--- /dev/null
+From 8dab34ca77293b409c3223636dde915a22656748 Mon Sep 17 00:00:00 2001
+From: Kurt Borja <kuurtb@gmail.com>
+Date: Mon, 30 Jun 2025 14:31:19 -0300
+Subject: platform/x86: think-lmi: Create ksets consecutively
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kurt Borja <kuurtb@gmail.com>
+
+commit 8dab34ca77293b409c3223636dde915a22656748 upstream.
+
+Avoid entering tlmi_release_attr() in error paths if both ksets are not
+yet created.
+
+This is accomplished by initializing them side by side.
+
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kurt Borja <kuurtb@gmail.com>
+Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-1-ce4f81c9c481@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/think-lmi.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -1285,6 +1285,14 @@ static int tlmi_sysfs_init(void)
+ goto fail_device_created;
+ }
+
++ tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
++ &tlmi_priv.class_dev->kobj);
++ if (!tlmi_priv.authentication_kset) {
++ kset_unregister(tlmi_priv.attribute_kset);
++ ret = -ENOMEM;
++ goto fail_device_created;
++ }
++
+ for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
+ /* Check if index is a valid setting - skip if it isn't */
+ if (!tlmi_priv.setting[i])
+@@ -1322,12 +1330,6 @@ static int tlmi_sysfs_init(void)
+ }
+
+ /* Create authentication entries */
+- tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
+- &tlmi_priv.class_dev->kobj);
+- if (!tlmi_priv.authentication_kset) {
+- ret = -ENOMEM;
+- goto fail_create_attr;
+- }
+ tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
+ ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");
+ if (ret)
--- /dev/null
+From 9110056fe10b0519529bdbbac37311a5037ea0c2 Mon Sep 17 00:00:00 2001
+From: Kurt Borja <kuurtb@gmail.com>
+Date: Mon, 30 Jun 2025 14:31:20 -0300
+Subject: platform/x86: think-lmi: Fix kobject cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kurt Borja <kuurtb@gmail.com>
+
+commit 9110056fe10b0519529bdbbac37311a5037ea0c2 upstream.
+
+In tlmi_analyze(), allocated structs with an embedded kobject are freed
+in error paths after the they were already initialized.
+
+Fix this by first by avoiding the initialization of kobjects in
+tlmi_analyze() and then by correctly cleaning them up in
+tlmi_release_attr() using their kset's kobject list.
+
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Fixes: 30e78435d3bf ("platform/x86: think-lmi: Split kobject_init() and kobject_add() calls")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Kurt Borja <kuurtb@gmail.com>
+Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-2-ce4f81c9c481@gmail.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/think-lmi.c | 35 +++++++++++++++++++----------------
+ 1 file changed, 19 insertions(+), 16 deletions(-)
+
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -1208,19 +1208,22 @@ static struct kobj_attribute debug_cmd =
+ /* ---- Initialisation --------------------------------------------------------- */
+ static void tlmi_release_attr(void)
+ {
++ struct kobject *pos, *n;
+ int i;
+
+ /* Attribute structures */
+ for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
+ if (tlmi_priv.setting[i]) {
+ sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
+- kobject_put(&tlmi_priv.setting[i]->kobj);
+ }
+ }
+ sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
+ if (tlmi_priv.can_debug_cmd && debug_support)
+ sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
+
++ list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry)
++ kobject_put(pos);
++
+ kset_unregister(tlmi_priv.attribute_kset);
+
+ /* Free up any saved signatures */
+@@ -1229,19 +1232,17 @@ static void tlmi_release_attr(void)
+
+ /* Authentication structures */
+ sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_admin->kobj);
+ sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_power->kobj);
+
+ if (tlmi_priv.opcode_support) {
+ sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_system->kobj);
+ sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_hdd->kobj);
+ sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
+- kobject_put(&tlmi_priv.pwd_nvme->kobj);
+ }
+
++ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry)
++ kobject_put(pos);
++
+ kset_unregister(tlmi_priv.authentication_kset);
+ }
+
+@@ -1309,8 +1310,8 @@ static int tlmi_sysfs_init(void)
+
+ /* Build attribute */
+ tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;
+- ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL,
+- "%s", tlmi_priv.setting[i]->display_name);
++ ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype,
++ NULL, "%s", tlmi_priv.setting[i]->display_name);
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1331,7 +1332,8 @@ static int tlmi_sysfs_init(void)
+
+ /* Create authentication entries */
+ tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "Admin");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1340,7 +1342,8 @@ static int tlmi_sysfs_init(void)
+ goto fail_create_attr;
+
+ tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "Power-on");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1350,7 +1353,8 @@ static int tlmi_sysfs_init(void)
+
+ if (tlmi_priv.opcode_support) {
+ tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "System");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1359,7 +1363,8 @@ static int tlmi_sysfs_init(void)
+ goto fail_create_attr;
+
+ tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "HDD");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1368,7 +1373,8 @@ static int tlmi_sysfs_init(void)
+ goto fail_create_attr;
+
+ tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
+- ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe");
++ ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype,
++ NULL, "%s", "NVMe");
+ if (ret)
+ goto fail_create_attr;
+
+@@ -1406,8 +1412,6 @@ static struct tlmi_pwd_setting *tlmi_cre
+ new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;
+ new_pwd->index = 0;
+
+- kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype);
+-
+ return new_pwd;
+ }
+
+@@ -1512,7 +1516,6 @@ static int tlmi_analyze(void)
+ if (setting->possible_values)
+ strreplace(setting->possible_values, ',', ';');
+
+- kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
+ tlmi_priv.setting[i] = setting;
+ kfree(item);
+ }
--- /dev/null
+From 099cf1fbb8afc3771f408109f62bdec66f85160e Mon Sep 17 00:00:00 2001
+From: Andrei Kuchynski <akuchynski@chromium.org>
+Date: Tue, 24 Jun 2025 13:32:46 +0000
+Subject: usb: typec: displayport: Fix potential deadlock
+
+From: Andrei Kuchynski <akuchynski@chromium.org>
+
+commit 099cf1fbb8afc3771f408109f62bdec66f85160e upstream.
+
+The deadlock can occur due to a recursive lock acquisition of
+`cros_typec_altmode_data::mutex`.
+The call chain is as follows:
+1. cros_typec_altmode_work() acquires the mutex
+2. typec_altmode_vdm() -> dp_altmode_vdm() ->
+3. typec_altmode_exit() -> cros_typec_altmode_exit()
+4. cros_typec_altmode_exit() attempts to acquire the mutex again
+
+To prevent this, defer the `typec_altmode_exit()` call by scheduling
+it rather than calling it directly from within the mutex-protected
+context.
+
+Cc: stable <stable@kernel.org>
+Fixes: b4b38ffb38c9 ("usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode")
+Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250624133246.3936737-1-akuchynski@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/altmodes/displayport.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -321,8 +321,7 @@ static int dp_altmode_vdm(struct typec_a
+ case CMDT_RSP_NAK:
+ switch (cmd) {
+ case DP_CMD_STATUS_UPDATE:
+- if (typec_altmode_exit(alt))
+- dev_err(&dp->alt->dev, "Exit Mode Failed!\n");
++ dp->state = DP_STATE_EXIT;
+ break;
+ case DP_CMD_CONFIGURE:
+ dp->data.conf = 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
