From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:28:04 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c341cd8e4ac3585c9fe59d00edaf4310d89035a5;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: bluetooth-btrtl-validate-firmware-patch-bounds.patch ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch ipvs-reload-ip-header-after-head-reallocation.patch llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch mmc-sdhci-esdhc-imx-restore-pinctrl-before-restoring-ios-timing-on-resume.patch net-mlx5-free-mlx5_st_idx_data-on-final-dealloc.patch net-openvswitch-reject-oversized-nested-action-attrs.patch pmdomain-imx-fix-i.mx8mp-power-notifier.patch pmdomain-imx-fix-i.mx8mp-vc8000e-power-up-sequence.patch powerpc-pseries-fix-memory-leak-on-krealloc-failure-in-papr_init.patch regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch riscv-vdso-do-not-use-lto-for-the-vdso.patch selftests-landlock-fix-screwed-up-pointers-in-the-scoped_signal_test.patch selftests-landlock-skip-scoped_signal-subtest-with-msg_oob-if-not-available.patch wifi-brcmfmac-cyw-fix-heap-overflow-on-a-short-auth-frame.patch wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch wifi-mwifiex-fix-roaming-to-different-channel-in-host_mlme-mode.patch wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch --- diff --git a/queue-6.18/bluetooth-btrtl-validate-firmware-patch-bounds.patch b/queue-6.18/bluetooth-btrtl-validate-firmware-patch-bounds.patch new file mode 100644 index 0000000000..3d36e463e1 --- /dev/null +++ b/queue-6.18/bluetooth-btrtl-validate-firmware-patch-bounds.patch @@ -0,0 +1,41 @@ +From 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 Mon Sep 17 00:00:00 2001 +From: Laxman Acharya Padhya +Date: Fri, 10 Jul 2026 23:10:03 +0545 +Subject: Bluetooth: btrtl: validate firmware patch bounds + +From: Laxman Acharya Padhya + +commit 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 upstream. + +rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the +firmware version. A malformed firmware patch shorter than the version field +can make this subtraction underflow and turn the copy into an oversized +read and write during Bluetooth setup. + +The existing patch_offset + patch_length check can also wrap on 32-bit +architectures. Validate the patch length and range without arithmetic +overflow before allocating or copying the patch. + +Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver") +Cc: stable@vger.kernel.org +Signed-off-by: Laxman Acharya Padhya +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btrtl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -786,8 +786,9 @@ static int rtlbt_parse_firmware(struct h + } + + BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i); +- min_size = patch_offset + patch_length; +- if (btrtl_dev->fw_len < min_size) ++ if (patch_length < sizeof(epatch_info->fw_version) || ++ patch_offset > btrtl_dev->fw_len || ++ patch_length > btrtl_dev->fw_len - patch_offset) + return -EINVAL; + + /* Copy the firmware into a new buffer and write the version at diff --git a/queue-6.18/ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch b/queue-6.18/ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch new file mode 100644 index 0000000000..df39701cd4 --- /dev/null +++ b/queue-6.18/ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch @@ -0,0 +1,82 @@ +From b3fe4cbd583895987935a9bdad01c8f9d3a02310 Mon Sep 17 00:00:00 2001 +From: Julian Anastasov +Date: Wed, 8 Jul 2026 21:03:15 +0300 +Subject: ipvs: fix more places with wrong ipv6 transport offsets + +From: Julian Anastasov + +commit b3fe4cbd583895987935a9bdad01c8f9d3a02310 upstream. + +Sashiko reports for more incorrect IPv6 transport offsets. + +The app code for TCP was assuming IPv4 network header +even after the ipvsh argument was provided. This can +cause problems with apps over IPv6. As for the only +official app in the kernel tree (FTP) this problem is +harmless because we use Netfilter to mangle the FTP +ports and we do not adjust the TCP seq numbers. + +Also, provide correct offset of the ICMPV6 header in +ip_vs_out_icmp_v6() for correct checksum checks when +the IPv6 packet has extension headers. + +Fixes: d12e12299a69 ("ipvs: add ipv6 support to ftp") +Fixes: 2a3b791e6e11 ("IPVS: Add/adjust Netfilter hook functions and helpers for v6") +Cc: stable@vger.kernel.org +Link: https://sashiko.dev/#/patchset/20260706101624.69471-1-zhaoyz24%40mails.tsinghua.edu.cn +Signed-off-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_app.c | 10 ++++------ + net/netfilter/ipvs/ip_vs_core.c | 3 +-- + 2 files changed, 5 insertions(+), 8 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_app.c ++++ b/net/netfilter/ipvs/ip_vs_app.c +@@ -362,14 +362,13 @@ static inline int app_tcp_pkt_out(struct + struct ip_vs_iphdr *ipvsh) + { + int diff; +- const unsigned int tcp_offset = ip_hdrlen(skb); + struct tcphdr *th; + __u32 seq; + +- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th))) ++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th))) + return 0; + +- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset); ++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len); + + /* + * Remember seq number in case this pkt gets resized +@@ -439,14 +438,13 @@ static inline int app_tcp_pkt_in(struct + struct ip_vs_iphdr *ipvsh) + { + int diff; +- const unsigned int tcp_offset = ip_hdrlen(skb); + struct tcphdr *th; + __u32 seq; + +- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th))) ++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th))) + return 0; + +- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset); ++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len); + + /* + * Remember seq number in case this pkt gets resized +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1041,8 +1041,7 @@ static int ip_vs_out_icmp_v6(struct netn + snet.in6 = ciph.saddr.in6; + offset = ciph.len; + return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp, +- pp, offset, sizeof(struct ipv6hdr), +- hooknum); ++ pp, offset, ipvsh->len, hooknum); + } + #endif + diff --git a/queue-6.18/ipvs-reload-ip-header-after-head-reallocation.patch b/queue-6.18/ipvs-reload-ip-header-after-head-reallocation.patch new file mode 100644 index 0000000000..f49f1e9596 --- /dev/null +++ b/queue-6.18/ipvs-reload-ip-header-after-head-reallocation.patch @@ -0,0 +1,40 @@ +From a2f57827bf7c695b8c72dc4511cae8e86582369d Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 8 Jul 2026 16:21:30 +0200 +Subject: ipvs: reload ip header after head reallocation + +From: Florian Westphal + +commit a2f57827bf7c695b8c72dc4511cae8e86582369d upstream. + +__ip_vs_get_out_rt() calls skb_ensure_writable() which may +reallocate skb->head. + +Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-sonnet-4-6 +Acked-by: Julian Anastasov +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_xmit.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_xmit.c ++++ b/net/netfilter/ipvs/ip_vs_xmit.c +@@ -733,13 +733,11 @@ int + ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, + struct ip_vs_protocol *pp, struct ip_vs_iphdr *ipvsh) + { +- struct iphdr *iph = ip_hdr(skb); +- +- if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, iph->daddr, ++ if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, ip_hdr(skb)->daddr, + IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0) + goto tx_error; + +- ip_send_check(iph); ++ ip_send_check(ip_hdr(skb)); + + /* Another hack: avoid icmp_send in ip_fragment */ + skb->ignore_df = 1; diff --git a/queue-6.18/llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch b/queue-6.18/llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch new file mode 100644 index 0000000000..0a8842d362 --- /dev/null +++ b/queue-6.18/llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch @@ -0,0 +1,42 @@ +From 2c72eb6286347d05a885412fb076993bd5286b53 Mon Sep 17 00:00:00 2001 +From: Xuanqiang Luo +Date: Sun, 12 Jul 2026 21:03:43 +0800 +Subject: llc: fix SAP refcount leak when creating incoming sockets + +From: Xuanqiang Luo + +commit 2c72eb6286347d05a885412fb076993bd5286b53 upstream. + +llc_sap_add_socket() takes a SAP reference for each socket added to a SAP, +and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes +an additional SAP reference after adding the child socket. + +This extra reference was balanced by an explicit llc_sap_put() in +llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference +counting w.r.t. socket handling") removed that put. The corresponding hold +in the accept path was left behind. + +When such a child socket is removed, only the reference taken by +llc_sap_add_socket() is released. The extra reference keeps the SAP alive +after its last socket is removed. Remove the obsolete hold. + +Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling") +Cc: stable@vger.kernel.org +Signed-off-by: Xuanqiang Luo +Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/llc_conn.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -773,7 +773,6 @@ static struct sock *llc_create_incoming_ + newllc->dev = dev; + dev_hold(dev); + llc_sap_add_socket(llc->sap, newsk); +- llc_sap_hold(llc->sap); + out: + return newsk; + } diff --git a/queue-6.18/macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch b/queue-6.18/macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch new file mode 100644 index 0000000000..137e89f9d9 --- /dev/null +++ b/queue-6.18/macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch @@ -0,0 +1,61 @@ +From 7410d11460eb90d6c9281162ccc6a128534d897d Mon Sep 17 00:00:00 2001 +From: James Raphael Tiovalen +Date: Sun, 5 Jul 2026 19:36:29 +0800 +Subject: macsec: fix promiscuity refcount leak in macsec_dev_open() + +From: James Raphael Tiovalen + +commit 7410d11460eb90d6c9281162ccc6a128534d897d upstream. + +When a MACsec interface with IFF_PROMISC set is brought up on top of a +device that has hardware offload enabled, macsec_dev_open() first calls +dev_set_promiscuity(real_dev, 1) and then propagates the open to the +offload device. If that propagation fails, the error path jumps to the +clear_allmulti label, which only reverts allmulti and the unicast +address. The promiscuity taken on the lower device is never dropped, so +real_dev is left permanently stuck in promiscuous mode. Its promiscuity +count can no longer be balanced from software. + +Add a clear_promisc label that drops the promiscuity reference and +route the two offload failure paths to it. The dev_set_promiscuity() +failure itself still jumps to clear_allmulti, since on that failure the +count was not incremented. + +Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure") +Cc: stable@vger.kernel.org +Signed-off-by: James Raphael Tiovalen +Reviewed-by: Sabrina Dubroca +Link: https://patch.msgid.link/20260705113629.187490-1-jamestiotio@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/macsec.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -3609,19 +3609,22 @@ static int macsec_dev_open(struct net_de + ops = macsec_get_ops(netdev_priv(dev), &ctx); + if (!ops) { + err = -EOPNOTSUPP; +- goto clear_allmulti; ++ goto clear_promisc; + } + + ctx.secy = &macsec->secy; + err = macsec_offload(ops->mdo_dev_open, &ctx); + if (err) +- goto clear_allmulti; ++ goto clear_promisc; + } + + if (netif_carrier_ok(real_dev)) + netif_carrier_on(dev); + + return 0; ++clear_promisc: ++ if (dev->flags & IFF_PROMISC) ++ dev_set_promiscuity(real_dev, -1); + clear_allmulti: + if (dev->flags & IFF_ALLMULTI) + dev_set_allmulti(real_dev, -1); diff --git a/queue-6.18/memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch b/queue-6.18/memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch new file mode 100644 index 0000000000..ca54f8d8d3 --- /dev/null +++ b/queue-6.18/memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch @@ -0,0 +1,54 @@ +From 718178f524b98bc920d74bc771aed823c8b81425 Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Thu, 2 Jul 2026 16:27:45 +0800 +Subject: memstick: ms_block: reject a card that reports too many blocks + +From: Maoyi Xie + +commit 718178f524b98bc920d74bc771aed823c8b81425 upstream. + +msb_ftl_initialize() computes the zone count from the card block count +with no bound: + + msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; + ... + for (i = 0; i < msb->zone_count; i++) + msb->free_block_count[i] = MS_BLOCKS_IN_ZONE; + +msb->block_count is a card value. msb_read_boot_blocks() reads +number_of_blocks from the card boot page and byte swaps it. +free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the +valid indices are 0 to 15. The init loop above indexes it by zone_count. +msb_mark_block_used() and msb_mark_block_unused() index it by +pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report +up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES * +MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past +free_block_count[] and corrupts struct msb_data. A larger count runs the +init loop past the end too. + +A real Memory Stick has at most 16 zones. So it has at most 8192 blocks. +msb_ftl_initialize() now rejects a card that reports more than +MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks. + +Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") +Cc: stable@vger.kernel.org +Signed-off-by: Maoyi Xie +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memstick/core/ms_block.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1339,6 +1339,10 @@ static int msb_ftl_initialize(struct msb + return 0; + + msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; ++ if (msb->block_count > MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) { ++ pr_err("Too many blocks: %d\n", msb->block_count); ++ return -EINVAL; ++ } + msb->logical_block_count = msb->zone_count * 496 - 2; + + msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); diff --git a/queue-6.18/mmc-sdhci-esdhc-imx-restore-pinctrl-before-restoring-ios-timing-on-resume.patch b/queue-6.18/mmc-sdhci-esdhc-imx-restore-pinctrl-before-restoring-ios-timing-on-resume.patch new file mode 100644 index 0000000000..7eb5ae8534 --- /dev/null +++ b/queue-6.18/mmc-sdhci-esdhc-imx-restore-pinctrl-before-restoring-ios-timing-on-resume.patch @@ -0,0 +1,59 @@ +From 1db87818bde3d2295613660879378b43a70d31f8 Mon Sep 17 00:00:00 2001 +From: Luke Wang +Date: Wed, 15 Jul 2026 15:18:14 +0800 +Subject: mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume + +From: Luke Wang + +commit 1db87818bde3d2295613660879378b43a70d31f8 upstream. + +SDIO devices such as WiFi may keep power during suspend, so the MMC +core skips full card re-initialization on resume and directly restores +the host controller's ios timing to match the card. For DDR mode, +pm_runtime_force_resume() sets DDR_EN before the pin configuration is +restored from sleep state. + +This is related to the SoC IP integration: switching pinctrl setting +(changing alt from GPIO to USDHC) impacts the internal loopback path. +If pinctrl configures the pad to GPIO function, once DDR_EN is set, the +DLL delay will be fixed based on the GPIO function loopback path. When +the pinctrl is later changed to USDHC function, the internal loopback +path changes, making the original fixed sample point no longer suitable +for the current loopback path. This causes persistent read CRC errors on +subsequent data transfers. + +SD/eMMC running in DDR mode are unaffected as they are fully +re-initialized from legacy timing after resume. + +Fix this by restoring the pinctrl state based on current timing mode +using esdhc_change_pinstate() before pm_runtime_force_resume(). This +ensures the correct pin configuration (e.g., 100/200MHz for UHS modes) +is applied before DDR_EN is set. Only restore for non-wakeup devices +since wakeup devices kept their active pin state during suspend. + +Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") +Acked-by: Adrian Hunter +Reviewed-by: Haibo Chen +Signed-off-by: Luke Wang +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -2083,6 +2083,12 @@ static int sdhci_esdhc_resume(struct dev + struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); + int ret; + ++ if (!device_may_wakeup(dev)) { ++ ret = esdhc_change_pinstate(host, host->timing); ++ if (ret) ++ dev_warn(dev, "Failed to restore pinctrl state\n"); ++ } ++ + pm_runtime_force_resume(dev); + + ret = mmc_gpio_set_cd_wake(host->mmc, false); diff --git a/queue-6.18/net-mlx5-free-mlx5_st_idx_data-on-final-dealloc.patch b/queue-6.18/net-mlx5-free-mlx5_st_idx_data-on-final-dealloc.patch new file mode 100644 index 0000000000..4c09cbf404 --- /dev/null +++ b/queue-6.18/net-mlx5-free-mlx5_st_idx_data-on-final-dealloc.patch @@ -0,0 +1,44 @@ +From df6134b527a88b3e65ba6ae5073664af091d5fd2 Mon Sep 17 00:00:00 2001 +From: Zhiping Zhang +Date: Thu, 2 Jul 2026 15:24:58 -0700 +Subject: net/mlx5: free mlx5_st_idx_data on final dealloc + +From: Zhiping Zhang + +commit df6134b527a88b3e65ba6ae5073664af091d5fd2 upstream. + +Workloads that repeatedly allocate and release mkeys carrying TPH +steering-tag hints (e.g. churning RDMA MRs) leak one +struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced +and the kmalloc slab grows over time. + +When the last reference to an ST table entry is dropped, +mlx5_st_dealloc_index() removed the entry from idx_xa but the backing +mlx5_st_idx_data allocation was never freed. + +Free idx_data after the xa_erase() so the lifetime of the bookkeeping +struct matches the lifetime of the ST entry it tracks. + +Cc: stable@vger.kernel.org +Fixes: 888a7776f4fb ("net/mlx5: Add support for device steering tag") +Reviewed-by: Michael Gur +Signed-off-by: Zhiping Zhang +Reviewed-by: Leon Romanovsky +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20260702222507.1234467-1-zhipingz@meta.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/lib/st.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c +@@ -154,6 +154,7 @@ int mlx5_st_dealloc_index(struct mlx5_co + + if (refcount_dec_and_test(&idx_data->usecount)) { + xa_erase(&st->idx_xa, st_index); ++ kfree(idx_data); + /* We leave PCI config space as was before, no mkey will refer to it */ + } + diff --git a/queue-6.18/net-openvswitch-reject-oversized-nested-action-attrs.patch b/queue-6.18/net-openvswitch-reject-oversized-nested-action-attrs.patch new file mode 100644 index 0000000000..01cd359d95 --- /dev/null +++ b/queue-6.18/net-openvswitch-reject-oversized-nested-action-attrs.patch @@ -0,0 +1,393 @@ +From 3f1f755366687d051174739fb99f7d560202f60b Mon Sep 17 00:00:00 2001 +From: Asim Viladi Oglu Manizada +Date: Mon, 6 Jul 2026 09:44:10 +0000 +Subject: net: openvswitch: reject oversized nested action attrs + +From: Asim Viladi Oglu Manizada + +commit 3f1f755366687d051174739fb99f7d560202f60b upstream. + +Open vSwitch stores generated flow actions as nlattrs, whose nla_len +field is u16. Commit a1e64addf3ff ("net: openvswitch: remove +misbehaving actions length check") allowed the total sw_flow_actions +stream to grow beyond 64 KiB, which is valid, but also removed the last +guard preventing a generated nested action attribute from exceeding +U16_MAX. + +An oversized generated container can thus be closed with a truncated +nla_len. A later dump or teardown then walks a structurally different +stream than the one that was validated. In particular, an oversized +nested CLONE/CT action may cause subsequent bytes in the generated +stream to be interpreted as independent actions. + +Keep the larger total-action-stream behavior, but make nested action +close reject generated containers that do not fit in nla_len, and return +the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and +CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse +construction order before discarding failed wrappers, so resources copied +into the rejected tails are released before the wrappers are removed. + +Most failed outer wrappers are discarded by truncating actions_len after +child resources have been released. CHECK_PKT_LEN also trims its parent +after branch resources are gone. SET/TUNNEL close failures unwind their +known tun_dst ownership directly, and SET_TO_MASKED has no external +ownership and truncates on close failure. + +Fixes: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") +Cc: stable@vger.kernel.org +Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix +Signed-off-by: Asim Viladi Oglu Manizada +Reviewed-by: Eelco Chaudron +Reviewed-by: Aaron Conole +Reviewed-by: Ilya Maximets +Link: https://patch.msgid.link/20260706094336.38639-1-manizada@pm.me +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/flow_netlink.c | 201 ++++++++++++++++++++++++++++++++--------- + 1 file changed, 157 insertions(+), 44 deletions(-) + +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2496,13 +2496,56 @@ static inline int add_nested_action_star + return used; + } + +-static inline void add_nested_action_end(struct sw_flow_actions *sfa, +- int st_offset) ++static inline int add_nested_action_end(struct sw_flow_actions *sfa, ++ int st_offset) + { +- struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions + +- st_offset); ++ struct nlattr *a; ++ u32 attr_len; ++ ++ if (WARN_ON_ONCE(st_offset < 0 || ++ (u32)st_offset > sfa->actions_len)) ++ return -EINVAL; ++ ++ attr_len = sfa->actions_len - (u32)st_offset; ++ if (WARN_ON_ONCE(attr_len < NLA_HDRLEN)) ++ return -EINVAL; ++ ++ if (attr_len > U16_MAX) ++ return -EMSGSIZE; ++ ++ a = (struct nlattr *)((u8 *)sfa->actions + st_offset); ++ a->nla_len = attr_len; ++ return 0; ++} ++ ++/* Free the generated action-list tail at @start and truncate it. ++ * If @nested, @start points to its containing nlattr header. ++ */ ++static void ovs_nla_trim(struct sw_flow_actions *sfa, int start, bool nested) ++{ ++ const struct nlattr *actions; ++ u32 len; ++ ++ if (start < 0) ++ return; ++ ++ if (WARN_ON_ONCE((u32)start > sfa->actions_len)) ++ return; + +- a->nla_len = sfa->actions_len - st_offset; ++ actions = (const struct nlattr *)((u8 *)sfa->actions + start); ++ len = sfa->actions_len - (u32)start; ++ ++ if (nested) { ++ if (len < NLA_HDRLEN) ++ goto out; ++ ++ actions = (const struct nlattr *)((u8 *)actions + NLA_HDRLEN); ++ len -= NLA_HDRLEN; ++ } ++ ++ ovs_nla_free_nested_actions(actions, len); ++out: ++ sfa->actions_len = start; + } + + static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, +@@ -2522,6 +2565,7 @@ static int validate_and_copy_sample(stru + const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1]; + const struct nlattr *probability, *actions; + const struct nlattr *a; ++ int actions_start; + int rem, start, err; + struct sample_arg arg; + +@@ -2565,18 +2609,27 @@ static int validate_and_copy_sample(stru + err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg), + log); + if (err) +- return err; ++ goto err; + ++ actions_start = (*sfa)->actions_len; + err = __ovs_nla_copy_actions(net, actions, key, sfa, + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); + + if (err) +- return err; ++ goto err_free; + +- add_nested_action_end(*sfa, start); ++ err = add_nested_action_end(*sfa, start); ++ if (err) ++ goto err_free; + + return 0; ++ ++err_free: ++ ovs_nla_trim(*sfa, actions_start, false); ++err: ++ (*sfa)->actions_len = start; ++ return err; + } + + static int validate_and_copy_dec_ttl(struct net *net, +@@ -2624,18 +2677,31 @@ static int validate_and_copy_dec_ttl(str + return start; + + action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log); +- if (action_start < 0) +- return action_start; ++ if (action_start < 0) { ++ err = action_start; ++ goto err; ++ } + + err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type, + vlan_tci, mpls_label_count, log, + depth + 1); + if (err) +- return err; ++ goto err_free; + +- add_nested_action_end(*sfa, action_start); +- add_nested_action_end(*sfa, start); ++ err = add_nested_action_end(*sfa, action_start); ++ if (err) ++ goto err_free; ++ ++ err = add_nested_action_end(*sfa, start); ++ if (err) ++ goto err_free; + return 0; ++ ++err_free: ++ ovs_nla_trim(*sfa, action_start, true); ++err: ++ (*sfa)->actions_len = start; ++ return err; + } + + static int validate_and_copy_clone(struct net *net, +@@ -2646,6 +2712,7 @@ static int validate_and_copy_clone(struc + u32 mpls_label_count, bool log, bool last, + u32 depth) + { ++ int actions_start; + int start, err; + u32 exec; + +@@ -2661,17 +2728,26 @@ static int validate_and_copy_clone(struc + err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec, + sizeof(exec), log); + if (err) +- return err; ++ goto err; + ++ actions_start = (*sfa)->actions_len; + err = __ovs_nla_copy_actions(net, attr, key, sfa, + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); + if (err) +- return err; ++ goto err_free; + +- add_nested_action_end(*sfa, start); ++ err = add_nested_action_end(*sfa, start); ++ if (err) ++ goto err_free; + + return 0; ++ ++err_free: ++ ovs_nla_trim(*sfa, actions_start, false); ++err: ++ (*sfa)->actions_len = start; ++ return err; + } + + void ovs_match_init(struct sw_flow_match *match, +@@ -2763,20 +2839,20 @@ static int validate_and_copy_set_tun(con + tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL, + GFP_KERNEL); + +- if (!tun_dst) +- return -ENOMEM; ++ if (!tun_dst) { ++ err = -ENOMEM; ++ goto err; ++ } + + err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL); +- if (err) { +- dst_release((struct dst_entry *)tun_dst); +- return err; +- } ++ if (err) ++ goto err_free_tun_dst; + + a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL, + sizeof(*ovs_tun), log); + if (IS_ERR(a)) { +- dst_release((struct dst_entry *)tun_dst); +- return PTR_ERR(a); ++ err = PTR_ERR(a); ++ goto err_free_tun_dst; + } + + ovs_tun = nla_data(a); +@@ -2797,8 +2873,16 @@ static int validate_and_copy_set_tun(con + ip_tunnel_info_opts_set(tun_info, + TUN_METADATA_OPTS(&key, key.tun_opts_len), + key.tun_opts_len, dst_opt_type); +- add_nested_action_end(*sfa, start); ++ err = add_nested_action_end(*sfa, start); ++ if (WARN_ON_ONCE(err)) ++ goto err_free_tun_dst; ++ ++ return 0; + ++err_free_tun_dst: ++ dst_release((struct dst_entry *)tun_dst); ++err: ++ (*sfa)->actions_len = start; + return err; + } + +@@ -2971,7 +3055,7 @@ static int validate_set(const struct nla + + /* Convert non-masked non-tunnel set actions to masked set actions. */ + if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) { +- int start, len = key_len * 2; ++ int err, start, len = key_len * 2; + struct nlattr *at; + + *skip_copy = true; +@@ -2983,8 +3067,11 @@ static int validate_set(const struct nla + return start; + + at = __add_action(sfa, key_type, NULL, len, log); +- if (IS_ERR(at)) +- return PTR_ERR(at); ++ if (IS_ERR(at)) { ++ err = PTR_ERR(at); ++ (*sfa)->actions_len = start; ++ return err; ++ } + + memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */ + memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */ +@@ -2994,7 +3081,11 @@ static int validate_set(const struct nla + + mask->ipv6_label &= htonl(0x000FFFFF); + } +- add_nested_action_end(*sfa, start); ++ err = add_nested_action_end(*sfa, start); ++ if (WARN_ON_ONCE(err)) { ++ (*sfa)->actions_len = start; ++ return err; ++ } + } + + return 0; +@@ -3040,7 +3131,8 @@ static int validate_and_copy_check_pkt_l + const struct nlattr *acts_if_greater, *acts_if_lesser_eq; + struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1]; + struct check_pkt_len_arg arg; +- int nested_acts_start; ++ int greater_acts_start = -1; ++ int lesser_acts_start = -1; + int start, err; + + err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX, +@@ -3075,37 +3167,58 @@ static int validate_and_copy_check_pkt_l + err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg, + sizeof(arg), log); + if (err) +- return err; ++ goto err_free; + +- nested_acts_start = add_nested_action_start(sfa, +- OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log); +- if (nested_acts_start < 0) +- return nested_acts_start; ++ lesser_acts_start = ++ add_nested_action_start(sfa, ++ OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, ++ log); ++ if (lesser_acts_start < 0) { ++ err = lesser_acts_start; ++ goto err_free; ++ } + + err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa, + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); + + if (err) +- return err; ++ goto err_free; + +- add_nested_action_end(*sfa, nested_acts_start); ++ err = add_nested_action_end(*sfa, lesser_acts_start); ++ if (err) ++ goto err_free; + +- nested_acts_start = add_nested_action_start(sfa, +- OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log); +- if (nested_acts_start < 0) +- return nested_acts_start; ++ greater_acts_start = ++ add_nested_action_start(sfa, ++ OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, ++ log); ++ if (greater_acts_start < 0) { ++ err = greater_acts_start; ++ goto err_free; ++ } + + err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa, + eth_type, vlan_tci, mpls_label_count, log, + depth + 1); + + if (err) +- return err; ++ goto err_free; ++ ++ err = add_nested_action_end(*sfa, greater_acts_start); ++ if (err) ++ goto err_free; + +- add_nested_action_end(*sfa, nested_acts_start); +- add_nested_action_end(*sfa, start); ++ err = add_nested_action_end(*sfa, start); ++ if (err) ++ goto err_free; + return 0; ++ ++err_free: ++ ovs_nla_trim(*sfa, greater_acts_start, true); ++ ovs_nla_trim(*sfa, lesser_acts_start, true); ++ ovs_nla_trim(*sfa, start, false); ++ return err; + } + + static int validate_psample(const struct nlattr *attr) diff --git a/queue-6.18/pmdomain-imx-fix-i.mx8mp-power-notifier.patch b/queue-6.18/pmdomain-imx-fix-i.mx8mp-power-notifier.patch new file mode 100644 index 0000000000..c0cbd3fe0c --- /dev/null +++ b/queue-6.18/pmdomain-imx-fix-i.mx8mp-power-notifier.patch @@ -0,0 +1,62 @@ +From 72422525f641f68bed6ca3389d29ee3f41fdea33 Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Wed, 10 Jun 2026 22:39:10 +0800 +Subject: pmdomain: imx: Fix i.MX8MP power notifier + +From: Peng Fan + +commit 72422525f641f68bed6ca3389d29ee3f41fdea33 upstream. + +Using imx8mm_vpu_power_notifier() for i.MX8MP is wrong, as it ungates +the VPU clocks to provide the ADB clock, which is necessary on i.MX8MM, +but on i.MX8MP there is a separate gate (bit 3) for the NoC. So add +imx8mp_vpu_power_notifier() for i.MX8MP. + +Fixes: a1a5f15f7f6cb ("soc: imx: imx8m-blk-ctrl: add i.MX8MP VPU blk ctrl") +Cc: stable@vger.kernel.org +Reviewed-by: Frank Li +Signed-off-by: Peng Fan +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/imx8m-blk-ctrl.c | 27 ++++++++++++++++++++++++++- + 1 file changed, 26 insertions(+), 1 deletion(-) + +--- a/drivers/pmdomain/imx/imx8m-blk-ctrl.c ++++ b/drivers/pmdomain/imx/imx8m-blk-ctrl.c +@@ -514,9 +514,34 @@ static const struct imx8m_blk_ctrl_domai + }, + }; + ++static int imx8mp_vpu_power_notifier(struct notifier_block *nb, ++ unsigned long action, void *data) ++{ ++ struct imx8m_blk_ctrl *bc = container_of(nb, struct imx8m_blk_ctrl, ++ power_nb); ++ ++ if (action == GENPD_NOTIFY_ON) { ++ /* ++ * On power up we have no software backchannel to the GPC to ++ * wait for the ADB handshake to happen, so we just delay for a ++ * bit. On power down the GPC driver waits for the handshake. ++ */ ++ ++ udelay(5); ++ ++ /* set "fuse" bits to enable the VPUs */ ++ regmap_set_bits(bc->regmap, 0x8, 0xffffffff); ++ regmap_set_bits(bc->regmap, 0xc, 0xffffffff); ++ regmap_set_bits(bc->regmap, 0x10, 0xffffffff); ++ regmap_set_bits(bc->regmap, 0x14, 0xffffffff); ++ } ++ ++ return NOTIFY_OK; ++} ++ + static const struct imx8m_blk_ctrl_data imx8mp_vpu_blk_ctl_dev_data = { + .max_reg = 0x18, +- .power_notifier_fn = imx8mm_vpu_power_notifier, ++ .power_notifier_fn = imx8mp_vpu_power_notifier, + .domains = imx8mp_vpu_blk_ctl_domain_data, + .num_domains = ARRAY_SIZE(imx8mp_vpu_blk_ctl_domain_data), + }; diff --git a/queue-6.18/pmdomain-imx-fix-i.mx8mp-vc8000e-power-up-sequence.patch b/queue-6.18/pmdomain-imx-fix-i.mx8mp-vc8000e-power-up-sequence.patch new file mode 100644 index 0000000000..fe544c6f5a --- /dev/null +++ b/queue-6.18/pmdomain-imx-fix-i.mx8mp-vc8000e-power-up-sequence.patch @@ -0,0 +1,85 @@ +From 25e252bcf1593b420b12a7231d9dd64b885a2ae2 Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Wed, 10 Jun 2026 22:39:11 +0800 +Subject: pmdomain: imx: Fix i.MX8MP VC8000E power up sequence + +From: Peng Fan + +commit 25e252bcf1593b420b12a7231d9dd64b885a2ae2 upstream. + +Per errata[1]: +ERR050531: VPU_NOC power down handshake may hang during VC8000E/VPUMIX +power up/down cycling. +Description: VC8000E reset de-assertion edge and AXI clock may have a +timing issue. +Workaround: Set bit2 (vc8000e_clk_en) of BLK_CLK_EN_CSR to 0 to gate off +both AXI clock and VC8000E clock sent to VC8000E and AXI clock sent to +VPU_NOC m_v_2 interface during VC8000E power up(VC8000E reset is +de-asserted by HW) + +Add a bool variable is_errata_err050531 in +'struct imx8m_blk_ctrl_domain_data' to represent whether the workaround +is needed. If is_errata_err050531 is true, first clear the clk before +powering up gpc, then enable the clk after powering up gpc. + +[1] https://www.nxp.com/webapp/Download?colCode=IMX8MP_1P33A + +Fixes: a1a5f15f7f6cb ("soc: imx: imx8m-blk-ctrl: add i.MX8MP VPU blk ctrl") +Cc: stable@vger.kernel.org +Signed-off-by: Peng Fan +Reviewed-by: Frank Li +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/imx/imx8m-blk-ctrl.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +--- a/drivers/pmdomain/imx/imx8m-blk-ctrl.c ++++ b/drivers/pmdomain/imx/imx8m-blk-ctrl.c +@@ -54,6 +54,15 @@ struct imx8m_blk_ctrl_domain_data { + * register. + */ + u32 mipi_phy_rst_mask; ++ ++ /* ++ * VC8000E reset de-assertion edge and AXI clock may have a timing issue. ++ * Workaround: Set bit2 (vc8000e_clk_en) of BLK_CLK_EN_CSR to 0 to gate off ++ * both AXI clock and VC8000E clock sent to VC8000E and AXI clock sent to ++ * VPU_NOC m_v_2 interface during VC8000E power up(VC8000E reset is ++ * de-asserted by HW) ++ */ ++ bool is_errata_err050531; + }; + + #define DOMAIN_MAX_CLKS 4 +@@ -108,7 +117,11 @@ static int imx8m_blk_ctrl_power_on(struc + dev_err(bc->dev, "failed to enable clocks\n"); + goto bus_put; + } +- regmap_set_bits(bc->regmap, BLK_CLK_EN, data->clk_mask); ++ ++ if (data->is_errata_err050531) ++ regmap_clear_bits(bc->regmap, BLK_CLK_EN, data->clk_mask); ++ else ++ regmap_set_bits(bc->regmap, BLK_CLK_EN, data->clk_mask); + + /* power up upstream GPC domain */ + ret = pm_runtime_get_sync(domain->power_dev); +@@ -117,6 +130,9 @@ static int imx8m_blk_ctrl_power_on(struc + goto clk_disable; + } + ++ if (data->is_errata_err050531) ++ regmap_set_bits(bc->regmap, BLK_CLK_EN, data->clk_mask); ++ + /* wait for reset to propagate */ + udelay(5); + +@@ -511,6 +527,7 @@ static const struct imx8m_blk_ctrl_domai + .clk_mask = BIT(2), + .path_names = (const char *[]){"vc8000e"}, + .num_paths = 1, ++ .is_errata_err050531 = true, + }, + }; + diff --git a/queue-6.18/powerpc-pseries-fix-memory-leak-on-krealloc-failure-in-papr_init.patch b/queue-6.18/powerpc-pseries-fix-memory-leak-on-krealloc-failure-in-papr_init.patch new file mode 100644 index 0000000000..d3e4c11659 --- /dev/null +++ b/queue-6.18/powerpc-pseries-fix-memory-leak-on-krealloc-failure-in-papr_init.patch @@ -0,0 +1,39 @@ +From bd83c98b988d2c560531084e296dbfb530aff829 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sun, 14 Jun 2026 16:23:56 +0200 +Subject: powerpc/pseries: fix memory leak on krealloc failure in papr_init + +From: Thorsten Blum + +commit bd83c98b988d2c560531084e296dbfb530aff829 upstream. + +When krealloc() fails, free the original esi_buf before returning to +avoid a memory leak. + +Fixes: 3c14b73454cf ("powerpc/pseries: Interface to represent PAPR firmware attributes") +Cc: stable@vger.kernel.org +Signed-off-by: Thorsten Blum +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20260614142356.658212-2-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/pseries/papr_platform_attributes.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/platforms/pseries/papr_platform_attributes.c ++++ b/arch/powerpc/platforms/pseries/papr_platform_attributes.c +@@ -271,11 +271,9 @@ retry: + esi_buf_size = ESI_HDR_SIZE + (CURR_MAX_ESI_ATTRS * max_esi_attrs); + + temp_esi_buf = krealloc(esi_buf, esi_buf_size, GFP_KERNEL); +- if (temp_esi_buf) +- esi_buf = temp_esi_buf; +- else +- return -ENOMEM; +- ++ if (!temp_esi_buf) ++ goto out_free_esi_buf; ++ esi_buf = temp_esi_buf; + goto retry; + } + diff --git a/queue-6.18/regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch b/queue-6.18/regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch new file mode 100644 index 0000000000..a3f84015a3 --- /dev/null +++ b/queue-6.18/regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch @@ -0,0 +1,58 @@ +From 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 Mon Sep 17 00:00:00 2001 +From: Abhishek Ojha +Date: Wed, 15 Jul 2026 13:04:08 -0400 +Subject: regulator: ltc3676: Fix incorrect IRQSTAT bit offsets + +From: Abhishek Ojha + +commit 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 upstream. + +The LTC3676_IRQSTAT_* bit definitions do not match the IRQSTAT +(Interrupt Request Status) register layout documented in Table 15 +of the LTC3676/LTC3676-1 datasheet: + + bit 0 - Pushbutton Status Active + bit 1 - Hard Reset Occurred + bit 2 - PGOOD Timeout Occurred + bit 3 - Undervoltage Warning + bit 4 - Undervoltage Standby (Fault) Occurred + bit 5 - Overtemperature Warning + bit 6 - Overtemperature Standby (Fault) Occurred + bit 7 - Reserved + +The driver instead defines these starting at bit 3, one bit higher +than the datasheet specifies, which causes ltc3676_regulator_isr() +to check the wrong status bits and misreport (or miss) PGOOD +timeout, undervoltage and thermal warning/fault conditions. + +Fix the bit offsets to match the datasheet. + +Fixes: 37b918a034fe ("regulator: Add LTC3676 support") +Cc: stable@vger.kernel.org +Signed-off-by: Abhishek Ojha +Link: https://patch.msgid.link/20260715170408.295552-1-Abhishek.ojha@savoirfairelinux.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/ltc3676.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/regulator/ltc3676.c ++++ b/drivers/regulator/ltc3676.c +@@ -45,11 +45,11 @@ + #define LTC3676_DVBxA_REF_SELECT BIT(5) + #define LTC3676_DVBxB_PGOOD_MASK BIT(5) + +-#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(3) +-#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(4) +-#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(5) +-#define LTC3676_IRQSTAT_THERMAL_WARN BIT(6) +-#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(7) ++#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(2) ++#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(3) ++#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(4) ++#define LTC3676_IRQSTAT_THERMAL_WARN BIT(5) ++#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(6) + + enum ltc3676_reg { + LTC3676_SW1, diff --git a/queue-6.18/reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch b/queue-6.18/reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch new file mode 100644 index 0000000000..97c57fca6e --- /dev/null +++ b/queue-6.18/reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch @@ -0,0 +1,48 @@ +From 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 Mon Sep 17 00:00:00 2001 +From: Robby Cai +Date: Fri, 19 Jun 2026 15:31:15 +0800 +Subject: reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ + +From: Robby Cai + +commit 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 upstream. + +On i.MX8MQ, the MIPI CSI reset lines are active-low and not self-clearing. +Writing '0' asserts reset and it remains asserted until explicitly +deasserted by software. + +This driver previously treated the MIPI CSI reset signals as active-high, +which led to incorrect reset assert/deassert sequencing. This issue was +exposed by commit 6d79bb8fd2aa ("media: imx8mq-mipi-csi2: Explicitly +release reset"). + +Fix this by reflecting the correct reset polarity and ensuring proper +reset handling. + +Fixes: c979dbf59987 ("reset: imx7: Add support for i.MX8MQ IP block variant") +Cc: stable@vger.kernel.org # 6d79bb8fd2aa: media: imx8mq-mipi-csi2: Explicitly release reset +Reviewed-by: Philipp Zabel +Signed-off-by: Robby Cai +Reviewed-by: Guoniu Zhou +Reviewed-by: Frank Li +Signed-off-by: Philipp Zabel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/reset/reset-imx7.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/reset/reset-imx7.c ++++ b/drivers/reset/reset-imx7.c +@@ -236,6 +236,12 @@ static int imx8mq_reset_set(struct reset + + case IMX8MQ_RESET_PCIE_CTRL_APPS_EN: + case IMX8MQ_RESET_PCIE2_CTRL_APPS_EN: ++ case IMX8MQ_RESET_MIPI_CSI1_CORE_RESET: ++ case IMX8MQ_RESET_MIPI_CSI1_PHY_REF_RESET: ++ case IMX8MQ_RESET_MIPI_CSI1_ESC_RESET: ++ case IMX8MQ_RESET_MIPI_CSI2_CORE_RESET: ++ case IMX8MQ_RESET_MIPI_CSI2_PHY_REF_RESET: ++ case IMX8MQ_RESET_MIPI_CSI2_ESC_RESET: + case IMX8MQ_RESET_MIPI_DSI_PCLK_RESET_N: + case IMX8MQ_RESET_MIPI_DSI_ESC_RESET_N: + case IMX8MQ_RESET_MIPI_DSI_DPI_RESET_N: diff --git a/queue-6.18/reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch b/queue-6.18/reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch new file mode 100644 index 0000000000..56eb900ba8 --- /dev/null +++ b/queue-6.18/reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch @@ -0,0 +1,46 @@ +From 1a8c89f8c112c75e84ff9a140f969e372aed0c9a Mon Sep 17 00:00:00 2001 +From: Zhao Dongdong +Date: Wed, 17 Jun 2026 11:16:27 +0800 +Subject: reset: sunxi: fix memory region leak on ioremap failure + +From: Zhao Dongdong + +commit 1a8c89f8c112c75e84ff9a140f969e372aed0c9a upstream. + +In sunxi_reset_init(), when ioremap() fails, the memory region obtained +via request_mem_region() is not released, leading to a resource leak. + +Add an err_mem_region label to properly release the memory region before +freeing the data structure. + +Fixes: 8f1ae77f4666 ("reset: Add Allwinner SoCs Reset Controller Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Zhao Dongdong +Reviewed-by: Philipp Zabel +Acked-by: Jernej Skrabec +Signed-off-by: Philipp Zabel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/reset/reset-sunxi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/reset/reset-sunxi.c ++++ b/drivers/reset/reset-sunxi.c +@@ -44,7 +44,7 @@ static int sunxi_reset_init(struct devic + data->membase = ioremap(res.start, size); + if (!data->membase) { + ret = -ENOMEM; +- goto err_alloc; ++ goto err_mem_region; + } + + spin_lock_init(&data->lock); +@@ -57,6 +57,8 @@ static int sunxi_reset_init(struct devic + + return reset_controller_register(&data->rcdev); + ++err_mem_region: ++ release_mem_region(res.start, size); + err_alloc: + kfree(data); + return ret; diff --git a/queue-6.18/riscv-vdso-do-not-use-lto-for-the-vdso.patch b/queue-6.18/riscv-vdso-do-not-use-lto-for-the-vdso.patch new file mode 100644 index 0000000000..c1360a1272 --- /dev/null +++ b/queue-6.18/riscv-vdso-do-not-use-lto-for-the-vdso.patch @@ -0,0 +1,46 @@ +From ad6dcfa023762e37962f77ee48e752b7570e9440 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= +Date: Wed, 1 Jul 2026 11:21:22 +0200 +Subject: riscv: vdso: Do not use LTO for the vDSO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +commit ad6dcfa023762e37962f77ee48e752b7570e9440 upstream. + +With LTO enabled the compiler assumes that the vDSO functions are not +used and optimizes them away completely. Currently this happens to +__vdso_clock_getres(), __vdso_clock_gettime(), __vdso_getrandom(), +__vdso_gettimeofday() and __vdso_riscv_hwprobe(). + +Disable LTO for the vDSO, as these functions are hand-optimized anyways. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202606301855.WvkSC4kD-lkp@intel.com/ +Fixes: 021d23428bdb ("RISC-V: build: Allow LTO to be selected") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Weißschuh +Link: https://patch.msgid.link/20260701-riscv-vdso-lto-v1-1-89db0cd82077@linutronix.de +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/vdso/Makefile | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -49,9 +49,9 @@ CPPFLAGS_vdso.lds += -DHAS_VGETTIMEOFDAY + endif + + # Disable -pg to prevent insert call site +-CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) +-CFLAGS_REMOVE_getrandom.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) +-CFLAGS_REMOVE_hwprobe.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) ++CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) $(CC_FLAGS_LTO) ++CFLAGS_REMOVE_getrandom.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) $(CC_FLAGS_LTO) ++CFLAGS_REMOVE_hwprobe.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) $(CC_FLAGS_LTO) + + # Force dependency + $(obj)/vdso.o: $(obj)/vdso.so diff --git a/queue-6.18/selftests-landlock-fix-screwed-up-pointers-in-the-scoped_signal_test.patch b/queue-6.18/selftests-landlock-fix-screwed-up-pointers-in-the-scoped_signal_test.patch new file mode 100644 index 0000000000..3e9106bc77 --- /dev/null +++ b/queue-6.18/selftests-landlock-fix-screwed-up-pointers-in-the-scoped_signal_test.patch @@ -0,0 +1,184 @@ +From d793186aa3bb833c878ae6826c87e62c843afaa3 Mon Sep 17 00:00:00 2001 +From: Thomas Huth +Date: Thu, 9 Jul 2026 18:43:40 +0200 +Subject: selftests/landlock: Fix screwed up pointers in the scoped_signal_test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Huth + +commit d793186aa3bb833c878ae6826c87e62c843afaa3 upstream. + +The scoped_signal_test uses pthread_join(..., (void **)&ret)) in +a couple of places, i.e. the return value of the thread is stored +in the shape of a "void *" into the memory location of &ret. +Pointers are 64-bit on modern computers, but the ret variable is +declared as a simple "enum thread_return" which is only 32 bits. +So the pthread_join() will overflow the ret variable by 4 byte. + +The problem is very visible on big endian systems like s390x +where the test is failing: The least significant byte that carries +the return code of the thread is not written into the ret variable +here, but somewhere else in the stack frame, so the comparison +for the right return code is failing here. + +Fix it by getting rid of the enum and defining the THREAD_* constants +and "ret" variables as proper "void *" pointers. This way we can +also get rid of some ugly (void *) castings in a couple of spots. + +Signed-off-by: Thomas Huth +Link: https://patch.msgid.link/20260709164340.339656-1-thuth@redhat.com +Cc: stable@vger.kernel.org +Fixes: c8994965013e ("selftests/landlock: Test signal scoping for threads") +[mic: Add clang-format markups] +Signed-off-by: Mickaël Salaün +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/landlock/scoped_signal_test.c | 46 +++++++++--------- + 1 file changed, 23 insertions(+), 23 deletions(-) + +--- a/tools/testing/selftests/landlock/scoped_signal_test.c ++++ b/tools/testing/selftests/landlock/scoped_signal_test.c +@@ -249,12 +249,12 @@ TEST_F(scoped_domains, check_access_sign + _metadata->exit_code = KSFT_FAIL; + } + +-enum thread_return { +- THREAD_INVALID = 0, +- THREAD_SUCCESS = 1, +- THREAD_ERROR = 2, +- THREAD_TEST_FAILED = 3, +-}; ++/* clang-format off */ ++#define THREAD_INVALID ((void *)0) ++#define THREAD_SUCCESS ((void *)1) ++#define THREAD_ERROR ((void *)2) ++#define THREAD_TEST_FAILED ((void *)3) ++/* clang-format on */ + + static void *thread_sync(void *arg) + { +@@ -262,15 +262,15 @@ static void *thread_sync(void *arg) + char buf; + + if (read(pipe_read, &buf, 1) != 1) +- return (void *)THREAD_ERROR; ++ return THREAD_ERROR; + +- return (void *)THREAD_SUCCESS; ++ return THREAD_SUCCESS; + } + + TEST(signal_scoping_thread_before) + { + pthread_t no_sandbox_thread; +- enum thread_return ret = THREAD_INVALID; ++ void *ret = THREAD_INVALID; + int thread_pipe[2]; + + drop_caps(_metadata); +@@ -285,7 +285,7 @@ TEST(signal_scoping_thread_before) + EXPECT_EQ(0, pthread_kill(no_sandbox_thread, 0)); + EXPECT_EQ(1, write(thread_pipe[1], ".", 1)); + +- EXPECT_EQ(0, pthread_join(no_sandbox_thread, (void **)&ret)); ++ EXPECT_EQ(0, pthread_join(no_sandbox_thread, &ret)); + EXPECT_EQ(THREAD_SUCCESS, ret); + + EXPECT_EQ(0, close(thread_pipe[0])); +@@ -295,7 +295,7 @@ TEST(signal_scoping_thread_before) + TEST(signal_scoping_thread_after) + { + pthread_t scoped_thread; +- enum thread_return ret = THREAD_INVALID; ++ void *ret = THREAD_INVALID; + int thread_pipe[2]; + + drop_caps(_metadata); +@@ -310,7 +310,7 @@ TEST(signal_scoping_thread_after) + EXPECT_EQ(0, pthread_kill(scoped_thread, 0)); + EXPECT_EQ(1, write(thread_pipe[1], ".", 1)); + +- EXPECT_EQ(0, pthread_join(scoped_thread, (void **)&ret)); ++ EXPECT_EQ(0, pthread_join(scoped_thread, &ret)); + EXPECT_EQ(THREAD_SUCCESS, ret); + + EXPECT_EQ(0, close(thread_pipe[0])); +@@ -327,20 +327,20 @@ void *thread_setuid(void *ptr) + char buf; + + if (read(arg->pipe_read, &buf, 1) != 1) +- return (void *)THREAD_ERROR; ++ return THREAD_ERROR; + + /* libc's setuid() should update all thread's credentials. */ + if (getuid() != arg->new_uid) +- return (void *)THREAD_TEST_FAILED; ++ return THREAD_TEST_FAILED; + +- return (void *)THREAD_SUCCESS; ++ return THREAD_SUCCESS; + } + + TEST(signal_scoping_thread_setuid) + { + struct thread_setuid_args arg; + pthread_t no_sandbox_thread; +- enum thread_return ret = THREAD_INVALID; ++ void *ret = THREAD_INVALID; + int pipe_parent[2]; + int prev_uid; + +@@ -367,7 +367,7 @@ TEST(signal_scoping_thread_setuid) + EXPECT_EQ(arg.new_uid, getuid()); + EXPECT_EQ(1, write(pipe_parent[1], ".", 1)); + +- EXPECT_EQ(0, pthread_join(no_sandbox_thread, (void **)&ret)); ++ EXPECT_EQ(0, pthread_join(no_sandbox_thread, &ret)); + EXPECT_EQ(THREAD_SUCCESS, ret); + + clear_cap(_metadata, CAP_SETUID); +@@ -688,20 +688,20 @@ static void *thread_setown_scoped(void * + ruleset_fd = + landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); + if (ruleset_fd < 0) +- return (void *)THREAD_ERROR; ++ return THREAD_ERROR; + if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) || + landlock_restrict_self(ruleset_fd, 0)) { + close(ruleset_fd); +- return (void *)THREAD_ERROR; ++ return THREAD_ERROR; + } + close(ruleset_fd); + + /* Makes this process group own the SIGIO source. */ + if (fcntl(fd, F_SETSIG, SIGURG) || fcntl(fd, F_SETOWN, -getpgrp()) || + fcntl(fd, F_SETFL, O_ASYNC)) +- return (void *)THREAD_ERROR; ++ return THREAD_ERROR; + +- return (void *)THREAD_SUCCESS; ++ return THREAD_SUCCESS; + } + + /* +@@ -723,7 +723,7 @@ TEST(sigio_to_pgid_self) + { + int trigger[2]; + pthread_t thread; +- enum thread_return ret = THREAD_INVALID; ++ void *ret = THREAD_INVALID; + int i; + + drop_caps(_metadata); +@@ -743,7 +743,7 @@ TEST(sigio_to_pgid_self) + */ + ASSERT_EQ(0, pthread_create(&thread, NULL, thread_setown_scoped, + &trigger[0])); +- ASSERT_EQ(0, pthread_join(thread, (void **)&ret)); ++ ASSERT_EQ(0, pthread_join(thread, &ret)); + ASSERT_EQ(THREAD_SUCCESS, ret); + + /* Fans SIGURG out to the process group. */ diff --git a/queue-6.18/selftests-landlock-skip-scoped_signal-subtest-with-msg_oob-if-not-available.patch b/queue-6.18/selftests-landlock-skip-scoped_signal-subtest-with-msg_oob-if-not-available.patch new file mode 100644 index 0000000000..547c5c9561 --- /dev/null +++ b/queue-6.18/selftests-landlock-skip-scoped_signal-subtest-with-msg_oob-if-not-available.patch @@ -0,0 +1,65 @@ +From 5ab1dc6d110db6bee167a32fd94c53ea0e7ad6d2 Mon Sep 17 00:00:00 2001 +From: Thomas Huth +Date: Fri, 10 Jul 2026 10:16:42 +0200 +Subject: selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Huth + +commit 5ab1dc6d110db6bee167a32fd94c53ea0e7ad6d2 upstream. + +MSG_OOB might be disabled in the kernel for unix sockets (by not +selecting CONFIG_AF_UNIX_OOB), and in this case the related tests +of the scoped_signal_test are currently failing. Add a runtime +probe using socketpair() to detect MSG_OOB support and skip the +test gracefully if it is unavailable. + +Signed-off-by: Thomas Huth +Link: https://patch.msgid.link/20260710081642.405916-1-thuth@redhat.com +Cc: stable@vger.kernel.org +Fixes: f34e9ce5f479 ("selftests/landlock: Test signal created by out-of-bound message") +Signed-off-by: Mickaël Salaün +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/landlock/scoped_signal_test.c | 21 ++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/tools/testing/selftests/landlock/scoped_signal_test.c ++++ b/tools/testing/selftests/landlock/scoped_signal_test.c +@@ -400,6 +400,24 @@ static int setup_signal_handler(int sign + return sigaction(SIGURG, &sa, NULL); + } + ++/* ++ * MSG_OOB might be disabled in the kernel via the CONFIG_AF_UNIX_OOB ++ * switch, so this function can be used for probing for its availability. ++ */ ++static bool has_af_unix_oob(void) ++{ ++ bool available = false; ++ int sp[2]; ++ ++ if (socketpair(AF_UNIX, SOCK_STREAM, 0, sp) == 0) { ++ available = (send(sp[0], ".", 1, MSG_OOB) == 1); ++ close(sp[0]); ++ close(sp[1]); ++ } ++ ++ return available; ++} ++ + /* clang-format off */ + FIXTURE(fown) {}; + /* clang-format on */ +@@ -462,6 +480,9 @@ TEST_F(fown, sigurg_socket) + int pipe_parent[2], pipe_child[2]; + pid_t child; + ++ if (!has_af_unix_oob()) ++ SKIP(return, "CONFIG_AF_UNIX_OOB / MSG_OOB not available"); ++ + memset(&server_address, 0, sizeof(server_address)); + set_unix_address(&server_address, 0); + diff --git a/queue-6.18/series b/queue-6.18/series index b45447b511..78afb870bd 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -1473,3 +1473,25 @@ s390-diag-add-missing-array_index_nospec-call-to-memtop_get_page_count.patch s390-mm-fix-type-mismatch-in-get_align_mask.patch selftests-rseq-fix-a-building-error-for-riscv-arch.patch cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch +pmdomain-imx-fix-i.mx8mp-power-notifier.patch +pmdomain-imx-fix-i.mx8mp-vc8000e-power-up-sequence.patch +selftests-landlock-skip-scoped_signal-subtest-with-msg_oob-if-not-available.patch +selftests-landlock-fix-screwed-up-pointers-in-the-scoped_signal_test.patch +mmc-sdhci-esdhc-imx-restore-pinctrl-before-restoring-ios-timing-on-resume.patch +powerpc-pseries-fix-memory-leak-on-krealloc-failure-in-papr_init.patch +net-mlx5-free-mlx5_st_idx_data-on-final-dealloc.patch +wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch +wifi-mwifiex-fix-roaming-to-different-channel-in-host_mlme-mode.patch +wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch +wifi-brcmfmac-cyw-fix-heap-overflow-on-a-short-auth-frame.patch +riscv-vdso-do-not-use-lto-for-the-vdso.patch +regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch +net-openvswitch-reject-oversized-nested-action-attrs.patch +bluetooth-btrtl-validate-firmware-patch-bounds.patch +llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch +macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch +memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch +ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch +ipvs-reload-ip-header-after-head-reallocation.patch +reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch +reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch diff --git a/queue-6.18/wifi-brcmfmac-cyw-fix-heap-overflow-on-a-short-auth-frame.patch b/queue-6.18/wifi-brcmfmac-cyw-fix-heap-overflow-on-a-short-auth-frame.patch new file mode 100644 index 0000000000..123236e8c5 --- /dev/null +++ b/queue-6.18/wifi-brcmfmac-cyw-fix-heap-overflow-on-a-short-auth-frame.patch @@ -0,0 +1,56 @@ +From 240c8d2c717b3f8153e7e877b22a82518d78dbdc Mon Sep 17 00:00:00 2001 +From: Maoyi Xie +Date: Sat, 27 Jun 2026 21:13:13 +0800 +Subject: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame + +From: Maoyi Xie + +commit 240c8d2c717b3f8153e7e877b22a82518d78dbdc upstream. + +brcmf_notify_auth_frame_rx() takes the frame length from the firmware +event and copies the frame body with the management header offset +subtracted: + + u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); + ... + memcpy(&mgmt_frame->u, frame, + mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); + +The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len +can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When +mgmt_frame_len is below that, the subtraction wraps as an unsigned value to +a huge length. The memcpy then runs far past the kzalloc'd buffer. A +malicious or malfunctioning AP can make the frame short during the +external SAE auth exchange, so this is a remotely triggered heap overflow. + +Reject frames shorter than the management header offset before the copy. + +Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode") +Link: https://lore.kernel.org/r/178214417708.2368577.16740907093694208834@maoyixie.com +Cc: stable@vger.kernel.org +Co-developed-by: Kaixuan Li +Signed-off-by: Kaixuan Li +Signed-off-by: Maoyi Xie +Acked-by: Arend van Spriel +Link: https://patch.msgid.link/20260627131313.3878893-1-maoyixie.tju@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +@@ -294,6 +294,12 @@ brcmf_notify_auth_frame_rx(struct brcmf_ + return -EINVAL; + } + ++ if (mgmt_frame_len < offsetof(struct ieee80211_mgmt, u)) { ++ bphy_err(drvr, "Event %s (%d) frame too small. Ignore\n", ++ brcmf_fweh_event_name(e->event_code), e->event_code); ++ return -EINVAL; ++ } ++ + wdev = &ifp->vif->wdev; + WARN_ON(!wdev); + diff --git a/queue-6.18/wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch b/queue-6.18/wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch new file mode 100644 index 0000000000..5292c0a822 --- /dev/null +++ b/queue-6.18/wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch @@ -0,0 +1,56 @@ +From 95fc02722edde02946d0d475221f2b2054d3d8ba Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Mon, 6 Jul 2026 22:35:07 +0800 +Subject: wifi: mac80211: fix memory leak in ieee80211_register_hw() + +From: Dawei Feng + +commit 95fc02722edde02946d0d475221f2b2054d3d8ba upstream. + +If kmemdup() fails while copying supported band structures, the error +path jumps to fail_rate. This skips rate_control_deinitialize() and +leaks the initialized local->rate_ctrl. + +Fix this by adding a fail_band label that shares the rate-control cleanup +path before falling through to the remaining teardown. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still present in +v7.1-rc7. + +An x86_64 allyesconfig build showed no new warnings. As we do not have a +suitable mac80211 device/driver combination to test with, no runtime +testing was able to be performed. + +Fixes: 09b4a4faf9d0 ("mac80211: introduce capability flags for VHT EXT NSS support") +Cc: stable@vger.kernel.org +Reviewed-by: Zilin Guan +Signed-off-by: Dawei Feng +Link: https://patch.msgid.link/20260706143507.146131-1-dawei.feng@seu.edu.cn +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1575,7 +1575,7 @@ int ieee80211_register_hw(struct ieee802 + sband = kmemdup(sband, sizeof(*sband), GFP_KERNEL); + if (!sband) { + result = -ENOMEM; +- goto fail_rate; ++ goto fail_band; + } + + wiphy_dbg(hw->wiphy, "copying sband (band %d) due to VHT EXT NSS BW flag\n", +@@ -1642,6 +1642,7 @@ int ieee80211_register_hw(struct ieee802 + #endif + wiphy_unregister(local->hw.wiphy); + fail_wiphy_register: ++ fail_band: + rtnl_lock(); + rate_control_deinitialize(local); + ieee80211_remove_interfaces(local); diff --git a/queue-6.18/wifi-mwifiex-fix-roaming-to-different-channel-in-host_mlme-mode.patch b/queue-6.18/wifi-mwifiex-fix-roaming-to-different-channel-in-host_mlme-mode.patch new file mode 100644 index 0000000000..7cff8b4d52 --- /dev/null +++ b/queue-6.18/wifi-mwifiex-fix-roaming-to-different-channel-in-host_mlme-mode.patch @@ -0,0 +1,70 @@ +From a707e4127c0f893c7a7703500ab56297a5bd2d51 Mon Sep 17 00:00:00 2001 +From: Rafael Beims +Date: Wed, 10 Jun 2026 12:00:18 -0300 +Subject: wifi: mwifiex: fix roaming to different channel in host_mlme mode + +From: Rafael Beims + +commit a707e4127c0f893c7a7703500ab56297a5bd2d51 upstream. + +When host MLME is enabled, mwifiex_cfg80211_authenticate() transmits the +authentication frame on a remain-on-channel (ROC) reservation so that the +frame is sent on the target BSS's channel. The ROC is only configured +when priv->auth_flag is zero. + +priv->auth_flag is set to HOST_MLME_AUTH_PENDING when the auth frame is +queued and advances to HOST_MLME_AUTH_DONE once authentication +completes. It is only cleared back to zero on a disconnect, deauth or +timeout path; nothing clears it when an association succeeds. It therefore +stays at HOST_MLME_AUTH_DONE for the whole connected session. + +When the station later roams to a BSS on a different channel, the next +authentication finds auth_flag != 0, skips the ROC setup, and the auth +frame is transmitted on the currently-associated channel instead of the +target's channel. Authentication times out on the new AP and the device +stays connected to the original AP. + +Gate the ROC setup on HOST_MLME_AUTH_PENDING instead of on auth_flag +being completely clear. This re-arms the remain-on-channel for every new +authentication attempt, while still suppressing a redundant ROC during +the multi-frame SAE exchange, where auth_flag stays PENDING between the +commit and confirm frames. + +This change was tested in 3 different devices: +Verdin AM62 (IW412 SD-UART) - (16.92.21.p142) +Verdin iMX8MM (W8997 SD-SD) - (16.68.1.p197) +Verdin iMX8MP (W8997 SD-UART) - (16.92.21.p137) + +There following loop tests were performed: +1) force roaming between two AP's, one 5GHz and one 2.4GHz, same +SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s +between iterations. +2) force a disconnection to AP 1 and a connection to AP 2, test +scan. Use wpa_cli to trigger the connection changes, sleep 2s +between iterations. + +Each test ran in each device for at least 3 hours. + +Fixes: 36995892c271 ("wifi: mwifiex: add host mlme for client mode") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 +Signed-off-by: Rafael Beims +Reviewed-by: Francesco Dolcini +Link: https://patch.msgid.link/20260610150021.1018611-1-rafael@beims.me +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -4326,7 +4326,7 @@ mwifiex_cfg80211_authenticate(struct wip + return -EOPNOTSUPP; + } + +- if (!priv->auth_flag) { ++ if (!(priv->auth_flag & HOST_MLME_AUTH_PENDING)) { + ret = mwifiex_remain_on_chan_cfg(priv, HostCmd_ACT_GEN_SET, + req->bss->channel, + AUTH_TX_DEFAULT_WAIT_TIME); diff --git a/queue-6.18/wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch b/queue-6.18/wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch new file mode 100644 index 0000000000..a6641dd1d8 --- /dev/null +++ b/queue-6.18/wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch @@ -0,0 +1,75 @@ +From 536fb3d739d75a03cb318c0c6fe799425cfea501 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Fri, 19 Jun 2026 15:31:04 +0800 +Subject: wifi: rt2x00: avoid full teardown before work setup in probe + +From: Runyu Xiao + +commit 536fb3d739d75a03cb318c0c6fe799425cfea501 upstream. + +rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for +all probe failures. However, drv_data allocation and workqueue allocation +can fail before intf_work, autowakeup_work and sleep_work have been +initialized. + +Do not enter the full remove path until the probe has reached the point +where those work items are set up. Return directly for drv_data allocation +failure, and use a small early cleanup path for workqueue allocation +failure. + +This issue was found by our static analysis tool and then confirmed by +manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The +early probe exits should not call a common teardown path that assumes the +later work setup has already completed. + +A QEMU PoC forced alloc_ordered_workqueue() to fail before the work +initializers are reached. The resulting fail path entered +rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with +rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack. + +Fixes: 1ebbc48520a0 ("rt2x00: Introduce concept of driver data in struct rt2x00_dev.") +Fixes: 0439f5367c8d ("rt2x00: Move TX/RX work into dedicated workqueue") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Link: https://patch.msgid.link/20260619073104.1809161-1-runyu.xiao@seu.edu.cn +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +@@ -1382,7 +1382,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de + GFP_KERNEL); + if (!rt2x00dev->drv_data) { + retval = -ENOMEM; +- goto exit; ++ return retval; + } + } + +@@ -1416,7 +1416,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de + alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy)); + if (!rt2x00dev->workqueue) { + retval = -ENOMEM; +- goto exit; ++ goto exit_free_drv_data; + } + + INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled); +@@ -1489,6 +1489,14 @@ exit: + rt2x00lib_remove_dev(rt2x00dev); + + return retval; ++ ++exit_free_drv_data: ++ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); ++ ++ kfree(rt2x00dev->drv_data); ++ rt2x00dev->drv_data = NULL; ++ ++ return retval; + } + EXPORT_SYMBOL_GPL(rt2x00lib_probe_dev); +