6.17-stable patches

added patches:
	isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch
	net-phy-micrel-fix-lan8814_config_init.patch

diff --git a/queue-6.17/isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch b/queue-6.17/isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch
new file mode 100644 (file)
index 0000000..381a3a1
--- /dev/null
+++ b/queue-6.17/isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch
@@ -0,0 +1,75 @@
+From 3f978e3f1570155a1327ffa25f60968bc7b9398f Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 30 Oct 2025 09:55:22 +0530
+Subject: isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 3f978e3f1570155a1327ffa25f60968bc7b9398f upstream.
+
+In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when
+setup_instance() fails with an error code. Fix that by freeing the urb
+before freeing the hw structure. Also change the error paths to use the
+goto ladder style.
+
+Compile tested only. Issue found using a prototype static analysis tool.
+
+Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver")
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/isdn/hardware/mISDN/hfcsusb.c |   18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1904,13 +1904,13 @@ out:
+       mISDN_freebchannel(&hw->bch[1]);
+       mISDN_freebchannel(&hw->bch[0]);
+       mISDN_freedchannel(&hw->dch);
+-      kfree(hw);
+       return err;
+ }
+ 
+ static int
+ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ {
++      int err;
+       struct hfcsusb                  *hw;
+       struct usb_device               *dev = interface_to_usbdev(intf);
+       struct usb_host_interface       *iface = intf->cur_altsetting;
+@@ -2101,20 +2101,28 @@ hfcsusb_probe(struct usb_interface *intf
+       if (!hw->ctrl_urb) {
+               pr_warn("%s: No memory for control urb\n",
+                       driver_info->vend_name);
+-              kfree(hw);
+-              return -ENOMEM;
++              err = -ENOMEM;
++              goto err_free_hw;
+       }
+ 
+       pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
+               hw->name, __func__, driver_info->vend_name,
+               conf_str[small_match], ifnum, alt_used);
+ 
+-      if (setup_instance(hw, dev->dev.parent))
+-              return -EIO;
++      if (setup_instance(hw, dev->dev.parent)) {
++              err = -EIO;
++              goto err_free_urb;
++      }
+ 
+       hw->intf = intf;
+       usb_set_intfdata(hw->intf, hw);
+       return 0;
++
++err_free_urb:
++      usb_free_urb(hw->ctrl_urb);
++err_free_hw:
++      kfree(hw);
++      return err;
+ }
+ 
+ /* function called when an active device is removed */

diff --git a/queue-6.17/net-phy-micrel-fix-lan8814_config_init.patch b/queue-6.17/net-phy-micrel-fix-lan8814_config_init.patch
new file mode 100644 (file)
index 0000000..34c8de9
--- /dev/null
+++ b/queue-6.17/net-phy-micrel-fix-lan8814_config_init.patch
@@ -0,0 +1,38 @@
+From bf91f4bc9c1dfba75e457e6a5f11e3cda658729a Mon Sep 17 00:00:00 2001
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+Date: Thu, 25 Sep 2025 08:47:02 +0200
+Subject: net: phy: micrel: Fix lan8814_config_init
+
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+
+commit bf91f4bc9c1dfba75e457e6a5f11e3cda658729a upstream.
+
+The blamed commit introduced the function lanphy_modify_page_reg which
+as name suggests it, it modifies the registers. In the same commit we
+have started to use this function inside the drivers. The problem is
+that in the function lan8814_config_init we passed the wrong page number
+when disabling the aneg towards host side. We passed extended page number
+4(LAN8814_PAGE_COMMON_REGS) instead of extended page
+5(LAN8814_PAGE_PORT_REGS)
+
+Fixes: a0de636ed7a264 ("net: phy: micrel: Introduce lanphy_modify_page_reg")
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250925064702.3906950-1-horatiu.vultur@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/micrel.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -4328,7 +4328,7 @@ static int lan8814_config_init(struct ph
+       struct kszphy_priv *lan8814 = phydev->priv;
+ 
+       /* Disable ANEG with QSGMII PCS Host side */
+-      lanphy_modify_page_reg(phydev, LAN8814_PAGE_COMMON_REGS,
++      lanphy_modify_page_reg(phydev, LAN8814_PAGE_PORT_REGS,
+                              LAN8814_QSGMII_PCS1G_ANEG_CONFIG,
+                              LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA,
+                              0);

diff --git a/queue-6.17/series b/queue-6.17/series
index e4c2ca9e86342a84dfd54f3e1bc82c77f666ee2b..a6ed7c435988dfb550df7eae3bc0c11bcc803250 100644 (file)
--- a/queue-6.17/series
+++ b/queue-6.17/series
@@ -243,3 +243,5 @@ asoc-da7213-use-component-driver-suspend-resume.patch
 kvm-x86-rename-local-ecx-variables-to-msr-and-pmc-as-appropriate.patch
 kvm-x86-add-support-for-rdmsr-wrmsrns-w-immediate-on-intel.patch
 kvm-vmx-inject-ud-if-guest-tries-to-execute-seamcall-or-tdcall.patch
+isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch
+net-phy-micrel-fix-lan8814_config_init.patch