--- /dev/null
+From 114a116aaa5f0295376cdf12da743c5bce3b20ce Mon Sep 17 00:00:00 2001
+From: Carlos Llamas <cmllamas@google.com>
+Date: Fri, 19 Jun 2026 18:52:30 +0000
+Subject: binder: fix UAF in binder_thread_release()
+
+From: Carlos Llamas <cmllamas@google.com>
+
+commit 114a116aaa5f0295376cdf12da743c5bce3b20ce upstream.
+
+When a thread exits, binder_thread_release() walks its transaction stack
+to clear the t->from and t->to_proc that correspond with the exiting
+thread. However, a process dying in parallel might attempt to kfree some
+of these transactions. And if one of them has no associated t->to_proc,
+the t->to_proc->inner_lock will not be acquired.
+
+This means that transaction accesses in binder_thread_release() after
+t->to_proc has been cleared might race with binder_free_transaction()
+and cause a use-after-free error as reported by KASAN:
+
+ ==================================================================
+ BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798
+ Write of size 8 at addr ffff000016627500 by task X/715
+
+ CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT
+ Hardware name: linux,dummy-virt (DT)
+ Call trace:
+ binder_thread_release+0x5d0/0x798
+ binder_ioctl+0x12c0/0x299c
+ [...]
+
+ Allocated by task 717 on cpu 18 at 67.267803s:
+ __kasan_kmalloc+0xa0/0xbc
+ __kmalloc_cache_noprof+0x174/0x444
+ binder_transaction+0x554/0x8150
+ binder_thread_write+0xa30/0x4354
+ binder_ioctl+0x20f0/0x299c
+ [...]
+
+ Freed by task 202 on cpu 18 at 90.416221s:
+ __kasan_slab_free+0x58/0x80
+ kfree+0x1a0/0x4a4
+ binder_free_transaction+0x150/0x294
+ binder_send_failed_reply+0x398/0x6d8
+ binder_release_work+0x3e4/0x4ec
+ binder_deferred_func+0xbd8/0x104c
+ [...]
+ ==================================================================
+
+In order to avoid this, make sure that binder_free_transaction() reads
+the t->to_proc under the transaction lock. This will serialize the
+transaction release with the accesses in binder_thread_release(). Plus,
+it matches the documented locking rules for @to_proc.
+
+Cc: stable <stable@kernel.org>
+Fixes: 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe")
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Signed-off-by: Carlos Llamas <cmllamas@google.com>
+Link: https://patch.msgid.link/20260619185233.2194678-1-cmllamas@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1909,7 +1909,11 @@ static void binder_free_txn_fixups(struc
+
+ static void binder_free_transaction(struct binder_transaction *t)
+ {
+- struct binder_proc *target_proc = t->to_proc;
++ struct binder_proc *target_proc;
++
++ spin_lock(&t->lock);
++ target_proc = t->to_proc;
++ spin_unlock(&t->lock);
+
+ if (target_proc) {
+ binder_inner_proc_lock(target_proc);
--- /dev/null
+From 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 Mon Sep 17 00:00:00 2001
+From: Zenm Chen <zenmchen@gmail.com>
+Date: Tue, 26 May 2026 00:19:42 +0800
+Subject: Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+commit 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 upstream.
+
+Add USB ID 2c4e:0128 for Mercusys MA60XNB, an RTL8851BU-based
+Wi-Fi + Bluetooth adapter.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below:
+
+T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=2c4e ProdID=0128 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=802.11ax WLAN Adapter
+S: SerialNumber=00e04c000001
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org # 6.6.x
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -436,6 +436,8 @@ static const struct usb_device_id blackl
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x2c4e, 0x0128), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Realtek Bluetooth devices */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
--- /dev/null
+From eedc6867ebad73edbfaf9a0a65fbef7115cc4753 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 4 Jun 2026 08:37:36 +0200
+Subject: Bluetooth: btusb: fix use-after-free on registration failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 upstream.
+
+Make sure to release the sibling interfaces in case controller
+registration fails to avoid use-after-free and double-free when they are
+eventually disconnected.
+
+This issue was reported by Sashiko while reviewing a fix for a wakeup
+source leak in the btusb probe errors paths.
+
+Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
+Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver")
+Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
+Cc: stable@vger.kernel.org # 2.6.27
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -4371,12 +4371,21 @@ static int btusb_probe(struct usb_interf
+
+ err = hci_register_dev(hdev);
+ if (err < 0)
+- goto out_free_dev;
++ goto err_release_siblings;
+
+ usb_set_intfdata(intf, data);
+
+ return 0;
+
++err_release_siblings:
++ if (data->diag) {
++ usb_set_intfdata(data->diag, NULL);
++ usb_driver_release_interface(&btusb_driver, data->diag);
++ }
++ if (data->isoc) {
++ usb_set_intfdata(data->isoc, NULL);
++ usb_driver_release_interface(&btusb_driver, data->isoc);
++ }
+ out_free_dev:
+ if (data->reset_gpio)
+ gpiod_put(data->reset_gpio);
alsa-usb-audio-roll-back-quirk-control-caches-on-write-errors.patch
alsa-usb-audio-update-babyface-pro-control-caches-only-after-successful-writes.patch
alsa-usb-audio-update-us-16x08-eq-comp-shadow-state-after-successful-writes.patch
+bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch
+bluetooth-btusb-fix-use-after-free-on-registration-failure.patch
+binder-fix-uaf-in-binder_thread_release.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
