From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 16:11:13 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=338dd65f64a12d5d4dfe3123e7f900ea45581998;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: cpu-hotplug-bound-hotplug-states-sysfs-output.patch cpu-hotplug-preserve-per-instance-callback-errors.patch gpio-f7188x-add-support-for-nct6126d-version-b.patch gpio-mt7621-avoid-corruption-of-shared-interrupt-trigger-state.patch gpio-mt7621-be-sure-irq-domain-is-created-before-exposing-gpio-chips.patch gpio-mt7621-more-robust-management-of-irq-domain-teardown.patch gpio-tegra-do-not-call-pinctrl-for-gpio-direction.patch gpios-palmas-add-.get_direction-op.patch gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch ieee802154-admin-gate-legacy-llsec-dump-operations.patch ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch net-ethernet-ti-icssg-guard-pa-stat-lookups.patch net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation.patch net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch octeontx2-af-free-bpid-bitmap-on-setup-failure.patch posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch selftests-ftrace-drop-invalid-top-level-local-in-test_ownership.patch selftests-net-fix-file-owner-for-broadcast_ether_dst-test.patch --- diff --git a/queue-6.18/cpu-hotplug-bound-hotplug-states-sysfs-output.patch b/queue-6.18/cpu-hotplug-bound-hotplug-states-sysfs-output.patch new file mode 100644 index 0000000000..3aa796be2a --- /dev/null +++ b/queue-6.18/cpu-hotplug-bound-hotplug-states-sysfs-output.patch @@ -0,0 +1,53 @@ +From 86f436567f2516a0083b210bedc933544826a2c3 Mon Sep 17 00:00:00 2001 +From: Bradley Morgan +Date: Fri, 19 Jun 2026 16:37:18 +0000 +Subject: cpu: hotplug: Bound hotplug states sysfs output + +From: Bradley Morgan + +commit 86f436567f2516a0083b210bedc933544826a2c3 upstream. + +states_show() adds CPU hotplug state names into a single sysfs buffer +using sprintf(). With enough registered states, this can write past the +end of the PAGE_SIZE buffer. + +Use sysfs_emit_at() so output is bounded. + +Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface") +Signed-off-by: Bradley Morgan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cpu.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -2865,21 +2865,17 @@ static const struct attribute_group cpuh + .name = "hotplug", + }; + +-static ssize_t states_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t states_show(struct device *dev, struct device_attribute *attr, char *buf) + { +- ssize_t cur, res = 0; ++ ssize_t res = 0; + int i; + + mutex_lock(&cpuhp_state_mutex); + for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) { + struct cpuhp_step *sp = cpuhp_get_step(i); + +- if (sp->name) { +- cur = sprintf(buf, "%3d: %s\n", i, sp->name); +- buf += cur; +- res += cur; +- } ++ if (sp->name) ++ res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name); + } + mutex_unlock(&cpuhp_state_mutex); + return res; diff --git a/queue-6.18/cpu-hotplug-preserve-per-instance-callback-errors.patch b/queue-6.18/cpu-hotplug-preserve-per-instance-callback-errors.patch new file mode 100644 index 0000000000..411cf1fda6 --- /dev/null +++ b/queue-6.18/cpu-hotplug-preserve-per-instance-callback-errors.patch @@ -0,0 +1,53 @@ +From 673db10729fb121ea1b16fe57791a0cb9eac1eb5 Mon Sep 17 00:00:00 2001 +From: Bradley Morgan +Date: Fri, 19 Jun 2026 16:37:17 +0000 +Subject: cpu: hotplug: Preserve per instance callback errors + +From: Bradley Morgan + +commit 673db10729fb121ea1b16fe57791a0cb9eac1eb5 upstream. + +cpuhp_invoke_callback() unwinds earlier callbacks for the same +hotplug state when one instance fails. The rollback path currently +reuses ret, so a successful rollback can hide the original error and +make the failed transition look successful. + +Keep the rollback result separate from the original error. + +Fixes: 724a86881d03 ("smp/hotplug: Callback vs state-machine consistency") +Signed-off-by: Bradley Morgan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260619163719.12103-1-include@grrlz.net +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cpu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -175,7 +175,7 @@ static int cpuhp_invoke_callback(unsigne + struct cpuhp_step *step = cpuhp_get_step(state); + int (*cbm)(unsigned int cpu, struct hlist_node *node); + int (*cb)(unsigned int cpu); +- int ret, cnt; ++ int ret, cnt, rollback_ret; + + if (st->fail == state) { + st->fail = CPUHP_INVALID; +@@ -239,12 +239,12 @@ err: + break; + + trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node); +- ret = cbm(cpu, node); +- trace_cpuhp_exit(cpu, st->state, state, ret); ++ rollback_ret = cbm(cpu, node); ++ trace_cpuhp_exit(cpu, st->state, state, rollback_ret); + /* + * Rollback must not fail, + */ +- WARN_ON_ONCE(ret); ++ WARN_ON_ONCE(rollback_ret); + } + return ret; + } diff --git a/queue-6.18/gpio-f7188x-add-support-for-nct6126d-version-b.patch b/queue-6.18/gpio-f7188x-add-support-for-nct6126d-version-b.patch new file mode 100644 index 0000000000..3179b6f362 --- /dev/null +++ b/queue-6.18/gpio-f7188x-add-support-for-nct6126d-version-b.patch @@ -0,0 +1,51 @@ +From 9a6c0b6ea12746d50cf53d59a7e05fd83f974bda Mon Sep 17 00:00:00 2001 +From: Paul Louvel +Date: Mon, 29 Jun 2026 16:07:02 +0200 +Subject: gpio-f7188x: Add support for NCT6126D version B + +From: Paul Louvel + +commit 9a6c0b6ea12746d50cf53d59a7e05fd83f974bda upstream. + +The Nuvoton NCT6126D Super-I/O is available in two hardware revisions. +According to the manufacturer datasheet revision 2.4, version A reports +chip ID 0xD283, while version B reports chip ID 0xD284. + +The driver currently only recognizes only the version A ID. Version B +only contains hardware fixes unrelated to the GPIO functionality, so it +can be supported by simply adding its chip ID without any other driver +changes. + +Fixes: 3002b8642f01 ("gpio-f7188x: fix chip name and pin count on Nuvoton chip") +Cc: stable@vger.kernel.org + +Signed-off-by: Paul Louvel +Link: https://patch.msgid.link/20260629-gpio-f7188x-nct6126d-version-b-v1-1-a06226c02a2d@bootlin.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-f7188x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-f7188x.c ++++ b/drivers/gpio/gpio-f7188x.c +@@ -48,7 +48,8 @@ + /* + * Nuvoton devices. + */ +-#define SIO_NCT6126D_ID 0xD283 /* NCT6126D chipset ID */ ++#define SIO_NCT6126D_VER_A_ID 0xD283 /* NCT6126D version A chipset ID */ ++#define SIO_NCT6126D_VER_B_ID 0xD284 /* NCT6126D version B chipset ID */ + + #define SIO_LD_GPIO_NUVOTON 0x07 /* GPIO logical device */ + +@@ -564,7 +565,8 @@ static int __init f7188x_find(int addr, + case SIO_F81865_ID: + sio->type = f81865; + break; +- case SIO_NCT6126D_ID: ++ case SIO_NCT6126D_VER_A_ID: ++ case SIO_NCT6126D_VER_B_ID: + sio->device = SIO_LD_GPIO_NUVOTON; + sio->type = nct6126d; + break; diff --git a/queue-6.18/gpio-mt7621-avoid-corruption-of-shared-interrupt-trigger-state.patch b/queue-6.18/gpio-mt7621-avoid-corruption-of-shared-interrupt-trigger-state.patch new file mode 100644 index 0000000000..5aa697c2dc --- /dev/null +++ b/queue-6.18/gpio-mt7621-avoid-corruption-of-shared-interrupt-trigger-state.patch @@ -0,0 +1,39 @@ +From 1781172526d1092323af443fa03f00e6de560401 Mon Sep 17 00:00:00 2001 +From: Sergio Paracuellos +Date: Fri, 26 Jun 2026 08:01:09 +0200 +Subject: gpio: mt7621: avoid corruption of shared interrupt trigger state + +From: Sergio Paracuellos + +commit 1781172526d1092323af443fa03f00e6de560401 upstream. + +The bank-shared fields like 'rising' and 'falling' are modified using +non-atomic read-modify-write operations. Since every gpio chip instance +represents an entire bank of 32 pins, if 'mediatek_gpio_irq_type()' is +called concurrently for different IRQs on the same bank a possible overwrite +of each other's configuration is possible. Thus, protect this state with +'gpio_generic_lock_irqsave' lock in the same way it is handled in irp_chip +'mediatek_gpio_irq_mask()' and 'mediatek_gpio_irq_unmask()' callbacks. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621") +Signed-off-by: Sergio Paracuellos +Link: https://patch.msgid.link/20260626060112.2498324-2-sergio.paracuellos@gmail.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-mt7621.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpio/gpio-mt7621.c ++++ b/drivers/gpio/gpio-mt7621.c +@@ -187,6 +187,8 @@ mediatek_gpio_irq_type(struct irq_data * + struct mtk_gc *rg = gpiochip_get_data(gc); + u32 mask = BIT(mt7621_gpio_hwirq_to_offset(d->hwirq, rg)); + ++ guard(gpio_generic_lock_irqsave)(&rg->chip); ++ + if (type == IRQ_TYPE_PROBE) { + if ((rg->rising | rg->falling | + rg->hlevel | rg->llevel) & mask) diff --git a/queue-6.18/gpio-mt7621-be-sure-irq-domain-is-created-before-exposing-gpio-chips.patch b/queue-6.18/gpio-mt7621-be-sure-irq-domain-is-created-before-exposing-gpio-chips.patch new file mode 100644 index 0000000000..c393cfe538 --- /dev/null +++ b/queue-6.18/gpio-mt7621-be-sure-irq-domain-is-created-before-exposing-gpio-chips.patch @@ -0,0 +1,57 @@ +From 0e024f58291dfcb28d98c512002e1a80fad69798 Mon Sep 17 00:00:00 2001 +From: Sergio Paracuellos +Date: Fri, 26 Jun 2026 08:01:11 +0200 +Subject: gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips + +From: Sergio Paracuellos + +commit 0e024f58291dfcb28d98c512002e1a80fad69798 upstream. + +Function 'mediatek_gpio_bank_probe()' registers three GPIO chips using +'devm_gpiochip_add_data()'. At this point, the chips become live and visible +to consumers. However, the IRQ domain isn't allocated and set up until +'mt7621_gpio_irq_setup()' is called after the GPIO chips setup finishes. +If a consumer requests a GPIO IRQ concurrently 'mt7621_gpio_to_irq()' can +be called and pass a NULL irq domain pointer irq_create_mapping(), that can +corrupt the mappings or cause a crash. Fix this possible problem seting up +irq domain before GPIO chips setup is performed. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: a46f2e5720f5 ("gpio: mt7621: fix interrupt banks mapping on gpio chips") +Signed-off-by: Sergio Paracuellos +Link: https://patch.msgid.link/20260626060112.2498324-4-sergio.paracuellos@gmail.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-mt7621.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpio/gpio-mt7621.c ++++ b/drivers/gpio/gpio-mt7621.c +@@ -464,12 +464,6 @@ mediatek_gpio_probe(struct platform_devi + mtk->num_gpios = MTK_BANK_WIDTH * MTK_BANK_CNT; + platform_set_drvdata(pdev, mtk); + +- for (i = 0; i < MTK_BANK_CNT; i++) { +- ret = mediatek_gpio_bank_probe(dev, i); +- if (ret) +- return ret; +- } +- + if (mtk->gpio_irq > 0) { + ret = mt7621_gpio_irq_setup(pdev, mtk); + if (ret) +@@ -480,6 +474,12 @@ mediatek_gpio_probe(struct platform_devi + if (ret) + return ret; + ++ for (i = 0; i < MTK_BANK_CNT; i++) { ++ ret = mediatek_gpio_bank_probe(dev, i); ++ if (ret) ++ return ret; ++ } ++ + return 0; + } + diff --git a/queue-6.18/gpio-mt7621-more-robust-management-of-irq-domain-teardown.patch b/queue-6.18/gpio-mt7621-more-robust-management-of-irq-domain-teardown.patch new file mode 100644 index 0000000000..67c9fc209b --- /dev/null +++ b/queue-6.18/gpio-mt7621-more-robust-management-of-irq-domain-teardown.patch @@ -0,0 +1,71 @@ +From 839738536adabae1a7e98ed3fc332ce9cc991d27 Mon Sep 17 00:00:00 2001 +From: Sergio Paracuellos +Date: Fri, 26 Jun 2026 08:01:10 +0200 +Subject: gpio: mt7621: more robust management of IRQ domain teardown + +From: Sergio Paracuellos + +commit 839738536adabae1a7e98ed3fc332ce9cc991d27 upstream. + +The driver uses devm_gpiochip_add_data() to register the GPIO chips which +means the devres subsystem will unregister them only after the function +'mt7621_gpio_remove()' returns. During the window between domain destruction +and devres unregistering the GPIO chips, the chips are still fully active. +If a consumer or userspace invokes gpiod_to_irq() during this window, +'mt7621_gpio_to_irq()' can dereference the already-freed irq domain pointer. +Thus, manage the IRQ domain teardown using 'devm_add_action_or_reset()' to +guarantee it is destroyed strictly after the GPIO chips are removed. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: a46f2e5720f5 ("gpio: mt7621: fix interrupt banks mapping on gpio chips") +Signed-off-by: Sergio Paracuellos +Link: https://patch.msgid.link/20260626060112.2498324-3-sergio.paracuellos@gmail.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-mt7621.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/gpio/gpio-mt7621.c ++++ b/drivers/gpio/gpio-mt7621.c +@@ -270,9 +270,9 @@ static const struct irq_chip mt7621_irq_ + }; + + static void +-mt7621_gpio_remove(struct platform_device *pdev) ++mt7621_gpio_remove(void *data) + { +- struct mtk *priv = platform_get_drvdata(pdev); ++ struct mtk *priv = data; + int offset, virq; + + if (priv->gpio_irq > 0) +@@ -473,14 +473,14 @@ mediatek_gpio_probe(struct platform_devi + if (mtk->gpio_irq > 0) { + ret = mt7621_gpio_irq_setup(pdev, mtk); + if (ret) +- goto fail; ++ return ret; + } + +- return 0; ++ ret = devm_add_action_or_reset(dev, mt7621_gpio_remove, mtk); ++ if (ret) ++ return ret; + +-fail: +- mt7621_gpio_remove(pdev); +- return ret; ++ return 0; + } + + static const struct of_device_id mediatek_gpio_match[] = { +@@ -491,7 +491,6 @@ MODULE_DEVICE_TABLE(of, mediatek_gpio_ma + + static struct platform_driver mediatek_gpio_driver = { + .probe = mediatek_gpio_probe, +- .remove = mt7621_gpio_remove, + .driver = { + .name = "mt7621_gpio", + .of_match_table = mediatek_gpio_match, diff --git a/queue-6.18/gpio-tegra-do-not-call-pinctrl-for-gpio-direction.patch b/queue-6.18/gpio-tegra-do-not-call-pinctrl-for-gpio-direction.patch new file mode 100644 index 0000000000..5485c5b7d7 --- /dev/null +++ b/queue-6.18/gpio-tegra-do-not-call-pinctrl-for-gpio-direction.patch @@ -0,0 +1,96 @@ +From d3e91a95b2b0fc6336dbf3ec90d831a1654d2720 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Fri, 19 Jun 2026 23:24:39 +0800 +Subject: gpio: tegra: do not call pinctrl for GPIO direction + +From: Runyu Xiao + +commit d3e91a95b2b0fc6336dbf3ec90d831a1654d2720 upstream. + +tegra_gpio_direction_input() and tegra_gpio_direction_output() already +program the GPIO controller direction registers directly. The additional +pinctrl_gpio_direction_input/output() calls do not add a Tegra pinctrl +operation, because the Tegra pinmux ops provide GPIO request/free +handling but no gpio_set_direction hook. + +The extra call still enters the pinctrl core and takes pctldev->mutex. +Shared GPIO users can call the direction path while holding their +per-line spinlock, so this otherwise redundant pinctrl direction call can +sleep in an atomic context. + +This was found by our static analysis tool and then confirmed by manual +review of tegra_gpio_probe(), the Tegra GPIO direction callbacks and the +Tegra pinctrl ops. The reviewed path has a default non-sleeping +struct gpio_chip while the direction callback still enters the pinctrl +mutex path. + +A directed runtime validation kept the same non-sleeping chip registration +and drove: + + gpio_shared_proxy_direction_output() + gpiod_direction_output_raw_commit() + tegra_gpio_direction_output() + pinctrl_gpio_direction_output() + +Lockdep reported a sleep-in-atomic warning with the shared GPIO spinlock +held and pinctrl_get_device_gpio_range() plus tegra_gpio_direction_output() +on the stack. + +Do not mark the whole chip as can_sleep to paper over this: can_sleep +describes whether get()/set() may sleep, and Tegra value access is MMIO. +Remove the redundant pinctrl direction calls and keep pinctrl involvement +in the existing request/free path. + +Fixes: 11da90541283 ("gpio: tegra: Fix offset of pinctrl calls") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Link: https://patch.msgid.link/20260619152439.1239561-1-runyu.xiao@seu.edu.cn +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-tegra.c | 18 ++---------------- + 1 file changed, 2 insertions(+), 16 deletions(-) + +--- a/drivers/gpio/gpio-tegra.c ++++ b/drivers/gpio/gpio-tegra.c +@@ -172,18 +172,11 @@ static int tegra_gpio_direction_input(st + unsigned int offset) + { + struct tegra_gpio_info *tgi = gpiochip_get_data(chip); +- int ret; + + tegra_gpio_mask_write(tgi, GPIO_MSK_OE(tgi, offset), offset, 0); + tegra_gpio_enable(tgi, offset); + +- ret = pinctrl_gpio_direction_input(chip, offset); +- if (ret < 0) +- dev_err(tgi->dev, +- "Failed to set pinctrl input direction of GPIO %d: %d", +- chip->base + offset, ret); +- +- return ret; ++ return 0; + } + + static int tegra_gpio_direction_output(struct gpio_chip *chip, +@@ -191,19 +184,12 @@ static int tegra_gpio_direction_output(s + int value) + { + struct tegra_gpio_info *tgi = gpiochip_get_data(chip); +- int ret; + + tegra_gpio_set(chip, offset, value); + tegra_gpio_mask_write(tgi, GPIO_MSK_OE(tgi, offset), offset, 1); + tegra_gpio_enable(tgi, offset); + +- ret = pinctrl_gpio_direction_output(chip, offset); +- if (ret < 0) +- dev_err(tgi->dev, +- "Failed to set pinctrl output direction of GPIO %d: %d", +- chip->base + offset, ret); +- +- return ret; ++ return 0; + } + + static int tegra_gpio_get_direction(struct gpio_chip *chip, diff --git a/queue-6.18/gpios-palmas-add-.get_direction-op.patch b/queue-6.18/gpios-palmas-add-.get_direction-op.patch new file mode 100644 index 0000000000..85e397e31a --- /dev/null +++ b/queue-6.18/gpios-palmas-add-.get_direction-op.patch @@ -0,0 +1,58 @@ +From db4a79713ed8e252d5e4edf6eaaa80948b6855a2 Mon Sep 17 00:00:00 2001 +From: Andreas Kemnade +Date: Sat, 4 Jul 2026 10:40:54 +0200 +Subject: gpios: palmas: add .get_direction() op + +From: Andreas Kemnade + +commit db4a79713ed8e252d5e4edf6eaaa80948b6855a2 upstream. + +Accessing debug/gpio is quite noisy without a get_direction() +implementation. To calm that down add an implementation. + +Fixes: 3d50a2785271 ("gpio: palmas: Add support for Palmas GPIO") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: Andreas Kemnade +Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-palmas.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/drivers/gpio/gpio-palmas.c ++++ b/drivers/gpio/gpio-palmas.c +@@ -116,6 +116,24 @@ static int palmas_gpio_input(struct gpio + return ret; + } + ++static int palmas_gpio_get_direction(struct gpio_chip *gc, unsigned int offset) ++{ ++ struct palmas_gpio *pg = gpiochip_get_data(gc); ++ struct palmas *palmas = pg->palmas; ++ unsigned int val; ++ unsigned int reg; ++ int ret; ++ int gpio16 = (offset/8); ++ ++ offset %= 8; ++ reg = (gpio16) ? PALMAS_GPIO_DATA_DIR2 : PALMAS_GPIO_DATA_DIR; ++ ret = palmas_read(palmas, PALMAS_GPIO_BASE, reg, &val); ++ if (ret) ++ return ret; ++ ++ return (val & BIT(offset)) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN; ++} ++ + static int palmas_gpio_to_irq(struct gpio_chip *gc, unsigned offset) + { + struct palmas_gpio *pg = gpiochip_get_data(gc); +@@ -165,6 +183,7 @@ static int palmas_gpio_probe(struct plat + palmas_gpio->gpio_chip.can_sleep = true; + palmas_gpio->gpio_chip.direction_input = palmas_gpio_input; + palmas_gpio->gpio_chip.direction_output = palmas_gpio_output; ++ palmas_gpio->gpio_chip.get_direction = palmas_gpio_get_direction; + palmas_gpio->gpio_chip.to_irq = palmas_gpio_to_irq; + palmas_gpio->gpio_chip.set = palmas_gpio_set; + palmas_gpio->gpio_chip.get = palmas_gpio_get; diff --git a/queue-6.18/gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch b/queue-6.18/gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch new file mode 100644 index 0000000000..65a9879d3a --- /dev/null +++ b/queue-6.18/gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch @@ -0,0 +1,139 @@ +From d676c9a73bdcd8237425dbb826f2bd1a25c36e40 Mon Sep 17 00:00:00 2001 +From: Ankit Garg +Date: Tue, 16 Jun 2026 18:32:08 -0700 +Subject: gve: fix header buffer corruption with header-split and HW-GRO + +From: Ankit Garg + +commit d676c9a73bdcd8237425dbb826f2bd1a25c36e40 upstream. + +The DQO RX datapath programs a per-buffer-queue-descriptor +header_buf_addr at post time and reads the split header back at +completion time. Both the post and the read currently index the +header buffer by queue position rather than by the buffer's identity: + + - post (gve_rx_post_buffers_dqo): header_buf_addr is computed from + bufq->tail + - read (gve_rx_dqo): the header is read from desc_idx (the completion + queue head index) + +This relies on the buffer-queue index and the completion-queue index +being equal for the start of every packet, i.e. on the device consuming +posted buffers and returning completions in the exact same order. That +assumption does not hold once HW-GRO is enabled with multiple +flows: coalesced segments are accepted and completed in an order that +may differ from the order buffers were posted, and segments from +different flows may interleave. + +That results in two problems: + +1. Wrong header slot on read. Because the read offset is derived from + the completion index (desc_idx) while the device wrote the header to + the address programmed for the buffer's buf_id, the driver can copy + a header belonging to a different packet. This shows up as + throughput drop (about 30% drop and large numbers of TCP + retransmissions) with header-split and HW-GRO both enabled and many + streams. + +2. Header buffer reused while still owned by the device. The driver + advances bufq->head by one per completion and re-posts buffers based + on that. Arrival of N RX completions only guarantees that at least N + RX buffer descriptors have been read by the device. It does not + guarantee that the device has relinquished the ownership of all the + buffers corresponding to those N descriptors. With out-of-order + completions (e.g. the completion for a packet copied into buffer N + arrives before the completion for a packet copied into buffer N-1), + the driver can re-post and overwrite a header buffer that the device + is still going to write into, corrupting the header of a packet + whose completion has not yet been processed. + +Fix both issues by indexing the header buffer by buf_id on both the post +and read paths. Reading from buf_id's slot is therefore always correct +regardless of completion ordering (fixes problem 1). + +Indexing by buf_id also ties each header slot to the lifetime of its +buffer state. A buffer state is only returned to the free/recycle lists +when its own completion (buf_id) is processed, so its header slot can +only be re-posted after the device is done with it. This makes header +slot reuse safe under out-of-order completions (fixes problem 2). + +Allocate (gve_rx_alloc_hdr_bufs) and free (gve_rx_free_hdr_bufs) the +header buffers based on num_buf_states to match the buf_id indexing. + +Cc: stable@vger.kernel.org +Fixes: 5e37d8254e7f ("gve: Add header split data path") +Signed-off-by: Ankit Garg +Reviewed-by: Praveen Kaligineedi +Reviewed-by: Jordan Rhee +Reviewed-by: Harshitha Ramamurthy +Signed-off-by: Joshua Washington +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20260617013208.3781453-1-joshwash@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 28 +++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +--- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c ++++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c +@@ -21,11 +21,13 @@ + static void gve_rx_free_hdr_bufs(struct gve_priv *priv, struct gve_rx_ring *rx) + { + struct device *hdev = &priv->pdev->dev; +- int buf_count = rx->dqo.bufq.mask + 1; + + if (rx->dqo.hdr_bufs.data) { +- dma_free_coherent(hdev, priv->header_buf_size * buf_count, +- rx->dqo.hdr_bufs.data, rx->dqo.hdr_bufs.addr); ++ size_t size = ++ (size_t)priv->header_buf_size * rx->dqo.num_buf_states; ++ ++ dma_free_coherent(hdev, size, rx->dqo.hdr_bufs.data, ++ rx->dqo.hdr_bufs.addr); + rx->dqo.hdr_bufs.data = NULL; + } + } +@@ -250,7 +252,7 @@ int gve_rx_alloc_ring_dqo(struct gve_pri + + /* Allocate header buffers for header-split */ + if (cfg->enable_header_split) +- if (gve_rx_alloc_hdr_bufs(priv, rx, buffer_queue_slots)) ++ if (gve_rx_alloc_hdr_bufs(priv, rx, rx->dqo.num_buf_states)) + goto err; + + /* Allocate RX completion queue */ +@@ -379,10 +381,13 @@ void gve_rx_post_buffers_dqo(struct gve_ + break; + } + +- if (rx->dqo.hdr_bufs.data) ++ if (rx->dqo.hdr_bufs.data) { ++ u16 buf_id = le16_to_cpu(desc->buf_id); ++ + desc->header_buf_addr = + cpu_to_le64(rx->dqo.hdr_bufs.addr + +- priv->header_buf_size * bufq->tail); ++ (size_t)priv->header_buf_size * buf_id); ++ } + + bufq->tail = (bufq->tail + 1) & bufq->mask; + complq->num_free_slots--; +@@ -799,10 +804,13 @@ static int gve_rx_dqo(struct napi_struct + int unsplit = 0; + + if (hdr_len && !hbo) { +- rx->ctx.skb_head = gve_rx_copy_data(priv->dev, napi, +- rx->dqo.hdr_bufs.data + +- desc_idx * priv->header_buf_size, +- hdr_len); ++ size_t offset = ++ (size_t)buffer_id * priv->header_buf_size; ++ ++ rx->ctx.skb_head = ++ gve_rx_copy_data(priv->dev, napi, ++ rx->dqo.hdr_bufs.data + offset, ++ hdr_len); + if (unlikely(!rx->ctx.skb_head)) + goto error; + rx->ctx.skb_tail = rx->ctx.skb_head; diff --git a/queue-6.18/ieee802154-admin-gate-legacy-llsec-dump-operations.patch b/queue-6.18/ieee802154-admin-gate-legacy-llsec-dump-operations.patch new file mode 100644 index 0000000000..7164dbff31 --- /dev/null +++ b/queue-6.18/ieee802154-admin-gate-legacy-llsec-dump-operations.patch @@ -0,0 +1,98 @@ +From 9c1e0b6d49471a712511d23fc9d06901561135e8 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Wed, 20 May 2026 10:16:39 -0400 +Subject: ieee802154: admin-gate legacy LLSEC dump operations + +From: Michael Bommarito + +commit 9c1e0b6d49471a712511d23fc9d06901561135e8 upstream. + +In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table +builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, +LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which +sets no .flags, so generic netlink runs them ungated. The modern +nl802154 family admin-gates the equivalent reads via +NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. + +Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve +the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev +that has an LLSEC key installed; the dump handler writes the raw +16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied +verbatim from struct ieee802154_llsec_key.key) into the reply. +Recovering the AES key compromises 802.15.4 LLSEC link confidentiality +and authenticity, since LLSEC uses CCM* and the same key authenticates +and encrypts frames. + +Impact: any local uid with no capabilities can read the raw 16-byte +AES-128 LLSEC key from the kernel keytable on any wpan netdev that has +an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY +dump on the legacy IEEE802154_NL generic-netlink family. + +Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but +setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump +entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the +modern nl802154 family exposes their equivalents to unprivileged +readers by design (NL802154_CMD_GET_WPAN_PHY and +NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged +users" annotations). + +Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 +Signed-off-by: Michael Bommarito +Link: https://lore.kernel.org/20260520141640.1149513-2-michael.bommarito@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/ieee802154.h | 8 ++++++++ + net/ieee802154/netlink.c | 16 ++++++++-------- + 2 files changed, 16 insertions(+), 8 deletions(-) + +--- a/net/ieee802154/ieee802154.h ++++ b/net/ieee802154/ieee802154.h +@@ -23,6 +23,14 @@ void ieee802154_nl_exit(void); + .dumpit = _dump, \ + } + ++#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \ ++ { \ ++ .cmd = _cmd, \ ++ .doit = _func, \ ++ .dumpit = _dump, \ ++ .flags = GENL_ADMIN_PERM, \ ++ } ++ + struct genl_info; + + struct sk_buff *ieee802154_nl_create(int flags, u8 req); +--- a/net/ieee802154/netlink.c ++++ b/net/ieee802154/netlink.c +@@ -98,20 +98,20 @@ static const struct genl_small_ops ieee8 + IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams), + IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams), + IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL, +- ieee802154_llsec_dump_keys), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL, ++ ieee802154_llsec_dump_keys), + IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), + IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL, +- ieee802154_llsec_dump_devs), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL, ++ ieee802154_llsec_dump_devs), + IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), + IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL, +- ieee802154_llsec_dump_devkeys), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL, ++ ieee802154_llsec_dump_devkeys), + IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), + IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, +- ieee802154_llsec_dump_seclevels), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, ++ ieee802154_llsec_dump_seclevels), + IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL, + ieee802154_llsec_add_seclevel), + IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL, diff --git a/queue-6.18/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch b/queue-6.18/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch new file mode 100644 index 0000000000..0de9daba83 --- /dev/null +++ b/queue-6.18/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch @@ -0,0 +1,94 @@ +From a6bfdfcc6711d1d5a92e98644359dedc67c0c858 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Wed, 20 May 2026 10:16:40 -0400 +Subject: ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation + +From: Michael Bommarito + +commit a6bfdfcc6711d1d5a92e98644359dedc67c0c858 upstream. + +The LLSEC ADD/DEL doit handlers under the legacy IEEE802154_NL family +consume IEEE802154_ATTR_LLSEC_KEY_BYTES and +IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS, both declared in +net/ieee802154/nl_policy.c as bare length entries with no .type +(defaulting to NLA_UNSPEC). Generic netlink strict validation rejects +all NLA_UNSPEC attributes via validate_nla(), so every LLSEC_ADD_KEY, +LLSEC_DEL_KEY, LLSEC_ADD_DEV, LLSEC_DEL_DEV, LLSEC_ADD_DEVKEY, +LLSEC_DEL_DEVKEY, LLSEC_ADD_SECLEVEL, and LLSEC_DEL_SECLEVEL request +fails at the dispatcher with "Unsupported attribute" before reaching +the handler. + +The doit path has been silently dead since strict validation became +the default for genl families that do not opt out. The dump path is +unaffected because dump requests carry no LLSEC attributes to +validate, which is why the LLSEC_LIST_KEY read remained reachable +(patch 1/2). Introduce IEEE802154_OP_RELAXED() mirroring +IEEE802154_OP() but with .validate = GENL_DONT_VALIDATE_STRICT, and +use it for the eight legacy LLSEC mutate ops so admin-driven LLSEC +configuration via the legacy interface works again. + +Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 +Signed-off-by: Michael Bommarito +Link: https://lore.kernel.org/20260520141640.1149513-3-michael.bommarito@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/ieee802154.h | 9 +++++++++ + net/ieee802154/netlink.c | 20 ++++++++++---------- + 2 files changed, 19 insertions(+), 10 deletions(-) + +--- a/net/ieee802154/ieee802154.h ++++ b/net/ieee802154/ieee802154.h +@@ -16,6 +16,15 @@ void ieee802154_nl_exit(void); + .flags = GENL_ADMIN_PERM, \ + } + ++#define IEEE802154_OP_RELAXED(_cmd, _func) \ ++ { \ ++ .cmd = _cmd, \ ++ .doit = _func, \ ++ .dumpit = NULL, \ ++ .flags = GENL_ADMIN_PERM, \ ++ .validate = GENL_DONT_VALIDATE_STRICT,\ ++ } ++ + #define IEEE802154_DUMP(_cmd, _func, _dump) \ + { \ + .cmd = _cmd, \ +--- a/net/ieee802154/netlink.c ++++ b/net/ieee802154/netlink.c +@@ -100,22 +100,22 @@ static const struct genl_small_ops ieee8 + IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL, + ieee802154_llsec_dump_keys), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL, + ieee802154_llsec_dump_devs), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL, + ieee802154_llsec_dump_devkeys), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, + ieee802154_llsec_dump_seclevels), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL, +- ieee802154_llsec_add_seclevel), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL, +- ieee802154_llsec_del_seclevel), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_SECLEVEL, ++ ieee802154_llsec_add_seclevel), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_SECLEVEL, ++ ieee802154_llsec_del_seclevel), + }; + + static const struct genl_multicast_group ieee802154_mcgrps[] = { diff --git a/queue-6.18/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch b/queue-6.18/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch new file mode 100644 index 0000000000..b24cba5c5f --- /dev/null +++ b/queue-6.18/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch @@ -0,0 +1,55 @@ +From e09390e439bd7cca30dd10893b1f64802961667a Mon Sep 17 00:00:00 2001 +From: Shitalkumar Gandhi +Date: Tue, 21 Apr 2026 13:02:59 +0530 +Subject: ieee802154: ca8210: fix cas_ctl leak on spi_async failure + +From: Shitalkumar Gandhi + +commit e09390e439bd7cca30dd10893b1f64802961667a upstream. + +ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) +and relies entirely on the SPI completion callback +ca8210_spi_transfer_complete() to free it. + +The spi_async() API only invokes the completion callback on successful +submission. On failure it returns a negative error code without ever +queuing the callback, which leaves cas_ctl and its embedded spi_message +and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is +inside the completion callback, so there is no other reclamation path. + +ca8210_spi_transfer() is called from ca8210_spi_exchange(), the +interrupt handler ca8210_interrupt_handler(), and from the retry path +inside the completion callback itself. The exchange and interrupt +handler paths loop on -EBUSY, so under sustained SPI bus contention +every retry iteration leaks a fresh cas_ctl (~600 bytes per +occurrence). + +Fix it by freeing cas_ctl on the spi_async() error path. While here, +correct the misleading error string: the function calls spi_async(), +not spi_sync(). + +Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Shitalkumar Gandhi +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/20260421073259.2259783-1-shitalkumar.gandhi@cambiumnetworks.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/ca8210.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -920,9 +920,10 @@ static int ca8210_spi_transfer( + if (status < 0) { + dev_crit( + &spi->dev, +- "status %d from spi_sync in write\n", ++ "status %d from spi_async in write\n", + status + ); ++ kfree(cas_ctl); + } + + return status; diff --git a/queue-6.18/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch b/queue-6.18/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch new file mode 100644 index 0000000000..90828503c1 --- /dev/null +++ b/queue-6.18/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch @@ -0,0 +1,71 @@ +From 6d7f7bcf225b2d566176bf6229dbd1252940cb3c Mon Sep 17 00:00:00 2001 +From: Shitalkumar Gandhi +Date: Wed, 20 May 2026 16:27:50 +0530 +Subject: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit + +From: Shitalkumar Gandhi + +commit 6d7f7bcf225b2d566176bf6229dbd1252940cb3c upstream. + +ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange +a kmalloc'd buffer pointer through a struct kfifo, but pass a literal +'4' as the byte count to kfifo_in()/kfifo_out(). + +This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the +low 4 bytes of the 8-byte pointer are written into the FIFO. The reader +then reads back 4 bytes into an 8-byte local pointer variable, leaving +the upper 4 bytes uninitialized stack data. The first dereference of +the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel +address and generally results in an oops. + +Use sizeof(fifo_buffer) so the byte count matches pointer width on every +architecture. + +The driver has no architecture restriction in Kconfig, so any 64-bit +build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has +been latent since the driver was added in 2017 because it is most +commonly deployed on 32-bit MCUs. + +Found via a custom Coccinelle semantic patch hunting for short-byte +kfifo I/O on byte-mode kfifos used to shuttle pointers. + +Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Shitalkumar Gandhi +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/20260520105750.30144-1-shitalkumar.gandhi@cambiumnetworks.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/ca8210.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -595,7 +595,7 @@ static int ca8210_test_int_driver_write( + fifo_buffer = kmemdup(buf, len, GFP_KERNEL); + if (!fifo_buffer) + return -ENOMEM; +- kfifo_in(&test->up_fifo, &fifo_buffer, 4); ++ kfifo_in(&test->up_fifo, &fifo_buffer, sizeof(fifo_buffer)); + wake_up_interruptible(&priv->test.readq); + + return 0; +@@ -2527,6 +2527,7 @@ static ssize_t ca8210_test_int_user_read + struct ca8210_priv *priv = filp->private_data; + unsigned char *fifo_buffer; + unsigned long bytes_not_copied; ++ unsigned int copied; + + if (filp->f_flags & O_NONBLOCK) { + /* Non-blocking mode */ +@@ -2540,7 +2541,8 @@ static ssize_t ca8210_test_int_user_read + ); + } + +- if (kfifo_out(&priv->test.up_fifo, &fifo_buffer, 4) != 4) { ++ copied = kfifo_out(&priv->test.up_fifo, &fifo_buffer, sizeof(fifo_buffer)); ++ if (copied != sizeof(fifo_buffer)) { + dev_err( + &priv->spi->dev, + "test_interface: Wrong number of elements popped from upstream fifo\n" diff --git a/queue-6.18/locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch b/queue-6.18/locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch new file mode 100644 index 0000000000..46bcd1ff1d --- /dev/null +++ b/queue-6.18/locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch @@ -0,0 +1,106 @@ +From 89038cc87d80c77e7aa6f42a64b2573b74af339f Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 19 Jun 2026 14:52:08 +0200 +Subject: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() + +From: Thomas Gleixner + +commit 89038cc87d80c77e7aa6f42a64b2573b74af339f upstream. + +rt_spin_unlock() releases the RCU protection before unlocking the +lock. That opens the door for the following UAF scenario: + + T1 T2 + spin_lock(&p->lock); rcu_read_lock(); + invalidate(p); p = rcu_dereference(ptr); + rcu_assign_pointer(ptr, NULL); if (!p) return; + spin_unlock(&p->lock); spin_lock(&p->lock) + lock(&lock->lock); + rcu_read_lock(); + kfree_rcu(p); rcu_read_unlock(); + .... + spin_unlock(&p->lock) + rcu_read_unlock(); // Ends grace period + rcu_do_batch() + kfree(p); + UAF -> rt_mutex_cmpxchg_release(&lock->lock...) + +Regular spinlocks keep preemption disabled accross the unlock operation, +which provides full RCU protection, but the RT substitution fails to +resemble that. Same applies for the rwlock substitution. + +Move the rcu_read_unlock() invocation past the unlock operations to match +the non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but +that's harmless as the caller needs to hold RCU read lock across the lock +operation. The migrate_enable() call stays before the unlock operation +because there is no per CPU operation in the unlock path which would +require migration to be kept disabled. + +Fixes: 0f383b6dc96e ("locking/spinlock: Provide RT variant") +Reported-by: syzbot+000c800a02097aaa10ed@syzkaller.appspotmail.com +Decoded-by: Jann Horn +Signed-off-by: Thomas Gleixner +Reviewed-by: Sebastian Andrzej Siewior +Acked-by: Al Viro +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/87jyrud75z.ffs@fw13 +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/spinlock_rt.c | 27 ++++++++++++++++++++++++--- + 1 file changed, 24 insertions(+), 3 deletions(-) + +--- a/kernel/locking/spinlock_rt.c ++++ b/kernel/locking/spinlock_rt.c +@@ -79,10 +79,27 @@ void __sched rt_spin_unlock(spinlock_t * + { + spin_release(&lock->dep_map, _RET_IP_); + migrate_enable(); +- rcu_read_unlock(); + + if (unlikely(!rt_mutex_cmpxchg_release(&lock->lock, current, NULL))) + rt_mutex_slowunlock(&lock->lock); ++ ++ /* ++ * This must be last to prevent the following UAF: ++ * ++ * T1 T2 ++ * spin_lock(&p->lock); rcu_read_lock(); ++ * invalidate(p); p = rcu_dereference(ptr); ++ * rcu_assign_pointer(ptr, NULL); if (!p) return; ++ * spin_unlock(&p->lock); spin_lock(&p->lock); ++ * kfree_rcu(p); rcu_read_unlock(); ++ * .... ++ * spin_unlock(&p->lock) ++ * rcu_read_unlock(); // Ends grace period ++ * rcu_do_batch() ++ * kfree(p); ++ * UAF -> rt_mutex_cmpxchg_release(&p->lock.lock...) ++ */ ++ rcu_read_unlock(); + } + EXPORT_SYMBOL(rt_spin_unlock); + +@@ -262,17 +279,21 @@ void __sched rt_read_unlock(rwlock_t *rw + { + rwlock_release(&rwlock->dep_map, _RET_IP_); + migrate_enable(); +- rcu_read_unlock(); + rwbase_read_unlock(&rwlock->rwbase, TASK_RTLOCK_WAIT); ++ ++ /* This must be last. See comment in rt_spin_unlock() */ ++ rcu_read_unlock(); + } + EXPORT_SYMBOL(rt_read_unlock); + + void __sched rt_write_unlock(rwlock_t *rwlock) __releases(RCU) + { + rwlock_release(&rwlock->dep_map, _RET_IP_); +- rcu_read_unlock(); + migrate_enable(); + rwbase_write_unlock(&rwlock->rwbase); ++ ++ /* This must be last. See comment in rt_spin_unlock() */ ++ rcu_read_unlock(); + } + EXPORT_SYMBOL(rt_write_unlock); + diff --git a/queue-6.18/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch b/queue-6.18/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch new file mode 100644 index 0000000000..c87a251445 --- /dev/null +++ b/queue-6.18/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch @@ -0,0 +1,83 @@ +From 1bd6676254b4ab6acd44b662b5e92822c036463a Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Tue, 16 Jun 2026 22:24:24 +0800 +Subject: net: ena: clean up XDP TX queues when regular TX setup fails + +From: Dawei Feng + +commit 1bd6676254b4ab6acd44b662b5e92822c036463a upstream. + +create_queues_with_size_backoff() creates XDP TX queues before setting +up the regular TX path. If the subsequent allocation or creation of +regular TX queues fails, the error handling paths omit the teardown of the +XDP TX queues, leading to a resource leak. + +Fix this by explicitly destroying the XDP TX queue subset at the two +missing failure points. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still +present in v7.1-rc7. + +An x86_64 allyesconfig build showed no new warnings. As we do not have +an ENA device to test with, no runtime testing was able to be performed. + +Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") +Cc: stable@vger.kernel.org +Signed-off-by: Dawei Feng +Reviewed-by: Arthur Kiyanovski +Tested-by: Arthur Kiyanovski +Link: https://patch.msgid.link/20260616142424.4005130-1-dawei.feng@seu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -752,6 +752,18 @@ static void ena_destroy_all_tx_queues(st + } + } + ++static void ena_destroy_xdp_tx_queues(struct ena_adapter *adapter) ++{ ++ u16 ena_qid; ++ int i; ++ ++ for (i = adapter->xdp_first_ring; ++ i < adapter->xdp_first_ring + adapter->xdp_num_queues; i++) { ++ ena_qid = ENA_IO_TXQ_IDX(i); ++ ena_com_destroy_io_queue(adapter->ena_dev, ena_qid); ++ } ++} ++ + static void ena_destroy_all_rx_queues(struct ena_adapter *adapter) + { + u16 ena_qid; +@@ -2078,14 +2090,21 @@ static int create_queues_with_size_backo + rc = ena_setup_tx_resources_in_range(adapter, + 0, + adapter->num_io_queues); +- if (rc) ++ if (rc) { ++ ena_destroy_xdp_tx_queues(adapter); ++ ena_free_all_io_tx_resources_in_range(adapter, ++ adapter->xdp_first_ring, ++ adapter->xdp_num_queues); + goto err_setup_tx; ++ } + + rc = ena_create_io_tx_queues_in_range(adapter, + 0, + adapter->num_io_queues); +- if (rc) ++ if (rc) { ++ ena_destroy_xdp_tx_queues(adapter); + goto err_create_tx_queues; ++ } + + rc = ena_setup_all_rx_resources(adapter); + if (rc) diff --git a/queue-6.18/net-ethernet-ti-icssg-guard-pa-stat-lookups.patch b/queue-6.18/net-ethernet-ti-icssg-guard-pa-stat-lookups.patch new file mode 100644 index 0000000000..651dcd40b1 --- /dev/null +++ b/queue-6.18/net-ethernet-ti-icssg-guard-pa-stat-lookups.patch @@ -0,0 +1,102 @@ +From 27b9daba50609335db6ca81e4cccf50ded21ec76 Mon Sep 17 00:00:00 2001 +From: Philippe Schenker +Date: Thu, 18 Jun 2026 11:30:24 +0200 +Subject: net: ethernet: ti: icssg: guard PA stat lookups + +From: Philippe Schenker + +commit 27b9daba50609335db6ca81e4cccf50ded21ec76 upstream. + +icssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name() +with FW PA stat names regardless of whether the PA stats block is +present on the hardware. emac_get_stat_by_name() already guards the +PA stats lookup with `if (emac->prueth->pa_stats)`; when that pointer +is NULL the lookup falls through to netdev_err() and returns -EINVAL. +Because ndo_get_stats64 is polled regularly by the networking stack +this produces thousands of log entries of the form: + + icssg-prueth icssg1-eth end0: Invalid stats FW_RX_ERROR + +A secondary consequence is that the int(-EINVAL) return value is +implicitly widened to a near-ULLONG_MAX unsigned value when accumulated +into the __u64 fields of rtnl_link_stats64, silently corrupting the +rx_errors, rx_dropped and tx_dropped counters reported by `ip -s link`. + +Every other PA-aware code path in the driver is already guarded with +the same `if (emac->prueth->pa_stats)` check. Apply the same guard +here. + +Fixes: 0d15a26b247d ("net: ti: icssg-prueth: Add ICSSG FW Stats") +Signed-off-by: Philippe Schenker +Reviewed-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +Cc: danishanwar@ti.com +Cc: rogerq@kernel.org +Cc: linux-arm-kernel@lists.infradead.org +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260618093037.3448858-1-dev@pschenker.ch +Signed-off-by: Jakub Kicinski +--- + drivers/net/ethernet/ti/icssg/icssg_common.c | 49 +++++++++++++++------------ + 1 file changed, 28 insertions(+), 21 deletions(-) + +--- a/drivers/net/ethernet/ti/icssg/icssg_common.c ++++ b/drivers/net/ethernet/ti/icssg/icssg_common.c +@@ -1315,28 +1315,35 @@ void icssg_ndo_get_stats64(struct net_de + stats->rx_over_errors = emac_get_stat_by_name(emac, "rx_over_errors"); + stats->multicast = emac_get_stat_by_name(emac, "rx_multicast_frames"); + +- stats->rx_errors = ndev->stats.rx_errors + +- emac_get_stat_by_name(emac, "FW_RX_ERROR") + +- emac_get_stat_by_name(emac, "FW_RX_EOF_SHORT_FRMERR") + +- emac_get_stat_by_name(emac, "FW_RX_B0_DROP_EARLY_EOF") + +- emac_get_stat_by_name(emac, "FW_RX_EXP_FRAG_Q_DROP") + +- emac_get_stat_by_name(emac, "FW_RX_FIFO_OVERRUN"); +- stats->rx_dropped = ndev->stats.rx_dropped + +- emac_get_stat_by_name(emac, "FW_DROPPED_PKT") + +- emac_get_stat_by_name(emac, "FW_INF_PORT_DISABLED") + +- emac_get_stat_by_name(emac, "FW_INF_SAV") + +- emac_get_stat_by_name(emac, "FW_INF_SA_DL") + +- emac_get_stat_by_name(emac, "FW_INF_PORT_BLOCKED") + +- emac_get_stat_by_name(emac, "FW_INF_DROP_TAGGED") + +- emac_get_stat_by_name(emac, "FW_INF_DROP_PRIOTAGGED") + +- emac_get_stat_by_name(emac, "FW_INF_DROP_NOTAG") + +- emac_get_stat_by_name(emac, "FW_INF_DROP_NOTMEMBER"); ++ stats->rx_errors = ndev->stats.rx_errors; ++ stats->rx_dropped = ndev->stats.rx_dropped; + stats->tx_errors = ndev->stats.tx_errors; +- stats->tx_dropped = ndev->stats.tx_dropped + +- emac_get_stat_by_name(emac, "FW_RTU_PKT_DROP") + +- emac_get_stat_by_name(emac, "FW_TX_DROPPED_PACKET") + +- emac_get_stat_by_name(emac, "FW_TX_TS_DROPPED_PACKET") + +- emac_get_stat_by_name(emac, "FW_TX_JUMBO_FRM_CUTOFF"); ++ stats->tx_dropped = ndev->stats.tx_dropped; ++ ++ if (!emac->prueth->pa_stats) ++ return; ++ ++ stats->rx_errors += ++ emac_get_stat_by_name(emac, "FW_RX_ERROR") + ++ emac_get_stat_by_name(emac, "FW_RX_EOF_SHORT_FRMERR") + ++ emac_get_stat_by_name(emac, "FW_RX_B0_DROP_EARLY_EOF") + ++ emac_get_stat_by_name(emac, "FW_RX_EXP_FRAG_Q_DROP") + ++ emac_get_stat_by_name(emac, "FW_RX_FIFO_OVERRUN"); ++ stats->rx_dropped += ++ emac_get_stat_by_name(emac, "FW_DROPPED_PKT") + ++ emac_get_stat_by_name(emac, "FW_INF_PORT_DISABLED") + ++ emac_get_stat_by_name(emac, "FW_INF_SAV") + ++ emac_get_stat_by_name(emac, "FW_INF_SA_DL") + ++ emac_get_stat_by_name(emac, "FW_INF_PORT_BLOCKED") + ++ emac_get_stat_by_name(emac, "FW_INF_DROP_TAGGED") + ++ emac_get_stat_by_name(emac, "FW_INF_DROP_PRIOTAGGED") + ++ emac_get_stat_by_name(emac, "FW_INF_DROP_NOTAG") + ++ emac_get_stat_by_name(emac, "FW_INF_DROP_NOTMEMBER"); ++ stats->tx_dropped += ++ emac_get_stat_by_name(emac, "FW_RTU_PKT_DROP") + ++ emac_get_stat_by_name(emac, "FW_TX_DROPPED_PACKET") + ++ emac_get_stat_by_name(emac, "FW_TX_TS_DROPPED_PACKET") + ++ emac_get_stat_by_name(emac, "FW_TX_JUMBO_FRM_CUTOFF"); + } + EXPORT_SYMBOL_GPL(icssg_ndo_get_stats64); + diff --git a/queue-6.18/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.18/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..c29418fafc --- /dev/null +++ b/queue-6.18/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,54 @@ +From f00a50876d2818bd6dc86fa98b3ef360884c53c8 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:39 +0800 +Subject: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit f00a50876d2818bd6dc86fa98b3ef360884c53c8 upstream. + +ip6gre_changelink() and ip6erspan_changelink() operate on at most two +netns, dev_net(dev) and the tunnel link netns t->net. They differ once +the device is created in or moved to a netns other than the one the +request runs in. The rtnl changelink path checks CAP_NET_ADMIN only +against dev_net(dev), so a caller privileged there but not in t->net can +rewrite a tunnel that lives in t->net. + +Gate both ops on rtnl_dev_link_net_capable() at their top, before any +attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 690afc165bb3 ("net: ip6_gre: fix moving ip6gre between namespaces") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-6-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_gre.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -2046,6 +2046,9 @@ static int ip6gre_changelink(struct net_ + struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id); + struct __ip6_tnl_parm p; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + t = ip6gre_changelink_common(dev, tb, data, &p, extack); + if (IS_ERR(t)) + return PTR_ERR(t); +@@ -2265,6 +2268,9 @@ static int ip6erspan_changelink(struct n + struct __ip6_tnl_parm p; + struct ip6gre_net *ign; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + ign = net_generic(t->net, ip6gre_net_id); + t = ip6gre_changelink_common(dev, tb, data, &p, extack); + if (IS_ERR(t)) diff --git a/queue-6.18/net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.18/net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..2e0d930da9 --- /dev/null +++ b/queue-6.18/net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From 2496fa0b7d180b3ad356b514e7ff93bb14e6140a Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:38 +0800 +Subject: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 2496fa0b7d180b3ad356b514e7ff93bb14e6140a upstream. + +ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate ip6_tnl_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 0bd8762824e7 ("ip6tnl: add x-netns support") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-5-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_tunnel.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -2068,6 +2068,9 @@ static int ip6_tnl_changelink(struct net + struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id); + struct ip_tunnel_encap ipencap; + ++ if (!rtnl_dev_link_net_capable(dev, net)) ++ return -EPERM; ++ + if (dev == ip6n->fb_tnl_dev) { + if (ip_tunnel_netlink_encap_parms(data, &ipencap)) { + /* iproute2 always sets TUNNEL_ENCAP_FLAG_CSUM6, so diff --git a/queue-6.18/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.18/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..6f819b7d4f --- /dev/null +++ b/queue-6.18/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From e2ac3b242c37dff323a964962e43854f4b1a2b79 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:40 +0800 +Subject: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit e2ac3b242c37dff323a964962e43854f4b1a2b79 upstream. + +vti6_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 61220ab34948 ("vti6: Enable namespace changing") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-7-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_vti.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -1046,6 +1046,9 @@ static int vti6_changelink(struct net_de + struct __ip6_tnl_parm p; + struct vti6_net *ip6n; + ++ if (!rtnl_dev_link_net_capable(dev, net)) ++ return -EPERM; ++ + ip6n = net_generic(net, vti6_net_id); + if (dev == ip6n->fb_tnl_dev) + return -EINVAL; diff --git a/queue-6.18/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.18/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..d2dfe8f954 --- /dev/null +++ b/queue-6.18/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From 95cceadbfd52d7239bd730afdda0655287d77425 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:37 +0800 +Subject: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 95cceadbfd52d7239bd730afdda0655287d77425 upstream. + +vti_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate vti_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 895de9a3488a ("vti4: Enable namespace changing") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-4-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_vti.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -596,6 +596,9 @@ static int vti_changelink(struct net_dev + struct ip_tunnel_parm_kern p; + __u32 fwmark = t->fwmark; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + vti_netlink_parms(data, &p, &fwmark); + return ip_tunnel_changelink(dev, tb, &p, fwmark); + } diff --git a/queue-6.18/net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.18/net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..04a9b202ef --- /dev/null +++ b/queue-6.18/net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From 8211a26324667980a463c069469a818e71207e02 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:36 +0800 +Subject: net: ipip: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 8211a26324667980a463c069469a818e71207e02 upstream. + +ipip_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 6c742e714d8c ("ipip: add x-netns support") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-3-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ipip.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/ipip.c ++++ b/net/ipv4/ipip.c +@@ -469,6 +469,9 @@ static int ipip_changelink(struct net_de + bool collect_md; + __u32 fwmark = t->fwmark; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + if (ip_tunnel_netlink_encap_parms(data, &ipencap)) { + int err = ip_tunnel_encap_setup(t, &ipencap); + diff --git a/queue-6.18/net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch b/queue-6.18/net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch new file mode 100644 index 0000000000..76873eccc4 --- /dev/null +++ b/queue-6.18/net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch @@ -0,0 +1,54 @@ +From db818b0e8af7bac16860116a19c341a63d6677b4 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Mon, 22 Jun 2026 12:30:15 +0800 +Subject: net: ixp4xx_hss: fix duplicate HDLC netdev allocation + +From: Haoxiang Li + +commit db818b0e8af7bac16860116a19c341a63d6677b4 upstream. + +ixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored +in ndev, initialized, and registered with register_hdlc_device(). The +second one is stored in port->netdev and later used by the remove path +for unregister_hdlc_device() and free_netdev(). + +This means that the registered netdev is not the same object that is +unregistered and freed on remove. It also leaks the first allocation if +the second alloc_hdlcdev() call fails, and the first allocation is not +checked before ndev is used. + +Older code allocated the HDLC netdev only once and stored the same object +in both the local variable and port->netdev. The buggy conversion split +this into two alloc_hdlcdev() calls. A later rename changed the local +variable name to ndev, but the underlying mismatch remained. + +Fix this by allocating the HDLC netdev only once and assigning the same +object to port->netdev. + +Fixes: 99ebe65eb9c0 ("net: ixp4xx_hss: move out assignment in if condition") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Linus Walleij +Link: https://patch.msgid.link/20260622043015.643637-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wan/ixp4xx_hss.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wan/ixp4xx_hss.c ++++ b/drivers/net/wan/ixp4xx_hss.c +@@ -1487,11 +1487,11 @@ static int ixp4xx_hss_probe(struct platf + "unable to get CLK internal GPIO\n"); + + ndev = alloc_hdlcdev(port); +- port->netdev = alloc_hdlcdev(port); +- if (!port->netdev) { ++ if (!ndev) { + err = -ENOMEM; + goto err_plat; + } ++ port->netdev = ndev; + + SET_NETDEV_DEV(ndev, &pdev->dev); + hdlc = dev_to_hdlc(ndev); diff --git a/queue-6.18/net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation.patch b/queue-6.18/net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation.patch new file mode 100644 index 0000000000..4646b16e98 --- /dev/null +++ b/queue-6.18/net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation.patch @@ -0,0 +1,64 @@ +From 9092e15defbe6c7bc241c306093ca9d358a578e7 Mon Sep 17 00:00:00 2001 +From: Zihan Xi +Date: Sun, 14 Jun 2026 01:42:39 +0800 +Subject: net/sched: act_ct: preserve tc_skb_cb across defragmentation + +From: Zihan Xi + +commit 9092e15defbe6c7bc241c306093ca9d358a578e7 upstream. + +tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving +and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases +the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through +act_ct therefore loses qdisc metadata such as pkt_segs and can trigger +WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled. + +Save and restore the full tc_skb_cb around nf_ct_handle_fragments(), +matching the pattern used by ovs_ct_handle_fragments(). + +Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Signed-off-by: Zihan Xi +Signed-off-by: Ren Wei +Link: https://patch.msgid.link/510c51217fd7aaf29c6dc298bab8d643fe229b1c.1781358692.git.xizh2024@lzu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/act_ct.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/sched/act_ct.c ++++ b/net/sched/act_ct.c +@@ -842,11 +842,11 @@ static int tcf_ct_handle_fragments(struc + u8 family, u16 zone, bool *defrag) + { + enum ip_conntrack_info ctinfo; ++ struct tc_skb_cb cb; + struct nf_conn *ct; + int err = 0; + bool frag; + u8 proto; +- u16 mru; + + /* Previously seen (loopback)? Ignore. */ + ct = nf_ct_get(skb, &ctinfo); +@@ -860,12 +860,13 @@ static int tcf_ct_handle_fragments(struc + if (err || !frag) + return err; + +- err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &mru); ++ cb = *tc_skb_cb(skb); ++ err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &cb.mru); + if (err) + return err; + + *defrag = true; +- tc_skb_cb(skb)->mru = mru; ++ *tc_skb_cb(skb) = cb; + + return 0; + } diff --git a/queue-6.18/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.18/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..9eaa9f60bc --- /dev/null +++ b/queue-6.18/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,46 @@ +From 27ccb68e7cccead5d8c611665a45d23032d468b3 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 18 Jun 2026 15:08:17 +0800 +Subject: net: sit: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 27ccb68e7cccead5d8c611665a45d23032d468b3 upstream. + +ipip6_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. sit was the one tunnel type not covered +by the recent series that added this check to the other changelink() +handlers. + +Fixes: 5e6700b3bf98 ("sit: add support of x-netns") +Link: https://lore.kernel.org/netdev/20260612085941.3158249-1-maoyixie.tju@gmail.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Nicolas Dichtel +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260618070817.3378283-1-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/sit.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1610,6 +1610,9 @@ static int ipip6_changelink(struct net_d + __u32 fwmark = t->fwmark; + int err; + ++ if (!rtnl_dev_link_net_capable(dev, net)) ++ return -EPERM; ++ + if (dev == sitn->fb_tunnel_dev) + return -EINVAL; + diff --git a/queue-6.18/net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch b/queue-6.18/net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch new file mode 100644 index 0000000000..dc42b4f0a8 --- /dev/null +++ b/queue-6.18/net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch @@ -0,0 +1,40 @@ +From 2bd6f26d4ce1e87de4d736b1e8896daf3acf1c0e Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Sun, 21 Jun 2026 11:17:14 +0800 +Subject: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure + +From: Haoxiang Li + +commit 2bd6f26d4ce1e87de4d736b1e8896daf3acf1c0e upstream. + +t7xx_cldma_late_init() creates md_ctrl->gpd_dmapool before +initializing the TX and RX rings. If any ring initialization +fails, the error path frees the already initialized rings but +leaves the DMA pool allocated. + +Destroy md_ctrl->gpd_dmapool on the late-init failure path +to avoid leaking the DMA pool. + +Fixes: 39d439047f1d ("net: wwan: t7xx: Add control DMA interface") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Loic Poulain +Link: https://patch.msgid.link/20260621031714.3605022-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wwan/t7xx/t7xx_hif_cldma.c ++++ b/drivers/net/wwan/t7xx/t7xx_hif_cldma.c +@@ -1066,6 +1066,9 @@ err_free_tx_ring: + while (i--) + t7xx_cldma_ring_free(md_ctrl, &md_ctrl->tx_ring[i], DMA_TO_DEVICE); + ++ dma_pool_destroy(md_ctrl->gpd_dmapool); ++ md_ctrl->gpd_dmapool = NULL; ++ + return ret; + } + diff --git a/queue-6.18/octeontx2-af-free-bpid-bitmap-on-setup-failure.patch b/queue-6.18/octeontx2-af-free-bpid-bitmap-on-setup-failure.patch new file mode 100644 index 0000000000..cf8a4a7f62 --- /dev/null +++ b/queue-6.18/octeontx2-af-free-bpid-bitmap-on-setup-failure.patch @@ -0,0 +1,55 @@ +From 36323f54cd323122a1be89ab2c316a6e55a94e30 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Tue, 23 Jun 2026 19:43:16 +0800 +Subject: octeontx2-af: Free BPID bitmap on setup failure + +From: Haoxiang Li + +commit 36323f54cd323122a1be89ab2c316a6e55a94e30 upstream. + +nix_setup_bpids() allocates bp->bpids with rvu_alloc_bitmap(), which uses +a plain kcalloc(). If any of the following devm_kcalloc() allocations for +the BPID mapping arrays fails, the function returns without freeing the +bitmap. Free the BPID bitmap before returning from those error paths. + +Fixes: d6212d2e41a0 ("octeontx2-af: Create BPIDs free pool") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260623114316.2182271-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -527,19 +527,24 @@ static int nix_setup_bpids(struct rvu *r + bp->fn_map = devm_kcalloc(rvu->dev, bp->bpids.max, + sizeof(u16), GFP_KERNEL); + if (!bp->fn_map) +- return -ENOMEM; ++ goto free_bpids; + + bp->intf_map = devm_kcalloc(rvu->dev, bp->bpids.max, + sizeof(u8), GFP_KERNEL); + if (!bp->intf_map) +- return -ENOMEM; ++ goto free_bpids; + + bp->ref_cnt = devm_kcalloc(rvu->dev, bp->bpids.max, + sizeof(u8), GFP_KERNEL); + if (!bp->ref_cnt) +- return -ENOMEM; ++ goto free_bpids; + + return 0; ++ ++free_bpids: ++ rvu_free_bitmap(&bp->bpids); ++ bp->bpids.bmap = NULL; ++ return -ENOMEM; + } + + void rvu_nix_flr_free_bpids(struct rvu *rvu, u16 pcifunc) diff --git a/queue-6.18/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch b/queue-6.18/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch new file mode 100644 index 0000000000..fe66b4ff14 --- /dev/null +++ b/queue-6.18/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch @@ -0,0 +1,53 @@ +From 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f Mon Sep 17 00:00:00 2001 +From: Zhan Xusheng +Date: Tue, 16 Jun 2026 19:20:17 +0800 +Subject: posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() + +From: Zhan Xusheng + +commit 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f upstream. + +update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with + + u64 nsecs = rlim_new * NSEC_PER_SEC; + +On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC +(1000000000L) are 32-bit, so the multiplication is performed in unsigned +long and truncated for rlim_new > 4 seconds before being widened to u64. + +The same file already casts to u64 for the matching computation in +check_process_timers(): + + u64 softns = (u64)soft * NSEC_PER_SEC; + +As a result, the truncated value is installed into the CPUCLOCK_PROF +expiry cache (nextevt), causing the process CPU timer to be programmed +to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The +actual SIGXCPU/SIGKILL decision in check_process_timers() already casts +to u64 and is therefore correct, so limit enforcement is not broken; +only the expiry-cache programming is wrong. Apply the same cast here so +both paths convert rlim_cur identically. + +64-bit kernels are unaffected. + +Fixes: 858cf3a8c599 ("timers/itimer: Convert internal cputime_t units to nsec") +Signed-off-by: Zhan Xusheng +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/posix-cpu-timers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -41,7 +41,7 @@ void posix_cputimers_group_init(struct p + */ + int update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new) + { +- u64 nsecs = rlim_new * NSEC_PER_SEC; ++ u64 nsecs = (u64)rlim_new * NSEC_PER_SEC; + unsigned long irq_fl; + + if (!lock_task_sighand(task, &irq_fl)) diff --git a/queue-6.18/selftests-ftrace-drop-invalid-top-level-local-in-test_ownership.patch b/queue-6.18/selftests-ftrace-drop-invalid-top-level-local-in-test_ownership.patch new file mode 100644 index 0000000000..8256a5142b --- /dev/null +++ b/queue-6.18/selftests-ftrace-drop-invalid-top-level-local-in-test_ownership.patch @@ -0,0 +1,42 @@ +From 808c447df2fe234eb7d9e08ecf53159d291c104c Mon Sep 17 00:00:00 2001 +From: Cao Ruichuang +Date: Tue, 7 Apr 2026 18:26:13 +0800 +Subject: selftests/ftrace: Drop invalid top-level local in test_ownership + +From: Cao Ruichuang + +commit 808c447df2fe234eb7d9e08ecf53159d291c104c upstream. + +test_ownership.tc is sourced by ftracetest under /bin/sh. + +The script currently declares mount_point with local at file scope, +which makes /bin/sh abort with "local: not in a function" before the +test can reach the eventfs ownership checks. + +Replace the top-level local declaration with a normal shell variable so +kernels that support the gid= tracefs mount option can run the test at +all. + +Link: https://lore.kernel.org/r/20260407102613.81419-1-create0818@163.com +Fixes: 8b55572e51805 ("tracing/selftests: Add tracefs mount options test") +Signed-off-by: Cao Ruichuang +Reviewed-by: Steven Rostedt (Google) +Acked-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc ++++ b/tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc +@@ -6,7 +6,7 @@ + original_group=`stat -c "%g" .` + original_owner=`stat -c "%u" .` + +-local mount_point=$(get_mount_point) ++mount_point=$(get_mount_point) + + mount_options=$(get_mnt_options "$mount_point") + diff --git a/queue-6.18/selftests-net-fix-file-owner-for-broadcast_ether_dst-test.patch b/queue-6.18/selftests-net-fix-file-owner-for-broadcast_ether_dst-test.patch new file mode 100644 index 0000000000..e67c2b20b8 --- /dev/null +++ b/queue-6.18/selftests-net-fix-file-owner-for-broadcast_ether_dst-test.patch @@ -0,0 +1,38 @@ +From b8613e9792002add3bf77122868cc06ce142e953 Mon Sep 17 00:00:00 2001 +From: Ross Porter +Date: Wed, 17 Jun 2026 18:10:39 +1200 +Subject: selftests: net: fix file owner for broadcast_ether_dst test + +From: Ross Porter + +commit b8613e9792002add3bf77122868cc06ce142e953 upstream. + +Ensure the output file is always owned by root (even if tcpdump was +compiled with `--with-user`), by passing the `-Z root` argument when +invoking it. + +Cc: stable@vger.kernel.org +Reported-by: Edoardo Canepa +Closes: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2129815 +Fixes: bf59028ea8d4 ("selftests: net: add test for destination in broadcast packets") +Suggested-by: Edoardo Canepa +Tested-by: Ross Porter +Signed-off-by: Ross Porter +Link: https://patch.msgid.link/20260617061039.79717-2-ross.porter@canonical.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/broadcast_ether_dst.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/net/broadcast_ether_dst.sh ++++ b/tools/testing/selftests/net/broadcast_ether_dst.sh +@@ -44,7 +44,7 @@ test_broadcast_ether_dst() { + # tcpdump will exit after receiving a single packet + # timeout will kill tcpdump if it is still running after 2s + timeout 2s ip netns exec "${CLIENT_NS}" \ +- tcpdump -i link0 -c 1 -w "${CAPFILE}" icmp &> "${OUTPUT}" & ++ tcpdump -i link0 -c 1 -w "${CAPFILE}" -Z root icmp &> "${OUTPUT}" & + pid=$! + slowwait 1 grep -qs "listening" "${OUTPUT}" + diff --git a/queue-6.18/series b/queue-6.18/series index 74b8ad28e0..f792f239ce 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -1389,3 +1389,32 @@ input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch net-mlx5e-macsec-fix-use-after-free-of-metadata_dst-on-rx-sc-delete.patch tracing-user_events-fix-use-after-free-in-user_event_mm_dup.patch wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch +locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch +posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch +selftests-ftrace-drop-invalid-top-level-local-in-test_ownership.patch +cpu-hotplug-preserve-per-instance-callback-errors.patch +cpu-hotplug-bound-hotplug-states-sysfs-output.patch +gpio-mt7621-more-robust-management-of-irq-domain-teardown.patch +gpio-tegra-do-not-call-pinctrl-for-gpio-direction.patch +gpio-mt7621-be-sure-irq-domain-is-created-before-exposing-gpio-chips.patch +gpio-f7188x-add-support-for-nct6126d-version-b.patch +gpio-mt7621-avoid-corruption-of-shared-interrupt-trigger-state.patch +gpios-palmas-add-.get_direction-op.patch +net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ethernet-ti-icssg-guard-pa-stat-lookups.patch +net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch +net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch +net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation.patch +selftests-net-fix-file-owner-for-broadcast_ether_dst-test.patch +net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch +net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch +octeontx2-af-free-bpid-bitmap-on-setup-failure.patch +ieee802154-admin-gate-legacy-llsec-dump-operations.patch +ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch +ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch +ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch +gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch