--- /dev/null
+From 130ff5c8b78e6fd05270a04985c50bce6a3de6c1 Mon Sep 17 00:00:00 2001
+From: Niklas Cassel <cassel@kernel.org>
+Date: Tue, 25 Feb 2025 15:16:12 +0100
+Subject: ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Cassel <cassel@kernel.org>
+
+commit 130ff5c8b78e6fd05270a04985c50bce6a3de6c1 upstream.
+
+Commit 8c87215dd3a2 ("ata: libahci_platform: support non-consecutive port
+numbers") added a skip to ahci_platform_enable_phys() for ports that are
+not in mask_port_map.
+
+The code in ahci_platform_get_resources(), will currently set mask_port_map
+for each child "port" node it finds in the device tree.
+
+However, device trees that do not have any child "port" nodes will not have
+mask_port_map set, and for non-device tree platforms mask_port_map will
+only exist as a quirk for specific PCI device + vendor IDs, or as a kernel
+module parameter, but will not be set by default.
+
+Therefore, the common thing is that mask_port_map is only set if you do not
+want to use all ports (as defined by Offset 0Ch: PI – Ports Implemented
+register), but instead only want to use the ports in mask_port_map. If
+mask_port_map is not set, all ports are available.
+
+Thus, ahci_ignore_port() must be able to handle an empty mask_port_map.
+
+Fixes: 8c87215dd3a2 ("ata: libahci_platform: support non-consecutive port numbers")
+Fixes: 2c202e6c4f4d ("ata: libahci_platform: Do not set mask_port_map when not needed")
+Fixes: c9b5be909e65 ("ahci: Introduce ahci_ignore_port() helper")
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Closes: https://lore.kernel.org/linux-ide/10b31dd0-d0bb-4f76-9305-2195c3e17670@samsung.com/
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Co-developed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20250225141612.942170-2-cassel@kernel.org
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/ahci.h | 8 ++++++--
+ drivers/ata/libahci.c | 1 +
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -387,8 +387,12 @@ struct ahci_host_priv {
+ static inline bool ahci_ignore_port(struct ahci_host_priv *hpriv,
+ unsigned int portid)
+ {
+- return portid >= hpriv->nports ||
+- !(hpriv->mask_port_map & (1 << portid));
++ if (portid >= hpriv->nports)
++ return true;
++ /* mask_port_map not set means that all ports are available */
++ if (!hpriv->mask_port_map)
++ return false;
++ return !(hpriv->mask_port_map & (1 << portid));
+ }
+
+ extern int ahci_ignore_sss;
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -542,6 +542,7 @@ void ahci_save_initial_config(struct dev
+ hpriv->saved_port_map = port_map;
+ }
+
++ /* mask_port_map not set means that all ports are available */
+ if (hpriv->mask_port_map) {
+ dev_warn(dev, "masking port_map 0x%lx -> 0x%lx\n",
+ port_map,
--- /dev/null
+From 0786469ee242952008628ed0e2d386098e2065ab Mon Sep 17 00:00:00 2001
+From: Pauli Virtanen <pav@iki.fi>
+Date: Fri, 24 Jul 2026 23:20:24 +0300
+Subject: Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
+
+From: Pauli Virtanen <pav@iki.fi>
+
+commit 0786469ee242952008628ed0e2d386098e2065ab upstream.
+
+Commit d57e506f6a1e ("Bluetooth: ISO: clear iso_data always when detaching conn from hcon")
+merged a version of the UAF fix that breaks releasing connected
+ISO sockets. Since hci_conn::iso_data is set to NULL, iso_chan_del() won't
+be called when the hci_conn disconnects, and the ISO socket does not emit
+POLLHUP correctly.
+
+Fix by retaining full hci_conn <-> iso_conn association while in
+BT_DISCONNECT state, so that local disconnect via shutdown() follows
+similar ISO socket code path as remote disconnect. Use a separate flag
+to track whether hci_conn_drop() is needed, instead of setting
+iso_conn::hcon = NULL
+
+In iso_sock_ready(), disallow disconnecting socket going BT_CONNECTED,
+in case hcon connects while its drop is pending.
+
+Fixes: d57e506f6a1e ("Bluetooth: ISO: clear iso_data always when detaching conn from hcon")
+Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/iso.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -23,8 +23,14 @@ static struct bt_sock_list iso_sk_list =
+ };
+
+ /* ---- ISO connections ---- */
++enum {
++ ISO_CONN_DROPPED,
++ __ISO_CONN_NUM_FLAGS
++};
++
+ struct iso_conn {
+ struct hci_conn *hcon;
++ DECLARE_BITMAP(flags, __ISO_CONN_NUM_FLAGS);
+
+ /* @lock: spinlock protecting changes to iso_conn fields */
+ spinlock_t lock;
+@@ -105,7 +111,8 @@ static void iso_conn_free(struct kref *r
+
+ if (conn->hcon) {
+ conn->hcon->iso_data = NULL;
+- hci_conn_drop(conn->hcon);
++ if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags))
++ hci_conn_drop(conn->hcon);
+ }
+
+ kfree_skb(conn->rx_skb);
+@@ -299,6 +306,7 @@ static int __iso_chan_add(struct iso_con
+
+ iso_pi(sk)->conn = conn;
+ conn->sk = sk;
++ clear_bit(ISO_CONN_DROPPED, conn->flags);
+
+ if (parent)
+ bt_accept_enqueue(parent, sk, true);
+@@ -813,11 +821,8 @@ static void iso_sock_disconn(struct sock
+ }
+
+ sk->sk_state = BT_DISCONN;
+- iso_conn_lock(iso_pi(sk)->conn);
+- hci_conn_drop(iso_pi(sk)->conn->hcon);
+- iso_pi(sk)->conn->hcon->iso_data = NULL;
+- iso_pi(sk)->conn->hcon = NULL;
+- iso_conn_unlock(iso_pi(sk)->conn);
++ if (!test_and_set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags))
++ hci_conn_drop(iso_pi(sk)->conn->hcon);
+ }
+
+ static void __iso_sock_close(struct sock *sk)
+@@ -1894,9 +1899,18 @@ static void iso_sock_ready(struct sock *
+ return;
+
+ lock_sock(sk);
++
++ switch (sk->sk_state) {
++ case BT_DISCONN:
++ case BT_CLOSED:
++ release_sock(sk);
++ return;
++ }
++
+ iso_sock_clear_timer(sk);
+ sk->sk_state = BT_CONNECTED;
+ sk->sk_state_change(sk);
++
+ release_sock(sk);
+ }
+
--- /dev/null
+From e1686ca81dbf3edbde589b7daf312b45cbf76e03 Mon Sep 17 00:00:00 2001
+From: Wandun Chen <chenwandun@lixiang.com>
+Date: Thu, 4 Jun 2026 09:53:32 +0800
+Subject: of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
+
+From: Wandun Chen <chenwandun@lixiang.com>
+
+commit e1686ca81dbf3edbde589b7daf312b45cbf76e03 upstream.
+
+The global pointer 'reserved_mem' continues to reference the
+reserved_mem_array which lives in __initdata if
+alloc_reserved_mem_array() fails. of_reserved_mem_lookup() is
+exported for post-init use, that would dereference freed memory
+and trigger a use-after-free.
+
+So reset reserved_mem_count to 0 when alloc_reserved_mem_array()
+fails.
+
+Fixes: 00c9a452a235 ("of: reserved_mem: Add code to dynamically allocate reserved_mem array")
+Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
+Link: https://patch.msgid.link/20260604015332.3669384-1-chenwandun1@gmail.com
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/of_reserved_mem.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/of/of_reserved_mem.c
++++ b/drivers/of/of_reserved_mem.c
+@@ -70,29 +70,32 @@ static int __init early_init_dt_alloc_re
+ * the initial static array is copied over to this new array and
+ * the new array is used from this point on.
+ */
+-static void __init alloc_reserved_mem_array(void)
++static int __init alloc_reserved_mem_array(void)
+ {
+ struct reserved_mem *new_array;
+ size_t alloc_size, copy_size, memset_size;
++ int ret;
++
++ if (!total_reserved_mem_cnt)
++ return 0;
+
+ alloc_size = array_size(total_reserved_mem_cnt, sizeof(*new_array));
+ if (alloc_size == SIZE_MAX) {
+- pr_err("Failed to allocate memory for reserved_mem array with err: %d", -EOVERFLOW);
+- return;
++ ret = -EOVERFLOW;
++ goto fail;
+ }
+
+ new_array = memblock_alloc(alloc_size, SMP_CACHE_BYTES);
+ if (!new_array) {
+- pr_err("Failed to allocate memory for reserved_mem array with err: %d", -ENOMEM);
+- return;
++ ret = -ENOMEM;
++ goto fail;
+ }
+
+ copy_size = array_size(reserved_mem_count, sizeof(*new_array));
+ if (copy_size == SIZE_MAX) {
+ memblock_free(new_array, alloc_size);
+- total_reserved_mem_cnt = MAX_RESERVED_REGIONS;
+- pr_err("Failed to allocate memory for reserved_mem array with err: %d", -EOVERFLOW);
+- return;
++ ret = -EOVERFLOW;
++ goto fail;
+ }
+
+ memset_size = alloc_size - copy_size;
+@@ -101,6 +104,12 @@ static void __init alloc_reserved_mem_ar
+ memset(new_array + reserved_mem_count, 0, memset_size);
+
+ reserved_mem = new_array;
++ return 0;
++
++fail:
++ pr_err("Failed to allocate memory for reserved_mem array with err: %d", ret);
++ reserved_mem_count = 0;
++ return ret;
+ }
+
+ static void __init fdt_init_reserved_mem_node(struct reserved_mem *rmem);
+@@ -246,7 +255,8 @@ void __init fdt_scan_reserved_mem_reg_no
+ }
+
+ /* Attempt dynamic allocation of a new reserved_mem array */
+- alloc_reserved_mem_array();
++ if (alloc_reserved_mem_array())
++ return;
+
+ if (__reserved_mem_check_root(node)) {
+ pr_err("Reserved memory: unsupported node format, ignoring\n");
spi-spi-cadence-enable-spi_controller_must_tx.patch
hid-logitech-dj-fix-maxfield-check-in-dj-short-report-validation.patch
ata-libahci_platform-do-not-set-mask_port_map-when-not-needed.patch
+ata-ahci-make-ahci_ignore_port-handle-empty-mask_port_map.patch
+of-reserved_mem-avoid-post-init-uaf-when-alloc_reserved_mem_array-fails.patch
+bluetooth-iso-fix-connected-closed-transition-on-shutdown-release.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
