[GIT PULL] s390 fixes for 6.16-rc4

[Alexander Gordeev]

Hi Linus,

please pull s390 fixes for 6.16-rc4.

Thanks,
Alexander

The following changes since commit e04c78d86a9699d136910cfc0bdcf01087e3267e:

  Linux 6.16-rc2 (2025-06-15 13:49:41 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git tags/s390-6.16-3

for you to fetch changes up to 7f8073cfb04a97842fe891ca50dad60afd1e3121:

  s390/ptrace: Fix pointer dereferencing in regs_get_kernel_stack_nth() (2025-06-17 18:15:25 +0200)

----------------------------------------------------------------
s390 fixes for 6.16-rc4

- Fix incorrectly dropped dereferencing of the stack nth entry
  introduced with a previous KASAN false positive fix

- Use a proper memdup_array_user() helper to prevent overflow
  in a protected key size calculation

----------------------------------------------------------------
Fedor Pchelkin (1):
      s390/pkey: Prevent overflow in size calculation for memdup_user()

Heiko Carstens (1):
      s390/ptrace: Fix pointer dereferencing in regs_get_kernel_stack_nth()

 arch/s390/include/asm/ptrace.h | 2 +-
 drivers/s390/crypto/pkey_api.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index 62c0ab4a4b9d..0905fa99a31e 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -265,7 +265,7 @@ static __always_inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *r
 	addr = kernel_stack_pointer(regs) + n * sizeof(long);
 	if (!regs_within_kernel_stack(regs, addr))
 		return 0;
-	return READ_ONCE_NOCHECK(addr);
+	return READ_ONCE_NOCHECK(*(unsigned long *)addr);
 }
 
 /**
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index cef60770f68b..b3fcdcae379e 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -86,7 +86,7 @@ static void *_copy_apqns_from_user(void __user *uapqns, size_t nr_apqns)
 	if (!uapqns || nr_apqns == 0)
 		return NULL;
 
-	return memdup_user(uapqns, nr_apqns * sizeof(struct pkey_apqn));
+	return memdup_array_user(uapqns, nr_apqns, sizeof(struct pkey_apqn));
 }
 
 static int pkey_ioctl_genseck(struct pkey_genseck __user *ugs)