From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 11:02:38 +0000 (+0200) Subject: fuzz cleanups X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=860a5ab8ee423f69eadb2f8b393c57af4ce6a0c2;p=thirdparty%2Fkernel%2Fstable-queue.git fuzz cleanups --- diff --git a/queue-6.18/afs-fix-callback-service-message-parsers-to-pass-thr.patch b/queue-6.18/afs-fix-callback-service-message-parsers-to-pass-thr.patch index 85e55af6f6..809dc28232 100644 --- a/queue-6.18/afs-fix-callback-service-message-parsers-to-pass-thr.patch +++ b/queue-6.18/afs-fix-callback-service-message-parsers-to-pass-thr.patch @@ -25,14 +25,12 @@ cc: linux-afs@lists.infradead.org Signed-off-by: Christian Brauner (Amutable) Signed-off-by: Sasha Levin --- - fs/afs/cmservice.c | 2 -- + fs/afs/cmservice.c | 2 -- 1 file changed, 2 deletions(-) -diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c -index 1a906805a9e342..c7fe9dc3fc89e1 100644 --- a/fs/afs/cmservice.c +++ b/fs/afs/cmservice.c -@@ -335,7 +335,6 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call) +@@ -335,7 +335,6 @@ static int afs_deliver_cb_init_call_back ret = afs_extract_data(call, false); switch (ret) { case 0: break; @@ -40,7 +38,7 @@ index 1a906805a9e342..c7fe9dc3fc89e1 100644 default: return ret; } -@@ -452,7 +451,6 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call) +@@ -457,7 +456,6 @@ static int afs_deliver_cb_probe_uuid(str ret = afs_extract_data(call, false); switch (ret) { case 0: break; @@ -48,6 +46,3 @@ index 1a906805a9e342..c7fe9dc3fc89e1 100644 default: return ret; } --- -2.53.0 - diff --git a/queue-6.18/afs-fix-reinitialisation-of-the-inode-in-particular-.patch b/queue-6.18/afs-fix-reinitialisation-of-the-inode-in-particular-.patch index 338a19cc43..6c370f0376 100644 --- a/queue-6.18/afs-fix-reinitialisation-of-the-inode-in-particular-.patch +++ b/queue-6.18/afs-fix-reinitialisation-of-the-inode-in-particular-.patch @@ -53,15 +53,13 @@ cc: linux-afs@lists.infradead.org Signed-off-by: Christian Brauner (Amutable) Signed-off-by: Sasha Levin --- - fs/afs/inode.c | 1 + - fs/afs/super.c | 2 +- + fs/afs/inode.c | 1 + + fs/afs/super.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) -diff --git a/fs/afs/inode.c b/fs/afs/inode.c -index 4890fd00b3a94f..f8d9ceb914cee5 100644 --- a/fs/afs/inode.c +++ b/fs/afs/inode.c -@@ -758,6 +758,7 @@ void afs_evict_inode(struct inode *inode) +@@ -758,6 +758,7 @@ void afs_evict_inode(struct inode *inode afs_single_writepages(inode->i_mapping, &wbc); } @@ -69,11 +67,9 @@ index 4890fd00b3a94f..f8d9ceb914cee5 100644 netfs_wait_for_outstanding_io(inode); truncate_inode_pages_final(&inode->i_data); netfs_free_folioq_buffer(vnode->directory); -diff --git a/fs/afs/super.c b/fs/afs/super.c -index d672b7ab57ae2c..9184caf9dad362 100644 --- a/fs/afs/super.c +++ b/fs/afs/super.c -@@ -659,7 +659,6 @@ static void afs_i_init_once(void *_vnode) +@@ -660,7 +660,6 @@ static void afs_i_init_once(void *_vnode INIT_LIST_HEAD(&vnode->wb_keys); INIT_LIST_HEAD(&vnode->pending_locks); INIT_LIST_HEAD(&vnode->granted_locks); @@ -81,7 +77,7 @@ index d672b7ab57ae2c..9184caf9dad362 100644 INIT_LIST_HEAD(&vnode->cb_mmap_link); seqlock_init(&vnode->cb_lock); } -@@ -693,6 +692,7 @@ static struct inode *afs_alloc_inode(struct super_block *sb) +@@ -694,6 +693,7 @@ static struct inode *afs_alloc_inode(str init_rwsem(&vnode->rmdir_lock); INIT_WORK(&vnode->cb_work, afs_invalidate_mmap_work); @@ -89,6 +85,3 @@ index d672b7ab57ae2c..9184caf9dad362 100644 _leave(" = %p", &vnode->netfs.inode); return &vnode->netfs.inode; --- -2.53.0 - diff --git a/queue-7.1/alsa-hda-realtek-alc269-fixup-for-yoga-pro-7-15ash11.patch b/queue-7.1/alsa-hda-realtek-alc269-fixup-for-yoga-pro-7-15ash11.patch index 2055e2fdc0..088561147c 100644 --- a/queue-7.1/alsa-hda-realtek-alc269-fixup-for-yoga-pro-7-15ash11.patch +++ b/queue-7.1/alsa-hda-realtek-alc269-fixup-for-yoga-pro-7-15ash11.patch @@ -25,11 +25,9 @@ Link: https://patch.msgid.link/20260527130353.5658-1-xy-jackie@139.com Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- - sound/hda/codecs/realtek/alc269.c | 10 +++++++++- + sound/hda/codecs/realtek/alc269.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c -index 1f6fdbb45fc75f..d02bfe6f71ba23 100644 --- a/sound/hda/codecs/realtek/alc269.c +++ b/sound/hda/codecs/realtek/alc269.c @@ -4076,6 +4076,7 @@ enum { @@ -40,7 +38,7 @@ index 1f6fdbb45fc75f..d02bfe6f71ba23 100644 ALC287_FIXUP_13S_GEN2_SPEAKERS, ALC256_FIXUP_SET_COEF_DEFAULTS, ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE, -@@ -6101,6 +6102,13 @@ static const struct hda_fixup alc269_fixups[] = { +@@ -6101,6 +6102,13 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id = ALC285_FIXUP_THINKPAD_HEADSET_JACK, }, @@ -54,7 +52,7 @@ index 1f6fdbb45fc75f..d02bfe6f71ba23 100644 [ALC623_FIXUP_LENOVO_THINKSTATION_P340] = { .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_no_shutup, -@@ -7770,7 +7778,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { +@@ -7771,7 +7779,7 @@ static const struct hda_quirk alc269_fix SND_PCI_QUIRK(0x17aa, 0x38df, "Y990 YG DUAL", ALC287_FIXUP_TAS2781_I2C), SND_PCI_QUIRK(0x17aa, 0x38f9, "Thinkbook 16P Gen5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD), SND_PCI_QUIRK(0x17aa, 0x38fa, "Thinkbook 16P Gen5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD), @@ -63,6 +61,3 @@ index 1f6fdbb45fc75f..d02bfe6f71ba23 100644 SND_PCI_QUIRK(0x17aa, 0x38fd, "ThinkBook plus Gen5 Hybrid", ALC287_FIXUP_TAS2781_I2C), SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), --- -2.53.0 - diff --git a/queue-7.1/media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch b/queue-7.1/media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch deleted file mode 100644 index 1692f2c865..0000000000 --- a/queue-7.1/media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 6d27f92c54ce28cfbd2a8a479a96d6f4a781b7d2 Mon Sep 17 00:00:00 2001 -From: Sean Anderson -Date: Mon, 16 Mar 2026 11:58:22 -0400 -Subject: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - -From: Sean Anderson - -commit 6d27f92c54ce28cfbd2a8a479a96d6f4a781b7d2 upstream. - -If a UVC camera has an asynchronous control, uvc_status_stop may be -called from async_ctrl.work: - -uvc_ctrl_status_event_work() - uvc_ctrl_status_event() - uvc_ctrl_clear_handle() - uvc_pm_put() - uvc_status_put() - uvc_status_stop() - cancel_work_sync() - -This will cause a deadlock, since cancel_work_sync will wait for -uvc_ctrl_status_event_work to complete before returning. - -Fix this by returning early from uvc_status_stop if we are currently in -the work function. flush_status now remains false until uvc_status_start -is called again, ensuring that uvc_ctrl_status_event_work won't resubmit -the URB. - -Fixes: a32d9c41bdb8 ("media: uvcvideo: Make power management granular") -Cc: stable@vger.kernel.org -Closes: https://lore.kernel.org/all/6733bdfb-3e88-479f-8956-ab09c04c433e@linux.dev/ -Signed-off-by: Sean Anderson -Link: https://patch.msgid.link/20260316155823.1855434-1-sean.anderson@linux.dev -Reviewed-by: Ricardo Ribalda -Tested-by: Ricardo Ribalda -Reviewed-by: Laurent Pinchart -Signed-off-by: Hans de Goede -Signed-off-by: Hans Verkuil -Signed-off-by: Greg Kroah-Hartman ---- - drivers/media/usb/uvc/uvc_status.c | 28 +++++++++++++++++++--------- - 1 file changed, 19 insertions(+), 9 deletions(-) - -diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c -index 65f5356bebb3..b632cf5e3fe9 100644 ---- a/drivers/media/usb/uvc/uvc_status.c -+++ b/drivers/media/usb/uvc/uvc_status.c -@@ -316,6 +316,16 @@ static int uvc_status_start(struct uvc_device *dev, gfp_t flags) - if (!dev->int_urb) - return 0; - -+ /* -+ * If the previous uvc_status_stop() call was from the async work, -+ * the work may still be running. Wait for it to finish before we submit -+ * the urb. -+ */ -+ flush_work(&dev->async_ctrl.work); -+ -+ /* Clear the flush status if we were previously stopped. */ -+ smp_store_release(&dev->flush_status, false); -+ - return usb_submit_urb(dev->int_urb, flags); - } - -@@ -336,6 +346,15 @@ static void uvc_status_stop(struct uvc_device *dev) - */ - smp_store_release(&dev->flush_status, true); - -+ /* -+ * If we are called from the event work function, the URB is guaranteed -+ * to not be in flight as it has completed and has not been resubmitted. -+ * There's no need to cancel the work (which would deadlock), or to kill -+ * the URB. -+ */ -+ if (current_work() == &w->work) -+ return; -+ - /* - * Cancel any pending asynchronous work. If any status event was queued, - * process it synchronously. -@@ -354,15 +373,6 @@ static void uvc_status_stop(struct uvc_device *dev) - */ - if (cancel_work_sync(&w->work)) - uvc_ctrl_status_event(w->chain, w->ctrl, w->data); -- -- /* -- * From this point, there are no events on the queue and the status URB -- * is dead. No events will be queued until uvc_status_start() is called. -- * The barrier is needed to make sure that flush_status is visible to -- * uvc_ctrl_status_event_work() when uvc_status_start() will be called -- * again. -- */ -- smp_store_release(&dev->flush_status, false); - } - - int uvc_status_resume(struct uvc_device *dev) --- -2.55.0 - diff --git a/queue-7.1/series b/queue-7.1/series index a2a63f07f2..2e0f5c5e06 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -38,7 +38,6 @@ afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch afs-fix-uncancelled-rxrpc-oob-message-handler.patch fbcon-fix-null-pointer-dereference-for-a-console-without-vc_data.patch fbcon-use-correct-type-for-vc_resize-return-value.patch -media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch soc-fsl-qe_ports_ic-add-missing-cleanup-on-device-re.patch openrisc-mm-fix-section-mismatch-between-map_page-an.patch clocksource-drivers-sun5i-handle-error-returns-from-.patch