From: Greg Kroah-Hartman Date: Thu, 15 Jan 2026 15:06:00 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.6.121~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d4d58e239c79cf772da1cf04c9767acd19b4e790;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch gpio-pca953x-fix-wrong-error-probe-return-value.patch --- diff --git a/queue-6.6/bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch b/queue-6.6/bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch new file mode 100644 index 0000000000..37e9d3aafd --- /dev/null +++ b/queue-6.6/bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch @@ -0,0 +1,45 @@ +From 7f9ee5fc97e14682e36fe22ae2654c07e4998b82 Mon Sep 17 00:00:00 2001 +From: Shardul Bankar +Date: Tue, 14 Oct 2025 17:30:37 +0530 +Subject: bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path + +From: Shardul Bankar + +commit 7f9ee5fc97e14682e36fe22ae2654c07e4998b82 upstream. + +Fix a memory leak in bpf_prog_test_run_xdp() where the context buffer +allocated by bpf_ctx_init() is not freed when the function returns early +due to a data size check. + +On the failing path: + ctx = bpf_ctx_init(...); + if (kattr->test.data_size_in - meta_sz < ETH_HLEN) + return -EINVAL; + +The early return bypasses the cleanup label that kfree()s ctx, leading to a +leak detectable by kmemleak under fuzzing. Change the return to jump to the +existing free_ctx label. + +Fixes: fe9544ed1a2e ("bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN") +Reported-by: BPF Runtime Fuzzer (BRF) +Signed-off-by: Shardul Bankar +Signed-off-by: Martin KaFai Lau +Acked-by: Jiri Olsa +Acked-by: Daniel Borkmann +Link: https://patch.msgid.link/20251014120037.1981316-1-shardulsb08@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + net/bpf/test_run.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bpf/test_run.c ++++ b/net/bpf/test_run.c +@@ -1214,7 +1214,7 @@ int bpf_prog_test_run_xdp(struct bpf_pro + goto free_ctx; + + if (kattr->test.data_size_in - meta_sz < ETH_HLEN) +- return -EINVAL; ++ goto free_ctx; + + data = bpf_test_init(kattr, linear_sz, max_linear_sz, headroom, tailroom); + if (IS_ERR(data)) { diff --git a/queue-6.6/gpio-pca953x-fix-wrong-error-probe-return-value.patch b/queue-6.6/gpio-pca953x-fix-wrong-error-probe-return-value.patch new file mode 100644 index 0000000000..278aff92b4 --- /dev/null +++ b/queue-6.6/gpio-pca953x-fix-wrong-error-probe-return-value.patch @@ -0,0 +1,33 @@ +From 0a1db19f66c0960eb00e1f2ccd40708b6747f5b1 Mon Sep 17 00:00:00 2001 +From: Sascha Hauer +Date: Mon, 16 Jun 2025 15:45:03 +0200 +Subject: gpio: pca953x: fix wrong error probe return value + +From: Sascha Hauer + +commit 0a1db19f66c0960eb00e1f2ccd40708b6747f5b1 upstream. + +The second argument to dev_err_probe() is the error value. Pass the +return value of devm_request_threaded_irq() there instead of the irq +number. + +Signed-off-by: Sascha Hauer +Fixes: c47f7ff0fe61 ("gpio: pca953x: Utilise dev_err_probe() where it makes sense") +Link: https://lore.kernel.org/r/20250616134503.1201138-1-s.hauer@pengutronix.de +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-pca953x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -989,7 +989,7 @@ static int pca953x_irq_setup(struct pca9 + IRQF_ONESHOT | IRQF_SHARED, dev_name(dev), + chip); + if (ret) +- return dev_err_probe(dev, client->irq, "failed to request irq\n"); ++ return dev_err_probe(dev, ret, "failed to request irq\n"); + + return 0; + } diff --git a/queue-6.6/series b/queue-6.6/series index a9d1bec1d4..a7395f504d 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -84,3 +84,5 @@ alsa-usb-audio-update-for-native-dsd-support-quirks.patch asoc-amd-yc-add-quirk-for-honor-magicbook-x16-2025.patch asoc-fsl_sai-add-missing-registers-to-cache-default.patch scsi-sg-fix-occasional-bogus-elapsed-time-that-excee.patch +bpf-test_run-fix-ctx-leak-in-bpf_prog_test_run_xdp-error-path.patch +gpio-pca953x-fix-wrong-error-probe-return-value.patch