From 0d38fe24361d39612ca0c45fb7ff169f7cfdf4a0 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Oct 2025 11:11:12 +0200 Subject: [PATCH] 5.15-stable patches added patches: firmware-meson_sm-fix-device-leak-at-probe.patch media-i2c-mt9v111-fix-incorrect-type-for-ret.patch xen-events-cleanup-find_virq-return-codes.patch xen-manage-fix-suspend-error-path.patch --- ...re-meson_sm-fix-device-leak-at-probe.patch | 49 +++++++++++++++++ ...c-mt9v111-fix-incorrect-type-for-ret.patch | 41 ++++++++++++++ queue-5.15/series | 4 ++ ...vents-cleanup-find_virq-return-codes.patch | 55 +++++++++++++++++++ .../xen-manage-fix-suspend-error-path.patch | 54 ++++++++++++++++++ 5 files changed, 203 insertions(+) create mode 100644 queue-5.15/firmware-meson_sm-fix-device-leak-at-probe.patch create mode 100644 queue-5.15/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch create mode 100644 queue-5.15/xen-events-cleanup-find_virq-return-codes.patch create mode 100644 queue-5.15/xen-manage-fix-suspend-error-path.patch diff --git a/queue-5.15/firmware-meson_sm-fix-device-leak-at-probe.patch b/queue-5.15/firmware-meson_sm-fix-device-leak-at-probe.patch new file mode 100644 index 0000000000..821d8e4dc9 --- /dev/null +++ b/queue-5.15/firmware-meson_sm-fix-device-leak-at-probe.patch @@ -0,0 +1,49 @@ +From 8ece3173f87df03935906d0c612c2aeda9db92ca Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 25 Jul 2025 09:40:19 +0200 +Subject: firmware: meson_sm: fix device leak at probe + +From: Johan Hovold + +commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream. + +Make sure to drop the reference to the secure monitor device taken by +of_find_device_by_node() when looking up its driver data on behalf of +other drivers (e.g. during probe). + +Note that holding a reference to the platform device does not prevent +its driver data from going away so there is no point in keeping the +reference after the helper returns. + +Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver") +Cc: stable@vger.kernel.org # 5.5 +Cc: Carlo Caione +Signed-off-by: Johan Hovold +Acked-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725074019.8765-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/meson/meson_sm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/firmware/meson/meson_sm.c ++++ b/drivers/firmware/meson/meson_sm.c +@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write); + struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node) + { + struct platform_device *pdev = of_find_device_by_node(sm_node); ++ struct meson_sm_firmware *fw; + + if (!pdev) + return NULL; + +- return platform_get_drvdata(pdev); ++ fw = platform_get_drvdata(pdev); ++ ++ put_device(&pdev->dev); ++ ++ return fw; + } + EXPORT_SYMBOL_GPL(meson_sm_get); + diff --git a/queue-5.15/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch b/queue-5.15/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..099b9dabaa --- /dev/null +++ b/queue-5.15/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From bacd713145443dce7764bb2967d30832a95e5ec8 Mon Sep 17 00:00:00 2001 +From: Qianfeng Rong +Date: Wed, 27 Aug 2025 20:39:10 +0800 +Subject: media: i2c: mt9v111: fix incorrect type for ret + +From: Qianfeng Rong + +commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream. + +Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() +to store negative error codes or zero returned by __mt9v111_hw_reset() +and other functions. + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: aab7ed1c3927 ("media: i2c: Add driver for Aptina MT9V111") +Cc: stable@vger.kernel.org +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/mt9v111.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/mt9v111.c ++++ b/drivers/media/i2c/mt9v111.c +@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(struc + static int mt9v111_hw_config(struct mt9v111_dev *mt9v111) + { + struct i2c_client *c = mt9v111->client; +- unsigned int ret; + u16 outfmtctrl2; ++ int ret; + + /* Force device reset. */ + ret = __mt9v111_hw_reset(mt9v111); diff --git a/queue-5.15/series b/queue-5.15/series index 01a9dc9e9a..1754061566 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -168,3 +168,7 @@ acpi-debug-fix-signedness-issues-in-read-write-helpers.patch arm64-dts-qcom-msm8916-add-missing-mdss-reset.patch arm64-kprobes-call-set_memory_rox-for-kprobe-page.patch arm-omap2-pm33xx-core-ix-device-node-reference-leaks-in-amx3_idle_init.patch +xen-events-cleanup-find_virq-return-codes.patch +xen-manage-fix-suspend-error-path.patch +firmware-meson_sm-fix-device-leak-at-probe.patch +media-i2c-mt9v111-fix-incorrect-type-for-ret.patch diff --git a/queue-5.15/xen-events-cleanup-find_virq-return-codes.patch b/queue-5.15/xen-events-cleanup-find_virq-return-codes.patch new file mode 100644 index 0000000000..3babea96d4 --- /dev/null +++ b/queue-5.15/xen-events-cleanup-find_virq-return-codes.patch @@ -0,0 +1,55 @@ +From 08df2d7dd4ab2db8a172d824cda7872d5eca460a Mon Sep 17 00:00:00 2001 +From: Jason Andryuk +Date: Wed, 27 Aug 2025 20:36:01 -0400 +Subject: xen/events: Cleanup find_virq() return codes + +From: Jason Andryuk + +commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream. + +rc is overwritten by the evtchn_status hypercall in each iteration, so +the return value will be whatever the last iteration is. This could +incorrectly return success even if the event channel was not found. +Change to an explicit -ENOENT for an un-found virq and return 0 on a +successful match. + +Fixes: 62cc5fc7b2e0 ("xen/pv-on-hvm kexec: rebind virqs to existing eventchannel ports") +Cc: stable@vger.kernel.org +Signed-off-by: Jason Andryuk +Reviewed-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20250828003604.8949-2-jason.andryuk@amd.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/events/events_base.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -1331,10 +1331,11 @@ static int find_virq(unsigned int virq, + { + struct evtchn_status status; + evtchn_port_t port; +- int rc = -ENOENT; + + memset(&status, 0, sizeof(status)); + for (port = 0; port < xen_evtchn_max_channels(); port++) { ++ int rc; ++ + status.dom = DOMID_SELF; + status.port = port; + rc = HYPERVISOR_event_channel_op(EVTCHNOP_status, &status); +@@ -1344,10 +1345,10 @@ static int find_virq(unsigned int virq, + continue; + if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) { + *evtchn = port; +- break; ++ return 0; + } + } +- return rc; ++ return -ENOENT; + } + + /** diff --git a/queue-5.15/xen-manage-fix-suspend-error-path.patch b/queue-5.15/xen-manage-fix-suspend-error-path.patch new file mode 100644 index 0000000000..a9eb44d08a --- /dev/null +++ b/queue-5.15/xen-manage-fix-suspend-error-path.patch @@ -0,0 +1,54 @@ +From f770c3d858687252f1270265ba152d5c622e793f Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Thu, 4 Sep 2025 15:11:09 +0200 +Subject: xen/manage: Fix suspend error path + +From: Lukas Wunner + +commit f770c3d858687252f1270265ba152d5c622e793f upstream. + +The device power management API has the following asymmetry: +* dpm_suspend_start() does not clean up on failure + (it requires a call to dpm_resume_end()) +* dpm_suspend_end() does clean up on failure + (it does not require a call to dpm_resume_start()) + +The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related +patches for 2.6.27") in June 2008: It removed a call to device_resume() +from device_suspend() (which was later renamed to dpm_suspend_start()). + +When Xen began using the device power management API in May 2008 with +commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did +not yet exist. But since it was introduced, a call to dpm_resume_end() +is missing in the error path of dpm_suspend_start(). Fix it. + +Fixes: d8f3de0d2412 ("Suspend-related patches for 2.6.27") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v2.6.27 +Reviewed-by: "Rafael J. Wysocki (Intel)" +Signed-off-by: Juergen Gross +Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/manage.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -116,7 +116,7 @@ static void do_suspend(void) + err = dpm_suspend_start(PMSG_FREEZE); + if (err) { + pr_err("%s: dpm_suspend_start %d\n", __func__, err); +- goto out_thaw; ++ goto out_resume_end; + } + + printk(KERN_DEBUG "suspending xenstore...\n"); +@@ -156,6 +156,7 @@ out_resume: + else + xs_suspend_cancel(); + ++out_resume_end: + dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE); + + out_thaw: -- 2.47.3