linux-stable.git, branch v6.12.96

Linux 6.12.96

2026-07-18T14:52:17+00:00

Link: https://lore.kernel.org/r/20260716133033.287196923@linuxfoundation.org
Tested-by: Brett A C Sheffield 
Tested-by: Florian Fainelli 
Tested-by: Peter Schneider 
Tested-by: Salvatore Bonaccorso 
Tested-by: Miguel Ojeda 
Tested-by: Francesco Dolcini 
Tested-by: Dominique Martinet 
Tested-by: Ron Economos 
Tested-by: Shuah Khan 
Tested-by: Pavel Machek (CIP) 
Link: https://lore.kernel.org/r/20260717101823.379399592@linuxfoundation.org
Tested-by: Brett A C Sheffield 
Tested-by: Florian Fainelli 
Tested-by: Pavel Machek (CIP) 
Tested-by: Peter Schneider 
Tested-by: Mark Brown 
Tested-by: Miguel Ojeda 
Signed-off-by: Greg Kroah-Hartman

xfs: don't zap bmbt forks if they are MAXLEVELS tall

2026-07-18T14:52:17+00:00

commit 59c462b0f5cfa107794228051724b34ae9334168 upstream.

LOLLM noticed a discrepancy between the bmbt level checks in the libxfs
bmbt code vs. the inode repair code.  We do actually allow a bmbt root
that proclaims to have a height of XFS_BM_MAXLEVELS.

Cc: stable@vger.kernel.org # v6.8
Fixes: e744cef2060559 ("xfs: zap broken inode forks")
Signed-off-by: "Darrick J. Wong" 
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

xfs: fully check the parent handle when it points to the rootdir

2026-07-18T14:52:17+00:00

commit ba150ce63453ccd74bae1404c1dfedbd01ecfd55 upstream.

LOLLM noticed that the directory tree path checking declares the path to
be ok if the inumber in the parent pointer reaches the root directory.
Unfortunately, it neglects to check that the generation is correct.  Fix
that by moving the generation check up.

Cc: stable@vger.kernel.org # v6.10
Fixes: 928b721a11789a ("xfs: teach online scrub to find directory tree structure problems")
Signed-off-by: "Darrick J. Wong" 
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

xfs: clamp timestamp nanoseconds correctly

2026-07-18T14:52:17+00:00

commit 15e38a9366b31d3d61081ead115f1dff59379e24 upstream.

LOLLM noticed an off-by-one error in the nsec clamping; fix that so that
we never have tv_nsec == 1e9.

Cc: stable@vger.kernel.org # v6.8
Fixes: 2d295fe65776d1 ("xfs: repair inode records")
Signed-off-by: "Darrick J. Wong" 
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

xfs: set xfarray killable sort correctly

2026-07-18T14:52:17+00:00

commit 540ddc626245f12f56326ee0c1601f71ebb41d64 upstream.

LOLLM noticed that we *disable* interruptible sorts when the KILLABLE
flag is set.  This is backwards.  Fix the incorrect logic, and rename
the variable to make the connection more obvious.

Cc: stable@vger.kernel.org # v6.10
Fixes: 271557de7cbfde ("xfs: reduce the rate of cond_resched calls inside scrub")
Signed-off-by: "Darrick J. Wong" 
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

xfs: don't wrap around quota ids in dqiterate

2026-07-18T14:52:17+00:00

commit d766e4e5e85d829629c3ba503802fe1303d7b591 upstream.

LOLLM noticed that q_id is an unsigned 32-bit variable.  If it happens
to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot
for ID_MAX, then this addition will truncate to zero and the iteration
starts over.  Fix this by casting to u64.

Cc: stable@vger.kernel.org # v6.8
Fixes: 21d7500929c8a0 ("xfs: improve dquot iteration for scrub")
Signed-off-by: "Darrick J. Wong" 
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

xfs: resample the data fork mapping after cycling ILOCK

2026-07-18T14:52:17+00:00

commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 upstream.

xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
a data fork mapping, and a cow fork mapping.  Unfortunately, these two
helpers cycle the ILOCK to grab a transaction, which means that the
mappings are stale as soon as we reacquire the ILOCK.  Currently we
refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but
we don't refresh the data fork mapping beforehand, which means that the
xfs_bmap_trim_cow in that function queries the refcount btree about the
wrong physical blocks and returns an inaccurate value in *shared.

If *shared is now false, the directio write proceeds with a stale data
fork mapping.  Fix this by querying the data fork mapping if the
sequence counter changes across the ILOCK cycle.

Cc: hch@lst.de
Cc: stable@vger.kernel.org # v4.11
Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin")
Signed-off-by: "Darrick J. Wong" 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Carlos Maiolino 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

xfs: fail recovery on a committed log item with no regions

2026-07-18T14:52:17+00:00

commit 2094dab19d45c487285617b7b68913d0cc0c1211 upstream.

If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.

The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log.  It came from an AI-assisted code audit of the
recovery parser.

xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf.  Reject it there, before the commit handlers that also read
ri_buf[0].

 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
  xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
  xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
  xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
  xlog_recover (fs/xfs/xfs_log_recover.c:3493)
  xfs_log_mount (fs/xfs/xfs_log.c:618)
  xfs_mountfs (fs/xfs/xfs_mount.c:1034)
  xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
  vfs_get_tree (fs/super.c:1695)
  path_mount (fs/namespace.c:4161)
  __x64_sys_mount (fs/namespace.c:4367)

Fixes: 89cebc847729 ("xfs: validate transaction header length on log recovery")
Cc: stable@vger.kernel.org # v4.3
Reported-by: Xiang Mei 
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi 
Reviewed-by: Christoph Hellwig 
Reviewed-by: "Darrick J. Wong" 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

xfs: fix null pointer dereference in tracepoint

2026-07-18T14:52:17+00:00

commit 9202ee546b0cd71004eed7598546efe4660097da upstream.

If dfp is not NULL we exit early here, when dfp is NULL it's allocated
in xfs_defer_alloc() but not assigned. The tracepoint tries to
dereference members of dfp struct.

Signed-off-by: Andrey Albershteyn 
Cc: stable@vger.kernel.org # v6.8
Fixes: 3f3cec031099c3 ("xfs: force small EFIs for reaping btree extents")
Reviewed-by: "Darrick J. Wong" 
Signed-off-by: Carlos Maiolino 
Signed-off-by: Greg Kroah-Hartman

smb: client: reject overlapping data areas in SMB2 responses

2026-07-18T14:52:17+00:00

commit 8986c932905ea508d66da421eb2eb6e676ace1fe upstream.

Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to
responses without data area") restricted the implied bcc[0] length
exception to responses without a data area. However, the overlap
handling in __smb2_calc_size() clears data_length, which can make an
invalid response appear to have no data area and so qualify for the
exception.

Track data area overlap separately and reject such responses before
applying the length compatibility exceptions.

Fixes: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
Cc: stable@vger.kernel.org
Signed-off-by: Shoichiro Miyamoto 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman