From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 11:52:32 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=0678664f3bde00a27bd86cddfd91f0cde5e8a7a8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch net-bridge-stop-fast-leave-after-deleting-a-port-group.patch net-ipv6-clear-suppressed-fib6-rule-result.patch net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch s390-dasd-fix-potential-null-pointer-dereference.patch s390-qeth-check-cap_net_admin-for-private-ioctls.patch s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch sctp-prevent-peer-transport-count-overflow.patch sctp-reject-stale-cookies-with-mismatched-verification-tags.patch selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch tracing-filters-fix-false-positive-match-in-regex_match_full.patch um-vector-fix-use-after-free-in-vector_mmsg_rx.patch vxlan-re-fetch-eth-header-after-route_shortcircuit.patch vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch --- diff --git a/queue-5.15/cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch b/queue-5.15/cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch new file mode 100644 index 0000000000..e2f2c33cb5 --- /dev/null +++ b/queue-5.15/cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch @@ -0,0 +1,35 @@ +From d5f8e5f6040d052d44fcbf4f31dd35145c0c8d7d Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Mon, 27 Jul 2026 15:05:51 +0530 +Subject: cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() + +From: Abdun Nihaal + +commit d5f8e5f6040d052d44fcbf4f31dd35145c0c8d7d upstream. + +The memory allocated for data->powernow_table inside +powernow_k8_cpu_init_acpi() or find_psb_table() is not freed in one of +the error paths in powernowk8_cpu_init(). Fix that by adding a kfree(). + +Fixes: 1ff6e97f1d99 ("[CPUFREQ] cpumask: avoid playing with cpus_allowed in powernow-k8.c") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Acked-by: Viresh Kumar +Reviewed-by: Zhongqiu Han +Link: https://patch.msgid.link/20260727093553.98246-1-nihaal@cse.iitm.ac.in +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/powernow-k8.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1083,6 +1083,7 @@ static int powernowk8_cpu_init(struct cp + + err_out_exit_acpi: + powernow_k8_cpu_exit_acpi(data); ++ kfree(data->powernow_table); + + err_out: + kfree(data); diff --git a/queue-5.15/hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch b/queue-5.15/hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch new file mode 100644 index 0000000000..b1e5e0e5c0 --- /dev/null +++ b/queue-5.15/hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch @@ -0,0 +1,57 @@ +From f27f6976ea269219c1259a7c2f8c6dfe782540a3 Mon Sep 17 00:00:00 2001 +From: Hongyan Xu +Date: Wed, 29 Jul 2026 18:01:16 +0800 +Subject: hwmon: (npcm750-pwm-fan): stop fan timer on device detach + +From: Hongyan Xu + +commit f27f6976ea269219c1259a7c2f8c6dfe782540a3 upstream. + +When a fan tach channel is present, npcm7xx_pwm_fan_probe() starts +fan_timer. The timer callback polls tach state and rearms the timer, but +the driver has no remove callback or devm cleanup action to stop it. On +device detach, the devm-managed driver data and I/O mappings can be +released while the timer is still pending or running. + +Register a devm cleanup action before starting the timer and shut the +timer down synchronously from that action. + +This issue was found by a static analysis tool. + +Fixes: f1fd4a4db777 ("hwmon: Add NPCM7xx PWM and Fan driver") +Cc: stable@vger.kernel.org +Signed-off-by: Hongyan Xu +Link: https://lore.kernel.org/r/20260729100116.790-1-getshell@seu.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/npcm750-pwm-fan.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/hwmon/npcm750-pwm-fan.c ++++ b/drivers/hwmon/npcm750-pwm-fan.c +@@ -360,6 +360,11 @@ static void npcm7xx_fan_polling(struct t + add_timer(&data->fan_timer); + } + ++static void npcm7xx_fan_cleanup(void *timer) ++{ ++ timer_shutdown_sync(timer); ++} ++ + static inline void npcm7xx_fan_compute(struct npcm7xx_pwm_fan_data *data, + u8 fan, u8 cmp, u8 fan_id, u8 flag_int, + u8 flag_mode, u8 flag_clear) +@@ -1003,6 +1008,12 @@ static int npcm7xx_pwm_fan_probe(struct + msecs_to_jiffies(NPCM7XX_FAN_POLL_TIMER_200MS); + timer_setup(&data->fan_timer, + npcm7xx_fan_polling, 0); ++ ret = devm_add_action_or_reset(dev, ++ npcm7xx_fan_cleanup, ++ &data->fan_timer); ++ if (ret) ++ return ret; ++ + add_timer(&data->fan_timer); + break; + } diff --git a/queue-5.15/i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch b/queue-5.15/i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch new file mode 100644 index 0000000000..03bab29799 --- /dev/null +++ b/queue-5.15/i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch @@ -0,0 +1,43 @@ +From 82048795242f04275a3f49ffc66ad851b6120954 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Tue, 21 Jul 2026 23:41:47 +0900 +Subject: i2c: amd-mp2: Unregister callback on adapter add failure + +From: Myeonghun Pak + +commit 82048795242f04275a3f49ffc66ad851b6120954 upstream. + +amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI +driver's callback table before the adapter is registered. If +i2c_add_adapter() fails, probe returns and devres frees the context, +but the PCI driver can still dereference the stale pointer from its IRQ +and system-sleep callbacks. + +Unregister the callback before returning the adapter registration error. + +Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller") +Co-developed-by: Ijae Kim +Signed-off-by: Ijae Kim +Signed-off-by: Myeonghun Pak +Cc: # v5.2+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260721144147.31150-1-mhun512@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-amd-mp2-plat.c ++++ b/drivers/i2c/busses/i2c-amd-mp2-plat.c +@@ -326,8 +326,10 @@ static int i2c_amd_probe(struct platform + + amd_mp2_pm_runtime_put(mp2_dev); + +- if (ret < 0) ++ if (ret < 0) { + dev_err(&pdev->dev, "i2c add adapter failed = %d\n", ret); ++ amd_mp2_unregister_cb(&i2c_dev->common); ++ } + + return ret; + } diff --git a/queue-5.15/i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch b/queue-5.15/i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch new file mode 100644 index 0000000000..008a7b9500 --- /dev/null +++ b/queue-5.15/i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch @@ -0,0 +1,42 @@ +From 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f Mon Sep 17 00:00:00 2001 +From: Liem +Date: Mon, 29 Jun 2026 10:38:29 +0800 +Subject: i2c: imx: Cancel hrtimer before clearing slave pointer + +From: Liem + +commit 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f upstream. + +In i2c_imx_unreg_slave(), the slave pointer is set to NULL after +disabling interrupts. However, a pending interrupt might already +have started the hrtimer (i2c_imx_slave_timeout) before the pointer +was cleared. If the hrtimer fires after i2c_imx->slave is set to +NULL, the timer callback i2c_imx_slave_finish_op() will call +i2c_imx_slave_event() with a NULL slave pointer, which results in a +use-after-free / NULL pointer dereference. + +Fix by canceling the hrtimer and waiting for it to complete after +disabling interrupts, before clearing the slave pointer. + +Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver") +Signed-off-by: Liem +Cc: # v5.11+ +Acked-by: Carlos Song +Reviewed-by: Frank Li +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260629023829.152651-3-liem16213@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-imx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -865,6 +865,7 @@ static int i2c_imx_unreg_slave(struct i2 + + i2c_imx_reset_regs(i2c_imx); + ++ hrtimer_cancel(&i2c_imx->slave_timer); + i2c_imx->slave = NULL; + + /* Suspend */ diff --git a/queue-5.15/i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch b/queue-5.15/i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch new file mode 100644 index 0000000000..c5972a3e7d --- /dev/null +++ b/queue-5.15/i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch @@ -0,0 +1,75 @@ +From d99607c888f26e8a4e9fe9772860cef4aff86bb4 Mon Sep 17 00:00:00 2001 +From: "H. Nikolaus Schaller" +Date: Sun, 19 Jul 2026 22:19:43 +0200 +Subject: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock + +From: H. Nikolaus Schaller + +commit d99607c888f26e8a4e9fe9772860cef4aff86bb4 upstream. + +Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) +and the I2C adapter lock, which triggers when an I2C-controlled clock +generator client (like the Si5351) is registered or modified under the CCF. + +During an i2c client clock (generator) frequency change, the CCF acquires its global +'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's +chip registers, stalling for the adapter's I2C bus lock. + +Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO +expander handling LEDs) can hold the I2C adapter lock. Inside this parallel +transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host +controller's input clock to calculate bus timings. This call attempts to acquire +the blocked CCF 'prepare_lock', creating a circular dependency that freezes +the system. + +The jz4780 host controller clock itself is static and never changes at runtime. + +However, calling clk_get_rate() inside the active transfer path introduces +an unnecessary dependency on the CCF internal locks. + +Eliminate this synchronous clk_get_rate() call from the active transfer +path by caching the static host peripheral clock rate once - inside the private +jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed() +to use this cached value, safely decoupling active I2C transactions from the +CCF internal locks without any risk of stale timings. + +Assisted-by web based Google AI (pinpointing the bug and writing the message). + +Fixes: ba92222ed63a12 ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780") +Signed-off-by: H. Nikolaus Schaller +Cc: # v4.1+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/2db6fd233aceb7238474e4833f4d25ca681c3ffb.1784492382.git.hns@goldelico.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-jz4780.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-jz4780.c ++++ b/drivers/i2c/busses/i2c-jz4780.c +@@ -141,6 +141,7 @@ struct jz4780_i2c { + void __iomem *iomem; + int irq; + struct clk *clk; ++ unsigned long clk_rate_khz; + struct i2c_adapter adap; + const struct ingenic_i2c_config *cdata; + +@@ -246,7 +247,7 @@ static int jz4780_i2c_set_target(struct + + static int jz4780_i2c_set_speed(struct jz4780_i2c *i2c) + { +- int dev_clk_khz = clk_get_rate(i2c->clk) / 1000; ++ int dev_clk_khz = i2c->clk_rate_khz; + int cnt_high = 0; /* HIGH period count of the SCL clock */ + int cnt_low = 0; /* LOW period count of the SCL clock */ + int cnt_period = 0; /* period count of the SCL clock */ +@@ -800,6 +801,8 @@ static int jz4780_i2c_probe(struct platf + if (ret) + return ret; + ++ i2c->clk_rate_khz = clk_get_rate(i2c->clk) / 1000; ++ + ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency", + &clk_freq); + if (ret) { diff --git a/queue-5.15/mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch b/queue-5.15/mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch new file mode 100644 index 0000000000..9d16557871 --- /dev/null +++ b/queue-5.15/mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch @@ -0,0 +1,98 @@ +From 0b45f6927a14914ff685fe0e6f9d11232a1e03df Mon Sep 17 00:00:00 2001 +From: Link Lin +Date: Tue, 21 Jul 2026 00:55:33 +0000 +Subject: mm/page_reporting: use system_freezable_wq to fix UAF during suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Link Lin + +commit 0b45f6927a14914ff685fe0e6f9d11232a1e03df upstream. + +During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like +virtio_balloon reset their underlying virtio devices and delete their +virtqueues via vdev->config->del_vqs(). + +However, page reporting work (page_reporting_process) was scheduled on the +global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM +freezer skips it, leaving page_reporting_process active during suspend. + +If pages are freed into the buddy allocator while suspending (for example, +when core MM invokes the balloon shrinker during S4 hibernation image +saving), page reporting triggers virtballoon_free_page_report() on deleted +virtqueues, resulting in a Use-After-Free / General Protection Fault: + + [ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI + [ 196.825967] Workqueue: events page_reporting_process + [ 196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring] + [ 196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon] + [ 196.946943] page_reporting_process+0x370/0x4f0 + +Fix this by switching page reporting work to system_freezable_wq. This +ensures that the PM freezer pauses page_reporting_process before device +drivers destroy their reporting virtqueues. Because the reporting worker +is frozen, memory reclamation/freeing (e.g. via shrinker execution) can +safely return pages to MM during freeze without triggering unfrozen +reporting work on deleted virtqueues. + +This aligns with the driver's existing design. The comment in +virtballoon_freeze() states: + /* + * The workqueue is already frozen by the PM core before this + * function is called. + */ + +Testing: +I have verified these fixes using Google’s virtualization infrastructure +by running continuous suspend/resume iterations (40+ cycles) while +churning memory using stress-ng (`stress-ng --vm 4 --vm-bytes 60% +--timeout 1`) to constantly create free pages for the buddy allocator. We +also set the `page_reporting_order` parameter to 0 to make the page +reporting worker highly sensitive, forcing it to pick up any 4K free +pages. This confirmed that the UAF crashes are no longer reproducible. + +Link: https://lore.kernel.org/20260721005603.1710551-1-linkl@google.com +Fixes: 36e66c554b5c ("mm: introduce Reported pages") +Signed-off-by: Link Lin +Suggested-by: David Hildenbrand (Arm) +Suggested-by: Michael S. Tsirkin +Acked-by: David Rientjes +Acked-by: David Hildenbrand (Arm) +Acked-by: Michael S. Tsirkin +Cc: Alexander Duyck +Cc: Greg Thelen +Cc: James Houghton +Cc: Jason Wang +Cc: Jiaqi Yan +Cc: Vlastimil Babka +Cc: Xuan Zhuo +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/page_reporting.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/page_reporting.c ++++ b/mm/page_reporting.c +@@ -48,7 +48,8 @@ __page_reporting_request(struct page_rep + * now we are limiting this to running no more than once every + * couple of seconds. + */ +- schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY); ++ queue_delayed_work(system_freezable_wq, &prdev->work, ++ PAGE_REPORTING_DELAY); + } + + /* notify prdev of free page reporting request */ +@@ -311,7 +312,8 @@ err_out: + */ + state = atomic_cmpxchg(&prdev->state, state, PAGE_REPORTING_IDLE); + if (state == PAGE_REPORTING_REQUESTED) +- schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY); ++ queue_delayed_work(system_freezable_wq, &prdev->work, ++ PAGE_REPORTING_DELAY); + } + + static DEFINE_MUTEX(page_reporting_mutex); diff --git a/queue-5.15/net-bridge-stop-fast-leave-after-deleting-a-port-group.patch b/queue-5.15/net-bridge-stop-fast-leave-after-deleting-a-port-group.patch new file mode 100644 index 0000000000..2485a295f5 --- /dev/null +++ b/queue-5.15/net-bridge-stop-fast-leave-after-deleting-a-port-group.patch @@ -0,0 +1,47 @@ +From a39789f211b8a4125f0c70e05b30cf715f4f187d Mon Sep 17 00:00:00 2001 +From: Zhiling Zou +Date: Fri, 24 Jul 2026 00:52:48 +0800 +Subject: net: bridge: stop fast-leave after deleting a port group + +From: Zhiling Zou + +commit a39789f211b8a4125f0c70e05b30cf715f4f187d upstream. + +br_multicast_leave_group() iterates mp->ports with pp = &p->next in +its fast-leave path. After br_multicast_del_pg() removes p, +continuing the loop advances pp through the deleted entry. + +If multicast-to-unicast was enabled, the bridge can hold multiple port +groups for the same port and group with different source MAC +addresses. Once multicast-to-unicast is disabled, +br_port_group_equal() matches those entries by port only. A fast leave +can then delete one entry and continue from its stale next pointer, +leaving mp->ports pointing at a deleted port group. + +Fast leave only needs to remove one matching port group. Break after +br_multicast_del_pg() so the loop stops before dereferencing the +removed entry. + +Fixes: 6db6f0eae605 ("bridge: multicast to unicast") +Cc: stable@vger.kernel.org +Reported-by: Vega +Signed-off-by: Zhiling Zou +Signed-off-by: Ren Wei +Acked-by: Nikolay Aleksandrov +Link: https://patch.msgid.link/1cf0898872ef7c72d5f4c0304414a192c6dac591.1784707712.git.zhilinz@nebusec.ai +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_multicast.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -3511,6 +3511,7 @@ br_multicast_leave_group(struct net_brid + + p->flags |= MDB_PG_FLAGS_FAST_LEAVE; + br_multicast_del_pg(mp, p, pp); ++ break; + } + goto out; + } diff --git a/queue-5.15/net-ipv6-clear-suppressed-fib6-rule-result.patch b/queue-5.15/net-ipv6-clear-suppressed-fib6-rule-result.patch new file mode 100644 index 0000000000..01b5e694ef --- /dev/null +++ b/queue-5.15/net-ipv6-clear-suppressed-fib6-rule-result.patch @@ -0,0 +1,43 @@ +From 6aea62e433fe1b586202a5fee8b5807ce635e1d7 Mon Sep 17 00:00:00 2001 +From: Zhiling Zou +Date: Fri, 24 Jul 2026 00:48:52 +0800 +Subject: net: ipv6: clear suppressed fib6 rule result + +From: Zhiling Zou + +commit 6aea62e433fe1b586202a5fee8b5807ce635e1d7 upstream. + +fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), +but leaves res->rt6 pointing at the released rt6_info. + +If no later rule supplies a replacement, fib6_rule_lookup() still sees +res.rt6 and returns that stale dst to its caller. A suppressing rule can +therefore leak a released route back to rt6_lookup(), and the next put +hits rcuref_put_slowpath() from dst_release(). + +Clear res->rt6 when suppressing the route so suppressed lookups fall +through to the null dst instead of reusing the released one. + +Fixes: cdef485217d3 ("ipv6: fix memory leak in fib6_rule_suppress") +Cc: stable@vger.kernel.org +Reported-by: Vega +Signed-off-by: Zhiling Zou +Signed-off-by: Ren Wei +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/4b8acb7787d54e440155585dd32ebdf0bef7d122.1784710966.git.zhilinz@nebusec.ai +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/fib6_rules.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/fib6_rules.c ++++ b/net/ipv6/fib6_rules.c +@@ -300,6 +300,7 @@ INDIRECT_CALLABLE_SCOPE bool fib6_rule_s + + suppress_route: + ip6_rt_put_flags(rt, flags); ++ res->rt6 = NULL; + return true; + } + diff --git a/queue-5.15/net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch b/queue-5.15/net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch new file mode 100644 index 0000000000..3afb693658 --- /dev/null +++ b/queue-5.15/net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch @@ -0,0 +1,120 @@ +From a58a2b0ce354df531ebc71fc870058c2feb59f6b Mon Sep 17 00:00:00 2001 +From: Ilya Maximets +Date: Mon, 27 Jul 2026 14:10:21 +0200 +Subject: net: openvswitch: fix potential UAF on meter attach failure + +From: Ilya Maximets + +commit a58a2b0ce354df531ebc71fc870058c2feb59f6b upstream. + +While attaching a newly created meter attach_meter() function makes +the new meter visible to other CPUs but can still fail afterwards. +On failure, it detaches the meter back and returns an error. + +However, this is an unexpected behavior for the ovs_meter_cmd_set() +that uses a plain kfree(meter) on attach failure without waiting for +RCU readers to stop using it, assuming it was never visible. + +This is never a problem for ovs-vswitchd as it always creates meters +before creating any flows that use them. But the UAF can be triggered +with a custom application using uAPI: + + BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653) + Read of size 8 at addr ffff88810d152650 by task meter/2508 + + Call Trace: + ovs_meter_execute (net/openvswitch/meter.c:653) + do_execute_actions (net/openvswitch/actions.c:1407) + ovs_execute_actions (net/openvswitch/actions.c:1584) + ovs_packet_cmd_execute (net/openvswitch/datapath.c:703) + ... + netlink_sendmsg (af_netlink.c:1900) + + Allocated by task 2519: + __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) + ovs_meter_cmd_set (net/openvswitch/meter.c:422) + ... + netlink_sendmsg (af_netlink.c:1900) + + Freed by task 2519: + kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720) + ovs_meter_cmd_set (net/openvswitch/meter.c:479) + ... + netlink_sendmsg (af_netlink.c:1900) + +Fix that by making sure attach_meter() doesn't make the meter visible +until all the checks are done and the function can't fail anymore. + +This also makes sure the "hash" value is calculated after the potential +re-sizing of the table. + +Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642. + +Fixes: c7c4c44c9a95 ("net: openvswitch: expand the meters supported number") +Cc: stable@vger.kernel.org +Signed-off-by: Ilya Maximets +Reviewed-by: Eelco Chaudron +Link: https://patch.msgid.link/20260727121022.198461-1-i.maximets@ovn.org +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/meter.c | 33 +++++++++++++++++++-------------- + 1 file changed, 19 insertions(+), 14 deletions(-) + +--- a/net/openvswitch/meter.c ++++ b/net/openvswitch/meter.c +@@ -136,18 +136,10 @@ static void dp_meter_instance_remove(str + + static int attach_meter(struct dp_meter_table *tbl, struct dp_meter *meter) + { +- struct dp_meter_instance *ti = rcu_dereference_ovsl(tbl->ti); +- u32 hash = meter_hash(ti, meter->id); ++ struct dp_meter_instance *ti; ++ u32 hash; + int err; + +- /* In generally, slots selected should be empty, because +- * OvS uses id-pool to fetch a available id. +- */ +- if (unlikely(rcu_dereference_ovsl(ti->dp_meters[hash]))) +- return -EBUSY; +- +- dp_meter_instance_insert(ti, meter); +- + /* That function is thread-safe. */ + tbl->count++; + if (tbl->count >= tbl->max_meters_allowed) { +@@ -155,16 +147,29 @@ static int attach_meter(struct dp_meter_ + goto attach_err; + } + +- if (tbl->count >= ti->n_meters && +- dp_meter_instance_realloc(tbl, ti->n_meters * 2)) { +- err = -ENOMEM; ++ ti = rcu_dereference_ovsl(tbl->ti); ++ if (tbl->count >= ti->n_meters) { ++ err = dp_meter_instance_realloc(tbl, ti->n_meters * 2); ++ if (err) ++ goto attach_err; ++ ++ ti = rcu_dereference_ovsl(tbl->ti); ++ } ++ ++ hash = meter_hash(ti, meter->id); ++ ++ /* In general, selected slots should be empty, because ++ * OvS uses id-pool to fetch available ids. ++ */ ++ if (unlikely(rcu_dereference_ovsl(ti->dp_meters[hash]))) { ++ err = -EBUSY; + goto attach_err; + } + ++ dp_meter_instance_insert(ti, meter); + return 0; + + attach_err: +- dp_meter_instance_remove(ti, meter); + tbl->count--; + return err; + } diff --git a/queue-5.15/net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch b/queue-5.15/net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch new file mode 100644 index 0000000000..353f3c5f1a --- /dev/null +++ b/queue-5.15/net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch @@ -0,0 +1,44 @@ +From bc62e843bc48f933da765ce47079fd992e535794 Mon Sep 17 00:00:00 2001 +From: Ilya Maximets +Date: Mon, 27 Jul 2026 20:18:31 +0200 +Subject: net: openvswitch: fix skb leak on flow key update failure during ct + +From: Ilya Maximets + +commit bc62e843bc48f933da765ce47079fd992e535794 upstream. + +ovs_ct_execute() always steals or frees the skb on failure while +ovs_flow_key_update() does not. So, if it fails and we return right +away, the skb ends up leaked. + +Fix that by breaking instead and letting the common error handling +code at the bottom of the loop to free the skb properly. + +This is a very unlikely scenario as it requires the packet to become +unparseable by applying a set of actions on a previously parseable skb, +but should be fixed nevertheless. + +Reported by Sashiko. + +Fixes: ec0d043d05e6 ("openvswitch: Ensure flow is valid before executing ct") +Cc: stable@vger.kernel.org +Signed-off-by: Ilya Maximets +Reviewed-by: Aaron Conole +Link: https://patch.msgid.link/20260727181851.306076-3-i.maximets@ovn.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/actions.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -1326,7 +1326,7 @@ static int do_execute_actions(struct dat + if (!is_flow_key_valid(key)) { + err = ovs_flow_key_update(skb, key); + if (err) +- return err; ++ break; + } + + err = ovs_ct_execute(ovs_dp_get_net(dp), skb, key, diff --git a/queue-5.15/phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch b/queue-5.15/phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch new file mode 100644 index 0000000000..0fe9349d25 --- /dev/null +++ b/queue-5.15/phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch @@ -0,0 +1,40 @@ +From 6cb22477929489a412df8d153e550e77a012e701 Mon Sep 17 00:00:00 2001 +From: Nava kishore Manne +Date: Sat, 27 Jun 2026 21:22:27 +0530 +Subject: phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask + +From: Nava kishore Manne + +commit 6cb22477929489a412df8d153e550e77a012e701 upstream. + +The L0_TX_DIG_61 register bit 2 is a reserved read-only field. +The previous mask value 0x0f incorrectly included bit 2, causing +unintended writes to a reserved bit on every scrambler bypass +operation. + +Correct the mask to (BIT(3) | GENMASK(1, 0)) to cover only the +valid scramble bypass control bits. + +Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") +Cc: stable@vger.kernel.org +Signed-off-by: Nava kishore Manne +Signed-off-by: Radhey Shyam Pandey +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260627155229.2791113-2-radhey.shyam.pandey@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/xilinx/phy-zynqmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -53,7 +53,7 @@ + #define L0_TM_DIG_6 0x106c + #define L0_TM_DIS_DESCRAMBLE_DECODER 0x0f + #define L0_TX_DIG_61 0x00f4 +-#define L0_TM_DISABLE_SCRAMBLE_ENCODER 0x0f ++#define L0_TM_DISABLE_SCRAMBLE_ENCODER (BIT(3) | GENMASK(1, 0)) + + /* PLL Test Mode register parameters */ + #define L0_TM_PLL_DIG_37 0x2094 diff --git a/queue-5.15/phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch b/queue-5.15/phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch new file mode 100644 index 0000000000..de8646a8d6 --- /dev/null +++ b/queue-5.15/phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch @@ -0,0 +1,98 @@ +From 7eb61caf45607e1e1270f51f8f93f0ded53146da Mon Sep 17 00:00:00 2001 +From: Nava kishore Manne +Date: Sat, 27 Jun 2026 21:22:29 +0530 +Subject: phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB + +From: Nava kishore Manne + +commit 7eb61caf45607e1e1270f51f8f93f0ded53146da upstream. + +USB Gen1 requires scrambling and 8b/10b encoding to be performed in the +physical layer. Do not bypass PHY-side scrambler or encoder/decoder for +USB operation, as mandated by the USB 3.x specification. + +Scrambler and 8b/10b bypass remain restricted to SATA and SGMII +modes, where encoding is handled in the controller. + +Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") +Cc: stable@vger.kernel.org +Signed-off-by: Nava kishore Manne +Signed-off-by: Radhey Shyam Pandey +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260627155229.2791113-4-radhey.shyam.pandey@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/xilinx/phy-zynqmp.c | 39 +++++++++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 10 deletions(-) + +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -488,15 +488,30 @@ static void xpsgtr_lane_set_protocol(str + } + } + +-/* Bypass (de)scrambler and 8b/10b decoder and encoder. */ +-static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy) ++/** ++ * xpsgtr_bypass_scrambler_8b10b - Configure scrambler/encoder behavior ++ * @gtr_phy: pointer to lane context ++ * @bypass: true to enable scrambler/encoder bypass (SATA/SGMII), ++ * false to disable scrambler/encoder bypass (USB3) ++ * ++ * Uses RMW to preserve reserved and unrelated register fields. ++ */ ++static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy, ++ bool bypass) + { +- xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, +- L0_TM_DIS_DESCRAMBLE_DECODER, +- L0_TM_DIS_DESCRAMBLE_DECODER); +- xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, +- L0_TM_DISABLE_SCRAMBLE_ENCODER, +- L0_TM_DISABLE_SCRAMBLE_ENCODER); ++ if (bypass) { ++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, ++ L0_TM_DIS_DESCRAMBLE_DECODER, ++ L0_TM_DIS_DESCRAMBLE_DECODER); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER); ++ } else { ++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, ++ L0_TM_DIS_DESCRAMBLE_DECODER, 0); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER, 0); ++ } + } + + /* DP-specific initialization. */ +@@ -517,7 +532,7 @@ static void xpsgtr_phy_init_sata(struct + { + struct xpsgtr_dev *gtr_dev = gtr_phy->dev; + +- xpsgtr_bypass_scrambler_8b10b(gtr_phy); ++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, true); + + writel(gtr_phy->lane, gtr_dev->siou + SATA_CONTROL_OFFSET); + } +@@ -533,7 +548,7 @@ static void xpsgtr_phy_init_sgmii(struct + xpsgtr_clr_set(gtr_dev, TX_PROT_BUS_WIDTH, mask, val); + xpsgtr_clr_set(gtr_dev, RX_PROT_BUS_WIDTH, mask, val); + +- xpsgtr_bypass_scrambler_8b10b(gtr_phy); ++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, true); + } + + /* Configure TX de-emphasis and margining for DP. */ +@@ -694,6 +709,10 @@ static int xpsgtr_phy_init(struct phy *p + case ICM_PROTOCOL_SGMII: + xpsgtr_phy_init_sgmii(gtr_phy); + break; ++ ++ case ICM_PROTOCOL_USB: ++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, false); ++ break; + } + + goto out; diff --git a/queue-5.15/phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch b/queue-5.15/phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch new file mode 100644 index 0000000000..86cbcfc4bc --- /dev/null +++ b/queue-5.15/phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch @@ -0,0 +1,45 @@ +From 21e0749f931702765b9d52d05740092bc87fcd8d Mon Sep 17 00:00:00 2001 +From: Nava kishore Manne +Date: Sat, 27 Jun 2026 21:22:28 +0530 +Subject: phy: zynqmp: use read-modify-write for SERDES scrambler bypass + +From: Nava kishore Manne + +commit 21e0749f931702765b9d52d05740092bc87fcd8d upstream. + +xpsgtr_bypass_scrambler_8b10b() used xpsgtr_write_phy() which performs +a full register write, silently clearing any bits beyond the intended +bypass control fields. + +Switch to xpsgtr_clr_set_phy() with clr=mask, set=mask to set only +the bypass bits while preserving the remaining bits in each register. + +Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") +Cc: stable@vger.kernel.org +Signed-off-by: Nava kishore Manne +Signed-off-by: Radhey Shyam Pandey +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260627155229.2791113-3-radhey.shyam.pandey@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/xilinx/phy-zynqmp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -491,8 +491,12 @@ static void xpsgtr_lane_set_protocol(str + /* Bypass (de)scrambler and 8b/10b decoder and encoder. */ + static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy) + { +- xpsgtr_write_phy(gtr_phy, L0_TM_DIG_6, L0_TM_DIS_DESCRAMBLE_DECODER); +- xpsgtr_write_phy(gtr_phy, L0_TX_DIG_61, L0_TM_DISABLE_SCRAMBLE_ENCODER); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, ++ L0_TM_DIS_DESCRAMBLE_DECODER, ++ L0_TM_DIS_DESCRAMBLE_DECODER); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER); + } + + /* DP-specific initialization. */ diff --git a/queue-5.15/powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch b/queue-5.15/powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch new file mode 100644 index 0000000000..cc8e88a57b --- /dev/null +++ b/queue-5.15/powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch @@ -0,0 +1,38 @@ +From 0bb024f11d120abff3e8db9144a585b9d7fb8459 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sat, 11 Jul 2026 15:09:32 +0200 +Subject: powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() + +From: Thorsten Blum + +commit 0bb024f11d120abff3e8db9144a585b9d7fb8459 upstream. + +If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path +decrements iopage but keeps using the failed mapping's offset. As a +result, it repeatedly tries to invalidate the failed IOPTE slot and +leaves the already installed IOPTEs valid. + +Recompute offset and invalidate the installed IOPTEs instead. + +Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework") +Cc: stable@vger.kernel.org +Signed-off-by: Thorsten Blum +Reviewed-by: Ritesh Harjani (IBM) +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20260711130931.740719-3-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/ps3/mm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/platforms/ps3/mm.c ++++ b/arch/powerpc/platforms/ps3/mm.c +@@ -616,6 +616,7 @@ static int dma_ioc0_map_pages(struct ps3 + + fail_map: + for (iopage--; 0 <= iopage; iopage--) { ++ offset = (1 << r->page_size) * iopage; + lv1_put_iopte(0, + c->bus_addr + offset, + c->lpar_addr + offset, diff --git a/queue-5.15/s390-dasd-fix-potential-null-pointer-dereference.patch b/queue-5.15/s390-dasd-fix-potential-null-pointer-dereference.patch new file mode 100644 index 0000000000..8c06bcf73e --- /dev/null +++ b/queue-5.15/s390-dasd-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,47 @@ +From 9973026f572db6b67570cadc30942f3014e41079 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20H=C3=B6ppner?= +Date: Mon, 27 Jul 2026 16:28:39 +0200 +Subject: s390/dasd: Fix potential NULL pointer dereference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan Höppner + +commit 9973026f572db6b67570cadc30942f3014e41079 upstream. + +dasd_release_space() checks the implementation of the is_ese() +discipline function before calling it to determine if a given device is +an ESE DASD. + +The current usage of the logical AND operator will lead to a NULL +pointer dereference as the function is called even if the function +pointer is NULL. + +Fix this by using the logical OR operator. + +Fixes: 91dc4a197569 ("s390/dasd: Add new ioctl to release space") +Cc: stable@vger.kernel.org # v5.3+ +Reported-by: Vasily Gorbik +Acked-by: Eduard Shishkin +Reviewed-by: Stefan Haberland +Signed-off-by: Jan Höppner +Signed-off-by: Stefan Haberland +Link: https://patch.msgid.link/20260727142840.567286-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/block/dasd_ioctl.c ++++ b/drivers/s390/block/dasd_ioctl.c +@@ -330,7 +330,7 @@ out_err: + static int dasd_release_space(struct dasd_device *device, + struct format_data_t *rdata) + { +- if (!device->discipline->is_ese && !device->discipline->is_ese(device)) ++ if (!device->discipline->is_ese || !device->discipline->is_ese(device)) + return -ENOTSUPP; + if (!device->discipline->release_space) + return -ENOTSUPP; diff --git a/queue-5.15/s390-qeth-check-cap_net_admin-for-private-ioctls.patch b/queue-5.15/s390-qeth-check-cap_net_admin-for-private-ioctls.patch new file mode 100644 index 0000000000..cc371f9906 --- /dev/null +++ b/queue-5.15/s390-qeth-check-cap_net_admin-for-private-ioctls.patch @@ -0,0 +1,38 @@ +From d211028bac1bd0fff0026bfa2a8328e5b78cd0e6 Mon Sep 17 00:00:00 2001 +From: Aswin Karuvally +Date: Thu, 23 Jul 2026 16:00:50 +0200 +Subject: s390/qeth: Check CAP_NET_ADMIN for private ioctls + +From: Aswin Karuvally + +commit d211028bac1bd0fff0026bfa2a8328e5b78cd0e6 upstream. + +Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL, +SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN +capable check to ensure unprivileged users cannot invoke them. + +Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate") +Cc: stable@vger.kernel.org +Suggested-by: Christian Borntraeger +Reviewed-by: Christian Borntraeger +Reviewed-by: Alexandra Winter +Signed-off-by: Aswin Karuvally +Link: https://patch.msgid.link/20260723140050.762991-1-aswin@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/net/qeth_core_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -6609,6 +6609,9 @@ int qeth_siocdevprivate(struct net_devic + struct qeth_card *card = dev->ml_priv; + int rc = 0; + ++ if (!capable(CAP_NET_ADMIN)) ++ return -EPERM; ++ + switch (cmd) { + case SIOC_QETH_ADP_SET_SNMP_CONTROL: + rc = qeth_snmp_command(card, data); diff --git a/queue-5.15/s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch b/queue-5.15/s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch new file mode 100644 index 0000000000..06e68bd0ff --- /dev/null +++ b/queue-5.15/s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch @@ -0,0 +1,36 @@ +From 06afe425d5283b9764303de47f554da5a808ce8a Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Wed, 29 Jul 2026 11:36:15 +0200 +Subject: s390/zcrypt: Validate length for CCA AES cipher key requests + +From: Holger Dengler + +commit 06afe425d5283b9764303de47f554da5a808ce8a upstream. + +cca_cipher2protkey() derives the copy length for the CPRB parameter +block directly from the length field in the key token. Reject the +request early if the token length exceeds the available space in the +parameter block. + +Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys") +Signed-off-by: Holger Dengler +Cc: stable@vger.kernel.org # 5.4+ +Reviewed-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -1232,6 +1232,9 @@ int cca_cipher2protkey(u16 cardnr, u16 d + } __packed * prepparm; + int keytoklen = ((struct cipherkeytoken *)ckey)->len; + ++ if (keytoklen > PARMBSIZE - sizeof(struct aureqparm)) ++ return -EINVAL; ++ + /* get already prepared memory for 2 cprbs with param block each */ + rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); + if (rc) diff --git a/queue-5.15/s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch b/queue-5.15/s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch new file mode 100644 index 0000000000..f1505ca383 --- /dev/null +++ b/queue-5.15/s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch @@ -0,0 +1,36 @@ +From a9ae0f6dd45c3ccc1d69363f7aea8af179122730 Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Wed, 29 Jul 2026 11:36:16 +0200 +Subject: s390/zcrypt: Validate length for CCA ECC private key requests + +From: Holger Dengler + +commit a9ae0f6dd45c3ccc1d69363f7aea8af179122730 upstream. + +cca_ecc2protkey() derives the copy length for the CPRB parameter +block directly from the length field in the key token. Reject the +request early if the token length exceeds the available space in the +parameter block. + +Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys") +Signed-off-by: Holger Dengler +Cc: stable@vger.kernel.org # 5.10+ +Reviewed-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -1404,6 +1404,9 @@ int cca_ecc2protkey(u16 cardnr, u16 doma + } __packed * prepparm; + int keylen = ((struct eccprivkeytoken *)key)->len; + ++ if (keylen > PARMBSIZE - sizeof(struct aureqparm)) ++ return -EINVAL; ++ + /* get already prepared memory for 2 cprbs with param block each */ + rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); + if (rc) diff --git a/queue-5.15/sctp-prevent-peer-transport-count-overflow.patch b/queue-5.15/sctp-prevent-peer-transport-count-overflow.patch new file mode 100644 index 0000000000..a37ed07841 --- /dev/null +++ b/queue-5.15/sctp-prevent-peer-transport-count-overflow.patch @@ -0,0 +1,45 @@ +From bd0e9289e2642f6a5c54faad304ce0f41e926d22 Mon Sep 17 00:00:00 2001 +From: Asim Viladi Oglu Manizada +Date: Sat, 25 Jul 2026 03:21:06 +0000 +Subject: sctp: prevent peer transport count overflow + +From: Asim Viladi Oglu Manizada + +commit bd0e9289e2642f6a5c54faad304ce0f41e926d22 upstream. + +sctp_assoc_add_peer() increments the association's 16-bit transport_count +for every new unique peer. Adding the 65,536th transport wraps the count to +zero. + +SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, +then copies one sockaddr_storage for every entry in transport_addr_list. +After the wrap, a diagnostic dump reserves an empty payload and writes +8 MiB of peer addresses past the skb tail. + +Reject a new unique peer when transport_count has reached U16_MAX. Perform +the check after the existing-peer lookup so a duplicate address continues +to return its existing transport at the limit. + +Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") +Cc: stable@vger.kernel.org +Signed-off-by: Asim Viladi Oglu Manizada +Acked-by: Xin Long +Link: https://patch.msgid.link/20260725032053.521705-1-manizada@pm.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/associola.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -616,6 +616,9 @@ struct sctp_transport *sctp_assoc_add_pe + return peer; + } + ++ if (asoc->peer.transport_count == U16_MAX) ++ return NULL; ++ + peer = sctp_transport_new(asoc->base.net, addr, gfp); + if (!peer) + return NULL; diff --git a/queue-5.15/sctp-reject-stale-cookies-with-mismatched-verification-tags.patch b/queue-5.15/sctp-reject-stale-cookies-with-mismatched-verification-tags.patch new file mode 100644 index 0000000000..4e4250eb1d --- /dev/null +++ b/queue-5.15/sctp-reject-stale-cookies-with-mismatched-verification-tags.patch @@ -0,0 +1,65 @@ +From 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 Mon Sep 17 00:00:00 2001 +From: Yuxiang Yang +Date: Thu, 23 Jul 2026 22:56:23 +0000 +Subject: sctp: reject stale cookies with mismatched verification tags + +From: Yuxiang Yang + +commit 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 upstream. + +sctp_unpack_cookie() skips cookie expiration checks whenever an +association already exists. This is broader than the exception in +RFC 9260 Section 5.2.4. + +For an existing association, Section 5.2.4 permits an expired State +Cookie only when both Verification Tags in the cookie match the current +association. Otherwise, the packet SHOULD be discarded and a Stale +Cookie ERROR MUST be sent. + +The broad check lets an expired Action A restart cookie reach +sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second +cookie lifetime, replaying such a cookie after 65 seconds returned a +COOKIE-ACK and restarted the association. + +Check cookie expiration unless both Verification Tags match. This +preserves the Action D exception for a lost COOKIE ACK while rejecting +expired cookies in all other cases. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Yuxiang Yang +Acked-by: Xin Long +Link: https://patch.msgid.link/20260723225623.2658868-1-yangyx22@mails.tsinghua.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/sm_make_chunk.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1821,9 +1821,9 @@ no_hmac: + goto fail; + } + +- /* Check to see if the cookie is stale. If there is already +- * an association, there is no need to check cookie's expiration +- * for init collision case of lost COOKIE ACK. ++ /* Check to see if the cookie is stale. RFC 9260 Section 5.2.4 ++ * exempts an expired cookie only when both Verification Tags match ++ * the current association. + * If skb has been timestamped, then use the stamp, otherwise + * use current time. This introduces a small possibility that + * a cookie may be considered expired, but this would only slow +@@ -1834,7 +1834,10 @@ no_hmac: + else + kt = ktime_get_real(); + +- if (!asoc && ktime_before(bear_cookie->expiration, kt)) { ++ if ((!asoc || ++ asoc->c.my_vtag != bear_cookie->my_vtag || ++ asoc->c.peer_vtag != bear_cookie->peer_vtag) && ++ ktime_before(bear_cookie->expiration, kt)) { + suseconds_t usecs = ktime_to_us(ktime_sub(kt, bear_cookie->expiration)); + __be32 n = htonl(usecs); + diff --git a/queue-5.15/selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch b/queue-5.15/selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch new file mode 100644 index 0000000000..8f9ff45a11 --- /dev/null +++ b/queue-5.15/selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch @@ -0,0 +1,95 @@ +From 8f6f9fd93cd7a5dd607ad5cd910476dd68fff3ed Mon Sep 17 00:00:00 2001 +From: Chris Gellermann +Date: Wed, 22 Jul 2026 15:02:45 +0200 +Subject: selftests/clone3: fix wild pointer access of getline due to missing init + +From: Chris Gellermann + +commit 8f6f9fd93cd7a5dd607ad5cd910476dd68fff3ed upstream. + +Patch series "selftests: Add missing initalization of pointer passed to +getline", v2. + + +This patch (of 2): + +Clone3_set_tid uses getline(&line, ...) in a loop to read the child's +process status. The code expects that getline allocates the buffer for +the line on the first loop iteration. According to the Open Group +Spec[1], char *line has to be null pointer for this: + +> ssize_t getline(char **restrict lineptr, ...); +> If *lineptr is a null pointer or if the object pointed to by *lineptr +> is of insufficient size, an object shall be allocated as if by +malloc() +> or the object shall be reallocated as if by realloc()[...]. + +However, char *line is only declared, leading to an undefined value that +is potentially non-null. In an example run with Musl v1.2.6, the realloc +call[2] of getdelim, which implements getline, triggers a segfault: + +./run_kselftest.sh --test clone3:clone3_set_tid +[ 1366.165898] kselftest: Running tests in clone3 +... +[ 1367.799244] clone3_set_tid[811]: unhandled signal 11 code 0x1 at +0x0000000000000000 in libc.so[68184,3fbf69f000+4c000] +[ 1367.802808] CPU: 0 UID: 0 PID: 811 Comm: clone3_set_tid Not tainted +.. +[ 1367.804188] epc: 0x0000003fbf6b0184 +[ 1367.804188] ra : 0x0000003fbf6d4664 +[ 1367.804188] sp : 0x0000003fce5f2e40 +[ 1367.805314] gp : 0x0000002aaab0dfb8 +[ 1367.805314] tp : 0x0000003fbf6f14a8 +[ 1367.805314] t0 : 0x0000003fbf63d000 +... + +Looking at the realloc implementation, Musl mallocs for a null pointer +memory. But for a non-null pointer, it assumes it's passed a valid +pointer to the heap and tries to access its meta-data. This leads to the +segfault we see: + +void *realloc(void *p, size_t n) +{ + if (!p) return malloc(n); + if (size_overflows(n)) return 0; + + struct meta *g = get_meta(p); + ... +} + +Fix this by properly initializing the line pointer to NULL. + +Link: https://lore.kernel.org/20260722130246.2135563-1-christian.gellermann@codasip.com +Link: https://lore.kernel.org/20260722130246.2135563-2-christian.gellermann@codasip.com +Link: https://pubs.opengroup.org/onlinepubs/9799919799/functions/getline.html [1] +Link: https://git.musl-libc.org/cgit/musl/tree/src/stdio/getdelim.c#n38 [2] +Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") +Signed-off-by: Chris Gellermann +Acked-by: David Hildenbrand (arm) +Reviewed-by: Lorenzo Stoakes +Cc: Christian Brauner +Cc: Liam R. Howlett +Cc: Lorenzo Stoakes +Cc: Michal Hocko +Cc: Mike Rapoport +Cc: Shuah Khan +Cc: Suren Baghdasaryan +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/clone3/clone3_set_tid.c ++++ b/tools/testing/selftests/clone3/clone3_set_tid.c +@@ -146,7 +146,7 @@ int main(int argc, char *argv[]) + { + FILE *f; + char buf; +- char *line; ++ char *line = NULL; + int status; + int ret = -1; + size_t len = 0; diff --git a/queue-5.15/series b/queue-5.15/series index 6ab32bd1df..75e67941a9 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -315,3 +315,31 @@ netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch binfmt_misc-reject-a-flag-character-as-the-field-delimiter.patch +mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch +net-bridge-stop-fast-leave-after-deleting-a-port-group.patch +net-ipv6-clear-suppressed-fib6-rule-result.patch +powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch +um-vector-fix-use-after-free-in-vector_mmsg_rx.patch +vxlan-re-fetch-eth-header-after-route_shortcircuit.patch +vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch +vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch +vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch +tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch +tracing-filters-fix-false-positive-match-in-regex_match_full.patch +selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch +sctp-reject-stale-cookies-with-mismatched-verification-tags.patch +sctp-prevent-peer-transport-count-overflow.patch +hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch +i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch +cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch +s390-qeth-check-cap_net_admin-for-private-ioctls.patch +s390-dasd-fix-potential-null-pointer-dereference.patch +s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch +s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch +phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch +phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch +phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch +net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch +net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch +i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch +i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch diff --git a/queue-5.15/tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch b/queue-5.15/tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch new file mode 100644 index 0000000000..7bc35bbcaf --- /dev/null +++ b/queue-5.15/tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch @@ -0,0 +1,47 @@ +From ac8719969e6c3c54e939834df812bc41f25453cf Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Wed, 29 Jul 2026 09:27:58 +0900 +Subject: tracing: Check return value of __register_event() in trace_module_add_events() + +From: Masami Hiramatsu (Google) + +commit ac8719969e6c3c54e939834df812bc41f25453cf upstream. + +trace_module_add_events() ignores the return value of __register_event() +and unconditionally calls __add_event_to_tracers() for each event. + +If __register_event() fails (for example, if event_init() fails), the +trace_event_call is not added to ftrace_events list, but +__add_event_to_tracers() still creates a trace_event_file pointing to it. +If module loading subsequently fails and module memory is freed, tracing +state retains a stale trace_event_call pointer in trace_event_file, +leading to a use-after-free when tracefs or tracing subsystem operations +are later executed. + +Fix this by checking the return value of __register_event() and only +calling __add_event_to_tracers() if event registration succeeded. + +Fixes: ae63b31e4d0e ("tracing: Separate out trace events from global variables") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/178528487878.124250.14170824576025743236.stgit@devnote2 +Assisted-by: Antigravity:gemini-3.5-flash +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -3089,8 +3089,8 @@ static void trace_module_add_events(stru + end = mod->trace_events + mod->num_trace_events; + + for_each_event(call, start, end) { +- __register_event(*call, mod); +- __add_event_to_tracers(*call); ++ if (!__register_event(*call, mod)) ++ __add_event_to_tracers(*call); + } + } + diff --git a/queue-5.15/tracing-filters-fix-false-positive-match-in-regex_match_full.patch b/queue-5.15/tracing-filters-fix-false-positive-match-in-regex_match_full.patch new file mode 100644 index 0000000000..073dca27e1 --- /dev/null +++ b/queue-5.15/tracing-filters-fix-false-positive-match-in-regex_match_full.patch @@ -0,0 +1,46 @@ +From c22c7b735f9810ad276014f788f9aa5c879ec238 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Wed, 29 Jul 2026 09:28:07 +0900 +Subject: tracing/filters: Fix false positive match in regex_match_full() + +From: Masami Hiramatsu (Google) + +commit c22c7b735f9810ad276014f788f9aa5c879ec238 upstream. + +regex_match_full() calls strncmp(str, r->pattern, len) where len is the +target field buffer size. When len is smaller than r->len (the filter +pattern length), strncmp() checks only len bytes of r->pattern against +str. If those len bytes match, strncmp() returns 0, resulting in a +false-positive match where a shorter string in a fixed-size field +matches a longer filter pattern. + +For example, a 4-byte static string field containing "abcd" matched the +filter pattern "abcdefgh" because strncmp("abcd", "abcdefgh", 4) +returned 0. In this case, @len does NOT include '\0' because it is +fixed-size array. + +Fix this by returning 0 (no match) early when len < r->len. + +Fixes: 1889d20922d1 ("tracing/filters: Provide basic regex support") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/178528488779.124250.5571741156199253769.stgit@devnote2 +Assisted-by: Antigravity:gemini-3.5-flash +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_filter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -836,6 +836,9 @@ static int regex_match_full(char *str, s + if (!len) + return strcmp(str, r->pattern) == 0; + ++ if (len < r->len) ++ return 0; ++ + return strncmp(str, r->pattern, len) == 0; + } + diff --git a/queue-5.15/um-vector-fix-use-after-free-in-vector_mmsg_rx.patch b/queue-5.15/um-vector-fix-use-after-free-in-vector_mmsg_rx.patch new file mode 100644 index 0000000000..34ff4812d9 --- /dev/null +++ b/queue-5.15/um-vector-fix-use-after-free-in-vector_mmsg_rx.patch @@ -0,0 +1,58 @@ +From af421e9aed3920c7ac88c24daa48606c7112feca Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Mon, 22 Jun 2026 08:47:22 -0400 +Subject: um: vector: fix use-after-free in vector_mmsg_rx() + +From: Michael Bommarito + +commit af421e9aed3920c7ac88c24daa48606c7112feca upstream. + +When vector_mmsg_rx() discards a packet whose overlay header fails +verify_header(), it frees the skb and continues the loop: + + if (header_check < 0) { + dev_kfree_skb_irq(skb); + vp->estats.rx_encaps_errors++; + continue; + } + +The normal and short-packet paths fall through to the bottom of the +loop body, which clears the consumed slot and advances the cursors: + + (*skbuff_vector) = NULL; + mmsg_vector++; + skbuff_vector++; + +The verify_header() < 0 path skips that via continue, so the freed skb +is left in skbuff_vector[] and the cursors do not advance. The next +iteration reads the same slot, gets the freed skb, and frees it again, +producing a refcount underflow / use-after-free in the RX path. + +Discard the slot the same way the other paths do before continuing. + +Only transports whose verify_header() can return negative are affected: +GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), +so any peer on such a transport can trigger it without authentication. + +Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Michael Bommarito +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + arch/um/drivers/vector_kern.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/um/drivers/vector_kern.c ++++ b/arch/um/drivers/vector_kern.c +@@ -1007,6 +1007,9 @@ static int vector_mmsg_rx(struct vector_ + */ + dev_kfree_skb_irq(skb); + vp->estats.rx_encaps_errors++; ++ (*skbuff_vector) = NULL; ++ mmsg_vector++; ++ skbuff_vector++; + continue; + } + if (header_check > 0) { diff --git a/queue-5.15/vxlan-re-fetch-eth-header-after-route_shortcircuit.patch b/queue-5.15/vxlan-re-fetch-eth-header-after-route_shortcircuit.patch new file mode 100644 index 0000000000..b80dfe33b4 --- /dev/null +++ b/queue-5.15/vxlan-re-fetch-eth-header-after-route_shortcircuit.patch @@ -0,0 +1,40 @@ +From 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:45 +0000 +Subject: vxlan: re-fetch eth header after route_shortcircuit() + +From: Eric Dumazet + +commit 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 upstream. + +Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). + +Inside route_shortcircuit(), pskb_may_pull() can be called, which may +reallocate skb->head. + +In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to +freed memory, leading to a use-after-free when dereferencing eth->h_dest. + +Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit(). + +Fixes: ae8840825605 ("VXLAN: Allow L2 redirection with L3 switching") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Reviewed-by: Vadim Fedorenko +Link: https://patch.msgid.link/20260723144249.759100-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2941,6 +2941,7 @@ static netdev_tx_t vxlan_xmit(struct sk_ + (ntohs(eth->h_proto) == ETH_P_IP || + ntohs(eth->h_proto) == ETH_P_IPV6)) { + did_rsc = route_shortcircuit(dev, skb); ++ eth = eth_hdr(skb); + if (did_rsc) + f = vxlan_find_mac(vxlan, eth->h_dest, vni); + } diff --git a/queue-5.15/vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch b/queue-5.15/vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch new file mode 100644 index 0000000000..be96493d8e --- /dev/null +++ b/queue-5.15/vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch @@ -0,0 +1,45 @@ +From 760d36e737f2b3867762f42af36c663f55babcc4 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:46 +0000 +Subject: vxlan: unclone skb head before modifying eth header in route_shortcircuit() + +From: Eric Dumazet + +commit 760d36e737f2b3867762f42af36c663f55babcc4 upstream. + +When route_shortcircuit() performs L3 short-circuit routing, it modifies +the Ethernet header of the skb in-place: + memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, dev->addr_len); + memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); + +If the incoming skb is cloned (for example by packet sockets, tcpdump, or +dev_queue_xmit), modifying the Ethernet header without uncloning can corrupt +the packet header for other readers holding a reference to the cloned skb. + +Ensure the skb header is writable and unshared by calling skb_cow_head(skb, 0) +prior to updating the Ethernet header. If skb_cow_head() fails, abort short-circuiting +and return false to allow standard packet processing fallback. + +Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260723144249.759100-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2292,6 +2292,10 @@ static bool route_shortcircuit(struct ne + + diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha); + if (diff) { ++ if (skb_cow_head(skb, 0)) { ++ neigh_release(n); ++ return false; ++ } + memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, + dev->addr_len); + memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); diff --git a/queue-5.15/vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch b/queue-5.15/vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch new file mode 100644 index 0000000000..53004420dc --- /dev/null +++ b/queue-5.15/vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch @@ -0,0 +1,55 @@ +From 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:47 +0000 +Subject: vxlan: use neigh_ha_snapshot() in route_shortcircuit() + +From: Eric Dumazet + +commit 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d upstream. + +The neighbour hardware address n->ha can be updated asynchronously by the +neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without +holding the seqlock loop can lead to torn reads or reading a partially updated +MAC address. + +Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under +read_seqbegin()/read_seqretry() lock protection before using it. + +Note that arp_reduce() and neigh_reduce() seem to have the same issue +left for future patches. + +Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Reviewed-by: Vadim Fedorenko +Link: https://patch.msgid.link/20260723144249.759100-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2288,9 +2288,11 @@ static bool route_shortcircuit(struct ne + } + + if (n) { ++ u8 haddr[ETH_ALEN]; + bool diff; + +- diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha); ++ neigh_ha_snapshot(haddr, n, dev); ++ diff = !ether_addr_equal_unaligned(eth_hdr(skb)->h_dest, haddr); + if (diff) { + if (skb_cow_head(skb, 0)) { + neigh_release(n); +@@ -2298,7 +2300,7 @@ static bool route_shortcircuit(struct ne + } + memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, + dev->addr_len); +- memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); ++ memcpy(eth_hdr(skb)->h_dest, haddr, dev->addr_len); + } + neigh_release(n); + return diff; diff --git a/queue-5.15/vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch b/queue-5.15/vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch new file mode 100644 index 0000000000..fbab3e1a2e --- /dev/null +++ b/queue-5.15/vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch @@ -0,0 +1,53 @@ +From 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:48 +0000 +Subject: vxlan: use pskb_network_may_pull() in route_shortcircuit() + +From: Eric Dumazet + +commit 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb upstream. + +route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) +(or ipv6hdr), which checks if bytes are available starting from skb->data. + +However, in vxlan_xmit(), skb->data points to the MAC header, so +skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) +only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of +IP header), leaving the rest of the IP header potentially un-pulled in non-linear +frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled +linear buffer length. + +Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to +the length check to ensure the full network header is present in the linear buffer. + +Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Reviewed-by: Vadim Fedorenko +Link: https://patch.msgid.link/20260723144249.759100-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2240,7 +2240,7 @@ static bool route_shortcircuit(struct ne + { + struct iphdr *pip; + +- if (!pskb_may_pull(skb, sizeof(struct iphdr))) ++ if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) + return false; + pip = ip_hdr(skb); + n = neigh_lookup(&arp_tbl, &pip->daddr, dev); +@@ -2266,7 +2266,7 @@ static bool route_shortcircuit(struct ne + */ + if (!ipv6_stub->nd_tbl) + return false; +- if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) ++ if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) + return false; + pip6 = ipv6_hdr(skb); + n = neigh_lookup(ipv6_stub->nd_tbl, &pip6->daddr, dev);