From c41331d3e586e1f4882b8cfec0d86a4b34bc26b6 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 8 Jul 2025 17:20:15 +0200 Subject: [PATCH] 6.1-stable patches added patches: platform-x86-think-lmi-create-ksets-consecutively.patch platform-x86-think-lmi-fix-kobject-cleanup.patch usb-typec-displayport-fix-potential-deadlock.patch --- ...think-lmi-create-ksets-consecutively.patch | 58 +++++++ ...rm-x86-think-lmi-fix-kobject-cleanup.patch | 159 ++++++++++++++++++ queue-6.1/series | 3 + ...c-displayport-fix-potential-deadlock.patch | 43 +++++ 4 files changed, 263 insertions(+) create mode 100644 queue-6.1/platform-x86-think-lmi-create-ksets-consecutively.patch create mode 100644 queue-6.1/platform-x86-think-lmi-fix-kobject-cleanup.patch create mode 100644 queue-6.1/usb-typec-displayport-fix-potential-deadlock.patch diff --git a/queue-6.1/platform-x86-think-lmi-create-ksets-consecutively.patch b/queue-6.1/platform-x86-think-lmi-create-ksets-consecutively.patch new file mode 100644 index 0000000000..5dfd5ce725 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-create-ksets-consecutively.patch @@ -0,0 +1,58 @@ +From 8dab34ca77293b409c3223636dde915a22656748 Mon Sep 17 00:00:00 2001 +From: Kurt Borja +Date: Mon, 30 Jun 2025 14:31:19 -0300 +Subject: platform/x86: think-lmi: Create ksets consecutively +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kurt Borja + +commit 8dab34ca77293b409c3223636dde915a22656748 upstream. + +Avoid entering tlmi_release_attr() in error paths if both ksets are not +yet created. + +This is accomplished by initializing them side by side. + +Reviewed-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Cc: stable@vger.kernel.org +Signed-off-by: Kurt Borja +Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-1-ce4f81c9c481@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/think-lmi.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1285,6 +1285,14 @@ static int tlmi_sysfs_init(void) + goto fail_device_created; + } + ++ tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, ++ &tlmi_priv.class_dev->kobj); ++ if (!tlmi_priv.authentication_kset) { ++ kset_unregister(tlmi_priv.attribute_kset); ++ ret = -ENOMEM; ++ goto fail_device_created; ++ } ++ + for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { + /* Check if index is a valid setting - skip if it isn't */ + if (!tlmi_priv.setting[i]) +@@ -1322,12 +1330,6 @@ static int tlmi_sysfs_init(void) + } + + /* Create authentication entries */ +- tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, +- &tlmi_priv.class_dev->kobj); +- if (!tlmi_priv.authentication_kset) { +- ret = -ENOMEM; +- goto fail_create_attr; +- } + tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; + ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); + if (ret) diff --git a/queue-6.1/platform-x86-think-lmi-fix-kobject-cleanup.patch b/queue-6.1/platform-x86-think-lmi-fix-kobject-cleanup.patch new file mode 100644 index 0000000000..2ffd39a3b4 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-fix-kobject-cleanup.patch @@ -0,0 +1,159 @@ +From 9110056fe10b0519529bdbbac37311a5037ea0c2 Mon Sep 17 00:00:00 2001 +From: Kurt Borja +Date: Mon, 30 Jun 2025 14:31:20 -0300 +Subject: platform/x86: think-lmi: Fix kobject cleanup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kurt Borja + +commit 9110056fe10b0519529bdbbac37311a5037ea0c2 upstream. + +In tlmi_analyze(), allocated structs with an embedded kobject are freed +in error paths after the they were already initialized. + +Fix this by first by avoiding the initialization of kobjects in +tlmi_analyze() and then by correctly cleaning them up in +tlmi_release_attr() using their kset's kobject list. + +Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") +Fixes: 30e78435d3bf ("platform/x86: think-lmi: Split kobject_init() and kobject_add() calls") +Cc: stable@vger.kernel.org +Reviewed-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Signed-off-by: Kurt Borja +Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-2-ce4f81c9c481@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/think-lmi.c | 35 +++++++++++++++++++---------------- + 1 file changed, 19 insertions(+), 16 deletions(-) + +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -1208,19 +1208,22 @@ static struct kobj_attribute debug_cmd = + /* ---- Initialisation --------------------------------------------------------- */ + static void tlmi_release_attr(void) + { ++ struct kobject *pos, *n; + int i; + + /* Attribute structures */ + for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { + if (tlmi_priv.setting[i]) { + sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); +- kobject_put(&tlmi_priv.setting[i]->kobj); + } + } + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); + if (tlmi_priv.can_debug_cmd && debug_support) + sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); + ++ list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry) ++ kobject_put(pos); ++ + kset_unregister(tlmi_priv.attribute_kset); + + /* Free up any saved signatures */ +@@ -1229,19 +1232,17 @@ static void tlmi_release_attr(void) + + /* Authentication structures */ + sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_admin->kobj); + sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_power->kobj); + + if (tlmi_priv.opcode_support) { + sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_system->kobj); + sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_hdd->kobj); + sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); +- kobject_put(&tlmi_priv.pwd_nvme->kobj); + } + ++ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry) ++ kobject_put(pos); ++ + kset_unregister(tlmi_priv.authentication_kset); + } + +@@ -1309,8 +1310,8 @@ static int tlmi_sysfs_init(void) + + /* Build attribute */ + tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset; +- ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL, +- "%s", tlmi_priv.setting[i]->display_name); ++ ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype, ++ NULL, "%s", tlmi_priv.setting[i]->display_name); + if (ret) + goto fail_create_attr; + +@@ -1331,7 +1332,8 @@ static int tlmi_sysfs_init(void) + + /* Create authentication entries */ + tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "Admin"); + if (ret) + goto fail_create_attr; + +@@ -1340,7 +1342,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "Power-on"); + if (ret) + goto fail_create_attr; + +@@ -1350,7 +1353,8 @@ static int tlmi_sysfs_init(void) + + if (tlmi_priv.opcode_support) { + tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "System"); + if (ret) + goto fail_create_attr; + +@@ -1359,7 +1363,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "HDD"); + if (ret) + goto fail_create_attr; + +@@ -1368,7 +1373,8 @@ static int tlmi_sysfs_init(void) + goto fail_create_attr; + + tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; +- ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe"); ++ ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype, ++ NULL, "%s", "NVMe"); + if (ret) + goto fail_create_attr; + +@@ -1406,8 +1412,6 @@ static struct tlmi_pwd_setting *tlmi_cre + new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length; + new_pwd->index = 0; + +- kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype); +- + return new_pwd; + } + +@@ -1512,7 +1516,6 @@ static int tlmi_analyze(void) + if (setting->possible_values) + strreplace(setting->possible_values, ',', ';'); + +- kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); + tlmi_priv.setting[i] = setting; + kfree(item); + } diff --git a/queue-6.1/series b/queue-6.1/series index 8d5b77e582..cf35a9dc15 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -72,3 +72,6 @@ usb-cdnsp-do-not-disable-slot-for-disabled-slot.patch dma-buf-fix-timeout-handling-in-dma_resv_wait_timeout-v2.patch i2c-designware-fix-an-initialization-issue.patch logitech-c-270-even-more-broken.patch +platform-x86-think-lmi-create-ksets-consecutively.patch +platform-x86-think-lmi-fix-kobject-cleanup.patch +usb-typec-displayport-fix-potential-deadlock.patch diff --git a/queue-6.1/usb-typec-displayport-fix-potential-deadlock.patch b/queue-6.1/usb-typec-displayport-fix-potential-deadlock.patch new file mode 100644 index 0000000000..2d36b45969 --- /dev/null +++ b/queue-6.1/usb-typec-displayport-fix-potential-deadlock.patch @@ -0,0 +1,43 @@ +From 099cf1fbb8afc3771f408109f62bdec66f85160e Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski +Date: Tue, 24 Jun 2025 13:32:46 +0000 +Subject: usb: typec: displayport: Fix potential deadlock + +From: Andrei Kuchynski + +commit 099cf1fbb8afc3771f408109f62bdec66f85160e upstream. + +The deadlock can occur due to a recursive lock acquisition of +`cros_typec_altmode_data::mutex`. +The call chain is as follows: +1. cros_typec_altmode_work() acquires the mutex +2. typec_altmode_vdm() -> dp_altmode_vdm() -> +3. typec_altmode_exit() -> cros_typec_altmode_exit() +4. cros_typec_altmode_exit() attempts to acquire the mutex again + +To prevent this, defer the `typec_altmode_exit()` call by scheduling +it rather than calling it directly from within the mutex-protected +context. + +Cc: stable +Fixes: b4b38ffb38c9 ("usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode") +Signed-off-by: Andrei Kuchynski +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250624133246.3936737-1-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -321,8 +321,7 @@ static int dp_altmode_vdm(struct typec_a + case CMDT_RSP_NAK: + switch (cmd) { + case DP_CMD_STATUS_UPDATE: +- if (typec_altmode_exit(alt)) +- dev_err(&dp->alt->dev, "Exit Mode Failed!\n"); ++ dp->state = DP_STATE_EXIT; + break; + case DP_CMD_CONFIGURE: + dp->data.conf = 0; -- 2.47.2