--- /dev/null
+From f865c143629d4094866a811dba5f329250bad486 Mon Sep 17 00:00:00 2001
+From: Zhan Xusheng <zhanxusheng1024@gmail.com>
+Date: Sat, 18 Jul 2026 13:09:22 +0800
+Subject: audit: fix potential integer overflow in audit_log_n_string()
+
+From: Zhan Xusheng <zhanxusheng1024@gmail.com>
+
+commit f865c143629d4094866a811dba5f329250bad486 upstream.
+
+audit_log_n_string() computes new_len as "slen + 3" (enclosing quotes
+plus the NUL terminator) and stores it into an int, while slen is a
+size_t. For a sufficiently large slen the addition can overflow and/or
+the result be truncated when assigned to the int new_len, so the
+"new_len > avail" check can be bypassed and the subsequent
+memcpy(ptr, string, slen) can write past the skb tail.
+
+This is the same class of bug that was fixed for the hex sibling in
+commit 65dfde57d1e2 ("audit: fix potential integer overflow in
+audit_log_n_hex()"); both helpers are reached through
+audit_log_n_untrustedstring() with the same length source.
+
+Make new_len a size_t and use check_add_overflow() to catch the
+overflow, mirroring the audit_log_n_hex() fix. No functional change for
+the in-tree callers, which all pass bounded lengths.
+
+Cc: stable@vger.kernel.org
+Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
+Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/audit.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -2077,7 +2077,8 @@ void audit_log_n_hex(struct audit_buffer
+ void audit_log_n_string(struct audit_buffer *ab, const char *string,
+ size_t slen)
+ {
+- int avail, new_len;
++ int avail;
++ size_t new_len;
+ unsigned char *ptr;
+ struct sk_buff *skb;
+
+@@ -2087,7 +2088,13 @@ void audit_log_n_string(struct audit_buf
+ BUG_ON(!ab->skb);
+ skb = ab->skb;
+ avail = skb_tailroom(skb);
+- new_len = slen + 3; /* enclosing quotes + null terminator */
++
++ /* enclosing quotes + null terminator */
++ if (check_add_overflow(slen, 3, &new_len)) {
++ audit_log_format(ab, "?");
++ return;
++ }
++
+ if (new_len > avail) {
+ avail = audit_expand(ab, new_len);
+ if (!avail)
--- /dev/null
+From 246df90b5f1a8a6e6abbd2f058b029558720adec Mon Sep 17 00:00:00 2001
+From: Luxiao Xu <rakukuip@gmail.com>
+Date: Tue, 21 Jul 2026 23:37:41 +0800
+Subject: audit: fix potential use-after-free in audit_del_rule()
+
+From: Luxiao Xu <rakukuip@gmail.com>
+
+commit 246df90b5f1a8a6e6abbd2f058b029558720adec upstream.
+
+`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`
+before unlinking the rule from RCU-visible filter lists and waiting for a
+grace period. Concurrent readers in `audit_filter()` and
+`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify
+mark can be freed on an independent lifetime path. This creates a
+use-after-free window during rule deletion.
+
+Fix this by unlinking the rule from the RCU-visible lists and invoking
+`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other
+rule removal helpers). This ensures that all existing RCU readers have
+exited the critical section before any underlying resources are destroyed.
+
+Cc: stable@vger.kernel.org
+Fixes: 34d99af52ad4 ("audit: implement audit by executable")
+Reported-by: Vega <vega@nebusec.ai>
+Assisted-by: Codex:gpt-5.4
+Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
+Signed-off-by: Ren Wei <enjou1224z@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/auditfilter.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -1036,6 +1036,10 @@ int audit_del_rule(struct audit_entry *e
+ goto out;
+ }
+
++ list_del_rcu(&e->list);
++ list_del(&e->rule.list);
++ synchronize_rcu();
++
+ if (e->rule.watch)
+ audit_remove_watch_rule(&e->rule);
+
+@@ -1053,8 +1057,6 @@ int audit_del_rule(struct audit_entry *e
+ audit_signals--;
+ #endif
+
+- list_del_rcu(&e->list);
+- list_del(&e->rule.list);
+ call_rcu(&e->rcu, audit_free_rule_rcu);
+
+ out:
--- /dev/null
+From 47778d2c2087b5d192398f6fddf692d16a5431cf Mon Sep 17 00:00:00 2001
+From: Sangho Lee <kudo3228@gmail.com>
+Date: Thu, 23 Jul 2026 12:28:06 +0900
+Subject: Bluetooth: HIDP: reject frames without a transaction header
+
+From: Sangho Lee <kudo3228@gmail.com>
+
+commit 47778d2c2087b5d192398f6fddf692d16a5431cf upstream.
+
+hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]
+before checking that the L2CAP SDU contains a transaction header. A
+connected HIDP peer can send an empty basic-mode SDU and make both paths
+use an uninitialized byte from skb tailroom.
+
+KMSAN reports the use in hidp_session_run(), with the uninitialized value
+originating in __alloc_skb() through vhci_write(). The control path
+produces two reports and the interrupt path produces one.
+
+The byte can also be controlled by a malformed lower-layer packet. If an
+HCI ACL packet contains an L2CAP PDU with a declared zero-length payload
+followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to
+the declared PDU length before dispatch. The current HIDP path nevertheless
+consumes the extra byte as HIDP_TRANS_HID_CONTROL |
+HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this
+change, the same packet is discarded and a subsequent feature report
+request succeeds.
+
+Pull the transaction header with skb_pull_data() and discard frames that
+do not contain it.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sangho Lee <kudo3228@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hidp/core.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -563,16 +563,18 @@ static int hidp_process_data(struct hidp
+ static void hidp_recv_ctrl_frame(struct hidp_session *session,
+ struct sk_buff *skb)
+ {
+- unsigned char hdr, type, param;
++ unsigned char type, param;
++ u8 *hdr;
+ int free_skb = 1;
+
+ BT_DBG("session %p skb %p len %u", session, skb, skb->len);
+
+- hdr = skb->data[0];
+- skb_pull(skb, 1);
++ hdr = skb_pull_data(skb, 1);
++ if (!hdr)
++ goto free;
+
+- type = hdr & HIDP_HEADER_TRANS_MASK;
+- param = hdr & HIDP_HEADER_PARAM_MASK;
++ type = *hdr & HIDP_HEADER_TRANS_MASK;
++ param = *hdr & HIDP_HEADER_PARAM_MASK;
+
+ switch (type) {
+ case HIDP_TRANS_HANDSHAKE:
+@@ -593,6 +595,7 @@ static void hidp_recv_ctrl_frame(struct
+ break;
+ }
+
++free:
+ if (free_skb)
+ kfree_skb(skb);
+ }
+@@ -600,14 +603,15 @@ static void hidp_recv_ctrl_frame(struct
+ static void hidp_recv_intr_frame(struct hidp_session *session,
+ struct sk_buff *skb)
+ {
+- unsigned char hdr;
++ u8 *hdr;
+
+ BT_DBG("session %p skb %p len %u", session, skb, skb->len);
+
+- hdr = skb->data[0];
+- skb_pull(skb, 1);
++ hdr = skb_pull_data(skb, 1);
++ if (!hdr)
++ goto free;
+
+- if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
++ if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
+ hidp_set_timer(session);
+
+ if (session->input)
+@@ -619,9 +623,10 @@ static void hidp_recv_intr_frame(struct
+ BT_DBG("report len %d", skb->len);
+ }
+ } else {
+- BT_DBG("Unsupported protocol header 0x%02x", hdr);
++ BT_DBG("Unsupported protocol header 0x%02x", *hdr);
+ }
+
++free:
+ kfree_skb(skb);
+ }
+
--- /dev/null
+From 34f53d27b81a16a02828c8fdfa4e02badc326f17 Mon Sep 17 00:00:00 2001
+From: Sangho Lee <kudo3228@gmail.com>
+Date: Thu, 23 Jul 2026 12:28:07 +0900
+Subject: Bluetooth: HIDP: validate numbered report payloads
+
+From: Sangho Lee <kudo3228@gmail.com>
+
+commit 34f53d27b81a16a02828c8fdfa4e02badc326f17 upstream.
+
+When hidp_get_raw_report() waits for a numbered report,
+hidp_process_data() compares the expected report number with skb->data[0].
+A connected HIDP peer can reply with only a DATA transaction header,
+leaving the skb empty after the header is removed.
+
+KMSAN reports an uninitialized-value use in hidp_session_run(), with the
+value originating in __alloc_skb() through vhci_write(). The transaction
+header checks remove the empty-frame reports, but this report remains until
+the payload check is added.
+
+The comparison can also consume a peer-controlled byte beyond the declared
+L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made
+the current code accept that byte as report ID 1 and complete
+HIDIOCGFEATURE with a zero-byte result. With this change the malformed
+response is rejected with -EIO, while a subsequent valid response still
+succeeds.
+
+Require a payload byte before comparing a numbered report ID. Unnumbered
+reports continue to accept an empty payload.
+
+Fixes: 0ff1731a1ae5 ("HID: bt: Add support for hidraw HIDIOCGFEATURE and HIDIOCSFEATURE")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sangho Lee <kudo3228@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hidp/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -546,9 +546,10 @@ static int hidp_process_data(struct hidp
+ }
+
+ if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
+- param == session->waiting_report_type) {
++ param == session->waiting_report_type) {
+ if (session->waiting_report_number < 0 ||
+- session->waiting_report_number == skb->data[0]) {
++ (skb->len &&
++ session->waiting_report_number == skb->data[0])) {
+ /* hidp_get_raw_report() is waiting on this report. */
+ session->report_return = skb;
+ done_with_skb = 0;
--- /dev/null
+From dd9623f58ec702a07b2d67179d6fcea79c52231a Mon Sep 17 00:00:00 2001
+From: Xiangfeng Cai <caixiangfeng@bytedance.com>
+Date: Tue, 14 Jul 2026 01:14:55 +0800
+Subject: mm/hugetlb: fix list corruption in allocate_file_region_entries()
+
+From: Xiangfeng Cai <caixiangfeng@bytedance.com>
+
+commit dd9623f58ec702a07b2d67179d6fcea79c52231a upstream.
+
+allocate_file_region_entries() tops up resv->region_cache with freshly
+allocated file_region descriptors. The allocation uses GFP_KERNEL, so
+resv->lock is dropped around it: the new entries are gathered on a
+stack-local list head, allocated_regions, and spliced into
+resv->region_cache once the lock is re-acquired.
+
+The splice used list_splice(), which moves the entries but does not
+re-initialize the source head, so allocated_regions is left pointing at an
+entry that now lives on resv->region_cache. The top-up runs in a while
+loop that re-checks the cache deficit after re-acquiring the lock. For a
+shared mapping the resv_map is shared by every mapper of the hugetlbfs
+inode, so a concurrent region_chg()/region_add()/region_del() on the same
+resv_map can consume cache entries during the unlocked window and force a
+second iteration. That iteration calls list_add() on the stale head and
+corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check
+trips:
+
+ list_add corruption. next->prev should be prev (ffffc900011ff7f8),
+ but was ffff88814c281460. (next=ffff88814c545640).
+ kernel BUG at lib/list_debug.c:31!
+ allocate_file_region_entries+0x191/0x420
+ region_chg+0x267/0x300
+ hugetlb_reserve_pages+0x387/0xc80
+ hugetlbfs_file_mmap+0x2ce/0x3f0
+ mmap_region+0x1348/0x1a80
+ do_mmap+0x85e/0xb90
+ vm_mmap_pgoff+0x18c/0x330
+ ksys_mmap_pgoff+0x2a1/0x3e0
+ do_syscall_64+0xd7/0x420
+
+Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack
+address into resv->region_cache, leading to later use-after-free.
+
+This was observed as a real host panic on a dense KVM host where a QEMU
+guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate
+SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one
+shared resv_map.
+
+Use list_splice_init() so the source head is re-initialized empty after
+each splice, making the retry loop safe.
+
+Link: https://lore.kernel.org/20260713171456.300518-2-caixiangfeng@bytedance.com
+Fixes: d3ec7b6e09e5 ("mm/hugetlb: use list_splice to merge two list at once")
+Signed-off-by: Xiangfeng Cai <caixiangfeng@bytedance.com>
+Reviewed-by: Muchun Song <muchun.song@linux.dev>
+Cc: Baoquan He <baoquan.he@linux.dev>
+Cc: David Hildenbrand <david@kernel.org>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Wei Yang <richard.weiyang@linux.alibaba.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/hugetlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -485,7 +485,7 @@ static int allocate_file_region_entries(
+
+ spin_lock(&resv->lock);
+
+- list_splice(&allocated_regions, &resv->region_cache);
++ list_splice_init(&allocated_regions, &resv->region_cache);
+ resv->region_cache_count += to_allocate;
+ }
+
--- /dev/null
+From 89b1b79c308818a715e75f28744b70d8940a07c9 Mon Sep 17 00:00:00 2001
+From: Zi Yan <ziy@nvidia.com>
+Date: Thu, 9 Jul 2026 15:12:01 -0400
+Subject: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
+
+From: Zi Yan <ziy@nvidia.com>
+
+commit 89b1b79c308818a715e75f28744b70d8940a07c9 upstream.
+
+In pcpu_create_chunk(), nr_pages is the total contiguous backing
+allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
+uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
+Since bit N in chunk->populated means page offset N inside every unit is
+backed. When nr_units > 1, the function writes beyond chunk->populated.
+Fix it by using chunk->nr_pages.
+
+It also fixes the global pcpu_nr_empty_pop_pages accounting, since
+pcpu_balance_free() only iterates up to chunk->nr_pages.
+
+Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap
+properly") introduced the bitmap overflow issue. Later, commit
+b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and
+chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
+accounting issue.
+
+Link: https://lore.kernel.org/20260709-fix-pcpu_create_chunk-in-percpu-km-v1-1-1f64745a84cc@nvidia.com
+Fixes: a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Closes: https://sashiko.dev/#/patchset/20260703-keep-subpage-private-zero-at-free-v2-0-2970fe777dd6%40nvidia.com?part=1
+Assisted-by: Codex:GPT-5
+Signed-off-by: Zi Yan <ziy@nvidia.com>
+Acked-by: Dennis Zhou <dennis@kernel.org>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Zi Yan <ziy@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/percpu-km.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/percpu-km.c
++++ b/mm/percpu-km.c
+@@ -75,7 +75,7 @@ static struct pcpu_chunk *pcpu_create_ch
+ chunk->base_addr = page_address(pages);
+
+ spin_lock_irqsave(&pcpu_lock, flags);
+- pcpu_chunk_populated(chunk, 0, nr_pages);
++ pcpu_chunk_populated(chunk, 0, chunk->nr_pages);
+ spin_unlock_irqrestore(&pcpu_lock, flags);
+
+ pcpu_stats_chunk_alloc();
--- /dev/null
+From 74b21f52c5c5a71a05c0ff70e513f4f04ff28b17 Mon Sep 17 00:00:00 2001
+From: Charles Vosburgh <trilobyte777@gmail.com>
+Date: Mon, 27 Jul 2026 19:17:30 -0400
+Subject: sctp: validate Adaptation Indication parameter length
+
+From: Charles Vosburgh <trilobyte777@gmail.com>
+
+commit 74b21f52c5c5a71a05c0ff70e513f4f04ff28b17 upstream.
+
+The Adaptation Layer Indication parameter contains a fixed 32-bit
+Adaptation Code Point after its parameter header. However,
+sctp_verify_param() accepts a header-only parameter because the generic
+parameter walker only requires the header to be present.
+
+sctp_process_param() then reads adaptation_ind beyond the declared
+parameter. When the malformed parameter is last in an INIT, the read
+starts at the receive skb tail, and the value is copied into the state
+cookie returned in the INIT ACK. This may disclose four receive-buffer
+tail bytes.
+
+Require the declared parameter length to match the fixed structure size
+and abort the association through the existing invalid parameter length
+path otherwise.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Charles Vosburgh <trilobyte777@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/20260727-sctp-adaptation-length-v1-1-0ab58b2810a5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/sm_make_chunk.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2187,7 +2187,13 @@ static enum sctp_ierror sctp_verify_para
+ case SCTP_PARAM_HEARTBEAT_INFO:
+ case SCTP_PARAM_UNRECOGNIZED_PARAMETERS:
+ case SCTP_PARAM_ECN_CAPABLE:
++ break;
+ case SCTP_PARAM_ADAPTATION_LAYER_IND:
++ if (ntohs(param.p->length) != sizeof(*param.aind)) {
++ sctp_process_inv_paramlength(asoc, param.p,
++ chunk, err_chunk);
++ retval = SCTP_IERROR_ABORT;
++ }
+ break;
+
+ case SCTP_PARAM_SUPPORTED_EXT:
rhashtable-clear-stale-iter-p-on-table-restart.patch
pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch
pinctrl-bm1880-add-missing-select-generic_pinconf.patch
+mm-percpu-km-fix-bitmap-overflow-and-accounting-in-pcpu_create_chunk.patch
+mm-hugetlb-fix-list-corruption-in-allocate_file_region_entries.patch
+sctp-validate-adaptation-indication-parameter-length.patch
+audit-fix-potential-integer-overflow-in-audit_log_n_string.patch
+audit-fix-potential-use-after-free-in-audit_del_rule.patch
+bluetooth-hidp-reject-frames-without-a-transaction-header.patch
+bluetooth-hidp-validate-numbered-report-payloads.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
