From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:09:46 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0a793afc8c235ea7e4478f8a54dd6b2ba5e044aa;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch fhandle-reject-detached-mounts-in-capable_wrt_mount.patch fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch hwmon-max1619-add-missing-select-regmap-to-kconfig.patch hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch net-lan743x-initialize-eth_syslock-spinlock-before-use.patch net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch riscv-probes-save-original-sp-in-rethook-trampoline.patch tracing-probes-fix-double-addition-of-offset-for-foffset.patch --- diff --git a/queue-6.12/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch b/queue-6.12/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch new file mode 100644 index 0000000000..dee8ce4bb6 --- /dev/null +++ b/queue-6.12/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch @@ -0,0 +1,38 @@ +From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Thu, 25 Jun 2026 22:18:37 +0800 +Subject: ata: pata_pxa: Fix DMA channel leak on probe error + +From: Wentao Liang + +commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream. + +When dmaengine_slave_config() fails, the DMA channel acquired by +dma_request_chan() is not released before returning the error, +leaking the channel reference. + +Fix by adding dma_release_channel() in the error path. + +The ata_host_activate() error path already correctly releases the +DMA channel. + +Cc: stable@vger.kernel.org +Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion") +Signed-off-by: Wentao Liang +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_pxa.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/pata_pxa.c ++++ b/drivers/ata/pata_pxa.c +@@ -286,6 +286,7 @@ static int pxa_ata_probe(struct platform + ret = dmaengine_slave_config(data->dma_chan, &config); + if (ret < 0) { + dev_err(&pdev->dev, "dma configuration failed: %d\n", ret); ++ dma_release_channel(data->dma_chan); + return ret; + } + diff --git a/queue-6.12/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch b/queue-6.12/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch new file mode 100644 index 0000000000..19e0147355 --- /dev/null +++ b/queue-6.12/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch @@ -0,0 +1,48 @@ +From 6c732471740bc2ac9b0946134f9f551dc75f4369 Mon Sep 17 00:00:00 2001 +From: David Lee +Date: Wed, 1 Jul 2026 11:44:28 +0000 +Subject: fhandle: reject detached mounts in capable_wrt_mount() + +From: David Lee + +commit 6c732471740bc2ac9b0946134f9f551dc75f4369 upstream. + +The recent fhandle RCU fix moved the mount namespace capability check +into capable_wrt_mount(), so a non-NULL mnt_namespace survives the +ns_capable() dereference. The helper still assumes the later +READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh() +checked is_mounted() first. + +That assumption is not stable. A detached mount from +open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while +open_by_handle_at() is between those checks, and umount_tree() can +clear mount->mnt_ns. If the helper observes NULL, it dereferences +mnt_ns->user_ns and panics. + +Return false when the RCU read observes a detached mount. This keeps +the relaxed permission path conservative: a mount no longer attached +to a namespace cannot authorize open_by_handle_at() access. + +Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") +Cc: stable@vger.kernel.org +Signed-off-by: David Lee +Assisted-by: LLM +Link: https://patch.msgid.link/20260701114438.24431-1-david.lee@trailofbits.com +Reviewed-by: Jeff Layton +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/fhandle.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -252,7 +252,7 @@ static bool capable_wrt_mount(struct mou + */ + guard(rcu)(); + mnt_ns = READ_ONCE(mount->mnt_ns); +- return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); ++ return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); + } + + /* diff --git a/queue-6.12/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch b/queue-6.12/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch new file mode 100644 index 0000000000..351a74b6f6 --- /dev/null +++ b/queue-6.12/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch @@ -0,0 +1,41 @@ +From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Thu, 25 Jun 2026 08:48:34 +0800 +Subject: fsl/fman: Free init resources on KeyGen failure in fman_init() + +From: Haoxiang Li + +commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream. + +fman_muram_alloc() allocates initialization resources before +initializing the KeyGen block. If keygen_init() fails, the +function returns -EINVAL directly and leaves those resources +allocated. Free the initialization resources before returning +from the KeyGen failure path. + +Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen") +Cc: stable@kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Pavan Chebbi +Reviewed-by: Breno Leitao +Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fman/fman.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -1995,8 +1995,10 @@ static int fman_init(struct fman *fman) + + /* Init KeyGen */ + fman->keygen = keygen_init(fman->kg_regs); +- if (!fman->keygen) ++ if (!fman->keygen) { ++ free_init_resources(fman); + return -EINVAL; ++ } + + err = enable(fman, cfg); + if (err != 0) diff --git a/queue-6.12/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch b/queue-6.12/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch new file mode 100644 index 0000000000..c11fde4e76 --- /dev/null +++ b/queue-6.12/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch @@ -0,0 +1,47 @@ +From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Fri, 19 Jun 2026 21:27:46 +0900 +Subject: hwmon: (asus_atk0110) Check package count before accessing element + +From: HyeongJun An + +commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream. + +atk_ec_present() walks the management group package returned by the GGRP +ACPI method and, for each sub-package, reads its first element: + + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + +without checking that the sub-package is non-empty. ACPICA allocates the +element array with exactly package.count entries, so for a sub-package +with a zero count this reads past the allocation. + +The sibling function atk_debugfs_ggrp_open() performs the same access but +skips empty packages with a package.count check first. Add the same +check to atk_ec_present() so a malformed firmware package cannot trigger +an out-of-bounds read. + +Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/asus_atk0110.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -1036,6 +1036,9 @@ static int atk_ec_present(struct atk_dat + if (obj->type != ACPI_TYPE_PACKAGE) + continue; + ++ if (!obj->package.count) ++ continue; ++ + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + continue; diff --git a/queue-6.12/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch b/queue-6.12/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch new file mode 100644 index 0000000000..f8a8a2a68a --- /dev/null +++ b/queue-6.12/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch @@ -0,0 +1,33 @@ +From 943a749bdffdd2132fab9240db890e07d93e1fcf Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Mon, 29 Jun 2026 21:17:39 +0200 +Subject: hwmon: (max1619) add missing 'select REGMAP' to Kconfig + +From: Joshua Crofts + +commit 943a749bdffdd2132fab9240db890e07d93e1fcf upstream. + +The Kconfig entry for the MAX1619 sensor doesn't contain a +`select REGMAP` parameter, causing build failures if regmap +isn't selected previously during the build process. + +Fixes: f8016132ce49 ("hwmon: (max1619) Convert to use regmap") +Cc: stable@vger.kernel.org +Signed-off-by: Joshua Crofts +Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-1-8104df929b1a@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1141,6 +1141,7 @@ config SENSORS_MAX16065 + config SENSORS_MAX1619 + tristate "Maxim MAX1619 sensor chip" + depends on I2C ++ select REGMAP + help + If you say yes here you get support for MAX1619 sensor chip. + diff --git a/queue-6.12/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch b/queue-6.12/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch new file mode 100644 index 0000000000..c47f64fe53 --- /dev/null +++ b/queue-6.12/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch @@ -0,0 +1,163 @@ +From e31408734332b8cc611342cdaaab6ba492180156 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Fri, 19 Jun 2026 09:59:38 +0800 +Subject: hwmon: (occ) unregister sysfs devices outside occ lock + +From: Runyu Xiao + +commit e31408734332b8cc611342cdaaab6ba492180156 upstream. + +occ_active(false) and occ_shutdown() unregister sysfs-backed devices while +occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can +wait for active sysfs callbacks to drain, and those callbacks can enter the +OCC update path and try to take occ->lock again. That gives the unregister +paths the lock ordering occ->lock -> sysfs callback drain, while a callback +has the opposite edge sysfs callback -> occ->lock. + +This issue was found by our static analysis tool and then manually +reviewed against the current tree. + +The grounded PoC kept the real unregister and callback carrier: + + occ_shutdown() + hwmon_device_unregister() + occ_show_temp_1() + occ_update_response() + +Lockdep reported the circular dependency with occ_shutdown() already +holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs +side: + + WARNING: possible circular locking dependency detected + ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv] + ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv] + occ_update_response.isra.0+0xb/0x20 [vuln_msv] + occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv] + *** DEADLOCK *** + +Serialize hwmon registration and removal with a separate hwmon_lock. +Under that lock, detach occ->hwmon and update occ->active while occ->lock +is held so concurrent OCC state changes still see a stable state, then +drop occ->lock before calling hwmon_device_unregister(). Remove the +driver sysfs group before taking occ->lock in occ_shutdown(), so draining +the driver attributes cannot wait while the OCC mutex is held. Also make +OCC update callbacks return -ENODEV after deactivation, so callbacks that +already passed sysfs active protection do not poll the hardware after +teardown has detached the hwmon device. + +Fixes: 849b0156d996 ("hwmon: (occ) Delay hwmon registration until user request") +Fixes: ac6888ac5a11 ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Link: https://lore.kernel.org/r/20260619015938.494464-1-runyu.xiao@seu.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/occ/common.c | 34 ++++++++++++++++++++++++++++------ + drivers/hwmon/occ/common.h | 1 + + 2 files changed, 29 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -214,6 +214,11 @@ int occ_update_response(struct occ *occ) + if (rc) + return rc; + ++ if (!occ->active) { ++ rc = -ENODEV; ++ goto unlock; ++ } ++ + /* limit the maximum rate of polling the OCC */ + if (time_after(jiffies, occ->next_update)) { + rc = occ_poll(occ); +@@ -222,6 +227,7 @@ int occ_update_response(struct occ *occ) + rc = occ->last_error; + } + ++unlock: + mutex_unlock(&occ->lock); + return rc; + } +@@ -1105,11 +1111,16 @@ static void occ_parse_poll_response(stru + + int occ_active(struct occ *occ, bool active) + { +- int rc = mutex_lock_interruptible(&occ->lock); ++ struct device *hwmon = NULL; ++ int rc = mutex_lock_interruptible(&occ->hwmon_lock); + + if (rc) + return rc; + ++ rc = mutex_lock_interruptible(&occ->lock); ++ if (rc) ++ goto unlock_hwmon; ++ + if (active) { + if (occ->active) { + rc = -EALREADY; +@@ -1154,14 +1165,17 @@ int occ_active(struct occ *occ, bool act + goto unlock; + } + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ hwmon = occ->hwmon; + occ->active = false; + occ->hwmon = NULL; + } + + unlock: + mutex_unlock(&occ->lock); ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++unlock_hwmon: ++ mutex_unlock(&occ->hwmon_lock); + return rc; + } + +@@ -1170,6 +1184,7 @@ int occ_setup(struct occ *occ) + int rc; + + mutex_init(&occ->lock); ++ mutex_init(&occ->hwmon_lock); + occ->groups[0] = &occ->group; + + rc = occ_setup_sysfs(occ); +@@ -1190,15 +1205,22 @@ EXPORT_SYMBOL_GPL(occ_setup); + + void occ_shutdown(struct occ *occ) + { +- mutex_lock(&occ->lock); ++ struct device *hwmon; + + occ_shutdown_sysfs(occ); + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ mutex_lock(&occ->hwmon_lock); ++ mutex_lock(&occ->lock); ++ ++ hwmon = occ->hwmon; ++ occ->active = false; + occ->hwmon = NULL; + + mutex_unlock(&occ->lock); ++ ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++ mutex_unlock(&occ->hwmon_lock); + } + EXPORT_SYMBOL_GPL(occ_shutdown); + +--- a/drivers/hwmon/occ/common.h ++++ b/drivers/hwmon/occ/common.h +@@ -101,6 +101,7 @@ struct occ { + + unsigned long next_update; + struct mutex lock; /* lock OCC access */ ++ struct mutex hwmon_lock; /* serialize hwmon registration/removal */ + + struct device *hwmon; + struct occ_attribute *attrs; diff --git a/queue-6.12/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch b/queue-6.12/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch new file mode 100644 index 0000000000..c62bc70775 --- /dev/null +++ b/queue-6.12/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch @@ -0,0 +1,49 @@ +From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:47:31 +0800 +Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove + +From: Pengpeng Hou + +commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream. + +w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when +VID information is available. + +The error path and remove callback only remove the common and optional +attribute groups. Those groups do not contain cpu0_vid or vrm, so the +files can remain after a later probe failure or after device removal +while their callbacks still expect live driver data. + +Remove the standalone VID sysfs files from both the probe error path and +the remove callback. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83627hf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwmon/w83627hf.c ++++ b/drivers/hwmon/w83627hf.c +@@ -1823,6 +1823,8 @@ static int w83627hf_probe(struct platfor + return 0; + + error: ++ device_remove_file(dev, &dev_attr_vrm); ++ device_remove_file(dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&dev->kobj, &w83627hf_group); + sysfs_remove_group(&dev->kobj, &w83627hf_group_opt); + return err; +@@ -1834,6 +1836,8 @@ static void w83627hf_remove(struct platf + + hwmon_device_unregister(data->hwmon_dev); + ++ device_remove_file(&pdev->dev, &dev_attr_vrm); ++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt); + } diff --git a/queue-6.12/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch b/queue-6.12/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch new file mode 100644 index 0000000000..c52ff3122c --- /dev/null +++ b/queue-6.12/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch @@ -0,0 +1,39 @@ +From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:48:06 +0800 +Subject: hwmon: (w83793) remove vrm sysfs file on probe failure + +From: Pengpeng Hou + +commit 77b983757280c69b0290811669ff1d31022e5f1d upstream. + +w83793_probe() creates the vrm sysfs file after creating the VID files +when VID support is present. + +The normal remove path deletes vrm, but the probe error path only +removes the sensor, SDA, VID, fan, PWM and temperature files. A later +probe failure can therefore leave vrm behind after the driver data has +been freed. + +Remove vrm in the probe error path next to the VID files, matching the +normal remove path. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83793.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/w83793.c ++++ b/drivers/hwmon/w83793.c +@@ -1917,6 +1917,7 @@ exit_remove: + + for (i = 0; i < ARRAY_SIZE(w83793_vid); i++) + device_remove_file(dev, &w83793_vid[i].dev_attr); ++ device_remove_file(dev, &dev_attr_vrm); + + for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++) + device_remove_file(dev, &w83793_left_fan[i].dev_attr); diff --git a/queue-6.12/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch b/queue-6.12/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch new file mode 100644 index 0000000000..c51ef57b23 --- /dev/null +++ b/queue-6.12/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch @@ -0,0 +1,46 @@ +From 39139b1c1c2b614096519b526112c726adb12ff0 Mon Sep 17 00:00:00 2001 +From: Andrea Righi +Date: Fri, 26 Jun 2026 18:32:18 +0200 +Subject: net: lan743x: Initialize eth_syslock spinlock before use + +From: Andrea Righi + +commit 39139b1c1c2b614096519b526112c726adb12ff0 upstream. + +lan743x_hardware_init() calls pci11x1x_strap_get_status() during the +PCI11x1x probe sequence. That helper acquires the Ethernet subsystem +hardware lock via lan743x_hs_syslock_acquire(), which relies on +adapter->eth_syslock_spinlock to serialize access. + +The spinlock is currently initialized only after the strap status is +read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized +spinlock can trip the spinlock debug check. + +Fix by initializing adapter->eth_syslock_spinlock before reading the +strap status so the probe path never attempts to lock an uninitialized +spinlock. + +Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G") +Cc: stable@vger.kernel.org # v6.0+ +Signed-off-by: Andrea Righi +Reviewed-by: David Thompson +Reviewed-by: Thangaraj Samynathan +Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microchip/lan743x_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -3506,8 +3506,8 @@ static int lan743x_hardware_init(struct + adapter->max_tx_channels = PCI11X1X_MAX_TX_CHANNELS; + adapter->used_tx_channels = PCI11X1X_USED_TX_CHANNELS; + adapter->max_vector_count = PCI11X1X_MAX_VECTOR_COUNT; +- pci11x1x_strap_get_status(adapter); + spin_lock_init(&adapter->eth_syslock_spinlock); ++ pci11x1x_strap_get_status(adapter); + mutex_init(&adapter->sgmii_rw_lock); + pci11x1x_set_rfe_rd_fifo_threshold(adapter); + sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL); diff --git a/queue-6.12/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch b/queue-6.12/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch new file mode 100644 index 0000000000..7a7926de8a --- /dev/null +++ b/queue-6.12/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch @@ -0,0 +1,64 @@ +From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Jun 2026 14:40:13 +0800 +Subject: net: liquidio: fix BAR resource leak on PF number failure + +From: Haoxiang Li + +commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream. + +If cn23xx_get_pf_num() fails, the function returns without +unmapping either BAR. Unmap both BARs before returning from +the error path. + +Found by manual code review. + +Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Larysa Zaremba +Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -1332,18 +1332,14 @@ int setup_cn23xx_octeon_pf_device(struct + if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) { + dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n", + __func__); +- octeon_unmap_pci_barx(oct, 0); +- return 1; ++ goto err_unmap_bar0; + } + + if (cn23xx_get_pf_num(oct) != 0) +- return 1; ++ goto err_unmap_bar1; + +- if (cn23xx_sriov_config(oct)) { +- octeon_unmap_pci_barx(oct, 0); +- octeon_unmap_pci_barx(oct, 1); +- return 1; +- } ++ if (cn23xx_sriov_config(oct)) ++ goto err_unmap_bar1; + + octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL); + +@@ -1374,6 +1370,12 @@ int setup_cn23xx_octeon_pf_device(struct + oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct); + + return 0; ++ ++err_unmap_bar1: ++ octeon_unmap_pci_barx(oct, 1); ++err_unmap_bar0: ++ octeon_unmap_pci_barx(oct, 0); ++ return 1; + } + EXPORT_SYMBOL_GPL(setup_cn23xx_octeon_pf_device); + diff --git a/queue-6.12/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-6.12/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..e9d73d114b --- /dev/null +++ b/queue-6.12/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,44 @@ +From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:20 -0500 +Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream. + +multiq_dequeue() takes a packet from a band's child with a direct +->dequeue() call after multiq_peek() peeked it. When the child is +non-work-conserving the peek stashes the skb in the child's gso_skb, so +the direct dequeue returns a different skb and orphans the stash, +desyncing the child's qlen/backlog. With a qfq child reached through a +peeking parent (e.g. tbf) this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_prio already does +and as sch_red and sch_sfb were just fixed to do. The helper is a no-op +when the child has no stash, so a work-conserving child is unaffected. + +Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_multiq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st + if (!netif_xmit_stopped( + netdev_get_tx_queue(qdisc_dev(sch), q->curband))) { + qdisc = q->queues[q->curband]; +- skb = qdisc->dequeue(qdisc); ++ skb = qdisc_dequeue_peeked(qdisc); + if (skb) { + qdisc_bstats_update(sch, skb); + sch->q.qlen--; diff --git a/queue-6.12/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-6.12/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..74c0c891f2 --- /dev/null +++ b/queue-6.12/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,45 @@ +From e056e1dfcddca877dd46d704e8ec9860cfc9ec44 Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:19 -0500 +Subject: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit e056e1dfcddca877dd46d704e8ec9860cfc9ec44 upstream. + +When taprio's software path peeks a non-work-conserving child qdisc, the +child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() +then takes the packet with a direct child ->dequeue() call, which ignores +that stash, orphans the peeked skb and desyncs the child's qlen/backlog. +With a qfq child this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb +now do. The helper returns the child's stashed skb first and is a no-op +when there is none, so a work-conserving child is unaffected and the +gated path now consumes the skb whose length was charged to the budget. + +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Cc: stable@vger.kernel.org +Cc: Vladimir Oltean +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-1-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_taprio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -748,7 +748,7 @@ static struct sk_buff *taprio_dequeue_fr + return NULL; + + skip_peek_checks: +- skb = child->ops->dequeue(child); ++ skb = qdisc_dequeue_peeked(child); + if (unlikely(!skb)) + return NULL; + diff --git a/queue-6.12/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch b/queue-6.12/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch new file mode 100644 index 0000000000..5d62765e44 --- /dev/null +++ b/queue-6.12/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch @@ -0,0 +1,130 @@ +From 526b8ef54668780c8f69e0211c342763d5dcbad1 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 25 Jun 2026 14:17:28 +0800 +Subject: net: wwan: iosm: bound device offsets in the MUX downlink decoder + +From: Maoyi Xie + +commit 526b8ef54668780c8f69e0211c342763d5dcbad1 upstream. + +mux_dl_adb_decode() walks a chain of aggregated datagram tables using +offsets and lengths taken from the modem. first_table_index, +next_table_index, table_length, datagram_index and datagram_length are +all device supplied le values. Only first_table_index was checked, and +only for being non zero. The decoder then formed adth = block + +adth_index and read the table header and the datagram entries with no +bound against the received skb. A modem that reports an index or a +length past the downlink buffer makes the decoder read out of bounds. + +The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most +that, so skb->len is the real limit, but none of these in band offsets +were checked against it. + +The table chain is also followed with no forward progress check. The loop +takes the next table from adth->next_table_index and stops only when that +reaches zero. A modem can stage two tables that point at each other, so +the loop never ends. It runs in softirq and clones the skb on every pass. + +Validate every device offset and length against skb->len before use. +The block header must fit. Each table header, on entry and after every +next_table_index, must lie inside the skb. The datagram table must fit. +Each datagram index and length must stay inside the skb. The header +padding must not exceed the datagram length so the receive length does +not wrap. Require each next_table_index to move forward so the chain +cannot cycle. + +This was reproduced under KASAN as a slab out of bounds read on a normal +downlink receive once the iosm net device is up. + +Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") +Suggested-by: Loic Poulain +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Simon Horman +Reviewed-by: Loic Poulain +Link: https://patch.msgid.link/178236824878.3259367.5389624724479864947@maoyixie.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 +++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 10 deletions(-) + +--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c +@@ -553,19 +553,21 @@ static int mux_dl_process_dg(struct iosm + u32 packet_offset, i, rc, dg_len; + + for (i = 0; i < nr_of_dg; i++, dg++) { +- if (le32_to_cpu(dg->datagram_index) +- < sizeof(struct mux_adbh)) ++ u32 dg_index = le32_to_cpu(dg->datagram_index); ++ ++ dg_len = le16_to_cpu(dg->datagram_length); ++ ++ if (dg_index < sizeof(struct mux_adbh)) + goto dg_error; + +- /* Is the packet inside of the ADB */ +- if (le32_to_cpu(dg->datagram_index) >= +- le32_to_cpu(adbh->block_length)) { ++ /* Is the packet inside of the ADB and the received skb ? */ ++ if (dg_index >= le32_to_cpu(adbh->block_length) || ++ dg_index >= skb->len || ++ dg_len > skb->len - dg_index || ++ dl_head_pad_len >= dg_len) { + goto dg_error; + } else { +- packet_offset = +- le32_to_cpu(dg->datagram_index) + +- dl_head_pad_len; +- dg_len = le16_to_cpu(dg->datagram_length); ++ packet_offset = dg_index + dl_head_pad_len; + /* Pass the packet to the netif layer. */ + rc = ipc_mux_net_receive(ipc_mux, if_id, ipc_mux->wwan, + packet_offset, +@@ -589,12 +591,16 @@ static void mux_dl_adb_decode(struct ios + struct mux_adbh *adbh; + struct mux_adth *adth; + int nr_of_dg, if_id; +- u32 adth_index; ++ u32 adth_index, prev_index = 0; + u8 *block; + + block = skb->data; + adbh = (struct mux_adbh *)block; + ++ /* The block header itself must fit in the received skb. */ ++ if (skb->len < sizeof(struct mux_adbh)) ++ goto adb_decode_err; ++ + /* Process the aggregated datagram tables. */ + adth_index = le32_to_cpu(adbh->first_table_index); + +@@ -606,6 +612,16 @@ static void mux_dl_adb_decode(struct ios + + /* Loop through mixed session tables. */ + while (adth_index) { ++ /* The table header must lie within the received skb, and the ++ * chain must move forward so a modem cannot make the loop ++ * cycle between two tables. ++ */ ++ if (adth_index <= prev_index || ++ adth_index < sizeof(struct mux_adbh) || ++ adth_index > skb->len - sizeof(struct mux_adth)) ++ goto adb_decode_err; ++ prev_index = adth_index; ++ + /* Get the reference to the table header. */ + adth = (struct mux_adth *)(block + adth_index); + +@@ -629,6 +645,10 @@ static void mux_dl_adb_decode(struct ios + if (le16_to_cpu(adth->table_length) < sizeof(struct mux_adth)) + goto adb_decode_err; + ++ /* The whole datagram table must fit in the received skb. */ ++ if (le16_to_cpu(adth->table_length) > skb->len - adth_index) ++ goto adb_decode_err; ++ + /* Calculate the number of datagrams. */ + nr_of_dg = (le16_to_cpu(adth->table_length) - + sizeof(struct mux_adth)) / diff --git a/queue-6.12/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch b/queue-6.12/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch new file mode 100644 index 0000000000..8f4f74d025 --- /dev/null +++ b/queue-6.12/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch @@ -0,0 +1,51 @@ +From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Fri, 19 Jun 2026 04:38:20 -0500 +Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part() + +From: Bryam Vargas + +commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream. + +fill_from_part() computes the size of a directory entry in size_t but +stores it in a __u32. An entry length near U32_MAX wraps it to a small +value, bypasses the bounds check, and is then used to index the entry, +reading far past the directory part -- an out-of-bounds read that oopses +the kernel. + +Compute the size as a u64 so it cannot truncate; the bounds check then +rejects the entry. The trailer is supplied by the userspace client. + +Fixes: 480e3e532e31 ("orangefs: support very large directories") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/orangefs/dir.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/orangefs/dir.c ++++ b/fs/orangefs/dir.c +@@ -190,7 +190,8 @@ static int fill_from_part(struct orangef + { + const int offset = sizeof(struct orangefs_readdir_response_s); + struct orangefs_khandle *khandle; +- __u32 *len, padlen; ++ __u32 *len; ++ u64 padlen; + loff_t i; + char *s; + i = ctx->pos & ~PART_MASK; +@@ -214,8 +215,8 @@ static int fill_from_part(struct orangef + * len is the size of the string itself. padlen is the + * total size of the encoded string. + */ +- padlen = (sizeof *len + *len + 1) + +- (8 - (sizeof *len + *len + 1)%8)%8; ++ padlen = (u64)sizeof *len + *len + 1; ++ padlen += (8 - padlen % 8) % 8; + if (part->len < i + padlen + sizeof *khandle) + goto next; + s = (void *)part + offset + i + sizeof *len; diff --git a/queue-6.12/riscv-probes-save-original-sp-in-rethook-trampoline.patch b/queue-6.12/riscv-probes-save-original-sp-in-rethook-trampoline.patch new file mode 100644 index 0000000000..fdb91c6c4b --- /dev/null +++ b/queue-6.12/riscv-probes-save-original-sp-in-rethook-trampoline.patch @@ -0,0 +1,59 @@ +From bc7b086a45521a986a49045907f017e3e46c763e Mon Sep 17 00:00:00 2001 +From: Martin Kaiser +Date: Tue, 30 Jun 2026 21:40:03 +0200 +Subject: riscv: probes: save original sp in rethook trampoline + +From: Martin Kaiser + +commit bc7b086a45521a986a49045907f017e3e46c763e upstream. + +Reading a word from the stack in a kretprobe crashes a risc-v kernel. + +$ cd /sys/kernel/tracing/ +$ echo 'r n_tty_write $stack0' > dynamic_events +$ echo 1 > events/kprobes/enable +Unable to handle kernel paging request at virtual address 0000000200000128 +... +[] regs_get_kernel_stack_nth+0x26/0x38 +[] process_fetch_insn+0x3ee/0x760 +[] kretprobe_trace_func+0x116/0x1f0 +[] kretprobe_dispatcher+0x4a/0x58 +[] kretprobe_rethook_handler+0x5e/0x90 +[] rethook_trampoline_handler+0x70/0x108 +[] arch_rethook_trampoline_callback+0x12/0x1c +[] arch_rethook_trampoline+0x48/0x94 +[] tty_write+0x1a/0x30 + +In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. + +arch_rethook_trampoline saves the registers from the probed function in a +struct pt_regs. sp is not saved. Instead, sp is decremented for +arch_rethook_trampoline's local stack. + +Fix this crash and save the original sp along with the other registers. +Use a0 as a temporary register, it is overwritten anyway. + +Cc: stable@vger.kernel.org +Fixes: c22b0bcb1dd02 ("riscv: Add kprobes supported") +Signed-off-by: Martin Kaiser +Acked-by: Masami Hiramatsu (Google) +Link: https://patch.msgid.link/20260630194010.1824039-1-martin@kaiser.cx +[pjw@kernel.org: added Fixes tag; cc'ed stable] +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/probes/rethook_trampoline.S | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/riscv/kernel/probes/rethook_trampoline.S ++++ b/arch/riscv/kernel/probes/rethook_trampoline.S +@@ -41,6 +41,9 @@ + REG_S x29, PT_T4(sp) + REG_S x30, PT_T5(sp) + REG_S x31, PT_T6(sp) ++ /* save original sp */ ++ addi a0, sp, PT_SIZE_ON_STACK ++ REG_S a0, PT_SP(sp) + .endm + + .macro restore_all_base_regs diff --git a/queue-6.12/series b/queue-6.12/series index e0553b59d0..e402654d91 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1070,3 +1070,19 @@ loongarch-fix-missing-dirty-page-tracking-in-pte-pmd-_wrprotect.patch espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch rtc-mpfs-fix-counter-upload-completion-condition.patch +hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch +hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch +net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch +hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch +fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch +net-lan743x-initialize-eth_syslock-spinlock-before-use.patch +net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +fhandle-reject-detached-mounts-in-capable_wrt_mount.patch +hwmon-max1619-add-missing-select-regmap-to-kconfig.patch +tracing-probes-fix-double-addition-of-offset-for-foffset.patch +orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch +ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch +net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch +hwmon-asus_atk0110-check-package-count-before-accessing-element.patch +riscv-probes-save-original-sp-in-rethook-trampoline.patch diff --git a/queue-6.12/tracing-probes-fix-double-addition-of-offset-for-foffset.patch b/queue-6.12/tracing-probes-fix-double-addition-of-offset-for-foffset.patch new file mode 100644 index 0000000000..f34a814164 --- /dev/null +++ b/queue-6.12/tracing-probes-fix-double-addition-of-offset-for-foffset.patch @@ -0,0 +1,34 @@ +From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 25 Jun 2026 08:34:47 +0900 +Subject: tracing/probes: Fix double addition of offset for @+FOFFSET + +From: Masami Hiramatsu (Google) + +commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream. + +Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument + fetching code") wrongly use @offset local variable during the parsing, +the offset value is added twice when dereferencing. +Reset the @offset after setting it in FETCH_OP_FOFFS. + +Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/ + +Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_probe.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -1105,6 +1105,7 @@ parse_probe_arg(char *arg, const struct + + code->op = FETCH_OP_FOFFS; + code->immediate = (unsigned long)offset; // imm64? ++ offset = 0; + } else { + /* uprobes don't support symbols */ + if (!(ctx->flags & TPARG_FL_KERNEL)) {