From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 09:31:06 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=ef1dc97173d6946ff5f7776b4a0a1ece83490fcd;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: pinctrl-bm1880-add-missing-select-generic_pinconf.patch pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch pinctrl-microchip-sgpio-add-missing-select-regmap_mmio.patch --- diff --git a/queue-6.1/pinctrl-bm1880-add-missing-select-generic_pinconf.patch b/queue-6.1/pinctrl-bm1880-add-missing-select-generic_pinconf.patch new file mode 100644 index 0000000000..6872a592a1 --- /dev/null +++ b/queue-6.1/pinctrl-bm1880-add-missing-select-generic_pinconf.patch @@ -0,0 +1,40 @@ +From dad6e107b3cd9d20514e7799b7ad8674f81e3f30 Mon Sep 17 00:00:00 2001 +From: Benjamin Boortz +Date: Mon, 20 Jul 2026 19:51:04 +0200 +Subject: pinctrl: bm1880: add missing select GENERIC_PINCONF + +From: Benjamin Boortz + +commit dad6e107b3cd9d20514e7799b7ad8674f81e3f30 upstream. + +drivers/pinctrl/pinctrl-bm1880.c initialises its pinconf_ops with +.is_generic = true, but that field is only present when +CONFIG_GENERIC_PINCONF is enabled (guarded by #ifdef in pinconf.h). +The Kconfig entry for PINCTRL_BM1880 never selects GENERIC_PINCONF, +so any config that enables CONFIG_PINCTRL_BM1880=y without +CONFIG_GENERIC_PINCONF=y fails to compile: + + drivers/pinctrl/pinctrl-bm1880.c:1288:10: error: 'const struct pinconf_ops' has no member named 'is_generic' + +Found by randconfig testing on arm64; tinyconfig reproducer below. +Add the missing select to fix the build. + +Fixes: 49bd61ebce5f ("pinctrl: Add pinconf support for BM1880 SoC") +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Boortz +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pinctrl/Kconfig ++++ b/drivers/pinctrl/Kconfig +@@ -132,6 +132,7 @@ config PINCTRL_BM1880 + depends on OF && (ARCH_BITMAIN || COMPILE_TEST) + default ARCH_BITMAIN + select PINMUX ++ select GENERIC_PINCONF + help + Pinctrl driver for Bitmain BM1880 SoC. + diff --git a/queue-6.1/pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch b/queue-6.1/pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch new file mode 100644 index 0000000000..5ae9fe30a8 --- /dev/null +++ b/queue-6.1/pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch @@ -0,0 +1,54 @@ +From 015b5bcbcb622b32317642be91a7f79aa5413649 Mon Sep 17 00:00:00 2001 +From: Karl Mehltretter +Date: Sun, 19 Jul 2026 14:11:40 +0200 +Subject: pinctrl: devicetree: don't free uninitialized dev_name on error path + +From: Karl Mehltretter + +commit 015b5bcbcb622b32317642be91a7f79aa5413649 upstream. + +dt_remember_or_free_map() duplicates dev_name for each map entry. If +kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps +entries, including entries that have not been initialized. + +Some pinctrl drivers, including pinctrl-imx, allocate the map with +kmalloc() and leave dev_name for the core to initialize. The untouched +entries therefore contain uninitialized data which is passed to +kfree_const(). + +Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection +while binding the pinctrl-consuming device, under KASAN: + + BUG: KASAN: double-free in dt_free_map+0x34/0xa4 + Free of addr c425a900 by task init/1 + kfree from dt_free_map+0x34/0xa4 + dt_free_map from dt_remember_or_free_map+0x184/0x198 + dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 + pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0 + +Initialize all dev_name fields to NULL before duplicating the device +name, making the full-map cleanup safe after a partial failure. + +Fixes: be4c60b563ed ("pinctrl: devicetree: Avoid taking direct reference to device name string") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-fable-5 +Signed-off-by: Karl Mehltretter +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/devicetree.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -69,6 +69,10 @@ static int dt_remember_or_free_map(struc + int i; + struct pinctrl_dt_map *dt_map; + ++ /* Initialize dev_name before any allocation can fail */ ++ for (i = 0; i < num_maps; i++) ++ map[i].dev_name = NULL; ++ + /* Initialize common mapping table entry fields */ + for (i = 0; i < num_maps; i++) { + const char *devname; diff --git a/queue-6.1/pinctrl-microchip-sgpio-add-missing-select-regmap_mmio.patch b/queue-6.1/pinctrl-microchip-sgpio-add-missing-select-regmap_mmio.patch new file mode 100644 index 0000000000..76f47af6f6 --- /dev/null +++ b/queue-6.1/pinctrl-microchip-sgpio-add-missing-select-regmap_mmio.patch @@ -0,0 +1,38 @@ +From 25cb6e9a13123d1039cdc75b446ac52e1ebdc26d Mon Sep 17 00:00:00 2001 +From: Benjamin Boortz +Date: Sun, 19 Jul 2026 11:41:46 +0200 +Subject: pinctrl: microchip-sgpio: add missing select REGMAP_MMIO + +From: Benjamin Boortz + +commit 25cb6e9a13123d1039cdc75b446ac52e1ebdc26d upstream. + +The driver calls ocelot_regmap_from_resource() via , +which internally uses devm_regmap_init_mmio() and requires REGMAP_MMIO. +The Kconfig entry does not select REGMAP_MMIO, causing a build failure +when no other driver in the config happens to pull in REGMAP_MMIO: + + include/linux/mfd/ocelot.h:34:24: error: implicit declaration of function 'devm_regmap_init_mmio' + +Found by randconfig testing on arm64; tinyconfig reproducer below. + +Fixes: 2afbbab45c26 ("pinctrl: microchip-sgpio: update to support regmap") +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Boortz +Reviewed-by: Andy Shevchenko +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pinctrl/Kconfig ++++ b/drivers/pinctrl/Kconfig +@@ -188,6 +188,7 @@ config PINCTRL_EQUILIBRIUM + select GENERIC_PINCONF + select GENERIC_PINCTRL_GROUPS + select GENERIC_PINMUX_FUNCTIONS ++ select REGMAP_MMIO + help + Equilibrium driver is a pinctrl and GPIO driver for Intel Lightning + Mountain network processor SoC that supports both the GPIO and pin diff --git a/queue-6.1/series b/queue-6.1/series index 1a743cffeb..9a283fd4ce 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -379,3 +379,6 @@ ksmbd-fix-use-after-free-in-__close_file_table_ids.patch ipv6-fib6-fix-null-deref-in-fib6_walk_continue-on-mu.patch af_unix-give-up-gc-if-msg_peek-intervened.patch rhashtable-clear-stale-iter-p-on-table-restart.patch +pinctrl-microchip-sgpio-add-missing-select-regmap_mmio.patch +pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch +pinctrl-bm1880-add-missing-select-generic_pinconf.patch