--- /dev/null
+From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Thu, 25 Jun 2026 22:18:37 +0800
+Subject: ata: pata_pxa: Fix DMA channel leak on probe error
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream.
+
+When dmaengine_slave_config() fails, the DMA channel acquired by
+dma_request_chan() is not released before returning the error,
+leaking the channel reference.
+
+Fix by adding dma_release_channel() in the error path.
+
+The ata_host_activate() error path already correctly releases the
+DMA channel.
+
+Cc: stable@vger.kernel.org
+Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/pata_pxa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/pata_pxa.c
++++ b/drivers/ata/pata_pxa.c
+@@ -287,6 +287,7 @@ static int pxa_ata_probe(struct platform
+ ret = dmaengine_slave_config(data->dma_chan, &config);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "dma configuration failed: %d\n", ret);
++ dma_release_channel(data->dma_chan);
+ return ret;
+ }
+
--- /dev/null
+From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Thu, 25 Jun 2026 08:48:34 +0800
+Subject: fsl/fman: Free init resources on KeyGen failure in fman_init()
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream.
+
+fman_muram_alloc() allocates initialization resources before
+initializing the KeyGen block. If keygen_init() fails, the
+function returns -EINVAL directly and leaves those resources
+allocated. Free the initialization resources before returning
+from the KeyGen failure path.
+
+Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen")
+Cc: stable@kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fman/fman.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -1995,8 +1995,10 @@ static int fman_init(struct fman *fman)
+
+ /* Init KeyGen */
+ fman->keygen = keygen_init(fman->kg_regs);
+- if (!fman->keygen)
++ if (!fman->keygen) {
++ free_init_resources(fman);
+ return -EINVAL;
++ }
+
+ err = enable(fman, cfg);
+ if (err != 0)
--- /dev/null
+From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001
+From: HyeongJun An <sammiee5311@gmail.com>
+Date: Fri, 19 Jun 2026 21:27:46 +0900
+Subject: hwmon: (asus_atk0110) Check package count before accessing element
+
+From: HyeongJun An <sammiee5311@gmail.com>
+
+commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream.
+
+atk_ec_present() walks the management group package returned by the GGRP
+ACPI method and, for each sub-package, reads its first element:
+
+ id = &obj->package.elements[0];
+ if (id->type != ACPI_TYPE_INTEGER)
+
+without checking that the sub-package is non-empty. ACPICA allocates the
+element array with exactly package.count entries, so for a sub-package
+with a zero count this reads past the allocation.
+
+The sibling function atk_debugfs_ggrp_open() performs the same access but
+skips empty packages with a package.count check first. Add the same
+check to atk_ec_present() so a malformed firmware package cannot trigger
+an out-of-bounds read.
+
+Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
+Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/asus_atk0110.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/hwmon/asus_atk0110.c
++++ b/drivers/hwmon/asus_atk0110.c
+@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat
+ if (obj->type != ACPI_TYPE_PACKAGE)
+ continue;
+
++ if (!obj->package.count)
++ continue;
++
+ id = &obj->package.elements[0];
+ if (id->type != ACPI_TYPE_INTEGER)
+ continue;
--- /dev/null
+From e31408734332b8cc611342cdaaab6ba492180156 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Fri, 19 Jun 2026 09:59:38 +0800
+Subject: hwmon: (occ) unregister sysfs devices outside occ lock
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit e31408734332b8cc611342cdaaab6ba492180156 upstream.
+
+occ_active(false) and occ_shutdown() unregister sysfs-backed devices while
+occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can
+wait for active sysfs callbacks to drain, and those callbacks can enter the
+OCC update path and try to take occ->lock again. That gives the unregister
+paths the lock ordering occ->lock -> sysfs callback drain, while a callback
+has the opposite edge sysfs callback -> occ->lock.
+
+This issue was found by our static analysis tool and then manually
+reviewed against the current tree.
+
+The grounded PoC kept the real unregister and callback carrier:
+
+ occ_shutdown()
+ hwmon_device_unregister()
+ occ_show_temp_1()
+ occ_update_response()
+
+Lockdep reported the circular dependency with occ_shutdown() already
+holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs
+side:
+
+ WARNING: possible circular locking dependency detected
+ ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]
+ ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]
+ occ_update_response.isra.0+0xb/0x20 [vuln_msv]
+ occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]
+ *** DEADLOCK ***
+
+Serialize hwmon registration and removal with a separate hwmon_lock.
+Under that lock, detach occ->hwmon and update occ->active while occ->lock
+is held so concurrent OCC state changes still see a stable state, then
+drop occ->lock before calling hwmon_device_unregister(). Remove the
+driver sysfs group before taking occ->lock in occ_shutdown(), so draining
+the driver attributes cannot wait while the OCC mutex is held. Also make
+OCC update callbacks return -ENODEV after deactivation, so callbacks that
+already passed sysfs active protection do not poll the hardware after
+teardown has detached the hwmon device.
+
+Fixes: 849b0156d996 ("hwmon: (occ) Delay hwmon registration until user request")
+Fixes: ac6888ac5a11 ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Link: https://lore.kernel.org/r/20260619015938.494464-1-runyu.xiao@seu.edu.cn
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/occ/common.c | 34 ++++++++++++++++++++++++++++------
+ drivers/hwmon/occ/common.h | 1 +
+ 2 files changed, 29 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -214,6 +214,11 @@ int occ_update_response(struct occ *occ)
+ if (rc)
+ return rc;
+
++ if (!occ->active) {
++ rc = -ENODEV;
++ goto unlock;
++ }
++
+ /* limit the maximum rate of polling the OCC */
+ if (time_after(jiffies, occ->next_update)) {
+ rc = occ_poll(occ);
+@@ -222,6 +227,7 @@ int occ_update_response(struct occ *occ)
+ rc = occ->last_error;
+ }
+
++unlock:
+ mutex_unlock(&occ->lock);
+ return rc;
+ }
+@@ -1105,11 +1111,16 @@ static void occ_parse_poll_response(stru
+
+ int occ_active(struct occ *occ, bool active)
+ {
+- int rc = mutex_lock_interruptible(&occ->lock);
++ struct device *hwmon = NULL;
++ int rc = mutex_lock_interruptible(&occ->hwmon_lock);
+
+ if (rc)
+ return rc;
+
++ rc = mutex_lock_interruptible(&occ->lock);
++ if (rc)
++ goto unlock_hwmon;
++
+ if (active) {
+ if (occ->active) {
+ rc = -EALREADY;
+@@ -1154,14 +1165,17 @@ int occ_active(struct occ *occ, bool act
+ goto unlock;
+ }
+
+- if (occ->hwmon)
+- hwmon_device_unregister(occ->hwmon);
++ hwmon = occ->hwmon;
+ occ->active = false;
+ occ->hwmon = NULL;
+ }
+
+ unlock:
+ mutex_unlock(&occ->lock);
++ if (hwmon)
++ hwmon_device_unregister(hwmon);
++unlock_hwmon:
++ mutex_unlock(&occ->hwmon_lock);
+ return rc;
+ }
+
+@@ -1170,6 +1184,7 @@ int occ_setup(struct occ *occ)
+ int rc;
+
+ mutex_init(&occ->lock);
++ mutex_init(&occ->hwmon_lock);
+ occ->groups[0] = &occ->group;
+
+ rc = occ_setup_sysfs(occ);
+@@ -1190,15 +1205,22 @@ EXPORT_SYMBOL_GPL(occ_setup);
+
+ void occ_shutdown(struct occ *occ)
+ {
+- mutex_lock(&occ->lock);
++ struct device *hwmon;
+
+ occ_shutdown_sysfs(occ);
+
+- if (occ->hwmon)
+- hwmon_device_unregister(occ->hwmon);
++ mutex_lock(&occ->hwmon_lock);
++ mutex_lock(&occ->lock);
++
++ hwmon = occ->hwmon;
++ occ->active = false;
+ occ->hwmon = NULL;
+
+ mutex_unlock(&occ->lock);
++
++ if (hwmon)
++ hwmon_device_unregister(hwmon);
++ mutex_unlock(&occ->hwmon_lock);
+ }
+ EXPORT_SYMBOL_GPL(occ_shutdown);
+
+--- a/drivers/hwmon/occ/common.h
++++ b/drivers/hwmon/occ/common.h
+@@ -101,6 +101,7 @@ struct occ {
+
+ unsigned long next_update;
+ struct mutex lock; /* lock OCC access */
++ struct mutex hwmon_lock; /* serialize hwmon registration/removal */
+
+ struct device *hwmon;
+ struct occ_attribute *attrs;
--- /dev/null
+From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Mon, 15 Jun 2026 14:47:31 +0800
+Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream.
+
+w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when
+VID information is available.
+
+The error path and remove callback only remove the common and optional
+attribute groups. Those groups do not contain cpu0_vid or vrm, so the
+files can remain after a later probe failure or after device removal
+while their callbacks still expect live driver data.
+
+Remove the standalone VID sysfs files from both the probe error path and
+the remove callback.
+
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83627hf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -1823,6 +1823,8 @@ static int w83627hf_probe(struct platfor
+ return 0;
+
+ error:
++ device_remove_file(dev, &dev_attr_vrm);
++ device_remove_file(dev, &dev_attr_cpu0_vid);
+ sysfs_remove_group(&dev->kobj, &w83627hf_group);
+ sysfs_remove_group(&dev->kobj, &w83627hf_group_opt);
+ return err;
+@@ -1834,6 +1836,8 @@ static int w83627hf_remove(struct platfo
+
+ hwmon_device_unregister(data->hwmon_dev);
+
++ device_remove_file(&pdev->dev, &dev_attr_vrm);
++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid);
+ sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group);
+ sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt);
+
--- /dev/null
+From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Mon, 15 Jun 2026 14:48:06 +0800
+Subject: hwmon: (w83793) remove vrm sysfs file on probe failure
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 77b983757280c69b0290811669ff1d31022e5f1d upstream.
+
+w83793_probe() creates the vrm sysfs file after creating the VID files
+when VID support is present.
+
+The normal remove path deletes vrm, but the probe error path only
+removes the sensor, SDA, VID, fan, PWM and temperature files. A later
+probe failure can therefore leave vrm behind after the driver data has
+been freed.
+
+Remove vrm in the probe error path next to the VID files, matching the
+normal remove path.
+
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83793.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/w83793.c
++++ b/drivers/hwmon/w83793.c
+@@ -1918,6 +1918,7 @@ exit_remove:
+
+ for (i = 0; i < ARRAY_SIZE(w83793_vid); i++)
+ device_remove_file(dev, &w83793_vid[i].dev_attr);
++ device_remove_file(dev, &dev_attr_vrm);
+
+ for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++)
+ device_remove_file(dev, &w83793_left_fan[i].dev_attr);
--- /dev/null
+From 39139b1c1c2b614096519b526112c726adb12ff0 Mon Sep 17 00:00:00 2001
+From: Andrea Righi <arighi@nvidia.com>
+Date: Fri, 26 Jun 2026 18:32:18 +0200
+Subject: net: lan743x: Initialize eth_syslock spinlock before use
+
+From: Andrea Righi <arighi@nvidia.com>
+
+commit 39139b1c1c2b614096519b526112c726adb12ff0 upstream.
+
+lan743x_hardware_init() calls pci11x1x_strap_get_status() during the
+PCI11x1x probe sequence. That helper acquires the Ethernet subsystem
+hardware lock via lan743x_hs_syslock_acquire(), which relies on
+adapter->eth_syslock_spinlock to serialize access.
+
+The spinlock is currently initialized only after the strap status is
+read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized
+spinlock can trip the spinlock debug check.
+
+Fix by initializing adapter->eth_syslock_spinlock before reading the
+strap status so the probe path never attempts to lock an uninitialized
+spinlock.
+
+Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G")
+Cc: stable@vger.kernel.org # v6.0+
+Signed-off-by: Andrea Righi <arighi@nvidia.com>
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Reviewed-by: Thangaraj Samynathan<Thangaraj.s@microchip.com>
+Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -3299,8 +3299,8 @@ static int lan743x_hardware_init(struct
+ adapter->max_tx_channels = PCI11X1X_MAX_TX_CHANNELS;
+ adapter->used_tx_channels = PCI11X1X_USED_TX_CHANNELS;
+ adapter->max_vector_count = PCI11X1X_MAX_VECTOR_COUNT;
+- pci11x1x_strap_get_status(adapter);
+ spin_lock_init(&adapter->eth_syslock_spinlock);
++ pci11x1x_strap_get_status(adapter);
+ mutex_init(&adapter->sgmii_rw_lock);
+ pci11x1x_set_rfe_rd_fifo_threshold(adapter);
+ sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL);
--- /dev/null
+From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Wed, 24 Jun 2026 14:40:13 +0800
+Subject: net: liquidio: fix BAR resource leak on PF number failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream.
+
+If cn23xx_get_pf_num() fails, the function returns without
+unmapping either BAR. Unmap both BARs before returning from
+the error path.
+
+Found by manual code review.
+
+Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+@@ -1332,18 +1332,14 @@ int setup_cn23xx_octeon_pf_device(struct
+ if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) {
+ dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n",
+ __func__);
+- octeon_unmap_pci_barx(oct, 0);
+- return 1;
++ goto err_unmap_bar0;
+ }
+
+ if (cn23xx_get_pf_num(oct) != 0)
+- return 1;
++ goto err_unmap_bar1;
+
+- if (cn23xx_sriov_config(oct)) {
+- octeon_unmap_pci_barx(oct, 0);
+- octeon_unmap_pci_barx(oct, 1);
+- return 1;
+- }
++ if (cn23xx_sriov_config(oct))
++ goto err_unmap_bar1;
+
+ octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL);
+
+@@ -1374,6 +1370,12 @@ int setup_cn23xx_octeon_pf_device(struct
+ oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct);
+
+ return 0;
++
++err_unmap_bar1:
++ octeon_unmap_pci_barx(oct, 1);
++err_unmap_bar0:
++ octeon_unmap_pci_barx(oct, 0);
++ return 1;
+ }
+ EXPORT_SYMBOL_GPL(setup_cn23xx_octeon_pf_device);
+
--- /dev/null
+From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Thu, 25 Jun 2026 04:51:20 -0500
+Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream.
+
+multiq_dequeue() takes a packet from a band's child with a direct
+->dequeue() call after multiq_peek() peeked it. When the child is
+non-work-conserving the peek stashes the skb in the child's gso_skb, so
+the direct dequeue returns a different skb and orphans the stash,
+desyncing the child's qlen/backlog. With a qfq child reached through a
+peeking parent (e.g. tbf) this re-enters the child on an emptied list and
+dereferences NULL, panicking the kernel from softirq on ordinary egress.
+
+Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
+and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
+when the child has no stash, so a work-conserving child is unaffected.
+
+Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_multiq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_multiq.c
++++ b/net/sched/sch_multiq.c
+@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st
+ if (!netif_xmit_stopped(
+ netdev_get_tx_queue(qdisc_dev(sch), q->curband))) {
+ qdisc = q->queues[q->curband];
+- skb = qdisc->dequeue(qdisc);
++ skb = qdisc_dequeue_peeked(qdisc);
+ if (skb) {
+ qdisc_bstats_update(sch, skb);
+ sch->q.qlen--;
--- /dev/null
+From e056e1dfcddca877dd46d704e8ec9860cfc9ec44 Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Thu, 25 Jun 2026 04:51:19 -0500
+Subject: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit e056e1dfcddca877dd46d704e8ec9860cfc9ec44 upstream.
+
+When taprio's software path peeks a non-work-conserving child qdisc, the
+child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq()
+then takes the packet with a direct child ->dequeue() call, which ignores
+that stash, orphans the peeked skb and desyncs the child's qlen/backlog.
+With a qfq child this re-enters the child on an emptied list and
+dereferences NULL, panicking the kernel from softirq on ordinary egress.
+
+Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb
+now do. The helper returns the child's stashed skb first and is a no-op
+when there is none, so a work-conserving child is unaffected and the
+gated path now consumes the skb whose length was charged to the budget.
+
+Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
+Cc: stable@vger.kernel.org
+Cc: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-1-85c40b83c529@proton.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -759,7 +759,7 @@ static struct sk_buff *taprio_dequeue_fr
+ return NULL;
+
+ skip_peek_checks:
+- skb = child->ops->dequeue(child);
++ skb = qdisc_dequeue_peeked(child);
+ if (unlikely(!skb))
+ return NULL;
+
--- /dev/null
+From 526b8ef54668780c8f69e0211c342763d5dcbad1 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Thu, 25 Jun 2026 14:17:28 +0800
+Subject: net: wwan: iosm: bound device offsets in the MUX downlink decoder
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 526b8ef54668780c8f69e0211c342763d5dcbad1 upstream.
+
+mux_dl_adb_decode() walks a chain of aggregated datagram tables using
+offsets and lengths taken from the modem. first_table_index,
+next_table_index, table_length, datagram_index and datagram_length are
+all device supplied le values. Only first_table_index was checked, and
+only for being non zero. The decoder then formed adth = block +
+adth_index and read the table header and the datagram entries with no
+bound against the received skb. A modem that reports an index or a
+length past the downlink buffer makes the decoder read out of bounds.
+
+The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most
+that, so skb->len is the real limit, but none of these in band offsets
+were checked against it.
+
+The table chain is also followed with no forward progress check. The loop
+takes the next table from adth->next_table_index and stops only when that
+reaches zero. A modem can stage two tables that point at each other, so
+the loop never ends. It runs in softirq and clones the skb on every pass.
+
+Validate every device offset and length against skb->len before use.
+The block header must fit. Each table header, on entry and after every
+next_table_index, must lie inside the skb. The datagram table must fit.
+Each datagram index and length must stay inside the skb. The header
+padding must not exceed the datagram length so the receive length does
+not wrap. Require each next_table_index to move forward so the chain
+cannot cycle.
+
+This was reproduced under KASAN as a slab out of bounds read on a normal
+downlink receive once the iosm net device is up.
+
+Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/178236824878.3259367.5389624724479864947@maoyixie.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 +++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
++++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
+@@ -553,19 +553,21 @@ static int mux_dl_process_dg(struct iosm
+ u32 packet_offset, i, rc, dg_len;
+
+ for (i = 0; i < nr_of_dg; i++, dg++) {
+- if (le32_to_cpu(dg->datagram_index)
+- < sizeof(struct mux_adbh))
++ u32 dg_index = le32_to_cpu(dg->datagram_index);
++
++ dg_len = le16_to_cpu(dg->datagram_length);
++
++ if (dg_index < sizeof(struct mux_adbh))
+ goto dg_error;
+
+- /* Is the packet inside of the ADB */
+- if (le32_to_cpu(dg->datagram_index) >=
+- le32_to_cpu(adbh->block_length)) {
++ /* Is the packet inside of the ADB and the received skb ? */
++ if (dg_index >= le32_to_cpu(adbh->block_length) ||
++ dg_index >= skb->len ||
++ dg_len > skb->len - dg_index ||
++ dl_head_pad_len >= dg_len) {
+ goto dg_error;
+ } else {
+- packet_offset =
+- le32_to_cpu(dg->datagram_index) +
+- dl_head_pad_len;
+- dg_len = le16_to_cpu(dg->datagram_length);
++ packet_offset = dg_index + dl_head_pad_len;
+ /* Pass the packet to the netif layer. */
+ rc = ipc_mux_net_receive(ipc_mux, if_id, ipc_mux->wwan,
+ packet_offset,
+@@ -589,12 +591,16 @@ static void mux_dl_adb_decode(struct ios
+ struct mux_adbh *adbh;
+ struct mux_adth *adth;
+ int nr_of_dg, if_id;
+- u32 adth_index;
++ u32 adth_index, prev_index = 0;
+ u8 *block;
+
+ block = skb->data;
+ adbh = (struct mux_adbh *)block;
+
++ /* The block header itself must fit in the received skb. */
++ if (skb->len < sizeof(struct mux_adbh))
++ goto adb_decode_err;
++
+ /* Process the aggregated datagram tables. */
+ adth_index = le32_to_cpu(adbh->first_table_index);
+
+@@ -606,6 +612,16 @@ static void mux_dl_adb_decode(struct ios
+
+ /* Loop through mixed session tables. */
+ while (adth_index) {
++ /* The table header must lie within the received skb, and the
++ * chain must move forward so a modem cannot make the loop
++ * cycle between two tables.
++ */
++ if (adth_index <= prev_index ||
++ adth_index < sizeof(struct mux_adbh) ||
++ adth_index > skb->len - sizeof(struct mux_adth))
++ goto adb_decode_err;
++ prev_index = adth_index;
++
+ /* Get the reference to the table header. */
+ adth = (struct mux_adth *)(block + adth_index);
+
+@@ -629,6 +645,10 @@ static void mux_dl_adb_decode(struct ios
+ if (le16_to_cpu(adth->table_length) < sizeof(struct mux_adth))
+ goto adb_decode_err;
+
++ /* The whole datagram table must fit in the received skb. */
++ if (le16_to_cpu(adth->table_length) > skb->len - adth_index)
++ goto adb_decode_err;
++
+ /* Calculate the number of datagrams. */
+ nr_of_dg = (le16_to_cpu(adth->table_length) -
+ sizeof(struct mux_adth)) /
--- /dev/null
+From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Fri, 19 Jun 2026 04:38:20 -0500
+Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part()
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream.
+
+fill_from_part() computes the size of a directory entry in size_t but
+stores it in a __u32. An entry length near U32_MAX wraps it to a small
+value, bypasses the bounds check, and is then used to index the entry,
+reading far past the directory part -- an out-of-bounds read that oopses
+the kernel.
+
+Compute the size as a u64 so it cannot truncate; the bounds check then
+rejects the entry. The trailer is supplied by the userspace client.
+
+Fixes: 480e3e532e31 ("orangefs: support very large directories")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/orangefs/dir.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/fs/orangefs/dir.c
++++ b/fs/orangefs/dir.c
+@@ -191,7 +191,8 @@ static int fill_from_part(struct orangef
+ {
+ const int offset = sizeof(struct orangefs_readdir_response_s);
+ struct orangefs_khandle *khandle;
+- __u32 *len, padlen;
++ __u32 *len;
++ u64 padlen;
+ loff_t i;
+ char *s;
+ i = ctx->pos & ~PART_MASK;
+@@ -215,8 +216,8 @@ static int fill_from_part(struct orangef
+ * len is the size of the string itself. padlen is the
+ * total size of the encoded string.
+ */
+- padlen = (sizeof *len + *len + 1) +
+- (8 - (sizeof *len + *len + 1)%8)%8;
++ padlen = (u64)sizeof *len + *len + 1;
++ padlen += (8 - padlen % 8) % 8;
+ if (part->len < i + padlen + sizeof *khandle)
+ goto next;
+ s = (void *)part + offset + i + sizeof *len;
--- /dev/null
+From bc7b086a45521a986a49045907f017e3e46c763e Mon Sep 17 00:00:00 2001
+From: Martin Kaiser <martin@kaiser.cx>
+Date: Tue, 30 Jun 2026 21:40:03 +0200
+Subject: riscv: probes: save original sp in rethook trampoline
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+commit bc7b086a45521a986a49045907f017e3e46c763e upstream.
+
+Reading a word from the stack in a kretprobe crashes a risc-v kernel.
+
+$ cd /sys/kernel/tracing/
+$ echo 'r n_tty_write $stack0' > dynamic_events
+$ echo 1 > events/kprobes/enable
+Unable to handle kernel paging request at virtual address 0000000200000128
+...
+[<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38
+[<ffffffff80177196>] process_fetch_insn+0x3ee/0x760
+[<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0
+[<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58
+[<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90
+[<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108
+[<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c
+[<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94
+[<ffffffff8067872a>] tty_write+0x1a/0x30
+
+In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
+
+arch_rethook_trampoline saves the registers from the probed function in a
+struct pt_regs. sp is not saved. Instead, sp is decremented for
+arch_rethook_trampoline's local stack.
+
+Fix this crash and save the original sp along with the other registers.
+Use a0 as a temporary register, it is overwritten anyway.
+
+Cc: stable@vger.kernel.org
+Fixes: c22b0bcb1dd02 ("riscv: Add kprobes supported")
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Link: https://patch.msgid.link/20260630194010.1824039-1-martin@kaiser.cx
+[pjw@kernel.org: added Fixes tag; cc'ed stable]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/probes/rethook_trampoline.S | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/riscv/kernel/probes/rethook_trampoline.S
++++ b/arch/riscv/kernel/probes/rethook_trampoline.S
+@@ -41,6 +41,9 @@
+ REG_S x29, PT_T4(sp)
+ REG_S x30, PT_T5(sp)
+ REG_S x31, PT_T6(sp)
++ /* save original sp */
++ addi a0, sp, PT_SIZE_ON_STACK
++ REG_S a0, PT_SP(sp)
+ .endm
+
+ .macro restore_all_base_regs
espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch
bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch
rtc-mpfs-fix-counter-upload-completion-condition.patch
+hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch
+hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch
+net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch
+hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch
+fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch
+net-lan743x-initialize-eth_syslock-spinlock-before-use.patch
+net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch
+net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch
+tracing-probes-fix-double-addition-of-offset-for-foffset.patch
+orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch
+ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch
+net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch
+hwmon-asus_atk0110-check-package-count-before-accessing-element.patch
+riscv-probes-save-original-sp-in-rethook-trampoline.patch
--- /dev/null
+From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Thu, 25 Jun 2026 08:34:47 +0900
+Subject: tracing/probes: Fix double addition of offset for @+FOFFSET
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream.
+
+Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument
+ fetching code") wrongly use @offset local variable during the parsing,
+the offset value is added twice when dereferencing.
+Reset the @offset after setting it in FETCH_OP_FOFFS.
+
+Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/
+
+Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_probe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -1104,6 +1104,7 @@ parse_probe_arg(char *arg, const struct
+
+ code->op = FETCH_OP_FOFFS;
+ code->immediate = (unsigned long)offset; // imm64?
++ offset = 0;
+ } else {
+ /* uprobes don't support symbols */
+ if (!(ctx->flags & TPARG_FL_KERNEL)) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
