From: Greg Kroah-Hartman Date: Mon, 6 Apr 2026 07:12:39 +0000 (+0200) Subject: move 6.6 queue "to the side" X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e93a211f0731ff49bfd8da07d648fbea2a52102b;p=thirdparty%2Fkernel%2Fstable-queue.git move 6.6 queue "to the side" --- diff --git a/queue-6.6/revert-xattr-switch-to-class-fd.patch b/queue-6.6/revert-xattr-switch-to-class-fd.patch new file mode 100644 index 0000000000..0a68262134 --- /dev/null +++ b/queue-6.6/revert-xattr-switch-to-class-fd.patch @@ -0,0 +1,100 @@ +From tomasz@kramkow.ski Sun Apr 5 13:45:56 2026 +From: Tomasz Kramkowski +Date: Sun, 5 Apr 2026 12:45:04 +0100 +Subject: Revert "xattr: switch to CLASS(fd)" +To: Greg Kroah-Hartman , stable@vger.kernel.org +Cc: Alexander Viro , Christian Brauner , linux-fsdevel@vger.kernel.org, Tomasz Kramkowski , Brad Spengler , Alva Lan +Message-ID: <20260405114505.568530-2-tomasz@kramkow.ski> + +From: Tomasz Kramkowski + +This reverts commit 5a1e865e51063d6c56f673ec8ad4b6604321b455 which is +commit a71874379ec8c6e788a61d71b3ad014a8d9a5c08 upstream. + +A backporting mistake erroneously removed file descriptor checks for +`fgetxattr`, `flistxattr`, `fremovexattr`, and `fsetxattr` which lead to +kernel panics when those functions were called from userspace with a +file descriptor which did not reference an open file. + +Reported-by: Brad Spengler +Closes: https://x.com/spendergrsec/status/2040049852793450561 +Cc: Alva Lan +Cc: Al Viro +Signed-off-by: Tomasz Kramkowski +Tested-by: Barry K. Nathan +Signed-off-by: Greg Kroah-Hartman +--- + fs/xattr.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -698,6 +698,8 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons + int error; + + CLASS(fd, f)(fd); ++ if (!f.file) ++ return -EBADF; + + audit_file(f.file); + error = setxattr_copy(name, &ctx); +@@ -808,11 +810,16 @@ SYSCALL_DEFINE4(lgetxattr, const char __ + SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, + void __user *, value, size_t, size) + { +- CLASS(fd, f)(fd); ++ struct fd f = fdget(fd); ++ ssize_t error = -EBADF; + ++ if (!f.file) ++ return error; + audit_file(f.file); +- return getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, ++ error = getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, + name, value, size); ++ fdput(f); ++ return error; + } + + /* +@@ -879,10 +886,15 @@ SYSCALL_DEFINE3(llistxattr, const char _ + + SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size) + { +- CLASS(fd, f)(fd); ++ struct fd f = fdget(fd); ++ ssize_t error = -EBADF; + ++ if (!f.file) ++ return error; + audit_file(f.file); +- return listxattr(f.file->f_path.dentry, list, size); ++ error = listxattr(f.file->f_path.dentry, list, size); ++ fdput(f); ++ return error; + } + + /* +@@ -939,10 +951,12 @@ SYSCALL_DEFINE2(lremovexattr, const char + + SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name) + { +- CLASS(fd, f)(fd); ++ struct fd f = fdget(fd); + char kname[XATTR_NAME_MAX + 1]; +- int error; ++ int error = -EBADF; + ++ if (!f.file) ++ return error; + audit_file(f.file); + + error = strncpy_from_user(kname, name, sizeof(kname)); +@@ -957,6 +971,7 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, c + f.file->f_path.dentry, kname); + mnt_drop_write_file(f.file); + } ++ fdput(f); + return error; + } + diff --git a/queue-6.6/series b/queue-6.6/series index f54cbf96a6..ec4a38abad 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1,64 +1,2 @@ -arm64-scs-fix-handling-of-advance_loc4.patch -hid-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch -atm-lec-fix-use-after-free-in-sock_def_readable.patch -btrfs-don-t-take-device_list_mutex-when-querying-zon.patch -tg3-replace-placeholder-mac-address-with-device-prop.patch -objtool-fix-clang-jump-table-detection.patch -hid-multitouch-check-to-ensure-report-responses-matc.patch -i2c-tegra-don-t-mark-devices-with-pins-as-irq-safe.patch -btrfs-reject-root-items-with-drop_progress-and-zero-.patch -spi-geni-qcom-check-dma-interrupts-early-in-isr.patch -dt-bindings-auxdisplay-ht16k33-use-unevaluatedproper.patch -wifi-ath11k-skip-status-ring-entry-processing.patch -wifi-ath11k-use-dma_alloc_noncoherent-for-rx_tid-buf.patch -wifi-ath11k-pass-the-correct-value-of-each-tid-durin.patch -crypto-caam-fix-dma-corruption-on-long-hmac-keys.patch -crypto-caam-fix-overflow-on-long-hmac-keys.patch -crypto-af-alg-fix-null-pointer-dereference-in-scatte.patch -net-fec-fix-the-ptp-periodic-output-sysfs-interface.patch -net-qrtr-replace-qrtr_tx_flow-radix_tree-with-xarray.patch -net-ipv6-ndisc-fix-ndisc_ra_useropt-to-initialize-nd.patch -net-ipv6-ioam6-prevent-schema-length-wraparound-in-t.patch -tg3-fix-race-for-querying-speed-duplex.patch -ipv6-icmp-clear-skb2-cb-in-ip6_err_gen_icmpv6_unreac.patch -ip6_tunnel-clear-skb2-cb-in-ip4ip6_err.patch -bridge-br_nd_send-linearize-skb-before-parsing-nd-op.patch -net-sched-sch_hfsc-fix-divide-by-zero-in-rtsc_min.patch -asoc-ep93xx-fix-unchecked-clk_prepare_enable-and-add.patch -ipv6-prevent-possible-uaf-in-addrconf_permanent_addr.patch -net-sched-cls_api-fix-tc_chain_fill_node-to-initiali.patch -nfc-pn533-bound-the-uart-receive-buffer.patch -net-xilinx-axienet-correct-bd-length-masks-to-match-.patch -bpf-fix-regsafe-for-pointers-to-packet.patch -net-ipv6-flowlabel-defer-exclusive-option-free-until.patch -netfilter-flowtable-strictly-check-for-maximum-numbe.patch -netfilter-nfnetlink_log-account-for-netlink-header-s.patch -netfilter-x_tables-ensure-names-are-nul-terminated.patch -netfilter-ipset-use-nla_strcmp-for-ipset_attr_name-a.patch -netfilter-nf_conntrack_helper-pass-helper-to-expect-.patch -netfilter-ctnetlink-zero-expect-nat-fields-when-cta_.patch -netfilter-nf_conntrack_expect-honor-expectation-help.patch -netfilter-nf_conntrack_expect-use-expect-helper.patch -netfilter-nf_conntrack_expect-store-netns-and-zone-i.patch -netfilter-ctnetlink-ignore-explicit-helper-on-new-ex.patch -netfilter-x_tables-restrict-xt_check_match-xt_check_.patch -netfilter-nf_tables-reject-immediate-nf_queue-verdic.patch -bluetooth-hci_sync-call-destroy-in-hci_cmd_sync_run-.patch -bluetooth-sco-fix-race-conditions-in-sco_sock_connec.patch -bluetooth-mgmt-validate-ltk-enc_size-on-load.patch -bluetooth-hci_event-fix-potential-uaf-in-hci_le_remo.patch -bluetooth-mgmt-validate-mesh-send-advertising-payloa.patch -rds-ib-reject-frmr-registration-before-ib-connection.patch -bpf-sockmap-fix-use-after-free-of-sk-sk_socket-in-sk.patch -net-sched-sch_netem-fix-out-of-bounds-access-in-pack.patch -net-macb-fix-clk-handling-on-pci-glue-driver-removal.patch -net-macb-properly-unregister-fixed-rate-clocks.patch -net-mlx5-lag-check-for-lag-device-before-creating-de.patch -net-mlx5-avoid-no-data-available-when-fw-version-que.patch -net-x25-fix-potential-double-free-of-skb.patch -net-x25-fix-overflow-when-accumulating-packets.patch -net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch -net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch -net-hsr-fix-vlan-add-unwind-on-slave-errors.patch -ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch -bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch +revert-xattr-switch-to-class-fd.patch +xattr-switch-to-class-fd.patch diff --git a/queue-6.6/xattr-switch-to-class-fd.patch b/queue-6.6/xattr-switch-to-class-fd.patch new file mode 100644 index 0000000000..3ce384c9f5 --- /dev/null +++ b/queue-6.6/xattr-switch-to-class-fd.patch @@ -0,0 +1,100 @@ +From stable+bounces-233333-greg=kroah.com@vger.kernel.org Sun Apr 5 13:46:26 2026 +From: Tomasz Kramkowski +Date: Sun, 5 Apr 2026 12:45:05 +0100 +Subject: xattr: switch to CLASS(fd) +To: Greg Kroah-Hartman , stable@vger.kernel.org +Cc: Alexander Viro , Christian Brauner , linux-fsdevel@vger.kernel.org, Tomasz Kramkowski +Message-ID: <20260405114505.568530-3-tomasz@kramkow.ski> + +From: Al Viro + +[ Upstream commit a71874379ec8c6e788a61d71b3ad014a8d9a5c08 ] + +Reviewed-by: Christian Brauner +Signed-off-by: Al Viro +Link: https://lore.kernel.org/all/20241002012230.4174585-1-viro@zeniv.linux.org.uk/ +[ Neither `fd_file` nor `fd_empty` are available in 6.6.y, so the + changes to the check are dropped. Kept the minor formatting change. ] +Signed-off-by: Tomasz Kramkowski +Tested-by: Barry K. Nathan +Signed-off-by: Greg Kroah-Hartman +--- + fs/xattr.c | 27 ++++++++++----------------- + 1 file changed, 10 insertions(+), 17 deletions(-) + +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -698,9 +698,9 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons + int error; + + CLASS(fd, f)(fd); ++ + if (!f.file) + return -EBADF; +- + audit_file(f.file); + error = setxattr_copy(name, &ctx); + if (error) +@@ -810,16 +810,13 @@ SYSCALL_DEFINE4(lgetxattr, const char __ + SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, + void __user *, value, size_t, size) + { +- struct fd f = fdget(fd); +- ssize_t error = -EBADF; ++ CLASS(fd, f)(fd); + + if (!f.file) +- return error; ++ return -EBADF; + audit_file(f.file); +- error = getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, ++ return getxattr(file_mnt_idmap(f.file), f.file->f_path.dentry, + name, value, size); +- fdput(f); +- return error; + } + + /* +@@ -886,15 +883,12 @@ SYSCALL_DEFINE3(llistxattr, const char _ + + SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size) + { +- struct fd f = fdget(fd); +- ssize_t error = -EBADF; ++ CLASS(fd, f)(fd); + + if (!f.file) +- return error; ++ return -EBADF; + audit_file(f.file); +- error = listxattr(f.file->f_path.dentry, list, size); +- fdput(f); +- return error; ++ return listxattr(f.file->f_path.dentry, list, size); + } + + /* +@@ -951,12 +945,12 @@ SYSCALL_DEFINE2(lremovexattr, const char + + SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name) + { +- struct fd f = fdget(fd); ++ CLASS(fd, f)(fd); + char kname[XATTR_NAME_MAX + 1]; +- int error = -EBADF; ++ int error; + + if (!f.file) +- return error; ++ return -EBADF; + audit_file(f.file); + + error = strncpy_from_user(kname, name, sizeof(kname)); +@@ -971,7 +965,6 @@ SYSCALL_DEFINE2(fremovexattr, int, fd, c + f.file->f_path.dentry, kname); + mnt_drop_write_file(f.file); + } +- fdput(f); + return error; + } + diff --git a/queue-6.6/arm64-scs-fix-handling-of-advance_loc4.patch b/temp-6.6/arm64-scs-fix-handling-of-advance_loc4.patch similarity index 100% rename from queue-6.6/arm64-scs-fix-handling-of-advance_loc4.patch rename to temp-6.6/arm64-scs-fix-handling-of-advance_loc4.patch diff --git a/queue-6.6/asoc-ep93xx-fix-unchecked-clk_prepare_enable-and-add.patch b/temp-6.6/asoc-ep93xx-fix-unchecked-clk_prepare_enable-and-add.patch similarity index 100% rename from queue-6.6/asoc-ep93xx-fix-unchecked-clk_prepare_enable-and-add.patch rename to temp-6.6/asoc-ep93xx-fix-unchecked-clk_prepare_enable-and-add.patch diff --git a/queue-6.6/atm-lec-fix-use-after-free-in-sock_def_readable.patch b/temp-6.6/atm-lec-fix-use-after-free-in-sock_def_readable.patch similarity index 100% rename from queue-6.6/atm-lec-fix-use-after-free-in-sock_def_readable.patch rename to temp-6.6/atm-lec-fix-use-after-free-in-sock_def_readable.patch diff --git a/queue-6.6/bluetooth-hci_event-fix-potential-uaf-in-hci_le_remo.patch b/temp-6.6/bluetooth-hci_event-fix-potential-uaf-in-hci_le_remo.patch similarity index 100% rename from queue-6.6/bluetooth-hci_event-fix-potential-uaf-in-hci_le_remo.patch rename to temp-6.6/bluetooth-hci_event-fix-potential-uaf-in-hci_le_remo.patch diff --git a/queue-6.6/bluetooth-hci_sync-call-destroy-in-hci_cmd_sync_run-.patch b/temp-6.6/bluetooth-hci_sync-call-destroy-in-hci_cmd_sync_run-.patch similarity index 100% rename from queue-6.6/bluetooth-hci_sync-call-destroy-in-hci_cmd_sync_run-.patch rename to temp-6.6/bluetooth-hci_sync-call-destroy-in-hci_cmd_sync_run-.patch diff --git a/queue-6.6/bluetooth-mgmt-validate-ltk-enc_size-on-load.patch b/temp-6.6/bluetooth-mgmt-validate-ltk-enc_size-on-load.patch similarity index 100% rename from queue-6.6/bluetooth-mgmt-validate-ltk-enc_size-on-load.patch rename to temp-6.6/bluetooth-mgmt-validate-ltk-enc_size-on-load.patch diff --git a/queue-6.6/bluetooth-mgmt-validate-mesh-send-advertising-payloa.patch b/temp-6.6/bluetooth-mgmt-validate-mesh-send-advertising-payloa.patch similarity index 100% rename from queue-6.6/bluetooth-mgmt-validate-mesh-send-advertising-payloa.patch rename to temp-6.6/bluetooth-mgmt-validate-mesh-send-advertising-payloa.patch diff --git a/queue-6.6/bluetooth-sco-fix-race-conditions-in-sco_sock_connec.patch b/temp-6.6/bluetooth-sco-fix-race-conditions-in-sco_sock_connec.patch similarity index 100% rename from queue-6.6/bluetooth-sco-fix-race-conditions-in-sco_sock_connec.patch rename to temp-6.6/bluetooth-sco-fix-race-conditions-in-sco_sock_connec.patch diff --git a/queue-6.6/bpf-fix-regsafe-for-pointers-to-packet.patch b/temp-6.6/bpf-fix-regsafe-for-pointers-to-packet.patch similarity index 100% rename from queue-6.6/bpf-fix-regsafe-for-pointers-to-packet.patch rename to temp-6.6/bpf-fix-regsafe-for-pointers-to-packet.patch diff --git a/queue-6.6/bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch b/temp-6.6/bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch similarity index 100% rename from queue-6.6/bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch rename to temp-6.6/bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch diff --git a/queue-6.6/bpf-sockmap-fix-use-after-free-of-sk-sk_socket-in-sk.patch b/temp-6.6/bpf-sockmap-fix-use-after-free-of-sk-sk_socket-in-sk.patch similarity index 100% rename from queue-6.6/bpf-sockmap-fix-use-after-free-of-sk-sk_socket-in-sk.patch rename to temp-6.6/bpf-sockmap-fix-use-after-free-of-sk-sk_socket-in-sk.patch diff --git a/queue-6.6/bridge-br_nd_send-linearize-skb-before-parsing-nd-op.patch b/temp-6.6/bridge-br_nd_send-linearize-skb-before-parsing-nd-op.patch similarity index 100% rename from queue-6.6/bridge-br_nd_send-linearize-skb-before-parsing-nd-op.patch rename to temp-6.6/bridge-br_nd_send-linearize-skb-before-parsing-nd-op.patch diff --git a/queue-6.6/btrfs-don-t-take-device_list_mutex-when-querying-zon.patch b/temp-6.6/btrfs-don-t-take-device_list_mutex-when-querying-zon.patch similarity index 100% rename from queue-6.6/btrfs-don-t-take-device_list_mutex-when-querying-zon.patch rename to temp-6.6/btrfs-don-t-take-device_list_mutex-when-querying-zon.patch diff --git a/queue-6.6/btrfs-reject-root-items-with-drop_progress-and-zero-.patch b/temp-6.6/btrfs-reject-root-items-with-drop_progress-and-zero-.patch similarity index 100% rename from queue-6.6/btrfs-reject-root-items-with-drop_progress-and-zero-.patch rename to temp-6.6/btrfs-reject-root-items-with-drop_progress-and-zero-.patch diff --git a/queue-6.6/crypto-af-alg-fix-null-pointer-dereference-in-scatte.patch b/temp-6.6/crypto-af-alg-fix-null-pointer-dereference-in-scatte.patch similarity index 100% rename from queue-6.6/crypto-af-alg-fix-null-pointer-dereference-in-scatte.patch rename to temp-6.6/crypto-af-alg-fix-null-pointer-dereference-in-scatte.patch diff --git a/queue-6.6/crypto-caam-fix-dma-corruption-on-long-hmac-keys.patch b/temp-6.6/crypto-caam-fix-dma-corruption-on-long-hmac-keys.patch similarity index 100% rename from queue-6.6/crypto-caam-fix-dma-corruption-on-long-hmac-keys.patch rename to temp-6.6/crypto-caam-fix-dma-corruption-on-long-hmac-keys.patch diff --git a/queue-6.6/crypto-caam-fix-overflow-on-long-hmac-keys.patch b/temp-6.6/crypto-caam-fix-overflow-on-long-hmac-keys.patch similarity index 100% rename from queue-6.6/crypto-caam-fix-overflow-on-long-hmac-keys.patch rename to temp-6.6/crypto-caam-fix-overflow-on-long-hmac-keys.patch diff --git a/queue-6.6/dt-bindings-auxdisplay-ht16k33-use-unevaluatedproper.patch b/temp-6.6/dt-bindings-auxdisplay-ht16k33-use-unevaluatedproper.patch similarity index 100% rename from queue-6.6/dt-bindings-auxdisplay-ht16k33-use-unevaluatedproper.patch rename to temp-6.6/dt-bindings-auxdisplay-ht16k33-use-unevaluatedproper.patch diff --git a/queue-6.6/hid-multitouch-check-to-ensure-report-responses-matc.patch b/temp-6.6/hid-multitouch-check-to-ensure-report-responses-matc.patch similarity index 100% rename from queue-6.6/hid-multitouch-check-to-ensure-report-responses-matc.patch rename to temp-6.6/hid-multitouch-check-to-ensure-report-responses-matc.patch diff --git a/queue-6.6/hid-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch b/temp-6.6/hid-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch similarity index 100% rename from queue-6.6/hid-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch rename to temp-6.6/hid-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch diff --git a/queue-6.6/i2c-tegra-don-t-mark-devices-with-pins-as-irq-safe.patch b/temp-6.6/i2c-tegra-don-t-mark-devices-with-pins-as-irq-safe.patch similarity index 100% rename from queue-6.6/i2c-tegra-don-t-mark-devices-with-pins-as-irq-safe.patch rename to temp-6.6/i2c-tegra-don-t-mark-devices-with-pins-as-irq-safe.patch diff --git a/queue-6.6/ip6_tunnel-clear-skb2-cb-in-ip4ip6_err.patch b/temp-6.6/ip6_tunnel-clear-skb2-cb-in-ip4ip6_err.patch similarity index 100% rename from queue-6.6/ip6_tunnel-clear-skb2-cb-in-ip4ip6_err.patch rename to temp-6.6/ip6_tunnel-clear-skb2-cb-in-ip4ip6_err.patch diff --git a/queue-6.6/ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch b/temp-6.6/ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch similarity index 100% rename from queue-6.6/ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch rename to temp-6.6/ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch diff --git a/queue-6.6/ipv6-icmp-clear-skb2-cb-in-ip6_err_gen_icmpv6_unreac.patch b/temp-6.6/ipv6-icmp-clear-skb2-cb-in-ip6_err_gen_icmpv6_unreac.patch similarity index 100% rename from queue-6.6/ipv6-icmp-clear-skb2-cb-in-ip6_err_gen_icmpv6_unreac.patch rename to temp-6.6/ipv6-icmp-clear-skb2-cb-in-ip6_err_gen_icmpv6_unreac.patch diff --git a/queue-6.6/ipv6-prevent-possible-uaf-in-addrconf_permanent_addr.patch b/temp-6.6/ipv6-prevent-possible-uaf-in-addrconf_permanent_addr.patch similarity index 100% rename from queue-6.6/ipv6-prevent-possible-uaf-in-addrconf_permanent_addr.patch rename to temp-6.6/ipv6-prevent-possible-uaf-in-addrconf_permanent_addr.patch diff --git a/queue-6.6/net-fec-fix-the-ptp-periodic-output-sysfs-interface.patch b/temp-6.6/net-fec-fix-the-ptp-periodic-output-sysfs-interface.patch similarity index 100% rename from queue-6.6/net-fec-fix-the-ptp-periodic-output-sysfs-interface.patch rename to temp-6.6/net-fec-fix-the-ptp-periodic-output-sysfs-interface.patch diff --git a/queue-6.6/net-hsr-fix-vlan-add-unwind-on-slave-errors.patch b/temp-6.6/net-hsr-fix-vlan-add-unwind-on-slave-errors.patch similarity index 100% rename from queue-6.6/net-hsr-fix-vlan-add-unwind-on-slave-errors.patch rename to temp-6.6/net-hsr-fix-vlan-add-unwind-on-slave-errors.patch diff --git a/queue-6.6/net-ipv6-flowlabel-defer-exclusive-option-free-until.patch b/temp-6.6/net-ipv6-flowlabel-defer-exclusive-option-free-until.patch similarity index 100% rename from queue-6.6/net-ipv6-flowlabel-defer-exclusive-option-free-until.patch rename to temp-6.6/net-ipv6-flowlabel-defer-exclusive-option-free-until.patch diff --git a/queue-6.6/net-ipv6-ioam6-prevent-schema-length-wraparound-in-t.patch b/temp-6.6/net-ipv6-ioam6-prevent-schema-length-wraparound-in-t.patch similarity index 100% rename from queue-6.6/net-ipv6-ioam6-prevent-schema-length-wraparound-in-t.patch rename to temp-6.6/net-ipv6-ioam6-prevent-schema-length-wraparound-in-t.patch diff --git a/queue-6.6/net-ipv6-ndisc-fix-ndisc_ra_useropt-to-initialize-nd.patch b/temp-6.6/net-ipv6-ndisc-fix-ndisc_ra_useropt-to-initialize-nd.patch similarity index 100% rename from queue-6.6/net-ipv6-ndisc-fix-ndisc_ra_useropt-to-initialize-nd.patch rename to temp-6.6/net-ipv6-ndisc-fix-ndisc_ra_useropt-to-initialize-nd.patch diff --git a/queue-6.6/net-macb-fix-clk-handling-on-pci-glue-driver-removal.patch b/temp-6.6/net-macb-fix-clk-handling-on-pci-glue-driver-removal.patch similarity index 100% rename from queue-6.6/net-macb-fix-clk-handling-on-pci-glue-driver-removal.patch rename to temp-6.6/net-macb-fix-clk-handling-on-pci-glue-driver-removal.patch diff --git a/queue-6.6/net-macb-properly-unregister-fixed-rate-clocks.patch b/temp-6.6/net-macb-properly-unregister-fixed-rate-clocks.patch similarity index 100% rename from queue-6.6/net-macb-properly-unregister-fixed-rate-clocks.patch rename to temp-6.6/net-macb-properly-unregister-fixed-rate-clocks.patch diff --git a/queue-6.6/net-mlx5-avoid-no-data-available-when-fw-version-que.patch b/temp-6.6/net-mlx5-avoid-no-data-available-when-fw-version-que.patch similarity index 100% rename from queue-6.6/net-mlx5-avoid-no-data-available-when-fw-version-que.patch rename to temp-6.6/net-mlx5-avoid-no-data-available-when-fw-version-que.patch diff --git a/queue-6.6/net-mlx5-lag-check-for-lag-device-before-creating-de.patch b/temp-6.6/net-mlx5-lag-check-for-lag-device-before-creating-de.patch similarity index 100% rename from queue-6.6/net-mlx5-lag-check-for-lag-device-before-creating-de.patch rename to temp-6.6/net-mlx5-lag-check-for-lag-device-before-creating-de.patch diff --git a/queue-6.6/net-qrtr-replace-qrtr_tx_flow-radix_tree-with-xarray.patch b/temp-6.6/net-qrtr-replace-qrtr_tx_flow-radix_tree-with-xarray.patch similarity index 100% rename from queue-6.6/net-qrtr-replace-qrtr_tx_flow-radix_tree-with-xarray.patch rename to temp-6.6/net-qrtr-replace-qrtr_tx_flow-radix_tree-with-xarray.patch diff --git a/queue-6.6/net-sched-cls_api-fix-tc_chain_fill_node-to-initiali.patch b/temp-6.6/net-sched-cls_api-fix-tc_chain_fill_node-to-initiali.patch similarity index 100% rename from queue-6.6/net-sched-cls_api-fix-tc_chain_fill_node-to-initiali.patch rename to temp-6.6/net-sched-cls_api-fix-tc_chain_fill_node-to-initiali.patch diff --git a/queue-6.6/net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch b/temp-6.6/net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch similarity index 100% rename from queue-6.6/net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch rename to temp-6.6/net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch diff --git a/queue-6.6/net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch b/temp-6.6/net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch similarity index 100% rename from queue-6.6/net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch rename to temp-6.6/net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch diff --git a/queue-6.6/net-sched-sch_hfsc-fix-divide-by-zero-in-rtsc_min.patch b/temp-6.6/net-sched-sch_hfsc-fix-divide-by-zero-in-rtsc_min.patch similarity index 100% rename from queue-6.6/net-sched-sch_hfsc-fix-divide-by-zero-in-rtsc_min.patch rename to temp-6.6/net-sched-sch_hfsc-fix-divide-by-zero-in-rtsc_min.patch diff --git a/queue-6.6/net-sched-sch_netem-fix-out-of-bounds-access-in-pack.patch b/temp-6.6/net-sched-sch_netem-fix-out-of-bounds-access-in-pack.patch similarity index 100% rename from queue-6.6/net-sched-sch_netem-fix-out-of-bounds-access-in-pack.patch rename to temp-6.6/net-sched-sch_netem-fix-out-of-bounds-access-in-pack.patch diff --git a/queue-6.6/net-x25-fix-overflow-when-accumulating-packets.patch b/temp-6.6/net-x25-fix-overflow-when-accumulating-packets.patch similarity index 100% rename from queue-6.6/net-x25-fix-overflow-when-accumulating-packets.patch rename to temp-6.6/net-x25-fix-overflow-when-accumulating-packets.patch diff --git a/queue-6.6/net-x25-fix-potential-double-free-of-skb.patch b/temp-6.6/net-x25-fix-potential-double-free-of-skb.patch similarity index 100% rename from queue-6.6/net-x25-fix-potential-double-free-of-skb.patch rename to temp-6.6/net-x25-fix-potential-double-free-of-skb.patch diff --git a/queue-6.6/net-xilinx-axienet-correct-bd-length-masks-to-match-.patch b/temp-6.6/net-xilinx-axienet-correct-bd-length-masks-to-match-.patch similarity index 100% rename from queue-6.6/net-xilinx-axienet-correct-bd-length-masks-to-match-.patch rename to temp-6.6/net-xilinx-axienet-correct-bd-length-masks-to-match-.patch diff --git a/queue-6.6/netfilter-ctnetlink-ignore-explicit-helper-on-new-ex.patch b/temp-6.6/netfilter-ctnetlink-ignore-explicit-helper-on-new-ex.patch similarity index 100% rename from queue-6.6/netfilter-ctnetlink-ignore-explicit-helper-on-new-ex.patch rename to temp-6.6/netfilter-ctnetlink-ignore-explicit-helper-on-new-ex.patch diff --git a/queue-6.6/netfilter-ctnetlink-zero-expect-nat-fields-when-cta_.patch b/temp-6.6/netfilter-ctnetlink-zero-expect-nat-fields-when-cta_.patch similarity index 100% rename from queue-6.6/netfilter-ctnetlink-zero-expect-nat-fields-when-cta_.patch rename to temp-6.6/netfilter-ctnetlink-zero-expect-nat-fields-when-cta_.patch diff --git a/queue-6.6/netfilter-flowtable-strictly-check-for-maximum-numbe.patch b/temp-6.6/netfilter-flowtable-strictly-check-for-maximum-numbe.patch similarity index 100% rename from queue-6.6/netfilter-flowtable-strictly-check-for-maximum-numbe.patch rename to temp-6.6/netfilter-flowtable-strictly-check-for-maximum-numbe.patch diff --git a/queue-6.6/netfilter-ipset-use-nla_strcmp-for-ipset_attr_name-a.patch b/temp-6.6/netfilter-ipset-use-nla_strcmp-for-ipset_attr_name-a.patch similarity index 100% rename from queue-6.6/netfilter-ipset-use-nla_strcmp-for-ipset_attr_name-a.patch rename to temp-6.6/netfilter-ipset-use-nla_strcmp-for-ipset_attr_name-a.patch diff --git a/queue-6.6/netfilter-nf_conntrack_expect-honor-expectation-help.patch b/temp-6.6/netfilter-nf_conntrack_expect-honor-expectation-help.patch similarity index 100% rename from queue-6.6/netfilter-nf_conntrack_expect-honor-expectation-help.patch rename to temp-6.6/netfilter-nf_conntrack_expect-honor-expectation-help.patch diff --git a/queue-6.6/netfilter-nf_conntrack_expect-store-netns-and-zone-i.patch b/temp-6.6/netfilter-nf_conntrack_expect-store-netns-and-zone-i.patch similarity index 100% rename from queue-6.6/netfilter-nf_conntrack_expect-store-netns-and-zone-i.patch rename to temp-6.6/netfilter-nf_conntrack_expect-store-netns-and-zone-i.patch diff --git a/queue-6.6/netfilter-nf_conntrack_expect-use-expect-helper.patch b/temp-6.6/netfilter-nf_conntrack_expect-use-expect-helper.patch similarity index 100% rename from queue-6.6/netfilter-nf_conntrack_expect-use-expect-helper.patch rename to temp-6.6/netfilter-nf_conntrack_expect-use-expect-helper.patch diff --git a/queue-6.6/netfilter-nf_conntrack_helper-pass-helper-to-expect-.patch b/temp-6.6/netfilter-nf_conntrack_helper-pass-helper-to-expect-.patch similarity index 100% rename from queue-6.6/netfilter-nf_conntrack_helper-pass-helper-to-expect-.patch rename to temp-6.6/netfilter-nf_conntrack_helper-pass-helper-to-expect-.patch diff --git a/queue-6.6/netfilter-nf_tables-reject-immediate-nf_queue-verdic.patch b/temp-6.6/netfilter-nf_tables-reject-immediate-nf_queue-verdic.patch similarity index 100% rename from queue-6.6/netfilter-nf_tables-reject-immediate-nf_queue-verdic.patch rename to temp-6.6/netfilter-nf_tables-reject-immediate-nf_queue-verdic.patch diff --git a/queue-6.6/netfilter-nfnetlink_log-account-for-netlink-header-s.patch b/temp-6.6/netfilter-nfnetlink_log-account-for-netlink-header-s.patch similarity index 100% rename from queue-6.6/netfilter-nfnetlink_log-account-for-netlink-header-s.patch rename to temp-6.6/netfilter-nfnetlink_log-account-for-netlink-header-s.patch diff --git a/queue-6.6/netfilter-x_tables-ensure-names-are-nul-terminated.patch b/temp-6.6/netfilter-x_tables-ensure-names-are-nul-terminated.patch similarity index 100% rename from queue-6.6/netfilter-x_tables-ensure-names-are-nul-terminated.patch rename to temp-6.6/netfilter-x_tables-ensure-names-are-nul-terminated.patch diff --git a/queue-6.6/netfilter-x_tables-restrict-xt_check_match-xt_check_.patch b/temp-6.6/netfilter-x_tables-restrict-xt_check_match-xt_check_.patch similarity index 100% rename from queue-6.6/netfilter-x_tables-restrict-xt_check_match-xt_check_.patch rename to temp-6.6/netfilter-x_tables-restrict-xt_check_match-xt_check_.patch diff --git a/queue-6.6/nfc-pn533-bound-the-uart-receive-buffer.patch b/temp-6.6/nfc-pn533-bound-the-uart-receive-buffer.patch similarity index 100% rename from queue-6.6/nfc-pn533-bound-the-uart-receive-buffer.patch rename to temp-6.6/nfc-pn533-bound-the-uart-receive-buffer.patch diff --git a/queue-6.6/objtool-fix-clang-jump-table-detection.patch b/temp-6.6/objtool-fix-clang-jump-table-detection.patch similarity index 100% rename from queue-6.6/objtool-fix-clang-jump-table-detection.patch rename to temp-6.6/objtool-fix-clang-jump-table-detection.patch diff --git a/queue-6.6/rds-ib-reject-frmr-registration-before-ib-connection.patch b/temp-6.6/rds-ib-reject-frmr-registration-before-ib-connection.patch similarity index 100% rename from queue-6.6/rds-ib-reject-frmr-registration-before-ib-connection.patch rename to temp-6.6/rds-ib-reject-frmr-registration-before-ib-connection.patch diff --git a/temp-6.6/series b/temp-6.6/series new file mode 100644 index 0000000000..f54cbf96a6 --- /dev/null +++ b/temp-6.6/series @@ -0,0 +1,64 @@ +arm64-scs-fix-handling-of-advance_loc4.patch +hid-wacom-fix-out-of-bounds-read-in-wacom_intuos_bt_.patch +atm-lec-fix-use-after-free-in-sock_def_readable.patch +btrfs-don-t-take-device_list_mutex-when-querying-zon.patch +tg3-replace-placeholder-mac-address-with-device-prop.patch +objtool-fix-clang-jump-table-detection.patch +hid-multitouch-check-to-ensure-report-responses-matc.patch +i2c-tegra-don-t-mark-devices-with-pins-as-irq-safe.patch +btrfs-reject-root-items-with-drop_progress-and-zero-.patch +spi-geni-qcom-check-dma-interrupts-early-in-isr.patch +dt-bindings-auxdisplay-ht16k33-use-unevaluatedproper.patch +wifi-ath11k-skip-status-ring-entry-processing.patch +wifi-ath11k-use-dma_alloc_noncoherent-for-rx_tid-buf.patch +wifi-ath11k-pass-the-correct-value-of-each-tid-durin.patch +crypto-caam-fix-dma-corruption-on-long-hmac-keys.patch +crypto-caam-fix-overflow-on-long-hmac-keys.patch +crypto-af-alg-fix-null-pointer-dereference-in-scatte.patch +net-fec-fix-the-ptp-periodic-output-sysfs-interface.patch +net-qrtr-replace-qrtr_tx_flow-radix_tree-with-xarray.patch +net-ipv6-ndisc-fix-ndisc_ra_useropt-to-initialize-nd.patch +net-ipv6-ioam6-prevent-schema-length-wraparound-in-t.patch +tg3-fix-race-for-querying-speed-duplex.patch +ipv6-icmp-clear-skb2-cb-in-ip6_err_gen_icmpv6_unreac.patch +ip6_tunnel-clear-skb2-cb-in-ip4ip6_err.patch +bridge-br_nd_send-linearize-skb-before-parsing-nd-op.patch +net-sched-sch_hfsc-fix-divide-by-zero-in-rtsc_min.patch +asoc-ep93xx-fix-unchecked-clk_prepare_enable-and-add.patch +ipv6-prevent-possible-uaf-in-addrconf_permanent_addr.patch +net-sched-cls_api-fix-tc_chain_fill_node-to-initiali.patch +nfc-pn533-bound-the-uart-receive-buffer.patch +net-xilinx-axienet-correct-bd-length-masks-to-match-.patch +bpf-fix-regsafe-for-pointers-to-packet.patch +net-ipv6-flowlabel-defer-exclusive-option-free-until.patch +netfilter-flowtable-strictly-check-for-maximum-numbe.patch +netfilter-nfnetlink_log-account-for-netlink-header-s.patch +netfilter-x_tables-ensure-names-are-nul-terminated.patch +netfilter-ipset-use-nla_strcmp-for-ipset_attr_name-a.patch +netfilter-nf_conntrack_helper-pass-helper-to-expect-.patch +netfilter-ctnetlink-zero-expect-nat-fields-when-cta_.patch +netfilter-nf_conntrack_expect-honor-expectation-help.patch +netfilter-nf_conntrack_expect-use-expect-helper.patch +netfilter-nf_conntrack_expect-store-netns-and-zone-i.patch +netfilter-ctnetlink-ignore-explicit-helper-on-new-ex.patch +netfilter-x_tables-restrict-xt_check_match-xt_check_.patch +netfilter-nf_tables-reject-immediate-nf_queue-verdic.patch +bluetooth-hci_sync-call-destroy-in-hci_cmd_sync_run-.patch +bluetooth-sco-fix-race-conditions-in-sco_sock_connec.patch +bluetooth-mgmt-validate-ltk-enc_size-on-load.patch +bluetooth-hci_event-fix-potential-uaf-in-hci_le_remo.patch +bluetooth-mgmt-validate-mesh-send-advertising-payloa.patch +rds-ib-reject-frmr-registration-before-ib-connection.patch +bpf-sockmap-fix-use-after-free-of-sk-sk_socket-in-sk.patch +net-sched-sch_netem-fix-out-of-bounds-access-in-pack.patch +net-macb-fix-clk-handling-on-pci-glue-driver-removal.patch +net-macb-properly-unregister-fixed-rate-clocks.patch +net-mlx5-lag-check-for-lag-device-before-creating-de.patch +net-mlx5-avoid-no-data-available-when-fw-version-que.patch +net-x25-fix-potential-double-free-of-skb.patch +net-x25-fix-overflow-when-accumulating-packets.patch +net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch +net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch +net-hsr-fix-vlan-add-unwind-on-slave-errors.patch +ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch +bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch diff --git a/queue-6.6/spi-geni-qcom-check-dma-interrupts-early-in-isr.patch b/temp-6.6/spi-geni-qcom-check-dma-interrupts-early-in-isr.patch similarity index 100% rename from queue-6.6/spi-geni-qcom-check-dma-interrupts-early-in-isr.patch rename to temp-6.6/spi-geni-qcom-check-dma-interrupts-early-in-isr.patch diff --git a/queue-6.6/tg3-fix-race-for-querying-speed-duplex.patch b/temp-6.6/tg3-fix-race-for-querying-speed-duplex.patch similarity index 100% rename from queue-6.6/tg3-fix-race-for-querying-speed-duplex.patch rename to temp-6.6/tg3-fix-race-for-querying-speed-duplex.patch diff --git a/queue-6.6/tg3-replace-placeholder-mac-address-with-device-prop.patch b/temp-6.6/tg3-replace-placeholder-mac-address-with-device-prop.patch similarity index 100% rename from queue-6.6/tg3-replace-placeholder-mac-address-with-device-prop.patch rename to temp-6.6/tg3-replace-placeholder-mac-address-with-device-prop.patch diff --git a/queue-6.6/wifi-ath11k-pass-the-correct-value-of-each-tid-durin.patch b/temp-6.6/wifi-ath11k-pass-the-correct-value-of-each-tid-durin.patch similarity index 100% rename from queue-6.6/wifi-ath11k-pass-the-correct-value-of-each-tid-durin.patch rename to temp-6.6/wifi-ath11k-pass-the-correct-value-of-each-tid-durin.patch diff --git a/queue-6.6/wifi-ath11k-skip-status-ring-entry-processing.patch b/temp-6.6/wifi-ath11k-skip-status-ring-entry-processing.patch similarity index 100% rename from queue-6.6/wifi-ath11k-skip-status-ring-entry-processing.patch rename to temp-6.6/wifi-ath11k-skip-status-ring-entry-processing.patch diff --git a/queue-6.6/wifi-ath11k-use-dma_alloc_noncoherent-for-rx_tid-buf.patch b/temp-6.6/wifi-ath11k-use-dma_alloc_noncoherent-for-rx_tid-buf.patch similarity index 100% rename from queue-6.6/wifi-ath11k-use-dma_alloc_noncoherent-for-rx_tid-buf.patch rename to temp-6.6/wifi-ath11k-use-dma_alloc_noncoherent-for-rx_tid-buf.patch