From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 12:45:11 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d90c27111402a621e5a2d98bd920eb79d9557985;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch asoc-mediatek-mt8183-release-reserved-memory-on-cleanup.patch asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch asoc-mediatek-mt8192-release-reserved-memory-on-cleanup.patch asoc-qcom-q6apm-fix-null-pointer-dereference-in-graph_callback.patch asoc-sof-ipc3-control-fix-heap-overflow-in-bytes_ext-put-get.patch asoc-sof-ipc3-control-validate-size-in-snd_sof_update_control.patch asoc-sof-topology-fix-memory-leak-in-snd_sof_load_topology.patch backlight-ktd2801-enable-bl_core_suspendresume.patch batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch batman-adv-dat-fix-tie-break-for-candidate-selection.patch batman-adv-ensure-minimal-ethernet-header-on-tx.patch batman-adv-fix-vlan-priority-offset.patch batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch batman-adv-frag-free-unfragmentable-packet.patch batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch batman-adv-mcast-avoid-oob-read-of-num_dests-header.patch batman-adv-retrieve-ethhdr-after-potential-skb-realloc-on-rx.patch batman-adv-tt-avoid-request-storms-during-pending-request.patch batman-adv-tt-prevent-tvlv-oob-check-overflow.patch cifs-invalidate-cfid-on-unlink-rename-rmdir.patch cpufreq-intel_pstate-set-non-turbo-capacity-to-hwp_guaranteed_perf.patch cpufreq-schedutil-fix-uncleared-need_freq_update-on-the-.adjust_perf-path.patch fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch fbdev-efifb-fix-memory-leak-in-efifb_probe.patch fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch fbdev-vesafb-fix-memory-leak-in-vesafb_probe.patch gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch gpu-nova-core-simplify-and_then-with-condition-to-filter.patch leds-uleds-fix-potential-buffer-overread.patch mfd-sm501-fix-reference-leak-on-failed-device-registration.patch mfd-tps6586x-fix-of-node-refcount.patch netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch netfilter-ecache-fix-inverted-time_after-check.patch netfilter-flowtable-support-ipip-tunnel-with-direct-xmit.patch netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch netfilter-flowtable-use-dst-in-this-direction-when-pushing-ipip-header.patch netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch netfilter-nf_queue-pin-bridge-device-while-nfqueue-holds-fake-dst.patch netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch netfilter-nft_fib-reject-fib-expression-on-the-netdev-egress-hook.patch netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch netfilter-xt_nat-reject-unsupported-target-families.patch netfilter-xt_physdev-masks-are-not-c-strings.patch perf-x86-amd-brs-fix-kernel-address-leakage.patch perf-x86-amd-lbr-fix-kernel-address-leakage.patch s390-perf_cpum_cf-add-missing-array_index_nospec-to-__hw_perf_event_init.patch selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch selinux-check-connect-related-permissions-on-tcp-fast-open.patch selinux-fix-incorrect-execmem-checks-on-overlayfs.patch soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch tools-power-x86-intel-speed-select-harden-daemon-pidfile-open.patch x86-boot-reject-too-long-acpi_rsdp-values.patch x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch x86-video-only-fall-back-to-vga_default_device-without-screen-info.patch x86-virt-sev-revert-drop-wbinvd-before-setting-msr_amd64_syscfg_snp_en.patch --- diff --git a/queue-7.1/asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch b/queue-7.1/asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch new file mode 100644 index 0000000000..f318b8c9a3 --- /dev/null +++ b/queue-7.1/asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch @@ -0,0 +1,59 @@ +From f0334fbfd107682d0c95f3f71e25f6127038e2b9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Wed, 27 May 2026 10:41:49 -0300 +Subject: ASoC: mediatek: mt8183: Check runtime resume during probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit f0334fbfd107682d0c95f3f71e25f6127038e2b9 upstream. + +The MT8183 AFE probe uses pm_runtime_get_sync() before reading hardware +defaults into the regmap cache, but does not check whether runtime resume +failed. If regmap_reinit_cache() then fails, the temporary runtime PM +usage count is also not released. + +Use pm_runtime_resume_and_get() so resume failures abort probe without +leaking a usage count, and release the temporary reference before +handling the regmap cache result. + +Fixes: a94aec035a12 ("ASoC: mediatek: mt8183: add platform driver") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260527-asoc-mt8183-probe-cleanup-v1-2-4f4f5593c8d1@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c ++++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +@@ -833,17 +833,21 @@ static int mt8183_afe_pcm_dev_probe(stru + + /* enable clock for regcache get default value from hw */ + afe_priv->pm_runtime_bypass_reg_ctl = true; +- pm_runtime_get_sync(dev); +- +- ret = regmap_reinit_cache(afe->regmap, &mt8183_afe_regmap_config); ++ ret = pm_runtime_resume_and_get(dev); + if (ret) { +- dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret); ++ afe_priv->pm_runtime_bypass_reg_ctl = false; + goto err_pm_disable; + } + ++ ret = regmap_reinit_cache(afe->regmap, &mt8183_afe_regmap_config); + pm_runtime_put_sync(dev); + afe_priv->pm_runtime_bypass_reg_ctl = false; + ++ if (ret) { ++ dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret); ++ goto err_pm_disable; ++ } ++ + regcache_cache_only(afe->regmap, true); + regcache_mark_dirty(afe->regmap); + diff --git a/queue-7.1/asoc-mediatek-mt8183-release-reserved-memory-on-cleanup.patch b/queue-7.1/asoc-mediatek-mt8183-release-reserved-memory-on-cleanup.patch new file mode 100644 index 0000000000..43ee934d4d --- /dev/null +++ b/queue-7.1/asoc-mediatek-mt8183-release-reserved-memory-on-cleanup.patch @@ -0,0 +1,56 @@ +From bee65e00c0924ebecf97718d95dcf4a05ee36471 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Wed, 27 May 2026 10:41:48 -0300 +Subject: ASoC: mediatek: mt8183: Release reserved memory on cleanup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit bee65e00c0924ebecf97718d95dcf4a05ee36471 upstream. + +The MT8183 AFE probe can assign reserved memory with +of_reserved_mem_device_init(), but the assignment is never released on +driver removal or later probe failures. + +Register a devm cleanup action so the reserved memory assignment is +released consistently, matching newer Mediatek AFE drivers. + +Fixes: ec4a10ca4a68 ("ASoC: mediatek: use reserved memory or enable buffer pre-allocation") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260527-asoc-mt8183-probe-cleanup-v1-1-4f4f5593c8d1@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c ++++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +@@ -766,6 +766,11 @@ static const dai_register_cb dai_registe + mt8183_dai_memif_register, + }; + ++static void mt8183_afe_release_reserved_mem(void *data) ++{ ++ of_reserved_mem_device_release(data); ++} ++ + static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) + { + struct mtk_base_afe *afe; +@@ -794,6 +799,12 @@ static int mt8183_afe_pcm_dev_probe(stru + if (ret) { + dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n"); + afe->preallocate_buffers = true; ++ } else { ++ ret = devm_add_action_or_reset(dev, ++ mt8183_afe_release_reserved_mem, ++ dev); ++ if (ret) ++ return ret; + } + + /* initial audio related clock */ diff --git a/queue-7.1/asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch b/queue-7.1/asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch new file mode 100644 index 0000000000..54253a6b44 --- /dev/null +++ b/queue-7.1/asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch @@ -0,0 +1,61 @@ +From e24d5dde56a50946020b134fa8448869093db76a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Wed, 27 May 2026 10:55:47 -0300 +Subject: ASoC: mediatek: mt8192: Check runtime resume during probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit e24d5dde56a50946020b134fa8448869093db76a upstream. + +The MT8192 AFE probe enables runtime PM temporarily while reinitializing +the regmap cache from hardware, but it uses pm_runtime_get_sync() +without checking the return value. If runtime resume fails, probe keeps +going without the device necessarily being accessible, and +pm_runtime_get_sync() may leave the PM usage count incremented. + +The regmap_reinit_cache() failure path also returns before dropping the +temporary PM reference and before clearing pm_runtime_bypass_reg_ctl. + +Use pm_runtime_resume_and_get() so resume failures do not leak a usage +count, and clear the temporary bypass flag after dropping the probe PM +reference on all regmap_reinit_cache() outcomes. + +Fixes: 125ab5d588b0 ("ASoC: mediatek: mt8192: add platform driver") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260527-asoc-mt8192-probe-cleanup-v1-2-1bb834d05b72@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c ++++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +@@ -2218,15 +2218,19 @@ static int mt8192_afe_pcm_dev_probe(stru + + /* enable clock for regcache get default value from hw */ + afe_priv->pm_runtime_bypass_reg_ctl = true; +- pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); ++ if (ret) { ++ afe_priv->pm_runtime_bypass_reg_ctl = false; ++ return dev_err_probe(dev, ret, "failed to resume device\n"); ++ } + + ret = regmap_reinit_cache(afe->regmap, &mt8192_afe_regmap_config); +- if (ret) +- return dev_err_probe(dev, ret, "regmap_reinit_cache fail\n"); +- + pm_runtime_put_sync(dev); + afe_priv->pm_runtime_bypass_reg_ctl = false; + ++ if (ret) ++ return dev_err_probe(dev, ret, "regmap_reinit_cache fail\n"); ++ + regcache_cache_only(afe->regmap, true); + regcache_mark_dirty(afe->regmap); + diff --git a/queue-7.1/asoc-mediatek-mt8192-release-reserved-memory-on-cleanup.patch b/queue-7.1/asoc-mediatek-mt8192-release-reserved-memory-on-cleanup.patch new file mode 100644 index 0000000000..2bb8553ad4 --- /dev/null +++ b/queue-7.1/asoc-mediatek-mt8192-release-reserved-memory-on-cleanup.patch @@ -0,0 +1,56 @@ +From 965e17ae6751c5d3302430c8ebd650e72d45a85f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Wed, 27 May 2026 10:55:46 -0300 +Subject: ASoC: mediatek: mt8192: Release reserved memory on cleanup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 965e17ae6751c5d3302430c8ebd650e72d45a85f upstream. + +The MT8192 AFE probe calls of_reserved_mem_device_init() and falls +back to preallocated buffers when no reserved memory region is +available. When the reserved memory assignment succeeds, however, the +driver never releases it. + +Register a devm cleanup action after a successful reserved-memory +assignment so the assignment is released on probe failure and driver +unbind. + +Fixes: ec4a10ca4a68 ("ASoC: mediatek: use reserved memory or enable buffer pre-allocation") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260527-asoc-mt8192-probe-cleanup-v1-1-1bb834d05b72@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c ++++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c +@@ -2155,6 +2155,11 @@ static const dai_register_cb dai_registe + mt8192_dai_memif_register, + }; + ++static void mt8192_afe_release_reserved_mem(void *data) ++{ ++ of_reserved_mem_device_release(data); ++} ++ + static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev) + { + struct mtk_base_afe *afe; +@@ -2184,6 +2189,10 @@ static int mt8192_afe_pcm_dev_probe(stru + if (ret) { + dev_info(dev, "no reserved memory found, pre-allocating buffers instead\n"); + afe->preallocate_buffers = true; ++ } else { ++ ret = devm_add_action_or_reset(dev, mt8192_afe_release_reserved_mem, dev); ++ if (ret) ++ return ret; + } + + /* init audio related clock */ diff --git a/queue-7.1/asoc-qcom-q6apm-fix-null-pointer-dereference-in-graph_callback.patch b/queue-7.1/asoc-qcom-q6apm-fix-null-pointer-dereference-in-graph_callback.patch new file mode 100644 index 0000000000..5e9c20f35d --- /dev/null +++ b/queue-7.1/asoc-qcom-q6apm-fix-null-pointer-dereference-in-graph_callback.patch @@ -0,0 +1,60 @@ +From 2e9261761b35f0b67b7487688cd1365f535be0b3 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Tue, 16 Jun 2026 18:02:57 +0100 +Subject: ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback + +From: Srinivas Kandagatla + +commit 2e9261761b35f0b67b7487688cd1365f535be0b3 upstream. + +When q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf +and sets them to NULL under graph->lock. A late DSP buffer-done response +can race with this: graph_callback() passes the !graph->ar_graph guard +(not yet NULL), acquires the lock, but then dereferences a now-NULL buf +pointer to read buf[token].phys, crashing at virtual address 0x10. + +Add a NULL check for buf inside the mutex-protected section in both the +write-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and +read-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail +out cleanly if buffers have already been freed. + +This problem is only shown up recently while apr bus was updated to +process the commands per service rather from single global queue. + +Fixes: 5477518b8a0e ("ASoC: qdsp6: audioreach: add q6apm support") +Cc: Stable@vger.kernel.org +Assisted-by: Claude:claude-4-6-sonnet +Reported-by: Val Packett +Closes: https://lore.kernel.org/all/133ced18-1aa9-475d-80d8-6120678bdde4@packett.cool/ +Signed-off-by: Srinivas Kandagatla +Link: https://patch.msgid.link/20260616170257.9381-1-srinivas.kandagatla@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/qcom/qdsp6/q6apm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/soc/qcom/qdsp6/q6apm.c ++++ b/sound/soc/qcom/qdsp6/q6apm.c +@@ -549,6 +549,10 @@ static int graph_callback(const struct g + token = hdr->token & APM_WRITE_TOKEN_MASK; + + done = data->payload; ++ if (!graph->rx_data.buf) { ++ mutex_unlock(&graph->lock); ++ break; ++ } + phys = graph->rx_data.buf[token].phys; + mutex_unlock(&graph->lock); + /* token numbering starts at 0 */ +@@ -571,6 +575,10 @@ static int graph_callback(const struct g + client_event = APM_CLIENT_EVENT_DATA_READ_DONE; + mutex_lock(&graph->lock); + rd_done = data->payload; ++ if (!graph->tx_data.buf) { ++ mutex_unlock(&graph->lock); ++ break; ++ } + phys = graph->tx_data.buf[hdr->token].phys; + mutex_unlock(&graph->lock); + /* token numbering starts at 0 */ diff --git a/queue-7.1/asoc-sof-ipc3-control-fix-heap-overflow-in-bytes_ext-put-get.patch b/queue-7.1/asoc-sof-ipc3-control-fix-heap-overflow-in-bytes_ext-put-get.patch new file mode 100644 index 0000000000..a6e5f8b1f0 --- /dev/null +++ b/queue-7.1/asoc-sof-ipc3-control-fix-heap-overflow-in-bytes_ext-put-get.patch @@ -0,0 +1,96 @@ +From fd46668d538993218eea19c6925c868ac0f2630c Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Tue, 9 Jun 2026 11:34:58 +0300 +Subject: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get + +From: Peter Ujfalusi + +commit fd46668d538993218eea19c6925c868ac0f2630c upstream. + +The ipc_control_data buffer is allocated as kzalloc(max_size), where +max_size covers the entire struct sof_ipc_ctrl_data including its +flexible array payload. However, the bounds checks in bytes_ext_put +and _bytes_ext_get compared user data lengths against max_size +directly, ignoring that cdata->data sits at an offset of +sizeof(struct sof_ipc_ctrl_data) bytes into the allocation. + +This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past +the end of the heap buffer from unprivileged userspace via the ALSA TLV +kcontrol interface, and similarly allowed over-reading adjacent heap +data on the get path. + +Fix all bounds checks to subtract sizeof(*cdata) from max_size so they +reflect the actual space available at the cdata->data offset. Also fix +the error-path restore in bytes_ext_put which wrote to cdata->data +instead of cdata, causing the same overflow. + +Fixes: 67ec2a091630 ("ASoC: SOF: Add bytes_ext control IPC ops for IPC3") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Reviewed-by: Liam Girdwood +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20260609083458.31193-7-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/ipc3-control.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +--- a/sound/soc/sof/ipc3-control.c ++++ b/sound/soc/sof/ipc3-control.c +@@ -398,9 +398,17 @@ static int sof_ipc3_bytes_ext_put(struct + } + + /* be->max is coming from topology */ +- if (header.length > scontrol->max_size) { +- dev_err_ratelimited(scomp->dev, "Bytes data size %d exceeds max %zu\n", +- header.length, scontrol->max_size); ++ if (header.length > scontrol->max_size - sizeof(*cdata)) { ++ dev_err_ratelimited(scomp->dev, "Bytes data size %u exceeds max %zu\n", ++ header.length, scontrol->max_size - sizeof(*cdata)); ++ return -EINVAL; ++ } ++ ++ /* Ensure the data is large enough to contain the ABI header */ ++ if (header.length < sizeof(struct sof_abi_hdr)) { ++ dev_err_ratelimited(scomp->dev, ++ "Bytes data size %u less than ABI header %zu\n", ++ header.length, sizeof(struct sof_abi_hdr)); + return -EINVAL; + } + +@@ -436,7 +444,7 @@ static int sof_ipc3_bytes_ext_put(struct + } + + /* be->max has been verified to be >= sizeof(struct sof_abi_hdr) */ +- if (cdata->data->size > scontrol->max_size - sizeof(struct sof_abi_hdr)) { ++ if (cdata->data->size > scontrol->max_size - sizeof(*cdata) - sizeof(struct sof_abi_hdr)) { + dev_err_ratelimited(scomp->dev, "Mismatch in ABI data size (truncated?)\n"); + goto err_restore; + } +@@ -452,7 +460,7 @@ static int sof_ipc3_bytes_ext_put(struct + err_restore: + /* If we have an issue, we restore the old, valid bytes control data */ + if (scontrol->old_ipc_control_data) { +- memcpy(cdata->data, scontrol->old_ipc_control_data, scontrol->max_size); ++ memcpy(cdata, scontrol->old_ipc_control_data, scontrol->max_size); + kfree(scontrol->old_ipc_control_data); + scontrol->old_ipc_control_data = NULL; + } +@@ -491,10 +499,13 @@ static int _sof_ipc3_bytes_ext_get(struc + } + + /* check data size doesn't exceed max coming from topology */ +- if (cdata->data->size > scontrol->max_size - sizeof(struct sof_abi_hdr)) { +- dev_err_ratelimited(scomp->dev, "User data size %d exceeds max size %zu\n", ++ if (cdata->data->size > scontrol->max_size - sizeof(*cdata) - ++ sizeof(struct sof_abi_hdr)) { ++ dev_err_ratelimited(scomp->dev, ++ "User data size %u exceeds max size %zu\n", + cdata->data->size, +- scontrol->max_size - sizeof(struct sof_abi_hdr)); ++ scontrol->max_size - sizeof(*cdata) - ++ sizeof(struct sof_abi_hdr)); + return -EINVAL; + } + diff --git a/queue-7.1/asoc-sof-ipc3-control-validate-size-in-snd_sof_update_control.patch b/queue-7.1/asoc-sof-ipc3-control-validate-size-in-snd_sof_update_control.patch new file mode 100644 index 0000000000..c358edb5c0 --- /dev/null +++ b/queue-7.1/asoc-sof-ipc3-control-validate-size-in-snd_sof_update_control.patch @@ -0,0 +1,47 @@ +From 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Tue, 9 Jun 2026 11:34:56 +0300 +Subject: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control + +From: Peter Ujfalusi + +commit 390aa4c9339bb0ec0bc8d554e830faf93ca9d49e upstream. + +In snd_sof_update_control(), firmware-provided cdata->num_elems is +checked against local_cdata->data->size but never against the actual +allocation size. If local_cdata->data->size was previously set to an +inconsistent value, the memcpy could write past the allocated buffer. + +Add a bounds check to ensure num_elems fits within the available space +in the ipc_control_data allocation before copying. + +Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Reviewed-by: Liam Girdwood +Reviewed-by: Bard Liao +Link: https://patch.msgid.link/20260609083458.31193-5-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/ipc3-control.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/soc/sof/ipc3-control.c ++++ b/sound/soc/sof/ipc3-control.c +@@ -555,6 +555,15 @@ static void snd_sof_update_control(struc + return; + } + ++ /* Verify the size fits within the allocation */ ++ if (cdata->num_elems > scontrol->max_size - sizeof(*local_cdata) - ++ sizeof(*local_cdata->data)) { ++ dev_err(scomp->dev, ++ "cdata binary size %u exceeds buffer\n", ++ cdata->num_elems); ++ return; ++ } ++ + /* copy the new binary data */ + memcpy(local_cdata->data, cdata->data, cdata->num_elems); + } else if (cdata->num_elems != scontrol->num_channels) { diff --git a/queue-7.1/asoc-sof-topology-fix-memory-leak-in-snd_sof_load_topology.patch b/queue-7.1/asoc-sof-topology-fix-memory-leak-in-snd_sof_load_topology.patch new file mode 100644 index 0000000000..75402cceab --- /dev/null +++ b/queue-7.1/asoc-sof-topology-fix-memory-leak-in-snd_sof_load_topology.patch @@ -0,0 +1,39 @@ +From d46f9f23897261da53ffbeb89d48a13982ba7d28 Mon Sep 17 00:00:00 2001 +From: Zhao Dongdong +Date: Wed, 10 Jun 2026 15:20:43 +0800 +Subject: ASoC: SOF: topology: fix memory leak in snd_sof_load_topology + +From: Zhao Dongdong + +commit d46f9f23897261da53ffbeb89d48a13982ba7d28 upstream. + +When the topology filename contains "dummy" and tplg_cnt is 0, the +function returns -EINVAL directly without freeing the tplg_files +allocated by kcalloc() at line 2497. This leaks memory on every +such topology load attempt. + +Fix this by setting ret = -EINVAL and jumping to the out: label, +which already handles the kfree(tplg_files) cleanup. + +Fixes: 99c159279c6d ("ASoC: SOF: don't check the existence of dummy topology") +Cc: stable@vger.kernel.org +Signed-off-by: Zhao Dongdong +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/tencent_3EED6D778DC52C3703A2D1EE8119372E8E08@qq.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/topology.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/soc/sof/topology.c ++++ b/sound/soc/sof/topology.c +@@ -2537,6 +2537,8 @@ int snd_sof_load_topology(struct snd_soc + if (strstr(file, "dummy")) { + dev_err(scomp->dev, + "Function topology is required, please upgrade sof-firmware\n"); ++ ++ kfree(tplg_files); + return -EINVAL; + } + tplg_files[0] = file; diff --git a/queue-7.1/backlight-ktd2801-enable-bl_core_suspendresume.patch b/queue-7.1/backlight-ktd2801-enable-bl_core_suspendresume.patch new file mode 100644 index 0000000000..68fdb4ff13 --- /dev/null +++ b/queue-7.1/backlight-ktd2801-enable-bl_core_suspendresume.patch @@ -0,0 +1,38 @@ +From f37f5a2ac9d3737617c08f0dc7270b42e9cad907 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Duje=20Mihanovi=C4=87?= +Date: Sat, 28 Mar 2026 21:42:16 +0100 +Subject: backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duje Mihanović + +commit f37f5a2ac9d3737617c08f0dc7270b42e9cad907 upstream. + +Boards using this backlight chip do not power the backlight off on +suspend. Enable BL_CORE_SUSPENDRESUME so the chip gets powered off by +the backlight core on suspend. + +Tested on samsung,coreprimevelte. + +Cc: stable@vger.kernel.org # v6.19 +Signed-off-by: Duje Mihanović +Reviewed-by: Daniel Thompson (RISCstar) +Link: https://patch.msgid.link/20260328-ktd2801-pm-fix-v1-1-007cb103faeb@dujemihanovic.xyz +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/backlight/ktd2801-backlight.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/backlight/ktd2801-backlight.c ++++ b/drivers/video/backlight/ktd2801-backlight.c +@@ -53,6 +53,7 @@ static int ktd2801_update_status(struct + } + + static const struct backlight_ops ktd2801_backlight_ops = { ++ .options = BL_CORE_SUSPENDRESUME, + .update_status = ktd2801_update_status, + }; + diff --git a/queue-7.1/batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch b/queue-7.1/batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch new file mode 100644 index 0000000000..87d061181e --- /dev/null +++ b/queue-7.1/batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch @@ -0,0 +1,37 @@ +From 7141990add3f75436f2933cb310654cad3b1e3e9 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:35:35 +0200 +Subject: batman-adv: access unicast_ttvn skb->data only after skb realloc + +From: Sven Eckelmann + +commit 7141990add3f75436f2933cb310654cad3b1e3e9 upstream. + +The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer +behind the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the ethernet header but missed for the +unicast_packet pointer. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/routing.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/routing.c ++++ b/net/batman-adv/routing.c +@@ -855,8 +855,8 @@ static bool batadv_check_unicast_ttvn(st + if (skb_cow(skb, sizeof(*unicast_packet)) < 0) + return false; + +- unicast_packet = (struct batadv_unicast_packet *)skb->data; + vid = batadv_get_vid(skb, hdr_len); ++ unicast_packet = (struct batadv_unicast_packet *)skb->data; + ethhdr = (struct ethhdr *)(skb->data + hdr_len); + + /* do not reroute multicast frames in a unicast header */ diff --git a/queue-7.1/batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch b/queue-7.1/batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch new file mode 100644 index 0000000000..54e6bc78c4 --- /dev/null +++ b/queue-7.1/batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch @@ -0,0 +1,31 @@ +From cdf3b5af2bc4431e58629e8ad2086b1e9185c761 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:45:41 +0200 +Subject: batman-adv: bla: reacquire gw address after skb realloc + +From: Sven Eckelmann + +commit cdf3b5af2bc4431e58629e8ad2086b1e9185c761 upstream. + +The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate +the buffer behind the skb. Variables which were pointing to the old buffer +need to be reassigned to avoid an use-after-free. + +Cc: stable@vger.kernel.org +Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/routing.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/batman-adv/routing.c ++++ b/net/batman-adv/routing.c +@@ -1029,6 +1029,7 @@ int batadv_recv_unicast_packet(struct sk + hdr_size); + batadv_orig_node_put(orig_node_gw); + if (is_gw) { ++ orig_addr_gw = eth_hdr(skb)->h_source; + batadv_dbg(BATADV_DBG_BLA, bat_priv, + "%s(): Dropped unicast pkt received from another backbone gw %pM.\n", + __func__, orig_addr_gw); diff --git a/queue-7.1/batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch b/queue-7.1/batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch new file mode 100644 index 0000000000..cfdd4bf89d --- /dev/null +++ b/queue-7.1/batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch @@ -0,0 +1,102 @@ +From 8669a550c752d86baebc5fdc83b8ff35c4372c0e Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sat, 4 Jul 2026 09:46:09 +0200 +Subject: batman-adv: clean untagged VLAN on netdev registration failure + +From: Sven Eckelmann + +commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream. + +When an mesh interface is registered, it creates an untagged struct +batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in +this process, another receiver of this notification can veto the +registration. The netdev registration will be aborted because of this veto. + +The register_netdevice() call will try to clean up the net_device using +unregister_netdevice_queue() - which only uses the .priv_destructor to +free private resources. In this situation, .dellink will not be called. + +The cleanup of the untagged batadv_meshif_vlan must thefore be done in the +destructor to avoid a leak of this object. + +Cc: stable@vger.kernel.org +Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/main.c | 8 ++++++++ + net/batman-adv/mesh-interface.c | 13 ++----------- + net/batman-adv/mesh-interface.h | 2 ++ + 3 files changed, 12 insertions(+), 11 deletions(-) + +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -245,6 +245,7 @@ err_orig: + void batadv_mesh_free(struct net_device *mesh_iface) + { + struct batadv_priv *bat_priv = netdev_priv(mesh_iface); ++ struct batadv_meshif_vlan *vlan; + + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); + +@@ -259,6 +260,13 @@ void batadv_mesh_free(struct net_device + + batadv_mcast_free(bat_priv); + ++ /* destroy the "untagged" VLAN */ ++ vlan = batadv_meshif_vlan_get(bat_priv, BATADV_NO_FLAGS); ++ if (vlan) { ++ batadv_meshif_destroy_vlan(bat_priv, vlan); ++ batadv_meshif_vlan_put(vlan); ++ } ++ + /* Free the TT and the originator tables only after having terminated + * all the other depending components which may use these structures for + * their purposes. +--- a/net/batman-adv/mesh-interface.c ++++ b/net/batman-adv/mesh-interface.c +@@ -593,8 +593,8 @@ int batadv_meshif_create_vlan(struct bat + * @bat_priv: the bat priv with all the mesh interface information + * @vlan: the object to remove + */ +-static void batadv_meshif_destroy_vlan(struct batadv_priv *bat_priv, +- struct batadv_meshif_vlan *vlan) ++void batadv_meshif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_meshif_vlan *vlan) + { + /* explicitly remove the associated TT local entry because it is marked + * with the NOPURGE flag +@@ -1089,22 +1089,13 @@ static int batadv_meshif_newlink(struct + static void batadv_meshif_destroy_netlink(struct net_device *mesh_iface, + struct list_head *head) + { +- struct batadv_priv *bat_priv = netdev_priv(mesh_iface); + struct batadv_hard_iface *hard_iface; +- struct batadv_meshif_vlan *vlan; + + while (!list_empty(&mesh_iface->adj_list.lower)) { + hard_iface = netdev_adjacent_get_private(mesh_iface->adj_list.lower.next); + batadv_hardif_disable_interface(hard_iface); + } + +- /* destroy the "untagged" VLAN */ +- vlan = batadv_meshif_vlan_get(bat_priv, BATADV_NO_FLAGS); +- if (vlan) { +- batadv_meshif_destroy_vlan(bat_priv, vlan); +- batadv_meshif_vlan_put(vlan); +- } +- + unregister_netdevice_queue(mesh_iface, head); + } + +--- a/net/batman-adv/mesh-interface.h ++++ b/net/batman-adv/mesh-interface.h +@@ -21,6 +21,8 @@ void batadv_interface_rx(struct net_devi + bool batadv_meshif_is_valid(const struct net_device *net_dev); + extern struct rtnl_link_ops batadv_link_ops; + int batadv_meshif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); ++void batadv_meshif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_meshif_vlan *vlan); + void batadv_meshif_vlan_release(struct kref *ref); + struct batadv_meshif_vlan *batadv_meshif_vlan_get(struct batadv_priv *bat_priv, + unsigned short vid); diff --git a/queue-7.1/batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch b/queue-7.1/batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch new file mode 100644 index 0000000000..341f0092d5 --- /dev/null +++ b/queue-7.1/batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch @@ -0,0 +1,43 @@ +From 48067b2ae4504500a7093d9e1e16b42e70330480 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:45:41 +0200 +Subject: batman-adv: dat: acquire ARP hw source only after skb realloc + +From: Sven Eckelmann + +commit 48067b2ae4504500a7093d9e1e16b42e70330480 upstream. + +The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer +behind the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +Cc: stable@vger.kernel.org +Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -1746,6 +1746,7 @@ void batadv_dat_snoop_incoming_dhcp_ack( + struct ethhdr *ethhdr; + __be32 ip_src, yiaddr; + unsigned short vid; ++ int hdr_size_tmp; + __be16 proto; + u8 *hw_src; + +@@ -1762,8 +1763,10 @@ void batadv_dat_snoop_incoming_dhcp_ack( + if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr)) + return; + ++ hdr_size_tmp = hdr_size; ++ vid = batadv_dat_get_vid(skb, &hdr_size_tmp); ++ ethhdr = (struct ethhdr *)(skb->data + hdr_size); + hw_src = ethhdr->h_source; +- vid = batadv_dat_get_vid(skb, &hdr_size); + + batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid); + batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid); diff --git a/queue-7.1/batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch b/queue-7.1/batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch new file mode 100644 index 0000000000..f216608e60 --- /dev/null +++ b/queue-7.1/batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch @@ -0,0 +1,104 @@ +From 26560c4a03dc4d607331600c187f59ab2df5f341 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 10:37:07 +0200 +Subject: batman-adv: dat: ensure accessible eth_hdr proto field + +From: Sven Eckelmann + +commit 26560c4a03dc4d607331600c187f59ab2df5f341 upstream. + +When batadv_get_vid() accesses the proto field of the ethernet header, it +is not checking if the data itself is accessible. The caller is responsible +for it. But in contrast to other call sites, batadv_dat_get_vid() and its +caller didn't make sure this is true. This could have caused an +out-of-bounds access. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 23 +++++++++++++++++++++++ + net/batman-adv/main.c | 3 +++ + 2 files changed, 26 insertions(+) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -1065,6 +1065,9 @@ out: + * @skb: the buffer containing the packet to extract the VID from + * @hdr_size: the size of the batman-adv header encapsulating the packet + * ++ * The caller must ensure that at least @hdr_size + ETH_HLEN bytes are ++ * accessible after skb->data. ++ * + * Return: If the packet embedded in the skb is vlan tagged this function + * returns the VID with the BATADV_VLAN_HAS_TAG flag. Otherwise BATADV_NO_FLAGS + * is returned. +@@ -1147,6 +1150,10 @@ bool batadv_dat_snoop_outgoing_arp_reque + if (!atomic_read(&bat_priv->distributed_arp_table)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1242,6 +1249,10 @@ bool batadv_dat_snoop_incoming_arp_reque + if (!atomic_read(&bat_priv->distributed_arp_table)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1304,6 +1315,10 @@ void batadv_dat_snoop_outgoing_arp_reply + if (!atomic_read(&bat_priv->distributed_arp_table)) + return; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ return; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1352,6 +1367,10 @@ bool batadv_dat_snoop_incoming_arp_reply + if (!atomic_read(&bat_priv->distributed_arp_table)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, skb, hdr_size); +@@ -1806,6 +1825,10 @@ bool batadv_dat_drop_broadcast_packet(st + if (batadv_forw_packet_is_rebroadcast(forw_packet)) + goto out; + ++ /* first, find out the vid. */ ++ if (!pskb_may_pull(forw_packet->skb, hdr_size + ETH_HLEN)) ++ goto out; ++ + vid = batadv_dat_get_vid(forw_packet->skb, &hdr_size); + + type = batadv_arp_get_type(bat_priv, forw_packet->skb, hdr_size); +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -566,6 +566,9 @@ void batadv_recv_handler_unregister(u8 p + * @skb: the buffer containing the packet + * @header_len: length of the batman header preceding the ethernet header + * ++ * The caller must ensure that at least @header_len + ETH_HLEN bytes are ++ * accessible after skb->data. ++ * + * Return: VID with the BATADV_VLAN_HAS_TAG flag when the packet embedded in the + * skb is vlan tagged. Otherwise BATADV_NO_FLAGS. + */ diff --git a/queue-7.1/batman-adv-dat-fix-tie-break-for-candidate-selection.patch b/queue-7.1/batman-adv-dat-fix-tie-break-for-candidate-selection.patch new file mode 100644 index 0000000000..7d27e908a2 --- /dev/null +++ b/queue-7.1/batman-adv-dat-fix-tie-break-for-candidate-selection.patch @@ -0,0 +1,42 @@ +From 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 2 Jul 2026 19:32:40 +0200 +Subject: batman-adv: dat: fix tie-break for candidate selection + +From: Sven Eckelmann + +commit 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b upstream. + +The original version of the candidate selection for DAT attempted to +compare both candidate and max_orig_node to identify which has the smaller +MAC address. This comparison is required as tie-break when a hash collision +happened. + +But the used function returned 0 when the function was not equal and a +non-zero value when it was equal. As result, the actually selected +node was dependent on the order of entries in the orig_hash and not +actually on the mac addresses. The last originator in the hash collision +would always win. + +To have a proper ordering, it must diff the actual MAC address bytes and +reject the candidate when the diff is not smaller than 0. + +Cc: stable@vger.kernel.org +Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -545,7 +545,7 @@ static bool batadv_is_orig_node_eligible + * the one with the lowest address + */ + if (tmp_max == max && max_orig_node && +- batadv_compare_eth(candidate->orig, max_orig_node->orig)) ++ memcmp(candidate->orig, max_orig_node->orig, ETH_ALEN) >= 0) + goto out; + + ret = true; diff --git a/queue-7.1/batman-adv-ensure-minimal-ethernet-header-on-tx.patch b/queue-7.1/batman-adv-ensure-minimal-ethernet-header-on-tx.patch new file mode 100644 index 0000000000..38b9a05867 --- /dev/null +++ b/queue-7.1/batman-adv-ensure-minimal-ethernet-header-on-tx.patch @@ -0,0 +1,40 @@ +From 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 2 Jul 2026 11:46:21 +0200 +Subject: batman-adv: ensure minimal ethernet header on TX + +From: Sven Eckelmann + +commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream. + +As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have +at least eth header len bytes"), it is possible by for a local user with +eBPF TC hook access to attach a tc filter which truncates the packet and +redirects to an batadv interface. But the code assumes that at least +ETH_HLEN bytes are available and thus might read outside of the available +buffer. + +The batadv_interface_tx() must therefore always check itself if enough data +is available for the ethernet header and don't rely on min_header_len. + +Cc: stable@vger.kernel.org +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Reported-by: Sashiko +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/mesh-interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/batman-adv/mesh-interface.c ++++ b/net/batman-adv/mesh-interface.c +@@ -193,6 +193,9 @@ static netdev_tx_t batadv_interface_tx(s + if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) + goto dropped; + ++ if (!pskb_may_pull(skb, ETH_HLEN)) ++ goto dropped; ++ + /* reset control block to avoid left overs from previous users */ + memset(skb->cb, 0, sizeof(struct batadv_skb_cb)); + diff --git a/queue-7.1/batman-adv-fix-vlan-priority-offset.patch b/queue-7.1/batman-adv-fix-vlan-priority-offset.patch new file mode 100644 index 0000000000..342e6e2047 --- /dev/null +++ b/queue-7.1/batman-adv-fix-vlan-priority-offset.patch @@ -0,0 +1,38 @@ +From fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 2 Jul 2026 20:45:24 +0200 +Subject: batman-adv: fix VLAN priority offset + +From: Sven Eckelmann + +commit fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 upstream. + +The batadv_skb_set_priority() receives an SKB with the inner ethernet +header at position "offset". When it tries to extract the IPv4 and IPv6 +header, it needs to skip the ethernet header to get access to the IP +header. + +But for VLAN header, it performs the access with the struct vlan_ethhdr. +This struct contains both both the ethernet header and the VLAN header. It +is therefore incorrect to skip over the whole vlan_ethhdr size to get +access to the vlan_ethhdr. + +Cc: stable@vger.kernel.org +Fixes: c54f38c9aa22 ("batman-adv: set skb priority according to content") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -354,7 +354,7 @@ void batadv_skb_set_priority(struct sk_b + + switch (ethhdr->h_proto) { + case htons(ETH_P_8021Q): +- vhdr = skb_header_pointer(skb, offset + sizeof(*vhdr), ++ vhdr = skb_header_pointer(skb, offset, + sizeof(*vhdr), &vhdr_tmp); + if (!vhdr) + return; diff --git a/queue-7.1/batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch b/queue-7.1/batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch new file mode 100644 index 0000000000..a234e01508 --- /dev/null +++ b/queue-7.1/batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch @@ -0,0 +1,33 @@ +From 353d2c1d5492e53ae34f490a84494124dc3d3531 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Fri, 3 Jul 2026 21:04:03 +0200 +Subject: batman-adv: frag: fix primary_if leak on failed linearization + +From: Sven Eckelmann + +commit 353d2c1d5492e53ae34f490a84494124dc3d3531 upstream. + +If the skb has a frag_list, it must be linearized before it can be split +using skb_split(). But when this step failed, it must not only free the skb +but also take care of the reference to the already found primary_if. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: a063f2fba3fa ("batman-adv: Don't skb_split skbuffs with frag_list") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/fragmentation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -545,7 +545,7 @@ int batadv_frag_send_packet(struct sk_bu + */ + if (skb_has_frag_list(skb) && __skb_linearize(skb)) { + ret = -ENOMEM; +- goto free_skb; ++ goto put_primary_if; + } + + /* Create one header to be copied to all fragments */ diff --git a/queue-7.1/batman-adv-frag-free-unfragmentable-packet.patch b/queue-7.1/batman-adv-frag-free-unfragmentable-packet.patch new file mode 100644 index 0000000000..66594d6355 --- /dev/null +++ b/queue-7.1/batman-adv-frag-free-unfragmentable-packet.patch @@ -0,0 +1,39 @@ +From 6b628425aed49a1c7a4ffc997583840fc582d32b Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Fri, 3 Jul 2026 20:28:31 +0200 +Subject: batman-adv: frag: free unfragmentable packet + +From: Sven Eckelmann + +commit 6b628425aed49a1c7a4ffc997583840fc582d32b upstream. + +The caller of batadv_frag_send_packet() assume that the skb provided to the +function are always consumed. But the pre-check for an empty payload or the +zero fragment size returned an error without any further actions. + +A failed pre-check must use the same error handling code as the rest of the +function. + +Cc: stable@vger.kernel.org +Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/fragmentation.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -516,8 +516,10 @@ int batadv_frag_send_packet(struct sk_bu + mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE); + max_fragment_size = mtu - header_size; + +- if (skb->len == 0 || max_fragment_size == 0) +- return -EINVAL; ++ if (skb->len == 0 || max_fragment_size == 0) { ++ ret = -EINVAL; ++ goto free_skb; ++ } + + num_fragments = (skb->len - 1) / max_fragment_size + 1; + max_fragment_size = (skb->len - 1) / num_fragments + 1; diff --git a/queue-7.1/batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch b/queue-7.1/batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch new file mode 100644 index 0000000000..12431b6ff5 --- /dev/null +++ b/queue-7.1/batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch @@ -0,0 +1,38 @@ +From 77880a3be88d378d60cc1e8f8ec70430e2ed0518 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 08:45:41 +0200 +Subject: batman-adv: gw: acquire ethernet header only after skb realloc + +From: Sven Eckelmann + +commit 77880a3be88d378d60cc1e8f8ec70430e2ed0518 upstream. + +The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer +behind the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +Cc: stable@vger.kernel.org +Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/gateway_client.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/gateway_client.c ++++ b/net/batman-adv/gateway_client.c +@@ -683,12 +683,13 @@ bool batadv_gw_out_of_range(struct batad + struct batadv_gw_node *gw_node = NULL; + struct batadv_gw_node *curr_gw = NULL; + struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo; +- struct ethhdr *ethhdr = (struct ethhdr *)skb->data; ++ struct ethhdr *ethhdr; + bool out_of_range = false; + u8 curr_tq_avg; + unsigned short vid; + + vid = batadv_get_vid(skb, 0); ++ ethhdr = (struct ethhdr *)skb->data; + + if (is_multicast_ether_addr(ethhdr->h_dest)) + goto out; diff --git a/queue-7.1/batman-adv-mcast-avoid-oob-read-of-num_dests-header.patch b/queue-7.1/batman-adv-mcast-avoid-oob-read-of-num_dests-header.patch new file mode 100644 index 0000000000..59f2b651e0 --- /dev/null +++ b/queue-7.1/batman-adv-mcast-avoid-oob-read-of-num_dests-header.patch @@ -0,0 +1,54 @@ +From 38eaed28e250895d56f4b7989bd65479a511c5c3 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Fri, 3 Jul 2026 20:47:45 +0200 +Subject: batman-adv: mcast: avoid OOB read of num_dests header + +From: Sven Eckelmann + +commit 38eaed28e250895d56f4b7989bd65479a511c5c3 upstream. + +Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is +attempted to check whether enough space is actually in the network header. +But instead of using offsetofend() to check for the whole size (2) which +must be accessible, offsetof() of is called. The latter is always returning +0. The comparison with the network header length will always return that +enough data is available - even when only 1 or 0 bytes are accessible. + +Instead of using offsetofend(), use the more common check for the whole +header. + +Cc: stable@vger.kernel.org +Fixes: 07afe1ba288c ("batman-adv: mcast: implement multicast packet reception and forwarding") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/multicast_forw.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/net/batman-adv/multicast_forw.c ++++ b/net/batman-adv/multicast_forw.c +@@ -927,11 +927,11 @@ static int batadv_mcast_forw_packet(stru + { + struct batadv_tvlv_mcast_tracker *mcast_tracker; + struct batadv_neigh_node *neigh_node; +- unsigned long offset, num_dests_off; + struct sk_buff *nexthop_skb; + unsigned char *skb_net_hdr; + bool local_recv = false; + unsigned int tvlv_len; ++ unsigned long offset; + bool xmitted = false; + u8 *dest, *next_dest; + u16 num_dests; +@@ -940,9 +940,8 @@ static int batadv_mcast_forw_packet(stru + /* (at least) TVLV part needs to be linearized */ + SKB_LINEAR_ASSERT(skb); + +- /* check if num_dests is within skb length */ +- num_dests_off = offsetof(struct batadv_tvlv_mcast_tracker, num_dests); +- if (num_dests_off > skb_network_header_len(skb)) ++ /* check if batadv_tvlv_mcast_tracker header is within skb length */ ++ if (sizeof(*mcast_tracker) > skb_network_header_len(skb)) + return -EINVAL; + + skb_net_hdr = skb_network_header(skb); diff --git a/queue-7.1/batman-adv-retrieve-ethhdr-after-potential-skb-realloc-on-rx.patch b/queue-7.1/batman-adv-retrieve-ethhdr-after-potential-skb-realloc-on-rx.patch new file mode 100644 index 0000000000..dec04787ca --- /dev/null +++ b/queue-7.1/batman-adv-retrieve-ethhdr-after-potential-skb-realloc-on-rx.patch @@ -0,0 +1,36 @@ +From 035e1fed892d3d06002a73ff73668f618a514644 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sun, 28 Jun 2026 06:44:13 +0200 +Subject: batman-adv: retrieve ethhdr after potential skb realloc on RX + +From: Sven Eckelmann + +commit 035e1fed892d3d06002a73ff73668f618a514644 upstream. + +pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind +the skb. Variables which were pointing to the old buffer need to be +reassigned to avoid an use-after-free. + +This was done correctly for the VLAN header but missed for the ethernet +header which is later used for the TT and AP isolation handling. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/mesh-interface.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/batman-adv/mesh-interface.c ++++ b/net/batman-adv/mesh-interface.c +@@ -432,6 +432,7 @@ void batadv_interface_rx(struct net_devi + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + ++ ethhdr = eth_hdr(skb); + vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ diff --git a/queue-7.1/batman-adv-tt-avoid-request-storms-during-pending-request.patch b/queue-7.1/batman-adv-tt-avoid-request-storms-during-pending-request.patch new file mode 100644 index 0000000000..b0562cd542 --- /dev/null +++ b/queue-7.1/batman-adv-tt-avoid-request-storms-during-pending-request.patch @@ -0,0 +1,40 @@ +From 27c7d40008231ae4140d35501b60087a9de2d2c3 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Thu, 2 Jul 2026 21:06:23 +0200 +Subject: batman-adv: tt: avoid request storms during pending request + +From: Sven Eckelmann + +commit 27c7d40008231ae4140d35501b60087a9de2d2c3 upstream. + +batadv_send_tt_request() allocates a tt_req_node when none exists for the +destination originator node. This should prevent that a multiple TT +requests are send at the same time to an originator. + +But if allocation of the send buffer failed, this request must be cleaned +up again. But indicator for such a failure is "ret == false". But the +actual implementation is checking for "ret == true". + +The check must be inverted to not loose the information about the TT +request directly after it was attempted to be sent out. This should avoid +potential request storms. + +Cc: stable@vger.kernel.org +Fixes: 335fbe0f5d25 ("batman-adv: tvlv - convert tt query packet to use tvlv unicast packets") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/translation-table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -2963,7 +2963,7 @@ static bool batadv_send_tt_request(struc + out: + batadv_hardif_put(primary_if); + +- if (ret && tt_req_node) { ++ if (!ret && tt_req_node) { + spin_lock_bh(&bat_priv->tt.req_list_lock); + if (!hlist_unhashed(&tt_req_node->list)) { + hlist_del_init(&tt_req_node->list); diff --git a/queue-7.1/batman-adv-tt-prevent-tvlv-oob-check-overflow.patch b/queue-7.1/batman-adv-tt-prevent-tvlv-oob-check-overflow.patch new file mode 100644 index 0000000000..2e324b2647 --- /dev/null +++ b/queue-7.1/batman-adv-tt-prevent-tvlv-oob-check-overflow.patch @@ -0,0 +1,38 @@ +From 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Fri, 3 Jul 2026 22:27:13 +0200 +Subject: batman-adv: tt: prevent TVLV OOB check overflow + +From: Sven Eckelmann + +commit 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b upstream. + +A TT unicast TVLV contains the number of VLANs stored in it. This number is +an u16 and gets multiplied by the size of the struct +batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16 +used to store the tt_vlan_len. All additional safety checks to prevent +out-of-bounds access of the TVLV buffer are invalid due to this overflow. + +Using size_t prevents this overflow and ensures that the safety checks +compare against the actual buffer requirements. + +Cc: stable@vger.kernel.org +Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/translation-table.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -4025,7 +4025,8 @@ static int batadv_tt_tvlv_unicast_handle + u16 tvlv_value_len) + { + struct batadv_tvlv_tt_data *tt_data; +- u16 tt_vlan_len, tt_num_entries; ++ u16 tt_num_entries; ++ size_t tt_vlan_len; + char tt_flag; + bool ret; + diff --git a/queue-7.1/cifs-invalidate-cfid-on-unlink-rename-rmdir.patch b/queue-7.1/cifs-invalidate-cfid-on-unlink-rename-rmdir.patch new file mode 100644 index 0000000000..d5f7c1b648 --- /dev/null +++ b/queue-7.1/cifs-invalidate-cfid-on-unlink-rename-rmdir.patch @@ -0,0 +1,97 @@ +From f71d68d2b473e47db260c27c98212829590d8bae Mon Sep 17 00:00:00 2001 +From: Shyam Prasad N +Date: Thu, 14 May 2026 23:38:07 +0530 +Subject: cifs: invalidate cfid on unlink/rename/rmdir + +From: Shyam Prasad N + +commit f71d68d2b473e47db260c27c98212829590d8bae upstream. + +Today we do not invalidate the cached_dirent or the entire +parent cfid when a dentry in a dir has been removed/moved. + +This change invalidates the parent cfid so that we don't serve +directory contents from the cache. + +Cc: +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/inode.c | 30 +++++++++++++++++++++++++++++- + 1 file changed, 29 insertions(+), 1 deletion(-) + +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -28,6 +28,23 @@ + #include "cached_dir.h" + #include "reparse.h" + ++static void cifs_invalidate_cached_dir(struct cifs_tcon *tcon, ++ struct dentry *parent) ++{ ++ struct cached_fid *parent_cfid = NULL; ++ ++ if (!tcon || !parent) ++ return; ++ ++ if (!open_cached_dir_by_dentry(tcon, parent, &parent_cfid)) { ++ mutex_lock(&parent_cfid->dirents.de_mutex); ++ parent_cfid->dirents.is_valid = false; ++ parent_cfid->dirents.is_failed = true; ++ mutex_unlock(&parent_cfid->dirents.de_mutex); ++ close_cached_dir(parent_cfid); ++ } ++} ++ + /* + * Set parameters for the netfs library + */ +@@ -2067,6 +2084,9 @@ psx_del_no_retry: + cifs_set_file_info(inode, attrs, xid, full_path, origattr); + + out_reval: ++ if (!rc && dentry->d_parent) ++ cifs_invalidate_cached_dir(tcon, dentry->d_parent); ++ + if (inode) { + cifs_inode = CIFS_I(inode); + cifs_inode->time = 0; /* will force revalidate to get info +@@ -2378,7 +2398,6 @@ int cifs_rmdir(struct inode *inode, stru + } + + rc = server->ops->rmdir(xid, tcon, full_path, cifs_sb); +- cifs_put_tlink(tlink); + + cifsInode = CIFS_I(d_inode(direntry)); + +@@ -2388,6 +2407,8 @@ int cifs_rmdir(struct inode *inode, stru + i_size_write(d_inode(direntry), 0); + clear_nlink(d_inode(direntry)); + spin_unlock(&d_inode(direntry)->i_lock); ++ if (direntry->d_parent) ++ cifs_invalidate_cached_dir(tcon, direntry->d_parent); + } + + /* force revalidate to go get info when needed */ +@@ -2402,6 +2423,7 @@ int cifs_rmdir(struct inode *inode, stru + + inode_set_ctime_current(d_inode(direntry)); + inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); ++ cifs_put_tlink(tlink); + + rmdir_exit: + free_dentry_path(page); +@@ -2668,6 +2690,12 @@ unlink_target: + } + + /* force revalidate to go get info when needed */ ++ if (!rc) { ++ cifs_invalidate_cached_dir(tcon, source_dentry->d_parent); ++ if (target_dentry->d_parent != source_dentry->d_parent) ++ cifs_invalidate_cached_dir(tcon, target_dentry->d_parent); ++ } ++ + CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0; + + cifs_rename_exit: diff --git a/queue-7.1/cpufreq-intel_pstate-set-non-turbo-capacity-to-hwp_guaranteed_perf.patch b/queue-7.1/cpufreq-intel_pstate-set-non-turbo-capacity-to-hwp_guaranteed_perf.patch new file mode 100644 index 0000000000..89d2f491b6 --- /dev/null +++ b/queue-7.1/cpufreq-intel_pstate-set-non-turbo-capacity-to-hwp_guaranteed_perf.patch @@ -0,0 +1,47 @@ +From 27d80e0f8b8dff97503fc0061754b1d3800cb961 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 7 Jul 2026 19:19:55 +0200 +Subject: cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() + +From: Rafael J. Wysocki + +commit 27d80e0f8b8dff97503fc0061754b1d3800cb961 upstream. + +Setting cpu->capacity_perf to cpu->pstate.max_pstate_physical in the +"no turbo" case is inconsistent with what happens elsewhere in the +driver and causes arch_scale_cpu_capacity() to be incorrect. It also +skews arch_scale_freq_capacity() which ends up differing from 1024 for +the guaranteed P-state. + +Address that by setting capacity_perf to HWP_GUARANTEED_PERF() in the +"no turbo" case. + +Fixes: 929ebc93ccaa ("cpufreq: intel_pstate: Set asymmetric CPU capacity on hybrid systems") +Signed-off-by: Rafael J. Wysocki +Tested-by: Ricardo Neri +Cc: All applicable +Link: https://patch.msgid.link/12928972.O9o76ZdvQC@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/intel_pstate.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1058,12 +1058,14 @@ static void hybrid_clear_cpu_capacity(un + + static void hybrid_get_capacity_perf(struct cpudata *cpu) + { ++ u64 hwp_cap = READ_ONCE(cpu->hwp_cap_cached); ++ + if (READ_ONCE(global.no_turbo)) { +- cpu->capacity_perf = cpu->pstate.max_pstate_physical; ++ cpu->capacity_perf = HWP_GUARANTEED_PERF(hwp_cap); + return; + } + +- cpu->capacity_perf = HWP_HIGHEST_PERF(READ_ONCE(cpu->hwp_cap_cached)); ++ cpu->capacity_perf = HWP_HIGHEST_PERF(hwp_cap); + } + + static void hybrid_set_capacity_of_cpus(void) diff --git a/queue-7.1/cpufreq-schedutil-fix-uncleared-need_freq_update-on-the-.adjust_perf-path.patch b/queue-7.1/cpufreq-schedutil-fix-uncleared-need_freq_update-on-the-.adjust_perf-path.patch new file mode 100644 index 0000000000..09a51bd990 --- /dev/null +++ b/queue-7.1/cpufreq-schedutil-fix-uncleared-need_freq_update-on-the-.adjust_perf-path.patch @@ -0,0 +1,58 @@ +From 9ef450ca74e43dacf9a2a15db7a851052c78dcf0 Mon Sep 17 00:00:00 2001 +From: Zhongqiu Han +Date: Tue, 16 Jun 2026 23:47:33 +0800 +Subject: cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf() path + +From: Zhongqiu Han + +commit 9ef450ca74e43dacf9a2a15db7a851052c78dcf0 upstream. + +The need_freq_update flag makes sugov_should_update_freq() return true +regardless of the rate_limit_us throttling, and is cleared in +sugov_update_next_freq(). sugov_update_single_freq() and +sugov_update_shared() go through that helper, so the flag does not +persist there. + +However, sugov_update_single_perf(), used by drivers implementing the +.adjust_perf() callback (e.g. intel_pstate or amd-pstate in passive +mode) calls cpufreq_driver_adjust_perf() directly and never goes through +sugov_update_next_freq(), so the need_freq_update flag is not cleared in +that path. + +Before commit 75da043d8f88 ("cpufreq/sched: Set need_freq_update in +ignore_dl_rate_limit()"), this was effectively harmless because +sugov_should_update_freq() still honored the rate limit even when +need_freq_update was set. After that change, the flag forces +sugov_should_update_freq() to always return true, so once set, it +stays effective indefinitely on the .adjust_perf() path. + +As a result, cpufreq_driver_adjust_perf() gets called on every scheduler +utilization update (with the runqueue lock held) rather than being +throttled by rate_limit_us, even if the driver itself may skip redundant +hardware updates. + +Clear need_freq_update at the end of the adjust_perf path as well. + +Fixes: 75da043d8f88 ("cpufreq/sched: Set need_freq_update in ignore_dl_rate_limit()") +Signed-off-by: Zhongqiu Han +Reviewed-by: Hongyan Xia +Reviewed-by: Christian Loehle +Cc: All applicable +[ rjw: Subject and changelog edits ] +Link: https://patch.msgid.link/20260616154733.2405236-1-zhongqiu.han@oss.qualcomm.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/cpufreq_schedutil.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -486,6 +486,7 @@ static void sugov_update_single_perf(str + cpufreq_driver_adjust_perf(sg_policy->policy, sg_cpu->bw_min, + sg_cpu->util, max_cap); + ++ sg_policy->need_freq_update = false; + sg_policy->last_freq_update_time = time; + } + diff --git a/queue-7.1/fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch b/queue-7.1/fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch new file mode 100644 index 0000000000..a6ea4c8f88 --- /dev/null +++ b/queue-7.1/fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch @@ -0,0 +1,50 @@ +From 9d18a4e4234fd3ee0d0eed8ccbbb50cb76b2232c Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:31 +0530 +Subject: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() + +From: Abdun Nihaal + +commit 9d18a4e4234fd3ee0d0eed8ccbbb50cb76b2232c upstream. + +The memory allocated for pagerefs in fb_deferred_io_init() is not freed +on the error path. Fix it by calling fb_deferred_io_cleanup(). + +Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/broadsheetfb.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/broadsheetfb.c ++++ b/drivers/video/fbdev/broadsheetfb.c +@@ -1072,12 +1072,14 @@ static int broadsheetfb_probe(struct pla + info->flags = FBINFO_VIRTFB; + + info->fbdefio = &broadsheetfb_defio; +- fb_deferred_io_init(info); ++ retval = fb_deferred_io_init(info); ++ if (retval) ++ goto err_vfree; + + retval = fb_alloc_cmap(&info->cmap, 16, 0); + if (retval < 0) { + dev_err(&dev->dev, "Failed to allocate colormap\n"); +- goto err_vfree; ++ goto err_fbdefio; + } + + /* set cmap */ +@@ -1121,6 +1123,8 @@ err_free_irq: + board->cleanup(par); + err_cmap: + fb_dealloc_cmap(&info->cmap); ++err_fbdefio: ++ fb_deferred_io_cleanup(info); + err_vfree: + vfree(videomemory); + err_fb_rel: diff --git a/queue-7.1/fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch b/queue-7.1/fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch new file mode 100644 index 0000000000..22c9f0c418 --- /dev/null +++ b/queue-7.1/fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch @@ -0,0 +1,32 @@ +From 6fcca16a2b19c37f60693c56cbc0c923364ff3ef Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:34 +0530 +Subject: fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() + +From: Abdun Nihaal + +commit 6fcca16a2b19c37f60693c56cbc0c923364ff3ef upstream. + +The memory allocated for modelist in fb_videomode_to_modelist() is not +freed in the subsequent error path. +Fix that by calling fb_destroy_modelist() + +Fixes: 2ece5f43b041 ("fbdev: add the carmine FB driver") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/carminefb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/carminefb.c ++++ b/drivers/video/fbdev/carminefb.c +@@ -589,6 +589,7 @@ static int alloc_carmine_fb(void __iomem + return 0; + + err_dealloc_cmap: ++ fb_destroy_modelist(&info->modelist); + fb_dealloc_cmap(&info->cmap); + err_free_fb: + framebuffer_release(info); diff --git a/queue-7.1/fbdev-efifb-fix-memory-leak-in-efifb_probe.patch b/queue-7.1/fbdev-efifb-fix-memory-leak-in-efifb_probe.patch new file mode 100644 index 0000000000..5d649fd772 --- /dev/null +++ b/queue-7.1/fbdev-efifb-fix-memory-leak-in-efifb_probe.patch @@ -0,0 +1,34 @@ +From 9b6eaf101656958397a6012bf43f6e2e42c9e5cb Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:41 +0530 +Subject: fbdev: efifb: fix memory leak in efifb_probe() + +From: Abdun Nihaal + +commit 9b6eaf101656958397a6012bf43f6e2e42c9e5cb upstream. + +Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to +caller; clarify ownership") the string returned from fb_get_options() +is expected to be freed by the caller, but the string is not freed in +efifb_probe(). Fix that by freeing the option string after setup. + +Fixes: 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/efifb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/efifb.c ++++ b/drivers/video/fbdev/efifb.c +@@ -377,6 +377,7 @@ static int efifb_probe(struct platform_d + if (fb_get_options("efifb", &option)) + return -ENODEV; + efifb_setup(si, option); ++ kfree(option); + + /* We don't get linelength from UGA Draw Protocol, only from + * EFI Graphics Protocol. So if it's not in DMI, and it's not diff --git a/queue-7.1/fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch b/queue-7.1/fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch new file mode 100644 index 0000000000..fe25e4d342 --- /dev/null +++ b/queue-7.1/fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch @@ -0,0 +1,44 @@ +From cbef2a305a8a72969b86f96b7c07b86edde61aff Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:30 +0530 +Subject: fbdev: hecubafb: fix potential memory leak in hecubafb_probe() + +From: Abdun Nihaal + +commit cbef2a305a8a72969b86f96b7c07b86edde61aff upstream. + +The memory allocated for pagerefs in fb_deferred_io_init() is not freed +on the error path. Fix it by calling fb_deferred_io_cleanup(). + +Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/hecubafb.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/video/fbdev/hecubafb.c ++++ b/drivers/video/fbdev/hecubafb.c +@@ -192,7 +192,9 @@ static int hecubafb_probe(struct platfor + info->flags = FBINFO_VIRTFB; + + info->fbdefio = &hecubafb_defio; +- fb_deferred_io_init(info); ++ retval = fb_deferred_io_init(info); ++ if (retval) ++ goto err_fbdefio; + + retval = register_framebuffer(info); + if (retval < 0) +@@ -209,6 +211,8 @@ static int hecubafb_probe(struct platfor + + return 0; + err_fbreg: ++ fb_deferred_io_cleanup(info); ++err_fbdefio: + framebuffer_release(info); + err_fballoc: + vfree(videomemory); diff --git a/queue-7.1/fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch b/queue-7.1/fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch new file mode 100644 index 0000000000..b9643d236b --- /dev/null +++ b/queue-7.1/fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch @@ -0,0 +1,32 @@ +From 5936063409af230a2c88b8700c47b89a19fd70b5 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:35 +0530 +Subject: fbdev: i740fb: fix potential memory leak in i740fb_probe() + +From: Abdun Nihaal + +commit 5936063409af230a2c88b8700c47b89a19fd70b5 upstream. + +In i740fb_probe(), the memory allocated in fb_videomode_to_modelist() +for modelist is not freed in the error paths. Fix that by calling +fb_destroy_modelist(). + +Fixes: 5350c65f4f15 ("Resurrect Intel740 driver: i740fb") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/i740fb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/i740fb.c ++++ b/drivers/video/fbdev/i740fb.c +@@ -1152,6 +1152,7 @@ err_reg_framebuffer: + fb_dealloc_cmap(&info->cmap); + err_alloc_cmap: + err_find_mode: ++ fb_destroy_modelist(&info->modelist); + if (par->ddc_registered) + i2c_del_adapter(&par->ddc_adapter); + pci_iounmap(dev, par->regs); diff --git a/queue-7.1/fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch b/queue-7.1/fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch new file mode 100644 index 0000000000..0ca5db6ed7 --- /dev/null +++ b/queue-7.1/fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch @@ -0,0 +1,50 @@ +From 894632b862a39b3fe1cb5de06fbae86225ea64de Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:32 +0530 +Subject: fbdev: metronomefb: fix potential memory leak in metronomefb_probe() + +From: Abdun Nihaal + +commit 894632b862a39b3fe1cb5de06fbae86225ea64de upstream. + +The memory allocated for pagerefs in fb_deferred_io_init() is not freed +on the error path. Fix it by calling fb_deferred_io_cleanup(). + +Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/metronomefb.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/metronomefb.c ++++ b/drivers/video/fbdev/metronomefb.c +@@ -645,12 +645,14 @@ static int metronomefb_probe(struct plat + info->flags = FBINFO_VIRTFB; + + info->fbdefio = &metronomefb_defio; +- fb_deferred_io_init(info); ++ retval = fb_deferred_io_init(info); ++ if (retval) ++ goto err_free_irq; + + retval = fb_alloc_cmap(&info->cmap, 8, 0); + if (retval < 0) { + dev_err(&dev->dev, "Failed to allocate colormap\n"); +- goto err_free_irq; ++ goto err_fbdefio; + } + + /* set cmap */ +@@ -673,6 +675,8 @@ static int metronomefb_probe(struct plat + + err_cmap: + fb_dealloc_cmap(&info->cmap); ++err_fbdefio: ++ fb_deferred_io_cleanup(info); + err_free_irq: + board->cleanup(par); + err_csum_table: diff --git a/queue-7.1/fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch b/queue-7.1/fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch new file mode 100644 index 0000000000..00304284d7 --- /dev/null +++ b/queue-7.1/fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch @@ -0,0 +1,32 @@ +From 85f5e38c162bdf9dbbe197275d416402712f3707 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:36 +0530 +Subject: fbdev: nvidia: fix potential memory leak in nvidiafb_probe() + +From: Abdun Nihaal + +commit 85f5e38c162bdf9dbbe197275d416402712f3707 upstream. + +In nvidiafb_probe(), the memory allocated for modelist in +nvidia_set_fbinfo() is not freed in the subsequent error paths. +Fix that by calling fb_destroy_modelist(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/nvidia/nvidia.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/nvidia/nvidia.c ++++ b/drivers/video/fbdev/nvidia/nvidia.c +@@ -1421,6 +1421,7 @@ static int nvidiafb_probe(struct pci_dev + + err_out_iounmap_fb: + iounmap(info->screen_base); ++ fb_destroy_modelist(&info->modelist); + err_out_free_base1: + fb_destroy_modedb(info->monspecs.modedb); + nvidia_delete_i2c_busses(par); diff --git a/queue-7.1/fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch b/queue-7.1/fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch new file mode 100644 index 0000000000..808f4f89b0 --- /dev/null +++ b/queue-7.1/fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch @@ -0,0 +1,33 @@ +From df8c1101c9a08859da612b5d0a08d55d475522c6 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:33 +0530 +Subject: fbdev: radeon: fix potential memory leak in radeonfb_pci_register() + +From: Abdun Nihaal + +commit df8c1101c9a08859da612b5d0a08d55d475522c6 upstream. + +The function radeonfb_pci_register() allocates memory for modelist +(by calling radeon_check_modes() which calls fb_add_videomode()). +The memory is appended to info->modelist, but is not freed in subsequent +error paths. Fix this by calling fb_destroy_modelist(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/aty/radeon_base.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/aty/radeon_base.c ++++ b/drivers/video/fbdev/aty/radeon_base.c +@@ -2476,6 +2476,7 @@ static int radeonfb_pci_register(struct + return 0; + err_unmap_fb: + iounmap(rinfo->fb_base); ++ fb_destroy_modelist(&info->modelist); + err_unmap_rom: + kfree(rinfo->mon1_EDID); + kfree(rinfo->mon2_EDID); diff --git a/queue-7.1/fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch b/queue-7.1/fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch new file mode 100644 index 0000000000..8b3c27010c --- /dev/null +++ b/queue-7.1/fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch @@ -0,0 +1,32 @@ +From 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:37 +0530 +Subject: fbdev: s3fb: fix potential memory leak in s3_pci_probe() + +From: Abdun Nihaal + +commit 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 upstream. + +In s3_pci_probe(), the memory allocated for modelist using +fb_videomode_to_modelist() is not freed in subsequent error paths. +Fix that by calling fb_destroy_modelist() + +Fixes: 86c0f043a737 ("s3fb: add DDC support") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/s3fb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/s3fb.c ++++ b/drivers/video/fbdev/s3fb.c +@@ -1446,6 +1446,7 @@ err_reg_fb: + err_alloc_cmap: + err_find_mode: + #ifdef CONFIG_FB_S3_DDC ++ fb_destroy_modelist(&info->modelist); + if (par->ddc_registered) + i2c_del_adapter(&par->ddc_adapter); + if (par->mmio) diff --git a/queue-7.1/fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch b/queue-7.1/fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch new file mode 100644 index 0000000000..504202259c --- /dev/null +++ b/queue-7.1/fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch @@ -0,0 +1,40 @@ +From 5dbe5b65df0b0c0ec77492427c274b7b5011890e Mon Sep 17 00:00:00 2001 +From: Li RongQing +Date: Thu, 14 May 2026 21:02:02 -0400 +Subject: fbdev: sm712: Fix operator precedence in big_swap macro + +From: Li RongQing + +commit 5dbe5b65df0b0c0ec77492427c274b7b5011890e upstream. + +The big_swap(p) macro was intended to swap bytes within 16-bit halves +of a 32-bit value. However, because the bitwise shift operators (<<, >>) +have higher precedence than the bitwise AND operator (&), the original +code failed to perform any shifting on the masked bits. + +For example, 'p & 0xff00ff00 >> 8' was evaluated as 'p & +(0xff00ff00 >> 8)', effectively neutralizing the intended swap. + +Fix this by adding parentheses to ensure the bitwise AND is performed +before the shift, correctly implementing the byte swap logic. + +Fixes: 1461d66728648 ("staging: sm7xxfb: merge sm712fb with fbdev") +Cc: stable@vger.kernel.org +Signed-off-by: Li RongQing +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/sm712.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/fbdev/sm712.h ++++ b/drivers/video/fbdev/sm712.h +@@ -101,7 +101,7 @@ struct modeinit { + #define mmio_addr 0x00800000 + #define seqw17() smtc_seqw(0x17, 0x30) + #define big_pixel_depth(p, d) {if (p == 24) {p = 32; d = 32; } } +-#define big_swap(p) ((p & 0xff00ff00 >> 8) | (p & 0x00ff00ff << 8)) ++#define big_swap(p) (((p & 0xff00ff00) >> 8) | ((p & 0x00ff00ff) << 8)) + #else + #define pal_rgb(r, g, b, val) val + #define big_addr 0 diff --git a/queue-7.1/fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch b/queue-7.1/fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch new file mode 100644 index 0000000000..ed1a11d626 --- /dev/null +++ b/queue-7.1/fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch @@ -0,0 +1,33 @@ +From bb019d755366cc3e777a12d4bf457ff289837370 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:38 +0530 +Subject: fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() + +From: Abdun Nihaal + +commit bb019d755366cc3e777a12d4bf457ff289837370 upstream. + +In tdfxfb_probe(), the memory allocated for modelist using +fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not +freed in the subsequent error paths. +Fix that by calling fb_destroy_modelist(). + +Fixes: 215059d2421f ("tdfxfb: make use of DDC information about connected monitor") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/tdfxfb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/tdfxfb.c ++++ b/drivers/video/fbdev/tdfxfb.c +@@ -1551,6 +1551,7 @@ static int tdfxfb_probe(struct pci_dev * + + out_err_iobase: + #ifdef CONFIG_FB_3DFX_I2C ++ fb_destroy_modelist(&info->modelist); + tdfxfb_delete_i2c_busses(default_par); + #endif + arch_phys_wc_del(default_par->wc_cookie); diff --git a/queue-7.1/fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch b/queue-7.1/fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch new file mode 100644 index 0000000000..98af702486 --- /dev/null +++ b/queue-7.1/fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch @@ -0,0 +1,32 @@ +From 7a35ec619d9af8ee128320975c1252b8ad65f1e8 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:39 +0530 +Subject: fbdev: tridentfb: fix potential memory leak in trident_pci_probe() + +From: Abdun Nihaal + +commit 7a35ec619d9af8ee128320975c1252b8ad65f1e8 upstream. + +In trident_pci_probe(), the memory allocated for modelist using +fb_videomode_to_modelist() is not freed in subsequent error paths. +Fix that by calling fb_destroy_modelist(). + +Fixes: 6a5e3bd0c8bc ("tridentfb: Add DDC support") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/tridentfb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/tridentfb.c ++++ b/drivers/video/fbdev/tridentfb.c +@@ -1706,6 +1706,7 @@ static int trident_pci_probe(struct pci_ + return 0; + + out_unmap2: ++ fb_destroy_modelist(&info->modelist); + if (default_par->ddc_registered) + i2c_del_adapter(&default_par->ddc_adapter); + kfree(info->pixmap.addr); diff --git a/queue-7.1/fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch b/queue-7.1/fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch new file mode 100644 index 0000000000..9ba5a7c7e0 --- /dev/null +++ b/queue-7.1/fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch @@ -0,0 +1,41 @@ +From 033e56fed09047ee63072e9f58789f40c1c7079d Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:40 +0530 +Subject: fbdev: uvesafb: fix potential memory leak in uvesafb_probe() + +From: Abdun Nihaal + +commit 033e56fed09047ee63072e9f58789f40c1c7079d upstream. + +Due to an incorrect goto label, memory allocated for modedb and modelist +in uvesafb_vbe_init() is not freed in some error paths. Fix this by +updating the goto label. + +Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/uvesafb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/uvesafb.c ++++ b/drivers/video/fbdev/uvesafb.c +@@ -1694,14 +1694,14 @@ static int uvesafb_probe(struct platform + i = uvesafb_vbe_init_mode(info); + if (i < 0) { + err = -EINVAL; +- goto out; ++ goto out_mode; + } else { + mode = &par->vbe_modes[i]; + } + + if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) { + err = -ENXIO; +- goto out; ++ goto out_mode; + } + + uvesafb_init_info(info, mode); diff --git a/queue-7.1/fbdev-vesafb-fix-memory-leak-in-vesafb_probe.patch b/queue-7.1/fbdev-vesafb-fix-memory-leak-in-vesafb_probe.patch new file mode 100644 index 0000000000..8dac38139f --- /dev/null +++ b/queue-7.1/fbdev-vesafb-fix-memory-leak-in-vesafb_probe.patch @@ -0,0 +1,34 @@ +From b15d708995c01bbffe7dcd634a31959f6805bed3 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 14 May 2026 13:54:42 +0530 +Subject: fbdev: vesafb: fix memory leak in vesafb_probe() + +From: Abdun Nihaal + +commit b15d708995c01bbffe7dcd634a31959f6805bed3 upstream. + +Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to +caller; clarify ownership") the string returned from fb_get_options() +is expected to be freed by the caller. But the string is not freed in +vesafb_probe(). Fix that by freeing the option string after setup. + +Fixes: 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/vesafb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/video/fbdev/vesafb.c ++++ b/drivers/video/fbdev/vesafb.c +@@ -269,6 +269,7 @@ static int vesafb_probe(struct platform_ + /* ignore error return of fb_get_options */ + fb_get_options("vesafb", &option); + vesafb_setup(option); ++ kfree(option); + + if (si->orig_video_isVGA != VIDEO_TYPE_VLFB) + return -ENODEV; diff --git a/queue-7.1/gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch b/queue-7.1/gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch new file mode 100644 index 0000000000..82505078cb --- /dev/null +++ b/queue-7.1/gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch @@ -0,0 +1,139 @@ +From 56bc6384314fb9ae98975fb2af8b143097ede3dc Mon Sep 17 00:00:00 2001 +From: Arunpravin Paneer Selvam +Date: Thu, 9 Jul 2026 18:40:50 +0530 +Subject: gpu/buddy: bail out of try_harder when alignment cannot be honoured +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arunpravin Paneer Selvam + +commit 56bc6384314fb9ae98975fb2af8b143097ede3dc upstream. + +The try_harder contiguous fallback could return a range whose start +offset did not match the caller's min_block_size. When a candidate's +start is misaligned, realign it: free the misaligned run and reallocate +exactly @size at the next lower min_block_size boundary. This keeps the +returned size unchanged with no surplus to trim, and rejects the request +only when no aligned candidate fits. + +v2: align misaligned candidates down to min_block_size instead of + bailing out, for both the RHS and LHS paths (Matthew). + +Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation") +Suggested-by: Christian König +Cc: Matthew Auld +Cc: Christian König +Cc: Timur Kristóf +Cc: stable@vger.kernel.org +Reviewed-by: Matthew Auld +Tested-by: John Olender +Signed-off-by: Arunpravin Paneer Selvam +Link: https://patch.msgid.link/20260709131050.1022759-1-Arunpravin.PaneerSelvam@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/buddy.c | 65 ++++++++++++++++++++++++++++++++++++---------------- + 1 file changed, 45 insertions(+), 20 deletions(-) + +--- a/drivers/gpu/buddy.c ++++ b/drivers/gpu/buddy.c +@@ -1078,22 +1078,30 @@ static int __gpu_buddy_alloc_range(struc + blocks, total_allocated_on_err); + } + ++static int __alloc_contig_aligned_retry(struct gpu_buddy *mm, ++ u64 unaligned_offset, ++ u64 size, ++ u64 min_block_size, ++ struct list_head *blocks) ++{ ++ u64 aligned_offset = round_down(unaligned_offset, min_block_size); ++ ++ return __gpu_buddy_alloc_range(mm, aligned_offset, size, NULL, blocks); ++} ++ + static int __alloc_contig_try_harder(struct gpu_buddy *mm, + u64 size, + u64 min_block_size, + struct list_head *blocks) + { +- u64 rhs_offset, lhs_offset, lhs_size, filled; ++ u64 rhs_offset, lhs_offset, filled; + struct gpu_buddy_block *block; + unsigned int tree, order; +- LIST_HEAD(blocks_lhs); +- unsigned long pages; + u64 modify_size; + int err; + + modify_size = rounddown_pow_of_two(size); +- pages = modify_size >> ilog2(mm->chunk_size); +- order = fls(pages) - 1; ++ order = ilog2(modify_size) - ilog2(mm->chunk_size); + if (order == 0) + return -ENOSPC; + +@@ -1109,31 +1117,48 @@ static int __alloc_contig_try_harder(str + while (iter) { + block = rbtree_get_free_block(iter); + +- /* Allocate blocks traversing RHS */ + rhs_offset = gpu_buddy_block_offset(block); ++ ++ /* Allocate blocks traversing RHS */ + err = __gpu_buddy_alloc_range(mm, rhs_offset, size, + &filled, blocks); +- if (!err || err != -ENOSPC) ++ if (err && err != -ENOSPC) + return err; +- +- lhs_size = max((size - filled), min_block_size); +- if (!IS_ALIGNED(lhs_size, min_block_size)) +- lhs_size = round_up(lhs_size, min_block_size); +- +- /* Allocate blocks traversing LHS */ +- lhs_offset = gpu_buddy_block_offset(block) - lhs_size; +- err = __gpu_buddy_alloc_range(mm, lhs_offset, lhs_size, +- NULL, &blocks_lhs); ++ if (!err && IS_ALIGNED(rhs_offset, min_block_size)) ++ return 0; + if (!err) { +- list_splice(&blocks_lhs, blocks); ++ /* Allocate the unaligned RHS offset using round_down */ ++ gpu_buddy_free_list_internal(mm, blocks); ++ err = __alloc_contig_aligned_retry(mm, rhs_offset, ++ size, ++ min_block_size, ++ blocks); ++ if (!err) ++ return 0; ++ if (err != -ENOSPC) { ++ gpu_buddy_free_list_internal(mm, blocks); ++ return err; ++ } ++ goto next; ++ } ++ ++ if (size - filled > rhs_offset) ++ goto next; ++ ++ lhs_offset = rhs_offset - (size - filled); ++ ++ /* Allocate the unaligned LHS offset using round_down */ ++ gpu_buddy_free_list_internal(mm, blocks); ++ err = __alloc_contig_aligned_retry(mm, lhs_offset, size, ++ min_block_size, blocks); ++ if (!err) + return 0; +- } else if (err != -ENOSPC) { ++ if (err != -ENOSPC) { + gpu_buddy_free_list_internal(mm, blocks); + return err; + } +- /* Free blocks for the next iteration */ ++next: + gpu_buddy_free_list_internal(mm, blocks); +- + iter = rb_prev(iter); + } + } diff --git a/queue-7.1/gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch b/queue-7.1/gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch new file mode 100644 index 0000000000..b4da80168b --- /dev/null +++ b/queue-7.1/gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch @@ -0,0 +1,46 @@ +From e75717f9aec04355777be41070890c6a815c76df Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Mon, 13 Apr 2026 22:15:26 +0800 +Subject: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path + +From: Guangshuo Li + +commit e75717f9aec04355777be41070890c6a815c76df upstream. + +After device_initialize(), the embedded struct device in struct +host1x_device should be released through the device core with +put_device(). + +In host1x_device_add(), if host1x_device_parse_dt() fails, the current +error path frees the object directly with kfree(device). That bypasses +the normal device lifetime handling and leaks the reference held on the +embedded struct device. + +The issue was identified by a static analysis tool I developed and +confirmed by manual review. + +Fix this by using put_device() in the host1x_device_parse_dt() failure +path. + +Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Acked-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Link: https://patch.msgid.link/20260413141526.2961841-1-lgs201920130244@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/host1x/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/host1x/bus.c ++++ b/drivers/gpu/host1x/bus.c +@@ -485,7 +485,7 @@ static int host1x_device_add(struct host + + err = host1x_device_parse_dt(device, driver); + if (err < 0) { +- kfree(device); ++ put_device(&device->dev); + return err; + } + diff --git a/queue-7.1/gpu-nova-core-simplify-and_then-with-condition-to-filter.patch b/queue-7.1/gpu-nova-core-simplify-and_then-with-condition-to-filter.patch new file mode 100644 index 0000000000..97c950fc4b --- /dev/null +++ b/queue-7.1/gpu-nova-core-simplify-and_then-with-condition-to-filter.patch @@ -0,0 +1,61 @@ +From 16df3873c80388a71c4695909a51be0c809b889c Mon Sep 17 00:00:00 2001 +From: Eliot Courtney +Date: Thu, 23 Apr 2026 16:11:44 +0900 +Subject: gpu: nova-core: simplify and_then with condition to filter + +From: Eliot Courtney + +commit 16df3873c80388a71c4695909a51be0c809b889c upstream. + +This code is more simply expressed using Option::filter instead of the +and_then with conditional. + +This fixes the following warning with latest nightly Rust clippy build: + +warning: manual implementation of `Option::filter` + --> drivers/gpu/nova-core/firmware.rs:391:14 + | +391 | .and_then(|hdr| { + | ______________^ +392 | | if hdr.bin_magic == BIN_MAGIC { +393 | | Some(hdr) +394 | | } else { +... | +397 | | }) + | |______________^ help: try: `filter(|hdr| hdr.bin_magic == BIN_MAGIC)` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_filter + = note: `-D clippy::manual-filter` implied by `-D warnings` + = help: to override `-D warnings` add `#[allow(clippy::manual_filter)]` + +Cc: stable@vger.kernel.org +Fixes: d6cb7319e64e ("gpu: nova-core: firmware: add support for common firmware header") +Signed-off-by: Eliot Courtney +Acked-by: Danilo Krummrich +Reviewed-by: Alice Ryhl +Reviewed-by: Gary Guo +Link: https://patch.msgid.link/20260423-fix-filter-v1-1-b3b197c65daf@nvidia.com +[aliceryhl: add Fixes: tag and quote the warning it fixes] +Signed-off-by: Alice Ryhl +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/nova-core/firmware.rs | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/gpu/nova-core/firmware.rs ++++ b/drivers/gpu/nova-core/firmware.rs +@@ -388,13 +388,7 @@ impl<'a> BinFirmware<'a> { + // Extract header. + .and_then(BinHdr::from_bytes_copy) + // Validate header. +- .and_then(|hdr| { +- if hdr.bin_magic == BIN_MAGIC { +- Some(hdr) +- } else { +- None +- } +- }) ++ .filter(|hdr| hdr.bin_magic == BIN_MAGIC) + .map(|hdr| Self { hdr, fw }) + .ok_or(EINVAL) + } diff --git a/queue-7.1/leds-uleds-fix-potential-buffer-overread.patch b/queue-7.1/leds-uleds-fix-potential-buffer-overread.patch new file mode 100644 index 0000000000..a95935d57b --- /dev/null +++ b/queue-7.1/leds-uleds-fix-potential-buffer-overread.patch @@ -0,0 +1,39 @@ +From c19fe864f667afc49d1391d764e20b66555bcf7a Mon Sep 17 00:00:00 2001 +From: Armin Wolf +Date: Mon, 25 May 2026 01:55:53 +0200 +Subject: leds: uleds: Fix potential buffer overread + +From: Armin Wolf + +commit c19fe864f667afc49d1391d764e20b66555bcf7a upstream. + +The name string supplied by userspace is not guaranteed to be +null-terminated, so using strchr() on it might result in a buffer +overread. The same thing will happen when said string is used by +the LED class device. + +Fix this by using strnchr() instead and explicitly check that +the name string is properly null-terminated. + +Cc: stable@vger.kernel.org +Fixes: e381322b0190 ("leds: Introduce userspace LED class driver") +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20260524235553.189134-1-W_Armin@gmx.de +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/leds/uleds.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/leds/uleds.c ++++ b/drivers/leds/uleds.c +@@ -102,7 +102,8 @@ static ssize_t uleds_write(struct file * + + name = udev->user_dev.name; + if (!name[0] || !strcmp(name, ".") || !strcmp(name, "..") || +- strchr(name, '/')) { ++ strnchr(name, sizeof(udev->user_dev.name), '/') || ++ !strnchr(name, sizeof(udev->user_dev.name), '\0')) { + ret = -EINVAL; + goto out; + } diff --git a/queue-7.1/mfd-sm501-fix-reference-leak-on-failed-device-registration.patch b/queue-7.1/mfd-sm501-fix-reference-leak-on-failed-device-registration.patch new file mode 100644 index 0000000000..132b208620 --- /dev/null +++ b/queue-7.1/mfd-sm501-fix-reference-leak-on-failed-device-registration.patch @@ -0,0 +1,52 @@ +From 8c2f0b42fc252e1bf1c7746447091a468e784ca1 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Thu, 16 Apr 2026 00:26:27 +0800 +Subject: mfd: sm501: Fix reference leak on failed device registration + +From: Guangshuo Li + +commit 8c2f0b42fc252e1bf1c7746447091a468e784ca1 upstream. + +When platform_device_register() fails in sm501_register_device(), the +embedded struct device in pdev has already been initialized by +device_initialize(), but the failure path only reports the error and +returns without dropping the device reference for the current platform +device: + + sm501_register_device() + -> platform_device_register(pdev) + -> device_initialize(&pdev->dev) + -> setup_pdev_dma_masks(pdev) + -> platform_device_add(pdev) + +This leads to a reference leak when platform_device_register() fails. +Fix this by calling platform_device_put() before returning the error. + +The issue was identified by a static analysis tool I developed and +confirmed by manual review. + +Fixes: b6d6454fdb66f ("[PATCH] mfd: SM501 core driver") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Link: https://patch.msgid.link/20260415162627.3558789-1-lgs201920130244@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/sm501.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/sm501.c ++++ b/drivers/mfd/sm501.c +@@ -704,9 +704,11 @@ static int sm501_register_device(struct + if (ret >= 0) { + dev_dbg(sm->dev, "registered %s\n", pdev->name); + list_add_tail(&smdev->list, &sm->devices); +- } else ++ } else { + dev_err(sm->dev, "error registering %s (%d)\n", + pdev->name, ret); ++ platform_device_put(pdev); ++ } + + return ret; + } diff --git a/queue-7.1/mfd-tps6586x-fix-of-node-refcount.patch b/queue-7.1/mfd-tps6586x-fix-of-node-refcount.patch new file mode 100644 index 0000000000..b2838bd682 --- /dev/null +++ b/queue-7.1/mfd-tps6586x-fix-of-node-refcount.patch @@ -0,0 +1,38 @@ +From 3001ed2b4e06da2276c42ace6551617065a5b1f9 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Thu, 21 May 2026 10:36:24 +0200 +Subject: mfd: tps6586x: Fix OF node refcount + +From: Bartosz Golaszewski + +commit 3001ed2b4e06da2276c42ace6551617065a5b1f9 upstream. + +Platform devices created with platform_device_alloc() call +platform_device_release() when the last reference to the device's +kobject is dropped. This function calls of_node_put() unconditionally. +This works fine for devices created with platform_device_register_full() +but users of the split approach (platform_device_alloc() + +platform_device_add()) must bump the reference of the of_node they +assign manually. Add the missing call to of_node_get(). + +Cc: stable@vger.kernel.org +Fixes: 62f6b0879304 ("tps6586x: Add device tree support") +Signed-off-by: Bartosz Golaszewski +Link: https://patch.msgid.link/20260521-pdev-fwnode-ref-v1-1-88c324a1b8d2@oss.qualcomm.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/tps6586x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/tps6586x.c ++++ b/drivers/mfd/tps6586x.c +@@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct t + + pdev->dev.parent = tps6586x->dev; + pdev->dev.platform_data = subdev->platform_data; +- pdev->dev.of_node = subdev->of_node; ++ pdev->dev.of_node = of_node_get(subdev->of_node); + + ret = platform_device_add(pdev); + if (ret) { diff --git a/queue-7.1/netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch b/queue-7.1/netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch new file mode 100644 index 0000000000..a95b7ee063 --- /dev/null +++ b/queue-7.1/netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch @@ -0,0 +1,78 @@ +From 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d Mon Sep 17 00:00:00 2001 +From: "Xiang Mei (Microsoft)" +Date: Wed, 8 Jul 2026 18:11:50 +0000 +Subject: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() + +From: Xiang Mei (Microsoft) + +commit 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d upstream. + +br_ip6_fragment() gets prevhdr, a pointer into the skb head, from +ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb +skb_checksum_help() reallocates the head via pskb_expand_head(), leaving +prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a +use-after-free write. + +Save prevhdr's offset before skb_checksum_help() and recompute it after, +like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 +fragment"). + + BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) + Write of size 1 at addr ffff888013ff5016 by task exploit/141 + Call Trace: + ... + kasan_report (mm/kasan/report.c:595) + ip6_frag_next (net/ipv6/ip6_output.c:857) + br_ip6_fragment (net/ipv6/netfilter.c:212) + nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) + nf_hook_slow (net/netfilter/core.c:619) + br_forward_finish (net/bridge/br_forward.c:66) + __br_forward (net/bridge/br_forward.c:115) + maybe_deliver (net/bridge/br_forward.c:191) + br_flood (net/bridge/br_forward.c:245) + br_handle_frame_finish (net/bridge/br_input.c:229) + br_handle_frame (net/bridge/br_input.c:442) + ... + packet_sendmsg (net/packet/af_packet.c:3114) + ... + do_syscall_64 (arch/x86/entry/syscall_64.c:94) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) + Kernel panic - not syncing: Fatal exception in interrupt + +Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6") +Cc: stable@vger.kernel.org +Reported-by: AutonomousCodeSecurity@microsoft.com +Signed-off-by: Xiang Mei (Microsoft) +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/netfilter.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -120,7 +120,7 @@ int br_ip6_fragment(struct net *net, str + ktime_t tstamp = skb->tstamp; + struct ip6_frag_state state; + u8 *prevhdr, nexthdr = 0; +- unsigned int mtu, hlen; ++ unsigned int mtu, hlen, nexthdr_offset; + int hroom, err = 0; + __be32 frag_id; + +@@ -129,6 +129,7 @@ int br_ip6_fragment(struct net *net, str + goto blackhole; + hlen = err; + nexthdr = *prevhdr; ++ nexthdr_offset = prevhdr - skb_network_header(skb); + + mtu = skb->dev->mtu; + if (frag_max_size > mtu || +@@ -147,6 +148,7 @@ int br_ip6_fragment(struct net *net, str + (err = skb_checksum_help(skb))) + goto blackhole; + ++ prevhdr = skb_network_header(skb) + nexthdr_offset; + hroom = LL_RESERVED_SPACE(skb->dev); + if (skb_has_frag_list(skb)) { + unsigned int first_len = skb_pagelen(skb); diff --git a/queue-7.1/netfilter-ecache-fix-inverted-time_after-check.patch b/queue-7.1/netfilter-ecache-fix-inverted-time_after-check.patch new file mode 100644 index 0000000000..c5cfa49d0c --- /dev/null +++ b/queue-7.1/netfilter-ecache-fix-inverted-time_after-check.patch @@ -0,0 +1,69 @@ +From b06163ce52ec0561f202fbfb9b08090cb61f512e Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Tue, 7 Jul 2026 19:00:14 +0800 +Subject: netfilter: ecache: fix inverted time_after() check + +From: Yizhou Zhao + +commit b06163ce52ec0561f202fbfb9b08090cb61f512e upstream. + +ecache_work_evict_list() redelivers DESTROY events for conntracks that +were moved to the per-netns dying_list after event delivery failed. It +sets a 10ms deadline: + + stop = jiffies + ECACHE_MAX_JIFFIES + +but then tests: + + time_after(stop, jiffies) + +This condition is true while the deadline is still in the future, so the +worker returns STATE_RESTART after the first successful redelivery in the +usual case. ecache_work() maps STATE_RESTART to delay 0, which turns the +redelivery path into one dying conntrack per workqueue dispatch and makes +the sent > 16 batching/cond_resched() path effectively unreachable. + +A conntrack netlink listener whose receive queue is congested can make +DESTROY event delivery fail with -ENOBUFS. With sustained conntrack +churn, entries then accumulate on the dying_list and are only drained at +the degraded one-entry-per-dispatch rate once delivery succeeds again, +wasting CPU on back-to-back workqueue reschedules and prolonging +conntrack memory/resource pressure. + +In a KASAN QEMU test with CONFIG_NF_CONNTRACK_EVENTS=y and +nf_conntrack.enable_hooks=1, a congested DESTROY listener caused 8192 +nf_ct_delete() calls to return false and move entries to the dying_list. +After closing the listener, the unfixed kernel needed 7670 ecache_work() +entries to destroy 7669 conntracks. With this change, the same 8192 +entries were destroyed by 2 ecache_work() entries. + +Swap the comparison so the worker restarts only after the deadline has +expired. + +Fixes: 2ed3bf188b33 ("netfilter: ecache: use dedicated list for event redelivery") +Cc: stable@vger.kernel.org +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude-Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_ecache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/nf_conntrack_ecache.c ++++ b/net/netfilter/nf_conntrack_ecache.c +@@ -77,7 +77,7 @@ next: + hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode); + hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode, &evicted_list); + +- if (time_after(stop, jiffies)) { ++ if (time_after(jiffies, stop)) { + ret = STATE_RESTART; + break; + } diff --git a/queue-7.1/netfilter-flowtable-support-ipip-tunnel-with-direct-xmit.patch b/queue-7.1/netfilter-flowtable-support-ipip-tunnel-with-direct-xmit.patch new file mode 100644 index 0000000000..b611a970fa --- /dev/null +++ b/queue-7.1/netfilter-flowtable-support-ipip-tunnel-with-direct-xmit.patch @@ -0,0 +1,106 @@ +From fa7395c02d95e51bad2952325d2d6503bfbad437 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 30 Jun 2026 11:40:56 +0200 +Subject: netfilter: flowtable: support IPIP tunnel with direct xmit + +From: Pablo Neira Ayuso + +commit fa7395c02d95e51bad2952325d2d6503bfbad437 upstream. + +The combination of IPIP tunnel with direct xmit, eg. bridge device, +breaks because no dst_entry is provided to check the skb headroom and to +set the iph->frag_off field. This leads to invalid dst usage and can +trigger a crash in the tunnel transmit path. + +Fix this by moving dst_cache and dst_cookie out of the runtime union so +that they can be shared by neighbour, xfrm, and direct tunnel flows. +For FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve +route state in these shared fields and release it through the common +dst release path. + +Since dst_entry is now available to the three supported xmit modes and +dst_release() already deals with NULL dst, remove the xmit type check +in nft_flow_dst_release(). Moreover, skip the check if the dst entry +is NULL in nf_flow_dst_check() which is now the case for the direct +xmit case. + +Based on patch from Rein Wei . + +Fixes: d30301ba4b07 ("netfilter: flowtable: Add IPIP tx sw acceleration") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Xin Liu +Reported-by: Zhengyang Chen +Reported-by: Ren Wei +Signed-off-by: Pablo Neira Ayuso +Acked-by: Lorenzo Bianconi +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_flow_table.h | 5 +++-- + net/netfilter/nf_flow_table_core.c | 12 ++++++++---- + net/netfilter/nf_flow_table_ip.c | 3 +-- + 3 files changed, 12 insertions(+), 8 deletions(-) + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -155,11 +155,12 @@ struct flow_offload_tuple { + tun_num:2, + in_vlan_ingress:2; + u16 mtu; ++ u32 dst_cookie; ++ struct dst_entry *dst_cache; ++ + union { + struct { +- struct dst_entry *dst_cache; + u32 ifidx; +- u32 dst_cookie; + }; + struct { + u32 ifidx; +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -127,12 +127,18 @@ static int flow_offload_fill_route(struc + + switch (route->tuple[dir].xmit_type) { + case FLOW_OFFLOAD_XMIT_DIRECT: ++ if (flow_tuple->tun_num) { ++ flow_tuple->dst_cache = dst; ++ flow_tuple->dst_cookie = ++ flow_offload_dst_cookie(flow_tuple); ++ } + memcpy(flow_tuple->out.h_dest, route->tuple[dir].out.h_dest, + ETH_ALEN); + memcpy(flow_tuple->out.h_source, route->tuple[dir].out.h_source, + ETH_ALEN); + flow_tuple->out.ifidx = route->tuple[dir].out.ifindex; +- dst_release(dst); ++ if (!flow_tuple->tun_num) ++ dst_release(dst); + break; + case FLOW_OFFLOAD_XMIT_XFRM: + case FLOW_OFFLOAD_XMIT_NEIGH: +@@ -152,9 +158,7 @@ static int flow_offload_fill_route(struc + static void nft_flow_dst_release(struct flow_offload *flow, + enum flow_offload_tuple_dir dir) + { +- if (flow->tuplehash[dir].tuple.xmit_type == FLOW_OFFLOAD_XMIT_NEIGH || +- flow->tuplehash[dir].tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM) +- dst_release(flow->tuplehash[dir].tuple.dst_cache); ++ dst_release(flow->tuplehash[dir].tuple.dst_cache); + } + + void flow_offload_route_init(struct flow_offload *flow, +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -299,8 +299,7 @@ static bool nf_flow_exceeds_mtu(const st + + static inline bool nf_flow_dst_check(struct flow_offload_tuple *tuple) + { +- if (tuple->xmit_type != FLOW_OFFLOAD_XMIT_NEIGH && +- tuple->xmit_type != FLOW_OFFLOAD_XMIT_XFRM) ++ if (!tuple->dst_cache) + return true; + + return dst_check(tuple->dst_cache, tuple->dst_cookie); diff --git a/queue-7.1/netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch b/queue-7.1/netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch new file mode 100644 index 0000000000..fea6a46fa7 --- /dev/null +++ b/queue-7.1/netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch @@ -0,0 +1,54 @@ +From 90941d9c925d66a482c9121919ec3546a6988c16 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Thu, 9 Jul 2026 13:40:25 +0200 +Subject: netfilter: flowtable: use correct direction to set up tunnel route + +From: Pablo Neira Ayuso + +commit 90941d9c925d66a482c9121919ec3546a6988c16 upstream. + +The layer 2 encapsulation and layer 3 tunnel information in the xmit +path is taken from the other tuple, because the tunnel information that +is included in the tuple for hashtable lookups is also used to perform +the egress encapsulation in the transmit path. + +This patch uses the correct direction when setting up the tunnel, the +original proposed patch to address this fix uses the reversed direction. + +While at it, remove the redundant check to call dst_release() to drop +the reference on the dst that was obtained from the forward path, which +is not useful in the direct xmit path unless tunneling is performed. + +Fixes: fa7395c02d95 ("netfilter: flowtable: support IPIP tunnel with direct xmit") +Cc: stable@vger.kernel.org +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_flow_table_core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -127,18 +127,18 @@ static int flow_offload_fill_route(struc + + switch (route->tuple[dir].xmit_type) { + case FLOW_OFFLOAD_XMIT_DIRECT: +- if (flow_tuple->tun_num) { ++ if (route->tuple[!dir].in.num_tuns) { + flow_tuple->dst_cache = dst; + flow_tuple->dst_cookie = + flow_offload_dst_cookie(flow_tuple); ++ } else { ++ dst_release(dst); + } + memcpy(flow_tuple->out.h_dest, route->tuple[dir].out.h_dest, + ETH_ALEN); + memcpy(flow_tuple->out.h_source, route->tuple[dir].out.h_source, + ETH_ALEN); + flow_tuple->out.ifidx = route->tuple[dir].out.ifindex; +- if (!flow_tuple->tun_num) +- dst_release(dst); + break; + case FLOW_OFFLOAD_XMIT_XFRM: + case FLOW_OFFLOAD_XMIT_NEIGH: diff --git a/queue-7.1/netfilter-flowtable-use-dst-in-this-direction-when-pushing-ipip-header.patch b/queue-7.1/netfilter-flowtable-use-dst-in-this-direction-when-pushing-ipip-header.patch new file mode 100644 index 0000000000..315fb8f9b4 --- /dev/null +++ b/queue-7.1/netfilter-flowtable-use-dst-in-this-direction-when-pushing-ipip-header.patch @@ -0,0 +1,105 @@ +From c328b90c17fc5fa7786503695152880b2afb9326 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 30 Jun 2026 11:40:54 +0200 +Subject: netfilter: flowtable: use dst in this direction when pushing IPIP header + +From: Pablo Neira Ayuso + +commit c328b90c17fc5fa7786503695152880b2afb9326 upstream. + +When pushing the IPIP header, the route of the other direction is used +to calculate the headroom, use the route in this direction. Accessing +the other tuple to set the IP source and destination is fine because +this tuple does not provide such information to avoid storing redundant +information. However, this tuple already provides the dst for this +direction, this went unnoticed because this bug affects headroom and +iph->frag_off only at this stage. + +Fixes: d30301ba4b07 ("netfilter: flowtable: Add IPIP tx sw acceleration") +Fixes: 93cf357fa797 ("netfilter: flowtable: Add IP6IP6 tx sw acceleration") +Cc: stable@vger.kernel.org +Acked-by: Lorenzo Bianconi +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_flow_table_ip.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c +index 29e93ac1e2e4..089f2bc19972 100644 +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -590,10 +590,10 @@ static int nf_flow_pppoe_push(struct sk_buff *skb, u16 id, + + static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb, + struct flow_offload_tuple *tuple, +- __be32 *ip_daddr) ++ struct dst_entry *dst, __be32 *ip_daddr) + { + struct iphdr *iph = (struct iphdr *)skb_network_header(skb); +- struct rtable *rt = dst_rtable(tuple->dst_cache); ++ struct rtable *rt = dst_rtable(dst); + u8 tos = iph->tos, ttl = iph->ttl; + __be16 frag_off = iph->frag_off; + u32 headroom = sizeof(*iph); +@@ -636,21 +636,22 @@ static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb, + + static int nf_flow_tunnel_v4_push(struct net *net, struct sk_buff *skb, + struct flow_offload_tuple *tuple, +- __be32 *ip_daddr) ++ struct dst_entry *dst, __be32 *ip_daddr) + { + if (tuple->tun_num) +- return nf_flow_tunnel_ipip_push(net, skb, tuple, ip_daddr); ++ return nf_flow_tunnel_ipip_push(net, skb, tuple, dst, ip_daddr); + + return 0; + } + + static int nf_flow_tunnel_ip6ip6_push(struct net *net, struct sk_buff *skb, + struct flow_offload_tuple *tuple, ++ struct dst_entry *dst, + struct in6_addr **ip6_daddr) + { + struct ipv6hdr *ip6h = (struct ipv6hdr *)skb_network_header(skb); +- struct rtable *rt = dst_rtable(tuple->dst_cache); + __u8 dsfield = ipv6_get_dsfield(ip6h); ++ struct rtable *rt = dst_rtable(dst); + struct flowi6 fl6 = { + .daddr = tuple->tun.src_v6, + .saddr = tuple->tun.dst_v6, +@@ -696,10 +697,11 @@ static int nf_flow_tunnel_ip6ip6_push(struct net *net, struct sk_buff *skb, + + static int nf_flow_tunnel_v6_push(struct net *net, struct sk_buff *skb, + struct flow_offload_tuple *tuple, ++ struct dst_entry *dst, + struct in6_addr **ip6_daddr) + { + if (tuple->tun_num) +- return nf_flow_tunnel_ip6ip6_push(net, skb, tuple, ip6_daddr); ++ return nf_flow_tunnel_ip6ip6_push(net, skb, tuple, dst, ip6_daddr); + + return 0; + } +@@ -842,7 +844,8 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, + other_tuple = &flow->tuplehash[!dir].tuple; + ip_daddr = other_tuple->src_v4.s_addr; + +- if (nf_flow_tunnel_v4_push(state->net, skb, other_tuple, &ip_daddr) < 0) ++ if (nf_flow_tunnel_v4_push(state->net, skb, other_tuple, ++ tuplehash->tuple.dst_cache, &ip_daddr) < 0) + return NF_DROP; + + switch (tuplehash->tuple.xmit_type) { +@@ -1158,6 +1161,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, + ip6_daddr = &other_tuple->src_v6; + + if (nf_flow_tunnel_v6_push(state->net, skb, other_tuple, ++ tuplehash->tuple.dst_cache, + &ip6_daddr) < 0) + return NF_DROP; + +-- +2.55.0 + diff --git a/queue-7.1/netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch b/queue-7.1/netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch new file mode 100644 index 0000000000..d1c8d7bfbd --- /dev/null +++ b/queue-7.1/netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch @@ -0,0 +1,82 @@ +From f62c41b4910e65da396ec9a8c40c1fe7fe82e449 Mon Sep 17 00:00:00 2001 +From: Yizhou Zhao +Date: Wed, 8 Jul 2026 13:27:28 +0800 +Subject: netfilter: nf_conncount: fix zone comparison in tuple dedup + +From: Yizhou Zhao + +commit f62c41b4910e65da396ec9a8c40c1fe7fe82e449 upstream. + +The "already exists" dedup logic in __nf_conncount_add() decides +whether a connection has already been counted and can be skipped instead +of incrementing the connlimit count. It compares the conntrack zone of a +list entry with the zone of the connection being added using +nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or +zone->dir as the direction argument. + +Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0 +and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask: +NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and +NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction +shifts the meaning of every non-zero value. An ORIG-only zone passes 1 +and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and +test bits beyond the valid direction range. In those cases +nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using +the real zone id, so different zones can be treated as equal and dedup +collapses to tuple equality alone. + +nf_conncount stores and compares the original-direction tuple for a +connection. If an skb already has an attached conntrack entry, +get_ct_or_tuple_from_skb() explicitly copies +ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's +ctinfo. Therefore the zone comparison in the tuple dedup path must use +IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a +zone id applies, not which direction this conncount tuple represents. + +Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly. +Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone +ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the +direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional +zone contains the ORIG bit, so it naturally returns the real zone id; +reply-only zones continue to fall back for original-direction tuple +comparisons. + +Fixes: 21ba8847f857 ("netfilter: nf_conncount: Fix garbage collection with zones") +Fixes: b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race") +Cc: stable@vger.kernel.org +Reported-by: Yizhou Zhao +Reported-by: Yuxiang Yang +Reported-by: Ao Wang +Reported-by: Xuewei Feng +Reported-by: Qi Li +Reported-by: Ke Xu +Assisted-by: Claude-Code:GLM-5.2 +Signed-off-by: Yizhou Zhao +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conncount.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/netfilter/nf_conncount.c ++++ b/net/netfilter/nf_conncount.c +@@ -207,8 +207,8 @@ check_connections: + /* Not found, but might be about to be confirmed */ + if (PTR_ERR(found) == -EAGAIN) { + if (nf_ct_tuple_equal(&conn->tuple, &tuple) && +- nf_ct_zone_id(&conn->zone, conn->zone.dir) == +- nf_ct_zone_id(zone, zone->dir)) ++ nf_ct_zone_id(&conn->zone, IP_CT_DIR_ORIGINAL) == ++ nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL)) + goto out_put; /* already exists */ + } else { + collect++; +@@ -219,7 +219,7 @@ check_connections: + found_ct = nf_ct_tuplehash_to_ctrack(found); + + if (nf_ct_tuple_equal(&conn->tuple, &tuple) && +- nf_ct_zone_equal(found_ct, zone, zone->dir)) { ++ nf_ct_zone_equal(found_ct, zone, IP_CT_DIR_ORIGINAL)) { + /* + * We should not see tuples twice unless someone hooks + * this into a table without "-p tcp --syn". diff --git a/queue-7.1/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch b/queue-7.1/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch new file mode 100644 index 0000000000..900b958448 --- /dev/null +++ b/queue-7.1/netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch @@ -0,0 +1,61 @@ +From ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a Mon Sep 17 00:00:00 2001 +From: Muhammad Bilal +Date: Tue, 19 May 2026 17:23:28 -0400 +Subject: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read + +From: Muhammad Bilal + +commit ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a upstream. + +parse_dcc() treats data_end as an inclusive end pointer, but its only +caller passes data_limit = ib_ptr + datalen, which points one past the +last valid byte. + +The newline search loop iterates while tmp <= data_end, so when no +newline is present, *tmp is read at tmp == data_end, one byte beyond +the region filled by skb_header_pointer(). + +irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is +capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte +is uninitialized or stale; if it contains an ASCII digit, simple_strtoul +will consume it and produce a wrong DCC IP or port in the conntrack +expectation. The extra allocation byte is also a fragile guard: if the +cap or allocation size changes, this becomes a real out-of-bounds read. + +Change the loop and its post-loop check to use strict less-than, +consistent with the caller's exclusive-end convention. Update the +function comment accordingly. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Muhammad Bilal +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_irc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -59,7 +59,7 @@ static const char *const dccprotos[] = { + /* tries to get the ip_addr and port out of a dcc command + * return value: -1 on failure, 0 on success + * data pointer to first byte of DCC command data +- * data_end pointer to last byte of dcc command data ++ * data_end one past end of data + * ip returns parsed ip of dcc command + * port returns parsed port of dcc command + * ad_beg_p returns pointer to first byte of addr data +@@ -77,10 +77,10 @@ static int parse_dcc(char *data, const c + + /* Make sure we have a newline character within the packet boundaries + * because simple_strtoul parses until the first invalid character. */ +- for (tmp = data; tmp <= data_end; tmp++) ++ for (tmp = data; tmp < data_end; tmp++) + if (*tmp == '\n') + break; +- if (tmp > data_end || *tmp != '\n') ++ if (tmp >= data_end || *tmp != '\n') + return -1; + + *ad_beg_p = data; diff --git a/queue-7.1/netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch b/queue-7.1/netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch new file mode 100644 index 0000000000..186bdc333f --- /dev/null +++ b/queue-7.1/netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch @@ -0,0 +1,50 @@ +From 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 Mon Sep 17 00:00:00 2001 +From: Xiang Mei +Date: Sun, 5 Jul 2026 16:36:29 -0700 +Subject: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag + +From: Xiang Mei + +commit 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 upstream. + +nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6 +fragment header and then unconditionally advances skb->mac_header: + + skb->mac_header += sizeof(struct frag_hdr); + +On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header +yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding +sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7), +after which skb_mac_header_was_set() wrongly reports a MAC header is +present and skb_mac_header() points into the headroom. + +The reassembler has done this unconditional add since it was introduced; +it was harmless while mac_header was a bare pointer, but wrong once +mac_header became a u16 offset whose unset state is the ~0U sentinel +tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c +does the same relocation and does guard the adjustment; mirror the +guard here. + +Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") +Cc: stable@vger.kernel.org +Reported-by: Weiming Shi +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Xiang Mei +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -348,7 +348,8 @@ static int nf_ct_frag6_reasm(struct frag + skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0]; + memmove(skb->head + sizeof(struct frag_hdr), skb->head, + (skb->data - skb->head) - sizeof(struct frag_hdr)); +- skb->mac_header += sizeof(struct frag_hdr); ++ if (skb_mac_header_was_set(skb)) ++ skb->mac_header += sizeof(struct frag_hdr); + skb->network_header += sizeof(struct frag_hdr); + + skb_reset_transport_header(skb); diff --git a/queue-7.1/netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch b/queue-7.1/netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch new file mode 100644 index 0000000000..e4c13da580 --- /dev/null +++ b/queue-7.1/netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch @@ -0,0 +1,52 @@ +From e5e24a365a5e024efef63cc49abb345fbd4852c5 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 26 Jun 2026 13:24:49 +0200 +Subject: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it + +From: Pablo Neira Ayuso + +commit e5e24a365a5e024efef63cc49abb345fbd4852c5 upstream. + +tc ingress and openvswitch do not guarantee routing information to be +available. These subsystems use the conntrack helper infrastructure, and +the SIP helper relies on the skb_dst() to be present if +sip_external_media is set to 1 (which is disabled by default as a module +parameter). + +This effectively disables the sip_external_media toggle for these +subsystems without resulting in a crash. + +Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action") +Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") +Cc: stable@vger.kernel.org +Reported-by: Ren Wei +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_sip.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nf_conntrack_sip.c ++++ b/net/netfilter/nf_conntrack_sip.c +@@ -956,7 +956,6 @@ static int set_expected_rtp_rtcp(struct + return NF_ACCEPT; + saddr = &ct->tuplehash[!dir].tuple.src.u3; + } else if (sip_external_media) { +- struct net_device *dev = skb_dst(skb)->dev; + struct dst_entry *dst = NULL; + struct flowi fl; + +@@ -978,7 +977,11 @@ static int set_expected_rtp_rtcp(struct + * through the same interface as the signalling peer. + */ + if (dst) { +- bool external_media = (dst->dev == dev); ++ const struct dst_entry *this_dst = skb_dst(skb); ++ bool external_media = false; ++ ++ if (this_dst && dst->dev == this_dst->dev) ++ external_media = true; + + dst_release(dst); + if (external_media) diff --git a/queue-7.1/netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch b/queue-7.1/netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch new file mode 100644 index 0000000000..34bd1df9a6 --- /dev/null +++ b/queue-7.1/netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch @@ -0,0 +1,79 @@ +From 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 1 Jul 2026 07:44:17 +0200 +Subject: netfilter: nf_nat_sip: reload possible stale data pointer + +From: Florian Westphal + +commit 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 upstream. + +quoting sashiko: + ------------------------------------------------------------------------ + [..] noticed a potential memory bug and header corruption involving the + SIP NAT helper. + + In net/netfilter/nf_nat_sip.c:nf_nat_sip(): + if (skb_ensure_writable(skb, skb->len)) { + nf_ct_helper_log(skb, ct, "cannot mangle packet"); + return NF_DROP; + } + uh = (void *)skb->data + protoff; + uh->dest = ct_sip_info->forced_dport; + if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff, + 0, 0, NULL, 0)) { + + If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the + old data buffer is freed. However, nf_nat_sip() fails to update *dptr to + point to the new buffer. + + It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP + packet, which would overwrite the sequence number with a checksum update. + ------------------------------------------------------------------------ + +nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen. +But clones are possible, so rebuild dptr. + +Disable nf_nat_mangle_udp_packet() branch for TCP streams. +It doesn't look like this can ever happen, else we should have received +bug reports about this, so just check the conntrack is UDP and drop +otherwise. + +The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages, +so I don't think this is ever expected to be true for a TCP stream. + +Fixes: 7266507d8999 ("netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-sonnet-4-6 +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_nat_sip.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/net/netfilter/nf_nat_sip.c ++++ b/net/netfilter/nf_nat_sip.c +@@ -289,13 +289,24 @@ next: + + /* Mangle destination port for Cisco phones, then fix up checksums */ + if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) { ++ int doff = *dptr - (const char *)skb->data; + struct udphdr *uh; + ++ if (doff <= 0) { ++ DEBUG_NET_WARN_ON_ONCE(1); ++ return NF_DROP; ++ } ++ ++ /* ct_sip_info->forced_dport only expected with UDP */ ++ if (nf_ct_protonum(ct) != IPPROTO_UDP) ++ return NF_DROP; ++ + if (skb_ensure_writable(skb, skb->len)) { + nf_ct_helper_log(skb, ct, "cannot mangle packet"); + return NF_DROP; + } + ++ *dptr = skb->data + doff; + uh = (void *)skb->data + protoff; + uh->dest = ct_sip_info->forced_dport; + diff --git a/queue-7.1/netfilter-nf_queue-pin-bridge-device-while-nfqueue-holds-fake-dst.patch b/queue-7.1/netfilter-nf_queue-pin-bridge-device-while-nfqueue-holds-fake-dst.patch new file mode 100644 index 0000000000..a4c9817e34 --- /dev/null +++ b/queue-7.1/netfilter-nf_queue-pin-bridge-device-while-nfqueue-holds-fake-dst.patch @@ -0,0 +1,116 @@ +From c9c9b37f8c5505224e8d206184df3bb668ee00cf Mon Sep 17 00:00:00 2001 +From: Haoze Xie +Date: Mon, 8 Jun 2026 13:43:44 +0800 +Subject: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst + +From: Haoze Xie + +commit c9c9b37f8c5505224e8d206184df3bb668ee00cf upstream. + +The br_netfilter fake rtable is embedded in struct net_bridge and is +attached to bridged packets with skb_dst_set_noref(). If such a packet is +queued to NFQUEUE, __nf_queue() upgrades that fake dst with +skb_dst_force(). + +At that point the queued skb can hold a real dst reference after bridge +teardown has started. The problem is not that every bridged packet needs +its own dst reference. The problem is that NFQUEUE can keep the bridge +private fake dst alive after unregister begins. + +Fix this by keeping the bridge fake dst model unchanged and pinning the +bridge master device only while the packet sits in NFQUEUE. Record the +bridge device in nf_queue_entry when the queued skb carries a bridge fake +dst, take a device reference for the queue lifetime, and drop it when the +queue entry is freed. + +Also make sure queued entries are reaped when that bridge device goes +down, and drop the redundant nf_bridge_info_exists() test from the fake +dst detection. + +This keeps netdev_priv(br->dev) alive until verdict completion, so the +embedded fake rtable and its metrics backing storage cannot be freed out +from under dst_release(). It also avoids the constant refcount bump and +avoids using ipv4-specific dst helpers for IPv6 bridge traffic. + +Fixes: 34666d467cbf ("netfilter: bridge: move br_netfilter out of the core") +Cc: stable@kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Signed-off-by: Haoze Xie +Signed-off-by: Ren Wei +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_queue.h | 1 + + net/netfilter/nf_queue.c | 14 ++++++++++++++ + net/netfilter/nfnetlink_queue.c | 3 +++ + 3 files changed, 18 insertions(+) + +--- a/include/net/netfilter/nf_queue.h ++++ b/include/net/netfilter/nf_queue.h +@@ -18,6 +18,7 @@ struct nf_queue_entry { + unsigned int id; + unsigned int hook_index; /* index in hook_entries->hook[] */ + #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) ++ struct net_device *bridge_dev; + struct net_device *physin; + struct net_device *physout; + #endif +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -68,6 +68,7 @@ static void nf_queue_entry_release_refs( + nf_queue_sock_put(state->sk); + + #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) ++ dev_put(entry->bridge_dev); + dev_put(entry->physin); + dev_put(entry->physout); + #endif +@@ -84,6 +85,8 @@ static void __nf_queue_entry_init_physde + { + #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) + const struct sk_buff *skb = entry->skb; ++ struct dst_entry *dst = skb_dst(skb); ++ struct net_device *dev = NULL; + + if (nf_bridge_info_exists(skb)) { + entry->physin = nf_bridge_get_physindev(skb, entry->state.net); +@@ -92,6 +95,16 @@ static void __nf_queue_entry_init_physde + entry->physin = NULL; + entry->physout = NULL; + } ++ ++ if (entry->state.pf == NFPROTO_BRIDGE && ++ dst && (dst->flags & DST_FAKE_RTABLE)) ++ dev = dst_dev_rcu(dst); ++ ++ /* Must hold a reference on the bridge device: dst_hold() protects ++ * the dst itself, but the fake rtable is embedded in bridge-private ++ * storage that netdevice teardown can free independently. ++ */ ++ entry->bridge_dev = dev; + #endif + } + +@@ -108,6 +121,7 @@ bool nf_queue_entry_get_refs(struct nf_q + dev_hold(state->out); + + #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) ++ dev_hold(entry->bridge_dev); + dev_hold(entry->physin); + dev_hold(entry->physout); + #endif +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -1270,6 +1270,9 @@ dev_cmp(struct nf_queue_entry *entry, un + + if (physinif == ifindex || physoutif == ifindex) + return 1; ++ ++ if (entry->bridge_dev && entry->bridge_dev->ifindex == ifindex) ++ return 1; + #endif + if (entry->skb_dev && entry->skb_dev->ifindex == ifindex) + return 1; diff --git a/queue-7.1/netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch b/queue-7.1/netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch new file mode 100644 index 0000000000..125b7bd61f --- /dev/null +++ b/queue-7.1/netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch @@ -0,0 +1,46 @@ +From d738feccb98cb224ebabecb703e98f5008276bff Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 11 Apr 2026 19:57:21 +0100 +Subject: netfilter: nfnl_cthelper: apply per-class values when updating policies + +From: David Carlier + +commit d738feccb98cb224ebabecb703e98f5008276bff upstream. + +When a userspace conntrack helper with multiple expectation classes is +updated via nfnetlink, every class ends up with the first class's +max_expected and timeout values. + +nfnl_cthelper_update_policy_all() validates each new policy into the +corresponding slot of the temporary new_policy array, but the second +loop that commits the values into the live helper dereferences +new_policy as a pointer instead of indexing it, so every iteration +reads new_policy[0] regardless of i. An update that changes per-class +values is silently collapsed onto class 0's values with no error +returned to userspace. + +Index the temporary array by i in the commit loop so each class gets +its own validated values. + +Fixes: 2c422257550f ("netfilter: nfnl_cthelper: fix runtime expectation policy updates") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nfnetlink_cthelper.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -354,8 +354,8 @@ static int nfnl_cthelper_update_policy_a + for (i = 0; i < helper->expect_class_max + 1; i++) { + policy = (struct nf_conntrack_expect_policy *) + &helper->expect_policy[i]; +- policy->max_expected = new_policy->max_expected; +- policy->timeout = new_policy->timeout; ++ policy->max_expected = new_policy[i].max_expected; ++ policy->timeout = new_policy[i].timeout; + } + + err: diff --git a/queue-7.1/netfilter-nft_fib-reject-fib-expression-on-the-netdev-egress-hook.patch b/queue-7.1/netfilter-nft_fib-reject-fib-expression-on-the-netdev-egress-hook.patch new file mode 100644 index 0000000000..c041c0dd1c --- /dev/null +++ b/queue-7.1/netfilter-nft_fib-reject-fib-expression-on-the-netdev-egress-hook.patch @@ -0,0 +1,96 @@ +From d07955dd34ecae17d35d8c7d0a273a3fba653a8c Mon Sep 17 00:00:00 2001 +From: Theodor Arsenij Larionov-Trichkine +Date: Mon, 29 Jun 2026 12:53:11 +0200 +Subject: netfilter: nft_fib: reject fib expression on the netdev egress hook + +From: Theodor Arsenij Larionov-Trichkine + +commit d07955dd34ecae17d35d8c7d0a273a3fba653a8c upstream. + +A fib expression in a netdev egress base chain dereferences nft_in(pkt), +NULL on the transmit path, causing a NULL pointer dereference at eval. +nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook +numbers are a separate enum that aliases them (NF_NETDEV_EGRESS == +NF_INET_LOCAL_IN), so an egress chain passes validation and then faults. + +Add nft_fib_netdev_validate() that limits each result/flag to the netdev +hook where the device it reads exists: the input-device cases (OIF, +OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE +with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict +nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are +not applied to another family's hooks. + +Fixes: 42df6e1d221d ("netfilter: Introduce egress hook") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/netfilter-devel/ajxsjcDOnwllMfoR@strlen.de/ +Signed-off-by: Theodor Arsenij Larionov-Trichkine +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_fib.c | 9 +++++++++ + net/netfilter/nft_fib_netdev.c | 29 ++++++++++++++++++++++++++++- + 2 files changed, 37 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nft_fib.c ++++ b/net/netfilter/nft_fib.c +@@ -31,6 +31,15 @@ int nft_fib_validate(const struct nft_ct + const struct nft_fib *priv = nft_expr_priv(expr); + unsigned int hooks; + ++ switch (ctx->family) { ++ case NFPROTO_IPV4: ++ case NFPROTO_IPV6: ++ case NFPROTO_INET: ++ break; ++ default: ++ return -EOPNOTSUPP; ++ } ++ + switch (priv->result) { + case NFT_FIB_RESULT_OIF: + case NFT_FIB_RESULT_OIFNAME: +--- a/net/netfilter/nft_fib_netdev.c ++++ b/net/netfilter/nft_fib_netdev.c +@@ -50,6 +50,33 @@ static void nft_fib_netdev_eval(const st + regs->verdict.code = NFT_BREAK; + } + ++static int nft_fib_netdev_validate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ const struct nft_fib *priv = nft_expr_priv(expr); ++ unsigned int hooks; ++ ++ switch (priv->result) { ++ case NFT_FIB_RESULT_OIF: ++ case NFT_FIB_RESULT_OIFNAME: ++ hooks = (1 << NF_NETDEV_INGRESS); ++ break; ++ case NFT_FIB_RESULT_ADDRTYPE: ++ if (priv->flags & NFTA_FIB_F_IIF) ++ hooks = (1 << NF_NETDEV_INGRESS); ++ else if (priv->flags & NFTA_FIB_F_OIF) ++ hooks = (1 << NF_NETDEV_EGRESS); ++ else ++ hooks = (1 << NF_NETDEV_INGRESS) | ++ (1 << NF_NETDEV_EGRESS); ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ return nft_chain_validate_hooks(ctx->chain, hooks); ++} ++ + static struct nft_expr_type nft_fib_netdev_type; + static const struct nft_expr_ops nft_fib_netdev_ops = { + .type = &nft_fib_netdev_type, +@@ -57,7 +84,7 @@ static const struct nft_expr_ops nft_fib + .eval = nft_fib_netdev_eval, + .init = nft_fib_init, + .dump = nft_fib_dump, +- .validate = nft_fib_validate, ++ .validate = nft_fib_netdev_validate, + }; + + static struct nft_expr_type nft_fib_netdev_type __read_mostly = { diff --git a/queue-7.1/netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch b/queue-7.1/netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch new file mode 100644 index 0000000000..14068ab487 --- /dev/null +++ b/queue-7.1/netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch @@ -0,0 +1,160 @@ +From 47e65eff50691f0a5b79d325e28d83ec1da43bcf Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 16 Jun 2026 13:26:26 +0200 +Subject: netfilter: nft_set_pipapo: don't leak bad clone into future transaction + +From: Florian Westphal + +commit 47e65eff50691f0a5b79d325e28d83ec1da43bcf upstream. + +On memory allocation failure the cloned nft_pipapo_match can enter a bad +state: + - some fields can have their lookup tables resized while others did + not + - bits might have been toggled + - scratch map can be undersized which also means m->bsize_max can be + lower than what is required + +This means that the next insertion in the same batch can trigger +out-of-bounds writes. + +Furthermore, a failure in the first can result in the bad clone to +leak into the next transaction because the abort callback is never +executed in this case (the upper layer saw an error and no attempt to +allocate a transactional request was made). + +Record a state for the nft_pipapo_match structure: +- NEW (pristine clone) +- MOD (modified clone with good state) +- ERR (potentially bogus content) + +Then make it so that deletes and insertions fail when the clone +entered ERR state. + +In case the very first insert attempt results in an error, free the +clone right away. + +Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") +Cc: stable@vger.kernel.org +Reported-and-tested-by: Seesee +Reviewed-by: Stefano Brivio +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_set_pipapo.c | 34 +++++++++++++++++++++++++++++----- + net/netfilter/nft_set_pipapo.h | 8 ++++++++ + 2 files changed, 37 insertions(+), 5 deletions(-) + +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -342,6 +342,8 @@ + #include "nft_set_pipapo_avx2.h" + #include "nft_set_pipapo.h" + ++static void nft_pipapo_abort(const struct nft_set *set); ++ + /** + * pipapo_refill() - For each set bit, set bits from selected mapping table item + * @map: Bitmap to be scanned for set bits +@@ -1296,7 +1298,7 @@ static int nft_pipapo_insert(const struc + const u8 *start_p, *end_p; + int i, bsize_max, err = 0; + +- if (!m) ++ if (!m || m->state == NFT_PIPAPO_CLONE_ERR) + return -ENOMEM; + + if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END)) +@@ -1367,8 +1369,10 @@ static int nft_pipapo_insert(const struc + else + ret = pipapo_expand(f, start, end, f->groups * f->bb); + +- if (ret < 0) +- return ret; ++ if (ret < 0) { ++ err = ret; ++ goto abort; ++ } + + if (f->bsize > bsize_max) + bsize_max = f->bsize; +@@ -1384,7 +1388,7 @@ static int nft_pipapo_insert(const struc + + err = pipapo_realloc_scratch(m, bsize_max); + if (err) +- return err; ++ goto abort; + + m->bsize_max = bsize_max; + } else { +@@ -1396,7 +1400,26 @@ static int nft_pipapo_insert(const struc + + pipapo_map(m, rulemap, e); + ++ m->state = NFT_PIPAPO_CLONE_MOD; + return 0; ++abort: ++ DEBUG_NET_WARN_ON_ONCE(m->state == NFT_PIPAPO_CLONE_ERR); ++ ++ /* Two rollback cases: ++ * 1) no previous changes. nft_pipapo_abort is not ++ * guaranteed to be invoked (there might be no further ++ * add/delete requests coming after this). ++ * ++ * 2) we had previous changes: there are transaction ++ * records pointing to this set. Leave the rollback to ++ * the transaction handling. ++ */ ++ if (m->state == NFT_PIPAPO_CLONE_NEW) ++ nft_pipapo_abort(set); /* releases m */ ++ else ++ m->state = NFT_PIPAPO_CLONE_ERR; ++ ++ return err; + } + + /** +@@ -1473,6 +1496,7 @@ static struct nft_pipapo_match *pipapo_c + dst++; + } + ++ new->state = NFT_PIPAPO_CLONE_NEW; + return new; + + out_mt: +@@ -1896,7 +1920,7 @@ nft_pipapo_deactivate(const struct net * + /* removal must occur on priv->clone, if we are low on memory + * we have no choice and must fail the removal request. + */ +- if (!m) ++ if (!m || m->state == NFT_PIPAPO_CLONE_ERR) + return NULL; + + e = pipapo_get(m, (const u8 *)elem->key.val.data, +--- a/net/netfilter/nft_set_pipapo.h ++++ b/net/netfilter/nft_set_pipapo.h +@@ -131,9 +131,16 @@ struct nft_pipapo_scratch { + unsigned long __map[]; + }; + ++enum nft_pipapo_clone_state { ++ NFT_PIPAPO_CLONE_NEW, ++ NFT_PIPAPO_CLONE_MOD, ++ NFT_PIPAPO_CLONE_ERR, ++}; ++ + /** + * struct nft_pipapo_match - Data used for lookup and matching + * @field_count: Amount of fields in set ++ * @state: add/delete state; used from control plane + * @bsize_max: Maximum lookup table bucket size of all fields, in longs + * @scratch: Preallocated per-CPU maps for partial matching results + * @rcu: Matching data is swapped on commits +@@ -141,6 +148,7 @@ struct nft_pipapo_scratch { + */ + struct nft_pipapo_match { + u8 field_count; ++ enum nft_pipapo_clone_state state:8; + unsigned int bsize_max; + struct nft_pipapo_scratch * __percpu *scratch; + struct rcu_head rcu; diff --git a/queue-7.1/netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch b/queue-7.1/netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch new file mode 100644 index 0000000000..20d0356afc --- /dev/null +++ b/queue-7.1/netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch @@ -0,0 +1,49 @@ +From 5feba91006ec92da57acc1cc2e34df623b98541e Mon Sep 17 00:00:00 2001 +From: Wyatt Feng +Date: Thu, 11 Jun 2026 15:21:42 +0800 +Subject: netfilter: xt_cluster: reject template conntracks in hash match + +From: Wyatt Feng + +commit 5feba91006ec92da57acc1cc2e34df623b98541e upstream. + +xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully +initialized conntrack and passes it to xt_cluster_hash(). + +This causes a state confusion bug when the raw table CT target attaches +a template conntrack to skb->_nfct before normal conntrack processing. +Templates carry IPS_TEMPLATE status but do not have a valid tuple for +hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the +zeroed l3num field. + +Reject template conntracks before hashing them. This matches existing +netfilter handling for template objects and avoids hashing incomplete +conntrack state. + +Fixes: 0269ea493734 ("netfilter: xtables: add cluster match") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Zhengchuan Liang +Reported-by: Xin Liu +Assisted-by: Codex:GPT-5.4 +Signed-off-by: Wyatt Feng +Signed-off-by: Ren Wei +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/xt_cluster.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/xt_cluster.c ++++ b/net/netfilter/xt_cluster.c +@@ -107,7 +107,7 @@ xt_cluster_mt(const struct sk_buff *skb, + } + + ct = nf_ct_get(skb, &ctinfo); +- if (ct == NULL) ++ if (!ct || nf_ct_is_template(ct)) + return false; + + if (ct->master) diff --git a/queue-7.1/netfilter-xt_nat-reject-unsupported-target-families.patch b/queue-7.1/netfilter-xt_nat-reject-unsupported-target-families.patch new file mode 100644 index 0000000000..e174d47e3f --- /dev/null +++ b/queue-7.1/netfilter-xt_nat-reject-unsupported-target-families.patch @@ -0,0 +1,58 @@ +From 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd Mon Sep 17 00:00:00 2001 +From: Wyatt Feng +Date: Sat, 13 Jun 2026 18:27:15 +0800 +Subject: netfilter: xt_nat: reject unsupported target families + +From: Wyatt Feng + +commit 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd upstream. + +xt_nat SNAT and DNAT target handlers assume IP-family conntrack state +is present and can dereference a NULL pointer when instantiated from an +unsupported family through nft_compat. A bridge-family compat rule can +therefore trigger a NULL-dereference in nf_nat_setup_info(). + +Reject non-IP families in xt_nat_checkentry() so unsupported targets +cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT +compat users and leave the runtime fast path unchanged. + +[ The crash was fixed via + 9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"), + so this patch is no longer critical. + Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra + family check is a good idea in any case. ] + +Fixes: c7232c9979cb ("netfilter: add protocol independent NAT core") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Zhengchuan Liang +Reported-by: Xin Liu +Assisted-by: Codex:GPT-5.4 +Signed-off-by: Wyatt Feng +Signed-off-by: Ren Wei +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/xt_nat.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/net/netfilter/xt_nat.c ++++ b/net/netfilter/xt_nat.c +@@ -26,6 +26,15 @@ static int xt_nat_checkentry_v0(const st + + static int xt_nat_checkentry(const struct xt_tgchk_param *par) + { ++ switch (par->family) { ++ case NFPROTO_IPV4: ++ case NFPROTO_IPV6: ++ case NFPROTO_INET: ++ break; ++ default: ++ return -EINVAL; ++ } ++ + return nf_ct_netns_get(par->net, par->family); + } + diff --git a/queue-7.1/netfilter-xt_physdev-masks-are-not-c-strings.patch b/queue-7.1/netfilter-xt_physdev-masks-are-not-c-strings.patch new file mode 100644 index 0000000000..208cd00950 --- /dev/null +++ b/queue-7.1/netfilter-xt_physdev-masks-are-not-c-strings.patch @@ -0,0 +1,36 @@ +From f468c48d488d0ea2df3422b3e1dfafae1611e853 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 10 Jul 2026 12:44:41 +0200 +Subject: netfilter: xt_physdev: masks are not c-strings + +From: Florian Westphal + +commit f468c48d488d0ea2df3422b3e1dfafae1611e853 upstream. + +... and must not be subjected to the 'nul terminated' constraint. +If the interface name is 15 characters long, the mask is 16-bytes +'0xff' (to cover for \0) and the valid device name is rejected. + +Fixes: 8df772afc9d0 ("netfilter: x_physdev: reject empty or not-nul terminated device names") +Cc: stable@vger.kernel.org +Closes: https://bugs.launchpad.net/neutron/+bug/2159935 +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/xt_physdev.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/net/netfilter/xt_physdev.c ++++ b/net/netfilter/xt_physdev.c +@@ -130,11 +130,6 @@ static int physdev_mt_check(const struct + if (X(physoutdev)) + return -ENAMETOOLONG; + } +- +- if (X(in_mask)) +- return -ENAMETOOLONG; +- if (X(out_mask)) +- return -ENAMETOOLONG; + #undef X + + if (!brnf_probed) { diff --git a/queue-7.1/perf-x86-amd-brs-fix-kernel-address-leakage.patch b/queue-7.1/perf-x86-amd-brs-fix-kernel-address-leakage.patch new file mode 100644 index 0000000000..de7eec2bf7 --- /dev/null +++ b/queue-7.1/perf-x86-amd-brs-fix-kernel-address-leakage.patch @@ -0,0 +1,85 @@ +From 47915e855fb38b42133e31ba917d99565f862154 Mon Sep 17 00:00:00 2001 +From: Sandipan Das +Date: Fri, 10 Jul 2026 22:04:49 +0530 +Subject: perf/x86/amd/brs: Fix kernel address leakage + +From: Sandipan Das + +commit 47915e855fb38b42133e31ba917d99565f862154 upstream. + +A user-only branch stack can contain branches that originate from +the kernel. As a result, kernel addresses are exposed to user space +even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors +supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries +such as SYSRET/interrupt returns for which the branch-from addresses +are in the kernel. + +E.g. + + $ perf record -j any,u -c 4000 -e branch-brs -o - -- \ + perf bench syscall basic --loop 1000 | \ + perf script -i - -F brstack|tr ' ' '\n'| \ + grep -E '0x[89a-f][0-9a-f]{15}' + + ... + 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//- + 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//- + 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//- + ... + +BRS provides no hardware branch filtering, so privilege level +filtering is performed entirely in software. However, amd_brs_match_plm() +only validates the branch-to address against the requested privilege +levels. For branches from the kernel to user space, the branch-from +address is left unchecked and is leaked. Extend the software filter to +also validate the branch-from address, so that any branch record whose +branch-from address is in the kernel is dropped when +PERF_SAMPLE_BRANCH_USER is requested. + +Fixes: 8910075d61a3 ("perf/x86/amd: Enable branch sampling priv level filtering") +Reported-by: Sashiko +Signed-off-by: Sandipan Das +Signed-off-by: Ingo Molnar +Cc: stable@vger.kernel.org +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com +Closes: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/ +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/amd/brs.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/x86/events/amd/brs.c ++++ b/arch/x86/events/amd/brs.c +@@ -259,13 +259,13 @@ void amd_brs_disable_all(void) + amd_brs_disable(); + } + +-static bool amd_brs_match_plm(struct perf_event *event, u64 to) ++static bool amd_brs_match_plm(struct perf_event *event, u64 from, u64 to) + { + int type = event->attr.branch_sample_type; + int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV; + int plm_u = PERF_SAMPLE_BRANCH_USER; + +- if (!(type & plm_k) && kernel_ip(to)) ++ if (!(type & plm_k) && (kernel_ip(to) || kernel_ip(from))) + return 0; + + if (!(type & plm_u) && !kernel_ip(to)) +@@ -338,11 +338,11 @@ void amd_brs_drain(void) + */ + to = (u64)(((s64)to << shift) >> shift); + +- if (!amd_brs_match_plm(event, to)) +- continue; +- + rdmsrq(brs_from(brs_idx), from); + ++ if (!amd_brs_match_plm(event, from, to)) ++ continue; ++ + perf_clear_branch_entry_bitfields(br+nr); + + br[nr].from = from; diff --git a/queue-7.1/perf-x86-amd-lbr-fix-kernel-address-leakage.patch b/queue-7.1/perf-x86-amd-lbr-fix-kernel-address-leakage.patch new file mode 100644 index 0000000000..24661fe636 --- /dev/null +++ b/queue-7.1/perf-x86-amd-lbr-fix-kernel-address-leakage.patch @@ -0,0 +1,63 @@ +From 2a892294b83f541115c94b0bb637f39bef187657 Mon Sep 17 00:00:00 2001 +From: Sandipan Das +Date: Fri, 10 Jul 2026 16:15:27 +0530 +Subject: perf/x86/amd/lbr: Fix kernel address leakage + +From: Sandipan Das + +commit 2a892294b83f541115c94b0bb637f39bef187657 upstream. + +A user-only branch stack can contain branches that originate from +the kernel. As a result, kernel addresses are exposed to user space +even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors +supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET +entries for which the branch-from addresses are in the kernel. + +E.g. + + $ perf record -e cycles -o - -j any,save_type,u -- \ + perf bench syscall basic --loop 1000 | \ + perf script -i - -F brstack|tr ' ' '\n'| \ + grep -E '0x[89a-f][0-9a-f]{15}' + + ... + 0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + 0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + 0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + 0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + 0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + 0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH + ... + +The reason is that the hardware filter only considers the privilege +level applicable to the branch target. Extend software filtering to +also validate the branch-from addresses against br_sel, so that any +branch record whose branch-from address is in the kernel is dropped +when PERF_SAMPLE_BRANCH_USER is requested. + +Fixes: f4f925dae741 ("perf/x86/amd/lbr: Add LbrExtV2 hardware branch filter support") +Reported-by: Ian Rogers +Signed-off-by: Sandipan Das +Signed-off-by: Ingo Molnar +Cc: stable@vger.kernel.org +Cc: Peter Zijlstra +Link: https://patch.msgid.link/a898a29725f6b2f30518354cdc2e432db66c43cf.1783680119.git.sandipan.das@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/amd/lbr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/events/amd/lbr.c ++++ b/arch/x86/events/amd/lbr.c +@@ -125,7 +125,8 @@ static void amd_pmu_lbr_filter(void) + } + + /* If type does not correspond, then discard */ +- if (type == X86_BR_NONE || (br_sel & type) != type) { ++ if (type == X86_BR_NONE || (br_sel & type) != type || ++ (!(br_sel & X86_BR_KERNEL) && kernel_ip(cpuc->lbr_entries[i].from))) { + cpuc->lbr_entries[i].from = 0; /* mark invalid */ + compress = true; + } diff --git a/queue-7.1/s390-perf_cpum_cf-add-missing-array_index_nospec-to-__hw_perf_event_init.patch b/queue-7.1/s390-perf_cpum_cf-add-missing-array_index_nospec-to-__hw_perf_event_init.patch new file mode 100644 index 0000000000..15422e6fd7 --- /dev/null +++ b/queue-7.1/s390-perf_cpum_cf-add-missing-array_index_nospec-to-__hw_perf_event_init.patch @@ -0,0 +1,53 @@ +From 49145bce539117db4b6e9e83c0e5ef528e361050 Mon Sep 17 00:00:00 2001 +From: Sumanth Korikkar +Date: Mon, 6 Jul 2026 12:46:31 +0200 +Subject: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() + +From: Sumanth Korikkar + +commit 49145bce539117db4b6e9e83c0e5ef528e361050 upstream. + +ev variable is userspace controlled via event->attr.config and used +as an array index after bounds checking, but without speculation +barriers. + +Add the missing array_index_nospec() call to prevent speculative +execution. + +Cc: stable@vger.kernel.org +Fixes: 212188a596d1 ("[S390] perf: add support for s390x CPU counters") +Signed-off-by: Sumanth Korikkar +Reviewed-by: Ilya Leoshkevich +Acked-by: Thomas Richter +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/perf_cpum_cf.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -768,6 +769,7 @@ static int __hw_perf_event_init(struct p + if (!is_userspace_event(ev)) { + if (ev >= ARRAY_SIZE(cpumf_generic_events_user)) + return -EOPNOTSUPP; ++ ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_user)); + ev = cpumf_generic_events_user[ev]; + } + } else if (!attr->exclude_kernel && attr->exclude_user) { +@@ -778,6 +780,7 @@ static int __hw_perf_event_init(struct p + if (!is_userspace_event(ev)) { + if (ev >= ARRAY_SIZE(cpumf_generic_events_basic)) + return -EOPNOTSUPP; ++ ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_basic)); + ev = cpumf_generic_events_basic[ev]; + } + } diff --git a/queue-7.1/selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch b/queue-7.1/selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch new file mode 100644 index 0000000000..091f246022 --- /dev/null +++ b/queue-7.1/selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch @@ -0,0 +1,108 @@ +From 56acfeb10019e200ab6787d01f8d7cbe0f01526f Mon Sep 17 00:00:00 2001 +From: Tristan Madani +Date: Thu, 25 Jun 2026 23:53:36 +0000 +Subject: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() + +From: Tristan Madani + +commit 56acfeb10019e200ab6787d01f8d7cbe0f01526f upstream. + +selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a +struct socket * to selinux_socket_bind() and +selinux_socket_connect_helper(). However, when the hook is invoked +from the ASCONF softirq path (sctp_process_asconf), there is no file +reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt +callers (bindx, connectx, set_primary, sendmsg connect) hold a file +reference and are not affected. + +Both selinux_socket_bind() and selinux_socket_connect_helper() +immediately resolve sock->sk, never using the struct socket * for +anything else. Refactor the inner logic into helpers that take a +struct sock * directly so that selinux_sctp_bind_connect() never needs +to touch sk->sk_socket at all. + +Cc: stable@vger.kernel.org +Fixes: d452930fd3b9 ("selinux: Add SCTP support") +Suggested-by: Stephen Smalley +Signed-off-by: Tristan Madani +Reviewed-by: Stephen Smalley +Tested-by: Stephen Smalley +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/hooks.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -4998,9 +4998,8 @@ static int selinux_socket_socketpair(str + Need to determine whether we should perform a name_bind + permission check between the socket and the port number. */ + +-static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) ++static int __selinux_socket_bind(struct sock *sk, struct sockaddr *address, int addrlen) + { +- struct sock *sk = sock->sk; + struct sk_security_struct *sksec = selinux_sock(sk); + u16 family; + int err; +@@ -5130,13 +5129,17 @@ err_af: + return -EAFNOSUPPORT; + } + ++static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) ++{ ++ return __selinux_socket_bind(sock->sk, address, addrlen); ++} ++ + /* This supports connect(2) and SCTP connect services such as sctp_connectx(3) + * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst + */ +-static int selinux_socket_connect_helper(struct socket *sock, ++static int selinux_socket_connect_helper(struct sock *sk, + struct sockaddr *address, int addrlen) + { +- struct sock *sk = sock->sk; + struct sk_security_struct *sksec = selinux_sock(sk); + int err; + +@@ -5225,7 +5228,7 @@ static int selinux_socket_connect(struct + int err; + struct sock *sk = sock->sk; + +- err = selinux_socket_connect_helper(sock, address, addrlen); ++ err = selinux_socket_connect_helper(sk, address, addrlen); + if (err) + return err; + +@@ -5727,13 +5730,11 @@ static int selinux_sctp_bind_connect(str + int len, err = 0, walk_size = 0; + void *addr_buf; + struct sockaddr *addr; +- struct socket *sock; + + if (!selinux_policycap_extsockclass()) + return 0; + + /* Process one or more addresses that may be IPv4 or IPv6 */ +- sock = sk->sk_socket; + addr_buf = address; + + while (walk_size < addrlen) { +@@ -5762,14 +5763,14 @@ static int selinux_sctp_bind_connect(str + case SCTP_PRIMARY_ADDR: + case SCTP_SET_PEER_PRIMARY_ADDR: + case SCTP_SOCKOPT_BINDX_ADD: +- err = selinux_socket_bind(sock, addr, len); ++ err = __selinux_socket_bind(sk, addr, len); + break; + /* Connect checks */ + case SCTP_SOCKOPT_CONNECTX: + case SCTP_PARAM_SET_PRIMARY: + case SCTP_PARAM_ADD_IP: + case SCTP_SENDMSG_CONNECT: +- err = selinux_socket_connect_helper(sock, addr, len); ++ err = selinux_socket_connect_helper(sk, addr, len); + if (err) + return err; + diff --git a/queue-7.1/selinux-check-connect-related-permissions-on-tcp-fast-open.patch b/queue-7.1/selinux-check-connect-related-permissions-on-tcp-fast-open.patch new file mode 100644 index 0000000000..e280c8b17c --- /dev/null +++ b/queue-7.1/selinux-check-connect-related-permissions-on-tcp-fast-open.patch @@ -0,0 +1,56 @@ +From 44c74d27d1b9aaa99fa8a83640c1223575262b80 Mon Sep 17 00:00:00 2001 +From: Stephen Smalley +Date: Thu, 18 Jun 2026 13:55:14 -0400 +Subject: selinux: check connect-related permissions on TCP Fast Open + +From: Stephen Smalley + +commit 44c74d27d1b9aaa99fa8a83640c1223575262b80 upstream. + +Similar to Landlock, SELinux was not updated when TCP Fast Open +support was introduced to ensure connect-related permissions are +checked when using TCP Fast Open. Update its socket_sendmsg() hook to +call selinux_socket_connect() when MSG_FASTOPEN is passed. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/ +Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/ +Reported-by: Bryam Vargas +Reported-by: Matthieu Buffet +Reported-by: Mikhail Ivanov +Signed-off-by: Stephen Smalley +Tested-by: Bryam Vargas +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/hooks.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5266,7 +5266,24 @@ static int selinux_socket_accept(struct + static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg, + int size) + { +- return sock_has_perm(sock->sk, SOCKET__WRITE); ++ int rc; ++ struct sockaddr *const addr = msg->msg_name; ++ const int addrlen = msg->msg_namelen; ++ ++ rc = sock_has_perm(sock->sk, SOCKET__WRITE); ++ if (rc) ++ return rc; ++ ++ if (addr && (msg->msg_flags & MSG_FASTOPEN) && ++ (sk_is_tcp(sock->sk) || ++ (sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM && ++ sock->sk->sk_protocol == IPPROTO_MPTCP))) { ++ rc = selinux_socket_connect(sock, addr, addrlen); ++ if (rc) ++ return rc; ++ } ++ ++ return 0; + } + + static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg, diff --git a/queue-7.1/selinux-fix-incorrect-execmem-checks-on-overlayfs.patch b/queue-7.1/selinux-fix-incorrect-execmem-checks-on-overlayfs.patch new file mode 100644 index 0000000000..3dc631f3b7 --- /dev/null +++ b/queue-7.1/selinux-fix-incorrect-execmem-checks-on-overlayfs.patch @@ -0,0 +1,157 @@ +From 9fe595fad54d4ac6a402edb3f60bec859d52cea6 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Tue, 14 Jul 2026 14:57:59 +0200 +Subject: selinux: fix incorrect execmem checks on overlayfs + +From: Ondrej Mosnacek + +commit 9fe595fad54d4ac6a402edb3f60bec859d52cea6 upstream. + +The commit fixing the overlayfs mmap() and mprotect() access checks +failed to skip the execmem check in __file_map_prot_check() for the case +where the "mounter check" is being performed. This check should be +performed only against the credentials of the task that is calling +mmap()/mprotect(), since it doesn't pertain to the file itself, but +rather just gates the ability of the calling task to get an executable +memory mapping in general. + +The purpose of the "mounter check" is to guard against using an +overlayfs mount to gain file access that would otherwise be denied to +the mounter. For execmem this is not relevant, as there is no further +file access granted based on it (notice that the file's context is not +used as the target in the check), so checking it also against the +mounter credentials would be incorrect. + +Fix this by passing a boolean to [__]file_map_prot_check() and +selinux_mmap_file_common() that indicates if we are doing the "mounter +check" and skiping the execmem check in that case. Since this boolean +also indicates if we use current_cred() or the mounter cred as the +subject, also remove the "cred" argument from these functions and +determine it based on the boolean and the file struct. + +Cc: stable@vger.kernel.org +Fixes: 82544d36b172 ("selinux: fix overlayfs mmap() and mprotect() access checks") +Signed-off-by: Ondrej Mosnacek +Reviewed-by: Stephen Smalley +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/hooks.c | 42 ++++++++++++++++++++++++------------------ + 1 file changed, 24 insertions(+), 18 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -3973,9 +3973,9 @@ static int selinux_file_ioctl_compat(str + + static int default_noexec __ro_after_init; + +-static int __file_map_prot_check(const struct cred *cred, +- const struct file *file, unsigned long prot, +- bool shared, bool bf_user_file) ++static int __file_map_prot_check(const struct file *file, unsigned long prot, ++ bool shared, bool mounter_check, ++ bool bf_user_file) + { + struct inode *inode = NULL; + bool prot_exec = prot & PROT_EXEC; +@@ -3988,10 +3988,10 @@ static int __file_map_prot_check(const s + inode = file_inode(file); + } + +- if (default_noexec && prot_exec && ++ if (!mounter_check && default_noexec && prot_exec && + (!file || IS_PRIVATE(inode) || (!shared && prot_write))) { + int rc; +- u32 sid = cred_sid(cred); ++ u32 sid = current_sid(); + + /* + * We are making executable an anonymous mapping or a private +@@ -4004,6 +4004,8 @@ static int __file_map_prot_check(const s + } + + if (file) { ++ const struct cred *cred = mounter_check ? ++ file->f_cred : current_cred(); + /* "read" always possible, "write" only if shared */ + u32 av = FILE__READ; + if (shared && prot_write) +@@ -4017,11 +4019,11 @@ static int __file_map_prot_check(const s + return 0; + } + +-static inline int file_map_prot_check(const struct cred *cred, +- const struct file *file, +- unsigned long prot, bool shared) ++static inline int file_map_prot_check(const struct file *file, ++ unsigned long prot, bool shared, ++ bool mounter_check) + { +- return __file_map_prot_check(cred, file, prot, shared, false); ++ return __file_map_prot_check(file, prot, shared, mounter_check, false); + } + + static int selinux_mmap_addr(unsigned long addr) +@@ -4037,12 +4039,14 @@ static int selinux_mmap_addr(unsigned lo + return rc; + } + +-static int selinux_mmap_file_common(const struct cred *cred, struct file *file, +- unsigned long prot, bool shared) ++static int selinux_mmap_file_common(struct file *file, unsigned long prot, ++ bool shared, bool mounter_check) + { + if (file) { + int rc; + struct common_audit_data ad; ++ const struct cred *cred = mounter_check ? ++ file->f_cred : current_cred(); + + ad.type = LSM_AUDIT_DATA_FILE; + ad.u.file = file; +@@ -4051,15 +4055,16 @@ static int selinux_mmap_file_common(cons + return rc; + } + +- return file_map_prot_check(cred, file, prot, shared); ++ return file_map_prot_check(file, prot, shared, mounter_check); + } + + static int selinux_mmap_file(struct file *file, + unsigned long reqprot __always_unused, + unsigned long prot, unsigned long flags) + { +- return selinux_mmap_file_common(current_cred(), file, prot, +- (flags & MAP_TYPE) == MAP_SHARED); ++ return selinux_mmap_file_common(file, prot, ++ (flags & MAP_TYPE) == MAP_SHARED, ++ false); + } + + /** +@@ -4091,8 +4096,9 @@ static int selinux_mmap_backing_file(str + if (vma->vm_flags & VM_EXEC) + prot |= PROT_EXEC; + +- return selinux_mmap_file_common(backing_file->f_cred, backing_file, +- prot, vma->vm_flags & VM_SHARED); ++ return selinux_mmap_file_common(backing_file, prot, ++ vma->vm_flags & VM_SHARED, ++ true); + } + + static int selinux_file_mprotect(struct vm_area_struct *vma, +@@ -4153,11 +4159,11 @@ static int selinux_file_mprotect(struct + } + } + +- rc = __file_map_prot_check(cred, file, prot, shared, backing_file); ++ rc = __file_map_prot_check(file, prot, shared, false, backing_file); + if (rc) + return rc; + if (backing_file) { +- rc = file_map_prot_check(file->f_cred, file, prot, shared); ++ rc = file_map_prot_check(file, prot, shared, true); + if (rc) + return rc; + } diff --git a/queue-7.1/series b/queue-7.1/series index 7faa95fbbb..dee56816a3 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1588,3 +1588,80 @@ kvm-arm64-nv-respect-read-only-pfn-when-mapping-l1-vncr.patch kvm-arm64-nv-inject-sea-if-kvm_translate_vncr-can-t-resolve-pfn.patch kvm-arm64-nv-re-translate-vncr-before-injecting-abort.patch kvm-arm64-nv-inject-sea-if-guest-vncr-isn-t-normal-memory.patch +fbdev-metronomefb-fix-potential-memory-leak-in-metronomefb_probe.patch +fbdev-broadsheetfb-fix-potential-memory-leak-in-broadsheetfb_probe.patch +fbdev-hecubafb-fix-potential-memory-leak-in-hecubafb_probe.patch +fbdev-sm712-fix-operator-precedence-in-big_swap-macro.patch +fbdev-efifb-fix-memory-leak-in-efifb_probe.patch +fbdev-radeon-fix-potential-memory-leak-in-radeonfb_pci_register.patch +fbdev-i740fb-fix-potential-memory-leak-in-i740fb_probe.patch +fbdev-s3fb-fix-potential-memory-leak-in-s3_pci_probe.patch +fbdev-uvesafb-fix-potential-memory-leak-in-uvesafb_probe.patch +fbdev-tdfxfb-fix-potential-memory-leak-in-tdfxfb_probe.patch +fbdev-carminefb-fix-potential-memory-leak-in-alloc_carmine_fb.patch +fbdev-vesafb-fix-memory-leak-in-vesafb_probe.patch +fbdev-nvidia-fix-potential-memory-leak-in-nvidiafb_probe.patch +fbdev-tridentfb-fix-potential-memory-leak-in-trident_pci_probe.patch +asoc-sof-topology-fix-memory-leak-in-snd_sof_load_topology.patch +asoc-sof-ipc3-control-fix-heap-overflow-in-bytes_ext-put-get.patch +asoc-sof-ipc3-control-validate-size-in-snd_sof_update_control.patch +asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch +asoc-mediatek-mt8192-release-reserved-memory-on-cleanup.patch +asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch +asoc-mediatek-mt8183-release-reserved-memory-on-cleanup.patch +asoc-qcom-q6apm-fix-null-pointer-dereference-in-graph_callback.patch +netfilter-nf_conntrack_irc-fix-parse_dcc-off-by-one-oob-read.patch +netfilter-nfnl_cthelper-apply-per-class-values-when-updating-policies.patch +netfilter-xt_cluster-reject-template-conntracks-in-hash-match.patch +netfilter-nf_queue-pin-bridge-device-while-nfqueue-holds-fake-dst.patch +netfilter-nft_fib-reject-fib-expression-on-the-netdev-egress-hook.patch +netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch +netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch +netfilter-nf_nat_sip-reload-possible-stale-data-pointer.patch +netfilter-nf_conntrack_reasm-guard-mac_header-adjustment-after-ipv6-defrag.patch +netfilter-flowtable-use-dst-in-this-direction-when-pushing-ipip-header.patch +netfilter-flowtable-support-ipip-tunnel-with-direct-xmit.patch +netfilter-nf_conncount-fix-zone-comparison-in-tuple-dedup.patch +netfilter-xt_physdev-masks-are-not-c-strings.patch +netfilter-ecache-fix-inverted-time_after-check.patch +netfilter-xt_nat-reject-unsupported-target-families.patch +netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch +netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch +gpu-nova-core-simplify-and_then-with-condition-to-filter.patch +gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch +gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch +soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch +soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch +selinux-check-connect-related-permissions-on-tcp-fast-open.patch +selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch +selinux-fix-incorrect-execmem-checks-on-overlayfs.patch +leds-uleds-fix-potential-buffer-overread.patch +mfd-sm501-fix-reference-leak-on-failed-device-registration.patch +tools-power-x86-intel-speed-select-harden-daemon-pidfile-open.patch +x86-video-only-fall-back-to-vga_default_device-without-screen-info.patch +x86-virt-sev-revert-drop-wbinvd-before-setting-msr_amd64_syscfg_snp_en.patch +x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch +x86-boot-reject-too-long-acpi_rsdp-values.patch +perf-x86-amd-brs-fix-kernel-address-leakage.patch +perf-x86-amd-lbr-fix-kernel-address-leakage.patch +cpufreq-schedutil-fix-uncleared-need_freq_update-on-the-.adjust_perf-path.patch +cpufreq-intel_pstate-set-non-turbo-capacity-to-hwp_guaranteed_perf.patch +s390-perf_cpum_cf-add-missing-array_index_nospec-to-__hw_perf_event_init.patch +batman-adv-gw-acquire-ethernet-header-only-after-skb-realloc.patch +batman-adv-retrieve-ethhdr-after-potential-skb-realloc-on-rx.patch +batman-adv-access-unicast_ttvn-skb-data-only-after-skb-realloc.patch +batman-adv-dat-acquire-arp-hw-source-only-after-skb-realloc.patch +batman-adv-bla-reacquire-gw-address-after-skb-realloc.patch +batman-adv-dat-ensure-accessible-eth_hdr-proto-field.patch +batman-adv-ensure-minimal-ethernet-header-on-tx.patch +batman-adv-dat-fix-tie-break-for-candidate-selection.patch +batman-adv-tt-avoid-request-storms-during-pending-request.patch +batman-adv-fix-vlan-priority-offset.patch +batman-adv-frag-free-unfragmentable-packet.patch +batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch +batman-adv-frag-fix-primary_if-leak-on-failed-linearization.patch +batman-adv-mcast-avoid-oob-read-of-num_dests-header.patch +batman-adv-tt-prevent-tvlv-oob-check-overflow.patch +cifs-invalidate-cfid-on-unlink-rename-rmdir.patch +mfd-tps6586x-fix-of-node-refcount.patch +backlight-ktd2801-enable-bl_core_suspendresume.patch diff --git a/queue-7.1/soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch b/queue-7.1/soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch new file mode 100644 index 0000000000..d39c2ffed0 --- /dev/null +++ b/queue-7.1/soc-fsl-qe-panic-on-ioremap-failure-in-qe_reset.patch @@ -0,0 +1,42 @@ +From a0fe29d20e7822182e12324905af5115c1b3aed3 Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Fri, 27 Mar 2026 08:12:25 +0800 +Subject: soc: fsl: qe: panic on ioremap() failure in qe_reset() + +From: Wang Jun <1742789905@qq.com> + +commit a0fe29d20e7822182e12324905af5115c1b3aed3 upstream. + +When ioremap() fails in qe_reset(), the global pointer qe_immr remains +NULL, leading to a subsequent NULL pointer dereference when the pointer +is accessed. Since this happens early in the boot process, a failure to +map a few bytes of I/O memory indicates a fatal error from which the +system cannot recover. + +Follow the same pattern as qe_sdma_init() and panic immediately when +ioremap() fails. This avoids a silent NULL pointer dereference later +and makes the error explicit. + +Fixes: 986585385131 ("[POWERPC] Add QUICC Engine (QE) infrastructure") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Link: https://lore.kernel.org/r/tencent_FED49CF5331CC0C7910618883332A08E2606@qq.com +[chleroy: Rearranged change to reduce churn] +Signed-off-by: Christophe Leroy (CS GROUP) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/fsl/qe/qe.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/soc/fsl/qe/qe.c ++++ b/drivers/soc/fsl/qe/qe.c +@@ -89,6 +89,9 @@ void qe_reset(void) + if (qe_immr == NULL) + qe_immr = ioremap(get_qe_base(), QE_IMMAP_SIZE); + ++ if (!qe_immr) ++ panic("QE:ioremap failed!"); ++ + qe_snums_init(); + + qe_issue_cmd(QE_RESET, QE_CR_SUBBLOCK_INVALID, diff --git a/queue-7.1/soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch b/queue-7.1/soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch new file mode 100644 index 0000000000..1493a93d2b --- /dev/null +++ b/queue-7.1/soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch @@ -0,0 +1,45 @@ +From b920352cfd2b0fcd1249ff006618c939b64fc8f7 Mon Sep 17 00:00:00 2001 +From: Siddharth Vadapalli +Date: Fri, 1 May 2026 18:10:54 +0530 +Subject: soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy + +From: Siddharth Vadapalli + +commit b920352cfd2b0fcd1249ff006618c939b64fc8f7 upstream. + +k3_ringacc_ring_pop_tail_io() and k3_ringacc_ring_pop_tail_proxy() +incorrectly use K3_RINGACC_ACCESS_MODE_POP_HEAD instead of +K3_RINGACC_ACCESS_MODE_POP_TAIL. This will result in ring elements being +popped in the reverse order of that which the caller expects. Fix this. + +Fixes: 3277e8aa2504 ("soc: ti: k3: add navss ringacc driver") +Cc: stable@vger.kernel.org +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Hari Prasath Gujulan Elango +Link: https://patch.msgid.link/20260501124129.362192-1-s-vadapalli@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/ti/k3-ringacc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/soc/ti/k3-ringacc.c ++++ b/drivers/soc/ti/k3-ringacc.c +@@ -1012,7 +1012,7 @@ static int k3_ringacc_ring_pop_head_prox + static int k3_ringacc_ring_pop_tail_proxy(struct k3_ring *ring, void *elem) + { + return k3_ringacc_ring_access_proxy(ring, elem, +- K3_RINGACC_ACCESS_MODE_POP_HEAD); ++ K3_RINGACC_ACCESS_MODE_POP_TAIL); + } + + static int k3_ringacc_ring_access_io(struct k3_ring *ring, void *elem, +@@ -1083,7 +1083,7 @@ static int k3_ringacc_ring_pop_io(struct + static int k3_ringacc_ring_pop_tail_io(struct k3_ring *ring, void *elem) + { + return k3_ringacc_ring_access_io(ring, elem, +- K3_RINGACC_ACCESS_MODE_POP_HEAD); ++ K3_RINGACC_ACCESS_MODE_POP_TAIL); + } + + /* diff --git a/queue-7.1/tools-power-x86-intel-speed-select-harden-daemon-pidfile-open.patch b/queue-7.1/tools-power-x86-intel-speed-select-harden-daemon-pidfile-open.patch new file mode 100644 index 0000000000..14757a7ae5 --- /dev/null +++ b/queue-7.1/tools-power-x86-intel-speed-select-harden-daemon-pidfile-open.patch @@ -0,0 +1,54 @@ +From 607af438e6430893a822964c841a1994b33acccc Mon Sep 17 00:00:00 2001 +From: Ali Ahmet MEMIS +Date: Sun, 26 Apr 2026 08:09:28 -0700 +Subject: tools/power/x86/intel-speed-select: Harden daemon pidfile open + +From: Ali Ahmet MEMIS + +commit 607af438e6430893a822964c841a1994b33acccc upstream. + +Avoid symlink-based pidfile clobbering by opening the pidfile with +O_NOFOLLOW and validating it with fstat() before locking/writing. + +The daemon currently uses a fixed pidfile path under /tmp. A local +unprivileged user can pre-create a symlink at that path and cause a +root-run daemon instance to write into an attacker-chosen file. + +Fixes: 7fd786dfbd2c ("tools/power/x86/intel-speed-select: OOB daemon mode") +Signed-off-by: Ali Ahmet MEMIS +Signed-off-by: Srinivas Pandruvada +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + tools/power/x86/intel-speed-select/isst-daemon.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/tools/power/x86/intel-speed-select/isst-daemon.c ++++ b/tools/power/x86/intel-speed-select/isst-daemon.c +@@ -148,6 +148,7 @@ static void daemonize(char *rundir, char + { + int pid, sid, i; + char str[10]; ++ struct stat st; + struct sigaction sig_actions; + sigset_t sig_set; + int ret; +@@ -200,11 +201,17 @@ static void daemonize(char *rundir, char + if (ret == -1) + exit(EXIT_FAILURE); + +- pid_file_handle = open(pidfile, O_RDWR | O_CREAT, 0600); ++ pid_file_handle = open(pidfile, O_RDWR | O_CREAT | O_NOFOLLOW, 0600); + if (pid_file_handle == -1) { + /* Couldn't open lock file */ + exit(1); + } ++ ++ if (fstat(pid_file_handle, &st) == -1) ++ exit(1); ++ ++ if (!S_ISREG(st.st_mode)) ++ exit(1); + /* Try to lock file */ + #ifdef LOCKF_SUPPORT + if (lockf(pid_file_handle, F_TLOCK, 0) == -1) { diff --git a/queue-7.1/x86-boot-reject-too-long-acpi_rsdp-values.patch b/queue-7.1/x86-boot-reject-too-long-acpi_rsdp-values.patch new file mode 100644 index 0000000000..ef1119eb91 --- /dev/null +++ b/queue-7.1/x86-boot-reject-too-long-acpi_rsdp-values.patch @@ -0,0 +1,51 @@ +From d130041a7b96f79cd4c7079a6c2431a6db4c9619 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sun, 21 Jun 2026 19:00:10 +0200 +Subject: x86/boot: Reject too long acpi_rsdp= values + +From: Thorsten Blum + +commit d130041a7b96f79cd4c7079a6c2431a6db4c9619 upstream. + +cmdline_find_option() returns the full length of the parsed acpi_rsdp= +value. get_cmdline_acpi_rsdp() then silently truncates values which do +not fit in the val[] buffer. + +Prevent boot_kstrtoul() from parsing a truncated value and then the +kernel from silently using the wrong RSDP address, see discussion in +Link:. + +Issue a warning so that the user is aware that s/he supplied a malformed +value and can get feedback instead of silent crashes. + + [ bp: Make commit message more precise. ] + +Fixes: 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing") +Signed-off-by: Thorsten Blum +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20260617130417.36651-4-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/boot/compressed/acpi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/x86/boot/compressed/acpi.c ++++ b/arch/x86/boot/compressed/acpi.c +@@ -184,10 +184,15 @@ static unsigned long get_cmdline_acpi_rs + char val[MAX_ADDR_LEN] = { }; + int ret; + +- ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN); ++ ret = cmdline_find_option("acpi_rsdp", val, sizeof(val)); + if (ret < 0) + return 0; + ++ if (ret >= sizeof(val)) { ++ warn("acpi_rsdp= value too long; ignoring"); ++ return 0; ++ } ++ + if (boot_kstrtoul(val, 16, &addr)) + return 0; + #endif diff --git a/queue-7.1/x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch b/queue-7.1/x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch new file mode 100644 index 0000000000..c8d330abe6 --- /dev/null +++ b/queue-7.1/x86-boot-validate-console-uart8250-baud-rate-to-fix-early-boot-hang.patch @@ -0,0 +1,55 @@ +From ffa0aa5b625fe0bed7463ac613f8b06676ff4542 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Mon, 13 Jul 2026 21:49:25 +0200 +Subject: x86/boot: Validate console=uart8250 baud rate to fix early boot hang + +From: Thorsten Blum + +commit ffa0aa5b625fe0bed7463ac613f8b06676ff4542 upstream. + +When the baud rate is empty, 0, invalid, or overflows to 0 when stored +as an int, the system will hang during early boot because of a division +by zero in early_serial_init(). + +Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent +an early system hang. + +Fixes: ce0aa5dd20e4 ("x86, setup: Make the setup code also accept console=uart8250") +Signed-off-by: Thorsten Blum +Signed-off-by: Ingo Molnar +Cc: "H. Peter Anvin" +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260713194924.126472-3-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/boot/early_serial_console.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/arch/x86/boot/early_serial_console.c ++++ b/arch/x86/boot/early_serial_console.c +@@ -117,7 +117,7 @@ static unsigned int probe_baud(int port) + static void parse_console_uart8250(void) + { + char optstr[64], *options; +- int baud = DEFAULT_BAUD; ++ int baud; + int port = 0; + + /* +@@ -136,10 +136,13 @@ static void parse_console_uart8250(void) + else + return; + +- if (options && (options[0] == ',')) +- baud = simple_strtoull(options + 1, &options, 0); +- else ++ if (options && (options[0] == ',')) { ++ baud = simple_strtoull(options + 1, NULL, 0); ++ if (!baud) ++ baud = DEFAULT_BAUD; ++ } else { + baud = probe_baud(port); ++ } + + if (port) + early_serial_init(port, baud); diff --git a/queue-7.1/x86-video-only-fall-back-to-vga_default_device-without-screen-info.patch b/queue-7.1/x86-video-only-fall-back-to-vga_default_device-without-screen-info.patch new file mode 100644 index 0000000000..7d7e4d1792 --- /dev/null +++ b/queue-7.1/x86-video-only-fall-back-to-vga_default_device-without-screen-info.patch @@ -0,0 +1,73 @@ +From 596b3678326d3d1aed7c19423b6746f1ce09688a Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Tue, 23 Jun 2026 07:15:05 -0700 +Subject: x86/video: Only fall back to vga_default_device() without screen info + +From: Mario Limonciello + +commit 596b3678326d3d1aed7c19423b6746f1ce09688a upstream. + +Some multi GPU systems may have a VGA compatible device, but that might not be +used for display. If due to enumeration order this device is found before the +one actually used for display then multiple devices may show the boot_display +attribute, confusing userspace. + +When screen info is valid, use it exclusively to find the primary device so +that only the device backing the framebuffer is reported. Only when no +framebuffer has been set up does it make sense to fall back to the default VGA +device. This ensures at most one primary graphics device, preferably the one +with the framebuffer. + +Fixes: ad90860bd10ee ("fbcon: Use screen info to find primary device") +Closes: https://lore.kernel.org/linux-pci/20260618081803.2790848-1-aaron.ma@canonical.com/#t +Reported-by: Aaron Ma +Suggested-by: Thomas Zimmermann +Signed-off-by: Mario Limonciello +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Thomas Zimmermann +Tested-by: Aaron Ma +Cc: +Link: https://patch.msgid.link/20260623141505.1816786-1-mario.limonciello@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/video/video-common.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +--- a/arch/x86/video/video-common.c ++++ b/arch/x86/video/video-common.c +@@ -43,21 +43,26 @@ bool video_is_primary_device(struct devi + if (!pci_is_display(pdev)) + return false; + +- if (pdev == vga_default_device()) +- return true; +- + #ifdef CONFIG_SCREEN_INFO + numres = screen_info_resources(si, res, ARRAY_SIZE(res)); +- for (i = 0; i < numres; ++i) { +- if (!(res[i].flags & IORESOURCE_MEM)) +- continue; ++ if (numres > 0) { ++ for (i = 0; i < numres; ++i) { ++ if (!(res[i].flags & IORESOURCE_MEM)) ++ continue; ++ ++ if (pci_find_resource(pdev, &res[i])) ++ return true; ++ } + +- if (pci_find_resource(pdev, &res[i])) +- return true; ++ return false; + } + #endif + +- return false; ++ /* ++ * No framebuffer was set up by the firmware/bootloader, so fall back ++ * to the default VGA device. ++ */ ++ return pdev == vga_default_device(); + } + EXPORT_SYMBOL(video_is_primary_device); + diff --git a/queue-7.1/x86-virt-sev-revert-drop-wbinvd-before-setting-msr_amd64_syscfg_snp_en.patch b/queue-7.1/x86-virt-sev-revert-drop-wbinvd-before-setting-msr_amd64_syscfg_snp_en.patch new file mode 100644 index 0000000000..19ab8de746 --- /dev/null +++ b/queue-7.1/x86-virt-sev-revert-drop-wbinvd-before-setting-msr_amd64_syscfg_snp_en.patch @@ -0,0 +1,53 @@ +From 4c2509f3b79756679a02bea649c6a7501b58f52c Mon Sep 17 00:00:00 2001 +From: "Tycho Andersen (AMD)" +Date: Tue, 7 Jul 2026 09:00:33 -0600 +Subject: x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN" + +From: Tycho Andersen (AMD) + +commit 4c2509f3b79756679a02bea649c6a7501b58f52c upstream. + +Revert + + 99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"). + +Section 8.8 of the SNP spec says: + + Before invoking SNP_INIT_EX with INIT_RMP set to 1, software must ensure + that no CPUs contain dirty cache lines for the memory containing the RMP. + +Cachelines can be moved from cache to cache in a dirty state. The +wbinvd_on_all_cpus() before SNP_INIT_EX flushes the caches for each CPU, but +if the IPIs for WBINVD race with this dirty cacheline movement, it is possible +that they may not get flushed, violating the firmware requirement. + +Doing wbinvd_on_all_cpus() before setting SNPEn is safer since the RMP +table is not yet in use. + + [ Heroically bisected by Srikanth. ] + [ bp: Massage commit message. ] + +Fixes: 99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN") +Reported-by: Srikanth Aithal +Signed-off-by: Tycho Andersen (AMD) +Signed-off-by: Borislav Petkov (AMD) +Tested-by: Srikanth Aithal +Reviewed-by: Tom Lendacky +Cc: +Link: https://patch.msgid.link/20260707150033.2364758-1-tycho@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/virt/svm/sev.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/virt/svm/sev.c ++++ b/arch/x86/virt/svm/sev.c +@@ -527,6 +527,8 @@ void snp_prepare(void) + + cpus_read_lock(); + ++ wbinvd_on_all_cpus(); ++ + /* + * MtrrFixDramModEn is not shared between threads on a core, + * therefore it must be set on all CPUs prior to enabling SNP.