Changelog in Linux kernel 6.17.1

 
ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free [+ + +]
Author: Jeongjun Park <[email protected]>
Date:   Sun Sep 28 02:39:24 2025 +0900

    ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
    
    commit 9f2c0ac1423d5f267e7f1d1940780fc764b0fee3 upstream.
    
    The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at
    removal") patched a UAF issue caused by the error timer.
    
    However, because the error timer kill added in this patch occurs after the
    endpoint delete, a race condition to UAF still occurs, albeit rarely.
    
    Additionally, since kill-cleanup for urb is also missing, freed memory can
    be accessed in interrupt context related to urb, which can cause UAF.
    
    Therefore, to prevent this, error timer and urb must be killed before
    freeing the heap memory.
    
    Cc: <[email protected]>
    Reported-by: [email protected]
    Closes: https://syzkaller.appspot.com/bug?extid=f02665daa2abeef4a947
    Fixes: 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal")
    Signed-off-by: Jeongjun Park <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
ASoC: qcom: audioreach: fix potential null pointer dereference [+ + +]
Author: Srinivas Kandagatla <[email protected]>
Date:   Mon Aug 25 11:12:45 2025 +0100

    ASoC: qcom: audioreach: fix potential null pointer dereference
    
    commit 8318e04ab2526b155773313b66a1542476ce1106 upstream.
    
    It is possible that the topology parsing function
    audioreach_widget_load_module_common() could return NULL or an error
    pointer. Add missing NULL check so that we do not dereference it.
    
    Reported-by: Dan Carpenter <[email protected]>
    Cc: [email protected]
    Fixes: 36ad9bf1d93d ("ASoC: qdsp6: audioreach: add topology support")
    Signed-off-by: Srinivas Kandagatla <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
blk-mq: fix blk_mq_tags double free while nr_requests grown [+ + +]
Author: Yu Kuai <[email protected]>
Date:   Thu Aug 21 14:06:12 2025 +0800

    blk-mq: fix blk_mq_tags double free while nr_requests grown
    
    commit ba28afbd9eff2a6370f23ef4e6a036ab0cfda409 upstream.
    
    In the case user trigger tags grow by queue sysfs attribute nr_requests,
    hctx->sched_tags will be freed directly and replaced with a new
    allocated tags, see blk_mq_tag_update_depth().
    
    The problem is that hctx->sched_tags is from elevator->et->tags, while
    et->tags is still the freed tags, hence later elevator exit will try to
    free the tags again, causing kernel panic.
    
    Fix this problem by replacing et->tags with new allocated tags as well.
    
    Noted there are still some long term problems that will require some
    refactor to be fixed thoroughly[1].
    
    [1] https://lore.kernel.org/all/[email protected]/
    Fixes: f5a6604f7a44 ("block: fix lockdep warning caused by lock dependency in elv_iosched_store")
    
    Signed-off-by: Yu Kuai <[email protected]>
    Reviewed-by: Ming Lei <[email protected]>
    Reviewed-by: Nilay Shroff <[email protected]>
    Reviewed-by: Hannes Reinecke <[email protected]>
    Reviewed-by: Li Nan <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jens Axboe <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
 
gcc-plugins: Remove TODO_verify_il for GCC >= 16 [+ + +]
Author: Kees Cook <[email protected]>
Date:   Sat Sep 20 16:45:23 2025 -0700

    gcc-plugins: Remove TODO_verify_il for GCC >= 16
    
    commit a40282dd3c484e6c882e93f4680e0a3ef3814453 upstream.
    
    GCC now runs TODO_verify_il automatically[1], so it is no longer exposed to
    plugins. Only use the flag on GCC < 16.
    
    Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=9739ae9384dd7cd3bb1c7683d6b80b7a9116eaf8 [1]
    Suggested-by: Christopher Fore <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Kees Cook <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Linux: Linux 6.17.1 [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Mon Oct 6 11:20:06 2025 +0200

    Linux 6.17.1
    
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Ronald Warsow <[email protected]>
    Tested-by: Justin M. Forbes <[email protected]>
    Tested-by: Brett A C Sheffield <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Tested-by: Ron Economos <[email protected]>
    Tested-by: Peter Schneider <[email protected]>
    Tested-by: Takeshi Ogasawara <[email protected]>
    Tested-by: Dileep Malepu <[email protected]>
    Tested-by: Mark Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove [+ + +]
Author: Duoming Zhou <[email protected]>
Date:   Wed Sep 17 17:59:26 2025 +0800

    media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
    
    commit 01e03fb7db419d39e18d6090d4873c1bff103914 upstream.
    
    The original code uses cancel_delayed_work() in flexcop_pci_remove(), which
    does not guarantee that the delayed work item irq_check_work has fully
    completed if it was already running. This leads to use-after-free scenarios
    where flexcop_pci_remove() may free the flexcop_device while irq_check_work
    is still active and attempts to dereference the device.
    
    A typical race condition is illustrated below:
    
    CPU 0 (remove)                         | CPU 1 (delayed work callback)
    flexcop_pci_remove()                   | flexcop_pci_irq_check_work()
      cancel_delayed_work()                |
      flexcop_device_kfree(fc_pci->fc_dev) |
                                           |   fc = fc_pci->fc_dev; // UAF
    
    This is confirmed by a KASAN report:
    
    ==================================================================
    BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0
    Write of size 8 at addr ffff8880093aa8c8 by task bash/135
    ...
    Call Trace:
     <IRQ>
     dump_stack_lvl+0x55/0x70
     print_report+0xcf/0x610
     ? __run_timer_base.part.0+0x7d7/0x8c0
     kasan_report+0xb8/0xf0
     ? __run_timer_base.part.0+0x7d7/0x8c0
     __run_timer_base.part.0+0x7d7/0x8c0
     ? __pfx___run_timer_base.part.0+0x10/0x10
     ? __pfx_read_tsc+0x10/0x10
     ? ktime_get+0x60/0x140
     ? lapic_next_event+0x11/0x20
     ? clockevents_program_event+0x1d4/0x2a0
     run_timer_softirq+0xd1/0x190
     handle_softirqs+0x16a/0x550
     irq_exit_rcu+0xaf/0xe0
     sysvec_apic_timer_interrupt+0x70/0x80
     </IRQ>
    ...
    
    Allocated by task 1:
     kasan_save_stack+0x24/0x50
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0x7f/0x90
     __kmalloc_noprof+0x1be/0x460
     flexcop_device_kmalloc+0x54/0xe0
     flexcop_pci_probe+0x1f/0x9d0
     local_pci_probe+0xdc/0x190
     pci_device_probe+0x2fe/0x470
     really_probe+0x1ca/0x5c0
     __driver_probe_device+0x248/0x310
     driver_probe_device+0x44/0x120
     __driver_attach+0xd2/0x310
     bus_for_each_dev+0xed/0x170
     bus_add_driver+0x208/0x500
     driver_register+0x132/0x460
     do_one_initcall+0x89/0x300
     kernel_init_freeable+0x40d/0x720
     kernel_init+0x1a/0x150
     ret_from_fork+0x10c/0x1a0
     ret_from_fork_asm+0x1a/0x30
    
    Freed by task 135:
     kasan_save_stack+0x24/0x50
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3a/0x60
     __kasan_slab_free+0x3f/0x50
     kfree+0x137/0x370
     flexcop_device_kfree+0x32/0x50
     pci_device_remove+0xa6/0x1d0
     device_release_driver_internal+0xf8/0x210
     pci_stop_bus_device+0x105/0x150
     pci_stop_and_remove_bus_device_locked+0x15/0x30
     remove_store+0xcc/0xe0
     kernfs_fop_write_iter+0x2c3/0x440
     vfs_write+0x871/0xd70
     ksys_write+0xee/0x1c0
     do_syscall_64+0xac/0x280
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    ...
    
    Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
    that the delayed work item is properly canceled and any executing delayed
    work has finished before the device memory is deallocated.
    
    This bug was initially identified through static analysis. To reproduce
    and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced
    artificial delays within the flexcop_pci_irq_check_work() function to
    increase the likelihood of triggering the bug.
    
    Fixes: 382c5546d618 ("V4L/DVB (10694): [PATCH] software IRQ watchdog for Flexcop B2C2 DVB PCI cards")
    Cc: [email protected]
    Signed-off-by: Duoming Zhou <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe [+ + +]
Author: Duoming Zhou <[email protected]>
Date:   Wed Sep 17 17:57:42 2025 +0800

    media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
    
    commit 79d10f4f21a92e459b2276a77be62c59c1502c9d upstream.
    
    The state->timer is a cyclic timer that schedules work_i2c_poll and
    delayed_work_enable_hotplug, while rearming itself. Using timer_delete()
    fails to guarantee the timer isn't still running when destroyed, similarly
    cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has
    terminated if already executing. During probe failure after timer
    initialization, these may continue running as orphans and reference the
    already-freed tc358743_state object through tc358743_irq_poll_timer.
    
    The following is the trace captured by KASAN.
    
    BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0
    Write of size 8 at addr ffff88800ded83c8 by task swapper/1/0
    ...
    Call Trace:
     <IRQ>
     dump_stack_lvl+0x55/0x70
     print_report+0xcf/0x610
     ? __pfx_sched_balance_find_src_group+0x10/0x10
     ? __run_timer_base.part.0+0x7d7/0x8c0
     kasan_report+0xb8/0xf0
     ? __run_timer_base.part.0+0x7d7/0x8c0
     __run_timer_base.part.0+0x7d7/0x8c0
     ? rcu_sched_clock_irq+0xb06/0x27d0
     ? __pfx___run_timer_base.part.0+0x10/0x10
     ? try_to_wake_up+0xb15/0x1960
     ? tmigr_update_events+0x280/0x740
     ? _raw_spin_lock_irq+0x80/0xe0
     ? __pfx__raw_spin_lock_irq+0x10/0x10
     tmigr_handle_remote_up+0x603/0x7e0
     ? __pfx_tmigr_handle_remote_up+0x10/0x10
     ? sched_balance_trigger+0x98/0x9f0
     ? sched_tick+0x221/0x5a0
     ? _raw_spin_lock_irq+0x80/0xe0
     ? __pfx__raw_spin_lock_irq+0x10/0x10
     ? tick_nohz_handler+0x339/0x440
     ? __pfx_tmigr_handle_remote_up+0x10/0x10
     __walk_groups.isra.0+0x42/0x150
     tmigr_handle_remote+0x1f4/0x2e0
     ? __pfx_tmigr_handle_remote+0x10/0x10
     ? ktime_get+0x60/0x140
     ? lapic_next_event+0x11/0x20
     ? clockevents_program_event+0x1d4/0x2a0
     ? hrtimer_interrupt+0x322/0x780
     handle_softirqs+0x16a/0x550
     irq_exit_rcu+0xaf/0xe0
     sysvec_apic_timer_interrupt+0x70/0x80
     </IRQ>
    ...
    
    Allocated by task 141:
     kasan_save_stack+0x24/0x50
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0x7f/0x90
     __kmalloc_node_track_caller_noprof+0x198/0x430
     devm_kmalloc+0x7b/0x1e0
     tc358743_probe+0xb7/0x610  i2c_device_probe+0x51d/0x880
     really_probe+0x1ca/0x5c0
     __driver_probe_device+0x248/0x310
     driver_probe_device+0x44/0x120
     __device_attach_driver+0x174/0x220
     bus_for_each_drv+0x100/0x190
     __device_attach+0x206/0x370
     bus_probe_device+0x123/0x170
     device_add+0xd25/0x1470
     i2c_new_client_device+0x7a0/0xcd0
     do_one_initcall+0x89/0x300
     do_init_module+0x29d/0x7f0
     load_module+0x4f48/0x69e0
     init_module_from_file+0xe4/0x150
     idempotent_init_module+0x320/0x670
     __x64_sys_finit_module+0xbd/0x120
     do_syscall_64+0xac/0x280
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    Freed by task 141:
     kasan_save_stack+0x24/0x50
     kasan_save_track+0x14/0x30
     kasan_save_free_info+0x3a/0x60
     __kasan_slab_free+0x3f/0x50
     kfree+0x137/0x370
     release_nodes+0xa4/0x100
     devres_release_group+0x1b2/0x380
     i2c_device_probe+0x694/0x880
     really_probe+0x1ca/0x5c0
     __driver_probe_device+0x248/0x310
     driver_probe_device+0x44/0x120
     __device_attach_driver+0x174/0x220
     bus_for_each_drv+0x100/0x190
     __device_attach+0x206/0x370
     bus_probe_device+0x123/0x170
     device_add+0xd25/0x1470
     i2c_new_client_device+0x7a0/0xcd0
     do_one_initcall+0x89/0x300
     do_init_module+0x29d/0x7f0
     load_module+0x4f48/0x69e0
     init_module_from_file+0xe4/0x150
     idempotent_init_module+0x320/0x670
     __x64_sys_finit_module+0xbd/0x120
     do_syscall_64+0xac/0x280
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    ...
    
    Replace timer_delete() with timer_delete_sync() and cancel_delayed_work()
    with cancel_delayed_work_sync() to ensure proper termination of timer and
    work items before resource cleanup.
    
    This bug was initially identified through static analysis. For reproduction
    and testing, I created a functional emulation of the tc358743 device via a
    kernel module and introduced faults through the debugfs interface.
    
    Fixes: 869f38ae07f7 ("media: i2c: tc358743: Fix crash in the probe error path when using polling")
    Fixes: d32d98642de6 ("[media] Driver for Toshiba TC358743 HDMI to CSI-2 bridge")
    Cc: [email protected]
    Signed-off-by: Duoming Zhou <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

media: iris: Fix memory leak by freeing untracked persist buffer [+ + +]
Author: Dikshita Agarwal <[email protected]>
Date:   Mon Aug 25 12:30:27 2025 +0530

    media: iris: Fix memory leak by freeing untracked persist buffer
    
    commit 02a24f13b3a1d9da9f3de56aa5fdb7cc1fe167a2 upstream.
    
    One internal buffer which is allocated only once per session was not
    being freed during session close because it was not being tracked as
    part of internal buffer list which resulted in a memory leak.
    
    Add the necessary logic to explicitly free the untracked internal buffer
    during session close to ensure all allocated memory is released
    properly.
    
    Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers")
    Cc: [email protected]
    Reviewed-by: Vikash Garodia <[email protected]>
    Tested-by: Vikash Garodia <[email protected]> # X1E80100
    Tested-by: Neil Armstrong <[email protected]> # on SM8550-HDK
    Tested-by: Neil Armstrong <[email protected]> # on SM8650-HDK
    Signed-off-by: Dikshita Agarwal <[email protected]>
    Tested-by: Bryan O'Donoghue <[email protected]> # x1e80100-crd
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

media: rc: fix races with imon_disconnect() [+ + +]
Author: Larshin Sergey <[email protected]>
Date:   Tue Jul 29 13:13:32 2025 +0300

    media: rc: fix races with imon_disconnect()
    
    commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb upstream.
    
    Syzbot reports a KASAN issue as below:
    BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline]
    BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627
    Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465
    
    CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
    Call Trace:
     <TASK>
    __dump_stack lib/dump_stack.c:88 [inline]
    dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
    print_address_description mm/kasan/report.c:317 [inline]
    print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433
    kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
    __create_pipe include/linux/usb.h:1945 [inline]
    send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627
    vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991
    vfs_write+0x2d7/0xdd0 fs/read_write.c:576
    ksys_write+0x127/0x250 fs/read_write.c:631
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    The iMON driver improperly releases the usb_device reference in
    imon_disconnect without coordinating with active users of the
    device.
    
    Specifically, the fields usbdev_intf0 and usbdev_intf1 are not
    protected by the users counter (ictx->users). During probe,
    imon_init_intf0 or imon_init_intf1 increments the usb_device
    reference count depending on the interface. However, during
    disconnect, usb_put_dev is called unconditionally, regardless of
    actual usage.
    
    As a result, if vfd_write or other operations are still in
    progress after disconnect, this can lead to a use-after-free of
    the usb_device pointer.
    
    Thread 1 vfd_write                      Thread 2 imon_disconnect
                                            ...
                                            if
                                              usb_put_dev(ictx->usbdev_intf0)
                                            else
                                              usb_put_dev(ictx->usbdev_intf1)
    ...
    while
      send_packet
        if
          pipe = usb_sndintpipe(
            ictx->usbdev_intf0) UAF
        else
          pipe = usb_sndctrlpipe(
            ictx->usbdev_intf0, 0) UAF
    
    Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by
    checking ictx->disconnected in all writer paths. Add early return
    with -ENODEV in send_packet(), vfd_write(), lcd_write() and
    display_open() if the device is no longer present.
    
    Set and read ictx->disconnected under ictx->lock to ensure memory
    synchronization. Acquire the lock in imon_disconnect() before setting
    the flag to synchronize with any ongoing operations.
    
    Ensure writers exit early and safely after disconnect before the USB
    core proceeds with cleanup.
    
    Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
    
    Reported-by: [email protected]
    Closes: https://syzkaller.appspot.com/bug?extid=f1a69784f6efe748c3bf
    Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
    Cc: [email protected]
    
    Signed-off-by: Larshin Sergey <[email protected]>
    Signed-off-by: Sean Young <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

media: stm32-csi: Fix dereference before NULL check [+ + +]
Author: Chandra Mohan Sundar <[email protected]>
Date:   Mon Aug 18 15:01:57 2025 +0530

    media: stm32-csi: Fix dereference before NULL check
    
    commit 80eaf32672871bd2623ce6ba13ffc1f018756580 upstream.
    
    In 'stm32_csi_start', 'csidev->s_subdev' is dereferenced directly while
    assigning a value to the 'src_pad'. However the same value is being
    checked against NULL at a later point of time indicating that there
    are chances that the value can be NULL.
    
    Move the dereference after the NULL check.
    
    Fixes: e7bad98c205d1 ("media: v4l: Convert the users of v4l2_get_link_freq to call it on a pad")
    Cc: [email protected]
    Signed-off-by: Chandra Mohan Sundar <[email protected]>
    Signed-off-by: Sakari Ailus <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

media: tuner: xc5000: Fix use-after-free in xc5000_release [+ + +]
Author: Duoming Zhou <[email protected]>
Date:   Wed Sep 17 17:56:08 2025 +0800

    media: tuner: xc5000: Fix use-after-free in xc5000_release
    
    commit 40b7a19f321e65789612ebaca966472055dab48c upstream.
    
    The original code uses cancel_delayed_work() in xc5000_release(), which
    does not guarantee that the delayed work item timer_sleep has fully
    completed if it was already running. This leads to use-after-free scenarios
    where xc5000_release() may free the xc5000_priv while timer_sleep is still
    active and attempts to dereference the xc5000_priv.
    
    A typical race condition is illustrated below:
    
    CPU 0 (release thread)                 | CPU 1 (delayed work callback)
    xc5000_release()                       | xc5000_do_timer_sleep()
      cancel_delayed_work()                |
      hybrid_tuner_release_state(priv)     |
        kfree(priv)                        |
                                           |   priv = container_of() // UAF
    
    Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
    that the timer_sleep is properly canceled before the xc5000_priv memory
    is deallocated.
    
    A deadlock concern was considered: xc5000_release() is called in a process
    context and is not holding any locks that the timer_sleep work item might
    also need. Therefore, the use of the _sync() variant is safe here.
    
    This bug was initially identified through static analysis.
    
    Fixes: f7a27ff1fb77 ("[media] xc5000: delay tuner sleep to 5 seconds")
    Cc: [email protected]
    Signed-off-by: Duoming Zhou <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    [hverkuil: fix typo in Subject: tunner -> tuner]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID [+ + +]
Author: Thadeu Lima de Souza Cascardo <[email protected]>
Date:   Wed Aug 20 16:08:16 2025 +0000

    media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
    
    commit 0e2ee70291e64a30fe36960c85294726d34a103e upstream.
    
    Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
    unique ID.
    
    ```
    Each Unit and Terminal within the video function is assigned a unique
    identification number, the Unit ID (UID) or Terminal ID (TID), contained in
    the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
    reserved for undefined ID,
    ```
    
    If we add a new entity with id 0 or a duplicated ID, it will be marked
    as UVC_INVALID_ENTITY_ID.
    
    In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require
    entities to have a non-zero unique ID"), we ignored all the invalid units,
    this broke a lot of non-compatible cameras. Hopefully we are more lucky
    this time.
    
    This also prevents some syzkaller reproducers from triggering warnings due
    to a chain of entities referring to themselves. In one particular case, an
    Output Unit is connected to an Input Unit, both with the same ID of 1. But
    when looking up for the source ID of the Output Unit, that same entity is
    found instead of the input entity, which leads to such warnings.
    
    In another case, a backward chain was considered finished as the source ID
    was 0. Later on, that entity was found, but its pads were not valid.
    
    Here is a sample stack trace for one of those cases.
    
    [   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
    [   20.830206] usb 1-1: Using ep0 maxpacket: 8
    [   20.833501] usb 1-1: config 0 descriptor??
    [   21.038518] usb 1-1: string descriptor 0 read error: -71
    [   21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
    [   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
    [   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
    [   21.042218] ------------[ cut here ]------------
    [   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
    [   21.043195] Modules linked in:
    [   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
    [   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
    [   21.044639] Workqueue: usb_hub_wq hub_event
    [   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
    [   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
    [   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
    [   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
    [   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
    [   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
    [   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
    [   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
    [   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
    [   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
    [   21.051136] PKRU: 55555554
    [   21.051331] Call Trace:
    [   21.051480]  <TASK>
    [   21.051611]  ? __warn+0xc4/0x210
    [   21.051861]  ? media_create_pad_link+0x2c4/0x2e0
    [   21.052252]  ? report_bug+0x11b/0x1a0
    [   21.052540]  ? trace_hardirqs_on+0x31/0x40
    [   21.052901]  ? handle_bug+0x3d/0x70
    [   21.053197]  ? exc_invalid_op+0x1a/0x50
    [   21.053511]  ? asm_exc_invalid_op+0x1a/0x20
    [   21.053924]  ? media_create_pad_link+0x91/0x2e0
    [   21.054364]  ? media_create_pad_link+0x2c4/0x2e0
    [   21.054834]  ? media_create_pad_link+0x91/0x2e0
    [   21.055131]  ? _raw_spin_unlock+0x1e/0x40
    [   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210
    [   21.055837]  uvc_mc_register_entities+0x358/0x400
    [   21.056144]  uvc_register_chains+0x1fd/0x290
    [   21.056413]  uvc_probe+0x380e/0x3dc0
    [   21.056676]  ? __lock_acquire+0x5aa/0x26e0
    [   21.056946]  ? find_held_lock+0x33/0xa0
    [   21.057196]  ? kernfs_activate+0x70/0x80
    [   21.057533]  ? usb_match_dynamic_id+0x1b/0x70
    [   21.057811]  ? find_held_lock+0x33/0xa0
    [   21.058047]  ? usb_match_dynamic_id+0x55/0x70
    [   21.058330]  ? lock_release+0x124/0x260
    [   21.058657]  ? usb_match_one_id_intf+0xa2/0x100
    [   21.058997]  usb_probe_interface+0x1ba/0x330
    [   21.059399]  really_probe+0x1ba/0x4c0
    [   21.059662]  __driver_probe_device+0xb2/0x180
    [   21.059944]  driver_probe_device+0x5a/0x100
    [   21.060170]  __device_attach_driver+0xe9/0x160
    [   21.060427]  ? __pfx___device_attach_driver+0x10/0x10
    [   21.060872]  bus_for_each_drv+0xa9/0x100
    [   21.061312]  __device_attach+0xed/0x190
    [   21.061812]  device_initial_probe+0xe/0x20
    [   21.062229]  bus_probe_device+0x4d/0xd0
    [   21.062590]  device_add+0x308/0x590
    [   21.062912]  usb_set_configuration+0x7b6/0xaf0
    [   21.063403]  usb_generic_driver_probe+0x36/0x80
    [   21.063714]  usb_probe_device+0x7b/0x130
    [   21.063936]  really_probe+0x1ba/0x4c0
    [   21.064111]  __driver_probe_device+0xb2/0x180
    [   21.064577]  driver_probe_device+0x5a/0x100
    [   21.065019]  __device_attach_driver+0xe9/0x160
    [   21.065403]  ? __pfx___device_attach_driver+0x10/0x10
    [   21.065820]  bus_for_each_drv+0xa9/0x100
    [   21.066094]  __device_attach+0xed/0x190
    [   21.066535]  device_initial_probe+0xe/0x20
    [   21.066992]  bus_probe_device+0x4d/0xd0
    [   21.067250]  device_add+0x308/0x590
    [   21.067501]  usb_new_device+0x347/0x610
    [   21.067817]  hub_event+0x156b/0x1e30
    [   21.068060]  ? process_scheduled_works+0x48b/0xaf0
    [   21.068337]  process_scheduled_works+0x5a3/0xaf0
    [   21.068668]  worker_thread+0x3cf/0x560
    [   21.068932]  ? kthread+0x109/0x1b0
    [   21.069133]  kthread+0x197/0x1b0
    [   21.069343]  ? __pfx_worker_thread+0x10/0x10
    [   21.069598]  ? __pfx_kthread+0x10/0x10
    [   21.069908]  ret_from_fork+0x32/0x40
    [   21.070169]  ? __pfx_kthread+0x10/0x10
    [   21.070424]  ret_from_fork_asm+0x1a/0x30
    [   21.070737]  </TASK>
    
    Reported-by: [email protected]
    Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675
    Reported-by: [email protected]
    Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b
    Reported-by: Youngjun Lee <[email protected]>
    Fixes: a3fbc2e6bb05 ("media: mc-entity.c: use WARN_ON, validate link pads")
    Cc: [email protected]
    Signed-off-by: Thadeu Lima de Souza Cascardo <[email protected]>
    Co-developed-by: Ricardo Ribalda <[email protected]>
    Signed-off-by: Ricardo Ribalda <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>
    Reviewed-by: Hans de Goede <[email protected]>
    Signed-off-by: Hans de Goede <[email protected]>
    Signed-off-by: Laurent Pinchart <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mm: swap: check for stable address space before operating on the VMA [+ + +]
Author: Charan Teja Kalla <[email protected]>
Date:   Wed Sep 24 23:41:38 2025 +0530

    mm: swap: check for stable address space before operating on the VMA
    
    commit 1367da7eb875d01102d2ed18654b24d261ff5393 upstream.
    
    It is possible to hit a zero entry while traversing the vmas in unuse_mm()
    called from swapoff path and accessing it causes the OOPS:
    
    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000446--> Loading the memory from offset 0x40 on the
    XA_ZERO_ENTRY as address.
    Mem abort info:
      ESR = 0x0000000096000005
      EC = 0x25: DABT (current EL), IL = 32 bits
      SET = 0, FnV = 0
      EA = 0, S1PTW = 0
      FSC = 0x05: level 1 translation fault
    
    The issue is manifested from the below race between the fork() on a
    process and swapoff:
    fork(dup_mmap())                        swapoff(unuse_mm)
    ---------------                         -----------------
    1) Identical mtree is built using
       __mt_dup().
    
    2) copy_pte_range()-->
            copy_nonpresent_pte():
           The dst mm is added into the
        mmlist to be visible to the
        swapoff operation.
    
    3) Fatal signal is sent to the parent
    process(which is the current during the
    fork) thus skip the duplication of the
    vmas and mark the vma range with
    XA_ZERO_ENTRY as a marker for this process
    that helps during exit_mmap().
    
                                         4) swapoff is tried on the
                                            'mm' added to the 'mmlist' as
                                            part of the 2.
    
                                         5) unuse_mm(), that iterates
                                            through the vma's of this 'mm'
                                            will hit the non-NULL zero entry
                                            and operating on this zero entry
                                            as a vma is resulting into the
                                            oops.
    
    The proper fix would be around not exposing this partially-valid tree to
    others when droping the mmap lock, which is being solved with [1].  A
    simpler solution would be checking for MMF_UNSTABLE, as it is set if
    mm_struct is not fully initialized in dup_mmap().
    
    Thanks to Liam/Lorenzo/David for all the suggestions in fixing this
    issue.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Link: https://lore.kernel.org/all/[email protected]/ [1]
    Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()")
    Signed-off-by: Charan Teja Kalla <[email protected]>
    Suggested-by: David Hildenbrand <[email protected]>
    Cc: Baoquan He <[email protected]>
    Cc: Barry Song <[email protected]>
    Cc: Chris Li <[email protected]>
    Cc: Kairui Song <[email protected]>
    Cc: Kemeng Shi <[email protected]>
    Cc: Liam Howlett <[email protected]>
    Cc: Lorenzo Stoakes <[email protected]>
    Cc: Nhat Pham <[email protected]>
    Cc: Peng Zhang <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
scsi: target: target_core_configfs: Add length check to avoid buffer overflow [+ + +]
Author: Wang Haoran <[email protected]>
Date:   Sat Sep 20 15:44:41 2025 +0800

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow
    
    commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream.
    
    A buffer overflow arises from the usage of snprintf to write into the
    buffer "buf" in target_lu_gp_members_show function located in
    /drivers/target/target_core_configfs.c. This buffer is allocated with
    size LU_GROUP_NAME_BUF (256 bytes).
    
    snprintf(...) formats multiple strings into buf with the HBA name
    (hba->hba_group.cg_item), a slash character, a devicename (dev->
    dev_group.cg_item) and a newline character, the total formatted string
    length may exceed the buffer size of 256 bytes.
    
    Since snprintf() returns the total number of bytes that would have been
    written (the length of %s/%sn ), this value may exceed the buffer length
    (256 bytes) passed to memcpy(), this will ultimately cause function
    memcpy reporting a buffer overflow error.
    
    An additional check of the return value of snprintf() can avoid this
    buffer overflow.
    
    Reported-by: Wang Haoran <[email protected]>
    Reported-by: ziiiro <[email protected]>
    Signed-off-by: Wang Haoran <[email protected]>
    Signed-off-by: Martin K. Petersen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() [+ + +]
Author: Matvey Kovalev <[email protected]>
Date:   Wed Sep 17 22:20:01 2025 +0300

    wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
    
    commit 3fd2ef2ae2b5c955584a3bee8e83ae7d7a98f782 upstream.
    
    If ab->fw.m3_data points to data, then fw pointer remains null.
    Further, if m3_mem is not allocated, then fw is dereferenced to be
    passed to ath11k_err function.
    
    Replace fw->size by m3_len.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: 7db88b962f06 ("wifi: ath11k: add firmware-2.bin support")
    Cc: [email protected]
    Signed-off-by: Matvey Kovalev <[email protected]>
    Reviewed-by: Baochen Qiang <[email protected]>
    Reviewed-by: Vasanthakumar Thiagarajan <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jeff Johnson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() [+ + +]
Author: Fedor Pchelkin <[email protected]>
Date:   Sat Sep 20 00:08:47 2025 +0300

    wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
    
    commit 3e31a6bc07312b448fad3b45de578471f86f0e77 upstream.
    
    There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to
    access already freed skb_data:
    
     BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110
    
     CPU: 6 UID: 0 PID: 41377 Comm: kworker/u64:24 Not tainted  6.17.0-rc1+ #1 PREEMPT(lazy)
     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
     Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
    
     Use-after-free write at 0x0000000020309d9d (in kfence-#251):
     rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110
     rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338
     rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979
     rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165
     rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.h:141
     rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012
     rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059
     rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758
     process_one_work kernel/workqueue.c:3241
     worker_thread kernel/workqueue.c:3400
     kthread kernel/kthread.c:463
     ret_from_fork arch/x86/kernel/process.c:154
     ret_from_fork_asm arch/x86/entry/entry_64.S:258
    
     kfence-#251: 0x0000000056e2393d-0x000000009943cb62, size=232, cache=skbuff_head_cache
    
     allocated by task 41377 on cpu 6 at 77869.159548s (0.009551s ago):
     __alloc_skb net/core/skbuff.c:659
     __netdev_alloc_skb net/core/skbuff.c:734
     ieee80211_nullfunc_get net/mac80211/tx.c:5844
     rtw89_core_send_nullfunc drivers/net/wireless/realtek/rtw89/core.c:3431
     rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338
     rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979
     rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165
     rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.c:3194
     rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012
     rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059
     rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758
     process_one_work kernel/workqueue.c:3241
     worker_thread kernel/workqueue.c:3400
     kthread kernel/kthread.c:463
     ret_from_fork arch/x86/kernel/process.c:154
     ret_from_fork_asm arch/x86/entry/entry_64.S:258
    
     freed by task 1045 on cpu 9 at 77869.168393s (0.001557s ago):
     ieee80211_tx_status_skb net/mac80211/status.c:1117
     rtw89_pci_release_txwd_skb drivers/net/wireless/realtek/rtw89/pci.c:564
     rtw89_pci_release_tx_skbs.isra.0 drivers/net/wireless/realtek/rtw89/pci.c:651
     rtw89_pci_release_tx drivers/net/wireless/realtek/rtw89/pci.c:676
     rtw89_pci_napi_poll drivers/net/wireless/realtek/rtw89/pci.c:4238
     __napi_poll net/core/dev.c:7495
     net_rx_action net/core/dev.c:7557 net/core/dev.c:7684
     handle_softirqs kernel/softirq.c:580
     do_softirq.part.0 kernel/softirq.c:480
     __local_bh_enable_ip kernel/softirq.c:407
     rtw89_pci_interrupt_threadfn drivers/net/wireless/realtek/rtw89/pci.c:927
     irq_thread_fn kernel/irq/manage.c:1133
     irq_thread kernel/irq/manage.c:1257
     kthread kernel/kthread.c:463
     ret_from_fork arch/x86/kernel/process.c:154
     ret_from_fork_asm arch/x86/entry/entry_64.S:258
    
    It is a consequence of a race between the waiting and the signaling side
    of the completion:
    
                Waiting thread                            Completing thread
    
    rtw89_core_tx_kick_off_and_wait()
      rcu_assign_pointer(skb_data->wait, wait)
      /* start waiting */
      wait_for_completion_timeout()
                                                    rtw89_pci_tx_status()
                                                      rtw89_core_tx_wait_complete()
                                                        rcu_read_lock()
                                                        /* signals completion and
                                                         * proceeds further
                                                         */
                                                        complete(&wait->completion)
                                                        rcu_read_unlock()
                                                      ...
                                                      /* frees skb_data */
                                                      ieee80211_tx_status_ni()
      /* returns (exit status doesn't matter) */
      wait_for_completion_timeout()
      ...
      /* accesses the already freed skb_data */
      rcu_assign_pointer(skb_data->wait, NULL)
    
    The completing side might proceed and free the underlying skb even before
    the waiting side is fully awoken and run to execution.  Actually the race
    happens regardless of wait_for_completion_timeout() exit status, e.g.
    the waiting side may hit a timeout and the concurrent completing side is
    still able to free the skb.
    
    Skbs which are sent by rtw89_core_tx_kick_off_and_wait() are owned by the
    driver.  They don't come from core ieee80211 stack so no need to pass them
    to ieee80211_tx_status_ni() on completing side.
    
    Introduce a work function which will act as a garbage collector for
    rtw89_tx_wait_info objects and the associated skbs.  Thus no potentially
    heavy locks are required on the completing side.
    
    Found by Linux Verification Center (linuxtesting.org).
    
    Fixes: 1ae5ca615285 ("wifi: rtw89: add function to wait for completion of TX skbs")
    Cc: [email protected]
    Suggested-by: Zong-Zhe Yang <[email protected]>
    Signed-off-by: Fedor Pchelkin <[email protected]>
    Acked-by: Ping-Ke Shih <[email protected]>
    Signed-off-by: Ping-Ke Shih <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>