--- /dev/null
+From f3ef7110924b897f4b79db9f7ac75d319ec09c4a Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Thu, 28 Aug 2025 19:22:43 +0800
+Subject: ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit f3ef7110924b897f4b79db9f7ac75d319ec09c4a upstream.
+
+If krealloc_array() fails in iort_rmr_alloc_sids(), the function returns
+NULL but does not free the original 'sids' allocation. This results in a
+memory leak since the caller overwrites the original pointer with the
+NULL return value.
+
+Fixes: 491cf4a6735a ("ACPI/IORT: Add support to retrieve IORT RMR reserved regions")
+Cc: <stable@vger.kernel.org> # 6.0.x
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/20250828112243.61460-1-linmq006@gmail.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/arm64/iort.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -928,8 +928,10 @@ static u32 *iort_rmr_alloc_sids(u32 *sid
+
+ new_sids = krealloc_array(sids, count + new_count,
+ sizeof(*new_sids), GFP_KERNEL);
+- if (!new_sids)
++ if (!new_sids) {
++ kfree(sids);
+ return NULL;
++ }
+
+ for (i = count; i < total_count; i++)
+ new_sids[i] = id_start++;
--- /dev/null
+From 9c6182843b0d02ca04cc1d946954a65a2286c7db Mon Sep 17 00:00:00 2001
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+Date: Fri, 22 Aug 2025 20:58:08 +0800
+Subject: ALSA: usb-audio: Add mute TLV for playback volumes on some devices
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+commit 9c6182843b0d02ca04cc1d946954a65a2286c7db upstream.
+
+Applying the quirk of that, the lowest Playback mixer volume setting
+mutes the audio output, on more devices.
+
+Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2514
+Cc: <stable@vger.kernel.org>
+Tested-by: Guoli An <anguoli@uniontech.com>
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Link: https://patch.msgid.link/20250822-mixer-quirk-v1-1-b19252239c1c@uniontech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -3631,9 +3631,11 @@ void snd_usb_mixer_fu_apply_quirk(struct
+ snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
+ break;
+ /* lowest playback value is muted on some devices */
++ case USB_ID(0x0572, 0x1b09): /* Conexant Systems (Rockwell), Inc. */
+ case USB_ID(0x0d8c, 0x000c): /* C-Media */
+ case USB_ID(0x0d8c, 0x0014): /* C-Media */
+ case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */
++ case USB_ID(0x2d99, 0x0026): /* HECATE G2 GAMING HEADSET */
+ if (strstr(kctl->id.name, "Playback"))
+ cval->min_mute = 1;
+ break;
--- /dev/null
+From 44822df89e8f3386871d9cad563ece8e2fd8f0e7 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Tue, 12 Aug 2025 15:25:09 +0800
+Subject: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit 44822df89e8f3386871d9cad563ece8e2fd8f0e7 upstream.
+
+In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to
+res and used in pci_bus_alloc_resource(). There is a dereference of res
+in pci_bus_alloc_resource(), which could lead to a NULL pointer
+dereference on failure of pcmcia_make_resource().
+
+Fix this bug by adding a check of res.
+
+Cc: stable@vger.kernel.org
+Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into one module")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pcmcia/rsrc_iodyn.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pcmcia/rsrc_iodyn.c
++++ b/drivers/pcmcia/rsrc_iodyn.c
+@@ -62,6 +62,9 @@ static struct resource *__iodyn_find_io_
+ unsigned long min = base;
+ int ret;
+
++ if (!res)
++ return NULL;
++
+ data.mask = align - 1;
+ data.offset = base & data.mask;
+
ppp-fix-memory-leak-in-pad_compress_skb.patch
selftest-net-fix-weird-setsockopt-in-bind_bhash.c.patch
phy-mscc-stop-taking-ts_lock-for-tx_queue-and-use-it.patch
+alsa-usb-audio-add-mute-tlv-for-playback-volumes-on-some-devices.patch
+acpi-iort-fix-memory-leak-in-iort_rmr_alloc_sids.patch
+pcmcia-fix-a-null-pointer-dereference-in-__iodyn_find_io_region.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
