user/sven/linux.git, branch v6.6.133

Linux 6.6.133

2026-04-06T07:55:59Z

Signed-off-by: Greg Kroah-Hartman

xattr: switch to CLASS(fd)

2026-04-06T07:55:59Z

[ Upstream commit a71874379ec8c6e788a61d71b3ad014a8d9a5c08 ] Reviewed-by: Christian Brauner Signed-off-by: Al Viro Link: https://lore.kernel.org/all/20241002012230.4174585-1-viro@zeniv.linux.org.uk/ [ Neither `fd_file` nor `fd_empty` are available in 6.6.y, so the changes to the check are dropped. Kept the minor formatting change. ] Signed-off-by: Tomasz Kramkowski Tested-by: Barry K. Nathan Signed-off-by: Greg Kroah-Hartman

Revert "xattr: switch to CLASS(fd)"

2026-04-06T07:55:58Z

This reverts commit 5a1e865e51063d6c56f673ec8ad4b6604321b455 which is commit a71874379ec8c6e788a61d71b3ad014a8d9a5c08 upstream. A backporting mistake erroneously removed file descriptor checks for `fgetxattr`, `flistxattr`, `fremovexattr`, and `fsetxattr` which lead to kernel panics when those functions were called from userspace with a file descriptor which did not reference an open file. Reported-by: Brad Spengler Closes: https://x.com/spendergrsec/status/2040049852793450561 Cc: Alva Lan Cc: Al Viro Signed-off-by: Tomasz Kramkowski Tested-by: Barry K. Nathan Signed-off-by: Greg Kroah-Hartman

Linux 6.6.132

2026-04-02T12:00:28Z

Signed-off-by: Greg Kroah-Hartman

Revert "rust: pin-init: add references to previously initialized fields"

2026-04-02T12:00:28Z

This reverts commit c28fc9b0dbc7ae5426689cde4f47c5e32dbf80fc which is commit 42415d163e5df6db799c7de6262d707e402c2c7e upstream. It breaks the build at this time. Link: https://lore.kernel.org/r/20260402112712.110869-1-ojeda@kernel.org Reported-by: Miguel Ojeda Cc: Benno Lossin Cc: Gary Guo Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman

Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors"

2026-04-02T12:00:28Z

This reverts commit 0890fba6129dc244bd6d61756dda1ec69b24f60b which is commit 580cc37b1de4fcd9997c48d7080e744533f09f36 upstream. It breaks the build at this time. Link: https://lore.kernel.org/r/20260402112712.110869-1-ojeda@kernel.org Reported-by: Miguel Ojeda Cc: Benno Lossin Cc: Gary Guo Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman

Linux 6.6.131

2026-04-02T11:07:33Z

Link: https://lore.kernel.org/r/20260331161729.779738837@linuxfoundation.org Tested-by: Florian Fainelli Tested-by: Peter Schneider Tested-by: Shung-Hsi Yu Tested-by: Brett A C Sheffield Tested-by: Jon Hunter Tested-by: Ron Economos Tested-by: Barry K. Nathan Tested-by: Francesco Dolcini Tested-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman

tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses.

2026-04-02T11:07:33Z

commit ea111449501ea32bf6da82750de860243691efc7 upstream. Commit 5e07e672412b ("tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.") introduced bind() regression for v4-mapped-v6 address. When we bind() the following two addresses on the same port, the 2nd bind() should succeed but fails now. 1. [::] w/ IPV6_ONLY 2. ::ffff:127.0.0.1 After the chagne, v4-mapped-v6 uses bhash2 instead of bhash to detect conflict faster, but I forgot to add a necessary change. During the 2nd bind(), inet_bind2_bucket_match_addr_any() returns the tb2 bucket of [::], and inet_bhash2_conflict() finally calls inet_bind_conflict(), which returns true, meaning conflict. inet_bhash2_addr_any_conflict |- inet_bind2_bucket_match_addr_any <-- return [::] bucket `- inet_bhash2_conflict `- __inet_bhash2_conflict <-- checks IPV6_ONLY for AF_INET | but not for v4-mapped-v6 address `- inet_bind_conflict <-- does not check address inet_bind_conflict() does not check socket addresses because __inet_bhash2_conflict() is expected to do so. However, it checks IPV6_V6ONLY attribute only against AF_INET socket, and not for v4-mapped-v6 address. As a result, v4-mapped-v6 address conflicts with v6-only wildcard address. To avoid that, let's add the missing test to use bhash2 for v4-mapped-v6 address. Fixes: 5e07e672412b ("tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.") Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20240326204251.51301-2-kuniyu@amazon.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman

futex: Clear stale exiting pointer in futex_lock_pi() retry path

2026-04-02T11:07:33Z

commit 210d36d892de5195e6766c45519dfb1e65f3eb83 upstream. Fuzzying/stressing futexes triggered: WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524 When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY and stores a refcounted task pointer in 'exiting'. After wait_for_owner_exiting() consumes that reference, the local pointer is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a different error, the bogus pointer is passed to wait_for_owner_exiting(). CPU0 CPU1 CPU2 futex_lock_pi(uaddr) // acquires the PI futex exit() futex_cleanup_begin() futex_state = EXITING; futex_lock_pi(uaddr) futex_lock_pi_atomic() attach_to_pi_owner() // observes EXITING *exiting = owner; // takes ref return -EBUSY wait_for_owner_exiting(-EBUSY, owner) put_task_struct(); // drops ref // exiting still points to owner goto retry; futex_lock_pi_atomic() lock_pi_update_atomic() cmpxchg(uaddr) *uaddr ^= WAITERS // whatever // value changed return -EAGAIN; wait_for_owner_exiting(-EAGAIN, exiting) // stale WARN_ON_ONCE(exiting) Fix this by resetting upon retry, essentially aligning it with requeue_pi. Fixes: 3ef240eaff36 ("futex: Prevent exit livelock") Signed-off-by: Davidlohr Bueso Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net Signed-off-by: Greg Kroah-Hartman

dmaengine: idxd: Fix freeing the allocated ida too late

2026-04-02T11:07:32Z

[ Upstream commit c311f5e9248471a950f0a524c2fd736414d98900 ] It can happen that when the cdev .release() is called, the driver already called ida_destroy(). Move ida_free() to the _del() path. We see with DEBUG_KOBJECT_RELEASE enabled and forcing an early PCI unbind. Fixes: 04922b7445a1 ("dmaengine: idxd: fix cdev setup and free device lifetime issues") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-9-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin