5.4-stable patches

added patches:
	calipso-unlock-rcu-before-returning-eafnosupport.patch
	net-usb-aqc111-debug-info-before-sanitation.patch

diff --git a/queue-5.4/calipso-unlock-rcu-before-returning-eafnosupport.patch b/queue-5.4/calipso-unlock-rcu-before-returning-eafnosupport.patch
new file mode 100644 (file)
index 0000000..928546c
--- /dev/null
+++ b/queue-5.4/calipso-unlock-rcu-before-returning-eafnosupport.patch
@@ -0,0 +1,41 @@
+From 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 4 Jun 2025 13:38:26 +0000
+Subject: calipso: unlock rcu before returning -EAFNOSUPPORT
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad upstream.
+
+syzbot reported that a recent patch forgot to unlock rcu
+in the error path.
+
+Adopt the convention that netlbl_conn_setattr() is already using.
+
+Fixes: 6e9f2df1c550 ("calipso: Don't call calipso functions for AF_INET sk.")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Kuniyuki Iwashima <kuniyu@amazon.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Link: https://patch.msgid.link/20250604133826.1667664-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlabel/netlabel_kapi.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -1140,8 +1140,10 @@ int netlbl_conn_setattr(struct sock *sk,
+               break;
+ #if IS_ENABLED(CONFIG_IPV6)
+       case AF_INET6:
+-              if (sk->sk_family != AF_INET6)
+-                      return -EAFNOSUPPORT;
++              if (sk->sk_family != AF_INET6) {
++                      ret_val = -EAFNOSUPPORT;
++                      goto conn_setattr_return;
++              }
+ 
+               addr6 = (struct sockaddr_in6 *)addr;
+               entry = netlbl_domhsh_getentry_af6(secattr->domain,

diff --git a/queue-5.4/net-usb-aqc111-debug-info-before-sanitation.patch b/queue-5.4/net-usb-aqc111-debug-info-before-sanitation.patch
new file mode 100644 (file)
index 0000000..e91febb
--- /dev/null
+++ b/queue-5.4/net-usb-aqc111-debug-info-before-sanitation.patch
@@ -0,0 +1,51 @@
+From d3faab9b5a6a0477d69c38bd11c43aa5e936f929 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 28 May 2025 13:03:54 +0200
+Subject: net: usb: aqc111: debug info before sanitation
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit d3faab9b5a6a0477d69c38bd11c43aa5e936f929 upstream.
+
+If we sanitize error returns, the debug statements need
+to come before that so that we don't lose information.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: 405b0d610745 ("net: usb: aqc111: fix error handling of usbnet read calls")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/aqc111.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/usb/aqc111.c
++++ b/drivers/net/usb/aqc111.c
+@@ -31,11 +31,11 @@ static int aqc111_read_cmd_nopm(struct u
+                                  USB_RECIP_DEVICE, value, index, data, size);
+ 
+       if (unlikely(ret < size)) {
+-              ret = ret < 0 ? ret : -ENODATA;
+-
+               netdev_warn(dev->net,
+                           "Failed to read(0x%x) reg index 0x%04x: %d\n",
+                           cmd, index, ret);
++
++              ret = ret < 0 ? ret : -ENODATA;
+       }
+ 
+       return ret;
+@@ -50,11 +50,11 @@ static int aqc111_read_cmd(struct usbnet
+                             USB_RECIP_DEVICE, value, index, data, size);
+ 
+       if (unlikely(ret < size)) {
+-              ret = ret < 0 ? ret : -ENODATA;
+-
+               netdev_warn(dev->net,
+                           "Failed to read(0x%x) reg index 0x%04x: %d\n",
+                           cmd, index, ret);
++
++              ret = ret < 0 ? ret : -ENODATA;
+       }
+ 
+       return ret;

diff --git a/queue-5.4/series b/queue-5.4/series
index ea7fac27f02ae4d71b11b4def01b9413c5d317c1..d5b1760f1b7d3ce93f79d4a5314b78bdd20f049f 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -97,3 +97,5 @@ net-mdiobus-fix-potential-out-of-bounds-read-write-a.patch
 fs-filesystems-fix-potential-unsigned-integer-underf.patch
 usb-flush-altsetting-0-endpoints-before-reinitializating-them-after-reset.patch
 xen-arm-call-uaccess_ttbr0_enable-for-dm_op-hypercall.patch
+calipso-unlock-rcu-before-returning-eafnosupport.patch
+net-usb-aqc111-debug-info-before-sanitation.patch