From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:37:32 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.10.260~19 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=215ab81da6bde7977e057f9d84c4b7c5a6c333b6;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: bnxt_en-fix-null-pointer-dereference.patch bnxt_en-modify-bnxt_disable_int_sync-to-be-called-more-than-once.patch dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch hv-utils-handle-and-propagate-errors-in-kvp_register.patch misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch misc-fastrpc-fix-dma-address-corruption-due-to-find_vma-misuse.patch misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch mmc-renesas_sdhi-add-of-entry-for-rz-g2h-soc.patch mptcp-fix-missing-wakeups-in-edge-scenarios.patch net-phonet-free-phonet_device-after-rcu-grace-period.patch phonet-pass-ifindex-to-fill_addr.patch phonet-pass-net-and-ifindex-to-phonet_address_notify.patch usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch virtiofs-fix-uaf-on-submount-umount.patch --- diff --git a/queue-5.10/bnxt_en-fix-null-pointer-dereference.patch b/queue-5.10/bnxt_en-fix-null-pointer-dereference.patch new file mode 100644 index 0000000000..fc1469ba0b --- /dev/null +++ b/queue-5.10/bnxt_en-fix-null-pointer-dereference.patch @@ -0,0 +1,49 @@ +From stable+bounces-264333-greg=kroah.com@vger.kernel.org Tue Jun 16 18:15:26 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 11:55:38 -0400 +Subject: bnxt_en: Fix NULL pointer dereference +To: stable@vger.kernel.org +Cc: Kyle Meyer , Pavan Chebbi , Jakub Kicinski , Sasha Levin +Message-ID: <20260616155538.3323509-2-sashal@kernel.org> + +From: Kyle Meyer + +[ Upstream commit d930276f2cddd0b7294cac7a8fe7b877f6d9e08d ] + +PCIe errors detected by a Root Port or Downstream Port cause error +recovery services to run on all subordinate devices regardless of +administrative state. + +The .error_detected() callback, bnxt_io_error_detected(), disables +and synchronizes IRQs via bnxt_disable_int_sync(), which calls +bnxt_cp_num_to_irq_num() to map completion rings to IRQs using +bp->bnapi. + +Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe +error recovery on a closed NIC can dereference a NULL pointer. + +Check if bp->bnapi is NULL before disabling and synchronizing IRQs. + +Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.") +Cc: stable@vger.kernel.org +Signed-off-by: Kyle Meyer +Reviewed-by: Pavan Chebbi +Link: https://patch.msgid.link/aiNM1CY2-StPilxW@hpe.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -4382,7 +4382,7 @@ static void bnxt_disable_int_sync(struct + { + int i; + +- if (!bp->irq_tbl) ++ if (!bp->irq_tbl || !bp->bnapi) + return; + + atomic_inc(&bp->intr_sem); diff --git a/queue-5.10/bnxt_en-modify-bnxt_disable_int_sync-to-be-called-more-than-once.patch b/queue-5.10/bnxt_en-modify-bnxt_disable_int_sync-to-be-called-more-than-once.patch new file mode 100644 index 0000000000..985de2283f --- /dev/null +++ b/queue-5.10/bnxt_en-modify-bnxt_disable_int_sync-to-be-called-more-than-once.patch @@ -0,0 +1,40 @@ +From stable+bounces-264332-greg=kroah.com@vger.kernel.org Tue Jun 16 18:15:25 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 11:55:37 -0400 +Subject: bnxt_en: Modify bnxt_disable_int_sync() to be called more than once. +To: stable@vger.kernel.org +Cc: Michael Chan , Edwin Peer , Vasundhara Volam , Willem de Bruijn , Jakub Kicinski , Sasha Levin +Message-ID: <20260616155538.3323509-1-sashal@kernel.org> + +From: Michael Chan + +[ Upstream commit 38290e37297087f7ea3ef7904b8f185d77c42976 ] + +In the event of a fatal firmware error, we want to disable IRQ early +in the recovery sequence. This change will allow it to be called +safely again as part of the normal shutdown sequence. + +Reviewed-by: Edwin Peer +Reviewed-by: Vasundhara Volam +Signed-off-by: Michael Chan +Acked-by: Willem de Bruijn +Signed-off-by: Jakub Kicinski +Stable-dep-of: d930276f2cdd ("bnxt_en: Fix NULL pointer dereference") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -4382,6 +4382,9 @@ static void bnxt_disable_int_sync(struct + { + int i; + ++ if (!bp->irq_tbl) ++ return; ++ + atomic_inc(&bp->intr_sem); + + bnxt_disable_int(bp); diff --git a/queue-5.10/dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch b/queue-5.10/dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch new file mode 100644 index 0000000000..9c4311f2b9 --- /dev/null +++ b/queue-5.10/dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch @@ -0,0 +1,42 @@ +From 8e2bad543eca5c25cd02cbc63d72557934d45f13 Mon Sep 17 00:00:00 2001 +From: Thadeu Lima de Souza Cascardo +Date: Mon, 10 Feb 2025 13:16:22 -0600 +Subject: dlm: prevent NPD when writing a positive value to event_done + +From: Thadeu Lima de Souza Cascardo + +commit 8e2bad543eca5c25cd02cbc63d72557934d45f13 upstream. + +do_uevent returns the value written to event_done. In case it is a +positive value, new_lockspace would undo all the work, and lockspace +would not be set. __dlm_new_lockspace, however, would treat that +positive value as a success due to commit 8511a2728ab8 ("dlm: fix use +count with multiple joins"). + +Down the line, device_create_lockspace would pass that NULL lockspace to +dlm_find_lockspace_local, leading to a NULL pointer dereference. + +Treating such positive values as successes prevents the problem. Given +this has been broken for so long, this is unlikely to break userspace +expectations. + +Fixes: 8511a2728ab8 ("dlm: fix use count with multiple joins") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: David Teigland +Signed-off-by: Nazar Kalashnikov +Signed-off-by: Greg Kroah-Hartman +--- + fs/dlm/lockspace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -639,7 +639,7 @@ static int new_lockspace(const char *nam + lockspace to start running (via sysfs) in dlm_ls_start(). */ + + error = do_uevent(ls, 1); +- if (error) ++ if (error < 0) + goto out_recoverd; + + wait_for_completion(&ls->ls_members_done); diff --git a/queue-5.10/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch b/queue-5.10/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch new file mode 100644 index 0000000000..756a260a59 --- /dev/null +++ b/queue-5.10/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch @@ -0,0 +1,165 @@ +From stable+bounces-266742-greg=kroah.com@vger.kernel.org Wed Jun 17 14:45:58 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 08:45:49 -0400 +Subject: Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs +To: stable@vger.kernel.org +Cc: Dexuan Cui , Michael Kelley , Krister Johansen , Matthew Ruffell , Wei Liu , Sasha Levin +Message-ID: <20260617124549.3856162-1-sashal@kernel.org> + +From: Dexuan Cui + +[ Upstream commit 016a25e4b0df4d77e7c258edee4aaf982e4ee809 ] + +If vmbus_reserve_fb() in the kdump/kexec kernel fails to properly reserve +the framebuffer MMIO range (which is below 4GB) due to a Gen2 VM's +screen.lfb_base being zero [1], there is an MMIO conflict between the +drivers hyperv-drm and pci-hyperv: when the driver pci-hyperv's +hv_allocate_config_window() calls vmbus_allocate_mmio() to get an +MMIO range, typically it gets a 32-bit MMIO range that overlaps with the +framebuffer MMIO range, and later hv_pci_enter_d0() fails with an +error message "PCI Pass-through VSP failed D0 Entry with status" since +the host thinks that PCI devices must not use MMIO space that the +host has assigned to the framebuffer. + +This is especially an issue if pci-hyperv is built-in and hyperv-drm is +built as a module. Consequently, the kdump/kexec kernel fails to detect +PCI devices via pci-hyperv, and may fail to mount the root file system, +which may reside in a NVMe disk. The issue described here has existed +for SR-IOV VF NICs since day one of the pci-hyperv driver, and has been +worked around on x64 when possible. With the recent introduction of +ARM64 VMs that boot from NVMe, there is no workaround, so we need a +formal fix. + +On Gen2 VMs, if the screen.lfb_base is 0 in the kdump/kexec kernel [1], +fall back to the low MMIO base, which should be equal to the framebuffer +MMIO base [2] (the statement is true according to my testing on x64 +Windows Server 2016, and on x64 and ARM64 Windows Server 2025 and on +Azure. I checked with the Hyper-V team and they said the statement should +continue to be true for Gen2 VMs). In the first kernel, screen.lfb_base +is not 0; if the user specifies a very high resolution, it's not enough +to only reserve 8MB: let's always reserve half of the space below 4GB, +but cap the reservation to 128MB, which is the required framebuffer size +of the highest resolution 7680*4320 supported by Hyper-V. + +While at it, fix the comparison "end > VTPM_BASE_ADDRESS" by changing +the > to >=. Here the 'end' is an inclusive end (typically, it's +0xFFFF_FFFF for the low MMIO range). + +Note: vmbus_reserve_fb() now also reserves an MMIO range at the beginning +of the low MMIO range on CVMs, which have no framebuffers (the +'screen.lfb_base' in vmbus_reserve_fb() is 0 for CVMs), just in case the +host might treat the beginning of the low MMIO range specially [3]. BTW, +the OpenHCL kernel is not affected by the change, because that kernel +boots with DeviceTree rather than ACPI (so vmbus_reserve_fb() won't run +there), and there is no framebuffer device for that kernel. + +Note: normally Gen1 VMs don't have the MMIO conflict issue because the +framebuffer MMIO range (which is hardcoded to base=4GB-128MB and +size=64MB for Gen1 VMs by the host) is always reported via the legacy PCI +graphics device's BAR, so the kdump/kexec kernel can reserve the 64MB +MMIO range; however, if the VM is configured to use a very high resolution +and the required framebuffer size exceeds 64MB (AFAIK, in practice, this +isn't a typical configuration by users), the hyperv-drm driver may need to +allocate an MMIO range above 4GB and change the framebuffer MMIO location +to the allocated MMIO range -- in this case, there can still be issues [4] +which can't be easily fixed: any possible affected Gen1 users would have +to use a resolution whose framebuffer size is <= 64MB, or switch to Gen2 +VMs. + +[1] https://lore.kernel.org/all/SA1PR21MB692176C1BC53BFC9EAE5CF8EBF51A@SA1PR21MB6921.namprd21.prod.outlook.com/ +[2] https://lore.kernel.org/all/SA1PR21MB69218F955B62DFF62E3E88D2BF222@SA1PR21MB6921.namprd21.prod.outlook.com/ +[3] https://lore.kernel.org/all/SN6PR02MB415726B17D5A6027CD1717E8D4342@SN6PR02MB4157.namprd02.prod.outlook.com/ +[4] https://lore.kernel.org/all/SA1PR21MB69213486F821CA5A2C793C81BF342@SA1PR21MB6921.namprd21.prod.outlook.com/ + +Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs") +CC: stable@vger.kernel.org +Reviewed-by: Michael Kelley +Tested-by: Krister Johansen +Tested-by: Matthew Ruffell +Signed-off-by: Dexuan Cui +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hv/vmbus_drv.c | 56 +++++++++++++++++++++++++++++++++++-------------- + 1 file changed, 41 insertions(+), 15 deletions(-) + +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2134,8 +2134,8 @@ static acpi_status vmbus_walk_resources( + return AE_NO_MEMORY; + + /* If this range overlaps the virtual TPM, truncate it. */ +- if (end > VTPM_BASE_ADDRESS && start < VTPM_BASE_ADDRESS) +- end = VTPM_BASE_ADDRESS; ++ if (end >= VTPM_BASE_ADDRESS && start < VTPM_BASE_ADDRESS) ++ end = VTPM_BASE_ADDRESS - 1; + + new_res->name = "hyperv mmio"; + new_res->flags = IORESOURCE_MEM; +@@ -2202,26 +2202,52 @@ static int vmbus_acpi_remove(struct acpi + + static void vmbus_reserve_fb(void) + { +- int size; ++ resource_size_t start = 0, size; ++ resource_size_t low_mmio_base; ++ ++ if (efi_enabled(EFI_BOOT)) { ++ /* Gen2 VM: get FB base from EFI framebuffer */ ++ start = screen_info.lfb_base; ++ size = max_t(__u32, screen_info.lfb_size, 0x800000); ++ ++ low_mmio_base = hyperv_mmio->start; ++ if (!low_mmio_base || upper_32_bits(low_mmio_base) || ++ (start && start < low_mmio_base)) { ++ pr_warn("Unexpected low mmio base %pa\n", &low_mmio_base); ++ } else { ++ /* ++ * If the kdump/kexec or CVM kernel's lfb_base ++ * is 0, fall back to the low mmio base. ++ */ ++ if (!start) ++ start = low_mmio_base; ++ /* ++ * Reserve half of the space below 4GB for high ++ * resolutions, but cap the reservation to 128MB. ++ */ ++ size = min((SZ_4G - start) / 2, SZ_128M); ++ } ++ } else { ++ /* Gen1 VM: get FB base from screen_info */ ++ start = screen_info.lfb_base; ++ size = max_t(__u32, screen_info.lfb_size, 0x4000000); ++ } ++ ++ if (!start) { ++ pr_warn("Unexpected framebuffer mmio base of zero\n"); ++ return; ++ } ++ + /* + * Make a claim for the frame buffer in the resource tree under the + * first node, which will be the one below 4GB. The length seems to + * be underreported, particularly in a Generation 1 VM. So start out + * reserving a larger area and make it smaller until it succeeds. + */ ++ for (; !fb_mmio && (size >= 0x100000); size >>= 1) ++ fb_mmio = __request_region(hyperv_mmio, start, size, fb_mmio_name, 0); + +- if (screen_info.lfb_base) { +- if (efi_enabled(EFI_BOOT)) +- size = max_t(__u32, screen_info.lfb_size, 0x800000); +- else +- size = max_t(__u32, screen_info.lfb_size, 0x4000000); +- +- for (; !fb_mmio && (size >= 0x100000); size >>= 1) { +- fb_mmio = __request_region(hyperv_mmio, +- screen_info.lfb_base, size, +- fb_mmio_name, 0); +- } +- } ++ pr_info("hv_mmio=%pR,%pR fb=%pR\n", hyperv_mmio, hyperv_mmio->sibling, fb_mmio); + } + + /** diff --git a/queue-5.10/hv-utils-handle-and-propagate-errors-in-kvp_register.patch b/queue-5.10/hv-utils-handle-and-propagate-errors-in-kvp_register.patch new file mode 100644 index 0000000000..f666208a0b --- /dev/null +++ b/queue-5.10/hv-utils-handle-and-propagate-errors-in-kvp_register.patch @@ -0,0 +1,89 @@ +From stable+bounces-266173-greg=kroah.com@vger.kernel.org Tue Jun 16 20:37:25 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 14:37:18 -0400 +Subject: hv: utils: handle and propagate errors in kvp_register +To: stable@vger.kernel.org +Cc: Thorsten Blum , Long Li , Wei Liu , Sasha Levin +Message-ID: <20260616183718.3474794-1-sashal@kernel.org> + +From: Thorsten Blum + +[ Upstream commit 3fcf923302a8f5c0dc3af3d2ca2657cb5fae4297 ] + +Make kvp_register() return an error code instead of silently ignoring +failures, and propagate the error from kvp_handle_handshake() instead of +returning success. + +This propagates both kzalloc_obj() and hvutil_transport_send() failures +to kvp_handle_handshake() and thus to kvp_on_msg(). + +Fixes: 245ba56a52a3 ("Staging: hv: Implement key/value pair (KVP)") +Cc: stable@vger.kernel.org +Signed-off-by: Thorsten Blum +Reviewed-by: Long Li +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hv/hv_kvp.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -93,7 +93,7 @@ static void kvp_send_key(struct work_str + static void kvp_respond_to_host(struct hv_kvp_msg *msg, int error); + static void kvp_timeout_func(struct work_struct *dummy); + static void kvp_host_handshake_func(struct work_struct *dummy); +-static void kvp_register(int); ++static int kvp_register(int); + + static DECLARE_DELAYED_WORK(kvp_timeout_work, kvp_timeout_func); + static DECLARE_DELAYED_WORK(kvp_host_handshake_work, kvp_host_handshake_func); +@@ -127,24 +127,26 @@ static void kvp_register_done(void) + hv_poll_channel(kvp_transaction.recv_channel, kvp_poll_wrapper); + } + +-static void ++static int + kvp_register(int reg_value) + { + + struct hv_kvp_msg *kvp_msg; + char *version; ++ int ret; + + kvp_msg = kzalloc(sizeof(*kvp_msg), GFP_KERNEL); ++ if (!kvp_msg) ++ return -ENOMEM; + +- if (kvp_msg) { +- version = kvp_msg->body.kvp_register.version; +- kvp_msg->kvp_hdr.operation = reg_value; +- strcpy(version, HV_DRV_VERSION); +- +- hvutil_transport_send(hvt, kvp_msg, sizeof(*kvp_msg), +- kvp_register_done); +- kfree(kvp_msg); +- } ++ version = kvp_msg->body.kvp_register.version; ++ kvp_msg->kvp_hdr.operation = reg_value; ++ strcpy(version, HV_DRV_VERSION); ++ ++ ret = hvutil_transport_send(hvt, kvp_msg, sizeof(*kvp_msg), ++ kvp_register_done); ++ kfree(kvp_msg); ++ return ret; + } + + static void kvp_timeout_func(struct work_struct *dummy) +@@ -186,9 +188,8 @@ static int kvp_handle_handshake(struct h + */ + pr_debug("KVP: userspace daemon ver. %d connected\n", + msg->kvp_hdr.operation); +- kvp_register(dm_reg_value); + +- return 0; ++ return kvp_register(dm_reg_value); + } + + diff --git a/queue-5.10/misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch b/queue-5.10/misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch new file mode 100644 index 0000000000..e05430b58e --- /dev/null +++ b/queue-5.10/misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch @@ -0,0 +1,47 @@ +From sashal@kernel.org Wed Jun 17 00:40:08 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 18:40:03 -0400 +Subject: misc: fastrpc: Add dma_mask to fastrpc_channel_ctx +To: stable@vger.kernel.org +Cc: Abel Vesa , Srinivas Kandagatla , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260616224004.3558667-1-sashal@kernel.org> + +From: Abel Vesa + +[ Upstream commit 9bde43a0e2f469961e18d0a3496a9a74379c22bf ] + +dma_set_mask_and_coherent only updates the mask to which the device +dma_mask pointer points to. Add a dma_mask to the channel ctx and set +the device dma_mask to point to that, otherwise the dma_set_mask will +return an error and the dma_set_coherent_mask will be skipped too. + +Co-developed-by: Srinivas Kandagatla +Signed-off-by: Abel Vesa +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20221125071405.148786-11-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 5401fb4fe10f ("misc: fastrpc: Fix NULL pointer dereference in rpmsg callback") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -214,6 +214,7 @@ struct fastrpc_channel_ctx { + struct list_head users; + struct miscdevice miscdev; + struct kref refcount; ++ u64 dma_mask; + }; + + struct fastrpc_user { +@@ -1689,6 +1690,7 @@ static int fastrpc_rpmsg_probe(struct rp + kref_init(&data->refcount); + + dev_set_drvdata(&rpdev->dev, data); ++ rdev->dma_mask = &data->dma_mask; + dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32)); + INIT_LIST_HEAD(&data->users); + spin_lock_init(&data->lock); diff --git a/queue-5.10/misc-fastrpc-fix-dma-address-corruption-due-to-find_vma-misuse.patch b/queue-5.10/misc-fastrpc-fix-dma-address-corruption-due-to-find_vma-misuse.patch new file mode 100644 index 0000000000..56bbdb23f6 --- /dev/null +++ b/queue-5.10/misc-fastrpc-fix-dma-address-corruption-due-to-find_vma-misuse.patch @@ -0,0 +1,46 @@ +From sashal@kernel.org Wed Jun 17 21:09:21 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 15:09:17 -0400 +Subject: misc: fastrpc: fix DMA address corruption due to find_vma misuse +To: stable@vger.kernel.org +Cc: Junrui Luo , Yuhao Jiang , Dmitry Baryshkov , Srinivas Kandagatla , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260617190917.292166-1-sashal@kernel.org> + +From: Junrui Luo + +[ Upstream commit 464c6ad2aa16e1e1df9d559289199356493d1e00 ] + +fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided +pointer and compute a DMA address offset. When the address falls in a gap +before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, +corrupting the DMA address sent to the DSP. + +Replace find_vma() with vma_lookup(), which returns NULL when the address +is not contained within any VMA. + +Cc: stable@vger.kernel.org +Fixes: 80f3afd72bd4 ("misc: fastrpc: consider address offset before sending to DSP") +Reported-by: Yuhao Jiang +Signed-off-by: Junrui Luo +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204528.116920-3-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +[ adapted `vma_lookup(mm, ptr)` to `find_vma(mm, ptr)` plus a `ptr >= vma->vm_start` guard since `vma_lookup()` does not exist in 5.10 ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -875,7 +875,7 @@ static int fastrpc_get_args(u32 kernel, + + mmap_read_lock(current->mm); + vma = find_vma(current->mm, ctx->args[i].ptr); +- if (vma) ++ if (vma && ctx->args[i].ptr >= vma->vm_start) + pages[i].addr += (ctx->args[i].ptr & PAGE_MASK) - + vma->vm_start; + mmap_read_unlock(current->mm); diff --git a/queue-5.10/misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch b/queue-5.10/misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch new file mode 100644 index 0000000000..970296b829 --- /dev/null +++ b/queue-5.10/misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch @@ -0,0 +1,83 @@ +From sashal@kernel.org Wed Jun 17 00:40:09 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 18:40:04 -0400 +Subject: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback +To: stable@vger.kernel.org +Cc: Mukesh Ojha , Bjorn Andersson , Srinivas Kandagatla , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260616224004.3558667-2-sashal@kernel.org> + +From: Mukesh Ojha + +[ Upstream commit 5401fb4fe10fac6134c308495df18ed74aebb9c4 ] + +A NULL pointer dereference was observed on Hawi at boot when the DSP +sends a glink message before fastrpc_rpmsg_probe() has completed +initialization: + + Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178 + pc : _raw_spin_lock_irqsave+0x34/0x8c + lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] + ... + Call trace: + _raw_spin_lock_irqsave+0x34/0x8c (P) + fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] + qcom_glink_native_rx+0x538/0x6a4 + qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem] + +The faulting address 0x178 corresponds to the lock variable inside +struct fastrpc_channel_ctx, confirming that cctx is NULL when +fastrpc_rpmsg_callback() attempts to take the spinlock. + +There are two issues here. First, dev_set_drvdata() is called before +spin_lock_init() and idr_init(), leaving a window where the callback +can retrieve a valid cctx pointer but operate on an uninitialized +spinlock. Second, the rpmsg channel becomes live as soon as the driver +is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata() +is called at all, resulting in dev_get_drvdata() returning NULL. + +Fix both issues by moving all cctx initialization ahead of +dev_set_drvdata() so the structure is fully initialized before it +becomes visible to the callback, and add a NULL check in +fastrpc_rpmsg_callback() as a guard against any remaining window. + +Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model") +Cc: stable@vger.kernel.org +Signed-off-by: Mukesh Ojha +Reviewed-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260530204528.116920-4-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1689,7 +1689,6 @@ static int fastrpc_rpmsg_probe(struct rp + + kref_init(&data->refcount); + +- dev_set_drvdata(&rpdev->dev, data); + rdev->dma_mask = &data->dma_mask; + dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32)); + INIT_LIST_HEAD(&data->users); +@@ -1697,6 +1696,7 @@ static int fastrpc_rpmsg_probe(struct rp + idr_init(&data->ctx_idr); + data->domain_id = domain_id; + data->rpdev = rpdev; ++ dev_set_drvdata(&rpdev->dev, data); + + return of_platform_populate(rdev->of_node, NULL, NULL, rdev); + } +@@ -1744,6 +1744,9 @@ static int fastrpc_rpmsg_callback(struct + if (len < sizeof(*rsp)) + return -EINVAL; + ++ if (!cctx) ++ return -ENODEV; ++ + ctxid = ((rsp->ctx & FASTRPC_CTXID_MASK) >> 4); + + spin_lock_irqsave(&cctx->lock, flags); diff --git a/queue-5.10/mmc-renesas_sdhi-add-of-entry-for-rz-g2h-soc.patch b/queue-5.10/mmc-renesas_sdhi-add-of-entry-for-rz-g2h-soc.patch new file mode 100644 index 0000000000..8347e2fa61 --- /dev/null +++ b/queue-5.10/mmc-renesas_sdhi-add-of-entry-for-rz-g2h-soc.patch @@ -0,0 +1,44 @@ +From stable+bounces-266858-greg=kroah.com@vger.kernel.org Wed Jun 17 19:21:01 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 13:20:51 -0400 +Subject: mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC +To: stable@vger.kernel.org +Cc: Lad Prabhakar , Wolfram Sang , Geert Uytterhoeven , Ulf Hansson , Sasha Levin +Message-ID: <20260617172051.253322-1-sashal@kernel.org> + +From: Lad Prabhakar + +[ Upstream commit f48ee49726ee4ab545fd2dc644f169c0809b19b3 ] + +The RZ/G2H (R8A774E1) SoC was previously handled via the generic +"renesas,rcar-gen3-sdhi" fallback compatible string. However, because +the SDHI IP on RZ/G2H is identical with the R-Car H3-N (R8A77951), it +requires the specific quirks and configuration defined in +`of_r8a7795_compatible` rather than the generic Gen3 data. + +Add the explicit "renesas,sdhi-r8a774e1" match entry to map it correctly. +Note that the DT binding file renesas,sdhi.yaml does not need an update +as the entry for this SoC is already present. + +Fixes: 31941342888d ("arm64: dts: renesas: r8a774e1: Add SDHI nodes") +Cc: stable@vger.kernel.org +Signed-off-by: Lad Prabhakar +Reviewed-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c ++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +@@ -119,6 +119,7 @@ static const struct renesas_sdhi_of_data + static const struct of_device_id renesas_sdhi_internal_dmac_of_match[] = { + { .compatible = "renesas,sdhi-r7s9210", .data = &of_rza2_compatible, }, + { .compatible = "renesas,sdhi-mmc-r8a77470", .data = &of_rcar_gen3_compatible, }, ++ { .compatible = "renesas,sdhi-r8a774e1", .data = &of_rcar_gen3_compatible, }, + { .compatible = "renesas,sdhi-r8a7795", .data = &of_rcar_gen3_compatible, }, + { .compatible = "renesas,sdhi-r8a7796", .data = &of_rcar_gen3_compatible, }, + { .compatible = "renesas,rcar-gen3-sdhi", .data = &of_rcar_gen3_compatible, }, diff --git a/queue-5.10/mptcp-fix-missing-wakeups-in-edge-scenarios.patch b/queue-5.10/mptcp-fix-missing-wakeups-in-edge-scenarios.patch new file mode 100644 index 0000000000..2fe71645a5 --- /dev/null +++ b/queue-5.10/mptcp-fix-missing-wakeups-in-edge-scenarios.patch @@ -0,0 +1,49 @@ +From stable+bounces-266175-greg=kroah.com@vger.kernel.org Tue Jun 16 20:37:32 2026 +From: Sasha Levin +Date: Tue, 16 Jun 2026 14:37:23 -0400 +Subject: mptcp: fix missing wakeups in edge scenarios +To: stable@vger.kernel.org +Cc: Paolo Abeni , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin +Message-ID: <20260616183723.3474931-1-sashal@kernel.org> + +From: Paolo Abeni + +[ Upstream commit 9d8d28738f24b75616d6ca7a27cb4aed88520343 ] + +The mptcp_recvmsg() can fill MPTCP socket receive queue via +mptcp_move_skbs(), but currently does not try to wakeup any listener, +because the same process is going to check the receive queue soon. + +When multiple threads are reading from the same fd, the above can +cause stall. Add the missing wakeup. + +Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -1571,6 +1571,14 @@ static bool __mptcp_move_skbs(struct mpt + + if (mptcp_ofo_queue(msk) || moved > 0) { + mptcp_check_data_fin((struct sock *)msk); ++ ++ /* When multiple threads read from the same socket, the caller ++ * filling the receive queue does not try to wake up any other ++ * listener, which can stall it. Flag the data as ready and ++ * issue the missing wakeup here. ++ */ ++ set_bit(MPTCP_DATA_READY, &msk->flags); ++ ((struct sock *)msk)->sk_data_ready((struct sock *)msk); + return true; + } + return false; diff --git a/queue-5.10/net-phonet-free-phonet_device-after-rcu-grace-period.patch b/queue-5.10/net-phonet-free-phonet_device-after-rcu-grace-period.patch new file mode 100644 index 0000000000..b8b20920ba --- /dev/null +++ b/queue-5.10/net-phonet-free-phonet_device-after-rcu-grace-period.patch @@ -0,0 +1,43 @@ +From stable+bounces-266813-greg=kroah.com@vger.kernel.org Wed Jun 17 16:55:49 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 10:55:38 -0400 +Subject: net: phonet: free phonet_device after RCU grace period +To: stable@vger.kernel.org +Cc: "Santosh Kalluri" , "Rémi Denis-Courmont" , "Simon Horman" , "Jakub Kicinski" , "Sasha Levin" +Message-ID: <20260617145538.157435-3-sashal@kernel.org> + +From: Santosh Kalluri + +[ Upstream commit 71de0177b28da751f407581a4515cf4d762f6296 ] + +phonet_device_destroy() removes a phonet_device from the per-net device +list with list_del_rcu(), but frees it immediately. RCU readers walking +the same list can still hold a pointer to the object after it has been +removed, leading to a slab-use-after-free. + +Use kfree_rcu(), matching the lifetime rule already used by +phonet_address_del() for the same object type. + +Fixes: eeb74a9d45f7 ("Phonet: convert devices list to RCU") +Cc: stable@vger.kernel.org +Signed-off-by: Santosh Kalluri +Acked-by: Rémi Denis-Courmont +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/phonet/pn_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/phonet/pn_dev.c ++++ b/net/phonet/pn_dev.c +@@ -105,7 +105,7 @@ static void phonet_device_destroy(struct + for_each_set_bit(addr, pnd->addrs, 64) + phonet_address_notify(net, RTM_DELADDR, ifindex, addr); + +- kfree(pnd); ++ kfree_rcu(pnd, rcu); + } + } + diff --git a/queue-5.10/phonet-pass-ifindex-to-fill_addr.patch b/queue-5.10/phonet-pass-ifindex-to-fill_addr.patch new file mode 100644 index 0000000000..028134fd26 --- /dev/null +++ b/queue-5.10/phonet-pass-ifindex-to-fill_addr.patch @@ -0,0 +1,80 @@ +From stable+bounces-266811-greg=kroah.com@vger.kernel.org Wed Jun 17 16:59:00 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 10:55:36 -0400 +Subject: phonet: Pass ifindex to fill_addr(). +To: stable@vger.kernel.org +Cc: Kuniyuki Iwashima , Eric Dumazet , Paolo Abeni , Sasha Levin +Message-ID: <20260617145538.157435-1-sashal@kernel.org> + +From: Kuniyuki Iwashima + +[ Upstream commit 08a9572be36819b5d9011604edfa5db6c5062a7a ] + +We will convert addr_doit() and getaddr_dumpit() to RCU, both +of which call fill_addr(). + +The former will call phonet_address_notify() outside of RCU +due to GFP_KERNEL, so dev will not be available in fill_addr(). + +Let's pass ifindex directly to fill_addr(). + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Signed-off-by: Paolo Abeni +Stable-dep-of: 71de0177b28d ("net: phonet: free phonet_device after RCU grace period") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/phonet/pn_netlink.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/net/phonet/pn_netlink.c ++++ b/net/phonet/pn_netlink.c +@@ -19,7 +19,7 @@ + + /* Device address handling */ + +-static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr, ++static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr, + u32 portid, u32 seq, int event); + + void phonet_address_notify(int event, struct net_device *dev, u8 addr) +@@ -31,7 +31,8 @@ void phonet_address_notify(int event, st + nla_total_size(1), GFP_KERNEL); + if (skb == NULL) + goto errout; +- err = fill_addr(skb, dev, addr, 0, 0, event); ++ ++ err = fill_addr(skb, dev->ifindex, addr, 0, 0, event); + if (err < 0) { + WARN_ON(err == -EMSGSIZE); + kfree_skb(skb); +@@ -92,8 +93,8 @@ static int addr_doit(struct sk_buff *skb + return err; + } + +-static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr, +- u32 portid, u32 seq, int event) ++static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr, ++ u32 portid, u32 seq, int event) + { + struct ifaddrmsg *ifm; + struct nlmsghdr *nlh; +@@ -107,7 +108,7 @@ static int fill_addr(struct sk_buff *skb + ifm->ifa_prefixlen = 0; + ifm->ifa_flags = IFA_F_PERMANENT; + ifm->ifa_scope = RT_SCOPE_LINK; +- ifm->ifa_index = dev->ifindex; ++ ifm->ifa_index = ifindex; + if (nla_put_u8(skb, IFA_LOCAL, addr)) + goto nla_put_failure; + nlmsg_end(skb, nlh); +@@ -140,7 +141,7 @@ static int getaddr_dumpit(struct sk_buff + if (addr_idx++ < addr_start_idx) + continue; + +- if (fill_addr(skb, pnd->netdev, addr << 2, ++ if (fill_addr(skb, pnd->netdev->ifindex, addr << 2, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, RTM_NEWADDR) < 0) + goto out; diff --git a/queue-5.10/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch b/queue-5.10/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch new file mode 100644 index 0000000000..1fa9c22997 --- /dev/null +++ b/queue-5.10/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch @@ -0,0 +1,114 @@ +From stable+bounces-266812-greg=kroah.com@vger.kernel.org Wed Jun 17 16:59:06 2026 +From: Sasha Levin +Date: Wed, 17 Jun 2026 10:55:37 -0400 +Subject: phonet: Pass net and ifindex to phonet_address_notify(). +To: stable@vger.kernel.org +Cc: Kuniyuki Iwashima , Eric Dumazet , Paolo Abeni , Sasha Levin +Message-ID: <20260617145538.157435-2-sashal@kernel.org> + +From: Kuniyuki Iwashima + +[ Upstream commit 68ed5c38b512b734caf3da1f87db4a99fcfe3002 ] + +Currently, phonet_address_notify() fetches netns and ifindex from dev. + +Once addr_doit() is converted to RCU, phonet_address_notify() will be +called outside of RCU due to GFP_KERNEL, and dev will be unavailable +there. + +Let's pass net and ifindex to phonet_address_notify(). + +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Signed-off-by: Paolo Abeni +Stable-dep-of: 71de0177b28d ("net: phonet: free phonet_device after RCU grace period") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/phonet/pn_dev.h | 2 +- + net/phonet/pn_dev.c | 10 +++++++--- + net/phonet/pn_netlink.c | 12 ++++++------ + 3 files changed, 14 insertions(+), 10 deletions(-) + +--- a/include/net/phonet/pn_dev.h ++++ b/include/net/phonet/pn_dev.h +@@ -33,7 +33,7 @@ int phonet_address_add(struct net_device + int phonet_address_del(struct net_device *dev, u8 addr); + u8 phonet_address_get(struct net_device *dev, u8 addr); + int phonet_address_lookup(struct net *net, u8 addr); +-void phonet_address_notify(int event, struct net_device *dev, u8 addr); ++void phonet_address_notify(struct net *net, int event, u32 ifindex, u8 addr); + + int phonet_route_add(struct net_device *dev, u8 daddr); + int phonet_route_del(struct net_device *dev, u8 daddr); +--- a/net/phonet/pn_dev.c ++++ b/net/phonet/pn_dev.c +@@ -98,10 +98,13 @@ static void phonet_device_destroy(struct + mutex_unlock(&pndevs->lock); + + if (pnd) { ++ struct net *net = dev_net(dev); ++ u32 ifindex = dev->ifindex; + u8 addr; + + for_each_set_bit(addr, pnd->addrs, 64) +- phonet_address_notify(RTM_DELADDR, dev, addr); ++ phonet_address_notify(net, RTM_DELADDR, ifindex, addr); ++ + kfree(pnd); + } + } +@@ -244,8 +247,9 @@ static int phonet_device_autoconf(struct + ret = phonet_address_add(dev, req.ifr_phonet_autoconf.device); + if (ret) + return ret; +- phonet_address_notify(RTM_NEWADDR, dev, +- req.ifr_phonet_autoconf.device); ++ ++ phonet_address_notify(dev_net(dev), RTM_NEWADDR, dev->ifindex, ++ req.ifr_phonet_autoconf.device); + return 0; + } + +--- a/net/phonet/pn_netlink.c ++++ b/net/phonet/pn_netlink.c +@@ -22,7 +22,7 @@ + static int fill_addr(struct sk_buff *skb, u32 ifindex, u8 addr, + u32 portid, u32 seq, int event); + +-void phonet_address_notify(int event, struct net_device *dev, u8 addr) ++void phonet_address_notify(struct net *net, int event, u32 ifindex, u8 addr) + { + struct sk_buff *skb; + int err = -ENOBUFS; +@@ -32,17 +32,17 @@ void phonet_address_notify(int event, st + if (skb == NULL) + goto errout; + +- err = fill_addr(skb, dev->ifindex, addr, 0, 0, event); ++ err = fill_addr(skb, ifindex, addr, 0, 0, event); + if (err < 0) { + WARN_ON(err == -EMSGSIZE); + kfree_skb(skb); + goto errout; + } +- rtnl_notify(skb, dev_net(dev), 0, +- RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL); ++ ++ rtnl_notify(skb, net, 0, RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL); + return; + errout: +- rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err); ++ rtnl_set_sk_err(net, RTNLGRP_PHONET_IFADDR, err); + } + + static const struct nla_policy ifa_phonet_policy[IFA_MAX+1] = { +@@ -89,7 +89,7 @@ static int addr_doit(struct sk_buff *skb + else + err = phonet_address_del(dev, pnaddr); + if (!err) +- phonet_address_notify(nlh->nlmsg_type, dev, pnaddr); ++ phonet_address_notify(net, nlh->nlmsg_type, ifm->ifa_index, pnaddr); + return err; + } + diff --git a/queue-5.10/series b/queue-5.10/series index efddcaaefd..71450da887 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -80,3 +80,18 @@ fbdev-modedb-fix-misaligned-fields-in-the-1920x1080-60-mode.patch nfsd-fix-secinfo_no_name-decode-error-cleanup.patch nfsd-fix-posix_acl-leak-on-setacl-decode-failure.patch nfsd-check-get_user-return-when-reading-princhashlen.patch +dlm-prevent-npd-when-writing-a-positive-value-to-event_done.patch +usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch +bnxt_en-modify-bnxt_disable_int_sync-to-be-called-more-than-once.patch +bnxt_en-fix-null-pointer-dereference.patch +hv-utils-handle-and-propagate-errors-in-kvp_register.patch +mptcp-fix-missing-wakeups-in-edge-scenarios.patch +misc-fastrpc-add-dma_mask-to-fastrpc_channel_ctx.patch +misc-fastrpc-fix-null-pointer-dereference-in-rpmsg-callback.patch +drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch +phonet-pass-ifindex-to-fill_addr.patch +phonet-pass-net-and-ifindex-to-phonet_address_notify.patch +net-phonet-free-phonet_device-after-rcu-grace-period.patch +mmc-renesas_sdhi-add-of-entry-for-rz-g2h-soc.patch +misc-fastrpc-fix-dma-address-corruption-due-to-find_vma-misuse.patch +virtiofs-fix-uaf-on-submount-umount.patch diff --git a/queue-5.10/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch b/queue-5.10/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch new file mode 100644 index 0000000000..467f0b9479 --- /dev/null +++ b/queue-5.10/usb-cdns3-gadget-fix-null-pointer-dereference-in-ep_queue.patch @@ -0,0 +1,42 @@ +From 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Mon Sep 17 00:00:00 2001 +From: Yongchao Wu +Date: Tue, 31 Mar 2026 08:04:07 +0800 +Subject: usb: cdns3: gadget: fix NULL pointer dereference in ep_queue + +From: Yongchao Wu + +commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 upstream. + +When the gadget endpoint is disabled or not yet configured, the ep->desc +pointer can be NULL. This leads to a NULL pointer dereference when +__cdns3_gadget_ep_queue() is called, causing a kernel crash. + +Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the +standard return code for unconfigured endpoints. + +This prevents potential crashes when ep_queue is called on endpoints +that are not ready. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: stable +Signed-off-by: Yongchao Wu +Acked-by: Peter Chen +Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com +Signed-off-by: Mikhail Dmitrichenko +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/gadget.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -2587,6 +2587,9 @@ static int __cdns3_gadget_ep_queue(struc + struct cdns3_request *priv_req; + int ret = 0; + ++ if (!ep->desc) ++ return -ESHUTDOWN; ++ + request->actual = 0; + request->status = -EINPROGRESS; + priv_req = to_cdns3_request(request); diff --git a/queue-5.10/virtiofs-fix-uaf-on-submount-umount.patch b/queue-5.10/virtiofs-fix-uaf-on-submount-umount.patch new file mode 100644 index 0000000000..6dd067dadf --- /dev/null +++ b/queue-5.10/virtiofs-fix-uaf-on-submount-umount.patch @@ -0,0 +1,54 @@ +From stable+bounces-268642-greg=kroah.com@vger.kernel.org Thu Jun 25 19:59:15 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 13:56:09 -0400 +Subject: virtiofs: fix UAF on submount umount +To: stable@vger.kernel.org +Cc: "Miklos Szeredi" , "Aurélien Bombo" , "Zhihao Cheng" , "Greg Kurz" , "Sasha Levin" +Message-ID: <20260625175609.2544109-1-sashal@kernel.org> + +From: Miklos Szeredi + +[ Upstream commit 06b41351779e9289e8785694ade9042ae85e41ea ] + +iput() called from fuse_release_end() can Oops if the super block has +already been destroyed. Normally this is prevented by waiting for +num_waiting to go down to zero before commencing with super block shutdown. + +This only works, however, for the last submount instance, as the wait +counter is per connection, not per superblock. + +Revert to using synchronous release requests for the auto_submounts case, +which is virtiofs only at this time. + +Reported-by: Aurélien Bombo +Reported-by: Zhihao Cheng +Cc: Greg Kurz +Closes: https://github.com/kata-containers/kata-containers/issues/12589 +Fixes: 26e5c67deb2e ("fuse: fix livelock in synchronous file put from fuseblk workers") +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kurz +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/fuse/file.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -330,8 +330,14 @@ void fuse_release_common(struct file *fi + * aio and closes the fd before the aio completes. Since aio takes its + * own ref to the file, the IO completion has to drop the ref, which is + * how the fuse server can end up closing its clients' files. ++ * ++ * Exception is virtio-fs, which is not affected by the above (server is ++ * on host, cannot close open files in guest). Virtio-fs needs sync ++ * release, because the num_waiting mechanism to wait for all requests ++ * before commencing with fs shutdown doesn't work if submounts are ++ * used. + */ +- fuse_file_put(ff, false, isdir); ++ fuse_file_put(ff, ff->fm->fc->auto_submounts, isdir); + } + + static int fuse_open(struct inode *inode, struct file *file)