--- /dev/null
+From 69ee44e1a23be62318189dc4b37fa4ad94053269 Mon Sep 17 00:00:00 2001
+From: Baul Lee <baul.lee@xbow.com>
+Date: Wed, 5 Aug 2026 10:34:41 +0900
+Subject: ALSA: usb-audio: fix OOB write on Type II inbound URBs
+
+From: Baul Lee <baul.lee@xbow.com>
+
+commit 69ee44e1a23be62318189dc4b37fa4ad94053269 upstream.
+
+data_ep_set_params() sizes each URB transfer buffer before it adds the
+Format Type II transfer delimiter:
+
+ u->packets = urb_packs;
+ u->buffer_size = maxsize * u->packets;
+
+ if (fmt->fmt_type == UAC_FORMAT_TYPE_II)
+ u->packets++; /* for transfer delimiter */
+ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);
+
+buffer_size is computed from the pre-increment packet count and never
+recomputed, so for a Type II endpoint the buffer is one packet short of
+the packet count the URB is built with.
+
+prepare_inbound_urb() then lays out one iso frame per packet and never
+consults buffer_size:
+
+ offs = 0;
+ for (i = 0; i < urb_ctx->packets; i++) {
+ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = ep->curpacksize;
+ offs += ep->curpacksize;
+ }
+
+ urb->transfer_buffer_length = offs;
+ urb->number_of_packets = urb_ctx->packets;
+
+The last descriptor therefore points one packet past the end of the
+transfer buffer, where the host controller writes device data on every
+inbound transfer. prepare_silent_urb() and prepare_playback_urb() bound
+their fill loops by ctx->buffer_size, so only capture is affected.
+
+fmt_type comes from the device's audio streaming descriptors, so any
+device advertising a Type II capture format hits this once userspace sets
+hw_params on the stream.
+
+KASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report
+per inbound transfer:
+
+ BUG: KASAN: slab-out-of-bounds in dummy_timer
+ Write of size 64 at addr ffff0000186171c0 by task cons02/166
+ __asan_memcpy
+ dummy_timer
+ hrtimer_run_softirq
+ Allocated by task 166:
+ usb_alloc_coherent
+ snd_usb_endpoint_set_params
+ The buggy address is located 0 bytes to the right of
+ allocated 64-byte region [ffff000018617180, ffff0000186171c0)
+
+Compute buffer_size after the delimiter packet has been accounted for,
+and bound the fill loop by buffer_size, as prepare_silent_urb() already
+does on the outbound side. This grows every Type II URB allocation by
+one maxsize packet.
+
+Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
+
+Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model")
+Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
+Reported-by: Baul Lee <baul.lee@xbow.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Baul Lee <baul.lee@xbow.com>
+Link: https://patch.msgid.link/20260805013441.38245-1-baul.lee@xbow.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -388,13 +388,15 @@ static int prepare_inbound_urb(struct sn
+ case SND_USB_ENDPOINT_TYPE_DATA:
+ offs = 0;
+ for (i = 0; i < urb_ctx->packets; i++) {
++ if (offs + ep->curpacksize > urb_ctx->buffer_size)
++ break;
+ urb->iso_frame_desc[i].offset = offs;
+ urb->iso_frame_desc[i].length = ep->curpacksize;
+ offs += ep->curpacksize;
+ }
+
+ urb->transfer_buffer_length = offs;
+- urb->number_of_packets = urb_ctx->packets;
++ urb->number_of_packets = i;
+ break;
+
+ case SND_USB_ENDPOINT_TYPE_SYNC:
+@@ -1263,10 +1265,10 @@ static int data_ep_set_params(struct snd
+ u->index = i;
+ u->ep = ep;
+ u->packets = urb_packs;
+- u->buffer_size = maxsize * u->packets;
+
+ if (fmt->fmt_type == UAC_FORMAT_TYPE_II)
+ u->packets++; /* for transfer delimiter */
++ u->buffer_size = maxsize * u->packets;
+ u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);
+ if (!u->urb)
+ goto out_of_memory;
--- /dev/null
+From 3abd29c61d2ef37c4102cf755b18be53bb9dbea6 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 3 Aug 2026 18:41:49 -0700
+Subject: Input: evdev - sanitize event type index when fetching event masks
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 3abd29c61d2ef37c4102cf755b18be53bb9dbea6 upstream.
+
+The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
+ioctls is used to index the static counts array in evdev_get_mask_cnt()
+and client evmasks array in evdev_get_mask().
+
+While the event type is architecturally bounded by EV_CNT, speculative
+execution may mispredict bounds checks and perform out-of-bounds loads.
+
+Sanitize the event type index in evdev_get_mask_cnt() branchlessly using
+array_index_mask_nospec(). This clamps the index to 0 for safe array
+access and forces the returned count to 0 speculatively when the index
+is out of bounds.
+
+We do not need additional array_index_nospec() calls in evdev_get_mask()
+because evdev_get_mask_cnt() speculatively forces the count (and
+resulting xfer_size) to 0 for out-of-bounds types, preventing any
+speculative memory access to client evmasks array.
+
+Reported-by: "Wagenaar, C.C.J. (Chris)" <c.c.j.wagenaar@vu.nl>
+Cc: stable@vger.kernel.org
+Assisted-by: Antigravity:gemini-3.6-flash
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/anFCAfvxwXB5eJF1@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/evdev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -21,6 +21,7 @@
+ #include <linux/init.h>
+ #include <linux/input/mt.h>
+ #include <linux/major.h>
++#include <linux/nospec.h>
+ #include <linux/device.h>
+ #include <linux/cdev.h>
+ #include "input-compat.h"
+@@ -67,8 +68,10 @@ static size_t evdev_get_mask_cnt(unsigne
+ [EV_SND] = SND_CNT,
+ [EV_FF] = FF_CNT,
+ };
++ unsigned long mask = array_index_mask_nospec(type, EV_CNT);
+
+- return (type < EV_CNT) ? counts[type] : 0;
++ /* Returns 0 for out-of-bounds types, including speculatively */
++ return counts[type & mask] & mask;
+ }
+
+ /* requires the buffer lock to be held */
--- /dev/null
+From 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 Mon Sep 17 00:00:00 2001
+From: Yi Cong <yicong@kylinos.cn>
+Date: Wed, 29 Jul 2026 11:04:36 +0800
+Subject: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yi Cong <yicong@kylinos.cn>
+
+commit 1f428e30947395d9b9aacee03e25a4e6cfcad7a4 upstream.
+
+When the interface has NETIF_F_SG enabled and skb_linearize() fails in
+ax88179_tx_fixup(), the function returns NULL without freeing the skb.
+
+usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop
+(info->flags does not set FLAG_MULTI_PACKET for this driver), jumping
+to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`.
+Because tx_fixup() returned NULL, the local skb variable in
+usbnet_start_xmit() is NULL, so the original skb is never freed — a
+memory leak on every TX frame whose linearization fails (i.e. under
+memory pressure).
+
+Free the skb before returning, matching the error handling already used
+for the pskb_expand_head() failure path in the same function.
+
+Fixes: 16b1c4e01c89 ("net: usb: ax88179_178a: add TSO feature")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yi Cong <yicong@kylinos.cn>
+Link: https://patch.msgid.link/20260729030436.3420477-1-cong.yi@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/ax88179_178a.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1493,8 +1493,10 @@ ax88179_tx_fixup(struct usbnet *dev, str
+
+ headroom = skb_headroom(skb) - 8;
+
+- if ((dev->net->features & NETIF_F_SG) && skb_linearize(skb))
++ if ((dev->net->features & NETIF_F_SG) && skb_linearize(skb)) {
++ dev_kfree_skb_any(skb);
+ return NULL;
++ }
+
+ if ((skb_header_cloned(skb) || headroom < 0) &&
+ pskb_expand_head(skb, headroom < 0 ? 8 : 0, 0, GFP_ATOMIC)) {
--- /dev/null
+From fde39b8a521780391fb4e5bda2c0aa4928947f12 Mon Sep 17 00:00:00 2001
+From: Doruk Tan Ozturk <doruk@0sec.ai>
+Date: Sun, 2 Aug 2026 14:06:02 +0200
+Subject: net: usb: ipheth: fix carrier_work UAF on disconnect
+
+From: Doruk Tan Ozturk <doruk@0sec.ai>
+
+commit fde39b8a521780391fb4e5bda2c0aa4928947f12 upstream.
+
+ipheth_sndbulk_callback() re-arms the carrier-check work on any
+non-zero URB status:
+
+ else
+ schedule_delayed_work(&dev->carrier_work, 0);
+
+Nothing ties that to the interface being up, so the work can be armed
+again after ipheth_close() has already drained it, and stay armed
+until the netdev whose private area embeds it is freed.
+
+On unplug with a TX URB in flight, ipheth_disconnect() drains the work
+through unregister_netdev() -> ipheth_close() ->
+cancel_delayed_work_sync() and only then calls ipheth_kill_urbs().
+usb_kill_urb() completes the in-flight TX URB with -ENOENT, so
+ipheth_sndbulk_callback() runs after the drain and re-arms
+carrier_work.
+
+The same completion also re-arms the work if the interface is only
+brought down while a TX URB is in flight, and
+ipheth_carrier_check_work() then keeps re-queueing itself once a
+second. unregister_netdev() does not call ipheth_close() for an
+already-down interface, so nothing drains it on the later unplug
+either.
+
+In both cases free_netdev() frees the netdev while carrier_work is
+still pending, and ipheth_carrier_check_work() dereferences freed
+memory.
+
+Tie the work to the interface state instead of chasing the completion:
+disable it in ipheth_close() and enable it in ipheth_open(), so a
+schedule_delayed_work() from the URB completion is a no-op whenever
+the interface is not up. disable_delayed_work_sync() also waits for a
+running instance, so it fully replaces the cancel_delayed_work_sync()
+it takes the place of. The work starts out disabled in ipheth_probe()
+so the enable/disable counts balance from the first open.
+
+Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and
+raw-gadget standing in for the device, driving the second path above (the
+interface is already down, so unregister_netdev() does not call
+ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in
+__run_timers(), freed by ipheth_disconnect() and re-armed from
+ipheth_sndbulk_callback() via queue_delayed_work_on(). The
+same trigger on a kernel differing only by this patch reports 0 of 15,
+and the carrier check still functions across open/close cycles.
+
+The reproducer needs an attached USB device that stops draining bulk OUT,
+plus a link down and unplug, driven as root. It is not a privilege
+boundary crossing and no exploit primitive was developed.
+
+Found by 0sec (https://0sec.ai).
+
+Fixes: bb1b40c7cb86 ("usbnet: ipheth: prevent TX queue timeouts when device not ready")
+Cc: stable@vger.kernel.org
+Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
+Link: https://patch.msgid.link/20260802120602.42595-1-doruk@0sec.ai
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/ipheth.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -490,6 +490,7 @@ static int ipheth_open(struct net_device
+ if (retval)
+ return retval;
+
++ enable_delayed_work(&dev->carrier_work);
+ schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+ return retval;
+ }
+@@ -499,7 +500,11 @@ static int ipheth_close(struct net_devic
+ struct ipheth_device *dev = netdev_priv(net);
+
+ netif_stop_queue(net);
+- cancel_delayed_work_sync(&dev->carrier_work);
++ /* A TX URB can still complete with an error after this point and
++ * try to re-arm the carrier work. Disable it instead of cancelling
++ * it, so that such a schedule_delayed_work() is a no-op.
++ */
++ disable_delayed_work_sync(&dev->carrier_work);
+ return 0;
+ }
+
+@@ -633,6 +638,10 @@ static int ipheth_probe(struct usb_inter
+ }
+
+ INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
++ /* Armed only between ipheth_open() and ipheth_close(). Start out
++ * disabled so the enable/disable counts balance from the first open.
++ */
++ disable_delayed_work(&dev->carrier_work);
+
+ retval = ipheth_alloc_urbs(dev);
+ if (retval) {
mtd-spinand-try-a-regular-dirmap-if-creating-a-dirma.patch
mtd-spinand-repeat-reading-in-regular-mode-if-contin.patch
swapfile-call-cond_resched-before-locking-si-lock.patch
+input-evdev-sanitize-event-type-index-when-fetching-event-masks.patch
+alsa-usb-audio-fix-oob-write-on-type-ii-inbound-urbs.patch
+usb-atm-cxacru-properly-kill-rcv_urb-on-error-in-cxacru_cm.patch
+thunderbolt-icm-preserve-usb4-proxy-data-valid-bit.patch
+usb-cdnsp-fix-incorrect-endian-conversions-for-apb-timeout-register.patch
+usb-gadget-f_ncm-use-unsigned-int-for-ndp_index.patch
+net-usb-ax88179_178a-fix-skb-leak-in-ax88179_tx_fixup.patch
+net-usb-ipheth-fix-carrier_work-uaf-on-disconnect.patch
+vt-add-permission-check-for-kdskbmeta-ioctl.patch
+vt-stabilize-tty-reference-in-kbd_keycode-with-tty_port_tty_get.patch
--- /dev/null
+From e48844ece5e3ed1d1eb865f6da2b16f62cd9f86d Mon Sep 17 00:00:00 2001
+From: Xu Rao <raoxu@uniontech.com>
+Date: Mon, 13 Jul 2026 17:32:37 +0800
+Subject: thunderbolt: icm: Preserve USB4 proxy data-valid bit
+
+From: Xu Rao <raoxu@uniontech.com>
+
+commit e48844ece5e3ed1d1eb865f6da2b16f62cd9f86d upstream.
+
+The ICM USB4 switch operation request encodes two values in
+request.data_len_valid: bit 4 marks the data payload valid, while bits
+3:0 hold the payload length in dwords. A zero length with the valid bit
+set represents the full 16-dword data array.
+
+icm_usb4_switch_op() sets the valid bit when a transmit payload is
+present. For payloads shorter than the full 16 dwords, it then assigns
+the length to the whole field and clears the valid bit that was just set.
+The payload is still copied into the request, but the descriptor sent to
+firmware marks that data as invalid.
+
+This affects USB4 router operations that send short payloads through the
+firmware connection manager. In particular, USB4 NVM writes can send a
+short final block when the image size is not aligned to the 64-byte proxy
+payload size. Firmware may then ignore or reject that final block, while
+full 16-dword blocks are unaffected because they are encoded as length 0
+with the valid bit set.
+
+OR the short payload length into data_len_valid so the valid bit is
+preserved.
+
+Fixes: 9039387e166e ("thunderbolt: Add USB4 router operation proxy for firmware connection manager")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/icm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thunderbolt/icm.c
++++ b/drivers/thunderbolt/icm.c
+@@ -2291,7 +2291,7 @@ static int icm_usb4_switch_op(struct tb_
+ if (tx_data_len) {
+ request.data_len_valid |= ICM_USB4_SWITCH_DATA_VALID;
+ if (tx_data_len < ARRAY_SIZE(request.data))
+- request.data_len_valid =
++ request.data_len_valid |=
+ tx_data_len & ICM_USB4_SWITCH_DATA_LEN_MASK;
+ memcpy(request.data, tx_data, tx_data_len * sizeof(u32));
+ }
--- /dev/null
+From c2f811314be351d86b6ab41e9297ae80d8da6f86 Mon Sep 17 00:00:00 2001
+From: Aleksandr Nogikh <nogikh@google.com>
+Date: Fri, 31 Jul 2026 10:15:20 +0000
+Subject: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
+
+From: Aleksandr Nogikh <nogikh@google.com>
+
+commit c2f811314be351d86b6ab41e9297ae80d8da6f86 upstream.
+
+If cxacru_cm() encounters an error while submitting or waiting for snd_urb,
+it aborts and returns the error without killing the already submitted
+rcv_urb. This leaves the rcv_urb active.
+
+When this happens during initialization (e.g., in cxacru_atm_start()), the
+driver may ignore the error and proceed to call cxacru_poll_status(), which
+invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb
+triggers a warning in usb_submit_urb():
+
+cxacru 1-1:1.0: send of cm 0x84 failed (-104)
+ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104
+------------[ cut here ]------------
+URB ffff88812658d200 submitted while active
+WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0
+drivers/usb/core/urb.c:379
+...
+Call Trace:
+ <TASK>
+ cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631
+ cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline]
+ cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828
+ cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814
+ usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927
+ usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178
+ cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370
+...
+
+To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts
+early. We can safely call usb_kill_urb() on rcv_urb in the error path, as
+it is safe to call even if the URB is not active (e.g., if it failed to
+submit in the first place, or if it already completed).
+
+Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru")
+Cc: stable <stable@kernel.org>
+Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
+Reported-by: syzbot+c9dff578c3a41775176a@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=c9dff578c3a41775176a
+Link: https://syzkaller.appspot.com/ai_job?id=75fec6f2-c8a6-43b1-b184-4d26baba86cc
+Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
+Link: https://patch.msgid.link/91edfa4c-a63d-400c-9f00-31f3e1f98c00@mail.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/atm/cxacru.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/atm/cxacru.c
++++ b/drivers/usb/atm/cxacru.c
+@@ -700,6 +700,8 @@ static int cxacru_cm(struct cxacru_data
+ ret = offd;
+ usb_dbg(instance->usbatm, "cm %#x\n", cm);
+ fail:
++ if (ret < 0)
++ usb_kill_urb(instance->rcv_urb);
+ mutex_unlock(&instance->cm_serialize);
+ err:
+ return ret;
--- /dev/null
+From 50b303f3d0f7de543ee90d50879970783d06da33 Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Mon, 20 Jul 2026 13:11:58 +0200
+Subject: usb: cdnsp: fix incorrect endian conversions for APB timeout register
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit 50b303f3d0f7de543ee90d50879970783d06da33 upstream.
+
+readl() already returns a CPU-endian value. Passing its return value to
+le32_to_cpu() is therefore redundant and causes an incorrect double byte
+swap on big-endian systems.
+
+Similarly, writel() expects a CPU-endian value, so passing the result of
+cpu_to_le32() is incorrect.
+
+Remove the unnecessary conversions and operate on the MMIO register value
+as a CPU-endian u32.
+
+Fixes: 241e2ce88e5a ("usb: cdnsp: Fix issue with resuming from L1")
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20260720-endian-fix-v1-v1-1-b5681fa1ea9f@cadence.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -154,9 +154,9 @@ static void cdnsp_set_apb_timeout_value(
+ offset = cdnsp_find_next_ext_cap(base, offset, D_XEC_PRE_REGS_CAP);
+ reg = base + offset + REG_CHICKEN_BITS_3_OFFSET;
+
+- val = le32_to_cpu(readl(reg));
++ val = readl(reg);
+ val = CHICKEN_APB_TIMEOUT_SET(val, cdns->override_apb_timeout);
+- writel(cpu_to_le32(val), reg);
++ writel(val, reg);
+ }
+
+ static void cdnsp_set_chicken_bits_2(struct cdnsp_device *pdev, u32 bit)
--- /dev/null
+From 6b1c8a9403a26cb0fed7a648916c74dc236da591 Mon Sep 17 00:00:00 2001
+From: Sonali Pradhan <sonalipradhan@google.com>
+Date: Mon, 20 Jul 2026 16:56:54 +0000
+Subject: usb: gadget: f_ncm: Use unsigned int for ndp_index
+
+From: Sonali Pradhan <sonalipradhan@google.com>
+
+commit 6b1c8a9403a26cb0fed7a648916c74dc236da591 upstream.
+
+The variable ndp_index is declared as a signed integer, but it stores
+the return value of get_ncm(), which is unsigned.
+
+A malicious host can supply a large offset that overflows the signed
+ndp_index, making it negative. Because ndp_index is compared against
+unsigned bounds, this negative value bypasses sanity checks and leads
+to an out-of-bounds read when calculating the address of the NDP
+block (ntb_ptr + ndp_index).
+
+Fix this by changing ndp_index to unsigned int to ensure consistent
+unsigned comparisons throughout the function.
+
+Fixes: 370af734dfaf ("usb: gadget: NCM: RX function support multiple NDPs")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
+Link: https://patch.msgid.link/20260720165654.2224591-1-sonalipradhan@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1171,7 +1171,7 @@ static int ncm_unwrap_ntb(struct gether
+ unsigned char *ntb_ptr = skb->data;
+ __le16 *tmp;
+ unsigned index, index2;
+- int ndp_index;
++ unsigned int ndp_index;
+ unsigned dg_len, dg_len2;
+ unsigned ndp_len;
+ unsigned block_len;
--- /dev/null
+From a7ad0034453ba4c353f9b8f810ee2569de33d283 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <linux@joshua.hu>
+Date: Fri, 31 Jul 2026 09:56:17 +0200
+Subject: vt: add permission check for KDSKBMETA ioctl
+
+From: Joshua Rogers <linux@joshua.hu>
+
+commit a7ad0034453ba4c353f9b8f810ee2569de33d283 upstream.
+
+KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all
+other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process
+to change meta mode on a non-controlling console without authorization.
+
+Assisted-by: AISLE:Snapshot
+Cc: stable <stable@kernel.org>
+Signed-off-by: Joshua Rogers <linux@joshua.hu>
+Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-2-be99b9da8e30@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/vt_ioctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -408,6 +408,8 @@ static int vt_k_ioctl(struct tty_struct
+ /* this could be folded into KDSKBMODE, but for compatibility
+ reasons it is not so easy to fold KDGKBMETA into KDGKBMODE */
+ case KDSKBMETA:
++ if (!perm)
++ return -EPERM;
+ return vt_do_kdskbmeta(console, arg);
+
+ case KDGKBMETA:
--- /dev/null
+From e25d47a526939ad44b75f778b8a7500562b84fc1 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <linux@joshua.hu>
+Date: Fri, 31 Jul 2026 09:56:16 +0200
+Subject: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
+
+From: Joshua Rogers <linux@joshua.hu>
+
+commit e25d47a526939ad44b75f778b8a7500562b84fc1 upstream.
+
+kbd_keycode() reads vc->port.tty without acquiring a tty reference,
+racing against con_shutdown() which clears port.tty under a different
+lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference
+for the duration the tty pointer is needed.
+
+Assisted-by: AISLE:Snapshot
+Signed-off-by: Joshua Rogers <linux@joshua.hu>
+Cc: stable <stable@kernel.org>
+Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-1-be99b9da8e30@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/keyboard.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -1403,7 +1403,7 @@ static void kbd_keycode(unsigned int key
+ struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
+ int rc;
+
+- tty = vc->port.tty;
++ tty = tty_port_tty_get(&vc->port);
+
+ if (tty && (!tty->driver_data)) {
+ /* No driver data? Strange. Okay we fix it then. */
+@@ -1463,9 +1463,12 @@ static void kbd_keycode(unsigned int key
+ * characters get aren't echoed locally. This makes key repeat
+ * usable with slow applications and under heavy loads.
+ */
++ tty_kref_put(tty);
+ return;
+ }
+
++ tty_kref_put(tty);
++
+ param.shift = shift_final = (shift_state | kbd->slockstate) ^ kbd->lockstate;
+ param.ledstate = kbd->ledflagstate;
+ key_map = key_maps[shift_final];
projects / thirdparty / kernel / stable-queue.git / commitdiff
