From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 16:12:27 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6d348c92c537c1fedcf0d8a9216a082acdf15d45;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: cpu-hotplug-bound-hotplug-states-sysfs-output.patch cpu-hotplug-preserve-per-instance-callback-errors.patch gpio-f7188x-add-support-for-nct6126d-version-b.patch gpios-palmas-add-.get_direction-op.patch ieee802154-admin-gate-legacy-llsec-dump-operations.patch ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch --- diff --git a/queue-6.1/cpu-hotplug-bound-hotplug-states-sysfs-output.patch b/queue-6.1/cpu-hotplug-bound-hotplug-states-sysfs-output.patch new file mode 100644 index 0000000000..f2b2f23a3e --- /dev/null +++ b/queue-6.1/cpu-hotplug-bound-hotplug-states-sysfs-output.patch @@ -0,0 +1,53 @@ +From 86f436567f2516a0083b210bedc933544826a2c3 Mon Sep 17 00:00:00 2001 +From: Bradley Morgan +Date: Fri, 19 Jun 2026 16:37:18 +0000 +Subject: cpu: hotplug: Bound hotplug states sysfs output + +From: Bradley Morgan + +commit 86f436567f2516a0083b210bedc933544826a2c3 upstream. + +states_show() adds CPU hotplug state names into a single sysfs buffer +using sprintf(). With enough registered states, this can write past the +end of the PAGE_SIZE buffer. + +Use sysfs_emit_at() so output is bounded. + +Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface") +Signed-off-by: Bradley Morgan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cpu.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -2502,21 +2502,17 @@ static const struct attribute_group cpuh + NULL + }; + +-static ssize_t states_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t states_show(struct device *dev, struct device_attribute *attr, char *buf) + { +- ssize_t cur, res = 0; ++ ssize_t res = 0; + int i; + + mutex_lock(&cpuhp_state_mutex); + for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) { + struct cpuhp_step *sp = cpuhp_get_step(i); + +- if (sp->name) { +- cur = sprintf(buf, "%3d: %s\n", i, sp->name); +- buf += cur; +- res += cur; +- } ++ if (sp->name) ++ res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name); + } + mutex_unlock(&cpuhp_state_mutex); + return res; diff --git a/queue-6.1/cpu-hotplug-preserve-per-instance-callback-errors.patch b/queue-6.1/cpu-hotplug-preserve-per-instance-callback-errors.patch new file mode 100644 index 0000000000..9f77437849 --- /dev/null +++ b/queue-6.1/cpu-hotplug-preserve-per-instance-callback-errors.patch @@ -0,0 +1,53 @@ +From 673db10729fb121ea1b16fe57791a0cb9eac1eb5 Mon Sep 17 00:00:00 2001 +From: Bradley Morgan +Date: Fri, 19 Jun 2026 16:37:17 +0000 +Subject: cpu: hotplug: Preserve per instance callback errors + +From: Bradley Morgan + +commit 673db10729fb121ea1b16fe57791a0cb9eac1eb5 upstream. + +cpuhp_invoke_callback() unwinds earlier callbacks for the same +hotplug state when one instance fails. The rollback path currently +reuses ret, so a successful rollback can hide the original error and +make the failed transition look successful. + +Keep the rollback result separate from the original error. + +Fixes: 724a86881d03 ("smp/hotplug: Callback vs state-machine consistency") +Signed-off-by: Bradley Morgan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260619163719.12103-1-include@grrlz.net +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cpu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -172,7 +172,7 @@ static int cpuhp_invoke_callback(unsigne + struct cpuhp_step *step = cpuhp_get_step(state); + int (*cbm)(unsigned int cpu, struct hlist_node *node); + int (*cb)(unsigned int cpu); +- int ret, cnt; ++ int ret, cnt, rollback_ret; + + if (st->fail == state) { + st->fail = CPUHP_INVALID; +@@ -236,12 +236,12 @@ err: + break; + + trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node); +- ret = cbm(cpu, node); +- trace_cpuhp_exit(cpu, st->state, state, ret); ++ rollback_ret = cbm(cpu, node); ++ trace_cpuhp_exit(cpu, st->state, state, rollback_ret); + /* + * Rollback must not fail, + */ +- WARN_ON_ONCE(ret); ++ WARN_ON_ONCE(rollback_ret); + } + return ret; + } diff --git a/queue-6.1/gpio-f7188x-add-support-for-nct6126d-version-b.patch b/queue-6.1/gpio-f7188x-add-support-for-nct6126d-version-b.patch new file mode 100644 index 0000000000..59eae7729b --- /dev/null +++ b/queue-6.1/gpio-f7188x-add-support-for-nct6126d-version-b.patch @@ -0,0 +1,51 @@ +From 9a6c0b6ea12746d50cf53d59a7e05fd83f974bda Mon Sep 17 00:00:00 2001 +From: Paul Louvel +Date: Mon, 29 Jun 2026 16:07:02 +0200 +Subject: gpio-f7188x: Add support for NCT6126D version B + +From: Paul Louvel + +commit 9a6c0b6ea12746d50cf53d59a7e05fd83f974bda upstream. + +The Nuvoton NCT6126D Super-I/O is available in two hardware revisions. +According to the manufacturer datasheet revision 2.4, version A reports +chip ID 0xD283, while version B reports chip ID 0xD284. + +The driver currently only recognizes only the version A ID. Version B +only contains hardware fixes unrelated to the GPIO functionality, so it +can be supported by simply adding its chip ID without any other driver +changes. + +Fixes: 3002b8642f01 ("gpio-f7188x: fix chip name and pin count on Nuvoton chip") +Cc: stable@vger.kernel.org + +Signed-off-by: Paul Louvel +Link: https://patch.msgid.link/20260629-gpio-f7188x-nct6126d-version-b-v1-1-a06226c02a2d@bootlin.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-f7188x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-f7188x.c ++++ b/drivers/gpio/gpio-f7188x.c +@@ -48,7 +48,8 @@ + /* + * Nuvoton devices. + */ +-#define SIO_NCT6126D_ID 0xD283 /* NCT6126D chipset ID */ ++#define SIO_NCT6126D_VER_A_ID 0xD283 /* NCT6126D version A chipset ID */ ++#define SIO_NCT6126D_VER_B_ID 0xD284 /* NCT6126D version B chipset ID */ + + #define SIO_LD_GPIO_NUVOTON 0x07 /* GPIO logical device */ + +@@ -559,7 +560,8 @@ static int __init f7188x_find(int addr, + case SIO_F81865_ID: + sio->type = f81865; + break; +- case SIO_NCT6126D_ID: ++ case SIO_NCT6126D_VER_A_ID: ++ case SIO_NCT6126D_VER_B_ID: + sio->device = SIO_LD_GPIO_NUVOTON; + sio->type = nct6126d; + break; diff --git a/queue-6.1/gpios-palmas-add-.get_direction-op.patch b/queue-6.1/gpios-palmas-add-.get_direction-op.patch new file mode 100644 index 0000000000..4b0966d7e5 --- /dev/null +++ b/queue-6.1/gpios-palmas-add-.get_direction-op.patch @@ -0,0 +1,58 @@ +From db4a79713ed8e252d5e4edf6eaaa80948b6855a2 Mon Sep 17 00:00:00 2001 +From: Andreas Kemnade +Date: Sat, 4 Jul 2026 10:40:54 +0200 +Subject: gpios: palmas: add .get_direction() op + +From: Andreas Kemnade + +commit db4a79713ed8e252d5e4edf6eaaa80948b6855a2 upstream. + +Accessing debug/gpio is quite noisy without a get_direction() +implementation. To calm that down add an implementation. + +Fixes: 3d50a2785271 ("gpio: palmas: Add support for Palmas GPIO") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: Andreas Kemnade +Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-palmas.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/drivers/gpio/gpio-palmas.c ++++ b/drivers/gpio/gpio-palmas.c +@@ -118,6 +118,24 @@ static int palmas_gpio_input(struct gpio + return ret; + } + ++static int palmas_gpio_get_direction(struct gpio_chip *gc, unsigned int offset) ++{ ++ struct palmas_gpio *pg = gpiochip_get_data(gc); ++ struct palmas *palmas = pg->palmas; ++ unsigned int val; ++ unsigned int reg; ++ int ret; ++ int gpio16 = (offset/8); ++ ++ offset %= 8; ++ reg = (gpio16) ? PALMAS_GPIO_DATA_DIR2 : PALMAS_GPIO_DATA_DIR; ++ ret = palmas_read(palmas, PALMAS_GPIO_BASE, reg, &val); ++ if (ret) ++ return ret; ++ ++ return (val & BIT(offset)) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN; ++} ++ + static int palmas_gpio_to_irq(struct gpio_chip *gc, unsigned offset) + { + struct palmas_gpio *pg = gpiochip_get_data(gc); +@@ -166,6 +184,7 @@ static int palmas_gpio_probe(struct plat + palmas_gpio->gpio_chip.can_sleep = true; + palmas_gpio->gpio_chip.direction_input = palmas_gpio_input; + palmas_gpio->gpio_chip.direction_output = palmas_gpio_output; ++ palmas_gpio->gpio_chip.get_direction = palmas_gpio_get_direction; + palmas_gpio->gpio_chip.to_irq = palmas_gpio_to_irq; + palmas_gpio->gpio_chip.set = palmas_gpio_set; + palmas_gpio->gpio_chip.get = palmas_gpio_get; diff --git a/queue-6.1/ieee802154-admin-gate-legacy-llsec-dump-operations.patch b/queue-6.1/ieee802154-admin-gate-legacy-llsec-dump-operations.patch new file mode 100644 index 0000000000..7164dbff31 --- /dev/null +++ b/queue-6.1/ieee802154-admin-gate-legacy-llsec-dump-operations.patch @@ -0,0 +1,98 @@ +From 9c1e0b6d49471a712511d23fc9d06901561135e8 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Wed, 20 May 2026 10:16:39 -0400 +Subject: ieee802154: admin-gate legacy LLSEC dump operations + +From: Michael Bommarito + +commit 9c1e0b6d49471a712511d23fc9d06901561135e8 upstream. + +In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table +builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, +LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which +sets no .flags, so generic netlink runs them ungated. The modern +nl802154 family admin-gates the equivalent reads via +NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. + +Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve +the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev +that has an LLSEC key installed; the dump handler writes the raw +16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied +verbatim from struct ieee802154_llsec_key.key) into the reply. +Recovering the AES key compromises 802.15.4 LLSEC link confidentiality +and authenticity, since LLSEC uses CCM* and the same key authenticates +and encrypts frames. + +Impact: any local uid with no capabilities can read the raw 16-byte +AES-128 LLSEC key from the kernel keytable on any wpan netdev that has +an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY +dump on the legacy IEEE802154_NL generic-netlink family. + +Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but +setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump +entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the +modern nl802154 family exposes their equivalents to unprivileged +readers by design (NL802154_CMD_GET_WPAN_PHY and +NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged +users" annotations). + +Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 +Signed-off-by: Michael Bommarito +Link: https://lore.kernel.org/20260520141640.1149513-2-michael.bommarito@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/ieee802154.h | 8 ++++++++ + net/ieee802154/netlink.c | 16 ++++++++-------- + 2 files changed, 16 insertions(+), 8 deletions(-) + +--- a/net/ieee802154/ieee802154.h ++++ b/net/ieee802154/ieee802154.h +@@ -23,6 +23,14 @@ void ieee802154_nl_exit(void); + .dumpit = _dump, \ + } + ++#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \ ++ { \ ++ .cmd = _cmd, \ ++ .doit = _func, \ ++ .dumpit = _dump, \ ++ .flags = GENL_ADMIN_PERM, \ ++ } ++ + struct genl_info; + + struct sk_buff *ieee802154_nl_create(int flags, u8 req); +--- a/net/ieee802154/netlink.c ++++ b/net/ieee802154/netlink.c +@@ -98,20 +98,20 @@ static const struct genl_small_ops ieee8 + IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams), + IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams), + IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL, +- ieee802154_llsec_dump_keys), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL, ++ ieee802154_llsec_dump_keys), + IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), + IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL, +- ieee802154_llsec_dump_devs), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL, ++ ieee802154_llsec_dump_devs), + IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), + IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL, +- ieee802154_llsec_dump_devkeys), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL, ++ ieee802154_llsec_dump_devkeys), + IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), + IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, +- ieee802154_llsec_dump_seclevels), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, ++ ieee802154_llsec_dump_seclevels), + IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL, + ieee802154_llsec_add_seclevel), + IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL, diff --git a/queue-6.1/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch b/queue-6.1/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch new file mode 100644 index 0000000000..0de9daba83 --- /dev/null +++ b/queue-6.1/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch @@ -0,0 +1,94 @@ +From a6bfdfcc6711d1d5a92e98644359dedc67c0c858 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Wed, 20 May 2026 10:16:40 -0400 +Subject: ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation + +From: Michael Bommarito + +commit a6bfdfcc6711d1d5a92e98644359dedc67c0c858 upstream. + +The LLSEC ADD/DEL doit handlers under the legacy IEEE802154_NL family +consume IEEE802154_ATTR_LLSEC_KEY_BYTES and +IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS, both declared in +net/ieee802154/nl_policy.c as bare length entries with no .type +(defaulting to NLA_UNSPEC). Generic netlink strict validation rejects +all NLA_UNSPEC attributes via validate_nla(), so every LLSEC_ADD_KEY, +LLSEC_DEL_KEY, LLSEC_ADD_DEV, LLSEC_DEL_DEV, LLSEC_ADD_DEVKEY, +LLSEC_DEL_DEVKEY, LLSEC_ADD_SECLEVEL, and LLSEC_DEL_SECLEVEL request +fails at the dispatcher with "Unsupported attribute" before reaching +the handler. + +The doit path has been silently dead since strict validation became +the default for genl families that do not opt out. The dump path is +unaffected because dump requests carry no LLSEC attributes to +validate, which is why the LLSEC_LIST_KEY read remained reachable +(patch 1/2). Introduce IEEE802154_OP_RELAXED() mirroring +IEEE802154_OP() but with .validate = GENL_DONT_VALIDATE_STRICT, and +use it for the eight legacy LLSEC mutate ops so admin-driven LLSEC +configuration via the legacy interface works again. + +Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 +Signed-off-by: Michael Bommarito +Link: https://lore.kernel.org/20260520141640.1149513-3-michael.bommarito@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/ieee802154.h | 9 +++++++++ + net/ieee802154/netlink.c | 20 ++++++++++---------- + 2 files changed, 19 insertions(+), 10 deletions(-) + +--- a/net/ieee802154/ieee802154.h ++++ b/net/ieee802154/ieee802154.h +@@ -16,6 +16,15 @@ void ieee802154_nl_exit(void); + .flags = GENL_ADMIN_PERM, \ + } + ++#define IEEE802154_OP_RELAXED(_cmd, _func) \ ++ { \ ++ .cmd = _cmd, \ ++ .doit = _func, \ ++ .dumpit = NULL, \ ++ .flags = GENL_ADMIN_PERM, \ ++ .validate = GENL_DONT_VALIDATE_STRICT,\ ++ } ++ + #define IEEE802154_DUMP(_cmd, _func, _dump) \ + { \ + .cmd = _cmd, \ +--- a/net/ieee802154/netlink.c ++++ b/net/ieee802154/netlink.c +@@ -100,22 +100,22 @@ static const struct genl_small_ops ieee8 + IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL, + ieee802154_llsec_dump_keys), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL, + ieee802154_llsec_dump_devs), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL, + ieee802154_llsec_dump_devkeys), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, + ieee802154_llsec_dump_seclevels), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL, +- ieee802154_llsec_add_seclevel), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL, +- ieee802154_llsec_del_seclevel), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_SECLEVEL, ++ ieee802154_llsec_add_seclevel), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_SECLEVEL, ++ ieee802154_llsec_del_seclevel), + }; + + static const struct genl_multicast_group ieee802154_mcgrps[] = { diff --git a/queue-6.1/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch b/queue-6.1/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch new file mode 100644 index 0000000000..b78f58ee5c --- /dev/null +++ b/queue-6.1/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch @@ -0,0 +1,55 @@ +From e09390e439bd7cca30dd10893b1f64802961667a Mon Sep 17 00:00:00 2001 +From: Shitalkumar Gandhi +Date: Tue, 21 Apr 2026 13:02:59 +0530 +Subject: ieee802154: ca8210: fix cas_ctl leak on spi_async failure + +From: Shitalkumar Gandhi + +commit e09390e439bd7cca30dd10893b1f64802961667a upstream. + +ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) +and relies entirely on the SPI completion callback +ca8210_spi_transfer_complete() to free it. + +The spi_async() API only invokes the completion callback on successful +submission. On failure it returns a negative error code without ever +queuing the callback, which leaves cas_ctl and its embedded spi_message +and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is +inside the completion callback, so there is no other reclamation path. + +ca8210_spi_transfer() is called from ca8210_spi_exchange(), the +interrupt handler ca8210_interrupt_handler(), and from the retry path +inside the completion callback itself. The exchange and interrupt +handler paths loop on -EBUSY, so under sustained SPI bus contention +every retry iteration leaks a fresh cas_ctl (~600 bytes per +occurrence). + +Fix it by freeing cas_ctl on the spi_async() error path. While here, +correct the misleading error string: the function calls spi_async(), +not spi_sync(). + +Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Shitalkumar Gandhi +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/20260421073259.2259783-1-shitalkumar.gandhi@cambiumnetworks.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/ca8210.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -921,9 +921,10 @@ static int ca8210_spi_transfer( + if (status < 0) { + dev_crit( + &spi->dev, +- "status %d from spi_sync in write\n", ++ "status %d from spi_async in write\n", + status + ); ++ kfree(cas_ctl); + } + + return status; diff --git a/queue-6.1/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch b/queue-6.1/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch new file mode 100644 index 0000000000..91a0a4e6e5 --- /dev/null +++ b/queue-6.1/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch @@ -0,0 +1,71 @@ +From 6d7f7bcf225b2d566176bf6229dbd1252940cb3c Mon Sep 17 00:00:00 2001 +From: Shitalkumar Gandhi +Date: Wed, 20 May 2026 16:27:50 +0530 +Subject: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit + +From: Shitalkumar Gandhi + +commit 6d7f7bcf225b2d566176bf6229dbd1252940cb3c upstream. + +ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange +a kmalloc'd buffer pointer through a struct kfifo, but pass a literal +'4' as the byte count to kfifo_in()/kfifo_out(). + +This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the +low 4 bytes of the 8-byte pointer are written into the FIFO. The reader +then reads back 4 bytes into an 8-byte local pointer variable, leaving +the upper 4 bytes uninitialized stack data. The first dereference of +the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel +address and generally results in an oops. + +Use sizeof(fifo_buffer) so the byte count matches pointer width on every +architecture. + +The driver has no architecture restriction in Kconfig, so any 64-bit +build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has +been latent since the driver was added in 2017 because it is most +commonly deployed on 32-bit MCUs. + +Found via a custom Coccinelle semantic patch hunting for short-byte +kfifo I/O on byte-mode kfifos used to shuttle pointers. + +Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Shitalkumar Gandhi +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/20260520105750.30144-1-shitalkumar.gandhi@cambiumnetworks.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/ca8210.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -597,7 +597,7 @@ static int ca8210_test_int_driver_write( + fifo_buffer = kmemdup(buf, len, GFP_KERNEL); + if (!fifo_buffer) + return -ENOMEM; +- kfifo_in(&test->up_fifo, &fifo_buffer, 4); ++ kfifo_in(&test->up_fifo, &fifo_buffer, sizeof(fifo_buffer)); + wake_up_interruptible(&priv->test.readq); + + return 0; +@@ -2528,6 +2528,7 @@ static ssize_t ca8210_test_int_user_read + struct ca8210_priv *priv = filp->private_data; + unsigned char *fifo_buffer; + unsigned long bytes_not_copied; ++ unsigned int copied; + + if (filp->f_flags & O_NONBLOCK) { + /* Non-blocking mode */ +@@ -2541,7 +2542,8 @@ static ssize_t ca8210_test_int_user_read + ); + } + +- if (kfifo_out(&priv->test.up_fifo, &fifo_buffer, 4) != 4) { ++ copied = kfifo_out(&priv->test.up_fifo, &fifo_buffer, sizeof(fifo_buffer)); ++ if (copied != sizeof(fifo_buffer)) { + dev_err( + &priv->spi->dev, + "test_interface: Wrong number of elements popped from upstream fifo\n" diff --git a/queue-6.1/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch b/queue-6.1/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch new file mode 100644 index 0000000000..c78b64e2d8 --- /dev/null +++ b/queue-6.1/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch @@ -0,0 +1,83 @@ +From 1bd6676254b4ab6acd44b662b5e92822c036463a Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Tue, 16 Jun 2026 22:24:24 +0800 +Subject: net: ena: clean up XDP TX queues when regular TX setup fails + +From: Dawei Feng + +commit 1bd6676254b4ab6acd44b662b5e92822c036463a upstream. + +create_queues_with_size_backoff() creates XDP TX queues before setting +up the regular TX path. If the subsequent allocation or creation of +regular TX queues fails, the error handling paths omit the teardown of the +XDP TX queues, leading to a resource leak. + +Fix this by explicitly destroying the XDP TX queue subset at the two +missing failure points. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still +present in v7.1-rc7. + +An x86_64 allyesconfig build showed no new warnings. As we do not have +an ENA device to test with, no runtime testing was able to be performed. + +Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") +Cc: stable@vger.kernel.org +Signed-off-by: Dawei Feng +Reviewed-by: Arthur Kiyanovski +Tested-by: Arthur Kiyanovski +Link: https://patch.msgid.link/20260616142424.4005130-1-dawei.feng@seu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1257,6 +1257,18 @@ static void ena_destroy_all_tx_queues(st + } + } + ++static void ena_destroy_xdp_tx_queues(struct ena_adapter *adapter) ++{ ++ u16 ena_qid; ++ int i; ++ ++ for (i = adapter->xdp_first_ring; ++ i < adapter->xdp_first_ring + adapter->xdp_num_queues; i++) { ++ ena_qid = ENA_IO_TXQ_IDX(i); ++ ena_com_destroy_io_queue(adapter->ena_dev, ena_qid); ++ } ++} ++ + static void ena_destroy_all_rx_queues(struct ena_adapter *adapter) + { + u16 ena_qid; +@@ -2618,14 +2630,21 @@ static int create_queues_with_size_backo + rc = ena_setup_tx_resources_in_range(adapter, + 0, + adapter->num_io_queues); +- if (rc) ++ if (rc) { ++ ena_destroy_xdp_tx_queues(adapter); ++ ena_free_all_io_tx_resources_in_range(adapter, ++ adapter->xdp_first_ring, ++ adapter->xdp_num_queues); + goto err_setup_tx; ++ } + + rc = ena_create_io_tx_queues_in_range(adapter, + 0, + adapter->num_io_queues); +- if (rc) ++ if (rc) { ++ ena_destroy_xdp_tx_queues(adapter); + goto err_create_tx_queues; ++ } + + rc = ena_setup_all_rx_resources(adapter); + if (rc) diff --git a/queue-6.1/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.1/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..7b54b8be88 --- /dev/null +++ b/queue-6.1/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,54 @@ +From f00a50876d2818bd6dc86fa98b3ef360884c53c8 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:39 +0800 +Subject: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit f00a50876d2818bd6dc86fa98b3ef360884c53c8 upstream. + +ip6gre_changelink() and ip6erspan_changelink() operate on at most two +netns, dev_net(dev) and the tunnel link netns t->net. They differ once +the device is created in or moved to a netns other than the one the +request runs in. The rtnl changelink path checks CAP_NET_ADMIN only +against dev_net(dev), so a caller privileged there but not in t->net can +rewrite a tunnel that lives in t->net. + +Gate both ops on rtnl_dev_link_net_capable() at their top, before any +attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 690afc165bb3 ("net: ip6_gre: fix moving ip6gre between namespaces") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-6-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_gre.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -2112,6 +2112,9 @@ static int ip6gre_changelink(struct net_ + struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id); + struct __ip6_tnl_parm p; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + t = ip6gre_changelink_common(dev, tb, data, &p, extack); + if (IS_ERR(t)) + return PTR_ERR(t); +@@ -2326,6 +2329,9 @@ static int ip6erspan_changelink(struct n + struct __ip6_tnl_parm p; + struct ip6gre_net *ign; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + ign = net_generic(t->net, ip6gre_net_id); + t = ip6gre_changelink_common(dev, tb, data, &p, extack); + if (IS_ERR(t)) diff --git a/queue-6.1/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.1/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..9b905ee510 --- /dev/null +++ b/queue-6.1/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From e2ac3b242c37dff323a964962e43854f4b1a2b79 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:40 +0800 +Subject: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit e2ac3b242c37dff323a964962e43854f4b1a2b79 upstream. + +vti6_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 61220ab34948 ("vti6: Enable namespace changing") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-7-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_vti.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -1053,6 +1053,9 @@ static int vti6_changelink(struct net_de + struct __ip6_tnl_parm p; + struct vti6_net *ip6n; + ++ if (!rtnl_dev_link_net_capable(dev, net)) ++ return -EPERM; ++ + ip6n = net_generic(net, vti6_net_id); + if (dev == ip6n->fb_tnl_dev) + return -EINVAL; diff --git a/queue-6.1/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.1/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..c1ce2b9819 --- /dev/null +++ b/queue-6.1/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From 95cceadbfd52d7239bd730afdda0655287d77425 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:37 +0800 +Subject: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 95cceadbfd52d7239bd730afdda0655287d77425 upstream. + +vti_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate vti_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 895de9a3488a ("vti4: Enable namespace changing") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-4-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_vti.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -579,6 +579,9 @@ static int vti_changelink(struct net_dev + __u32 fwmark = t->fwmark; + struct ip_tunnel_parm p; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + vti_netlink_parms(data, &p, &fwmark); + return ip_tunnel_changelink(dev, tb, &p, fwmark); + } diff --git a/queue-6.1/net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.1/net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..c458fa1506 --- /dev/null +++ b/queue-6.1/net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From 8211a26324667980a463c069469a818e71207e02 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:36 +0800 +Subject: net: ipip: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 8211a26324667980a463c069469a818e71207e02 upstream. + +ipip_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 6c742e714d8c ("ipip: add x-netns support") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-3-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ipip.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/ipip.c ++++ b/net/ipv4/ipip.c +@@ -457,6 +457,9 @@ static int ipip_changelink(struct net_de + bool collect_md; + __u32 fwmark = t->fwmark; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + if (ip_tunnel_netlink_encap_parms(data, &ipencap)) { + int err = ip_tunnel_encap_setup(t, &ipencap); + diff --git a/queue-6.1/net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch b/queue-6.1/net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch new file mode 100644 index 0000000000..76873eccc4 --- /dev/null +++ b/queue-6.1/net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch @@ -0,0 +1,54 @@ +From db818b0e8af7bac16860116a19c341a63d6677b4 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Mon, 22 Jun 2026 12:30:15 +0800 +Subject: net: ixp4xx_hss: fix duplicate HDLC netdev allocation + +From: Haoxiang Li + +commit db818b0e8af7bac16860116a19c341a63d6677b4 upstream. + +ixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored +in ndev, initialized, and registered with register_hdlc_device(). The +second one is stored in port->netdev and later used by the remove path +for unregister_hdlc_device() and free_netdev(). + +This means that the registered netdev is not the same object that is +unregistered and freed on remove. It also leaks the first allocation if +the second alloc_hdlcdev() call fails, and the first allocation is not +checked before ndev is used. + +Older code allocated the HDLC netdev only once and stored the same object +in both the local variable and port->netdev. The buggy conversion split +this into two alloc_hdlcdev() calls. A later rename changed the local +variable name to ndev, but the underlying mismatch remained. + +Fix this by allocating the HDLC netdev only once and assigning the same +object to port->netdev. + +Fixes: 99ebe65eb9c0 ("net: ixp4xx_hss: move out assignment in if condition") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Linus Walleij +Link: https://patch.msgid.link/20260622043015.643637-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wan/ixp4xx_hss.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wan/ixp4xx_hss.c ++++ b/drivers/net/wan/ixp4xx_hss.c +@@ -1487,11 +1487,11 @@ static int ixp4xx_hss_probe(struct platf + "unable to get CLK internal GPIO\n"); + + ndev = alloc_hdlcdev(port); +- port->netdev = alloc_hdlcdev(port); +- if (!port->netdev) { ++ if (!ndev) { + err = -ENOMEM; + goto err_plat; + } ++ port->netdev = ndev; + + SET_NETDEV_DEV(ndev, &pdev->dev); + hdlc = dev_to_hdlc(ndev); diff --git a/queue-6.1/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-6.1/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..3d369a1c27 --- /dev/null +++ b/queue-6.1/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,46 @@ +From 27ccb68e7cccead5d8c611665a45d23032d468b3 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 18 Jun 2026 15:08:17 +0800 +Subject: net: sit: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 27ccb68e7cccead5d8c611665a45d23032d468b3 upstream. + +ipip6_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. sit was the one tunnel type not covered +by the recent series that added this check to the other changelink() +handlers. + +Fixes: 5e6700b3bf98 ("sit: add support of x-netns") +Link: https://lore.kernel.org/netdev/20260612085941.3158249-1-maoyixie.tju@gmail.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Nicolas Dichtel +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260618070817.3378283-1-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/sit.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1615,6 +1615,9 @@ static int ipip6_changelink(struct net_d + __u32 fwmark = t->fwmark; + int err; + ++ if (!rtnl_dev_link_net_capable(dev, net)) ++ return -EPERM; ++ + if (dev == sitn->fb_tunnel_dev) + return -EINVAL; + diff --git a/queue-6.1/net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch b/queue-6.1/net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch new file mode 100644 index 0000000000..0344b576a1 --- /dev/null +++ b/queue-6.1/net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch @@ -0,0 +1,40 @@ +From 2bd6f26d4ce1e87de4d736b1e8896daf3acf1c0e Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Sun, 21 Jun 2026 11:17:14 +0800 +Subject: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure + +From: Haoxiang Li + +commit 2bd6f26d4ce1e87de4d736b1e8896daf3acf1c0e upstream. + +t7xx_cldma_late_init() creates md_ctrl->gpd_dmapool before +initializing the TX and RX rings. If any ring initialization +fails, the error path frees the already initialized rings but +leaves the DMA pool allocated. + +Destroy md_ctrl->gpd_dmapool on the late-init failure path +to avoid leaking the DMA pool. + +Fixes: 39d439047f1d ("net: wwan: t7xx: Add control DMA interface") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Loic Poulain +Link: https://patch.msgid.link/20260621031714.3605022-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/t7xx/t7xx_hif_cldma.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wwan/t7xx/t7xx_hif_cldma.c ++++ b/drivers/net/wwan/t7xx/t7xx_hif_cldma.c +@@ -1051,6 +1051,9 @@ err_free_tx_ring: + while (i--) + t7xx_cldma_ring_free(md_ctrl, &md_ctrl->tx_ring[i], DMA_TO_DEVICE); + ++ dma_pool_destroy(md_ctrl->gpd_dmapool); ++ md_ctrl->gpd_dmapool = NULL; ++ + return ret; + } + diff --git a/queue-6.1/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch b/queue-6.1/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch new file mode 100644 index 0000000000..fe66b4ff14 --- /dev/null +++ b/queue-6.1/posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch @@ -0,0 +1,53 @@ +From 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f Mon Sep 17 00:00:00 2001 +From: Zhan Xusheng +Date: Tue, 16 Jun 2026 19:20:17 +0800 +Subject: posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() + +From: Zhan Xusheng + +commit 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f upstream. + +update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with + + u64 nsecs = rlim_new * NSEC_PER_SEC; + +On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC +(1000000000L) are 32-bit, so the multiplication is performed in unsigned +long and truncated for rlim_new > 4 seconds before being widened to u64. + +The same file already casts to u64 for the matching computation in +check_process_timers(): + + u64 softns = (u64)soft * NSEC_PER_SEC; + +As a result, the truncated value is installed into the CPUCLOCK_PROF +expiry cache (nextevt), causing the process CPU timer to be programmed +to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The +actual SIGXCPU/SIGKILL decision in check_process_timers() already casts +to u64 and is therefore correct, so limit enforcement is not broken; +only the expiry-cache programming is wrong. Apply the same cast here so +both paths convert rlim_cur identically. + +64-bit kernels are unaffected. + +Fixes: 858cf3a8c599 ("timers/itimer: Convert internal cputime_t units to nsec") +Signed-off-by: Zhan Xusheng +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/posix-cpu-timers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -41,7 +41,7 @@ void posix_cputimers_group_init(struct p + */ + int update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new) + { +- u64 nsecs = rlim_new * NSEC_PER_SEC; ++ u64 nsecs = (u64)rlim_new * NSEC_PER_SEC; + unsigned long irq_fl; + + if (!lock_task_sighand(task, &irq_fl)) diff --git a/queue-6.1/series b/queue-6.1/series index 19dda6cc68..789b4f3e9b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -869,3 +869,20 @@ input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch input-ims-pcu-fix-race-condition-in-reset_device-sysfs-callback.patch input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch net-mlx5e-macsec-fix-use-after-free-of-metadata_dst-on-rx-sc-delete.patch +posix-cpu-timers-use-u64-multiplication-in-update_rlimit_cpu.patch +cpu-hotplug-preserve-per-instance-callback-errors.patch +cpu-hotplug-bound-hotplug-states-sysfs-output.patch +gpio-f7188x-add-support-for-nct6126d-version-b.patch +gpios-palmas-add-.get_direction-op.patch +net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-wwan-t7xx-destroy-dma-pool-on-cldma-late-init-failure.patch +net-ixp4xx_hss-fix-duplicate-hdlc-netdev-allocation.patch +net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch +net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ipip-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch +ieee802154-admin-gate-legacy-llsec-dump-operations.patch +ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch +ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch +ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch