--- /dev/null
+From d568a43f6dbba3ba006304d95fd09862bd482a2f Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 23 Jul 2026 12:34:46 +0100
+Subject: afs: Fix afs_fs_fetch_data() to set call->async
+
+From: David Howells <dhowells@redhat.com>
+
+commit d568a43f6dbba3ba006304d95fd09862bd482a2f upstream.
+
+Fix afs_fs_fetch_data() to set call->async on an async operation as does
+afs_fs_fetch_data64().
+
+Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation")
+Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://patch.msgid.link/20260723113452.566619-2-dhowells@redhat.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/fsclient.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/afs/fsclient.c
++++ b/fs/afs/fsclient.c
+@@ -477,6 +477,9 @@ void afs_fs_fetch_data(struct afs_operat
+ if (!call)
+ return afs_op_nomem(op);
+
++ if (op->flags & AFS_OPERATION_ASYNC)
++ call->async = true;
++
+ /* marshall the parameters */
+ bp = call->request;
+ bp[0] = htonl(FSFETCHDATA);
--- /dev/null
+From 222052c6be186f2074b3a4d741d5de200f654c43 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 23 Jul 2026 12:34:47 +0100
+Subject: afs: Fix afs_fs_fetch_data() to subtract transferred from len
+
+From: David Howells <dhowells@redhat.com>
+
+commit 222052c6be186f2074b3a4d741d5de200f654c43 upstream.
+
+Fix afs_fs_fetch_data() to subtract subreq->transferred from subreq->len
+rather than adding it.
+
+Fixes: f28fc2010d62 ("afs: Eliminate afs_read")
+Link: https://sashiko.dev/#/patchset/20260713081022.2186481-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://patch.msgid.link/20260723113452.566619-3-dhowells@redhat.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/fsclient.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
+index 626e1d37b915..1a3f186a6a11 100644
+--- a/fs/afs/fsclient.c
++++ b/fs/afs/fsclient.c
+@@ -487,7 +487,7 @@ void afs_fs_fetch_data(struct afs_operation *op)
+ bp[2] = htonl(vp->fid.vnode);
+ bp[3] = htonl(vp->fid.unique);
+ bp[4] = htonl(lower_32_bits(subreq->start + subreq->transferred));
+- bp[5] = htonl(lower_32_bits(subreq->len + subreq->transferred));
++ bp[5] = htonl(lower_32_bits(subreq->len - subreq->transferred));
+
+ call->fid = vp->fid;
+ trace_afs_make_fs_call(call, &vp->fid);
+--
+2.55.0
+
--- /dev/null
+From 4af1ec68d54b3871155914d584fb10669c41a861 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 23 Jul 2026 12:34:48 +0100
+Subject: afs: Fix UAF when sending a message
+
+From: David Howells <dhowells@redhat.com>
+
+commit 4af1ec68d54b3871155914d584fb10669c41a861 upstream.
+
+In afs_make_call(), there's a race with async call reception and
+destruction. If a call is dispatched that doesn't have call->write_iter
+set (used to specify the data content for FS.StoreData), then the first
+rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr.
+
+Once rxrpc_send_data() queues the last request packet, the response could
+come in at any time and cause the call to be completed and put. However,
+afs_make_call() will look at the call again to see it ->write_iter should
+be handled - something it's only allowed to do if it has its own ref on the
+call. Whilst this is the case for synchronous calls, it isn't true for
+async calls such as FS.FetchData.
+
+There's also a potential UAF in afs_make_call() in the event that an
+asynchronous call is being sent, but the call fails in some way (e.g. it
+gets aborted from the server). The problem there is that afs_make_call()
+tries to abort a call if the rxrpc send fails, but the asynchronous
+notification from rxrpc may have caused the afs_call to be torn down.
+
+generic/650 plays games with randomly taking CPUs offline, and can
+interject a significant delay such that the call is deallocated before
+afs_make_call() gets to check call->write_iter - and a UAF ensues (caught
+by KASAN).
+
+ BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs]
+ Read of size 8 at addr ffff888035e050e8 by task fsstress/1409
+
+Fix this by making afs_make_op_call() give the op->call its own ref rather
+than transferring the caller's ref to it and then dropping the ref when
+afs_make_call() returns.
+
+This also means that the afs_make_call() func never loses its ref on the
+call now.
+
+Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation")
+Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept")
+Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://patch.msgid.link/20260723113452.566619-4-dhowells@redhat.com
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/internal.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -1420,7 +1420,7 @@ static inline void afs_make_op_call(stru
+ {
+ struct afs_addr_list *alist = op->estate->addresses;
+
+- op->call = call;
++ op->call = afs_get_call(call, afs_call_trace_get);
+ op->type = call->type;
+ call->op = op;
+ call->key = op->key;
+@@ -1428,6 +1428,7 @@ static inline void afs_make_op_call(stru
+ call->peer = rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer);
+ call->service_id = op->server->service_id;
+ afs_make_call(call, gfp);
++ afs_put_call(call);
+ }
+
+ static inline void afs_extract_begin(struct afs_call *call, void *buf, size_t size)
--- /dev/null
+From a54bf16965f896415c3337bc4fbb40fb11941d99 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 26 Jul 2026 09:48:19 +0200
+Subject: ALSA: 6fire: Fix UAF at error handling during probe
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a54bf16965f896415c3337bc4fbb40fb11941d99 upstream.
+
+Although 6fire driver had a few fixes for dealing with the early error
+handling during the probe phase, it forgot a pending URB before
+freeing the resources, which may lead to a UAF.
+
+This patch addresses it by doing the almost same cleanup procedure
+like the normal disconnect phase at the error path.
+
+Reported-and-tested-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
+Closes: https://lore.kernel.org/20260724030900.1984491-1-shuangpeng.kernel@gmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20260726074821.2288158-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/6fire/chip.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/usb/6fire/chip.c
++++ b/sound/usb/6fire/chip.c
+@@ -156,6 +156,10 @@ static int usb6fire_chip_probe(struct us
+ return 0;
+
+ destroy_chip:
++ chip->shutdown = true;
++ if (card)
++ snd_card_disconnect(card);
++ usb6fire_chip_abort(chip);
+ snd_card_free(card);
+ return ret;
+ }
--- /dev/null
+From 26a94400ffa4fcbeff32e23abebb83a1a20eb401 Mon Sep 17 00:00:00 2001
+From: Eckhart Mohr <e.mohr@tuxedocomputers.com>
+Date: Fri, 24 Jul 2026 21:00:13 +0200
+Subject: ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
+
+From: Eckhart Mohr <e.mohr@tuxedocomputers.com>
+
+commit 26a94400ffa4fcbeff32e23abebb83a1a20eb401 upstream.
+
+TongFang X6KK45xU and X6SP45xU have actually different PCI IDs. This patch
+Adds the missing PCI ID to fix headphone detection and clarifies the
+naming.
+
+Fixes: d595255241e5 ("ALSA: hda/realtek: Add quirk for TongFang X6xx45xU")
+Signed-off-by: Eckhart Mohr <e.mohr@tuxedocomputers.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260724190109.169889-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -7560,7 +7560,8 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x1d05, 0x300f, "TongFang X6AR5xxY", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d05, 0x3019, "TongFang X6FR5xxY", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d05, 0x3031, "TongFang X6AR55xU", ALC2XX_FIXUP_HEADSET_MIC),
+- SND_PCI_QUIRK(0x1d05, 0x3034, "TongFang X6xx45xU", ALC2XX_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1d05, 0x3033, "TongFang X6SP45xU", ALC2XX_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1d05, 0x3034, "TongFang X6KK45xU", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
+ SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
--- /dev/null
+From 6437033bffe8bd2af174d139af552d90d40c7ac6 Mon Sep 17 00:00:00 2001
+From: Xu Rao <raoxu@uniontech.com>
+Date: Thu, 23 Jul 2026 16:57:10 +0800
+Subject: ALSA: lx6464es: fix period byte count for 16-bit streams
+
+From: Xu Rao <raoxu@uniontech.com>
+
+commit 6437033bffe8bd2af174d139af552d90d40c7ac6 upstream.
+
+The lx6464es driver advertises both 16-bit and packed 24-bit PCM formats,
+but lx_trigger_start() and lx_interrupt_request_new_buffer() calculate the
+DMA period size as runtime->period_size * runtime->channels * 3. That is
+only correct for the packed 24-bit formats.
+
+For 16-bit streams the driver submits buffers that are 50% larger than the
+actual ALSA period and advances the DMA address by the same wrong amount.
+For example, with 2 channels, 256 frames and 4 periods, the third buffer
+already extends beyond the ALSA buffer and the fourth buffer starts outside
+it.
+
+Use snd_pcm_lib_period_bytes() so the byte count matches the runtime
+format, channel count and period size.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Link: https://patch.msgid.link/8BB12E8D92A7CDBA+20260723085710.2567463-1-raoxu@uniontech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/lx6464es/lx6464es.c | 5 +----
+ sound/pci/lx6464es/lx_core.c | 5 +----
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/lx6464es/lx6464es.c
++++ b/sound/pci/lx6464es/lx6464es.c
+@@ -402,11 +402,8 @@ static void lx_trigger_start(struct lx64
+
+ int err;
+
+- const u32 channels = substream->runtime->channels;
+- const u32 bytes_per_frame = channels * 3;
+- const u32 period_size = substream->runtime->period_size;
+ const u32 periods = substream->runtime->periods;
+- const u32 period_bytes = period_size * bytes_per_frame;
++ const u32 period_bytes = snd_pcm_lib_period_bytes(substream);
+
+ dma_addr_t buf = substream->dma_buffer.addr;
+ int i;
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -969,10 +969,7 @@ static int lx_interrupt_request_new_buff
+ const unsigned int is_capture = lx_stream->is_capture;
+ int err;
+
+- const u32 channels = substream->runtime->channels;
+- const u32 bytes_per_frame = channels * 3;
+- const u32 period_size = substream->runtime->period_size;
+- const u32 period_bytes = period_size * bytes_per_frame;
++ const u32 period_bytes = snd_pcm_lib_period_bytes(substream);
+ const u32 pos = lx_stream->frame_pos;
+ const u32 next_pos = ((pos+1) == substream->runtime->periods) ?
+ 0 : pos + 1;
--- /dev/null
+From f495b6c4c8594122918552c9be2b51eb71647cd9 Mon Sep 17 00:00:00 2001
+From: Norbert Szetei <norbert@doyensec.com>
+Date: Tue, 28 Jul 2026 14:50:01 +0200
+Subject: ALSA: pcm: wake linked drain waiters on unlink
+
+From: Norbert Szetei <norbert@doyensec.com>
+
+commit f495b6c4c8594122918552c9be2b51eb71647cd9 upstream.
+
+snd_pcm_drain() on a linked stream parks an on-stack wait entry on the
+drained peer's runtime->sleep, and after schedule_timeout() removes it
+only if that peer is still found in the caller's group. If group
+membership changes during the wait and the sleep ends by signal or
+timeout (so autoremove_wake_function() does not run), finish_wait() is
+skipped and snd_pcm_drain() returns with the entry still queued on that
+stream's sleep list; a later wake_up() then walks a freed stack frame.
+This is reachable by unlinking either the drained or the draining stream.
+
+Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()),
+snd_pcm_unlink() never wakes the sleep queues. Wake every group member
+under the group lock before the membership change, so a linked drainer is
+released and drops its entry while the streams are still grouped.
+
+The window was opened when snd_pcm_link_rwsem stopped being held across
+the wait and the removal became conditional on group membership (see
+Fixes). The later switch to finish_wait() kept that conditional removal,
+so the signal/timeout case remained.
+
+Fixes: f57f3df03a8e ("ALSA: pcm: More fine-grained PCM link locking")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-5
+Signed-off-by: Norbert Szetei <norbert@doyensec.com>
+Link: https://patch.msgid.link/A0705100-D10B-4286-9980-0142ABEEAD51@doyensec.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/pcm_native.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -2334,6 +2334,7 @@ static void relink_to_local(struct snd_p
+
+ static int snd_pcm_unlink(struct snd_pcm_substream *substream)
+ {
++ struct snd_pcm_substream *s;
+ struct snd_pcm_group *group;
+ bool nonatomic = substream->pcm->nonatomic;
+ bool do_free = false;
+@@ -2346,6 +2347,12 @@ static int snd_pcm_unlink(struct snd_pcm
+ group = substream->group;
+ snd_pcm_group_lock_irq(group, nonatomic);
+
++ /* release drain waiters before changing membership, else snd_pcm_drain()
++ * leaves its on-stack wait entry queued on a member's sleep list
++ */
++ snd_pcm_group_for_each_entry(s, substream)
++ wake_up(&s->runtime->sleep);
++
+ relink_to_local(substream);
+ refcount_dec(&group->refs);
+
--- /dev/null
+From 21e19688433452dfbbbe6b2bb670dea6eb92f0f6 Mon Sep 17 00:00:00 2001
+From: Norbert Szetei <norbert@doyensec.com>
+Date: Sat, 25 Jul 2026 08:33:45 +0200
+Subject: ALSA: seq: Fix division by zero in initialize_timer()
+
+From: Norbert Szetei <norbert@doyensec.com>
+
+commit 21e19688433452dfbbbe6b2bb670dea6eb92f0f6 upstream.
+
+A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set
+the backing snd_timer's hardware resolution to an arbitrary 64-bit value
+via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.
+
+When such a timer is bound to a sequencer queue, initialize_timer()
+computes the tick period as
+
+ tmr->ticks = 1000000000 / (r * freq);
+
+where r is that user-controlled resolution and freq is the sequencer
+update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).
+A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for
+any even freq, including DEFAULT_FREQUENCY (1000), so the division faults
+with a divide-by-zero.
+
+The division runs under tmr->lock with interrupts disabled, so the oops
+leaves the spinlock held and hangs the CPU. It is reachable by an
+unprivileged user with access to /dev/snd/timer and /dev/snd/seq.
+
+ Oops: divide error: 0000 [#1] SMP KASAN PTI
+ CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+
+ RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0
+ snd_seq_timer_start+0x15e/0x2b0
+ snd_seq_control_queue+0x56f/0xba0
+ snd_seq_write+0x3e0/0x730
+
+Reject an overflowing product with check_mul_overflow() and fall back to
+a single tick, which also avoids feeding a wrapped-but-nonzero divisor
+(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small
+value) into the period computation.
+
+Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
+Cc: <stable@vger.kernel.org>
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Norbert Szetei <norbert@doyensec.com>
+Link: https://patch.msgid.link/DF8A3844-AD5E-4B8A-9CFC-BD83C212BA38@doyensec.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_timer.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -362,11 +362,10 @@ static int initialize_timer(struct snd_s
+ tmr->ticks = 1;
+ if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
+ unsigned long r = snd_timer_resolution(tmr->timeri);
+- if (r) {
+- tmr->ticks = (unsigned int)(1000000000uL / (r * freq));
+- if (! tmr->ticks)
+- tmr->ticks = 1;
+- }
++ unsigned long den;
++
++ if (r && !check_mul_overflow(r, freq, &den))
++ tmr->ticks = max(1U, (unsigned int)(1000000000uL / den));
+ }
+ tmr->initialized = 1;
+ return 0;
--- /dev/null
+From c2744d5f3aea474513fd2298daecb94a952ce441 Mon Sep 17 00:00:00 2001
+From: Norbert Szetei <norbert@doyensec.com>
+Date: Sun, 26 Jul 2026 10:01:45 +0200
+Subject: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
+
+From: Norbert Szetei <norbert@doyensec.com>
+
+commit c2744d5f3aea474513fd2298daecb94a952ce441 upstream.
+
+snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD
+and returns early when the flag is already set, but the flag is never
+cleared again. A completed close ends in remove_slave_links(), which
+leaves timeri->timer NULL, so a second close is already harmless through
+the timer == NULL path; the early return can only be reached by an
+instance that was opened again in between. For such an instance the
+close unlinks nothing, so snd_timer_instance_free() frees an object that
+is still on timer->open_list_head, still on snd_timer_master_list if it
+was opened with a slave key, still owns any adopted slaves, and still
+holds its timer and module references.
+
+snd_seq_timer_open() reopens an instance exactly like that: it retries
+its fallback open on the same object after a failure that has already
+run snd_timer_close_locked() internally. An unprivileged user with
+access to /dev/snd/timer and /dev/snd/seq can force that failure, since
+snd_timer_check_master() returns -EBUSY when a pending slave matches the
+new master's (slave_class, slave_id) key and the target timer has
+reached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class =
+SNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a
+sequencer queue's key can be forged. The freed instance is afterwards
+dereferenced by any further snd_timer_open() on that timer, by
+snd_timer_check_slave(), and by /proc/asound/timers, which faults on the
+stale ti->owner pointer.
+
+The flag only has to be visible while the close is in progress, which is
+all its other users need. Clear it in remove_slave_links(), under the
+same timer->lock that sets it, once the instance is off every list.
+
+Fixes: da3039e91d1f ("ALSA: timer: Forcibly close timer instances at closing")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-5
+Signed-off-by: Norbert Szetei <norbert@doyensec.com>
+Link: https://patch.msgid.link/CA41AA48-75BF-45E9-A36D-3A5D2F124F60@doyensec.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/timer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -409,6 +409,8 @@ static void remove_slave_links(struct sn
+ list_del_init(&slave->ack_list);
+ list_del_init(&slave->active_list);
+ }
++ /* the close is done; a reopen must not see the mark */
++ timeri->flags &= ~SNDRV_TIMER_IFLG_DEAD;
+ }
+
+ /*
--- /dev/null
+From 70c977815af0d997feb2d0c5d284d55689bf7051 Mon Sep 17 00:00:00 2001
+From: Baul Lee <baul.lee@xbow.com>
+Date: Sun, 26 Jul 2026 14:16:33 +0900
+Subject: ALSA: ump: fix double free of out_cvts on rawmidi error
+
+From: Baul Lee <baul.lee@xbow.com>
+
+commit 70c977815af0d997feb2d0c5d284d55689bf7051 upstream.
+
+snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array
+ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with
+kfree() but leaves ump->out_cvts pointing at the freed memory. When the
+endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts
+a second time, resulting in a double free.
+
+The host snd-usb-audio driver attaches the legacy rawmidi for any USB
+MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail
+reaches this path on enumeration.
+
+Clear ump->out_cvts after freeing it on the error path so it is not
+freed again during teardown.
+
+Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
+
+Fixes: 33cd7630782d ("ALSA: ump: Export MIDI1 / UMP conversion helpers")
+Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
+Reported-by: Baul Lee <baul.lee@xbow.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Baul Lee <baul.lee@xbow.com>
+Link: https://patch.msgid.link/20260726051633.41206-1-baul.lee@xbow.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/ump.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/core/ump.c
++++ b/sound/core/ump.c
+@@ -1366,6 +1366,7 @@ int snd_ump_attach_legacy_rawmidi(struct
+ &rmidi);
+ if (err < 0) {
+ kfree(ump->out_cvts);
++ ump->out_cvts = NULL;
+ return err;
+ }
+
--- /dev/null
+From 8d7a30c50c2e58a6839634ed0acde14466d1dc61 Mon Sep 17 00:00:00 2001
+From: Sonali Pradhan <sonalipradhan@google.com>
+Date: Tue, 28 Jul 2026 20:24:32 +0000
+Subject: ALSA: usb-audio: Clamp frame size in implicit-feedback mode
+
+From: Sonali Pradhan <sonalipradhan@google.com>
+
+commit 8d7a30c50c2e58a6839634ed0acde14466d1dc61 upstream.
+
+snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's
+stride and stores the result directly in out_packet->packet_size[i]. If a
+connected USB device sends an oversized sync packet, this frame count can
+exceed ep->maxframesize.
+
+The un-clamped frame count then propagates to the playback endpoint queue,
+potentially driving packet transfers beyond the endpoint's hardware frame
+limits.
+
+Cap the calculated frame count against ep->maxframesize in
+snd_usb_handle_sync_urb() to prevent oversized packets from entering the
+playback queue.
+
+Fixes: 28acb12014fb ("ALSA: usb-audio: use sender stride for implicit feedback")
+Cc: stable@vger.kernel.org
+Assisted-by: Jetski:Gemini-3.6-Flash
+Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
+Link: https://patch.msgid.link/20260728202432.2354994-1-sonalipradhan@google.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -1806,11 +1806,13 @@ static void snd_usb_handle_sync_urb(stru
+
+ out_packet->packets = in_ctx->packets;
+ for (i = 0; i < in_ctx->packets; i++) {
+- if (urb->iso_frame_desc[i].status == 0)
+- out_packet->packet_size[i] =
++ if (urb->iso_frame_desc[i].status == 0) {
++ unsigned int frames =
+ urb->iso_frame_desc[i].actual_length / sender->stride;
+- else
++ out_packet->packet_size[i] = min(frames, ep->maxframesize);
++ } else {
+ out_packet->packet_size[i] = 0;
++ }
+ }
+
+ spin_unlock_irqrestore(&ep->lock, flags);
--- /dev/null
+From d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5 Mon Sep 17 00:00:00 2001
+From: Sonali Pradhan <sonalipradhan@google.com>
+Date: Tue, 28 Jul 2026 20:17:16 +0000
+Subject: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
+
+From: Sonali Pradhan <sonalipradhan@google.com>
+
+commit d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5 upstream.
+
+When a USB audio endpoint requests full packet transfers via the fill_max
+descriptor flag, data_ep_set_params() promotes ep->curpacksize to
+ep->maxpacksize. However, maxsize is left at the original sample-rate
+derived value.
+
+Since u->buffer_size is allocated as maxsize * packets, the resulting
+DMA buffer is far too small for the requested transfer length. When the
+USB host controller streams up to curpacksize bytes per packet, it writes
+past the end of the buffer via DMA, corrupting kernel heap memory.
+
+Update maxsize to curpacksize when fill_max is set so that the allocated
+DMA buffer size matches the actual transfer request size.
+
+[ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]
+
+Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model")
+Cc: stable@vger.kernel.org
+Assisted-by: Jetski:Gemini-3.6-Flash
+Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
+Link: https://patch.msgid.link/20260728201716.2347726-1-sonalipradhan@google.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -1164,10 +1164,12 @@ static int data_ep_set_params(struct snd
+ << (16 - ep->datainterval);
+ }
+
+- if (ep->fill_max)
++ if (ep->fill_max) {
+ ep->curpacksize = ep->maxpacksize;
+- else
++ maxsize = ep->curpacksize;
++ } else {
+ ep->curpacksize = maxsize;
++ }
+
+ if (snd_usb_get_speed(chip->dev) != USB_SPEED_FULL) {
+ packs_per_ms = 8 >> ep->datainterval;
--- /dev/null
+From 0970274613fb463d376211450cab066d34ebfe6a Mon Sep 17 00:00:00 2001
+From: Baul Lee <baul.lee@xbow.com>
+Date: Sun, 26 Jul 2026 16:45:00 +0900
+Subject: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
+
+From: Baul Lee <baul.lee@xbow.com>
+
+commit 0970274613fb463d376211450cab066d34ebfe6a upstream.
+
+snd_usbmidi_akai_output() computes its fill-loop bound
+
+ buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;
+
+as a signed int, so a small device-advertised bulk-OUT max_transfer
+makes buf_end negative. The loop guard then compares the u32
+urb->transfer_buffer_length against that negative int: the usual
+arithmetic conversion turns buf_end into a large unsigned value, so the
+guard stays true and each iteration keeps appending SysEx framing and
+payload bytes past the end of the URB transfer buffer, which is only
+max_transfer bytes long.
+
+A USB device that advertises a tiny bulk-OUT endpoint can therefore
+trigger an attacker-length- and content-controlled heap out-of-bounds
+write when a process writes to the created /dev/snd/midiC*D* node.
+
+Return early when there is no room for even one SysEx, so the loop is
+never entered with a bound that would wrap. The loop is the last
+statement of the function, so bailing out is equivalent to it not
+running.
+
+Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
+
+Fixes: 4434ade8c933 ("ALSA: usb-audio: add support for Akai MPD16")
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
+Reported-by: Baul Lee <baul.lee@xbow.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Baul Lee <baul.lee@xbow.com>
+Link: https://patch.msgid.link/20260726074500.50145-1-baul.lee@xbow.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/midi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -793,6 +793,8 @@ static void snd_usbmidi_akai_output(stru
+
+ msg = urb->transfer_buffer + urb->transfer_buffer_length;
+ buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;
++ if (buf_end <= 0)
++ return;
+
+ /* only try adding more data when there's space for at least 1 SysEx */
+ while (urb->transfer_buffer_length < buf_end) {
--- /dev/null
+From 441aaad150c57edaf57ee482a79a3bf4c5b7e353 Mon Sep 17 00:00:00 2001
+From: Baul Lee <baul.lee@xbow.com>
+Date: Sun, 26 Jul 2026 15:50:20 +0900
+Subject: ALSA: usb-audio: fix stack info leak in RME Digiface status
+
+From: Baul Lee <baul.lee@xbow.com>
+
+commit 441aaad150c57edaf57ee482a79a3bf4c5b7e353 upstream.
+
+snd_rme_digiface_read_status() reads a four-word status block from the
+device into an uninitialised on-stack __le32 buf[4] and, whenever the
+vendor control-IN transfer does not return a negative error, copies all
+four words into the caller's status[].
+
+snd_usb_ctl_msg() copies the full requested size back into the caller's
+buffer regardless of how many bytes the data stage actually delivered:
+
+ buf = kmemdup(data, size, GFP_KERNEL);
+ err = usb_control_msg(dev, pipe, request, requesttype,
+ value, index, buf, size, timeout);
+ memcpy(data, buf, size);
+
+usb_control_msg() returns the transferred length on a short control-IN,
+which is a non-negative value, and writes only that many bytes. The
+remainder of the copy back is the kmemdup()ed image of the caller's
+buffer, so a device answering with a short data stage leaves the
+trailing words of buf[] holding leftover kernel stack. The only guard
+in the caller is err < 0, so those words are stored into status[].
+
+They then reach user space: snd_rme_digiface_get_status_val() selects a
+16-bit halfword of status[] per the control's reg/mask, and the eight
+Digiface status controls together expose the whole 16-byte frame to an
+unprivileged reader of /dev/snd/controlC*.
+
+Zero-initialise the buffer so a short read yields zeros instead of stack
+residue. This mirrors snd_rme_get_status1(), which already clears its
+output word before the same kind of vendor read.
+
+Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
+
+Fixes: 611a96f6acf2 ("ALSA: usb-audio: Add mixer quirk for RME Digiface USB")
+Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
+Reported-by: Baul Lee <baul.lee@xbow.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Baul Lee <baul.lee@xbow.com>
+Link: https://patch.msgid.link/20260726065020.46070-1-baul.lee@xbow.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -3352,7 +3352,7 @@ static int snd_rme_digiface_read_status(
+ struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
+ struct snd_usb_audio *chip = list->mixer->chip;
+ struct usb_device *dev = chip->dev;
+- __le32 buf[4];
++ __le32 buf[4] = {};
+ int err;
+
+ err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
--- /dev/null
+From 4a05b2d1b4642df74f30b6f54843e825c4a2bfd3 Mon Sep 17 00:00:00 2001
+From: Baul Lee <baul.lee@xbow.com>
+Date: Sun, 26 Jul 2026 14:13:37 +0900
+Subject: ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
+
+From: Baul Lee <baul.lee@xbow.com>
+
+commit 4a05b2d1b4642df74f30b6f54843e825c4a2bfd3 upstream.
+
+create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a
+back-pointer to its per-interface snd_usb_midi2_ump object in
+ump->private_data, but it never installs an ump->private_free hook and
+never clears that pointer.
+
+If a later step of snd_usb_midi_v2_create() fails, its error path calls
+free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while
+the already-registered endpoint keeps pointing at it. The created
+/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP
+open, ump_to_endpoint(), dereferences the dangling ump->private_data and
+reads rmidi->eps[dir] out of freed memory.
+
+A malicious USB MIDI 2.0 device that makes creation fail after the
+endpoint is registered can thus trigger a slab use-after-free read on a
+subsequent open of the UMP node.
+
+Clear the endpoint's back-pointer before freeing the object, and let
+ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger
+callbacks fail cleanly (their callers already handle a NULL endpoint)
+instead of dereferencing a stale pointer.
+
+Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
+
+Fixes: ff49d1df79ae ("ALSA: usb-audio: USB MIDI 2.0 UMP support")
+Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
+Reported-by: Baul Lee <baul.lee@xbow.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Baul Lee <baul.lee@xbow.com>
+Link: https://patch.msgid.link/20260726051337.41124-1-baul.lee@xbow.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/midi2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/midi2.c
++++ b/sound/usb/midi2.c
+@@ -329,7 +329,7 @@ ump_to_endpoint(struct snd_ump_endpoint
+ {
+ struct snd_usb_midi2_ump *rmidi = ump->private_data;
+
+- return rmidi->eps[dir];
++ return rmidi ? rmidi->eps[dir] : NULL;
+ }
+
+ /* ump open callback */
+@@ -685,6 +685,8 @@ static void free_all_midi2_umps(struct s
+ rmidi = list_first_entry(&umidi->rawmidi_list,
+ struct snd_usb_midi2_ump, list);
+ list_del(&rmidi->list);
++ if (rmidi->ump)
++ rmidi->ump->private_data = NULL;
+ kfree(rmidi);
+ }
+ }
--- /dev/null
+From 890b4253134f3a39883af7d5bea67af9c494c56d Mon Sep 17 00:00:00 2001
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+Date: Wed, 15 Jul 2026 10:47:57 +0800
+Subject: ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+commit 890b4253134f3a39883af7d5bea67af9c494c56d upstream.
+
+When fsl_asrc_m2m_init() fails in fsl_asrc_probe(), the code did a
+bare return ret, bypassing pm_runtime_disable() in err_pm_get_sync.
+Use goto err_pm_get_sync to ensure proper cleanup on failure.
+
+Fixes: 286d658477a4 ("ASoC: fsl_asrc: register m2m platform device")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20260715024758.1252801-2-shengjiu.wang@oss.nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/fsl/fsl_asrc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/fsl/fsl_asrc.c
++++ b/sound/soc/fsl/fsl_asrc.c
+@@ -1388,7 +1388,7 @@ static int fsl_asrc_probe(struct platfor
+ ret = fsl_asrc_m2m_init(asrc);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to init m2m device %d\n", ret);
+- return ret;
++ goto err_pm_get_sync;
+ }
+
+ return 0;
--- /dev/null
+From a54bc0eef90ea760039c14bb7f3b5db42529f84d Mon Sep 17 00:00:00 2001
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+Date: Wed, 15 Jul 2026 10:47:58 +0800
+Subject: ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+commit a54bc0eef90ea760039c14bb7f3b5db42529f84d upstream.
+
+When fsl_asrc_m2m_init() fails in fsl_easrc_probe(), the code did a
+bare return ret, bypassing pm_runtime_disable() in err_pm_disable.
+Use goto err_pm_disable to ensure proper cleanup on failure.
+
+Fixes: b62eaff0650d ("ASoC: fsl_easrc: register m2m platform device")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20260715024758.1252801-3-shengjiu.wang@oss.nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/fsl/fsl_easrc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/fsl/fsl_easrc.c
++++ b/sound/soc/fsl/fsl_easrc.c
+@@ -2266,7 +2266,7 @@ static int fsl_easrc_probe(struct platfo
+ ret = fsl_asrc_m2m_init(easrc);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to init m2m device %d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ return 0;
--- /dev/null
+From bdb0fd6de403fcea7b85dc9d38f0a571583ebe80 Mon Sep 17 00:00:00 2001
+From: Haidar Lee <haidar.lee@adlinktech.com>
+Date: Wed, 15 Jul 2026 14:04:41 +0800
+Subject: ASoC: tas2562: fix broken entries in the volume lookup table
+
+From: Haidar Lee <haidar.lee@adlinktech.com>
+
+commit bdb0fd6de403fcea7b85dc9d38f0a571583ebe80 upstream.
+
+The float_vol_db_lookup table is supposed to hold
+round(10^(dB/20) * 2^30) for every 2 dB step from -110 dB to 0 dB,
+which is 56 entries, but it only has 55: the -90 dB entry duplicates
+the -92 dB value (0x0000695b) and the -20 dB entry (0x06666666) is
+missing altogether. As a result every step between -90 dB and -22 dB
+is off by 2 dB, and the control's maximum raw value of 110 indexes one
+element past the end of the array.
+
+Replace the duplicated -90 dB entry with the correct value 0x000084a3
+and add the missing -20 dB entry, bringing the table to the full 56
+entries so index 55 (raw value 110, 0 dB) is in range again.
+
+Fixes: bf726b1c86f2 ("ASoC: tas2562: Add support for digital volume control")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haidar Lee <haidar.lee@adlinktech.com>
+Link: https://patch.msgid.link/20260715-tas2562-dvc-fix-v1-2-072b13901b20@adlinktech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/tas2562.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/tas2562.c
++++ b/sound/soc/codecs/tas2562.c
+@@ -32,15 +32,16 @@
+ static const unsigned int float_vol_db_lookup[] = {
+ 0x00000d43, 0x000010b2, 0x00001505, 0x00001a67, 0x00002151,
+ 0x000029f1, 0x000034cd, 0x00004279, 0x000053af, 0x0000695b,
+-0x0000695b, 0x0000a6fa, 0x0000d236, 0x000108a4, 0x00014d2a,
++0x000084a3, 0x0000a6fa, 0x0000d236, 0x000108a4, 0x00014d2a,
+ 0x0001a36e, 0x00021008, 0x000298c0, 0x000344df, 0x00041d8f,
+ 0x00052e5a, 0x000685c8, 0x00083621, 0x000a566d, 0x000d03a7,
+ 0x0010624d, 0x0014a050, 0x0019f786, 0x0020b0bc, 0x0029279d,
+ 0x0033cf8d, 0x004139d3, 0x00521d50, 0x00676044, 0x0082248a,
+ 0x00a3d70a, 0x00ce4328, 0x0103ab3d, 0x0146e75d, 0x019b8c27,
+ 0x02061b89, 0x028c423f, 0x03352529, 0x0409c2b0, 0x05156d68,
+-0x080e9f96, 0x0a24b062, 0x0cc509ab, 0x10137987, 0x143d1362,
+-0x197a967f, 0x2013739e, 0x28619ae9, 0x32d64617, 0x40000000
++0x06666666, 0x080e9f96, 0x0a24b062, 0x0cc509ab, 0x10137987,
++0x143d1362, 0x197a967f, 0x2013739e, 0x28619ae9, 0x32d64617,
++0x40000000
+ };
+
+ struct tas2562_data {
--- /dev/null
+From 8e957e4907c58e9ca944f98799524f2bbb9cf68a Mon Sep 17 00:00:00 2001
+From: Haidar Lee <haidar.lee@adlinktech.com>
+Date: Wed, 15 Jul 2026 14:04:40 +0800
+Subject: ASoC: tas2562: fix DVC coefficient write order
+
+From: Haidar Lee <haidar.lee@adlinktech.com>
+
+commit 8e957e4907c58e9ca944f98799524f2bbb9cf68a upstream.
+
+The TAS2562 applies the 32-bit digital volume coefficient to the
+playback path when the last byte, DVC_CFG4 (book 0 page 2 reg 0x0F), is
+written. tas2562_volume_control_put() wrote DVC_CFG4 first and DVC_CFG1
+(the MSB) last, so every volume change latched a value made of the
+previous coefficient's upper three bytes combined with the new LSB; the
+remaining bytes only took effect on the next volume change.
+
+In practice the control was unusable: the first setting after power-on
+always played at roughly 0 dB no matter what value was requested (the
+chip's default upper bytes were still latched), and most subsequent
+changes muted the output entirely or produced a distorted, over-unity
+gain.
+
+Verified on a TAS2562 (ADLINK OSM-520 / MT8189 board) by tracing the
+I2C writes with ftrace and by writing the same coefficients manually in
+both byte orders: written MSB-first the register block behaves exactly
+as the driver expects, LSB-first reproduces the broken behaviour.
+
+Write the bytes MSB first with DVC_CFG4 last so the complete new
+coefficient is latched atomically.
+
+Fixes: bf726b1c86f2 ("ASoC: tas2562: Add support for digital volume control")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haidar Lee <haidar.lee@adlinktech.com>
+Link: https://patch.msgid.link/20260715-tas2562-dvc-fix-v1-1-072b13901b20@adlinktech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/tas2562.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/codecs/tas2562.c
++++ b/sound/soc/codecs/tas2562.c
+@@ -475,20 +475,27 @@ static int tas2562_volume_control_put(st
+ u32 reg_val;
+
+ reg_val = float_vol_db_lookup[ucontrol->value.integer.value[0]/2];
+- ret = snd_soc_component_write(component, TAS2562_DVC_CFG4,
+- (reg_val & 0xff));
+- if (ret)
+- return ret;
+- ret = snd_soc_component_write(component, TAS2562_DVC_CFG3,
+- ((reg_val >> 8) & 0xff));
++ /*
++ * The device applies the 32-bit coefficient to the playback path on
++ * the write to DVC_CFG4 (the LSB, book 0 page 2 reg 0x0F), so the
++ * bytes must be written MSB first and DVC_CFG4 last. Writing CFG4
++ * first latches a mix of the previous coefficient's upper bytes and
++ * the new LSB instead of the requested value.
++ */
++ ret = snd_soc_component_write(component, TAS2562_DVC_CFG1,
++ ((reg_val >> 24) & 0xff));
+ if (ret)
+ return ret;
+ ret = snd_soc_component_write(component, TAS2562_DVC_CFG2,
+ ((reg_val >> 16) & 0xff));
+ if (ret)
+ return ret;
+- ret = snd_soc_component_write(component, TAS2562_DVC_CFG1,
+- ((reg_val >> 24) & 0xff));
++ ret = snd_soc_component_write(component, TAS2562_DVC_CFG3,
++ ((reg_val >> 8) & 0xff));
++ if (ret)
++ return ret;
++ ret = snd_soc_component_write(component, TAS2562_DVC_CFG4,
++ (reg_val & 0xff));
+ if (ret)
+ return ret;
+
--- /dev/null
+From 1e024d2b41ee32bc06818f7f09a3562c58842cf9 Mon Sep 17 00:00:00 2001
+From: Matt Vollrath <tactii@gmail.com>
+Date: Fri, 24 Jul 2026 03:39:42 -0400
+Subject: ata: libata-eh: Increase STANDBY IMMEDIATE timeout
+
+From: Matt Vollrath <tactii@gmail.com>
+
+commit 1e024d2b41ee32bc06818f7f09a3562c58842cf9 upstream.
+
+Correct a previous change (see Fixes) which reduced the standby timeout
+from 30 to 5 seconds. Increase it to 15 seconds.
+
+I was troubleshooting an error spotted during system suspend:
+
+ [ 1217.152867] ata1.00: Entering standby power mode
+ [ 1222.322948] ata1.00: qc timeout after 5000 msecs (cmd 0xe0)
+ [ 1222.324010] ata1.00: STANDBY IMMEDIATE failed (err_mask=0x4)
+
+This drive is a Samsung 870 EVO SSD in good SMART standing, and I wasn't
+aware of any reason it should be taking so long to standby. The issue is
+intermittent, but I observed it sometimes taking 7 seconds to manually
+standby. I assume this was interruption of background maintenance after
+a power outage.
+
+As a desktop user, I would prefer to wait the extra 2 seconds at suspend
+to let the drive finish its business rather than drop the rails from
+under it.
+
+The change from 30 to 5 seconds was implicit when switching suspend
+from START STOP UNIT to an internal command with no timeout table entry.
+No reason was stated for the change.
+
+Fixes: aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matt Vollrath <tactii@gmail.com>
+Assisted-by: Claude:claude-5-fable
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-eh.c | 8 ++++++++
+ include/linux/libata.h | 2 +-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -106,6 +106,12 @@ static const unsigned int ata_eh_flush_t
+ UINT_MAX,
+ };
+
++static const unsigned int ata_eh_standby_timeouts[] = {
++ 15000, /* Some drives may be slow to standby */
++ /* but don't hold up a suspend too long waiting for them */
++ UINT_MAX,
++};
++
+ static const unsigned int ata_eh_other_timeouts[] = {
+ 5000, /* same rationale as identify timeout */
+ 10000, /* ditto */
+@@ -147,6 +153,8 @@ ata_eh_cmd_timeout_table[ATA_EH_CMD_TIME
+ .timeouts = ata_eh_other_timeouts, },
+ { .commands = CMDS(ATA_CMD_FLUSH, ATA_CMD_FLUSH_EXT),
+ .timeouts = ata_eh_flush_timeouts },
++ { .commands = CMDS(ATA_CMD_STANDBYNOW1),
++ .timeouts = ata_eh_standby_timeouts },
+ { .commands = CMDS(ATA_CMD_VERIFY),
+ .timeouts = ata_eh_reset_timeouts },
+ };
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -389,7 +389,7 @@ enum {
+ /* This should match the actual table size of
+ * ata_eh_cmd_timeout_table in libata-eh.c.
+ */
+- ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 8,
++ ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 9,
+
+ /*
+ * Quirk flags: may be set by libata or controller drivers on drives.
--- /dev/null
+From 3fd70e96914d761c17c376aadd0b0d1a3c9badba Mon Sep 17 00:00:00 2001
+From: Niklas Cassel <cassel@kernel.org>
+Date: Tue, 28 Jul 2026 13:38:42 +0200
+Subject: ata: libata-sata: fix ata_scsi_lpm_supported() iteration
+
+From: Niklas Cassel <cassel@kernel.org>
+
+commit 3fd70e96914d761c17c376aadd0b0d1a3c9badba upstream.
+
+The inner loop of ata_scsi_lpm_supported() uses the wrong variable when
+iterating.
+
+It should obviously use the link that we are currently iterating over,
+rather than always using the host link.
+
+ata_scsi_lpm_supported() is used to control if a user should be allowed
+to change lpm policy (from the default) via sysfs.
+
+Thus, this bug could potentially disallow users to change the LPM policy
+for certain SATA devices via sysfs.
+
+Cc: stable@vger.kernel.org
+Fixes: 0060beec0bfa ("ata: libata-sata: Add link_power_management_supported sysfs attribute")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Link: https://lore.kernel.org/linux-ide/20260728112200.B99F21F000E9@smtp.kernel.org/
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-sata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-sata.c
++++ b/drivers/ata/libata-sata.c
+@@ -913,7 +913,7 @@ static bool ata_scsi_lpm_supported(struc
+ return false;
+
+ ata_for_each_link(link, ap, EDGE) {
+- ata_for_each_dev(dev, &ap->link, ENABLED) {
++ ata_for_each_dev(dev, link, ENABLED) {
+ if (dev->quirks & ATA_QUIRK_NOLPM)
+ return false;
+ }
--- /dev/null
+From 88c17de85ddb459c3fe1e3c65d61fa366b1cf0a8 Mon Sep 17 00:00:00 2001
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Date: Thu, 23 Jul 2026 14:04:45 +0800
+Subject: bpf: lwt: Fix dst reference leak on reroute failure
+
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+
+commit 88c17de85ddb459c3fe1e3c65d61fa366b1cf0a8 upstream.
+
+bpf_lwt_xmit_reroute() obtains a referenced dst from the route
+lookup. When skb_cow_head() fails before that dst is installed on the
+skb, the error path only frees the skb. The skb still owns its previous
+dst, so the newly looked up dst reference is leaked.
+
+Release the new dst reference before freeing the skb on this error
+path.
+
+Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Link: https://patch.msgid.link/20260723060445.21926-1-xuanqiang.luo@linux.dev
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/lwt_bpf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/core/lwt_bpf.c
++++ b/net/core/lwt_bpf.c
+@@ -251,8 +251,10 @@ static int bpf_lwt_xmit_reroute(struct s
+ * if there is enough header space in skb.
+ */
+ err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
+- if (unlikely(err))
++ if (unlikely(err)) {
++ dst_release(dst);
+ goto err;
++ }
+
+ skb_dst_drop(skb);
+ skb_dst_set(skb, dst);
--- /dev/null
+From 867621ba203027338b525af6729719c544135336 Mon Sep 17 00:00:00 2001
+From: Md Sadre Alam <md.alam@oss.qualcomm.com>
+Date: Mon, 15 Jun 2026 11:39:08 +0530
+Subject: dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
+
+From: Md Sadre Alam <md.alam@oss.qualcomm.com>
+
+commit 867621ba203027338b525af6729719c544135336 upstream.
+
+BAM version 1.6.0 and later changed the behavior of the mask field in
+command elements for read operations.
+
+In older BAM versions, or prior implementation assumptions, the mask
+field was effectively ignored for read commands. However, starting from
+BAM v1.6.0, the mask field for read commands is repurposed to carry the
+upper 4 bits of the destination address, enabling support for 36-bit
+addressing. For write commands, the mask field continues to function as
+a traditional write mask.
+
+The current driver sets mask = 0xffffffff for all command elements.
+While this works for write operations, it breaks read operations on
+BAM v1.6.0+ hardware. In such cases, the hardware interprets the upper
+address bits as 0xf, resulting in an invalid destination address
+(0xf_xxxxxxxx instead of 0x0_xxxxxxxx).
+
+This leads to failures such as NAND enumeration issues observed on
+platforms like IPQ5424.
+
+Fix this by assigning the mask field based on command type:
+ - For read commands: set mask = 0 (upper address bits = 0)
+ - For write commands: retain mask = 0xffffffff
+
+Also update the bam_cmd_element structure documentation to reflect the
+dual purpose of the mask field across BAM versions.
+
+This ensures correct behavior on BAM v1.6.0+ while maintaining backward
+compatibility with older hardware.
+
+Fixes: dfebb055f73a2 ("dmaengine: qcom: bam_dma: wrapper functions for command descriptor")
+Tested-by: Lakshmi Sowjanya D <lakshmi.d@oss.qualcomm.com>
+Signed-off-by: Md Sadre Alam <md.alam@oss.qualcomm.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260615060908.1263171-1-varadarajan.narayanan@oss.qualcomm.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/dma/qcom_bam_dma.h | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/include/linux/dma/qcom_bam_dma.h
++++ b/include/linux/dma/qcom_bam_dma.h
+@@ -13,9 +13,12 @@
+ * supported by BAM DMA Engine.
+ *
+ * @cmd_and_addr - upper 8 bits command and lower 24 bits register address.
+- * @data - for write command: content to be written into peripheral register.
+- * for read command: dest addr to write peripheral register value.
+- * @mask - register mask.
++ * @data - For write command: content to be written into peripheral register.
++ * For read command: lower 32 bits of destination address.
++ * @mask - For write command: register write mask.
++ * For read command on BAM v1.6.0+: upper 4 bits of destination address.
++ * For read command on BAM < v1.6.0: ignored by hardware.
++ * Setting to 0 ensures 32-bit addressing compatibility.
+ * @reserved - for future usage.
+ *
+ */
+@@ -42,6 +45,10 @@ enum bam_command_type {
+ * @addr: target address
+ * @cmd: BAM command
+ * @data: actual data for write and dest addr for read in le32
++ *
++ * For BAM v1.6.0+, the mask field behavior depends on command type:
++ * - Write commands: mask = write mask (typically 0xffffffff)
++ * - Read commands: mask = upper 4 bits of destination address (0 for 32-bit)
+ */
+ static inline void
+ bam_prep_ce_le32(struct bam_cmd_element *bam_ce, u32 addr,
+@@ -50,7 +57,11 @@ bam_prep_ce_le32(struct bam_cmd_element
+ bam_ce->cmd_and_addr =
+ cpu_to_le32((addr & 0xffffff) | ((cmd & 0xff) << 24));
+ bam_ce->data = data;
+- bam_ce->mask = cpu_to_le32(0xffffffff);
++ if (cmd == BAM_READ_COMMAND)
++ bam_ce->mask = cpu_to_le32(0x0); /* 32-bit addressing */
++ else
++ bam_ce->mask = cpu_to_le32(0xffffffff); /* Write mask */
++ bam_ce->reserved = 0;
+ }
+
+ /*
+@@ -60,7 +71,7 @@ bam_prep_ce_le32(struct bam_cmd_element
+ * @bam_ce: BAM command element
+ * @addr: target address
+ * @cmd: BAM command
+- * @data: actual data for write and dest addr for read
++ * @data: actual data for write and destination address for read
+ */
+ static inline void
+ bam_prep_ce(struct bam_cmd_element *bam_ce, u32 addr,
--- /dev/null
+From 816419dfea5c88126f35eb7a1b429a1bf546665e Mon Sep 17 00:00:00 2001
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+Date: Sun, 7 Jun 2026 22:57:06 +0800
+Subject: e1000: fix memory leak in e1000_probe()
+
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+
+commit 816419dfea5c88126f35eb7a1b429a1bf546665e upstream.
+
+In the e1000_probe() path, e1000_sw_init() allocates adapter->tx_ring and
+adapter->rx_ring. If the subsequent CE4100-specific MDIO BAR mapping
+fails, the error handling jumps past the ring cleanup code, leaking both
+allocations.
+
+Fix this leak by moving the err_mdio_ioremap label above the ring
+deallocation logic. This guarantees the proper release of these resources
+and prevents the memory leak.
+
+The bug was first flagged by an experimental analysis tool we are
+developing for kernel memory-management bugs while analyzing
+v6.13-rc1. The tool is still under development and is not yet publicly
+available. Manual inspection confirms that the bug is still
+present in v7.1-rc6.
+
+An x86_64 allyesconfig build showed no new warnings. As we do not have a
+CE4100 reference platform to test with, no runtime testing was able to
+be performed.
+
+Fixes: 5377a4160bb65 ("e1000: Add support for the CE4100 reference platform")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
+Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -1222,11 +1222,11 @@ err_eeprom:
+
+ if (hw->flash_address)
+ iounmap(hw->flash_address);
++err_mdio_ioremap:
+ kfree(adapter->tx_ring);
+ kfree(adapter->rx_ring);
+ err_dma:
+ err_sw_init:
+-err_mdio_ioremap:
+ iounmap(hw->ce4100_gbe_mdio_base_virt);
+ iounmap(hw->hw_addr);
+ err_ioremap:
--- /dev/null
+From 0565052b7e2f436b7f1541f4849da96dc0aa7a0e Mon Sep 17 00:00:00 2001
+From: Matt Vollrath <tactii@gmail.com>
+Date: Thu, 16 Apr 2026 23:34:52 -0400
+Subject: igbvf: Fix leak in TX DMA error cleanup
+
+From: Matt Vollrath <tactii@gmail.com>
+
+commit 0565052b7e2f436b7f1541f4849da96dc0aa7a0e upstream.
+
+If an error is encountered while mapping TX buffers, the driver should
+unmap any buffers already mapped for that skb.
+
+Because count is incremented before each frag mapping, it will always
+match the correct number of unmappings needed when dma_error is reached.
+Decrementing count before the while loop in dma_error causes an
+off-by-one error. If any mapping was successful before an unsuccessful
+mapping, exactly one DMA mapping (the head) would leak.
+
+This bug was introduced by a 2010 fix for an endless loop in dma_error.
+All other affected drivers have already been fixed.
+
+Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-4-7-opus
+Signed-off-by: Matt Vollrath <tactii@gmail.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/igbvf/netdev.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/igbvf/netdev.c
++++ b/drivers/net/ethernet/intel/igbvf/netdev.c
+@@ -2191,8 +2191,6 @@ dma_error:
+ buffer_info->time_stamp = 0;
+ buffer_info->length = 0;
+ buffer_info->mapped_as_page = false;
+- if (count)
+- count--;
+
+ /* clear timestamp and dma mappings for remaining portion of packet */
+ while (count--) {
--- /dev/null
+From 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019 Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Sun, 12 Jul 2026 14:22:42 +0100
+Subject: igc: remove napi_synchronize() in igc_down()
+
+From: David Carlier <devnexen@gmail.com>
+
+commit 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019 upstream.
+
+When an AF_XDP zero-copy application is killed abruptly, the XSK pool is
+torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the
+full budget on every poll, so napi_complete_done() never clears
+NAPI_STATE_SCHED.
+
+igc_down() calls napi_synchronize() before napi_disable(), so it spins
+forever waiting for that bit and the interface never goes down. Drop the
+napi_synchronize() and let napi_disable() do the job -- it sets
+NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it
+ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after
+polling has stopped, matching the recent igb fix b1e067240379.
+
+Fixes: fc9df2a0b520 ("igc: Enable RX via AF_XDP zero-copy")
+Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
+Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -5354,9 +5354,8 @@ void igc_down(struct igc_adapter *adapte
+
+ for (i = 0; i < adapter->num_q_vectors; i++) {
+ if (adapter->q_vector[i]) {
+- napi_synchronize(&adapter->q_vector[i]->napi);
+- igc_set_queue_napi(adapter, i, NULL);
+ napi_disable(&adapter->q_vector[i]->napi);
++ igc_set_queue_napi(adapter, i, NULL);
+ }
+ }
+
--- /dev/null
+From a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b Mon Sep 17 00:00:00 2001
+From: Zhiling Zou <roxy520tt@gmail.com>
+Date: Mon, 13 Jul 2026 19:52:32 +0800
+Subject: ipvs: do not propagate one-packet flag to synced conns
+
+From: Zhiling Zou <roxy520tt@gmail.com>
+
+commit a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b upstream.
+
+Synced connections can be created before their destination exists. When
+the destination is later added, ip_vs_bind_dest() copies connection flags
+from the destination into cp->flags.
+
+IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced
+connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,
+expiry can treat it as a one-packet connection and skip unlinking the
+existing conn_tab node, leaving stale hash nodes pointing at a freed
+struct ip_vs_conn.
+
+Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced
+connections.
+
+Fixes: 26ec037f9841 ("IPVS: one-packet scheduling")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -599,6 +599,9 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
+ flags = cp->flags;
+ /* Bind with the destination and its corresponding transmitter */
+ if (flags & IP_VS_CONN_F_SYNC) {
++ /* Synced conns are hashed, so they can not get this flag */
++ conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
++
+ /* if the connection is not template and is created
+ * by sync, preserve the activity flag.
+ */
--- /dev/null
+From cb469993b3a61a72653770856d37af616d72d05f Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Thu, 23 Jul 2026 23:07:14 +0900
+Subject: ksmbd: reject repeated SMB2 NEGOTIATE requests
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit cb469993b3a61a72653770856d37af616d72d05f upstream.
+
+Unauthenticated client can send multiple successful SMB2 NEGOTIATE
+requests on one connection before SESSION_SETUP. While the connection is
+in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another
+SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation.
+Only the final allocation is freed when the connection is released, leaking
+one object for every additional successful request.
+
+A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol
+violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect
+without replying in this case. Set the connection exiting when rejecting
+the request, in addition to suppressing the response.
+
+Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the
+SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize
+both SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they
+update connection-wide dialect and negotiation state.
+
+Move the locking contract to ksmbd_smb_negotiate_common(), where the state
+and dialect are selected, and add ksmbd_conn_new() for consistent state
+access.
+
+Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
+Cc: stable@vger.kernel.org
+Reported-by: Runa Takemoto <takemotoruna223@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/connection.h | 5 +++++
+ fs/smb/server/smb2pdu.c | 10 ++--------
+ fs/smb/server/smb_common.c | 37 ++++++++++++++++++++++++++++++-------
+ 3 files changed, 37 insertions(+), 15 deletions(-)
+
+--- a/fs/smb/server/connection.h
++++ b/fs/smb/server/connection.h
+@@ -197,6 +197,11 @@ void ksmbd_conn_r_count_dec(struct ksmbd
+ * This is a hack. We will move status to a proper place once we land
+ * a multi-sessions support.
+ */
++static inline bool ksmbd_conn_new(struct ksmbd_conn *conn)
++{
++ return READ_ONCE(conn->status) == KSMBD_SESS_NEW;
++}
++
+ static inline bool ksmbd_conn_good(struct ksmbd_conn *conn)
+ {
+ return READ_ONCE(conn->status) == KSMBD_SESS_GOOD;
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1102,6 +1102,8 @@ static __le32 deassemble_neg_contexts(st
+ * smb2_handle_negotiate() - handler for smb2 negotiate command
+ * @work: smb work containing smb request buffer
+ *
++ * The caller holds conn->srv_mutex.
++ *
+ * Return: 0
+ */
+ int smb2_handle_negotiate(struct ksmbd_work *work)
+@@ -1115,13 +1117,6 @@ int smb2_handle_negotiate(struct ksmbd_w
+
+ ksmbd_debug(SMB, "Received negotiate request\n");
+ conn->need_neg = false;
+- if (ksmbd_conn_good(conn)) {
+- pr_err("conn->tcp_status is already in CifsGood State\n");
+- work->send_no_response = 1;
+- return rc;
+- }
+-
+- ksmbd_conn_lock(conn);
+ smb2_buf_len = get_rfc1002_len(work->request_buf);
+ smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects);
+ if (smb2_neg_size > smb2_buf_len) {
+@@ -1272,7 +1267,6 @@ int smb2_handle_negotiate(struct ksmbd_w
+ ksmbd_conn_set_need_setup(conn);
+
+ err_out:
+- ksmbd_conn_unlock(conn);
+ if (rc)
+ rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES;
+
+--- a/fs/smb/server/smb_common.c
++++ b/fs/smb/server/smb_common.c
+@@ -592,23 +592,46 @@ int ksmbd_smb_negotiate_common(struct ks
+ struct ksmbd_conn *conn = work->conn;
+ int ret;
+
+- conn->dialect =
+- ksmbd_negotiate_smb_dialect(work->request_buf);
+- ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect);
+-
+ if (command == SMB2_NEGOTIATE_HE) {
++ /*
++ * An SMB2 NEGOTIATE is valid for a new connection, or after an
++ * SMB1 multi-protocol negotiate has selected SMB2. Do not allow
++ * a second SMB2 NEGOTIATE to replace connection-wide state
++ * while a session setup is pending. KSMBD_SESS_NEED_RECONNECT
++ * is a transient session state and does not restart transport
++ * negotiation.
++ */
++ ksmbd_conn_lock(conn);
++ if (!ksmbd_conn_new(conn) &&
++ !ksmbd_conn_need_negotiate(conn)) {
++ work->send_no_response = 1;
++ ksmbd_conn_set_exiting(conn);
++ ksmbd_conn_unlock(conn);
++ return 0;
++ }
++
++ conn->dialect =
++ ksmbd_negotiate_smb_dialect(work->request_buf);
++ ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect);
+ ret = smb2_handle_negotiate(work);
++ ksmbd_conn_unlock(conn);
+ return ret;
+ }
+
+ if (command == SMB_COM_NEGOTIATE) {
++ ksmbd_conn_lock(conn);
++ conn->dialect =
++ ksmbd_negotiate_smb_dialect(work->request_buf);
++ ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect);
+ if (__smb2_negotiate(conn)) {
+ init_smb3_11_server(conn);
+- init_smb2_neg_rsp(work);
++ ret = init_smb2_neg_rsp(work);
+ ksmbd_debug(SMB, "Upgrade to SMB2 negotiation\n");
+- return 0;
++ } else {
++ ret = smb_handle_negotiate(work);
+ }
+- return smb_handle_negotiate(work);
++ ksmbd_conn_unlock(conn);
++ return ret;
+ }
+
+ pr_err("Unknown SMB negotiation command: %u\n", command);
--- /dev/null
+From d6f0248f04a96249660591e47fcf37ba98ac7ea3 Mon Sep 17 00:00:00 2001
+From: Wei Liu <wei.liu@kernel.org>
+Date: Tue, 30 Jun 2026 14:57:54 -0700
+Subject: mshv: fix hv_input_get_system_property struct
+
+From: Wei Liu <wei.liu@kernel.org>
+
+commit d6f0248f04a96249660591e47fcf37ba98ac7ea3 upstream.
+
+Keep it in sync with the correct definition.
+
+The old code worked by chance.
+
+Fixes: e68bda71a2384 ("hyperv: Add new Hyper-V headers in include/hyperv")
+Cc: stable@kernel.org
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/hyperv/hvhdk_mini.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/hyperv/hvhdk_mini.h
++++ b/include/hyperv/hvhdk_mini.h
+@@ -126,8 +126,9 @@ enum hv_dynamic_processor_feature_proper
+
+ struct hv_input_get_system_property {
+ u32 property_id; /* enum hv_system_property */
++ u32 reserved;
+ union {
+- u32 as_uint32;
++ u64 as_uint64;
+ #if IS_ENABLED(CONFIG_X86)
+ /* enum hv_dynamic_processor_feature_property */
+ u32 hv_processor_feature;
--- /dev/null
+From f621d6ebeebb6374342571e4ddf45fdbc420f6cd Mon Sep 17 00:00:00 2001
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Date: Thu, 23 Jul 2026 18:54:54 +0800
+Subject: net/smc: fix socket use-after-free during link group termination
+
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+
+commit f621d6ebeebb6374342571e4ddf45fdbc420f6cd upstream.
+
+__smc_lgr_terminate() drops conns_lock after finding a connection in
+lgr->conns_all, but before taking a reference on its socket. The connection
+is embedded in the socket, and its registration reference protects it only
+while the connection remains in the tree.
+
+A concurrent close can unregister the connection and drop that reference,
+freeing the socket before the termination worker reaches sock_hold().
+
+The race is reachable when close overlaps link group termination.
+Local stress testing reproduced the use-after-free and KASAN reported:
+
+ BUG: KASAN: slab-use-after-free in __smc_lgr_terminate.part.0 [smc]
+ Write of size 4 by task kworker/3:3
+ Workqueue: events smc_lgr_terminate_work [smc]
+ __smc_lgr_terminate.part.0 [smc]
+
+The socket was allocated by smc_create(), freed through
+slab_free_after_rcu_debug(), and was followed by:
+
+ refcount_t: addition on 0; use-after-free.
+ __smc_lgr_terminate.part.0 [smc]
+
+Take the socket reference while conns_lock still protects the tree entry.
+The unregister path then cannot drop the last reference until termination
+has finished using the socket.
+
+Fixes: 69318b5215f2 ("net/smc: improve abnormal termination locking")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
+Link: https://patch.msgid.link/20260723105454.87016-1-xuanqiang.luo@linux.dev
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/smc/smc_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -1558,10 +1558,10 @@ static void __smc_lgr_terminate(struct s
+ read_lock_bh(&lgr->conns_lock);
+ node = rb_first(&lgr->conns_all);
+ while (node) {
+- read_unlock_bh(&lgr->conns_lock);
+ conn = rb_entry(node, struct smc_connection, alert_node);
+ smc = container_of(conn, struct smc_sock, conn);
+ sock_hold(&smc->sk); /* sock_put below */
++ read_unlock_bh(&lgr->conns_lock);
+ lock_sock(&smc->sk);
+ smc_conn_kill(conn, soft);
+ release_sock(&smc->sk);
--- /dev/null
+From f30415929be8aeb002d557c8d3f7ab2d2188003a Mon Sep 17 00:00:00 2001
+From: David Lee <david.lee@trailofbits.com>
+Date: Mon, 13 Jul 2026 09:59:15 +0000
+Subject: netfilter: ipset: do not update comments from kernel-side hash adds
+
+From: David Lee <david.lee@trailofbits.com>
+
+commit f30415929be8aeb002d557c8d3f7ab2d2188003a upstream.
+
+mtype_resize() copies comment pointers with memcpy(), not the comment
+objects themselves. During the window after an entry has been copied but
+before the table swap and backlog replay, the old table is still
+published for packet-side updates while the replacement-table entry
+already holds the same ip_set_comment_rcu pointer.
+
+If xt_SET --add-set ... --exist hits that old entry in this window,
+mtype_add() calls ip_set_init_comment() even though packet-side adds
+carry no comment payload. That call frees the shared comment through the
+old entry, so the replacement-table entry now holds a stale pointer.
+When the queued add is replayed on the new table, mtype_add() calls
+ip_set_init_comment() again and strlen() dereferences the stale pointer.
+
+Fix this in mtype_add() by skipping ip_set_init_comment() when
+ext->target marks a packet-side add. Userspace adds still update
+comments, while packet-side adds can no longer free comment storage
+shared with a resize copy.
+
+Fixes: f66ee0410b1c ("netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Lee <david.lee@trailofbits.com>
+Assisted-by: Codex:gpt-5.5
+Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -984,7 +984,7 @@ overwrite_extensions:
+ #endif
+ if (SET_WITH_COUNTER(set))
+ ip_set_init_counter(ext_counter(data, set), ext);
+- if (SET_WITH_COMMENT(set))
++ if (SET_WITH_COMMENT(set) && !ext->target)
+ ip_set_init_comment(set, ext_comment(data, set), ext);
+ if (SET_WITH_SKBINFO(set))
+ ip_set_init_skbinfo(ext_skbinfo(data, set), ext);
--- /dev/null
+From bba13ad17b1a11b3f1ed9b3a5d556191d7755a59 Mon Sep 17 00:00:00 2001
+From: Carlo Caione <ccaione@baylibre.com>
+Date: Mon, 27 Jul 2026 10:36:59 +0200
+Subject: of/address: Fix NULL bus dereference in of_pci_range_parser_one()
+
+From: Carlo Caione <ccaione@baylibre.com>
+
+commit bba13ad17b1a11b3f1ed9b3a5d556191d7755a59 upstream.
+
+The bus matching rework made of_match_bus() return NULL for nodes with
+ranges/dma-ranges but no local #address-cells. parser_init() stored that
+NULL bus, and the range iterator later dereferenced it.
+
+Reject such nodes in parser_init(), leaving an explicit empty
+iterator for callers that ignore the init return, and make
+of_dma_get_max_cpu_address() honour the init failure so a rejected node
+cannot clamp the DMA limit.
+
+Fixes: 64ee3cf096ac ("of/address: Rework bus matching to avoid warnings")
+Cc: stable@vger.kernel.org
+Signed-off-by: Carlo Caione <ccaione@baylibre.com>
+Link: https://patch.msgid.link/20260727-of-range-parser-null-bus-v3-1-be01b708a4ce@baylibre.com
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/address.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -757,6 +757,7 @@ EXPORT_SYMBOL(of_property_read_reg);
+ static int parser_init(struct of_pci_range_parser *parser,
+ struct device_node *node, const char *name)
+ {
++ const __be32 *range;
+ int rlen;
+
+ parser->node = node;
+@@ -765,12 +766,20 @@ static int parser_init(struct of_pci_ran
+ parser->ns = of_bus_n_size_cells(node);
+ parser->dma = !strcmp(name, "dma-ranges");
+ parser->bus = of_match_bus(node);
++ parser->range = NULL;
++ parser->end = NULL;
+
+- parser->range = of_get_property(node, name, &rlen);
+- if (parser->range == NULL)
++ range = of_get_property(node, name, &rlen);
++ if (!range)
+ return -ENOENT;
+
+- parser->end = parser->range + rlen / sizeof(__be32);
++ if (!parser->bus ||
++ !OF_CHECK_COUNTS(parser->na, parser->ns) ||
++ !OF_CHECK_ADDR_COUNT(parser->pna))
++ return -EINVAL;
++
++ parser->range = range;
++ parser->end = range + rlen / sizeof(__be32);
+
+ return 0;
+ }
+@@ -796,7 +805,7 @@ struct of_pci_range *of_pci_range_parser
+ int na = parser->na;
+ int ns = parser->ns;
+ int np = parser->pna + na + ns;
+- int busflag_na = parser->bus->flag_cells;
++ int busflag_na;
+
+ if (!range)
+ return NULL;
+@@ -804,6 +813,8 @@ struct of_pci_range *of_pci_range_parser
+ if (!parser->range || parser->range + np > parser->end)
+ return NULL;
+
++ busflag_na = parser->bus->flag_cells;
++
+ range->flags = parser->bus->get_flags(parser->range);
+
+ range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na);
+@@ -980,8 +991,7 @@ phys_addr_t __init of_dma_get_max_cpu_ad
+ np = of_root;
+
+ ranges = of_get_property(np, "dma-ranges", &len);
+- if (ranges && len) {
+- of_dma_range_parser_init(&parser, np);
++ if (ranges && len && !of_dma_range_parser_init(&parser, np)) {
+ for_each_of_range(&parser, &range)
+ if (range.cpu_addr + range.size > cpu_end)
+ cpu_end = range.cpu_addr + range.size - 1;
bluetooth-hci_sync-fix-advertising-data-uafs.patch
bluetooth-hidp-reject-frames-without-a-transaction-header.patch
bluetooth-hidp-validate-numbered-report-payloads.patch
+bpf-lwt-fix-dst-reference-leak-on-reroute-failure.patch
+afs-fix-afs_fs_fetch_data-to-set-call-async.patch
+afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch
+afs-fix-uaf-when-sending-a-message.patch
+alsa-6fire-fix-uaf-at-error-handling-during-probe.patch
+alsa-hda-realtek-add-quirk-for-tongfang-x6sp45xu.patch
+alsa-lx6464es-fix-period-byte-count-for-16-bit-streams.patch
+alsa-pcm-wake-linked-drain-waiters-on-unlink.patch
+alsa-seq-fix-division-by-zero-in-initialize_timer.patch
+alsa-timer-clear-sndrv_timer_iflg_dead-once-the-close-completes.patch
+alsa-ump-fix-double-free-of-out_cvts-on-rawmidi-error.patch
+asoc-fsl_asrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch
+asoc-fsl_easrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch
+asoc-tas2562-fix-dvc-coefficient-write-order.patch
+asoc-tas2562-fix-broken-entries-in-the-volume-lookup-table.patch
+ata-libata-eh-increase-standby-immediate-timeout.patch
+ata-libata-sata-fix-ata_scsi_lpm_supported-iteration.patch
+alsa-usb-audio-fix-use-after-free-in-ump_to_endpoint.patch
+alsa-usb-audio-fix-stack-info-leak-in-rme-digiface-status.patch
+alsa-usb-audio-fix-oob-write-in-snd_usbmidi_akai_output.patch
+alsa-usb-audio-fix-dma-buffer-out-of-bounds-write-when-fill_max-is-set.patch
+alsa-usb-audio-clamp-frame-size-in-implicit-feedback-mode.patch
+dmaengine-qcom-bam_dma-fix-command-element-mask-field-for-bam-v1.6.0.patch
+e1000-fix-memory-leak-in-e1000_probe.patch
+igbvf-fix-leak-in-tx-dma-error-cleanup.patch
+igc-remove-napi_synchronize-in-igc_down.patch
+ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch
+ksmbd-reject-repeated-smb2-negotiate-requests.patch
+mshv-fix-hv_input_get_system_property-struct.patch
+net-smc-fix-socket-use-after-free-during-link-group-termination.patch
+netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch
+of-address-fix-null-bus-dereference-in-of_pci_range_parser_one.patch
+tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch
+wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch
--- /dev/null
+From b4f1719dfea023220e0e6bd892b087d76b2a6a49 Mon Sep 17 00:00:00 2001
+From: Zihan Xi <zihanx@nebusec.ai>
+Date: Fri, 24 Jul 2026 00:38:41 +0800
+Subject: tipc: avoid use-after-free in poll trace queue dumps
+
+From: Zihan Xi <zihanx@nebusec.ai>
+
+commit b4f1719dfea023220e0e6bd892b087d76b2a6a49 upstream.
+
+TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most
+queue-dump callsites already serialize that walk under the socket lock or
+sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(...,
+TIPC_DUMP_ALL, ...) without holding either lock.
+
+That lets the poll trace path reach tipc_list_dump() and backlog head/tail
+dumping while another context dequeues and frees an skb, leaving the trace
+helper dereferencing a stale queue entry.
+
+Stop the unlocked poll trace site from requesting queue dumps. Other queue
+dump trace callsites keep their existing output under the locking they
+already provide, while poll still emits the event itself without walking
+live queue members from an unlocked context.
+
+Fixes: b4b9771bcbbd ("tipc: enable tracepoints in tipc")
+Cc: stable@vger.kernel.org
+Reported-by: Vega <vega@nebusec.ai>
+Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
+Signed-off-by: Ren Wei <enjou1224z@gmail.com>
+Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
+Link: https://patch.msgid.link/f8119abd5e5ecc400597de667ae9d39656de56d0.1784794294.git.zihanx@nebusec.ai
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/socket.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -795,7 +795,7 @@ static __poll_t tipc_poll(struct file *f
+ __poll_t revents = 0;
+
+ sock_poll_wait(file, sock, wait);
+- trace_tipc_sk_poll(sk, NULL, TIPC_DUMP_ALL, " ");
++ trace_tipc_sk_poll(sk, NULL, TIPC_DUMP_NONE, " ");
+
+ if (sk->sk_shutdown & RCV_SHUTDOWN)
+ revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
--- /dev/null
+From 99a948382af8a225e2d5e54a7052158cd6281cc6 Mon Sep 17 00:00:00 2001
+From: Zhao Li <enderaoelyther@gmail.com>
+Date: Tue, 28 Jul 2026 19:53:25 +0800
+Subject: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
+
+From: Zhao Li <enderaoelyther@gmail.com>
+
+commit 99a948382af8a225e2d5e54a7052158cd6281cc6 upstream.
+
+mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with
+ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each
+subframe it passes the subframe data pointer to
+mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the
+length of the A-MSDU parent, instead of rx_skb->len:
+
+ rx_skb = __skb_dequeue(&list);
+ rx_hdr = (struct rx_packet_hdr *)rx_skb->data;
+ if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+ ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
+ mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,
+ skb->len);
+ }
+
+The parent is not a valid description of that buffer, and may not be
+valid memory at all. ieee80211_amsdu_to_8023s() ends with
+
+ if (!reuse_skb)
+ dev_kfree_skb(skb);
+
+and it only sets reuse_skb when the parent is linear, is not a
+head_frag, and is being consumed as the *last* subframe. So when the
+parent does not qualify for reuse it has already been freed, and the
+read of skb->len is a use-after-free. When it is reused, skb->len is
+the length of the last subframe, applied to every earlier subframe,
+which over-states the buffer whenever an earlier subframe is shorter.
+
+The callee cannot absorb a wrong length, because it derives its own
+ceiling from the value it is given. Each frame type computes
+
+ ies_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;
+
+and the element walk is then bounded entirely against that ceiling,
+
+ for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) {
+ u8 ie_len = pos[1];
+
+ if (pos + 2 + ie_len > end)
+ break;
+
+so a too-large len moves end past the end of the subframe and the walk
+reads and copies beyond it. The A-MSDU layout is chosen by the sender,
+which makes the difference between the last subframe and a shorter
+earlier one remotely selectable. Reaching this requires TDLS support in
+firmware and the TDLS ethertype on the subframe.
+
+The other caller, mwifiex_process_rx_packet(), is correct: it passes a
+pointer and a length that describe the same region of the RX buffer.
+
+Pass rx_skb->len, the length of the subframe actually being parsed.
+
+Fixes: 776f742040ca ("mwifiex: fix AMPDU not setup on TDLS link problem")
+Assisted-by: Codex:gpt-5.6-sol
+Assisted-by: Kimi:K3
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
+Link: https://patch.msgid.link/20260728115325.19128-1-enderaoelyther@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+@@ -44,7 +44,7 @@ static int mwifiex_11n_dispatch_amsdu_pk
+ ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
+ mwifiex_process_tdls_action_frame(priv,
+ (u8 *)rx_hdr,
+- skb->len);
++ rx_skb->len);
+ }
+
+ if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
projects / thirdparty / kernel / stable-queue.git / commitdiff
