cc: Thomas Zimmermann <[email protected]>, Helge Deller <[email protected]>,
[email protected], [email protected], Sasha Levin
<[email protected]>
Message-ID: <[email protected]>
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 9ded47ad003f09a94b6a710b5c47f4aa5ceb7429 ]
Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an
instance as part of initializing deferred I/O and remove it only after
the final mapping has been closed. If the fb_info and the contained
deferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info
to invalidate the mapping. Any access will then result in a SIGBUS
signal.
Fixes a long-standing problem, where a device hot-unplug happens while
user space still has an active mapping of the graphics memory. The hot-
unplug frees the instance of struct fb_info. Accessing the memory will
operate on undefined state.
Signed-off-by: Thomas Zimmermann <[email protected]>
Fixes: 60b59beafba8 ("fbdev: mm: Deferred IO support")
Cc: Helge Deller <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected] # v2.6.22+
Signed-off-by: Helge Deller <[email protected]>
[ context + _obj() conversion ]
Signed-off-by: Sasha Levin <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/video/fbdev/core/fb_defio.c | 164 +++++++++++++++++++++++++++++++-----
include/linux/fb.h | 4
2 files changed, 145 insertions(+), 23 deletions(-)
--- a/drivers/video/fbdev/core/fb_defio.c
+++ b/drivers/video/fbdev/core/fb_defio.c
@@ -23,6 +23,75 @@
#include <linux/rmap.h>
#include <linux/pagemap.h>
+/*
+ * struct fb_deferred_io_state
+ */
+
+struct fb_deferred_io_state {
+ struct kref ref;
+
+ struct mutex lock; /* mutex that protects the pageref list */
+ /* fields protected by lock */
+ struct fb_info *info;
+};
+
+static struct fb_deferred_io_state *fb_deferred_io_state_alloc(void)
+{
+ struct fb_deferred_io_state *fbdefio_state;
+
+ fbdefio_state = kzalloc(sizeof(*fbdefio_state), GFP_KERNEL);
+ if (!fbdefio_state)
+ return NULL;
+
+ kref_init(&fbdefio_state->ref);
+ mutex_init(&fbdefio_state->lock);
+
+ return fbdefio_state;
+}
+
+static void fb_deferred_io_state_release(struct fb_deferred_io_state
*fbdefio_state)
+{
+ mutex_destroy(&fbdefio_state->lock);
+
+ kfree(fbdefio_state);
+}
+
+static void fb_deferred_io_state_get(struct fb_deferred_io_state
*fbdefio_state)
+{
+ kref_get(&fbdefio_state->ref);
+}
+
+static void __fb_deferred_io_state_release(struct kref *ref)
+{
+ struct fb_deferred_io_state *fbdefio_state =
+ container_of(ref, struct fb_deferred_io_state, ref);
+
+ fb_deferred_io_state_release(fbdefio_state);
+}
+
+static void fb_deferred_io_state_put(struct fb_deferred_io_state
*fbdefio_state)
+{
+ kref_put(&fbdefio_state->ref, __fb_deferred_io_state_release);
+}
+
+/*
+ * struct vm_operations_struct
+ */
+
+static void fb_deferred_io_vm_open(struct vm_area_struct *vma)
+{
+ struct fb_deferred_io_state *fbdefio_state = vma->vm_private_data;
+
+ fb_deferred_io_state_get(fbdefio_state);
+}
+
+static void fb_deferred_io_vm_close(struct vm_area_struct *vma)
+{
+ struct fb_deferred_io_state *fbdefio_state = vma->vm_private_data;
+
+ fb_deferred_io_state_put(fbdefio_state);
+}
+
static struct page *fb_deferred_io_page(struct fb_info *info, unsigned long
offs)
{
void *screen_base = (void __force *) info->screen_base;
@@ -93,17 +162,31 @@ static void fb_deferred_io_pageref_put(s
/* this is to find and return the vmalloc-ed fb pages */
static vm_fault_t fb_deferred_io_fault(struct vm_fault *vmf)
{
+ struct fb_info *info;
unsigned long offset;
struct page *page;
- struct fb_info *info = vmf->vma->vm_private_data;
+ vm_fault_t ret;
+ struct fb_deferred_io_state *fbdefio_state = vmf->vma->vm_private_data;
+
+ mutex_lock(&fbdefio_state->lock);
+
+ info = fbdefio_state->info;
+ if (!info) {
+ ret = VM_FAULT_SIGBUS; /* our device is gone */
+ goto err_mutex_unlock;
+ }
offset = vmf->pgoff << PAGE_SHIFT;
- if (offset >= info->fix.smem_len)
- return VM_FAULT_SIGBUS;
+ if (offset >= info->fix.smem_len) {
+ ret = VM_FAULT_SIGBUS;
+ goto err_mutex_unlock;
+ }
page = fb_deferred_io_page(info, offset);
- if (!page)
- return VM_FAULT_SIGBUS;
+ if (!page) {
+ ret = VM_FAULT_SIGBUS;
+ goto err_mutex_unlock;
+ }
get_page(page);
@@ -115,8 +198,15 @@ static vm_fault_t fb_deferred_io_fault(s
BUG_ON(!page->mapping);
page->index = vmf->pgoff; /* for page_mkclean() */
+ mutex_unlock(&fbdefio_state->lock);
+
vmf->page = page;
+
return 0;
+
+err_mutex_unlock:
+ mutex_unlock(&fbdefio_state->lock);
+ return ret;
}
int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int
datasync)
@@ -143,15 +233,24 @@ EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
* Adds a page to the dirty list. Call this from struct
* vm_operations_struct.page_mkwrite.
*/
-static vm_fault_t fb_deferred_io_track_page(struct fb_info *info, unsigned
long offset,
- struct page *page)
+static vm_fault_t fb_deferred_io_track_page(struct fb_deferred_io_state
*fbdefio_state,
+ unsigned long offset, struct page
*page)
{
- struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_info *info;
+ struct fb_deferred_io *fbdefio;
struct fb_deferred_io_pageref *pageref;
vm_fault_t ret;
/* protect against the workqueue changing the page list */
- mutex_lock(&fbdefio->lock);
+ mutex_lock(&fbdefio_state->lock);
+
+ info = fbdefio_state->info;
+ if (!info) {
+ ret = VM_FAULT_SIGBUS; /* our device is gone */
+ goto err_mutex_unlock;
+ }
+
+ fbdefio = info->fbdefio;
/* first write in this cycle, notify the driver */
if (fbdefio->first_io && list_empty(&fbdefio->pagereflist))
@@ -173,14 +272,14 @@ static vm_fault_t fb_deferred_io_track_p
*/
lock_page(pageref->page);
- mutex_unlock(&fbdefio->lock);
+ mutex_unlock(&fbdefio_state->lock);
/* come back after delay to process the deferred IO */
schedule_delayed_work(&info->deferred_work, fbdefio->delay);
return VM_FAULT_LOCKED;
err_mutex_unlock:
- mutex_unlock(&fbdefio->lock);
+ mutex_unlock(&fbdefio_state->lock);
return ret;
}
@@ -198,25 +297,28 @@ err_mutex_unlock:
* Returns:
* VM_FAULT_LOCKED on success, or a VM_FAULT error otherwise.
*/
-static vm_fault_t fb_deferred_io_page_mkwrite(struct fb_info *info, struct
vm_fault *vmf)
+static vm_fault_t fb_deferred_io_page_mkwrite(struct fb_deferred_io_state
*fbdefio_state,
+ struct vm_fault *vmf)
{
unsigned long offset = vmf->pgoff << PAGE_SHIFT;
struct page *page = vmf->page;
file_update_time(vmf->vma->vm_file);
- return fb_deferred_io_track_page(info, offset, page);
+ return fb_deferred_io_track_page(fbdefio_state, offset, page);
}
/* vm_ops->page_mkwrite handler */
static vm_fault_t fb_deferred_io_mkwrite(struct vm_fault *vmf)
{
- struct fb_info *info = vmf->vma->vm_private_data;
+ struct fb_deferred_io_state *fbdefio_state = vmf->vma->vm_private_data;
- return fb_deferred_io_page_mkwrite(info, vmf);
+ return fb_deferred_io_page_mkwrite(fbdefio_state, vmf);
}
static const struct vm_operations_struct fb_deferred_io_vm_ops = {
+ .open = fb_deferred_io_vm_open,
+ .close = fb_deferred_io_vm_close,
.fault = fb_deferred_io_fault,
.page_mkwrite = fb_deferred_io_mkwrite,
};
@@ -231,7 +333,10 @@ int fb_deferred_io_mmap(struct fb_info *
vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
if (!(info->flags & FBINFO_VIRTFB))
vma->vm_flags |= VM_IO;
- vma->vm_private_data = info;
+ vma->vm_private_data = info->fbdefio_state;
+
+ fb_deferred_io_state_get(info->fbdefio_state); /* released in
vma->vm_ops->close() */
+
return 0;
}
EXPORT_SYMBOL_GPL(fb_deferred_io_mmap);
@@ -242,9 +347,10 @@ static void fb_deferred_io_work(struct w
struct fb_info *info = container_of(work, struct fb_info,
deferred_work.work);
struct fb_deferred_io_pageref *pageref, *next;
struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_deferred_io_state *fbdefio_state = info->fbdefio_state;
/* here we mkclean the pages, then do all deferred IO */
- mutex_lock(&fbdefio->lock);
+ mutex_lock(&fbdefio_state->lock);
list_for_each_entry(pageref, &fbdefio->pagereflist, list) {
struct page *cur = pageref->page;
lock_page(cur);
@@ -259,12 +365,13 @@ static void fb_deferred_io_work(struct w
list_for_each_entry_safe(pageref, next, &fbdefio->pagereflist, list)
fb_deferred_io_pageref_put(pageref, info);
- mutex_unlock(&fbdefio->lock);
+ mutex_unlock(&fbdefio_state->lock);
}
int fb_deferred_io_init(struct fb_info *info)
{
struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_deferred_io_state *fbdefio_state;
struct fb_deferred_io_pageref *pagerefs;
unsigned long npagerefs, i;
int ret;
@@ -274,7 +381,11 @@ int fb_deferred_io_init(struct fb_info *
if (WARN_ON(!info->fix.smem_len))
return -EINVAL;
- mutex_init(&fbdefio->lock);
+ fbdefio_state = fb_deferred_io_state_alloc();
+ if (!fbdefio_state)
+ return -ENOMEM;
+ fbdefio_state->info = info;
+
INIT_DELAYED_WORK(&info->deferred_work, fb_deferred_io_work);
INIT_LIST_HEAD(&fbdefio->pagereflist);
if (fbdefio->delay == 0) /* set a default of 1 s */
@@ -293,10 +404,12 @@ int fb_deferred_io_init(struct fb_info *
info->npagerefs = npagerefs;
info->pagerefs = pagerefs;
+ info->fbdefio_state = fbdefio_state;
+
return 0;
err:
- mutex_destroy(&fbdefio->lock);
+ fb_deferred_io_state_release(fbdefio_state);
return ret;
}
EXPORT_SYMBOL_GPL(fb_deferred_io_init);
@@ -337,11 +450,18 @@ EXPORT_SYMBOL_GPL(fb_deferred_io_release
void fb_deferred_io_cleanup(struct fb_info *info)
{
- struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_deferred_io_state *fbdefio_state = info->fbdefio_state;
fb_deferred_io_lastclose(info);
+ info->fbdefio_state = NULL;
+
+ mutex_lock(&fbdefio_state->lock);
+ fbdefio_state->info = NULL;
+ mutex_unlock(&fbdefio_state->lock);
+
+ fb_deferred_io_state_put(fbdefio_state);
+
kvfree(info->pagerefs);
- mutex_destroy(&fbdefio->lock);
}
EXPORT_SYMBOL_GPL(fb_deferred_io_cleanup);
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -213,12 +213,13 @@ struct fb_deferred_io {
unsigned long delay;
bool sort_pagereflist; /* sort pagelist by offset */
int open_count; /* number of opened files; protected by fb_info lock */
- struct mutex lock; /* mutex that protects the pageref list */
struct list_head pagereflist; /* list of pagerefs for touched pages */
/* callback */
void (*first_io)(struct fb_info *info);
void (*deferred_io)(struct fb_info *info, struct list_head *pagelist);
};
+
+struct fb_deferred_io_state;
#endif
/*
@@ -479,6 +480,7 @@ struct fb_info {
unsigned long npagerefs;
struct fb_deferred_io_pageref *pagerefs;
struct fb_deferred_io *fbdefio;
+ struct fb_deferred_io_state *fbdefio_state;
#endif
const struct fb_ops *fbops;
Patches currently in stable-queue which might be from [email protected] are
queue-6.1/f2fs-use-kfree-instead-of-kvfree-to-free-some-memory.patch
queue-6.1/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-wi.patch
queue-6.1/bonding-refuse-to-enslave-can-devices.patch
queue-6.1/asoc-intel-bytcht_es8316-fix-mclk-leak-on-init-error.patch
queue-6.1/asoc-codecs-simple-mux-fix-enum-control-bounds-check.patch
queue-6.1/selftests-bpf-add-read_build_id-function.patch
queue-6.1/smb-client-validate-the-whole-dacl-before-rewriting-it-in-cifsacl.patch
queue-6.1/rdma-rxe-complete-the-rxe_cleanup_task-backport.patch
queue-6.1/bluetooth-l2cap-fix-possible-crash-on-l2cap_ecred_co.patch
queue-6.1/ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
queue-6.1/ethtool-eeprom-add-more-safeties-to-eeprom-netlink-f.patch
queue-6.1/vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
queue-6.1/6lowpan-fix-off-by-one-in-multicast-context-address-.patch
queue-6.1/sctp-fix-race-between-sctp_wait_for_connect-and-peel.patch
queue-6.1/pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
queue-6.1/drm-vc4-fix-krealloc-memory-leak.patch
queue-6.1/f2fs-fix-to-do-sanity-check-on-dcc-discard_cmd_cnt-conditionally.patch
queue-6.1/arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
queue-6.1/nfc-llcp-fix-use-after-free-race-in-nfc_llcp_recv_cc.patch
queue-6.1/revert-selftests-bpf-workaround-strict-bpf_lsm-retur.patch
queue-6.1/net-netlink-fix-sending-unassigned-nsid-after-assign.patch
queue-6.1/bluetooth-bnep-reject-short-frames-before-parsing.patch
queue-6.1/net-packet-convert-po-has_vnet_hdr-to-an-atomic-flag.patch
queue-6.1/net-qrtr-ns-free-the-node-during-ctrl_cmd_bye.patch
queue-6.1/dm-cache-policy-smq-check-allocation-under-invalidat.patch
queue-6.1/ipmi-fix-rcu_read_unlock-to-srcu_read_unlock-in-hand.patch
queue-6.1/drm-i915-psr-read-intel-dpcd-workaround-register.patch
queue-6.1/net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
queue-6.1/ipv6-rpl-fix-hdrlen-overflow-in-ipv6_rpl_srh_decompr.patch
queue-6.1/net-gro-don-t-merge-zcopy-skbs.patch
queue-6.1/ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
queue-6.1/tun-free-page-on-short-frame-rejection-in-tun_xdp_on.patch
queue-6.1/usb-serial-mct_u232-fix-memory-corruption-with-small.patch
queue-6.1/bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
queue-6.1/signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
queue-6.1/loongarch-add-spectre-boundry-for-syscall-dispatch-table.patch
queue-6.1/alsa-aoa-i2sbus-clear-stale-prepared-state.patch
queue-6.1/sched-use-u64-for-bandwidth-ratio-calculations.patch
queue-6.1/revert-rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch
queue-6.1/net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
queue-6.1/media-rc-igorplugusb-heed-coherency-rules.patch
queue-6.1/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch
queue-6.1/net-qrtr-ns-change-servers-radix-tree-to-xarray.patch
queue-6.1/net-mctp-ensure-our-nlmsg-responses-are-initialised.patch
queue-6.1/media-rc-ttusbir-respect-dma-coherency-rules.patch
queue-6.1/batman-adv-tt-fix-toctou-race-for-reported-vlans.patch
queue-6.1/ptp-vclock-switch-from-rcu-to-srcu.patch
queue-6.1/time-fix-off-by-one-in-settimeofday-usec-validation.patch
queue-6.1/usb-serial-cypress_m8-fix-memory-corruption-with-sma.patch
queue-6.1/xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
queue-6.1/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch
queue-6.1/netlabel-validate-unlabeled-address-and-mask-attribu.patch
queue-6.1/batman-adv-tt-avoid-empty-vlan-responses.patch
queue-6.1/net-hsr-fix-potential-oob-access-in-supervision-fram.patch
queue-6.1/drm-remove-plane-hsub-vsub-alignment-requirement-for.patch
queue-6.1/net-qrtr-ns-limit-the-total-number-of-nodes.patch
queue-6.1/selftests-bpf-convert-test_global_funcs-test-to-test.patch
queue-6.1/serial-dz-fix-bootconsole-handover-lockup.patch
queue-6.1/net-sched-revert-net-sched-restrict-conditions-for-a.patch
queue-6.1/net-packet-convert-po-tp_loss-to-an-atomic-flag.patch
queue-6.1/mm-hugetlb-avoid-false-positive-lockdep-assertion.patch
queue-6.1/drm-i915-psr-add-defininitions-for-intel_wa_register.patch
queue-6.1/revert-selftests-bpf-add-a-cgroup-prog-bpf_get_ns_cu.patch
queue-6.1/net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
queue-6.1/bpf-fix-a-few-selftest-failures-due-to-llvm18-change.patch
queue-6.1/vxlan-do-not-reuse-cached-ip_hdr-value-after-skb_tun.patch
queue-6.1/net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
queue-6.1/batman-adv-tvlv-reject-oversized-tvlv-packets.patch
queue-6.1/r8152-block-future-register-access-if-register-acces.patch
queue-6.1/net-mvpp2-add-metadata-support-for-xdp-mode.patch
queue-6.1/net-packet-convert-po-tp_tx_has_off-to-an-atomic-fla.patch
queue-6.1/net-mctp-fix-don-t-require-received-header-reserved-bits-to-be-zero.patch
queue-6.1/xfrm-check-for-underflow-in-xfrm_state_mtu.patch
queue-6.1/netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
queue-6.1/net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
queue-6.1/selftests-bpf-s-iptables-iptables-legacy-in-the-bpf_.patch
queue-6.1/revert-selftests-bpf-add-tests-for-_opts-variants-of.patch
queue-6.1/hid-core-fix-size_t-specifier-in-hid_report_raw_even.patch
queue-6.1/rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
queue-6.1/net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
queue-6.1/bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch
queue-6.1/batman-adv-v-stop-ogmv2-on-disabled-interface.patch
queue-6.1/net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
queue-6.1/hwmon-pmbus-adm1266-serialize-sequencer_state-debugf.patch
queue-6.1/fbdev-defio-disconnect-deferred-i-o-from-the-lifetime-of-struct-fb_info.patch
queue-6.1/bluetooth-mgmt-fix-backward-compatibility-with-users.patch
queue-6.1/ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
queue-6.1/gpio-rockchip-convert-bank-clk-to-devm_clk_get_enabl.patch
queue-6.1/selftests-bpf-enhance-align-selftest-s-expected-log-.patch
queue-6.1/netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
queue-6.1/rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch-25226
queue-6.1/hid-pass-the-buffer-size-to-hid_report_raw_event.patch
queue-6.1/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch
queue-6.1/batman-adv-bla-avoid-null-ptr-deref-for-claim-via-dr.patch
queue-6.1/usb-serial-digi_acceleport-fix-memory-corruption-wit.patch
queue-6.1/tools-bootconfig-fix-buf-leaks-in-apply_xbc.patch
queue-6.1/bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
queue-6.1/wifi-mwifiex-fix-use-after-free-in-mwifiex_adapter_cleanup.patch
queue-6.1/batman-adv-iv-recover-ogm-scheduling-after-forward-p.patch
queue-6.1/net-sched-cls_fw-fix-null-dereference-of-old-filters.patch
queue-6.1/net-netlink-don-t-set-nsid-on-local-notifications.patch
queue-6.1/tcp-restrict-so_attach_filter-to-priv-users.patch
queue-6.1/batman-adv-tp_meter-directly-shut-down-timer-on-clea.patch
queue-6.1/netfilter-nf_log-validate-mac-header-was-set-before-.patch
queue-6.1/mm-page_alloc-clear-page-private-in-free_pages_prepa.patch
queue-6.1/octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
queue-6.1/net-smc-do-not-re-initialize-smc-hashtables.patch
queue-6.1/ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
queue-6.1/bluetooth-l2cap-clear-chan-ident-on-ecred-reconfigur.patch
queue-6.1/bpf-bonding-reject-vlan-srcmac-xmit_hash_policy-chan.patch
queue-6.1/tunnels-do-not-assume-transport-header-in-iptunnel_p.patch
queue-6.1/iomap-don-t-revert-iov_iter-on-partially-completed-b.patch
queue-6.1/phy-mscc-use-phy_id_match_vendor-to-minimize-phy-id-.patch
queue-6.1/net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
queue-6.1/batman-adv-bla-avoid-double-decrement-of-bla.num_req.patch
queue-6.1/batman-adv-tvlv-abort-ogm-send-on-tvlv-append-failur.patch
queue-6.1/lib-test_hmm-evict-device-pages-on-file-close-to-avoid-use-after-free.patch
queue-6.1/alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
queue-6.1/net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
queue-6.1/tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
queue-6.1/selftests-bpf-fix-arg_ptr_to_long-half-uninitialized.patch
queue-6.1/net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
queue-6.1/selftests-bpf-add-generic-bpf-program-tester-loader.patch
queue-6.1/bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
queue-6.1/hid-core-add-printk_ratelimited-variants-to-hid_warn.patch
queue-6.1/bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
queue-6.1/mm-damon-ops-common-call-folio_test_lru-after-folio_.patch
queue-6.1/netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
queue-6.1/asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
queue-6.1/net-skbuff-fix-missing-zerocopy-reference-in-pskb_ca.patch
queue-6.1/drm-dp-add-edp-1.5-bit-definition.patch
queue-6.1/dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch
queue-6.1/ipv6-fix-possible-infinite-loop-in-rt6_fill_node.patch
queue-6.1/tee-optee-prevent-use-after-free-when-the-client-exi.patch
queue-6.1/disable-wattribute-alias-for-clang-23-and-newer.patch
queue-6.1/vxlan-vnifilter-send-notification-on-vni-add.patch
queue-6.1/usb-gadget-f_ncm-fix-net_device-lifecycle-with-devic.patch
queue-6.1/selftests-bpf-update-bpf_clone_redirect-expected-ret.patch
queue-6.1/net-skbuff-fix-pskb_carve-leaking-zcopy-pages.patch
queue-6.1/net-qrtr-ns-limit-the-maximum-number-of-lookups.patch
queue-6.1/net-sched-sch_sfb-replace-direct-dequeue-call-with-p.patch
queue-6.1/netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
queue-6.1/tunnels-load-network-headers-after-skb_cow-in-iptunn.patch
queue-6.1/spi-imx-fix-use-after-free-on-unbind.patch
queue-6.1/netfilter-synproxy-refresh-tcphdr-after-skb_ensure_w.patch
queue-6.1/arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
queue-6.1/netfilter-nf_tables-restore-set-elements-when-delete.patch
queue-6.1/alsa-aoa-use-guard-for-mutex-locks.patch
queue-6.1/mm-huge_memory-update-file-pmd-counter-before-folio_.patch
queue-6.1/spi-fix-resource-leaks-on-device-setup-failure.patch
queue-6.1/kvm-arm64-remove-vpipt-i-cache-handling.patch
queue-6.1/xhci-tegra-fix-ghost-usb-device-on-dual-role-port-un.patch
queue-6.1/net-mana-add-null-guards-in-teardown-path-to-prevent.patch
queue-6.1/netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
queue-6.1/net-packet-fix-toctou-race-on-mmap-d-vnet_hdr-in-tpa.patch
queue-6.1/net-cpsw_new-fix-potential-unregister-of-netdev-that.patch
queue-6.1/drm-i915-psr-apply-intel-dpcd-workaround-when-sdp-on.patch
queue-6.1/net-iucv-fix-locking-in-.getsockopt.patch
queue-6.1/sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
queue-6.1/ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
queue-6.1/netfilter-xt_cpu-prefer-raw_smp_processor_id.patch
queue-6.1/batman-adv-tt-reject-oversized-local-tvlv-buffers.patch
queue-6.1/net-annotate-sk-sk_write_space-for-udp-sockmap.patch
queue-6.1/r8152-handle-the-return-value-of-usb_reset_device.patch
queue-6.1/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-wi.patch
queue-6.1/netfilter-ebtables-fix-oob-read-in-compat_mtw_from_u.patch
queue-6.1/r8152-reduce-the-control-transfer-of-rtl8152_get_ver.patch
queue-6.1/net-packet-convert-po-running-to-an-atomic-flag.patch
queue-6.1/tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
queue-6.1/nfc-nxp-nci-i2c-use-rising-edge-irq-on-acpi-systems.patch
queue-6.1/bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
queue-6.1/net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch
queue-6.1/fs-ntfs3-return-error-for-inconsistent-extended-attr.patch
queue-6.1/f2fs-fix-uaf-caused-by-decrementing-sbi-nr_pages-in-f2fs_write_end_io.patch
queue-6.1/thermal-core-fix-thermal-zone-governor-cleanup-issues.patch
queue-6.1/net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
queue-6.1/drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
queue-6.1/spi-imx-convert-to-platform-remove-callback-returning-void.patch
queue-6.1/net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
queue-6.1/ipv6-fix-possible-infinite-loop-in-fib6_select_path.patch
queue-6.1/netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
queue-6.1/nfc-llcp-fix-use-after-free-in-llcp_sock_release.patch
queue-6.1/selftests-forwarding-lib-add-helpers-for-checksum-ha.patch
queue-6.1/ksmbd-require-minimum-ace-size-in-smb_check_perm_dacl.patch
queue-6.1/netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
queue-6.1/netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
queue-6.1/phy-mscc-use-phy_id_match_exact-for-vsc8584-vsc8582-.patch
queue-6.1/usb-gadget-u_ether-fix-null-pointer-deref-in-eth_get.patch
queue-6.1/net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
queue-6.1/sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
queue-6.1/ipv4-free-net-ipv4.sysctl_local_reserved_ports-after.patch
queue-6.1/net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
queue-6.1/arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
