6.6-stable patches

added patches:
	bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch
	gpio-pca953x-fix-wrong-error-probe-return-value.patch

diff --git a/queue-6.6/bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch b/queue-6.6/bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch
new file mode 100644 (file)
index 0000000..37e9d3a
--- /dev/null
+++ b/queue-6.6/bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch
@@ -0,0 +1,45 @@
+From 7f9ee5fc97e14682e36fe22ae2654c07e4998b82 Mon Sep 17 00:00:00 2001
+From: Shardul Bankar <shardulsb08@gmail.com>
+Date: Tue, 14 Oct 2025 17:30:37 +0530
+Subject: bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
+
+From: Shardul Bankar <shardulsb08@gmail.com>
+
+commit 7f9ee5fc97e14682e36fe22ae2654c07e4998b82 upstream.
+
+Fix a memory leak in bpf_prog_test_run_xdp() where the context buffer
+allocated by bpf_ctx_init() is not freed when the function returns early
+due to a data size check.
+
+On the failing path:
+  ctx = bpf_ctx_init(...);
+  if (kattr->test.data_size_in - meta_sz < ETH_HLEN)
+      return -EINVAL;
+
+The early return bypasses the cleanup label that kfree()s ctx, leading to a
+leak detectable by kmemleak under fuzzing. Change the return to jump to the
+existing free_ctx label.
+
+Fixes: fe9544ed1a2e ("bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN")
+Reported-by: BPF Runtime Fuzzer (BRF)
+Signed-off-by: Shardul Bankar <shardulsb08@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://patch.msgid.link/20251014120037.1981316-1-shardulsb08@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bpf/test_run.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bpf/test_run.c
++++ b/net/bpf/test_run.c
+@@ -1214,7 +1214,7 @@ int bpf_prog_test_run_xdp(struct bpf_pro
+               goto free_ctx;
+ 
+       if (kattr->test.data_size_in - meta_sz < ETH_HLEN)
+-              return -EINVAL;
++              goto free_ctx;
+ 
+       data = bpf_test_init(kattr, linear_sz, max_linear_sz, headroom, tailroom);
+       if (IS_ERR(data)) {

diff --git a/queue-6.6/gpio-pca953x-fix-wrong-error-probe-return-value.patch b/queue-6.6/gpio-pca953x-fix-wrong-error-probe-return-value.patch
new file mode 100644 (file)
index 0000000..278aff9
--- /dev/null
+++ b/queue-6.6/gpio-pca953x-fix-wrong-error-probe-return-value.patch
@@ -0,0 +1,33 @@
+From 0a1db19f66c0960eb00e1f2ccd40708b6747f5b1 Mon Sep 17 00:00:00 2001
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Mon, 16 Jun 2025 15:45:03 +0200
+Subject: gpio: pca953x: fix wrong error probe return value
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+commit 0a1db19f66c0960eb00e1f2ccd40708b6747f5b1 upstream.
+
+The second argument to dev_err_probe() is the error value. Pass the
+return value of devm_request_threaded_irq() there instead of the irq
+number.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Fixes: c47f7ff0fe61 ("gpio: pca953x: Utilise dev_err_probe() where it makes sense")
+Link: https://lore.kernel.org/r/20250616134503.1201138-1-s.hauer@pengutronix.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-pca953x.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -989,7 +989,7 @@ static int pca953x_irq_setup(struct pca9
+                                       IRQF_ONESHOT | IRQF_SHARED, dev_name(dev),
+                                       chip);
+       if (ret)
+-              return dev_err_probe(dev, client->irq, "failed to request irq\n");
++              return dev_err_probe(dev, ret, "failed to request irq\n");
+ 
+       return 0;
+ }

diff --git a/queue-6.6/series b/queue-6.6/series
index a9d1bec1d42843ba90fcf90a9ac432d5ec9112e3..a7395f504d263249917bea248ac9fa81e78b7a06 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -84,3 +84,5 @@ alsa-usb-audio-update-for-native-dsd-support-quirks.patch
 asoc-amd-yc-add-quirk-for-honor-magicbook-x16-2025.patch
 asoc-fsl_sai-add-missing-registers-to-cache-default.patch
 scsi-sg-fix-occasional-bogus-elapsed-time-that-excee.patch
+bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch
+gpio-pca953x-fix-wrong-error-probe-return-value.patch