From: Greg Kroah-Hartman Date: Tue, 12 May 2026 13:53:24 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c26119a90101100b593cddd65bccb786a5451d87;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: af_unix-reject-siocatmark-on-non-stream-sockets.patch block-add-pgmap-check-to-biovec_phys_mergeable.patch cifs-abort-open_cached_dir-if-we-don-t-request-leases.patch cifs-change_conf-needs-to-be-called-for-session-setup.patch clk-imx-imx8-acm-fix-flags-for-acm-clocks.patch clk-microchip-mpfs-ccc-fix-out-of-bounds-access-during-output-registration.patch clk-rk808-fix-of-node-reference-imbalance.patch cpuidle-powerpc-avoid-double-clear-when-breaking-snooze.patch extcon-ptn5150-handle-pending-irq-events-during-system-resume.patch gpio-of-clear-of_populated-on-hog-nodes-in-remove-path.patch hv_sock-fix-arm64-support.patch hwmon-corsair-psu-close-hid-device-on-probe-errors.patch hwmon-ltc2992-clamp-threshold-writes-to-hardware-range.patch hwmon-ltc2992-fix-u32-overflow-in-power-read-path.patch ibmveth-disable-gso-for-packets-with-small-mss.patch ice-fix-double-free-in-ice_sf_eth_activate-error-path.patch ip6_gre-use-cached-t-net-in-ip6erspan_changelink.patch net-libwx-fix-vf-illegal-register-access.patch net-rds-handle-zerocopy-send-cleanup-before-the-message-is-queued.patch net-wwan-t7xx-validate-port_count-against-message-length-in-t7xx_port_enum_msg_handler.patch parisc-fix-irq-leak-in-lasi-driver.patch sound-ua101-fix-division-by-zero-at-probe.patch spi-microchip-core-qspi-fix-controller-deregistration.patch spi-topcliff-pch-fix-controller-deregistration.patch spi-topcliff-pch-fix-use-after-free-on-unbind.patch thermal-core-free-thermal-zone-id-later-during-removal.patch thermal-drivers-sprd-fix-raw-temperature-clamping-in-sprd_thm_rawdata_to_temp.patch thermal-drivers-sprd-fix-temperature-clamping-in-sprd_thm_temp_to_rawdata.patch udf-reject-descriptors-with-oversized-crc-length.patch --- diff --git a/queue-6.12/af_unix-reject-siocatmark-on-non-stream-sockets.patch b/queue-6.12/af_unix-reject-siocatmark-on-non-stream-sockets.patch new file mode 100644 index 0000000000..0b8e090827 --- /dev/null +++ b/queue-6.12/af_unix-reject-siocatmark-on-non-stream-sockets.patch @@ -0,0 +1,48 @@ +From d119775f2bad827edc28071c061fdd4a91f889a5 Mon Sep 17 00:00:00 2001 +From: Jiexun Wang +Date: Wed, 6 May 2026 22:08:23 +0800 +Subject: af_unix: Reject SIOCATMARK on non-stream sockets + +From: Jiexun Wang + +commit d119775f2bad827edc28071c061fdd4a91f889a5 upstream. + +SIOCATMARK reports whether the receive queue is at the urgent mark for +MSG_OOB. + +In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets. +SOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(), +so they should not support SIOCATMARK either. + +Return -EOPNOTSUPP for non-stream sockets before checking the receive +queue. + +Fixes: 314001f0bf92 ("af_unix: Add OOB support") +Cc: stable@kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Suggested-by: Kuniyuki Iwashima +Signed-off-by: Jiexun Wang +Signed-off-by: Ren Wei +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260506140825.2987635-1-n05ec@lzu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/af_unix.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -3187,6 +3187,9 @@ static int unix_ioctl(struct socket *soc + struct sk_buff *skb; + int answ = 0; + ++ if (sk->sk_type != SOCK_STREAM) ++ return -EOPNOTSUPP; ++ + mutex_lock(&u->iolock); + + skb = skb_peek(&sk->sk_receive_queue); diff --git a/queue-6.12/block-add-pgmap-check-to-biovec_phys_mergeable.patch b/queue-6.12/block-add-pgmap-check-to-biovec_phys_mergeable.patch new file mode 100644 index 0000000000..d282695b1a --- /dev/null +++ b/queue-6.12/block-add-pgmap-check-to-biovec_phys_mergeable.patch @@ -0,0 +1,48 @@ +From 13920e4b7b784b40cf4519ff1f0f3e513476a499 Mon Sep 17 00:00:00 2001 +From: Naman Jain +Date: Fri, 10 Apr 2026 15:34:13 +0000 +Subject: block: add pgmap check to biovec_phys_mergeable + +From: Naman Jain + +commit 13920e4b7b784b40cf4519ff1f0f3e513476a499 upstream. + +biovec_phys_mergeable() is used by the request merge, DMA mapping, +and integrity merge paths to decide if two physically contiguous +bvec segments can be coalesced into one. It currently has no check +for whether the segments belong to different dev_pagemaps. + +When zone device memory is registered in multiple chunks, each chunk +gets its own dev_pagemap. A single bio can legitimately contain +bvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at +pgmap boundaries but the outer loop in bio_iov_iter_get_pages() +continues filling the same bio. If such bvecs are physically +contiguous, biovec_phys_mergeable() will coalesce them, making it +impossible to recover the correct pgmap for the merged segment +via page_pgmap(). + +Add a zone_device_pages_have_same_pgmap() check to prevent merging +bvec segments that span different pgmaps. + +Fixes: 49580e690755 ("block: add check when merging zone device pages") +Cc: stable@vger.kernel.org +Reviewed-by: Christoph Hellwig +Signed-off-by: Naman Jain +Link: https://patch.msgid.link/20260410153414.4159050-2-namjain@linux.microsoft.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/block/blk.h ++++ b/block/blk.h +@@ -117,6 +117,8 @@ static inline bool biovec_phys_mergeable + + if (addr1 + vec1->bv_len != addr2) + return false; ++ if (!zone_device_pages_have_same_pgmap(vec1->bv_page, vec2->bv_page)) ++ return false; + if (xen_domain() && !xen_biovec_phys_mergeable(vec1, vec2->bv_page)) + return false; + if ((addr1 | mask) != ((addr2 + vec2->bv_len - 1) | mask)) diff --git a/queue-6.12/cifs-abort-open_cached_dir-if-we-don-t-request-leases.patch b/queue-6.12/cifs-abort-open_cached_dir-if-we-don-t-request-leases.patch new file mode 100644 index 0000000000..249a329282 --- /dev/null +++ b/queue-6.12/cifs-abort-open_cached_dir-if-we-don-t-request-leases.patch @@ -0,0 +1,46 @@ +From d68ce834f8cf6cb2e77f3331df65166b35466b53 Mon Sep 17 00:00:00 2001 +From: Shyam Prasad N +Date: Tue, 28 Apr 2026 21:37:47 +0530 +Subject: cifs: abort open_cached_dir if we don't request leases + +From: Shyam Prasad N + +commit d68ce834f8cf6cb2e77f3331df65166b35466b53 upstream. + +It is possible that SMB2_open_init may not set lease context based +on the requested oplock level. This can happen when leases have been +temporarily or permanently disabled. When this happens, we will have +open_cached_dir making an open without lease context and the response +will anyway be rejected by open_cached_dir (thereby forcing a close to +discard this open). That's unnecessary two round-trips to the server. + +This change adds a check before making the open request to the server +to make sure that SMB2_open_init did add the expected lease context +to the open in open_cached_dir. + +Cc: +Reviewed-by: Bharath SM +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cached_dir.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/smb/client/cached_dir.c ++++ b/fs/smb/client/cached_dir.c +@@ -261,6 +261,14 @@ replay_again: + &rqst[0], &oplock, &oparms, utf16_path); + if (rc) + goto oshr_free; ++ ++ if (oplock != SMB2_OPLOCK_LEVEL_II) { ++ rc = -EINVAL; ++ cifs_dbg(FYI, "%s: Oplock level %d not suitable for cached directory\n", ++ __func__, oplock); ++ goto oshr_free; ++ } ++ + smb2_set_next_command(tcon, &rqst[0]); + + memset(&qi_iov, 0, sizeof(qi_iov)); diff --git a/queue-6.12/cifs-change_conf-needs-to-be-called-for-session-setup.patch b/queue-6.12/cifs-change_conf-needs-to-be-called-for-session-setup.patch new file mode 100644 index 0000000000..356c3f1756 --- /dev/null +++ b/queue-6.12/cifs-change_conf-needs-to-be-called-for-session-setup.patch @@ -0,0 +1,54 @@ +From c208a2b95811d6e1ebae65d0d2fc13f73707f8e7 Mon Sep 17 00:00:00 2001 +From: Shyam Prasad N +Date: Mon, 30 Mar 2026 16:19:59 +0530 +Subject: cifs: change_conf needs to be called for session setup + +From: Shyam Prasad N + +commit c208a2b95811d6e1ebae65d0d2fc13f73707f8e7 upstream. + +Today we skip calling change_conf for negotiates and session setup +requests. This can be a problem for mchan as the immediate next call +after session setup could be due to an I/O that is made on the +mount point. For single channel, this is not a problem as +there will be several calls after setting up session. + +This change enforces calling change_conf when the total credits contain +enough for reservations for echoes and oplocks. We expect this to happen +during the last session setup response. This way, echoes and oplocks are +not disabled before the first request to the server. So if that first +request is an open, it does not need to disable requesting leases. + +Cc: +Reviewed-by: Bharath SM +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/smb2ops.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -111,10 +111,21 @@ smb2_add_credits(struct TCP_Server_Info + cifs_trace_rw_credits_zero_in_flight); + } + server->in_flight--; ++ ++ /* ++ * Rebalance credits when an op drains in_flight. For session setup, ++ * do this only when the total accumulated credits are high enough (>2) ++ * so that a newly established secondary channel can reserve credits for ++ * echoes and oplocks. We expect this to happen at the end of the final ++ * session setup response. ++ */ + if (server->in_flight == 0 && + ((optype & CIFS_OP_MASK) != CIFS_NEG_OP) && + ((optype & CIFS_OP_MASK) != CIFS_SESS_OP)) + rc = change_conf(server); ++ else if (server->in_flight == 0 && ++ ((optype & CIFS_OP_MASK) == CIFS_SESS_OP) && *val > 2) ++ rc = change_conf(server); + /* + * Sometimes server returns 0 credits on oplock break ack - we need to + * rebalance credits in this case. diff --git a/queue-6.12/clk-imx-imx8-acm-fix-flags-for-acm-clocks.patch b/queue-6.12/clk-imx-imx8-acm-fix-flags-for-acm-clocks.patch new file mode 100644 index 0000000000..0cbb799f52 --- /dev/null +++ b/queue-6.12/clk-imx-imx8-acm-fix-flags-for-acm-clocks.patch @@ -0,0 +1,45 @@ +From f2c2fc93b4a3efdfcf3805ab74741826d343ff2c Mon Sep 17 00:00:00 2001 +From: Stefan Eichenberger +Date: Thu, 12 Feb 2026 16:57:50 +0800 +Subject: clk: imx: imx8-acm: fix flags for acm clocks + +From: Stefan Eichenberger + +commit f2c2fc93b4a3efdfcf3805ab74741826d343ff2c upstream. + +Currently, the flags for the ACM clocks are set to 0. This configuration +causes the fsl-sai audio driver to fail when attempting to set the +sysclk, returning an EINVAL error. The following error messages +highlight the issue: +fsl-sai 59090000.sai: ASoC: error at snd_soc_dai_set_sysclk on 59090000.sai: -22 +imx-hdmi sound-hdmi: failed to set cpu sysclk: -22 + +By setting the flag CLK_SET_RATE_NO_REPARENT, we signal that the ACM +driver does not support reparenting and instead relies on the clock tree +as defined in the device tree. This change resolves the issue with the +fsl-sai audio driver. + +CC: stable@vger.kernel.org +Fixes: d3a0946d7ac9 ("clk: imx: imx8: add audio clock mux driver") +Signed-off-by: Stefan Eichenberger +Signed-off-by: Shengjiu Wang +Reviewed-by: Peng Fan +Link: https://patch.msgid.link/20260212085750.3253187-1-shengjiu.wang@nxp.com +Signed-off-by: Abel Vesa +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/imx/clk-imx8-acm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/clk/imx/clk-imx8-acm.c ++++ b/drivers/clk/imx/clk-imx8-acm.c +@@ -371,7 +371,8 @@ static int imx8_acm_clk_probe(struct pla + for (i = 0; i < priv->soc_data->num_sels; i++) { + hws[sels[i].clkid] = devm_clk_hw_register_mux_parent_data_table(dev, + sels[i].name, sels[i].parents, +- sels[i].num_parents, 0, ++ sels[i].num_parents, ++ CLK_SET_RATE_NO_REPARENT, + base + sels[i].reg, + sels[i].shift, sels[i].width, + 0, NULL, NULL); diff --git a/queue-6.12/clk-microchip-mpfs-ccc-fix-out-of-bounds-access-during-output-registration.patch b/queue-6.12/clk-microchip-mpfs-ccc-fix-out-of-bounds-access-during-output-registration.patch new file mode 100644 index 0000000000..71b3902fc5 --- /dev/null +++ b/queue-6.12/clk-microchip-mpfs-ccc-fix-out-of-bounds-access-during-output-registration.patch @@ -0,0 +1,48 @@ +From 2f7ae8ab6aa73daaf080d5332110357c29df9c36 Mon Sep 17 00:00:00 2001 +From: Conor Dooley +Date: Tue, 24 Feb 2026 09:35:25 +0000 +Subject: clk: microchip: mpfs-ccc: fix out of bounds access during output registration + +From: Conor Dooley + +commit 2f7ae8ab6aa73daaf080d5332110357c29df9c36 upstream. + +UBSAN reported an out of bounds access during registration of the last +two outputs. This out of bounds access occurs because space is only +allocated in the hws array for two PLLs and the four output dividers +that each has, but the defined IDs contain two DLLS and their two +outputs each, which are not supported by the driver. The ID order is +PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs +by two while adding them to the array to avoid the problem. + +Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") +CC: stable@vger.kernel.org +Reviewed-by: Brian Masney +Signed-off-by: Conor Dooley +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/microchip/clk-mpfs-ccc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/clk/microchip/clk-mpfs-ccc.c ++++ b/drivers/clk/microchip/clk-mpfs-ccc.c +@@ -178,7 +178,7 @@ static int mpfs_ccc_register_outputs(str + return dev_err_probe(dev, ret, "failed to register clock id: %d\n", + out_hw->id); + +- data->hw_data.hws[out_hw->id] = &out_hw->divider.hw; ++ data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw; + } + + return 0; +@@ -234,6 +234,10 @@ static int mpfs_ccc_probe(struct platfor + unsigned int num_clks; + int ret; + ++ /* ++ * If DLLs get added here, mpfs_ccc_register_outputs() currently packs ++ * sparse clock IDs in the hws array ++ */ + num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) + + ARRAY_SIZE(mpfs_ccc_pll1out_clks); + diff --git a/queue-6.12/clk-rk808-fix-of-node-reference-imbalance.patch b/queue-6.12/clk-rk808-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..f56371592d --- /dev/null +++ b/queue-6.12/clk-rk808-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From de019f203b0d472c98ead4081ad4f05d92c9b826 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 7 Apr 2026 11:50:27 +0200 +Subject: clk: rk808: fix OF node reference imbalance + +From: Johan Hovold + +commit de019f203b0d472c98ead4081ad4f05d92c9b826 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 2dc51ca822e4 ("clk: RK808: Reduce 'struct rk808' usage") +Cc: stable@vger.kernel.org # 6.5 +Cc: Sebastian Reichel +Signed-off-by: Johan Hovold +Reviewed-by: Sebastian Reichel +Reviewed-by: Brian Masney +Reviewed-by: Heiko Stuebner +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/clk-rk808.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/clk-rk808.c ++++ b/drivers/clk/clk-rk808.c +@@ -153,7 +153,7 @@ static int rk808_clkout_probe(struct pla + struct rk808_clkout *rk808_clkout; + int ret; + +- dev->of_node = pdev->dev.parent->of_node; ++ device_set_of_node_from_dev(dev, dev->parent); + + rk808_clkout = devm_kzalloc(dev, + sizeof(*rk808_clkout), GFP_KERNEL); diff --git a/queue-6.12/cpuidle-powerpc-avoid-double-clear-when-breaking-snooze.patch b/queue-6.12/cpuidle-powerpc-avoid-double-clear-when-breaking-snooze.patch new file mode 100644 index 0000000000..90a4cf869d --- /dev/null +++ b/queue-6.12/cpuidle-powerpc-avoid-double-clear-when-breaking-snooze.patch @@ -0,0 +1,59 @@ +From 64ed1e3e728afb57ba9acb59e69de930ead847d9 Mon Sep 17 00:00:00 2001 +From: Shrikanth Hegde +Date: Wed, 11 Mar 2026 11:47:09 +0530 +Subject: cpuidle: powerpc: avoid double clear when breaking snooze + +From: Shrikanth Hegde + +commit 64ed1e3e728afb57ba9acb59e69de930ead847d9 upstream. + +snooze_loop is done often in any system which has fair bit of +idle time. So it qualifies for even micro-optimizations. + +When breaking the snooze due to timeout, TIF_POLLING_NRFLAG is cleared +twice. Clearing the bit invokes atomics. Avoid double clear and thereby +avoid one atomic write. + +dev->poll_time_limit indicates whether the loop was broken due to +timeout. Use that instead of defining a new variable. + +Fixes: 7ded429152e8 ("cpuidle: powerpc: no memory barrier after break from idle") +Cc: stable@vger.kernel.org +Reviewed-by: Mukesh Kumar Chaurasiya (IBM) +Signed-off-by: Shrikanth Hegde +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20260311061709.1230440-1-sshegde@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpuidle/cpuidle-powernv.c | 5 ++++- + drivers/cpuidle/cpuidle-pseries.c | 5 ++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/cpuidle/cpuidle-powernv.c ++++ b/drivers/cpuidle/cpuidle-powernv.c +@@ -95,7 +95,10 @@ static int snooze_loop(struct cpuidle_de + + HMT_medium(); + ppc64_runlatch_on(); +- clear_thread_flag(TIF_POLLING_NRFLAG); ++ ++ /* Avoid double clear when breaking */ ++ if (!dev->poll_time_limit) ++ clear_thread_flag(TIF_POLLING_NRFLAG); + + local_irq_disable(); + +--- a/drivers/cpuidle/cpuidle-pseries.c ++++ b/drivers/cpuidle/cpuidle-pseries.c +@@ -63,7 +63,10 @@ int snooze_loop(struct cpuidle_device *d + } + + HMT_medium(); +- clear_thread_flag(TIF_POLLING_NRFLAG); ++ ++ /* Avoid double clear when breaking */ ++ if (!dev->poll_time_limit) ++ clear_thread_flag(TIF_POLLING_NRFLAG); + + raw_local_irq_disable(); + diff --git a/queue-6.12/extcon-ptn5150-handle-pending-irq-events-during-system-resume.patch b/queue-6.12/extcon-ptn5150-handle-pending-irq-events-during-system-resume.patch new file mode 100644 index 0000000000..fc9a972c4f --- /dev/null +++ b/queue-6.12/extcon-ptn5150-handle-pending-irq-events-during-system-resume.patch @@ -0,0 +1,58 @@ +From 4652fefcda3c604c83d1ae28ede94544e2142f06 Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Sat, 15 Nov 2025 10:59:05 +0800 +Subject: extcon: ptn5150: handle pending IRQ events during system resume + +From: Xu Yang + +commit 4652fefcda3c604c83d1ae28ede94544e2142f06 upstream. + +When the system is suspended and ptn5150 wakeup interrupt is disabled, +any changes on ptn5150 will only be record in interrupt status +registers and won't fire an IRQ since its trigger type is falling +edge. So the HW interrupt line will keep at low state and any further +changes won't trigger IRQ anymore. To fix it, this will schedule a +work to check whether any IRQ are pending and handle it accordingly. + +Fixes: 4ed754de2d66 ("extcon: Add support for ptn5150 extcon driver") +Cc: stable@vger.kernel.org +Reviewed-by: Krzysztof Kozlowski +Acked-by: MyungJoo Ham +Signed-off-by: Xu Yang +Signed-off-by: Chanwoo Choi +Link: https://lore.kernel.org/lkml/20251115025905.1395347-1-xu.yang_2@nxp.com/ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/extcon/extcon-ptn5150.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/extcon/extcon-ptn5150.c ++++ b/drivers/extcon/extcon-ptn5150.c +@@ -331,6 +331,19 @@ static int ptn5150_i2c_probe(struct i2c_ + return 0; + } + ++static int ptn5150_resume(struct device *dev) ++{ ++ struct i2c_client *i2c = to_i2c_client(dev); ++ struct ptn5150_info *info = i2c_get_clientdata(i2c); ++ ++ /* Need to check possible pending interrupt events */ ++ schedule_work(&info->irq_work); ++ ++ return 0; ++} ++ ++static DEFINE_SIMPLE_DEV_PM_OPS(ptn5150_pm_ops, NULL, ptn5150_resume); ++ + static const struct of_device_id ptn5150_dt_match[] = { + { .compatible = "nxp,ptn5150" }, + { }, +@@ -346,6 +359,7 @@ MODULE_DEVICE_TABLE(i2c, ptn5150_i2c_id) + static struct i2c_driver ptn5150_i2c_driver = { + .driver = { + .name = "ptn5150", ++ .pm = pm_sleep_ptr(&ptn5150_pm_ops), + .of_match_table = ptn5150_dt_match, + }, + .probe = ptn5150_i2c_probe, diff --git a/queue-6.12/gpio-of-clear-of_populated-on-hog-nodes-in-remove-path.patch b/queue-6.12/gpio-of-clear-of_populated-on-hog-nodes-in-remove-path.patch new file mode 100644 index 0000000000..1115a4de52 --- /dev/null +++ b/queue-6.12/gpio-of-clear-of_populated-on-hog-nodes-in-remove-path.patch @@ -0,0 +1,39 @@ +From bbee90e750262bfb406d66dc65c46d616d2b6673 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Mon, 9 Mar 2026 13:42:37 +0100 +Subject: gpio: of: clear OF_POPULATED on hog nodes in remove path + +From: Bartosz Golaszewski + +commit bbee90e750262bfb406d66dc65c46d616d2b6673 upstream. + +The previously set OF_POPULATED flag should be cleared on the hog nodes +when removing the chip. + +Cc: stable@vger.kernel.org +Fixes: 63636d956c455 ("gpio: of: Add DT overlay support for GPIO hogs") +Acked-by: Linus Walleij +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-1-4e61f3dbf06a@oss.qualcomm.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib-of.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -1196,5 +1196,12 @@ int of_gpiochip_add(struct gpio_chip *ch + + void of_gpiochip_remove(struct gpio_chip *chip) + { +- of_node_put(dev_of_node(&chip->gpiodev->dev)); ++ struct device_node *np = dev_of_node(&chip->gpiodev->dev); ++ ++ for_each_child_of_node_scoped(np, child) { ++ if (of_property_present(child, "gpio-hog")) ++ of_node_clear_flag(child, OF_POPULATED); ++ } ++ ++ of_node_put(np); + } diff --git a/queue-6.12/hv_sock-fix-arm64-support.patch b/queue-6.12/hv_sock-fix-arm64-support.patch new file mode 100644 index 0000000000..360d3575d2 --- /dev/null +++ b/queue-6.12/hv_sock-fix-arm64-support.patch @@ -0,0 +1,42 @@ +From b31681206e3f527970a7c7ed807fbf6a028fc25b Mon Sep 17 00:00:00 2001 +From: Hamza Mahfooz +Date: Tue, 28 Apr 2026 08:53:39 -0400 +Subject: hv_sock: fix ARM64 support + +From: Hamza Mahfooz + +commit b31681206e3f527970a7c7ed807fbf6a028fc25b upstream. + +VMBUS ring buffers must be page aligned. Therefore, the current value of +24K presents a challenge on ARM64 kernels (with 64K pages). So, use +VMBUS_RING_SIZE() to ensure they are always aligned and large enough to +hold all of the relevant data. + +Cc: stable@vger.kernel.org +Fixes: 77ffe33363c0 ("hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication") +Tested-by: Dexuan Cui +Reviewed-by: Dexuan Cui +Signed-off-by: Hamza Mahfooz +Acked-by: Stefano Garzarella +Link: https://patch.msgid.link/20260428125339.13963-1-hamzamahfooz@linux.microsoft.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/vmw_vsock/hyperv_transport.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/vmw_vsock/hyperv_transport.c ++++ b/net/vmw_vsock/hyperv_transport.c +@@ -375,10 +375,10 @@ static void hvs_open_connection(struct v + } else { + sndbuf = max_t(int, sk->sk_sndbuf, RINGBUFFER_HVS_SND_SIZE); + sndbuf = min_t(int, sndbuf, RINGBUFFER_HVS_MAX_SIZE); +- sndbuf = ALIGN(sndbuf, HV_HYP_PAGE_SIZE); ++ sndbuf = VMBUS_RING_SIZE(sndbuf); + rcvbuf = max_t(int, sk->sk_rcvbuf, RINGBUFFER_HVS_RCV_SIZE); + rcvbuf = min_t(int, rcvbuf, RINGBUFFER_HVS_MAX_SIZE); +- rcvbuf = ALIGN(rcvbuf, HV_HYP_PAGE_SIZE); ++ rcvbuf = VMBUS_RING_SIZE(rcvbuf); + } + + chan->max_pkt_size = HVS_MAX_PKT_SIZE; diff --git a/queue-6.12/hwmon-corsair-psu-close-hid-device-on-probe-errors.patch b/queue-6.12/hwmon-corsair-psu-close-hid-device-on-probe-errors.patch new file mode 100644 index 0000000000..66ab35e217 --- /dev/null +++ b/queue-6.12/hwmon-corsair-psu-close-hid-device-on-probe-errors.patch @@ -0,0 +1,45 @@ +From 174606451fbb17db506ebaacdd5e203e57773d5f Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Fri, 24 Apr 2026 22:50:51 +0900 +Subject: hwmon: (corsair-psu) Close HID device on probe errors + +From: Myeonghun Pak + +commit 174606451fbb17db506ebaacdd5e203e57773d5f upstream. + +corsairpsu_probe() opens the HID device before sending the device init +and firmware-info commands. If either command fails, the error path jumps +directly to fail_and_stop and skips hid_hw_close(). + +Use the existing fail_and_close label for those post-open failures so the +open count and low-level close callback are balanced before hid_hw_stop(). + +Fixes: d115b51e0e56 ("hwmon: add Corsair PSU HID controller driver") +Cc: stable@vger.kernel.org +Signed-off-by: Myeonghun Pak +Reviewed-by: Wilken Gottwalt +Link: https://lore.kernel.org/r/20260424135107.13720-1-mhun512@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/corsair-psu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/corsair-psu.c ++++ b/drivers/hwmon/corsair-psu.c +@@ -805,13 +805,13 @@ static int corsairpsu_probe(struct hid_d + ret = corsairpsu_init(priv); + if (ret < 0) { + dev_err(&hdev->dev, "unable to initialize device (%d)\n", ret); +- goto fail_and_stop; ++ goto fail_and_close; + } + + ret = corsairpsu_fwinfo(priv); + if (ret < 0) { + dev_err(&hdev->dev, "unable to query firmware (%d)\n", ret); +- goto fail_and_stop; ++ goto fail_and_close; + } + + corsairpsu_get_criticals(priv); diff --git a/queue-6.12/hwmon-ltc2992-clamp-threshold-writes-to-hardware-range.patch b/queue-6.12/hwmon-ltc2992-clamp-threshold-writes-to-hardware-range.patch new file mode 100644 index 0000000000..e4b47f5d7f --- /dev/null +++ b/queue-6.12/hwmon-ltc2992-clamp-threshold-writes-to-hardware-range.patch @@ -0,0 +1,115 @@ +From d6cc7c99bf1f73eda7d565d224d791d16239bb41 Mon Sep 17 00:00:00 2001 +From: Sanman Pradhan +Date: Thu, 16 Apr 2026 21:59:30 +0000 +Subject: hwmon: (ltc2992) Clamp threshold writes to hardware range + +From: Sanman Pradhan + +commit d6cc7c99bf1f73eda7d565d224d791d16239bb41 upstream. + +ltc2992_set_voltage(), ltc2992_set_current(), and ltc2992_set_power() +do not validate the user-supplied value before converting it to a +register value. This can result in: + +1. Negative input values wrapping to large positive register values. + For power, the negative long is implicitly cast to u64 in + mul_u64_u32_div(), producing an incorrect value. For voltage and + current, the negative converted value wraps when passed to + ltc2992_write_reg() as a u32. + +2. Intermediate arithmetic exceeding the range representable in u64 on + 64-bit platforms. In ltc2992_set_voltage(), (u64)val * 1000 can + exceed U64_MAX when val is a large positive long. In + ltc2992_set_current(), (u64)val * r_sense_uohm can overflow + similarly. In ltc2992_set_power(), the computed value may not fit + in u64. + +3. Register values exceeding the hardware field width. Voltage and + current threshold registers are 12-bit (stored left-justified in + 16 bits), and power threshold registers are 24-bit. Without + clamping, bits above the field width are truncated in + ltc2992_write_reg(). + +Fix by clamping negative values to zero, clamping positive values to +the rounded hardware-representable maximum (the value returned by the +read path for a full-scale register) to prevent intermediate overflow, +and clamping the converted register value to the hardware field width +before writing. The existing conversion formula and rounding behavior +are preserved. + +In the power write path, cancel the factor of 1000 from both the +numerator (r_sense_uohm * 1000) and the denominator +(VADC_UV_LSB * IADC_NANOV_LSB) to also eliminate a u32 overflow of +r_sense_uohm * 1000 when r_sense_uohm exceeds about 4.29 ohms. + +Fixes: b0bd407e94b03 ("hwmon: (ltc2992) Add support") +Cc: stable@vger.kernel.org +Signed-off-by: Sanman Pradhan +Link: https://lore.kernel.org/r/20260416215904.101969-2-sanman.pradhan@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/ltc2992.c | 35 ++++++++++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 7 deletions(-) + +--- a/drivers/hwmon/ltc2992.c ++++ b/drivers/hwmon/ltc2992.c +@@ -421,10 +421,16 @@ static int ltc2992_get_voltage(struct lt + + static int ltc2992_set_voltage(struct ltc2992_state *st, u32 reg, u32 scale, long val) + { +- val = DIV_ROUND_CLOSEST(val * 1000, scale); +- val = val << 4; ++ u32 reg_val; ++ long vmax; ++ ++ vmax = DIV_ROUND_CLOSEST_ULL(0xFFFULL * scale, 1000); ++ val = max(val, 0L); ++ val = min(val, vmax); ++ reg_val = min(DIV_ROUND_CLOSEST_ULL((u64)val * 1000, scale), ++ 0xFFFULL) << 4; + +- return ltc2992_write_reg(st, reg, 2, val); ++ return ltc2992_write_reg(st, reg, 2, reg_val); + } + + static int ltc2992_read_gpio_alarm(struct ltc2992_state *st, int nr_gpio, u32 attr, long *val) +@@ -549,9 +555,15 @@ static int ltc2992_get_current(struct lt + static int ltc2992_set_current(struct ltc2992_state *st, u32 reg, u32 channel, long val) + { + u32 reg_val; ++ long cmax; + +- reg_val = DIV_ROUND_CLOSEST(val * st->r_sense_uohm[channel], LTC2992_IADC_NANOV_LSB); +- reg_val = reg_val << 4; ++ cmax = DIV_ROUND_CLOSEST_ULL(0xFFFULL * LTC2992_IADC_NANOV_LSB, ++ st->r_sense_uohm[channel]); ++ val = max(val, 0L); ++ val = min(val, cmax); ++ reg_val = min(DIV_ROUND_CLOSEST_ULL((u64)val * st->r_sense_uohm[channel], ++ LTC2992_IADC_NANOV_LSB), ++ 0xFFFULL) << 4; + + return ltc2992_write_reg(st, reg, 2, reg_val); + } +@@ -624,9 +636,18 @@ static int ltc2992_get_power(struct ltc2 + static int ltc2992_set_power(struct ltc2992_state *st, u32 reg, u32 channel, long val) + { + u32 reg_val; ++ u64 pmax, uval; + +- reg_val = mul_u64_u32_div(val, st->r_sense_uohm[channel] * 1000, +- LTC2992_VADC_UV_LSB * LTC2992_IADC_NANOV_LSB); ++ uval = max(val, 0L); ++ pmax = mul_u64_u32_div(0xFFFFFFULL, ++ LTC2992_VADC_UV_LSB / 1000 * ++ LTC2992_IADC_NANOV_LSB, ++ st->r_sense_uohm[channel]); ++ uval = min(uval, pmax); ++ reg_val = min(mul_u64_u32_div(uval, st->r_sense_uohm[channel], ++ LTC2992_VADC_UV_LSB / 1000 * ++ LTC2992_IADC_NANOV_LSB), ++ 0xFFFFFFULL); + + return ltc2992_write_reg(st, reg, 3, reg_val); + } diff --git a/queue-6.12/hwmon-ltc2992-fix-u32-overflow-in-power-read-path.patch b/queue-6.12/hwmon-ltc2992-fix-u32-overflow-in-power-read-path.patch new file mode 100644 index 0000000000..e76760f84c --- /dev/null +++ b/queue-6.12/hwmon-ltc2992-fix-u32-overflow-in-power-read-path.patch @@ -0,0 +1,49 @@ +From 2da0c1fd01dbd6b22844e8676585153dfc660cbe Mon Sep 17 00:00:00 2001 +From: Sanman Pradhan +Date: Thu, 16 Apr 2026 21:59:40 +0000 +Subject: hwmon: (ltc2992) Fix u32 overflow in power read path + +From: Sanman Pradhan + +commit 2da0c1fd01dbd6b22844e8676585153dfc660cbe upstream. + +ltc2992_get_power() computes the divisor for mul_u64_u32_div() as +r_sense_uohm * 1000. This multiplication overflows u32 when +r_sense_uohm exceeds about 4.29 ohms (4294967 micro-ohms), producing +a truncated divisor and an incorrect power reading. + +Cancel the factor of 1000 from both the numerator +(VADC_UV_LSB * IADC_NANOV_LSB = 312500000) and the divisor +(r_sense_uohm * 1000), giving (VADC_UV_LSB / 1000) * IADC_NANOV_LSB += 312500 as the numerator and plain r_sense_uohm as the divisor. +The cancellation is exact because LTC2992_VADC_UV_LSB (25000) is +divisible by 1000. + +This is the read-path counterpart of the write-path fix applied in +the preceding patch. + +Fixes: b0bd407e94b03 ("hwmon: (ltc2992) Add support") +Cc: stable@vger.kernel.org +Signed-off-by: Sanman Pradhan +Link: https://lore.kernel.org/r/20260416215904.101969-3-sanman.pradhan@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/ltc2992.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/ltc2992.c ++++ b/drivers/hwmon/ltc2992.c +@@ -627,8 +627,10 @@ static int ltc2992_get_power(struct ltc2 + if (reg_val < 0) + return reg_val; + +- *val = mul_u64_u32_div(reg_val, LTC2992_VADC_UV_LSB * LTC2992_IADC_NANOV_LSB, +- st->r_sense_uohm[channel] * 1000); ++ *val = mul_u64_u32_div(reg_val, ++ LTC2992_VADC_UV_LSB / 1000 * ++ LTC2992_IADC_NANOV_LSB, ++ st->r_sense_uohm[channel]); + + return 0; + } diff --git a/queue-6.12/ibmveth-disable-gso-for-packets-with-small-mss.patch b/queue-6.12/ibmveth-disable-gso-for-packets-with-small-mss.patch new file mode 100644 index 0000000000..8f137e64a3 --- /dev/null +++ b/queue-6.12/ibmveth-disable-gso-for-packets-with-small-mss.patch @@ -0,0 +1,99 @@ +From cc427d24ac6442ffdeafd157a63c7c5b73ed4de4 Mon Sep 17 00:00:00 2001 +From: Mingming Cao +Date: Fri, 24 Apr 2026 09:29:17 -0700 +Subject: ibmveth: Disable GSO for packets with small MSS + +From: Mingming Cao + +commit cc427d24ac6442ffdeafd157a63c7c5b73ed4de4 upstream. + +Some physical adapters on Power systems do not support segmentation +offload when the MSS is less than 224 bytes. Attempting to send such +packets causes the adapter to freeze, stopping all traffic until +manually reset. + +Implement ndo_features_check to disable GSO for packets with small MSS +values. The network stack will perform software segmentation instead. + +The 224-byte minimum matches ibmvnic +commit ("ibmvnic: Enforce stronger sanity checks +on GSO packets") +which uses the same physical adapters in SEA configurations. + +The issue occurs specifically when the hardware attempts to perform +segmentation (gso_segs > 1) with a small MSS. Single-segment GSO packets +(gso_segs == 1) do not trigger the problematic LSO code path and are +transmitted normally without segmentation. + +Add an ndo_features_check callback to disable GSO when MSS < 224 bytes. +Also call vlan_features_check() to ensure proper handling of VLAN packets, +particularly QinQ (802.1ad) configurations where the hardware parser may +not support certain offload features. + +Validated using iptables to force small MSS values. Without the fix, +the adapter freezes. With the fix, packets are segmented in software +and transmission succeeds. Comprehensive regression testing completedd +(MSS tests, performance, stability). + +Fixes: 8641dd85799f ("ibmveth: Add support for TSO") +Cc: stable@vger.kernel.org +Reviewed-by: Brian King +Tested-by: Shaik Abdulla +Tested-by: Naveed Ahmed +Signed-off-by: Mingming Cao +Link: https://patch.msgid.link/20260424162917.65725-1-mmc@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmveth.c | 22 ++++++++++++++++++++++ + drivers/net/ethernet/ibm/ibmveth.h | 1 + + 2 files changed, 23 insertions(+) + +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1608,6 +1608,27 @@ static int ibmveth_set_mac_addr(struct n + return 0; + } + ++static netdev_features_t ibmveth_features_check(struct sk_buff *skb, ++ struct net_device *dev, ++ netdev_features_t features) ++{ ++ /* Some physical adapters do not support segmentation offload with ++ * MSS < 224. Disable GSO for such packets to avoid adapter freeze. ++ * Note: Single-segment packets (gso_segs == 1) don't need this check ++ * as they bypass the LSO path and are transmitted without segmentation. ++ */ ++ if (skb_is_gso(skb)) { ++ if (skb_shinfo(skb)->gso_size < IBMVETH_MIN_LSO_MSS) { ++ netdev_warn_once(dev, ++ "MSS %u too small for LSO, disabling GSO\n", ++ skb_shinfo(skb)->gso_size); ++ features &= ~NETIF_F_GSO_MASK; ++ } ++ } ++ ++ return vlan_features_check(skb, features); ++} ++ + static const struct net_device_ops ibmveth_netdev_ops = { + .ndo_open = ibmveth_open, + .ndo_stop = ibmveth_close, +@@ -1619,6 +1640,7 @@ static const struct net_device_ops ibmve + .ndo_set_features = ibmveth_set_features, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = ibmveth_set_mac_addr, ++ .ndo_features_check = ibmveth_features_check, + #ifdef CONFIG_NET_POLL_CONTROLLER + .ndo_poll_controller = ibmveth_poll_controller, + #endif +--- a/drivers/net/ethernet/ibm/ibmveth.h ++++ b/drivers/net/ethernet/ibm/ibmveth.h +@@ -36,6 +36,7 @@ + #define IBMVETH_ILLAN_IPV4_TCP_CSUM 0x0000000000000002UL + #define IBMVETH_ILLAN_ACTIVE_TRUNK 0x0000000000000001UL + ++#define IBMVETH_MIN_LSO_MSS 224 /* Minimum MSS for LSO */ + /* hcall macros */ + #define h_register_logical_lan(ua, buflst, rxq, fltlst, mac) \ + plpar_hcall_norets(H_REGISTER_LOGICAL_LAN, ua, buflst, rxq, fltlst, mac) diff --git a/queue-6.12/ice-fix-double-free-in-ice_sf_eth_activate-error-path.patch b/queue-6.12/ice-fix-double-free-in-ice_sf_eth_activate-error-path.patch new file mode 100644 index 0000000000..56b97a745c --- /dev/null +++ b/queue-6.12/ice-fix-double-free-in-ice_sf_eth_activate-error-path.patch @@ -0,0 +1,48 @@ +From 9aab1c3d7299285e2569cbc0ed5892d631a241b2 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Thu, 16 Apr 2026 17:53:27 -0700 +Subject: ice: fix double free in ice_sf_eth_activate() error path + +From: Guangshuo Li + +commit 9aab1c3d7299285e2569cbc0ed5892d631a241b2 upstream. + +When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to +aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). + +The device release callback ice_sf_dev_release() frees sf_dev, but +the current error path falls through to sf_dev_free and calls +kfree(sf_dev) again, causing a double free. + +Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but +avoid falling through to sf_dev_free after auxiliary_device_uninit(). + +Fixes: 13acc5c4cdbe ("ice: subfunction activation and base devlink ops") +Cc: stable@vger.kernel.org +Reviewed-by: Aleksandr Loktionov +Signed-off-by: Guangshuo Li +Reviewed-by: Simon Horman +Signed-off-by: Jacob Keller +Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-3-686c33c9828d@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_sf_eth.c b/drivers/net/ethernet/intel/ice/ice_sf_eth.c +index 2cf04bc6edce..a730aa368c92 100644 +--- a/drivers/net/ethernet/intel/ice/ice_sf_eth.c ++++ b/drivers/net/ethernet/intel/ice/ice_sf_eth.c +@@ -305,6 +305,8 @@ ice_sf_eth_activate(struct ice_dynamic_port *dyn_port, + + aux_dev_uninit: + auxiliary_device_uninit(&sf_dev->adev); ++ return err; ++ + sf_dev_free: + kfree(sf_dev); + xa_erase: +-- +2.54.0 + diff --git a/queue-6.12/ip6_gre-use-cached-t-net-in-ip6erspan_changelink.patch b/queue-6.12/ip6_gre-use-cached-t-net-in-ip6erspan_changelink.patch new file mode 100644 index 0000000000..fd5cf84d40 --- /dev/null +++ b/queue-6.12/ip6_gre-use-cached-t-net-in-ip6erspan_changelink.patch @@ -0,0 +1,55 @@ +From 1d324c2f43f70c965f25c58cc3611c779adbe47e Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 30 Apr 2026 18:33:18 +0800 +Subject: ip6_gre: Use cached t->net in ip6erspan_changelink(). + +From: Maoyi Xie + +commit 1d324c2f43f70c965f25c58cc3611c779adbe47e upstream. + +After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of +rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns +ip6gre hash via link_net. ip6erspan_changelink() was not converted in +that series and still uses dev_net(dev), which diverges from the +device's creation netns after IFLA_NET_NS_FD migration. + +This re-inserts the tunnel into the wrong per-netns hash. The +original netns keeps a stale entry. When that netns is later +destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a +slab-use-after-free reported by KASAN, followed by a kernel BUG at +net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify(). + +Reachable from an unprivileged user namespace (unshare --user +--map-root-user --net). + +ip6gre_changelink() earlier in the same file already uses the cached +t->net; only ip6erspan_changelink() has the wrong shape. + +Fixes: 2d665034f239 ("net: ip6_gre: Fix ip6erspan hlen calculation") +Cc: stable@vger.kernel.org # v5.15+ +Signed-off-by: Maoyi Xie +Reviewed-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260430103318.3206018-1-maoyi.xie@ntu.edu.sg +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_gre.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -2296,10 +2296,11 @@ static int ip6erspan_changelink(struct n + struct nlattr *data[], + struct netlink_ext_ack *extack) + { +- struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id); ++ struct ip6_tnl *t = netdev_priv(dev); + struct __ip6_tnl_parm p; +- struct ip6_tnl *t; ++ struct ip6gre_net *ign; + ++ ign = net_generic(t->net, ip6gre_net_id); + t = ip6gre_changelink_common(dev, tb, data, &p, extack); + if (IS_ERR(t)) + return PTR_ERR(t); diff --git a/queue-6.12/net-libwx-fix-vf-illegal-register-access.patch b/queue-6.12/net-libwx-fix-vf-illegal-register-access.patch new file mode 100644 index 0000000000..9bb97b9bbe --- /dev/null +++ b/queue-6.12/net-libwx-fix-vf-illegal-register-access.patch @@ -0,0 +1,42 @@ +From 694de316f607fe2473d52ca0707e3918e72c1562 Mon Sep 17 00:00:00 2001 +From: Jiawen Wu +Date: Wed, 29 Apr 2026 16:37:42 +0800 +Subject: net: libwx: fix VF illegal register access + +From: Jiawen Wu + +commit 694de316f607fe2473d52ca0707e3918e72c1562 upstream. + +Register WX_CFG_PORT_ST is a PF restricted register. When a VF is +initialized, attempting to read this register triggers an illegal +register access, which lead to a system hang. + +When the device is VF, the bus function ID can be obtained directly from +the PCI_FUNC(pdev->devfn). + +Fixes: a04ea57aae37 ("net: libwx: fix device bus LAN ID") +Cc: stable@vger.kernel.org +Signed-off-by: Jiawen Wu +Link: https://patch.msgid.link/4D1F4452D21DE107+20260429083743.88961-1-jiawenwu@trustnetic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c +@@ -1943,8 +1943,11 @@ int wx_sw_init(struct wx *wx) + wx->oem_svid = pdev->subsystem_vendor; + wx->oem_ssid = pdev->subsystem_device; + wx->bus.device = PCI_SLOT(pdev->devfn); +- wx->bus.func = FIELD_GET(WX_CFG_PORT_ST_LANID, +- rd32(wx, WX_CFG_PORT_ST)); ++ if (pdev->is_virtfn) ++ wx->bus.func = PCI_FUNC(pdev->devfn); ++ else ++ wx->bus.func = FIELD_GET(WX_CFG_PORT_ST_LANID, ++ rd32(wx, WX_CFG_PORT_ST)); + + if (wx->oem_svid == PCI_VENDOR_ID_WANGXUN) { + wx->subsystem_vendor_id = pdev->subsystem_vendor; diff --git a/queue-6.12/net-rds-handle-zerocopy-send-cleanup-before-the-message-is-queued.patch b/queue-6.12/net-rds-handle-zerocopy-send-cleanup-before-the-message-is-queued.patch new file mode 100644 index 0000000000..31872be5f0 --- /dev/null +++ b/queue-6.12/net-rds-handle-zerocopy-send-cleanup-before-the-message-is-queued.patch @@ -0,0 +1,87 @@ +From 44b550d88b267320459d518c0743a241ab2108fa Mon Sep 17 00:00:00 2001 +From: Nan Li +Date: Fri, 1 May 2026 09:08:44 +0800 +Subject: net/rds: handle zerocopy send cleanup before the message is queued + +From: Nan Li + +commit 44b550d88b267320459d518c0743a241ab2108fa upstream. + +A zerocopy send can fail after user pages have been pinned but before +the message is attached to the sending socket. + +The purge path currently infers zerocopy state from rm->m_rs, so an +unqueued message can be cleaned up as if it owned normal payload pages. +However, zerocopy ownership is really determined by the presence of +op_mmp_znotifier, regardless of whether the message has reached the +socket queue. + +Capture op_mmp_znotifier up front in rds_message_purge() and use it as +the cleanup discriminator. If the message is already associated with a +socket, keep the existing completion path. Otherwise, drop the pinned +page accounting directly and release the notifier before putting the +payload pages. + +This keeps early send failure cleanup consistent with the zerocopy +lifetime rules without changing the normal queued completion path. + +Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") +Cc: stable@kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Co-developed-by: Xiao Liu +Signed-off-by: Xiao Liu +Signed-off-by: Nan Li +Signed-off-by: Ren Wei +Reviewed-by: Allison Henderson +Link: https://patch.msgid.link/d2ea98a6313d5467bac00f7c9fef8c7acddb9258.1777550074.git.tonanli66@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/rds/message.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/net/rds/message.c ++++ b/net/rds/message.c +@@ -129,24 +129,34 @@ static void rds_rm_zerocopy_callback(str + */ + static void rds_message_purge(struct rds_message *rm) + { ++ struct rds_znotifier *znotifier; + unsigned long i, flags; +- bool zcopy = false; ++ bool zcopy; + + if (unlikely(test_bit(RDS_MSG_PAGEVEC, &rm->m_flags))) + return; + + spin_lock_irqsave(&rm->m_rs_lock, flags); ++ znotifier = rm->data.op_mmp_znotifier; ++ rm->data.op_mmp_znotifier = NULL; ++ zcopy = !!znotifier; ++ + if (rm->m_rs) { + struct rds_sock *rs = rm->m_rs; + +- if (rm->data.op_mmp_znotifier) { +- zcopy = true; +- rds_rm_zerocopy_callback(rs, rm->data.op_mmp_znotifier); ++ if (znotifier) { ++ rds_rm_zerocopy_callback(rs, znotifier); + rds_wake_sk_sleep(rs); +- rm->data.op_mmp_znotifier = NULL; + } + sock_put(rds_rs_to_sk(rs)); + rm->m_rs = NULL; ++ } else if (znotifier) { ++ /* ++ * Zerocopy can fail before the message is queued on the ++ * socket, so there is no rs to carry the notification. ++ */ ++ mm_unaccount_pinned_pages(&znotifier->z_mmp); ++ kfree(rds_info_from_znotifier(znotifier)); + } + spin_unlock_irqrestore(&rm->m_rs_lock, flags); + diff --git a/queue-6.12/net-wwan-t7xx-validate-port_count-against-message-length-in-t7xx_port_enum_msg_handler.patch b/queue-6.12/net-wwan-t7xx-validate-port_count-against-message-length-in-t7xx_port_enum_msg_handler.patch new file mode 100644 index 0000000000..68501c83e2 --- /dev/null +++ b/queue-6.12/net-wwan-t7xx-validate-port_count-against-message-length-in-t7xx_port_enum_msg_handler.patch @@ -0,0 +1,140 @@ +From 0e7c074cfcd9bd93765505f9eb8b42f03ed2a744 Mon Sep 17 00:00:00 2001 +From: Pavitra Jha +Date: Fri, 1 May 2026 07:07:12 -0400 +Subject: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler + +From: Pavitra Jha + +commit 0e7c074cfcd9bd93765505f9eb8b42f03ed2a744 upstream. + +t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as +a loop bound over port_msg->data[] without checking that the message buffer +contains sufficient data. A modem sending port_count=65535 in a 12-byte +buffer triggers a slab-out-of-bounds read of up to 262140 bytes. + +Add a sizeof(*port_msg) check before accessing the port message header +fields to guard against undersized messages. + +Add a struct_size() check after extracting port_count and before the loop. + +In t7xx_parse_host_rt_data(), guard the rt_feature header read with a +remaining-buffer check before accessing data_len, validate feat_data_len +against the actual remaining buffer to prevent OOB reads and signed +integer overflow on offset. + +Pass msg_len from both call sites: skb->len at the DPMAIF path after +skb_pull(), and the validated feat_data_len at the handshake path. + +Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port") +Cc: stable@vger.kernel.org +Signed-off-by: Pavitra Jha +Link: https://patch.msgid.link/20260501110713.145563-1-jhapavitra98@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +++++++++++++++++--- + drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++++++++++++++++-- + drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- + 3 files changed, 34 insertions(+), 6 deletions(-) + +--- a/drivers/net/wwan/t7xx/t7xx_modem_ops.c ++++ b/drivers/net/wwan/t7xx/t7xx_modem_ops.c +@@ -456,8 +456,20 @@ static int t7xx_parse_host_rt_data(struc + + offset = sizeof(struct feature_query); + for (i = 0; i < FEATURE_COUNT && offset < data_length; i++) { ++ size_t remaining = data_length - offset; ++ size_t feat_data_len, feat_total; ++ ++ if (remaining < sizeof(*rt_feature)) ++ break; ++ + rt_feature = data + offset; +- offset += sizeof(*rt_feature) + le32_to_cpu(rt_feature->data_len); ++ feat_data_len = le32_to_cpu(rt_feature->data_len); ++ ++ if (feat_data_len > remaining - sizeof(*rt_feature)) ++ break; ++ ++ feat_total = sizeof(*rt_feature) + feat_data_len; ++ offset += feat_total; + + ft_spt_cfg = FIELD_GET(FEATURE_MSK, core->feature_set[i]); + if (ft_spt_cfg != MTK_FEATURE_MUST_BE_SUPPORTED) +@@ -467,8 +479,10 @@ static int t7xx_parse_host_rt_data(struc + if (ft_spt_st != MTK_FEATURE_MUST_BE_SUPPORTED) + return -EINVAL; + +- if (i == RT_ID_MD_PORT_ENUM || i == RT_ID_AP_PORT_ENUM) +- t7xx_port_enum_msg_handler(ctl->md, rt_feature->data); ++ if (i == RT_ID_MD_PORT_ENUM || i == RT_ID_AP_PORT_ENUM) { ++ t7xx_port_enum_msg_handler(ctl->md, rt_feature->data, ++ feat_data_len); ++ } + } + + return 0; +--- a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c ++++ b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c +@@ -117,6 +117,7 @@ static int fsm_ee_message_handler(struct + * t7xx_port_enum_msg_handler() - Parse the port enumeration message to create/remove nodes. + * @md: Modem context. + * @msg: Message. ++ * @msg_len: Length of @msg in bytes. + * + * Used to control create/remove device node. + * +@@ -124,12 +125,18 @@ static int fsm_ee_message_handler(struct + * * 0 - Success. + * * -EFAULT - Message check failure. + */ +-int t7xx_port_enum_msg_handler(struct t7xx_modem *md, void *msg) ++int t7xx_port_enum_msg_handler(struct t7xx_modem *md, void *msg, size_t msg_len) + { + struct device *dev = &md->t7xx_dev->pdev->dev; + unsigned int version, port_count, i; + struct port_msg *port_msg = msg; + ++ if (msg_len < sizeof(*port_msg)) { ++ dev_err(dev, "Port enum msg too short for header: need %zu, have %zu\n", ++ sizeof(*port_msg), msg_len); ++ return -EINVAL; ++ } ++ + version = FIELD_GET(PORT_MSG_VERSION, le32_to_cpu(port_msg->info)); + if (version != PORT_ENUM_VER || + le32_to_cpu(port_msg->head_pattern) != PORT_ENUM_HEAD_PATTERN || +@@ -141,6 +148,13 @@ int t7xx_port_enum_msg_handler(struct t7 + } + + port_count = FIELD_GET(PORT_MSG_PRT_CNT, le32_to_cpu(port_msg->info)); ++ ++ if (msg_len < struct_size(port_msg, data, port_count)) { ++ dev_err(dev, "Port enum msg too short: need %zu, have %zu\n", ++ struct_size(port_msg, data, port_count), msg_len); ++ return -EINVAL; ++ } ++ + for (i = 0; i < port_count; i++) { + u32 port_info = le32_to_cpu(port_msg->data[i]); + unsigned int ch_id; +@@ -191,7 +205,7 @@ static int control_msg_handler(struct t7 + + case CTL_ID_PORT_ENUM: + skb_pull(skb, sizeof(*ctrl_msg_h)); +- ret = t7xx_port_enum_msg_handler(ctl->md, (struct port_msg *)skb->data); ++ ret = t7xx_port_enum_msg_handler(ctl->md, (struct port_msg *)skb->data, skb->len); + if (!ret) + ret = port_ctl_send_msg_to_md(port, CTL_ID_PORT_ENUM, 0); + else +--- a/drivers/net/wwan/t7xx/t7xx_port_proxy.h ++++ b/drivers/net/wwan/t7xx/t7xx_port_proxy.h +@@ -102,7 +102,7 @@ void t7xx_port_proxy_reset(struct port_p + void t7xx_port_proxy_uninit(struct port_proxy *port_prox); + int t7xx_port_proxy_init(struct t7xx_modem *md); + void t7xx_port_proxy_md_status_notify(struct port_proxy *port_prox, unsigned int state); +-int t7xx_port_enum_msg_handler(struct t7xx_modem *md, void *msg); ++int t7xx_port_enum_msg_handler(struct t7xx_modem *md, void *msg, size_t msg_len); + int t7xx_port_proxy_chl_enable_disable(struct port_proxy *port_prox, unsigned int ch_id, + bool en_flag); + void t7xx_port_proxy_set_cfg(struct t7xx_modem *md, enum port_cfg_id cfg_id); diff --git a/queue-6.12/parisc-fix-irq-leak-in-lasi-driver.patch b/queue-6.12/parisc-fix-irq-leak-in-lasi-driver.patch new file mode 100644 index 0000000000..5478898a6f --- /dev/null +++ b/queue-6.12/parisc-fix-irq-leak-in-lasi-driver.patch @@ -0,0 +1,63 @@ +From 37b0dc5e279f35036fb638d1e187197b6c05a76d Mon Sep 17 00:00:00 2001 +From: Hongling Zeng +Date: Sun, 3 May 2026 12:17:44 +0800 +Subject: parisc: Fix IRQ leak in LASI driver + +From: Hongling Zeng + +commit 37b0dc5e279f35036fb638d1e187197b6c05a76d upstream. + +When request_irq() succeeds but gsc_common_setup() fails later, +the IRQ is never released. Fix this by adding proper error handling +with goto labels to ensure resources are released in LIFO order. + +Detected by Smatch: + drivers/parisc/lasi.c:216 lasi_init_chip() warn: 'lasi->gsc_irq.irq' +from request_irq() not released on lines: 207. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202604180957.4QdAIxP6-lkp@intel.com/ +Signed-off-by: Hongling Zeng +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/lasi.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/parisc/lasi.c ++++ b/drivers/parisc/lasi.c +@@ -193,8 +193,7 @@ static int __init lasi_init_chip(struct + + ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); + if (ret < 0) { +- kfree(lasi); +- return ret; ++ goto err_free; + } + + /* enable IRQ's for devices below LASI */ +@@ -203,8 +202,7 @@ static int __init lasi_init_chip(struct + /* Done init'ing, register this driver */ + ret = gsc_common_setup(dev, lasi); + if (ret) { +- kfree(lasi); +- return ret; ++ goto err_irq; + } + + gsc_fixup_irqs(dev, lasi, lasi_choose_irq); +@@ -214,6 +212,12 @@ static int __init lasi_init_chip(struct + SYS_OFF_PRIO_DEFAULT, lasi_power_off, lasi); + + return ret; ++ ++err_irq: ++ free_irq(lasi->gsc_irq.irq, lasi); ++err_free: ++ kfree(lasi); ++ return ret; + } + + static struct parisc_device_id lasi_tbl[] __initdata = { diff --git a/queue-6.12/series b/queue-6.12/series index 1f370bc7de..783a96be2c 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -76,3 +76,32 @@ kvm-arm64-fix-kvm_vcpu_initialized-macro-parameter.patch mtd-spi-nor-debugfs-fix-out-of-bounds-read-in-spi_nor_params_show.patch loongarch-fix-sym_sigfunc_start-definition-for-32bit.patch net-rtnetlink-zero-ifla_vf_broadcast-to-avoid-stack-infoleak-in-rtnl_fill_vfinfo.patch +sound-ua101-fix-division-by-zero-at-probe.patch +net-libwx-fix-vf-illegal-register-access.patch +ip6_gre-use-cached-t-net-in-ip6erspan_changelink.patch +net-rds-handle-zerocopy-send-cleanup-before-the-message-is-queued.patch +net-wwan-t7xx-validate-port_count-against-message-length-in-t7xx_port_enum_msg_handler.patch +parisc-fix-irq-leak-in-lasi-driver.patch +hwmon-ltc2992-clamp-threshold-writes-to-hardware-range.patch +hwmon-ltc2992-fix-u32-overflow-in-power-read-path.patch +clk-rk808-fix-of-node-reference-imbalance.patch +hwmon-corsair-psu-close-hid-device-on-probe-errors.patch +af_unix-reject-siocatmark-on-non-stream-sockets.patch +block-add-pgmap-check-to-biovec_phys_mergeable.patch +cifs-abort-open_cached_dir-if-we-don-t-request-leases.patch +cifs-change_conf-needs-to-be-called-for-session-setup.patch +extcon-ptn5150-handle-pending-irq-events-during-system-resume.patch +gpio-of-clear-of_populated-on-hog-nodes-in-remove-path.patch +hv_sock-fix-arm64-support.patch +ibmveth-disable-gso-for-packets-with-small-mss.patch +ice-fix-double-free-in-ice_sf_eth_activate-error-path.patch +spi-microchip-core-qspi-fix-controller-deregistration.patch +udf-reject-descriptors-with-oversized-crc-length.patch +thermal-core-free-thermal-zone-id-later-during-removal.patch +thermal-drivers-sprd-fix-temperature-clamping-in-sprd_thm_temp_to_rawdata.patch +thermal-drivers-sprd-fix-raw-temperature-clamping-in-sprd_thm_rawdata_to_temp.patch +spi-topcliff-pch-fix-controller-deregistration.patch +spi-topcliff-pch-fix-use-after-free-on-unbind.patch +clk-imx-imx8-acm-fix-flags-for-acm-clocks.patch +clk-microchip-mpfs-ccc-fix-out-of-bounds-access-during-output-registration.patch +cpuidle-powerpc-avoid-double-clear-when-breaking-snooze.patch diff --git a/queue-6.12/sound-ua101-fix-division-by-zero-at-probe.patch b/queue-6.12/sound-ua101-fix-division-by-zero-at-probe.patch new file mode 100644 index 0000000000..9c247f100f --- /dev/null +++ b/queue-6.12/sound-ua101-fix-division-by-zero-at-probe.patch @@ -0,0 +1,45 @@ +From d1f73f169c1014463b5060e3f60813e13ddc7b87 Mon Sep 17 00:00:00 2001 +From: SeungJu Cheon +Date: Sun, 26 Apr 2026 20:12:39 +0900 +Subject: sound: ua101: fix division by zero at probe + +From: SeungJu Cheon + +commit d1f73f169c1014463b5060e3f60813e13ddc7b87 upstream. + +Add a missing sanity check for bNrChannels in detect_usb_format() +to prevent a division by zero in playback_urb_complete() and +capture_urb_complete(). + +USB core does not validate class-specific descriptor fields such +as bNrChannels, so drivers must verify them before use. If a +device provides bNrChannels = 0, frame_bytes becomes zero and is +later used as a divisor in the URB completion handlers, leading +to a kernel crash. + +Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support") +Cc: stable@vger.kernel.org +Signed-off-by: SeungJu Cheon +Link: https://patch.msgid.link/20260426111239.103296-1-suunj1331@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/misc/ua101.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/usb/misc/ua101.c ++++ b/sound/usb/misc/ua101.c +@@ -994,6 +994,13 @@ static int detect_usb_format(struct ua10 + + ua->capture.channels = fmt_capture->bNrChannels; + ua->playback.channels = fmt_playback->bNrChannels; ++ if (!ua->capture.channels || !ua->playback.channels) { ++ dev_err(&ua->dev->dev, ++ "invalid channel count: capture %u, playback %u\n", ++ ua->capture.channels, ua->playback.channels); ++ return -EINVAL; ++ } ++ + ua->capture.frame_bytes = + fmt_capture->bSubframeSize * ua->capture.channels; + ua->playback.frame_bytes = diff --git a/queue-6.12/spi-microchip-core-qspi-fix-controller-deregistration.patch b/queue-6.12/spi-microchip-core-qspi-fix-controller-deregistration.patch new file mode 100644 index 0000000000..10db7fcaa3 --- /dev/null +++ b/queue-6.12/spi-microchip-core-qspi-fix-controller-deregistration.patch @@ -0,0 +1,60 @@ +From e6464140d439f2d42f072eb422a5b1fec470c5a6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:17 +0200 +Subject: spi: microchip-core-qspi: fix controller deregistration + +From: Johan Hovold + +commit e6464140d439f2d42f072eb422a5b1fec470c5a6 upstream. + +Make sure to deregister the controller before disabling underlying +resources like interrupts during driver unbind. + +Fixes: 8596124c4c1b ("spi: microchip-core-qspi: Add support for microchip fpga qspi controllers") +Cc: stable@vger.kernel.org # 6.1 +Cc: Naga Sureshkumar Relli +Signed-off-by: Johan Hovold +Acked-by: Conor Dooley +Link: https://patch.msgid.link/20260409120419.388546-19-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-microchip-core-qspi.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-microchip-core-qspi.c ++++ b/drivers/spi/spi-microchip-core-qspi.c +@@ -512,7 +512,7 @@ static int mchp_coreqspi_probe(struct pl + "unable to allocate host for QSPI controller\n"); + + qspi = spi_controller_get_devdata(ctlr); +- platform_set_drvdata(pdev, qspi); ++ platform_set_drvdata(pdev, ctlr); + + qspi->regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(qspi->regs)) +@@ -545,7 +545,7 @@ static int mchp_coreqspi_probe(struct pl + SPI_TX_DUAL | SPI_TX_QUAD; + ctlr->dev.of_node = np; + +- ret = devm_spi_register_controller(&pdev->dev, ctlr); ++ ret = spi_register_controller(ctlr); + if (ret) + return dev_err_probe(&pdev->dev, ret, + "spi_register_controller failed\n"); +@@ -555,9 +555,13 @@ static int mchp_coreqspi_probe(struct pl + + static void mchp_coreqspi_remove(struct platform_device *pdev) + { +- struct mchp_coreqspi *qspi = platform_get_drvdata(pdev); +- u32 control = readl_relaxed(qspi->regs + REG_CONTROL); ++ struct spi_controller *ctlr = platform_get_drvdata(pdev); ++ struct mchp_coreqspi *qspi = spi_controller_get_devdata(ctlr); ++ u32 control; + ++ spi_unregister_controller(ctlr); ++ ++ control = readl_relaxed(qspi->regs + REG_CONTROL); + mchp_coreqspi_disable_ints(qspi); + control &= ~CONTROL_ENABLE; + writel_relaxed(control, qspi->regs + REG_CONTROL); diff --git a/queue-6.12/spi-topcliff-pch-fix-controller-deregistration.patch b/queue-6.12/spi-topcliff-pch-fix-controller-deregistration.patch new file mode 100644 index 0000000000..b79e0f4bc6 --- /dev/null +++ b/queue-6.12/spi-topcliff-pch-fix-controller-deregistration.patch @@ -0,0 +1,46 @@ +From 5d6f477d6fc0767c57c5e1e6f55a1662820eef87 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 14 Apr 2026 15:43:18 +0200 +Subject: spi: topcliff-pch: fix controller deregistration + +From: Johan Hovold + +commit 5d6f477d6fc0767c57c5e1e6f55a1662820eef87 upstream. + +Make sure to deregister the controller before disabling and releasing +underlying resources like interrupts and DMA during driver unbind. + +Fixes: e8b17b5b3f30 ("spi/topcliff: Add topcliff platform controller hub (PCH) spi bus driver") +Cc: stable@vger.kernel.org # 2.6.37 +Cc: Masayuki Ohtake +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260414134319.978196-8-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-topcliff-pch.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-topcliff-pch.c ++++ b/drivers/spi/spi-topcliff-pch.c +@@ -1406,6 +1406,10 @@ static void pch_spi_pd_remove(struct pla + dev_dbg(&plat_dev->dev, "%s:[ch%d] irq=%d\n", + __func__, plat_dev->id, board_dat->pdev->irq); + ++ spi_controller_get(data->host); ++ ++ spi_unregister_controller(data->host); ++ + if (use_dma) + pch_free_dma_buf(board_dat, data); + +@@ -1433,7 +1437,8 @@ static void pch_spi_pd_remove(struct pla + } + + pci_iounmap(board_dat->pdev, data->io_remap_addr); +- spi_unregister_controller(data->host); ++ ++ spi_controller_put(data->host); + } + #ifdef CONFIG_PM + static int pch_spi_pd_suspend(struct platform_device *pd_dev, diff --git a/queue-6.12/spi-topcliff-pch-fix-use-after-free-on-unbind.patch b/queue-6.12/spi-topcliff-pch-fix-use-after-free-on-unbind.patch new file mode 100644 index 0000000000..8c07a94a8c --- /dev/null +++ b/queue-6.12/spi-topcliff-pch-fix-use-after-free-on-unbind.patch @@ -0,0 +1,45 @@ +From 9d72732fe70c11424bc90ed466c7ccfa58b42a9a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 14 Apr 2026 15:43:19 +0200 +Subject: spi: topcliff-pch: fix use-after-free on unbind + +From: Johan Hovold + +commit 9d72732fe70c11424bc90ed466c7ccfa58b42a9a upstream. + +Give the driver a chance to flush its queue before releasing the DMA +buffers on driver unbind + +Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support") +Cc: stable@vger.kernel.org # 3.1 +Cc: Tomoya MORINAGA +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-topcliff-pch.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-topcliff-pch.c ++++ b/drivers/spi/spi-topcliff-pch.c +@@ -1410,9 +1410,6 @@ static void pch_spi_pd_remove(struct pla + + spi_unregister_controller(data->host); + +- if (use_dma) +- pch_free_dma_buf(board_dat, data); +- + /* check for any pending messages; no action is taken if the queue + * is still full; but at least we tried. Unload anyway */ + count = 500; +@@ -1436,6 +1433,9 @@ static void pch_spi_pd_remove(struct pla + free_irq(board_dat->pdev->irq, data); + } + ++ if (use_dma) ++ pch_free_dma_buf(board_dat, data); ++ + pci_iounmap(board_dat->pdev, data->io_remap_addr); + + spi_controller_put(data->host); diff --git a/queue-6.12/thermal-core-free-thermal-zone-id-later-during-removal.patch b/queue-6.12/thermal-core-free-thermal-zone-id-later-during-removal.patch new file mode 100644 index 0000000000..3f65848c72 --- /dev/null +++ b/queue-6.12/thermal-core-free-thermal-zone-id-later-during-removal.patch @@ -0,0 +1,60 @@ +From daae9c18feec74566e023fc88cfb0ce26e39d868 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 7 Apr 2026 15:58:34 +0200 +Subject: thermal: core: Free thermal zone ID later during removal + +From: Rafael J. Wysocki + +commit daae9c18feec74566e023fc88cfb0ce26e39d868 upstream. + +The thermal zone removal ordering is different from the thermal zone +registration rollback path ordering and the former is arguably +problematic because freeing a thermal zone ID prematurely may cause +it to be used during the registration of another thermal zone which +may fail as a result. + +Prevent that from occurring by changing the thermal zone removal +ordering to reflect the thermal zone registration rollback path +ordering. + +Also more the ida_destroy() call from thermal_zone_device_unregister() +to thermal_release() for consistency. + +Fixes: b31ef8285b19 ("thermal core: convert ID allocation to IDA") +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/5063934.GXAFRqVoOG@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/thermal_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -918,6 +918,7 @@ static void thermal_release(struct devic + tz = to_thermal_zone(dev); + thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); ++ ida_destroy(&tz->ida); + mutex_destroy(&tz->lock); + complete(&tz->removal); + } else if (!strncmp(dev_name(dev), "cooling_device", +@@ -1634,8 +1635,6 @@ void thermal_zone_device_unregister(stru + cancel_delayed_work_sync(&tz->poll_queue); + + thermal_remove_hwmon_sysfs(tz); +- ida_free(&thermal_tz_ida, tz->id); +- ida_destroy(&tz->ida); + + device_del(&tz->device); + put_device(&tz->device); +@@ -1643,6 +1642,9 @@ void thermal_zone_device_unregister(stru + thermal_notify_tz_delete(tz); + + wait_for_completion(&tz->removal); ++ ++ ida_free(&thermal_tz_ida, tz->id); ++ + kfree(tz->tzp); + kfree(tz); + } diff --git a/queue-6.12/thermal-drivers-sprd-fix-raw-temperature-clamping-in-sprd_thm_rawdata_to_temp.patch b/queue-6.12/thermal-drivers-sprd-fix-raw-temperature-clamping-in-sprd_thm_rawdata_to_temp.patch new file mode 100644 index 0000000000..84710b7a48 --- /dev/null +++ b/queue-6.12/thermal-drivers-sprd-fix-raw-temperature-clamping-in-sprd_thm_rawdata_to_temp.patch @@ -0,0 +1,38 @@ +From b3414148bbc1f9cd56217e58a558c6ac4fd1b4a6 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sat, 7 Mar 2026 11:24:21 +0100 +Subject: thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp + +From: Thorsten Blum + +commit b3414148bbc1f9cd56217e58a558c6ac4fd1b4a6 upstream. + +The raw temperature data was never clamped to SPRD_THM_RAW_DATA_LOW or +SPRD_THM_RAW_DATA_HIGH because the return value of clamp() was not used. +Fix this by assigning the clamped value to 'rawdata'. + +Casting SPRD_THM_RAW_DATA_LOW and SPRD_THM_RAW_DATA_HIGH to u32 is also +redundant and can be removed. + +Fixes: 554fdbaf19b1 ("thermal: sprd: Add Spreadtrum thermal driver support") +Signed-off-by: Thorsten Blum +Signed-off-by: Daniel Lezcano +Reviewed-by: Baolin Wang +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260307102422.306055-2-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/sprd_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/thermal/sprd_thermal.c ++++ b/drivers/thermal/sprd_thermal.c +@@ -178,7 +178,7 @@ static int sprd_thm_sensor_calibration(s + static int sprd_thm_rawdata_to_temp(struct sprd_thermal_sensor *sen, + u32 rawdata) + { +- clamp(rawdata, (u32)SPRD_THM_RAW_DATA_LOW, (u32)SPRD_THM_RAW_DATA_HIGH); ++ rawdata = clamp(rawdata, SPRD_THM_RAW_DATA_LOW, SPRD_THM_RAW_DATA_HIGH); + + /* + * According to the thermal datasheet, the formula of converting diff --git a/queue-6.12/thermal-drivers-sprd-fix-temperature-clamping-in-sprd_thm_temp_to_rawdata.patch b/queue-6.12/thermal-drivers-sprd-fix-temperature-clamping-in-sprd_thm_temp_to_rawdata.patch new file mode 100644 index 0000000000..f6a868ccb3 --- /dev/null +++ b/queue-6.12/thermal-drivers-sprd-fix-temperature-clamping-in-sprd_thm_temp_to_rawdata.patch @@ -0,0 +1,38 @@ +From 83c0f9a5d679a6f8d84fc49b2f62ea434ccab4b6 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sat, 7 Mar 2026 11:24:20 +0100 +Subject: thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata + +From: Thorsten Blum + +commit 83c0f9a5d679a6f8d84fc49b2f62ea434ccab4b6 upstream. + +The temperature was never clamped to SPRD_THM_TEMP_LOW or +SPRD_THM_TEMP_HIGH because the return value of clamp() was not used. Fix +this by assigning the clamped value to 'temp'. + +Casting SPRD_THM_TEMP_LOW and SPRD_THM_TEMP_HIGH to int is also +redundant and can be removed. + +Fixes: 554fdbaf19b1 ("thermal: sprd: Add Spreadtrum thermal driver support") +Signed-off-by: Thorsten Blum +Signed-off-by: Daniel Lezcano +Reviewed-by: Baolin Wang +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260307102422.306055-1-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/sprd_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/thermal/sprd_thermal.c ++++ b/drivers/thermal/sprd_thermal.c +@@ -192,7 +192,7 @@ static int sprd_thm_temp_to_rawdata(int + { + u32 val; + +- clamp(temp, (int)SPRD_THM_TEMP_LOW, (int)SPRD_THM_TEMP_HIGH); ++ temp = clamp(temp, SPRD_THM_TEMP_LOW, SPRD_THM_TEMP_HIGH); + + /* + * According to the thermal datasheet, the formula of converting diff --git a/queue-6.12/udf-reject-descriptors-with-oversized-crc-length.patch b/queue-6.12/udf-reject-descriptors-with-oversized-crc-length.patch new file mode 100644 index 0000000000..0339628f8a --- /dev/null +++ b/queue-6.12/udf-reject-descriptors-with-oversized-crc-length.patch @@ -0,0 +1,48 @@ +From 55d41b0a20128e86b9e960dd2e3f0a2d69a18df7 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Mon, 13 Apr 2026 17:12:40 -0400 +Subject: udf: reject descriptors with oversized CRC length + +From: Michael Bommarito + +commit 55d41b0a20128e86b9e960dd2e3f0a2d69a18df7 upstream. + +udf_read_tagged() skips CRC verification when descCRCLength + +sizeof(struct tag) exceeds the block size. A crafted UDF image can +set descCRCLength to an oversized value to bypass CRC validation +entirely; the descriptor is then accepted based solely on the 8-bit +tag checksum, which is trivially recomputable. + +Reject such descriptors instead of silently accepting them. A +legitimate single-block descriptor should never have a CRC length that +exceeds the block. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-6 +Assisted-by: Codex:gpt-5-4 +Signed-off-by: Michael Bommarito +Link: https://patch.msgid.link/20260413211240.853662-1-michael.bommarito@gmail.com +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +--- + fs/udf/misc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/udf/misc.c ++++ b/fs/udf/misc.c +@@ -230,8 +230,12 @@ struct buffer_head *udf_read_tagged(stru + } + + /* Verify the descriptor CRC */ +- if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize || +- le16_to_cpu(tag_p->descCRC) == crc_itu_t(0, ++ if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize) { ++ udf_err(sb, "block %u: CRC length %u exceeds block size\n", ++ block, le16_to_cpu(tag_p->descCRCLength)); ++ goto error_out; ++ } ++ if (le16_to_cpu(tag_p->descCRC) == crc_itu_t(0, + bh->b_data + sizeof(struct tag), + le16_to_cpu(tag_p->descCRCLength))) + return bh;