From: Greg Kroah-Hartman Date: Fri, 22 Aug 2025 15:08:35 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.16.3~33 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6a5347a41683e91dfa59daa957da36a82d73c24c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-realtek-add-support-for-hp-elitebook-x360-830-g6-and-elitebook-830-g6.patch memstick-fix-deadlock-by-moving-removing-flag-earlier.patch mmc-sdhci-pci-gli-gl9763e-rename-the-gli_set_gl9763e-for-consistency.patch squashfs-fix-memory-leak-in-squashfs_fill_super.patch --- diff --git a/queue-5.10/alsa-hda-realtek-add-support-for-hp-elitebook-x360-830-g6-and-elitebook-830-g6.patch b/queue-5.10/alsa-hda-realtek-add-support-for-hp-elitebook-x360-830-g6-and-elitebook-830-g6.patch new file mode 100644 index 0000000000..c03fa553cc --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-support-for-hp-elitebook-x360-830-g6-and-elitebook-830-g6.patch @@ -0,0 +1,33 @@ +From eafae0fdd115a71b3a200ef1a31f86da04bac77f Mon Sep 17 00:00:00 2001 +From: Evgeniy Harchenko +Date: Fri, 15 Aug 2025 12:58:14 +0300 +Subject: ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 + +From: Evgeniy Harchenko + +commit eafae0fdd115a71b3a200ef1a31f86da04bac77f upstream. + +The HP EliteBook x360 830 G6 and HP EliteBook 830 G6 have +Realtek HDA codec ALC215. It needs the ALC285_FIXUP_HP_GPIO_LED +quirk to enable the mute LED. + +Cc: +Signed-off-by: Evgeniy Harchenko +Link: https://patch.msgid.link/20250815095814.75845-1-evgeniyharchenko.dev@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9256,6 +9256,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), + SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8548, "HP EliteBook x360 830 G6", ALC285_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x854a, "HP EliteBook 830 G6", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x85c6, "HP Pavilion x360 Convertible 14-dy1xxx", ALC295_FIXUP_HP_MUTE_LED_COEFBIT11), + SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360), + SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT), diff --git a/queue-5.10/memstick-fix-deadlock-by-moving-removing-flag-earlier.patch b/queue-5.10/memstick-fix-deadlock-by-moving-removing-flag-earlier.patch new file mode 100644 index 0000000000..34574dbb15 --- /dev/null +++ b/queue-5.10/memstick-fix-deadlock-by-moving-removing-flag-earlier.patch @@ -0,0 +1,80 @@ +From 99d7ab8db9d8230b243f5ed20ba0229e54cc0dfa Mon Sep 17 00:00:00 2001 +From: Jiayi Li +Date: Mon, 4 Aug 2025 09:36:04 +0800 +Subject: memstick: Fix deadlock by moving removing flag earlier + +From: Jiayi Li + +commit 99d7ab8db9d8230b243f5ed20ba0229e54cc0dfa upstream. + +The existing memstick core patch: commit 62c59a8786e6 ("memstick: Skip +allocating card when removing host") sets host->removing in +memstick_remove_host(),but still exists a critical time window where +memstick_check can run after host->eject is set but before removing is set. + +In the rtsx_usb_ms driver, the problematic sequence is: + +rtsx_usb_ms_drv_remove: memstick_check: + host->eject = true + cancel_work_sync(handle_req) if(!host->removing) + ... memstick_alloc_card() + memstick_set_rw_addr() + memstick_new_req() + rtsx_usb_ms_request() + if(!host->eject) + skip schedule_work + wait_for_completion() + memstick_remove_host: [blocks indefinitely] + host->removing = true + flush_workqueue() + [block] + +1. rtsx_usb_ms_drv_remove sets host->eject = true +2. cancel_work_sync(&host->handle_req) runs +3. memstick_check work may be executed here <-- danger window +4. memstick_remove_host sets removing = 1 + +During this window (step 3), memstick_check calls memstick_alloc_card, +which may indefinitely waiting for mrq_complete completion that will +never occur because rtsx_usb_ms_request sees eject=true and skips +scheduling work, memstick_set_rw_addr waits forever for completion. + +This causes a deadlock when memstick_remove_host tries to flush_workqueue, +waiting for memstick_check to complete, while memstick_check is blocked +waiting for mrq_complete completion. + +Fix this by setting removing=true at the start of rtsx_usb_ms_drv_remove, +before any work cancellation. This ensures memstick_check will see the +removing flag immediately and exit early, avoiding the deadlock. + +Fixes: 62c59a8786e6 ("memstick: Skip allocating card when removing host") +Signed-off-by: Jiayi Li +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250804013604.1311218-1-lijiayi@kylinos.cn +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memstick/core/memstick.c | 1 - + drivers/memstick/host/rtsx_usb_ms.c | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/memstick/core/memstick.c ++++ b/drivers/memstick/core/memstick.c +@@ -550,7 +550,6 @@ EXPORT_SYMBOL(memstick_add_host); + */ + void memstick_remove_host(struct memstick_host *host) + { +- host->removing = 1; + flush_workqueue(workqueue); + mutex_lock(&host->lock); + if (host->card) +--- a/drivers/memstick/host/rtsx_usb_ms.c ++++ b/drivers/memstick/host/rtsx_usb_ms.c +@@ -812,6 +812,7 @@ static int rtsx_usb_ms_drv_remove(struct + int err; + + host->eject = true; ++ msh->removing = true; + cancel_work_sync(&host->handle_req); + cancel_delayed_work_sync(&host->poll_card); + diff --git a/queue-5.10/mmc-sdhci-pci-gli-gl9763e-rename-the-gli_set_gl9763e-for-consistency.patch b/queue-5.10/mmc-sdhci-pci-gli-gl9763e-rename-the-gli_set_gl9763e-for-consistency.patch new file mode 100644 index 0000000000..9688079d75 --- /dev/null +++ b/queue-5.10/mmc-sdhci-pci-gli-gl9763e-rename-the-gli_set_gl9763e-for-consistency.patch @@ -0,0 +1,43 @@ +From 293ed0f5f34e1e9df888456af4b0a021f57b5f54 Mon Sep 17 00:00:00 2001 +From: Victor Shih +Date: Thu, 31 Jul 2025 14:57:51 +0800 +Subject: mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency + +From: Victor Shih + +commit 293ed0f5f34e1e9df888456af4b0a021f57b5f54 upstream. + +In preparation to fix replay timer timeout, rename the +gli_set_gl9763e() to gl9763e_hw_setting() for consistency. + +Signed-off-by: Victor Shih +Fixes: 1ae1d2d6e555 ("mmc: sdhci-pci-gli: Add Genesys Logic GL9763E support") +Cc: stable@vger.kernel.org +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250731065752.450231-3-victorshihgli@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-gli.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -755,7 +755,7 @@ static void sdhci_gl9763e_reset(struct s + sdhci_reset(host, mask); + } + +-static void gli_set_gl9763e(struct sdhci_pci_slot *slot) ++static void gl9763e_hw_setting(struct sdhci_pci_slot *slot) + { + struct pci_dev *pdev = slot->chip->pdev; + u32 value; +@@ -797,7 +797,7 @@ static int gli_probe_slot_gl9763e(struct + gli_pcie_enable_msi(slot); + host->mmc_host_ops.hs400_enhanced_strobe = + gl9763e_hs400_enhanced_strobe; +- gli_set_gl9763e(slot); ++ gl9763e_hw_setting(slot); + sdhci_enable_v4_mode(host); + + return 0; diff --git a/queue-5.10/series b/queue-5.10/series index 6df4f99dc4..1b7ae307a3 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -390,3 +390,7 @@ sch_hfsc-make-hfsc_qlen_notify-idempotent.patch sch_qfq-make-qfq_qlen_notify-idempotent.patch codel-remove-sch-q.qlen-check-before-qdisc_tree_reduce_backlog.patch sch_htb-make-htb_deactivate-idempotent.patch +memstick-fix-deadlock-by-moving-removing-flag-earlier.patch +mmc-sdhci-pci-gli-gl9763e-rename-the-gli_set_gl9763e-for-consistency.patch +squashfs-fix-memory-leak-in-squashfs_fill_super.patch +alsa-hda-realtek-add-support-for-hp-elitebook-x360-830-g6-and-elitebook-830-g6.patch diff --git a/queue-5.10/squashfs-fix-memory-leak-in-squashfs_fill_super.patch b/queue-5.10/squashfs-fix-memory-leak-in-squashfs_fill_super.patch new file mode 100644 index 0000000000..80880ad6ff --- /dev/null +++ b/queue-5.10/squashfs-fix-memory-leak-in-squashfs_fill_super.patch @@ -0,0 +1,60 @@ +From b64700d41bdc4e9f82f1346c15a3678ebb91a89c Mon Sep 17 00:00:00 2001 +From: Phillip Lougher +Date: Mon, 11 Aug 2025 23:37:40 +0100 +Subject: squashfs: fix memory leak in squashfs_fill_super + +From: Phillip Lougher + +commit b64700d41bdc4e9f82f1346c15a3678ebb91a89c upstream. + +If sb_min_blocksize returns 0, squashfs_fill_super exits without freeing +allocated memory (sb->s_fs_info). + +Fix this by moving the call to sb_min_blocksize to before memory is +allocated. + +Link: https://lkml.kernel.org/r/20250811223740.110392-1-phillip@squashfs.org.uk +Fixes: 734aa85390ea ("Squashfs: check return result of sb_min_blocksize") +Signed-off-by: Phillip Lougher +Reported-by: Scott GUO +Closes: https://lore.kernel.org/all/20250811061921.3807353-1-scott_gzh@163.com +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/squashfs/super.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/fs/squashfs/super.c ++++ b/fs/squashfs/super.c +@@ -74,10 +74,15 @@ static int squashfs_fill_super(struct su + unsigned short flags; + unsigned int fragments; + u64 lookup_table_start, xattr_id_table_start, next_table; +- int err; ++ int err, devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); + + TRACE("Entered squashfs_fill_superblock\n"); + ++ if (!devblksize) { ++ errorf(fc, "squashfs: unable to set blocksize\n"); ++ return -EINVAL; ++ } ++ + sb->s_fs_info = kzalloc(sizeof(*msblk), GFP_KERNEL); + if (sb->s_fs_info == NULL) { + ERROR("Failed to allocate squashfs_sb_info\n"); +@@ -85,12 +90,7 @@ static int squashfs_fill_super(struct su + } + msblk = sb->s_fs_info; + +- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); +- if (!msblk->devblksize) { +- errorf(fc, "squashfs: unable to set blocksize\n"); +- return -EINVAL; +- } +- ++ msblk->devblksize = devblksize; + msblk->devblksize_log2 = ffz(~msblk->devblksize); + + mutex_init(&msblk->meta_index_mutex);