From: Greg Kroah-Hartman Date: Thu, 9 Jul 2026 17:42:19 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a61bd8da486111a2e87a341850cbd51c6c9ab55c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch acpi-nfit-core-fix-possible-null-pointer-dereference.patch loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch --- diff --git a/queue-6.6/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch b/queue-6.6/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch new file mode 100644 index 0000000000..1882ebce2e --- /dev/null +++ b/queue-6.6/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch @@ -0,0 +1,81 @@ +From 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Mon, 1 Jun 2026 18:58:08 -0500 +Subject: ACPI: CPPC: Suppress UBSAN warning caused by field misuse + +From: Jeremy Linton + +commit 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 upstream. + +The definition of reg->access_width changes depending on the +reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses +access_width to indicate the PCC region, which can result in a UBSAN +if the value is greater than 4. + +For example: + + UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 + shift exponent 32 is too large for 32-bit type 'int' + CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) + Hardware name: To be filled by O.E.M. + Call trace: + ...(trimming) + ubsan_epilogue+0x10/0x48 + __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 + cpc_write+0x4d0/0x670 + cppc_set_perf+0x18c/0x490 + cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq] + ... (trimming) + +Lets fix this by validating the region type, as well as whether +access_width has a value. Then since we are returning bit_width +directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting +the size. + +Fixes: 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses") +Signed-off-by: Jeremy Linton +Tested-by: Jarred White +Reviewed-by: Jarred White +Reviewed-by: Easwar Hariharan +Cc: All applicable +Link: https://patch.msgid.link/20260601235808.1113137-1-jeremy.linton@arm.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/cppc_acpi.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -171,8 +171,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_ + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf); + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); + +-/* Check for valid access_width, otherwise, fallback to using bit_width */ +-#define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width) ++/* ++ * PCC reuses the access_width field as the subspace id, so only decode access ++ * size for non-PCC registers. Otherwise, use the bit_width. ++ */ ++#define GET_BIT_WIDTH(reg) (((reg)->access_width && \ ++ (reg)->space_id != ACPI_ADR_SPACE_PLATFORM_COMM) ? \ ++ (8 << ((reg)->access_width - 1)) : (reg)->bit_width) + + /* Shift and apply the mask for CPC reads/writes */ + #define MASK_VAL_READ(reg, val) (((val) >> (reg)->bit_offset) & \ +@@ -1033,7 +1038,6 @@ static int cpc_read(int cpu, struct cpc_ + * by the bit width field; the access size is used to indicate + * the PCC subspace id. + */ +- size = reg->bit_width; + vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id); + } + else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) +@@ -1105,7 +1109,6 @@ static int cpc_write(int cpu, struct cpc + * by the bit width field; the access size is used to indicate + * the PCC subspace id. + */ +- size = reg->bit_width; + vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id); + } + else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) diff --git a/queue-6.6/acpi-nfit-core-fix-possible-null-pointer-dereference.patch b/queue-6.6/acpi-nfit-core-fix-possible-null-pointer-dereference.patch new file mode 100644 index 0000000000..de91c5554b --- /dev/null +++ b/queue-6.6/acpi-nfit-core-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,43 @@ +From 027e128abb82788189d6d45b68e3e8e7329b67be Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 3 Jun 2026 19:56:21 +0200 +Subject: ACPI: NFIT: core: Fix possible NULL pointer dereference + +From: Rafael J. Wysocki + +commit 027e128abb82788189d6d45b68e3e8e7329b67be upstream. + +After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before +getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler +for the NFIT device before checking the presence of the NFIT table. If +that table is not there, 0 is returned without allocating the acpi_desc +object and setting the driver data pointer of the NFIT device. If the +platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification +on the NFIT device at that point, acpi_nfit_uc_error_notify() will +dereference a NULL pointer. + +Prevent that from occurring by adding an acpi_desc check against NULL +to acpi_nfit_uc_error_notify(). + +Fixes: 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table") +Signed-off-by: Rafael J. Wysocki +Cc: All applicable +Reviewed-by: Dave Jiang +Link: https://patch.msgid.link/2418508.ElGaqSPkdT@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/nfit/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3453,6 +3453,9 @@ static void acpi_nfit_uc_error_notify(st + { + struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(dev); + ++ if (!acpi_desc) ++ return; ++ + if (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON) + acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG); + else diff --git a/queue-6.6/loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch b/queue-6.6/loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch new file mode 100644 index 0000000000..e7001e5df4 --- /dev/null +++ b/queue-6.6/loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch @@ -0,0 +1,107 @@ +From 6061e65f95713b01f4313cda6637dfe3aa5412b4 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Thu, 25 Jun 2026 13:03:47 +0800 +Subject: LoongArch: Add PIO for early access before ACPI PCI root register + +From: Huacai Chen + +commit 6061e65f95713b01f4313cda6637dfe3aa5412b4 upstream. + +For ACPI system we suppose the ISA/LPC PIO range is registered together +with PCI root bridge. But the fact is there may be some early access to +the ISA/LPC PIO range before ACPI PCI root register (most of them are +due to abnormal BIOS). Unconditionally register the ISA/LPC PIO range +usually causes ACPI PCI root register fail because of the address range +confliction. So we add a pair of helpers: acpi_add_early_pio() to add +PIO for early access, and acpi_remove_early_pio() to remove PIO before +PCI root register. Since acpi_remove_early_pio() may be called multiple +times, we add an acpi_pio flag to ensure PIO be removed only once. + +Cc: +Tested-by: Yuanzhen Gan +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/include/asm/acpi.h | 2 ++ + arch/loongarch/kernel/acpi.c | 28 ++++++++++++++++++++++++++++ + arch/loongarch/kernel/setup.c | 2 ++ + arch/loongarch/pci/acpi.c | 2 ++ + 4 files changed, 34 insertions(+) + +--- a/arch/loongarch/include/asm/acpi.h ++++ b/arch/loongarch/include/asm/acpi.h +@@ -37,6 +37,8 @@ static inline bool acpi_has_cpu_in_madt( + extern struct list_head acpi_wakeup_device_list; + extern struct acpi_madt_core_pic acpi_core_pic[MAX_CORE_PIC]; + ++extern void acpi_add_early_pio(void); ++extern void acpi_remove_early_pio(void); + extern int __init parse_acpi_topology(void); + + static inline u32 get_acpi_id_for_cpu(unsigned int cpu) +--- a/arch/loongarch/kernel/acpi.c ++++ b/arch/loongarch/kernel/acpi.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -57,6 +58,33 @@ void __iomem *acpi_os_ioremap(acpi_physi + return ioremap_cache(phys, size); + } + ++#define PIO_BASE (unsigned long)PCI_IOBASE ++#define PIO_SIZE ALIGN(ISA_IOSIZE, PAGE_SIZE) ++ ++static bool acpi_pio; ++ ++/* Add PIO for early access */ ++void acpi_add_early_pio(void) ++{ ++ if (!acpi_disabled) { ++ acpi_pio = true; ++ vmap_page_range(PIO_BASE, PIO_BASE + PIO_SIZE, ++ LOONGSON_LIO_BASE, pgprot_device(PAGE_KERNEL)); ++ } ++} ++ ++/* Remove PIO for PCI register */ ++void acpi_remove_early_pio(void) ++{ ++ if (!acpi_pio) ++ return; ++ ++ if (!acpi_disabled) { ++ acpi_pio = false; ++ vunmap_range(PIO_BASE, PIO_BASE + PIO_SIZE); ++ } ++} ++ + #ifdef CONFIG_SMP + static int set_processor_mask(u32 id, u32 flags) + { +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -530,6 +530,8 @@ static __init int arch_reserve_pio_range + { + struct device_node *np; + ++ acpi_add_early_pio(); ++ + for_each_node_by_name(np, "isa") { + struct of_range range; + struct of_range_parser parser; +--- a/arch/loongarch/pci/acpi.c ++++ b/arch/loongarch/pci/acpi.c +@@ -65,6 +65,8 @@ static int acpi_prepare_root_resources(s + struct resource_entry *entry, *tmp; + struct acpi_device *device = ci->bridge; + ++ acpi_remove_early_pio(); ++ + status = acpi_pci_probe_root_resources(ci); + if (status > 0) { + acpi_evaluate_integer(device->handle, "PCIH", NULL, &pci_h); diff --git a/queue-6.6/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch b/queue-6.6/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch new file mode 100644 index 0000000000..6cc7296814 --- /dev/null +++ b/queue-6.6/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch @@ -0,0 +1,54 @@ +From 191f49f1e38b1c10eb44b0f967c6175c884ef7db Mon Sep 17 00:00:00 2001 +From: Alice Ryhl +Date: Tue, 16 Jun 2026 12:30:38 +0000 +Subject: rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER + +From: Alice Ryhl + +commit 191f49f1e38b1c10eb44b0f967c6175c884ef7db upstream. + +Due to a rustc bug, the -Cforce-frame-pointers=y flag only emits the +frame-pointer annotation for functions, but not for the module. This +means that functions generated by the LLVM backend such as +'asan.module_ctor' do not receive the frame-pointer annotation. + +This is likely to lead to broken backtraces and may also cause issues +with ftrace if these features are used with functions generated by the +LLVM backend. + +Thus, use -Zllvm_module_flag to work around this rustc bug if using a +rustc without the fix. + +[ The fix [1] has landed for Rust 1.98.0 (expected release on + 2026-08-20). - Miguel ] + +Cc: stable@vger.kernel.org # 6.12.y and later (flag not available in pinned Rust in older LTSs). +Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") +Link: https://github.com/rust-lang/rust/pull/156980 [1] +Signed-off-by: Alice Ryhl +Link: https://patch.msgid.link/20260616-frame-ptr-fix-v1-1-dc6b29a631d9@google.com +[ - Adjusted Cc: stable@ as discussed. +Signed-off-by: Greg Kroah-Hartman + + - Added comment with link to the PR, similar to what we did in commit + ac35b5580ace ("rust: arm64: set uwtable llvm module flag for + CONFIG_UNWIND_TABLES"). + + - Miguel ] +Signed-off-by: Miguel Ojeda +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/Makefile ++++ b/Makefile +@@ -857,6 +857,9 @@ KBUILD_RUSTFLAGS += $(KBUILD_RUSTFLAGS-y + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + KBUILD_RUSTFLAGS += -Cforce-frame-pointers=y ++# Work around rustc bug on compilers without ++# https://github.com/rust-lang/rust/pull/156980. ++KBUILD_RUSTFLAGS += $(if $(call rustc-min-version,109800),,-Zllvm_module_flag=frame-pointer:u32:2:max) + else + # Some targets (ARM with Thumb2, for example), can't be built with frame + # pointers. For those, we don't have FUNCTION_TRACER automatically diff --git a/queue-6.6/series b/queue-6.6/series index ecaba6b88e..ee3ea4180a 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -58,3 +58,7 @@ xfs-use-xfs_defer_finish_one-to-finish-recovered-wor.patch xfs-move-iop_recover-to-xfs_defer_op_type.patch bluetooth-iso-copy-base-if-service-data-matches-eir_.patch perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch +acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch +acpi-nfit-core-fix-possible-null-pointer-dereference.patch +loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch +rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch