From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 12:52:05 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5862f466ef46aba5cec1bfbe6d03be599be21e03;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch batman-adv-dat-fix-tie-break-for-candidate-selection.patch batman-adv-fix-vlan-priority-offset.patch batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch batman-adv-frag-free-unfragmentable-packet.patch batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch batman-adv-tt-avoid-request-storms-during-pending-request.patch batman-adv-tt-prevent-tvlv-oob-check-overflow.patch bluetooth-sco-fix-sleeping-under-spinlock-in-sco_conn_ready.patch bluetooth-sco-hold-sk-properly-in-sco_conn_ready.patch fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch leds-uleds-fix-potential-buffer-overread.patch mfd-sm501-fix-reference-leak-on-failed-device-registration.patch mfd-tps6586x-fix-of-node-refcount.patch netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch netfilter-xt_nat-reject-unsupported-target-families.patch soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch x86-boot-reject-too-long-acpi_rsdp-values.patch x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch --- diff --git a/queue-5.15/batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch b/queue-5.15/batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch new file mode 100644 index 0000000000..10d0d87625 --- /dev/null +++ b/queue-5.15/batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch @@ -0,0 +1,37 @@ +From 7141990add3f75436f2933cb310654cad3b1e3e9 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:35:35 +0200 +Subject: batman-adv: access unicast_ttvn skb->data only after skb realloc + +From: Sven Eckelmann + +commit 7141990add3f75436f2933cb310654cad3b1e3e9 upstream. + +The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer +behind the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the ethernet header but missed for the +unicast_packet pointer. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/routing.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/routing.c ++++ b/net/batman-adv/routing.c +@@ -854,8 +854,8 @@ static bool batadv_check_unicast_ttvn(st + if (skb_cow(skb, sizeof(*unicast_packet)) < 0) + return false; + +- unicast_packet = (struct batadv_unicast_packet *)skb->data; + vid = batadv_get_vid(skb, hdr_len); ++ unicast_packet = (struct batadv_unicast_packet *)skb->data; + ethhdr = (struct ethhdr *)(skb->data + hdr_len); + + /* do not reroute multicast frames in a unicast header */ diff --git a/queue-5.15/batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch b/queue-5.15/batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch new file mode 100644 index 0000000000..cc9d394dff --- /dev/null +++ b/queue-5.15/batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch @@ -0,0 +1,31 @@ +From cdf3b5af2bc4431e58629e8ad2086b1e9185c761 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:45:41 +0200 +Subject: batman-adv: bla: reacquire gw address after skb realloc + +From: Sven Eckelmann + +commit cdf3b5af2bc4431e58629e8ad2086b1e9185c761 upstream. + +The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate +the buffer behind the skb. Variables which were pointing to the old buffer +need to be reassigned to avoid an use-after-free. + +Cc: stable@vger.kernel.org +Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/routing.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/batman-adv/routing.c ++++ b/net/batman-adv/routing.c +@@ -1034,6 +1034,7 @@ int batadv_recv_unicast_packet(struct sk + hdr_size); + batadv_orig_node_put(orig_node_gw); + if (is_gw) { ++ orig_addr_gw = eth_hdr(skb)->h_source; + batadv_dbg(BATADV_DBG_BLA, bat_priv, + "%s(): Dropped unicast pkt received from another backbone gw %pM.\n", + __func__, orig_addr_gw); diff --git a/queue-5.15/batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch b/queue-5.15/batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch new file mode 100644 index 0000000000..b60e21f46f --- /dev/null +++ b/queue-5.15/batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch @@ -0,0 +1,43 @@ +From 48067b2ae4504500a7093d9e1e16b42e70330480 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:45:41 +0200 +Subject: batman-adv: dat: acquire ARP hw source only after skb realloc + +From: Sven Eckelmann + +commit 48067b2ae4504500a7093d9e1e16b42e70330480 upstream. + +The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer +behind the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +Cc: stable@vger.kernel.org +Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -1758,6 +1758,7 @@ void batadv_dat_snoop_incoming_dhcp_ack( + struct ethhdr *ethhdr; + __be32 ip_src, yiaddr; + unsigned short vid; ++ int hdr_size_tmp; + __be16 proto; + u8 *hw_src; + +@@ -1774,8 +1775,10 @@ void batadv_dat_snoop_incoming_dhcp_ack( + if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr)) + return; + ++ hdr_size_tmp = hdr_size; ++ vid = batadv_dat_get_vid(skb, &hdr_size_tmp); ++ ethhdr = (struct ethhdr *)(skb->data + hdr_size); + hw_src = ethhdr->h_source; +- vid = batadv_dat_get_vid(skb, &hdr_size); + + batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid); + batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid); diff --git a/queue-5.15/batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch b/queue-5.15/batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch new file mode 100644 index 0000000000..88642b603f --- /dev/null +++ b/queue-5.15/batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch @@ -0,0 +1,104 @@ +From 26560c4a03dc4d607331600c187f59ab2df5f341 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 10:37:07 +0200 +Subject: batman-adv: dat: ensure accessible eth_hdr proto field + +From: Sven Eckelmann + +commit 26560c4a03dc4d607331600c187f59ab2df5f341 upstream. + +When batadv_get_vid() accesses the proto field of the ethernet header, it +is not checking if the data itself is accessible. The caller is responsible +for it. But in contrast to other call sites, batadv_dat_get_vid() and its +caller didn't make sure this is true. This could have caused an +out-of-bounds access. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 23 +++++++++++++++++++++++ + net/batman-adv/main.c | 3 +++ + 2 files changed, 26 insertions(+) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -1077,6 +1077,9 @@ out: + * @skb: the buffer containing the packet to extract the VID from + * @hdr_size: the size of the batman-adv header encapsulating the packet + * ++ * The caller must ensure that at least @hdr_size + ETH_HLEN bytes are ++ * accessible after skb->data. ++ * + * Return: If the packet embedded in the skb is vlan tagged this function + * returns the VID with the BATADV_VLAN_HAS_TAG flag. Otherwise BATADV_NO_FLAGS + * is returned. +@@ -1159,6 +1162,10 @@ bool batadv_dat_snoop_outgoing_arp_reque + if (!atomic_read(&bat_priv->distributed_arp_table)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1254,6 +1261,10 @@ bool batadv_dat_snoop_incoming_arp_reque + if (!atomic_read(&bat_priv->distributed_arp_table)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1316,6 +1327,10 @@ void batadv_dat_snoop_outgoing_arp_reply + if (!atomic_read(&bat_priv->distributed_arp_table)) + return; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ return; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1364,6 +1379,10 @@ bool batadv_dat_snoop_incoming_arp_reply + if (!atomic_read(&bat_priv->distributed_arp_table)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1818,6 +1837,10 @@ bool batadv_dat_drop_broadcast_packet(st + if (batadv_forw_packet_is_rebroadcast(forw_packet)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(forw_packet->skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(forw_packet->skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, forw_packet->skb, hdr_size); +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -618,6 +618,9 @@ __be32 batadv_skb_crc32(struct sk_buff * + * @skb: the buffer containing the packet + * @header_len: length of the batman header preceding the ethernet header + * ++ * The caller must ensure that at least @header_len + ETH_HLEN bytes are ++ * accessible after skb->data. ++ * + * Return: VID with the BATADV_VLAN_HAS_TAG flag when the packet embedded in the + * skb is vlan tagged. Otherwise BATADV_NO_FLAGS. + */ diff --git a/queue-5.15/batman-adv-dat-fix-tie-break-for-candidate-selection.patch b/queue-5.15/batman-adv-dat-fix-tie-break-for-candidate-selection.patch new file mode 100644 index 0000000000..a8bce2fda8 --- /dev/null +++ b/queue-5.15/batman-adv-dat-fix-tie-break-for-candidate-selection.patch @@ -0,0 +1,42 @@ +From 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 2 Jul 2026 19:32:40 +0200 +Subject: batman-adv: dat: fix tie-break for candidate selection + +From: Sven Eckelmann + +commit 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b upstream. + +The original version of the candidate selection for DAT attempted to +compare both candidate and max_orig_node to identify which has the smaller +MAC address. This comparison is required as tie-break when a hash collision +happened. + +But the used function returned 0 when the function was not equal and a +non-zero value when it was equal. As result, the actually selected +node was dependent on the order of entries in the orig_hash and not +actually on the mac addresses. The last originator in the hash collision +would always win. + +To have a proper ordering, it must diff the actual MAC address bytes and +reject the candidate when the diff is not smaller than 0. + +Cc: stable@vger.kernel.org +Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -546,7 +546,7 @@ static bool batadv_is_orig_node_eligible + * the one with the lowest address + */ + if (tmp_max == max && max_orig_node && +- batadv_compare_eth(candidate->orig, max_orig_node->orig)) ++ memcmp(candidate->orig, max_orig_node->orig, ETH_ALEN) >= 0) + goto out; + + ret = true; diff --git a/queue-5.15/batman-adv-fix-vlan-priority-offset.patch b/queue-5.15/batman-adv-fix-vlan-priority-offset.patch new file mode 100644 index 0000000000..061d8e65bd --- /dev/null +++ b/queue-5.15/batman-adv-fix-vlan-priority-offset.patch @@ -0,0 +1,38 @@ +From fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 2 Jul 2026 20:45:24 +0200 +Subject: batman-adv: fix VLAN priority offset + +From: Sven Eckelmann + +commit fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 upstream. + +The batadv_skb_set_priority() receives an SKB with the inner ethernet +header at position "offset". When it tries to extract the IPv4 and IPv6 +header, it needs to skip the ethernet header to get access to the IP +header. + +But for VLAN header, it performs the access with the struct vlan_ethhdr. +This struct contains both both the ethernet header and the VLAN header. It +is therefore incorrect to skip over the whole vlan_ethhdr size to get +access to the vlan_ethhdr. + +Cc: stable@vger.kernel.org +Fixes: c54f38c9aa22 ("batman-adv: set skb priority according to content") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -375,7 +375,7 @@ void batadv_skb_set_priority(struct sk_b + + switch (ethhdr->h_proto) { + case htons(ETH_P_8021Q): +- vhdr = skb_header_pointer(skb, offset + sizeof(*vhdr), ++ vhdr = skb_header_pointer(skb, offset, + sizeof(*vhdr), &vhdr_tmp); + if (!vhdr) + return; diff --git a/queue-5.15/batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch b/queue-5.15/batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch new file mode 100644 index 0000000000..e551775744 --- /dev/null +++ b/queue-5.15/batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch @@ -0,0 +1,33 @@ +From 353d2c1d5492e53ae34f490a84494124dc3d3531 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Fri, 3 Jul 2026 21:04:03 +0200 +Subject: batman-adv: frag: fix primary_if leak on failed linearization + +From: Sven Eckelmann + +commit 353d2c1d5492e53ae34f490a84494124dc3d3531 upstream. + +If the skb has a frag_list, it must be linearized before it can be split +using skb_split(). But when this step failed, it must not only free the skb +but also take care of the reference to the already found primary_if. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: a063f2fba3fa ("batman-adv: Don't skb_split skbuffs with frag_list") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/fragmentation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -551,7 +551,7 @@ int batadv_frag_send_packet(struct sk_bu + */ + if (skb_has_frag_list(skb) && __skb_linearize(skb)) { + ret = -ENOMEM; +- goto free_skb; ++ goto put_primary_if; + } + + /* Create one header to be copied to all fragments */ diff --git a/queue-5.15/batman-adv-frag-free-unfragmentable-packet.patch b/queue-5.15/batman-adv-frag-free-unfragmentable-packet.patch new file mode 100644 index 0000000000..1b18cc73eb --- /dev/null +++ b/queue-5.15/batman-adv-frag-free-unfragmentable-packet.patch @@ -0,0 +1,39 @@ +From 6b628425aed49a1c7a4ffc997583840fc582d32b Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Fri, 3 Jul 2026 20:28:31 +0200 +Subject: batman-adv: frag: free unfragmentable packet + +From: Sven Eckelmann + +commit 6b628425aed49a1c7a4ffc997583840fc582d32b upstream. + +The caller of batadv_frag_send_packet() assume that the skb provided to the +function are always consumed. But the pre-check for an empty payload or the +zero fragment size returned an error without any further actions. + +A failed pre-check must use the same error handling code as the rest of the +function. + +Cc: stable@vger.kernel.org +Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/fragmentation.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -522,8 +522,10 @@ int batadv_frag_send_packet(struct sk_bu + mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE); + max_fragment_size = mtu - header_size; + +- if (skb->len == 0 || max_fragment_size == 0) +- return -EINVAL; ++ if (skb->len == 0 || max_fragment_size == 0) { ++ ret = -EINVAL; ++ goto free_skb; ++ } + + num_fragments = (skb->len - 1) / max_fragment_size + 1; + max_fragment_size = (skb->len - 1) / num_fragments + 1; diff --git a/queue-5.15/batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch b/queue-5.15/batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch new file mode 100644 index 0000000000..2093b435ad --- /dev/null +++ b/queue-5.15/batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch @@ -0,0 +1,38 @@ +From 77880a3be88d378d60cc1e8f8ec70430e2ed0518 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:45:41 +0200 +Subject: batman-adv: gw: acquire ethernet header only after skb realloc + +From: Sven Eckelmann + +commit 77880a3be88d378d60cc1e8f8ec70430e2ed0518 upstream. + +The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer +behind the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +Cc: stable@vger.kernel.org +Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/gateway_client.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/gateway_client.c ++++ b/net/batman-adv/gateway_client.c +@@ -692,12 +692,13 @@ bool batadv_gw_out_of_range(struct batad + struct batadv_gw_node *gw_node = NULL; + struct batadv_gw_node *curr_gw = NULL; + struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo; +- struct ethhdr *ethhdr = (struct ethhdr *)skb->data; ++ struct ethhdr *ethhdr; + bool out_of_range = false; + u8 curr_tq_avg; + unsigned short vid; + + vid = batadv_get_vid(skb, 0); ++ ethhdr = (struct ethhdr *)skb->data; + + if (is_multicast_ether_addr(ethhdr->h_dest)) + goto out; diff --git a/queue-5.15/batman-adv-tt-avoid-request-storms-during-pending-request.patch b/queue-5.15/batman-adv-tt-avoid-request-storms-during-pending-request.patch new file mode 100644 index 0000000000..b35e6e7096 --- /dev/null +++ b/queue-5.15/batman-adv-tt-avoid-request-storms-during-pending-request.patch @@ -0,0 +1,40 @@ +From 27c7d40008231ae4140d35501b60087a9de2d2c3 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 2 Jul 2026 21:06:23 +0200 +Subject: batman-adv: tt: avoid request storms during pending request + +From: Sven Eckelmann + +commit 27c7d40008231ae4140d35501b60087a9de2d2c3 upstream. + +batadv_send_tt_request() allocates a tt_req_node when none exists for the +destination originator node. This should prevent that a multiple TT +requests are send at the same time to an originator. + +But if allocation of the send buffer failed, this request must be cleaned +up again. But indicator for such a failure is "ret == false". But the +actual implementation is checking for "ret == true". + +The check must be inverted to not loose the information about the TT +request directly after it was attempted to be sent out. This should avoid +potential request storms. + +Cc: stable@vger.kernel.org +Fixes: 335fbe0f5d25 ("batman-adv: tvlv - convert tt query packet to use tvlv unicast packets") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/translation-table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -3032,7 +3032,7 @@ static bool batadv_send_tt_request(struc + out: + batadv_hardif_put(primary_if); + +- if (ret && tt_req_node) { ++ if (!ret && tt_req_node) { + spin_lock_bh(&bat_priv->tt.req_list_lock); + if (!hlist_unhashed(&tt_req_node->list)) { + hlist_del_init(&tt_req_node->list); diff --git a/queue-5.15/batman-adv-tt-prevent-tvlv-oob-check-overflow.patch b/queue-5.15/batman-adv-tt-prevent-tvlv-oob-check-overflow.patch new file mode 100644 index 0000000000..df42b6b120 --- /dev/null +++ b/queue-5.15/batman-adv-tt-prevent-tvlv-oob-check-overflow.patch @@ -0,0 +1,38 @@ +From 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Fri, 3 Jul 2026 22:27:13 +0200 +Subject: batman-adv: tt: prevent TVLV OOB check overflow + +From: Sven Eckelmann + +commit 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b upstream. + +A TT unicast TVLV contains the number of VLANs stored in it. This number is +an u16 and gets multiplied by the size of the struct +batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 +used to store the tt_vlan_len. All additional safety checks to prevent +out-of-bounds access of the TVLV buffer are invalid due to this overflow. + +Using size_t prevents this overflow and ensures that the safety checks +compare against the actual buffer requirements. + +Cc: stable@vger.kernel.org +Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/translation-table.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -4101,7 +4101,8 @@ static int batadv_tt_tvlv_unicast_handle + u16 tvlv_value_len) + { + struct batadv_tvlv_tt_data *tt_data; +- u16 tt_vlan_len, tt_num_entries; ++ u16 tt_num_entries; ++ size_t tt_vlan_len; + char tt_flag; + bool ret; + diff --git a/queue-5.15/bluetooth-sco-fix-sleeping-under-spinlock-in-sco_conn_ready.patch b/queue-5.15/bluetooth-sco-fix-sleeping-under-spinlock-in-sco_conn_ready.patch new file mode 100644 index 0000000000..71432e20f9 --- /dev/null +++ b/queue-5.15/bluetooth-sco-fix-sleeping-under-spinlock-in-sco_conn_ready.patch @@ -0,0 +1,74 @@ +From b819db93d73f4593636299e229914052b89e3ef2 Mon Sep 17 00:00:00 2001 +From: Pauli Virtanen +Date: Sun, 12 Apr 2026 21:47:42 +0300 +Subject: Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready + +From: Pauli Virtanen + +commit b819db93d73f4593636299e229914052b89e3ef2 upstream. + +sco_conn_ready calls sleeping functions under conn->lock spinlock. + +The critical section can be reduced: conn->hcon is modified only with +hdev->lock held. It is guaranteed to be held in sco_conn_ready, so +conn->lock is not needed to guard it. + +Move taking conn->lock after lock_sock(parent). This also follows the +lock ordering lock_sock() > conn->lock elsewhere in the file. + +Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/sco.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -1126,26 +1126,24 @@ static void sco_conn_ready(struct sco_co + sk->sk_state_change(sk); + release_sock(sk); + } else { +- sco_conn_lock(conn); +- +- if (!conn->hcon) { +- sco_conn_unlock(conn); ++ if (!conn->hcon) + return; +- } ++ ++ lockdep_assert_held(&conn->hcon->hdev->lock); + + parent = sco_get_sock_listen(&conn->hcon->src); +- if (!parent) { +- sco_conn_unlock(conn); ++ if (!parent) + return; +- } + + lock_sock(parent); + ++ sco_conn_lock(conn); ++ + sk = sco_sock_alloc(sock_net(parent), NULL, + BTPROTO_SCO, GFP_ATOMIC, 0); + if (!sk) { +- release_sock(parent); + sco_conn_unlock(conn); ++ release_sock(parent); + return; + } + +@@ -1165,9 +1163,9 @@ static void sco_conn_ready(struct sco_co + /* Wake up parent */ + parent->sk_data_ready(parent); + +- release_sock(parent); +- + sco_conn_unlock(conn); ++ ++ release_sock(parent); + } + } + diff --git a/queue-5.15/bluetooth-sco-hold-sk-properly-in-sco_conn_ready.patch b/queue-5.15/bluetooth-sco-hold-sk-properly-in-sco_conn_ready.patch new file mode 100644 index 0000000000..791aa0efae --- /dev/null +++ b/queue-5.15/bluetooth-sco-hold-sk-properly-in-sco_conn_ready.patch @@ -0,0 +1,137 @@ +From 4e37f6452d586b95c346a9abdd2fb80b67794f39 Mon Sep 17 00:00:00 2001 +From: Pauli Virtanen +Date: Sat, 18 Apr 2026 18:41:12 +0300 +Subject: Bluetooth: SCO: hold sk properly in sco_conn_ready + +From: Pauli Virtanen + +commit 4e37f6452d586b95c346a9abdd2fb80b67794f39 upstream. + +sk deref in sco_conn_ready must be done either under conn->lock, or +holding a refcount, to avoid concurrent close. conn->sk and parent sk is +currently accessed without either, and without checking parent->sk_state: + + [Task 1] [Task 2] + sco_sock_release + sco_conn_ready + sk = conn->sk + lock_sock(sk) + conn->sk = NULL + lock_sock(sk) + release_sock(sk) + sco_sock_kill(sk) + UAF on sk deref + +and similarly for access to sco_get_sock_listen() return value. + +Fix possible UAF by holding sk refcount in sco_conn_ready() and making +sco_get_sock_listen() increase refcount. Also recheck after lock_sock +that the socket is still valid. Adjust conn->sk locking so it's +protected also by lock_sock() of the associated socket if any. + +Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/sco.c | 44 ++++++++++++++++++++++++++++++++------------ + 1 file changed, 32 insertions(+), 12 deletions(-) + +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -371,9 +371,13 @@ static struct sock *sco_get_sock_listen( + sk1 = sk; + } + ++ sk = sk ? sk : sk1; ++ if (sk) ++ sock_hold(sk); ++ + read_unlock(&sco_sk_list.lock); + +- return sk ? sk : sk1; ++ return sk; + } + + static void sco_sock_destruct(struct sock *sk) +@@ -413,11 +417,13 @@ static void sco_sock_kill(struct sock *s + BT_DBG("sk %p state %d", sk, sk->sk_state); + + /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ ++ lock_sock(sk); + if (sco_pi(sk)->conn) { + sco_conn_lock(sco_pi(sk)->conn); + sco_pi(sk)->conn->sk = NULL; + sco_conn_unlock(sco_pi(sk)->conn); + } ++ release_sock(sk); + + /* Kill poor orphan */ + bt_sock_unlink(&sco_sk_list, sk); +@@ -1114,17 +1120,28 @@ static int sco_sock_release(struct socke + + static void sco_conn_ready(struct sco_conn *conn) + { +- struct sock *parent; +- struct sock *sk = conn->sk; ++ struct sock *parent, *sk; ++ ++ sco_conn_lock(conn); ++ sk = sco_sock_hold(conn); ++ sco_conn_unlock(conn); + + BT_DBG("conn %p", conn); + + if (sk) { + lock_sock(sk); +- sco_sock_clear_timer(sk); +- sk->sk_state = BT_CONNECTED; +- sk->sk_state_change(sk); ++ ++ /* conn->sk may have become NULL if racing with sk close, but ++ * due to held hdev->lock, it can't become different sk. ++ */ ++ if (conn->sk) { ++ sco_sock_clear_timer(sk); ++ sk->sk_state = BT_CONNECTED; ++ sk->sk_state_change(sk); ++ } ++ + release_sock(sk); ++ sock_put(sk); + } else { + if (!conn->hcon) + return; +@@ -1139,13 +1156,15 @@ static void sco_conn_ready(struct sco_co + + sco_conn_lock(conn); + ++ /* hdev->lock guarantees conn->sk == NULL still here */ ++ ++ if (parent->sk_state != BT_LISTEN) ++ goto release; ++ + sk = sco_sock_alloc(sock_net(parent), NULL, + BTPROTO_SCO, GFP_ATOMIC, 0); +- if (!sk) { +- sco_conn_unlock(conn); +- release_sock(parent); +- return; +- } ++ if (!sk) ++ goto release; + + sco_sock_init(sk, parent); + +@@ -1163,9 +1182,10 @@ static void sco_conn_ready(struct sco_co + /* Wake up parent */ + parent->sk_data_ready(parent); + ++release: + sco_conn_unlock(conn); +- + release_sock(parent); ++ sock_put(parent); + } + } + diff --git a/queue-5.15/fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch b/queue-5.15/fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch new file mode 100644 index 0000000000..450dc9b589 --- /dev/null +++ b/queue-5.15/fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch @@ -0,0 +1,50 @@ +From 9d18a4e4234fd3ee0d0eed8ccbbb50cb76b2232c Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:31 +0530 +Subject: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() + +From: Abdun Nihaal + +commit 9d18a4e4234fd3ee0d0eed8ccbbb50cb76b2232c upstream. + +The memory allocated for pagerefs in fb_deferred_io_init() is not freed +on the error path. Fix it by calling fb_deferred_io_cleanup(). + +Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/broadsheetfb.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/broadsheetfb.c ++++ b/drivers/video/fbdev/broadsheetfb.c +@@ -1134,12 +1134,14 @@ static int broadsheetfb_probe(struct pla + info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB; + + info->fbdefio = &broadsheetfb_defio; +- fb_deferred_io_init(info); ++ retval = fb_deferred_io_init(info); ++ if (retval) ++ goto err_vfree; + + retval = fb_alloc_cmap(&info->cmap, 16, 0); + if (retval < 0) { + dev_err(&dev->dev, "Failed to allocate colormap\n"); +- goto err_vfree; ++ goto err_fbdefio; + } + + /* set cmap */ +@@ -1183,6 +1185,8 @@ err_free_irq: + board->cleanup(par); + err_cmap: + fb_dealloc_cmap(&info->cmap); ++err_fbdefio: ++ fb_deferred_io_cleanup(info); + err_vfree: + vfree(videomemory); + err_fb_rel: diff --git a/queue-5.15/fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch b/queue-5.15/fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch new file mode 100644 index 0000000000..f61c1f7e4c --- /dev/null +++ b/queue-5.15/fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch @@ -0,0 +1,32 @@ +From 6fcca16a2b19c37f60693c56cbc0c923364ff3ef Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:34 +0530 +Subject: fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() + +From: Abdun Nihaal + +commit 6fcca16a2b19c37f60693c56cbc0c923364ff3ef upstream. + +The memory allocated for modelist in fb_videomode_to_modelist() is not +freed in the subsequent error path. +Fix that by calling fb_destroy_modelist() + +Fixes: 2ece5f43b041 ("fbdev: add the carmine FB driver") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/carminefb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/carminefb.c ++++ b/drivers/video/fbdev/carminefb.c +@@ -592,6 +592,7 @@ static int alloc_carmine_fb(void __iomem + return 0; + + err_dealloc_cmap: ++ fb_destroy_modelist(&info->modelist); + fb_dealloc_cmap(&info->cmap); + err_free_fb: + framebuffer_release(info); diff --git a/queue-5.15/fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch b/queue-5.15/fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch new file mode 100644 index 0000000000..47f7c661f8 --- /dev/null +++ b/queue-5.15/fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch @@ -0,0 +1,44 @@ +From cbef2a305a8a72969b86f96b7c07b86edde61aff Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:30 +0530 +Subject: fbdev: hecubafb: fix potential memory leak in hecubafb_probe() + +From: Abdun Nihaal + +commit cbef2a305a8a72969b86f96b7c07b86edde61aff upstream. + +The memory allocated for pagerefs in fb_deferred_io_init() is not freed +on the error path. Fix it by calling fb_deferred_io_cleanup(). + +Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/hecubafb.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/video/fbdev/hecubafb.c ++++ b/drivers/video/fbdev/hecubafb.c +@@ -253,7 +253,9 @@ static int hecubafb_probe(struct platfor + info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB; + + info->fbdefio = &hecubafb_defio; +- fb_deferred_io_init(info); ++ retval = fb_deferred_io_init(info); ++ if (retval) ++ goto err_fbdefio; + + retval = register_framebuffer(info); + if (retval < 0) +@@ -270,6 +272,8 @@ static int hecubafb_probe(struct platfor + + return 0; + err_fbreg: ++ fb_deferred_io_cleanup(info); ++err_fbdefio: + framebuffer_release(info); + err_fballoc: + vfree(videomemory); diff --git a/queue-5.15/fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch b/queue-5.15/fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch new file mode 100644 index 0000000000..f317388a39 --- /dev/null +++ b/queue-5.15/fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch @@ -0,0 +1,32 @@ +From 5936063409af230a2c88b8700c47b89a19fd70b5 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:35 +0530 +Subject: fbdev: i740fb: fix potential memory leak in i740fb_probe() + +From: Abdun Nihaal + +commit 5936063409af230a2c88b8700c47b89a19fd70b5 upstream. + +In i740fb_probe(), the memory allocated in fb_videomode_to_modelist() +for modelist is not freed in the error paths. Fix that by calling +fb_destroy_modelist(). + +Fixes: 5350c65f4f15 ("Resurrect Intel740 driver: i740fb") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/i740fb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/i740fb.c ++++ b/drivers/video/fbdev/i740fb.c +@@ -1150,6 +1150,7 @@ err_reg_framebuffer: + fb_dealloc_cmap(&info->cmap); + err_alloc_cmap: + err_find_mode: ++ fb_destroy_modelist(&info->modelist); + if (par->ddc_registered) + i2c_del_adapter(&par->ddc_adapter); + pci_iounmap(dev, par->regs); diff --git a/queue-5.15/fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch b/queue-5.15/fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch new file mode 100644 index 0000000000..af2d3584b6 --- /dev/null +++ b/queue-5.15/fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch @@ -0,0 +1,50 @@ +From 894632b862a39b3fe1cb5de06fbae86225ea64de Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:32 +0530 +Subject: fbdev: metronomefb: fix potential memory leak in metronomefb_probe() + +From: Abdun Nihaal + +commit 894632b862a39b3fe1cb5de06fbae86225ea64de upstream. + +The memory allocated for pagerefs in fb_deferred_io_init() is not freed +on the error path. Fix it by calling fb_deferred_io_cleanup(). + +Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/metronomefb.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/metronomefb.c ++++ b/drivers/video/fbdev/metronomefb.c +@@ -703,12 +703,14 @@ static int metronomefb_probe(struct plat + info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB; + + info->fbdefio = &metronomefb_defio; +- fb_deferred_io_init(info); ++ retval = fb_deferred_io_init(info); ++ if (retval) ++ goto err_free_irq; + + retval = fb_alloc_cmap(&info->cmap, 8, 0); + if (retval < 0) { + dev_err(&dev->dev, "Failed to allocate colormap\n"); +- goto err_free_irq; ++ goto err_fbdefio; + } + + /* set cmap */ +@@ -731,6 +733,8 @@ static int metronomefb_probe(struct plat + + err_cmap: + fb_dealloc_cmap(&info->cmap); ++err_fbdefio: ++ fb_deferred_io_cleanup(info); + err_free_irq: + board->cleanup(par); + err_csum_table: diff --git a/queue-5.15/fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch b/queue-5.15/fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch new file mode 100644 index 0000000000..ee8d5ab504 --- /dev/null +++ b/queue-5.15/fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch @@ -0,0 +1,32 @@ +From 85f5e38c162bdf9dbbe197275d416402712f3707 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:36 +0530 +Subject: fbdev: nvidia: fix potential memory leak in nvidiafb_probe() + +From: Abdun Nihaal + +commit 85f5e38c162bdf9dbbe197275d416402712f3707 upstream. + +In nvidiafb_probe(), the memory allocated for modelist in +nvidia_set_fbinfo() is not freed in the subsequent error paths. +Fix that by calling fb_destroy_modelist(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/nvidia/nvidia.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/nvidia/nvidia.c ++++ b/drivers/video/fbdev/nvidia/nvidia.c +@@ -1409,6 +1409,7 @@ static int nvidiafb_probe(struct pci_dev + + err_out_iounmap_fb: + iounmap(info->screen_base); ++ fb_destroy_modelist(&info->modelist); + err_out_free_base1: + fb_destroy_modedb(info->monspecs.modedb); + nvidia_delete_i2c_busses(par); diff --git a/queue-5.15/fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch b/queue-5.15/fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch new file mode 100644 index 0000000000..d4f77c306f --- /dev/null +++ b/queue-5.15/fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch @@ -0,0 +1,33 @@ +From df8c1101c9a08859da612b5d0a08d55d475522c6 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:33 +0530 +Subject: fbdev: radeon: fix potential memory leak in radeonfb_pci_register() + +From: Abdun Nihaal + +commit df8c1101c9a08859da612b5d0a08d55d475522c6 upstream. + +The function radeonfb_pci_register() allocates memory for modelist +(by calling radeon_check_modes() which calls fb_add_videomode()). +The memory is appended to info->modelist, but is not freed in subsequent +error paths. Fix this by calling fb_destroy_modelist(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/aty/radeon_base.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/aty/radeon_base.c ++++ b/drivers/video/fbdev/aty/radeon_base.c +@@ -2492,6 +2492,7 @@ static int radeonfb_pci_register(struct + return 0; + err_unmap_fb: + iounmap(rinfo->fb_base); ++ fb_destroy_modelist(&info->modelist); + err_unmap_rom: + kfree(rinfo->mon1_EDID); + kfree(rinfo->mon2_EDID); diff --git a/queue-5.15/fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch b/queue-5.15/fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch new file mode 100644 index 0000000000..82e60192a3 --- /dev/null +++ b/queue-5.15/fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch @@ -0,0 +1,32 @@ +From 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:37 +0530 +Subject: fbdev: s3fb: fix potential memory leak in s3_pci_probe() + +From: Abdun Nihaal + +commit 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 upstream. + +In s3_pci_probe(), the memory allocated for modelist using +fb_videomode_to_modelist() is not freed in subsequent error paths. +Fix that by calling fb_destroy_modelist() + +Fixes: 86c0f043a737 ("s3fb: add DDC support") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/s3fb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/s3fb.c ++++ b/drivers/video/fbdev/s3fb.c +@@ -1366,6 +1366,7 @@ err_reg_fb: + err_alloc_cmap: + err_find_mode: + #ifdef CONFIG_FB_S3_DDC ++ fb_destroy_modelist(&info->modelist); + if (par->ddc_registered) + i2c_del_adapter(&par->ddc_adapter); + if (par->mmio) diff --git a/queue-5.15/fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch b/queue-5.15/fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch new file mode 100644 index 0000000000..504202259c --- /dev/null +++ b/queue-5.15/fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch @@ -0,0 +1,40 @@ +From 5dbe5b65df0b0c0ec77492427c274b7b5011890e Mon Sep 17 00:00:00 2001 +From: Li RongQing +Date: Thu, 14 May 2026 21:02:02 -0400 +Subject: fbdev: sm712: Fix operator precedence in big_swap macro + +From: Li RongQing + +commit 5dbe5b65df0b0c0ec77492427c274b7b5011890e upstream. + +The big_swap(p) macro was intended to swap bytes within 16-bit halves +of a 32-bit value. However, because the bitwise shift operators (<<, >>) +have higher precedence than the bitwise AND operator (&), the original +code failed to perform any shifting on the masked bits. + +For example, 'p & 0xff00ff00 >> 8' was evaluated as 'p & +(0xff00ff00 >> 8)', effectively neutralizing the intended swap. + +Fix this by adding parentheses to ensure the bitwise AND is performed +before the shift, correctly implementing the byte swap logic. + +Fixes: 1461d66728648 ("staging: sm7xxfb: merge sm712fb with fbdev") +Cc: stable@vger.kernel.org +Signed-off-by: Li RongQing +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/sm712.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/fbdev/sm712.h ++++ b/drivers/video/fbdev/sm712.h +@@ -101,7 +101,7 @@ struct modeinit { + #define mmio_addr 0x00800000 + #define seqw17() smtc_seqw(0x17, 0x30) + #define big_pixel_depth(p, d) {if (p == 24) {p = 32; d = 32; } } +-#define big_swap(p) ((p & 0xff00ff00 >> 8) | (p & 0x00ff00ff << 8)) ++#define big_swap(p) (((p & 0xff00ff00) >> 8) | ((p & 0x00ff00ff) << 8)) + #else + #define pal_rgb(r, g, b, val) val + #define big_addr 0 diff --git a/queue-5.15/fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch b/queue-5.15/fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch new file mode 100644 index 0000000000..8742ec9333 --- /dev/null +++ b/queue-5.15/fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch @@ -0,0 +1,33 @@ +From bb019d755366cc3e777a12d4bf457ff289837370 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:38 +0530 +Subject: fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() + +From: Abdun Nihaal + +commit bb019d755366cc3e777a12d4bf457ff289837370 upstream. + +In tdfxfb_probe(), the memory allocated for modelist using +fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not +freed in the subsequent error paths. +Fix that by calling fb_destroy_modelist(). + +Fixes: 215059d2421f ("tdfxfb: make use of DDC information about connected monitor") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/tdfxfb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/tdfxfb.c ++++ b/drivers/video/fbdev/tdfxfb.c +@@ -1546,6 +1546,7 @@ static int tdfxfb_probe(struct pci_dev * + + out_err_iobase: + #ifdef CONFIG_FB_3DFX_I2C ++ fb_destroy_modelist(&info->modelist); + tdfxfb_delete_i2c_busses(default_par); + #endif + arch_phys_wc_del(default_par->wc_cookie); diff --git a/queue-5.15/fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch b/queue-5.15/fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch new file mode 100644 index 0000000000..03b3e55fe9 --- /dev/null +++ b/queue-5.15/fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch @@ -0,0 +1,32 @@ +From 7a35ec619d9af8ee128320975c1252b8ad65f1e8 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:39 +0530 +Subject: fbdev: tridentfb: fix potential memory leak in trident_pci_probe() + +From: Abdun Nihaal + +commit 7a35ec619d9af8ee128320975c1252b8ad65f1e8 upstream. + +In trident_pci_probe(), the memory allocated for modelist using +fb_videomode_to_modelist() is not freed in subsequent error paths. +Fix that by calling fb_destroy_modelist(). + +Fixes: 6a5e3bd0c8bc ("tridentfb: Add DDC support") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/tridentfb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/tridentfb.c ++++ b/drivers/video/fbdev/tridentfb.c +@@ -1702,6 +1702,7 @@ static int trident_pci_probe(struct pci_ + return 0; + + out_unmap2: ++ fb_destroy_modelist(&info->modelist); + if (default_par->ddc_registered) + i2c_del_adapter(&default_par->ddc_adapter); + kfree(info->pixmap.addr); diff --git a/queue-5.15/fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch b/queue-5.15/fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch new file mode 100644 index 0000000000..0c67ebfe57 --- /dev/null +++ b/queue-5.15/fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch @@ -0,0 +1,41 @@ +From 033e56fed09047ee63072e9f58789f40c1c7079d Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:40 +0530 +Subject: fbdev: uvesafb: fix potential memory leak in uvesafb_probe() + +From: Abdun Nihaal + +commit 033e56fed09047ee63072e9f58789f40c1c7079d upstream. + +Due to an incorrect goto label, memory allocated for modedb and modelist +in uvesafb_vbe_init() is not freed in some error paths. Fix this by +updating the goto label. + +Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/uvesafb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/uvesafb.c ++++ b/drivers/video/fbdev/uvesafb.c +@@ -1700,14 +1700,14 @@ static int uvesafb_probe(struct platform + i = uvesafb_vbe_init_mode(info); + if (i < 0) { + err = -EINVAL; +- goto out; ++ goto out_mode; + } else { + mode = &par->vbe_modes[i]; + } + + if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) { + err = -ENXIO; +- goto out; ++ goto out_mode; + } + + uvesafb_init_info(info, mode); diff --git a/queue-5.15/gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch b/queue-5.15/gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch new file mode 100644 index 0000000000..fc5d0ee31c --- /dev/null +++ b/queue-5.15/gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch @@ -0,0 +1,46 @@ +From e75717f9aec04355777be41070890c6a815c76df Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Mon, 13 Apr 2026 22:15:26 +0800 +Subject: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path + +From: Guangshuo Li + +commit e75717f9aec04355777be41070890c6a815c76df upstream. + +After device_initialize(), the embedded struct device in struct +host1x_device should be released through the device core with +put_device(). + +In host1x_device_add(), if host1x_device_parse_dt() fails, the current +error path frees the object directly with kfree(device). That bypasses +the normal device lifetime handling and leaks the reference held on the +embedded struct device. + +The issue was identified by a static analysis tool I developed and +confirmed by manual review. + +Fix this by using put_device() in the host1x_device_parse_dt() failure +path. + +Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Acked-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Link: https://patch.msgid.link/20260413141526.2961841-1-lgs201920130244@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/host1x/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/host1x/bus.c ++++ b/drivers/gpu/host1x/bus.c +@@ -473,7 +473,7 @@ static int host1x_device_add(struct host + + err = host1x_device_parse_dt(device, driver); + if (err < 0) { +- kfree(device); ++ put_device(&device->dev); + return err; + } + diff --git a/queue-5.15/leds-uleds-fix-potential-buffer-overread.patch b/queue-5.15/leds-uleds-fix-potential-buffer-overread.patch new file mode 100644 index 0000000000..a95935d57b --- /dev/null +++ b/queue-5.15/leds-uleds-fix-potential-buffer-overread.patch @@ -0,0 +1,39 @@ +From c19fe864f667afc49d1391d764e20b66555bcf7a Mon Sep 17 00:00:00 2001 +From: Armin Wolf +Date: Mon, 25 May 2026 01:55:53 +0200 +Subject: leds: uleds: Fix potential buffer overread + +From: Armin Wolf + +commit c19fe864f667afc49d1391d764e20b66555bcf7a upstream. + +The name string supplied by userspace is not guaranteed to be +null-terminated, so using strchr() on it might result in a buffer +overread. The same thing will happen when said string is used by +the LED class device. + +Fix this by using strnchr() instead and explicitly check that +the name string is properly null-terminated. + +Cc: stable@vger.kernel.org +Fixes: e381322b0190 ("leds: Introduce userspace LED class driver") +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20260524235553.189134-1-W_Armin@gmx.de +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/leds/uleds.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/leds/uleds.c ++++ b/drivers/leds/uleds.c +@@ -102,7 +102,8 @@ static ssize_t uleds_write(struct file * + + name = udev->user_dev.name; + if (!name[0] || !strcmp(name, ".") || !strcmp(name, "..") || +- strchr(name, '/')) { ++ strnchr(name, sizeof(udev->user_dev.name), '/') || ++ !strnchr(name, sizeof(udev->user_dev.name), '\0')) { + ret = -EINVAL; + goto out; + } diff --git a/queue-5.15/mfd-sm501-fix-reference-leak-on-failed-device-registration.patch b/queue-5.15/mfd-sm501-fix-reference-leak-on-failed-device-registration.patch new file mode 100644 index 0000000000..95187c445c --- /dev/null +++ b/queue-5.15/mfd-sm501-fix-reference-leak-on-failed-device-registration.patch @@ -0,0 +1,52 @@ +From 8c2f0b42fc252e1bf1c7746447091a468e784ca1 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Thu, 16 Apr 2026 00:26:27 +0800 +Subject: mfd: sm501: Fix reference leak on failed device registration + +From: Guangshuo Li + +commit 8c2f0b42fc252e1bf1c7746447091a468e784ca1 upstream. + +When platform_device_register() fails in sm501_register_device(), the +embedded struct device in pdev has already been initialized by +device_initialize(), but the failure path only reports the error and +returns without dropping the device reference for the current platform +device: + + sm501_register_device() + -> platform_device_register(pdev) + -> device_initialize(&pdev->dev) + -> setup_pdev_dma_masks(pdev) + -> platform_device_add(pdev) + +This leads to a reference leak when platform_device_register() fails. +Fix this by calling platform_device_put() before returning the error. + +The issue was identified by a static analysis tool I developed and +confirmed by manual review. + +Fixes: b6d6454fdb66f ("[PATCH] mfd: SM501 core driver") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Link: https://patch.msgid.link/20260415162627.3558789-1-lgs201920130244@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/sm501.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/sm501.c ++++ b/drivers/mfd/sm501.c +@@ -747,9 +747,11 @@ static int sm501_register_device(struct + if (ret >= 0) { + dev_dbg(sm->dev, "registered %s\n", pdev->name); + list_add_tail(&smdev->list, &sm->devices); +- } else ++ } else { + dev_err(sm->dev, "error registering %s (%d)\n", + pdev->name, ret); ++ platform_device_put(pdev); ++ } + + return ret; + } diff --git a/queue-5.15/mfd-tps6586x-fix-of-node-refcount.patch b/queue-5.15/mfd-tps6586x-fix-of-node-refcount.patch new file mode 100644 index 0000000000..abb5a0f9b8 --- /dev/null +++ b/queue-5.15/mfd-tps6586x-fix-of-node-refcount.patch @@ -0,0 +1,38 @@ +From 3001ed2b4e06da2276c42ace6551617065a5b1f9 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Thu, 21 May 2026 10:36:24 +0200 +Subject: mfd: tps6586x: Fix OF node refcount + +From: Bartosz Golaszewski + +commit 3001ed2b4e06da2276c42ace6551617065a5b1f9 upstream. + +Platform devices created with platform_device_alloc() call +platform_device_release() when the last reference to the device's +kobject is dropped. This function calls of_node_put() unconditionally. +This works fine for devices created with platform_device_register_full() +but users of the split approach (platform_device_alloc() + +platform_device_add()) must bump the reference of the of_node they +assign manually. Add the missing call to of_node_get(). + +Cc: stable@vger.kernel.org +Fixes: 62f6b0879304 ("tps6586x: Add device tree support") +Signed-off-by: Bartosz Golaszewski +Link: https://patch.msgid.link/20260521-pdev-fwnode-ref-v1-1-88c324a1b8d2@oss.qualcomm.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/tps6586x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/tps6586x.c ++++ b/drivers/mfd/tps6586x.c +@@ -399,7 +399,7 @@ static int tps6586x_add_subdevs(struct t + + pdev->dev.parent = tps6586x->dev; + pdev->dev.platform_data = subdev->platform_data; +- pdev->dev.of_node = subdev->of_node; ++ pdev->dev.of_node = of_node_get(subdev->of_node); + + ret = platform_device_add(pdev); + if (ret) { diff --git a/queue-5.15/netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch b/queue-5.15/netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch new file mode 100644 index 0000000000..9a65e2da1d --- /dev/null +++ b/queue-5.15/netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch @@ -0,0 +1,78 @@ +From 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d Mon Sep 17 00:00:00 2001 +From: "Xiang Mei (Microsoft)" +Date: Wed, 8 Jul 2026 18:11:50 +0000 +Subject: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() + +From: Xiang Mei (Microsoft) + +commit 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d upstream. + +br_ip6_fragment() gets prevhdr, a pointer into the skb head, from +ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb +skb_checksum_help() reallocates the head via pskb_expand_head(), leaving +prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a +use-after-free write. + +Save prevhdr's offset before skb_checksum_help() and recompute it after, +like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 +fragment"). + + BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) + Write of size 1 at addr ffff888013ff5016 by task exploit/141 + Call Trace: + ... + kasan_report (mm/kasan/report.c:595) + ip6_frag_next (net/ipv6/ip6_output.c:857) + br_ip6_fragment (net/ipv6/netfilter.c:212) + nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) + nf_hook_slow (net/netfilter/core.c:619) + br_forward_finish (net/bridge/br_forward.c:66) + __br_forward (net/bridge/br_forward.c:115) + maybe_deliver (net/bridge/br_forward.c:191) + br_flood (net/bridge/br_forward.c:245) + br_handle_frame_finish (net/bridge/br_input.c:229) + br_handle_frame (net/bridge/br_input.c:442) + ... + packet_sendmsg (net/packet/af_packet.c:3114) + ... + do_syscall_64 (arch/x86/entry/syscall_64.c:94) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) + Kernel panic - not syncing: Fatal exception in interrupt + +Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6") +Cc: stable@vger.kernel.org +Reported-by: AutonomousCodeSecurity@microsoft.com +Signed-off-by: Xiang Mei (Microsoft) +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/netfilter.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -130,7 +130,7 @@ int br_ip6_fragment(struct net *net, str + ktime_t tstamp = skb->tstamp; + struct ip6_frag_state state; + u8 *prevhdr, nexthdr = 0; +- unsigned int mtu, hlen; ++ unsigned int mtu, hlen, nexthdr_offset; + int hroom, err = 0; + __be32 frag_id; + +@@ -139,6 +139,7 @@ int br_ip6_fragment(struct net *net, str + goto blackhole; + hlen = err; + nexthdr = *prevhdr; ++ nexthdr_offset = prevhdr - skb_network_header(skb); + + mtu = skb->dev->mtu; + if (frag_max_size > mtu || +@@ -157,6 +158,7 @@ int br_ip6_fragment(struct net *net, str + (err = skb_checksum_help(skb))) + goto blackhole; + ++ prevhdr = skb_network_header(skb) + nexthdr_offset; + hroom = LL_RESERVED_SPACE(skb->dev); + if (skb_has_frag_list(skb)) { + unsigned int first_len = skb_pagelen(skb); diff --git a/queue-5.15/netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch b/queue-5.15/netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch new file mode 100644 index 0000000000..d1c8d7bfbd --- /dev/null +++ b/queue-5.15/netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch @@ -0,0 +1,82 @@ +From f62c41b4910e65da396ec9a8c40c1fe7fe82e449 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Wed, 8 Jul 2026 13:27:28 +0800 +Subject: netfilter: nf_conncount: fix zone comparison in tuple dedup + +From: Yizhou Zhao + +commit f62c41b4910e65da396ec9a8c40c1fe7fe82e449 upstream. + +The "already exists" dedup logic in __nf_conncount_add() decides +whether a connection has already been counted and can be skipped instead +of incrementing the connlimit count. It compares the conntrack zone of a +list entry with the zone of the connection being added using +nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or +zone->dir as the direction argument. + +Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0 +and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask: +NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and +NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction +shifts the meaning of every non-zero value. An ORIG-only zone passes 1 +and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and +test bits beyond the valid direction range. In those cases +nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using +the real zone id, so different zones can be treated as equal and dedup +collapses to tuple equality alone. + +nf_conncount stores and compares the original-direction tuple for a +connection. If an skb already has an attached conntrack entry, +get_ct_or_tuple_from_skb() explicitly copies +ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's +ctinfo. Therefore the zone comparison in the tuple dedup path must use +IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a +zone id applies, not which direction this conncount tuple represents. + +Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly. +Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone +ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the +direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional +zone contains the ORIG bit, so it naturally returns the real zone id; +reply-only zones continue to fall back for original-direction tuple +comparisons. + +Fixes: 21ba8847f857 ("netfilter: nf_conncount: Fix garbage collection with zones") +Fixes: b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race") +Cc: stable@vger.kernel.org +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude-Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conncount.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/netfilter/nf_conncount.c ++++ b/net/netfilter/nf_conncount.c +@@ -207,8 +207,8 @@ check_connections: + /* Not found, but might be about to be confirmed */ + if (PTR_ERR(found) == -EAGAIN) { + if (nf_ct_tuple_equal(&conn->tuple, &tuple) && +- nf_ct_zone_id(&conn->zone, conn->zone.dir) == +- nf_ct_zone_id(zone, zone->dir)) ++ nf_ct_zone_id(&conn->zone, IP_CT_DIR_ORIGINAL) == ++ nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL)) + goto out_put; /* already exists */ + } else { + collect++; +@@ -219,7 +219,7 @@ check_connections: + found_ct = nf_ct_tuplehash_to_ctrack(found); + + if (nf_ct_tuple_equal(&conn->tuple, &tuple) && +- nf_ct_zone_equal(found_ct, zone, zone->dir)) { ++ nf_ct_zone_equal(found_ct, zone, IP_CT_DIR_ORIGINAL)) { + /* + * We should not see tuples twice unless someone hooks + * this into a table without "-p tcp --syn". diff --git a/queue-5.15/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch b/queue-5.15/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch new file mode 100644 index 0000000000..1058c48c64 --- /dev/null +++ b/queue-5.15/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch @@ -0,0 +1,61 @@ +From ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a Mon Sep 17 00:00:00 2001 +From: Muhammad Bilal +Date: Tue, 19 May 2026 17:23:28 -0400 +Subject: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read + +From: Muhammad Bilal + +commit ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a upstream. + +parse_dcc() treats data_end as an inclusive end pointer, but its only +caller passes data_limit = ib_ptr + datalen, which points one past the +last valid byte. + +The newline search loop iterates while tmp <= data_end, so when no +newline is present, *tmp is read at tmp == data_end, one byte beyond +the region filled by skb_header_pointer(). + +irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is +capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte +is uninitialized or stale; if it contains an ASCII digit, simple_strtoul +will consume it and produce a wrong DCC IP or port in the conntrack +expectation. The extra allocation byte is also a fragile guard: if the +cap or allocation size changes, this becomes a real out-of-bounds read. + +Change the loop and its post-loop check to use strict less-than, +consistent with the caller's exclusive-end convention. Update the +function comment accordingly. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Muhammad Bilal +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_irc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -63,7 +63,7 @@ static const char *const dccprotos[] = { + /* tries to get the ip_addr and port out of a dcc command + * return value: -1 on failure, 0 on success + * data pointer to first byte of DCC command data +- * data_end pointer to last byte of dcc command data ++ * data_end one past end of data + * ip returns parsed ip of dcc command + * port returns parsed port of dcc command + * ad_beg_p returns pointer to first byte of addr data +@@ -81,10 +81,10 @@ static int parse_dcc(char *data, const c + + /* Make sure we have a newline character within the packet boundaries + * because simple_strtoul parses until the first invalid character. */ +- for (tmp = data; tmp <= data_end; tmp++) ++ for (tmp = data; tmp < data_end; tmp++) + if (*tmp == '\n') + break; +- if (tmp > data_end || *tmp != '\n') ++ if (tmp >= data_end || *tmp != '\n') + return -1; + + *ad_beg_p = data; diff --git a/queue-5.15/netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch b/queue-5.15/netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch new file mode 100644 index 0000000000..5b726088b3 --- /dev/null +++ b/queue-5.15/netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch @@ -0,0 +1,50 @@ +From 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 Mon Sep 17 00:00:00 2001 +From: Xiang Mei +Date: Sun, 5 Jul 2026 16:36:29 -0700 +Subject: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag + +From: Xiang Mei + +commit 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 upstream. + +nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6 +fragment header and then unconditionally advances skb->mac_header: + + skb->mac_header += sizeof(struct frag_hdr); + +On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header +yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding +sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7), +after which skb_mac_header_was_set() wrongly reports a MAC header is +present and skb_mac_header() points into the headroom. + +The reassembler has done this unconditional add since it was introduced; +it was harmless while mac_header was a bare pointer, but wrong once +mac_header became a u16 offset whose unset state is the ~0U sentinel +tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c +does the same relocation and does guard the adjustment; mirror the +guard here. + +Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") +Cc: stable@vger.kernel.org +Reported-by: Weiming Shi +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Xiang Mei +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -345,7 +345,8 @@ static int nf_ct_frag6_reasm(struct frag + skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0]; + memmove(skb->head + sizeof(struct frag_hdr), skb->head, + (skb->data - skb->head) - sizeof(struct frag_hdr)); +- skb->mac_header += sizeof(struct frag_hdr); ++ if (skb_mac_header_was_set(skb)) ++ skb->mac_header += sizeof(struct frag_hdr); + skb->network_header += sizeof(struct frag_hdr); + + skb_reset_transport_header(skb); diff --git a/queue-5.15/netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch b/queue-5.15/netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch new file mode 100644 index 0000000000..960e350c05 --- /dev/null +++ b/queue-5.15/netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch @@ -0,0 +1,77 @@ +From 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 1 Jul 2026 07:44:17 +0200 +Subject: netfilter: nf_nat_sip: reload possible stale data pointer + +From: Florian Westphal + +commit 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 upstream. + +quoting sashiko: + ------------------------------------------------------------------------ + [..] noticed a potential memory bug and header corruption involving the + SIP NAT helper. + + In net/netfilter/nf_nat_sip.c:nf_nat_sip(): + if (skb_ensure_writable(skb, skb->len)) { + nf_ct_helper_log(skb, ct, "cannot mangle packet"); + return NF_DROP; + } + uh = (void *)skb->data + protoff; + uh->dest = ct_sip_info->forced_dport; + if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff, + 0, 0, NULL, 0)) { + + If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the + old data buffer is freed. However, nf_nat_sip() fails to update *dptr to + point to the new buffer. + + It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP + packet, which would overwrite the sequence number with a checksum update. + ------------------------------------------------------------------------ + +nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen. +But clones are possible, so rebuild dptr. + +Disable nf_nat_mangle_udp_packet() branch for TCP streams. +It doesn't look like this can ever happen, else we should have received +bug reports about this, so just check the conntrack is UDP and drop +otherwise. + +The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages, +so I don't think this is ever expected to be true for a TCP stream. + +Fixes: 7266507d8999 ("netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-sonnet-4-6 +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_nat_sip.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/net/netfilter/nf_nat_sip.c ++++ b/net/netfilter/nf_nat_sip.c +@@ -283,13 +283,22 @@ next: + + /* Mangle destination port for Cisco phones, then fix up checksums */ + if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) { ++ int doff = *dptr - (const char *)skb->data; + struct udphdr *uh; + ++ if (doff <= 0) ++ return NF_DROP; ++ ++ /* ct_sip_info->forced_dport only expected with UDP */ ++ if (nf_ct_protonum(ct) != IPPROTO_UDP) ++ return NF_DROP; ++ + if (skb_ensure_writable(skb, skb->len)) { + nf_ct_helper_log(skb, ct, "cannot mangle packet"); + return NF_DROP; + } + ++ *dptr = skb->data + doff; + uh = (void *)skb->data + protoff; + uh->dest = ct_sip_info->forced_dport; + diff --git a/queue-5.15/netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch b/queue-5.15/netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch new file mode 100644 index 0000000000..c998f4aa80 --- /dev/null +++ b/queue-5.15/netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch @@ -0,0 +1,46 @@ +From d738feccb98cb224ebabecb703e98f5008276bff Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 11 Apr 2026 19:57:21 +0100 +Subject: netfilter: nfnl_cthelper: apply per-class values when updating policies + +From: David Carlier + +commit d738feccb98cb224ebabecb703e98f5008276bff upstream. + +When a userspace conntrack helper with multiple expectation classes is +updated via nfnetlink, every class ends up with the first class's +max_expected and timeout values. + +nfnl_cthelper_update_policy_all() validates each new policy into the +corresponding slot of the temporary new_policy array, but the second +loop that commits the values into the live helper dereferences +new_policy as a pointer instead of indexing it, so every iteration +reads new_policy[0] regardless of i. An update that changes per-class +values is silently collapsed onto class 0's values with no error +returned to userspace. + +Index the temporary array by i in the commit loop so each class gets +its own validated values. + +Fixes: 2c422257550f ("netfilter: nfnl_cthelper: fix runtime expectation policy updates") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nfnetlink_cthelper.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -344,8 +344,8 @@ static int nfnl_cthelper_update_policy_a + for (i = 0; i < helper->expect_class_max + 1; i++) { + policy = (struct nf_conntrack_expect_policy *) + &helper->expect_policy[i]; +- policy->max_expected = new_policy->max_expected; +- policy->timeout = new_policy->timeout; ++ policy->max_expected = new_policy[i].max_expected; ++ policy->timeout = new_policy[i].timeout; + } + + err: diff --git a/queue-5.15/netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch b/queue-5.15/netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch new file mode 100644 index 0000000000..20d0356afc --- /dev/null +++ b/queue-5.15/netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch @@ -0,0 +1,49 @@ +From 5feba91006ec92da57acc1cc2e34df623b98541e Mon Sep 17 00:00:00 2001 +From: Wyatt Feng +Date: Thu, 11 Jun 2026 15:21:42 +0800 +Subject: netfilter: xt_cluster: reject template conntracks in hash match + +From: Wyatt Feng + +commit 5feba91006ec92da57acc1cc2e34df623b98541e upstream. + +xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully +initialized conntrack and passes it to xt_cluster_hash(). + +This causes a state confusion bug when the raw table CT target attaches +a template conntrack to skb->_nfct before normal conntrack processing. +Templates carry IPS_TEMPLATE status but do not have a valid tuple for +hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the +zeroed l3num field. + +Reject template conntracks before hashing them. This matches existing +netfilter handling for template objects and avoids hashing incomplete +conntrack state. + +Fixes: 0269ea493734 ("netfilter: xtables: add cluster match") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Zhengchuan Liang +Reported-by: Xin Liu +Assisted-by: Codex:GPT-5.4 +Signed-off-by: Wyatt Feng +Signed-off-by: Ren Wei +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/xt_cluster.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/xt_cluster.c ++++ b/net/netfilter/xt_cluster.c +@@ -107,7 +107,7 @@ xt_cluster_mt(const struct sk_buff *skb, + } + + ct = nf_ct_get(skb, &ctinfo); +- if (ct == NULL) ++ if (!ct || nf_ct_is_template(ct)) + return false; + + if (ct->master) diff --git a/queue-5.15/netfilter-xt_nat-reject-unsupported-target-families.patch b/queue-5.15/netfilter-xt_nat-reject-unsupported-target-families.patch new file mode 100644 index 0000000000..e174d47e3f --- /dev/null +++ b/queue-5.15/netfilter-xt_nat-reject-unsupported-target-families.patch @@ -0,0 +1,58 @@ +From 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd Mon Sep 17 00:00:00 2001 +From: Wyatt Feng +Date: Sat, 13 Jun 2026 18:27:15 +0800 +Subject: netfilter: xt_nat: reject unsupported target families + +From: Wyatt Feng + +commit 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd upstream. + +xt_nat SNAT and DNAT target handlers assume IP-family conntrack state +is present and can dereference a NULL pointer when instantiated from an +unsupported family through nft_compat. A bridge-family compat rule can +therefore trigger a NULL-dereference in nf_nat_setup_info(). + +Reject non-IP families in xt_nat_checkentry() so unsupported targets +cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT +compat users and leave the runtime fast path unchanged. + +[ The crash was fixed via + 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), + so this patch is no longer critical. + Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra + family check is a good idea in any case. ] + +Fixes: c7232c9979cb ("netfilter: add protocol independent NAT core") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Zhengchuan Liang +Reported-by: Xin Liu +Assisted-by: Codex:GPT-5.4 +Signed-off-by: Wyatt Feng +Signed-off-by: Ren Wei +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/xt_nat.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/net/netfilter/xt_nat.c ++++ b/net/netfilter/xt_nat.c +@@ -26,6 +26,15 @@ static int xt_nat_checkentry_v0(const st + + static int xt_nat_checkentry(const struct xt_tgchk_param *par) + { ++ switch (par->family) { ++ case NFPROTO_IPV4: ++ case NFPROTO_IPV6: ++ case NFPROTO_INET: ++ break; ++ default: ++ return -EINVAL; ++ } ++ + return nf_ct_netns_get(par->net, par->family); + } + diff --git a/queue-5.15/series b/queue-5.15/series index 51a48057cc..f215c063bd 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -562,3 +562,44 @@ net-ife-require-eth_hlen-to-be-pullable-in-ife_decode.patch arm64-dts-qcom-sdm630-describe-adsp_mem-region-properly.patch kvm-arm64-vgic-check-the-interrupt-is-still-ours-before-migrating-it.patch kvm-arm64-vgic-handle-race-between-interrupt-affinity-change-and-lpi-disabling.patch +fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch +fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch +fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch +fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch +fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch +fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch +fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch +fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch +fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch +fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch +fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch +fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch +netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch +netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch +netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch +netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch +netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch +netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch +netfilter-xt_nat-reject-unsupported-target-families.patch +netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch +gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch +soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch +soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch +leds-uleds-fix-potential-buffer-overread.patch +mfd-sm501-fix-reference-leak-on-failed-device-registration.patch +x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch +x86-boot-reject-too-long-acpi_rsdp-values.patch +batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch +batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch +batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch +batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch +batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch +batman-adv-dat-fix-tie-break-for-candidate-selection.patch +batman-adv-tt-avoid-request-storms-during-pending-request.patch +batman-adv-fix-vlan-priority-offset.patch +batman-adv-frag-free-unfragmentable-packet.patch +batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch +batman-adv-tt-prevent-tvlv-oob-check-overflow.patch +mfd-tps6586x-fix-of-node-refcount.patch +bluetooth-sco-fix-sleeping-under-spinlock-in-sco_conn_ready.patch +bluetooth-sco-hold-sk-properly-in-sco_conn_ready.patch diff --git a/queue-5.15/soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch b/queue-5.15/soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch new file mode 100644 index 0000000000..8cd9489c5e --- /dev/null +++ b/queue-5.15/soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch @@ -0,0 +1,42 @@ +From a0fe29d20e7822182e12324905af5115c1b3aed3 Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Fri, 27 Mar 2026 08:12:25 +0800 +Subject: soc: fsl: qe: panic on ioremap() failure in qe_reset() + +From: Wang Jun <1742789905@qq.com> + +commit a0fe29d20e7822182e12324905af5115c1b3aed3 upstream. + +When ioremap() fails in qe_reset(), the global pointer qe_immr remains +NULL, leading to a subsequent NULL pointer dereference when the pointer +is accessed. Since this happens early in the boot process, a failure to +map a few bytes of I/O memory indicates a fatal error from which the +system cannot recover. + +Follow the same pattern as qe_sdma_init() and panic immediately when +ioremap() fails. This avoids a silent NULL pointer dereference later +and makes the error explicit. + +Fixes: 986585385131 ("[POWERPC] Add QUICC Engine (QE) infrastructure") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Link: https://lore.kernel.org/r/tencent_FED49CF5331CC0C7910618883332A08E2606@qq.com +[chleroy: Rearranged change to reduce churn] +Signed-off-by: Christophe Leroy (CS GROUP) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/fsl/qe/qe.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/soc/fsl/qe/qe.c ++++ b/drivers/soc/fsl/qe/qe.c +@@ -88,6 +88,9 @@ void qe_reset(void) + if (qe_immr == NULL) + qe_immr = ioremap(get_qe_base(), QE_IMMAP_SIZE); + ++ if (!qe_immr) ++ panic("QE:ioremap failed!"); ++ + qe_snums_init(); + + qe_issue_cmd(QE_RESET, QE_CR_SUBBLOCK_INVALID, diff --git a/queue-5.15/soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch b/queue-5.15/soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch new file mode 100644 index 0000000000..ac2c7f05b6 --- /dev/null +++ b/queue-5.15/soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch @@ -0,0 +1,45 @@ +From b920352cfd2b0fcd1249ff006618c939b64fc8f7 Mon Sep 17 00:00:00 2001 +From: Siddharth Vadapalli +Date: Fri, 1 May 2026 18:10:54 +0530 +Subject: soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy + +From: Siddharth Vadapalli + +commit b920352cfd2b0fcd1249ff006618c939b64fc8f7 upstream. + +k3_ringacc_ring_pop_tail_io() and k3_ringacc_ring_pop_tail_proxy() +incorrectly use K3_RINGACC_ACCESS_MODE_POP_HEAD instead of +K3_RINGACC_ACCESS_MODE_POP_TAIL. This will result in ring elements being +popped in the reverse order of that which the caller expects. Fix this. + +Fixes: 3277e8aa2504 ("soc: ti: k3: add navss ringacc driver") +Cc: stable@vger.kernel.org +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Hari Prasath Gujulan Elango +Link: https://patch.msgid.link/20260501124129.362192-1-s-vadapalli@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/ti/k3-ringacc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/soc/ti/k3-ringacc.c ++++ b/drivers/soc/ti/k3-ringacc.c +@@ -997,7 +997,7 @@ static int k3_ringacc_ring_pop_head_prox + static int k3_ringacc_ring_pop_tail_proxy(struct k3_ring *ring, void *elem) + { + return k3_ringacc_ring_access_proxy(ring, elem, +- K3_RINGACC_ACCESS_MODE_POP_HEAD); ++ K3_RINGACC_ACCESS_MODE_POP_TAIL); + } + + static int k3_ringacc_ring_access_io(struct k3_ring *ring, void *elem, +@@ -1068,7 +1068,7 @@ static int k3_ringacc_ring_pop_io(struct + static int k3_ringacc_ring_pop_tail_io(struct k3_ring *ring, void *elem) + { + return k3_ringacc_ring_access_io(ring, elem, +- K3_RINGACC_ACCESS_MODE_POP_HEAD); ++ K3_RINGACC_ACCESS_MODE_POP_TAIL); + } + + /* diff --git a/queue-5.15/x86-boot-reject-too-long-acpi_rsdp-values.patch b/queue-5.15/x86-boot-reject-too-long-acpi_rsdp-values.patch new file mode 100644 index 0000000000..7ea96f22f9 --- /dev/null +++ b/queue-5.15/x86-boot-reject-too-long-acpi_rsdp-values.patch @@ -0,0 +1,51 @@ +From d130041a7b96f79cd4c7079a6c2431a6db4c9619 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sun, 21 Jun 2026 19:00:10 +0200 +Subject: x86/boot: Reject too long acpi_rsdp= values + +From: Thorsten Blum + +commit d130041a7b96f79cd4c7079a6c2431a6db4c9619 upstream. + +cmdline_find_option() returns the full length of the parsed acpi_rsdp= +value. get_cmdline_acpi_rsdp() then silently truncates values which do +not fit in the val[] buffer. + +Prevent boot_kstrtoul() from parsing a truncated value and then the +kernel from silently using the wrong RSDP address, see discussion in +Link:. + +Issue a warning so that the user is aware that s/he supplied a malformed +value and can get feedback instead of silent crashes. + + [ bp: Make commit message more precise. ] + +Fixes: 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing") +Signed-off-by: Thorsten Blum +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20260617130417.36651-4-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/boot/compressed/acpi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/x86/boot/compressed/acpi.c ++++ b/arch/x86/boot/compressed/acpi.c +@@ -288,10 +288,15 @@ static unsigned long get_cmdline_acpi_rs + char val[MAX_ADDR_LEN] = { }; + int ret; + +- ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN); ++ ret = cmdline_find_option("acpi_rsdp", val, sizeof(val)); + if (ret < 0) + return 0; + ++ if (ret >= sizeof(val)) { ++ warn("acpi_rsdp= value too long; ignoring"); ++ return 0; ++ } ++ + if (boot_kstrtoul(val, 16, &addr)) + return 0; + #endif diff --git a/queue-5.15/x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch b/queue-5.15/x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch new file mode 100644 index 0000000000..c8d330abe6 --- /dev/null +++ b/queue-5.15/x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch @@ -0,0 +1,55 @@ +From ffa0aa5b625fe0bed7463ac613f8b06676ff4542 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Mon, 13 Jul 2026 21:49:25 +0200 +Subject: x86/boot: Validate console=uart8250 baud rate to fix early boot hang + +From: Thorsten Blum + +commit ffa0aa5b625fe0bed7463ac613f8b06676ff4542 upstream. + +When the baud rate is empty, 0, invalid, or overflows to 0 when stored +as an int, the system will hang during early boot because of a division +by zero in early_serial_init(). + +Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent +an early system hang. + +Fixes: ce0aa5dd20e4 ("x86, setup: Make the setup code also accept console=uart8250") +Signed-off-by: Thorsten Blum +Signed-off-by: Ingo Molnar +Cc: "H. Peter Anvin" +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260713194924.126472-3-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/boot/early_serial_console.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/arch/x86/boot/early_serial_console.c ++++ b/arch/x86/boot/early_serial_console.c +@@ -117,7 +117,7 @@ static unsigned int probe_baud(int port) + static void parse_console_uart8250(void) + { + char optstr[64], *options; +- int baud = DEFAULT_BAUD; ++ int baud; + int port = 0; + + /* +@@ -136,10 +136,13 @@ static void parse_console_uart8250(void) + else + return; + +- if (options && (options[0] == ',')) +- baud = simple_strtoull(options + 1, &options, 0); +- else ++ if (options && (options[0] == ',')) { ++ baud = simple_strtoull(options + 1, NULL, 0); ++ if (!baud) ++ baud = DEFAULT_BAUD; ++ } else { + baud = probe_baud(port); ++ } + + if (port) + early_serial_init(port, baud);