--- /dev/null
+From 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 Mon Sep 17 00:00:00 2001
+From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
+Date: Fri, 10 Jul 2026 23:10:03 +0545
+Subject: Bluetooth: btrtl: validate firmware patch bounds
+
+From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
+
+commit 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 upstream.
+
+rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
+firmware version. A malformed firmware patch shorter than the version field
+can make this subtraction underflow and turn the copy into an oversized
+read and write during Bluetooth setup.
+
+The existing patch_offset + patch_length check can also wrap on 32-bit
+architectures. Validate the patch length and range without arithmetic
+overflow before allocating or copying the patch.
+
+Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btrtl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -382,8 +382,9 @@ static int rtlbt_parse_firmware(struct h
+ }
+
+ BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
+- min_size = patch_offset + patch_length;
+- if (btrtl_dev->fw_len < min_size)
++ if (patch_length < sizeof(epatch_info->fw_version) ||
++ patch_offset > btrtl_dev->fw_len ||
++ patch_length > btrtl_dev->fw_len - patch_offset)
+ return -EINVAL;
+
+ /* Copy the firmware into a new buffer and write the version at
--- /dev/null
+From b3fe4cbd583895987935a9bdad01c8f9d3a02310 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Wed, 8 Jul 2026 21:03:15 +0300
+Subject: ipvs: fix more places with wrong ipv6 transport offsets
+
+From: Julian Anastasov <ja@ssi.bg>
+
+commit b3fe4cbd583895987935a9bdad01c8f9d3a02310 upstream.
+
+Sashiko reports for more incorrect IPv6 transport offsets.
+
+The app code for TCP was assuming IPv4 network header
+even after the ipvsh argument was provided. This can
+cause problems with apps over IPv6. As for the only
+official app in the kernel tree (FTP) this problem is
+harmless because we use Netfilter to mangle the FTP
+ports and we do not adjust the TCP seq numbers.
+
+Also, provide correct offset of the ICMPV6 header in
+ip_vs_out_icmp_v6() for correct checksum checks when
+the IPv6 packet has extension headers.
+
+Fixes: d12e12299a69 ("ipvs: add ipv6 support to ftp")
+Fixes: 2a3b791e6e11 ("IPVS: Add/adjust Netfilter hook functions and helpers for v6")
+Cc: stable@vger.kernel.org
+Link: https://sashiko.dev/#/patchset/20260706101624.69471-1-zhaoyz24%40mails.tsinghua.edu.cn
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_app.c | 10 ++++------
+ net/netfilter/ipvs/ip_vs_core.c | 3 +--
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_app.c
++++ b/net/netfilter/ipvs/ip_vs_app.c
+@@ -362,14 +362,13 @@ static inline int app_tcp_pkt_out(struct
+ struct ip_vs_iphdr *ipvsh)
+ {
+ int diff;
+- const unsigned int tcp_offset = ip_hdrlen(skb);
+ struct tcphdr *th;
+ __u32 seq;
+
+- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
+ return 0;
+
+- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
+
+ /*
+ * Remember seq number in case this pkt gets resized
+@@ -439,14 +438,13 @@ static inline int app_tcp_pkt_in(struct
+ struct ip_vs_iphdr *ipvsh)
+ {
+ int diff;
+- const unsigned int tcp_offset = ip_hdrlen(skb);
+ struct tcphdr *th;
+ __u32 seq;
+
+- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
+ return 0;
+
+- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
+
+ /*
+ * Remember seq number in case this pkt gets resized
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1053,8 +1053,7 @@ static int ip_vs_out_icmp_v6(struct netn
+ snet.in6 = ciph.saddr.in6;
+ offset = ciph.len;
+ return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp,
+- pp, offset, sizeof(struct ipv6hdr),
+- hooknum);
++ pp, offset, ipvsh->len, hooknum);
+ }
+ #endif
+
--- /dev/null
+From 2c72eb6286347d05a885412fb076993bd5286b53 Mon Sep 17 00:00:00 2001
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Date: Sun, 12 Jul 2026 21:03:43 +0800
+Subject: llc: fix SAP refcount leak when creating incoming sockets
+
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+
+commit 2c72eb6286347d05a885412fb076993bd5286b53 upstream.
+
+llc_sap_add_socket() takes a SAP reference for each socket added to a SAP,
+and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes
+an additional SAP reference after adding the child socket.
+
+This extra reference was balanced by an explicit llc_sap_put() in
+llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference
+counting w.r.t. socket handling") removed that put. The corresponding hold
+in the accept path was left behind.
+
+When such a child socket is removed, only the reference taken by
+llc_sap_add_socket() is released. The extra reference keeps the SAP alive
+after its last socket is removed. Remove the obsolete hold.
+
+Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/llc/llc_conn.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -761,7 +761,6 @@ static struct sock *llc_create_incoming_
+ newllc->dev = dev;
+ dev_hold(dev);
+ llc_sap_add_socket(llc->sap, newsk);
+- llc_sap_hold(llc->sap);
+ out:
+ return newsk;
+ }
--- /dev/null
+From 7410d11460eb90d6c9281162ccc6a128534d897d Mon Sep 17 00:00:00 2001
+From: James Raphael Tiovalen <jamestiotio@gmail.com>
+Date: Sun, 5 Jul 2026 19:36:29 +0800
+Subject: macsec: fix promiscuity refcount leak in macsec_dev_open()
+
+From: James Raphael Tiovalen <jamestiotio@gmail.com>
+
+commit 7410d11460eb90d6c9281162ccc6a128534d897d upstream.
+
+When a MACsec interface with IFF_PROMISC set is brought up on top of a
+device that has hardware offload enabled, macsec_dev_open() first calls
+dev_set_promiscuity(real_dev, 1) and then propagates the open to the
+offload device. If that propagation fails, the error path jumps to the
+clear_allmulti label, which only reverts allmulti and the unicast
+address. The promiscuity taken on the lower device is never dropped, so
+real_dev is left permanently stuck in promiscuous mode. Its promiscuity
+count can no longer be balanced from software.
+
+Add a clear_promisc label that drops the promiscuity reference and
+route the two offload failure paths to it. The dev_set_promiscuity()
+failure itself still jumps to clear_allmulti, since on that failure the
+count was not incremented.
+
+Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure")
+Cc: stable@vger.kernel.org
+Signed-off-by: James Raphael Tiovalen <jamestiotio@gmail.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/20260705113629.187490-1-jamestiotio@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/macsec.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3560,19 +3560,22 @@ static int macsec_dev_open(struct net_de
+ ops = macsec_get_ops(netdev_priv(dev), &ctx);
+ if (!ops) {
+ err = -EOPNOTSUPP;
+- goto clear_allmulti;
++ goto clear_promisc;
+ }
+
+ ctx.secy = &macsec->secy;
+ err = macsec_offload(ops->mdo_dev_open, &ctx);
+ if (err)
+- goto clear_allmulti;
++ goto clear_promisc;
+ }
+
+ if (netif_carrier_ok(real_dev))
+ netif_carrier_on(dev);
+
+ return 0;
++clear_promisc:
++ if (dev->flags & IFF_PROMISC)
++ dev_set_promiscuity(real_dev, -1);
+ clear_allmulti:
+ if (dev->flags & IFF_ALLMULTI)
+ dev_set_allmulti(real_dev, -1);
--- /dev/null
+From 718178f524b98bc920d74bc771aed823c8b81425 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Thu, 2 Jul 2026 16:27:45 +0800
+Subject: memstick: ms_block: reject a card that reports too many blocks
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 718178f524b98bc920d74bc771aed823c8b81425 upstream.
+
+msb_ftl_initialize() computes the zone count from the card block count
+with no bound:
+
+ msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
+ ...
+ for (i = 0; i < msb->zone_count; i++)
+ msb->free_block_count[i] = MS_BLOCKS_IN_ZONE;
+
+msb->block_count is a card value. msb_read_boot_blocks() reads
+number_of_blocks from the card boot page and byte swaps it.
+free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the
+valid indices are 0 to 15. The init loop above indexes it by zone_count.
+msb_mark_block_used() and msb_mark_block_unused() index it by
+pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report
+up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES *
+MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past
+free_block_count[] and corrupts struct msb_data. A larger count runs the
+init loop past the end too.
+
+A real Memory Stick has at most 16 zones. So it has at most 8192 blocks.
+msb_ftl_initialize() now rejects a card that reports more than
+MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks.
+
+Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Signed-off-by: Ulf Hansson <ulfh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/memstick/core/ms_block.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/memstick/core/ms_block.c
++++ b/drivers/memstick/core/ms_block.c
+@@ -1333,6 +1333,10 @@ static int msb_ftl_initialize(struct msb
+ return 0;
+
+ msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
++ if (msb->block_count > MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) {
++ pr_err("Too many blocks: %d\n", msb->block_count);
++ return -EINVAL;
++ }
+ msb->logical_block_count = msb->zone_count * 496 - 2;
+
+ msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL);
--- /dev/null
+From 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 Mon Sep 17 00:00:00 2001
+From: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
+Date: Wed, 15 Jul 2026 13:04:08 -0400
+Subject: regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
+
+From: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
+
+commit 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 upstream.
+
+The LTC3676_IRQSTAT_* bit definitions do not match the IRQSTAT
+(Interrupt Request Status) register layout documented in Table 15
+of the LTC3676/LTC3676-1 datasheet:
+
+ bit 0 - Pushbutton Status Active
+ bit 1 - Hard Reset Occurred
+ bit 2 - PGOOD Timeout Occurred
+ bit 3 - Undervoltage Warning
+ bit 4 - Undervoltage Standby (Fault) Occurred
+ bit 5 - Overtemperature Warning
+ bit 6 - Overtemperature Standby (Fault) Occurred
+ bit 7 - Reserved
+
+The driver instead defines these starting at bit 3, one bit higher
+than the datasheet specifies, which causes ltc3676_regulator_isr()
+to check the wrong status bits and misreport (or miss) PGOOD
+timeout, undervoltage and thermal warning/fault conditions.
+
+Fix the bit offsets to match the datasheet.
+
+Fixes: 37b918a034fe ("regulator: Add LTC3676 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
+Link: https://patch.msgid.link/20260715170408.295552-1-Abhishek.ojha@savoirfairelinux.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/ltc3676.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/regulator/ltc3676.c
++++ b/drivers/regulator/ltc3676.c
+@@ -45,11 +45,11 @@
+ #define LTC3676_DVBxA_REF_SELECT BIT(5)
+ #define LTC3676_DVBxB_PGOOD_MASK BIT(5)
+
+-#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(3)
+-#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(4)
+-#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(5)
+-#define LTC3676_IRQSTAT_THERMAL_WARN BIT(6)
+-#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(7)
++#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(2)
++#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(3)
++#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(4)
++#define LTC3676_IRQSTAT_THERMAL_WARN BIT(5)
++#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(6)
+
+ enum ltc3676_reg {
+ LTC3676_SW1,
--- /dev/null
+From 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 Mon Sep 17 00:00:00 2001
+From: Robby Cai <robby.cai@nxp.com>
+Date: Fri, 19 Jun 2026 15:31:15 +0800
+Subject: reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
+
+From: Robby Cai <robby.cai@nxp.com>
+
+commit 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 upstream.
+
+On i.MX8MQ, the MIPI CSI reset lines are active-low and not self-clearing.
+Writing '0' asserts reset and it remains asserted until explicitly
+deasserted by software.
+
+This driver previously treated the MIPI CSI reset signals as active-high,
+which led to incorrect reset assert/deassert sequencing. This issue was
+exposed by commit 6d79bb8fd2aa ("media: imx8mq-mipi-csi2: Explicitly
+release reset").
+
+Fix this by reflecting the correct reset polarity and ensuring proper
+reset handling.
+
+Fixes: c979dbf59987 ("reset: imx7: Add support for i.MX8MQ IP block variant")
+Cc: stable@vger.kernel.org # 6d79bb8fd2aa: media: imx8mq-mipi-csi2: Explicitly release reset
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Robby Cai <robby.cai@nxp.com>
+Reviewed-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/reset/reset-imx7.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/reset/reset-imx7.c
++++ b/drivers/reset/reset-imx7.c
+@@ -236,6 +236,12 @@ static int imx8mq_reset_set(struct reset
+
+ case IMX8MQ_RESET_PCIE_CTRL_APPS_EN:
+ case IMX8MQ_RESET_PCIE2_CTRL_APPS_EN:
++ case IMX8MQ_RESET_MIPI_CSI1_CORE_RESET:
++ case IMX8MQ_RESET_MIPI_CSI1_PHY_REF_RESET:
++ case IMX8MQ_RESET_MIPI_CSI1_ESC_RESET:
++ case IMX8MQ_RESET_MIPI_CSI2_CORE_RESET:
++ case IMX8MQ_RESET_MIPI_CSI2_PHY_REF_RESET:
++ case IMX8MQ_RESET_MIPI_CSI2_ESC_RESET:
+ case IMX8MQ_RESET_MIPI_DSI_PCLK_RESET_N:
+ case IMX8MQ_RESET_MIPI_DSI_ESC_RESET_N:
+ case IMX8MQ_RESET_MIPI_DSI_DPI_RESET_N:
--- /dev/null
+From 1a8c89f8c112c75e84ff9a140f969e372aed0c9a Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 17 Jun 2026 11:16:27 +0800
+Subject: reset: sunxi: fix memory region leak on ioremap failure
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit 1a8c89f8c112c75e84ff9a140f969e372aed0c9a upstream.
+
+In sunxi_reset_init(), when ioremap() fails, the memory region obtained
+via request_mem_region() is not released, leading to a resource leak.
+
+Add an err_mem_region label to properly release the memory region before
+freeing the data structure.
+
+Fixes: 8f1ae77f4666 ("reset: Add Allwinner SoCs Reset Controller Driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/reset/reset-sunxi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/reset/reset-sunxi.c
++++ b/drivers/reset/reset-sunxi.c
+@@ -44,7 +44,7 @@ static int sunxi_reset_init(struct devic
+ data->membase = ioremap(res.start, size);
+ if (!data->membase) {
+ ret = -ENOMEM;
+- goto err_alloc;
++ goto err_mem_region;
+ }
+
+ spin_lock_init(&data->lock);
+@@ -57,6 +57,8 @@ static int sunxi_reset_init(struct devic
+
+ return reset_controller_register(&data->rcdev);
+
++err_mem_region:
++ release_mem_region(res.start, size);
+ err_alloc:
+ kfree(data);
+ return ret;
ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch
drbd-reject-data-replies-with-an-out-of-range-payload-size.patch
cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch
+wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch
+wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch
+regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch
+bluetooth-btrtl-validate-firmware-patch-bounds.patch
+llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch
+macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch
+memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch
+ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch
+reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch
+reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch
--- /dev/null
+From 95fc02722edde02946d0d475221f2b2054d3d8ba Mon Sep 17 00:00:00 2001
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+Date: Mon, 6 Jul 2026 22:35:07 +0800
+Subject: wifi: mac80211: fix memory leak in ieee80211_register_hw()
+
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+
+commit 95fc02722edde02946d0d475221f2b2054d3d8ba upstream.
+
+If kmemdup() fails while copying supported band structures, the error
+path jumps to fail_rate. This skips rate_control_deinitialize() and
+leaks the initialized local->rate_ctrl.
+
+Fix this by adding a fail_band label that shares the rate-control cleanup
+path before falling through to the remaining teardown.
+
+The bug was first flagged by an experimental analysis tool we are
+developing for kernel memory-management bugs while analyzing
+v6.13-rc1. The tool is still under development and is not yet publicly
+available. Manual inspection confirms that the bug is still present in
+v7.1-rc7.
+
+An x86_64 allyesconfig build showed no new warnings. As we do not have a
+suitable mac80211 device/driver combination to test with, no runtime
+testing was able to be performed.
+
+Fixes: 09b4a4faf9d0 ("mac80211: introduce capability flags for VHT EXT NSS support")
+Cc: stable@vger.kernel.org
+Reviewed-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
+Link: https://patch.msgid.link/20260706143507.146131-1-dawei.feng@seu.edu.cn
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1279,7 +1279,7 @@ int ieee80211_register_hw(struct ieee802
+ sband = kmemdup(sband, sizeof(*sband), GFP_KERNEL);
+ if (!sband) {
+ result = -ENOMEM;
+- goto fail_rate;
++ goto fail_band;
+ }
+
+ wiphy_dbg(hw->wiphy, "copying sband (band %d) due to VHT EXT NSS BW flag\n",
+@@ -1342,6 +1342,7 @@ int ieee80211_register_hw(struct ieee802
+ #endif
+ wiphy_unregister(local->hw.wiphy);
+ fail_wiphy_register:
++ fail_band:
+ rtnl_lock();
+ rate_control_deinitialize(local);
+ ieee80211_remove_interfaces(local);
--- /dev/null
+From 536fb3d739d75a03cb318c0c6fe799425cfea501 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Fri, 19 Jun 2026 15:31:04 +0800
+Subject: wifi: rt2x00: avoid full teardown before work setup in probe
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit 536fb3d739d75a03cb318c0c6fe799425cfea501 upstream.
+
+rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for
+all probe failures. However, drv_data allocation and workqueue allocation
+can fail before intf_work, autowakeup_work and sleep_work have been
+initialized.
+
+Do not enter the full remove path until the probe has reached the point
+where those work items are set up. Return directly for drv_data allocation
+failure, and use a small early cleanup path for workqueue allocation
+failure.
+
+This issue was found by our static analysis tool and then confirmed by
+manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The
+early probe exits should not call a common teardown path that assumes the
+later work setup has already completed.
+
+A QEMU PoC forced alloc_ordered_workqueue() to fail before the work
+initializers are reached. The resulting fail path entered
+rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with
+rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.
+
+Fixes: 1ebbc48520a0 ("rt2x00: Introduce concept of driver data in struct rt2x00_dev.")
+Fixes: 0439f5367c8d ("rt2x00: Move TX/RX work into dedicated workqueue")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Link: https://patch.msgid.link/20260619073104.1809161-1-runyu.xiao@seu.edu.cn
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -1368,7 +1368,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ GFP_KERNEL);
+ if (!rt2x00dev->drv_data) {
+ retval = -ENOMEM;
+- goto exit;
++ return retval;
+ }
+ }
+
+@@ -1402,7 +1402,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
+ if (!rt2x00dev->workqueue) {
+ retval = -ENOMEM;
+- goto exit;
++ goto exit_free_drv_data;
+ }
+
+ INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
+@@ -1478,6 +1478,14 @@ exit:
+ rt2x00lib_remove_dev(rt2x00dev);
+
+ return retval;
++
++exit_free_drv_data:
++ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
++
++ kfree(rt2x00dev->drv_data);
++ rt2x00dev->drv_data = NULL;
++
++ return retval;
+ }
+ EXPORT_SYMBOL_GPL(rt2x00lib_probe_dev);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
