From: Greg Kroah-Hartman Date: Mon, 13 Jul 2026 13:11:56 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3ec49e3a1ccbe44c1b6e84bb219487db01f4fb94;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: binder-fix-uaf-in-binder_free_transaction.patch binder-fix-uaf-in-binder_thread_release.patch bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch bluetooth-btusb-fix-use-after-free-on-marvell-probe-failure.patch bluetooth-btusb-fix-use-after-free-on-registration-failure.patch bluetooth-btusb-fix-wakeup-source-leak-on-probe-failure.patch --- diff --git a/queue-5.15/binder-fix-uaf-in-binder_free_transaction.patch b/queue-5.15/binder-fix-uaf-in-binder_free_transaction.patch new file mode 100644 index 0000000000..c8266c9d2f --- /dev/null +++ b/queue-5.15/binder-fix-uaf-in-binder_free_transaction.patch @@ -0,0 +1,95 @@ +From f223d27a546c1e1f48d38fd67760e78f068fe8c4 Mon Sep 17 00:00:00 2001 +From: Carlos Llamas +Date: Fri, 19 Jun 2026 18:52:31 +0000 +Subject: binder: fix UAF in binder_free_transaction() + +From: Carlos Llamas + +commit f223d27a546c1e1f48d38fd67760e78f068fe8c4 upstream. + +In binder_free_transaction(), the t->to_proc is read under the t->lock. +However, once the t->lock is dropped, the to_proc can die in parallel. +This leads to a use-after-free error when we attempt to acquire its +inner lock right afterwards: + + ================================================================== + BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 + Write of size 4 at addr ffff00001125da70 by task B/672 + + CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT + Hardware name: linux,dummy-virt (DT) + Call trace: + _raw_spin_lock+0xe4/0x1a0 + binder_free_transaction+0x8c/0x320 + binder_send_failed_reply+0x21c/0x2f8 + binder_thread_release+0x488/0x7e0 + binder_ioctl+0x12c0/0x29a0 + [...] + + Allocated by task 675: + __kmalloc_cache_noprof+0x174/0x444 + binder_open+0x118/0xb70 + do_dentry_open+0x374/0x1040 + vfs_open+0x58/0x3bc + [...] + + Freed by task 212: + __kasan_slab_free+0x58/0x80 + kfree+0x1a0/0x4a4 + binder_proc_dec_tmpref+0x32c/0x5e0 + binder_deferred_func+0xc48/0x104c + process_one_work+0x53c/0xbc0 + [...] + ================================================================== + +To prevent this, pin the target thread (t->to_thread) to guarantee the +target process remains alive. Undelivered transactions without a target +thread are already safe, as the target process can only be the current +context in those paths. + +Cc: stable +Reported-by: Alice Ryhl +Closes: https://lore.kernel.org/all/aikJKVuny_eOivwN@google.com/ +Fixes: a370003cc301 ("binder: fix possible UAF when freeing buffer") +Signed-off-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Link: https://patch.msgid.link/20260619185233.2194678-2-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -1537,10 +1537,19 @@ static void binder_txn_latency_free(stru + + static void binder_free_transaction(struct binder_transaction *t) + { ++ struct binder_thread *target_thread; + struct binder_proc *target_proc; + + spin_lock(&t->lock); + target_proc = t->to_proc; ++ target_thread = t->to_thread; ++ /* ++ * Pin target_thread to keep target_proc alive. Undelivered ++ * transactions with !target_thread are safe, as target_proc ++ * can only be the current context there. ++ */ ++ if (target_thread) ++ atomic_inc(&target_thread->tmp_ref); + spin_unlock(&t->lock); + + if (target_proc) { +@@ -1555,6 +1564,10 @@ static void binder_free_transaction(stru + t->buffer->transaction = NULL; + binder_inner_proc_unlock(target_proc); + } ++ ++ if (target_thread) ++ binder_thread_dec_tmpref(target_thread); ++ + if (trace_binder_txn_latency_free_enabled()) + binder_txn_latency_free(t); + /* diff --git a/queue-5.15/binder-fix-uaf-in-binder_thread_release.patch b/queue-5.15/binder-fix-uaf-in-binder_thread_release.patch new file mode 100644 index 0000000000..7693da40cc --- /dev/null +++ b/queue-5.15/binder-fix-uaf-in-binder_thread_release.patch @@ -0,0 +1,79 @@ +From 114a116aaa5f0295376cdf12da743c5bce3b20ce Mon Sep 17 00:00:00 2001 +From: Carlos Llamas +Date: Fri, 19 Jun 2026 18:52:30 +0000 +Subject: binder: fix UAF in binder_thread_release() + +From: Carlos Llamas + +commit 114a116aaa5f0295376cdf12da743c5bce3b20ce upstream. + +When a thread exits, binder_thread_release() walks its transaction stack +to clear the t->from and t->to_proc that correspond with the exiting +thread. However, a process dying in parallel might attempt to kfree some +of these transactions. And if one of them has no associated t->to_proc, +the t->to_proc->inner_lock will not be acquired. + +This means that transaction accesses in binder_thread_release() after +t->to_proc has been cleared might race with binder_free_transaction() +and cause a use-after-free error as reported by KASAN: + + ================================================================== + BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798 + Write of size 8 at addr ffff000016627500 by task X/715 + + CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT + Hardware name: linux,dummy-virt (DT) + Call trace: + binder_thread_release+0x5d0/0x798 + binder_ioctl+0x12c0/0x299c + [...] + + Allocated by task 717 on cpu 18 at 67.267803s: + __kasan_kmalloc+0xa0/0xbc + __kmalloc_cache_noprof+0x174/0x444 + binder_transaction+0x554/0x8150 + binder_thread_write+0xa30/0x4354 + binder_ioctl+0x20f0/0x299c + [...] + + Freed by task 202 on cpu 18 at 90.416221s: + __kasan_slab_free+0x58/0x80 + kfree+0x1a0/0x4a4 + binder_free_transaction+0x150/0x294 + binder_send_failed_reply+0x398/0x6d8 + binder_release_work+0x3e4/0x4ec + binder_deferred_func+0xbd8/0x104c + [...] + ================================================================== + +In order to avoid this, make sure that binder_free_transaction() reads +the t->to_proc under the transaction lock. This will serialize the +transaction release with the accesses in binder_thread_release(). Plus, +it matches the documented locking rules for @to_proc. + +Cc: stable +Fixes: 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe") +Reviewed-by: Alice Ryhl +Signed-off-by: Carlos Llamas +Link: https://patch.msgid.link/20260619185233.2194678-1-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -1537,7 +1537,11 @@ static void binder_txn_latency_free(stru + + static void binder_free_transaction(struct binder_transaction *t) + { +- struct binder_proc *target_proc = t->to_proc; ++ struct binder_proc *target_proc; ++ ++ spin_lock(&t->lock); ++ target_proc = t->to_proc; ++ spin_unlock(&t->lock); + + if (target_proc) { + binder_inner_proc_lock(target_proc); diff --git a/queue-5.15/bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch b/queue-5.15/bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch new file mode 100644 index 0000000000..c1dc713f12 --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch @@ -0,0 +1,77 @@ +From 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 Mon Sep 17 00:00:00 2001 +From: Zenm Chen +Date: Tue, 26 May 2026 00:19:42 +0800 +Subject: Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB + +From: Zenm Chen + +commit 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 upstream. + +Add USB ID 2c4e:0128 for Mercusys MA60XNB, an RTL8851BU-based +Wi-Fi + Bluetooth adapter. + +The information in /sys/kernel/debug/usb/devices about the Bluetooth +device is listed as the below: + +T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c4e ProdID=0128 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=802.11ax WLAN Adapter +S: SerialNumber=00e04c000001 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org # 6.6.x +Signed-off-by: Zenm Chen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -527,6 +527,8 @@ static const struct usb_device_id blackl + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x2c4e, 0x0128), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Additional Realtek 8821AE Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, diff --git a/queue-5.15/bluetooth-btusb-fix-use-after-free-on-marvell-probe-failure.patch b/queue-5.15/bluetooth-btusb-fix-use-after-free-on-marvell-probe-failure.patch new file mode 100644 index 0000000000..3a6da7c45f --- /dev/null +++ b/queue-5.15/bluetooth-btusb-fix-use-after-free-on-marvell-probe-failure.patch @@ -0,0 +1,65 @@ +From c5b600a3c05b1a7a110d558df935a8fc8a471c79 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 4 Jun 2026 08:37:37 +0200 +Subject: Bluetooth: btusb: fix use-after-free on marvell probe failure + +From: Johan Hovold + +commit c5b600a3c05b1a7a110d558df935a8fc8a471c79 upstream. + +Make sure to stop any TX URBs submitted during Marvell OOB wakeup +configuration on later probe failures to avoid use-after-free in the +completion callback. + +This issue was reported by Sashiko while reviewing a fix for a wakeup +source leak in the btusb probe errors paths. + +Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org +Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the pins for oob wakeup") +Cc: stable@vger.kernel.org # 4.11 +Cc: Rajat Jain +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3948,7 +3948,7 @@ static int btusb_probe(struct usb_interf + if (id->driver_info & BTUSB_INTEL_COMBINED) { + err = btintel_configure_setup(hdev); + if (err) +- goto out_free_dev; ++ goto err_kill_tx_urbs; + + /* Transport specific configuration */ + hdev->send = btusb_send_frame_intel; +@@ -4086,7 +4086,7 @@ static int btusb_probe(struct usb_interf + err = usb_set_interface(data->udev, 0, 0); + if (err < 0) { + BT_ERR("failed to set interface 0, alt 0 %d", err); +- goto out_free_dev; ++ goto err_kill_tx_urbs; + } + } + +@@ -4094,7 +4094,7 @@ static int btusb_probe(struct usb_interf + err = usb_driver_claim_interface(&btusb_driver, + data->isoc, data); + if (err < 0) +- goto out_free_dev; ++ goto err_kill_tx_urbs; + } + + if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) { +@@ -4125,6 +4125,8 @@ err_release_siblings: + usb_set_intfdata(data->isoc, NULL); + usb_driver_release_interface(&btusb_driver, data->isoc); + } ++err_kill_tx_urbs: ++ usb_kill_anchored_urbs(&data->tx_anchor); + out_free_dev: + if (data->reset_gpio) + gpiod_put(data->reset_gpio); diff --git a/queue-5.15/bluetooth-btusb-fix-use-after-free-on-registration-failure.patch b/queue-5.15/bluetooth-btusb-fix-use-after-free-on-registration-failure.patch new file mode 100644 index 0000000000..aa067a121c --- /dev/null +++ b/queue-5.15/bluetooth-btusb-fix-use-after-free-on-registration-failure.patch @@ -0,0 +1,53 @@ +From eedc6867ebad73edbfaf9a0a65fbef7115cc4753 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 4 Jun 2026 08:37:36 +0200 +Subject: Bluetooth: btusb: fix use-after-free on registration failure + +From: Johan Hovold + +commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 upstream. + +Make sure to release the sibling interfaces in case controller +registration fails to avoid use-after-free and double-free when they are +eventually disconnected. + +This issue was reported by Sashiko while reviewing a fix for a wakeup +source leak in the btusb probe errors paths. + +Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org +Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver") +Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface") +Cc: stable@vger.kernel.org # 2.6.27 +Reviewed-by: Paul Menzel +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -4110,12 +4110,21 @@ static int btusb_probe(struct usb_interf + + err = hci_register_dev(hdev); + if (err < 0) +- goto out_free_dev; ++ goto err_release_siblings; + + usb_set_intfdata(intf, data); + + return 0; + ++err_release_siblings: ++ if (data->diag) { ++ usb_set_intfdata(data->diag, NULL); ++ usb_driver_release_interface(&btusb_driver, data->diag); ++ } ++ if (data->isoc) { ++ usb_set_intfdata(data->isoc, NULL); ++ usb_driver_release_interface(&btusb_driver, data->isoc); ++ } + out_free_dev: + if (data->reset_gpio) + gpiod_put(data->reset_gpio); diff --git a/queue-5.15/bluetooth-btusb-fix-wakeup-source-leak-on-probe-failure.patch b/queue-5.15/bluetooth-btusb-fix-wakeup-source-leak-on-probe-failure.patch new file mode 100644 index 0000000000..da26e8732f --- /dev/null +++ b/queue-5.15/bluetooth-btusb-fix-wakeup-source-leak-on-probe-failure.patch @@ -0,0 +1,78 @@ +From 3d93e1bb0fb881fe3ef961d1120556658e9cac4d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 4 Jun 2026 08:37:38 +0200 +Subject: Bluetooth: btusb: fix wakeup source leak on probe failure + +From: Johan Hovold + +commit 3d93e1bb0fb881fe3ef961d1120556658e9cac4d upstream. + +Make sure to disable wakeup on probe failure to avoid leaking the wakeup +source. + +Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") +Cc: stable@vger.kernel.org # 4.11 +Cc: Rajat Jain +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3198,6 +3198,11 @@ static int marvell_config_oob_wake(struc + + return 0; + } ++#else ++static inline int marvell_config_oob_wake(struct hci_dev *hdev) ++{ ++ return 0; ++} + #endif + + static int btusb_set_bdaddr_marvell(struct hci_dev *hdev, +@@ -3727,6 +3732,11 @@ static int btusb_config_oob_wake(struct + bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); + return 0; + } ++#else ++static inline int btusb_config_oob_wake(struct hci_dev *hdev) ++{ ++ return 0; ++} + #endif + + static void btusb_check_needs_reset_resume(struct usb_interface *intf) +@@ -3902,7 +3912,6 @@ static int btusb_probe(struct usb_interf + hdev->notify = btusb_notify; + hdev->prevent_wake = btusb_prevent_wake; + +-#ifdef CONFIG_PM + err = btusb_config_oob_wake(hdev); + if (err) + goto out_free_dev; +@@ -3911,9 +3920,9 @@ static int btusb_probe(struct usb_interf + if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { + err = marvell_config_oob_wake(hdev); + if (err) +- goto out_free_dev; ++ goto err_disable_wakeup; + } +-#endif ++ + if (id->driver_info & BTUSB_CW6622) + set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); + +@@ -4127,6 +4136,9 @@ err_release_siblings: + } + err_kill_tx_urbs: + usb_kill_anchored_urbs(&data->tx_anchor); ++err_disable_wakeup: ++ if (data->oob_wake_irq) ++ device_init_wakeup(&data->udev->dev, false); + out_free_dev: + if (data->reset_gpio) + gpiod_put(data->reset_gpio); diff --git a/queue-5.15/series b/queue-5.15/series index 2f6abd4061..cffff76c3b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -73,3 +73,9 @@ alsa-usb-audio-propagate-us-16x08-write-errors-in-route-mix-eq-switch-put-callba alsa-usb-audio-roll-back-quirk-control-caches-on-write-errors.patch alsa-usb-audio-update-babyface-pro-control-caches-only-after-successful-writes.patch alsa-usb-audio-update-us-16x08-eq-comp-shadow-state-after-successful-writes.patch +bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch +bluetooth-btusb-fix-use-after-free-on-registration-failure.patch +bluetooth-btusb-fix-use-after-free-on-marvell-probe-failure.patch +bluetooth-btusb-fix-wakeup-source-leak-on-probe-failure.patch +binder-fix-uaf-in-binder_thread_release.patch +binder-fix-uaf-in-binder_free_transaction.patch