--- /dev/null
+From 8522d806d84e2c3816c275ae6dd79e124c1b3dac Mon Sep 17 00:00:00 2001
+From: Xu Rao <raoxu@uniontech.com>
+Date: Thu, 25 Jun 2026 21:29:03 +0800
+Subject: ACPI: TAD: Check AC wake capability before enabling wakeup
+
+From: Xu Rao <raoxu@uniontech.com>
+
+commit 8522d806d84e2c3816c275ae6dd79e124c1b3dac upstream.
+
+ACPI_TAD_AC_WAKE is a non-zero bit definition, so testing the macro
+itself is always true. As a result, every TAD device is initialized as
+a system wakeup device, including RTC-only devices and devices whose
+wake capability bits were cleared because _PRW is absent.
+
+Test the capability value returned by _GCP instead. This keeps
+RTC-only TAD devices usable without advertising a wakeup capability
+that the firmware does not provide.
+
+Fixes: 6c711fde3a1c ("ACPI: TAD: Support RTC without wakeup")
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Link: https://patch.msgid.link/961A84FF37B50665+20260625132903.2840457-1-raoxu@uniontech.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpi_tad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/acpi_tad.c
++++ b/drivers/acpi/acpi_tad.c
+@@ -856,7 +856,7 @@ static int acpi_tad_probe(struct platfor
+ * runtime suspend. Everything else should be taken care of by the ACPI
+ * PM domain callbacks.
+ */
+- if (ACPI_TAD_AC_WAKE) {
++ if (caps & ACPI_TAD_AC_WAKE) {
+ device_init_wakeup(dev, true);
+ dev_pm_set_driver_flags(dev, DPM_FLAG_SMART_SUSPEND |
+ DPM_FLAG_MAY_SKIP_RESUME);
--- /dev/null
+From 462775c620197adaabc983ce847e5b9878ff4cb0 Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Fri, 19 Jun 2026 21:54:02 -0500
+Subject: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 462775c620197adaabc983ce847e5b9878ff4cb0 upstream.
+
+The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus
+after entering Device-Initiated Slumber during idle. With the default
+med_power_with_dipm policy the link goes down (SStatus 1 SControl 300)
+and does not recover, forcing the filesystem read-only. Forcing
+max_performance keeps the link stable across prolonged idle.
+
+Add a NOLPM quirk so link power management is disabled for this drive
+specifically, leaving it intact for other devices on the host.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4295,6 +4295,9 @@ static const struct ata_dev_quirks_entry
+ /* Apacer models with LPM issues */
+ { "Apacer AS340*", NULL, ATA_QUIRK_NOLPM },
+
++ /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */
++ { "PNY CS900 1TB SSD", NULL, ATA_QUIRK_NOLPM },
++
+ /* Silicon Motion models with LPM issues */
+ { "MD619HXCLDE3TC", "TCVAID", ATA_QUIRK_NOLPM },
+ { "MD619GXCLDE3TC", "TCV35D", ATA_QUIRK_NOLPM },
--- /dev/null
+From 533a0b940f901c15e5cbbd4b5d66e871c209e8ce Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Mon, 22 Jun 2026 22:23:45 -0500
+Subject: ata: libata-core: Reject an invalid concurrent positioning ranges count
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 533a0b940f901c15e5cbbd4b5d66e871c209e8ce upstream.
+
+ata_dev_config_cpr() takes the number of range descriptors from buf[0]
+of the concurrent positioning ranges log (up to 255), which the device
+reports independently of the log size in the GPL directory. The count is
+then walked at a fixed 32-byte stride in two places with no bound: the
+log read here, and the INQUIRY VPD page B9h emitter, which writes one
+descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device
+reporting a count larger than its own log overflows the read buffer (up
+to 7704 bytes past a 512-byte slab), and a count above 62 overflows the
+response buffer on the emit side.
+
+Bound the count once, on probe, against both the log the device returned
+and the number of descriptors the VPD B9h response buffer can hold
+(ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range
+count with a warning; this keeps the emitter in bounds with no separate
+change there.
+
+Suggested-by: Damien Le Moal <dlemoal@kernel.org>
+Fixes: fe22e1c2f705 ("libata: support concurrent positioning ranges log")
+Fixes: c745dfc541e7 ("libata: fix reading concurrent positioning ranges log")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-core.c | 18 ++++++++++++++++++
+ drivers/ata/libata-scsi.c | 2 --
+ drivers/ata/libata.h | 9 +++++++++
+ 3 files changed, 27 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2847,6 +2847,24 @@ static void ata_dev_config_cpr(struct at
+ if (!nr_cpr)
+ goto out;
+
++ /*
++ * The device reports the number of CPR descriptors independently of the
++ * log size, and that count is also used to emit VPD page B9h into the
++ * fixed-size rbuf. Reject a count larger than what that buffer can hold
++ * (ATA_DEV_MAX_CPR) or larger than the log the device actually returned.
++ */
++ if (nr_cpr > ATA_DEV_MAX_CPR) {
++ ata_dev_warn(dev,
++ "Too many concurrent positioning ranges\n");
++ goto out;
++ }
++
++ if (buf_len < 64 + (size_t)nr_cpr * 32) {
++ ata_dev_warn(dev,
++ "Invalid number of concurrent positioning ranges\n");
++ goto out;
++ }
++
+ cpr_log = kzalloc_flex(*cpr_log, cpr, nr_cpr);
+ if (!cpr_log)
+ goto out;
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -37,8 +37,6 @@
+ #include "libata.h"
+ #include "libata-transport.h"
+
+-#define ATA_SCSI_RBUF_SIZE 2048
+-
+ static DEFINE_SPINLOCK(ata_scsi_rbuf_lock);
+ static u8 ata_scsi_rbuf[ATA_SCSI_RBUF_SIZE];
+
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -148,6 +148,15 @@ static inline bool ata_acpi_dev_manage_r
+ #endif
+
+ /* libata-scsi.c */
++#define ATA_SCSI_RBUF_SIZE 2048
++
++/*
++ * Maximum number of concurrent positioning ranges (CPR) supported. The ACS
++ * specifications allow up to 255, but we limit this to the number of CPR
++ * descriptors that fit in the rbuf buffer used to emit VPD page B9h.
++ */
++#define ATA_DEV_MAX_CPR min(255, ((ATA_SCSI_RBUF_SIZE - 64) / 32))
++
+ extern struct ata_device *ata_scsi_find_dev(struct ata_port *ap,
+ const struct scsi_device *scsidev);
+ extern int ata_scsi_add_hosts(struct ata_host *host,
--- /dev/null
+From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Thu, 25 Jun 2026 22:18:37 +0800
+Subject: ata: pata_pxa: Fix DMA channel leak on probe error
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream.
+
+When dmaengine_slave_config() fails, the DMA channel acquired by
+dma_request_chan() is not released before returning the error,
+leaking the channel reference.
+
+Fix by adding dma_release_channel() in the error path.
+
+The ata_host_activate() error path already correctly releases the
+DMA channel.
+
+Cc: stable@vger.kernel.org
+Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/pata_pxa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/pata_pxa.c
++++ b/drivers/ata/pata_pxa.c
+@@ -286,6 +286,7 @@ static int pxa_ata_probe(struct platform
+ ret = dmaengine_slave_config(data->dma_chan, &config);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "dma configuration failed: %d\n", ret);
++ dma_release_channel(data->dma_chan);
+ return ret;
+ }
+
--- /dev/null
+From 6c732471740bc2ac9b0946134f9f551dc75f4369 Mon Sep 17 00:00:00 2001
+From: David Lee <david.lee@trailofbits.com>
+Date: Wed, 1 Jul 2026 11:44:28 +0000
+Subject: fhandle: reject detached mounts in capable_wrt_mount()
+
+From: David Lee <david.lee@trailofbits.com>
+
+commit 6c732471740bc2ac9b0946134f9f551dc75f4369 upstream.
+
+The recent fhandle RCU fix moved the mount namespace capability check
+into capable_wrt_mount(), so a non-NULL mnt_namespace survives the
+ns_capable() dereference. The helper still assumes the later
+READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh()
+checked is_mounted() first.
+
+That assumption is not stable. A detached mount from
+open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while
+open_by_handle_at() is between those checks, and umount_tree() can
+clear mount->mnt_ns. If the helper observes NULL, it dereferences
+mnt_ns->user_ns and panics.
+
+Return false when the RCU read observes a detached mount. This keeps
+the relaxed permission path conservative: a mount no longer attached
+to a namespace cannot authorize open_by_handle_at() access.
+
+Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Lee <david.lee@trailofbits.com>
+Assisted-by: LLM
+Link: https://patch.msgid.link/20260701114438.24431-1-david.lee@trailofbits.com
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fhandle.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -295,7 +295,7 @@ static bool capable_wrt_mount(struct mou
+ */
+ guard(rcu)();
+ mnt_ns = READ_ONCE(mount->mnt_ns);
+- return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
++ return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);
+ }
+
+ static inline int may_decode_fh(struct handle_to_path_ctx *ctx,
--- /dev/null
+From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Thu, 25 Jun 2026 08:48:34 +0800
+Subject: fsl/fman: Free init resources on KeyGen failure in fman_init()
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream.
+
+fman_muram_alloc() allocates initialization resources before
+initializing the KeyGen block. If keygen_init() fails, the
+function returns -EINVAL directly and leaves those resources
+allocated. Free the initialization resources before returning
+from the KeyGen failure path.
+
+Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen")
+Cc: stable@kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fman/fman.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -1995,8 +1995,10 @@ static int fman_init(struct fman *fman)
+
+ /* Init KeyGen */
+ fman->keygen = keygen_init(fman->kg_regs);
+- if (!fman->keygen)
++ if (!fman->keygen) {
++ free_init_resources(fman);
+ return -EINVAL;
++ }
+
+ err = enable(fman, cfg);
+ if (err != 0)
--- /dev/null
+From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001
+From: HyeongJun An <sammiee5311@gmail.com>
+Date: Fri, 19 Jun 2026 21:27:46 +0900
+Subject: hwmon: (asus_atk0110) Check package count before accessing element
+
+From: HyeongJun An <sammiee5311@gmail.com>
+
+commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream.
+
+atk_ec_present() walks the management group package returned by the GGRP
+ACPI method and, for each sub-package, reads its first element:
+
+ id = &obj->package.elements[0];
+ if (id->type != ACPI_TYPE_INTEGER)
+
+without checking that the sub-package is non-empty. ACPICA allocates the
+element array with exactly package.count entries, so for a sub-package
+with a zero count this reads past the allocation.
+
+The sibling function atk_debugfs_ggrp_open() performs the same access but
+skips empty packages with a package.count check first. Add the same
+check to atk_ec_present() so a malformed firmware package cannot trigger
+an out-of-bounds read.
+
+Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
+Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/asus_atk0110.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/hwmon/asus_atk0110.c
++++ b/drivers/hwmon/asus_atk0110.c
+@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat
+ if (obj->type != ACPI_TYPE_PACKAGE)
+ continue;
+
++ if (!obj->package.count)
++ continue;
++
+ id = &obj->package.elements[0];
+ if (id->type != ACPI_TYPE_INTEGER)
+ continue;
--- /dev/null
+From 943a749bdffdd2132fab9240db890e07d93e1fcf Mon Sep 17 00:00:00 2001
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+Date: Mon, 29 Jun 2026 21:17:39 +0200
+Subject: hwmon: (max1619) add missing 'select REGMAP' to Kconfig
+
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+
+commit 943a749bdffdd2132fab9240db890e07d93e1fcf upstream.
+
+The Kconfig entry for the MAX1619 sensor doesn't contain a
+`select REGMAP` parameter, causing build failures if regmap
+isn't selected previously during the build process.
+
+Fixes: f8016132ce49 ("hwmon: (max1619) Convert to use regmap")
+Cc: stable@vger.kernel.org
+Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
+Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-1-8104df929b1a@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1215,6 +1215,7 @@ config SENSORS_MAX16065
+ config SENSORS_MAX1619
+ tristate "Maxim MAX1619 sensor chip"
+ depends on I2C
++ select REGMAP
+ help
+ If you say yes here you get support for MAX1619 sensor chip.
+
--- /dev/null
+From e31408734332b8cc611342cdaaab6ba492180156 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Fri, 19 Jun 2026 09:59:38 +0800
+Subject: hwmon: (occ) unregister sysfs devices outside occ lock
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit e31408734332b8cc611342cdaaab6ba492180156 upstream.
+
+occ_active(false) and occ_shutdown() unregister sysfs-backed devices while
+occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can
+wait for active sysfs callbacks to drain, and those callbacks can enter the
+OCC update path and try to take occ->lock again. That gives the unregister
+paths the lock ordering occ->lock -> sysfs callback drain, while a callback
+has the opposite edge sysfs callback -> occ->lock.
+
+This issue was found by our static analysis tool and then manually
+reviewed against the current tree.
+
+The grounded PoC kept the real unregister and callback carrier:
+
+ occ_shutdown()
+ hwmon_device_unregister()
+ occ_show_temp_1()
+ occ_update_response()
+
+Lockdep reported the circular dependency with occ_shutdown() already
+holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs
+side:
+
+ WARNING: possible circular locking dependency detected
+ ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]
+ ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]
+ occ_update_response.isra.0+0xb/0x20 [vuln_msv]
+ occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]
+ *** DEADLOCK ***
+
+Serialize hwmon registration and removal with a separate hwmon_lock.
+Under that lock, detach occ->hwmon and update occ->active while occ->lock
+is held so concurrent OCC state changes still see a stable state, then
+drop occ->lock before calling hwmon_device_unregister(). Remove the
+driver sysfs group before taking occ->lock in occ_shutdown(), so draining
+the driver attributes cannot wait while the OCC mutex is held. Also make
+OCC update callbacks return -ENODEV after deactivation, so callbacks that
+already passed sysfs active protection do not poll the hardware after
+teardown has detached the hwmon device.
+
+Fixes: 849b0156d996 ("hwmon: (occ) Delay hwmon registration until user request")
+Fixes: ac6888ac5a11 ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Link: https://lore.kernel.org/r/20260619015938.494464-1-runyu.xiao@seu.edu.cn
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/occ/common.c | 34 ++++++++++++++++++++++++++++------
+ drivers/hwmon/occ/common.h | 1 +
+ 2 files changed, 29 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -214,6 +214,11 @@ int occ_update_response(struct occ *occ)
+ if (rc)
+ return rc;
+
++ if (!occ->active) {
++ rc = -ENODEV;
++ goto unlock;
++ }
++
+ /* limit the maximum rate of polling the OCC */
+ if (time_after(jiffies, occ->next_update)) {
+ rc = occ_poll(occ);
+@@ -222,6 +227,7 @@ int occ_update_response(struct occ *occ)
+ rc = occ->last_error;
+ }
+
++unlock:
+ mutex_unlock(&occ->lock);
+ return rc;
+ }
+@@ -1105,11 +1111,16 @@ static void occ_parse_poll_response(stru
+
+ int occ_active(struct occ *occ, bool active)
+ {
+- int rc = mutex_lock_interruptible(&occ->lock);
++ struct device *hwmon = NULL;
++ int rc = mutex_lock_interruptible(&occ->hwmon_lock);
+
+ if (rc)
+ return rc;
+
++ rc = mutex_lock_interruptible(&occ->lock);
++ if (rc)
++ goto unlock_hwmon;
++
+ if (active) {
+ if (occ->active) {
+ rc = -EALREADY;
+@@ -1154,14 +1165,17 @@ int occ_active(struct occ *occ, bool act
+ goto unlock;
+ }
+
+- if (occ->hwmon)
+- hwmon_device_unregister(occ->hwmon);
++ hwmon = occ->hwmon;
+ occ->active = false;
+ occ->hwmon = NULL;
+ }
+
+ unlock:
+ mutex_unlock(&occ->lock);
++ if (hwmon)
++ hwmon_device_unregister(hwmon);
++unlock_hwmon:
++ mutex_unlock(&occ->hwmon_lock);
+ return rc;
+ }
+
+@@ -1170,6 +1184,7 @@ int occ_setup(struct occ *occ)
+ int rc;
+
+ mutex_init(&occ->lock);
++ mutex_init(&occ->hwmon_lock);
+ occ->groups[0] = &occ->group;
+
+ rc = occ_setup_sysfs(occ);
+@@ -1190,15 +1205,22 @@ EXPORT_SYMBOL_GPL(occ_setup);
+
+ void occ_shutdown(struct occ *occ)
+ {
+- mutex_lock(&occ->lock);
++ struct device *hwmon;
+
+ occ_shutdown_sysfs(occ);
+
+- if (occ->hwmon)
+- hwmon_device_unregister(occ->hwmon);
++ mutex_lock(&occ->hwmon_lock);
++ mutex_lock(&occ->lock);
++
++ hwmon = occ->hwmon;
++ occ->active = false;
+ occ->hwmon = NULL;
+
+ mutex_unlock(&occ->lock);
++
++ if (hwmon)
++ hwmon_device_unregister(hwmon);
++ mutex_unlock(&occ->hwmon_lock);
+ }
+ EXPORT_SYMBOL_GPL(occ_shutdown);
+
+--- a/drivers/hwmon/occ/common.h
++++ b/drivers/hwmon/occ/common.h
+@@ -101,6 +101,7 @@ struct occ {
+
+ unsigned long next_update;
+ struct mutex lock; /* lock OCC access */
++ struct mutex hwmon_lock; /* serialize hwmon registration/removal */
+
+ struct device *hwmon;
+ struct occ_attribute *attrs;
--- /dev/null
+From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Mon, 15 Jun 2026 14:47:31 +0800
+Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream.
+
+w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when
+VID information is available.
+
+The error path and remove callback only remove the common and optional
+attribute groups. Those groups do not contain cpu0_vid or vrm, so the
+files can remain after a later probe failure or after device removal
+while their callbacks still expect live driver data.
+
+Remove the standalone VID sysfs files from both the probe error path and
+the remove callback.
+
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83627hf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -1823,6 +1823,8 @@ static int w83627hf_probe(struct platfor
+ return 0;
+
+ error:
++ device_remove_file(dev, &dev_attr_vrm);
++ device_remove_file(dev, &dev_attr_cpu0_vid);
+ sysfs_remove_group(&dev->kobj, &w83627hf_group);
+ sysfs_remove_group(&dev->kobj, &w83627hf_group_opt);
+ return err;
+@@ -1834,6 +1836,8 @@ static void w83627hf_remove(struct platf
+
+ hwmon_device_unregister(data->hwmon_dev);
+
++ device_remove_file(&pdev->dev, &dev_attr_vrm);
++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid);
+ sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group);
+ sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt);
+ }
--- /dev/null
+From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Mon, 15 Jun 2026 14:48:06 +0800
+Subject: hwmon: (w83793) remove vrm sysfs file on probe failure
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 77b983757280c69b0290811669ff1d31022e5f1d upstream.
+
+w83793_probe() creates the vrm sysfs file after creating the VID files
+when VID support is present.
+
+The normal remove path deletes vrm, but the probe error path only
+removes the sensor, SDA, VID, fan, PWM and temperature files. A later
+probe failure can therefore leave vrm behind after the driver data has
+been freed.
+
+Remove vrm in the probe error path next to the VID files, matching the
+normal remove path.
+
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83793.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/w83793.c
++++ b/drivers/hwmon/w83793.c
+@@ -1917,6 +1917,7 @@ exit_remove:
+
+ for (i = 0; i < ARRAY_SIZE(w83793_vid); i++)
+ device_remove_file(dev, &w83793_vid[i].dev_attr);
++ device_remove_file(dev, &dev_attr_vrm);
+
+ for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++)
+ device_remove_file(dev, &w83793_left_fan[i].dev_attr);
--- /dev/null
+From 96ca1e658ae459276292bd6d971ab5d8c7e0379a Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Wed, 24 Jun 2026 14:59:55 +0800
+Subject: net: ipa: fix SMEM state handle leaks in SMP2P init
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 96ca1e658ae459276292bd6d971ab5d8c7e0379a upstream.
+
+ipa_smp2p_init() acquires two Qualcomm SMEM state handles with
+qcom_smem_state_get(). However, neither the init error paths
+nor ipa_smp2p_exit() release them.
+
+Release both handles with qcom_smem_state_put() in the init
+error paths and in ipa_smp2p_exit().
+
+Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Reviewed-by: Alex Elder <elder@riscstar.com>
+Link: https://patch.msgid.link/20260624065955.2822765-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipa/ipa_smp2p.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ipa/ipa_smp2p.c
++++ b/drivers/net/ipa/ipa_smp2p.c
+@@ -232,19 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct p
+ &valid_bit);
+ if (IS_ERR(valid_state))
+ return PTR_ERR(valid_state);
+- if (valid_bit >= 32) /* BITS_PER_U32 */
+- return -EINVAL;
++ if (valid_bit >= 32) { /* BITS_PER_U32 */
++ ret = -EINVAL;
++ goto err_valid_state_put;
++ }
+
+ enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
+ &enabled_bit);
+- if (IS_ERR(enabled_state))
+- return PTR_ERR(enabled_state);
+- if (enabled_bit >= 32) /* BITS_PER_U32 */
+- return -EINVAL;
++ if (IS_ERR(enabled_state)) {
++ ret = PTR_ERR(enabled_state);
++ goto err_valid_state_put;
++ }
++ if (enabled_bit >= 32) { /* BITS_PER_U32 */
++ ret = -EINVAL;
++ goto err_enabled_state_put;
++ }
+
+ smp2p = kzalloc_obj(*smp2p);
+- if (!smp2p)
+- return -ENOMEM;
++ if (!smp2p) {
++ ret = -ENOMEM;
++ goto err_enabled_state_put;
++ }
+
+ smp2p->ipa = ipa;
+
+@@ -289,6 +297,10 @@ err_null_smp2p:
+ ipa->smp2p = NULL;
+ mutex_destroy(&smp2p->mutex);
+ kfree(smp2p);
++err_enabled_state_put:
++ qcom_smem_state_put(enabled_state);
++err_valid_state_put:
++ qcom_smem_state_put(valid_state);
+
+ return ret;
+ }
+@@ -305,6 +317,8 @@ void ipa_smp2p_exit(struct ipa *ipa)
+ ipa_smp2p_power_release(ipa);
+ ipa->smp2p = NULL;
+ mutex_destroy(&smp2p->mutex);
++ qcom_smem_state_put(smp2p->enabled_state);
++ qcom_smem_state_put(smp2p->valid_state);
+ kfree(smp2p);
+ }
+
--- /dev/null
+From 39139b1c1c2b614096519b526112c726adb12ff0 Mon Sep 17 00:00:00 2001
+From: Andrea Righi <arighi@nvidia.com>
+Date: Fri, 26 Jun 2026 18:32:18 +0200
+Subject: net: lan743x: Initialize eth_syslock spinlock before use
+
+From: Andrea Righi <arighi@nvidia.com>
+
+commit 39139b1c1c2b614096519b526112c726adb12ff0 upstream.
+
+lan743x_hardware_init() calls pci11x1x_strap_get_status() during the
+PCI11x1x probe sequence. That helper acquires the Ethernet subsystem
+hardware lock via lan743x_hs_syslock_acquire(), which relies on
+adapter->eth_syslock_spinlock to serialize access.
+
+The spinlock is currently initialized only after the strap status is
+read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized
+spinlock can trip the spinlock debug check.
+
+Fix by initializing adapter->eth_syslock_spinlock before reading the
+strap status so the probe path never attempts to lock an uninitialized
+spinlock.
+
+Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G")
+Cc: stable@vger.kernel.org # v6.0+
+Signed-off-by: Andrea Righi <arighi@nvidia.com>
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Reviewed-by: Thangaraj Samynathan<Thangaraj.s@microchip.com>
+Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -3542,8 +3542,8 @@ static int lan743x_hardware_init(struct
+ adapter->max_tx_channels = PCI11X1X_MAX_TX_CHANNELS;
+ adapter->used_tx_channels = PCI11X1X_USED_TX_CHANNELS;
+ adapter->max_vector_count = PCI11X1X_MAX_VECTOR_COUNT;
+- pci11x1x_strap_get_status(adapter);
+ spin_lock_init(&adapter->eth_syslock_spinlock);
++ pci11x1x_strap_get_status(adapter);
+ mutex_init(&adapter->sgmii_rw_lock);
+ pci11x1x_set_rfe_rd_fifo_threshold(adapter);
+ sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL);
--- /dev/null
+From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Wed, 24 Jun 2026 14:40:13 +0800
+Subject: net: liquidio: fix BAR resource leak on PF number failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream.
+
+If cn23xx_get_pf_num() fails, the function returns without
+unmapping either BAR. Unmap both BARs before returning from
+the error path.
+
+Found by manual code review.
+
+Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+@@ -1163,18 +1163,14 @@ int setup_cn23xx_octeon_pf_device(struct
+ if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) {
+ dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n",
+ __func__);
+- octeon_unmap_pci_barx(oct, 0);
+- return 1;
++ goto err_unmap_bar0;
+ }
+
+ if (cn23xx_get_pf_num(oct) != 0)
+- return 1;
++ goto err_unmap_bar1;
+
+- if (cn23xx_sriov_config(oct)) {
+- octeon_unmap_pci_barx(oct, 0);
+- octeon_unmap_pci_barx(oct, 1);
+- return 1;
+- }
++ if (cn23xx_sriov_config(oct))
++ goto err_unmap_bar1;
+
+ octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL);
+
+@@ -1205,6 +1201,12 @@ int setup_cn23xx_octeon_pf_device(struct
+ oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct);
+
+ return 0;
++
++err_unmap_bar1:
++ octeon_unmap_pci_barx(oct, 1);
++err_unmap_bar0:
++ octeon_unmap_pci_barx(oct, 0);
++ return 1;
+ }
+ EXPORT_SYMBOL_GPL(setup_cn23xx_octeon_pf_device);
+
--- /dev/null
+From bb09d0e64ecaa0aa0f7d1133a1696ed74dead295 Mon Sep 17 00:00:00 2001
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+Date: Mon, 29 Jun 2026 14:40:49 +0800
+Subject: net/mlx5: HWS, fix matcher leak on resize target setup failure
+
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+
+commit bb09d0e64ecaa0aa0f7d1133a1696ed74dead295 upstream.
+
+hws_bwc_matcher_move() allocates a replacement matcher before setting it
+as the resize target. If mlx5hws_matcher_resize_set_target() fails, the
+replacement matcher is not attached anywhere and is leaked.
+
+Fix the leak by destroying the replacement matcher before returning from
+the resize-target failure path.
+
+The bug was first flagged by an experimental analysis tool we are
+developing for kernel memory-management bugs while analyzing
+v6.13-rc1. The tool is still under development and is not yet publicly
+available. Manual inspection confirms that the bug is still
+present in v7.1.1.
+
+An x86_64 allyesconfig build showed no new warnings. As we do not have a
+mlx5 HWS-capable device to test with, no runtime testing was able to be
+performed.
+
+Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
+Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Acked-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20260629064049.3852759-1-dawei.feng@seu.edu.cn
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
+@@ -205,6 +205,7 @@ static int hws_bwc_matcher_move(struct m
+ ret = mlx5hws_matcher_resize_set_target(old_matcher, new_matcher);
+ if (ret) {
+ mlx5hws_err(ctx, "Rehash error: failed setting resize target\n");
++ mlx5hws_matcher_destroy(new_matcher);
+ return ret;
+ }
+
--- /dev/null
+From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Thu, 25 Jun 2026 04:51:20 -0500
+Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream.
+
+multiq_dequeue() takes a packet from a band's child with a direct
+->dequeue() call after multiq_peek() peeked it. When the child is
+non-work-conserving the peek stashes the skb in the child's gso_skb, so
+the direct dequeue returns a different skb and orphans the stash,
+desyncing the child's qlen/backlog. With a qfq child reached through a
+peeking parent (e.g. tbf) this re-enters the child on an emptied list and
+dereferences NULL, panicking the kernel from softirq on ordinary egress.
+
+Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
+and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
+when the child has no stash, so a work-conserving child is unaffected.
+
+Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_multiq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_multiq.c
++++ b/net/sched/sch_multiq.c
+@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st
+ if (!netif_xmit_stopped(
+ netdev_get_tx_queue(qdisc_dev(sch), q->curband))) {
+ qdisc = q->queues[q->curband];
+- skb = qdisc->dequeue(qdisc);
++ skb = qdisc_dequeue_peeked(qdisc);
+ if (skb) {
+ qdisc_bstats_update(sch, skb);
+ qdisc_qlen_dec(sch);
--- /dev/null
+From e056e1dfcddca877dd46d704e8ec9860cfc9ec44 Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Thu, 25 Jun 2026 04:51:19 -0500
+Subject: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit e056e1dfcddca877dd46d704e8ec9860cfc9ec44 upstream.
+
+When taprio's software path peeks a non-work-conserving child qdisc, the
+child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq()
+then takes the packet with a direct child ->dequeue() call, which ignores
+that stash, orphans the peeked skb and desyncs the child's qlen/backlog.
+With a qfq child this re-enters the child on an emptied list and
+dereferences NULL, panicking the kernel from softirq on ordinary egress.
+
+Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb
+now do. The helper returns the child's stashed skb first and is a no-op
+when there is none, so a work-conserving child is unaffected and the
+gated path now consumes the skb whose length was charged to the budget.
+
+Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
+Cc: stable@vger.kernel.org
+Cc: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-1-85c40b83c529@proton.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -749,7 +749,7 @@ static struct sk_buff *taprio_dequeue_fr
+ return NULL;
+
+ skip_peek_checks:
+- skb = child->ops->dequeue(child);
++ skb = qdisc_dequeue_peeked(child);
+ if (unlikely(!skb))
+ return NULL;
+
--- /dev/null
+From 526b8ef54668780c8f69e0211c342763d5dcbad1 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Thu, 25 Jun 2026 14:17:28 +0800
+Subject: net: wwan: iosm: bound device offsets in the MUX downlink decoder
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 526b8ef54668780c8f69e0211c342763d5dcbad1 upstream.
+
+mux_dl_adb_decode() walks a chain of aggregated datagram tables using
+offsets and lengths taken from the modem. first_table_index,
+next_table_index, table_length, datagram_index and datagram_length are
+all device supplied le values. Only first_table_index was checked, and
+only for being non zero. The decoder then formed adth = block +
+adth_index and read the table header and the datagram entries with no
+bound against the received skb. A modem that reports an index or a
+length past the downlink buffer makes the decoder read out of bounds.
+
+The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most
+that, so skb->len is the real limit, but none of these in band offsets
+were checked against it.
+
+The table chain is also followed with no forward progress check. The loop
+takes the next table from adth->next_table_index and stops only when that
+reaches zero. A modem can stage two tables that point at each other, so
+the loop never ends. It runs in softirq and clones the skb on every pass.
+
+Validate every device offset and length against skb->len before use.
+The block header must fit. Each table header, on entry and after every
+next_table_index, must lie inside the skb. The datagram table must fit.
+Each datagram index and length must stay inside the skb. The header
+padding must not exceed the datagram length so the receive length does
+not wrap. Require each next_table_index to move forward so the chain
+cannot cycle.
+
+This was reproduced under KASAN as a slab out of bounds read on a normal
+downlink receive once the iosm net device is up.
+
+Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/178236824878.3259367.5389624724479864947@maoyixie.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 +++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
++++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
+@@ -553,19 +553,21 @@ static int mux_dl_process_dg(struct iosm
+ u32 packet_offset, i, rc, dg_len;
+
+ for (i = 0; i < nr_of_dg; i++, dg++) {
+- if (le32_to_cpu(dg->datagram_index)
+- < sizeof(struct mux_adbh))
++ u32 dg_index = le32_to_cpu(dg->datagram_index);
++
++ dg_len = le16_to_cpu(dg->datagram_length);
++
++ if (dg_index < sizeof(struct mux_adbh))
+ goto dg_error;
+
+- /* Is the packet inside of the ADB */
+- if (le32_to_cpu(dg->datagram_index) >=
+- le32_to_cpu(adbh->block_length)) {
++ /* Is the packet inside of the ADB and the received skb ? */
++ if (dg_index >= le32_to_cpu(adbh->block_length) ||
++ dg_index >= skb->len ||
++ dg_len > skb->len - dg_index ||
++ dl_head_pad_len >= dg_len) {
+ goto dg_error;
+ } else {
+- packet_offset =
+- le32_to_cpu(dg->datagram_index) +
+- dl_head_pad_len;
+- dg_len = le16_to_cpu(dg->datagram_length);
++ packet_offset = dg_index + dl_head_pad_len;
+ /* Pass the packet to the netif layer. */
+ rc = ipc_mux_net_receive(ipc_mux, if_id, ipc_mux->wwan,
+ packet_offset,
+@@ -589,12 +591,16 @@ static void mux_dl_adb_decode(struct ios
+ struct mux_adbh *adbh;
+ struct mux_adth *adth;
+ int nr_of_dg, if_id;
+- u32 adth_index;
++ u32 adth_index, prev_index = 0;
+ u8 *block;
+
+ block = skb->data;
+ adbh = (struct mux_adbh *)block;
+
++ /* The block header itself must fit in the received skb. */
++ if (skb->len < sizeof(struct mux_adbh))
++ goto adb_decode_err;
++
+ /* Process the aggregated datagram tables. */
+ adth_index = le32_to_cpu(adbh->first_table_index);
+
+@@ -606,6 +612,16 @@ static void mux_dl_adb_decode(struct ios
+
+ /* Loop through mixed session tables. */
+ while (adth_index) {
++ /* The table header must lie within the received skb, and the
++ * chain must move forward so a modem cannot make the loop
++ * cycle between two tables.
++ */
++ if (adth_index <= prev_index ||
++ adth_index < sizeof(struct mux_adbh) ||
++ adth_index > skb->len - sizeof(struct mux_adth))
++ goto adb_decode_err;
++ prev_index = adth_index;
++
+ /* Get the reference to the table header. */
+ adth = (struct mux_adth *)(block + adth_index);
+
+@@ -629,6 +645,10 @@ static void mux_dl_adb_decode(struct ios
+ if (le16_to_cpu(adth->table_length) < sizeof(struct mux_adth))
+ goto adb_decode_err;
+
++ /* The whole datagram table must fit in the received skb. */
++ if (le16_to_cpu(adth->table_length) > skb->len - adth_index)
++ goto adb_decode_err;
++
+ /* Calculate the number of datagrams. */
+ nr_of_dg = (le16_to_cpu(adth->table_length) -
+ sizeof(struct mux_adth)) /
--- /dev/null
+From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Fri, 19 Jun 2026 04:38:20 -0500
+Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part()
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream.
+
+fill_from_part() computes the size of a directory entry in size_t but
+stores it in a __u32. An entry length near U32_MAX wraps it to a small
+value, bypasses the bounds check, and is then used to index the entry,
+reading far past the directory part -- an out-of-bounds read that oopses
+the kernel.
+
+Compute the size as a u64 so it cannot truncate; the bounds check then
+rejects the entry. The trailer is supplied by the userspace client.
+
+Fixes: 480e3e532e31 ("orangefs: support very large directories")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/orangefs/dir.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/fs/orangefs/dir.c
++++ b/fs/orangefs/dir.c
+@@ -191,7 +191,8 @@ static int fill_from_part(struct orangef
+ {
+ const int offset = sizeof(struct orangefs_readdir_response_s);
+ struct orangefs_khandle *khandle;
+- __u32 *len, padlen;
++ __u32 *len;
++ u64 padlen;
+ loff_t i;
+ char *s;
+ i = ctx->pos & ~PART_MASK;
+@@ -215,8 +216,8 @@ static int fill_from_part(struct orangef
+ * len is the size of the string itself. padlen is the
+ * total size of the encoded string.
+ */
+- padlen = (sizeof *len + *len + 1) +
+- (8 - (sizeof *len + *len + 1)%8)%8;
++ padlen = (u64)sizeof *len + *len + 1;
++ padlen += (8 - padlen % 8) % 8;
+ if (part->len < i + padlen + sizeof *khandle)
+ goto next;
+ s = (void *)part + offset + i + sizeof *len;
--- /dev/null
+From bc7b086a45521a986a49045907f017e3e46c763e Mon Sep 17 00:00:00 2001
+From: Martin Kaiser <martin@kaiser.cx>
+Date: Tue, 30 Jun 2026 21:40:03 +0200
+Subject: riscv: probes: save original sp in rethook trampoline
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+commit bc7b086a45521a986a49045907f017e3e46c763e upstream.
+
+Reading a word from the stack in a kretprobe crashes a risc-v kernel.
+
+$ cd /sys/kernel/tracing/
+$ echo 'r n_tty_write $stack0' > dynamic_events
+$ echo 1 > events/kprobes/enable
+Unable to handle kernel paging request at virtual address 0000000200000128
+...
+[<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38
+[<ffffffff80177196>] process_fetch_insn+0x3ee/0x760
+[<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0
+[<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58
+[<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90
+[<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108
+[<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c
+[<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94
+[<ffffffff8067872a>] tty_write+0x1a/0x30
+
+In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
+
+arch_rethook_trampoline saves the registers from the probed function in a
+struct pt_regs. sp is not saved. Instead, sp is decremented for
+arch_rethook_trampoline's local stack.
+
+Fix this crash and save the original sp along with the other registers.
+Use a0 as a temporary register, it is overwritten anyway.
+
+Cc: stable@vger.kernel.org
+Fixes: c22b0bcb1dd02 ("riscv: Add kprobes supported")
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Link: https://patch.msgid.link/20260630194010.1824039-1-martin@kaiser.cx
+[pjw@kernel.org: added Fixes tag; cc'ed stable]
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/probes/rethook_trampoline.S | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/riscv/kernel/probes/rethook_trampoline.S
++++ b/arch/riscv/kernel/probes/rethook_trampoline.S
+@@ -41,6 +41,9 @@
+ REG_S x29, PT_T4(sp)
+ REG_S x30, PT_T5(sp)
+ REG_S x31, PT_T6(sp)
++ /* save original sp */
++ addi a0, sp, PT_SIZE_ON_STACK
++ REG_S a0, PT_SP(sp)
+ .endm
+
+ .macro restore_all_base_regs
rtc-renesas-rtca3-fix-pie-clear-polling-condition-in-alarm-setup-error-path.patch
fscrypt-replace-mk_users-keyring-with-simple-list.patch
rtc-mpfs-fix-counter-upload-completion-condition.patch
+hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch
+hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch
+net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch
+acpi-tad-check-ac-wake-capability-before-enabling-wakeup.patch
+hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch
+fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch
+net-lan743x-initialize-eth_syslock-spinlock-before-use.patch
+net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch
+net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch
+fhandle-reject-detached-mounts-in-capable_wrt_mount.patch
+hwmon-max1619-add-missing-select-regmap-to-kconfig.patch
+tracing-probes-fix-double-addition-of-offset-for-foffset.patch
+orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch
+net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch
+ata-libata-core-add-nolpm-quirk-for-pny-cs900-1tb-ssd.patch
+ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch
+ata-libata-core-reject-an-invalid-concurrent-positioning-ranges-count.patch
+net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch
+net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch
+hwmon-asus_atk0110-check-package-count-before-accessing-element.patch
+riscv-probes-save-original-sp-in-rethook-trampoline.patch
--- /dev/null
+From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Thu, 25 Jun 2026 08:34:47 +0900
+Subject: tracing/probes: Fix double addition of offset for @+FOFFSET
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream.
+
+Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument
+ fetching code") wrongly use @offset local variable during the parsing,
+the offset value is added twice when dereferencing.
+Reset the @offset after setting it in FETCH_OP_FOFFS.
+
+Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/
+
+Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_probe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -1248,6 +1248,7 @@ parse_probe_arg(char *arg, const struct
+
+ code->op = FETCH_OP_FOFFS;
+ code->immediate = (unsigned long)offset; // imm64?
++ offset = 0;
+ } else {
+ /* uprobes don't support symbols */
+ if (!(ctx->flags & TPARG_FL_KERNEL)) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
