From: Greg Kroah-Hartman Date: Tue, 9 Jun 2026 10:50:25 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=c03ae08f7596b676dd64937cba8f5a904d74bf1b;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: bluetooth-hci_conn-fix-potential-uaf-in-set_cig_para.patch bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch disable-wattribute-alias-for-clang-23-and-newer.patch hwmon-pmbus-core-protect-regulator-operations-with-m.patch rdma-rxe-fix-trying-to-register-non-static-key-in-rx.patch usb-serial-mct_u232-fix-memory-corruption-with-small.patch --- diff --git a/queue-6.6/bluetooth-hci_conn-fix-potential-uaf-in-set_cig_para.patch b/queue-6.6/bluetooth-hci_conn-fix-potential-uaf-in-set_cig_para.patch new file mode 100644 index 0000000000..8a63b3ec59 --- /dev/null +++ b/queue-6.6/bluetooth-hci_conn-fix-potential-uaf-in-set_cig_para.patch @@ -0,0 +1,57 @@ +From ea47648b6dfe7d9b309378d27e5e5605c365c91d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jun 2026 17:56:55 +0800 +Subject: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync + +From: Pauli Virtanen + +[ Upstream commit a2639a7f0f5bf7d73f337f8f077c19415c62ed2c ] + +hci_conn lookup and field access must be covered by hdev lock in +set_cig_params_sync, otherwise it's possible it is freed concurrently. + +Take hdev lock to prevent hci_conn from being deleted or modified +concurrently. Just RCU lock is not suitable here, as we also want to +avoid "tearing" in the configuration. + +Fixes: a091289218202 ("Bluetooth: hci_conn: Fix hci_le_set_cig_params") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +[ Minor context conflict resolved. ] +Signed-off-by: Alva Lan +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index f51c530a3c4583..ab86cc4a5e3fc8 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1734,9 +1734,13 @@ static int set_cig_params_sync(struct hci_dev *hdev, void *data) + struct iso_cig_params pdu; + u8 cis_id; + ++ hci_dev_lock(hdev); ++ + conn = hci_conn_hash_lookup_cig(hdev, cig_id); +- if (!conn) ++ if (!conn) { ++ hci_dev_unlock(hdev); + return 0; ++ } + + memset(&pdu, 0, sizeof(pdu)); + +@@ -1776,6 +1780,8 @@ static int set_cig_params_sync(struct hci_dev *hdev, void *data) + cis->p_rtn = qos->ucast.in.rtn; + } + ++ hci_dev_unlock(hdev); ++ + if (!pdu.cp.num_cis) + return 0; + +-- +2.53.0 + diff --git a/queue-6.6/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch b/queue-6.6/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch new file mode 100644 index 0000000000..97c8458a25 --- /dev/null +++ b/queue-6.6/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch @@ -0,0 +1,139 @@ +From 6098ee0b62b3c0aa85bf2f823b6e140c36da0368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Apr 2026 01:26:43 +0000 +Subject: bpf: Free reuseport cBPF prog after RCU grace period. + +From: Kuniyuki Iwashima + +[ Upstream commit 18fc650ccd7fe3376eca89203668cfb8268f60df ] + +Eulgyu Kim reported the splat below with a repro. [0] + +The repro sets up a UDP reuseport group with a cBPF prog and +replaces it with a new one while another thread is sending +a UDP packet to the group. + +The reuseport prog is freed by sk_reuseport_prog_free(). +bpf_prog_put() is called for "e"BPF prog to destruct through +multiple stages while cBPF prog is freed immediately by +bpf_release_orig_filter() and bpf_prog_free(). + +If a reuseport prog is detached from the setsockopt() path +(reuseport_attach_prog() or reuseport_detach_prog()), +sk_reuseport_prog_free() is called without waiting for RCU +readers to complete, resulting in various bugs. + +Let's defer freeing the reuseport cBPF prog after one RCU +grace period. + +Note "e"BPF prog is safe as is unless the fast path starts +to touch fields destroyed in bpf_prog_put_deferred() and +__bpf_prog_put_noref(). + +[0]: +BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 +Read of size 4 at addr ffffc9000051e004 by task slowme/10208 +CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full) +Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +Call Trace: + + dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0xca/0x240 mm/kasan/report.c:482 + kasan_report+0x118/0x150 mm/kasan/report.c:595 + reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 + udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495 + __udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723 + __udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752 + __udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752 + ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207 + ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 + NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 + NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 + __netif_receive_skb_one_core net/core/dev.c:6181 [inline] + __netif_receive_skb net/core/dev.c:6294 [inline] + process_backlog+0xaa4/0x1960 net/core/dev.c:6645 + __napi_poll+0xae/0x340 net/core/dev.c:7709 + napi_poll net/core/dev.c:7772 [inline] + net_rx_action+0x5d7/0xf50 net/core/dev.c:7929 + handle_softirqs+0x22b/0x870 kernel/softirq.c:622 + do_softirq+0x76/0xd0 kernel/softirq.c:523 + + + __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 + local_bh_enable include/linux/bottom_half.h:33 [inline] + rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline] + __dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890 + neigh_output include/net/neighbour.h:556 [inline] + ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237 + NF_HOOK_COND include/linux/netfilter.h:307 [inline] + ip_output+0x29f/0x450 net/ipv4/ip_output.c:438 + ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508 + udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195 + udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485 + sock_sendmsg_nosec net/socket.c:727 [inline] + __sock_sendmsg net/socket.c:742 [inline] + __sys_sendto+0x554/0x680 net/socket.c:2206 + __do_sys_sendto net/socket.c:2213 [inline] + __se_sys_sendto net/socket.c:2209 [inline] + __x64_sys_sendto+0xde/0x100 net/socket.c:2209 + do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] + do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x415a2d +Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c +RAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d +RDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003 +RBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010 +R10: 0000000000000000 R11: 0000000000000212 R12: 00007f6bc31e46c0 +R13: ffffffffffffffb8 R14: 0000000000000000 R15: 00007ffc9b0d70b0 + + +Fixes: 538950a1b752 ("soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF") +Reported-by: Eulgyu Kim +Reported-by: Taeyang Lee <0wn@theori.io> +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20260426012647.3233119-1-kuniyu@google.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index c33d896c7a6eef..2922f88311ca66 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1642,15 +1642,24 @@ int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk) + return err; + } + ++static void sk_reuseport_prog_free_rcu(struct rcu_head *rcu) ++{ ++ struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu); ++ struct bpf_prog *prog = aux->prog; ++ ++ bpf_release_orig_filter(prog); ++ bpf_prog_free(prog); ++} ++ + void sk_reuseport_prog_free(struct bpf_prog *prog) + { + if (!prog) + return; + +- if (prog->type == BPF_PROG_TYPE_SK_REUSEPORT) +- bpf_prog_put(prog); ++ if (bpf_prog_was_classic(prog)) ++ call_rcu(&prog->aux->rcu, sk_reuseport_prog_free_rcu); + else +- bpf_prog_destroy(prog); ++ bpf_prog_put(prog); + } + + struct bpf_scratchpad { +-- +2.53.0 + diff --git a/queue-6.6/disable-wattribute-alias-for-clang-23-and-newer.patch b/queue-6.6/disable-wattribute-alias-for-clang-23-and-newer.patch new file mode 100644 index 0000000000..2fa166e8c2 --- /dev/null +++ b/queue-6.6/disable-wattribute-alias-for-clang-23-and-newer.patch @@ -0,0 +1,123 @@ +From 3cf57aaba7fcf82208970ff86318850daa0eeb84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 May 2026 04:34:14 +0900 +Subject: Disable -Wattribute-alias for clang-23 and newer + +From: Nathan Chancellor + +commit 175db11786bde9061db526bf1ac5107d915f5163 upstream. + +Clang recently added support for -Wattribute-alias [1], which results in +the same warnings that necessitated commit bee20031772a ("disable +-Wattribute-alias warning for SYSCALL_DEFINEx()") for GCC. + + kernel/time/itimer.c:325:1: error: alias and aliasee have different types 'long (unsigned int)' and 'long (typeof (__builtin_choose_expr((__builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0LL)) || __builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0ULL))), 0LL, 0L)))' (aka 'long (long)') [-Werror,-Wattribute-alias] + 325 | SYSCALL_DEFINE1(alarm, unsigned int, seconds) + | ^ + include/linux/syscalls.h:225:36: note: expanded from macro 'SYSCALL_DEFINE1' + 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__) + | ^ + include/linux/syscalls.h:236:2: note: expanded from macro 'SYSCALL_DEFINEx' + 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) + | ^ + include/linux/syscalls.h:251:18: note: expanded from macro '__SYSCALL_DEFINEx' + 251 | __attribute__((alias(__stringify(__se_sys##name)))); \ + | ^ + kernel/time/itimer.c:325:1: note: aliasee is declared here + include/linux/syscalls.h:225:36: note: expanded from macro 'SYSCALL_DEFINE1' + 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__) + | ^ + include/linux/syscalls.h:236:2: note: expanded from macro 'SYSCALL_DEFINEx' + 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) + | ^ + include/linux/syscalls.h:255:18: note: expanded from macro '__SYSCALL_DEFINEx' + 255 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ + | ^ + :16:1: note: expanded from here + 16 | __se_sys_alarm + | ^ + +Disable the warnings in the same way for clang-23 and newer. Disable the +warning about unknown warning options to avoid breaking the build for +versions of clang-23 that do not have -Wattribute-alias, such as ones +deployed by vendors like Android or CI systems or when bisecting LLVM +between llvmorg-23-init and release/23.x. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/2163 +Link: https://github.com/llvm/llvm-project/commit/40da6920a0d71d49dfa2392b09153600b0759f5e [1] +Link: https://patch.msgid.link/20260515-syscall-disable-attribute-alias-for-clang-v1-1-9a9d95d41df6@kernel.org +[nathan: Drop arch/riscv hunk in older trees and address conflicts] +Signed-off-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + include/linux/compat.h | 4 ++++ + include/linux/compiler-clang.h | 6 ++++++ + include/linux/compiler_types.h | 4 ++++ + include/linux/syscalls.h | 4 ++++ + 4 files changed, 18 insertions(+) + +diff --git a/include/linux/compat.h b/include/linux/compat.h +index 5981d3eadaee1e..7a55636cc98454 100644 +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -72,6 +72,10 @@ + __diag_push(); \ + __diag_ignore(GCC, 8, "-Wattribute-alias", \ + "Type aliasing is used to sanitize syscall arguments");\ ++ __diag_ignore(clang, 23, "-Wunknown-warning-option", \ ++ "Avoid breaking versions without -Wattribute-alias"); \ ++ __diag_ignore(clang, 23, "-Wattribute-alias", \ ++ "Type aliasing is used to sanitize syscall arguments"); \ + asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ + __attribute__((alias(__stringify(__se_compat_sys##name)))); \ + ALLOW_ERROR_INJECTION(compat_sys##name, ERRNO); \ +diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h +index f9de53fff3acc4..2fd5b596b36b5c 100644 +--- a/include/linux/compiler-clang.h ++++ b/include/linux/compiler-clang.h +@@ -144,5 +144,11 @@ + #define __diag_clang_11(s) + #endif + ++#if CONFIG_CLANG_VERSION >= 230000 ++#define __diag_clang_23(s) __diag(s) ++#else ++#define __diag_clang_23(s) ++#endif ++ + #define __diag_ignore_all(option, comment) \ + __diag_clang(11, ignore, option) +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index b63da6b03d3382..ed1c107124e4e1 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -486,6 +486,10 @@ struct ftrace_likely_data { + #define __diag_GCC(version, severity, string) + #endif + ++#ifndef __diag_clang ++#define __diag_clang(version, severity, string) ++#endif ++ + #define __diag_push() __diag(push) + #define __diag_pop() __diag(pop) + +diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h +index 36c592e43d6520..8109d9f0ede62d 100644 +--- a/include/linux/syscalls.h ++++ b/include/linux/syscalls.h +@@ -242,6 +242,10 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event) + __diag_push(); \ + __diag_ignore(GCC, 8, "-Wattribute-alias", \ + "Type aliasing is used to sanitize syscall arguments");\ ++ __diag_ignore(clang, 23, "-Wunknown-warning-option", \ ++ "Avoid breaking versions without -Wattribute-alias");\ ++ __diag_ignore(clang, 23, "-Wattribute-alias", \ ++ "Type aliasing is used to sanitize syscall arguments");\ + asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ + __attribute__((alias(__stringify(__se_sys##name)))); \ + ALLOW_ERROR_INJECTION(sys##name, ERRNO); \ +-- +2.53.0 + diff --git a/queue-6.6/hwmon-pmbus-core-protect-regulator-operations-with-m.patch b/queue-6.6/hwmon-pmbus-core-protect-regulator-operations-with-m.patch new file mode 100644 index 0000000000..e95d70f3b3 --- /dev/null +++ b/queue-6.6/hwmon-pmbus-core-protect-regulator-operations-with-m.patch @@ -0,0 +1,261 @@ +From 13674af8b61df5b87c70af55b9d837a65443b351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jun 2026 14:20:22 +0800 +Subject: hwmon: (pmbus/core) Protect regulator operations with mutex + +From: Guenter Roeck + +[ Upstream commit 754bd2b4a084b90b5e7b630e1f423061a9b9b761 ] + +The regulator operations pmbus_regulator_get_voltage(), +pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() +access PMBus registers and shared data but were not protected by +the update_lock mutex. This could lead to race conditions. + +However, adding mutex protection directly to these functions causes +a deadlock because pmbus_regulator_notify() (which calls +regulator_notifier_call_chain()) is often called with the mutex +already held (e.g., from pmbus_fault_handler()). If a regulator +callback then calls one of the now-protected voltage functions, +it will attempt to acquire the same mutex. + +Rework pmbus_regulator_notify() to utilize a worker function to +send notifications outside of the mutex protection. Events are +stored as atomics in a per-page bitmask and processed by the worker. + +Initialize the worker and its associated data during regulator +registration, and ensure it is cancelled on device removal using +devm_add_action_or_reset(). + +While at it, remove the unnecessary include of linux/of.h. + +Cc: Sanman Pradhan +Fixes: ddbb4db4ced1b ("hwmon: (pmbus) Add regulator support") +Reviewed-by: Sanman Pradhan +Signed-off-by: Guenter Roeck +Signed-off-by: Fang Wang <32840572@qq.com> +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/pmbus_core.c | 117 ++++++++++++++++++++++++------- + 1 file changed, 91 insertions(+), 26 deletions(-) + +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index 019c5982ba564b..a61e2fb176da78 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -6,6 +6,7 @@ + * Copyright (c) 2012 Guenter Roeck + */ + ++#include + #include + #include + #include +@@ -19,8 +20,8 @@ + #include + #include + #include +-#include + #include ++#include + #include "pmbus.h" + + /* +@@ -102,6 +103,11 @@ struct pmbus_data { + + struct mutex update_lock; + ++#if IS_ENABLED(CONFIG_REGULATOR) ++ atomic_t regulator_events[PMBUS_PAGES]; ++ struct work_struct regulator_notify_work; ++#endif ++ + bool has_status_word; /* device uses STATUS_WORD register */ + int (*read_status)(struct i2c_client *client, int page); + +@@ -3056,12 +3062,19 @@ static int pmbus_regulator_get_voltage(struct regulator_dev *rdev) + .class = PSC_VOLTAGE_OUT, + .convert = true, + }; ++ int ret; + ++ mutex_lock(&data->update_lock); + s.data = _pmbus_read_word_data(client, s.page, 0xff, PMBUS_READ_VOUT); +- if (s.data < 0) +- return s.data; ++ if (s.data < 0) { ++ ret = s.data; ++ goto unlock; ++ } + +- return (int)pmbus_reg2data(data, &s) * 1000; /* unit is uV */ ++ ret = (int)pmbus_reg2data(data, &s) * 1000; /* unit is uV */ ++unlock: ++ mutex_unlock(&data->update_lock); ++ return ret; + } + + static int pmbus_regulator_set_voltage(struct regulator_dev *rdev, int min_uv, +@@ -3078,16 +3091,22 @@ static int pmbus_regulator_set_voltage(struct regulator_dev *rdev, int min_uv, + }; + int val = DIV_ROUND_CLOSEST(min_uv, 1000); /* convert to mV */ + int low, high; ++ int ret; + + *selector = 0; + ++ mutex_lock(&data->update_lock); + low = pmbus_regulator_get_low_margin(client, s.page); +- if (low < 0) +- return low; ++ if (low < 0) { ++ ret = low; ++ goto unlock; ++ } + + high = pmbus_regulator_get_high_margin(client, s.page); +- if (high < 0) +- return high; ++ if (high < 0) { ++ ret = high; ++ goto unlock; ++ } + + /* Make sure we are within margins */ + if (low > val) +@@ -3097,7 +3116,10 @@ static int pmbus_regulator_set_voltage(struct regulator_dev *rdev, int min_uv, + + val = pmbus_data2reg(data, &s, val); + +- return _pmbus_write_word_data(client, s.page, PMBUS_VOUT_COMMAND, (u16)val); ++ ret = _pmbus_write_word_data(client, s.page, PMBUS_VOUT_COMMAND, (u16)val); ++unlock: ++ mutex_unlock(&data->update_lock); ++ return ret; + } + + static int pmbus_regulator_list_voltage(struct regulator_dev *rdev, +@@ -3105,7 +3127,9 @@ static int pmbus_regulator_list_voltage(struct regulator_dev *rdev, + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + int val, low, high; ++ int ret; + + if (selector >= rdev->desc->n_voltages || + selector < rdev->desc->linear_min_sel) +@@ -3115,18 +3139,29 @@ static int pmbus_regulator_list_voltage(struct regulator_dev *rdev, + val = DIV_ROUND_CLOSEST(rdev->desc->min_uV + + (rdev->desc->uV_step * selector), 1000); /* convert to mV */ + ++ mutex_lock(&data->update_lock); ++ + low = pmbus_regulator_get_low_margin(client, rdev_get_id(rdev)); +- if (low < 0) +- return low; ++ if (low < 0) { ++ ret = low; ++ goto unlock; ++ } + + high = pmbus_regulator_get_high_margin(client, rdev_get_id(rdev)); +- if (high < 0) +- return high; ++ if (high < 0) { ++ ret = high; ++ goto unlock; ++ } + +- if (val >= low && val <= high) +- return val * 1000; /* unit is uV */ ++ if (val >= low && val <= high) { ++ ret = val * 1000; /* unit is uV */ ++ goto unlock; ++ } + +- return 0; ++ ret = 0; ++unlock: ++ mutex_unlock(&data->update_lock); ++ return ret; + } + + const struct regulator_ops pmbus_regulator_ops = { +@@ -3141,12 +3176,42 @@ const struct regulator_ops pmbus_regulator_ops = { + }; + EXPORT_SYMBOL_NS_GPL(pmbus_regulator_ops, PMBUS); + ++static void pmbus_regulator_notify_work_cancel(void *data) ++{ ++ struct pmbus_data *pdata = data; ++ ++ cancel_work_sync(&pdata->regulator_notify_work); ++} ++ ++static void pmbus_regulator_notify_worker(struct work_struct *work) ++{ ++ struct pmbus_data *data = ++ container_of(work, struct pmbus_data, regulator_notify_work); ++ int i, j; ++ ++ for (i = 0; i < data->info->pages; i++) { ++ int event; ++ ++ event = atomic_xchg(&data->regulator_events[i], 0); ++ if (!event) ++ continue; ++ ++ for (j = 0; j < data->info->num_regulators; j++) { ++ if (i == rdev_get_id(data->rdevs[j])) { ++ regulator_notifier_call_chain(data->rdevs[j], ++ event, NULL); ++ break; ++ } ++ } ++ } ++} ++ + static int pmbus_regulator_register(struct pmbus_data *data) + { + struct device *dev = data->dev; + const struct pmbus_driver_info *info = data->info; + const struct pmbus_platform_data *pdata = dev_get_platdata(dev); +- int i; ++ int i, ret; + + data->rdevs = devm_kzalloc(dev, sizeof(struct regulator_dev *) * info->num_regulators, + GFP_KERNEL); +@@ -3170,20 +3235,20 @@ static int pmbus_regulator_register(struct pmbus_data *data) + info->reg_desc[i].name); + } + ++ INIT_WORK(&data->regulator_notify_work, pmbus_regulator_notify_worker); ++ ++ ret = devm_add_action_or_reset(dev, pmbus_regulator_notify_work_cancel, data); ++ if (ret) ++ return ret; ++ + return 0; + } + + static int pmbus_regulator_notify(struct pmbus_data *data, int page, int event) + { +- int j; +- +- for (j = 0; j < data->info->num_regulators; j++) { +- if (page == rdev_get_id(data->rdevs[j])) { +- regulator_notifier_call_chain(data->rdevs[j], event, NULL); +- break; +- } +- } +- return 0; ++ atomic_or(event, &data->regulator_events[page]); ++ schedule_work(&data->regulator_notify_work); ++ return 0; + } + #else + static int pmbus_regulator_register(struct pmbus_data *data) +-- +2.53.0 + diff --git a/queue-6.6/rdma-rxe-fix-trying-to-register-non-static-key-in-rx.patch b/queue-6.6/rdma-rxe-fix-trying-to-register-non-static-key-in-rx.patch new file mode 100644 index 0000000000..5612aa3282 --- /dev/null +++ b/queue-6.6/rdma-rxe-fix-trying-to-register-non-static-key-in-rx.patch @@ -0,0 +1,94 @@ +From 6b08f4115ae7c2456349ae4e4b1ac19bdcdd3169 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jun 2026 19:55:44 +0300 +Subject: RDMA/rxe: Fix "trying to register non-static key in + rxe_qp_do_cleanup" bug + +From: Zhu Yanjun + +commit 1c7eec4d5f3b39cdea2153abaebf1b7229a47072 upstream. + +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + assign_lock_key kernel/locking/lockdep.c:986 [inline] + register_lock_class+0x4a3/0x4c0 kernel/locking/lockdep.c:1300 + __lock_acquire+0x99/0x1ba0 kernel/locking/lockdep.c:5110 + lock_acquire kernel/locking/lockdep.c:5866 [inline] + lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5823 + __timer_delete_sync+0x152/0x1b0 kernel/time/timer.c:1644 + rxe_qp_do_cleanup+0x5c3/0x7e0 drivers/infiniband/sw/rxe/rxe_qp.c:815 + execute_in_process_context+0x3a/0x160 kernel/workqueue.c:4596 + __rxe_cleanup+0x267/0x3c0 drivers/infiniband/sw/rxe/rxe_pool.c:232 + rxe_create_qp+0x3f7/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:604 + create_qp+0x62d/0xa80 drivers/infiniband/core/verbs.c:1250 + ib_create_qp_kernel+0x9f/0x310 drivers/infiniband/core/verbs.c:1361 + ib_create_qp include/rdma/ib_verbs.h:3803 [inline] + rdma_create_qp+0x10c/0x340 drivers/infiniband/core/cma.c:1144 + rds_ib_setup_qp+0xc86/0x19a0 net/rds/ib_cm.c:600 + rds_ib_cm_initiate_connect+0x1e8/0x3d0 net/rds/ib_cm.c:944 + rds_rdma_cm_event_handler_cmn+0x61f/0x8c0 net/rds/rdma_transport.c:109 + cma_cm_event_handler+0x94/0x300 drivers/infiniband/core/cma.c:2184 + cma_work_handler+0x15b/0x230 drivers/infiniband/core/cma.c:3042 + process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 + process_scheduled_works kernel/workqueue.c:3319 [inline] + worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 + kthread+0x3c2/0x780 kernel/kthread.c:464 + ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 + + +The root cause is as below: + +In the function rxe_create_qp, the function rxe_qp_from_init is called +to create qp, if this function rxe_qp_from_init fails, rxe_cleanup will +be called to handle all the allocated resources, including the timers: +retrans_timer and rnr_nak_timer. + +The function rxe_qp_from_init calls the function rxe_qp_init_req to +initialize the timers: retrans_timer and rnr_nak_timer. + +But these timers are initialized in the end of rxe_qp_init_req. +If some errors occur before the initialization of these timers, this +problem will occur. + +The solution is to check whether these timers are initialized or not. +If these timers are not initialized, ignore these timers. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Reported-by: syzbot+4edb496c3cad6e953a31@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=4edb496c3cad6e953a31 +Signed-off-by: Zhu Yanjun +Link: https://patch.msgid.link/20250419080741.1515231-1-yanjun.zhu@linux.dev +Signed-off-by: Leon Romanovsky +[ Vladislav: keep del_timer_sync() because linux-6.6.y has not renamed it + to timer_delete_sync() yet. The actual fix is unchanged: check the timer + .function fields before deleting the timers. ] +Signed-off-by: Vladislav Nikolaev +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 287fc8b8f5bafe..8426c261c263a9 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -817,7 +817,12 @@ static void rxe_qp_do_cleanup(struct work_struct *work) + spin_unlock_irqrestore(&qp->state_lock, flags); + qp->qp_timeout_jiffies = 0; + +- if (qp_type(qp) == IB_QPT_RC) { ++ /* In the function timer_setup, .function is initialized. If .function ++ * is NULL, it indicates the function timer_setup is not called, the ++ * timer is not initialized. Or else, the timer is initialized. ++ */ ++ if (qp_type(qp) == IB_QPT_RC && qp->retrans_timer.function && ++ qp->rnr_nak_timer.function) { + del_timer_sync(&qp->retrans_timer); + del_timer_sync(&qp->rnr_nak_timer); + } +-- +2.53.0 + diff --git a/queue-6.6/series b/queue-6.6/series index e4809e7b04..239da65d79 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -201,3 +201,9 @@ hid-core-add-printk_ratelimited-variants-to-hid_warn-etc.patch hid-pass-the-buffer-size-to-hid_report_raw_event.patch hid-core-fix-size_t-specifier-in-hid_report_raw_event.patch usb-core-fix-superspeed-root-hub-wmaxpacketsize.patch +bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch +usb-serial-mct_u232-fix-memory-corruption-with-small.patch +bluetooth-hci_conn-fix-potential-uaf-in-set_cig_para.patch +rdma-rxe-fix-trying-to-register-non-static-key-in-rx.patch +hwmon-pmbus-core-protect-regulator-operations-with-m.patch +disable-wattribute-alias-for-clang-23-and-newer.patch diff --git a/queue-6.6/usb-serial-mct_u232-fix-memory-corruption-with-small.patch b/queue-6.6/usb-serial-mct_u232-fix-memory-corruption-with-small.patch new file mode 100644 index 0000000000..c659992b97 --- /dev/null +++ b/queue-6.6/usb-serial-mct_u232-fix-memory-corruption-with-small.patch @@ -0,0 +1,81 @@ +From 4f6f6cc2be22a3a24e9b60c92032e362bf085ef1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jun 2026 14:11:33 +0200 +Subject: USB: serial: mct_u232: fix memory corruption with small endpoint + +From: Johan Hovold + +commit 915b36d701950503c4ea0f6e314b10868e59fce3 upstream. + +The driver overrides the maximum transfer size for a specific device +which only accepts 16 byte packets for its 32 byte bulk-out endpoint. + +Make sure to never increase the maximum transfer size to prevent slab +corruption should a malicious device report a smaller endpoint max +packet size than expected. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/mct_u232.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index 6c2c4a597fb146..be63f5f3740477 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -379,6 +379,7 @@ static int mct_u232_port_probe(struct usb_serial_port *port) + { + struct usb_serial *serial = port->serial; + struct mct_u232_private *priv; ++ u16 pid; + + /* check first to simplify error handling */ + if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { +@@ -386,6 +387,16 @@ static int mct_u232_port_probe(struct usb_serial_port *port) + return -ENODEV; + } + ++ /* ++ * Compensate for a hardware bug: although the Sitecom U232-P25 ++ * device reports a maximum output packet size of 32 bytes, ++ * it seems to be able to accept only 16 bytes (and that's what ++ * SniffUSB says too...) ++ */ ++ pid = le16_to_cpu(serial->dev->descriptor.idProduct); ++ if (pid == MCT_U232_SITECOM_PID) ++ port->bulk_out_size = min(16, port->bulk_out_size); ++ + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; +@@ -411,7 +422,6 @@ static void mct_u232_port_remove(struct usb_serial_port *port) + + static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) + { +- struct usb_serial *serial = port->serial; + struct mct_u232_private *priv = usb_get_serial_port_data(port); + int retval = 0; + unsigned int control_state; +@@ -419,15 +429,6 @@ static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) + unsigned char last_lcr; + unsigned char last_msr; + +- /* Compensate for a hardware bug: although the Sitecom U232-P25 +- * device reports a maximum output packet size of 32 bytes, +- * it seems to be able to accept only 16 bytes (and that's what +- * SniffUSB says too...) +- */ +- if (le16_to_cpu(serial->dev->descriptor.idProduct) +- == MCT_U232_SITECOM_PID) +- port->bulk_out_size = 16; +- + /* Do a defined restart: the normal serial device seems to + * always turn on DTR and RTS here, so do the same. I'm not + * sure if this is really necessary. But it should not harm +-- +2.53.0 +