--- /dev/null
+From 86f436567f2516a0083b210bedc933544826a2c3 Mon Sep 17 00:00:00 2001
+From: Bradley Morgan <include@grrlz.net>
+Date: Fri, 19 Jun 2026 16:37:18 +0000
+Subject: cpu: hotplug: Bound hotplug states sysfs output
+
+From: Bradley Morgan <include@grrlz.net>
+
+commit 86f436567f2516a0083b210bedc933544826a2c3 upstream.
+
+states_show() adds CPU hotplug state names into a single sysfs buffer
+using sprintf(). With enough registered states, this can write past the
+end of the PAGE_SIZE buffer.
+
+Use sysfs_emit_at() so output is bounded.
+
+Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface")
+Signed-off-by: Bradley Morgan <include@grrlz.net>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cpu.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2436,21 +2436,17 @@ static const struct attribute_group cpuh
+ NULL
+ };
+
+-static ssize_t states_show(struct device *dev,
+- struct device_attribute *attr, char *buf)
++static ssize_t states_show(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+- ssize_t cur, res = 0;
++ ssize_t res = 0;
+ int i;
+
+ mutex_lock(&cpuhp_state_mutex);
+ for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) {
+ struct cpuhp_step *sp = cpuhp_get_step(i);
+
+- if (sp->name) {
+- cur = sprintf(buf, "%3d: %s\n", i, sp->name);
+- buf += cur;
+- res += cur;
+- }
++ if (sp->name)
++ res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name);
+ }
+ mutex_unlock(&cpuhp_state_mutex);
+ return res;
--- /dev/null
+From 673db10729fb121ea1b16fe57791a0cb9eac1eb5 Mon Sep 17 00:00:00 2001
+From: Bradley Morgan <include@grrlz.net>
+Date: Fri, 19 Jun 2026 16:37:17 +0000
+Subject: cpu: hotplug: Preserve per instance callback errors
+
+From: Bradley Morgan <include@grrlz.net>
+
+commit 673db10729fb121ea1b16fe57791a0cb9eac1eb5 upstream.
+
+cpuhp_invoke_callback() unwinds earlier callbacks for the same
+hotplug state when one instance fails. The rollback path currently
+reuses ret, so a successful rollback can hide the original error and
+make the failed transition look successful.
+
+Keep the rollback result separate from the original error.
+
+Fixes: 724a86881d03 ("smp/hotplug: Callback vs state-machine consistency")
+Signed-off-by: Bradley Morgan <include@grrlz.net>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260619163719.12103-1-include@grrlz.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cpu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -171,7 +171,7 @@ static int cpuhp_invoke_callback(unsigne
+ struct cpuhp_step *step = cpuhp_get_step(state);
+ int (*cbm)(unsigned int cpu, struct hlist_node *node);
+ int (*cb)(unsigned int cpu);
+- int ret, cnt;
++ int ret, cnt, rollback_ret;
+
+ if (st->fail == state) {
+ st->fail = CPUHP_INVALID;
+@@ -235,12 +235,12 @@ err:
+ break;
+
+ trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
+- ret = cbm(cpu, node);
+- trace_cpuhp_exit(cpu, st->state, state, ret);
++ rollback_ret = cbm(cpu, node);
++ trace_cpuhp_exit(cpu, st->state, state, rollback_ret);
+ /*
+ * Rollback must not fail,
+ */
+- WARN_ON_ONCE(ret);
++ WARN_ON_ONCE(rollback_ret);
+ }
+ return ret;
+ }
--- /dev/null
+From db4a79713ed8e252d5e4edf6eaaa80948b6855a2 Mon Sep 17 00:00:00 2001
+From: Andreas Kemnade <andreas@kemnade.info>
+Date: Sat, 4 Jul 2026 10:40:54 +0200
+Subject: gpios: palmas: add .get_direction() op
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+commit db4a79713ed8e252d5e4edf6eaaa80948b6855a2 upstream.
+
+Accessing debug/gpio is quite noisy without a get_direction()
+implementation. To calm that down add an implementation.
+
+Fixes: 3d50a2785271 ("gpio: palmas: Add support for Palmas GPIO")
+Cc: stable@vger.kernel.org
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-palmas.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/gpio/gpio-palmas.c
++++ b/drivers/gpio/gpio-palmas.c
+@@ -118,6 +118,24 @@ static int palmas_gpio_input(struct gpio
+ return ret;
+ }
+
++static int palmas_gpio_get_direction(struct gpio_chip *gc, unsigned int offset)
++{
++ struct palmas_gpio *pg = gpiochip_get_data(gc);
++ struct palmas *palmas = pg->palmas;
++ unsigned int val;
++ unsigned int reg;
++ int ret;
++ int gpio16 = (offset/8);
++
++ offset %= 8;
++ reg = (gpio16) ? PALMAS_GPIO_DATA_DIR2 : PALMAS_GPIO_DATA_DIR;
++ ret = palmas_read(palmas, PALMAS_GPIO_BASE, reg, &val);
++ if (ret)
++ return ret;
++
++ return (val & BIT(offset)) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN;
++}
++
+ static int palmas_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
+ {
+ struct palmas_gpio *pg = gpiochip_get_data(gc);
+@@ -166,6 +184,7 @@ static int palmas_gpio_probe(struct plat
+ palmas_gpio->gpio_chip.can_sleep = true;
+ palmas_gpio->gpio_chip.direction_input = palmas_gpio_input;
+ palmas_gpio->gpio_chip.direction_output = palmas_gpio_output;
++ palmas_gpio->gpio_chip.get_direction = palmas_gpio_get_direction;
+ palmas_gpio->gpio_chip.to_irq = palmas_gpio_to_irq;
+ palmas_gpio->gpio_chip.set = palmas_gpio_set;
+ palmas_gpio->gpio_chip.get = palmas_gpio_get;
--- /dev/null
+From 9c1e0b6d49471a712511d23fc9d06901561135e8 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Wed, 20 May 2026 10:16:39 -0400
+Subject: ieee802154: admin-gate legacy LLSEC dump operations
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit 9c1e0b6d49471a712511d23fc9d06901561135e8 upstream.
+
+In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table
+builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV,
+LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which
+sets no .flags, so generic netlink runs them ungated. The modern
+nl802154 family admin-gates the equivalent reads via
+NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM.
+
+Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve
+the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev
+that has an LLSEC key installed; the dump handler writes the raw
+16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied
+verbatim from struct ieee802154_llsec_key.key) into the reply.
+Recovering the AES key compromises 802.15.4 LLSEC link confidentiality
+and authenticity, since LLSEC uses CCM* and the same key authenticates
+and encrypts frames.
+
+Impact: any local uid with no capabilities can read the raw 16-byte
+AES-128 LLSEC key from the kernel keytable on any wpan netdev that has
+an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY
+dump on the legacy IEEE802154_NL generic-netlink family.
+
+Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but
+setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump
+entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the
+modern nl802154 family exposes their equivalents to unprivileged
+readers by design (NL802154_CMD_GET_WPAN_PHY and
+NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged
+users" annotations).
+
+Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-7
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Link: https://lore.kernel.org/20260520141640.1149513-2-michael.bommarito@gmail.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ieee802154/ieee802154.h | 8 ++++++++
+ net/ieee802154/netlink.c | 16 ++++++++--------
+ 2 files changed, 16 insertions(+), 8 deletions(-)
+
+--- a/net/ieee802154/ieee802154.h
++++ b/net/ieee802154/ieee802154.h
+@@ -23,6 +23,14 @@ void ieee802154_nl_exit(void);
+ .dumpit = _dump, \
+ }
+
++#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \
++ { \
++ .cmd = _cmd, \
++ .doit = _func, \
++ .dumpit = _dump, \
++ .flags = GENL_ADMIN_PERM, \
++ }
++
+ struct genl_info;
+
+ struct sk_buff *ieee802154_nl_create(int flags, u8 req);
+--- a/net/ieee802154/netlink.c
++++ b/net/ieee802154/netlink.c
+@@ -98,20 +98,20 @@ static const struct genl_small_ops ieee8
+ IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams),
+ IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams),
+ IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL,
+- ieee802154_llsec_dump_keys),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL,
++ ieee802154_llsec_dump_keys),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL,
+- ieee802154_llsec_dump_devs),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL,
++ ieee802154_llsec_dump_devs),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
+- ieee802154_llsec_dump_devkeys),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
++ ieee802154_llsec_dump_devkeys),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
+- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
+- ieee802154_llsec_dump_seclevels),
++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
++ ieee802154_llsec_dump_seclevels),
+ IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL,
+ ieee802154_llsec_add_seclevel),
+ IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL,
--- /dev/null
+From a6bfdfcc6711d1d5a92e98644359dedc67c0c858 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Wed, 20 May 2026 10:16:40 -0400
+Subject: ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit a6bfdfcc6711d1d5a92e98644359dedc67c0c858 upstream.
+
+The LLSEC ADD/DEL doit handlers under the legacy IEEE802154_NL family
+consume IEEE802154_ATTR_LLSEC_KEY_BYTES and
+IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS, both declared in
+net/ieee802154/nl_policy.c as bare length entries with no .type
+(defaulting to NLA_UNSPEC). Generic netlink strict validation rejects
+all NLA_UNSPEC attributes via validate_nla(), so every LLSEC_ADD_KEY,
+LLSEC_DEL_KEY, LLSEC_ADD_DEV, LLSEC_DEL_DEV, LLSEC_ADD_DEVKEY,
+LLSEC_DEL_DEVKEY, LLSEC_ADD_SECLEVEL, and LLSEC_DEL_SECLEVEL request
+fails at the dispatcher with "Unsupported attribute" before reaching
+the handler.
+
+The doit path has been silently dead since strict validation became
+the default for genl families that do not opt out. The dump path is
+unaffected because dump requests carry no LLSEC attributes to
+validate, which is why the LLSEC_LIST_KEY read remained reachable
+(patch 1/2). Introduce IEEE802154_OP_RELAXED() mirroring
+IEEE802154_OP() but with .validate = GENL_DONT_VALIDATE_STRICT, and
+use it for the eight legacy LLSEC mutate ops so admin-driven LLSEC
+configuration via the legacy interface works again.
+
+Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-7
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Link: https://lore.kernel.org/20260520141640.1149513-3-michael.bommarito@gmail.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ieee802154/ieee802154.h | 9 +++++++++
+ net/ieee802154/netlink.c | 20 ++++++++++----------
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+--- a/net/ieee802154/ieee802154.h
++++ b/net/ieee802154/ieee802154.h
+@@ -16,6 +16,15 @@ void ieee802154_nl_exit(void);
+ .flags = GENL_ADMIN_PERM, \
+ }
+
++#define IEEE802154_OP_RELAXED(_cmd, _func) \
++ { \
++ .cmd = _cmd, \
++ .doit = _func, \
++ .dumpit = NULL, \
++ .flags = GENL_ADMIN_PERM, \
++ .validate = GENL_DONT_VALIDATE_STRICT,\
++ }
++
+ #define IEEE802154_DUMP(_cmd, _func, _dump) \
+ { \
+ .cmd = _cmd, \
+--- a/net/ieee802154/netlink.c
++++ b/net/ieee802154/netlink.c
+@@ -100,22 +100,22 @@ static const struct genl_small_ops ieee8
+ IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL,
+ ieee802154_llsec_dump_keys),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL,
+ ieee802154_llsec_dump_devs),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
+ ieee802154_llsec_dump_devkeys),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
+ ieee802154_llsec_dump_seclevels),
+- IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL,
+- ieee802154_llsec_add_seclevel),
+- IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL,
+- ieee802154_llsec_del_seclevel),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_SECLEVEL,
++ ieee802154_llsec_add_seclevel),
++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_SECLEVEL,
++ ieee802154_llsec_del_seclevel),
+ };
+
+ static const struct genl_multicast_group ieee802154_mcgrps[] = {
--- /dev/null
+From e09390e439bd7cca30dd10893b1f64802961667a Mon Sep 17 00:00:00 2001
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+Date: Tue, 21 Apr 2026 13:02:59 +0530
+Subject: ieee802154: ca8210: fix cas_ctl leak on spi_async failure
+
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+
+commit e09390e439bd7cca30dd10893b1f64802961667a upstream.
+
+ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)
+and relies entirely on the SPI completion callback
+ca8210_spi_transfer_complete() to free it.
+
+The spi_async() API only invokes the completion callback on successful
+submission. On failure it returns a negative error code without ever
+queuing the callback, which leaves cas_ctl and its embedded spi_message
+and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is
+inside the completion callback, so there is no other reclamation path.
+
+ca8210_spi_transfer() is called from ca8210_spi_exchange(), the
+interrupt handler ca8210_interrupt_handler(), and from the retry path
+inside the completion callback itself. The exchange and interrupt
+handler paths loop on -EBUSY, so under sustained SPI bus contention
+every retry iteration leaks a fresh cas_ctl (~600 bytes per
+occurrence).
+
+Fix it by freeing cas_ctl on the spi_async() error path. While here,
+correct the misleading error string: the function calls spi_async(),
+not spi_sync().
+
+Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/20260421073259.2259783-1-shitalkumar.gandhi@cambiumnetworks.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/ca8210.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -963,9 +963,10 @@ static int ca8210_spi_transfer(
+ if (status < 0) {
+ dev_crit(
+ &spi->dev,
+- "status %d from spi_sync in write\n",
++ "status %d from spi_async in write\n",
+ status
+ );
++ kfree(cas_ctl);
+ }
+
+ return status;
--- /dev/null
+From 6d7f7bcf225b2d566176bf6229dbd1252940cb3c Mon Sep 17 00:00:00 2001
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+Date: Wed, 20 May 2026 16:27:50 +0530
+Subject: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
+
+From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
+
+commit 6d7f7bcf225b2d566176bf6229dbd1252940cb3c upstream.
+
+ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange
+a kmalloc'd buffer pointer through a struct kfifo, but pass a literal
+'4' as the byte count to kfifo_in()/kfifo_out().
+
+This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the
+low 4 bytes of the 8-byte pointer are written into the FIFO. The reader
+then reads back 4 bytes into an 8-byte local pointer variable, leaving
+the upper 4 bytes uninitialized stack data. The first dereference of
+the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel
+address and generally results in an oops.
+
+Use sizeof(fifo_buffer) so the byte count matches pointer width on every
+architecture.
+
+The driver has no architecture restriction in Kconfig, so any 64-bit
+build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has
+been latent since the driver was added in 2017 because it is most
+commonly deployed on 32-bit MCUs.
+
+Found via a custom Coccinelle semantic patch hunting for short-byte
+kfifo I/O on byte-mode kfifos used to shuttle pointers.
+
+Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/20260520105750.30144-1-shitalkumar.gandhi@cambiumnetworks.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ieee802154/ca8210.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -639,7 +639,7 @@ static int ca8210_test_int_driver_write(
+ fifo_buffer = kmemdup(buf, len, GFP_KERNEL);
+ if (!fifo_buffer)
+ return -ENOMEM;
+- kfifo_in(&test->up_fifo, &fifo_buffer, 4);
++ kfifo_in(&test->up_fifo, &fifo_buffer, sizeof(fifo_buffer));
+ wake_up_interruptible(&priv->test.readq);
+
+ return 0;
+@@ -2571,6 +2571,7 @@ static ssize_t ca8210_test_int_user_read
+ struct ca8210_priv *priv = filp->private_data;
+ unsigned char *fifo_buffer;
+ unsigned long bytes_not_copied;
++ unsigned int copied;
+
+ if (filp->f_flags & O_NONBLOCK) {
+ /* Non-blocking mode */
+@@ -2584,7 +2585,8 @@ static ssize_t ca8210_test_int_user_read
+ );
+ }
+
+- if (kfifo_out(&priv->test.up_fifo, &fifo_buffer, 4) != 4) {
++ copied = kfifo_out(&priv->test.up_fifo, &fifo_buffer, sizeof(fifo_buffer));
++ if (copied != sizeof(fifo_buffer)) {
+ dev_err(
+ &priv->spi->dev,
+ "test_interface: Wrong number of elements popped from upstream fifo\n"
--- /dev/null
+From 1bd6676254b4ab6acd44b662b5e92822c036463a Mon Sep 17 00:00:00 2001
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+Date: Tue, 16 Jun 2026 22:24:24 +0800
+Subject: net: ena: clean up XDP TX queues when regular TX setup fails
+
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+
+commit 1bd6676254b4ab6acd44b662b5e92822c036463a upstream.
+
+create_queues_with_size_backoff() creates XDP TX queues before setting
+up the regular TX path. If the subsequent allocation or creation of
+regular TX queues fails, the error handling paths omit the teardown of the
+XDP TX queues, leading to a resource leak.
+
+Fix this by explicitly destroying the XDP TX queue subset at the two
+missing failure points.
+
+The bug was first flagged by an experimental analysis tool we are
+developing for kernel memory-management bugs while analyzing
+v6.13-rc1. The tool is still under development and is not yet publicly
+available. Manual inspection confirms that the bug is still
+present in v7.1-rc7.
+
+An x86_64 allyesconfig build showed no new warnings. As we do not have
+an ENA device to test with, no runtime testing was able to be performed.
+
+Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
+Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com>
+Tested-by: Arthur Kiyanovski <akiyano@amazon.com>
+Link: https://patch.msgid.link/20260616142424.4005130-1-dawei.feng@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1257,6 +1257,18 @@ static void ena_destroy_all_tx_queues(st
+ }
+ }
+
++static void ena_destroy_xdp_tx_queues(struct ena_adapter *adapter)
++{
++ u16 ena_qid;
++ int i;
++
++ for (i = adapter->xdp_first_ring;
++ i < adapter->xdp_first_ring + adapter->xdp_num_queues; i++) {
++ ena_qid = ENA_IO_TXQ_IDX(i);
++ ena_com_destroy_io_queue(adapter->ena_dev, ena_qid);
++ }
++}
++
+ static void ena_destroy_all_rx_queues(struct ena_adapter *adapter)
+ {
+ u16 ena_qid;
+@@ -2620,14 +2632,21 @@ static int create_queues_with_size_backo
+ rc = ena_setup_tx_resources_in_range(adapter,
+ 0,
+ adapter->num_io_queues);
+- if (rc)
++ if (rc) {
++ ena_destroy_xdp_tx_queues(adapter);
++ ena_free_all_io_tx_resources_in_range(adapter,
++ adapter->xdp_first_ring,
++ adapter->xdp_num_queues);
+ goto err_setup_tx;
++ }
+
+ rc = ena_create_io_tx_queues_in_range(adapter,
+ 0,
+ adapter->num_io_queues);
+- if (rc)
++ if (rc) {
++ ena_destroy_xdp_tx_queues(adapter);
+ goto err_create_tx_queues;
++ }
+
+ rc = ena_setup_all_rx_resources(adapter);
+ if (rc)
--- /dev/null
+From f00a50876d2818bd6dc86fa98b3ef360884c53c8 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:39 +0800
+Subject: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit f00a50876d2818bd6dc86fa98b3ef360884c53c8 upstream.
+
+ip6gre_changelink() and ip6erspan_changelink() operate on at most two
+netns, dev_net(dev) and the tunnel link netns t->net. They differ once
+the device is created in or moved to a netns other than the one the
+request runs in. The rtnl changelink path checks CAP_NET_ADMIN only
+against dev_net(dev), so a caller privileged there but not in t->net can
+rewrite a tunnel that lives in t->net.
+
+Gate both ops on rtnl_dev_link_net_capable() at their top, before any
+attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 690afc165bb3 ("net: ip6_gre: fix moving ip6gre between namespaces")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-6-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_gre.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -2091,6 +2091,9 @@ static int ip6gre_changelink(struct net_
+ struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
+ struct __ip6_tnl_parm p;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ t = ip6gre_changelink_common(dev, tb, data, &p, extack);
+ if (IS_ERR(t))
+ return PTR_ERR(t);
+@@ -2305,6 +2308,9 @@ static int ip6erspan_changelink(struct n
+ struct __ip6_tnl_parm p;
+ struct ip6gre_net *ign;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ ign = net_generic(t->net, ip6gre_net_id);
+ t = ip6gre_changelink_common(dev, tb, data, &p, extack);
+ if (IS_ERR(t))
--- /dev/null
+From e2ac3b242c37dff323a964962e43854f4b1a2b79 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:40 +0800
+Subject: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit e2ac3b242c37dff323a964962e43854f4b1a2b79 upstream.
+
+vti6_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 61220ab34948 ("vti6: Enable namespace changing")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-7-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_vti.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -1052,6 +1052,9 @@ static int vti6_changelink(struct net_de
+ struct __ip6_tnl_parm p;
+ struct vti6_net *ip6n;
+
++ if (!rtnl_dev_link_net_capable(dev, net))
++ return -EPERM;
++
+ ip6n = net_generic(net, vti6_net_id);
+ if (dev == ip6n->fb_tnl_dev)
+ return -EINVAL;
--- /dev/null
+From 95cceadbfd52d7239bd730afdda0655287d77425 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Fri, 12 Jun 2026 16:59:37 +0800
+Subject: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 95cceadbfd52d7239bd730afdda0655287d77425 upstream.
+
+vti_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate vti_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed.
+
+Reported-by: Xiao Liang <shaw.leon@gmail.com>
+Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
+Fixes: 895de9a3488a ("vti4: Enable namespace changing")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260612085941.3158249-4-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_vti.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -579,6 +579,9 @@ static int vti_changelink(struct net_dev
+ __u32 fwmark = t->fwmark;
+ struct ip_tunnel_parm p;
+
++ if (!rtnl_dev_link_net_capable(dev, t->net))
++ return -EPERM;
++
+ vti_netlink_parms(data, &p, &fwmark);
+ return ip_tunnel_changelink(dev, tb, &p, fwmark);
+ }
--- /dev/null
+From 27ccb68e7cccead5d8c611665a45d23032d468b3 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Thu, 18 Jun 2026 15:08:17 +0800
+Subject: net: sit: require CAP_NET_ADMIN in the device netns for changelink
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 27ccb68e7cccead5d8c611665a45d23032d468b3 upstream.
+
+ipip6_changelink() operates on at most two netns, dev_net(dev) and the
+tunnel link netns t->net. They differ once the device is created in or
+moved to a netns other than the one the request runs in. The rtnl
+changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
+caller privileged there but not in t->net can rewrite a tunnel that
+lives in t->net.
+
+Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top,
+before any attribute is parsed. sit was the one tunnel type not covered
+by the recent series that added this check to the other changelink()
+handlers.
+
+Fixes: 5e6700b3bf98 ("sit: add support of x-netns")
+Link: https://lore.kernel.org/netdev/20260612085941.3158249-1-maoyixie.tju@gmail.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20260618070817.3378283-1-maoyixie.tju@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/sit.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1679,6 +1679,9 @@ static int ipip6_changelink(struct net_d
+ __u32 fwmark = t->fwmark;
+ int err;
+
++ if (!rtnl_dev_link_net_capable(dev, net))
++ return -EPERM;
++
+ if (dev == sitn->fb_tunnel_dev)
+ return -EINVAL;
+
input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch
input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch
input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch
+cpu-hotplug-preserve-per-instance-callback-errors.patch
+cpu-hotplug-bound-hotplug-states-sysfs-output.patch
+gpios-palmas-add-.get_direction-op.patch
+net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch
+net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+ieee802154-admin-gate-legacy-llsec-dump-operations.patch
+ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch
+ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
+ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
