linux-stable.git, branch v7.2.6

Linux 7.2.6

2026-09-14T11:41:11+00:00

Link: https://lore.kernel.org/r/20260912065648.999753832@linuxfoundation.org
Tested-by: Brett A C Sheffield 
Tested-by: Salvatore Bonaccorso 
Tested-by: Ronald Warsow 
Tested-by: Takeshi Ogasawara 
Tested-by: Peter Schneider 
Tested-by: Benjamin Boortz 
Tested-by: Markus Reichelt 
Tested-by: Barry K. Nathan 
Tested-by: Ron Economos 
Tested-by: Miguel Ojeda 
Signed-off-by: Greg Kroah-Hartman

ksmbd: prevent out-of-bounds reads in share config responses

2026-09-14T11:41:11+00:00

commit f25e93768fcc5d8287e50b1ec52a42e4c276df34 upstream.

Validate IPC share configuration payload sizes before consuming
variable-length fields. Bound veto list parsing and account for
the separator byte when deriving the path length.

Fixes: a677ebd8ca2f ("ksmbd: validate payload size in ipc response")
Reported-by: Kanishka De Silva 
Reported-by: Farhad Alemi 
Signed-off-by: Namjae Jeon 
Signed-off-by: Greg Kroah-Hartman

perf python: Add missed explicit dependencies

2026-09-14T11:41:11+00:00

commit 01fa2d416aceab51f97ec2769e8da9971a605eeb upstream.

Fix missing #include of pmus.h found while cleaning the evsel/evlist
header files.

Also define PY_SSIZE_T_CLEAN before including Python.h to comply with
modern Python 3 C-API requirements, and introduce CHECK_INITIALIZED
and CHECK_INITIALIZED_INT safety macros to be used by subsequent patches.

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alice Rogers 
Cc: Dapeng Mi 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Leo Yan 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Thomas Richter 
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Namhyung Kim 
Signed-off-by: Greg Kroah-Hartman

perf ui hists: Fix dso_filter reference leak and exit zoom cleanup

2026-09-14T11:41:11+00:00

commit bd86119c3ee6ed7b8fc9be8298fe49f1a5355a46 upstream.

In hists_browser__zoom_map(), the active dso is assigned as a raw
pointer to hists->dso_filter without acquiring a reference using
dso__get(). This creates a potential use-after-free defect if the
underlying dso is released while the filter remains active.

Fix it by properly acquiring a reference via dso__get() when assigning
the filter, and releasing it with dso__put() when clearing it.
Additionally, since the browser stack relies on pstack__new() and deletes
it completely upon exiting, we must fully reset the persistent hists
structure by un-eliding columns and recalculating histogram filter
states for dso, thread, and symbols upon exit to guarantee immaculate,
uncorrupted state across browser tab switching.

Closes: https://lore.kernel.org/linux-perf-users/20260709170834.52F1A1F000E9@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers 
Signed-off-by: Namhyung Kim 
Signed-off-by: Greg Kroah-Hartman

perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow

2026-09-14T11:41:11+00:00

commit 2ec3b985872594031cc1000b830344de5c26633d upstream.

In evsel__hists_browse(), the 'options' and 'actions' arrays are
statically allocated on the stack with a size of MAX_OPTIONS (16).
Further down, the function sequentially calls several add_*_opt()
functions, which increment nr_options without bounds checking.

Depending on the context (e.g., branch mode, scripting, annotations),
the sum of added options can theoretically exceed 16 (potentially
reaching up to ~19). This could lead to a stack buffer overflow.

Increase MAX_OPTIONS to 32 to safely accommodate the maximum possible
number of options without risking an overflow.

Closes: https://lore.kernel.org/linux-perf-users/20260708235834.3FB771F00A3A@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers 
Link: https://lore.kernel.org/linux-perf-users/20260708235834.3FB771F00A3A@smtp.kernel.org/
Signed-off-by: Namhyung Kim 
Signed-off-by: Greg Kroah-Hartman

net/sched: fq: clamp quantum and initial_quantum in change path

2026-09-14T11:41:11+00:00

[ Upstream commit 094cc07f98dfe70a34e2a1923af17fd29b8cf622 ]

The fq change path accepts TCA_FQ_QUANTUM in [1, INT_MAX] and
TCA_FQ_INITIAL_QUANTUM up to INT_MAX, while fq_init() already clamps to
[1, 1<<20]. A user can override the init clamp via tc qdisc change,
restoring the small-quantum deficit spin that the init clamp prevents.

Narrow iq_range.max to 1<<20 so TCA_FQ_INITIAL_QUANTUM is rejected at
parse time. Clamp TCA_FQ_QUANTUM to [256, 1<<20] in fq_change() and
fq_init() quantum to [256, 1<<20] for tiny-MTU devices.

Conditions to recreate the bug:
  CONFIG_NET_SCH_FQ=y. Requires CAP_NET_ADMIN (namespace-local via
  unshare -Urn suffices).

  tc qdisc add dev dummy0 root fq
  tc qdisc change dev dummy0 root fq quantum 1 stab data 32768 size_log 15 cell_log 0

Fixes: 709f34f7c28d ("net/sched: fq: add overflow bounds to quantum and initial quantum")
Reported-by: Vega 
Reviewed-by: Toke Høiland-Jørgensen 
Tested-by: Victor Nogueira 
Signed-off-by: Jamal Hadi Salim 
Link: https://patch.msgid.link/QDISC-0CFC.v3.20260901204856@mojatatu.com.2
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin

tcp: reject non zerocopy devmem tx

2026-09-14T11:41:11+00:00

[ Upstream commit 125755776bc6d4dd53eaf551c87e3d460625d638 ]

Devmem tcp tx doesn't work without zero-copy, however it's not currently
enforced if NETIF_F_SG isn't present. In this case, tcp_sendmsg_locked()
will try the copy path and try to copy data from an iovec which consists
of offsets into the dma-buf and would normally fail. Moreover,
d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags")
relies on that and assumes that the devmem binding is present IFF we're
using the zero-copy path, which can be used to mix net-iov and pages in
a single skb, and break invariants. Let's reject devmem tx without
zero-copy.

Note, the parameter check the patch is modifying is too loose, we can
create an io_uring request with dmabuf_id and all ZC flags, but which
won't have the binding. We replace it with stricter validation.

Fixes: bd61848900bff ("net: devmem: Implement TX path")
Fixes: d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags")
Signed-off-by: Pavel Begunkov 
Reviewed-by: Mina Almasry 
Link: https://patch.msgid.link/fdc2478d8f21268d7078556409887d8e6ba0ad32.1788529053.git.asml.silence@gmail.com
Signed-off-by: Paolo Abeni 
Signed-off-by: Sasha Levin

Revert "esp: do not unref managed frag pages in esp_ssg_unref()"

2026-09-14T11:41:11+00:00

[ Upstream commit 0fda52de8bbd4ca9a852c8a7ef6536cf82bd71fd ]

This reverts commit 21697720ff43b8dfa25b8e8d9ca7f56f4597fc80.

The patch does not fix the issue completely, so revert for
now and wait for an updated version.

Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

dm-integrity: fix buffer overflow with keyed discard

2026-09-14T11:41:11+00:00

commit 59e6f919d77d72ec79cbf171256f2f7819737580 upstream.

Since commit 68c5c42567bc ("dm-integrity: replace forgeable discard
filler with a keyed sector marker"), integrity_metadata computes a
checksum for every discarded block into the "checksums" buffer.
integrity_sector_checksum always writes the whole digest. So if the tag
size is smaller than the digest size, the checksum of the last block
that fits into the buffer is written past the end of it. For example,
with hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past
the kmalloc'ed page.

Fix this by subtracting extra_space from the buffer size when computing
max_blocks, like we do for writes.

Fixes: 68c5c42567bc ("dm-integrity: replace forgeable discard filler with a keyed sector marker")
Reviewed-by: Jose Fernandez (Anthropic) 
Signed-off-by: Ben Cressey 
Assisted-by: Claude:unspecified
Signed-off-by: Mikulas Patocka 
Signed-off-by: Greg Kroah-Hartman

net/sched: sch_htb: limit htb_classify inner-class filter hops

2026-09-14T11:41:11+00:00

[ Upstream commit 729c4896ab829169f95915d65edd530325910b37 ]

htb_classify() follows each filter-selected inner class by switching
to cl->filter_list, but never bounds the number of hops. A filter on
an inner class can point back to itself or to another inner class that
points back, creating an infinite loop in the packet classification
path with the qdisc lock held and BH disabled — a soft lockup / panic
from a single packet.

Bound the traversal with a hop counter and drop the packet with a
rate-limited warning once the bound is exceeded. The counter is
incremented at the point the inner filter chain is picked up, after the
TC_ACT_* switch has consumed the classifier verdict, so a terminal
TC_ACT_QUEUED/STOLEN/TRAP on the last permitted chain still sets *qerr
to __NET_XMIT_STOLEN and the packet is not charged as a drop by this
qdisc or its parent.

The bound is TC_HTB_MAXDEPTH, taken from HTB's own parameters rather than
from the qdisc hierarchy depth limit. Class levels run from 0 to
TC_HTB_MAXDEPTH - 1, so a traversal that strictly descends in level can
take at most TC_HTB_MAXDEPTH hops. That descent is what a sane
configuration does, but it is assumed here rather than enforced:
htb_find() resolves a classid against every class in the qdisc, so a
filter may equally select a sibling or an ancestor. The normal
root -> inner -> leaf path takes a single hop, so the bound does not
affect legitimate classification.

htb_classify() can now return NULL irrespective of CONFIG_NET_CLS_ACT,
whereas previously every NULL return sat inside that ifdef. The NULL
handler in htb_enqueue() therefore cannot stay conditional either, so
drop the ifdef around it. This matches hfsc_enqueue(), which has always
handled a NULL class unconditionally. Without it, a kernel built
without actions would dereference a NULL class instead of dropping.

Conditions to recreate the bug:
- CONFIG_NET_SCHED, CONFIG_NET_SCH_HTB, CONFIG_NET_CLS_U32,
  CONFIG_LOCKUP_DETECTOR.
- Create an HTB qdisc on a device (e.g. lo), add an inner class
  1:1 with a leaf child 1:10, install a root u32 filter selecting
  1:1, and an inner-class u32 filter on 1:1 also selecting 1:1.
- Send one packet (ping). On the unfixed kernel the classify loop
  spins with the qdisc lock held; with softlockup_panic=1 it panics.
- Reachable from unprivileged user via unshare -Urn (CAP_NET_ADMIN).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Vega 
Co-developed-by: Victor Nogueira 
Signed-off-by: Victor Nogueira 
Signed-off-by: Jamal Hadi Salim 
Reviewed-by: Eric Dumazet 
Link: https://patch.msgid.link/20260826143339.271935-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin