From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:09:24 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0184779456466d2c329f32276f6367c24a37350d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch net-lan743x-initialize-eth_syslock-spinlock-before-use.patch net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch tracing-probes-fix-double-addition-of-offset-for-foffset.patch --- diff --git a/queue-6.1/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch b/queue-6.1/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch new file mode 100644 index 0000000000..89cebcdc61 --- /dev/null +++ b/queue-6.1/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch @@ -0,0 +1,38 @@ +From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Thu, 25 Jun 2026 22:18:37 +0800 +Subject: ata: pata_pxa: Fix DMA channel leak on probe error + +From: Wentao Liang + +commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream. + +When dmaengine_slave_config() fails, the DMA channel acquired by +dma_request_chan() is not released before returning the error, +leaking the channel reference. + +Fix by adding dma_release_channel() in the error path. + +The ata_host_activate() error path already correctly releases the +DMA channel. + +Cc: stable@vger.kernel.org +Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion") +Signed-off-by: Wentao Liang +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_pxa.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/pata_pxa.c ++++ b/drivers/ata/pata_pxa.c +@@ -287,6 +287,7 @@ static int pxa_ata_probe(struct platform + ret = dmaengine_slave_config(data->dma_chan, &config); + if (ret < 0) { + dev_err(&pdev->dev, "dma configuration failed: %d\n", ret); ++ dma_release_channel(data->dma_chan); + return ret; + } + diff --git a/queue-6.1/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch b/queue-6.1/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch new file mode 100644 index 0000000000..351a74b6f6 --- /dev/null +++ b/queue-6.1/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch @@ -0,0 +1,41 @@ +From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Thu, 25 Jun 2026 08:48:34 +0800 +Subject: fsl/fman: Free init resources on KeyGen failure in fman_init() + +From: Haoxiang Li + +commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream. + +fman_muram_alloc() allocates initialization resources before +initializing the KeyGen block. If keygen_init() fails, the +function returns -EINVAL directly and leaves those resources +allocated. Free the initialization resources before returning +from the KeyGen failure path. + +Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen") +Cc: stable@kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Pavan Chebbi +Reviewed-by: Breno Leitao +Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fman/fman.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -1995,8 +1995,10 @@ static int fman_init(struct fman *fman) + + /* Init KeyGen */ + fman->keygen = keygen_init(fman->kg_regs); +- if (!fman->keygen) ++ if (!fman->keygen) { ++ free_init_resources(fman); + return -EINVAL; ++ } + + err = enable(fman, cfg); + if (err != 0) diff --git a/queue-6.1/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch b/queue-6.1/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch new file mode 100644 index 0000000000..a3f94f9ccb --- /dev/null +++ b/queue-6.1/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch @@ -0,0 +1,47 @@ +From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Fri, 19 Jun 2026 21:27:46 +0900 +Subject: hwmon: (asus_atk0110) Check package count before accessing element + +From: HyeongJun An + +commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream. + +atk_ec_present() walks the management group package returned by the GGRP +ACPI method and, for each sub-package, reads its first element: + + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + +without checking that the sub-package is non-empty. ACPICA allocates the +element array with exactly package.count entries, so for a sub-package +with a zero count this reads past the allocation. + +The sibling function atk_debugfs_ggrp_open() performs the same access but +skips empty packages with a package.count check first. Add the same +check to atk_ec_present() so a malformed firmware package cannot trigger +an out-of-bounds read. + +Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/asus_atk0110.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat + if (obj->type != ACPI_TYPE_PACKAGE) + continue; + ++ if (!obj->package.count) ++ continue; ++ + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + continue; diff --git a/queue-6.1/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch b/queue-6.1/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch new file mode 100644 index 0000000000..c47f64fe53 --- /dev/null +++ b/queue-6.1/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch @@ -0,0 +1,163 @@ +From e31408734332b8cc611342cdaaab6ba492180156 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Fri, 19 Jun 2026 09:59:38 +0800 +Subject: hwmon: (occ) unregister sysfs devices outside occ lock + +From: Runyu Xiao + +commit e31408734332b8cc611342cdaaab6ba492180156 upstream. + +occ_active(false) and occ_shutdown() unregister sysfs-backed devices while +occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can +wait for active sysfs callbacks to drain, and those callbacks can enter the +OCC update path and try to take occ->lock again. That gives the unregister +paths the lock ordering occ->lock -> sysfs callback drain, while a callback +has the opposite edge sysfs callback -> occ->lock. + +This issue was found by our static analysis tool and then manually +reviewed against the current tree. + +The grounded PoC kept the real unregister and callback carrier: + + occ_shutdown() + hwmon_device_unregister() + occ_show_temp_1() + occ_update_response() + +Lockdep reported the circular dependency with occ_shutdown() already +holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs +side: + + WARNING: possible circular locking dependency detected + ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv] + ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv] + occ_update_response.isra.0+0xb/0x20 [vuln_msv] + occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv] + *** DEADLOCK *** + +Serialize hwmon registration and removal with a separate hwmon_lock. +Under that lock, detach occ->hwmon and update occ->active while occ->lock +is held so concurrent OCC state changes still see a stable state, then +drop occ->lock before calling hwmon_device_unregister(). Remove the +driver sysfs group before taking occ->lock in occ_shutdown(), so draining +the driver attributes cannot wait while the OCC mutex is held. Also make +OCC update callbacks return -ENODEV after deactivation, so callbacks that +already passed sysfs active protection do not poll the hardware after +teardown has detached the hwmon device. + +Fixes: 849b0156d996 ("hwmon: (occ) Delay hwmon registration until user request") +Fixes: ac6888ac5a11 ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Link: https://lore.kernel.org/r/20260619015938.494464-1-runyu.xiao@seu.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/occ/common.c | 34 ++++++++++++++++++++++++++++------ + drivers/hwmon/occ/common.h | 1 + + 2 files changed, 29 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -214,6 +214,11 @@ int occ_update_response(struct occ *occ) + if (rc) + return rc; + ++ if (!occ->active) { ++ rc = -ENODEV; ++ goto unlock; ++ } ++ + /* limit the maximum rate of polling the OCC */ + if (time_after(jiffies, occ->next_update)) { + rc = occ_poll(occ); +@@ -222,6 +227,7 @@ int occ_update_response(struct occ *occ) + rc = occ->last_error; + } + ++unlock: + mutex_unlock(&occ->lock); + return rc; + } +@@ -1105,11 +1111,16 @@ static void occ_parse_poll_response(stru + + int occ_active(struct occ *occ, bool active) + { +- int rc = mutex_lock_interruptible(&occ->lock); ++ struct device *hwmon = NULL; ++ int rc = mutex_lock_interruptible(&occ->hwmon_lock); + + if (rc) + return rc; + ++ rc = mutex_lock_interruptible(&occ->lock); ++ if (rc) ++ goto unlock_hwmon; ++ + if (active) { + if (occ->active) { + rc = -EALREADY; +@@ -1154,14 +1165,17 @@ int occ_active(struct occ *occ, bool act + goto unlock; + } + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ hwmon = occ->hwmon; + occ->active = false; + occ->hwmon = NULL; + } + + unlock: + mutex_unlock(&occ->lock); ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++unlock_hwmon: ++ mutex_unlock(&occ->hwmon_lock); + return rc; + } + +@@ -1170,6 +1184,7 @@ int occ_setup(struct occ *occ) + int rc; + + mutex_init(&occ->lock); ++ mutex_init(&occ->hwmon_lock); + occ->groups[0] = &occ->group; + + rc = occ_setup_sysfs(occ); +@@ -1190,15 +1205,22 @@ EXPORT_SYMBOL_GPL(occ_setup); + + void occ_shutdown(struct occ *occ) + { +- mutex_lock(&occ->lock); ++ struct device *hwmon; + + occ_shutdown_sysfs(occ); + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ mutex_lock(&occ->hwmon_lock); ++ mutex_lock(&occ->lock); ++ ++ hwmon = occ->hwmon; ++ occ->active = false; + occ->hwmon = NULL; + + mutex_unlock(&occ->lock); ++ ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++ mutex_unlock(&occ->hwmon_lock); + } + EXPORT_SYMBOL_GPL(occ_shutdown); + +--- a/drivers/hwmon/occ/common.h ++++ b/drivers/hwmon/occ/common.h +@@ -101,6 +101,7 @@ struct occ { + + unsigned long next_update; + struct mutex lock; /* lock OCC access */ ++ struct mutex hwmon_lock; /* serialize hwmon registration/removal */ + + struct device *hwmon; + struct occ_attribute *attrs; diff --git a/queue-6.1/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch b/queue-6.1/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch new file mode 100644 index 0000000000..c4e609b61a --- /dev/null +++ b/queue-6.1/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch @@ -0,0 +1,49 @@ +From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:47:31 +0800 +Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove + +From: Pengpeng Hou + +commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream. + +w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when +VID information is available. + +The error path and remove callback only remove the common and optional +attribute groups. Those groups do not contain cpu0_vid or vrm, so the +files can remain after a later probe failure or after device removal +while their callbacks still expect live driver data. + +Remove the standalone VID sysfs files from both the probe error path and +the remove callback. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83627hf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwmon/w83627hf.c ++++ b/drivers/hwmon/w83627hf.c +@@ -1823,6 +1823,8 @@ static int w83627hf_probe(struct platfor + return 0; + + error: ++ device_remove_file(dev, &dev_attr_vrm); ++ device_remove_file(dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&dev->kobj, &w83627hf_group); + sysfs_remove_group(&dev->kobj, &w83627hf_group_opt); + return err; +@@ -1834,6 +1836,8 @@ static int w83627hf_remove(struct platfo + + hwmon_device_unregister(data->hwmon_dev); + ++ device_remove_file(&pdev->dev, &dev_attr_vrm); ++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt); + diff --git a/queue-6.1/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch b/queue-6.1/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch new file mode 100644 index 0000000000..23eddbe10e --- /dev/null +++ b/queue-6.1/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch @@ -0,0 +1,39 @@ +From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:48:06 +0800 +Subject: hwmon: (w83793) remove vrm sysfs file on probe failure + +From: Pengpeng Hou + +commit 77b983757280c69b0290811669ff1d31022e5f1d upstream. + +w83793_probe() creates the vrm sysfs file after creating the VID files +when VID support is present. + +The normal remove path deletes vrm, but the probe error path only +removes the sensor, SDA, VID, fan, PWM and temperature files. A later +probe failure can therefore leave vrm behind after the driver data has +been freed. + +Remove vrm in the probe error path next to the VID files, matching the +normal remove path. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83793.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/w83793.c ++++ b/drivers/hwmon/w83793.c +@@ -1918,6 +1918,7 @@ exit_remove: + + for (i = 0; i < ARRAY_SIZE(w83793_vid); i++) + device_remove_file(dev, &w83793_vid[i].dev_attr); ++ device_remove_file(dev, &dev_attr_vrm); + + for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++) + device_remove_file(dev, &w83793_left_fan[i].dev_attr); diff --git a/queue-6.1/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch b/queue-6.1/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch new file mode 100644 index 0000000000..c1c1c2ea0e --- /dev/null +++ b/queue-6.1/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch @@ -0,0 +1,46 @@ +From 39139b1c1c2b614096519b526112c726adb12ff0 Mon Sep 17 00:00:00 2001 +From: Andrea Righi +Date: Fri, 26 Jun 2026 18:32:18 +0200 +Subject: net: lan743x: Initialize eth_syslock spinlock before use + +From: Andrea Righi + +commit 39139b1c1c2b614096519b526112c726adb12ff0 upstream. + +lan743x_hardware_init() calls pci11x1x_strap_get_status() during the +PCI11x1x probe sequence. That helper acquires the Ethernet subsystem +hardware lock via lan743x_hs_syslock_acquire(), which relies on +adapter->eth_syslock_spinlock to serialize access. + +The spinlock is currently initialized only after the strap status is +read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized +spinlock can trip the spinlock debug check. + +Fix by initializing adapter->eth_syslock_spinlock before reading the +strap status so the probe path never attempts to lock an uninitialized +spinlock. + +Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G") +Cc: stable@vger.kernel.org # v6.0+ +Signed-off-by: Andrea Righi +Reviewed-by: David Thompson +Reviewed-by: Thangaraj Samynathan +Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microchip/lan743x_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -3293,8 +3293,8 @@ static int lan743x_hardware_init(struct + adapter->max_tx_channels = PCI11X1X_MAX_TX_CHANNELS; + adapter->used_tx_channels = PCI11X1X_USED_TX_CHANNELS; + adapter->max_vector_count = PCI11X1X_MAX_VECTOR_COUNT; +- pci11x1x_strap_get_status(adapter); + spin_lock_init(&adapter->eth_syslock_spinlock); ++ pci11x1x_strap_get_status(adapter); + mutex_init(&adapter->sgmii_rw_lock); + pci11x1x_set_rfe_rd_fifo_threshold(adapter); + sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL); diff --git a/queue-6.1/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch b/queue-6.1/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch new file mode 100644 index 0000000000..1c152dec8c --- /dev/null +++ b/queue-6.1/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch @@ -0,0 +1,64 @@ +From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Jun 2026 14:40:13 +0800 +Subject: net: liquidio: fix BAR resource leak on PF number failure + +From: Haoxiang Li + +commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream. + +If cn23xx_get_pf_num() fails, the function returns without +unmapping either BAR. Unmap both BARs before returning from +the error path. + +Found by manual code review. + +Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Larysa Zaremba +Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -1334,18 +1334,14 @@ int setup_cn23xx_octeon_pf_device(struct + if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) { + dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n", + __func__); +- octeon_unmap_pci_barx(oct, 0); +- return 1; ++ goto err_unmap_bar0; + } + + if (cn23xx_get_pf_num(oct) != 0) +- return 1; ++ goto err_unmap_bar1; + +- if (cn23xx_sriov_config(oct)) { +- octeon_unmap_pci_barx(oct, 0); +- octeon_unmap_pci_barx(oct, 1); +- return 1; +- } ++ if (cn23xx_sriov_config(oct)) ++ goto err_unmap_bar1; + + octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL); + +@@ -1376,6 +1372,12 @@ int setup_cn23xx_octeon_pf_device(struct + oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct); + + return 0; ++ ++err_unmap_bar1: ++ octeon_unmap_pci_barx(oct, 1); ++err_unmap_bar0: ++ octeon_unmap_pci_barx(oct, 0); ++ return 1; + } + + int validate_cn23xx_pf_config_info(struct octeon_device *oct, diff --git a/queue-6.1/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-6.1/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..e9d73d114b --- /dev/null +++ b/queue-6.1/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,44 @@ +From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:20 -0500 +Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream. + +multiq_dequeue() takes a packet from a band's child with a direct +->dequeue() call after multiq_peek() peeked it. When the child is +non-work-conserving the peek stashes the skb in the child's gso_skb, so +the direct dequeue returns a different skb and orphans the stash, +desyncing the child's qlen/backlog. With a qfq child reached through a +peeking parent (e.g. tbf) this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_prio already does +and as sch_red and sch_sfb were just fixed to do. The helper is a no-op +when the child has no stash, so a work-conserving child is unaffected. + +Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_multiq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st + if (!netif_xmit_stopped( + netdev_get_tx_queue(qdisc_dev(sch), q->curband))) { + qdisc = q->queues[q->curband]; +- skb = qdisc->dequeue(qdisc); ++ skb = qdisc_dequeue_peeked(qdisc); + if (skb) { + qdisc_bstats_update(sch, skb); + sch->q.qlen--; diff --git a/queue-6.1/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch b/queue-6.1/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch new file mode 100644 index 0000000000..389c60416c --- /dev/null +++ b/queue-6.1/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch @@ -0,0 +1,130 @@ +From 526b8ef54668780c8f69e0211c342763d5dcbad1 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 25 Jun 2026 14:17:28 +0800 +Subject: net: wwan: iosm: bound device offsets in the MUX downlink decoder + +From: Maoyi Xie + +commit 526b8ef54668780c8f69e0211c342763d5dcbad1 upstream. + +mux_dl_adb_decode() walks a chain of aggregated datagram tables using +offsets and lengths taken from the modem. first_table_index, +next_table_index, table_length, datagram_index and datagram_length are +all device supplied le values. Only first_table_index was checked, and +only for being non zero. The decoder then formed adth = block + +adth_index and read the table header and the datagram entries with no +bound against the received skb. A modem that reports an index or a +length past the downlink buffer makes the decoder read out of bounds. + +The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most +that, so skb->len is the real limit, but none of these in band offsets +were checked against it. + +The table chain is also followed with no forward progress check. The loop +takes the next table from adth->next_table_index and stops only when that +reaches zero. A modem can stage two tables that point at each other, so +the loop never ends. It runs in softirq and clones the skb on every pass. + +Validate every device offset and length against skb->len before use. +The block header must fit. Each table header, on entry and after every +next_table_index, must lie inside the skb. The datagram table must fit. +Each datagram index and length must stay inside the skb. The header +padding must not exceed the datagram length so the receive length does +not wrap. Require each next_table_index to move forward so the chain +cannot cycle. + +This was reproduced under KASAN as a slab out of bounds read on a normal +downlink receive once the iosm net device is up. + +Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") +Suggested-by: Loic Poulain +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Simon Horman +Reviewed-by: Loic Poulain +Link: https://patch.msgid.link/178236824878.3259367.5389624724479864947@maoyixie.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 +++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 10 deletions(-) + +--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c +@@ -553,19 +553,21 @@ static int mux_dl_process_dg(struct iosm + u32 packet_offset, i, rc, dg_len; + + for (i = 0; i < nr_of_dg; i++, dg++) { +- if (le32_to_cpu(dg->datagram_index) +- < sizeof(struct mux_adbh)) ++ u32 dg_index = le32_to_cpu(dg->datagram_index); ++ ++ dg_len = le16_to_cpu(dg->datagram_length); ++ ++ if (dg_index < sizeof(struct mux_adbh)) + goto dg_error; + +- /* Is the packet inside of the ADB */ +- if (le32_to_cpu(dg->datagram_index) >= +- le32_to_cpu(adbh->block_length)) { ++ /* Is the packet inside of the ADB and the received skb ? */ ++ if (dg_index >= le32_to_cpu(adbh->block_length) || ++ dg_index >= skb->len || ++ dg_len > skb->len - dg_index || ++ dl_head_pad_len >= dg_len) { + goto dg_error; + } else { +- packet_offset = +- le32_to_cpu(dg->datagram_index) + +- dl_head_pad_len; +- dg_len = le16_to_cpu(dg->datagram_length); ++ packet_offset = dg_index + dl_head_pad_len; + /* Pass the packet to the netif layer. */ + rc = ipc_mux_net_receive(ipc_mux, if_id, ipc_mux->wwan, + packet_offset, +@@ -589,12 +591,16 @@ static void mux_dl_adb_decode(struct ios + struct mux_adbh *adbh; + struct mux_adth *adth; + int nr_of_dg, if_id; +- u32 adth_index; ++ u32 adth_index, prev_index = 0; + u8 *block; + + block = skb->data; + adbh = (struct mux_adbh *)block; + ++ /* The block header itself must fit in the received skb. */ ++ if (skb->len < sizeof(struct mux_adbh)) ++ goto adb_decode_err; ++ + /* Process the aggregated datagram tables. */ + adth_index = le32_to_cpu(adbh->first_table_index); + +@@ -606,6 +612,16 @@ static void mux_dl_adb_decode(struct ios + + /* Loop through mixed session tables. */ + while (adth_index) { ++ /* The table header must lie within the received skb, and the ++ * chain must move forward so a modem cannot make the loop ++ * cycle between two tables. ++ */ ++ if (adth_index <= prev_index || ++ adth_index < sizeof(struct mux_adbh) || ++ adth_index > skb->len - sizeof(struct mux_adth)) ++ goto adb_decode_err; ++ prev_index = adth_index; ++ + /* Get the reference to the table header. */ + adth = (struct mux_adth *)(block + adth_index); + +@@ -630,6 +646,10 @@ static void mux_dl_adb_decode(struct ios + sizeof(struct mux_adth_dg))) + goto adb_decode_err; + ++ /* The whole datagram table must fit in the received skb. */ ++ if (le16_to_cpu(adth->table_length) > skb->len - adth_index) ++ goto adb_decode_err; ++ + /* Calculate the number of datagrams. */ + nr_of_dg = (le16_to_cpu(adth->table_length) - + sizeof(struct mux_adth) + diff --git a/queue-6.1/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch b/queue-6.1/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch new file mode 100644 index 0000000000..670d96fcf3 --- /dev/null +++ b/queue-6.1/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch @@ -0,0 +1,51 @@ +From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Fri, 19 Jun 2026 04:38:20 -0500 +Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part() + +From: Bryam Vargas + +commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream. + +fill_from_part() computes the size of a directory entry in size_t but +stores it in a __u32. An entry length near U32_MAX wraps it to a small +value, bypasses the bounds check, and is then used to index the entry, +reading far past the directory part -- an out-of-bounds read that oopses +the kernel. + +Compute the size as a u64 so it cannot truncate; the bounds check then +rejects the entry. The trailer is supplied by the userspace client. + +Fixes: 480e3e532e31 ("orangefs: support very large directories") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/orangefs/dir.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/orangefs/dir.c ++++ b/fs/orangefs/dir.c +@@ -191,7 +191,8 @@ static int fill_from_part(struct orangef + { + const int offset = sizeof(struct orangefs_readdir_response_s); + struct orangefs_khandle *khandle; +- __u32 *len, padlen; ++ __u32 *len; ++ u64 padlen; + loff_t i; + char *s; + i = ctx->pos & ~PART_MASK; +@@ -215,8 +216,8 @@ static int fill_from_part(struct orangef + * len is the size of the string itself. padlen is the + * total size of the encoded string. + */ +- padlen = (sizeof *len + *len + 1) + +- (8 - (sizeof *len + *len + 1)%8)%8; ++ padlen = (u64)sizeof *len + *len + 1; ++ padlen += (8 - padlen % 8) % 8; + if (part->len < i + padlen + sizeof *khandle) + goto next; + s = (void *)part + offset + i + sizeof *len; diff --git a/queue-6.1/series b/queue-6.1/series index 91219a9a40..02cdb15dbe 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -893,3 +893,15 @@ batman-adv-clean-untagged-vlan-on-netdev-registratio.patch loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch rtc-mpfs-fix-counter-upload-completion-condition.patch +hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch +hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch +net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch +hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch +fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch +net-lan743x-initialize-eth_syslock-spinlock-before-use.patch +net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +tracing-probes-fix-double-addition-of-offset-for-foffset.patch +orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch +ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch +net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch +hwmon-asus_atk0110-check-package-count-before-accessing-element.patch diff --git a/queue-6.1/tracing-probes-fix-double-addition-of-offset-for-foffset.patch b/queue-6.1/tracing-probes-fix-double-addition-of-offset-for-foffset.patch new file mode 100644 index 0000000000..169cd5f5ee --- /dev/null +++ b/queue-6.1/tracing-probes-fix-double-addition-of-offset-for-foffset.patch @@ -0,0 +1,34 @@ +From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 25 Jun 2026 08:34:47 +0900 +Subject: tracing/probes: Fix double addition of offset for @+FOFFSET + +From: Masami Hiramatsu (Google) + +commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream. + +Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument + fetching code") wrongly use @offset local variable during the parsing, +the offset value is added twice when dereferencing. +Reset the @offset after setting it in FETCH_OP_FOFFS. + +Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/ + +Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_probe.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -433,6 +433,7 @@ parse_probe_arg(char *arg, const struct + + code->op = FETCH_OP_FOFFS; + code->immediate = (unsigned long)offset; // imm64? ++ offset = 0; + } else { + /* uprobes don't support symbols */ + if (!(flags & TPARG_FL_KERNEL)) {