From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 16:12:25 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6d7d0b144c8d8235fb3a9aa503226a8fac9d5876;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: cpu-hotplug-bound-hotplug-states-sysfs-output.patch cpu-hotplug-preserve-per-instance-callback-errors.patch gpios-palmas-add-.get_direction-op.patch ieee802154-admin-gate-legacy-llsec-dump-operations.patch ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch --- diff --git a/queue-5.15/cpu-hotplug-bound-hotplug-states-sysfs-output.patch b/queue-5.15/cpu-hotplug-bound-hotplug-states-sysfs-output.patch new file mode 100644 index 0000000000..1f433974a5 --- /dev/null +++ b/queue-5.15/cpu-hotplug-bound-hotplug-states-sysfs-output.patch @@ -0,0 +1,53 @@ +From 86f436567f2516a0083b210bedc933544826a2c3 Mon Sep 17 00:00:00 2001 +From: Bradley Morgan +Date: Fri, 19 Jun 2026 16:37:18 +0000 +Subject: cpu: hotplug: Bound hotplug states sysfs output + +From: Bradley Morgan + +commit 86f436567f2516a0083b210bedc933544826a2c3 upstream. + +states_show() adds CPU hotplug state names into a single sysfs buffer +using sprintf(). With enough registered states, this can write past the +end of the PAGE_SIZE buffer. + +Use sysfs_emit_at() so output is bounded. + +Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface") +Signed-off-by: Bradley Morgan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cpu.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -2436,21 +2436,17 @@ static const struct attribute_group cpuh + NULL + }; + +-static ssize_t states_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t states_show(struct device *dev, struct device_attribute *attr, char *buf) + { +- ssize_t cur, res = 0; ++ ssize_t res = 0; + int i; + + mutex_lock(&cpuhp_state_mutex); + for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) { + struct cpuhp_step *sp = cpuhp_get_step(i); + +- if (sp->name) { +- cur = sprintf(buf, "%3d: %s\n", i, sp->name); +- buf += cur; +- res += cur; +- } ++ if (sp->name) ++ res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name); + } + mutex_unlock(&cpuhp_state_mutex); + return res; diff --git a/queue-5.15/cpu-hotplug-preserve-per-instance-callback-errors.patch b/queue-5.15/cpu-hotplug-preserve-per-instance-callback-errors.patch new file mode 100644 index 0000000000..323bc36e72 --- /dev/null +++ b/queue-5.15/cpu-hotplug-preserve-per-instance-callback-errors.patch @@ -0,0 +1,53 @@ +From 673db10729fb121ea1b16fe57791a0cb9eac1eb5 Mon Sep 17 00:00:00 2001 +From: Bradley Morgan +Date: Fri, 19 Jun 2026 16:37:17 +0000 +Subject: cpu: hotplug: Preserve per instance callback errors + +From: Bradley Morgan + +commit 673db10729fb121ea1b16fe57791a0cb9eac1eb5 upstream. + +cpuhp_invoke_callback() unwinds earlier callbacks for the same +hotplug state when one instance fails. The rollback path currently +reuses ret, so a successful rollback can hide the original error and +make the failed transition look successful. + +Keep the rollback result separate from the original error. + +Fixes: 724a86881d03 ("smp/hotplug: Callback vs state-machine consistency") +Signed-off-by: Bradley Morgan +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260619163719.12103-1-include@grrlz.net +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cpu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -171,7 +171,7 @@ static int cpuhp_invoke_callback(unsigne + struct cpuhp_step *step = cpuhp_get_step(state); + int (*cbm)(unsigned int cpu, struct hlist_node *node); + int (*cb)(unsigned int cpu); +- int ret, cnt; ++ int ret, cnt, rollback_ret; + + if (st->fail == state) { + st->fail = CPUHP_INVALID; +@@ -235,12 +235,12 @@ err: + break; + + trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node); +- ret = cbm(cpu, node); +- trace_cpuhp_exit(cpu, st->state, state, ret); ++ rollback_ret = cbm(cpu, node); ++ trace_cpuhp_exit(cpu, st->state, state, rollback_ret); + /* + * Rollback must not fail, + */ +- WARN_ON_ONCE(ret); ++ WARN_ON_ONCE(rollback_ret); + } + return ret; + } diff --git a/queue-5.15/gpios-palmas-add-.get_direction-op.patch b/queue-5.15/gpios-palmas-add-.get_direction-op.patch new file mode 100644 index 0000000000..4b0966d7e5 --- /dev/null +++ b/queue-5.15/gpios-palmas-add-.get_direction-op.patch @@ -0,0 +1,58 @@ +From db4a79713ed8e252d5e4edf6eaaa80948b6855a2 Mon Sep 17 00:00:00 2001 +From: Andreas Kemnade +Date: Sat, 4 Jul 2026 10:40:54 +0200 +Subject: gpios: palmas: add .get_direction() op + +From: Andreas Kemnade + +commit db4a79713ed8e252d5e4edf6eaaa80948b6855a2 upstream. + +Accessing debug/gpio is quite noisy without a get_direction() +implementation. To calm that down add an implementation. + +Fixes: 3d50a2785271 ("gpio: palmas: Add support for Palmas GPIO") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: Andreas Kemnade +Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-palmas.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/drivers/gpio/gpio-palmas.c ++++ b/drivers/gpio/gpio-palmas.c +@@ -118,6 +118,24 @@ static int palmas_gpio_input(struct gpio + return ret; + } + ++static int palmas_gpio_get_direction(struct gpio_chip *gc, unsigned int offset) ++{ ++ struct palmas_gpio *pg = gpiochip_get_data(gc); ++ struct palmas *palmas = pg->palmas; ++ unsigned int val; ++ unsigned int reg; ++ int ret; ++ int gpio16 = (offset/8); ++ ++ offset %= 8; ++ reg = (gpio16) ? PALMAS_GPIO_DATA_DIR2 : PALMAS_GPIO_DATA_DIR; ++ ret = palmas_read(palmas, PALMAS_GPIO_BASE, reg, &val); ++ if (ret) ++ return ret; ++ ++ return (val & BIT(offset)) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN; ++} ++ + static int palmas_gpio_to_irq(struct gpio_chip *gc, unsigned offset) + { + struct palmas_gpio *pg = gpiochip_get_data(gc); +@@ -166,6 +184,7 @@ static int palmas_gpio_probe(struct plat + palmas_gpio->gpio_chip.can_sleep = true; + palmas_gpio->gpio_chip.direction_input = palmas_gpio_input; + palmas_gpio->gpio_chip.direction_output = palmas_gpio_output; ++ palmas_gpio->gpio_chip.get_direction = palmas_gpio_get_direction; + palmas_gpio->gpio_chip.to_irq = palmas_gpio_to_irq; + palmas_gpio->gpio_chip.set = palmas_gpio_set; + palmas_gpio->gpio_chip.get = palmas_gpio_get; diff --git a/queue-5.15/ieee802154-admin-gate-legacy-llsec-dump-operations.patch b/queue-5.15/ieee802154-admin-gate-legacy-llsec-dump-operations.patch new file mode 100644 index 0000000000..7164dbff31 --- /dev/null +++ b/queue-5.15/ieee802154-admin-gate-legacy-llsec-dump-operations.patch @@ -0,0 +1,98 @@ +From 9c1e0b6d49471a712511d23fc9d06901561135e8 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Wed, 20 May 2026 10:16:39 -0400 +Subject: ieee802154: admin-gate legacy LLSEC dump operations + +From: Michael Bommarito + +commit 9c1e0b6d49471a712511d23fc9d06901561135e8 upstream. + +In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table +builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, +LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which +sets no .flags, so generic netlink runs them ungated. The modern +nl802154 family admin-gates the equivalent reads via +NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. + +Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve +the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev +that has an LLSEC key installed; the dump handler writes the raw +16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied +verbatim from struct ieee802154_llsec_key.key) into the reply. +Recovering the AES key compromises 802.15.4 LLSEC link confidentiality +and authenticity, since LLSEC uses CCM* and the same key authenticates +and encrypts frames. + +Impact: any local uid with no capabilities can read the raw 16-byte +AES-128 LLSEC key from the kernel keytable on any wpan netdev that has +an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY +dump on the legacy IEEE802154_NL generic-netlink family. + +Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but +setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump +entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the +modern nl802154 family exposes their equivalents to unprivileged +readers by design (NL802154_CMD_GET_WPAN_PHY and +NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged +users" annotations). + +Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 +Signed-off-by: Michael Bommarito +Link: https://lore.kernel.org/20260520141640.1149513-2-michael.bommarito@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/ieee802154.h | 8 ++++++++ + net/ieee802154/netlink.c | 16 ++++++++-------- + 2 files changed, 16 insertions(+), 8 deletions(-) + +--- a/net/ieee802154/ieee802154.h ++++ b/net/ieee802154/ieee802154.h +@@ -23,6 +23,14 @@ void ieee802154_nl_exit(void); + .dumpit = _dump, \ + } + ++#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \ ++ { \ ++ .cmd = _cmd, \ ++ .doit = _func, \ ++ .dumpit = _dump, \ ++ .flags = GENL_ADMIN_PERM, \ ++ } ++ + struct genl_info; + + struct sk_buff *ieee802154_nl_create(int flags, u8 req); +--- a/net/ieee802154/netlink.c ++++ b/net/ieee802154/netlink.c +@@ -98,20 +98,20 @@ static const struct genl_small_ops ieee8 + IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams), + IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams), + IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL, +- ieee802154_llsec_dump_keys), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL, ++ ieee802154_llsec_dump_keys), + IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), + IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL, +- ieee802154_llsec_dump_devs), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL, ++ ieee802154_llsec_dump_devs), + IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), + IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL, +- ieee802154_llsec_dump_devkeys), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL, ++ ieee802154_llsec_dump_devkeys), + IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), + IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), +- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, +- ieee802154_llsec_dump_seclevels), ++ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, ++ ieee802154_llsec_dump_seclevels), + IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL, + ieee802154_llsec_add_seclevel), + IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL, diff --git a/queue-5.15/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch b/queue-5.15/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch new file mode 100644 index 0000000000..0de9daba83 --- /dev/null +++ b/queue-5.15/ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch @@ -0,0 +1,94 @@ +From a6bfdfcc6711d1d5a92e98644359dedc67c0c858 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Wed, 20 May 2026 10:16:40 -0400 +Subject: ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation + +From: Michael Bommarito + +commit a6bfdfcc6711d1d5a92e98644359dedc67c0c858 upstream. + +The LLSEC ADD/DEL doit handlers under the legacy IEEE802154_NL family +consume IEEE802154_ATTR_LLSEC_KEY_BYTES and +IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS, both declared in +net/ieee802154/nl_policy.c as bare length entries with no .type +(defaulting to NLA_UNSPEC). Generic netlink strict validation rejects +all NLA_UNSPEC attributes via validate_nla(), so every LLSEC_ADD_KEY, +LLSEC_DEL_KEY, LLSEC_ADD_DEV, LLSEC_DEL_DEV, LLSEC_ADD_DEVKEY, +LLSEC_DEL_DEVKEY, LLSEC_ADD_SECLEVEL, and LLSEC_DEL_SECLEVEL request +fails at the dispatcher with "Unsupported attribute" before reaching +the handler. + +The doit path has been silently dead since strict validation became +the default for genl families that do not opt out. The dump path is +unaffected because dump requests carry no LLSEC attributes to +validate, which is why the LLSEC_LIST_KEY read remained reachable +(patch 1/2). Introduce IEEE802154_OP_RELAXED() mirroring +IEEE802154_OP() but with .validate = GENL_DONT_VALIDATE_STRICT, and +use it for the eight legacy LLSEC mutate ops so admin-driven LLSEC +configuration via the legacy interface works again. + +Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 +Signed-off-by: Michael Bommarito +Link: https://lore.kernel.org/20260520141640.1149513-3-michael.bommarito@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/ieee802154.h | 9 +++++++++ + net/ieee802154/netlink.c | 20 ++++++++++---------- + 2 files changed, 19 insertions(+), 10 deletions(-) + +--- a/net/ieee802154/ieee802154.h ++++ b/net/ieee802154/ieee802154.h +@@ -16,6 +16,15 @@ void ieee802154_nl_exit(void); + .flags = GENL_ADMIN_PERM, \ + } + ++#define IEEE802154_OP_RELAXED(_cmd, _func) \ ++ { \ ++ .cmd = _cmd, \ ++ .doit = _func, \ ++ .dumpit = NULL, \ ++ .flags = GENL_ADMIN_PERM, \ ++ .validate = GENL_DONT_VALIDATE_STRICT,\ ++ } ++ + #define IEEE802154_DUMP(_cmd, _func, _dump) \ + { \ + .cmd = _cmd, \ +--- a/net/ieee802154/netlink.c ++++ b/net/ieee802154/netlink.c +@@ -100,22 +100,22 @@ static const struct genl_small_ops ieee8 + IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL, + ieee802154_llsec_dump_keys), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL, + ieee802154_llsec_dump_devs), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL, + ieee802154_llsec_dump_devkeys), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, + ieee802154_llsec_dump_seclevels), +- IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL, +- ieee802154_llsec_add_seclevel), +- IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL, +- ieee802154_llsec_del_seclevel), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_SECLEVEL, ++ ieee802154_llsec_add_seclevel), ++ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_SECLEVEL, ++ ieee802154_llsec_del_seclevel), + }; + + static const struct genl_multicast_group ieee802154_mcgrps[] = { diff --git a/queue-5.15/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch b/queue-5.15/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch new file mode 100644 index 0000000000..77a6f6d57a --- /dev/null +++ b/queue-5.15/ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch @@ -0,0 +1,55 @@ +From e09390e439bd7cca30dd10893b1f64802961667a Mon Sep 17 00:00:00 2001 +From: Shitalkumar Gandhi +Date: Tue, 21 Apr 2026 13:02:59 +0530 +Subject: ieee802154: ca8210: fix cas_ctl leak on spi_async failure + +From: Shitalkumar Gandhi + +commit e09390e439bd7cca30dd10893b1f64802961667a upstream. + +ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) +and relies entirely on the SPI completion callback +ca8210_spi_transfer_complete() to free it. + +The spi_async() API only invokes the completion callback on successful +submission. On failure it returns a negative error code without ever +queuing the callback, which leaves cas_ctl and its embedded spi_message +and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is +inside the completion callback, so there is no other reclamation path. + +ca8210_spi_transfer() is called from ca8210_spi_exchange(), the +interrupt handler ca8210_interrupt_handler(), and from the retry path +inside the completion callback itself. The exchange and interrupt +handler paths loop on -EBUSY, so under sustained SPI bus contention +every retry iteration leaks a fresh cas_ctl (~600 bytes per +occurrence). + +Fix it by freeing cas_ctl on the spi_async() error path. While here, +correct the misleading error string: the function calls spi_async(), +not spi_sync(). + +Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Shitalkumar Gandhi +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/20260421073259.2259783-1-shitalkumar.gandhi@cambiumnetworks.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/ca8210.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -963,9 +963,10 @@ static int ca8210_spi_transfer( + if (status < 0) { + dev_crit( + &spi->dev, +- "status %d from spi_sync in write\n", ++ "status %d from spi_async in write\n", + status + ); ++ kfree(cas_ctl); + } + + return status; diff --git a/queue-5.15/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch b/queue-5.15/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch new file mode 100644 index 0000000000..55fe0fdaaf --- /dev/null +++ b/queue-5.15/ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch @@ -0,0 +1,71 @@ +From 6d7f7bcf225b2d566176bf6229dbd1252940cb3c Mon Sep 17 00:00:00 2001 +From: Shitalkumar Gandhi +Date: Wed, 20 May 2026 16:27:50 +0530 +Subject: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit + +From: Shitalkumar Gandhi + +commit 6d7f7bcf225b2d566176bf6229dbd1252940cb3c upstream. + +ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange +a kmalloc'd buffer pointer through a struct kfifo, but pass a literal +'4' as the byte count to kfifo_in()/kfifo_out(). + +This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the +low 4 bytes of the 8-byte pointer are written into the FIFO. The reader +then reads back 4 bytes into an 8-byte local pointer variable, leaving +the upper 4 bytes uninitialized stack data. The first dereference of +the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel +address and generally results in an oops. + +Use sizeof(fifo_buffer) so the byte count matches pointer width on every +architecture. + +The driver has no architecture restriction in Kconfig, so any 64-bit +build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has +been latent since the driver was added in 2017 because it is most +commonly deployed on 32-bit MCUs. + +Found via a custom Coccinelle semantic patch hunting for short-byte +kfifo I/O on byte-mode kfifos used to shuttle pointers. + +Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Shitalkumar Gandhi +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/20260520105750.30144-1-shitalkumar.gandhi@cambiumnetworks.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/ca8210.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -639,7 +639,7 @@ static int ca8210_test_int_driver_write( + fifo_buffer = kmemdup(buf, len, GFP_KERNEL); + if (!fifo_buffer) + return -ENOMEM; +- kfifo_in(&test->up_fifo, &fifo_buffer, 4); ++ kfifo_in(&test->up_fifo, &fifo_buffer, sizeof(fifo_buffer)); + wake_up_interruptible(&priv->test.readq); + + return 0; +@@ -2571,6 +2571,7 @@ static ssize_t ca8210_test_int_user_read + struct ca8210_priv *priv = filp->private_data; + unsigned char *fifo_buffer; + unsigned long bytes_not_copied; ++ unsigned int copied; + + if (filp->f_flags & O_NONBLOCK) { + /* Non-blocking mode */ +@@ -2584,7 +2585,8 @@ static ssize_t ca8210_test_int_user_read + ); + } + +- if (kfifo_out(&priv->test.up_fifo, &fifo_buffer, 4) != 4) { ++ copied = kfifo_out(&priv->test.up_fifo, &fifo_buffer, sizeof(fifo_buffer)); ++ if (copied != sizeof(fifo_buffer)) { + dev_err( + &priv->spi->dev, + "test_interface: Wrong number of elements popped from upstream fifo\n" diff --git a/queue-5.15/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch b/queue-5.15/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch new file mode 100644 index 0000000000..e8dc8bbfb3 --- /dev/null +++ b/queue-5.15/net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch @@ -0,0 +1,83 @@ +From 1bd6676254b4ab6acd44b662b5e92822c036463a Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Tue, 16 Jun 2026 22:24:24 +0800 +Subject: net: ena: clean up XDP TX queues when regular TX setup fails + +From: Dawei Feng + +commit 1bd6676254b4ab6acd44b662b5e92822c036463a upstream. + +create_queues_with_size_backoff() creates XDP TX queues before setting +up the regular TX path. If the subsequent allocation or creation of +regular TX queues fails, the error handling paths omit the teardown of the +XDP TX queues, leading to a resource leak. + +Fix this by explicitly destroying the XDP TX queue subset at the two +missing failure points. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still +present in v7.1-rc7. + +An x86_64 allyesconfig build showed no new warnings. As we do not have +an ENA device to test with, no runtime testing was able to be performed. + +Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") +Cc: stable@vger.kernel.org +Signed-off-by: Dawei Feng +Reviewed-by: Arthur Kiyanovski +Tested-by: Arthur Kiyanovski +Link: https://patch.msgid.link/20260616142424.4005130-1-dawei.feng@seu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1257,6 +1257,18 @@ static void ena_destroy_all_tx_queues(st + } + } + ++static void ena_destroy_xdp_tx_queues(struct ena_adapter *adapter) ++{ ++ u16 ena_qid; ++ int i; ++ ++ for (i = adapter->xdp_first_ring; ++ i < adapter->xdp_first_ring + adapter->xdp_num_queues; i++) { ++ ena_qid = ENA_IO_TXQ_IDX(i); ++ ena_com_destroy_io_queue(adapter->ena_dev, ena_qid); ++ } ++} ++ + static void ena_destroy_all_rx_queues(struct ena_adapter *adapter) + { + u16 ena_qid; +@@ -2620,14 +2632,21 @@ static int create_queues_with_size_backo + rc = ena_setup_tx_resources_in_range(adapter, + 0, + adapter->num_io_queues); +- if (rc) ++ if (rc) { ++ ena_destroy_xdp_tx_queues(adapter); ++ ena_free_all_io_tx_resources_in_range(adapter, ++ adapter->xdp_first_ring, ++ adapter->xdp_num_queues); + goto err_setup_tx; ++ } + + rc = ena_create_io_tx_queues_in_range(adapter, + 0, + adapter->num_io_queues); +- if (rc) ++ if (rc) { ++ ena_destroy_xdp_tx_queues(adapter); + goto err_create_tx_queues; ++ } + + rc = ena_setup_all_rx_resources(adapter); + if (rc) diff --git a/queue-5.15/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-5.15/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..624342b6aa --- /dev/null +++ b/queue-5.15/net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,54 @@ +From f00a50876d2818bd6dc86fa98b3ef360884c53c8 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:39 +0800 +Subject: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit f00a50876d2818bd6dc86fa98b3ef360884c53c8 upstream. + +ip6gre_changelink() and ip6erspan_changelink() operate on at most two +netns, dev_net(dev) and the tunnel link netns t->net. They differ once +the device is created in or moved to a netns other than the one the +request runs in. The rtnl changelink path checks CAP_NET_ADMIN only +against dev_net(dev), so a caller privileged there but not in t->net can +rewrite a tunnel that lives in t->net. + +Gate both ops on rtnl_dev_link_net_capable() at their top, before any +attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 690afc165bb3 ("net: ip6_gre: fix moving ip6gre between namespaces") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-6-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_gre.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -2091,6 +2091,9 @@ static int ip6gre_changelink(struct net_ + struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id); + struct __ip6_tnl_parm p; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + t = ip6gre_changelink_common(dev, tb, data, &p, extack); + if (IS_ERR(t)) + return PTR_ERR(t); +@@ -2305,6 +2308,9 @@ static int ip6erspan_changelink(struct n + struct __ip6_tnl_parm p; + struct ip6gre_net *ign; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + ign = net_generic(t->net, ip6gre_net_id); + t = ip6gre_changelink_common(dev, tb, data, &p, extack); + if (IS_ERR(t)) diff --git a/queue-5.15/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-5.15/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..6184ea1041 --- /dev/null +++ b/queue-5.15/net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From e2ac3b242c37dff323a964962e43854f4b1a2b79 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:40 +0800 +Subject: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit e2ac3b242c37dff323a964962e43854f4b1a2b79 upstream. + +vti6_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 61220ab34948 ("vti6: Enable namespace changing") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-7-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_vti.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -1052,6 +1052,9 @@ static int vti6_changelink(struct net_de + struct __ip6_tnl_parm p; + struct vti6_net *ip6n; + ++ if (!rtnl_dev_link_net_capable(dev, net)) ++ return -EPERM; ++ + ip6n = net_generic(net, vti6_net_id); + if (dev == ip6n->fb_tnl_dev) + return -EINVAL; diff --git a/queue-5.15/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-5.15/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..c1ce2b9819 --- /dev/null +++ b/queue-5.15/net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,44 @@ +From 95cceadbfd52d7239bd730afdda0655287d77425 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Fri, 12 Jun 2026 16:59:37 +0800 +Subject: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 95cceadbfd52d7239bd730afdda0655287d77425 upstream. + +vti_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate vti_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. + +Reported-by: Xiao Liang +Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ +Fixes: 895de9a3488a ("vti4: Enable namespace changing") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260612085941.3158249-4-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_vti.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -579,6 +579,9 @@ static int vti_changelink(struct net_dev + __u32 fwmark = t->fwmark; + struct ip_tunnel_parm p; + ++ if (!rtnl_dev_link_net_capable(dev, t->net)) ++ return -EPERM; ++ + vti_netlink_parms(data, &p, &fwmark); + return ip_tunnel_changelink(dev, tb, &p, fwmark); + } diff --git a/queue-5.15/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch b/queue-5.15/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch new file mode 100644 index 0000000000..43672689a3 --- /dev/null +++ b/queue-5.15/net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch @@ -0,0 +1,46 @@ +From 27ccb68e7cccead5d8c611665a45d23032d468b3 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 18 Jun 2026 15:08:17 +0800 +Subject: net: sit: require CAP_NET_ADMIN in the device netns for changelink + +From: Maoyi Xie + +commit 27ccb68e7cccead5d8c611665a45d23032d468b3 upstream. + +ipip6_changelink() operates on at most two netns, dev_net(dev) and the +tunnel link netns t->net. They differ once the device is created in or +moved to a netns other than the one the request runs in. The rtnl +changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a +caller privileged there but not in t->net can rewrite a tunnel that +lives in t->net. + +Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top, +before any attribute is parsed. sit was the one tunnel type not covered +by the recent series that added this check to the other changelink() +handlers. + +Fixes: 5e6700b3bf98 ("sit: add support of x-netns") +Link: https://lore.kernel.org/netdev/20260612085941.3158249-1-maoyixie.tju@gmail.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Nicolas Dichtel +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260618070817.3378283-1-maoyixie.tju@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/sit.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1679,6 +1679,9 @@ static int ipip6_changelink(struct net_d + __u32 fwmark = t->fwmark; + int err; + ++ if (!rtnl_dev_link_net_capable(dev, net)) ++ return -EPERM; ++ + if (dev == sitn->fb_tunnel_dev) + return -EINVAL; + diff --git a/queue-5.15/series b/queue-5.15/series index 31d588f4cd..8b1c8162ad 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -678,3 +678,15 @@ input-ims-pcu-fix-dma-mapping-violation-in-line-setup.patch input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch +cpu-hotplug-preserve-per-instance-callback-errors.patch +cpu-hotplug-bound-hotplug-states-sysfs-output.patch +gpios-palmas-add-.get_direction-op.patch +net-sit-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ena-clean-up-xdp-tx-queues-when-regular-tx-setup-fails.patch +net-ip6_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ip_vti-require-cap_net_admin-in-the-device-netns-for-changelink.patch +net-ip6_gre-require-cap_net_admin-in-the-device-netns-for-changelink.patch +ieee802154-admin-gate-legacy-llsec-dump-operations.patch +ieee802154-allow-legacy-llsec-add-del-ops-to-pass-strict-validation.patch +ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch +ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch