Commit b264d8422779 for kernel

commit b264d8422779d69febce914efc47a92a85cc382c
Author: Aswin Karuvally <aswin@linux.ibm.com>
Date:   Thu Aug 27 08:34:08 2026 +0200

    s390/ctcm: Prevent XID null dereference

    The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40
    to signal XID validation error. If peer XID is NULL or r/w channel
    pairing mismatch happens, grp->saved_xid2 is never initialized. An
    attempt to set the flag in such case leads to NULL dereference.

    Fix this by using the always available priv->xid->xid2_flag2 instead of
    grp->saved_xid2->xid2_flag2 for validation errors.

    Fixes: 293d984f0e36 ("ctcm: infrastructure for replaced ctc driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
    Link: https://patch.msgid.link/20260827063408.2168914-1-aswin@linux.ibm.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
index 08e36685e578..61c88fe853c5 100644
--- a/drivers/s390/net/ctcm_mpc.c
+++ b/drivers/s390/net/ctcm_mpc.c
@@ -826,7 +826,7 @@ static void mpc_action_go_ready(fsm_instance *fsm, int event, void *arg)

 	fsm_deltimer(&grp->timer);

-	if (grp->saved_xid2->xid2_flag2 == 0x40) {
+	if (priv->xid->xid2_flag2 == 0x40) {
 		priv->xid->xid2_flag2 = 0x00;
 		if (grp->estconnfunc) {
 			grp->estconnfunc(grp->port_num, 1,
@@ -1636,7 +1636,6 @@ static int mpc_validate_xid(struct mpcg_info *mpcginfo)
 			"The XID used in the MPC protocol is not valid, "
 			"rc = %d\n", rc);
 		priv->xid->xid2_flag2 = 0x40;
-		grp->saved_xid2->xid2_flag2 = 0x40;
 	}

 	return rc;