From: Greg Kroah-Hartman Date: Fri, 21 Nov 2025 10:43:39 +0000 (+0100) Subject: 6.17-stable patches X-Git-Tag: v6.6.117~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=316c17e933a0ea58c324f904b65639796c4a26ce;p=thirdparty%2Fkernel%2Fstable-queue.git 6.17-stable patches added patches: isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch net-phy-micrel-fix-lan8814_config_init.patch --- diff --git a/queue-6.17/isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch b/queue-6.17/isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch new file mode 100644 index 0000000000..381a3a17cb --- /dev/null +++ b/queue-6.17/isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch @@ -0,0 +1,75 @@ +From 3f978e3f1570155a1327ffa25f60968bc7b9398f Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 30 Oct 2025 09:55:22 +0530 +Subject: isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() + +From: Abdun Nihaal + +commit 3f978e3f1570155a1327ffa25f60968bc7b9398f upstream. + +In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when +setup_instance() fails with an error code. Fix that by freeing the urb +before freeing the hw structure. Also change the error paths to use the +goto ladder style. + +Compile tested only. Issue found using a prototype static analysis tool. + +Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver") +Signed-off-by: Abdun Nihaal +Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/isdn/hardware/mISDN/hfcsusb.c ++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c +@@ -1904,13 +1904,13 @@ out: + mISDN_freebchannel(&hw->bch[1]); + mISDN_freebchannel(&hw->bch[0]); + mISDN_freedchannel(&hw->dch); +- kfree(hw); + return err; + } + + static int + hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) + { ++ int err; + struct hfcsusb *hw; + struct usb_device *dev = interface_to_usbdev(intf); + struct usb_host_interface *iface = intf->cur_altsetting; +@@ -2101,20 +2101,28 @@ hfcsusb_probe(struct usb_interface *intf + if (!hw->ctrl_urb) { + pr_warn("%s: No memory for control urb\n", + driver_info->vend_name); +- kfree(hw); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto err_free_hw; + } + + pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n", + hw->name, __func__, driver_info->vend_name, + conf_str[small_match], ifnum, alt_used); + +- if (setup_instance(hw, dev->dev.parent)) +- return -EIO; ++ if (setup_instance(hw, dev->dev.parent)) { ++ err = -EIO; ++ goto err_free_urb; ++ } + + hw->intf = intf; + usb_set_intfdata(hw->intf, hw); + return 0; ++ ++err_free_urb: ++ usb_free_urb(hw->ctrl_urb); ++err_free_hw: ++ kfree(hw); ++ return err; + } + + /* function called when an active device is removed */ diff --git a/queue-6.17/net-phy-micrel-fix-lan8814_config_init.patch b/queue-6.17/net-phy-micrel-fix-lan8814_config_init.patch new file mode 100644 index 0000000000..34c8de911c --- /dev/null +++ b/queue-6.17/net-phy-micrel-fix-lan8814_config_init.patch @@ -0,0 +1,38 @@ +From bf91f4bc9c1dfba75e457e6a5f11e3cda658729a Mon Sep 17 00:00:00 2001 +From: Horatiu Vultur +Date: Thu, 25 Sep 2025 08:47:02 +0200 +Subject: net: phy: micrel: Fix lan8814_config_init + +From: Horatiu Vultur + +commit bf91f4bc9c1dfba75e457e6a5f11e3cda658729a upstream. + +The blamed commit introduced the function lanphy_modify_page_reg which +as name suggests it, it modifies the registers. In the same commit we +have started to use this function inside the drivers. The problem is +that in the function lan8814_config_init we passed the wrong page number +when disabling the aneg towards host side. We passed extended page number +4(LAN8814_PAGE_COMMON_REGS) instead of extended page +5(LAN8814_PAGE_PORT_REGS) + +Fixes: a0de636ed7a264 ("net: phy: micrel: Introduce lanphy_modify_page_reg") +Signed-off-by: Horatiu Vultur +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250925064702.3906950-1-horatiu.vultur@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/micrel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -4328,7 +4328,7 @@ static int lan8814_config_init(struct ph + struct kszphy_priv *lan8814 = phydev->priv; + + /* Disable ANEG with QSGMII PCS Host side */ +- lanphy_modify_page_reg(phydev, LAN8814_PAGE_COMMON_REGS, ++ lanphy_modify_page_reg(phydev, LAN8814_PAGE_PORT_REGS, + LAN8814_QSGMII_PCS1G_ANEG_CONFIG, + LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA, + 0); diff --git a/queue-6.17/series b/queue-6.17/series index e4c2ca9e86..a6ed7c4359 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -243,3 +243,5 @@ asoc-da7213-use-component-driver-suspend-resume.patch kvm-x86-rename-local-ecx-variables-to-msr-and-pmc-as-appropriate.patch kvm-x86-add-support-for-rdmsr-wrmsrns-w-immediate-on-intel.patch kvm-vmx-inject-ud-if-guest-tries-to-execute-seamcall-or-tdcall.patch +isdn-misdn-hfcsusb-fix-memory-leak-in-hfcsusb_probe.patch +net-phy-micrel-fix-lan8814_config_init.patch