+++ /dev/null
-From stable+bounces-289742-greg=kroah.com@vger.kernel.org Tue Jul 28 01:37:22 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 27 Jul 2026 19:34:42 -0400
-Subject: mmc: vub300: fix use-after-free on disconnect
-To: stable@vger.kernel.org
-Cc: Johan Hovold <johan@kernel.org>, Binbin Zhou <zhoubinbin@loongson.cn>, Ulf Hansson <ulf.hansson@linaro.org>
-Message-ID: <20260727233445.2426041-1-sashal@kernel.org>
-
-From: Johan Hovold <johan@kernel.org>
-
-The vub300 driver maintains an explicit reference count for the
-controller and its driver data and the last reference can in theory be
-dropped after the driver has been unbound.
-
-This specifically means that the controller allocation must not be
-device managed as that can lead to use-after-free.
-
-Note that the lifetime is currently also incorrectly tied the parent USB
-device rather than interface, which can lead to memory leaks if the
-driver is unbound without its device being physically disconnected (e.g.
-on probe deferral).
-
-Fix both issues by reverting to non-managed allocation of the controller.
-
-Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper")
-Cc: stable@vger.kernel.org # 6.17+
-Cc: Binbin Zhou <zhoubinbin@loongson.cn>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-(cherry picked from commit 8f4d20a710225ec7a565f6a0459862d3b1f32330)
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/host/vub300.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
---- a/drivers/mmc/host/vub300.c
-+++ b/drivers/mmc/host/vub300.c
-@@ -2279,7 +2279,7 @@ static int vub300_probe(struct usb_inter
- dev_err(&vub300->udev->dev,
- "Could not find two sets of bulk-in/out endpoint pairs\n");
- retval = -EINVAL;
-- goto error5;
-+ goto err_free_host;
- }
- retval =
- usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
-@@ -2288,14 +2288,14 @@ static int vub300_probe(struct usb_inter
- 0x0000, 0x0000, &vub300->hc_info,
- sizeof(vub300->hc_info), 1000);
- if (retval < 0)
-- goto error5;
-+ goto err_free_host;
- retval =
- usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
- SET_ROM_WAIT_STATES,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
- if (retval < 0)
-- goto error5;
-+ goto err_free_host;
- dev_info(&vub300->udev->dev,
- "operating_mode = %s %s %d MHz %s %d byte USB packets\n",
- (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
-@@ -2310,7 +2310,7 @@ static int vub300_probe(struct usb_inter
- 0x0000, 0x0000, &vub300->system_port_status,
- sizeof(vub300->system_port_status), 1000);
- if (retval < 0) {
-- goto error5;
-+ goto err_free_host;
- } else if (sizeof(vub300->system_port_status) == retval) {
- vub300->card_present =
- (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
-@@ -2318,7 +2318,7 @@ static int vub300_probe(struct usb_inter
- (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
- } else {
- retval = -EINVAL;
-- goto error5;
-+ goto err_free_host;
- }
- usb_set_intfdata(interface, vub300);
- INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
-@@ -2348,7 +2348,7 @@ static int vub300_probe(struct usb_inter
- return 0;
- error6:
- del_timer_sync(&vub300->inactivity_timer);
--error5:
-+err_free_host:
- mmc_free_host(mmc);
- /*
- * and hence also frees vub300
+++ /dev/null
-From stable+bounces-289744-greg=kroah.com@vger.kernel.org Tue Jul 28 01:38:01 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 27 Jul 2026 19:34:44 -0400
-Subject: mmc: vub300: fix use-after-free on probe failure
-To: stable@vger.kernel.org
-Cc: Guangshuo Li <lgs201920130244@gmail.com>, Johan Hovold <johan@kernel.org>, Ulf Hansson <ulfh@kernel.org>
-Message-ID: <20260727233445.2426041-3-sashal@kernel.org>
-
-From: Guangshuo Li <lgs201920130244@gmail.com>
-
-The vub300 driver lifetime-manages its controller state using
-vub300->kref, with vub300_delete() freeing the mmc host when the last
-reference is dropped. The probe error path after the inactivity timer has
-been armed still bypasses that lifetime rule, however, and falls through
-to mmc_free_host() directly if mmc_add_host() fails.
-
-The race window is between arming the inactivity timer and reaching the
-probe error unwind after mmc_add_host() fails:
-
- probe thread timer/workqueue
- ------------ ---------------
- kref_init(&vub300->kref) ref = 1
- kref_get(&vub300->kref) ref = 2, timer ref
- add_timer(inactivity_timer) fires after one second
- |
- | race window
- |<---------------------------------------------------->
- |
- mmc_add_host(mmc)
- inactivity timer fires
- vub300_queue_dead_work()
- kref_get() ref = 3
- queue_work(deadwork)
- mmc_add_host() fails
- timer_delete_sync()
- mmc_free_host(mmc)
- frees vub300
- deadwork runs
- use-after-free
-
-The inactivity timeout is one second, so this would require
-mmc_add_host() to both fail and take more than one second to do so. This
-is unlikely to happen in practice, but the error path is still wrong.
-
-timer_delete_sync() only waits for the timer callback itself. It does
-not flush deadwork that the callback may already have queued. As a
-result, queued deadwork can still hold a kref while the probe error path
-directly frees the backing mmc host, including the vub300 storage.
-
-Fix this by using the same lifetime mechanism as disconnect. Clear
-vub300->interface so that the timer callback and any queued deadwork
-return early and drop their references, then drop the initial probe
-reference and return without falling through to err_free_host.
-
-Fixes: 0613ad2401f8 ("mmc: vub300: fix return value check of mmc_add_host()")
-Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
-Reviewed-by: Johan Hovold <johan@kernel.org>
-Cc: stable@vger.kernel.org
-Signed-off-by: Ulf Hansson <ulfh@kernel.org>
-(cherry picked from commit a3b5f242997a3be7404112fd48784881560aea57)
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/host/vub300.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
---- a/drivers/mmc/host/vub300.c
-+++ b/drivers/mmc/host/vub300.c
-@@ -2343,12 +2343,16 @@ static int vub300_probe(struct usb_inter
- interface_to_InterfaceNumber(interface));
- retval = mmc_add_host(mmc);
- if (retval)
-- goto err_delete_timer;
-+ goto err_stop_io;
-
- return 0;
-
--err_delete_timer:
-- timer_delete_sync(&vub300->inactivity_timer);
-+err_stop_io:
-+ vub300->interface = NULL;
-+ kref_put(&vub300->kref, vub300_delete);
-+
-+ return retval;
-+
- err_free_host:
- mmc_free_host(mmc);
- /*
+++ /dev/null
-From stable+bounces-289743-greg=kroah.com@vger.kernel.org Tue Jul 28 01:34:53 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 27 Jul 2026 19:34:43 -0400
-Subject: mmc: vub300: rename probe error labels
-To: stable@vger.kernel.org
-Cc: Johan Hovold <johan@kernel.org>, Ulf Hansson <ulf.hansson@linaro.org>
-Message-ID: <20260727233445.2426041-2-sashal@kernel.org>
-
-From: Johan Hovold <johan@kernel.org>
-
-Error labels should be named after what they do.
-
-Rename the probe error labels.
-
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-(cherry picked from commit 5b8b35d6f4fa758dd5e8ae18526ea1c73f6787e0)
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/host/vub300.c | 20 +++++++++++---------
- 1 file changed, 11 insertions(+), 9 deletions(-)
-
---- a/drivers/mmc/host/vub300.c
-+++ b/drivers/mmc/host/vub300.c
-@@ -2114,19 +2114,19 @@ static int vub300_probe(struct usb_inter
- command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
- if (!command_out_urb) {
- retval = -ENOMEM;
-- goto error0;
-+ goto err_put_udev;
- }
- command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
- if (!command_res_urb) {
- retval = -ENOMEM;
-- goto error1;
-+ goto err_free_out_urb;
- }
- /* this also allocates memory for our VUB300 mmc host device */
- mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
- if (!mmc) {
- retval = -ENOMEM;
- dev_err(&udev->dev, "not enough memory for the mmc_host\n");
-- goto error4;
-+ goto err_free_res_urb;
- }
- /* MMC core transfer sizes tunable parameters */
- mmc->caps = 0;
-@@ -2343,23 +2343,25 @@ static int vub300_probe(struct usb_inter
- interface_to_InterfaceNumber(interface));
- retval = mmc_add_host(mmc);
- if (retval)
-- goto error6;
-+ goto err_delete_timer;
-
- return 0;
--error6:
-- del_timer_sync(&vub300->inactivity_timer);
-+
-+err_delete_timer:
-+ timer_delete_sync(&vub300->inactivity_timer);
- err_free_host:
- mmc_free_host(mmc);
- /*
- * and hence also frees vub300
- * which is contained at the end of struct mmc
- */
--error4:
-+err_free_res_urb:
- usb_free_urb(command_res_urb);
--error1:
-+err_free_out_urb:
- usb_free_urb(command_out_urb);
--error0:
-+err_put_udev:
- usb_put_dev(udev);
-+
- return retval;
- }
-
cred-add-scoped_with_kernel_creds.patch
dm-avoid-leaking-the-caller-s-thread-keyring-via-the-table-device-file.patch
wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch
-mmc-vub300-fix-use-after-free-on-disconnect.patch
-mmc-vub300-rename-probe-error-labels.patch
-mmc-vub300-fix-use-after-free-on-probe-failure.patch
locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch
net-mana-validate-the-packet-length-reported-by-the-nic.patch
net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch
+++ /dev/null
-From stable+bounces-289774-greg=kroah.com@vger.kernel.org Tue Jul 28 02:59:39 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 27 Jul 2026 20:58:03 -0400
-Subject: mmc: vub300: fix use-after-free on disconnect
-To: stable@vger.kernel.org
-Cc: Johan Hovold <johan@kernel.org>, Binbin Zhou <zhoubinbin@loongson.cn>, Ulf Hansson <ulf.hansson@linaro.org>
-Message-ID: <20260728005806.2694893-1-sashal@kernel.org>
-
-From: Johan Hovold <johan@kernel.org>
-
-The vub300 driver maintains an explicit reference count for the
-controller and its driver data and the last reference can in theory be
-dropped after the driver has been unbound.
-
-This specifically means that the controller allocation must not be
-device managed as that can lead to use-after-free.
-
-Note that the lifetime is currently also incorrectly tied the parent USB
-device rather than interface, which can lead to memory leaks if the
-driver is unbound without its device being physically disconnected (e.g.
-on probe deferral).
-
-Fix both issues by reverting to non-managed allocation of the controller.
-
-Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper")
-Cc: stable@vger.kernel.org # 6.17+
-Cc: Binbin Zhou <zhoubinbin@loongson.cn>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-(cherry picked from commit 8f4d20a710225ec7a565f6a0459862d3b1f32330)
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/host/vub300.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
---- a/drivers/mmc/host/vub300.c
-+++ b/drivers/mmc/host/vub300.c
-@@ -2279,7 +2279,7 @@ static int vub300_probe(struct usb_inter
- dev_err(&vub300->udev->dev,
- "Could not find two sets of bulk-in/out endpoint pairs\n");
- retval = -EINVAL;
-- goto error5;
-+ goto err_free_host;
- }
- retval =
- usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
-@@ -2288,14 +2288,14 @@ static int vub300_probe(struct usb_inter
- 0x0000, 0x0000, &vub300->hc_info,
- sizeof(vub300->hc_info), 1000);
- if (retval < 0)
-- goto error5;
-+ goto err_free_host;
- retval =
- usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
- SET_ROM_WAIT_STATES,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
- if (retval < 0)
-- goto error5;
-+ goto err_free_host;
- dev_info(&vub300->udev->dev,
- "operating_mode = %s %s %d MHz %s %d byte USB packets\n",
- (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
-@@ -2310,7 +2310,7 @@ static int vub300_probe(struct usb_inter
- 0x0000, 0x0000, &vub300->system_port_status,
- sizeof(vub300->system_port_status), 1000);
- if (retval < 0) {
-- goto error5;
-+ goto err_free_host;
- } else if (sizeof(vub300->system_port_status) == retval) {
- vub300->card_present =
- (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
-@@ -2318,7 +2318,7 @@ static int vub300_probe(struct usb_inter
- (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
- } else {
- retval = -EINVAL;
-- goto error5;
-+ goto err_free_host;
- }
- usb_set_intfdata(interface, vub300);
- INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
-@@ -2348,7 +2348,7 @@ static int vub300_probe(struct usb_inter
- return 0;
- error6:
- del_timer_sync(&vub300->inactivity_timer);
--error5:
-+err_free_host:
- mmc_free_host(mmc);
- /*
- * and hence also frees vub300
+++ /dev/null
-From stable+bounces-289776-greg=kroah.com@vger.kernel.org Tue Jul 28 02:59:45 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 27 Jul 2026 20:58:05 -0400
-Subject: mmc: vub300: fix use-after-free on probe failure
-To: stable@vger.kernel.org
-Cc: Guangshuo Li <lgs201920130244@gmail.com>, Johan Hovold <johan@kernel.org>, Ulf Hansson <ulfh@kernel.org>
-Message-ID: <20260728005806.2694893-3-sashal@kernel.org>
-
-From: Guangshuo Li <lgs201920130244@gmail.com>
-
-The vub300 driver lifetime-manages its controller state using
-vub300->kref, with vub300_delete() freeing the mmc host when the last
-reference is dropped. The probe error path after the inactivity timer has
-been armed still bypasses that lifetime rule, however, and falls through
-to mmc_free_host() directly if mmc_add_host() fails.
-
-The race window is between arming the inactivity timer and reaching the
-probe error unwind after mmc_add_host() fails:
-
- probe thread timer/workqueue
- ------------ ---------------
- kref_init(&vub300->kref) ref = 1
- kref_get(&vub300->kref) ref = 2, timer ref
- add_timer(inactivity_timer) fires after one second
- |
- | race window
- |<---------------------------------------------------->
- |
- mmc_add_host(mmc)
- inactivity timer fires
- vub300_queue_dead_work()
- kref_get() ref = 3
- queue_work(deadwork)
- mmc_add_host() fails
- timer_delete_sync()
- mmc_free_host(mmc)
- frees vub300
- deadwork runs
- use-after-free
-
-The inactivity timeout is one second, so this would require
-mmc_add_host() to both fail and take more than one second to do so. This
-is unlikely to happen in practice, but the error path is still wrong.
-
-timer_delete_sync() only waits for the timer callback itself. It does
-not flush deadwork that the callback may already have queued. As a
-result, queued deadwork can still hold a kref while the probe error path
-directly frees the backing mmc host, including the vub300 storage.
-
-Fix this by using the same lifetime mechanism as disconnect. Clear
-vub300->interface so that the timer callback and any queued deadwork
-return early and drop their references, then drop the initial probe
-reference and return without falling through to err_free_host.
-
-Fixes: 0613ad2401f8 ("mmc: vub300: fix return value check of mmc_add_host()")
-Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
-Reviewed-by: Johan Hovold <johan@kernel.org>
-Cc: stable@vger.kernel.org
-Signed-off-by: Ulf Hansson <ulfh@kernel.org>
-(cherry picked from commit a3b5f242997a3be7404112fd48784881560aea57)
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/host/vub300.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
---- a/drivers/mmc/host/vub300.c
-+++ b/drivers/mmc/host/vub300.c
-@@ -2343,12 +2343,16 @@ static int vub300_probe(struct usb_inter
- interface_to_InterfaceNumber(interface));
- retval = mmc_add_host(mmc);
- if (retval)
-- goto err_delete_timer;
-+ goto err_stop_io;
-
- return 0;
-
--err_delete_timer:
-- timer_delete_sync(&vub300->inactivity_timer);
-+err_stop_io:
-+ vub300->interface = NULL;
-+ kref_put(&vub300->kref, vub300_delete);
-+
-+ return retval;
-+
- err_free_host:
- mmc_free_host(mmc);
- /*
+++ /dev/null
-From stable+bounces-289775-greg=kroah.com@vger.kernel.org Tue Jul 28 02:59:41 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 27 Jul 2026 20:58:04 -0400
-Subject: mmc: vub300: rename probe error labels
-To: stable@vger.kernel.org
-Cc: Johan Hovold <johan@kernel.org>, Ulf Hansson <ulf.hansson@linaro.org>
-Message-ID: <20260728005806.2694893-2-sashal@kernel.org>
-
-From: Johan Hovold <johan@kernel.org>
-
-Error labels should be named after what they do.
-
-Rename the probe error labels.
-
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-(cherry picked from commit 5b8b35d6f4fa758dd5e8ae18526ea1c73f6787e0)
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/host/vub300.c | 20 +++++++++++---------
- 1 file changed, 11 insertions(+), 9 deletions(-)
-
---- a/drivers/mmc/host/vub300.c
-+++ b/drivers/mmc/host/vub300.c
-@@ -2114,19 +2114,19 @@ static int vub300_probe(struct usb_inter
- command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
- if (!command_out_urb) {
- retval = -ENOMEM;
-- goto error0;
-+ goto err_put_udev;
- }
- command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
- if (!command_res_urb) {
- retval = -ENOMEM;
-- goto error1;
-+ goto err_free_out_urb;
- }
- /* this also allocates memory for our VUB300 mmc host device */
- mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
- if (!mmc) {
- retval = -ENOMEM;
- dev_err(&udev->dev, "not enough memory for the mmc_host\n");
-- goto error4;
-+ goto err_free_res_urb;
- }
- /* MMC core transfer sizes tunable parameters */
- mmc->caps = 0;
-@@ -2343,23 +2343,25 @@ static int vub300_probe(struct usb_inter
- interface_to_InterfaceNumber(interface));
- retval = mmc_add_host(mmc);
- if (retval)
-- goto error6;
-+ goto err_delete_timer;
-
- return 0;
--error6:
-- del_timer_sync(&vub300->inactivity_timer);
-+
-+err_delete_timer:
-+ timer_delete_sync(&vub300->inactivity_timer);
- err_free_host:
- mmc_free_host(mmc);
- /*
- * and hence also frees vub300
- * which is contained at the end of struct mmc
- */
--error4:
-+err_free_res_urb:
- usb_free_urb(command_res_urb);
--error1:
-+err_free_out_urb:
- usb_free_urb(command_out_urb);
--error0:
-+err_put_udev:
- usb_put_dev(udev);
-+
- return retval;
- }
-
workqueue-add-system_percpu_wq-and-system_dfl_wq.patch
tracing-user_events-fix-use-after-free-in-user_event_mm_dup.patch
wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch
-mmc-vub300-fix-use-after-free-on-disconnect.patch
-mmc-vub300-rename-probe-error-labels.patch
-mmc-vub300-fix-use-after-free-on-probe-failure.patch
locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch
net-mana-validate-the-packet-length-reported-by-the-nic.patch
pinctrl-remove-pinctrl_gpio_direction_output.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
