From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 12:23:41 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.10.263~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=019cf29c2a831f954701dddb5d5b053886c76798;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: ata-ahci-make-ahci_ignore_port-handle-empty-mask_port_map.patch bluetooth-iso-fix-connected-closed-transition-on-shutdown-release.patch of-reserved_mem-avoid-post-init-uaf-when-alloc_reserved_mem_array-fails.patch --- diff --git a/queue-6.12/ata-ahci-make-ahci_ignore_port-handle-empty-mask_port_map.patch b/queue-6.12/ata-ahci-make-ahci_ignore_port-handle-empty-mask_port_map.patch new file mode 100644 index 0000000000..1da1ff27a0 --- /dev/null +++ b/queue-6.12/ata-ahci-make-ahci_ignore_port-handle-empty-mask_port_map.patch @@ -0,0 +1,74 @@ +From 130ff5c8b78e6fd05270a04985c50bce6a3de6c1 Mon Sep 17 00:00:00 2001 +From: Niklas Cassel +Date: Tue, 25 Feb 2025 15:16:12 +0100 +Subject: ata: ahci: Make ahci_ignore_port() handle empty mask_port_map +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Cassel + +commit 130ff5c8b78e6fd05270a04985c50bce6a3de6c1 upstream. + +Commit 8c87215dd3a2 ("ata: libahci_platform: support non-consecutive port +numbers") added a skip to ahci_platform_enable_phys() for ports that are +not in mask_port_map. + +The code in ahci_platform_get_resources(), will currently set mask_port_map +for each child "port" node it finds in the device tree. + +However, device trees that do not have any child "port" nodes will not have +mask_port_map set, and for non-device tree platforms mask_port_map will +only exist as a quirk for specific PCI device + vendor IDs, or as a kernel +module parameter, but will not be set by default. + +Therefore, the common thing is that mask_port_map is only set if you do not +want to use all ports (as defined by Offset 0Ch: PI – Ports Implemented +register), but instead only want to use the ports in mask_port_map. If +mask_port_map is not set, all ports are available. + +Thus, ahci_ignore_port() must be able to handle an empty mask_port_map. + +Fixes: 8c87215dd3a2 ("ata: libahci_platform: support non-consecutive port numbers") +Fixes: 2c202e6c4f4d ("ata: libahci_platform: Do not set mask_port_map when not needed") +Fixes: c9b5be909e65 ("ahci: Introduce ahci_ignore_port() helper") +Reported-by: Marek Szyprowski +Closes: https://lore.kernel.org/linux-ide/10b31dd0-d0bb-4f76-9305-2195c3e17670@samsung.com/ +Tested-by: Marek Szyprowski +Co-developed-by: Damien Le Moal +Signed-off-by: Damien Le Moal +Link: https://lore.kernel.org/r/20250225141612.942170-2-cassel@kernel.org +Signed-off-by: Niklas Cassel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/ahci.h | 8 ++++++-- + drivers/ata/libahci.c | 1 + + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -387,8 +387,12 @@ struct ahci_host_priv { + static inline bool ahci_ignore_port(struct ahci_host_priv *hpriv, + unsigned int portid) + { +- return portid >= hpriv->nports || +- !(hpriv->mask_port_map & (1 << portid)); ++ if (portid >= hpriv->nports) ++ return true; ++ /* mask_port_map not set means that all ports are available */ ++ if (!hpriv->mask_port_map) ++ return false; ++ return !(hpriv->mask_port_map & (1 << portid)); + } + + extern int ahci_ignore_sss; +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -542,6 +542,7 @@ void ahci_save_initial_config(struct dev + hpriv->saved_port_map = port_map; + } + ++ /* mask_port_map not set means that all ports are available */ + if (hpriv->mask_port_map) { + dev_warn(dev, "masking port_map 0x%lx -> 0x%lx\n", + port_map, diff --git a/queue-6.12/bluetooth-iso-fix-connected-closed-transition-on-shutdown-release.patch b/queue-6.12/bluetooth-iso-fix-connected-closed-transition-on-shutdown-release.patch new file mode 100644 index 0000000000..8b9d4c79c7 --- /dev/null +++ b/queue-6.12/bluetooth-iso-fix-connected-closed-transition-on-shutdown-release.patch @@ -0,0 +1,101 @@ +From 0786469ee242952008628ed0e2d386098e2065ab Mon Sep 17 00:00:00 2001 +From: Pauli Virtanen +Date: Fri, 24 Jul 2026 23:20:24 +0300 +Subject: Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release + +From: Pauli Virtanen + +commit 0786469ee242952008628ed0e2d386098e2065ab upstream. + +Commit d57e506f6a1e ("Bluetooth: ISO: clear iso_data always when detaching conn from hcon") +merged a version of the UAF fix that breaks releasing connected +ISO sockets. Since hci_conn::iso_data is set to NULL, iso_chan_del() won't +be called when the hci_conn disconnects, and the ISO socket does not emit +POLLHUP correctly. + +Fix by retaining full hci_conn <-> iso_conn association while in +BT_DISCONNECT state, so that local disconnect via shutdown() follows +similar ISO socket code path as remote disconnect. Use a separate flag +to track whether hci_conn_drop() is needed, instead of setting +iso_conn::hcon = NULL + +In iso_sock_ready(), disallow disconnecting socket going BT_CONNECTED, +in case hcon connects while its drop is pending. + +Fixes: d57e506f6a1e ("Bluetooth: ISO: clear iso_data always when detaching conn from hcon") +Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/iso.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -23,8 +23,14 @@ static struct bt_sock_list iso_sk_list = + }; + + /* ---- ISO connections ---- */ ++enum { ++ ISO_CONN_DROPPED, ++ __ISO_CONN_NUM_FLAGS ++}; ++ + struct iso_conn { + struct hci_conn *hcon; ++ DECLARE_BITMAP(flags, __ISO_CONN_NUM_FLAGS); + + /* @lock: spinlock protecting changes to iso_conn fields */ + spinlock_t lock; +@@ -105,7 +111,8 @@ static void iso_conn_free(struct kref *r + + if (conn->hcon) { + conn->hcon->iso_data = NULL; +- hci_conn_drop(conn->hcon); ++ if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) ++ hci_conn_drop(conn->hcon); + } + + kfree_skb(conn->rx_skb); +@@ -299,6 +306,7 @@ static int __iso_chan_add(struct iso_con + + iso_pi(sk)->conn = conn; + conn->sk = sk; ++ clear_bit(ISO_CONN_DROPPED, conn->flags); + + if (parent) + bt_accept_enqueue(parent, sk, true); +@@ -813,11 +821,8 @@ static void iso_sock_disconn(struct sock + } + + sk->sk_state = BT_DISCONN; +- iso_conn_lock(iso_pi(sk)->conn); +- hci_conn_drop(iso_pi(sk)->conn->hcon); +- iso_pi(sk)->conn->hcon->iso_data = NULL; +- iso_pi(sk)->conn->hcon = NULL; +- iso_conn_unlock(iso_pi(sk)->conn); ++ if (!test_and_set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags)) ++ hci_conn_drop(iso_pi(sk)->conn->hcon); + } + + static void __iso_sock_close(struct sock *sk) +@@ -1894,9 +1899,18 @@ static void iso_sock_ready(struct sock * + return; + + lock_sock(sk); ++ ++ switch (sk->sk_state) { ++ case BT_DISCONN: ++ case BT_CLOSED: ++ release_sock(sk); ++ return; ++ } ++ + iso_sock_clear_timer(sk); + sk->sk_state = BT_CONNECTED; + sk->sk_state_change(sk); ++ + release_sock(sk); + } + diff --git a/queue-6.12/of-reserved_mem-avoid-post-init-uaf-when-alloc_reserved_mem_array-fails.patch b/queue-6.12/of-reserved_mem-avoid-post-init-uaf-when-alloc_reserved_mem_array-fails.patch new file mode 100644 index 0000000000..db29bef412 --- /dev/null +++ b/queue-6.12/of-reserved_mem-avoid-post-init-uaf-when-alloc_reserved_mem_array-fails.patch @@ -0,0 +1,93 @@ +From e1686ca81dbf3edbde589b7daf312b45cbf76e03 Mon Sep 17 00:00:00 2001 +From: Wandun Chen +Date: Thu, 4 Jun 2026 09:53:32 +0800 +Subject: of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails + +From: Wandun Chen + +commit e1686ca81dbf3edbde589b7daf312b45cbf76e03 upstream. + +The global pointer 'reserved_mem' continues to reference the +reserved_mem_array which lives in __initdata if +alloc_reserved_mem_array() fails. of_reserved_mem_lookup() is +exported for post-init use, that would dereference freed memory +and trigger a use-after-free. + +So reset reserved_mem_count to 0 when alloc_reserved_mem_array() +fails. + +Fixes: 00c9a452a235 ("of: reserved_mem: Add code to dynamically allocate reserved_mem array") +Signed-off-by: Wandun Chen +Link: https://patch.msgid.link/20260604015332.3669384-1-chenwandun1@gmail.com +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/of_reserved_mem.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -70,29 +70,32 @@ static int __init early_init_dt_alloc_re + * the initial static array is copied over to this new array and + * the new array is used from this point on. + */ +-static void __init alloc_reserved_mem_array(void) ++static int __init alloc_reserved_mem_array(void) + { + struct reserved_mem *new_array; + size_t alloc_size, copy_size, memset_size; ++ int ret; ++ ++ if (!total_reserved_mem_cnt) ++ return 0; + + alloc_size = array_size(total_reserved_mem_cnt, sizeof(*new_array)); + if (alloc_size == SIZE_MAX) { +- pr_err("Failed to allocate memory for reserved_mem array with err: %d", -EOVERFLOW); +- return; ++ ret = -EOVERFLOW; ++ goto fail; + } + + new_array = memblock_alloc(alloc_size, SMP_CACHE_BYTES); + if (!new_array) { +- pr_err("Failed to allocate memory for reserved_mem array with err: %d", -ENOMEM); +- return; ++ ret = -ENOMEM; ++ goto fail; + } + + copy_size = array_size(reserved_mem_count, sizeof(*new_array)); + if (copy_size == SIZE_MAX) { + memblock_free(new_array, alloc_size); +- total_reserved_mem_cnt = MAX_RESERVED_REGIONS; +- pr_err("Failed to allocate memory for reserved_mem array with err: %d", -EOVERFLOW); +- return; ++ ret = -EOVERFLOW; ++ goto fail; + } + + memset_size = alloc_size - copy_size; +@@ -101,6 +104,12 @@ static void __init alloc_reserved_mem_ar + memset(new_array + reserved_mem_count, 0, memset_size); + + reserved_mem = new_array; ++ return 0; ++ ++fail: ++ pr_err("Failed to allocate memory for reserved_mem array with err: %d", ret); ++ reserved_mem_count = 0; ++ return ret; + } + + static void __init fdt_init_reserved_mem_node(struct reserved_mem *rmem); +@@ -246,7 +255,8 @@ void __init fdt_scan_reserved_mem_reg_no + } + + /* Attempt dynamic allocation of a new reserved_mem array */ +- alloc_reserved_mem_array(); ++ if (alloc_reserved_mem_array()) ++ return; + + if (__reserved_mem_check_root(node)) { + pr_err("Reserved memory: unsupported node format, ignoring\n"); diff --git a/queue-6.12/series b/queue-6.12/series index 1e7e83e396..db833ae5d3 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -268,3 +268,6 @@ drm-vmwgfx-validate-external-bo-copy-bounds-for-both-stride-paths.patch spi-spi-cadence-enable-spi_controller_must_tx.patch hid-logitech-dj-fix-maxfield-check-in-dj-short-report-validation.patch ata-libahci_platform-do-not-set-mask_port_map-when-not-needed.patch +ata-ahci-make-ahci_ignore_port-handle-empty-mask_port_map.patch +of-reserved_mem-avoid-post-init-uaf-when-alloc_reserved_mem_array-fails.patch +bluetooth-iso-fix-connected-closed-transition-on-shutdown-release.patch