From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:20:01 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=378b120b2817cede13cf9812a6f948b583eaa710;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch drbd-reject-data-replies-with-an-out-of-range-payload-size.patch ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch mac802154-remove-interfaces-with-rcu-list-deletion.patch riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch s390-monwriter-reject-buffer-reuse-with-different-data-length.patch --- diff --git a/queue-5.15/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch b/queue-5.15/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch new file mode 100644 index 0000000000..adb2f127fc --- /dev/null +++ b/queue-5.15/cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch @@ -0,0 +1,76 @@ +From b983c56426383e4a06fa5970c4e33cee879b1482 Mon Sep 17 00:00:00 2001 +From: Farhad Alemi +Date: Mon, 6 Jul 2026 10:20:23 +0200 +Subject: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Farhad Alemi + +commit b983c56426383e4a06fa5970c4e33cee879b1482 upstream. + +Creating a child cpuset where cpuset.mems is never set leads to a div/0 +when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a +CPU hotplug event. + +Reproduction steps: + 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) + 2) Move the task into the child cpuset + 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES + 4) unplug and hotplug a cpu + echo 0 > /sys/devices/system/cpu/cpu1/online + echo 1 > /sys/devices/system/cpu/cpu1/online + 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the + call to __nodes_fold() + +The cpuset code passes (cs->mems_allowed) which is not guaranteed to have +nodes to the rebind routine. Use cs->effective_mems instead, which is +guaranteed to have a non-empty nodemask once we reach that code path. + +Link: https://lore.kernel.org/all/CA+0ovCiEz6SP_sn3kN4Tb+_oC=eHMXy_Ffj=usV3wREdQrUtww@mail.gmail.com/ +Fixes: ae1c802382f7 ("cpuset: apply cs->effective_{cpus,mems}") +Closes: https://lore.kernel.org/linux-mm/CA+0ovCgxbZkXa+OU8w3s84R3KNPNxxRfmsNR-udh+afQBbGNmw@mail.gmail.com/ +Suggested-by: Gregory Price +Suggested-by: Waiman Long +Acked-by: Waiman Long +Signed-off-by: Farhad Alemi +Cc: Andrew Morton +Cc: Alistair Popple +Cc: Byungchul Park +Cc: Gregory Price +Cc: "Huang, Ying" +Cc: Joshua Hahn +Cc: Matthew Brost +Cc: Rakie Kim +Cc: Rasmus Villemoes +Cc: Zi Yan +Cc: Tejun Heo +Cc: Ridong Chen +Cc: Johannes Weiner +Cc: "Michal Koutný" +Cc: +[ david: add a comment, slightly rephrase description ] +Signed-off-by: David Hildenbrand (Arm) +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cgroup/cpuset.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -1805,7 +1805,12 @@ static void update_tasks_nodemask(struct + + migrate = is_memory_migrate(cs); + +- mpol_rebind_mm(mm, &cs->mems_allowed); ++ /* ++ * For v1 we can have empty effective_mems, but we cannot ++ * attach any tasks (see cpuset_can_attach_check()). For v2, ++ * effective_mems is guaranteed to not be empty. ++ */ ++ mpol_rebind_mm(mm, &cs->effective_mems); + if (migrate) + cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems); + else diff --git a/queue-5.15/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch b/queue-5.15/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch new file mode 100644 index 0000000000..1d39271b1e --- /dev/null +++ b/queue-5.15/drbd-reject-data-replies-with-an-out-of-range-payload-size.patch @@ -0,0 +1,63 @@ +From bd910a7660d280595ef94cb6d193951d855d330f Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Thu, 9 Jul 2026 22:28:37 -0400 +Subject: drbd: reject data replies with an out-of-range payload size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Bommarito + +commit bd910a7660d280595ef94cb6d193951d855d330f upstream. + +recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an +outstanding read request. The peer-supplied payload length reaches it as +the signed int data_size, and two peer-controlled inputs can make it +negative. With a negotiated data-integrity-alg the digest length is +subtracted first, so a reply whose payload is smaller than the digest +underflows data_size. With no integrity algorithm (the default) data_size +is assigned from the unsigned h95/h100 wire length and drbdd() never +bounds it for a payload-carrying command, so a length above INT_MAX casts +it negative; this path needs no non-default feature. The bio receive loop +then computes expect = min_t(int, data_size, bv_len), which is negative, +and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX +into the first mapped page. + +The sibling receive path read_in_block() is not affected: it uses an +unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving. +Reject a data reply whose size is negative after the optional digest +subtraction, covering both triggers. + +Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen +bytes past a bio page in the receiver, corrupting kernel memory. A node +that reads from its peer (a diskless node, or read-balancing to the peer) +is exposed in the default configuration; data-integrity-alg is not +required. + +Fixes: b411b3637fa7 ("The DRBD driver") +Cc: stable@vger.kernel.org +Assisted-by: Codex:gpt-5-5-xhigh +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Michael Bommarito +Reviewed-by: Christoph Böhmwalder +Link: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/drbd/drbd_receiver.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -2025,6 +2025,11 @@ static int recv_dless_read(struct drbd_p + data_size -= digest_size; + } + ++ if (data_size < 0) { ++ drbd_err(peer_device, "Invalid data reply size\n"); ++ return -EIO; ++ } ++ + /* optimistically update recv_cnt. if receiving fails below, + * we disconnect anyways, and counters will be reset. */ + peer_device->device->recv_cnt += data_size>>9; diff --git a/queue-5.15/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch b/queue-5.15/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch new file mode 100644 index 0000000000..280f2abea9 --- /dev/null +++ b/queue-5.15/ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch @@ -0,0 +1,65 @@ +From 2975324d164c552b028632f107b567302863b7f6 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Thu, 2 Jul 2026 19:28:36 +0800 +Subject: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new + +From: Yizhou Zhao + +commit 2975324d164c552b028632f107b567302863b7f6 upstream. + +Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in +ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn +object with kmem_cache_alloc(). The function then initializes many +fields explicitly, but only resets in_seq.delta and out_seq.delta in the +two struct ip_vs_seq members. + +That leaves init_seq and previous_delta uninitialized. This is normally +harmless while the corresponding IP_VS_CONN_F_IN_SEQ or +IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync +message, however, ip_vs_proc_conn() preserves those flags from +IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits +IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with +SEQ flags set but with the rest of in_seq/out_seq still containing stale +slab data. + +When a packet for such a connection is later handled by an IPVS +application helper, vs_fix_seq() and vs_fix_ack_seq() use +previous_delta and init_seq to rewrite TCP sequence numbers. A malformed +sync message can therefore make forwarded packets carry stale slab bytes +in their TCP seq/ack numbers, and can also corrupt the forwarded TCP +flow. + +Reset both struct ip_vs_seq members completely before publishing the +connection. This matches the existing "reset struct ip_vs_seq" comment +and keeps the sequence-adjustment gates inactive unless valid sequence +data is installed later. + +Fixes: 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") +Cc: stable@vger.kernel.org +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude-Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_conn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -996,8 +996,8 @@ ip_vs_conn_new(const struct ip_vs_conn_p + cp->app = NULL; + cp->app_data = NULL; + /* reset struct ip_vs_seq */ +- cp->in_seq.delta = 0; +- cp->out_seq.delta = 0; ++ memset(&cp->in_seq, 0, sizeof(cp->in_seq)); ++ memset(&cp->out_seq, 0, sizeof(cp->out_seq)); + + atomic_inc(&ipvs->conn_count); + if (flags & IP_VS_CONN_F_NO_CPORT) diff --git a/queue-5.15/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch b/queue-5.15/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch new file mode 100644 index 0000000000..34d78753c1 --- /dev/null +++ b/queue-5.15/ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch @@ -0,0 +1,83 @@ +From 2f75c0faa3361b28e36cc0512b3299e163e25789 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Mon, 6 Jul 2026 18:16:24 +0800 +Subject: ipvs: use parsed transport offset in SCTP state lookup + +From: Yizhou Zhao + +commit 2f75c0faa3361b28e36cc0512b3299e163e25789 upstream. + +set_sctp_state() reads the SCTP chunk header again in order to drive the +IPVS SCTP state table. For IPv6 it computes the offset with +sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from +ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped +extension headers and found the real transport header. + +This makes the state machine read from the wrong offset for IPv6 SCTP +packets that carry extension headers. For example, an INIT packet with an +8-byte destination options header can be scheduled correctly by +sctp_conn_schedule(), but set_sctp_state() reads the first byte of the +SCTP verification tag as a DATA chunk type. The connection then moves +from NONE to ESTABLISHED instead of INIT1, gets the longer established +timeout, and updates the active/inactive destination counters +incorrectly. This happens even though the SCTP handshake has not +completed. + +Use the parsed transport offset passed down from ip_vs_set_state() for +the SCTP chunk-header lookup. For IPv4 and IPv6 packets without +extension headers this preserves the existing offset. + +Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/ +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -372,20 +372,15 @@ static const char *sctp_state_name(int s + + static inline void + set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, +- int direction, const struct sk_buff *skb) ++ int direction, const struct sk_buff *skb, ++ unsigned int iph_len) + { + struct sctp_chunkhdr _sctpch, *sch; + unsigned char chunk_type; + int event, next_state; +- int ihl, cofs; +- +-#ifdef CONFIG_IP_VS_IPV6 +- ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr); +-#else +- ihl = ip_hdrlen(skb); +-#endif ++ int cofs; + +- cofs = ihl + sizeof(struct sctphdr); ++ cofs = iph_len + sizeof(struct sctphdr); + sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch); + if (sch == NULL) + return; +@@ -472,7 +467,7 @@ sctp_state_transition(struct ip_vs_conn + unsigned int iph_len) + { + spin_lock_bh(&cp->lock); +- set_sctp_state(pd, cp, direction, skb); ++ set_sctp_state(pd, cp, direction, skb, iph_len); + spin_unlock_bh(&cp->lock); + } + diff --git a/queue-5.15/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch b/queue-5.15/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch new file mode 100644 index 0000000000..be86987d5a --- /dev/null +++ b/queue-5.15/llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch @@ -0,0 +1,45 @@ +From 660667cd406648bbaffbd5c0d897c2263a852f11 Mon Sep 17 00:00:00 2001 +From: Shuangpeng Bai +Date: Tue, 30 Jun 2026 15:48:56 -0400 +Subject: llc: fix SAP refcount leak in llc_ui_autobind() + +From: Shuangpeng Bai + +commit 660667cd406648bbaffbd5c0d897c2263a852f11 upstream. + +llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. +llc_sap_open() returns a reference owned by the caller, and +llc_sap_add_socket() takes a second reference for the socket's +membership in the SAP hash tables. + +llc_ui_bind() drops the caller's reference after adding the socket, +but llc_ui_autobind() keeps it. When the socket is closed, +llc_sap_remove_socket() releases only the socket reference, leaving +the SAP on llc_sap_list with sk_count == 0. + +This is user-visible because repeated autobind and close cycles can consume +all dynamic SAP values and make later autobinds fail with -EUSERS. + +Drop the caller's reference after a successful autobind, matching +llc_ui_bind()'s ownership model. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Shuangpeng Bai +Link: https://patch.msgid.link/20260630194856.1036497-1-shuangpeng.kernel@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/af_llc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -316,6 +316,7 @@ static int llc_ui_autobind(struct socket + /* assign new connection to its SAP */ + llc_sap_add_socket(sap, sk); + sock_reset_flag(sk, SOCK_ZAPPED); ++ llc_sap_put(sap); + rc = 0; + out: + dev_put(dev); diff --git a/queue-5.15/mac802154-remove-interfaces-with-rcu-list-deletion.patch b/queue-5.15/mac802154-remove-interfaces-with-rcu-list-deletion.patch new file mode 100644 index 0000000000..4ba541c045 --- /dev/null +++ b/queue-5.15/mac802154-remove-interfaces-with-rcu-list-deletion.patch @@ -0,0 +1,43 @@ +From 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 Mon Sep 17 00:00:00 2001 +From: Yousef Alhouseen +Date: Wed, 1 Jul 2026 18:42:22 +0200 +Subject: mac802154: remove interfaces with RCU list deletion + +From: Yousef Alhouseen + +commit 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 upstream. + +Queue wake, stop, and disable paths walk local->interfaces under RCU. +The bulk hardware teardown path removes entries with list_del(), so an +asynchronous transmit completion can follow a poisoned list node in +ieee802154_wake_queue(). + +Use list_del_rcu() as in the single-interface removal path. The following +unregister_netdevice() waits for in-flight RCU readers before freeing the +netdevice, so no separate grace-period wait is needed. + +Fixes: 592dfbfc72f5 ("mac820154: move interface unregistration into iface") +Reported-by: syzbot+36256deb69a588e9290e@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=36256deb69a588e9290e +Cc: stable@vger.kernel.org +Signed-off-by: Yousef Alhouseen +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Miquel Raynal +Link: https://patch.msgid.link/20260701164222.9094-1-alhouseenyousef@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mac802154/iface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac802154/iface.c ++++ b/net/mac802154/iface.c +@@ -705,7 +705,7 @@ void ieee802154_remove_interfaces(struct + + mutex_lock(&local->iflist_mtx); + list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) { +- list_del(&sdata->list); ++ list_del_rcu(&sdata->list); + + unregister_netdevice(sdata->dev); + } diff --git a/queue-5.15/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch b/queue-5.15/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch new file mode 100644 index 0000000000..49d24d6266 --- /dev/null +++ b/queue-5.15/riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch @@ -0,0 +1,53 @@ +From 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f Mon Sep 17 00:00:00 2001 +From: Tao Liu +Date: Mon, 6 Jul 2026 11:27:07 +1200 +Subject: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() + +From: Tao Liu + +commit 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f upstream. + +A NULL pointer dereference issue is noticed in riscv's +machine_kexec_prepare(), where image->segment[i].buf might be NULL and +copied unchecked. + +The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by +kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without +a check in machine_kexec_prepare(): + + kexec_file_load + -> kimage_file_alloc_init() + -> kimage_file_prepare_segments() + -> ima_add_kexec_buffer() + -> kexec_add_buffer() + -> machine_kexec_prepare() + -> memcpy() + +Address this by adding a check before the data copy attempt. + +Fixes: b7fb4d78a6ad ("RISC-V: use memcpy for kexec_file mode") +Cc: stable@vger.kernel.org +Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/ +Acked-by: Baoquan He +Acked-by: Pratyush Yadav +Reviewed-by: Nutty Liu +Signed-off-by: Tao Liu +Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/machine_kexec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/riscv/kernel/machine_kexec.c ++++ b/arch/riscv/kernel/machine_kexec.c +@@ -67,6 +67,9 @@ machine_kexec_prepare(struct kimage *ima + if (image->segment[i].memsz <= sizeof(fdt)) + continue; + ++ if (!image->segment[i].buf) ++ continue; ++ + if (image->file_mode) + memcpy(&fdt, image->segment[i].buf, sizeof(fdt)); + else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt))) diff --git a/queue-5.15/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch b/queue-5.15/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch new file mode 100644 index 0000000000..c28d484547 --- /dev/null +++ b/queue-5.15/s390-monwriter-reject-buffer-reuse-with-different-data-length.patch @@ -0,0 +1,43 @@ +From 2995ccec260caa9e85b3301a4aba1e66ed80ad74 Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Tue, 23 Jun 2026 19:44:06 +0200 +Subject: s390/monwriter: Reject buffer reuse with different data length + +From: Gerald Schaefer + +commit 2995ccec260caa9e85b3301a4aba1e66ed80ad74 upstream. + +When data buffers are reused, e.g. for interval sample records, the +first record determines the data length, and the size of the buffer for +user copy. Current monwriter code does not check if the data length was +changed for subsequent records, which also would never happen for valid +user programs. + +However, a malicious user could change the data length, resulting in out +of bounds user copy to the kernel buffer, and memory corruption. By +default, the monwriter misc device is created with root-only permissions, +so practical impact is typically low. + +Fix this by checking for changed data length and rejecting such records. + +Cc: stable@vger.kernel.org +Signed-off-by: Gerald Schaefer +Reviewed-by: Christian Borntraeger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/char/monwriter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/char/monwriter.c ++++ b/drivers/s390/char/monwriter.c +@@ -122,6 +122,9 @@ static int monwrite_new_hdr(struct mon_p + kfree(monbuf->data); + kfree(monbuf); + monbuf = NULL; ++ } else if (monbuf->hdr.datalen != monhdr->datalen) { ++ /* Data with buffer reuse must not change its length */ ++ return -EINVAL; + } + } else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) { + if (mon_buf_count >= mon_max_bufs) diff --git a/queue-5.15/series b/queue-5.15/series index e54524b41c..863800dc9e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -702,3 +702,11 @@ tracing-probes-fix-double-addition-of-offset-for-foffset.patch orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch +s390-monwriter-reject-buffer-reuse-with-different-data-length.patch +mac802154-remove-interfaces-with-rcu-list-deletion.patch +llc-fix-sap-refcount-leak-in-llc_ui_autobind.patch +ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch +ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch +drbd-reject-data-replies-with-an-out-of-range-payload-size.patch +riscv-prevent-null-pointer-dereference-in-machine_kexec_prepare.patch +cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch