linux.git/fs, branch v7.2-rc7 Linux kernel source tree Merge tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 2026-08-09T15:47:31+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-09T15:47:31+00:00 b9b3e33b70b71e516930117e21de3ad2a7723747 Pull tracing fixes from Steven Rostedt: - Fix use-after-free in eventfs_remove_rec() The freeing of the eventfs_inode children used list_for_each_entry() where the child is freed via srcu, but there's still a chance that it gets freed. It should be using list_for_each_entry_safe(). - Fix eventfs_inode SRCU use of list in freeing The iterator uses an SRCU protected list walk on the eventfs inodes. The eventfs inode uses its "list" field in a union with the RCU list head. When the inode gets added to the SRCU list it immediately corrupts the list pointer and can cause an issue with the iterator. Move the RCU list head to be shared with the children list head which allows the iterator to check the parent inode if is freed before referencing the child. Have the iterator check the parent "is_freed" field and break out if it is set. Also add memory barriers to make sure the ordering is correct. - Fix various RCU synchronization issues with direct_functions Updates to direct_functions have some missing RCU protection and synchronization. Restructure the code a bit to make sure updates to the direct_functions are protected. - Remove an unneeded comma from a scope_guard() There's a spurious comma in a scope_guard(). Remove it. - Fix race in per CPU buffer swap in the ring buffer When a per CPU buffer swap happens, it must make sure that it doesn't occur while a writer is active. Instead it returns an -EBUSY. But there's a small race window when a writer moves from one sub-buffer to the next that it resets the "committing" counter. If a swap happens at that moment, the buffer used for the commit of an event will not match the buffer the event is actually on. Instead of using the "committing" counter, use the recursive detection counter that does not get reset when the writer crosses sub-buffers. - Fix off-by-one in ftrace_free_mem() The function ftrace_free_mem() gets an "end_ptr" as a parameter that is exclusive to the rang to be freed. But its value is used to search for the records that expects an inclusive value. Subtract one from the parameter to convert it to an inclusive range. - Disable resizing of the ring buffer for persistent buffers Resizing the persistent buffer has undefined behavior. Prevent it from being resized. - Disable changing ring buffer subbuf order when resizing is disabled The ring buffer subbuffer order can not be changed during resizing. Use that instead of just checking if the buffer is mapped as mapped buffers also have resizing disabled. - Initialize subbuf_order of reader pages when they are created In rb_allocate_cpu_buffer() the bpage->order is not updated to the current subbuf_order leaving it as zero. This value is used when the page is freed. - Fix test_ringbuffer() to test for ERR_PTR before calling kthread_stop() The rb_threads[] array is assigned the output of kthread_run_on_cpu() which could return an ERR_PTR. At the end of the test, all threads in the array are cleaned up by kthread_stop() passing in the value in the array if it isn't zero. But if the array contains an ERR_PTR, kthread_stop() will not be able to handle it properly. * tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Fix crash passing ERR_PTR to kthread_stop() ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() ring-buffer: Prevent subbuf order change when resizing is disabled ring-buffer: Prevent resizing of persistent ring buffer ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() ring-buffer: Use current_context for safe per-CPU buffer swap ftrace: Drop extra comma in trace_buffered_event_enable ftrace: Protect direct_functions in update_ftrace_direct_mod ftrace: Protect direct_functions in update_ftrace_direct_del ftrace: Protect direct_functions in ftrace_find_rec_direct eventfs: Use children field for rcu head and add memory barriers eventfs: Fix use-after-free in eventfs_remove_rec() 
Pull tracing fixes from Steven Rostedt:

 - Fix use-after-free in eventfs_remove_rec()

   The freeing of the eventfs_inode children used list_for_each_entry()
   where the child is freed via srcu, but there's still a chance that it
   gets freed. It should be using list_for_each_entry_safe().

 - Fix eventfs_inode SRCU use of list in freeing

   The iterator uses an SRCU protected list walk on the eventfs inodes.
   The eventfs inode uses its "list" field in a union with the RCU list
   head. When the inode gets added to the SRCU list it immediately
   corrupts the list pointer and can cause an issue with the iterator.
   Move the RCU list head to be shared with the children list head which
   allows the iterator to check the parent inode if is freed before
   referencing the child. Have the iterator check the parent "is_freed"
   field and break out if it is set. Also add memory barriers to make
   sure the ordering is correct.

 - Fix various RCU synchronization issues with direct_functions

   Updates to direct_functions have some missing RCU protection and
   synchronization. Restructure the code a bit to make sure updates to
   the direct_functions are protected.

 - Remove an unneeded comma from a scope_guard()

   There's a spurious comma in a scope_guard(). Remove it.

 - Fix race in per CPU buffer swap in the ring buffer

   When a per CPU buffer swap happens, it must make sure that it doesn't
   occur while a writer is active. Instead it returns an -EBUSY. But
   there's a small race window when a writer moves from one sub-buffer
   to the next that it resets the "committing" counter. If a swap
   happens at that moment, the buffer used for the commit of an event
   will not match the buffer the event is actually on. Instead of using
   the "committing" counter, use the recursive detection counter that
   does not get reset when the writer crosses sub-buffers.

 - Fix off-by-one in ftrace_free_mem()

   The function ftrace_free_mem() gets an "end_ptr" as a parameter that
   is exclusive to the rang to be freed. But its value is used to search
   for the records that expects an inclusive value. Subtract one from
   the parameter to convert it to an inclusive range.

 - Disable resizing of the ring buffer for persistent buffers

   Resizing the persistent buffer has undefined behavior. Prevent it
   from being resized.

 - Disable changing ring buffer subbuf order when resizing is disabled

   The ring buffer subbuffer order can not be changed during resizing.
   Use that instead of just checking if the buffer is mapped as mapped
   buffers also have resizing disabled.

 - Initialize subbuf_order of reader pages when they are created

   In rb_allocate_cpu_buffer() the bpage->order is not updated to the
   current subbuf_order leaving it as zero. This value is used when the
   page is freed.

 - Fix test_ringbuffer() to test for ERR_PTR before calling
   kthread_stop()

   The rb_threads[] array is assigned the output of kthread_run_on_cpu()
   which could return an ERR_PTR. At the end of the test, all threads in
   the array are cleaned up by kthread_stop() passing in the value in
   the array if it isn't zero. But if the array contains an ERR_PTR,
   kthread_stop() will not be able to handle it properly.

* tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
  ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
  ring-buffer: Prevent subbuf order change when resizing is disabled
  ring-buffer: Prevent resizing of persistent ring buffer
  ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
  ring-buffer: Use current_context for safe per-CPU buffer swap
  ftrace: Drop extra comma in trace_buffered_event_enable
  ftrace: Protect direct_functions in update_ftrace_direct_mod
  ftrace: Protect direct_functions in update_ftrace_direct_del
  ftrace: Protect direct_functions in ftrace_find_rec_direct
  eventfs: Use children field for rcu head and add memory barriers
  eventfs: Fix use-after-free in eventfs_remove_rec()
eventfs: Use children field for rcu head and add memory barriers 2026-08-08T14:36:05+00:00 Steven Rostedt rostedt@goodmis.org 2026-08-08T13:42:15+00:00 f0ece16ffca7384787b692431961ce202907acf5 When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target. To fix this, change the union of the rcu list head with the children list. On freeing the eventfs inode, set the is_free and execute a smp_wmb() before adding the eventfs inode to the SRCU list. On iteration of the ei->children list, at the start, execute a smp_rmb() and then read the is_freed of the ei to see if the children list is still valid. If is_freed is set, then the ei_child read is not valid and the loop should exit immediately. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260808094215.4252430d@robin Fixes: 704f960dbee2f ("eventfs: Read ei->entries before ei->children in eventfs_iterate()") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260806022719.375354-1-shuangpeng.kernel%40gmail.com Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> 
When an eventfs inode is freed, it sets ei->is_freed and then uses its
ei->list to add it to the srcu link list as the list field is a union with
the rcu list head. As the ei->list is used to iterate over an SRCU
protected list without taking the eventfs_mutex, there's nothing stopping
the iteration over that list to see the ei->rcu instead of the ei->list
and it will read a corrupt target.

To fix this, change the union of the rcu list head with the children list.
On freeing the eventfs inode, set the is_free and execute a smp_wmb()
before adding the eventfs inode to the SRCU list.

On iteration of the ei->children list, at the start, execute a smp_rmb()
and then read the is_freed of the ei to see if the children list is still
valid. If is_freed is set, then the ei_child read is not valid and the
loop should exit immediately.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808094215.4252430d@robin
Fixes: 704f960dbee2f ("eventfs: Read ei->entries before ei->children in eventfs_iterate()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260806022719.375354-1-shuangpeng.kernel%40gmail.com
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
eventfs: Fix use-after-free in eventfs_remove_rec() 2026-08-08T14:35:33+00:00 Shuangpeng Bai shuangpeng.kernel@gmail.com 2026-08-06T02:27:19+00:00 fd73b691702170d37d66f4b0278530cea8ed419a eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child. Cc: stable@vger.kernel.org Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts") Link: https://patch.msgid.link/20260806022719.375354-1-shuangpeng.kernel@gmail.com Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> 
eventfs_remove_rec() recursively removes the child at the current loop
position. After the recursive call returns, list_for_each_entry() advances
by reading list.next from the removed child.

If free_ei() drops the final reference, release_ei() reuses the list/rcu
union to queue an SRCU callback. The child may be freed before that read.
The eventfs_mutex serializes list updates, but it does not keep the removed
child alive or prevent the SRCU callback from running.

Use list_for_each_entry_safe() to save the next sibling before recursively
removing the current child.

Cc: stable@vger.kernel.org
Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts")
Link: https://patch.msgid.link/20260806022719.375354-1-shuangpeng.kernel@gmail.com
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2026-08-07T15:08:57+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-07T15:08:57+00:00 a13307e97d5c54b65720bb71fa379960ded1e51a Pull BPF fixes from Daniel Borkmann: - Fix BPF verifier to preserve full pointer state for commuted scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman) - Fix a use-after-free of request sockets in the BPF TCP iterator batching (Jose Fernandez) - Fix a use-after-free of sk_redir in the BPF sockmap send verdict path (Chengfeng Ye) - Fix a netns reference imbalance in the BPF conntrack kfuncs (Chengfeng Ye) - Fix bpf_get_fsverity_digest() dynptr assumptions and silent digest truncation (Eric Biggers) - Fix bpf_tcp_{gen,check}_syncookie to check sk_state before sk_protocol to make sure it is a full socket (Luxiao Xu) - Fix rqspinlock to reset the tail when preserving the queue on deadlock (Kumar Kartikeya Dwivedi) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: rqspinlock: Reset tail when preserving queue on deadlock bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie fsverity: Fix silent truncation in bpf_get_fsverity_digest() fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() bpf: Fix netns reference imbalance in conntrack kfuncs bpf, sockmap: Fix sk_redir use-after-free in send verdict selftests/bpf: Cover commuted pointer state propagation bpf: Propagate untrusted pointer state in commuted arithmetic bpf: Preserve pointer state for commuted arithmetic bpf: Simplify sanitize_err() signature 
Pull BPF fixes from Daniel Borkmann:

 - Fix BPF verifier to preserve full pointer state for commuted
   scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)

 - Fix a use-after-free of request sockets in the BPF TCP iterator
   batching (Jose Fernandez)

 - Fix a use-after-free of sk_redir in the BPF sockmap send verdict
   path (Chengfeng Ye)

 - Fix a netns reference imbalance in the BPF conntrack kfuncs
   (Chengfeng Ye)

 - Fix bpf_get_fsverity_digest() dynptr assumptions and silent
   digest truncation (Eric Biggers)

 - Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
   sk_protocol to make sure it is a full socket (Luxiao Xu)

 - Fix rqspinlock to reset the tail when preserving the queue
   on deadlock (Kumar Kartikeya Dwivedi)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  rqspinlock: Reset tail when preserving queue on deadlock
  bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
  fsverity: Fix silent truncation in bpf_get_fsverity_digest()
  fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
  bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
  bpf: Fix netns reference imbalance in conntrack kfuncs
  bpf, sockmap: Fix sk_redir use-after-free in send verdict
  selftests/bpf: Cover commuted pointer state propagation
  bpf: Propagate untrusted pointer state in commuted arithmetic
  bpf: Preserve pointer state for commuted arithmetic
  bpf: Simplify sanitize_err() signature
Merge tag 'v7.2-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd 2026-08-07T03:25:46+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-07T03:25:46+00:00 364465ab19defc0635d06f13f170c8d5c096de7c Pull smb server fixes from Steve French: - Reject Pattern_V1 payloads when Pattern_V1 support was not negotiated - Validate compression transform flags and chained mode before allocating the decompression buffer - Enforce the pre-authentication PDU size limit before allocating the decompression buffer, preventing compressed requests from bypassing the limit * tag 'v7.2-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: apply the pre-authentication PDU limit when decompressing ksmbd: validate compression Flags before kvmalloc smb: compress: reject Pattern_V1 when not negotiated 
Pull smb server fixes from Steve French:

 - Reject Pattern_V1 payloads when Pattern_V1 support was not
   negotiated

 - Validate compression transform flags and chained mode before
   allocating the decompression buffer

 - Enforce the pre-authentication PDU size limit before allocating
   the decompression buffer, preventing compressed requests from
   bypassing the limit

* tag 'v7.2-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: apply the pre-authentication PDU limit when decompressing
  ksmbd: validate compression Flags before kvmalloc
  smb: compress: reject Pattern_V1 when not negotiated
Merge tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 2026-08-06T22:38:00+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-06T22:38:00+00:00 c0a27675eaf08255017b3cabc28c99c0cd71f468 Pull smb client fixes from Steve French: - Fix potential use after free in cifs_try_adding_channels - Fix SMB1 large directory enumeration - Minor debug improvement (show compress mount option) * tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() smb: client: Fix use-after-free in cifs_try_adding_channels() smb/client: show compress mount option 
Pull smb client fixes from Steve French:

 - Fix potential use after free in cifs_try_adding_channels

 - Fix SMB1 large directory enumeration

 - Minor debug improvement (show compress mount option)

* tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
  smb: client: Fix use-after-free in cifs_try_adding_channels()
  smb/client: show compress mount option
Merge tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 2026-08-06T20:29:15+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-06T20:29:15+00:00 6c68fa601b49683ecb04eded993a71dfa8b2ba0b Pull Btrfs Fixes 2: Electric Boogaloo from David Sterba: "This brings back the fixup worker infrastructure. It's a mechanism to detect pages/folios that are marked dirty without filesystem knowledge and require COW fixup. The consequence of not doing so is silent data loss. The first patch covers the scenarios in detail, also reflecting folio API port and subpage block size support added in recent years. The original fixup worker was only for pages. The patch is relatively big, half of the code is debugging and support code, the rest is the core design around the detection and fix. The second patch handles an unlikely case when there's work left during unmount" * tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: flush the fixup workers during close_ctree btrfs: trigger cow fixup via dirty_folio() 
Pull Btrfs Fixes 2: Electric Boogaloo from David Sterba:
 "This brings back the fixup worker infrastructure.

  It's a mechanism to detect pages/folios that are marked dirty without
  filesystem knowledge and require COW fixup. The consequence of not
  doing so is silent data loss.

  The first patch covers the scenarios in detail, also reflecting folio
  API port and subpage block size support added in recent years. The
  original fixup worker was only for pages.

  The patch is relatively big, half of the code is debugging and support
  code, the rest is the core design around the detection and fix.

  The second patch handles an unlikely case when there's work left
  during unmount"

* tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: flush the fixup workers during close_ctree
  btrfs: trigger cow fixup via dirty_folio()
Merge tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 2026-08-06T20:24:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-06T20:24:40+00:00 63354634885c8d41675c5af54f757db2d14326e6 Pull btrfs fixes from David Sterba: - fix leak in encoded ioctl write - disable large folios on systems with highmem - disable block size > page size when there's no transparent hugepage support (under experimental config) - reject compressed inline extents without valid LZO headers - properly initialize cached inode mapping (if block size > page size) * tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: initialize inode mapping flags for cached inodes btrfs: disable bs > ps support if no transparent hugepage support btrfs: fix memory leak in btrfs_do_encoded_write() btrfs: lzo: reject inline extents without valid headers btrfs: disable large folios for systems with highmem 
Pull btrfs fixes from David Sterba:

 - fix leak in encoded ioctl write

 - disable large folios on systems with highmem

 - disable block size > page size when there's no transparent hugepage
   support (under experimental config)

 - reject compressed inline extents without valid LZO headers

 - properly initialize cached inode mapping (if block size > page size)

* tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: initialize inode mapping flags for cached inodes
  btrfs: disable bs > ps support if no transparent hugepage support
  btrfs: fix memory leak in btrfs_do_encoded_write()
  btrfs: lzo: reject inline extents without valid headers
  btrfs: disable large folios for systems with highmem
Merge tag 'xfs-fixes-7.2-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux 2026-08-06T15:16:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-06T15:16:40+00:00 ad7d48f1fb6599a51fcf51472439a555e6b802be Pull xfs fixes from Carlos Maiolino: "This contains mostly a collection of bug fixes found by LLM tools" * tag 'xfs-fixes-7.2-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (34 commits) xfs: check v5 superblock features early xfs: add a comment to describe xfs_gc_bio.victim_rtg xfs: add a separate bio_set for spliting GC writes xfs: don't swallow dquot recovery verification errors xfs: fix ilock leak on error in xfs_dq_get_next_id xfs: don't ignore runtime errors in xrep_iunlink_reload_next xfs: set the prev pointer when reinserting an inode on the unlinked list xfs: fix another iunlink infinite loop bug in online fsck xfs: fix allocated inodes that show up in the unlinked list xfs: check xfarray iteration errors when committing unlinked inode lists xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair xfs: don't livelock in scrub on a circular unlinked list xfs: hoist per-bucket unlinked list check to helper xfs: avoid UAF on sc->tempip in xrep_tempfile_create xfs: nlink scrub must take IOLOCK before determining ILOCK state xfs: don't zap the attr fork on repair when there are queued pptr updates xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers xfs: don't double-lock when deleting a self-referential directory ... 
Pull xfs fixes from Carlos Maiolino:
 "This contains mostly a collection of bug fixes found by LLM tools"

* tag 'xfs-fixes-7.2-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (34 commits)
  xfs: check v5 superblock features early
  xfs: add a comment to describe xfs_gc_bio.victim_rtg
  xfs: add a separate bio_set for spliting GC writes
  xfs: don't swallow dquot recovery verification errors
  xfs: fix ilock leak on error in xfs_dq_get_next_id
  xfs: don't ignore runtime errors in xrep_iunlink_reload_next
  xfs: set the prev pointer when reinserting an inode on the unlinked list
  xfs: fix another iunlink infinite loop bug in online fsck
  xfs: fix allocated inodes that show up in the unlinked list
  xfs: check xfarray iteration errors when committing unlinked inode lists
  xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
  xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
  xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
  xfs: don't livelock in scrub on a circular unlinked list
  xfs: hoist per-bucket unlinked list check to helper
  xfs: avoid UAF on sc->tempip in xrep_tempfile_create
  xfs: nlink scrub must take IOLOCK before determining ILOCK state
  xfs: don't zap the attr fork on repair when there are queued pptr updates
  xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
  xfs: don't double-lock when deleting a self-referential directory
  ...
smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() 2026-08-04T23:17:02+00:00 Frank Sorenson sorenson@redhat.com 2026-08-04T19:21:12+00:00 26fa4d17c023dbe5427a92d3a7bd9ae1d1e58bc5 When a TRANS2 response is split across multiple secondary packets, coalesce_t2() assembles the payload into the large response buffer. Two bugs cause SendReceive() to copy only a small fraction of the assembled buffer into the caller's output buffer. This manifests when listing a large directory on an SMB1 share (observed against Windows XP); the first getdents returns only partial results, and subsequent getdents returns EINVAL. Bug 1: coalesce_t2() computes the coalesced size as: *pdu_len += total_in_src; cifs_demultiplex_thread() resets *pdu_len to each secondary's own pdu_length before calling coalesce_t2(), so this accumulates from the wrong baseline on every secondary after the first. Bug 2: after reassembly, cifs_demultiplex_thread() sets mid->resp_buf_size to the final secondary's raw packet size. This value is later used as the memcpy length, so only a portion of the coalesced response is copied. Fix both by replacing the stale *pdu_len arithmetic with smbCalcSize(), which reads the BCC field that coalesce_t2() maintains correctly throughout reassembly. Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") Cc: stable@vger.kernel.org Signed-off-by: Frank Sorenson <sorenson@redhat.com> Reviewed-by: Paulo Alcantara <pc@manguebit.org> Signed-off-by: Steve French <stfrench@microsoft.com> 
When a TRANS2 response is split across multiple secondary packets,
coalesce_t2() assembles the payload into the large response buffer.
Two bugs cause SendReceive() to copy only a small fraction of the
assembled buffer into the caller's output buffer.

This manifests when listing a large directory on an SMB1 share
(observed against Windows XP); the first getdents returns only
partial results, and subsequent getdents returns EINVAL.

Bug 1: coalesce_t2() computes the coalesced size as:

  *pdu_len += total_in_src;

cifs_demultiplex_thread() resets *pdu_len to each secondary's own
pdu_length before calling coalesce_t2(), so this accumulates from
the wrong baseline on every secondary after the first.

Bug 2: after reassembly, cifs_demultiplex_thread() sets
mid->resp_buf_size to the final secondary's raw packet size.  This
value is later used as the memcpy length, so only a portion of the
coalesced response is copied.

Fix both by replacing the stale *pdu_len arithmetic with
smbCalcSize(), which reads the BCC field that coalesce_t2()
maintains correctly throughout reassembly.

Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>