--- /dev/null
+From 500e1368e46928f4b2259612dcabb6999afae2a6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 25 Sep 2025 17:00:07 +0200
+Subject: amba: tegra-ahb: Fix device leak on SMMU enable
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 500e1368e46928f4b2259612dcabb6999afae2a6 upstream.
+
+Make sure to drop the reference taken to the AHB platform device when
+looking up its driver data while enabling the SMMU.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away.
+
+Fixes: 89c788bab1f0 ("ARM: tegra: Add SMMU enabler in AHB")
+Cc: stable@vger.kernel.org # 3.5
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/amba/tegra-ahb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/amba/tegra-ahb.c
++++ b/drivers/amba/tegra-ahb.c
+@@ -144,6 +144,7 @@ int tegra_ahb_enable_smmu(struct device_
+ if (!dev)
+ return -EPROBE_DEFER;
+ ahb = dev_get_drvdata(dev);
++ put_device(dev);
+ val = gizmo_readl(ahb, AHB_ARBITRATION_XBAR_CTRL);
+ val |= AHB_ARBITRATION_XBAR_CTRL_SMMU_INIT_DONE;
+ gizmo_writel(ahb, val, AHB_ARBITRATION_XBAR_CTRL);
--- /dev/null
+From 670d7ef945d3a84683594429aea6ab2cdfa5ceb4 Mon Sep 17 00:00:00 2001
+From: Gui-Dong Han <hanguidong02@gmail.com>
+Date: Wed, 3 Dec 2025 02:01:05 +0800
+Subject: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
+
+From: Gui-Dong Han <hanguidong02@gmail.com>
+
+commit 670d7ef945d3a84683594429aea6ab2cdfa5ceb4 upstream.
+
+The macro FAN_FROM_REG evaluates its arguments multiple times. When used
+in lockless contexts involving shared driver data, this leads to
+Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially
+causing divide-by-zero errors.
+
+Convert the macro to a static function. This guarantees that arguments
+are evaluated only once (pass-by-value), preventing the race
+conditions.
+
+Additionally, in store_fan_div, move the calculation of the minimum
+limit inside the update lock. This ensures that the read-modify-write
+sequence operates on consistent data.
+
+Adhere to the principle of minimal changes by only converting macros
+that evaluate arguments multiple times and are used in lockless
+contexts.
+
+Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/
+Fixes: 9873964d6eb2 ("[PATCH] HWMON: w83791d: New hardware monitoring driver for the Winbond W83791D")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
+Link: https://lore.kernel.org/r/20251202180105.12842-1-hanguidong02@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83791d.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/w83791d.c
++++ b/drivers/hwmon/w83791d.c
+@@ -218,9 +218,14 @@ static u8 fan_to_reg(long rpm, int div)
+ return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
+ }
+
+-#define FAN_FROM_REG(val, div) ((val) == 0 ? -1 : \
+- ((val) == 255 ? 0 : \
+- 1350000 / ((val) * (div))))
++static int fan_from_reg(int val, int div)
++{
++ if (val == 0)
++ return -1;
++ if (val == 255)
++ return 0;
++ return 1350000 / (val * div);
++}
+
+ /* for temp1 which is 8-bit resolution, LSB = 1 degree Celsius */
+ #define TEMP1_FROM_REG(val) ((val) * 1000)
+@@ -521,7 +526,7 @@ static ssize_t show_##reg(struct device
+ struct w83791d_data *data = w83791d_update_device(dev); \
+ int nr = sensor_attr->index; \
+ return sprintf(buf, "%d\n", \
+- FAN_FROM_REG(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \
++ fan_from_reg(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \
+ }
+
+ show_fan_reg(fan);
+@@ -585,10 +590,10 @@ static ssize_t store_fan_div(struct devi
+ if (err)
+ return err;
+
++ mutex_lock(&data->update_lock);
+ /* Save fan_min */
+- min = FAN_FROM_REG(data->fan_min[nr], DIV_FROM_REG(data->fan_div[nr]));
++ min = fan_from_reg(data->fan_min[nr], DIV_FROM_REG(data->fan_div[nr]));
+
+- mutex_lock(&data->update_lock);
+ data->fan_div[nr] = div_to_reg(nr, val);
+
+ switch (nr) {
--- /dev/null
+From 07272e883fc61574b8367d44de48917f622cdd83 Mon Sep 17 00:00:00 2001
+From: Gui-Dong Han <hanguidong02@gmail.com>
+Date: Fri, 28 Nov 2025 20:38:16 +0800
+Subject: hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
+
+From: Gui-Dong Han <hanguidong02@gmail.com>
+
+commit 07272e883fc61574b8367d44de48917f622cdd83 upstream.
+
+The macros FAN_FROM_REG and TEMP_FROM_REG evaluate their arguments
+multiple times. When used in lockless contexts involving shared driver
+data, this causes Time-of-Check to Time-of-Use (TOCTOU) race
+conditions.
+
+Convert the macros to static functions. This guarantees that arguments
+are evaluated only once (pass-by-value), preventing the race
+conditions.
+
+Adhere to the principle of minimal changes by only converting macros
+that evaluate arguments multiple times and are used in lockless
+contexts.
+
+Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/
+Fixes: 85f03bccd6e0 ("hwmon: Add support for Winbond W83L786NG/NR")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
+Link: https://lore.kernel.org/r/20251128123816.3670-1-hanguidong02@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83l786ng.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/hwmon/w83l786ng.c
++++ b/drivers/hwmon/w83l786ng.c
+@@ -77,15 +77,25 @@ FAN_TO_REG(long rpm, int div)
+ return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
+ }
+
+-#define FAN_FROM_REG(val, div) ((val) == 0 ? -1 : \
+- ((val) == 255 ? 0 : \
+- 1350000 / ((val) * (div))))
++static int fan_from_reg(int val, int div)
++{
++ if (val == 0)
++ return -1;
++ if (val == 255)
++ return 0;
++ return 1350000 / (val * div);
++}
+
+ /* for temp */
+ #define TEMP_TO_REG(val) (clamp_val(((val) < 0 ? (val) + 0x100 * 1000 \
+ : (val)) / 1000, 0, 0xff))
+-#define TEMP_FROM_REG(val) (((val) & 0x80 ? \
+- (val) - 0x100 : (val)) * 1000)
++
++static int temp_from_reg(int val)
++{
++ if (val & 0x80)
++ return (val - 0x100) * 1000;
++ return val * 1000;
++}
+
+ /*
+ * The analog voltage inputs have 8mV LSB. Since the sysfs output is
+@@ -281,7 +291,7 @@ static ssize_t show_##reg(struct device
+ int nr = to_sensor_dev_attr(attr)->index; \
+ struct w83l786ng_data *data = w83l786ng_update_device(dev); \
+ return sprintf(buf, "%d\n", \
+- FAN_FROM_REG(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \
++ fan_from_reg(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \
+ }
+
+ show_fan_reg(fan);
+@@ -348,7 +358,7 @@ store_fan_div(struct device *dev, struct
+
+ /* Save fan_min */
+ mutex_lock(&data->update_lock);
+- min = FAN_FROM_REG(data->fan_min[nr], DIV_FROM_REG(data->fan_div[nr]));
++ min = fan_from_reg(data->fan_min[nr], DIV_FROM_REG(data->fan_div[nr]));
+
+ data->fan_div[nr] = DIV_TO_REG(val);
+
+@@ -410,7 +420,7 @@ show_temp(struct device *dev, struct dev
+ int nr = sensor_attr->nr;
+ int index = sensor_attr->index;
+ struct w83l786ng_data *data = w83l786ng_update_device(dev);
+- return sprintf(buf, "%d\n", TEMP_FROM_REG(data->temp[nr][index]));
++ return sprintf(buf, "%d\n", temp_from_reg(data->temp[nr][index]));
+ }
+
+ static ssize_t
--- /dev/null
+From a6ee6aac66fb394b7f6e6187c73bdcd873f2d139 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Wed, 22 Oct 2025 17:54:02 +0800
+Subject: i2c: amd-mp2: fix reference leak in MP2 PCI device
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit a6ee6aac66fb394b7f6e6187c73bdcd873f2d139 upstream.
+
+In i2c_amd_probe(), amd_mp2_find_device() utilizes
+driver_find_next_device() which internally calls driver_find_device()
+to locate the matching device. driver_find_device() increments the
+reference count of the found device by calling get_device(), but
+amd_mp2_find_device() fails to call put_device() to decrement the
+reference count before returning. This results in a reference count
+leak of the PCI device each time i2c_amd_probe() is executed, which
+may prevent the device from being properly released and cause a memory
+leak.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20251022095402.8846-1-make24@iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-amd-mp2-pci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-amd-mp2-pci.c
++++ b/drivers/i2c/busses/i2c-amd-mp2-pci.c
+@@ -461,13 +461,16 @@ struct amd_mp2_dev *amd_mp2_find_device(
+ {
+ struct device *dev;
+ struct pci_dev *pci_dev;
++ struct amd_mp2_dev *mp2_dev;
+
+ dev = driver_find_next_device(&amd_mp2_pci_driver.driver, NULL);
+ if (!dev)
+ return NULL;
+
+ pci_dev = to_pci_dev(dev);
+- return (struct amd_mp2_dev *)pci_get_drvdata(pci_dev);
++ mp2_dev = (struct amd_mp2_dev *)pci_get_drvdata(pci_dev);
++ put_device(dev);
++ return mp2_dev;
+ }
+ EXPORT_SYMBOL_GPL(amd_mp2_find_device);
+
--- /dev/null
+From a53e356df548f6b0e82529ef3cc6070f42622189 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Date: Fri, 22 Aug 2025 11:00:42 +0100
+Subject: rpmsg: glink: fix rpmsg device leak
+
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+
+commit a53e356df548f6b0e82529ef3cc6070f42622189 upstream.
+
+While testing rpmsg-char interface it was noticed that duplicate sysfs
+entries are getting created and below warning is noticed.
+
+Reason for this is that we are leaking rpmsg device pointer, setting it
+null without actually unregistering device.
+Any further attempts to unregister fail because rpdev is NULL,
+resulting in a leak.
+
+Fix this by unregistering rpmsg device before removing its reference
+from rpmsg channel.
+
+sysfs: cannot create duplicate filename '/devices/platform/soc@0/3700000.remot
+eproc/remoteproc/remoteproc1/3700000.remoteproc:glink-edge/3700000.remoteproc:
+glink-edge.adsp_apps.-1.-1'
+[ 114.115347] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not
+ tainted 6.16.0-rc4 #7 PREEMPT
+[ 114.115355] Hardware name: Qualcomm Technologies, Inc. Robotics RB3gen2 (DT)
+[ 114.115358] Workqueue: events qcom_glink_work
+[ 114.115371] Call trace:8
+[ 114.115374] show_stack+0x18/0x24 (C)
+[ 114.115382] dump_stack_lvl+0x60/0x80
+[ 114.115388] dump_stack+0x18/0x24
+[ 114.115393] sysfs_warn_dup+0x64/0x80
+[ 114.115402] sysfs_create_dir_ns+0xf4/0x120
+[ 114.115409] kobject_add_internal+0x98/0x260
+[ 114.115416] kobject_add+0x9c/0x108
+[ 114.115421] device_add+0xc4/0x7a0
+[ 114.115429] rpmsg_register_device+0x5c/0xb0
+[ 114.115434] qcom_glink_work+0x4bc/0x820
+[ 114.115438] process_one_work+0x148/0x284
+[ 114.115446] worker_thread+0x2c4/0x3e0
+[ 114.115452] kthread+0x12c/0x204
+[ 114.115457] ret_from_fork+0x10/0x20
+[ 114.115464] kobject: kobject_add_internal failed for 3700000.remoteproc:
+glink-edge.adsp_apps.-1.-1 with -EEXIST, don't try to register things with
+the same name in the same directory.
+[ 114.250045] rpmsg 3700000.remoteproc:glink-edge.adsp_apps.-1.-1:
+device_add failed: -17
+
+Fixes: 835764ddd9af ("rpmsg: glink: Move the common glink protocol implementation to glink_native.c")
+Cc: Stable@vger.kernel.org
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250822100043.2604794-2-srinivas.kandagatla@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rpmsg/qcom_glink_native.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -1244,6 +1244,7 @@ static void qcom_glink_destroy_ept(struc
+ {
+ struct glink_channel *channel = to_glink_channel(ept);
+ struct qcom_glink *glink = channel->glink;
++ struct rpmsg_channel_info chinfo;
+ unsigned long flags;
+
+ spin_lock_irqsave(&channel->recv_lock, flags);
+@@ -1251,6 +1252,13 @@ static void qcom_glink_destroy_ept(struc
+ spin_unlock_irqrestore(&channel->recv_lock, flags);
+
+ /* Decouple the potential rpdev from the channel */
++ if (channel->rpdev) {
++ strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
++ chinfo.src = RPMSG_ADDR_ANY;
++ chinfo.dst = RPMSG_ADDR_ANY;
++
++ rpmsg_unregister_device(glink->dev, &chinfo);
++ }
+ channel->rpdev = NULL;
+
+ qcom_glink_send_close_req(glink, channel);
nfsd-mark-variable-__maybe_unused-to-avoid-w-1-build-break.patch
io_uring-fix-filename-leak-in-__io_openat_prep.patch
drm-amd-display-use-gfp_atomic-in-dc_create_plane_state.patch
+amba-tegra-ahb-fix-device-leak-on-smmu-enable.patch
+soc-qcom-ocmem-fix-device-leak-on-lookup.patch
+soc-amlogic-canvas-fix-device-leak-on-lookup.patch
+rpmsg-glink-fix-rpmsg-device-leak.patch
+i2c-amd-mp2-fix-reference-leak-in-mp2-pci-device.patch
+hwmon-w83791d-convert-macros-to-functions-to-avoid-toctou.patch
+hwmon-w83l786ng-convert-macros-to-functions-to-avoid-toctou.patch
--- /dev/null
+From 32200f4828de9d7e6db379909898e718747f4e18 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 26 Sep 2025 16:24:53 +0200
+Subject: soc: amlogic: canvas: fix device leak on lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 32200f4828de9d7e6db379909898e718747f4e18 upstream.
+
+Make sure to drop the reference taken to the canvas platform device when
+looking up its driver data.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Also note that commit 28f851e6afa8 ("soc: amlogic: canvas: add missing
+put_device() call in meson_canvas_get()") fixed the leak in a lookup
+error path, but the reference is still leaking on success.
+
+Fixes: d4983983d987 ("soc: amlogic: add meson-canvas driver")
+Cc: stable@vger.kernel.org # 4.20: 28f851e6afa8
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://patch.msgid.link/20250926142454.5929-2-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/amlogic/meson-canvas.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/soc/amlogic/meson-canvas.c
++++ b/drivers/soc/amlogic/meson-canvas.c
+@@ -72,10 +72,9 @@ struct meson_canvas *meson_canvas_get(st
+ * current state, this driver probe cannot return -EPROBE_DEFER
+ */
+ canvas = dev_get_drvdata(&canvas_pdev->dev);
+- if (!canvas) {
+- put_device(&canvas_pdev->dev);
++ put_device(&canvas_pdev->dev);
++ if (!canvas)
+ return ERR_PTR(-EINVAL);
+- }
+
+ return canvas;
+ }
--- /dev/null
+From b5c16ea57b030b8e9428ec726e26219dfe05c3d9 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 26 Sep 2025 16:35:10 +0200
+Subject: soc: qcom: ocmem: fix device leak on lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b5c16ea57b030b8e9428ec726e26219dfe05c3d9 upstream.
+
+Make sure to drop the reference taken to the ocmem platform device when
+looking up its driver data.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Also note that commit 0ff027027e05 ("soc: qcom: ocmem: Fix missing
+put_device() call in of_get_ocmem") fixed the leak in a lookup error
+path, but the reference is still leaking on success.
+
+Fixes: 88c1e9404f1d ("soc: qcom: add OCMEM driver")
+Cc: stable@vger.kernel.org # 5.5: 0ff027027e05
+Cc: Brian Masney <bmasney@redhat.com>
+Cc: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Brian Masney <bmasney@redhat.com>
+Link: https://lore.kernel.org/r/20250926143511.6715-2-johan@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/ocmem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/qcom/ocmem.c
++++ b/drivers/soc/qcom/ocmem.c
+@@ -211,9 +211,9 @@ struct ocmem *of_get_ocmem(struct device
+ of_node_put(devnode);
+
+ ocmem = platform_get_drvdata(pdev);
++ put_device(&pdev->dev);
+ if (!ocmem) {
+ dev_err(dev, "Cannot get ocmem\n");
+- put_device(&pdev->dev);
+ return ERR_PTR(-ENODEV);
+ }
+ return ocmem;
projects / thirdparty / kernel / stable-queue.git / commitdiff
