From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:10:04 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb918c7e1e27a608d41f4401a08b19563e011d46;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: acpi-tad-check-ac-wake-capability-before-enabling-wakeup.patch ata-libata-core-add-nolpm-quirk-for-pny-cs900-1tb-ssd.patch ata-libata-core-reject-an-invalid-concurrent-positioning-ranges-count.patch ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch fhandle-reject-detached-mounts-in-capable_wrt_mount.patch fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch hwmon-max1619-add-missing-select-regmap-to-kconfig.patch hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch net-lan743x-initialize-eth_syslock-spinlock-before-use.patch net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch riscv-probes-save-original-sp-in-rethook-trampoline.patch tracing-probes-fix-double-addition-of-offset-for-foffset.patch --- diff --git a/queue-7.1/acpi-tad-check-ac-wake-capability-before-enabling-wakeup.patch b/queue-7.1/acpi-tad-check-ac-wake-capability-before-enabling-wakeup.patch new file mode 100644 index 0000000000..131b6e579b --- /dev/null +++ b/queue-7.1/acpi-tad-check-ac-wake-capability-before-enabling-wakeup.patch @@ -0,0 +1,39 @@ +From 8522d806d84e2c3816c275ae6dd79e124c1b3dac Mon Sep 17 00:00:00 2001 +From: Xu Rao +Date: Thu, 25 Jun 2026 21:29:03 +0800 +Subject: ACPI: TAD: Check AC wake capability before enabling wakeup + +From: Xu Rao + +commit 8522d806d84e2c3816c275ae6dd79e124c1b3dac upstream. + +ACPI_TAD_AC_WAKE is a non-zero bit definition, so testing the macro +itself is always true. As a result, every TAD device is initialized as +a system wakeup device, including RTC-only devices and devices whose +wake capability bits were cleared because _PRW is absent. + +Test the capability value returned by _GCP instead. This keeps +RTC-only TAD devices usable without advertising a wakeup capability +that the firmware does not provide. + +Fixes: 6c711fde3a1c ("ACPI: TAD: Support RTC without wakeup") +Cc: All applicable +Signed-off-by: Xu Rao +Link: https://patch.msgid.link/961A84FF37B50665+20260625132903.2840457-1-raoxu@uniontech.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_tad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/acpi_tad.c ++++ b/drivers/acpi/acpi_tad.c +@@ -856,7 +856,7 @@ static int acpi_tad_probe(struct platfor + * runtime suspend. Everything else should be taken care of by the ACPI + * PM domain callbacks. + */ +- if (ACPI_TAD_AC_WAKE) { ++ if (caps & ACPI_TAD_AC_WAKE) { + device_init_wakeup(dev, true); + dev_pm_set_driver_flags(dev, DPM_FLAG_SMART_SUSPEND | + DPM_FLAG_MAY_SKIP_RESUME); diff --git a/queue-7.1/ata-libata-core-add-nolpm-quirk-for-pny-cs900-1tb-ssd.patch b/queue-7.1/ata-libata-core-add-nolpm-quirk-for-pny-cs900-1tb-ssd.patch new file mode 100644 index 0000000000..111a05f91d --- /dev/null +++ b/queue-7.1/ata-libata-core-add-nolpm-quirk-for-pny-cs900-1tb-ssd.patch @@ -0,0 +1,39 @@ +From 462775c620197adaabc983ce847e5b9878ff4cb0 Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Fri, 19 Jun 2026 21:54:02 -0500 +Subject: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD + +From: Bryam Vargas + +commit 462775c620197adaabc983ce847e5b9878ff4cb0 upstream. + +The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus +after entering Device-Initiated Slumber during idle. With the default +med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) +and does not recover, forcing the filesystem read-only. Forcing +max_performance keeps the link stable across prolonged idle. + +Add a NOLPM quirk so link power management is disabled for this drive +specifically, leaving it intact for other devices on the host. + +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4295,6 +4295,9 @@ static const struct ata_dev_quirks_entry + /* Apacer models with LPM issues */ + { "Apacer AS340*", NULL, ATA_QUIRK_NOLPM }, + ++ /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ ++ { "PNY CS900 1TB SSD", NULL, ATA_QUIRK_NOLPM }, ++ + /* Silicon Motion models with LPM issues */ + { "MD619HXCLDE3TC", "TCVAID", ATA_QUIRK_NOLPM }, + { "MD619GXCLDE3TC", "TCV35D", ATA_QUIRK_NOLPM }, diff --git a/queue-7.1/ata-libata-core-reject-an-invalid-concurrent-positioning-ranges-count.patch b/queue-7.1/ata-libata-core-reject-an-invalid-concurrent-positioning-ranges-count.patch new file mode 100644 index 0000000000..c6709fa87c --- /dev/null +++ b/queue-7.1/ata-libata-core-reject-an-invalid-concurrent-positioning-ranges-count.patch @@ -0,0 +1,95 @@ +From 533a0b940f901c15e5cbbd4b5d66e871c209e8ce Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Mon, 22 Jun 2026 22:23:45 -0500 +Subject: ata: libata-core: Reject an invalid concurrent positioning ranges count + +From: Bryam Vargas + +commit 533a0b940f901c15e5cbbd4b5d66e871c209e8ce upstream. + +ata_dev_config_cpr() takes the number of range descriptors from buf[0] +of the concurrent positioning ranges log (up to 255), which the device +reports independently of the log size in the GPL directory. The count is +then walked at a fixed 32-byte stride in two places with no bound: the +log read here, and the INQUIRY VPD page B9h emitter, which writes one +descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device +reporting a count larger than its own log overflows the read buffer (up +to 7704 bytes past a 512-byte slab), and a count above 62 overflows the +response buffer on the emit side. + +Bound the count once, on probe, against both the log the device returned +and the number of descriptors the VPD B9h response buffer can hold +(ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range +count with a warning; this keeps the emitter in bounds with no separate +change there. + +Suggested-by: Damien Le Moal +Fixes: fe22e1c2f705 ("libata: support concurrent positioning ranges log") +Fixes: c745dfc541e7 ("libata: fix reading concurrent positioning ranges log") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 18 ++++++++++++++++++ + drivers/ata/libata-scsi.c | 2 -- + drivers/ata/libata.h | 9 +++++++++ + 3 files changed, 27 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2847,6 +2847,24 @@ static void ata_dev_config_cpr(struct at + if (!nr_cpr) + goto out; + ++ /* ++ * The device reports the number of CPR descriptors independently of the ++ * log size, and that count is also used to emit VPD page B9h into the ++ * fixed-size rbuf. Reject a count larger than what that buffer can hold ++ * (ATA_DEV_MAX_CPR) or larger than the log the device actually returned. ++ */ ++ if (nr_cpr > ATA_DEV_MAX_CPR) { ++ ata_dev_warn(dev, ++ "Too many concurrent positioning ranges\n"); ++ goto out; ++ } ++ ++ if (buf_len < 64 + (size_t)nr_cpr * 32) { ++ ata_dev_warn(dev, ++ "Invalid number of concurrent positioning ranges\n"); ++ goto out; ++ } ++ + cpr_log = kzalloc_flex(*cpr_log, cpr, nr_cpr); + if (!cpr_log) + goto out; +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -37,8 +37,6 @@ + #include "libata.h" + #include "libata-transport.h" + +-#define ATA_SCSI_RBUF_SIZE 2048 +- + static DEFINE_SPINLOCK(ata_scsi_rbuf_lock); + static u8 ata_scsi_rbuf[ATA_SCSI_RBUF_SIZE]; + +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -148,6 +148,15 @@ static inline bool ata_acpi_dev_manage_r + #endif + + /* libata-scsi.c */ ++#define ATA_SCSI_RBUF_SIZE 2048 ++ ++/* ++ * Maximum number of concurrent positioning ranges (CPR) supported. The ACS ++ * specifications allow up to 255, but we limit this to the number of CPR ++ * descriptors that fit in the rbuf buffer used to emit VPD page B9h. ++ */ ++#define ATA_DEV_MAX_CPR min(255, ((ATA_SCSI_RBUF_SIZE - 64) / 32)) ++ + extern struct ata_device *ata_scsi_find_dev(struct ata_port *ap, + const struct scsi_device *scsidev); + extern int ata_scsi_add_hosts(struct ata_host *host, diff --git a/queue-7.1/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch b/queue-7.1/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch new file mode 100644 index 0000000000..dee8ce4bb6 --- /dev/null +++ b/queue-7.1/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch @@ -0,0 +1,38 @@ +From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Thu, 25 Jun 2026 22:18:37 +0800 +Subject: ata: pata_pxa: Fix DMA channel leak on probe error + +From: Wentao Liang + +commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream. + +When dmaengine_slave_config() fails, the DMA channel acquired by +dma_request_chan() is not released before returning the error, +leaking the channel reference. + +Fix by adding dma_release_channel() in the error path. + +The ata_host_activate() error path already correctly releases the +DMA channel. + +Cc: stable@vger.kernel.org +Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion") +Signed-off-by: Wentao Liang +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_pxa.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/pata_pxa.c ++++ b/drivers/ata/pata_pxa.c +@@ -286,6 +286,7 @@ static int pxa_ata_probe(struct platform + ret = dmaengine_slave_config(data->dma_chan, &config); + if (ret < 0) { + dev_err(&pdev->dev, "dma configuration failed: %d\n", ret); ++ dma_release_channel(data->dma_chan); + return ret; + } + diff --git a/queue-7.1/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch b/queue-7.1/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch new file mode 100644 index 0000000000..8201abf51a --- /dev/null +++ b/queue-7.1/fhandle-reject-detached-mounts-in-capable_wrt_mount.patch @@ -0,0 +1,48 @@ +From 6c732471740bc2ac9b0946134f9f551dc75f4369 Mon Sep 17 00:00:00 2001 +From: David Lee +Date: Wed, 1 Jul 2026 11:44:28 +0000 +Subject: fhandle: reject detached mounts in capable_wrt_mount() + +From: David Lee + +commit 6c732471740bc2ac9b0946134f9f551dc75f4369 upstream. + +The recent fhandle RCU fix moved the mount namespace capability check +into capable_wrt_mount(), so a non-NULL mnt_namespace survives the +ns_capable() dereference. The helper still assumes the later +READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh() +checked is_mounted() first. + +That assumption is not stable. A detached mount from +open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while +open_by_handle_at() is between those checks, and umount_tree() can +clear mount->mnt_ns. If the helper observes NULL, it dereferences +mnt_ns->user_ns and panics. + +Return false when the RCU read observes a detached mount. This keeps +the relaxed permission path conservative: a mount no longer attached +to a namespace cannot authorize open_by_handle_at() access. + +Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") +Cc: stable@vger.kernel.org +Signed-off-by: David Lee +Assisted-by: LLM +Link: https://patch.msgid.link/20260701114438.24431-1-david.lee@trailofbits.com +Reviewed-by: Jeff Layton +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/fhandle.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -295,7 +295,7 @@ static bool capable_wrt_mount(struct mou + */ + guard(rcu)(); + mnt_ns = READ_ONCE(mount->mnt_ns); +- return ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); ++ return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN); + } + + static inline int may_decode_fh(struct handle_to_path_ctx *ctx, diff --git a/queue-7.1/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch b/queue-7.1/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch new file mode 100644 index 0000000000..351a74b6f6 --- /dev/null +++ b/queue-7.1/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch @@ -0,0 +1,41 @@ +From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Thu, 25 Jun 2026 08:48:34 +0800 +Subject: fsl/fman: Free init resources on KeyGen failure in fman_init() + +From: Haoxiang Li + +commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream. + +fman_muram_alloc() allocates initialization resources before +initializing the KeyGen block. If keygen_init() fails, the +function returns -EINVAL directly and leaves those resources +allocated. Free the initialization resources before returning +from the KeyGen failure path. + +Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen") +Cc: stable@kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Pavan Chebbi +Reviewed-by: Breno Leitao +Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fman/fman.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -1995,8 +1995,10 @@ static int fman_init(struct fman *fman) + + /* Init KeyGen */ + fman->keygen = keygen_init(fman->kg_regs); +- if (!fman->keygen) ++ if (!fman->keygen) { ++ free_init_resources(fman); + return -EINVAL; ++ } + + err = enable(fman, cfg); + if (err != 0) diff --git a/queue-7.1/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch b/queue-7.1/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch new file mode 100644 index 0000000000..a3f94f9ccb --- /dev/null +++ b/queue-7.1/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch @@ -0,0 +1,47 @@ +From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Fri, 19 Jun 2026 21:27:46 +0900 +Subject: hwmon: (asus_atk0110) Check package count before accessing element + +From: HyeongJun An + +commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream. + +atk_ec_present() walks the management group package returned by the GGRP +ACPI method and, for each sub-package, reads its first element: + + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + +without checking that the sub-package is non-empty. ACPICA allocates the +element array with exactly package.count entries, so for a sub-package +with a zero count this reads past the allocation. + +The sibling function atk_debugfs_ggrp_open() performs the same access but +skips empty packages with a package.count check first. Add the same +check to atk_ec_present() so a malformed firmware package cannot trigger +an out-of-bounds read. + +Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/asus_atk0110.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat + if (obj->type != ACPI_TYPE_PACKAGE) + continue; + ++ if (!obj->package.count) ++ continue; ++ + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + continue; diff --git a/queue-7.1/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch b/queue-7.1/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch new file mode 100644 index 0000000000..bcb4b3be8c --- /dev/null +++ b/queue-7.1/hwmon-max1619-add-missing-select-regmap-to-kconfig.patch @@ -0,0 +1,33 @@ +From 943a749bdffdd2132fab9240db890e07d93e1fcf Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Mon, 29 Jun 2026 21:17:39 +0200 +Subject: hwmon: (max1619) add missing 'select REGMAP' to Kconfig + +From: Joshua Crofts + +commit 943a749bdffdd2132fab9240db890e07d93e1fcf upstream. + +The Kconfig entry for the MAX1619 sensor doesn't contain a +`select REGMAP` parameter, causing build failures if regmap +isn't selected previously during the build process. + +Fixes: f8016132ce49 ("hwmon: (max1619) Convert to use regmap") +Cc: stable@vger.kernel.org +Signed-off-by: Joshua Crofts +Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-1-8104df929b1a@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1215,6 +1215,7 @@ config SENSORS_MAX16065 + config SENSORS_MAX1619 + tristate "Maxim MAX1619 sensor chip" + depends on I2C ++ select REGMAP + help + If you say yes here you get support for MAX1619 sensor chip. + diff --git a/queue-7.1/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch b/queue-7.1/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch new file mode 100644 index 0000000000..c47f64fe53 --- /dev/null +++ b/queue-7.1/hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch @@ -0,0 +1,163 @@ +From e31408734332b8cc611342cdaaab6ba492180156 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Fri, 19 Jun 2026 09:59:38 +0800 +Subject: hwmon: (occ) unregister sysfs devices outside occ lock + +From: Runyu Xiao + +commit e31408734332b8cc611342cdaaab6ba492180156 upstream. + +occ_active(false) and occ_shutdown() unregister sysfs-backed devices while +occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can +wait for active sysfs callbacks to drain, and those callbacks can enter the +OCC update path and try to take occ->lock again. That gives the unregister +paths the lock ordering occ->lock -> sysfs callback drain, while a callback +has the opposite edge sysfs callback -> occ->lock. + +This issue was found by our static analysis tool and then manually +reviewed against the current tree. + +The grounded PoC kept the real unregister and callback carrier: + + occ_shutdown() + hwmon_device_unregister() + occ_show_temp_1() + occ_update_response() + +Lockdep reported the circular dependency with occ_shutdown() already +holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs +side: + + WARNING: possible circular locking dependency detected + ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv] + ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv] + occ_update_response.isra.0+0xb/0x20 [vuln_msv] + occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv] + *** DEADLOCK *** + +Serialize hwmon registration and removal with a separate hwmon_lock. +Under that lock, detach occ->hwmon and update occ->active while occ->lock +is held so concurrent OCC state changes still see a stable state, then +drop occ->lock before calling hwmon_device_unregister(). Remove the +driver sysfs group before taking occ->lock in occ_shutdown(), so draining +the driver attributes cannot wait while the OCC mutex is held. Also make +OCC update callbacks return -ENODEV after deactivation, so callbacks that +already passed sysfs active protection do not poll the hardware after +teardown has detached the hwmon device. + +Fixes: 849b0156d996 ("hwmon: (occ) Delay hwmon registration until user request") +Fixes: ac6888ac5a11 ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Link: https://lore.kernel.org/r/20260619015938.494464-1-runyu.xiao@seu.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/occ/common.c | 34 ++++++++++++++++++++++++++++------ + drivers/hwmon/occ/common.h | 1 + + 2 files changed, 29 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -214,6 +214,11 @@ int occ_update_response(struct occ *occ) + if (rc) + return rc; + ++ if (!occ->active) { ++ rc = -ENODEV; ++ goto unlock; ++ } ++ + /* limit the maximum rate of polling the OCC */ + if (time_after(jiffies, occ->next_update)) { + rc = occ_poll(occ); +@@ -222,6 +227,7 @@ int occ_update_response(struct occ *occ) + rc = occ->last_error; + } + ++unlock: + mutex_unlock(&occ->lock); + return rc; + } +@@ -1105,11 +1111,16 @@ static void occ_parse_poll_response(stru + + int occ_active(struct occ *occ, bool active) + { +- int rc = mutex_lock_interruptible(&occ->lock); ++ struct device *hwmon = NULL; ++ int rc = mutex_lock_interruptible(&occ->hwmon_lock); + + if (rc) + return rc; + ++ rc = mutex_lock_interruptible(&occ->lock); ++ if (rc) ++ goto unlock_hwmon; ++ + if (active) { + if (occ->active) { + rc = -EALREADY; +@@ -1154,14 +1165,17 @@ int occ_active(struct occ *occ, bool act + goto unlock; + } + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ hwmon = occ->hwmon; + occ->active = false; + occ->hwmon = NULL; + } + + unlock: + mutex_unlock(&occ->lock); ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++unlock_hwmon: ++ mutex_unlock(&occ->hwmon_lock); + return rc; + } + +@@ -1170,6 +1184,7 @@ int occ_setup(struct occ *occ) + int rc; + + mutex_init(&occ->lock); ++ mutex_init(&occ->hwmon_lock); + occ->groups[0] = &occ->group; + + rc = occ_setup_sysfs(occ); +@@ -1190,15 +1205,22 @@ EXPORT_SYMBOL_GPL(occ_setup); + + void occ_shutdown(struct occ *occ) + { +- mutex_lock(&occ->lock); ++ struct device *hwmon; + + occ_shutdown_sysfs(occ); + +- if (occ->hwmon) +- hwmon_device_unregister(occ->hwmon); ++ mutex_lock(&occ->hwmon_lock); ++ mutex_lock(&occ->lock); ++ ++ hwmon = occ->hwmon; ++ occ->active = false; + occ->hwmon = NULL; + + mutex_unlock(&occ->lock); ++ ++ if (hwmon) ++ hwmon_device_unregister(hwmon); ++ mutex_unlock(&occ->hwmon_lock); + } + EXPORT_SYMBOL_GPL(occ_shutdown); + +--- a/drivers/hwmon/occ/common.h ++++ b/drivers/hwmon/occ/common.h +@@ -101,6 +101,7 @@ struct occ { + + unsigned long next_update; + struct mutex lock; /* lock OCC access */ ++ struct mutex hwmon_lock; /* serialize hwmon registration/removal */ + + struct device *hwmon; + struct occ_attribute *attrs; diff --git a/queue-7.1/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch b/queue-7.1/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch new file mode 100644 index 0000000000..c62bc70775 --- /dev/null +++ b/queue-7.1/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch @@ -0,0 +1,49 @@ +From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:47:31 +0800 +Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove + +From: Pengpeng Hou + +commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream. + +w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when +VID information is available. + +The error path and remove callback only remove the common and optional +attribute groups. Those groups do not contain cpu0_vid or vrm, so the +files can remain after a later probe failure or after device removal +while their callbacks still expect live driver data. + +Remove the standalone VID sysfs files from both the probe error path and +the remove callback. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83627hf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwmon/w83627hf.c ++++ b/drivers/hwmon/w83627hf.c +@@ -1823,6 +1823,8 @@ static int w83627hf_probe(struct platfor + return 0; + + error: ++ device_remove_file(dev, &dev_attr_vrm); ++ device_remove_file(dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&dev->kobj, &w83627hf_group); + sysfs_remove_group(&dev->kobj, &w83627hf_group_opt); + return err; +@@ -1834,6 +1836,8 @@ static void w83627hf_remove(struct platf + + hwmon_device_unregister(data->hwmon_dev); + ++ device_remove_file(&pdev->dev, &dev_attr_vrm); ++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt); + } diff --git a/queue-7.1/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch b/queue-7.1/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch new file mode 100644 index 0000000000..c52ff3122c --- /dev/null +++ b/queue-7.1/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch @@ -0,0 +1,39 @@ +From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:48:06 +0800 +Subject: hwmon: (w83793) remove vrm sysfs file on probe failure + +From: Pengpeng Hou + +commit 77b983757280c69b0290811669ff1d31022e5f1d upstream. + +w83793_probe() creates the vrm sysfs file after creating the VID files +when VID support is present. + +The normal remove path deletes vrm, but the probe error path only +removes the sensor, SDA, VID, fan, PWM and temperature files. A later +probe failure can therefore leave vrm behind after the driver data has +been freed. + +Remove vrm in the probe error path next to the VID files, matching the +normal remove path. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83793.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/w83793.c ++++ b/drivers/hwmon/w83793.c +@@ -1917,6 +1917,7 @@ exit_remove: + + for (i = 0; i < ARRAY_SIZE(w83793_vid); i++) + device_remove_file(dev, &w83793_vid[i].dev_attr); ++ device_remove_file(dev, &dev_attr_vrm); + + for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++) + device_remove_file(dev, &w83793_left_fan[i].dev_attr); diff --git a/queue-7.1/net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch b/queue-7.1/net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch new file mode 100644 index 0000000000..b3c617d154 --- /dev/null +++ b/queue-7.1/net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch @@ -0,0 +1,86 @@ +From 96ca1e658ae459276292bd6d971ab5d8c7e0379a Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Jun 2026 14:59:55 +0800 +Subject: net: ipa: fix SMEM state handle leaks in SMP2P init + +From: Haoxiang Li + +commit 96ca1e658ae459276292bd6d971ab5d8c7e0379a upstream. + +ipa_smp2p_init() acquires two Qualcomm SMEM state handles with +qcom_smem_state_get(). However, neither the init error paths +nor ipa_smp2p_exit() release them. + +Release both handles with qcom_smem_state_put() in the init +error paths and in ipa_smp2p_exit(). + +Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Larysa Zaremba +Reviewed-by: Alex Elder +Link: https://patch.msgid.link/20260624065955.2822765-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipa/ipa_smp2p.c | 30 ++++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 8 deletions(-) + +--- a/drivers/net/ipa/ipa_smp2p.c ++++ b/drivers/net/ipa/ipa_smp2p.c +@@ -232,19 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct p + &valid_bit); + if (IS_ERR(valid_state)) + return PTR_ERR(valid_state); +- if (valid_bit >= 32) /* BITS_PER_U32 */ +- return -EINVAL; ++ if (valid_bit >= 32) { /* BITS_PER_U32 */ ++ ret = -EINVAL; ++ goto err_valid_state_put; ++ } + + enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled", + &enabled_bit); +- if (IS_ERR(enabled_state)) +- return PTR_ERR(enabled_state); +- if (enabled_bit >= 32) /* BITS_PER_U32 */ +- return -EINVAL; ++ if (IS_ERR(enabled_state)) { ++ ret = PTR_ERR(enabled_state); ++ goto err_valid_state_put; ++ } ++ if (enabled_bit >= 32) { /* BITS_PER_U32 */ ++ ret = -EINVAL; ++ goto err_enabled_state_put; ++ } + + smp2p = kzalloc_obj(*smp2p); +- if (!smp2p) +- return -ENOMEM; ++ if (!smp2p) { ++ ret = -ENOMEM; ++ goto err_enabled_state_put; ++ } + + smp2p->ipa = ipa; + +@@ -289,6 +297,10 @@ err_null_smp2p: + ipa->smp2p = NULL; + mutex_destroy(&smp2p->mutex); + kfree(smp2p); ++err_enabled_state_put: ++ qcom_smem_state_put(enabled_state); ++err_valid_state_put: ++ qcom_smem_state_put(valid_state); + + return ret; + } +@@ -305,6 +317,8 @@ void ipa_smp2p_exit(struct ipa *ipa) + ipa_smp2p_power_release(ipa); + ipa->smp2p = NULL; + mutex_destroy(&smp2p->mutex); ++ qcom_smem_state_put(smp2p->enabled_state); ++ qcom_smem_state_put(smp2p->valid_state); + kfree(smp2p); + } + diff --git a/queue-7.1/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch b/queue-7.1/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch new file mode 100644 index 0000000000..788c2fbcf5 --- /dev/null +++ b/queue-7.1/net-lan743x-initialize-eth_syslock-spinlock-before-use.patch @@ -0,0 +1,46 @@ +From 39139b1c1c2b614096519b526112c726adb12ff0 Mon Sep 17 00:00:00 2001 +From: Andrea Righi +Date: Fri, 26 Jun 2026 18:32:18 +0200 +Subject: net: lan743x: Initialize eth_syslock spinlock before use + +From: Andrea Righi + +commit 39139b1c1c2b614096519b526112c726adb12ff0 upstream. + +lan743x_hardware_init() calls pci11x1x_strap_get_status() during the +PCI11x1x probe sequence. That helper acquires the Ethernet subsystem +hardware lock via lan743x_hs_syslock_acquire(), which relies on +adapter->eth_syslock_spinlock to serialize access. + +The spinlock is currently initialized only after the strap status is +read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized +spinlock can trip the spinlock debug check. + +Fix by initializing adapter->eth_syslock_spinlock before reading the +strap status so the probe path never attempts to lock an uninitialized +spinlock. + +Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G") +Cc: stable@vger.kernel.org # v6.0+ +Signed-off-by: Andrea Righi +Reviewed-by: David Thompson +Reviewed-by: Thangaraj Samynathan +Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microchip/lan743x_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -3542,8 +3542,8 @@ static int lan743x_hardware_init(struct + adapter->max_tx_channels = PCI11X1X_MAX_TX_CHANNELS; + adapter->used_tx_channels = PCI11X1X_USED_TX_CHANNELS; + adapter->max_vector_count = PCI11X1X_MAX_VECTOR_COUNT; +- pci11x1x_strap_get_status(adapter); + spin_lock_init(&adapter->eth_syslock_spinlock); ++ pci11x1x_strap_get_status(adapter); + mutex_init(&adapter->sgmii_rw_lock); + pci11x1x_set_rfe_rd_fifo_threshold(adapter); + sgmii_ctl = lan743x_csr_read(adapter, SGMII_CTL); diff --git a/queue-7.1/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch b/queue-7.1/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch new file mode 100644 index 0000000000..f31b077645 --- /dev/null +++ b/queue-7.1/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch @@ -0,0 +1,64 @@ +From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Jun 2026 14:40:13 +0800 +Subject: net: liquidio: fix BAR resource leak on PF number failure + +From: Haoxiang Li + +commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream. + +If cn23xx_get_pf_num() fails, the function returns without +unmapping either BAR. Unmap both BARs before returning from +the error path. + +Found by manual code review. + +Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Larysa Zaremba +Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -1163,18 +1163,14 @@ int setup_cn23xx_octeon_pf_device(struct + if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) { + dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n", + __func__); +- octeon_unmap_pci_barx(oct, 0); +- return 1; ++ goto err_unmap_bar0; + } + + if (cn23xx_get_pf_num(oct) != 0) +- return 1; ++ goto err_unmap_bar1; + +- if (cn23xx_sriov_config(oct)) { +- octeon_unmap_pci_barx(oct, 0); +- octeon_unmap_pci_barx(oct, 1); +- return 1; +- } ++ if (cn23xx_sriov_config(oct)) ++ goto err_unmap_bar1; + + octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL); + +@@ -1205,6 +1201,12 @@ int setup_cn23xx_octeon_pf_device(struct + oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct); + + return 0; ++ ++err_unmap_bar1: ++ octeon_unmap_pci_barx(oct, 1); ++err_unmap_bar0: ++ octeon_unmap_pci_barx(oct, 0); ++ return 1; + } + EXPORT_SYMBOL_GPL(setup_cn23xx_octeon_pf_device); + diff --git a/queue-7.1/net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch b/queue-7.1/net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch new file mode 100644 index 0000000000..f9cc03140b --- /dev/null +++ b/queue-7.1/net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch @@ -0,0 +1,48 @@ +From bb09d0e64ecaa0aa0f7d1133a1696ed74dead295 Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Mon, 29 Jun 2026 14:40:49 +0800 +Subject: net/mlx5: HWS, fix matcher leak on resize target setup failure + +From: Dawei Feng + +commit bb09d0e64ecaa0aa0f7d1133a1696ed74dead295 upstream. + +hws_bwc_matcher_move() allocates a replacement matcher before setting it +as the resize target. If mlx5hws_matcher_resize_set_target() fails, the +replacement matcher is not attached anywhere and is leaked. + +Fix the leak by destroying the replacement matcher before returning from +the resize-target failure path. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still +present in v7.1.1. + +An x86_64 allyesconfig build showed no new warnings. As we do not have a +mlx5 HWS-capable device to test with, no runtime testing was able to be +performed. + +Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling") +Cc: stable@vger.kernel.org +Signed-off-by: Dawei Feng +Reviewed-by: Yevgeny Kliteynik +Acked-by: Tariq Toukan +Link: https://patch.msgid.link/20260629064049.3852759-1-dawei.feng@seu.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c +@@ -205,6 +205,7 @@ static int hws_bwc_matcher_move(struct m + ret = mlx5hws_matcher_resize_set_target(old_matcher, new_matcher); + if (ret) { + mlx5hws_err(ctx, "Rehash error: failed setting resize target\n"); ++ mlx5hws_matcher_destroy(new_matcher); + return ret; + } + diff --git a/queue-7.1/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-7.1/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..eb790935a4 --- /dev/null +++ b/queue-7.1/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,44 @@ +From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:20 -0500 +Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream. + +multiq_dequeue() takes a packet from a band's child with a direct +->dequeue() call after multiq_peek() peeked it. When the child is +non-work-conserving the peek stashes the skb in the child's gso_skb, so +the direct dequeue returns a different skb and orphans the stash, +desyncing the child's qlen/backlog. With a qfq child reached through a +peeking parent (e.g. tbf) this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_prio already does +and as sch_red and sch_sfb were just fixed to do. The helper is a no-op +when the child has no stash, so a work-conserving child is unaffected. + +Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_multiq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st + if (!netif_xmit_stopped( + netdev_get_tx_queue(qdisc_dev(sch), q->curband))) { + qdisc = q->queues[q->curband]; +- skb = qdisc->dequeue(qdisc); ++ skb = qdisc_dequeue_peeked(qdisc); + if (skb) { + qdisc_bstats_update(sch, skb); + qdisc_qlen_dec(sch); diff --git a/queue-7.1/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-7.1/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..104f15fd04 --- /dev/null +++ b/queue-7.1/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,45 @@ +From e056e1dfcddca877dd46d704e8ec9860cfc9ec44 Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:19 -0500 +Subject: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit e056e1dfcddca877dd46d704e8ec9860cfc9ec44 upstream. + +When taprio's software path peeks a non-work-conserving child qdisc, the +child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() +then takes the packet with a direct child ->dequeue() call, which ignores +that stash, orphans the peeked skb and desyncs the child's qlen/backlog. +With a qfq child this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb +now do. The helper returns the child's stashed skb first and is a no-op +when there is none, so a work-conserving child is unaffected and the +gated path now consumes the skb whose length was charged to the budget. + +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Cc: stable@vger.kernel.org +Cc: Vladimir Oltean +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-1-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_taprio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -749,7 +749,7 @@ static struct sk_buff *taprio_dequeue_fr + return NULL; + + skip_peek_checks: +- skb = child->ops->dequeue(child); ++ skb = qdisc_dequeue_peeked(child); + if (unlikely(!skb)) + return NULL; + diff --git a/queue-7.1/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch b/queue-7.1/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch new file mode 100644 index 0000000000..5d62765e44 --- /dev/null +++ b/queue-7.1/net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch @@ -0,0 +1,130 @@ +From 526b8ef54668780c8f69e0211c342763d5dcbad1 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 25 Jun 2026 14:17:28 +0800 +Subject: net: wwan: iosm: bound device offsets in the MUX downlink decoder + +From: Maoyi Xie + +commit 526b8ef54668780c8f69e0211c342763d5dcbad1 upstream. + +mux_dl_adb_decode() walks a chain of aggregated datagram tables using +offsets and lengths taken from the modem. first_table_index, +next_table_index, table_length, datagram_index and datagram_length are +all device supplied le values. Only first_table_index was checked, and +only for being non zero. The decoder then formed adth = block + +adth_index and read the table header and the datagram entries with no +bound against the received skb. A modem that reports an index or a +length past the downlink buffer makes the decoder read out of bounds. + +The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most +that, so skb->len is the real limit, but none of these in band offsets +were checked against it. + +The table chain is also followed with no forward progress check. The loop +takes the next table from adth->next_table_index and stops only when that +reaches zero. A modem can stage two tables that point at each other, so +the loop never ends. It runs in softirq and clones the skb on every pass. + +Validate every device offset and length against skb->len before use. +The block header must fit. Each table header, on entry and after every +next_table_index, must lie inside the skb. The datagram table must fit. +Each datagram index and length must stay inside the skb. The header +padding must not exceed the datagram length so the receive length does +not wrap. Require each next_table_index to move forward so the chain +cannot cycle. + +This was reproduced under KASAN as a slab out of bounds read on a normal +downlink receive once the iosm net device is up. + +Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") +Suggested-by: Loic Poulain +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Reviewed-by: Simon Horman +Reviewed-by: Loic Poulain +Link: https://patch.msgid.link/178236824878.3259367.5389624724479864947@maoyixie.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 40 +++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 10 deletions(-) + +--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c +@@ -553,19 +553,21 @@ static int mux_dl_process_dg(struct iosm + u32 packet_offset, i, rc, dg_len; + + for (i = 0; i < nr_of_dg; i++, dg++) { +- if (le32_to_cpu(dg->datagram_index) +- < sizeof(struct mux_adbh)) ++ u32 dg_index = le32_to_cpu(dg->datagram_index); ++ ++ dg_len = le16_to_cpu(dg->datagram_length); ++ ++ if (dg_index < sizeof(struct mux_adbh)) + goto dg_error; + +- /* Is the packet inside of the ADB */ +- if (le32_to_cpu(dg->datagram_index) >= +- le32_to_cpu(adbh->block_length)) { ++ /* Is the packet inside of the ADB and the received skb ? */ ++ if (dg_index >= le32_to_cpu(adbh->block_length) || ++ dg_index >= skb->len || ++ dg_len > skb->len - dg_index || ++ dl_head_pad_len >= dg_len) { + goto dg_error; + } else { +- packet_offset = +- le32_to_cpu(dg->datagram_index) + +- dl_head_pad_len; +- dg_len = le16_to_cpu(dg->datagram_length); ++ packet_offset = dg_index + dl_head_pad_len; + /* Pass the packet to the netif layer. */ + rc = ipc_mux_net_receive(ipc_mux, if_id, ipc_mux->wwan, + packet_offset, +@@ -589,12 +591,16 @@ static void mux_dl_adb_decode(struct ios + struct mux_adbh *adbh; + struct mux_adth *adth; + int nr_of_dg, if_id; +- u32 adth_index; ++ u32 adth_index, prev_index = 0; + u8 *block; + + block = skb->data; + adbh = (struct mux_adbh *)block; + ++ /* The block header itself must fit in the received skb. */ ++ if (skb->len < sizeof(struct mux_adbh)) ++ goto adb_decode_err; ++ + /* Process the aggregated datagram tables. */ + adth_index = le32_to_cpu(adbh->first_table_index); + +@@ -606,6 +612,16 @@ static void mux_dl_adb_decode(struct ios + + /* Loop through mixed session tables. */ + while (adth_index) { ++ /* The table header must lie within the received skb, and the ++ * chain must move forward so a modem cannot make the loop ++ * cycle between two tables. ++ */ ++ if (adth_index <= prev_index || ++ adth_index < sizeof(struct mux_adbh) || ++ adth_index > skb->len - sizeof(struct mux_adth)) ++ goto adb_decode_err; ++ prev_index = adth_index; ++ + /* Get the reference to the table header. */ + adth = (struct mux_adth *)(block + adth_index); + +@@ -629,6 +645,10 @@ static void mux_dl_adb_decode(struct ios + if (le16_to_cpu(adth->table_length) < sizeof(struct mux_adth)) + goto adb_decode_err; + ++ /* The whole datagram table must fit in the received skb. */ ++ if (le16_to_cpu(adth->table_length) > skb->len - adth_index) ++ goto adb_decode_err; ++ + /* Calculate the number of datagrams. */ + nr_of_dg = (le16_to_cpu(adth->table_length) - + sizeof(struct mux_adth)) / diff --git a/queue-7.1/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch b/queue-7.1/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch new file mode 100644 index 0000000000..670d96fcf3 --- /dev/null +++ b/queue-7.1/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch @@ -0,0 +1,51 @@ +From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Fri, 19 Jun 2026 04:38:20 -0500 +Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part() + +From: Bryam Vargas + +commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream. + +fill_from_part() computes the size of a directory entry in size_t but +stores it in a __u32. An entry length near U32_MAX wraps it to a small +value, bypasses the bounds check, and is then used to index the entry, +reading far past the directory part -- an out-of-bounds read that oopses +the kernel. + +Compute the size as a u64 so it cannot truncate; the bounds check then +rejects the entry. The trailer is supplied by the userspace client. + +Fixes: 480e3e532e31 ("orangefs: support very large directories") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/orangefs/dir.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/orangefs/dir.c ++++ b/fs/orangefs/dir.c +@@ -191,7 +191,8 @@ static int fill_from_part(struct orangef + { + const int offset = sizeof(struct orangefs_readdir_response_s); + struct orangefs_khandle *khandle; +- __u32 *len, padlen; ++ __u32 *len; ++ u64 padlen; + loff_t i; + char *s; + i = ctx->pos & ~PART_MASK; +@@ -215,8 +216,8 @@ static int fill_from_part(struct orangef + * len is the size of the string itself. padlen is the + * total size of the encoded string. + */ +- padlen = (sizeof *len + *len + 1) + +- (8 - (sizeof *len + *len + 1)%8)%8; ++ padlen = (u64)sizeof *len + *len + 1; ++ padlen += (8 - padlen % 8) % 8; + if (part->len < i + padlen + sizeof *khandle) + goto next; + s = (void *)part + offset + i + sizeof *len; diff --git a/queue-7.1/riscv-probes-save-original-sp-in-rethook-trampoline.patch b/queue-7.1/riscv-probes-save-original-sp-in-rethook-trampoline.patch new file mode 100644 index 0000000000..fdb91c6c4b --- /dev/null +++ b/queue-7.1/riscv-probes-save-original-sp-in-rethook-trampoline.patch @@ -0,0 +1,59 @@ +From bc7b086a45521a986a49045907f017e3e46c763e Mon Sep 17 00:00:00 2001 +From: Martin Kaiser +Date: Tue, 30 Jun 2026 21:40:03 +0200 +Subject: riscv: probes: save original sp in rethook trampoline + +From: Martin Kaiser + +commit bc7b086a45521a986a49045907f017e3e46c763e upstream. + +Reading a word from the stack in a kretprobe crashes a risc-v kernel. + +$ cd /sys/kernel/tracing/ +$ echo 'r n_tty_write $stack0' > dynamic_events +$ echo 1 > events/kprobes/enable +Unable to handle kernel paging request at virtual address 0000000200000128 +... +[] regs_get_kernel_stack_nth+0x26/0x38 +[] process_fetch_insn+0x3ee/0x760 +[] kretprobe_trace_func+0x116/0x1f0 +[] kretprobe_dispatcher+0x4a/0x58 +[] kretprobe_rethook_handler+0x5e/0x90 +[] rethook_trampoline_handler+0x70/0x108 +[] arch_rethook_trampoline_callback+0x12/0x1c +[] arch_rethook_trampoline+0x48/0x94 +[] tty_write+0x1a/0x30 + +In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. + +arch_rethook_trampoline saves the registers from the probed function in a +struct pt_regs. sp is not saved. Instead, sp is decremented for +arch_rethook_trampoline's local stack. + +Fix this crash and save the original sp along with the other registers. +Use a0 as a temporary register, it is overwritten anyway. + +Cc: stable@vger.kernel.org +Fixes: c22b0bcb1dd02 ("riscv: Add kprobes supported") +Signed-off-by: Martin Kaiser +Acked-by: Masami Hiramatsu (Google) +Link: https://patch.msgid.link/20260630194010.1824039-1-martin@kaiser.cx +[pjw@kernel.org: added Fixes tag; cc'ed stable] +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/probes/rethook_trampoline.S | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/riscv/kernel/probes/rethook_trampoline.S ++++ b/arch/riscv/kernel/probes/rethook_trampoline.S +@@ -41,6 +41,9 @@ + REG_S x29, PT_T4(sp) + REG_S x30, PT_T5(sp) + REG_S x31, PT_T6(sp) ++ /* save original sp */ ++ addi a0, sp, PT_SIZE_ON_STACK ++ REG_S a0, PT_SP(sp) + .endm + + .macro restore_all_base_regs diff --git a/queue-7.1/series b/queue-7.1/series index c09e8cdde6..8c10260b8a 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1956,3 +1956,24 @@ bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch rtc-renesas-rtca3-fix-pie-clear-polling-condition-in-alarm-setup-error-path.patch fscrypt-replace-mk_users-keyring-with-simple-list.patch rtc-mpfs-fix-counter-upload-completion-condition.patch +hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch +hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch +net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch +acpi-tad-check-ac-wake-capability-before-enabling-wakeup.patch +hwmon-occ-unregister-sysfs-devices-outside-occ-lock.patch +fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch +net-lan743x-initialize-eth_syslock-spinlock-before-use.patch +net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +fhandle-reject-detached-mounts-in-capable_wrt_mount.patch +hwmon-max1619-add-missing-select-regmap-to-kconfig.patch +tracing-probes-fix-double-addition-of-offset-for-foffset.patch +orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch +net-mlx5-hws-fix-matcher-leak-on-resize-target-setup-failure.patch +ata-libata-core-add-nolpm-quirk-for-pny-cs900-1tb-ssd.patch +ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch +ata-libata-core-reject-an-invalid-concurrent-positioning-ranges-count.patch +net-wwan-iosm-bound-device-offsets-in-the-mux-downlink-decoder.patch +net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch +hwmon-asus_atk0110-check-package-count-before-accessing-element.patch +riscv-probes-save-original-sp-in-rethook-trampoline.patch diff --git a/queue-7.1/tracing-probes-fix-double-addition-of-offset-for-foffset.patch b/queue-7.1/tracing-probes-fix-double-addition-of-offset-for-foffset.patch new file mode 100644 index 0000000000..bf218993a2 --- /dev/null +++ b/queue-7.1/tracing-probes-fix-double-addition-of-offset-for-foffset.patch @@ -0,0 +1,34 @@ +From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 25 Jun 2026 08:34:47 +0900 +Subject: tracing/probes: Fix double addition of offset for @+FOFFSET + +From: Masami Hiramatsu (Google) + +commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream. + +Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument + fetching code") wrongly use @offset local variable during the parsing, +the offset value is added twice when dereferencing. +Reset the @offset after setting it in FETCH_OP_FOFFS. + +Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/ + +Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_probe.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -1248,6 +1248,7 @@ parse_probe_arg(char *arg, const struct + + code->op = FETCH_OP_FOFFS; + code->immediate = (unsigned long)offset; // imm64? ++ offset = 0; + } else { + /* uprobes don't support symbols */ + if (!(ctx->flags & TPARG_FL_KERNEL)) {