From: Greg Kroah-Hartman Date: Tue, 8 Jul 2025 15:20:35 +0000 (+0200) Subject: 6.15-stable patches X-Git-Tag: v5.15.187~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e5a080340ae666a5907bd7b51b97afb6c20e565;p=thirdparty%2Fkernel%2Fstable-queue.git 6.15-stable patches added patches: platform-x86-think-lmi-create-ksets-consecutively.patch platform-x86-think-lmi-fix-kobject-cleanup.patch platform-x86-think-lmi-fix-sysfs-group-cleanup.patch usb-typec-displayport-fix-potential-deadlock.patch --- diff --git a/queue-6.15/platform-x86-think-lmi-create-ksets-consecutively.patch b/queue-6.15/platform-x86-think-lmi-create-ksets-consecutively.patch new file mode 100644 index 0000000000..09de20ef37 --- /dev/null +++ b/queue-6.15/platform-x86-think-lmi-create-ksets-consecutively.patch @@ -0,0 +1,58 @@ +From 8dab34ca77293b409c3223636dde915a22656748 Mon Sep 17 00:00:00 2001 +From: Kurt Borja +Date: Mon, 30 Jun 2025 14:31:19 -0300 +Subject: platform/x86: think-lmi: Create ksets consecutively +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kurt Borja + +commit 8dab34ca77293b409c3223636dde915a22656748 upstream. + +Avoid entering tlmi_release_attr() in error paths if both ksets are not +yet created. + +This is accomplished by initializing them side by side. + +Reviewed-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Cc: stable@vger.kernel.org +Signed-off-by: Kurt Borja +Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-1-ce4f81c9c481@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/think-lmi.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1455,6 +1455,14 @@ static int tlmi_sysfs_init(void) + goto fail_device_created; + } + ++ tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, ++ &tlmi_priv.class_dev->kobj); ++ if (!tlmi_priv.authentication_kset) { ++ kset_unregister(tlmi_priv.attribute_kset); ++ ret = -ENOMEM; ++ goto fail_device_created; ++ } ++ + for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { + /* Check if index is a valid setting - skip if it isn't */ + if (!tlmi_priv.setting[i]) +@@ -1496,12 +1504,6 @@ static int tlmi_sysfs_init(void) + } + + /* Create authentication entries */ +- tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, +- &tlmi_priv.class_dev->kobj); +- if (!tlmi_priv.authentication_kset) { +- ret = -ENOMEM; +- goto fail_create_attr; +- } + tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; + ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); + if (ret) diff --git a/queue-6.15/platform-x86-think-lmi-fix-kobject-cleanup.patch b/queue-6.15/platform-x86-think-lmi-fix-kobject-cleanup.patch new file mode 100644 index 0000000000..a5560785e3 --- /dev/null +++ b/queue-6.15/platform-x86-think-lmi-fix-kobject-cleanup.patch @@ -0,0 +1,160 @@ +From 9110056fe10b0519529bdbbac37311a5037ea0c2 Mon Sep 17 00:00:00 2001 +From: Kurt Borja +Date: Mon, 30 Jun 2025 14:31:20 -0300 +Subject: platform/x86: think-lmi: Fix kobject cleanup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kurt Borja + +commit 9110056fe10b0519529bdbbac37311a5037ea0c2 upstream. + +In tlmi_analyze(), allocated structs with an embedded kobject are freed +in error paths after the they were already initialized. + +Fix this by first by avoiding the initialization of kobjects in +tlmi_analyze() and then by correctly cleaning them up in +tlmi_release_attr() using their kset's kobject list. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Fixes: 30e78435d3bf ("platform/x86: think-lmi: Split kobject_init() and kobject_add() calls") +Cc: stable@vger.kernel.org +Reviewed-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Signed-off-by: Kurt Borja +Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-2-ce4f81c9c481@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/think-lmi.c | 35 +++++++++++++++++++---------------- + 1 file changed, 19 insertions(+), 16 deletions(-) + +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1380,13 +1380,13 @@ static struct kobj_attribute debug_cmd = + /* ---- Initialisation --------------------------------------------------------- */ + static void tlmi_release_attr(void) + { ++ struct kobject *pos, *n; + int i; + + /* Attribute structures */ + for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { + if (tlmi_priv.setting[i]) { + sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); +- kobject_put(&tlmi_priv.setting[i]->kobj); + } + } + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); +@@ -1395,6 +1395,9 @@ static void tlmi_release_attr(void) + if (tlmi_priv.can_debug_cmd && debug_support) + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); + ++ list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry) ++ kobject_put(pos); ++ + kset_unregister(tlmi_priv.attribute_kset); + + /* Free up any saved signatures */ +@@ -1403,19 +1406,17 @@ static void tlmi_release_attr(void) + + /* Authentication structures */ + sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_admin->kobj); + sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_power->kobj); + + if (tlmi_priv.opcode_support) { + sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_system->kobj); + sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_hdd->kobj); + sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_nvme->kobj); + } + ++ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry) ++ kobject_put(pos); ++ + kset_unregister(tlmi_priv.authentication_kset); + } + +@@ -1479,8 +1480,8 @@ static int tlmi_sysfs_init(void) + + /* Build attribute */ + tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset; +- ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL, +- "%s", tlmi_priv.setting[i]->display_name); ++ ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype, ++ NULL, "%s", tlmi_priv.setting[i]->display_name); + if (ret) + goto fail_create_attr; + +@@ -1505,7 +1506,8 @@ static int tlmi_sysfs_init(void) + + /* Create authentication entries */ + tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "Admin"); + if (ret) + goto fail_create_attr; + +@@ -1514,7 +1516,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "Power-on"); + if (ret) + goto fail_create_attr; + +@@ -1524,7 +1527,8 @@ static int tlmi_sysfs_init(void) + + if (tlmi_priv.opcode_support) { + tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "System"); + if (ret) + goto fail_create_attr; + +@@ -1533,7 +1537,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "HDD"); + if (ret) + goto fail_create_attr; + +@@ -1542,7 +1547,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "NVMe"); + if (ret) + goto fail_create_attr; + +@@ -1579,8 +1585,6 @@ static struct tlmi_pwd_setting *tlmi_cre + new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length; + new_pwd->index = 0; + +- kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype); +- + return new_pwd; + } + +@@ -1685,7 +1689,6 @@ static int tlmi_analyze(struct wmi_devic + if (setting->possible_values) + strreplace(setting->possible_values, ',', ';'); + +- kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); + tlmi_priv.setting[i] = setting; + kfree(item); + } diff --git a/queue-6.15/platform-x86-think-lmi-fix-sysfs-group-cleanup.patch b/queue-6.15/platform-x86-think-lmi-fix-sysfs-group-cleanup.patch new file mode 100644 index 0000000000..6eb72ac1ab --- /dev/null +++ b/queue-6.15/platform-x86-think-lmi-fix-sysfs-group-cleanup.patch @@ -0,0 +1,155 @@ +From 4f30f946f27b7f044cf8f3f1f353dee1dcd3517a Mon Sep 17 00:00:00 2001 +From: Kurt Borja +Date: Mon, 30 Jun 2025 14:31:21 -0300 +Subject: platform/x86: think-lmi: Fix sysfs group cleanup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kurt Borja + +commit 4f30f946f27b7f044cf8f3f1f353dee1dcd3517a upstream. + +Many error paths in tlmi_sysfs_init() lead to sysfs groups being removed +when they were not even created. + +Fix this by letting the kobject core manage these groups through their +kobj_type's defult_groups. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Cc: stable@vger.kernel.org +Reviewed-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Signed-off-by: Kurt Borja +Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-3-ce4f81c9c481@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/think-lmi.c | 43 +++------------------------------------ + 1 file changed, 4 insertions(+), 39 deletions(-) + +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -973,6 +973,7 @@ static const struct attribute_group auth + .is_visible = auth_attr_is_visible, + .attrs = auth_attrs, + }; ++__ATTRIBUTE_GROUPS(auth_attr); + + /* ---- Attributes sysfs --------------------------------------------------------- */ + static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr, +@@ -1188,6 +1189,7 @@ static const struct attribute_group tlmi + .is_visible = attr_is_visible, + .attrs = tlmi_attrs, + }; ++__ATTRIBUTE_GROUPS(tlmi_attr); + + static void tlmi_attr_setting_release(struct kobject *kobj) + { +@@ -1207,11 +1209,13 @@ static void tlmi_pwd_setting_release(str + static const struct kobj_type tlmi_attr_setting_ktype = { + .release = &tlmi_attr_setting_release, + .sysfs_ops = &kobj_sysfs_ops, ++ .default_groups = tlmi_attr_groups, + }; + + static const struct kobj_type tlmi_pwd_setting_ktype = { + .release = &tlmi_pwd_setting_release, + .sysfs_ops = &kobj_sysfs_ops, ++ .default_groups = auth_attr_groups, + }; + + static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr, +@@ -1381,14 +1385,8 @@ static struct kobj_attribute debug_cmd = + static void tlmi_release_attr(void) + { + struct kobject *pos, *n; +- int i; + + /* Attribute structures */ +- for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { +- if (tlmi_priv.setting[i]) { +- sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); +- } +- } + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr); + +@@ -1405,15 +1403,6 @@ static void tlmi_release_attr(void) + kfree(tlmi_priv.pwd_admin->save_signature); + + /* Authentication structures */ +- sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); +- sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); +- +- if (tlmi_priv.opcode_support) { +- sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); +- sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); +- sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); +- } +- + list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry) + kobject_put(pos); + +@@ -1484,10 +1473,6 @@ static int tlmi_sysfs_init(void) + NULL, "%s", tlmi_priv.setting[i]->display_name); + if (ret) + goto fail_create_attr; +- +- ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); +- if (ret) +- goto fail_create_attr; + } + + ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); +@@ -1511,20 +1496,12 @@ static int tlmi_sysfs_init(void) + if (ret) + goto fail_create_attr; + +- ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); +- if (ret) +- goto fail_create_attr; +- + tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; + ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype, + NULL, "%s", "Power-on"); + if (ret) + goto fail_create_attr; + +- ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); +- if (ret) +- goto fail_create_attr; +- + if (tlmi_priv.opcode_support) { + tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; + ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype, +@@ -1532,29 +1509,17 @@ static int tlmi_sysfs_init(void) + if (ret) + goto fail_create_attr; + +- ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); +- if (ret) +- goto fail_create_attr; +- + tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; + ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype, + NULL, "%s", "HDD"); + if (ret) + goto fail_create_attr; + +- ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); +- if (ret) +- goto fail_create_attr; +- + tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; + ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype, + NULL, "%s", "NVMe"); + if (ret) + goto fail_create_attr; +- +- ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); +- if (ret) +- goto fail_create_attr; + } + + return ret; diff --git a/queue-6.15/series b/queue-6.15/series index 343404703e..180456a7a2 100644 --- a/queue-6.15/series +++ b/queue-6.15/series @@ -165,3 +165,7 @@ iommu-rockchip-prevent-iommus-dead-loop-when-two-masters-share-one-iommu.patch iommu-vt-d-assign-devtlb-cache-tag-on-ats-enablement.patch powercap-intel_rapl-do-not-change-clamping-bit-if-enable-bit-cannot-be-changed.patch riscv-cpu_ops_sbi-use-static-array-for-boot_data.patch +platform-x86-think-lmi-create-ksets-consecutively.patch +platform-x86-think-lmi-fix-kobject-cleanup.patch +platform-x86-think-lmi-fix-sysfs-group-cleanup.patch +usb-typec-displayport-fix-potential-deadlock.patch diff --git a/queue-6.15/usb-typec-displayport-fix-potential-deadlock.patch b/queue-6.15/usb-typec-displayport-fix-potential-deadlock.patch new file mode 100644 index 0000000000..fc1f1f8825 --- /dev/null +++ b/queue-6.15/usb-typec-displayport-fix-potential-deadlock.patch @@ -0,0 +1,43 @@ +From 099cf1fbb8afc3771f408109f62bdec66f85160e Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski +Date: Tue, 24 Jun 2025 13:32:46 +0000 +Subject: usb: typec: displayport: Fix potential deadlock + +From: Andrei Kuchynski + +commit 099cf1fbb8afc3771f408109f62bdec66f85160e upstream. + +The deadlock can occur due to a recursive lock acquisition of +`cros_typec_altmode_data::mutex`. +The call chain is as follows: +1. cros_typec_altmode_work() acquires the mutex +2. typec_altmode_vdm() -> dp_altmode_vdm() -> +3. typec_altmode_exit() -> cros_typec_altmode_exit() +4. cros_typec_altmode_exit() attempts to acquire the mutex again + +To prevent this, defer the `typec_altmode_exit()` call by scheduling +it rather than calling it directly from within the mutex-protected +context. + +Cc: stable +Fixes: b4b38ffb38c9 ("usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode") +Signed-off-by: Andrei Kuchynski +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250624133246.3936737-1-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -394,8 +394,7 @@ static int dp_altmode_vdm(struct typec_a + case CMDT_RSP_NAK: + switch (cmd) { + case DP_CMD_STATUS_UPDATE: +- if (typec_altmode_exit(alt)) +- dev_err(&dp->alt->dev, "Exit Mode Failed!\n"); ++ dp->state = DP_STATE_EXIT; + break; + case DP_CMD_CONFIGURE: + dp->data.conf = 0;