[PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[Nobuhiro Iwamatsu]

Hi all,

This is patch series that fixes CVEs related to patches backported to
CIP kernel.
The following CVEs and commits are addressed:

- CVE-2026-80950:
    introduced-cip-commits:
    - 0bea5c0e39992654677bb6e94d276c14bf75c2f8

- CVE-2026-98408:
    introduced-cip-commits:
    - e7be3130426e3a807b36f67672c483be40149ece

- CVE-2026-93168:
    introduced-cip-commits:
    - 45d1a8483d570ddd1017945c730d82beda702006

- CVE-2026-90147:
    introduced-cip-commits:
    - ec6f6aa0c2897b4f0cfda06a10489137d78f1894

- CVE-2026-89728:
    introduced-cip-commits:
    - 8b01676f5130eb96966a155b3d62247592c0600c

Best regards,
  Nobuhiro

Alex Bereza (1):
  dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout

Claudiu Beznea (2):
  i3c: renesas: Check that the transfer is valid before accessing it
  i3c: renesas: Fix out-of-bounds access for newdevs mask

Onur Özkan (1):
  clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()

Tzung-Bi Shih (1):
  watchdog: rzv2h: Avoid division by zero

 drivers/clk/clk-devres.c         | 12 +++++--
 drivers/dma/xilinx/xilinx_dma.c  | 14 +++++---
 drivers/i3c/master/renesas-i3c.c | 58 +++++++++++++++++++++++++++-----
 drivers/watchdog/rzv2h_wdt.c     |  7 +++-
 4 files changed, 76 insertions(+), 15 deletions(-)

-- 
2.55.0

[PATCH 6.1.y-cip 1/5] i3c: renesas: Check that the transfer is valid before accessing it

[Nobuhiro Iwamatsu]

From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>

commit 5f1a76ecfe90544a28d657306c9b3caa66ba0e63 upstream.

The Renesas I3C driver uses an asynchronous model to transfer data. It
prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion.
The interrupt handler dequeues the transfer, updates/uses it, and signals
the waiting thread.

If the completion times out, the waiting thread dequeues the transfer and
free it. If an interrupt fires after that, the handler may access freed
memory, leading to crashes.

Check that the transfer is still valid before accessing it in the
interrupt handler. With it clear any status flags and disable all
the interrupts to avoid triggering the same interrupts again.

Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller")
Cc: stable@vger.kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-2-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
---
 drivers/i3c/master/renesas-i3c.c | 52 +++++++++++++++++++++++++++-----
 1 file changed, 45 insertions(+), 7 deletions(-)

diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c
index 16c9b54057a9..faf116b70aef 100644
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -434,6 +434,21 @@ static void renesas_i3c_enqueue_xfer(struct renesas_i3c *i3c, struct renesas_i3c
 	}
 }
 
+static void renesas_i3c_irqs_mask_and_clear_locked(struct renesas_i3c *i3c)
+{
+	/* Disable all the interrupts. */
+	renesas_writel(i3c->regs, BIE, 0);
+	renesas_writel(i3c->regs, NTIE, 0);
+
+	/* Clear normal transfer status flags. */
+	renesas_writel(i3c->regs, NTST, 0);
+
+	/* Clear bus status flags. */
+	renesas_writel(i3c->regs, BST, 0);
+	/* Read back registers to confirm writes have fully propagated. */
+	renesas_readl(i3c->regs, BST);
+}
+
 static void renesas_i3c_wait_xfer(struct renesas_i3c *i3c, struct renesas_i3c_xfer *xfer)
 {
 	unsigned long time_left;
@@ -1018,6 +1033,11 @@ static irqreturn_t renesas_i3c_tx_isr(int irq, void *data)
 
 	scoped_guard(spinlock, &i3c->xferqueue.lock) {
 		xfer = i3c->xferqueue.cur;
+		if (!xfer) {
+			renesas_i3c_irqs_mask_and_clear_locked(i3c);
+			return IRQ_HANDLED;
+		}
+
 		cmd = xfer->cmds;
 
 		if (xfer->is_i2c_xfer) {
@@ -1058,6 +1078,11 @@ static irqreturn_t renesas_i3c_resp_isr(int irq, void *data)
 
 	scoped_guard(spinlock, &i3c->xferqueue.lock) {
 		xfer = i3c->xferqueue.cur;
+		if (!xfer) {
+			renesas_i3c_irqs_mask_and_clear_locked(i3c);
+			return IRQ_HANDLED;
+		}
+
 		cmd = xfer->cmds;
 
 		/* Clear the Respone Queue Full status flag*/
@@ -1142,6 +1167,11 @@ static irqreturn_t renesas_i3c_tend_isr(int irq, void *data)
 
 	scoped_guard(spinlock, &i3c->xferqueue.lock) {
 		xfer = i3c->xferqueue.cur;
+		if (!xfer) {
+			renesas_i3c_irqs_mask_and_clear_locked(i3c);
+			return IRQ_HANDLED;
+		}
+
 		cmd = xfer->cmds;
 
 		if (xfer->is_i2c_xfer) {
@@ -1188,6 +1218,11 @@ static irqreturn_t renesas_i3c_rx_isr(int irq, void *data)
 
 	scoped_guard(spinlock, &i3c->xferqueue.lock) {
 		xfer = i3c->xferqueue.cur;
+		if (!xfer) {
+			renesas_i3c_irqs_mask_and_clear_locked(i3c);
+			return IRQ_HANDLED;
+		}
+
 		cmd = xfer->cmds;
 
 		if (xfer->is_i2c_xfer) {
@@ -1238,15 +1273,13 @@ static irqreturn_t renesas_i3c_stop_isr(int irq, void *data)
 	struct renesas_i3c_xfer *xfer;
 
 	scoped_guard(spinlock, &i3c->xferqueue.lock) {
-		xfer = i3c->xferqueue.cur;
-
-		/* read back registers to confirm writes have fully propagated */
-		renesas_writel(i3c->regs, BST, 0);
-		renesas_readl(i3c->regs, BST);
-		renesas_writel(i3c->regs, BIE, 0);
-		renesas_clear_bit(i3c->regs, NTST, NTST_TDBEF0 | NTST_RDBFF0);
+		renesas_i3c_irqs_mask_and_clear_locked(i3c);
 		renesas_clear_bit(i3c->regs, SCSTRCTL, SCSTRCTL_RWE);
 
+		xfer = i3c->xferqueue.cur;
+		if (!xfer)
+			return IRQ_HANDLED;
+
 		xfer->ret = 0;
 		complete(&xfer->comp);
 	}
@@ -1263,6 +1296,11 @@ static irqreturn_t renesas_i3c_start_isr(int irq, void *data)
 
 	scoped_guard(spinlock, &i3c->xferqueue.lock) {
 		xfer = i3c->xferqueue.cur;
+		if (!xfer) {
+			renesas_i3c_irqs_mask_and_clear_locked(i3c);
+			return IRQ_HANDLED;
+		}
+
 		cmd = xfer->cmds;
 
 		if (xfer->is_i2c_xfer) {
-- 
2.55.0

[PATCH 6.1.y-cip 2/5] i3c: renesas: Fix out-of-bounds access for newdevs mask

[Nobuhiro Iwamatsu]

From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>

commit 50dec95c9d1f1f82819bc898ef2b60fa83fd4ccd upstream.

When software initiates DAA (Dynamic Address Assignment), the controller
reports the result via the NRSPQP (Normal Response Queue Port Register).
The data length field of the response descriptor, which is accessible
through the NRSPQP register, indicates the number of devices remaining
after DAA. Consequently, when the bus is empty, this field contains the
maximum number of devices supported by the controller (8 for the Renesas
I3C controller).

Adjust the condition that computes the newly discovered devices bitmask
to prevent an out-of-bounds when the I3C bus is empty.

Fixes: e7218986319b ("i3c: renesas: Add suspend/resume support")
Cc: stable@vger.kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-9-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
---
 drivers/i3c/master/renesas-i3c.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c
index faf116b70aef..86ea675a97d7 100644
--- a/drivers/i3c/master/renesas-i3c.c
+++ b/drivers/i3c/master/renesas-i3c.c
@@ -705,7 +705,11 @@ static int renesas_i3c_daa(struct i3c_master_controller *m)
 
 	renesas_i3c_wait_xfer(i3c, xfer);
 
-	newdevs = GENMASK(i3c->maxdevs - cmd->rx_count - 1, 0);
+	if (cmd->rx_count >= i3c->maxdevs)
+		newdevs = 0;
+	else
+		newdevs = GENMASK(i3c->maxdevs - cmd->rx_count - 1, 0);
+
 	newdevs &= ~olddevs;
 
 	for (pos = 0; pos < i3c->maxdevs; pos++) {
-- 
2.55.0

[PATCH 6.1.y-cip 3/5] clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()

[Nobuhiro Iwamatsu]

From: Onur Özkan <work@onurozkan.dev>

commit 0d4d262c1664365e17e0a5ba2ab79f4db484b44e upstream.

devm_clk_get_optional_enabled_with_rate() registers its cleanup action
before setting the clock rate. If setting the rate fails, it attempts to
disable and unprepare a clock that was never enabled. This issue was
spotted while reviewing "rust: clk: add devres-managed clks" [1].

Register the cleanup action only after successfully preparing and enabling
the clock.

[1]: https://lore.kernel.org/rust-for-linux/20260706-clk-type-state-v5-3-67c5f326a16c@collabora.com

Fixes: 9934a1bd45b2 ("clk: provide devm_clk_get_optional_enabled_with_rate()")
Signed-off-by: Onur Özkan <work@onurozkan.dev>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
---
 drivers/clk/clk-devres.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c
index 5368d92d9b39..09fd5e8fb72c 100644
--- a/drivers/clk/clk-devres.c
+++ b/drivers/clk/clk-devres.c
@@ -99,6 +99,11 @@ struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id)
 }
 EXPORT_SYMBOL_GPL(devm_clk_get_optional_enabled);
 
+static void devm_clk_disable_unprepare(void *data)
+{
+	clk_disable_unprepare(data);
+}
+
 struct clk *devm_clk_get_optional_enabled_with_rate(struct device *dev,
 						    const char *id,
 						    unsigned long rate)
@@ -106,8 +111,7 @@ struct clk *devm_clk_get_optional_enabled_with_rate(struct device *dev,
 	struct clk *clk;
 	int ret;
 
-	clk = __devm_clk_get(dev, id, clk_get_optional, NULL,
-			     clk_disable_unprepare);
+	clk = devm_clk_get_optional(dev, id);
 	if (IS_ERR(clk))
 		return ERR_CAST(clk);
 
@@ -119,6 +123,10 @@ struct clk *devm_clk_get_optional_enabled_with_rate(struct device *dev,
 	if (ret)
 		goto out_put_clk;
 
+	ret = devm_add_action_or_reset(dev, devm_clk_disable_unprepare, clk);
+	if (ret)
+		goto out_put_clk;
+
 	return clk;
 
 out_put_clk:
-- 
2.55.0

[PATCH 6.1.y-cip 4/5] dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout

[Nobuhiro Iwamatsu]

From: Alex Bereza <alex@bereza.email>

commit aa99c4d1d63bbc26a5fc4c667d89b2595743c19d upstream.

Currently when calling xilinx_dma_poll_timeout with delay_us=0 and a
condition that is never fulfilled, the CPU busy-waits for prolonged time
and the timeout triggers only with a massive delay causing a CPU stall.

This happens due to a huge underestimation of wall clock time in
poll_timeout_us_atomic. Commit 7349a69cf312 ("iopoll: Do not use
timekeeping in read_poll_timeout_atomic()") changed the behavior to no
longer use ktime_get at the expense of underestimation of wall clock
time which appears to be very large for delay_us=0. Instead of timing
out after approximately XILINX_DMA_LOOP_COUNT microseconds, the timeout
takes XILINX_DMA_LOOP_COUNT * 1000 * (time that the overhead of the for
loop in poll_timeout_us_atomic takes) which is in the range of several
minutes for XILINX_DMA_LOOP_COUNT=1000000. Fix this by using a non-zero
value for delay_us. Use delay_us=10 to keep the delay in the hot path of
starting DMA transfers minimal but still avoid CPU stalls in case of
unexpected hardware failures.

One-off measurement with delay_us=0 causes the cpu to busy wait around 7
minutes in the timeout case. After applying this patch with delay_us=10
the measured timeout was 1053428 microseconds which is roughly
equivalent to the expected 1000000 microseconds specified in
XILINX_DMA_LOOP_COUNT.

Add a constant XILINX_DMA_POLL_DELAY_US for delay_us value.

Fixes: 9495f2648287 ("dmaengine: xilinx_vdma: Use readl_poll_timeout instead of do while loop's")
Fixes: 7349a69cf312 ("iopoll: Do not use timekeeping in read_poll_timeout_atomic()")
Reviewed-by: Suraj Gupta <suraj.gupta2@amd.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Alex Bereza <alex@bereza.email>
Link: https://patch.msgid.link/20260402-fix-atomic-poll-timeout-regression-v4-1-f30d6a6c13cb@bereza.email
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
---
 drivers/dma/xilinx/xilinx_dma.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index 5fb423261c3f..d1f83e315be7 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -164,6 +164,8 @@
 
 /* Delay loop counter to prevent hardware failure */
 #define XILINX_DMA_LOOP_COUNT		1000000
+/* Delay between polls (avoid a delay of 0 to prevent CPU stalls) */
+#define XILINX_DMA_POLL_DELAY_US	10
 
 /* AXI DMA Specific Registers/Offsets */
 #define XILINX_DMA_REG_SRCDSTADDR	0x18
@@ -1287,7 +1289,8 @@ static int xilinx_dma_stop_transfer(struct xilinx_dma_chan *chan)
 
 	/* Wait for the hardware to halt */
 	return xilinx_dma_poll_timeout(chan, XILINX_DMA_REG_DMASR, val,
-				       val & XILINX_DMA_DMASR_HALTED, 0,
+				       val & XILINX_DMA_DMASR_HALTED,
+				       XILINX_DMA_POLL_DELAY_US,
 				       XILINX_DMA_LOOP_COUNT);
 }
 
@@ -1302,7 +1305,8 @@ static int xilinx_cdma_stop_transfer(struct xilinx_dma_chan *chan)
 	u32 val;
 
 	return xilinx_dma_poll_timeout(chan, XILINX_DMA_REG_DMASR, val,
-				       val & XILINX_DMA_DMASR_IDLE, 0,
+				       val & XILINX_DMA_DMASR_IDLE,
+				       XILINX_DMA_POLL_DELAY_US,
 				       XILINX_DMA_LOOP_COUNT);
 }
 
@@ -1319,7 +1323,8 @@ static void xilinx_dma_start(struct xilinx_dma_chan *chan)
 
 	/* Wait for the hardware to start */
 	err = xilinx_dma_poll_timeout(chan, XILINX_DMA_REG_DMASR, val,
-				      !(val & XILINX_DMA_DMASR_HALTED), 0,
+				      !(val & XILINX_DMA_DMASR_HALTED),
+				      XILINX_DMA_POLL_DELAY_US,
 				      XILINX_DMA_LOOP_COUNT);
 
 	if (err) {
@@ -1742,7 +1747,8 @@ static int xilinx_dma_reset(struct xilinx_dma_chan *chan)
 
 	/* Wait for the hardware to finish reset */
 	err = xilinx_dma_poll_timeout(chan, XILINX_DMA_REG_DMACR, tmp,
-				      !(tmp & XILINX_DMA_DMACR_RESET), 0,
+				      !(tmp & XILINX_DMA_DMACR_RESET),
+				      XILINX_DMA_POLL_DELAY_US,
 				      XILINX_DMA_LOOP_COUNT);
 
 	if (err) {
-- 
2.55.0

[PATCH 6.1.y-cip 5/5] watchdog: rzv2h: Avoid division by zero

[Nobuhiro Iwamatsu]

From: Tzung-Bi Shih <tzungbi@kernel.org>

commit 6274281c41efa8dd1aa5234c59ad904ff89d7af4 upstream.

clk_get_rate() could return 0.  Avoid a division by zero panic.

Fixes: f6febd0a30b6 ("watchdog: Add Watchdog Timer driver for RZ/V2H(P)")
Cc: stable@vger.kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20260913064851.8239-4-tzungbi@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
[iwamatsu: adjust context]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
---
 drivers/watchdog/rzv2h_wdt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/rzv2h_wdt.c b/drivers/watchdog/rzv2h_wdt.c
index 8defd0241213..4c486244fd5b 100644
--- a/drivers/watchdog/rzv2h_wdt.c
+++ b/drivers/watchdog/rzv2h_wdt.c
@@ -207,6 +207,7 @@ static int rzv2h_wdt_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct rzv2h_wdt_priv *priv;
+	unsigned long rate;
 	int ret;
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -230,8 +231,12 @@ static int rzv2h_wdt_probe(struct platform_device *pdev)
 		return dev_err_probe(dev, PTR_ERR(priv->rstc),
 				     "failed to get cpg reset");
 
+	rate = clk_get_rate(priv->oscclk);
+	if (!rate)
+		return dev_err_probe(dev, -EINVAL, "Invalid clock rate\n");
+
 	priv->wdev.max_hw_heartbeat_ms = (MILLI * MAX_TIMEOUT_CYCLES * CLOCK_DIV_BY_256) /
-					 clk_get_rate(priv->oscclk);
+					 rate;
 	dev_dbg(dev, "max hw timeout of %dms\n", priv->wdev.max_hw_heartbeat_ms);
 
 	ret = devm_pm_runtime_enable(dev);
-- 
2.55.0

Re: [cip-dev] [PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 535 bytes --]

Hi!

> This is patch series that fixes CVEs related to patches backported to
> CIP kernel.
> The following CVEs and commits are addressed:

Thanks, I will take a look.

I don't see these in 6.12 (c8fba74056). Should we get them into 6.12
before merging them to 6.1?

> Claudiu Beznea (2):
>   i3c: renesas: Check that the transfer is valid before accessing it
>   i3c: renesas: Fix out-of-bounds access for newdevs mask
> 
> Tzung-Bi Shih (1):
>   watchdog: rzv2h: Avoid division by zero

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [cip-dev] [PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[claudiu beznea]

Hi, all,

On 11/9/26 11:10, Pavel Machek via cip-dev wrote:
> Hi!
> 
>> This is patch series that fixes CVEs related to patches backported to
>> CIP kernel.
>> The following CVEs and commits are addressed:
> 
> Thanks, I will take a look.
> 
> I don't see these in 6.12 (c8fba74056). Should we get them into 6.12
> before merging them to 6.1?
> 
>> Claudiu Beznea (2):
>>    i3c: renesas: Check that the transfer is valid before accessing it
>>    i3c: renesas: Fix out-of-bounds access for newdevs mask

Just to let you know, I plan to backport these (along with other renesas-i3c 
fixes and improvements) on CIP v6.12, v6.1, v5.10. These should be done by the 
end of the week. If you can wait till then, I can handle it.

Thank you,
Claudiu

Re: [cip-dev] [PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 858 bytes --]

Hi!

> > > This is patch series that fixes CVEs related to patches backported to
> > > CIP kernel.
> > > The following CVEs and commits are addressed:
> > 
> > Thanks, I will take a look.
> > 
> > I don't see these in 6.12 (c8fba74056). Should we get them into 6.12
> > before merging them to 6.1?
> > 
> > > Claudiu Beznea (2):
> > >    i3c: renesas: Check that the transfer is valid before accessing it
> > >    i3c: renesas: Fix out-of-bounds access for newdevs mask
> 
> Just to let you know, I plan to backport these (along with other renesas-i3c
> fixes and improvements) on CIP v6.12, v6.1, v5.10. These should be done by
> the end of the week. If you can wait till then, I can handle it.

That sounds like a good plan. I have applied the rest of the series,
and will wait for you to submit these.

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [cip-dev] [PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 703 bytes --]

Hi!

> Alex Bereza (1):
>   dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
> 
> Claudiu Beznea (2):
>   i3c: renesas: Check that the transfer is valid before accessing it
>   i3c: renesas: Fix out-of-bounds access for newdevs mask
> 
> Onur Özkan (1):
>   clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()

I don't think attacker can trigger the next one, looks like it is just
a robustness against invalid dts.

> Tzung-Bi Shih (1):
>   watchdog: rzv2h: Avoid division by zero

Anyway, patches seem good, but I believe we should get them into 6.12
branch, first.

Reviewed-by: Pavel Machek <pavel@nabladev.com>

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[Nobuhiro Iwamatsu]

Hi all,

This is a patch series that fixes CVEs related to patches backported to
CIP kernel.
The following CVEs and commits are addressed in this:

- CVE-2026-53030:
    introduced-commits:
    - 0bea5c0e39992654677bb6e94d276c14bf75c2f8
- CVE-2025-71187:
    introduced-commits:
    - 282d5dfb9147694b8ba1a6528d38450d2f7addda
- CVE-2025-39774:
    introduced-commits:
    - ffe4a44bf16c17a26124536533179c12239668de
- CVE-2026-31740:
    introduced-commits:
    - 6ae52685cb60989ed37870bb7f9d2e2d96a6e509
- CVE-2026-31741:
    introduced-commits:
    - 6ae52685cb60989ed37870bb7f9d2e2d96a6e509

Best regards,
  Nobuhiro

Claudiu Beznea (1):
  iio: adc: rzg2l_adc: Set driver data before enabling runtime PM

Cosmin Tanislav (2):
  counter: rz-mtu3-cnt: prevent counter from being toggled multiple
    times
  counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member

Felix Gu (1):
  i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()

Johan Hovold (1):
  dmaengine: sh: rz-dmac: fix device leak on probe failure

 drivers/counter/rz-mtu3-cnt.c    | 67 +++++++++++++++++---------------
 drivers/dma/sh/rz-dmac.c         | 13 ++++++-
 drivers/i3c/master/renesas-i3c.c |  4 +-
 drivers/iio/adc/rzg2l_adc.c      |  4 +-
 4 files changed, 50 insertions(+), 38 deletions(-)

-- 
2.55.0

Re: [cip-dev] [PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 431 bytes --]

Hi!

> This is a patch series that fixes CVEs related to patches backported to
> CIP kernel.
> The following CVEs and commits are addressed in this:

This looks okay to me.

Reviewed-by: Pavel Machek <pavel@nabladev.com>

I can apply the series if it passes testing and there are no other
comments (but it may be easier for you to apply it...?).

Best regards,
                                                                Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [cip-dev] [PATCH 6.1.y-cip 0/5] Fix CVEs related to patches backported to the CIP kernel

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 515 bytes --]

Hi!

> Claudiu Beznea (1):
>   iio: adc: rzg2l_adc: Set driver data before enabling runtime PM

> Cosmin Tanislav (2):
>   counter: rz-mtu3-cnt: prevent counter from being toggled multiple
>     times
>   counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
> 
> Felix Gu (1):
>   i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()
> 
> Johan Hovold (1):
>   dmaengine: sh: rz-dmac: fix device leak on probe failure

Thank you, applied.

Best regards,
							Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]