From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:27:23 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=60b35fa224af10edfa18d01e17cb6d7cd34313ba;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: bluetooth-btrtl-validate-firmware-patch-bounds.patch ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch --- diff --git a/queue-5.10/bluetooth-btrtl-validate-firmware-patch-bounds.patch b/queue-5.10/bluetooth-btrtl-validate-firmware-patch-bounds.patch new file mode 100644 index 0000000000..544cc804e5 --- /dev/null +++ b/queue-5.10/bluetooth-btrtl-validate-firmware-patch-bounds.patch @@ -0,0 +1,41 @@ +From 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 Mon Sep 17 00:00:00 2001 +From: Laxman Acharya Padhya +Date: Fri, 10 Jul 2026 23:10:03 +0545 +Subject: Bluetooth: btrtl: validate firmware patch bounds + +From: Laxman Acharya Padhya + +commit 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 upstream. + +rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the +firmware version. A malformed firmware patch shorter than the version field +can make this subtraction underflow and turn the copy into an oversized +read and write during Bluetooth setup. + +The existing patch_offset + patch_length check can also wrap on 32-bit +architectures. Validate the patch length and range without arithmetic +overflow before allocating or copying the patch. + +Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver") +Cc: stable@vger.kernel.org +Signed-off-by: Laxman Acharya Padhya +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btrtl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -382,8 +382,9 @@ static int rtlbt_parse_firmware(struct h + } + + BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i); +- min_size = patch_offset + patch_length; +- if (btrtl_dev->fw_len < min_size) ++ if (patch_length < sizeof(epatch_info->fw_version) || ++ patch_offset > btrtl_dev->fw_len || ++ patch_length > btrtl_dev->fw_len - patch_offset) + return -EINVAL; + + /* Copy the firmware into a new buffer and write the version at diff --git a/queue-5.10/ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch b/queue-5.10/ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch new file mode 100644 index 0000000000..63d33a4cbb --- /dev/null +++ b/queue-5.10/ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch @@ -0,0 +1,82 @@ +From b3fe4cbd583895987935a9bdad01c8f9d3a02310 Mon Sep 17 00:00:00 2001 +From: Julian Anastasov +Date: Wed, 8 Jul 2026 21:03:15 +0300 +Subject: ipvs: fix more places with wrong ipv6 transport offsets + +From: Julian Anastasov + +commit b3fe4cbd583895987935a9bdad01c8f9d3a02310 upstream. + +Sashiko reports for more incorrect IPv6 transport offsets. + +The app code for TCP was assuming IPv4 network header +even after the ipvsh argument was provided. This can +cause problems with apps over IPv6. As for the only +official app in the kernel tree (FTP) this problem is +harmless because we use Netfilter to mangle the FTP +ports and we do not adjust the TCP seq numbers. + +Also, provide correct offset of the ICMPV6 header in +ip_vs_out_icmp_v6() for correct checksum checks when +the IPv6 packet has extension headers. + +Fixes: d12e12299a69 ("ipvs: add ipv6 support to ftp") +Fixes: 2a3b791e6e11 ("IPVS: Add/adjust Netfilter hook functions and helpers for v6") +Cc: stable@vger.kernel.org +Link: https://sashiko.dev/#/patchset/20260706101624.69471-1-zhaoyz24%40mails.tsinghua.edu.cn +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_app.c | 10 ++++------ + net/netfilter/ipvs/ip_vs_core.c | 3 +-- + 2 files changed, 5 insertions(+), 8 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_app.c ++++ b/net/netfilter/ipvs/ip_vs_app.c +@@ -362,14 +362,13 @@ static inline int app_tcp_pkt_out(struct + struct ip_vs_iphdr *ipvsh) + { + int diff; +- const unsigned int tcp_offset = ip_hdrlen(skb); + struct tcphdr *th; + __u32 seq; + +- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th))) ++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th))) + return 0; + +- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset); ++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len); + + /* + * Remember seq number in case this pkt gets resized +@@ -439,14 +438,13 @@ static inline int app_tcp_pkt_in(struct + struct ip_vs_iphdr *ipvsh) + { + int diff; +- const unsigned int tcp_offset = ip_hdrlen(skb); + struct tcphdr *th; + __u32 seq; + +- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th))) ++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th))) + return 0; + +- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset); ++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len); + + /* + * Remember seq number in case this pkt gets resized +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1053,8 +1053,7 @@ static int ip_vs_out_icmp_v6(struct netn + snet.in6 = ciph.saddr.in6; + offset = ciph.len; + return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp, +- pp, offset, sizeof(struct ipv6hdr), +- hooknum); ++ pp, offset, ipvsh->len, hooknum); + } + #endif + diff --git a/queue-5.10/llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch b/queue-5.10/llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch new file mode 100644 index 0000000000..766737a1bd --- /dev/null +++ b/queue-5.10/llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch @@ -0,0 +1,42 @@ +From 2c72eb6286347d05a885412fb076993bd5286b53 Mon Sep 17 00:00:00 2001 +From: Xuanqiang Luo +Date: Sun, 12 Jul 2026 21:03:43 +0800 +Subject: llc: fix SAP refcount leak when creating incoming sockets + +From: Xuanqiang Luo + +commit 2c72eb6286347d05a885412fb076993bd5286b53 upstream. + +llc_sap_add_socket() takes a SAP reference for each socket added to a SAP, +and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes +an additional SAP reference after adding the child socket. + +This extra reference was balanced by an explicit llc_sap_put() in +llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference +counting w.r.t. socket handling") removed that put. The corresponding hold +in the accept path was left behind. + +When such a child socket is removed, only the reference taken by +llc_sap_add_socket() is released. The extra reference keeps the SAP alive +after its last socket is removed. Remove the obsolete hold. + +Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling") +Cc: stable@vger.kernel.org +Signed-off-by: Xuanqiang Luo +Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/llc_conn.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -761,7 +761,6 @@ static struct sock *llc_create_incoming_ + newllc->dev = dev; + dev_hold(dev); + llc_sap_add_socket(llc->sap, newsk); +- llc_sap_hold(llc->sap); + out: + return newsk; + } diff --git a/queue-5.10/macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch b/queue-5.10/macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch new file mode 100644 index 0000000000..1974e4cc07 --- /dev/null +++ b/queue-5.10/macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch @@ -0,0 +1,61 @@ +From 7410d11460eb90d6c9281162ccc6a128534d897d Mon Sep 17 00:00:00 2001 +From: James Raphael Tiovalen +Date: Sun, 5 Jul 2026 19:36:29 +0800 +Subject: macsec: fix promiscuity refcount leak in macsec_dev_open() + +From: James Raphael Tiovalen + +commit 7410d11460eb90d6c9281162ccc6a128534d897d upstream. + +When a MACsec interface with IFF_PROMISC set is brought up on top of a +device that has hardware offload enabled, macsec_dev_open() first calls +dev_set_promiscuity(real_dev, 1) and then propagates the open to the +offload device. If that propagation fails, the error path jumps to the +clear_allmulti label, which only reverts allmulti and the unicast +address. The promiscuity taken on the lower device is never dropped, so +real_dev is left permanently stuck in promiscuous mode. Its promiscuity +count can no longer be balanced from software. + +Add a clear_promisc label that drops the promiscuity reference and +route the two offload failure paths to it. The dev_set_promiscuity() +failure itself still jumps to clear_allmulti, since on that failure the +count was not incremented. + +Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure") +Cc: stable@vger.kernel.org +Signed-off-by: James Raphael Tiovalen +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20260705113629.187490-1-jamestiotio@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/macsec.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -3560,19 +3560,22 @@ static int macsec_dev_open(struct net_de + ops = macsec_get_ops(netdev_priv(dev), &ctx); + if (!ops) { + err = -EOPNOTSUPP; +- goto clear_allmulti; ++ goto clear_promisc; + } + + ctx.secy = &macsec->secy; + err = macsec_offload(ops->mdo_dev_open, &ctx); + if (err) +- goto clear_allmulti; ++ goto clear_promisc; + } + + if (netif_carrier_ok(real_dev)) + netif_carrier_on(dev); + + return 0; ++clear_promisc: ++ if (dev->flags & IFF_PROMISC) ++ dev_set_promiscuity(real_dev, -1); + clear_allmulti: + if (dev->flags & IFF_ALLMULTI) + dev_set_allmulti(real_dev, -1); diff --git a/queue-5.10/memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch b/queue-5.10/memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch new file mode 100644 index 0000000000..f846e0929e --- /dev/null +++ b/queue-5.10/memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch @@ -0,0 +1,54 @@ +From 718178f524b98bc920d74bc771aed823c8b81425 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 2 Jul 2026 16:27:45 +0800 +Subject: memstick: ms_block: reject a card that reports too many blocks + +From: Maoyi Xie + +commit 718178f524b98bc920d74bc771aed823c8b81425 upstream. + +msb_ftl_initialize() computes the zone count from the card block count +with no bound: + + msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; + ... + for (i = 0; i < msb->zone_count; i++) + msb->free_block_count[i] = MS_BLOCKS_IN_ZONE; + +msb->block_count is a card value. msb_read_boot_blocks() reads +number_of_blocks from the card boot page and byte swaps it. +free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the +valid indices are 0 to 15. The init loop above indexes it by zone_count. +msb_mark_block_used() and msb_mark_block_unused() index it by +pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report +up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES * +MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past +free_block_count[] and corrupts struct msb_data. A larger count runs the +init loop past the end too. + +A real Memory Stick has at most 16 zones. So it has at most 8192 blocks. +msb_ftl_initialize() now rejects a card that reports more than +MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks. + +Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memstick/core/ms_block.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1333,6 +1333,10 @@ static int msb_ftl_initialize(struct msb + return 0; + + msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; ++ if (msb->block_count > MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) { ++ pr_err("Too many blocks: %d\n", msb->block_count); ++ return -EINVAL; ++ } + msb->logical_block_count = msb->zone_count * 496 - 2; + + msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); diff --git a/queue-5.10/regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch b/queue-5.10/regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch new file mode 100644 index 0000000000..a3f84015a3 --- /dev/null +++ b/queue-5.10/regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch @@ -0,0 +1,58 @@ +From 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 Mon Sep 17 00:00:00 2001 +From: Abhishek Ojha +Date: Wed, 15 Jul 2026 13:04:08 -0400 +Subject: regulator: ltc3676: Fix incorrect IRQSTAT bit offsets + +From: Abhishek Ojha + +commit 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 upstream. + +The LTC3676_IRQSTAT_* bit definitions do not match the IRQSTAT +(Interrupt Request Status) register layout documented in Table 15 +of the LTC3676/LTC3676-1 datasheet: + + bit 0 - Pushbutton Status Active + bit 1 - Hard Reset Occurred + bit 2 - PGOOD Timeout Occurred + bit 3 - Undervoltage Warning + bit 4 - Undervoltage Standby (Fault) Occurred + bit 5 - Overtemperature Warning + bit 6 - Overtemperature Standby (Fault) Occurred + bit 7 - Reserved + +The driver instead defines these starting at bit 3, one bit higher +than the datasheet specifies, which causes ltc3676_regulator_isr() +to check the wrong status bits and misreport (or miss) PGOOD +timeout, undervoltage and thermal warning/fault conditions. + +Fix the bit offsets to match the datasheet. + +Fixes: 37b918a034fe ("regulator: Add LTC3676 support") +Cc: stable@vger.kernel.org +Signed-off-by: Abhishek Ojha +Link: https://patch.msgid.link/20260715170408.295552-1-Abhishek.ojha@savoirfairelinux.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/ltc3676.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/regulator/ltc3676.c ++++ b/drivers/regulator/ltc3676.c +@@ -45,11 +45,11 @@ + #define LTC3676_DVBxA_REF_SELECT BIT(5) + #define LTC3676_DVBxB_PGOOD_MASK BIT(5) + +-#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(3) +-#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(4) +-#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(5) +-#define LTC3676_IRQSTAT_THERMAL_WARN BIT(6) +-#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(7) ++#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(2) ++#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(3) ++#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(4) ++#define LTC3676_IRQSTAT_THERMAL_WARN BIT(5) ++#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(6) + + enum ltc3676_reg { + LTC3676_SW1, diff --git a/queue-5.10/reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch b/queue-5.10/reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch new file mode 100644 index 0000000000..97c57fca6e --- /dev/null +++ b/queue-5.10/reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch @@ -0,0 +1,48 @@ +From 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 Mon Sep 17 00:00:00 2001 +From: Robby Cai +Date: Fri, 19 Jun 2026 15:31:15 +0800 +Subject: reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ + +From: Robby Cai + +commit 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 upstream. + +On i.MX8MQ, the MIPI CSI reset lines are active-low and not self-clearing. +Writing '0' asserts reset and it remains asserted until explicitly +deasserted by software. + +This driver previously treated the MIPI CSI reset signals as active-high, +which led to incorrect reset assert/deassert sequencing. This issue was +exposed by commit 6d79bb8fd2aa ("media: imx8mq-mipi-csi2: Explicitly +release reset"). + +Fix this by reflecting the correct reset polarity and ensuring proper +reset handling. + +Fixes: c979dbf59987 ("reset: imx7: Add support for i.MX8MQ IP block variant") +Cc: stable@vger.kernel.org # 6d79bb8fd2aa: media: imx8mq-mipi-csi2: Explicitly release reset +Reviewed-by: Philipp Zabel +Signed-off-by: Robby Cai +Reviewed-by: Guoniu Zhou +Reviewed-by: Frank Li +Signed-off-by: Philipp Zabel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/reset/reset-imx7.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/reset/reset-imx7.c ++++ b/drivers/reset/reset-imx7.c +@@ -236,6 +236,12 @@ static int imx8mq_reset_set(struct reset + + case IMX8MQ_RESET_PCIE_CTRL_APPS_EN: + case IMX8MQ_RESET_PCIE2_CTRL_APPS_EN: ++ case IMX8MQ_RESET_MIPI_CSI1_CORE_RESET: ++ case IMX8MQ_RESET_MIPI_CSI1_PHY_REF_RESET: ++ case IMX8MQ_RESET_MIPI_CSI1_ESC_RESET: ++ case IMX8MQ_RESET_MIPI_CSI2_CORE_RESET: ++ case IMX8MQ_RESET_MIPI_CSI2_PHY_REF_RESET: ++ case IMX8MQ_RESET_MIPI_CSI2_ESC_RESET: + case IMX8MQ_RESET_MIPI_DSI_PCLK_RESET_N: + case IMX8MQ_RESET_MIPI_DSI_ESC_RESET_N: + case IMX8MQ_RESET_MIPI_DSI_DPI_RESET_N: diff --git a/queue-5.10/reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch b/queue-5.10/reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch new file mode 100644 index 0000000000..56eb900ba8 --- /dev/null +++ b/queue-5.10/reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch @@ -0,0 +1,46 @@ +From 1a8c89f8c112c75e84ff9a140f969e372aed0c9a Mon Sep 17 00:00:00 2001 +From: Zhao Dongdong +Date: Wed, 17 Jun 2026 11:16:27 +0800 +Subject: reset: sunxi: fix memory region leak on ioremap failure + +From: Zhao Dongdong + +commit 1a8c89f8c112c75e84ff9a140f969e372aed0c9a upstream. + +In sunxi_reset_init(), when ioremap() fails, the memory region obtained +via request_mem_region() is not released, leading to a resource leak. + +Add an err_mem_region label to properly release the memory region before +freeing the data structure. + +Fixes: 8f1ae77f4666 ("reset: Add Allwinner SoCs Reset Controller Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Zhao Dongdong +Reviewed-by: Philipp Zabel +Acked-by: Jernej Skrabec +Signed-off-by: Philipp Zabel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/reset/reset-sunxi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/reset/reset-sunxi.c ++++ b/drivers/reset/reset-sunxi.c +@@ -44,7 +44,7 @@ static int sunxi_reset_init(struct devic + data->membase = ioremap(res.start, size); + if (!data->membase) { + ret = -ENOMEM; +- goto err_alloc; ++ goto err_mem_region; + } + + spin_lock_init(&data->lock); +@@ -57,6 +57,8 @@ static int sunxi_reset_init(struct devic + + return reset_controller_register(&data->rcdev); + ++err_mem_region: ++ release_mem_region(res.start, size); + err_alloc: + kfree(data); + return ret; diff --git a/queue-5.10/series b/queue-5.10/series index f7587e5d11..7bafa4d477 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -556,3 +556,13 @@ ipvs-use-parsed-transport-offset-in-sctp-state-lookup.patch ipvs-reset-full-ip_vs_seq-structs-in-ip_vs_conn_new.patch drbd-reject-data-replies-with-an-out-of-range-payload-size.patch cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch +wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch +wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch +regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch +bluetooth-btrtl-validate-firmware-patch-bounds.patch +llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch +macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch +memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch +ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch +reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch +reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch diff --git a/queue-5.10/wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch b/queue-5.10/wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch new file mode 100644 index 0000000000..091696ba4f --- /dev/null +++ b/queue-5.10/wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch @@ -0,0 +1,56 @@ +From 95fc02722edde02946d0d475221f2b2054d3d8ba Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Mon, 6 Jul 2026 22:35:07 +0800 +Subject: wifi: mac80211: fix memory leak in ieee80211_register_hw() + +From: Dawei Feng + +commit 95fc02722edde02946d0d475221f2b2054d3d8ba upstream. + +If kmemdup() fails while copying supported band structures, the error +path jumps to fail_rate. This skips rate_control_deinitialize() and +leaks the initialized local->rate_ctrl. + +Fix this by adding a fail_band label that shares the rate-control cleanup +path before falling through to the remaining teardown. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still present in +v7.1-rc7. + +An x86_64 allyesconfig build showed no new warnings. As we do not have a +suitable mac80211 device/driver combination to test with, no runtime +testing was able to be performed. + +Fixes: 09b4a4faf9d0 ("mac80211: introduce capability flags for VHT EXT NSS support") +Cc: stable@vger.kernel.org +Reviewed-by: Zilin Guan +Signed-off-by: Dawei Feng +Link: https://patch.msgid.link/20260706143507.146131-1-dawei.feng@seu.edu.cn +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1279,7 +1279,7 @@ int ieee80211_register_hw(struct ieee802 + sband = kmemdup(sband, sizeof(*sband), GFP_KERNEL); + if (!sband) { + result = -ENOMEM; +- goto fail_rate; ++ goto fail_band; + } + + wiphy_dbg(hw->wiphy, "copying sband (band %d) due to VHT EXT NSS BW flag\n", +@@ -1342,6 +1342,7 @@ int ieee80211_register_hw(struct ieee802 + #endif + wiphy_unregister(local->hw.wiphy); + fail_wiphy_register: ++ fail_band: + rtnl_lock(); + rate_control_deinitialize(local); + ieee80211_remove_interfaces(local); diff --git a/queue-5.10/wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch b/queue-5.10/wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch new file mode 100644 index 0000000000..b46c29e803 --- /dev/null +++ b/queue-5.10/wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch @@ -0,0 +1,75 @@ +From 536fb3d739d75a03cb318c0c6fe799425cfea501 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Fri, 19 Jun 2026 15:31:04 +0800 +Subject: wifi: rt2x00: avoid full teardown before work setup in probe + +From: Runyu Xiao + +commit 536fb3d739d75a03cb318c0c6fe799425cfea501 upstream. + +rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for +all probe failures. However, drv_data allocation and workqueue allocation +can fail before intf_work, autowakeup_work and sleep_work have been +initialized. + +Do not enter the full remove path until the probe has reached the point +where those work items are set up. Return directly for drv_data allocation +failure, and use a small early cleanup path for workqueue allocation +failure. + +This issue was found by our static analysis tool and then confirmed by +manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The +early probe exits should not call a common teardown path that assumes the +later work setup has already completed. + +A QEMU PoC forced alloc_ordered_workqueue() to fail before the work +initializers are reached. The resulting fail path entered +rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with +rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack. + +Fixes: 1ebbc48520a0 ("rt2x00: Introduce concept of driver data in struct rt2x00_dev.") +Fixes: 0439f5367c8d ("rt2x00: Move TX/RX work into dedicated workqueue") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Link: https://patch.msgid.link/20260619073104.1809161-1-runyu.xiao@seu.edu.cn +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +@@ -1368,7 +1368,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de + GFP_KERNEL); + if (!rt2x00dev->drv_data) { + retval = -ENOMEM; +- goto exit; ++ return retval; + } + } + +@@ -1402,7 +1402,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de + alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy)); + if (!rt2x00dev->workqueue) { + retval = -ENOMEM; +- goto exit; ++ goto exit_free_drv_data; + } + + INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled); +@@ -1478,6 +1478,14 @@ exit: + rt2x00lib_remove_dev(rt2x00dev); + + return retval; ++ ++exit_free_drv_data: ++ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); ++ ++ kfree(rt2x00dev->drv_data); ++ rt2x00dev->drv_data = NULL; ++ ++ return retval; + } + EXPORT_SYMBOL_GPL(rt2x00lib_probe_dev); +