From: Greg Kroah-Hartman Date: Sun, 24 Aug 2025 08:17:55 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.297~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=29d66e51baaeb8139683f3543d95b743e3d5d104;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: acpi-processor-idle-check-acpi_fetch_acpi_dev-return-value.patch pci-acpi-fix-runtime-pm-ref-imbalance-on-hot-plug-capable-ports.patch --- diff --git a/queue-5.4/acpi-processor-idle-check-acpi_fetch_acpi_dev-return-value.patch b/queue-5.4/acpi-processor-idle-check-acpi_fetch_acpi_dev-return-value.patch new file mode 100644 index 0000000000..8a7d18744f --- /dev/null +++ b/queue-5.4/acpi-processor-idle-check-acpi_fetch_acpi_dev-return-value.patch @@ -0,0 +1,37 @@ +From 2437513a814b3e93bd02879740a8a06e52e2cf7d Mon Sep 17 00:00:00 2001 +From: Li Zhong +Date: Fri, 2 Sep 2022 00:37:30 -0700 +Subject: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value + +From: Li Zhong + +commit 2437513a814b3e93bd02879740a8a06e52e2cf7d upstream. + +The return value of acpi_fetch_acpi_dev() could be NULL, which would +cause a NULL pointer dereference to occur in acpi_device_hid(). + +Signed-off-by: Li Zhong +[ rjw: Subject and changelog edits, added empty line after if () ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Teddy Astie +Signed-off-by: Yann Sionneau +Reported-by: Dillon C +Tested-by: Dillon C +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/processor_idle.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1228,7 +1228,9 @@ static int acpi_processor_get_lpi_info(s + + status = acpi_get_parent(handle, &pr_ahandle); + while (ACPI_SUCCESS(status)) { +- acpi_bus_get_device(pr_ahandle, &d); ++ if (acpi_bus_get_device(pr_ahandle, &d)) ++ break; ++ + handle = pr_ahandle; + + if (strcmp(acpi_device_hid(d), ACPI_PROCESSOR_CONTAINER_HID)) diff --git a/queue-5.4/pci-acpi-fix-runtime-pm-ref-imbalance-on-hot-plug-capable-ports.patch b/queue-5.4/pci-acpi-fix-runtime-pm-ref-imbalance-on-hot-plug-capable-ports.patch new file mode 100644 index 0000000000..dfa944144d --- /dev/null +++ b/queue-5.4/pci-acpi-fix-runtime-pm-ref-imbalance-on-hot-plug-capable-ports.patch @@ -0,0 +1,122 @@ +From 6cff20ce3b92ffbf2fc5eb9e5a030b3672aa414a Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 13 Jul 2025 16:31:01 +0200 +Subject: PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports + +From: Lukas Wunner + +commit 6cff20ce3b92ffbf2fc5eb9e5a030b3672aa414a upstream. + +pci_bridge_d3_possible() is called from both pcie_portdrv_probe() and +pcie_portdrv_remove() to determine whether runtime power management shall +be enabled (on probe) or disabled (on remove) on a PCIe port. + +The underlying assumption is that pci_bridge_d3_possible() always returns +the same value, else a runtime PM reference imbalance would occur. That +assumption is not given if the PCIe port is inaccessible on remove due to +hot-unplug: pci_bridge_d3_possible() calls pciehp_is_native(), which +accesses Config Space to determine whether the port is Hot-Plug Capable. +An inaccessible port returns "all ones", which is converted to "all +zeroes" by pcie_capability_read_dword(). Hence the port no longer seems +Hot-Plug Capable on remove even though it was on probe. + +The resulting runtime PM ref imbalance causes warning messages such as: + + pcieport 0000:02:04.0: Runtime PM usage count underflow! + +Avoid the Config Space access (and thus the runtime PM ref imbalance) by +caching the Hot-Plug Capable bit in struct pci_dev. + +The struct already contains an "is_hotplug_bridge" flag, which however is +not only set on Hot-Plug Capable PCIe ports, but also Conventional PCI +Hot-Plug bridges and ACPI slots. The flag identifies bridges which are +allocated additional MMIO and bus number resources to allow for hierarchy +expansion. + +The kernel is somewhat sloppily using "is_hotplug_bridge" in a number of +places to identify Hot-Plug Capable PCIe ports, even though the flag +encompasses other devices. Subsequent commits replace these occurrences +with the new flag to clearly delineate Hot-Plug Capable PCIe ports from +other kinds of hotplug bridges. + +Document the existing "is_hotplug_bridge" and the new "is_pciehp" flag +and document the (non-obvious) requirement that pci_bridge_d3_possible() +always returns the same value across the entire lifetime of a bridge, +including its hot-removal. + +Fixes: 5352a44a561d ("PCI: pciehp: Make pciehp_is_native() stricter") +Reported-by: Laurent Bigonville +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220216 +Reported-by: Mario Limonciello +Closes: https://lore.kernel.org/r/20250609020223.269407-3-superm1@kernel.org/ +Link: https://lore.kernel.org/all/20250620025535.3425049-3-superm1@kernel.org/T/#u +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Acked-by: Rafael J. Wysocki +Cc: stable@vger.kernel.org # v4.18+ +Link: https://patch.msgid.link/fe5dcc3b2e62ee1df7905d746bde161eb1b3291c.1752390101.git.lukas@wunner.de +[ Adjust surrounding documentation changes ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci-acpi.c | 4 +--- + drivers/pci/pci.c | 8 ++++++-- + drivers/pci/probe.c | 2 +- + include/linux/pci.h | 1 + + 4 files changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -791,13 +791,11 @@ int pci_acpi_program_hp_params(struct pc + bool pciehp_is_native(struct pci_dev *bridge) + { + const struct pci_host_bridge *host; +- u32 slot_cap; + + if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE)) + return false; + +- pcie_capability_read_dword(bridge, PCI_EXP_SLTCAP, &slot_cap); +- if (!(slot_cap & PCI_EXP_SLTCAP_HPC)) ++ if (!bridge->is_pciehp) + return false; + + if (pcie_ports_native) +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2646,8 +2646,12 @@ static const struct dmi_system_id bridge + * pci_bridge_d3_possible - Is it possible to put the bridge into D3 + * @bridge: Bridge to check + * +- * This function checks if it is possible to move the bridge to D3. +- * Currently we only allow D3 for recent enough PCIe ports and Thunderbolt. ++ * Currently we only allow D3 for some PCIe ports and for Thunderbolt. ++ * ++ * Return: Whether it is possible to move the bridge to D3. ++ * ++ * The return value is guaranteed to be constant across the entire lifetime ++ * of the bridge, including its hot-removal. + */ + bool pci_bridge_d3_possible(struct pci_dev *bridge) + { +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1479,7 +1479,7 @@ void set_pcie_hotplug_bridge(struct pci_ + + pcie_capability_read_dword(pdev, PCI_EXP_SLTCAP, ®32); + if (reg32 & PCI_EXP_SLTCAP_HPC) +- pdev->is_hotplug_bridge = 1; ++ pdev->is_hotplug_bridge = pdev->is_pciehp = 1; + } + + static void set_pcie_thunderbolt(struct pci_dev *dev) +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -415,6 +415,7 @@ struct pci_dev { + unsigned int is_virtfn:1; + unsigned int reset_fn:1; + unsigned int is_hotplug_bridge:1; ++ unsigned int is_pciehp:1; + unsigned int shpc_managed:1; /* SHPC owned by shpchp */ + unsigned int is_thunderbolt:1; /* Thunderbolt controller */ + /* diff --git a/queue-5.4/series b/queue-5.4/series index dda78e405f..de9674c76d 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -328,3 +328,5 @@ kbuild-add-clang_flags-to-kbuild_cppflags.patch kbuild-add-kbuild_cppflags-to-as-option-invocation.patch comedi-fix-initialization-of-data-for-instructions-that-write-to-subdevice.patch comedi-fail-comedi_insnlist-ioctl-if-n_insns-is-too-large.patch +acpi-processor-idle-check-acpi_fetch_acpi_dev-return-value.patch +pci-acpi-fix-runtime-pm-ref-imbalance-on-hot-plug-capable-ports.patch