From: Greg Kroah-Hartman Date: Mon, 13 Jul 2026 13:11:55 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2cb8ee98220f09d7b3fdab20467b7df3f0c7c9d7;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: binder-fix-uaf-in-binder_thread_release.patch bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch bluetooth-btusb-fix-use-after-free-on-registration-failure.patch --- diff --git a/queue-5.10/binder-fix-uaf-in-binder_thread_release.patch b/queue-5.10/binder-fix-uaf-in-binder_thread_release.patch new file mode 100644 index 0000000000..520cd84e08 --- /dev/null +++ b/queue-5.10/binder-fix-uaf-in-binder_thread_release.patch @@ -0,0 +1,79 @@ +From 114a116aaa5f0295376cdf12da743c5bce3b20ce Mon Sep 17 00:00:00 2001 +From: Carlos Llamas +Date: Fri, 19 Jun 2026 18:52:30 +0000 +Subject: binder: fix UAF in binder_thread_release() + +From: Carlos Llamas + +commit 114a116aaa5f0295376cdf12da743c5bce3b20ce upstream. + +When a thread exits, binder_thread_release() walks its transaction stack +to clear the t->from and t->to_proc that correspond with the exiting +thread. However, a process dying in parallel might attempt to kfree some +of these transactions. And if one of them has no associated t->to_proc, +the t->to_proc->inner_lock will not be acquired. + +This means that transaction accesses in binder_thread_release() after +t->to_proc has been cleared might race with binder_free_transaction() +and cause a use-after-free error as reported by KASAN: + + ================================================================== + BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798 + Write of size 8 at addr ffff000016627500 by task X/715 + + CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT + Hardware name: linux,dummy-virt (DT) + Call trace: + binder_thread_release+0x5d0/0x798 + binder_ioctl+0x12c0/0x299c + [...] + + Allocated by task 717 on cpu 18 at 67.267803s: + __kasan_kmalloc+0xa0/0xbc + __kmalloc_cache_noprof+0x174/0x444 + binder_transaction+0x554/0x8150 + binder_thread_write+0xa30/0x4354 + binder_ioctl+0x20f0/0x299c + [...] + + Freed by task 202 on cpu 18 at 90.416221s: + __kasan_slab_free+0x58/0x80 + kfree+0x1a0/0x4a4 + binder_free_transaction+0x150/0x294 + binder_send_failed_reply+0x398/0x6d8 + binder_release_work+0x3e4/0x4ec + binder_deferred_func+0xbd8/0x104c + [...] + ================================================================== + +In order to avoid this, make sure that binder_free_transaction() reads +the t->to_proc under the transaction lock. This will serialize the +transaction release with the accesses in binder_thread_release(). Plus, +it matches the documented locking rules for @to_proc. + +Cc: stable +Fixes: 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe") +Reviewed-by: Alice Ryhl +Signed-off-by: Carlos Llamas +Link: https://patch.msgid.link/20260619185233.2194678-1-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -1909,7 +1909,11 @@ static void binder_free_txn_fixups(struc + + static void binder_free_transaction(struct binder_transaction *t) + { +- struct binder_proc *target_proc = t->to_proc; ++ struct binder_proc *target_proc; ++ ++ spin_lock(&t->lock); ++ target_proc = t->to_proc; ++ spin_unlock(&t->lock); + + if (target_proc) { + binder_inner_proc_lock(target_proc); diff --git a/queue-5.10/bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch b/queue-5.10/bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch new file mode 100644 index 0000000000..04d92e4e99 --- /dev/null +++ b/queue-5.10/bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch @@ -0,0 +1,77 @@ +From 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 Mon Sep 17 00:00:00 2001 +From: Zenm Chen +Date: Tue, 26 May 2026 00:19:42 +0800 +Subject: Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB + +From: Zenm Chen + +commit 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 upstream. + +Add USB ID 2c4e:0128 for Mercusys MA60XNB, an RTL8851BU-based +Wi-Fi + Bluetooth adapter. + +The information in /sys/kernel/debug/usb/devices about the Bluetooth +device is listed as the below: + +T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c4e ProdID=0128 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=802.11ax WLAN Adapter +S: SerialNumber=00e04c000001 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org # 6.6.x +Signed-off-by: Zenm Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -436,6 +436,8 @@ static const struct usb_device_id blackl + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x2c4e, 0x0128), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Realtek Bluetooth devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), diff --git a/queue-5.10/bluetooth-btusb-fix-use-after-free-on-registration-failure.patch b/queue-5.10/bluetooth-btusb-fix-use-after-free-on-registration-failure.patch new file mode 100644 index 0000000000..fdd079382a --- /dev/null +++ b/queue-5.10/bluetooth-btusb-fix-use-after-free-on-registration-failure.patch @@ -0,0 +1,53 @@ +From eedc6867ebad73edbfaf9a0a65fbef7115cc4753 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 4 Jun 2026 08:37:36 +0200 +Subject: Bluetooth: btusb: fix use-after-free on registration failure + +From: Johan Hovold + +commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 upstream. + +Make sure to release the sibling interfaces in case controller +registration fails to avoid use-after-free and double-free when they are +eventually disconnected. + +This issue was reported by Sashiko while reviewing a fix for a wakeup +source leak in the btusb probe errors paths. + +Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org +Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver") +Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface") +Cc: stable@vger.kernel.org # 2.6.27 +Reviewed-by: Paul Menzel +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -4371,12 +4371,21 @@ static int btusb_probe(struct usb_interf + + err = hci_register_dev(hdev); + if (err < 0) +- goto out_free_dev; ++ goto err_release_siblings; + + usb_set_intfdata(intf, data); + + return 0; + ++err_release_siblings: ++ if (data->diag) { ++ usb_set_intfdata(data->diag, NULL); ++ usb_driver_release_interface(&btusb_driver, data->diag); ++ } ++ if (data->isoc) { ++ usb_set_intfdata(data->isoc, NULL); ++ usb_driver_release_interface(&btusb_driver, data->isoc); ++ } + out_free_dev: + if (data->reset_gpio) + gpiod_put(data->reset_gpio); diff --git a/queue-5.10/series b/queue-5.10/series index 1d785ee050..7621daaac5 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -57,3 +57,6 @@ alsa-usb-audio-propagate-us-16x08-write-errors-in-route-mix-eq-switch-put-callba alsa-usb-audio-roll-back-quirk-control-caches-on-write-errors.patch alsa-usb-audio-update-babyface-pro-control-caches-only-after-successful-writes.patch alsa-usb-audio-update-us-16x08-eq-comp-shadow-state-after-successful-writes.patch +bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch +bluetooth-btusb-fix-use-after-free-on-registration-failure.patch +binder-fix-uaf-in-binder_thread_release.patch