From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 09:09:05 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f4b66b0325fe8490ee7a741d036f1b65ebc5ee8d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch hwmon-asus_atk0110-check-package-count-before-accessing-element.patch hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch tracing-probes-fix-double-addition-of-offset-for-foffset.patch --- diff --git a/queue-5.10/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch b/queue-5.10/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch new file mode 100644 index 0000000000..89cebcdc61 --- /dev/null +++ b/queue-5.10/ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch @@ -0,0 +1,38 @@ +From fcaf242e7fc406e78f444a35441e3b58f5e28781 Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Thu, 25 Jun 2026 22:18:37 +0800 +Subject: ata: pata_pxa: Fix DMA channel leak on probe error + +From: Wentao Liang + +commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream. + +When dmaengine_slave_config() fails, the DMA channel acquired by +dma_request_chan() is not released before returning the error, +leaking the channel reference. + +Fix by adding dma_release_channel() in the error path. + +The ata_host_activate() error path already correctly releases the +DMA channel. + +Cc: stable@vger.kernel.org +Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion") +Signed-off-by: Wentao Liang +Reviewed-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_pxa.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/pata_pxa.c ++++ b/drivers/ata/pata_pxa.c +@@ -287,6 +287,7 @@ static int pxa_ata_probe(struct platform + ret = dmaengine_slave_config(data->dma_chan, &config); + if (ret < 0) { + dev_err(&pdev->dev, "dma configuration failed: %d\n", ret); ++ dma_release_channel(data->dma_chan); + return ret; + } + diff --git a/queue-5.10/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch b/queue-5.10/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch new file mode 100644 index 0000000000..df18fa3dc4 --- /dev/null +++ b/queue-5.10/fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch @@ -0,0 +1,41 @@ +From d288efa2b94abc2e45a061fceb156b4f4e5b37be Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Thu, 25 Jun 2026 08:48:34 +0800 +Subject: fsl/fman: Free init resources on KeyGen failure in fman_init() + +From: Haoxiang Li + +commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream. + +fman_muram_alloc() allocates initialization resources before +initializing the KeyGen block. If keygen_init() fails, the +function returns -EINVAL directly and leaves those resources +allocated. Free the initialization resources before returning +from the KeyGen failure path. + +Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen") +Cc: stable@kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Pavan Chebbi +Reviewed-by: Breno Leitao +Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fman/fman.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -2022,8 +2022,10 @@ static int fman_init(struct fman *fman) + + /* Init KeyGen */ + fman->keygen = keygen_init(fman->kg_regs); +- if (!fman->keygen) ++ if (!fman->keygen) { ++ free_init_resources(fman); + return -EINVAL; ++ } + + err = enable(fman, cfg); + if (err != 0) diff --git a/queue-5.10/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch b/queue-5.10/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch new file mode 100644 index 0000000000..a3f94f9ccb --- /dev/null +++ b/queue-5.10/hwmon-asus_atk0110-check-package-count-before-accessing-element.patch @@ -0,0 +1,47 @@ +From e2735b39f044bad7bf2017aef248935525bc0b97 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Fri, 19 Jun 2026 21:27:46 +0900 +Subject: hwmon: (asus_atk0110) Check package count before accessing element + +From: HyeongJun An + +commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream. + +atk_ec_present() walks the management group package returned by the GGRP +ACPI method and, for each sub-package, reads its first element: + + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + +without checking that the sub-package is non-empty. ACPICA allocates the +element array with exactly package.count entries, so for a sub-package +with a zero count this reads past the allocation. + +The sibling function atk_debugfs_ggrp_open() performs the same access but +skips empty packages with a package.count check first. Add the same +check to atk_ec_present() so a malformed firmware package cannot trigger +an out-of-bounds read. + +Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/asus_atk0110.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat + if (obj->type != ACPI_TYPE_PACKAGE) + continue; + ++ if (!obj->package.count) ++ continue; ++ + id = &obj->package.elements[0]; + if (id->type != ACPI_TYPE_INTEGER) + continue; diff --git a/queue-5.10/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch b/queue-5.10/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch new file mode 100644 index 0000000000..6cd6c15d4f --- /dev/null +++ b/queue-5.10/hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch @@ -0,0 +1,49 @@ +From 5264b389c4e02dec214a46c400eb3ab867a7749a Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:47:31 +0800 +Subject: hwmon: (w83627hf) remove VID sysfs files on error and remove + +From: Pengpeng Hou + +commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream. + +w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when +VID information is available. + +The error path and remove callback only remove the common and optional +attribute groups. Those groups do not contain cpu0_vid or vrm, so the +files can remain after a later probe failure or after device removal +while their callbacks still expect live driver data. + +Remove the standalone VID sysfs files from both the probe error path and +the remove callback. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83627hf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwmon/w83627hf.c ++++ b/drivers/hwmon/w83627hf.c +@@ -1551,6 +1551,8 @@ static int w83627hf_probe(struct platfor + return 0; + + error: ++ device_remove_file(dev, &dev_attr_vrm); ++ device_remove_file(dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&dev->kobj, &w83627hf_group); + sysfs_remove_group(&dev->kobj, &w83627hf_group_opt); + return err; +@@ -1562,6 +1564,8 @@ static int w83627hf_remove(struct platfo + + hwmon_device_unregister(data->hwmon_dev); + ++ device_remove_file(&pdev->dev, &dev_attr_vrm); ++ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group); + sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt); + diff --git a/queue-5.10/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch b/queue-5.10/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch new file mode 100644 index 0000000000..a08cd5efd0 --- /dev/null +++ b/queue-5.10/hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch @@ -0,0 +1,39 @@ +From 77b983757280c69b0290811669ff1d31022e5f1d Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Mon, 15 Jun 2026 14:48:06 +0800 +Subject: hwmon: (w83793) remove vrm sysfs file on probe failure + +From: Pengpeng Hou + +commit 77b983757280c69b0290811669ff1d31022e5f1d upstream. + +w83793_probe() creates the vrm sysfs file after creating the VID files +when VID support is present. + +The normal remove path deletes vrm, but the probe error path only +removes the sensor, SDA, VID, fan, PWM and temperature files. A later +probe failure can therefore leave vrm behind after the driver data has +been freed. + +Remove vrm in the probe error path next to the VID files, matching the +normal remove path. + +Signed-off-by: Pengpeng Hou +Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83793.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/w83793.c ++++ b/drivers/hwmon/w83793.c +@@ -1920,6 +1920,7 @@ exit_remove: + + for (i = 0; i < ARRAY_SIZE(w83793_vid); i++) + device_remove_file(dev, &w83793_vid[i].dev_attr); ++ device_remove_file(dev, &dev_attr_vrm); + + for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++) + device_remove_file(dev, &w83793_left_fan[i].dev_attr); diff --git a/queue-5.10/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch b/queue-5.10/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch new file mode 100644 index 0000000000..1c152dec8c --- /dev/null +++ b/queue-5.10/net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch @@ -0,0 +1,64 @@ +From c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Jun 2026 14:40:13 +0800 +Subject: net: liquidio: fix BAR resource leak on PF number failure + +From: Haoxiang Li + +commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream. + +If cn23xx_get_pf_num() fails, the function returns without +unmapping either BAR. Unmap both BARs before returning from +the error path. + +Found by manual code review. + +Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Larysa Zaremba +Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -1334,18 +1334,14 @@ int setup_cn23xx_octeon_pf_device(struct + if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) { + dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n", + __func__); +- octeon_unmap_pci_barx(oct, 0); +- return 1; ++ goto err_unmap_bar0; + } + + if (cn23xx_get_pf_num(oct) != 0) +- return 1; ++ goto err_unmap_bar1; + +- if (cn23xx_sriov_config(oct)) { +- octeon_unmap_pci_barx(oct, 0); +- octeon_unmap_pci_barx(oct, 1); +- return 1; +- } ++ if (cn23xx_sriov_config(oct)) ++ goto err_unmap_bar1; + + octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL); + +@@ -1376,6 +1372,12 @@ int setup_cn23xx_octeon_pf_device(struct + oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct); + + return 0; ++ ++err_unmap_bar1: ++ octeon_unmap_pci_barx(oct, 1); ++err_unmap_bar0: ++ octeon_unmap_pci_barx(oct, 0); ++ return 1; + } + + int validate_cn23xx_pf_config_info(struct octeon_device *oct, diff --git a/queue-5.10/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch b/queue-5.10/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch new file mode 100644 index 0000000000..e9d73d114b --- /dev/null +++ b/queue-5.10/net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch @@ -0,0 +1,44 @@ +From 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Thu, 25 Jun 2026 04:51:20 -0500 +Subject: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked + +From: Bryam Vargas + +commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream. + +multiq_dequeue() takes a packet from a band's child with a direct +->dequeue() call after multiq_peek() peeked it. When the child is +non-work-conserving the peek stashes the skb in the child's gso_skb, so +the direct dequeue returns a different skb and orphans the stash, +desyncing the child's qlen/backlog. With a qfq child reached through a +peeking parent (e.g. tbf) this re-enters the child on an emptied list and +dereferences NULL, panicking the kernel from softirq on ordinary egress. + +Take the packet through qdisc_dequeue_peeked(), as sch_prio already does +and as sch_red and sch_sfb were just fixed to do. The helper is a no-op +when the child has no stash, so a work-conserving child is unaffected. + +Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Reviewed-by: Victor Nogueira +Acked-by: Jamal Hadi Salim +Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_multiq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st + if (!netif_xmit_stopped( + netdev_get_tx_queue(qdisc_dev(sch), q->curband))) { + qdisc = q->queues[q->curband]; +- skb = qdisc->dequeue(qdisc); ++ skb = qdisc_dequeue_peeked(qdisc); + if (skb) { + qdisc_bstats_update(sch, skb); + sch->q.qlen--; diff --git a/queue-5.10/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch b/queue-5.10/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch new file mode 100644 index 0000000000..670d96fcf3 --- /dev/null +++ b/queue-5.10/orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch @@ -0,0 +1,51 @@ +From 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Fri, 19 Jun 2026 04:38:20 -0500 +Subject: orangefs: keep the readdir entry size 64-bit in fill_from_part() + +From: Bryam Vargas + +commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream. + +fill_from_part() computes the size of a directory entry in size_t but +stores it in a __u32. An entry length near U32_MAX wraps it to a small +value, bypasses the bounds check, and is then used to index the entry, +reading far past the directory part -- an out-of-bounds read that oopses +the kernel. + +Compute the size as a u64 so it cannot truncate; the bounds check then +rejects the entry. The trailer is supplied by the userspace client. + +Fixes: 480e3e532e31 ("orangefs: support very large directories") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/orangefs/dir.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/orangefs/dir.c ++++ b/fs/orangefs/dir.c +@@ -191,7 +191,8 @@ static int fill_from_part(struct orangef + { + const int offset = sizeof(struct orangefs_readdir_response_s); + struct orangefs_khandle *khandle; +- __u32 *len, padlen; ++ __u32 *len; ++ u64 padlen; + loff_t i; + char *s; + i = ctx->pos & ~PART_MASK; +@@ -215,8 +216,8 @@ static int fill_from_part(struct orangef + * len is the size of the string itself. padlen is the + * total size of the encoded string. + */ +- padlen = (sizeof *len + *len + 1) + +- (8 - (sizeof *len + *len + 1)%8)%8; ++ padlen = (u64)sizeof *len + *len + 1; ++ padlen += (8 - padlen % 8) % 8; + if (part->len < i + padlen + sizeof *khandle) + goto next; + s = (void *)part + offset + i + sizeof *len; diff --git a/queue-5.10/series b/queue-5.10/series index ab76d4ae10..9296ef7a25 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -540,3 +540,12 @@ batman-adv-ensure-minimal-ethernet-header-on-tx.patch rtmutex-use-waiter-task-instead-of-current-in-remove_waiter.patch locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch bnx2x-fix-potential-memory-leak-in-bnx2x_alloc_mem_bp.patch +hwmon-w83627hf-remove-vid-sysfs-files-on-error-and-remove.patch +hwmon-w83793-remove-vrm-sysfs-file-on-probe-failure.patch +net-liquidio-fix-bar-resource-leak-on-pf-number-failure.patch +fsl-fman-free-init-resources-on-keygen-failure-in-fman_init.patch +net-sched-sch_multiq-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch +tracing-probes-fix-double-addition-of-offset-for-foffset.patch +orangefs-keep-the-readdir-entry-size-64-bit-in-fill_from_part.patch +ata-pata_pxa-fix-dma-channel-leak-on-probe-error.patch +hwmon-asus_atk0110-check-package-count-before-accessing-element.patch diff --git a/queue-5.10/tracing-probes-fix-double-addition-of-offset-for-foffset.patch b/queue-5.10/tracing-probes-fix-double-addition-of-offset-for-foffset.patch new file mode 100644 index 0000000000..53c3f1164f --- /dev/null +++ b/queue-5.10/tracing-probes-fix-double-addition-of-offset-for-foffset.patch @@ -0,0 +1,34 @@ +From 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 25 Jun 2026 08:34:47 +0900 +Subject: tracing/probes: Fix double addition of offset for @+FOFFSET + +From: Masami Hiramatsu (Google) + +commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream. + +Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument + fetching code") wrongly use @offset local variable during the parsing, +the offset value is added twice when dereferencing. +Reset the @offset after setting it in FETCH_OP_FOFFS. + +Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/ + +Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code") +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_probe.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -401,6 +401,7 @@ parse_probe_arg(char *arg, const struct + + code->op = FETCH_OP_FOFFS; + code->immediate = (unsigned long)offset; // imm64? ++ offset = 0; + } else { + /* uprobes don't support symbols */ + if (!(flags & TPARG_FL_KERNEL)) {