From: Greg Kroah-Hartman Date: Fri, 31 Jul 2026 06:51:55 +0000 (+0200) Subject: drop some vub300 patches that were incorrect X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=0fade09deda1ff60c8f75b81d83ab2943961edbf;p=thirdparty%2Fkernel%2Fstable-queue.git drop some vub300 patches that were incorrect --- diff --git a/queue-6.12/mmc-vub300-fix-use-after-free-on-disconnect.patch b/queue-6.12/mmc-vub300-fix-use-after-free-on-disconnect.patch deleted file mode 100644 index 09a464d234..0000000000 --- a/queue-6.12/mmc-vub300-fix-use-after-free-on-disconnect.patch +++ /dev/null @@ -1,90 +0,0 @@ -From stable+bounces-289742-greg=kroah.com@vger.kernel.org Tue Jul 28 01:37:22 2026 -From: Sasha Levin -Date: Mon, 27 Jul 2026 19:34:42 -0400 -Subject: mmc: vub300: fix use-after-free on disconnect -To: stable@vger.kernel.org -Cc: Johan Hovold , Binbin Zhou , Ulf Hansson -Message-ID: <20260727233445.2426041-1-sashal@kernel.org> - -From: Johan Hovold - -The vub300 driver maintains an explicit reference count for the -controller and its driver data and the last reference can in theory be -dropped after the driver has been unbound. - -This specifically means that the controller allocation must not be -device managed as that can lead to use-after-free. - -Note that the lifetime is currently also incorrectly tied the parent USB -device rather than interface, which can lead to memory leaks if the -driver is unbound without its device being physically disconnected (e.g. -on probe deferral). - -Fix both issues by reverting to non-managed allocation of the controller. - -Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper") -Cc: stable@vger.kernel.org # 6.17+ -Cc: Binbin Zhou -Signed-off-by: Johan Hovold -Signed-off-by: Ulf Hansson -(cherry picked from commit 8f4d20a710225ec7a565f6a0459862d3b1f32330) -Signed-off-by: Greg Kroah-Hartman ---- - drivers/mmc/host/vub300.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - ---- a/drivers/mmc/host/vub300.c -+++ b/drivers/mmc/host/vub300.c -@@ -2279,7 +2279,7 @@ static int vub300_probe(struct usb_inter - dev_err(&vub300->udev->dev, - "Could not find two sets of bulk-in/out endpoint pairs\n"); - retval = -EINVAL; -- goto error5; -+ goto err_free_host; - } - retval = - usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0), -@@ -2288,14 +2288,14 @@ static int vub300_probe(struct usb_inter - 0x0000, 0x0000, &vub300->hc_info, - sizeof(vub300->hc_info), 1000); - if (retval < 0) -- goto error5; -+ goto err_free_host; - retval = - usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), - SET_ROM_WAIT_STATES, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - firmware_rom_wait_states, 0x0000, NULL, 0, 1000); - if (retval < 0) -- goto error5; -+ goto err_free_host; - dev_info(&vub300->udev->dev, - "operating_mode = %s %s %d MHz %s %d byte USB packets\n", - (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL", -@@ -2310,7 +2310,7 @@ static int vub300_probe(struct usb_inter - 0x0000, 0x0000, &vub300->system_port_status, - sizeof(vub300->system_port_status), 1000); - if (retval < 0) { -- goto error5; -+ goto err_free_host; - } else if (sizeof(vub300->system_port_status) == retval) { - vub300->card_present = - (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0; -@@ -2318,7 +2318,7 @@ static int vub300_probe(struct usb_inter - (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0; - } else { - retval = -EINVAL; -- goto error5; -+ goto err_free_host; - } - usb_set_intfdata(interface, vub300); - INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread); -@@ -2348,7 +2348,7 @@ static int vub300_probe(struct usb_inter - return 0; - error6: - del_timer_sync(&vub300->inactivity_timer); --error5: -+err_free_host: - mmc_free_host(mmc); - /* - * and hence also frees vub300 diff --git a/queue-6.12/mmc-vub300-fix-use-after-free-on-probe-failure.patch b/queue-6.12/mmc-vub300-fix-use-after-free-on-probe-failure.patch deleted file mode 100644 index 0473f0fb85..0000000000 --- a/queue-6.12/mmc-vub300-fix-use-after-free-on-probe-failure.patch +++ /dev/null @@ -1,87 +0,0 @@ -From stable+bounces-289744-greg=kroah.com@vger.kernel.org Tue Jul 28 01:38:01 2026 -From: Sasha Levin -Date: Mon, 27 Jul 2026 19:34:44 -0400 -Subject: mmc: vub300: fix use-after-free on probe failure -To: stable@vger.kernel.org -Cc: Guangshuo Li , Johan Hovold , Ulf Hansson -Message-ID: <20260727233445.2426041-3-sashal@kernel.org> - -From: Guangshuo Li - -The vub300 driver lifetime-manages its controller state using -vub300->kref, with vub300_delete() freeing the mmc host when the last -reference is dropped. The probe error path after the inactivity timer has -been armed still bypasses that lifetime rule, however, and falls through -to mmc_free_host() directly if mmc_add_host() fails. - -The race window is between arming the inactivity timer and reaching the -probe error unwind after mmc_add_host() fails: - - probe thread timer/workqueue - ------------ --------------- - kref_init(&vub300->kref) ref = 1 - kref_get(&vub300->kref) ref = 2, timer ref - add_timer(inactivity_timer) fires after one second - | - | race window - |<----------------------------------------------------> - | - mmc_add_host(mmc) - inactivity timer fires - vub300_queue_dead_work() - kref_get() ref = 3 - queue_work(deadwork) - mmc_add_host() fails - timer_delete_sync() - mmc_free_host(mmc) - frees vub300 - deadwork runs - use-after-free - -The inactivity timeout is one second, so this would require -mmc_add_host() to both fail and take more than one second to do so. This -is unlikely to happen in practice, but the error path is still wrong. - -timer_delete_sync() only waits for the timer callback itself. It does -not flush deadwork that the callback may already have queued. As a -result, queued deadwork can still hold a kref while the probe error path -directly frees the backing mmc host, including the vub300 storage. - -Fix this by using the same lifetime mechanism as disconnect. Clear -vub300->interface so that the timer callback and any queued deadwork -return early and drop their references, then drop the initial probe -reference and return without falling through to err_free_host. - -Fixes: 0613ad2401f8 ("mmc: vub300: fix return value check of mmc_add_host()") -Signed-off-by: Guangshuo Li -Reviewed-by: Johan Hovold -Cc: stable@vger.kernel.org -Signed-off-by: Ulf Hansson -(cherry picked from commit a3b5f242997a3be7404112fd48784881560aea57) -Signed-off-by: Greg Kroah-Hartman ---- - drivers/mmc/host/vub300.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - ---- a/drivers/mmc/host/vub300.c -+++ b/drivers/mmc/host/vub300.c -@@ -2343,12 +2343,16 @@ static int vub300_probe(struct usb_inter - interface_to_InterfaceNumber(interface)); - retval = mmc_add_host(mmc); - if (retval) -- goto err_delete_timer; -+ goto err_stop_io; - - return 0; - --err_delete_timer: -- timer_delete_sync(&vub300->inactivity_timer); -+err_stop_io: -+ vub300->interface = NULL; -+ kref_put(&vub300->kref, vub300_delete); -+ -+ return retval; -+ - err_free_host: - mmc_free_host(mmc); - /* diff --git a/queue-6.12/mmc-vub300-rename-probe-error-labels.patch b/queue-6.12/mmc-vub300-rename-probe-error-labels.patch deleted file mode 100644 index b8ccb85413..0000000000 --- a/queue-6.12/mmc-vub300-rename-probe-error-labels.patch +++ /dev/null @@ -1,79 +0,0 @@ -From stable+bounces-289743-greg=kroah.com@vger.kernel.org Tue Jul 28 01:34:53 2026 -From: Sasha Levin -Date: Mon, 27 Jul 2026 19:34:43 -0400 -Subject: mmc: vub300: rename probe error labels -To: stable@vger.kernel.org -Cc: Johan Hovold , Ulf Hansson -Message-ID: <20260727233445.2426041-2-sashal@kernel.org> - -From: Johan Hovold - -Error labels should be named after what they do. - -Rename the probe error labels. - -Signed-off-by: Johan Hovold -Signed-off-by: Ulf Hansson -(cherry picked from commit 5b8b35d6f4fa758dd5e8ae18526ea1c73f6787e0) -Signed-off-by: Greg Kroah-Hartman ---- - drivers/mmc/host/vub300.c | 20 +++++++++++--------- - 1 file changed, 11 insertions(+), 9 deletions(-) - ---- a/drivers/mmc/host/vub300.c -+++ b/drivers/mmc/host/vub300.c -@@ -2114,19 +2114,19 @@ static int vub300_probe(struct usb_inter - command_out_urb = usb_alloc_urb(0, GFP_KERNEL); - if (!command_out_urb) { - retval = -ENOMEM; -- goto error0; -+ goto err_put_udev; - } - command_res_urb = usb_alloc_urb(0, GFP_KERNEL); - if (!command_res_urb) { - retval = -ENOMEM; -- goto error1; -+ goto err_free_out_urb; - } - /* this also allocates memory for our VUB300 mmc host device */ - mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev); - if (!mmc) { - retval = -ENOMEM; - dev_err(&udev->dev, "not enough memory for the mmc_host\n"); -- goto error4; -+ goto err_free_res_urb; - } - /* MMC core transfer sizes tunable parameters */ - mmc->caps = 0; -@@ -2343,23 +2343,25 @@ static int vub300_probe(struct usb_inter - interface_to_InterfaceNumber(interface)); - retval = mmc_add_host(mmc); - if (retval) -- goto error6; -+ goto err_delete_timer; - - return 0; --error6: -- del_timer_sync(&vub300->inactivity_timer); -+ -+err_delete_timer: -+ timer_delete_sync(&vub300->inactivity_timer); - err_free_host: - mmc_free_host(mmc); - /* - * and hence also frees vub300 - * which is contained at the end of struct mmc - */ --error4: -+err_free_res_urb: - usb_free_urb(command_res_urb); --error1: -+err_free_out_urb: - usb_free_urb(command_out_urb); --error0: -+err_put_udev: - usb_put_dev(udev); -+ - return retval; - } - diff --git a/queue-6.12/series b/queue-6.12/series index b9b98ff15e..21c635863c 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -549,9 +549,6 @@ cred-add-kernel_cred-helper.patch cred-add-scoped_with_kernel_creds.patch dm-avoid-leaking-the-caller-s-thread-keyring-via-the-table-device-file.patch wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch -mmc-vub300-fix-use-after-free-on-disconnect.patch -mmc-vub300-rename-probe-error-labels.patch -mmc-vub300-fix-use-after-free-on-probe-failure.patch locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch net-mana-validate-the-packet-length-reported-by-the-nic.patch net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch diff --git a/queue-6.6/mmc-vub300-fix-use-after-free-on-disconnect.patch b/queue-6.6/mmc-vub300-fix-use-after-free-on-disconnect.patch deleted file mode 100644 index e963d13783..0000000000 --- a/queue-6.6/mmc-vub300-fix-use-after-free-on-disconnect.patch +++ /dev/null @@ -1,90 +0,0 @@ -From stable+bounces-289774-greg=kroah.com@vger.kernel.org Tue Jul 28 02:59:39 2026 -From: Sasha Levin -Date: Mon, 27 Jul 2026 20:58:03 -0400 -Subject: mmc: vub300: fix use-after-free on disconnect -To: stable@vger.kernel.org -Cc: Johan Hovold , Binbin Zhou , Ulf Hansson -Message-ID: <20260728005806.2694893-1-sashal@kernel.org> - -From: Johan Hovold - -The vub300 driver maintains an explicit reference count for the -controller and its driver data and the last reference can in theory be -dropped after the driver has been unbound. - -This specifically means that the controller allocation must not be -device managed as that can lead to use-after-free. - -Note that the lifetime is currently also incorrectly tied the parent USB -device rather than interface, which can lead to memory leaks if the -driver is unbound without its device being physically disconnected (e.g. -on probe deferral). - -Fix both issues by reverting to non-managed allocation of the controller. - -Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper") -Cc: stable@vger.kernel.org # 6.17+ -Cc: Binbin Zhou -Signed-off-by: Johan Hovold -Signed-off-by: Ulf Hansson -(cherry picked from commit 8f4d20a710225ec7a565f6a0459862d3b1f32330) -Signed-off-by: Greg Kroah-Hartman ---- - drivers/mmc/host/vub300.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - ---- a/drivers/mmc/host/vub300.c -+++ b/drivers/mmc/host/vub300.c -@@ -2279,7 +2279,7 @@ static int vub300_probe(struct usb_inter - dev_err(&vub300->udev->dev, - "Could not find two sets of bulk-in/out endpoint pairs\n"); - retval = -EINVAL; -- goto error5; -+ goto err_free_host; - } - retval = - usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0), -@@ -2288,14 +2288,14 @@ static int vub300_probe(struct usb_inter - 0x0000, 0x0000, &vub300->hc_info, - sizeof(vub300->hc_info), 1000); - if (retval < 0) -- goto error5; -+ goto err_free_host; - retval = - usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), - SET_ROM_WAIT_STATES, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - firmware_rom_wait_states, 0x0000, NULL, 0, 1000); - if (retval < 0) -- goto error5; -+ goto err_free_host; - dev_info(&vub300->udev->dev, - "operating_mode = %s %s %d MHz %s %d byte USB packets\n", - (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL", -@@ -2310,7 +2310,7 @@ static int vub300_probe(struct usb_inter - 0x0000, 0x0000, &vub300->system_port_status, - sizeof(vub300->system_port_status), 1000); - if (retval < 0) { -- goto error5; -+ goto err_free_host; - } else if (sizeof(vub300->system_port_status) == retval) { - vub300->card_present = - (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0; -@@ -2318,7 +2318,7 @@ static int vub300_probe(struct usb_inter - (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0; - } else { - retval = -EINVAL; -- goto error5; -+ goto err_free_host; - } - usb_set_intfdata(interface, vub300); - INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread); -@@ -2348,7 +2348,7 @@ static int vub300_probe(struct usb_inter - return 0; - error6: - del_timer_sync(&vub300->inactivity_timer); --error5: -+err_free_host: - mmc_free_host(mmc); - /* - * and hence also frees vub300 diff --git a/queue-6.6/mmc-vub300-fix-use-after-free-on-probe-failure.patch b/queue-6.6/mmc-vub300-fix-use-after-free-on-probe-failure.patch deleted file mode 100644 index 01305de9cf..0000000000 --- a/queue-6.6/mmc-vub300-fix-use-after-free-on-probe-failure.patch +++ /dev/null @@ -1,87 +0,0 @@ -From stable+bounces-289776-greg=kroah.com@vger.kernel.org Tue Jul 28 02:59:45 2026 -From: Sasha Levin -Date: Mon, 27 Jul 2026 20:58:05 -0400 -Subject: mmc: vub300: fix use-after-free on probe failure -To: stable@vger.kernel.org -Cc: Guangshuo Li , Johan Hovold , Ulf Hansson -Message-ID: <20260728005806.2694893-3-sashal@kernel.org> - -From: Guangshuo Li - -The vub300 driver lifetime-manages its controller state using -vub300->kref, with vub300_delete() freeing the mmc host when the last -reference is dropped. The probe error path after the inactivity timer has -been armed still bypasses that lifetime rule, however, and falls through -to mmc_free_host() directly if mmc_add_host() fails. - -The race window is between arming the inactivity timer and reaching the -probe error unwind after mmc_add_host() fails: - - probe thread timer/workqueue - ------------ --------------- - kref_init(&vub300->kref) ref = 1 - kref_get(&vub300->kref) ref = 2, timer ref - add_timer(inactivity_timer) fires after one second - | - | race window - |<----------------------------------------------------> - | - mmc_add_host(mmc) - inactivity timer fires - vub300_queue_dead_work() - kref_get() ref = 3 - queue_work(deadwork) - mmc_add_host() fails - timer_delete_sync() - mmc_free_host(mmc) - frees vub300 - deadwork runs - use-after-free - -The inactivity timeout is one second, so this would require -mmc_add_host() to both fail and take more than one second to do so. This -is unlikely to happen in practice, but the error path is still wrong. - -timer_delete_sync() only waits for the timer callback itself. It does -not flush deadwork that the callback may already have queued. As a -result, queued deadwork can still hold a kref while the probe error path -directly frees the backing mmc host, including the vub300 storage. - -Fix this by using the same lifetime mechanism as disconnect. Clear -vub300->interface so that the timer callback and any queued deadwork -return early and drop their references, then drop the initial probe -reference and return without falling through to err_free_host. - -Fixes: 0613ad2401f8 ("mmc: vub300: fix return value check of mmc_add_host()") -Signed-off-by: Guangshuo Li -Reviewed-by: Johan Hovold -Cc: stable@vger.kernel.org -Signed-off-by: Ulf Hansson -(cherry picked from commit a3b5f242997a3be7404112fd48784881560aea57) -Signed-off-by: Greg Kroah-Hartman ---- - drivers/mmc/host/vub300.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - ---- a/drivers/mmc/host/vub300.c -+++ b/drivers/mmc/host/vub300.c -@@ -2343,12 +2343,16 @@ static int vub300_probe(struct usb_inter - interface_to_InterfaceNumber(interface)); - retval = mmc_add_host(mmc); - if (retval) -- goto err_delete_timer; -+ goto err_stop_io; - - return 0; - --err_delete_timer: -- timer_delete_sync(&vub300->inactivity_timer); -+err_stop_io: -+ vub300->interface = NULL; -+ kref_put(&vub300->kref, vub300_delete); -+ -+ return retval; -+ - err_free_host: - mmc_free_host(mmc); - /* diff --git a/queue-6.6/mmc-vub300-rename-probe-error-labels.patch b/queue-6.6/mmc-vub300-rename-probe-error-labels.patch deleted file mode 100644 index d4c0d0c739..0000000000 --- a/queue-6.6/mmc-vub300-rename-probe-error-labels.patch +++ /dev/null @@ -1,79 +0,0 @@ -From stable+bounces-289775-greg=kroah.com@vger.kernel.org Tue Jul 28 02:59:41 2026 -From: Sasha Levin -Date: Mon, 27 Jul 2026 20:58:04 -0400 -Subject: mmc: vub300: rename probe error labels -To: stable@vger.kernel.org -Cc: Johan Hovold , Ulf Hansson -Message-ID: <20260728005806.2694893-2-sashal@kernel.org> - -From: Johan Hovold - -Error labels should be named after what they do. - -Rename the probe error labels. - -Signed-off-by: Johan Hovold -Signed-off-by: Ulf Hansson -(cherry picked from commit 5b8b35d6f4fa758dd5e8ae18526ea1c73f6787e0) -Signed-off-by: Greg Kroah-Hartman ---- - drivers/mmc/host/vub300.c | 20 +++++++++++--------- - 1 file changed, 11 insertions(+), 9 deletions(-) - ---- a/drivers/mmc/host/vub300.c -+++ b/drivers/mmc/host/vub300.c -@@ -2114,19 +2114,19 @@ static int vub300_probe(struct usb_inter - command_out_urb = usb_alloc_urb(0, GFP_KERNEL); - if (!command_out_urb) { - retval = -ENOMEM; -- goto error0; -+ goto err_put_udev; - } - command_res_urb = usb_alloc_urb(0, GFP_KERNEL); - if (!command_res_urb) { - retval = -ENOMEM; -- goto error1; -+ goto err_free_out_urb; - } - /* this also allocates memory for our VUB300 mmc host device */ - mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev); - if (!mmc) { - retval = -ENOMEM; - dev_err(&udev->dev, "not enough memory for the mmc_host\n"); -- goto error4; -+ goto err_free_res_urb; - } - /* MMC core transfer sizes tunable parameters */ - mmc->caps = 0; -@@ -2343,23 +2343,25 @@ static int vub300_probe(struct usb_inter - interface_to_InterfaceNumber(interface)); - retval = mmc_add_host(mmc); - if (retval) -- goto error6; -+ goto err_delete_timer; - - return 0; --error6: -- del_timer_sync(&vub300->inactivity_timer); -+ -+err_delete_timer: -+ timer_delete_sync(&vub300->inactivity_timer); - err_free_host: - mmc_free_host(mmc); - /* - * and hence also frees vub300 - * which is contained at the end of struct mmc - */ --error4: -+err_free_res_urb: - usb_free_urb(command_res_urb); --error1: -+err_free_out_urb: - usb_free_urb(command_out_urb); --error0: -+err_put_udev: - usb_put_dev(udev); -+ - return retval; - } - diff --git a/queue-6.6/series b/queue-6.6/series index b7b614c386..01ac1ccbad 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -453,9 +453,6 @@ workqueue-factor-out-init_cpu_worker_pool.patch workqueue-add-system_percpu_wq-and-system_dfl_wq.patch tracing-user_events-fix-use-after-free-in-user_event_mm_dup.patch wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch -mmc-vub300-fix-use-after-free-on-disconnect.patch -mmc-vub300-rename-probe-error-labels.patch -mmc-vub300-fix-use-after-free-on-probe-failure.patch locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch net-mana-validate-the-packet-length-reported-by-the-nic.patch pinctrl-remove-pinctrl_gpio_direction_output.patch