--- /dev/null
+From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Thu, 25 Jun 2026 22:18:37 +0800
+Subject: ata: pata_pxa: Fix DMA channel leak on probe error
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream.
+
+When dmaengine_slave_config() fails, the DMA channel acquired by
+dma_request_chan() is not released before returning the error,
+leaking the channel reference.
+
+Fix by adding dma_release_channel() in the error path.
+
+The ata_host_activate() error path already correctly releases the
+DMA channel.
+
+Cc: stable@vger.kernel.org
+Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/pata_pxa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/pata_pxa.c
++++ b/drivers/ata/pata_pxa.c
+@@ -287,6 +287,7 @@ static int pxa_ata_probe(struct platform
+ ret = dmaengine_slave_config(data->dma_chan, &config);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "dma configuration failed: %d\n", ret);
++ dma_release_channel(data->dma_chan);
+ return ret;
+ }
+
--- /dev/null
+From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Thu, 25 Jun 2026 08:48:34 +0800
+Subject: fsl/fman: Free init resources on KeyGen failure in fman_init()
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream.
+
+fman_muram_alloc() allocates initialization resources before
+initializing the KeyGen block. If keygen_init() fails, the
+function returns -EINVAL directly and leaves those resources
+allocated. Free the initialization resources before returning
+from the KeyGen failure path.
+
+Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen")
+Cc: stable@kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fman/fman.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -2022,8 +2022,10 @@ static int fman_init(struct fman *fman)
+
+ /* Init KeyGen */
+ fman->keygen = keygen_init(fman->kg_regs);
+- if (!fman->keygen)
++ if (!fman->keygen) {
++ free_init_resources(fman);
+ return -EINVAL;
++ }
+
+ err = enable(fman, cfg);
+ if (err != 0)
--- /dev/null
+From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001
+From: HyeongJun An <sammiee5311@gmail.com>
+Date: Fri, 19 Jun 2026 21:27:46 +0900
+Subject: hwmon: (asus_atk0110) Check package count before accessing element
+
+From: HyeongJun An <sammiee5311@gmail.com>
+
+commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream.
+
+atk_ec_present() walks the management group package returned by the GGRP
+ACPI method and, for each sub-package, reads its first element:
+
+ id = &obj->package.elements[0];
+ if (id->type != ACPI_TYPE_INTEGER)
+
+without checking that the sub-package is non-empty. ACPICA allocates the
+element array with exactly package.count entries, so for a sub-package
+with a zero count this reads past the allocation.
+
+The sibling function atk_debugfs_ggrp_open() performs the same access but
+skips empty packages with a package.count check first. Add the same
+check to atk_ec_present() so a malformed firmware package cannot trigger
+an out-of-bounds read.
+
+Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
+Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/asus_atk0110.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/hwmon/asus_atk0110.c
++++ b/drivers/hwmon/asus_atk0110.c
+@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat
+ if (obj->type != ACPI_TYPE_PACKAGE)
+ continue;
+
++ if (!obj->package.count)
++ continue;
++
+ id = &obj->package.elements[0];
+ if (id->type != ACPI_TYPE_INTEGER)
+ continue;
--- /dev/null
+From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Mon, 15 Jun 2026 14:47:31 +0800
+Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream.
+
+w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when
+VID information is available.
+
+The error path and remove callback only remove the common and optional
+attribute groups. Those groups do not contain cpu0_vid or vrm, so the
+files can remain after a later probe failure or after device removal
+while their callbacks still expect live driver data.
+
+Remove the standalone VID sysfs files from both the probe error path and
+the remove callback.
+
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83627hf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -1551,6 +1551,8 @@ static int w83627hf_probe(struct platfor
+ return 0;
+
+ error:
++ device_remove_file(dev, &dev_attr_vrm);
++ device_remove_file(dev, &dev_attr_cpu0_vid);
+ sysfs_remove_group(&dev->kobj, &w83627hf_group);
+ sysfs_remove_group(&dev->kobj, &w83627hf_group_opt);
+ return err;
+@@ -1562,6 +1564,8 @@ static int w83627hf_remove(struct platfo
+
+ hwmon_device_unregister(data->hwmon_dev);
+
++ device_remove_file(&pdev->dev, &dev_attr_vrm);
++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid);
+ sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group);
+ sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt);
+
--- /dev/null
+From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Mon, 15 Jun 2026 14:48:06 +0800
+Subject: hwmon: (w83793) remove vrm sysfs file on probe failure
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 77b983757280c69b0290811669ff1d31022e5f1d upstream.
+
+w83793_probe() creates the vrm sysfs file after creating the VID files
+when VID support is present.
+
+The normal remove path deletes vrm, but the probe error path only
+removes the sensor, SDA, VID, fan, PWM and temperature files. A later
+probe failure can therefore leave vrm behind after the driver data has
+been freed.
+
+Remove vrm in the probe error path next to the VID files, matching the
+normal remove path.
+
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/w83793.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/w83793.c
++++ b/drivers/hwmon/w83793.c
+@@ -1920,6 +1920,7 @@ exit_remove:
+
+ for (i = 0; i < ARRAY_SIZE(w83793_vid); i++)
+ device_remove_file(dev, &w83793_vid[i].dev_attr);
++ device_remove_file(dev, &dev_attr_vrm);
+
+ for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++)
+ device_remove_file(dev, &w83793_left_fan[i].dev_attr);
--- /dev/null
+From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Wed, 24 Jun 2026 14:40:13 +0800
+Subject: net: liquidio: fix BAR resource leak on PF number failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream.
+
+If cn23xx_get_pf_num() fails, the function returns without
+unmapping either BAR. Unmap both BARs before returning from
+the error path.
+
+Found by manual code review.
+
+Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+@@ -1334,18 +1334,14 @@ int setup_cn23xx_octeon_pf_device(struct
+ if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) {
+ dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n",
+ __func__);
+- octeon_unmap_pci_barx(oct, 0);
+- return 1;
++ goto err_unmap_bar0;
+ }
+
+ if (cn23xx_get_pf_num(oct) != 0)
+- return 1;
++ goto err_unmap_bar1;
+
+- if (cn23xx_sriov_config(oct)) {
+- octeon_unmap_pci_barx(oct, 0);
+- octeon_unmap_pci_barx(oct, 1);
+- return 1;
+- }
++ if (cn23xx_sriov_config(oct))
++ goto err_unmap_bar1;
+
+ octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL);
+
+@@ -1376,6 +1372,12 @@ int setup_cn23xx_octeon_pf_device(struct
+ oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct);
+
+ return 0;
++
++err_unmap_bar1:
++ octeon_unmap_pci_barx(oct, 1);
++err_unmap_bar0:
++ octeon_unmap_pci_barx(oct, 0);
++ return 1;
+ }
+
+ int validate_cn23xx_pf_config_info(struct octeon_device *oct,
--- /dev/null
+From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Thu, 25 Jun 2026 04:51:20 -0500
+Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream.
+
+multiq_dequeue() takes a packet from a band's child with a direct
+->dequeue() call after multiq_peek() peeked it. When the child is
+non-work-conserving the peek stashes the skb in the child's gso_skb, so
+the direct dequeue returns a different skb and orphans the stash,
+desyncing the child's qlen/backlog. With a qfq child reached through a
+peeking parent (e.g. tbf) this re-enters the child on an emptied list and
+dereferences NULL, panicking the kernel from softirq on ordinary egress.
+
+Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
+and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
+when the child has no stash, so a work-conserving child is unaffected.
+
+Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_multiq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_multiq.c
++++ b/net/sched/sch_multiq.c
+@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st
+ if (!netif_xmit_stopped(
+ netdev_get_tx_queue(qdisc_dev(sch), q->curband))) {
+ qdisc = q->queues[q->curband];
+- skb = qdisc->dequeue(qdisc);
++ skb = qdisc_dequeue_peeked(qdisc);
+ if (skb) {
+ qdisc_bstats_update(sch, skb);
+ sch->q.qlen--;
--- /dev/null
+From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Fri, 19 Jun 2026 04:38:20 -0500
+Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part()
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream.
+
+fill_from_part() computes the size of a directory entry in size_t but
+stores it in a __u32. An entry length near U32_MAX wraps it to a small
+value, bypasses the bounds check, and is then used to index the entry,
+reading far past the directory part -- an out-of-bounds read that oopses
+the kernel.
+
+Compute the size as a u64 so it cannot truncate; the bounds check then
+rejects the entry. The trailer is supplied by the userspace client.
+
+Fixes: 480e3e532e31 ("orangefs: support very large directories")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/orangefs/dir.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/fs/orangefs/dir.c
++++ b/fs/orangefs/dir.c
+@@ -191,7 +191,8 @@ static int fill_from_part(struct orangef
+ {
+ const int offset = sizeof(struct orangefs_readdir_response_s);
+ struct orangefs_khandle *khandle;
+- __u32 *len, padlen;
++ __u32 *len;
++ u64 padlen;
+ loff_t i;
+ char *s;
+ i = ctx->pos & ~PART_MASK;
+@@ -215,8 +216,8 @@ static int fill_from_part(struct orangef
+ * len is the size of the string itself. padlen is the
+ * total size of the encoded string.
+ */
+- padlen = (sizeof *len + *len + 1) +
+- (8 - (sizeof *len + *len + 1)%8)%8;
++ padlen = (u64)sizeof *len + *len + 1;
++ padlen += (8 - padlen % 8) % 8;
+ if (part->len < i + padlen + sizeof *khandle)
+ goto next;
+ s = (void *)part + offset + i + sizeof *len;
rtmutex-use-waiter-task-instead-of-current-in-remove_waiter.patch
locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch
bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch
+hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch
+hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch
+net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch
+fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch
+net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch
+tracing-probes-fix-double-addition-of-offset-for-foffset.patch
+orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch
+ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch
+hwmon-asus_atk0110-check-package-count-before-accessing-element.patch
--- /dev/null
+From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Thu, 25 Jun 2026 08:34:47 +0900
+Subject: tracing/probes: Fix double addition of offset for @+FOFFSET
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream.
+
+Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument
+ fetching code") wrongly use @offset local variable during the parsing,
+the offset value is added twice when dereferencing.
+Reset the @offset after setting it in FETCH_OP_FOFFS.
+
+Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/
+
+Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_probe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -401,6 +401,7 @@ parse_probe_arg(char *arg, const struct
+
+ code->op = FETCH_OP_FOFFS;
+ code->immediate = (unsigned long)offset; // imm64?
++ offset = 0;
+ } else {
+ /* uprobes don't support symbols */
+ if (!(flags & TPARG_FL_KERNEL)) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
