From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 11:49:17 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=697baa2fabec0d6f1d0400e3491c23ed44db4848;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch gpio-pca953x-fix-cache_only-and-irq-state-on-restore_context-failure.patch hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch i2c-imx-fix-slave-registration-race-and-error-handling.patch i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch ice-wait-for-reset-completion-in-ice_resume.patch mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch net-bridge-stop-fast-leave-after-deleting-a-port-group.patch net-ipv6-clear-suppressed-fib6-rule-result.patch net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch power-supply-bq25890-fix-the-10-c-ntc-lookup-entry.patch powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch s390-dasd-fix-potential-null-pointer-dereference.patch s390-qeth-check-cap_net_admin-for-private-ioctls.patch s390-zcrypt-fix-wrong-domain-value-verification-with-ep11-cprbs.patch s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch scsi-scsi_debug-fix-report-zones-alloc_len-underflow-oob-write.patch sctp-prevent-peer-transport-count-overflow.patch sctp-reject-stale-cookies-with-mismatched-verification-tags.patch selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch tracing-filters-fix-false-positive-match-in-regex_match_full.patch ublk-reset-kernel-owned-dev_info-fields-in-ublk_ctrl_add_dev.patch um-vector-fix-use-after-free-in-vector_mmsg_rx.patch vxlan-re-fetch-eth-header-after-route_shortcircuit.patch vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch --- diff --git a/queue-6.1/cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch b/queue-6.1/cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch new file mode 100644 index 0000000000..e2f2c33cb5 --- /dev/null +++ b/queue-6.1/cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch @@ -0,0 +1,35 @@ +From d5f8e5f6040d052d44fcbf4f31dd35145c0c8d7d Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Mon, 27 Jul 2026 15:05:51 +0530 +Subject: cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() + +From: Abdun Nihaal + +commit d5f8e5f6040d052d44fcbf4f31dd35145c0c8d7d upstream. + +The memory allocated for data->powernow_table inside +powernow_k8_cpu_init_acpi() or find_psb_table() is not freed in one of +the error paths in powernowk8_cpu_init(). Fix that by adding a kfree(). + +Fixes: 1ff6e97f1d99 ("[CPUFREQ] cpumask: avoid playing with cpus_allowed in powernow-k8.c") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Acked-by: Viresh Kumar +Reviewed-by: Zhongqiu Han +Link: https://patch.msgid.link/20260727093553.98246-1-nihaal@cse.iitm.ac.in +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/powernow-k8.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1083,6 +1083,7 @@ static int powernowk8_cpu_init(struct cp + + err_out_exit_acpi: + powernow_k8_cpu_exit_acpi(data); ++ kfree(data->powernow_table); + + err_out: + kfree(data); diff --git a/queue-6.1/gpio-pca953x-fix-cache_only-and-irq-state-on-restore_context-failure.patch b/queue-6.1/gpio-pca953x-fix-cache_only-and-irq-state-on-restore_context-failure.patch new file mode 100644 index 0000000000..b3978a1ea9 --- /dev/null +++ b/queue-6.1/gpio-pca953x-fix-cache_only-and-irq-state-on-restore_context-failure.patch @@ -0,0 +1,51 @@ +From d233087c19f6607ef926ac3f47d776e2406ffd1f Mon Sep 17 00:00:00 2001 +From: bui duc phuc +Date: Mon, 27 Jul 2026 15:02:05 +0700 +Subject: gpio: pca953x: fix cache_only and IRQ state on restore_context() failure + +From: bui duc phuc + +commit d233087c19f6607ef926ac3f47d776e2406ffd1f upstream. + +When pca953x_restore_context() fails, cache_only is left disabled and +the IRQ left enabled, even though register synchronization may not have +completed successfully. Restore cache_only and disable the IRQ again on +failure, matching the state set by pca953x_save_context(). + +Fixes: ec5bde62019b ("gpio: pca953x: Split pca953x_restore_context() and pca953x_save_context()") +Fixes: 3e38f946062b ("gpio: pca953x: fix IRQ storm on system wake up") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: bui duc phuc +Link: https://patch.msgid.link/20260727080205.16353-1-phucduc.bui@gmail.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-pca953x.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -1247,9 +1247,20 @@ static int pca953x_restore_context(struc + regcache_mark_dirty(chip->regmap); + ret = pca953x_regcache_sync(chip); + if (ret) +- return ret; ++ goto err; + +- return regcache_sync(chip->regmap); ++ ret = regcache_sync(chip->regmap); ++ if (ret) ++ goto err; ++ ++ return 0; ++ ++err: ++ if (chip->client->irq > 0) ++ disable_irq(chip->client->irq); ++ regcache_cache_only(chip->regmap, true); ++ ++ return ret; + } + + static void pca953x_save_context(struct pca953x_chip *chip) diff --git a/queue-6.1/hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch b/queue-6.1/hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch new file mode 100644 index 0000000000..b1e5e0e5c0 --- /dev/null +++ b/queue-6.1/hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch @@ -0,0 +1,57 @@ +From f27f6976ea269219c1259a7c2f8c6dfe782540a3 Mon Sep 17 00:00:00 2001 +From: Hongyan Xu +Date: Wed, 29 Jul 2026 18:01:16 +0800 +Subject: hwmon: (npcm750-pwm-fan): stop fan timer on device detach + +From: Hongyan Xu + +commit f27f6976ea269219c1259a7c2f8c6dfe782540a3 upstream. + +When a fan tach channel is present, npcm7xx_pwm_fan_probe() starts +fan_timer. The timer callback polls tach state and rearms the timer, but +the driver has no remove callback or devm cleanup action to stop it. On +device detach, the devm-managed driver data and I/O mappings can be +released while the timer is still pending or running. + +Register a devm cleanup action before starting the timer and shut the +timer down synchronously from that action. + +This issue was found by a static analysis tool. + +Fixes: f1fd4a4db777 ("hwmon: Add NPCM7xx PWM and Fan driver") +Cc: stable@vger.kernel.org +Signed-off-by: Hongyan Xu +Link: https://lore.kernel.org/r/20260729100116.790-1-getshell@seu.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/npcm750-pwm-fan.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/hwmon/npcm750-pwm-fan.c ++++ b/drivers/hwmon/npcm750-pwm-fan.c +@@ -360,6 +360,11 @@ static void npcm7xx_fan_polling(struct t + add_timer(&data->fan_timer); + } + ++static void npcm7xx_fan_cleanup(void *timer) ++{ ++ timer_shutdown_sync(timer); ++} ++ + static inline void npcm7xx_fan_compute(struct npcm7xx_pwm_fan_data *data, + u8 fan, u8 cmp, u8 fan_id, u8 flag_int, + u8 flag_mode, u8 flag_clear) +@@ -1003,6 +1008,12 @@ static int npcm7xx_pwm_fan_probe(struct + msecs_to_jiffies(NPCM7XX_FAN_POLL_TIMER_200MS); + timer_setup(&data->fan_timer, + npcm7xx_fan_polling, 0); ++ ret = devm_add_action_or_reset(dev, ++ npcm7xx_fan_cleanup, ++ &data->fan_timer); ++ if (ret) ++ return ret; ++ + add_timer(&data->fan_timer); + break; + } diff --git a/queue-6.1/i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch b/queue-6.1/i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch new file mode 100644 index 0000000000..af71d42bda --- /dev/null +++ b/queue-6.1/i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch @@ -0,0 +1,43 @@ +From 82048795242f04275a3f49ffc66ad851b6120954 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Tue, 21 Jul 2026 23:41:47 +0900 +Subject: i2c: amd-mp2: Unregister callback on adapter add failure + +From: Myeonghun Pak + +commit 82048795242f04275a3f49ffc66ad851b6120954 upstream. + +amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI +driver's callback table before the adapter is registered. If +i2c_add_adapter() fails, probe returns and devres frees the context, +but the PCI driver can still dereference the stale pointer from its IRQ +and system-sleep callbacks. + +Unregister the callback before returning the adapter registration error. + +Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller") +Co-developed-by: Ijae Kim +Signed-off-by: Ijae Kim +Signed-off-by: Myeonghun Pak +Cc: # v5.2+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260721144147.31150-1-mhun512@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-amd-mp2-plat.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-amd-mp2-plat.c ++++ b/drivers/i2c/busses/i2c-amd-mp2-plat.c +@@ -316,8 +316,10 @@ static int i2c_amd_probe(struct platform + + amd_mp2_pm_runtime_put(mp2_dev); + +- if (ret < 0) ++ if (ret < 0) { + dev_err(&pdev->dev, "i2c add adapter failed = %d\n", ret); ++ amd_mp2_unregister_cb(&i2c_dev->common); ++ } + + return ret; + } diff --git a/queue-6.1/i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch b/queue-6.1/i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch new file mode 100644 index 0000000000..0593c4268c --- /dev/null +++ b/queue-6.1/i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch @@ -0,0 +1,42 @@ +From 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f Mon Sep 17 00:00:00 2001 +From: Liem +Date: Mon, 29 Jun 2026 10:38:29 +0800 +Subject: i2c: imx: Cancel hrtimer before clearing slave pointer + +From: Liem + +commit 6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f upstream. + +In i2c_imx_unreg_slave(), the slave pointer is set to NULL after +disabling interrupts. However, a pending interrupt might already +have started the hrtimer (i2c_imx_slave_timeout) before the pointer +was cleared. If the hrtimer fires after i2c_imx->slave is set to +NULL, the timer callback i2c_imx_slave_finish_op() will call +i2c_imx_slave_event() with a NULL slave pointer, which results in a +use-after-free / NULL pointer dereference. + +Fix by canceling the hrtimer and waiting for it to complete after +disabling interrupts, before clearing the slave pointer. + +Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver") +Signed-off-by: Liem +Cc: # v5.11+ +Acked-by: Carlos Song +Reviewed-by: Frank Li +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260629023829.152651-3-liem16213@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-imx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -901,6 +901,7 @@ static int i2c_imx_unreg_slave(struct i2 + + i2c_imx_reset_regs(i2c_imx); + ++ hrtimer_cancel(&i2c_imx->slave_timer); + i2c_imx->slave = NULL; + + /* Suspend */ diff --git a/queue-6.1/i2c-imx-fix-slave-registration-race-and-error-handling.patch b/queue-6.1/i2c-imx-fix-slave-registration-race-and-error-handling.patch new file mode 100644 index 0000000000..f7bf3bf40d --- /dev/null +++ b/queue-6.1/i2c-imx-fix-slave-registration-race-and-error-handling.patch @@ -0,0 +1,64 @@ +From d64ec362c369bbc33833f7936d5f3a706b0d5c45 Mon Sep 17 00:00:00 2001 +From: Liem +Date: Mon, 29 Jun 2026 10:38:28 +0800 +Subject: i2c: imx: Fix slave registration race and error handling + +From: Liem + +commit d64ec362c369bbc33833f7936d5f3a706b0d5c45 upstream. + +In i2c_imx_reg_slave(), the slave pointer was assigned before +pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, +the error path returned without clearing i2c_imx->slave, leaving it +non-NULL and causing all subsequent registration attempts to fail +with -EBUSY. + +Additionally, because this driver uses a shared IRQ, the interrupt +handler i2c_imx_isr() can execute concurrently and, after acquiring +slave_lock, dereference i2c_imx->slave. The previous fix attempt +added a lockless i2c_imx->slave = NULL on the error path, but that +could race with the ISR under the lock and still cause a NULL pointer +dereference. + +Fix both issues by deferring the assignment of i2c_imx->slave and +i2c_imx->last_slave_event to after a successful resume, and by +performing the assignment inside the slave_lock critical section. +This guarantees that the slave pointer is never left stale on the +error path and is always valid when observed by the interrupt handler. + +Fixes: f7414cd6923f ("i2c: imx: support slave mode for imx I2C driver") +Signed-off-by: Liem +Cc: # v5.11+ +Reviewed-by: Frank Li +Acked-by: Carlos Song +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260629023829.152651-2-liem16213@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-imx.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -871,9 +871,6 @@ static int i2c_imx_reg_slave(struct i2c_ + if (i2c_imx->slave) + return -EBUSY; + +- i2c_imx->slave = client; +- i2c_imx->last_slave_event = I2C_SLAVE_STOP; +- + /* Resume */ + ret = pm_runtime_resume_and_get(i2c_imx->adapter.dev.parent); + if (ret < 0) { +@@ -881,6 +878,11 @@ static int i2c_imx_reg_slave(struct i2c_ + return ret; + } + ++ scoped_guard(spinlock_irqsave, &i2c_imx->slave_lock) { ++ i2c_imx->slave = client; ++ i2c_imx->last_slave_event = I2C_SLAVE_STOP; ++ } ++ + i2c_imx_slave_init(i2c_imx); + + return 0; diff --git a/queue-6.1/i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch b/queue-6.1/i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch new file mode 100644 index 0000000000..c5972a3e7d --- /dev/null +++ b/queue-6.1/i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch @@ -0,0 +1,75 @@ +From d99607c888f26e8a4e9fe9772860cef4aff86bb4 Mon Sep 17 00:00:00 2001 +From: "H. Nikolaus Schaller" +Date: Sun, 19 Jul 2026 22:19:43 +0200 +Subject: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock + +From: H. Nikolaus Schaller + +commit d99607c888f26e8a4e9fe9772860cef4aff86bb4 upstream. + +Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) +and the I2C adapter lock, which triggers when an I2C-controlled clock +generator client (like the Si5351) is registered or modified under the CCF. + +During an i2c client clock (generator) frequency change, the CCF acquires its global +'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's +chip registers, stalling for the adapter's I2C bus lock. + +Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO +expander handling LEDs) can hold the I2C adapter lock. Inside this parallel +transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host +controller's input clock to calculate bus timings. This call attempts to acquire +the blocked CCF 'prepare_lock', creating a circular dependency that freezes +the system. + +The jz4780 host controller clock itself is static and never changes at runtime. + +However, calling clk_get_rate() inside the active transfer path introduces +an unnecessary dependency on the CCF internal locks. + +Eliminate this synchronous clk_get_rate() call from the active transfer +path by caching the static host peripheral clock rate once - inside the private +jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed() +to use this cached value, safely decoupling active I2C transactions from the +CCF internal locks without any risk of stale timings. + +Assisted-by web based Google AI (pinpointing the bug and writing the message). + +Fixes: ba92222ed63a12 ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780") +Signed-off-by: H. Nikolaus Schaller +Cc: # v4.1+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/2db6fd233aceb7238474e4833f4d25ca681c3ffb.1784492382.git.hns@goldelico.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-jz4780.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-jz4780.c ++++ b/drivers/i2c/busses/i2c-jz4780.c +@@ -141,6 +141,7 @@ struct jz4780_i2c { + void __iomem *iomem; + int irq; + struct clk *clk; ++ unsigned long clk_rate_khz; + struct i2c_adapter adap; + const struct ingenic_i2c_config *cdata; + +@@ -246,7 +247,7 @@ static int jz4780_i2c_set_target(struct + + static int jz4780_i2c_set_speed(struct jz4780_i2c *i2c) + { +- int dev_clk_khz = clk_get_rate(i2c->clk) / 1000; ++ int dev_clk_khz = i2c->clk_rate_khz; + int cnt_high = 0; /* HIGH period count of the SCL clock */ + int cnt_low = 0; /* LOW period count of the SCL clock */ + int cnt_period = 0; /* period count of the SCL clock */ +@@ -800,6 +801,8 @@ static int jz4780_i2c_probe(struct platf + if (ret) + return ret; + ++ i2c->clk_rate_khz = clk_get_rate(i2c->clk) / 1000; ++ + ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency", + &clk_freq); + if (ret) { diff --git a/queue-6.1/ice-wait-for-reset-completion-in-ice_resume.patch b/queue-6.1/ice-wait-for-reset-completion-in-ice_resume.patch new file mode 100644 index 0000000000..a6336298cb --- /dev/null +++ b/queue-6.1/ice-wait-for-reset-completion-in-ice_resume.patch @@ -0,0 +1,65 @@ +From c2816d613f388814d27bc9fd6dbd931a88056e19 Mon Sep 17 00:00:00 2001 +From: Aaron Ma +Date: Wed, 29 Apr 2026 11:48:49 +0800 +Subject: ice: wait for reset completion in ice_resume() + +From: Aaron Ma + +commit c2816d613f388814d27bc9fd6dbd931a88056e19 upstream. + +ice_resume() schedules an asynchronous PF reset and returns +immediately. The reset runs later in ice_service_task(). If +userspace tries to bring up the net device before the reset +finishes, ice_open() fails with -EBUSY: + + ice_resume() + ice_schedule_reset() # sets ICE_PFR_REQ, returns + ... + ice_open() + ice_is_reset_in_progress() # ICE_PFR_REQ still set, -EBUSY + ... + ice_service_task() + ice_do_reset() + ice_rebuild() # clears ICE_PFR_REQ, too late + +Reproduced on E800 series NICs during suspend/resume with irdma +enabled, where the aux device probe widens the race window. + + ice 0000:81:00.0: can't open net device while reset is in progress + +Add a best-effort wait (10s timeout, matching ice_devlink_info_get()) +for the reset to complete before returning from ice_resume(). In +practice the reset completes in ~300ms. + +Fixes: 769c500dcc1e ("ice: Add advanced power mgmt for WoL") +Cc: stable@vger.kernel.org +Reviewed-by: Kohei Enju +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Przemek Kitszel +Signed-off-by: Aaron Ma +Tested-by: Alexander Nowlin +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -5369,6 +5369,16 @@ static int __maybe_unused ice_resume(str + /* Restart the service task */ + mod_timer(&pf->serv_tmr, round_jiffies(jiffies + pf->serv_tmr_period)); + ++ /* Best-effort wait for the scheduled reset to finish so that the ++ * device is operational before returning. Without this, userspace ++ * (e.g. NetworkManager) may try to open the net device while the ++ * asynchronous reset is still in progress, hitting -EBUSY. ++ */ ++ ret = ice_wait_for_reset(pf, secs_to_jiffies(10)); ++ if (ret) ++ dev_err(dev, "Wait for reset timed out (10s) during resume: %d\n", ++ ret); ++ + return 0; + } + #endif /* CONFIG_PM */ diff --git a/queue-6.1/mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch b/queue-6.1/mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch new file mode 100644 index 0000000000..9d16557871 --- /dev/null +++ b/queue-6.1/mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch @@ -0,0 +1,98 @@ +From 0b45f6927a14914ff685fe0e6f9d11232a1e03df Mon Sep 17 00:00:00 2001 +From: Link Lin +Date: Tue, 21 Jul 2026 00:55:33 +0000 +Subject: mm/page_reporting: use system_freezable_wq to fix UAF during suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Link Lin + +commit 0b45f6927a14914ff685fe0e6f9d11232a1e03df upstream. + +During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like +virtio_balloon reset their underlying virtio devices and delete their +virtqueues via vdev->config->del_vqs(). + +However, page reporting work (page_reporting_process) was scheduled on the +global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM +freezer skips it, leaving page_reporting_process active during suspend. + +If pages are freed into the buddy allocator while suspending (for example, +when core MM invokes the balloon shrinker during S4 hibernation image +saving), page reporting triggers virtballoon_free_page_report() on deleted +virtqueues, resulting in a Use-After-Free / General Protection Fault: + + [ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI + [ 196.825967] Workqueue: events page_reporting_process + [ 196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring] + [ 196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon] + [ 196.946943] page_reporting_process+0x370/0x4f0 + +Fix this by switching page reporting work to system_freezable_wq. This +ensures that the PM freezer pauses page_reporting_process before device +drivers destroy their reporting virtqueues. Because the reporting worker +is frozen, memory reclamation/freeing (e.g. via shrinker execution) can +safely return pages to MM during freeze without triggering unfrozen +reporting work on deleted virtqueues. + +This aligns with the driver's existing design. The comment in +virtballoon_freeze() states: + /* + * The workqueue is already frozen by the PM core before this + * function is called. + */ + +Testing: +I have verified these fixes using Google’s virtualization infrastructure +by running continuous suspend/resume iterations (40+ cycles) while +churning memory using stress-ng (`stress-ng --vm 4 --vm-bytes 60% +--timeout 1`) to constantly create free pages for the buddy allocator. We +also set the `page_reporting_order` parameter to 0 to make the page +reporting worker highly sensitive, forcing it to pick up any 4K free +pages. This confirmed that the UAF crashes are no longer reproducible. + +Link: https://lore.kernel.org/20260721005603.1710551-1-linkl@google.com +Fixes: 36e66c554b5c ("mm: introduce Reported pages") +Signed-off-by: Link Lin +Suggested-by: David Hildenbrand (Arm) +Suggested-by: Michael S. Tsirkin +Acked-by: David Rientjes +Acked-by: David Hildenbrand (Arm) +Acked-by: Michael S. Tsirkin +Cc: Alexander Duyck +Cc: Greg Thelen +Cc: James Houghton +Cc: Jason Wang +Cc: Jiaqi Yan +Cc: Vlastimil Babka +Cc: Xuan Zhuo +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/page_reporting.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/page_reporting.c ++++ b/mm/page_reporting.c +@@ -48,7 +48,8 @@ __page_reporting_request(struct page_rep + * now we are limiting this to running no more than once every + * couple of seconds. + */ +- schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY); ++ queue_delayed_work(system_freezable_wq, &prdev->work, ++ PAGE_REPORTING_DELAY); + } + + /* notify prdev of free page reporting request */ +@@ -311,7 +312,8 @@ err_out: + */ + state = atomic_cmpxchg(&prdev->state, state, PAGE_REPORTING_IDLE); + if (state == PAGE_REPORTING_REQUESTED) +- schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY); ++ queue_delayed_work(system_freezable_wq, &prdev->work, ++ PAGE_REPORTING_DELAY); + } + + static DEFINE_MUTEX(page_reporting_mutex); diff --git a/queue-6.1/net-bridge-stop-fast-leave-after-deleting-a-port-group.patch b/queue-6.1/net-bridge-stop-fast-leave-after-deleting-a-port-group.patch new file mode 100644 index 0000000000..2485a295f5 --- /dev/null +++ b/queue-6.1/net-bridge-stop-fast-leave-after-deleting-a-port-group.patch @@ -0,0 +1,47 @@ +From a39789f211b8a4125f0c70e05b30cf715f4f187d Mon Sep 17 00:00:00 2001 +From: Zhiling Zou +Date: Fri, 24 Jul 2026 00:52:48 +0800 +Subject: net: bridge: stop fast-leave after deleting a port group + +From: Zhiling Zou + +commit a39789f211b8a4125f0c70e05b30cf715f4f187d upstream. + +br_multicast_leave_group() iterates mp->ports with pp = &p->next in +its fast-leave path. After br_multicast_del_pg() removes p, +continuing the loop advances pp through the deleted entry. + +If multicast-to-unicast was enabled, the bridge can hold multiple port +groups for the same port and group with different source MAC +addresses. Once multicast-to-unicast is disabled, +br_port_group_equal() matches those entries by port only. A fast leave +can then delete one entry and continue from its stale next pointer, +leaving mp->ports pointing at a deleted port group. + +Fast leave only needs to remove one matching port group. Break after +br_multicast_del_pg() so the loop stops before dereferencing the +removed entry. + +Fixes: 6db6f0eae605 ("bridge: multicast to unicast") +Cc: stable@vger.kernel.org +Reported-by: Vega +Signed-off-by: Zhiling Zou +Signed-off-by: Ren Wei +Acked-by: Nikolay Aleksandrov +Link: https://patch.msgid.link/1cf0898872ef7c72d5f4c0304414a192c6dac591.1784707712.git.zhilinz@nebusec.ai +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_multicast.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -3511,6 +3511,7 @@ br_multicast_leave_group(struct net_brid + + p->flags |= MDB_PG_FLAGS_FAST_LEAVE; + br_multicast_del_pg(mp, p, pp); ++ break; + } + goto out; + } diff --git a/queue-6.1/net-ipv6-clear-suppressed-fib6-rule-result.patch b/queue-6.1/net-ipv6-clear-suppressed-fib6-rule-result.patch new file mode 100644 index 0000000000..6d62221eda --- /dev/null +++ b/queue-6.1/net-ipv6-clear-suppressed-fib6-rule-result.patch @@ -0,0 +1,43 @@ +From 6aea62e433fe1b586202a5fee8b5807ce635e1d7 Mon Sep 17 00:00:00 2001 +From: Zhiling Zou +Date: Fri, 24 Jul 2026 00:48:52 +0800 +Subject: net: ipv6: clear suppressed fib6 rule result + +From: Zhiling Zou + +commit 6aea62e433fe1b586202a5fee8b5807ce635e1d7 upstream. + +fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), +but leaves res->rt6 pointing at the released rt6_info. + +If no later rule supplies a replacement, fib6_rule_lookup() still sees +res.rt6 and returns that stale dst to its caller. A suppressing rule can +therefore leak a released route back to rt6_lookup(), and the next put +hits rcuref_put_slowpath() from dst_release(). + +Clear res->rt6 when suppressing the route so suppressed lookups fall +through to the null dst instead of reusing the released one. + +Fixes: cdef485217d3 ("ipv6: fix memory leak in fib6_rule_suppress") +Cc: stable@vger.kernel.org +Reported-by: Vega +Signed-off-by: Zhiling Zou +Signed-off-by: Ren Wei +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/4b8acb7787d54e440155585dd32ebdf0bef7d122.1784710966.git.zhilinz@nebusec.ai +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/fib6_rules.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/fib6_rules.c ++++ b/net/ipv6/fib6_rules.c +@@ -301,6 +301,7 @@ INDIRECT_CALLABLE_SCOPE bool fib6_rule_s + + suppress_route: + ip6_rt_put_flags(rt, flags); ++ res->rt6 = NULL; + return true; + } + diff --git a/queue-6.1/net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch b/queue-6.1/net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch new file mode 100644 index 0000000000..63482881e3 --- /dev/null +++ b/queue-6.1/net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch @@ -0,0 +1,120 @@ +From a58a2b0ce354df531ebc71fc870058c2feb59f6b Mon Sep 17 00:00:00 2001 +From: Ilya Maximets +Date: Mon, 27 Jul 2026 14:10:21 +0200 +Subject: net: openvswitch: fix potential UAF on meter attach failure + +From: Ilya Maximets + +commit a58a2b0ce354df531ebc71fc870058c2feb59f6b upstream. + +While attaching a newly created meter attach_meter() function makes +the new meter visible to other CPUs but can still fail afterwards. +On failure, it detaches the meter back and returns an error. + +However, this is an unexpected behavior for the ovs_meter_cmd_set() +that uses a plain kfree(meter) on attach failure without waiting for +RCU readers to stop using it, assuming it was never visible. + +This is never a problem for ovs-vswitchd as it always creates meters +before creating any flows that use them. But the UAF can be triggered +with a custom application using uAPI: + + BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653) + Read of size 8 at addr ffff88810d152650 by task meter/2508 + + Call Trace: + ovs_meter_execute (net/openvswitch/meter.c:653) + do_execute_actions (net/openvswitch/actions.c:1407) + ovs_execute_actions (net/openvswitch/actions.c:1584) + ovs_packet_cmd_execute (net/openvswitch/datapath.c:703) + ... + netlink_sendmsg (af_netlink.c:1900) + + Allocated by task 2519: + __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) + ovs_meter_cmd_set (net/openvswitch/meter.c:422) + ... + netlink_sendmsg (af_netlink.c:1900) + + Freed by task 2519: + kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720) + ovs_meter_cmd_set (net/openvswitch/meter.c:479) + ... + netlink_sendmsg (af_netlink.c:1900) + +Fix that by making sure attach_meter() doesn't make the meter visible +until all the checks are done and the function can't fail anymore. + +This also makes sure the "hash" value is calculated after the potential +re-sizing of the table. + +Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642. + +Fixes: c7c4c44c9a95 ("net: openvswitch: expand the meters supported number") +Cc: stable@vger.kernel.org +Signed-off-by: Ilya Maximets +Reviewed-by: Eelco Chaudron +Link: https://patch.msgid.link/20260727121022.198461-1-i.maximets@ovn.org +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/meter.c | 33 +++++++++++++++++++-------------- + 1 file changed, 19 insertions(+), 14 deletions(-) + +--- a/net/openvswitch/meter.c ++++ b/net/openvswitch/meter.c +@@ -135,18 +135,10 @@ static void dp_meter_instance_remove(str + + static int attach_meter(struct dp_meter_table *tbl, struct dp_meter *meter) + { +- struct dp_meter_instance *ti = rcu_dereference_ovsl(tbl->ti); +- u32 hash = meter_hash(ti, meter->id); ++ struct dp_meter_instance *ti; ++ u32 hash; + int err; + +- /* In generally, slots selected should be empty, because +- * OvS uses id-pool to fetch a available id. +- */ +- if (unlikely(rcu_dereference_ovsl(ti->dp_meters[hash]))) +- return -EBUSY; +- +- dp_meter_instance_insert(ti, meter); +- + /* That function is thread-safe. */ + tbl->count++; + if (tbl->count >= tbl->max_meters_allowed) { +@@ -154,16 +146,29 @@ static int attach_meter(struct dp_meter_ + goto attach_err; + } + +- if (tbl->count >= ti->n_meters && +- dp_meter_instance_realloc(tbl, ti->n_meters * 2)) { +- err = -ENOMEM; ++ ti = rcu_dereference_ovsl(tbl->ti); ++ if (tbl->count >= ti->n_meters) { ++ err = dp_meter_instance_realloc(tbl, ti->n_meters * 2); ++ if (err) ++ goto attach_err; ++ ++ ti = rcu_dereference_ovsl(tbl->ti); ++ } ++ ++ hash = meter_hash(ti, meter->id); ++ ++ /* In general, selected slots should be empty, because ++ * OvS uses id-pool to fetch available ids. ++ */ ++ if (unlikely(rcu_dereference_ovsl(ti->dp_meters[hash]))) { ++ err = -EBUSY; + goto attach_err; + } + ++ dp_meter_instance_insert(ti, meter); + return 0; + + attach_err: +- dp_meter_instance_remove(ti, meter); + tbl->count--; + return err; + } diff --git a/queue-6.1/net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch b/queue-6.1/net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch new file mode 100644 index 0000000000..353f3c5f1a --- /dev/null +++ b/queue-6.1/net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch @@ -0,0 +1,44 @@ +From bc62e843bc48f933da765ce47079fd992e535794 Mon Sep 17 00:00:00 2001 +From: Ilya Maximets +Date: Mon, 27 Jul 2026 20:18:31 +0200 +Subject: net: openvswitch: fix skb leak on flow key update failure during ct + +From: Ilya Maximets + +commit bc62e843bc48f933da765ce47079fd992e535794 upstream. + +ovs_ct_execute() always steals or frees the skb on failure while +ovs_flow_key_update() does not. So, if it fails and we return right +away, the skb ends up leaked. + +Fix that by breaking instead and letting the common error handling +code at the bottom of the loop to free the skb properly. + +This is a very unlikely scenario as it requires the packet to become +unparseable by applying a set of actions on a previously parseable skb, +but should be fixed nevertheless. + +Reported by Sashiko. + +Fixes: ec0d043d05e6 ("openvswitch: Ensure flow is valid before executing ct") +Cc: stable@vger.kernel.org +Signed-off-by: Ilya Maximets +Reviewed-by: Aaron Conole +Link: https://patch.msgid.link/20260727181851.306076-3-i.maximets@ovn.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/actions.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -1326,7 +1326,7 @@ static int do_execute_actions(struct dat + if (!is_flow_key_valid(key)) { + err = ovs_flow_key_update(skb, key); + if (err) +- return err; ++ break; + } + + err = ovs_ct_execute(ovs_dp_get_net(dp), skb, key, diff --git a/queue-6.1/phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch b/queue-6.1/phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch new file mode 100644 index 0000000000..0fe9349d25 --- /dev/null +++ b/queue-6.1/phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch @@ -0,0 +1,40 @@ +From 6cb22477929489a412df8d153e550e77a012e701 Mon Sep 17 00:00:00 2001 +From: Nava kishore Manne +Date: Sat, 27 Jun 2026 21:22:27 +0530 +Subject: phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask + +From: Nava kishore Manne + +commit 6cb22477929489a412df8d153e550e77a012e701 upstream. + +The L0_TX_DIG_61 register bit 2 is a reserved read-only field. +The previous mask value 0x0f incorrectly included bit 2, causing +unintended writes to a reserved bit on every scrambler bypass +operation. + +Correct the mask to (BIT(3) | GENMASK(1, 0)) to cover only the +valid scramble bypass control bits. + +Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") +Cc: stable@vger.kernel.org +Signed-off-by: Nava kishore Manne +Signed-off-by: Radhey Shyam Pandey +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260627155229.2791113-2-radhey.shyam.pandey@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/xilinx/phy-zynqmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -53,7 +53,7 @@ + #define L0_TM_DIG_6 0x106c + #define L0_TM_DIS_DESCRAMBLE_DECODER 0x0f + #define L0_TX_DIG_61 0x00f4 +-#define L0_TM_DISABLE_SCRAMBLE_ENCODER 0x0f ++#define L0_TM_DISABLE_SCRAMBLE_ENCODER (BIT(3) | GENMASK(1, 0)) + + /* PLL Test Mode register parameters */ + #define L0_TM_PLL_DIG_37 0x2094 diff --git a/queue-6.1/phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch b/queue-6.1/phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch new file mode 100644 index 0000000000..de8646a8d6 --- /dev/null +++ b/queue-6.1/phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch @@ -0,0 +1,98 @@ +From 7eb61caf45607e1e1270f51f8f93f0ded53146da Mon Sep 17 00:00:00 2001 +From: Nava kishore Manne +Date: Sat, 27 Jun 2026 21:22:29 +0530 +Subject: phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB + +From: Nava kishore Manne + +commit 7eb61caf45607e1e1270f51f8f93f0ded53146da upstream. + +USB Gen1 requires scrambling and 8b/10b encoding to be performed in the +physical layer. Do not bypass PHY-side scrambler or encoder/decoder for +USB operation, as mandated by the USB 3.x specification. + +Scrambler and 8b/10b bypass remain restricted to SATA and SGMII +modes, where encoding is handled in the controller. + +Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") +Cc: stable@vger.kernel.org +Signed-off-by: Nava kishore Manne +Signed-off-by: Radhey Shyam Pandey +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260627155229.2791113-4-radhey.shyam.pandey@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/xilinx/phy-zynqmp.c | 39 +++++++++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 10 deletions(-) + +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -488,15 +488,30 @@ static void xpsgtr_lane_set_protocol(str + } + } + +-/* Bypass (de)scrambler and 8b/10b decoder and encoder. */ +-static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy) ++/** ++ * xpsgtr_bypass_scrambler_8b10b - Configure scrambler/encoder behavior ++ * @gtr_phy: pointer to lane context ++ * @bypass: true to enable scrambler/encoder bypass (SATA/SGMII), ++ * false to disable scrambler/encoder bypass (USB3) ++ * ++ * Uses RMW to preserve reserved and unrelated register fields. ++ */ ++static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy, ++ bool bypass) + { +- xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, +- L0_TM_DIS_DESCRAMBLE_DECODER, +- L0_TM_DIS_DESCRAMBLE_DECODER); +- xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, +- L0_TM_DISABLE_SCRAMBLE_ENCODER, +- L0_TM_DISABLE_SCRAMBLE_ENCODER); ++ if (bypass) { ++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, ++ L0_TM_DIS_DESCRAMBLE_DECODER, ++ L0_TM_DIS_DESCRAMBLE_DECODER); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER); ++ } else { ++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, ++ L0_TM_DIS_DESCRAMBLE_DECODER, 0); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER, 0); ++ } + } + + /* DP-specific initialization. */ +@@ -517,7 +532,7 @@ static void xpsgtr_phy_init_sata(struct + { + struct xpsgtr_dev *gtr_dev = gtr_phy->dev; + +- xpsgtr_bypass_scrambler_8b10b(gtr_phy); ++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, true); + + writel(gtr_phy->lane, gtr_dev->siou + SATA_CONTROL_OFFSET); + } +@@ -533,7 +548,7 @@ static void xpsgtr_phy_init_sgmii(struct + xpsgtr_clr_set(gtr_dev, TX_PROT_BUS_WIDTH, mask, val); + xpsgtr_clr_set(gtr_dev, RX_PROT_BUS_WIDTH, mask, val); + +- xpsgtr_bypass_scrambler_8b10b(gtr_phy); ++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, true); + } + + /* Configure TX de-emphasis and margining for DP. */ +@@ -694,6 +709,10 @@ static int xpsgtr_phy_init(struct phy *p + case ICM_PROTOCOL_SGMII: + xpsgtr_phy_init_sgmii(gtr_phy); + break; ++ ++ case ICM_PROTOCOL_USB: ++ xpsgtr_bypass_scrambler_8b10b(gtr_phy, false); ++ break; + } + + goto out; diff --git a/queue-6.1/phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch b/queue-6.1/phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch new file mode 100644 index 0000000000..86cbcfc4bc --- /dev/null +++ b/queue-6.1/phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch @@ -0,0 +1,45 @@ +From 21e0749f931702765b9d52d05740092bc87fcd8d Mon Sep 17 00:00:00 2001 +From: Nava kishore Manne +Date: Sat, 27 Jun 2026 21:22:28 +0530 +Subject: phy: zynqmp: use read-modify-write for SERDES scrambler bypass + +From: Nava kishore Manne + +commit 21e0749f931702765b9d52d05740092bc87fcd8d upstream. + +xpsgtr_bypass_scrambler_8b10b() used xpsgtr_write_phy() which performs +a full register write, silently clearing any bits beyond the intended +bypass control fields. + +Switch to xpsgtr_clr_set_phy() with clr=mask, set=mask to set only +the bypass bits while preserving the remaining bits in each register. + +Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") +Cc: stable@vger.kernel.org +Signed-off-by: Nava kishore Manne +Signed-off-by: Radhey Shyam Pandey +Acked-by: Michal Simek +Link: https://patch.msgid.link/20260627155229.2791113-3-radhey.shyam.pandey@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/xilinx/phy-zynqmp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/phy/xilinx/phy-zynqmp.c ++++ b/drivers/phy/xilinx/phy-zynqmp.c +@@ -491,8 +491,12 @@ static void xpsgtr_lane_set_protocol(str + /* Bypass (de)scrambler and 8b/10b decoder and encoder. */ + static void xpsgtr_bypass_scrambler_8b10b(struct xpsgtr_phy *gtr_phy) + { +- xpsgtr_write_phy(gtr_phy, L0_TM_DIG_6, L0_TM_DIS_DESCRAMBLE_DECODER); +- xpsgtr_write_phy(gtr_phy, L0_TX_DIG_61, L0_TM_DISABLE_SCRAMBLE_ENCODER); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TM_DIG_6, ++ L0_TM_DIS_DESCRAMBLE_DECODER, ++ L0_TM_DIS_DESCRAMBLE_DECODER); ++ xpsgtr_clr_set_phy(gtr_phy, L0_TX_DIG_61, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER, ++ L0_TM_DISABLE_SCRAMBLE_ENCODER); + } + + /* DP-specific initialization. */ diff --git a/queue-6.1/power-supply-bq25890-fix-the-10-c-ntc-lookup-entry.patch b/queue-6.1/power-supply-bq25890-fix-the-10-c-ntc-lookup-entry.patch new file mode 100644 index 0000000000..7e0cfb2e69 --- /dev/null +++ b/queue-6.1/power-supply-bq25890-fix-the-10-c-ntc-lookup-entry.patch @@ -0,0 +1,38 @@ +From 160a783aa65b74782bc17cb874af1a6d3f5fba3c Mon Sep 17 00:00:00 2001 +From: Xu Rao +Date: Thu, 23 Jul 2026 14:54:44 +0800 +Subject: power: supply: bq25890: fix the -10 C NTC lookup entry + +From: Xu Rao + +commit 160a783aa65b74782bc17cb874af1a6d3f5fba3c upstream. + +The TSPCT lookup table is monotonically decreasing except for ADC code +121, where the sequence reads -9.0 C, -1.0 C, -12.0 C. This makes the +reported battery temperature jump upward by eight degrees for one code +and then downward by eleven degrees for the next code. + +The entry is a missing zero: use -10.0 C so the sequence remains +monotonic between -9.0 C and -12.0 C. + +Fixes: 9652c02428f3 ("power: bq25890: add POWER_SUPPLY_PROP_TEMP") +Cc: stable@vger.kernel.org +Signed-off-by: Xu Rao +Link: https://patch.msgid.link/0619C8BF15F43B7C+20260723065444.1796002-1-raoxu@uniontech.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/bq25890_charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/supply/bq25890_charger.c ++++ b/drivers/power/supply/bq25890_charger.c +@@ -310,7 +310,7 @@ static const u32 bq25890_tspct_tbl[] = { + 145, 140, 130, 120, 115, 110, 100, 90, + 80, 70, 60, 50, 40, 30, 20, 10, + 0, -10, -20, -30, -40, -60, -70, -80, +- -90, -10, -120, -140, -150, -170, -190, -210, ++ -90, -100, -120, -140, -150, -170, -190, -210, + }; + + #define BQ25890_TSPCT_TBL_SIZE ARRAY_SIZE(bq25890_tspct_tbl) diff --git a/queue-6.1/powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch b/queue-6.1/powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch new file mode 100644 index 0000000000..0a64583c1f --- /dev/null +++ b/queue-6.1/powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch @@ -0,0 +1,38 @@ +From 0bb024f11d120abff3e8db9144a585b9d7fb8459 Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sat, 11 Jul 2026 15:09:32 +0200 +Subject: powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() + +From: Thorsten Blum + +commit 0bb024f11d120abff3e8db9144a585b9d7fb8459 upstream. + +If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path +decrements iopage but keeps using the failed mapping's offset. As a +result, it repeatedly tries to invalidate the failed IOPTE slot and +leaves the already installed IOPTEs valid. + +Recompute offset and invalidate the installed IOPTEs instead. + +Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework") +Cc: stable@vger.kernel.org +Signed-off-by: Thorsten Blum +Reviewed-by: Ritesh Harjani (IBM) +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20260711130931.740719-3-thorsten.blum@linux.dev +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/ps3/mm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/platforms/ps3/mm.c ++++ b/arch/powerpc/platforms/ps3/mm.c +@@ -615,6 +615,7 @@ static int dma_ioc0_map_pages(struct ps3 + + fail_map: + for (iopage--; 0 <= iopage; iopage--) { ++ offset = (1 << r->page_size) * iopage; + lv1_put_iopte(0, + c->bus_addr + offset, + c->lpar_addr + offset, diff --git a/queue-6.1/s390-dasd-fix-potential-null-pointer-dereference.patch b/queue-6.1/s390-dasd-fix-potential-null-pointer-dereference.patch new file mode 100644 index 0000000000..8c06bcf73e --- /dev/null +++ b/queue-6.1/s390-dasd-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,47 @@ +From 9973026f572db6b67570cadc30942f3014e41079 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20H=C3=B6ppner?= +Date: Mon, 27 Jul 2026 16:28:39 +0200 +Subject: s390/dasd: Fix potential NULL pointer dereference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan Höppner + +commit 9973026f572db6b67570cadc30942f3014e41079 upstream. + +dasd_release_space() checks the implementation of the is_ese() +discipline function before calling it to determine if a given device is +an ESE DASD. + +The current usage of the logical AND operator will lead to a NULL +pointer dereference as the function is called even if the function +pointer is NULL. + +Fix this by using the logical OR operator. + +Fixes: 91dc4a197569 ("s390/dasd: Add new ioctl to release space") +Cc: stable@vger.kernel.org # v5.3+ +Reported-by: Vasily Gorbik +Acked-by: Eduard Shishkin +Reviewed-by: Stefan Haberland +Signed-off-by: Jan Höppner +Signed-off-by: Stefan Haberland +Link: https://patch.msgid.link/20260727142840.567286-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/block/dasd_ioctl.c ++++ b/drivers/s390/block/dasd_ioctl.c +@@ -330,7 +330,7 @@ out_err: + static int dasd_release_space(struct dasd_device *device, + struct format_data_t *rdata) + { +- if (!device->discipline->is_ese && !device->discipline->is_ese(device)) ++ if (!device->discipline->is_ese || !device->discipline->is_ese(device)) + return -ENOTSUPP; + if (!device->discipline->release_space) + return -ENOTSUPP; diff --git a/queue-6.1/s390-qeth-check-cap_net_admin-for-private-ioctls.patch b/queue-6.1/s390-qeth-check-cap_net_admin-for-private-ioctls.patch new file mode 100644 index 0000000000..339b97521a --- /dev/null +++ b/queue-6.1/s390-qeth-check-cap_net_admin-for-private-ioctls.patch @@ -0,0 +1,38 @@ +From d211028bac1bd0fff0026bfa2a8328e5b78cd0e6 Mon Sep 17 00:00:00 2001 +From: Aswin Karuvally +Date: Thu, 23 Jul 2026 16:00:50 +0200 +Subject: s390/qeth: Check CAP_NET_ADMIN for private ioctls + +From: Aswin Karuvally + +commit d211028bac1bd0fff0026bfa2a8328e5b78cd0e6 upstream. + +Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL, +SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN +capable check to ensure unprivileged users cannot invoke them. + +Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate") +Cc: stable@vger.kernel.org +Suggested-by: Christian Borntraeger +Reviewed-by: Christian Borntraeger +Reviewed-by: Alexandra Winter +Signed-off-by: Aswin Karuvally +Link: https://patch.msgid.link/20260723140050.762991-1-aswin@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/net/qeth_core_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -6524,6 +6524,9 @@ int qeth_siocdevprivate(struct net_devic + struct qeth_card *card = dev->ml_priv; + int rc = 0; + ++ if (!capable(CAP_NET_ADMIN)) ++ return -EPERM; ++ + switch (cmd) { + case SIOC_QETH_ADP_SET_SNMP_CONTROL: + rc = qeth_snmp_command(card, data); diff --git a/queue-6.1/s390-zcrypt-fix-wrong-domain-value-verification-with-ep11-cprbs.patch b/queue-6.1/s390-zcrypt-fix-wrong-domain-value-verification-with-ep11-cprbs.patch new file mode 100644 index 0000000000..40385bb0be --- /dev/null +++ b/queue-6.1/s390-zcrypt-fix-wrong-domain-value-verification-with-ep11-cprbs.patch @@ -0,0 +1,36 @@ +From 983279d7f86ade73db86f886e09172dd567031b5 Mon Sep 17 00:00:00 2001 +From: Harald Freudenberger +Date: Thu, 23 Jul 2026 11:54:52 +0200 +Subject: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs + +From: Harald Freudenberger + +commit 983279d7f86ade73db86f886e09172dd567031b5 upstream. + +There is a wrong upper limit check for the domain value when an EP11 +CPRB is processed for sending to a crypto card. This check is only +active on custom device nodes but may lead to access heap memory +behind perms->adm when an administrative CPRB is sent. +Add correct limit (AP_DOMAINS = 256) checking to fix this. + +Fixes: cfd68b33094e ("s390/zcrypt: Filter admin CPRBs on custom devices") +Cc: stable@vger.kernel.org +Reviewed-by: Finn Callies +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/crypto/zcrypt_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/crypto/zcrypt_api.c ++++ b/drivers/s390/crypto/zcrypt_api.c +@@ -1119,7 +1119,7 @@ static long _zcrypt_send_ep11_cprb(bool + if (rc) + goto out_free; + +- if (perms != &ap_perms && domain < AUTOSEL_DOM) { ++ if (perms != &ap_perms && domain < AP_DOMAINS) { + if (ap_msg.flags & AP_MSG_FLAG_ADMIN) { + if (!test_bit_inv(domain, perms->adm)) { + rc = -ENODEV; diff --git a/queue-6.1/s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch b/queue-6.1/s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch new file mode 100644 index 0000000000..06e68bd0ff --- /dev/null +++ b/queue-6.1/s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch @@ -0,0 +1,36 @@ +From 06afe425d5283b9764303de47f554da5a808ce8a Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Wed, 29 Jul 2026 11:36:15 +0200 +Subject: s390/zcrypt: Validate length for CCA AES cipher key requests + +From: Holger Dengler + +commit 06afe425d5283b9764303de47f554da5a808ce8a upstream. + +cca_cipher2protkey() derives the copy length for the CPRB parameter +block directly from the length field in the key token. Reject the +request early if the token length exceeds the available space in the +parameter block. + +Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys") +Signed-off-by: Holger Dengler +Cc: stable@vger.kernel.org # 5.4+ +Reviewed-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -1232,6 +1232,9 @@ int cca_cipher2protkey(u16 cardnr, u16 d + } __packed * prepparm; + int keytoklen = ((struct cipherkeytoken *)ckey)->len; + ++ if (keytoklen > PARMBSIZE - sizeof(struct aureqparm)) ++ return -EINVAL; ++ + /* get already prepared memory for 2 cprbs with param block each */ + rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); + if (rc) diff --git a/queue-6.1/s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch b/queue-6.1/s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch new file mode 100644 index 0000000000..f1505ca383 --- /dev/null +++ b/queue-6.1/s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch @@ -0,0 +1,36 @@ +From a9ae0f6dd45c3ccc1d69363f7aea8af179122730 Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Wed, 29 Jul 2026 11:36:16 +0200 +Subject: s390/zcrypt: Validate length for CCA ECC private key requests + +From: Holger Dengler + +commit a9ae0f6dd45c3ccc1d69363f7aea8af179122730 upstream. + +cca_ecc2protkey() derives the copy length for the CPRB parameter +block directly from the length field in the key token. Reject the +request early if the token length exceeds the available space in the +parameter block. + +Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys") +Signed-off-by: Holger Dengler +Cc: stable@vger.kernel.org # 5.10+ +Reviewed-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/s390/crypto/zcrypt_ccamisc.c ++++ b/drivers/s390/crypto/zcrypt_ccamisc.c +@@ -1404,6 +1404,9 @@ int cca_ecc2protkey(u16 cardnr, u16 doma + } __packed * prepparm; + int keylen = ((struct eccprivkeytoken *)key)->len; + ++ if (keylen > PARMBSIZE - sizeof(struct aureqparm)) ++ return -EINVAL; ++ + /* get already prepared memory for 2 cprbs with param block each */ + rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk); + if (rc) diff --git a/queue-6.1/scsi-scsi_debug-fix-report-zones-alloc_len-underflow-oob-write.patch b/queue-6.1/scsi-scsi_debug-fix-report-zones-alloc_len-underflow-oob-write.patch new file mode 100644 index 0000000000..99affd7d9c --- /dev/null +++ b/queue-6.1/scsi-scsi_debug-fix-report-zones-alloc_len-underflow-oob-write.patch @@ -0,0 +1,68 @@ +From 93dde0bf2f39a0f9f57fd610aa3201ce5b753433 Mon Sep 17 00:00:00 2001 +From: Ibrahim Hashimov +Date: Sun, 12 Jul 2026 20:37:39 +0200 +Subject: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write + +From: Ibrahim Hashimov + +commit 93dde0bf2f39a0f9f57fd610aa3201ce5b753433 upstream. + +resp_report_zones() sizes the reply buffer from the CDB allocation +length. The v3 fix rounds alloc_len up with ALIGN() before deriving the +descriptor count: + + rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - + RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); + arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); + +For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to +0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit +and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which +passes the !arr check, and desc = arr + 64 is then dereferenced in the +loop -> out-of-bounds write / panic. + +Clamp rep_max_zones to devip->nr_zones. The loop already stops at +sdebug_capacity (after nr_zones zones), so a report can never hold more +than nr_zones descriptors; the clamp does not change the report, it only +bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device +property that can never reach 0x100000000. + +Fixes: 7db0e0c8190a ("scsi: scsi_debug: Fix buffer size of REPORT ZONES command") +Suggested-by: Damien Le Moal +Cc: stable@vger.kernel.org +Signed-off-by: Ibrahim Hashimov +Assisted-by: AuditCode-AI:2026.07 +Reviewed-by: Damien Le Moal +Reviewed-by: Bart Van Assche +Link: https://patch.msgid.link/20260712183739.83915-1-security@auditcode.ai +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_debug.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -4481,6 +4481,7 @@ static int resp_report_zones(struct scsi + u32 alloc_len, rep_opts, rep_len; + bool partial; + u64 lba, zs_lba; ++ u64 arr_len; + u8 *arr = NULL, *desc; + u8 *cmd = scp->cmnd; + struct sdeb_zone_state *zsp = NULL; +@@ -4502,9 +4503,12 @@ static int resp_report_zones(struct scsi + return check_condition_result; + } + +- rep_max_zones = (alloc_len - 64) >> ilog2(RZONES_DESC_HD); ++ rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ++ ilog2(RZONES_DESC_HD); ++ rep_max_zones = min_t(unsigned int, rep_max_zones, devip->nr_zones); ++ arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); + +- arr = kzalloc(alloc_len, GFP_ATOMIC | __GFP_NOWARN); ++ arr = kzalloc(arr_len, GFP_ATOMIC | __GFP_NOWARN); + if (!arr) { + mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC, + INSUFF_RES_ASCQ); diff --git a/queue-6.1/sctp-prevent-peer-transport-count-overflow.patch b/queue-6.1/sctp-prevent-peer-transport-count-overflow.patch new file mode 100644 index 0000000000..a37ed07841 --- /dev/null +++ b/queue-6.1/sctp-prevent-peer-transport-count-overflow.patch @@ -0,0 +1,45 @@ +From bd0e9289e2642f6a5c54faad304ce0f41e926d22 Mon Sep 17 00:00:00 2001 +From: Asim Viladi Oglu Manizada +Date: Sat, 25 Jul 2026 03:21:06 +0000 +Subject: sctp: prevent peer transport count overflow + +From: Asim Viladi Oglu Manizada + +commit bd0e9289e2642f6a5c54faad304ce0f41e926d22 upstream. + +sctp_assoc_add_peer() increments the association's 16-bit transport_count +for every new unique peer. Adding the 65,536th transport wraps the count to +zero. + +SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, +then copies one sockaddr_storage for every entry in transport_addr_list. +After the wrap, a diagnostic dump reserves an empty payload and writes +8 MiB of peer addresses past the skb tail. + +Reject a new unique peer when transport_count has reached U16_MAX. Perform +the check after the existing-peer lookup so a duplicate address continues +to return its existing transport at the limit. + +Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") +Cc: stable@vger.kernel.org +Signed-off-by: Asim Viladi Oglu Manizada +Acked-by: Xin Long +Link: https://patch.msgid.link/20260725032053.521705-1-manizada@pm.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/associola.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -616,6 +616,9 @@ struct sctp_transport *sctp_assoc_add_pe + return peer; + } + ++ if (asoc->peer.transport_count == U16_MAX) ++ return NULL; ++ + peer = sctp_transport_new(asoc->base.net, addr, gfp); + if (!peer) + return NULL; diff --git a/queue-6.1/sctp-reject-stale-cookies-with-mismatched-verification-tags.patch b/queue-6.1/sctp-reject-stale-cookies-with-mismatched-verification-tags.patch new file mode 100644 index 0000000000..4e4250eb1d --- /dev/null +++ b/queue-6.1/sctp-reject-stale-cookies-with-mismatched-verification-tags.patch @@ -0,0 +1,65 @@ +From 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 Mon Sep 17 00:00:00 2001 +From: Yuxiang Yang +Date: Thu, 23 Jul 2026 22:56:23 +0000 +Subject: sctp: reject stale cookies with mismatched verification tags + +From: Yuxiang Yang + +commit 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 upstream. + +sctp_unpack_cookie() skips cookie expiration checks whenever an +association already exists. This is broader than the exception in +RFC 9260 Section 5.2.4. + +For an existing association, Section 5.2.4 permits an expired State +Cookie only when both Verification Tags in the cookie match the current +association. Otherwise, the packet SHOULD be discarded and a Stale +Cookie ERROR MUST be sent. + +The broad check lets an expired Action A restart cookie reach +sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second +cookie lifetime, replaying such a cookie after 65 seconds returned a +COOKIE-ACK and restarted the association. + +Check cookie expiration unless both Verification Tags match. This +preserves the Action D exception for a lost COOKIE ACK while rejecting +expired cookies in all other cases. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Yuxiang Yang +Acked-by: Xin Long +Link: https://patch.msgid.link/20260723225623.2658868-1-yangyx22@mails.tsinghua.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/sm_make_chunk.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1821,9 +1821,9 @@ no_hmac: + goto fail; + } + +- /* Check to see if the cookie is stale. If there is already +- * an association, there is no need to check cookie's expiration +- * for init collision case of lost COOKIE ACK. ++ /* Check to see if the cookie is stale. RFC 9260 Section 5.2.4 ++ * exempts an expired cookie only when both Verification Tags match ++ * the current association. + * If skb has been timestamped, then use the stamp, otherwise + * use current time. This introduces a small possibility that + * a cookie may be considered expired, but this would only slow +@@ -1834,7 +1834,10 @@ no_hmac: + else + kt = ktime_get_real(); + +- if (!asoc && ktime_before(bear_cookie->expiration, kt)) { ++ if ((!asoc || ++ asoc->c.my_vtag != bear_cookie->my_vtag || ++ asoc->c.peer_vtag != bear_cookie->peer_vtag) && ++ ktime_before(bear_cookie->expiration, kt)) { + suseconds_t usecs = ktime_to_us(ktime_sub(kt, bear_cookie->expiration)); + __be32 n = htonl(usecs); + diff --git a/queue-6.1/selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch b/queue-6.1/selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch new file mode 100644 index 0000000000..8f9ff45a11 --- /dev/null +++ b/queue-6.1/selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch @@ -0,0 +1,95 @@ +From 8f6f9fd93cd7a5dd607ad5cd910476dd68fff3ed Mon Sep 17 00:00:00 2001 +From: Chris Gellermann +Date: Wed, 22 Jul 2026 15:02:45 +0200 +Subject: selftests/clone3: fix wild pointer access of getline due to missing init + +From: Chris Gellermann + +commit 8f6f9fd93cd7a5dd607ad5cd910476dd68fff3ed upstream. + +Patch series "selftests: Add missing initalization of pointer passed to +getline", v2. + + +This patch (of 2): + +Clone3_set_tid uses getline(&line, ...) in a loop to read the child's +process status. The code expects that getline allocates the buffer for +the line on the first loop iteration. According to the Open Group +Spec[1], char *line has to be null pointer for this: + +> ssize_t getline(char **restrict lineptr, ...); +> If *lineptr is a null pointer or if the object pointed to by *lineptr +> is of insufficient size, an object shall be allocated as if by +malloc() +> or the object shall be reallocated as if by realloc()[...]. + +However, char *line is only declared, leading to an undefined value that +is potentially non-null. In an example run with Musl v1.2.6, the realloc +call[2] of getdelim, which implements getline, triggers a segfault: + +./run_kselftest.sh --test clone3:clone3_set_tid +[ 1366.165898] kselftest: Running tests in clone3 +... +[ 1367.799244] clone3_set_tid[811]: unhandled signal 11 code 0x1 at +0x0000000000000000 in libc.so[68184,3fbf69f000+4c000] +[ 1367.802808] CPU: 0 UID: 0 PID: 811 Comm: clone3_set_tid Not tainted +.. +[ 1367.804188] epc: 0x0000003fbf6b0184 +[ 1367.804188] ra : 0x0000003fbf6d4664 +[ 1367.804188] sp : 0x0000003fce5f2e40 +[ 1367.805314] gp : 0x0000002aaab0dfb8 +[ 1367.805314] tp : 0x0000003fbf6f14a8 +[ 1367.805314] t0 : 0x0000003fbf63d000 +... + +Looking at the realloc implementation, Musl mallocs for a null pointer +memory. But for a non-null pointer, it assumes it's passed a valid +pointer to the heap and tries to access its meta-data. This leads to the +segfault we see: + +void *realloc(void *p, size_t n) +{ + if (!p) return malloc(n); + if (size_overflows(n)) return 0; + + struct meta *g = get_meta(p); + ... +} + +Fix this by properly initializing the line pointer to NULL. + +Link: https://lore.kernel.org/20260722130246.2135563-1-christian.gellermann@codasip.com +Link: https://lore.kernel.org/20260722130246.2135563-2-christian.gellermann@codasip.com +Link: https://pubs.opengroup.org/onlinepubs/9799919799/functions/getline.html [1] +Link: https://git.musl-libc.org/cgit/musl/tree/src/stdio/getdelim.c#n38 [2] +Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") +Signed-off-by: Chris Gellermann +Acked-by: David Hildenbrand (arm) +Reviewed-by: Lorenzo Stoakes +Cc: Christian Brauner +Cc: Liam R. Howlett +Cc: Lorenzo Stoakes +Cc: Michal Hocko +Cc: Mike Rapoport +Cc: Shuah Khan +Cc: Suren Baghdasaryan +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/clone3/clone3_set_tid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/clone3/clone3_set_tid.c ++++ b/tools/testing/selftests/clone3/clone3_set_tid.c +@@ -146,7 +146,7 @@ int main(int argc, char *argv[]) + { + FILE *f; + char buf; +- char *line; ++ char *line = NULL; + int status; + int ret = -1; + size_t len = 0; diff --git a/queue-6.1/series b/queue-6.1/series index 998041e5fa..72da0b2387 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -411,3 +411,38 @@ netfilter-ipset-do-not-update-comments-from-kernel-side-hash-adds.patch tipc-avoid-use-after-free-in-poll-trace-queue-dumps.patch wifi-mwifiex-use-the-subframe-length-when-parsing-a-msdu-tdls-frames.patch binfmt_misc-reject-a-flag-character-as-the-field-delimiter.patch +mm-page_reporting-use-system_freezable_wq-to-fix-uaf-during-suspend.patch +net-bridge-stop-fast-leave-after-deleting-a-port-group.patch +net-ipv6-clear-suppressed-fib6-rule-result.patch +powerpc-ps3-fix-map-failure-path-in-dma_ioc0_map_pages.patch +um-vector-fix-use-after-free-in-vector_mmsg_rx.patch +vxlan-re-fetch-eth-header-after-route_shortcircuit.patch +vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch +vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch +vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch +ublk-reset-kernel-owned-dev_info-fields-in-ublk_ctrl_add_dev.patch +tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch +tracing-filters-fix-false-positive-match-in-regex_match_full.patch +selftests-clone3-fix-wild-pointer-access-of-getline-due-to-missing-init.patch +scsi-scsi_debug-fix-report-zones-alloc_len-underflow-oob-write.patch +sctp-reject-stale-cookies-with-mismatched-verification-tags.patch +sctp-prevent-peer-transport-count-overflow.patch +hwmon-npcm750-pwm-fan-stop-fan-timer-on-device-detach.patch +i2c-amd-mp2-unregister-callback-on-adapter-add-failure.patch +gpio-pca953x-fix-cache_only-and-irq-state-on-restore_context-failure.patch +cpufreq-powernow-k8-fix-possible-memory-leak-in-powernowk8_cpu_init.patch +power-supply-bq25890-fix-the-10-c-ntc-lookup-entry.patch +s390-qeth-check-cap_net_admin-for-private-ioctls.patch +s390-dasd-fix-potential-null-pointer-dereference.patch +s390-zcrypt-fix-wrong-domain-value-verification-with-ep11-cprbs.patch +s390-zcrypt-validate-length-for-cca-aes-cipher-key-requests.patch +s390-zcrypt-validate-length-for-cca-ecc-private-key-requests.patch +phy-zynqmp-fix-l0_tm_disable_scramble_encoder-mask.patch +phy-zynqmp-use-read-modify-write-for-serdes-scrambler-bypass.patch +phy-zynqmp-keep-serdes-scrambler-and-8b-10b-enabled-for-usb.patch +net-openvswitch-fix-potential-uaf-on-meter-attach-failure.patch +net-openvswitch-fix-skb-leak-on-flow-key-update-failure-during-ct.patch +ice-wait-for-reset-completion-in-ice_resume.patch +i2c-jz4780-cache-host-clock-rate-at-probe-to-prevent-ccf-prepare_lock-deadlock.patch +i2c-imx-fix-slave-registration-race-and-error-handling.patch +i2c-imx-cancel-hrtimer-before-clearing-slave-pointer.patch diff --git a/queue-6.1/tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch b/queue-6.1/tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch new file mode 100644 index 0000000000..148c5ef4d2 --- /dev/null +++ b/queue-6.1/tracing-check-return-value-of-__register_event-in-trace_module_add_events.patch @@ -0,0 +1,47 @@ +From ac8719969e6c3c54e939834df812bc41f25453cf Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Wed, 29 Jul 2026 09:27:58 +0900 +Subject: tracing: Check return value of __register_event() in trace_module_add_events() + +From: Masami Hiramatsu (Google) + +commit ac8719969e6c3c54e939834df812bc41f25453cf upstream. + +trace_module_add_events() ignores the return value of __register_event() +and unconditionally calls __add_event_to_tracers() for each event. + +If __register_event() fails (for example, if event_init() fails), the +trace_event_call is not added to ftrace_events list, but +__add_event_to_tracers() still creates a trace_event_file pointing to it. +If module loading subsequently fails and module memory is freed, tracing +state retains a stale trace_event_call pointer in trace_event_file, +leading to a use-after-free when tracefs or tracing subsystem operations +are later executed. + +Fix this by checking the return value of __register_event() and only +calling __add_event_to_tracers() if event registration succeeded. + +Fixes: ae63b31e4d0e ("tracing: Separate out trace events from global variables") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/178528487878.124250.14170824576025743236.stgit@devnote2 +Assisted-by: Antigravity:gemini-3.5-flash +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -3122,8 +3122,8 @@ static void trace_module_add_events(stru + end = mod->trace_events + mod->num_trace_events; + + for_each_event(call, start, end) { +- __register_event(*call, mod); +- __add_event_to_tracers(*call); ++ if (!__register_event(*call, mod)) ++ __add_event_to_tracers(*call); + } + } + diff --git a/queue-6.1/tracing-filters-fix-false-positive-match-in-regex_match_full.patch b/queue-6.1/tracing-filters-fix-false-positive-match-in-regex_match_full.patch new file mode 100644 index 0000000000..8986e3a6f8 --- /dev/null +++ b/queue-6.1/tracing-filters-fix-false-positive-match-in-regex_match_full.patch @@ -0,0 +1,46 @@ +From c22c7b735f9810ad276014f788f9aa5c879ec238 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Wed, 29 Jul 2026 09:28:07 +0900 +Subject: tracing/filters: Fix false positive match in regex_match_full() + +From: Masami Hiramatsu (Google) + +commit c22c7b735f9810ad276014f788f9aa5c879ec238 upstream. + +regex_match_full() calls strncmp(str, r->pattern, len) where len is the +target field buffer size. When len is smaller than r->len (the filter +pattern length), strncmp() checks only len bytes of r->pattern against +str. If those len bytes match, strncmp() returns 0, resulting in a +false-positive match where a shorter string in a fixed-size field +matches a longer filter pattern. + +For example, a 4-byte static string field containing "abcd" matched the +filter pattern "abcdefgh" because strncmp("abcd", "abcdefgh", 4) +returned 0. In this case, @len does NOT include '\0' because it is +fixed-size array. + +Fix this by returning 0 (no match) early when len < r->len. + +Fixes: 1889d20922d1 ("tracing/filters: Provide basic regex support") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/178528488779.124250.5571741156199253769.stgit@devnote2 +Assisted-by: Antigravity:gemini-3.5-flash +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_filter.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -894,6 +894,9 @@ static int regex_match_full(char *str, s + if (!len) + return strcmp(str, r->pattern) == 0; + ++ if (len < r->len) ++ return 0; ++ + return strncmp(str, r->pattern, len) == 0; + } + diff --git a/queue-6.1/ublk-reset-kernel-owned-dev_info-fields-in-ublk_ctrl_add_dev.patch b/queue-6.1/ublk-reset-kernel-owned-dev_info-fields-in-ublk_ctrl_add_dev.patch new file mode 100644 index 0000000000..b5f6c1b657 --- /dev/null +++ b/queue-6.1/ublk-reset-kernel-owned-dev_info-fields-in-ublk_ctrl_add_dev.patch @@ -0,0 +1,61 @@ +From e65848e4ce352bac9e3465099354c8b8f845391f Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Sun, 26 Jul 2026 09:50:25 -0500 +Subject: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() + +From: Ming Lei + +commit e65848e4ce352bac9e3465099354c8b8f845391f upstream. + +ublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into +ub->dev_info and then fixes up the fields the driver owns, but misses +->state and ->ublksrv_pid. + +A device added with ->state = UBLK_S_DEV_LIVE passes the +"->state != UBLK_S_DEV_DEAD" test that ublk_stop_dev_unlocked() uses as its +proxy for "a disk is attached", while ->ub_disk is still NULL, so DEL_DEV +right after ADD_DEV oopses in del_gendisk(). UBLK_S_DEV_QUIESCED plus +UBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev(). A +poisoned ->state also gets START_USER_RECOVERY and the char device +read/write path onto a device that was never started, and wedges START_DEV +at -EEXIST. A poisoned ->ublksrv_pid just makes GET_DEV_INFO report an +unrelated task as the ublk server. + +Reset both after the memcpy(), as ublk_detach_disk() does. Userspace only +ever reads these back, so correcting them silently breaks nothing. + +ADD_DEV has copied ->state in unsanitized since ublk was merged, but back +then it was harmless: the gendisk was allocated during ADD_DEV, and both +teardown and the START_DEV -EEXIST check keyed off disk_live() rather than +->state. The oops became reachable once the disk allocation moved to +START_DEV and those checks switched to ->state. + +Fixes: 6d9e6dfdf3b2 ("ublk: defer disk allocation") +Cc: stable@vger.kernel.org +Signed-off-by: Ming Lei +Reviewed-by: Caleb Sander Mateos +Link: https://patch.msgid.link/20260726145025.1507383-1-tom.leiming@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/ublk_drv.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -1727,6 +1727,15 @@ static int ublk_ctrl_add_dev(struct io_u + ub->dev_info.dev_id = ub->ub_number; + + /* ++ * ->state and ->ublksrv_pid are owned by the driver and only read back ++ * by userspace, but they come from the copied-in dev_info, so reset ++ * them. Otherwise a device added with ->state != DEAD looks live while ++ * ->ub_disk is still NULL. ++ */ ++ ub->dev_info.state = UBLK_S_DEV_DEAD; ++ ub->dev_info.ublksrv_pid = -1; ++ ++ /* + * 64bit flags will be copied back to userspace as feature + * negotiation result, so have to clear flags which driver + * doesn't support yet, then userspace can get correct flags diff --git a/queue-6.1/um-vector-fix-use-after-free-in-vector_mmsg_rx.patch b/queue-6.1/um-vector-fix-use-after-free-in-vector_mmsg_rx.patch new file mode 100644 index 0000000000..34ff4812d9 --- /dev/null +++ b/queue-6.1/um-vector-fix-use-after-free-in-vector_mmsg_rx.patch @@ -0,0 +1,58 @@ +From af421e9aed3920c7ac88c24daa48606c7112feca Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Mon, 22 Jun 2026 08:47:22 -0400 +Subject: um: vector: fix use-after-free in vector_mmsg_rx() + +From: Michael Bommarito + +commit af421e9aed3920c7ac88c24daa48606c7112feca upstream. + +When vector_mmsg_rx() discards a packet whose overlay header fails +verify_header(), it frees the skb and continues the loop: + + if (header_check < 0) { + dev_kfree_skb_irq(skb); + vp->estats.rx_encaps_errors++; + continue; + } + +The normal and short-packet paths fall through to the bottom of the +loop body, which clears the consumed slot and advances the cursors: + + (*skbuff_vector) = NULL; + mmsg_vector++; + skbuff_vector++; + +The verify_header() < 0 path skips that via continue, so the freed skb +is left in skbuff_vector[] and the cursors do not advance. The next +iteration reads the same slot, gets the freed skb, and frees it again, +producing a refcount underflow / use-after-free in the RX path. + +Discard the slot the same way the other paths do before continuing. + +Only transports whose verify_header() can return negative are affected: +GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), +so any peer on such a transport can trigger it without authentication. + +Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Michael Bommarito +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + arch/um/drivers/vector_kern.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/um/drivers/vector_kern.c ++++ b/arch/um/drivers/vector_kern.c +@@ -1007,6 +1007,9 @@ static int vector_mmsg_rx(struct vector_ + */ + dev_kfree_skb_irq(skb); + vp->estats.rx_encaps_errors++; ++ (*skbuff_vector) = NULL; ++ mmsg_vector++; ++ skbuff_vector++; + continue; + } + if (header_check > 0) { diff --git a/queue-6.1/vxlan-re-fetch-eth-header-after-route_shortcircuit.patch b/queue-6.1/vxlan-re-fetch-eth-header-after-route_shortcircuit.patch new file mode 100644 index 0000000000..e9a6146bd5 --- /dev/null +++ b/queue-6.1/vxlan-re-fetch-eth-header-after-route_shortcircuit.patch @@ -0,0 +1,40 @@ +From 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:45 +0000 +Subject: vxlan: re-fetch eth header after route_shortcircuit() + +From: Eric Dumazet + +commit 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 upstream. + +Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). + +Inside route_shortcircuit(), pskb_may_pull() can be called, which may +reallocate skb->head. + +In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to +freed memory, leading to a use-after-free when dereferencing eth->h_dest. + +Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit(). + +Fixes: ae8840825605 ("VXLAN: Allow L2 redirection with L3 switching") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Reviewed-by: Vadim Fedorenko +Link: https://patch.msgid.link/20260723144249.759100-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2879,6 +2879,7 @@ static netdev_tx_t vxlan_xmit(struct sk_ + (ntohs(eth->h_proto) == ETH_P_IP || + ntohs(eth->h_proto) == ETH_P_IPV6)) { + did_rsc = route_shortcircuit(dev, skb); ++ eth = eth_hdr(skb); + if (did_rsc) + f = vxlan_find_mac(vxlan, eth->h_dest, vni); + } diff --git a/queue-6.1/vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch b/queue-6.1/vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch new file mode 100644 index 0000000000..38199bee8b --- /dev/null +++ b/queue-6.1/vxlan-unclone-skb-head-before-modifying-eth-header-in-route_shortcircuit.patch @@ -0,0 +1,45 @@ +From 760d36e737f2b3867762f42af36c663f55babcc4 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:46 +0000 +Subject: vxlan: unclone skb head before modifying eth header in route_shortcircuit() + +From: Eric Dumazet + +commit 760d36e737f2b3867762f42af36c663f55babcc4 upstream. + +When route_shortcircuit() performs L3 short-circuit routing, it modifies +the Ethernet header of the skb in-place: + memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, dev->addr_len); + memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); + +If the incoming skb is cloned (for example by packet sockets, tcpdump, or +dev_queue_xmit), modifying the Ethernet header without uncloning can corrupt +the packet header for other readers holding a reference to the cloned skb. + +Ensure the skb header is writable and unshared by calling skb_cow_head(skb, 0) +prior to updating the Ethernet header. If skb_cow_head() fails, abort short-circuiting +and return false to allow standard packet processing fallback. + +Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20260723144249.759100-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2208,6 +2208,10 @@ static bool route_shortcircuit(struct ne + + diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha); + if (diff) { ++ if (skb_cow_head(skb, 0)) { ++ neigh_release(n); ++ return false; ++ } + memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, + dev->addr_len); + memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); diff --git a/queue-6.1/vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch b/queue-6.1/vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch new file mode 100644 index 0000000000..16204f20ca --- /dev/null +++ b/queue-6.1/vxlan-use-neigh_ha_snapshot-in-route_shortcircuit.patch @@ -0,0 +1,55 @@ +From 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:47 +0000 +Subject: vxlan: use neigh_ha_snapshot() in route_shortcircuit() + +From: Eric Dumazet + +commit 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d upstream. + +The neighbour hardware address n->ha can be updated asynchronously by the +neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without +holding the seqlock loop can lead to torn reads or reading a partially updated +MAC address. + +Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under +read_seqbegin()/read_seqretry() lock protection before using it. + +Note that arp_reduce() and neigh_reduce() seem to have the same issue +left for future patches. + +Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Reviewed-by: Vadim Fedorenko +Link: https://patch.msgid.link/20260723144249.759100-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2204,9 +2204,11 @@ static bool route_shortcircuit(struct ne + } + + if (n) { ++ u8 haddr[ETH_ALEN]; + bool diff; + +- diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha); ++ neigh_ha_snapshot(haddr, n, dev); ++ diff = !ether_addr_equal_unaligned(eth_hdr(skb)->h_dest, haddr); + if (diff) { + if (skb_cow_head(skb, 0)) { + neigh_release(n); +@@ -2214,7 +2216,7 @@ static bool route_shortcircuit(struct ne + } + memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, + dev->addr_len); +- memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); ++ memcpy(eth_hdr(skb)->h_dest, haddr, dev->addr_len); + } + neigh_release(n); + return diff; diff --git a/queue-6.1/vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch b/queue-6.1/vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch new file mode 100644 index 0000000000..a29e11f66f --- /dev/null +++ b/queue-6.1/vxlan-use-pskb_network_may_pull-in-route_shortcircuit.patch @@ -0,0 +1,53 @@ +From 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Jul 2026 14:42:48 +0000 +Subject: vxlan: use pskb_network_may_pull() in route_shortcircuit() + +From: Eric Dumazet + +commit 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb upstream. + +route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) +(or ipv6hdr), which checks if bytes are available starting from skb->data. + +However, in vxlan_xmit(), skb->data points to the MAC header, so +skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) +only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of +IP header), leaving the rest of the IP header potentially un-pulled in non-linear +frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled +linear buffer length. + +Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to +the length check to ensure the full network header is present in the linear buffer. + +Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Reviewed-by: Vadim Fedorenko +Link: https://patch.msgid.link/20260723144249.759100-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan/vxlan_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2156,7 +2156,7 @@ static bool route_shortcircuit(struct ne + { + struct iphdr *pip; + +- if (!pskb_may_pull(skb, sizeof(struct iphdr))) ++ if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) + return false; + pip = ip_hdr(skb); + n = neigh_lookup(&arp_tbl, &pip->daddr, dev); +@@ -2182,7 +2182,7 @@ static bool route_shortcircuit(struct ne + */ + if (!ipv6_stub->nd_tbl) + return false; +- if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) ++ if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) + return false; + pip6 = ipv6_hdr(skb); + n = neigh_lookup(ipv6_stub->nd_tbl, &pip6->daddr, dev);