From: Sasha Levin Date: Fri, 17 Apr 2026 19:05:07 +0000 (-0400) Subject: drop 1 patch from queue-5.15 based on RC review feedback X-Git-Tag: v5.10.253~9 X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=53772f8788a90286aa95e5d2eb746c2174798e7d;p=thirdparty%2Fkernel%2Fstable-queue.git drop 1 patch from queue-5.15 based on RC review feedback Dropped patches: - "dmaengine: idxd: Fix not releasing workqueue on .release()" Queues: 5.15 Reason: causes double destroy_workqueue() (UAF) on idxd_remove in 5.15 because the upstream refactor a409e919ca32 that removed destroy_workqueue() from idxd_remove() is not backported to 5.15 Report: https://lore.kernel.org/stable/72718777-af7f-4d1a-902d-04e765a8e8aa@oracle.com/ --- diff --git a/queue-5.15/dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch b/queue-5.15/dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch deleted file mode 100644 index 3269dc17e9..0000000000 --- a/queue-5.15/dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 642d51d755da3cbcbebc40cb74c8a25c91f9d076 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 21 Jan 2026 10:34:33 -0800 -Subject: dmaengine: idxd: Fix not releasing workqueue on .release() - -From: Vinicius Costa Gomes - -[ Upstream commit 3d33de353b1ff9023d5ec73b9becf80ea87af695 ] - -The workqueue associated with an DSA/IAA device is not released when -the object is freed. - -Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime") -Reviewed-by: Dave Jiang -Signed-off-by: Vinicius Costa Gomes -Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-7-7ed70658a9d1@intel.com -Signed-off-by: Vinod Koul -Signed-off-by: Sasha Levin ---- - drivers/dma/idxd/sysfs.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c -index 489a9d8850764..ee208dfdd0cb5 100644 ---- a/drivers/dma/idxd/sysfs.c -+++ b/drivers/dma/idxd/sysfs.c -@@ -1271,6 +1271,7 @@ static void idxd_conf_device_release(struct device *dev) - { - struct idxd_device *idxd = confdev_to_idxd(dev); - -+ destroy_workqueue(idxd->wq); - kfree(idxd->groups); - kfree(idxd->wqs); - kfree(idxd->engines); --- -2.53.0 - diff --git a/queue-5.15/series b/queue-5.15/series index fe8535e2ed..e75891e07c 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -370,7 +370,6 @@ ext4-avoid-allocate-block-from-corrupted-group-in-ext4_mb_find_by_goal.patch ext4-reject-mount-if-bigalloc-with-s_first_data_block-0.patch ext4-fix-iloc.bh-leak-in-ext4_fc_replay_inode-error-paths.patch ext4-always-drain-queued-discard-work-in-ext4_mb_release.patch -dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch phy-ti-j721e-wiz-fix-device-node-reference-leak-in-w.patch dmaengine-xilinx-xilinx_dma-fix-dma_device-direction.patch dmaengine-xilinx-xilinx_dma-fix-residue-calculation-.patch