From: Greg Kroah-Hartman Date: Mon, 13 Jul 2026 13:15:10 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b233d6194a9306b4a09ff7b7461d72cf6910ec73;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: usb-typec-tcpci_rt1711h-unregister-tcpci-port-with-devres.patch usb-xhci-fix-sleep-in-atomic-context-in-xhci_free_streams.patch --- diff --git a/queue-6.12/series b/queue-6.12/series index ee12e20d15..b5108762ae 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -96,3 +96,5 @@ bluetooth-btusb-fix-use-after-free-on-marvell-probe-failure.patch bluetooth-btusb-fix-wakeup-source-leak-on-probe-failure.patch binder-fix-uaf-in-binder_thread_release.patch binder-fix-uaf-in-binder_free_transaction.patch +usb-xhci-fix-sleep-in-atomic-context-in-xhci_free_streams.patch +usb-typec-tcpci_rt1711h-unregister-tcpci-port-with-devres.patch diff --git a/queue-6.12/usb-typec-tcpci_rt1711h-unregister-tcpci-port-with-devres.patch b/queue-6.12/usb-typec-tcpci_rt1711h-unregister-tcpci-port-with-devres.patch new file mode 100644 index 0000000000..7858172934 --- /dev/null +++ b/queue-6.12/usb-typec-tcpci_rt1711h-unregister-tcpci-port-with-devres.patch @@ -0,0 +1,77 @@ +From e8da46d99d3710106e7c44db14566bf9b57386b5 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Mon, 6 Jul 2026 23:53:12 +0900 +Subject: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres + +From: Myeonghun Pak + +commit e8da46d99d3710106e7c44db14566bf9b57386b5 upstream. + +rt1711h_probe() registers the TCPCI port before requesting the interrupt +and enabling alert interrupts. If either of those later steps fails, the +probe function returns without unregistering the TCPCI port. The explicit +unregister currently only happens from the remove callback. + +Register a devres action immediately after tcpci_register_port() succeeds, +so tcpci_unregister_port() runs on later probe failures and on driver +detach. Drop the remove callback to avoid unregistering the same port +twice. + +This issue was identified during our ongoing static-analysis research while +reviewing kernel code. + +Fixes: 302c570bf36e ("usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs") +Cc: stable +Co-developed-by: Ijae Kim +Signed-off-by: Ijae Kim +Signed-off-by: Myeonghun Pak +Link: https://patch.msgid.link/20260706145312.37260-1-mhun512@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c ++++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c +@@ -330,6 +330,8 @@ static int rt1711h_check_revision(struct + return ret; + } + ++static void rt1711h_unregister_tcpci_port(void *tcpci); ++ + static int rt1711h_probe(struct i2c_client *client) + { + int ret; +@@ -381,6 +383,10 @@ static int rt1711h_probe(struct i2c_clie + if (IS_ERR_OR_NULL(chip->tcpci)) + return PTR_ERR(chip->tcpci); + ++ ret = devm_add_action_or_reset(chip->dev, rt1711h_unregister_tcpci_port, chip->tcpci); ++ if (ret) ++ return ret; ++ + ret = devm_request_threaded_irq(chip->dev, client->irq, NULL, + rt1711h_irq, + IRQF_ONESHOT | IRQF_TRIGGER_LOW, +@@ -398,11 +404,9 @@ static int rt1711h_probe(struct i2c_clie + return 0; + } + +-static void rt1711h_remove(struct i2c_client *client) ++static void rt1711h_unregister_tcpci_port(void *tcpci) + { +- struct rt1711h_chip *chip = i2c_get_clientdata(client); +- +- tcpci_unregister_port(chip->tcpci); ++ tcpci_unregister_port(tcpci); + } + + static const struct rt1711h_chip_info rt1711h = { +@@ -435,7 +439,6 @@ static struct i2c_driver rt1711h_i2c_dri + .of_match_table = rt1711h_of_match, + }, + .probe = rt1711h_probe, +- .remove = rt1711h_remove, + .id_table = rt1711h_id, + }; + module_i2c_driver(rt1711h_i2c_driver); diff --git a/queue-6.12/usb-xhci-fix-sleep-in-atomic-context-in-xhci_free_streams.patch b/queue-6.12/usb-xhci-fix-sleep-in-atomic-context-in-xhci_free_streams.patch new file mode 100644 index 0000000000..542164092f --- /dev/null +++ b/queue-6.12/usb-xhci-fix-sleep-in-atomic-context-in-xhci_free_streams.patch @@ -0,0 +1,86 @@ +From 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=E8=83=A1=E8=BF=9E=E5=8B=A4?= +Date: Fri, 3 Jul 2026 17:40:33 +0300 +Subject: usb: xhci: Fix sleep in atomic context in xhci_free_streams() + +From: 胡连勤 + +commit 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a upstream. + +When a USB device with active stream endpoints is disconnected, +xhci_free_streams() is called from the hub_event workqueue to +free the stream resources. It calls xhci_free_stream_info() +while holding xhci->lock with irqs disabled. + +xhci_free_stream_info() invokes xhci_free_stream_ctx(), which +calls dma_free_coherent() for large stream context arrays. + +dma_free_coherent() can sleep (e.g. via vunmap), triggering +a BUG when called from atomic context. + +Call trace: + dma_free_attrs+0x174/0x220 + xhci_free_stream_info+0xd0/0x11c + xhci_free_streams+0x278/0x37c + usb_free_streams+0x98/0xc0 + usb_unbind_interface+0x1b8/0x2f8 + device_release_driver_internal+0x1d4/0x2cc + device_release_driver+0x18/0x28 + bus_remove_device+0x160/0x1a4 + device_del+0x1ec/0x350 + usb_disable_device+0x98/0x214 + usb_disconnect+0xf0/0x35c + hub_event+0xab4/0x19ec + process_one_work+0x278/0x63c + +Fix this by saving the stream_info pointers and clearing the +ep references under the lock, then calling xhci_free_stream_info() +outside the lock where sleeping is allowed. + +Fixes: 8df75f42f8e6 ("USB: xhci: Add memory allocation for USB3 bulk streams.") +Cc: stable +Signed-off-by: Lianqin Hu +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20260703144033.483286-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3576,6 +3576,7 @@ static int xhci_free_streams(struct usb_ + struct xhci_virt_device *vdev; + struct xhci_command *command; + struct xhci_input_control_ctx *ctrl_ctx; ++ struct xhci_stream_info *stream_info[EP_CTX_PER_DEV]; + unsigned int ep_index; + unsigned long flags; + u32 changed_ep_bitmask; +@@ -3636,10 +3637,15 @@ static int xhci_free_streams(struct usb_ + if (ret < 0) + return ret; + ++ /* ++ * dma_free_coherent() called by xhci_free_stream_info() may sleep, ++ * so save stream_info pointers and clear references under lock, ++ * then free the memory outside lock. ++ */ + spin_lock_irqsave(&xhci->lock, flags); + for (i = 0; i < num_eps; i++) { + ep_index = xhci_get_endpoint_index(&eps[i]->desc); +- xhci_free_stream_info(xhci, vdev->eps[ep_index].stream_info); ++ stream_info[i] = vdev->eps[ep_index].stream_info; + vdev->eps[ep_index].stream_info = NULL; + /* FIXME Unset maxPstreams in endpoint context and + * update deq ptr to point to normal string ring. +@@ -3649,6 +3655,9 @@ static int xhci_free_streams(struct usb_ + } + spin_unlock_irqrestore(&xhci->lock, flags); + ++ for (i = 0; i < num_eps; i++) ++ xhci_free_stream_info(xhci, stream_info[i]); ++ + return 0; + } +