--- /dev/null
+From 8dab34ca77293b409c3223636dde915a22656748 Mon Sep 17 00:00:00 2001
+From: Kurt Borja <kuurtb@gmail.com>
+Date: Mon, 30 Jun 2025 14:31:19 -0300
+Subject: platform/x86: think-lmi: Create ksets consecutively
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kurt Borja <kuurtb@gmail.com>
+
+commit 8dab34ca77293b409c3223636dde915a22656748 upstream.
+
+Avoid entering tlmi_release_attr() in error paths if both ksets are not
+yet created.
+
+This is accomplished by initializing them side by side.
+
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kurt Borja <kuurtb@gmail.com>
+Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-1-ce4f81c9c481@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/think-lmi.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -1455,6 +1455,14 @@ static int tlmi_sysfs_init(void)
+ goto fail_device_created;
+ }
+
++ tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
++ &tlmi_priv.class_dev->kobj);
++ if (!tlmi_priv.authentication_kset) {
++ kset_unregister(tlmi_priv.attribute_kset);
++ ret = -ENOMEM;
++ goto fail_device_created;
++ }
++
+ for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
+ /* Check if index is a valid setting - skip if it isn't */
+ if (!tlmi_priv.setting[i])
+@@ -1496,12 +1504,6 @@ static int tlmi_sysfs_init(void)
+ }
+
+ /* Create authentication entries */
+- tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
+- &tlmi_priv.class_dev->kobj);
+- if (!tlmi_priv.authentication_kset) {
+- ret = -ENOMEM;
+- goto fail_create_attr;
+- }
+ tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
+ ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");
+ if (ret)
--- /dev/null
+From 9110056fe10b0519529bdbbac37311a5037ea0c2 Mon Sep 17 00:00:00 2001
+From: Kurt Borja <kuurtb@gmail.com>
+Date: Mon, 30 Jun 2025 14:31:20 -0300
+Subject: platform/x86: think-lmi: Fix kobject cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kurt Borja <kuurtb@gmail.com>
+
+commit 9110056fe10b0519529bdbbac37311a5037ea0c2 upstream.
+
+In tlmi_analyze(), allocated structs with an embedded kobject are freed
+in error paths after the they were already initialized.
+
+Fix this by first by avoiding the initialization of kobjects in
+tlmi_analyze() and then by correctly cleaning them up in
+tlmi_release_attr() using their kset's kobject list.
+
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Fixes: 30e78435d3bf ("platform/x86: think-lmi: Split kobject_init() and kobject_add() calls")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Kurt Borja <kuurtb@gmail.com>
+Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-2-ce4f81c9c481@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/think-lmi.c | 35 +++++++++++++++++++----------------
+ 1 file changed, 19 insertions(+), 16 deletions(-)
+
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -1380,13 +1380,13 @@ static struct kobj_attribute debug_cmd =
+ /* ---- Initialisation --------------------------------------------------------- */
+ static void tlmi_release_attr(void)
+ {
++ struct kobject *pos, *n;
+ int i;
+
+ /* Attribute structures */
+ for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
+ if (tlmi_priv.setting[i]) {
+ sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
+- kobject_put(&tlmi_priv.setting[i]->kobj);
+ }
+ }
+ sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
+@@ -1395,6 +1395,9 @@ static void tlmi_release_attr(void)
+ if (tlmi_priv.can_debug_cmd && debug_support)
+ sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
+
++ list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry)
++ kobject_put(pos);
++
+ kset_unregister(tlmi_priv.attribute_kset);
+
+ /* Free up any saved signatures */
+@@ -1403,19 +1406,17 @@ static void tlmi_release_attr(void)
+
+ /* Authentication structures */
+ sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_admin->kobj);
+ sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_power->kobj);
+
+ if (tlmi_priv.opcode_support) {
+ sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_system->kobj);
+ sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_hdd->kobj);
+ sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_nvme->kobj);
+ }
+
++ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry)
++ kobject_put(pos);
++
+ kset_unregister(tlmi_priv.authentication_kset);
+ }
+
+@@ -1479,8 +1480,8 @@ static int tlmi_sysfs_init(void)
+
+ /* Build attribute */
+ tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;
+- ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL,
+- "%s", tlmi_priv.setting[i]->display_name);
++ ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype,
++ NULL, "%s", tlmi_priv.setting[i]->display_name);
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1505,7 +1506,8 @@ static int tlmi_sysfs_init(void)
+
+ /* Create authentication entries */
+ tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "Admin");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1514,7 +1516,8 @@ static int tlmi_sysfs_init(void)
+ goto fail_create_attr;
+
+ tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "Power-on");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1524,7 +1527,8 @@ static int tlmi_sysfs_init(void)
+
+ if (tlmi_priv.opcode_support) {
+ tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "System");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1533,7 +1537,8 @@ static int tlmi_sysfs_init(void)
+ goto fail_create_attr;
+
+ tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "HDD");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1542,7 +1547,8 @@ static int tlmi_sysfs_init(void)
+ goto fail_create_attr;
+
+ tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "NVMe");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1579,8 +1585,6 @@ static struct tlmi_pwd_setting *tlmi_cre
+ new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;
+ new_pwd->index = 0;
+
+- kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype);
+-
+ return new_pwd;
+ }
+
+@@ -1685,7 +1689,6 @@ static int tlmi_analyze(struct wmi_devic
+ if (setting->possible_values)
+ strreplace(setting->possible_values, ',', ';');
+
+- kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
+ tlmi_priv.setting[i] = setting;
+ kfree(item);
+ }
--- /dev/null
+From 4f30f946f27b7f044cf8f3f1f353dee1dcd3517a Mon Sep 17 00:00:00 2001
+From: Kurt Borja <kuurtb@gmail.com>
+Date: Mon, 30 Jun 2025 14:31:21 -0300
+Subject: platform/x86: think-lmi: Fix sysfs group cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kurt Borja <kuurtb@gmail.com>
+
+commit 4f30f946f27b7f044cf8f3f1f353dee1dcd3517a upstream.
+
+Many error paths in tlmi_sysfs_init() lead to sysfs groups being removed
+when they were not even created.
+
+Fix this by letting the kobject core manage these groups through their
+kobj_type's defult_groups.
+
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Kurt Borja <kuurtb@gmail.com>
+Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-3-ce4f81c9c481@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/think-lmi.c | 43 +++------------------------------------
+ 1 file changed, 4 insertions(+), 39 deletions(-)
+
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -973,6 +973,7 @@ static const struct attribute_group auth
+ .is_visible = auth_attr_is_visible,
+ .attrs = auth_attrs,
+ };
++__ATTRIBUTE_GROUPS(auth_attr);
+
+ /* ---- Attributes sysfs --------------------------------------------------------- */
+ static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr,
+@@ -1188,6 +1189,7 @@ static const struct attribute_group tlmi
+ .is_visible = attr_is_visible,
+ .attrs = tlmi_attrs,
+ };
++__ATTRIBUTE_GROUPS(tlmi_attr);
+
+ static void tlmi_attr_setting_release(struct kobject *kobj)
+ {
+@@ -1207,11 +1209,13 @@ static void tlmi_pwd_setting_release(str
+ static const struct kobj_type tlmi_attr_setting_ktype = {
+ .release = &tlmi_attr_setting_release,
+ .sysfs_ops = &kobj_sysfs_ops,
++ .default_groups = tlmi_attr_groups,
+ };
+
+ static const struct kobj_type tlmi_pwd_setting_ktype = {
+ .release = &tlmi_pwd_setting_release,
+ .sysfs_ops = &kobj_sysfs_ops,
++ .default_groups = auth_attr_groups,
+ };
+
+ static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr,
+@@ -1381,14 +1385,8 @@ static struct kobj_attribute debug_cmd =
+ static void tlmi_release_attr(void)
+ {
+ struct kobject *pos, *n;
+- int i;
+
+ /* Attribute structures */
+- for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
+- if (tlmi_priv.setting[i]) {
+- sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
+- }
+- }
+ sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
+ sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr);
+
+@@ -1405,15 +1403,6 @@ static void tlmi_release_attr(void)
+ kfree(tlmi_priv.pwd_admin->save_signature);
+
+ /* Authentication structures */
+- sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
+- sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
+-
+- if (tlmi_priv.opcode_support) {
+- sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
+- sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
+- sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
+- }
+-
+ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry)
+ kobject_put(pos);
+
+@@ -1484,10 +1473,6 @@ static int tlmi_sysfs_init(void)
+ NULL, "%s", tlmi_priv.setting[i]->display_name);
+ if (ret)
+ goto fail_create_attr;
+-
+- ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
+- if (ret)
+- goto fail_create_attr;
+ }
+
+ ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
+@@ -1511,20 +1496,12 @@ static int tlmi_sysfs_init(void)
+ if (ret)
+ goto fail_create_attr;
+
+- ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
+- if (ret)
+- goto fail_create_attr;
+-
+ tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
+ ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype,
+ NULL, "%s", "Power-on");
+ if (ret)
+ goto fail_create_attr;
+
+- ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
+- if (ret)
+- goto fail_create_attr;
+-
+ if (tlmi_priv.opcode_support) {
+ tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
+ ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype,
+@@ -1532,29 +1509,17 @@ static int tlmi_sysfs_init(void)
+ if (ret)
+ goto fail_create_attr;
+
+- ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
+- if (ret)
+- goto fail_create_attr;
+-
+ tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
+ ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype,
+ NULL, "%s", "HDD");
+ if (ret)
+ goto fail_create_attr;
+
+- ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
+- if (ret)
+- goto fail_create_attr;
+-
+ tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
+ ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype,
+ NULL, "%s", "NVMe");
+ if (ret)
+ goto fail_create_attr;
+-
+- ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
+- if (ret)
+- goto fail_create_attr;
+ }
+
+ return ret;
iommu-vt-d-assign-devtlb-cache-tag-on-ats-enablement.patch
powercap-intel_rapl-do-not-change-clamping-bit-if-enable-bit-cannot-be-changed.patch
riscv-cpu_ops_sbi-use-static-array-for-boot_data.patch
+platform-x86-think-lmi-create-ksets-consecutively.patch
+platform-x86-think-lmi-fix-kobject-cleanup.patch
+platform-x86-think-lmi-fix-sysfs-group-cleanup.patch
+usb-typec-displayport-fix-potential-deadlock.patch
--- /dev/null
+From 099cf1fbb8afc3771f408109f62bdec66f85160e Mon Sep 17 00:00:00 2001
+From: Andrei Kuchynski <akuchynski@chromium.org>
+Date: Tue, 24 Jun 2025 13:32:46 +0000
+Subject: usb: typec: displayport: Fix potential deadlock
+
+From: Andrei Kuchynski <akuchynski@chromium.org>
+
+commit 099cf1fbb8afc3771f408109f62bdec66f85160e upstream.
+
+The deadlock can occur due to a recursive lock acquisition of
+`cros_typec_altmode_data::mutex`.
+The call chain is as follows:
+1. cros_typec_altmode_work() acquires the mutex
+2. typec_altmode_vdm() -> dp_altmode_vdm() ->
+3. typec_altmode_exit() -> cros_typec_altmode_exit()
+4. cros_typec_altmode_exit() attempts to acquire the mutex again
+
+To prevent this, defer the `typec_altmode_exit()` call by scheduling
+it rather than calling it directly from within the mutex-protected
+context.
+
+Cc: stable <stable@kernel.org>
+Fixes: b4b38ffb38c9 ("usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode")
+Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250624133246.3936737-1-akuchynski@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/altmodes/displayport.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -394,8 +394,7 @@ static int dp_altmode_vdm(struct typec_a
+ case CMDT_RSP_NAK:
+ switch (cmd) {
+ case DP_CMD_STATUS_UPDATE:
+- if (typec_altmode_exit(alt))
+- dev_err(&dp->alt->dev, "Exit Mode Failed!\n");
++ dp->state = DP_STATE_EXIT;
+ break;
+ case DP_CMD_CONFIGURE:
+ dp->data.conf = 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
