From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 09:50:45 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=50d2cab57a6516109dc158a2ececcbfcd75fce52;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: afs-fix-afs_fs_fetch_data-to-set-call-async.patch afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch afs-fix-uaf-when-sending-a-message.patch alsa-6fire-fix-uaf-at-error-handling-during-probe.patch alsa-hda-realtek-add-quirk-for-tongfang-x6sp45xu.patch alsa-lx6464es-fix-period-byte-count-for-16-bit-streams.patch alsa-pcm-wake-linked-drain-waiters-on-unlink.patch alsa-seq-fix-division-by-zero-in-initialize_timer.patch alsa-timer-clear-sndrv_timer_iflg_dead-once-the-close-completes.patch alsa-ump-fix-double-free-of-out_cvts-on-rawmidi-error.patch alsa-usb-audio-clamp-frame-size-in-implicit-feedback-mode.patch alsa-usb-audio-fix-dma-buffer-out-of-bounds-write-when-fill_max-is-set.patch alsa-usb-audio-fix-oob-write-in-snd_usbmidi_akai_output.patch alsa-usb-audio-fix-stack-info-leak-in-rme-digiface-status.patch alsa-usb-audio-fix-use-after-free-in-ump_to_endpoint.patch asoc-fsl_asrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch asoc-fsl_easrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch asoc-tas2562-fix-broken-entries-in-the-volume-lookup-table.patch asoc-tas2562-fix-dvc-coefficient-write-order.patch ata-libata-eh-increase-standby-immediate-timeout.patch ata-libata-sata-fix-ata_scsi_lpm_supported-iteration.patch bpf-lwt-fix-dst-reference-leak-on-reroute-failure.patch dmaengine-qcom-bam_dma-fix-command-element-mask-field-for-bam-v1.6.0.patch e1000-fix-memory-leak-in-e1000_probe.patch igbvf-fix-leak-in-tx-dma-error-cleanup.patch igc-remove-napi_synchronize-in-igc_down.patch ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch ksmbd-reject-repeated-smb2-negotiate-requests.patch mshv-fix-hv_input_get_system_property-struct.patch net-smc-fix-socket-use-after-free-during-link-group-termination.patch netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch of-address-fix-null-bus-dereference-in-of_pci_range_parser_one.patch tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch --- diff --git a/queue-6.18/afs-fix-afs_fs_fetch_data-to-set-call-async.patch b/queue-6.18/afs-fix-afs_fs_fetch_data-to-set-call-async.patch new file mode 100644 index 0000000000..b217133141 --- /dev/null +++ b/queue-6.18/afs-fix-afs_fs_fetch_data-to-set-call-async.patch @@ -0,0 +1,38 @@ +From d568a43f6dbba3ba006304d95fd09862bd482a2f Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 23 Jul 2026 12:34:46 +0100 +Subject: afs: Fix afs_fs_fetch_data() to set call->async + +From: David Howells + +commit d568a43f6dbba3ba006304d95fd09862bd482a2f upstream. + +Fix afs_fs_fetch_data() to set call->async on an async operation as does +afs_fs_fetch_data64(). + +Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation") +Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260723113452.566619-2-dhowells@redhat.com +cc: Marc Dionne +cc: Jeffrey Altman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/fsclient.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/afs/fsclient.c ++++ b/fs/afs/fsclient.c +@@ -477,6 +477,9 @@ void afs_fs_fetch_data(struct afs_operat + if (!call) + return afs_op_nomem(op); + ++ if (op->flags & AFS_OPERATION_ASYNC) ++ call->async = true; ++ + /* marshall the parameters */ + bp = call->request; + bp[0] = htonl(FSFETCHDATA); diff --git a/queue-6.18/afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch b/queue-6.18/afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch new file mode 100644 index 0000000000..db01a13ab6 --- /dev/null +++ b/queue-6.18/afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch @@ -0,0 +1,42 @@ +From 222052c6be186f2074b3a4d741d5de200f654c43 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 23 Jul 2026 12:34:47 +0100 +Subject: afs: Fix afs_fs_fetch_data() to subtract transferred from len + +From: David Howells + +commit 222052c6be186f2074b3a4d741d5de200f654c43 upstream. + +Fix afs_fs_fetch_data() to subtract subreq->transferred from subreq->len +rather than adding it. + +Fixes: f28fc2010d62 ("afs: Eliminate afs_read") +Link: https://sashiko.dev/#/patchset/20260713081022.2186481-1-dhowells%40redhat.com +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260723113452.566619-3-dhowells@redhat.com +cc: Marc Dionne +cc: Jeffrey Altman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/fsclient.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c +index 626e1d37b915..1a3f186a6a11 100644 +--- a/fs/afs/fsclient.c ++++ b/fs/afs/fsclient.c +@@ -487,7 +487,7 @@ void afs_fs_fetch_data(struct afs_operation *op) + bp[2] = htonl(vp->fid.vnode); + bp[3] = htonl(vp->fid.unique); + bp[4] = htonl(lower_32_bits(subreq->start + subreq->transferred)); +- bp[5] = htonl(lower_32_bits(subreq->len + subreq->transferred)); ++ bp[5] = htonl(lower_32_bits(subreq->len - subreq->transferred)); + + call->fid = vp->fid; + trace_afs_make_fs_call(call, &vp->fid); +-- +2.55.0 + diff --git a/queue-6.18/afs-fix-uaf-when-sending-a-message.patch b/queue-6.18/afs-fix-uaf-when-sending-a-message.patch new file mode 100644 index 0000000000..f97deeefd8 --- /dev/null +++ b/queue-6.18/afs-fix-uaf-when-sending-a-message.patch @@ -0,0 +1,76 @@ +From 4af1ec68d54b3871155914d584fb10669c41a861 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 23 Jul 2026 12:34:48 +0100 +Subject: afs: Fix UAF when sending a message + +From: David Howells + +commit 4af1ec68d54b3871155914d584fb10669c41a861 upstream. + +In afs_make_call(), there's a race with async call reception and +destruction. If a call is dispatched that doesn't have call->write_iter +set (used to specify the data content for FS.StoreData), then the first +rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr. + +Once rxrpc_send_data() queues the last request packet, the response could +come in at any time and cause the call to be completed and put. However, +afs_make_call() will look at the call again to see it ->write_iter should +be handled - something it's only allowed to do if it has its own ref on the +call. Whilst this is the case for synchronous calls, it isn't true for +async calls such as FS.FetchData. + +There's also a potential UAF in afs_make_call() in the event that an +asynchronous call is being sent, but the call fails in some way (e.g. it +gets aborted from the server). The problem there is that afs_make_call() +tries to abort a call if the rxrpc send fails, but the asynchronous +notification from rxrpc may have caused the afs_call to be torn down. + +generic/650 plays games with randomly taking CPUs offline, and can +interject a significant delay such that the call is deallocated before +afs_make_call() gets to check call->write_iter - and a UAF ensues (caught +by KASAN). + + BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs] + Read of size 8 at addr ffff888035e050e8 by task fsstress/1409 + +Fix this by making afs_make_op_call() give the op->call its own ref rather +than transferring the caller's ref to it and then dropping the ref when +afs_make_call() returns. + +This also means that the afs_make_call() func never loses its ref on the +call now. + +Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation") +Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") +Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com +Reported-by: Marc Dionne +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260723113452.566619-4-dhowells@redhat.com +cc: Jeffrey Altman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/internal.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -1420,7 +1420,7 @@ static inline void afs_make_op_call(stru + { + struct afs_addr_list *alist = op->estate->addresses; + +- op->call = call; ++ op->call = afs_get_call(call, afs_call_trace_get); + op->type = call->type; + call->op = op; + call->key = op->key; +@@ -1428,6 +1428,7 @@ static inline void afs_make_op_call(stru + call->peer = rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer); + call->service_id = op->server->service_id; + afs_make_call(call, gfp); ++ afs_put_call(call); + } + + static inline void afs_extract_begin(struct afs_call *call, void *buf, size_t size) diff --git a/queue-6.18/alsa-6fire-fix-uaf-at-error-handling-during-probe.patch b/queue-6.18/alsa-6fire-fix-uaf-at-error-handling-during-probe.patch new file mode 100644 index 0000000000..705db5770c --- /dev/null +++ b/queue-6.18/alsa-6fire-fix-uaf-at-error-handling-during-probe.patch @@ -0,0 +1,39 @@ +From a54bf16965f896415c3337bc4fbb40fb11941d99 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 26 Jul 2026 09:48:19 +0200 +Subject: ALSA: 6fire: Fix UAF at error handling during probe + +From: Takashi Iwai + +commit a54bf16965f896415c3337bc4fbb40fb11941d99 upstream. + +Although 6fire driver had a few fixes for dealing with the early error +handling during the probe phase, it forgot a pending URB before +freeing the resources, which may lead to a UAF. + +This patch addresses it by doing the almost same cleanup procedure +like the normal disconnect phase at the error path. + +Reported-and-tested-by: Shuangpeng Bai +Closes: https://lore.kernel.org/20260724030900.1984491-1-shuangpeng.kernel@gmail.com +Cc: +Link: https://patch.msgid.link/20260726074821.2288158-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/6fire/chip.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/usb/6fire/chip.c ++++ b/sound/usb/6fire/chip.c +@@ -156,6 +156,10 @@ static int usb6fire_chip_probe(struct us + return 0; + + destroy_chip: ++ chip->shutdown = true; ++ if (card) ++ snd_card_disconnect(card); ++ usb6fire_chip_abort(chip); + snd_card_free(card); + return ret; + } diff --git a/queue-6.18/alsa-hda-realtek-add-quirk-for-tongfang-x6sp45xu.patch b/queue-6.18/alsa-hda-realtek-add-quirk-for-tongfang-x6sp45xu.patch new file mode 100644 index 0000000000..283a8bc921 --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-add-quirk-for-tongfang-x6sp45xu.patch @@ -0,0 +1,36 @@ +From 26a94400ffa4fcbeff32e23abebb83a1a20eb401 Mon Sep 17 00:00:00 2001 +From: Eckhart Mohr +Date: Fri, 24 Jul 2026 21:00:13 +0200 +Subject: ALSA: hda/realtek: Add quirk for TongFang X6SP45xU + +From: Eckhart Mohr + +commit 26a94400ffa4fcbeff32e23abebb83a1a20eb401 upstream. + +TongFang X6KK45xU and X6SP45xU have actually different PCI IDs. This patch +Adds the missing PCI ID to fix headphone detection and clarifies the +naming. + +Fixes: d595255241e5 ("ALSA: hda/realtek: Add quirk for TongFang X6xx45xU") +Signed-off-by: Eckhart Mohr +Cc: stable@vger.kernel.org +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260724190109.169889-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/hda/codecs/realtek/alc269.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -7560,7 +7560,8 @@ static const struct hda_quirk alc269_fix + SND_PCI_QUIRK(0x1d05, 0x300f, "TongFang X6AR5xxY", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d05, 0x3019, "TongFang X6FR5xxY", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d05, 0x3031, "TongFang X6AR55xU", ALC2XX_FIXUP_HEADSET_MIC), +- SND_PCI_QUIRK(0x1d05, 0x3034, "TongFang X6xx45xU", ALC2XX_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1d05, 0x3033, "TongFang X6SP45xU", ALC2XX_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1d05, 0x3034, "TongFang X6KK45xU", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), + SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE), diff --git a/queue-6.18/alsa-lx6464es-fix-period-byte-count-for-16-bit-streams.patch b/queue-6.18/alsa-lx6464es-fix-period-byte-count-for-16-bit-streams.patch new file mode 100644 index 0000000000..99482dfe4c --- /dev/null +++ b/queue-6.18/alsa-lx6464es-fix-period-byte-count-for-16-bit-streams.patch @@ -0,0 +1,63 @@ +From 6437033bffe8bd2af174d139af552d90d40c7ac6 Mon Sep 17 00:00:00 2001 +From: Xu Rao +Date: Thu, 23 Jul 2026 16:57:10 +0800 +Subject: ALSA: lx6464es: fix period byte count for 16-bit streams + +From: Xu Rao + +commit 6437033bffe8bd2af174d139af552d90d40c7ac6 upstream. + +The lx6464es driver advertises both 16-bit and packed 24-bit PCM formats, +but lx_trigger_start() and lx_interrupt_request_new_buffer() calculate the +DMA period size as runtime->period_size * runtime->channels * 3. That is +only correct for the packed 24-bit formats. + +For 16-bit streams the driver submits buffers that are 50% larger than the +actual ALSA period and advances the DMA address by the same wrong amount. +For example, with 2 channels, 256 frames and 4 periods, the third buffer +already extends beyond the ALSA buffer and the fourth buffer starts outside +it. + +Use snd_pcm_lib_period_bytes() so the byte count matches the runtime +format, channel count and period size. + +Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") +Cc: stable@vger.kernel.org +Signed-off-by: Xu Rao +Link: https://patch.msgid.link/8BB12E8D92A7CDBA+20260723085710.2567463-1-raoxu@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/lx6464es/lx6464es.c | 5 +---- + sound/pci/lx6464es/lx_core.c | 5 +---- + 2 files changed, 2 insertions(+), 8 deletions(-) + +--- a/sound/pci/lx6464es/lx6464es.c ++++ b/sound/pci/lx6464es/lx6464es.c +@@ -402,11 +402,8 @@ static void lx_trigger_start(struct lx64 + + int err; + +- const u32 channels = substream->runtime->channels; +- const u32 bytes_per_frame = channels * 3; +- const u32 period_size = substream->runtime->period_size; + const u32 periods = substream->runtime->periods; +- const u32 period_bytes = period_size * bytes_per_frame; ++ const u32 period_bytes = snd_pcm_lib_period_bytes(substream); + + dma_addr_t buf = substream->dma_buffer.addr; + int i; +--- a/sound/pci/lx6464es/lx_core.c ++++ b/sound/pci/lx6464es/lx_core.c +@@ -969,10 +969,7 @@ static int lx_interrupt_request_new_buff + const unsigned int is_capture = lx_stream->is_capture; + int err; + +- const u32 channels = substream->runtime->channels; +- const u32 bytes_per_frame = channels * 3; +- const u32 period_size = substream->runtime->period_size; +- const u32 period_bytes = period_size * bytes_per_frame; ++ const u32 period_bytes = snd_pcm_lib_period_bytes(substream); + const u32 pos = lx_stream->frame_pos; + const u32 next_pos = ((pos+1) == substream->runtime->periods) ? + 0 : pos + 1; diff --git a/queue-6.18/alsa-pcm-wake-linked-drain-waiters-on-unlink.patch b/queue-6.18/alsa-pcm-wake-linked-drain-waiters-on-unlink.patch new file mode 100644 index 0000000000..5eb1d3b435 --- /dev/null +++ b/queue-6.18/alsa-pcm-wake-linked-drain-waiters-on-unlink.patch @@ -0,0 +1,62 @@ +From f495b6c4c8594122918552c9be2b51eb71647cd9 Mon Sep 17 00:00:00 2001 +From: Norbert Szetei +Date: Tue, 28 Jul 2026 14:50:01 +0200 +Subject: ALSA: pcm: wake linked drain waiters on unlink + +From: Norbert Szetei + +commit f495b6c4c8594122918552c9be2b51eb71647cd9 upstream. + +snd_pcm_drain() on a linked stream parks an on-stack wait entry on the +drained peer's runtime->sleep, and after schedule_timeout() removes it +only if that peer is still found in the caller's group. If group +membership changes during the wait and the sleep ends by signal or +timeout (so autoremove_wake_function() does not run), finish_wait() is +skipped and snd_pcm_drain() returns with the entry still queued on that +stream's sleep list; a later wake_up() then walks a freed stack frame. +This is reachable by unlinking either the drained or the draining stream. + +Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()), +snd_pcm_unlink() never wakes the sleep queues. Wake every group member +under the group lock before the membership change, so a linked drainer is +released and drops its entry while the streams are still grouped. + +The window was opened when snd_pcm_link_rwsem stopped being held across +the wait and the removal became conditional on group membership (see +Fixes). The later switch to finish_wait() kept that conditional removal, +so the signal/timeout case remained. + +Fixes: f57f3df03a8e ("ALSA: pcm: More fine-grained PCM link locking") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-5 +Signed-off-by: Norbert Szetei +Link: https://patch.msgid.link/A0705100-D10B-4286-9980-0142ABEEAD51@doyensec.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/pcm_native.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -2334,6 +2334,7 @@ static void relink_to_local(struct snd_p + + static int snd_pcm_unlink(struct snd_pcm_substream *substream) + { ++ struct snd_pcm_substream *s; + struct snd_pcm_group *group; + bool nonatomic = substream->pcm->nonatomic; + bool do_free = false; +@@ -2346,6 +2347,12 @@ static int snd_pcm_unlink(struct snd_pcm + group = substream->group; + snd_pcm_group_lock_irq(group, nonatomic); + ++ /* release drain waiters before changing membership, else snd_pcm_drain() ++ * leaves its on-stack wait entry queued on a member's sleep list ++ */ ++ snd_pcm_group_for_each_entry(s, substream) ++ wake_up(&s->runtime->sleep); ++ + relink_to_local(substream); + refcount_dec(&group->refs); + diff --git a/queue-6.18/alsa-seq-fix-division-by-zero-in-initialize_timer.patch b/queue-6.18/alsa-seq-fix-division-by-zero-in-initialize_timer.patch new file mode 100644 index 0000000000..e9c080b8d1 --- /dev/null +++ b/queue-6.18/alsa-seq-fix-division-by-zero-in-initialize_timer.patch @@ -0,0 +1,69 @@ +From 21e19688433452dfbbbe6b2bb670dea6eb92f0f6 Mon Sep 17 00:00:00 2001 +From: Norbert Szetei +Date: Sat, 25 Jul 2026 08:33:45 +0200 +Subject: ALSA: seq: Fix division by zero in initialize_timer() + +From: Norbert Szetei + +commit 21e19688433452dfbbbe6b2bb670dea6eb92f0f6 upstream. + +A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set +the backing snd_timer's hardware resolution to an arbitrary 64-bit value +via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero. + +When such a timer is bound to a sequencer queue, initialize_timer() +computes the tick period as + + tmr->ticks = 1000000000 / (r * freq); + +where r is that user-controlled resolution and freq is the sequencer +update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250). +A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for +any even freq, including DEFAULT_FREQUENCY (1000), so the division faults +with a divide-by-zero. + +The division runs under tmr->lock with interrupts disabled, so the oops +leaves the spinlock held and hangs the CPU. It is reachable by an +unprivileged user with access to /dev/snd/timer and /dev/snd/seq. + + Oops: divide error: 0000 [#1] SMP KASAN PTI + CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+ + RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0 + snd_seq_timer_start+0x15e/0x2b0 + snd_seq_control_queue+0x56f/0xba0 + snd_seq_write+0x3e0/0x730 + +Reject an overflowing product with check_mul_overflow() and fall back to +a single tick, which also avoids feeding a wrapped-but-nonzero divisor +(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small +value) into the period computation. + +Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") +Cc: +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Norbert Szetei +Link: https://patch.msgid.link/DF8A3844-AD5E-4B8A-9CFC-BD83C212BA38@doyensec.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_timer.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/sound/core/seq/seq_timer.c ++++ b/sound/core/seq/seq_timer.c +@@ -362,11 +362,10 @@ static int initialize_timer(struct snd_s + tmr->ticks = 1; + if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) { + unsigned long r = snd_timer_resolution(tmr->timeri); +- if (r) { +- tmr->ticks = (unsigned int)(1000000000uL / (r * freq)); +- if (! tmr->ticks) +- tmr->ticks = 1; +- } ++ unsigned long den; ++ ++ if (r && !check_mul_overflow(r, freq, &den)) ++ tmr->ticks = max(1U, (unsigned int)(1000000000uL / den)); + } + tmr->initialized = 1; + return 0; diff --git a/queue-6.18/alsa-timer-clear-sndrv_timer_iflg_dead-once-the-close-completes.patch b/queue-6.18/alsa-timer-clear-sndrv_timer_iflg_dead-once-the-close-completes.patch new file mode 100644 index 0000000000..abc49c6717 --- /dev/null +++ b/queue-6.18/alsa-timer-clear-sndrv_timer_iflg_dead-once-the-close-completes.patch @@ -0,0 +1,59 @@ +From c2744d5f3aea474513fd2298daecb94a952ce441 Mon Sep 17 00:00:00 2001 +From: Norbert Szetei +Date: Sun, 26 Jul 2026 10:01:45 +0200 +Subject: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes + +From: Norbert Szetei + +commit c2744d5f3aea474513fd2298daecb94a952ce441 upstream. + +snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD +and returns early when the flag is already set, but the flag is never +cleared again. A completed close ends in remove_slave_links(), which +leaves timeri->timer NULL, so a second close is already harmless through +the timer == NULL path; the early return can only be reached by an +instance that was opened again in between. For such an instance the +close unlinks nothing, so snd_timer_instance_free() frees an object that +is still on timer->open_list_head, still on snd_timer_master_list if it +was opened with a slave key, still owns any adopted slaves, and still +holds its timer and module references. + +snd_seq_timer_open() reopens an instance exactly like that: it retries +its fallback open on the same object after a failure that has already +run snd_timer_close_locked() internally. An unprivileged user with +access to /dev/snd/timer and /dev/snd/seq can force that failure, since +snd_timer_check_master() returns -EBUSY when a pending slave matches the +new master's (slave_class, slave_id) key and the target timer has +reached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class = +SNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a +sequencer queue's key can be forged. The freed instance is afterwards +dereferenced by any further snd_timer_open() on that timer, by +snd_timer_check_slave(), and by /proc/asound/timers, which faults on the +stale ti->owner pointer. + +The flag only has to be visible while the close is in progress, which is +all its other users need. Clear it in remove_slave_links(), under the +same timer->lock that sets it, once the instance is off every list. + +Fixes: da3039e91d1f ("ALSA: timer: Forcibly close timer instances at closing") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-5 +Signed-off-by: Norbert Szetei +Link: https://patch.msgid.link/CA41AA48-75BF-45E9-A36D-3A5D2F124F60@doyensec.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/timer.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -409,6 +409,8 @@ static void remove_slave_links(struct sn + list_del_init(&slave->ack_list); + list_del_init(&slave->active_list); + } ++ /* the close is done; a reopen must not see the mark */ ++ timeri->flags &= ~SNDRV_TIMER_IFLG_DEAD; + } + + /* diff --git a/queue-6.18/alsa-ump-fix-double-free-of-out_cvts-on-rawmidi-error.patch b/queue-6.18/alsa-ump-fix-double-free-of-out_cvts-on-rawmidi-error.patch new file mode 100644 index 0000000000..3caaac34c7 --- /dev/null +++ b/queue-6.18/alsa-ump-fix-double-free-of-out_cvts-on-rawmidi-error.patch @@ -0,0 +1,46 @@ +From 70c977815af0d997feb2d0c5d284d55689bf7051 Mon Sep 17 00:00:00 2001 +From: Baul Lee +Date: Sun, 26 Jul 2026 14:16:33 +0900 +Subject: ALSA: ump: fix double free of out_cvts on rawmidi error + +From: Baul Lee + +commit 70c977815af0d997feb2d0c5d284d55689bf7051 upstream. + +snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array +ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with +kfree() but leaves ump->out_cvts pointing at the freed memory. When the +endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts +a second time, resulting in a double free. + +The host snd-usb-audio driver attaches the legacy rawmidi for any USB +MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail +reaches this path on enumeration. + +Clear ump->out_cvts after freeing it on the error path so it is not +freed again during teardown. + +Discovered by XBOW, triaged by Baul Lee + +Fixes: 33cd7630782d ("ALSA: ump: Export MIDI1 / UMP conversion helpers") +Reported-by: Federico Kirschbaum +Reported-by: Baul Lee +Cc: stable@vger.kernel.org +Signed-off-by: Baul Lee +Link: https://patch.msgid.link/20260726051633.41206-1-baul.lee@xbow.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/ump.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/core/ump.c ++++ b/sound/core/ump.c +@@ -1366,6 +1366,7 @@ int snd_ump_attach_legacy_rawmidi(struct + &rmidi); + if (err < 0) { + kfree(ump->out_cvts); ++ ump->out_cvts = NULL; + return err; + } + diff --git a/queue-6.18/alsa-usb-audio-clamp-frame-size-in-implicit-feedback-mode.patch b/queue-6.18/alsa-usb-audio-clamp-frame-size-in-implicit-feedback-mode.patch new file mode 100644 index 0000000000..6093e22ca2 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-clamp-frame-size-in-implicit-feedback-mode.patch @@ -0,0 +1,52 @@ +From 8d7a30c50c2e58a6839634ed0acde14466d1dc61 Mon Sep 17 00:00:00 2001 +From: Sonali Pradhan +Date: Tue, 28 Jul 2026 20:24:32 +0000 +Subject: ALSA: usb-audio: Clamp frame size in implicit-feedback mode + +From: Sonali Pradhan + +commit 8d7a30c50c2e58a6839634ed0acde14466d1dc61 upstream. + +snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's +stride and stores the result directly in out_packet->packet_size[i]. If a +connected USB device sends an oversized sync packet, this frame count can +exceed ep->maxframesize. + +The un-clamped frame count then propagates to the playback endpoint queue, +potentially driving packet transfers beyond the endpoint's hardware frame +limits. + +Cap the calculated frame count against ep->maxframesize in +snd_usb_handle_sync_urb() to prevent oversized packets from entering the +playback queue. + +Fixes: 28acb12014fb ("ALSA: usb-audio: use sender stride for implicit feedback") +Cc: stable@vger.kernel.org +Assisted-by: Jetski:Gemini-3.6-Flash +Signed-off-by: Sonali Pradhan +Link: https://patch.msgid.link/20260728202432.2354994-1-sonalipradhan@google.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/endpoint.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -1806,11 +1806,13 @@ static void snd_usb_handle_sync_urb(stru + + out_packet->packets = in_ctx->packets; + for (i = 0; i < in_ctx->packets; i++) { +- if (urb->iso_frame_desc[i].status == 0) +- out_packet->packet_size[i] = ++ if (urb->iso_frame_desc[i].status == 0) { ++ unsigned int frames = + urb->iso_frame_desc[i].actual_length / sender->stride; +- else ++ out_packet->packet_size[i] = min(frames, ep->maxframesize); ++ } else { + out_packet->packet_size[i] = 0; ++ } + } + + spin_unlock_irqrestore(&ep->lock, flags); diff --git a/queue-6.18/alsa-usb-audio-fix-dma-buffer-out-of-bounds-write-when-fill_max-is-set.patch b/queue-6.18/alsa-usb-audio-fix-dma-buffer-out-of-bounds-write-when-fill_max-is-set.patch new file mode 100644 index 0000000000..3d94a1dd88 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-fix-dma-buffer-out-of-bounds-write-when-fill_max-is-set.patch @@ -0,0 +1,52 @@ +From d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5 Mon Sep 17 00:00:00 2001 +From: Sonali Pradhan +Date: Tue, 28 Jul 2026 20:17:16 +0000 +Subject: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set + +From: Sonali Pradhan + +commit d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5 upstream. + +When a USB audio endpoint requests full packet transfers via the fill_max +descriptor flag, data_ep_set_params() promotes ep->curpacksize to +ep->maxpacksize. However, maxsize is left at the original sample-rate +derived value. + +Since u->buffer_size is allocated as maxsize * packets, the resulting +DMA buffer is far too small for the requested transfer length. When the +USB host controller streams up to curpacksize bytes per packet, it writes +past the end of the buffer via DMA, corrupting kernel heap memory. + +Update maxsize to curpacksize when fill_max is set so that the allocated +DMA buffer size matches the actual transfer request size. + +[ changed to reassign maxsize only when ep->fill_max is set -- tiwai ] + +Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model") +Cc: stable@vger.kernel.org +Assisted-by: Jetski:Gemini-3.6-Flash +Signed-off-by: Sonali Pradhan +Link: https://patch.msgid.link/20260728201716.2347726-1-sonalipradhan@google.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/endpoint.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -1164,10 +1164,12 @@ static int data_ep_set_params(struct snd + << (16 - ep->datainterval); + } + +- if (ep->fill_max) ++ if (ep->fill_max) { + ep->curpacksize = ep->maxpacksize; +- else ++ maxsize = ep->curpacksize; ++ } else { + ep->curpacksize = maxsize; ++ } + + if (snd_usb_get_speed(chip->dev) != USB_SPEED_FULL) { + packs_per_ms = 8 >> ep->datainterval; diff --git a/queue-6.18/alsa-usb-audio-fix-oob-write-in-snd_usbmidi_akai_output.patch b/queue-6.18/alsa-usb-audio-fix-oob-write-in-snd_usbmidi_akai_output.patch new file mode 100644 index 0000000000..1b6c6d7053 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-fix-oob-write-in-snd_usbmidi_akai_output.patch @@ -0,0 +1,56 @@ +From 0970274613fb463d376211450cab066d34ebfe6a Mon Sep 17 00:00:00 2001 +From: Baul Lee +Date: Sun, 26 Jul 2026 16:45:00 +0900 +Subject: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() + +From: Baul Lee + +commit 0970274613fb463d376211450cab066d34ebfe6a upstream. + +snd_usbmidi_akai_output() computes its fill-loop bound + + buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; + +as a signed int, so a small device-advertised bulk-OUT max_transfer +makes buf_end negative. The loop guard then compares the u32 +urb->transfer_buffer_length against that negative int: the usual +arithmetic conversion turns buf_end into a large unsigned value, so the +guard stays true and each iteration keeps appending SysEx framing and +payload bytes past the end of the URB transfer buffer, which is only +max_transfer bytes long. + +A USB device that advertises a tiny bulk-OUT endpoint can therefore +trigger an attacker-length- and content-controlled heap out-of-bounds +write when a process writes to the created /dev/snd/midiC*D* node. + +Return early when there is no room for even one SysEx, so the loop is +never entered with a bound that would wrap. The loop is the last +statement of the function, so bailing out is equivalent to it not +running. + +Discovered by XBOW, triaged by Baul Lee + +Fixes: 4434ade8c933 ("ALSA: usb-audio: add support for Akai MPD16") +Suggested-by: Takashi Iwai +Reported-by: Federico Kirschbaum +Reported-by: Baul Lee +Cc: stable@vger.kernel.org +Signed-off-by: Baul Lee +Link: https://patch.msgid.link/20260726074500.50145-1-baul.lee@xbow.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/midi.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -793,6 +793,8 @@ static void snd_usbmidi_akai_output(stru + + msg = urb->transfer_buffer + urb->transfer_buffer_length; + buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; ++ if (buf_end <= 0) ++ return; + + /* only try adding more data when there's space for at least 1 SysEx */ + while (urb->transfer_buffer_length < buf_end) { diff --git a/queue-6.18/alsa-usb-audio-fix-stack-info-leak-in-rme-digiface-status.patch b/queue-6.18/alsa-usb-audio-fix-stack-info-leak-in-rme-digiface-status.patch new file mode 100644 index 0000000000..f9a2917764 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-fix-stack-info-leak-in-rme-digiface-status.patch @@ -0,0 +1,63 @@ +From 441aaad150c57edaf57ee482a79a3bf4c5b7e353 Mon Sep 17 00:00:00 2001 +From: Baul Lee +Date: Sun, 26 Jul 2026 15:50:20 +0900 +Subject: ALSA: usb-audio: fix stack info leak in RME Digiface status + +From: Baul Lee + +commit 441aaad150c57edaf57ee482a79a3bf4c5b7e353 upstream. + +snd_rme_digiface_read_status() reads a four-word status block from the +device into an uninitialised on-stack __le32 buf[4] and, whenever the +vendor control-IN transfer does not return a negative error, copies all +four words into the caller's status[]. + +snd_usb_ctl_msg() copies the full requested size back into the caller's +buffer regardless of how many bytes the data stage actually delivered: + + buf = kmemdup(data, size, GFP_KERNEL); + err = usb_control_msg(dev, pipe, request, requesttype, + value, index, buf, size, timeout); + memcpy(data, buf, size); + +usb_control_msg() returns the transferred length on a short control-IN, +which is a non-negative value, and writes only that many bytes. The +remainder of the copy back is the kmemdup()ed image of the caller's +buffer, so a device answering with a short data stage leaves the +trailing words of buf[] holding leftover kernel stack. The only guard +in the caller is err < 0, so those words are stored into status[]. + +They then reach user space: snd_rme_digiface_get_status_val() selects a +16-bit halfword of status[] per the control's reg/mask, and the eight +Digiface status controls together expose the whole 16-byte frame to an +unprivileged reader of /dev/snd/controlC*. + +Zero-initialise the buffer so a short read yields zeros instead of stack +residue. This mirrors snd_rme_get_status1(), which already clears its +output word before the same kind of vendor read. + +Discovered by XBOW, triaged by Baul Lee + +Fixes: 611a96f6acf2 ("ALSA: usb-audio: Add mixer quirk for RME Digiface USB") +Reported-by: Federico Kirschbaum +Reported-by: Baul Lee +Cc: stable@vger.kernel.org +Signed-off-by: Baul Lee +Link: https://patch.msgid.link/20260726065020.46070-1-baul.lee@xbow.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer_quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -3352,7 +3352,7 @@ static int snd_rme_digiface_read_status( + struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol); + struct snd_usb_audio *chip = list->mixer->chip; + struct usb_device *dev = chip->dev; +- __le32 buf[4]; ++ __le32 buf[4] = {}; + int err; + + err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), diff --git a/queue-6.18/alsa-usb-audio-fix-use-after-free-in-ump_to_endpoint.patch b/queue-6.18/alsa-usb-audio-fix-use-after-free-in-ump_to_endpoint.patch new file mode 100644 index 0000000000..fafc2cbde8 --- /dev/null +++ b/queue-6.18/alsa-usb-audio-fix-use-after-free-in-ump_to_endpoint.patch @@ -0,0 +1,64 @@ +From 4a05b2d1b4642df74f30b6f54843e825c4a2bfd3 Mon Sep 17 00:00:00 2001 +From: Baul Lee +Date: Sun, 26 Jul 2026 14:13:37 +0900 +Subject: ALSA: usb-audio: fix use-after-free in ump_to_endpoint() + +From: Baul Lee + +commit 4a05b2d1b4642df74f30b6f54843e825c4a2bfd3 upstream. + +create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a +back-pointer to its per-interface snd_usb_midi2_ump object in +ump->private_data, but it never installs an ump->private_free hook and +never clears that pointer. + +If a later step of snd_usb_midi_v2_create() fails, its error path calls +free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while +the already-registered endpoint keeps pointing at it. The created +/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP +open, ump_to_endpoint(), dereferences the dangling ump->private_data and +reads rmidi->eps[dir] out of freed memory. + +A malicious USB MIDI 2.0 device that makes creation fail after the +endpoint is registered can thus trigger a slab use-after-free read on a +subsequent open of the UMP node. + +Clear the endpoint's back-pointer before freeing the object, and let +ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger +callbacks fail cleanly (their callers already handle a NULL endpoint) +instead of dereferencing a stale pointer. + +Discovered by XBOW, triaged by Baul Lee + +Fixes: ff49d1df79ae ("ALSA: usb-audio: USB MIDI 2.0 UMP support") +Reported-by: Federico Kirschbaum +Reported-by: Baul Lee +Cc: stable@vger.kernel.org +Signed-off-by: Baul Lee +Link: https://patch.msgid.link/20260726051337.41124-1-baul.lee@xbow.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/midi2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/usb/midi2.c ++++ b/sound/usb/midi2.c +@@ -329,7 +329,7 @@ ump_to_endpoint(struct snd_ump_endpoint + { + struct snd_usb_midi2_ump *rmidi = ump->private_data; + +- return rmidi->eps[dir]; ++ return rmidi ? rmidi->eps[dir] : NULL; + } + + /* ump open callback */ +@@ -685,6 +685,8 @@ static void free_all_midi2_umps(struct s + rmidi = list_first_entry(&umidi->rawmidi_list, + struct snd_usb_midi2_ump, list); + list_del(&rmidi->list); ++ if (rmidi->ump) ++ rmidi->ump->private_data = NULL; + kfree(rmidi); + } + } diff --git a/queue-6.18/asoc-fsl_asrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch b/queue-6.18/asoc-fsl_asrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch new file mode 100644 index 0000000000..f840caa002 --- /dev/null +++ b/queue-6.18/asoc-fsl_asrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch @@ -0,0 +1,34 @@ +From 890b4253134f3a39883af7d5bea67af9c494c56d Mon Sep 17 00:00:00 2001 +From: Shengjiu Wang +Date: Wed, 15 Jul 2026 10:47:57 +0800 +Subject: ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return + +From: Shengjiu Wang + +commit 890b4253134f3a39883af7d5bea67af9c494c56d upstream. + +When fsl_asrc_m2m_init() fails in fsl_asrc_probe(), the code did a +bare return ret, bypassing pm_runtime_disable() in err_pm_get_sync. +Use goto err_pm_get_sync to ensure proper cleanup on failure. + +Fixes: 286d658477a4 ("ASoC: fsl_asrc: register m2m platform device") +Cc: stable@vger.kernel.org +Signed-off-by: Shengjiu Wang +Link: https://patch.msgid.link/20260715024758.1252801-2-shengjiu.wang@oss.nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/fsl_asrc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/fsl/fsl_asrc.c ++++ b/sound/soc/fsl/fsl_asrc.c +@@ -1388,7 +1388,7 @@ static int fsl_asrc_probe(struct platfor + ret = fsl_asrc_m2m_init(asrc); + if (ret) { + dev_err(&pdev->dev, "failed to init m2m device %d\n", ret); +- return ret; ++ goto err_pm_get_sync; + } + + return 0; diff --git a/queue-6.18/asoc-fsl_easrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch b/queue-6.18/asoc-fsl_easrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch new file mode 100644 index 0000000000..9628139e24 --- /dev/null +++ b/queue-6.18/asoc-fsl_easrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch @@ -0,0 +1,34 @@ +From a54bc0eef90ea760039c14bb7f3b5db42529f84d Mon Sep 17 00:00:00 2001 +From: Shengjiu Wang +Date: Wed, 15 Jul 2026 10:47:58 +0800 +Subject: ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return + +From: Shengjiu Wang + +commit a54bc0eef90ea760039c14bb7f3b5db42529f84d upstream. + +When fsl_asrc_m2m_init() fails in fsl_easrc_probe(), the code did a +bare return ret, bypassing pm_runtime_disable() in err_pm_disable. +Use goto err_pm_disable to ensure proper cleanup on failure. + +Fixes: b62eaff0650d ("ASoC: fsl_easrc: register m2m platform device") +Cc: stable@vger.kernel.org +Signed-off-by: Shengjiu Wang +Link: https://patch.msgid.link/20260715024758.1252801-3-shengjiu.wang@oss.nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/fsl_easrc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/fsl/fsl_easrc.c ++++ b/sound/soc/fsl/fsl_easrc.c +@@ -2266,7 +2266,7 @@ static int fsl_easrc_probe(struct platfo + ret = fsl_asrc_m2m_init(easrc); + if (ret) { + dev_err(&pdev->dev, "failed to init m2m device %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + return 0; diff --git a/queue-6.18/asoc-tas2562-fix-broken-entries-in-the-volume-lookup-table.patch b/queue-6.18/asoc-tas2562-fix-broken-entries-in-the-volume-lookup-table.patch new file mode 100644 index 0000000000..6e4d07f42d --- /dev/null +++ b/queue-6.18/asoc-tas2562-fix-broken-entries-in-the-volume-lookup-table.patch @@ -0,0 +1,53 @@ +From bdb0fd6de403fcea7b85dc9d38f0a571583ebe80 Mon Sep 17 00:00:00 2001 +From: Haidar Lee +Date: Wed, 15 Jul 2026 14:04:41 +0800 +Subject: ASoC: tas2562: fix broken entries in the volume lookup table + +From: Haidar Lee + +commit bdb0fd6de403fcea7b85dc9d38f0a571583ebe80 upstream. + +The float_vol_db_lookup table is supposed to hold +round(10^(dB/20) * 2^30) for every 2 dB step from -110 dB to 0 dB, +which is 56 entries, but it only has 55: the -90 dB entry duplicates +the -92 dB value (0x0000695b) and the -20 dB entry (0x06666666) is +missing altogether. As a result every step between -90 dB and -22 dB +is off by 2 dB, and the control's maximum raw value of 110 indexes one +element past the end of the array. + +Replace the duplicated -90 dB entry with the correct value 0x000084a3 +and add the missing -20 dB entry, bringing the table to the full 56 +entries so index 55 (raw value 110, 0 dB) is in range again. + +Fixes: bf726b1c86f2 ("ASoC: tas2562: Add support for digital volume control") +Cc: stable@vger.kernel.org +Signed-off-by: Haidar Lee +Link: https://patch.msgid.link/20260715-tas2562-dvc-fix-v1-2-072b13901b20@adlinktech.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/tas2562.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/tas2562.c ++++ b/sound/soc/codecs/tas2562.c +@@ -32,15 +32,16 @@ + static const unsigned int float_vol_db_lookup[] = { + 0x00000d43, 0x000010b2, 0x00001505, 0x00001a67, 0x00002151, + 0x000029f1, 0x000034cd, 0x00004279, 0x000053af, 0x0000695b, +-0x0000695b, 0x0000a6fa, 0x0000d236, 0x000108a4, 0x00014d2a, ++0x000084a3, 0x0000a6fa, 0x0000d236, 0x000108a4, 0x00014d2a, + 0x0001a36e, 0x00021008, 0x000298c0, 0x000344df, 0x00041d8f, + 0x00052e5a, 0x000685c8, 0x00083621, 0x000a566d, 0x000d03a7, + 0x0010624d, 0x0014a050, 0x0019f786, 0x0020b0bc, 0x0029279d, + 0x0033cf8d, 0x004139d3, 0x00521d50, 0x00676044, 0x0082248a, + 0x00a3d70a, 0x00ce4328, 0x0103ab3d, 0x0146e75d, 0x019b8c27, + 0x02061b89, 0x028c423f, 0x03352529, 0x0409c2b0, 0x05156d68, +-0x080e9f96, 0x0a24b062, 0x0cc509ab, 0x10137987, 0x143d1362, +-0x197a967f, 0x2013739e, 0x28619ae9, 0x32d64617, 0x40000000 ++0x06666666, 0x080e9f96, 0x0a24b062, 0x0cc509ab, 0x10137987, ++0x143d1362, 0x197a967f, 0x2013739e, 0x28619ae9, 0x32d64617, ++0x40000000 + }; + + struct tas2562_data { diff --git a/queue-6.18/asoc-tas2562-fix-dvc-coefficient-write-order.patch b/queue-6.18/asoc-tas2562-fix-dvc-coefficient-write-order.patch new file mode 100644 index 0000000000..fbf4bfa05c --- /dev/null +++ b/queue-6.18/asoc-tas2562-fix-dvc-coefficient-write-order.patch @@ -0,0 +1,78 @@ +From 8e957e4907c58e9ca944f98799524f2bbb9cf68a Mon Sep 17 00:00:00 2001 +From: Haidar Lee +Date: Wed, 15 Jul 2026 14:04:40 +0800 +Subject: ASoC: tas2562: fix DVC coefficient write order + +From: Haidar Lee + +commit 8e957e4907c58e9ca944f98799524f2bbb9cf68a upstream. + +The TAS2562 applies the 32-bit digital volume coefficient to the +playback path when the last byte, DVC_CFG4 (book 0 page 2 reg 0x0F), is +written. tas2562_volume_control_put() wrote DVC_CFG4 first and DVC_CFG1 +(the MSB) last, so every volume change latched a value made of the +previous coefficient's upper three bytes combined with the new LSB; the +remaining bytes only took effect on the next volume change. + +In practice the control was unusable: the first setting after power-on +always played at roughly 0 dB no matter what value was requested (the +chip's default upper bytes were still latched), and most subsequent +changes muted the output entirely or produced a distorted, over-unity +gain. + +Verified on a TAS2562 (ADLINK OSM-520 / MT8189 board) by tracing the +I2C writes with ftrace and by writing the same coefficients manually in +both byte orders: written MSB-first the register block behaves exactly +as the driver expects, LSB-first reproduces the broken behaviour. + +Write the bytes MSB first with DVC_CFG4 last so the complete new +coefficient is latched atomically. + +Fixes: bf726b1c86f2 ("ASoC: tas2562: Add support for digital volume control") +Cc: stable@vger.kernel.org +Signed-off-by: Haidar Lee +Link: https://patch.msgid.link/20260715-tas2562-dvc-fix-v1-1-072b13901b20@adlinktech.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/tas2562.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +--- a/sound/soc/codecs/tas2562.c ++++ b/sound/soc/codecs/tas2562.c +@@ -475,20 +475,27 @@ static int tas2562_volume_control_put(st + u32 reg_val; + + reg_val = float_vol_db_lookup[ucontrol->value.integer.value[0]/2]; +- ret = snd_soc_component_write(component, TAS2562_DVC_CFG4, +- (reg_val & 0xff)); +- if (ret) +- return ret; +- ret = snd_soc_component_write(component, TAS2562_DVC_CFG3, +- ((reg_val >> 8) & 0xff)); ++ /* ++ * The device applies the 32-bit coefficient to the playback path on ++ * the write to DVC_CFG4 (the LSB, book 0 page 2 reg 0x0F), so the ++ * bytes must be written MSB first and DVC_CFG4 last. Writing CFG4 ++ * first latches a mix of the previous coefficient's upper bytes and ++ * the new LSB instead of the requested value. ++ */ ++ ret = snd_soc_component_write(component, TAS2562_DVC_CFG1, ++ ((reg_val >> 24) & 0xff)); + if (ret) + return ret; + ret = snd_soc_component_write(component, TAS2562_DVC_CFG2, + ((reg_val >> 16) & 0xff)); + if (ret) + return ret; +- ret = snd_soc_component_write(component, TAS2562_DVC_CFG1, +- ((reg_val >> 24) & 0xff)); ++ ret = snd_soc_component_write(component, TAS2562_DVC_CFG3, ++ ((reg_val >> 8) & 0xff)); ++ if (ret) ++ return ret; ++ ret = snd_soc_component_write(component, TAS2562_DVC_CFG4, ++ (reg_val & 0xff)); + if (ret) + return ret; + diff --git a/queue-6.18/ata-libata-eh-increase-standby-immediate-timeout.patch b/queue-6.18/ata-libata-eh-increase-standby-immediate-timeout.patch new file mode 100644 index 0000000000..42f00135bf --- /dev/null +++ b/queue-6.18/ata-libata-eh-increase-standby-immediate-timeout.patch @@ -0,0 +1,78 @@ +From 1e024d2b41ee32bc06818f7f09a3562c58842cf9 Mon Sep 17 00:00:00 2001 +From: Matt Vollrath +Date: Fri, 24 Jul 2026 03:39:42 -0400 +Subject: ata: libata-eh: Increase STANDBY IMMEDIATE timeout + +From: Matt Vollrath + +commit 1e024d2b41ee32bc06818f7f09a3562c58842cf9 upstream. + +Correct a previous change (see Fixes) which reduced the standby timeout +from 30 to 5 seconds. Increase it to 15 seconds. + +I was troubleshooting an error spotted during system suspend: + + [ 1217.152867] ata1.00: Entering standby power mode + [ 1222.322948] ata1.00: qc timeout after 5000 msecs (cmd 0xe0) + [ 1222.324010] ata1.00: STANDBY IMMEDIATE failed (err_mask=0x4) + +This drive is a Samsung 870 EVO SSD in good SMART standing, and I wasn't +aware of any reason it should be taking so long to standby. The issue is +intermittent, but I observed it sometimes taking 7 seconds to manually +standby. I assume this was interruption of background maintenance after +a power outage. + +As a desktop user, I would prefer to wait the extra 2 seconds at suspend +to let the drive finish its business rather than drop the rails from +under it. + +The change from 30 to 5 seconds was implicit when switching suspend +from START STOP UNIT to an internal command with no timeout table entry. +No reason was stated for the change. + +Fixes: aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") +Cc: stable@vger.kernel.org +Signed-off-by: Matt Vollrath +Assisted-by: Claude:claude-5-fable +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-eh.c | 8 ++++++++ + include/linux/libata.h | 2 +- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -106,6 +106,12 @@ static const unsigned int ata_eh_flush_t + UINT_MAX, + }; + ++static const unsigned int ata_eh_standby_timeouts[] = { ++ 15000, /* Some drives may be slow to standby */ ++ /* but don't hold up a suspend too long waiting for them */ ++ UINT_MAX, ++}; ++ + static const unsigned int ata_eh_other_timeouts[] = { + 5000, /* same rationale as identify timeout */ + 10000, /* ditto */ +@@ -147,6 +153,8 @@ ata_eh_cmd_timeout_table[ATA_EH_CMD_TIME + .timeouts = ata_eh_other_timeouts, }, + { .commands = CMDS(ATA_CMD_FLUSH, ATA_CMD_FLUSH_EXT), + .timeouts = ata_eh_flush_timeouts }, ++ { .commands = CMDS(ATA_CMD_STANDBYNOW1), ++ .timeouts = ata_eh_standby_timeouts }, + { .commands = CMDS(ATA_CMD_VERIFY), + .timeouts = ata_eh_reset_timeouts }, + }; +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -389,7 +389,7 @@ enum { + /* This should match the actual table size of + * ata_eh_cmd_timeout_table in libata-eh.c. + */ +- ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 8, ++ ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 9, + + /* + * Quirk flags: may be set by libata or controller drivers on drives. diff --git a/queue-6.18/ata-libata-sata-fix-ata_scsi_lpm_supported-iteration.patch b/queue-6.18/ata-libata-sata-fix-ata_scsi_lpm_supported-iteration.patch new file mode 100644 index 0000000000..0a8ec2d601 --- /dev/null +++ b/queue-6.18/ata-libata-sata-fix-ata_scsi_lpm_supported-iteration.patch @@ -0,0 +1,43 @@ +From 3fd70e96914d761c17c376aadd0b0d1a3c9badba Mon Sep 17 00:00:00 2001 +From: Niklas Cassel +Date: Tue, 28 Jul 2026 13:38:42 +0200 +Subject: ata: libata-sata: fix ata_scsi_lpm_supported() iteration + +From: Niklas Cassel + +commit 3fd70e96914d761c17c376aadd0b0d1a3c9badba upstream. + +The inner loop of ata_scsi_lpm_supported() uses the wrong variable when +iterating. + +It should obviously use the link that we are currently iterating over, +rather than always using the host link. + +ata_scsi_lpm_supported() is used to control if a user should be allowed +to change lpm policy (from the default) via sysfs. + +Thus, this bug could potentially disallow users to change the LPM policy +for certain SATA devices via sysfs. + +Cc: stable@vger.kernel.org +Fixes: 0060beec0bfa ("ata: libata-sata: Add link_power_management_supported sysfs attribute") +Reported-by: Sashiko +Link: https://lore.kernel.org/linux-ide/20260728112200.B99F21F000E9@smtp.kernel.org/ +Signed-off-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-sata.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-sata.c ++++ b/drivers/ata/libata-sata.c +@@ -913,7 +913,7 @@ static bool ata_scsi_lpm_supported(struc + return false; + + ata_for_each_link(link, ap, EDGE) { +- ata_for_each_dev(dev, &ap->link, ENABLED) { ++ ata_for_each_dev(dev, link, ENABLED) { + if (dev->quirks & ATA_QUIRK_NOLPM) + return false; + } diff --git a/queue-6.18/bpf-lwt-fix-dst-reference-leak-on-reroute-failure.patch b/queue-6.18/bpf-lwt-fix-dst-reference-leak-on-reroute-failure.patch new file mode 100644 index 0000000000..21fb87e305 --- /dev/null +++ b/queue-6.18/bpf-lwt-fix-dst-reference-leak-on-reroute-failure.patch @@ -0,0 +1,41 @@ +From 88c17de85ddb459c3fe1e3c65d61fa366b1cf0a8 Mon Sep 17 00:00:00 2001 +From: Xuanqiang Luo +Date: Thu, 23 Jul 2026 14:04:45 +0800 +Subject: bpf: lwt: Fix dst reference leak on reroute failure + +From: Xuanqiang Luo + +commit 88c17de85ddb459c3fe1e3c65d61fa366b1cf0a8 upstream. + +bpf_lwt_xmit_reroute() obtains a referenced dst from the route +lookup. When skb_cow_head() fails before that dst is installed on the +skb, the error path only frees the skb. The skb still owns its previous +dst, so the newly looked up dst reference is leaked. + +Release the new dst reference before freeing the skb on this error +path. + +Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c") +Cc: stable@vger.kernel.org +Signed-off-by: Xuanqiang Luo +Link: https://patch.msgid.link/20260723060445.21926-1-xuanqiang.luo@linux.dev +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/core/lwt_bpf.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/core/lwt_bpf.c ++++ b/net/core/lwt_bpf.c +@@ -251,8 +251,10 @@ static int bpf_lwt_xmit_reroute(struct s + * if there is enough header space in skb. + */ + err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); +- if (unlikely(err)) ++ if (unlikely(err)) { ++ dst_release(dst); + goto err; ++ } + + skb_dst_drop(skb); + skb_dst_set(skb, dst); diff --git a/queue-6.18/dmaengine-qcom-bam_dma-fix-command-element-mask-field-for-bam-v1.6.0.patch b/queue-6.18/dmaengine-qcom-bam_dma-fix-command-element-mask-field-for-bam-v1.6.0.patch new file mode 100644 index 0000000000..dd572bdd29 --- /dev/null +++ b/queue-6.18/dmaengine-qcom-bam_dma-fix-command-element-mask-field-for-bam-v1.6.0.patch @@ -0,0 +1,103 @@ +From 867621ba203027338b525af6729719c544135336 Mon Sep 17 00:00:00 2001 +From: Md Sadre Alam +Date: Mon, 15 Jun 2026 11:39:08 +0530 +Subject: dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ + +From: Md Sadre Alam + +commit 867621ba203027338b525af6729719c544135336 upstream. + +BAM version 1.6.0 and later changed the behavior of the mask field in +command elements for read operations. + +In older BAM versions, or prior implementation assumptions, the mask +field was effectively ignored for read commands. However, starting from +BAM v1.6.0, the mask field for read commands is repurposed to carry the +upper 4 bits of the destination address, enabling support for 36-bit +addressing. For write commands, the mask field continues to function as +a traditional write mask. + +The current driver sets mask = 0xffffffff for all command elements. +While this works for write operations, it breaks read operations on +BAM v1.6.0+ hardware. In such cases, the hardware interprets the upper +address bits as 0xf, resulting in an invalid destination address +(0xf_xxxxxxxx instead of 0x0_xxxxxxxx). + +This leads to failures such as NAND enumeration issues observed on +platforms like IPQ5424. + +Fix this by assigning the mask field based on command type: + - For read commands: set mask = 0 (upper address bits = 0) + - For write commands: retain mask = 0xffffffff + +Also update the bam_cmd_element structure documentation to reflect the +dual purpose of the mask field across BAM versions. + +This ensures correct behavior on BAM v1.6.0+ while maintaining backward +compatibility with older hardware. + +Fixes: dfebb055f73a2 ("dmaengine: qcom: bam_dma: wrapper functions for command descriptor") +Tested-by: Lakshmi Sowjanya D +Signed-off-by: Md Sadre Alam +Reviewed-by: Frank Li +Reviewed-by: Dmitry Baryshkov +Cc: stable@vger.kernel.org +Signed-off-by: Varadarajan Narayanan +Link: https://patch.msgid.link/20260615060908.1263171-1-varadarajan.narayanan@oss.qualcomm.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/dma/qcom_bam_dma.h | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +--- a/include/linux/dma/qcom_bam_dma.h ++++ b/include/linux/dma/qcom_bam_dma.h +@@ -13,9 +13,12 @@ + * supported by BAM DMA Engine. + * + * @cmd_and_addr - upper 8 bits command and lower 24 bits register address. +- * @data - for write command: content to be written into peripheral register. +- * for read command: dest addr to write peripheral register value. +- * @mask - register mask. ++ * @data - For write command: content to be written into peripheral register. ++ * For read command: lower 32 bits of destination address. ++ * @mask - For write command: register write mask. ++ * For read command on BAM v1.6.0+: upper 4 bits of destination address. ++ * For read command on BAM < v1.6.0: ignored by hardware. ++ * Setting to 0 ensures 32-bit addressing compatibility. + * @reserved - for future usage. + * + */ +@@ -42,6 +45,10 @@ enum bam_command_type { + * @addr: target address + * @cmd: BAM command + * @data: actual data for write and dest addr for read in le32 ++ * ++ * For BAM v1.6.0+, the mask field behavior depends on command type: ++ * - Write commands: mask = write mask (typically 0xffffffff) ++ * - Read commands: mask = upper 4 bits of destination address (0 for 32-bit) + */ + static inline void + bam_prep_ce_le32(struct bam_cmd_element *bam_ce, u32 addr, +@@ -50,7 +57,11 @@ bam_prep_ce_le32(struct bam_cmd_element + bam_ce->cmd_and_addr = + cpu_to_le32((addr & 0xffffff) | ((cmd & 0xff) << 24)); + bam_ce->data = data; +- bam_ce->mask = cpu_to_le32(0xffffffff); ++ if (cmd == BAM_READ_COMMAND) ++ bam_ce->mask = cpu_to_le32(0x0); /* 32-bit addressing */ ++ else ++ bam_ce->mask = cpu_to_le32(0xffffffff); /* Write mask */ ++ bam_ce->reserved = 0; + } + + /* +@@ -60,7 +71,7 @@ bam_prep_ce_le32(struct bam_cmd_element + * @bam_ce: BAM command element + * @addr: target address + * @cmd: BAM command +- * @data: actual data for write and dest addr for read ++ * @data: actual data for write and destination address for read + */ + static inline void + bam_prep_ce(struct bam_cmd_element *bam_ce, u32 addr, diff --git a/queue-6.18/e1000-fix-memory-leak-in-e1000_probe.patch b/queue-6.18/e1000-fix-memory-leak-in-e1000_probe.patch new file mode 100644 index 0000000000..a139d9e97e --- /dev/null +++ b/queue-6.18/e1000-fix-memory-leak-in-e1000_probe.patch @@ -0,0 +1,54 @@ +From 816419dfea5c88126f35eb7a1b429a1bf546665e Mon Sep 17 00:00:00 2001 +From: Dawei Feng +Date: Sun, 7 Jun 2026 22:57:06 +0800 +Subject: e1000: fix memory leak in e1000_probe() + +From: Dawei Feng + +commit 816419dfea5c88126f35eb7a1b429a1bf546665e upstream. + +In the e1000_probe() path, e1000_sw_init() allocates adapter->tx_ring and +adapter->rx_ring. If the subsequent CE4100-specific MDIO BAR mapping +fails, the error handling jumps past the ring cleanup code, leaking both +allocations. + +Fix this leak by moving the err_mdio_ioremap label above the ring +deallocation logic. This guarantees the proper release of these resources +and prevents the memory leak. + +The bug was first flagged by an experimental analysis tool we are +developing for kernel memory-management bugs while analyzing +v6.13-rc1. The tool is still under development and is not yet publicly +available. Manual inspection confirms that the bug is still +present in v7.1-rc6. + +An x86_64 allyesconfig build showed no new warnings. As we do not have a +CE4100 reference platform to test with, no runtime testing was able to +be performed. + +Fixes: 5377a4160bb65 ("e1000: Add support for the CE4100 reference platform") +Cc: stable@vger.kernel.org +Signed-off-by: Zilin Guan +Signed-off-by: Dawei Feng +Reviewed-by: Dima Ruinskiy +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -1222,11 +1222,11 @@ err_eeprom: + + if (hw->flash_address) + iounmap(hw->flash_address); ++err_mdio_ioremap: + kfree(adapter->tx_ring); + kfree(adapter->rx_ring); + err_dma: + err_sw_init: +-err_mdio_ioremap: + iounmap(hw->ce4100_gbe_mdio_base_virt); + iounmap(hw->hw_addr); + err_ioremap: diff --git a/queue-6.18/igbvf-fix-leak-in-tx-dma-error-cleanup.patch b/queue-6.18/igbvf-fix-leak-in-tx-dma-error-cleanup.patch new file mode 100644 index 0000000000..af7effcc62 --- /dev/null +++ b/queue-6.18/igbvf-fix-leak-in-tx-dma-error-cleanup.patch @@ -0,0 +1,42 @@ +From 0565052b7e2f436b7f1541f4849da96dc0aa7a0e Mon Sep 17 00:00:00 2001 +From: Matt Vollrath +Date: Thu, 16 Apr 2026 23:34:52 -0400 +Subject: igbvf: Fix leak in TX DMA error cleanup + +From: Matt Vollrath + +commit 0565052b7e2f436b7f1541f4849da96dc0aa7a0e upstream. + +If an error is encountered while mapping TX buffers, the driver should +unmap any buffers already mapped for that skb. + +Because count is incremented before each frag mapping, it will always +match the correct number of unmappings needed when dma_error is reached. +Decrementing count before the while loop in dma_error causes an +off-by-one error. If any mapping was successful before an unsuccessful +mapping, exactly one DMA mapping (the head) would leak. + +This bug was introduced by a 2010 fix for an endless loop in dma_error. +All other affected drivers have already been fixed. + +Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-4-7-opus +Signed-off-by: Matt Vollrath +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igbvf/netdev.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/ethernet/intel/igbvf/netdev.c ++++ b/drivers/net/ethernet/intel/igbvf/netdev.c +@@ -2191,8 +2191,6 @@ dma_error: + buffer_info->time_stamp = 0; + buffer_info->length = 0; + buffer_info->mapped_as_page = false; +- if (count) +- count--; + + /* clear timestamp and dma mappings for remaining portion of packet */ + while (count--) { diff --git a/queue-6.18/igc-remove-napi_synchronize-in-igc_down.patch b/queue-6.18/igc-remove-napi_synchronize-in-igc_down.patch new file mode 100644 index 0000000000..4fe5326c6c --- /dev/null +++ b/queue-6.18/igc-remove-napi_synchronize-in-igc_down.patch @@ -0,0 +1,47 @@ +From 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019 Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sun, 12 Jul 2026 14:22:42 +0100 +Subject: igc: remove napi_synchronize() in igc_down() + +From: David Carlier + +commit 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019 upstream. + +When an AF_XDP zero-copy application is killed abruptly, the XSK pool is +torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the +full budget on every poll, so napi_complete_done() never clears +NAPI_STATE_SCHED. + +igc_down() calls napi_synchronize() before napi_disable(), so it spins +forever waiting for that bit and the interface never goes down. Drop the +napi_synchronize() and let napi_disable() do the job -- it sets +NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it +ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after +polling has stopped, matching the recent igb fix b1e067240379. + +Fixes: fc9df2a0b520 ("igc: Enable RX via AF_XDP zero-copy") +Suggested-by: Maciej Fijalkowski +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Reviewed-by: Maciej Fijalkowski +Reviewed-by: Dima Ruinskiy +Tested-by: Moriya Kadosh +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igc/igc_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -5354,9 +5354,8 @@ void igc_down(struct igc_adapter *adapte + + for (i = 0; i < adapter->num_q_vectors; i++) { + if (adapter->q_vector[i]) { +- napi_synchronize(&adapter->q_vector[i]->napi); +- igc_set_queue_napi(adapter, i, NULL); + napi_disable(&adapter->q_vector[i]->napi); ++ igc_set_queue_napi(adapter, i, NULL); + } + } + diff --git a/queue-6.18/ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch b/queue-6.18/ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch new file mode 100644 index 0000000000..33308f7543 --- /dev/null +++ b/queue-6.18/ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch @@ -0,0 +1,50 @@ +From a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b Mon Sep 17 00:00:00 2001 +From: Zhiling Zou +Date: Mon, 13 Jul 2026 19:52:32 +0800 +Subject: ipvs: do not propagate one-packet flag to synced conns + +From: Zhiling Zou + +commit a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b upstream. + +Synced connections can be created before their destination exists. When +the destination is later added, ip_vs_bind_dest() copies connection flags +from the destination into cp->flags. + +IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced +connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, +expiry can treat it as a one-packet connection and skip unlinking the +existing conn_tab node, leaving stale hash nodes pointing at a freed +struct ip_vs_conn. + +Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced +connections. + +Fixes: 26ec037f9841 ("IPVS: one-packet scheduling") +Cc: stable@vger.kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Suggested-by: Julian Anastasov +Signed-off-by: Zhiling Zou +Signed-off-by: Ren Wei +Acked-by: Julian Anastasov +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipvs/ip_vs_conn.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -599,6 +599,9 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s + flags = cp->flags; + /* Bind with the destination and its corresponding transmitter */ + if (flags & IP_VS_CONN_F_SYNC) { ++ /* Synced conns are hashed, so they can not get this flag */ ++ conn_flags &= ~IP_VS_CONN_F_ONE_PACKET; ++ + /* if the connection is not template and is created + * by sync, preserve the activity flag. + */ diff --git a/queue-6.18/ksmbd-reject-repeated-smb2-negotiate-requests.patch b/queue-6.18/ksmbd-reject-repeated-smb2-negotiate-requests.patch new file mode 100644 index 0000000000..bf3a011fc3 --- /dev/null +++ b/queue-6.18/ksmbd-reject-repeated-smb2-negotiate-requests.patch @@ -0,0 +1,145 @@ +From cb469993b3a61a72653770856d37af616d72d05f Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Thu, 23 Jul 2026 23:07:14 +0900 +Subject: ksmbd: reject repeated SMB2 NEGOTIATE requests + +From: Namjae Jeon + +commit cb469993b3a61a72653770856d37af616d72d05f upstream. + +Unauthenticated client can send multiple successful SMB2 NEGOTIATE +requests on one connection before SESSION_SETUP. While the connection is +in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another +SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation. +Only the final allocation is freed when the connection is released, leaking +one object for every additional successful request. + +A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol +violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect +without replying in this case. Set the connection exiting when rejecting +the request, in addition to suppressing the response. + +Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the +SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize +both SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they +update connection-wide dialect and negotiation state. + +Move the locking contract to ksmbd_smb_negotiate_common(), where the state +and dialect are selected, and add ksmbd_conn_new() for consistent state +access. + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Cc: stable@vger.kernel.org +Reported-by: Runa Takemoto +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/connection.h | 5 +++++ + fs/smb/server/smb2pdu.c | 10 ++-------- + fs/smb/server/smb_common.c | 37 ++++++++++++++++++++++++++++++------- + 3 files changed, 37 insertions(+), 15 deletions(-) + +--- a/fs/smb/server/connection.h ++++ b/fs/smb/server/connection.h +@@ -197,6 +197,11 @@ void ksmbd_conn_r_count_dec(struct ksmbd + * This is a hack. We will move status to a proper place once we land + * a multi-sessions support. + */ ++static inline bool ksmbd_conn_new(struct ksmbd_conn *conn) ++{ ++ return READ_ONCE(conn->status) == KSMBD_SESS_NEW; ++} ++ + static inline bool ksmbd_conn_good(struct ksmbd_conn *conn) + { + return READ_ONCE(conn->status) == KSMBD_SESS_GOOD; +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1102,6 +1102,8 @@ static __le32 deassemble_neg_contexts(st + * smb2_handle_negotiate() - handler for smb2 negotiate command + * @work: smb work containing smb request buffer + * ++ * The caller holds conn->srv_mutex. ++ * + * Return: 0 + */ + int smb2_handle_negotiate(struct ksmbd_work *work) +@@ -1115,13 +1117,6 @@ int smb2_handle_negotiate(struct ksmbd_w + + ksmbd_debug(SMB, "Received negotiate request\n"); + conn->need_neg = false; +- if (ksmbd_conn_good(conn)) { +- pr_err("conn->tcp_status is already in CifsGood State\n"); +- work->send_no_response = 1; +- return rc; +- } +- +- ksmbd_conn_lock(conn); + smb2_buf_len = get_rfc1002_len(work->request_buf); + smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects); + if (smb2_neg_size > smb2_buf_len) { +@@ -1272,7 +1267,6 @@ int smb2_handle_negotiate(struct ksmbd_w + ksmbd_conn_set_need_setup(conn); + + err_out: +- ksmbd_conn_unlock(conn); + if (rc) + rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES; + +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -592,23 +592,46 @@ int ksmbd_smb_negotiate_common(struct ks + struct ksmbd_conn *conn = work->conn; + int ret; + +- conn->dialect = +- ksmbd_negotiate_smb_dialect(work->request_buf); +- ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); +- + if (command == SMB2_NEGOTIATE_HE) { ++ /* ++ * An SMB2 NEGOTIATE is valid for a new connection, or after an ++ * SMB1 multi-protocol negotiate has selected SMB2. Do not allow ++ * a second SMB2 NEGOTIATE to replace connection-wide state ++ * while a session setup is pending. KSMBD_SESS_NEED_RECONNECT ++ * is a transient session state and does not restart transport ++ * negotiation. ++ */ ++ ksmbd_conn_lock(conn); ++ if (!ksmbd_conn_new(conn) && ++ !ksmbd_conn_need_negotiate(conn)) { ++ work->send_no_response = 1; ++ ksmbd_conn_set_exiting(conn); ++ ksmbd_conn_unlock(conn); ++ return 0; ++ } ++ ++ conn->dialect = ++ ksmbd_negotiate_smb_dialect(work->request_buf); ++ ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); + ret = smb2_handle_negotiate(work); ++ ksmbd_conn_unlock(conn); + return ret; + } + + if (command == SMB_COM_NEGOTIATE) { ++ ksmbd_conn_lock(conn); ++ conn->dialect = ++ ksmbd_negotiate_smb_dialect(work->request_buf); ++ ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect); + if (__smb2_negotiate(conn)) { + init_smb3_11_server(conn); +- init_smb2_neg_rsp(work); ++ ret = init_smb2_neg_rsp(work); + ksmbd_debug(SMB, "Upgrade to SMB2 negotiation\n"); +- return 0; ++ } else { ++ ret = smb_handle_negotiate(work); + } +- return smb_handle_negotiate(work); ++ ksmbd_conn_unlock(conn); ++ return ret; + } + + pr_err("Unknown SMB negotiation command: %u\n", command); diff --git a/queue-6.18/mshv-fix-hv_input_get_system_property-struct.patch b/queue-6.18/mshv-fix-hv_input_get_system_property-struct.patch new file mode 100644 index 0000000000..db0ac26c29 --- /dev/null +++ b/queue-6.18/mshv-fix-hv_input_get_system_property-struct.patch @@ -0,0 +1,34 @@ +From d6f0248f04a96249660591e47fcf37ba98ac7ea3 Mon Sep 17 00:00:00 2001 +From: Wei Liu +Date: Tue, 30 Jun 2026 14:57:54 -0700 +Subject: mshv: fix hv_input_get_system_property struct + +From: Wei Liu + +commit d6f0248f04a96249660591e47fcf37ba98ac7ea3 upstream. + +Keep it in sync with the correct definition. + +The old code worked by chance. + +Fixes: e68bda71a2384 ("hyperv: Add new Hyper-V headers in include/hyperv") +Cc: stable@kernel.org +Signed-off-by: Wei Liu +Signed-off-by: Greg Kroah-Hartman +--- + include/hyperv/hvhdk_mini.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/hyperv/hvhdk_mini.h ++++ b/include/hyperv/hvhdk_mini.h +@@ -126,8 +126,9 @@ enum hv_dynamic_processor_feature_proper + + struct hv_input_get_system_property { + u32 property_id; /* enum hv_system_property */ ++ u32 reserved; + union { +- u32 as_uint32; ++ u64 as_uint64; + #if IS_ENABLED(CONFIG_X86) + /* enum hv_dynamic_processor_feature_property */ + u32 hv_processor_feature; diff --git a/queue-6.18/net-smc-fix-socket-use-after-free-during-link-group-termination.patch b/queue-6.18/net-smc-fix-socket-use-after-free-during-link-group-termination.patch new file mode 100644 index 0000000000..ce22df4fb6 --- /dev/null +++ b/queue-6.18/net-smc-fix-socket-use-after-free-during-link-group-termination.patch @@ -0,0 +1,60 @@ +From f621d6ebeebb6374342571e4ddf45fdbc420f6cd Mon Sep 17 00:00:00 2001 +From: Xuanqiang Luo +Date: Thu, 23 Jul 2026 18:54:54 +0800 +Subject: net/smc: fix socket use-after-free during link group termination + +From: Xuanqiang Luo + +commit f621d6ebeebb6374342571e4ddf45fdbc420f6cd upstream. + +__smc_lgr_terminate() drops conns_lock after finding a connection in +lgr->conns_all, but before taking a reference on its socket. The connection +is embedded in the socket, and its registration reference protects it only +while the connection remains in the tree. + +A concurrent close can unregister the connection and drop that reference, +freeing the socket before the termination worker reaches sock_hold(). + +The race is reachable when close overlaps link group termination. +Local stress testing reproduced the use-after-free and KASAN reported: + + BUG: KASAN: slab-use-after-free in __smc_lgr_terminate.part.0 [smc] + Write of size 4 by task kworker/3:3 + Workqueue: events smc_lgr_terminate_work [smc] + __smc_lgr_terminate.part.0 [smc] + +The socket was allocated by smc_create(), freed through +slab_free_after_rcu_debug(), and was followed by: + + refcount_t: addition on 0; use-after-free. + __smc_lgr_terminate.part.0 [smc] + +Take the socket reference while conns_lock still protects the tree entry. +The unregister path then cannot drop the last reference until termination +has finished using the socket. + +Fixes: 69318b5215f2 ("net/smc: improve abnormal termination locking") +Cc: stable@vger.kernel.org +Signed-off-by: Xuanqiang Luo +Reviewed-by: Mahanta Jambigi +Link: https://patch.msgid.link/20260723105454.87016-1-xuanqiang.luo@linux.dev +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/smc/smc_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1558,10 +1558,10 @@ static void __smc_lgr_terminate(struct s + read_lock_bh(&lgr->conns_lock); + node = rb_first(&lgr->conns_all); + while (node) { +- read_unlock_bh(&lgr->conns_lock); + conn = rb_entry(node, struct smc_connection, alert_node); + smc = container_of(conn, struct smc_sock, conn); + sock_hold(&smc->sk); /* sock_put below */ ++ read_unlock_bh(&lgr->conns_lock); + lock_sock(&smc->sk); + smc_conn_kill(conn, soft); + release_sock(&smc->sk); diff --git a/queue-6.18/netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch b/queue-6.18/netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch new file mode 100644 index 0000000000..c6ec1a785e --- /dev/null +++ b/queue-6.18/netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch @@ -0,0 +1,49 @@ +From f30415929be8aeb002d557c8d3f7ab2d2188003a Mon Sep 17 00:00:00 2001 +From: David Lee +Date: Mon, 13 Jul 2026 09:59:15 +0000 +Subject: netfilter: ipset: do not update comments from kernel-side hash adds + +From: David Lee + +commit f30415929be8aeb002d557c8d3f7ab2d2188003a upstream. + +mtype_resize() copies comment pointers with memcpy(), not the comment +objects themselves. During the window after an entry has been copied but +before the table swap and backlog replay, the old table is still +published for packet-side updates while the replacement-table entry +already holds the same ip_set_comment_rcu pointer. + +If xt_SET --add-set ... --exist hits that old entry in this window, +mtype_add() calls ip_set_init_comment() even though packet-side adds +carry no comment payload. That call frees the shared comment through the +old entry, so the replacement-table entry now holds a stale pointer. +When the queued add is replayed on the new table, mtype_add() calls +ip_set_init_comment() again and strlen() dereferences the stale pointer. + +Fix this in mtype_add() by skipping ip_set_init_comment() when +ext->target marks a packet-side add. Userspace adds still update +comments, while packet-side adds can no longer free comment storage +shared with a resize copy. + +Fixes: f66ee0410b1c ("netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports") +Cc: stable@vger.kernel.org +Signed-off-by: David Lee +Assisted-by: Codex:gpt-5.5 +Acked-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -984,7 +984,7 @@ overwrite_extensions: + #endif + if (SET_WITH_COUNTER(set)) + ip_set_init_counter(ext_counter(data, set), ext); +- if (SET_WITH_COMMENT(set)) ++ if (SET_WITH_COMMENT(set) && !ext->target) + ip_set_init_comment(set, ext_comment(data, set), ext); + if (SET_WITH_SKBINFO(set)) + ip_set_init_skbinfo(ext_skbinfo(data, set), ext); diff --git a/queue-6.18/of-address-fix-null-bus-dereference-in-of_pci_range_parser_one.patch b/queue-6.18/of-address-fix-null-bus-dereference-in-of_pci_range_parser_one.patch new file mode 100644 index 0000000000..14633bd595 --- /dev/null +++ b/queue-6.18/of-address-fix-null-bus-dereference-in-of_pci_range_parser_one.patch @@ -0,0 +1,90 @@ +From bba13ad17b1a11b3f1ed9b3a5d556191d7755a59 Mon Sep 17 00:00:00 2001 +From: Carlo Caione +Date: Mon, 27 Jul 2026 10:36:59 +0200 +Subject: of/address: Fix NULL bus dereference in of_pci_range_parser_one() + +From: Carlo Caione + +commit bba13ad17b1a11b3f1ed9b3a5d556191d7755a59 upstream. + +The bus matching rework made of_match_bus() return NULL for nodes with +ranges/dma-ranges but no local #address-cells. parser_init() stored that +NULL bus, and the range iterator later dereferenced it. + +Reject such nodes in parser_init(), leaving an explicit empty +iterator for callers that ignore the init return, and make +of_dma_get_max_cpu_address() honour the init failure so a rejected node +cannot clamp the DMA limit. + +Fixes: 64ee3cf096ac ("of/address: Rework bus matching to avoid warnings") +Cc: stable@vger.kernel.org +Signed-off-by: Carlo Caione +Link: https://patch.msgid.link/20260727-of-range-parser-null-bus-v3-1-be01b708a4ce@baylibre.com +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/address.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -757,6 +757,7 @@ EXPORT_SYMBOL(of_property_read_reg); + static int parser_init(struct of_pci_range_parser *parser, + struct device_node *node, const char *name) + { ++ const __be32 *range; + int rlen; + + parser->node = node; +@@ -765,12 +766,20 @@ static int parser_init(struct of_pci_ran + parser->ns = of_bus_n_size_cells(node); + parser->dma = !strcmp(name, "dma-ranges"); + parser->bus = of_match_bus(node); ++ parser->range = NULL; ++ parser->end = NULL; + +- parser->range = of_get_property(node, name, &rlen); +- if (parser->range == NULL) ++ range = of_get_property(node, name, &rlen); ++ if (!range) + return -ENOENT; + +- parser->end = parser->range + rlen / sizeof(__be32); ++ if (!parser->bus || ++ !OF_CHECK_COUNTS(parser->na, parser->ns) || ++ !OF_CHECK_ADDR_COUNT(parser->pna)) ++ return -EINVAL; ++ ++ parser->range = range; ++ parser->end = range + rlen / sizeof(__be32); + + return 0; + } +@@ -796,7 +805,7 @@ struct of_pci_range *of_pci_range_parser + int na = parser->na; + int ns = parser->ns; + int np = parser->pna + na + ns; +- int busflag_na = parser->bus->flag_cells; ++ int busflag_na; + + if (!range) + return NULL; +@@ -804,6 +813,8 @@ struct of_pci_range *of_pci_range_parser + if (!parser->range || parser->range + np > parser->end) + return NULL; + ++ busflag_na = parser->bus->flag_cells; ++ + range->flags = parser->bus->get_flags(parser->range); + + range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na); +@@ -980,8 +991,7 @@ phys_addr_t __init of_dma_get_max_cpu_ad + np = of_root; + + ranges = of_get_property(np, "dma-ranges", &len); +- if (ranges && len) { +- of_dma_range_parser_init(&parser, np); ++ if (ranges && len && !of_dma_range_parser_init(&parser, np)) { + for_each_of_range(&parser, &range) + if (range.cpu_addr + range.size > cpu_end) + cpu_end = range.cpu_addr + range.size - 1; diff --git a/queue-6.18/series b/queue-6.18/series index 06fb1ff305..6846bd7f5b 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -194,3 +194,37 @@ bluetooth-mgmt-fix-uaf-in-pair-command-cancellation.patch bluetooth-hci_sync-fix-advertising-data-uafs.patch bluetooth-hidp-reject-frames-without-a-transaction-header.patch bluetooth-hidp-validate-numbered-report-payloads.patch +bpf-lwt-fix-dst-reference-leak-on-reroute-failure.patch +afs-fix-afs_fs_fetch_data-to-set-call-async.patch +afs-fix-afs_fs_fetch_data-to-subtract-transferred-from-len.patch +afs-fix-uaf-when-sending-a-message.patch +alsa-6fire-fix-uaf-at-error-handling-during-probe.patch +alsa-hda-realtek-add-quirk-for-tongfang-x6sp45xu.patch +alsa-lx6464es-fix-period-byte-count-for-16-bit-streams.patch +alsa-pcm-wake-linked-drain-waiters-on-unlink.patch +alsa-seq-fix-division-by-zero-in-initialize_timer.patch +alsa-timer-clear-sndrv_timer_iflg_dead-once-the-close-completes.patch +alsa-ump-fix-double-free-of-out_cvts-on-rawmidi-error.patch +asoc-fsl_asrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch +asoc-fsl_easrc-fix-m2m_init-error-path-to-use-goto-instead-of-bare-return.patch +asoc-tas2562-fix-dvc-coefficient-write-order.patch +asoc-tas2562-fix-broken-entries-in-the-volume-lookup-table.patch +ata-libata-eh-increase-standby-immediate-timeout.patch +ata-libata-sata-fix-ata_scsi_lpm_supported-iteration.patch +alsa-usb-audio-fix-use-after-free-in-ump_to_endpoint.patch +alsa-usb-audio-fix-stack-info-leak-in-rme-digiface-status.patch +alsa-usb-audio-fix-oob-write-in-snd_usbmidi_akai_output.patch +alsa-usb-audio-fix-dma-buffer-out-of-bounds-write-when-fill_max-is-set.patch +alsa-usb-audio-clamp-frame-size-in-implicit-feedback-mode.patch +dmaengine-qcom-bam_dma-fix-command-element-mask-field-for-bam-v1.6.0.patch +e1000-fix-memory-leak-in-e1000_probe.patch +igbvf-fix-leak-in-tx-dma-error-cleanup.patch +igc-remove-napi_synchronize-in-igc_down.patch +ipvs-do-not-propagate-one-packet-flag-to-synced-conns.patch +ksmbd-reject-repeated-smb2-negotiate-requests.patch +mshv-fix-hv_input_get_system_property-struct.patch +net-smc-fix-socket-use-after-free-during-link-group-termination.patch +netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch +of-address-fix-null-bus-dereference-in-of_pci_range_parser_one.patch +tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch +wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch diff --git a/queue-6.18/tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch b/queue-6.18/tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch new file mode 100644 index 0000000000..02914a56d6 --- /dev/null +++ b/queue-6.18/tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch @@ -0,0 +1,47 @@ +From b4f1719dfea023220e0e6bd892b087d76b2a6a49 Mon Sep 17 00:00:00 2001 +From: Zihan Xi +Date: Fri, 24 Jul 2026 00:38:41 +0800 +Subject: tipc: avoid use-after-free in poll trace queue dumps + +From: Zihan Xi + +commit b4f1719dfea023220e0e6bd892b087d76b2a6a49 upstream. + +TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most +queue-dump callsites already serialize that walk under the socket lock or +sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(..., +TIPC_DUMP_ALL, ...) without holding either lock. + +That lets the poll trace path reach tipc_list_dump() and backlog head/tail +dumping while another context dequeues and frees an skb, leaving the trace +helper dereferencing a stale queue entry. + +Stop the unlocked poll trace site from requesting queue dumps. Other queue +dump trace callsites keep their existing output under the locking they +already provide, while poll still emits the event itself without walking +live queue members from an unlocked context. + +Fixes: b4b9771bcbbd ("tipc: enable tracepoints in tipc") +Cc: stable@vger.kernel.org +Reported-by: Vega +Signed-off-by: Zihan Xi +Signed-off-by: Ren Wei +Reviewed-by: Tung Nguyen +Link: https://patch.msgid.link/f8119abd5e5ecc400597de667ae9d39656de56d0.1784794294.git.zihanx@nebusec.ai +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -795,7 +795,7 @@ static __poll_t tipc_poll(struct file *f + __poll_t revents = 0; + + sock_poll_wait(file, sock, wait); +- trace_tipc_sk_poll(sk, NULL, TIPC_DUMP_ALL, " "); ++ trace_tipc_sk_poll(sk, NULL, TIPC_DUMP_NONE, " "); + + if (sk->sk_shutdown & RCV_SHUTDOWN) + revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM; diff --git a/queue-6.18/wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch b/queue-6.18/wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch new file mode 100644 index 0000000000..b31f3f198d --- /dev/null +++ b/queue-6.18/wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch @@ -0,0 +1,83 @@ +From 99a948382af8a225e2d5e54a7052158cd6281cc6 Mon Sep 17 00:00:00 2001 +From: Zhao Li +Date: Tue, 28 Jul 2026 19:53:25 +0800 +Subject: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames + +From: Zhao Li + +commit 99a948382af8a225e2d5e54a7052158cd6281cc6 upstream. + +mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with +ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each +subframe it passes the subframe data pointer to +mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the +length of the A-MSDU parent, instead of rx_skb->len: + + rx_skb = __skb_dequeue(&list); + rx_hdr = (struct rx_packet_hdr *)rx_skb->data; + if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) && + ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) { + mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr, + skb->len); + } + +The parent is not a valid description of that buffer, and may not be +valid memory at all. ieee80211_amsdu_to_8023s() ends with + + if (!reuse_skb) + dev_kfree_skb(skb); + +and it only sets reuse_skb when the parent is linear, is not a +head_frag, and is being consumed as the *last* subframe. So when the +parent does not qualify for reuse it has already been freed, and the +read of skb->len is a use-after-free. When it is reused, skb->len is +the length of the last subframe, applied to every earlier subframe, +which over-states the buffer whenever an earlier subframe is shorter. + +The callee cannot absorb a wrong length, because it derives its own +ceiling from the value it is given. Each frame type computes + + ies_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN; + +and the element walk is then bounded entirely against that ceiling, + + for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) { + u8 ie_len = pos[1]; + + if (pos + 2 + ie_len > end) + break; + +so a too-large len moves end past the end of the subframe and the walk +reads and copies beyond it. The A-MSDU layout is chosen by the sender, +which makes the difference between the last subframe and a shorter +earlier one remotely selectable. Reaching this requires TDLS support in +firmware and the TDLS ethertype on the subframe. + +The other caller, mwifiex_process_rx_packet(), is correct: it passes a +pointer and a length that describe the same region of the RX buffer. + +Pass rx_skb->len, the length of the subframe actually being parsed. + +Fixes: 776f742040ca ("mwifiex: fix AMPDU not setup on TDLS link problem") +Assisted-by: Codex:gpt-5.6-sol +Assisted-by: Kimi:K3 +Cc: stable@vger.kernel.org +Signed-off-by: Zhao Li +Link: https://patch.msgid.link/20260728115325.19128-1-enderaoelyther@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c ++++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +@@ -44,7 +44,7 @@ static int mwifiex_11n_dispatch_amsdu_pk + ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) { + mwifiex_process_tdls_action_frame(priv, + (u8 *)rx_hdr, +- skb->len); ++ rx_skb->len); + } + + if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)