6.6-stable patches

added patches:
	drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch
	usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch

diff --git a/queue-6.6/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch b/queue-6.6/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch
new file mode 100644 (file)
index 0000000..6abef88
--- /dev/null
+++ b/queue-6.6/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch
@@ -0,0 +1,32 @@
+From d23bd83f3e47a928e783c0d6a004737519dc77dc Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 21 Apr 2026 09:29:05 +0200
+Subject: drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit d23bd83f3e47a928e783c0d6a004737519dc77dc upstream.
+
+That field already contains the value being assigned. No need to do
+this twice.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in single place")
+Cc: linux-tegra@vger.kernel.org
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patch.msgid.link/20260421073646.144712-2-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tegra/fbdev.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/tegra/fbdev.c
++++ b/drivers/gpu/drm/tegra/fbdev.c
+@@ -105,7 +105,6 @@ static int tegra_fbdev_probe(struct drm_
+       }
+ 
+       helper->fb = fb;
+-      helper->info = info;
+ 
+       info->fbops = &tegra_fb_ops;
+ 

diff --git a/queue-6.6/series b/queue-6.6/series
index 139b78db19732d6620aa0c94ce25a08316b076e9..222305de89caa774af5edcd60552d76abc75974a 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -257,3 +257,5 @@ drm-i915-hdcp-move-to-using-intel_display-in-intel_hdcp.patch
 drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch
 drm-i915-hdcp-check-streams-bounds-before-overflow.patch
 alsa-hda-codecs-hdmi-disable-keep-alive-before-audio-format-change.patch
+drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch
+usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch

diff --git a/queue-6.6/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch b/queue-6.6/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch
new file mode 100644 (file)
index 0000000..ff5ddd1
--- /dev/null
+++ b/queue-6.6/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch
@@ -0,0 +1,47 @@
+From fb0bf289f5d529336ef490c8273e88a8a8b29f69 Mon Sep 17 00:00:00 2001
+From: Andrei Kuchynski <akuchynski@chromium.org>
+Date: Fri, 17 Jul 2026 10:46:14 +0000
+Subject: usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
+
+From: Andrei Kuchynski <akuchynski@chromium.org>
+
+commit fb0bf289f5d529336ef490c8273e88a8a8b29f69 upstream.
+
+The commit 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and
+ordering in port unregistration") consolidated port teardown into the
+ucsi_unregister_port() helper. However, it introduced an ordering problem
+in the ucsi_init() error path.
+
+Fix this by ensuring ucsi_unregister_port() is called before we unregister
+their corresponding lockdep keys.
+
+Cc: stable@vger.kernel.org
+Fixes: 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and ordering in port unregistration")
+Reported-by: "Borah, Chaitanya Kumar" <chaitanya.kumar.borah@intel.com>
+Closes: https://lore.kernel.org/all/22064276-6c56-411a-9f20-6917ceeb865f@intel.com/
+Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
+Tested-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20260717104614.325250-1-akuchynski@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1548,11 +1548,11 @@ static int ucsi_init(struct ucsi *ucsi)
+       return 0;
+ 
+ err_unregister:
++      for (con = connector; con->port; con++)
++              ucsi_unregister_port(con);
+       for (i = 0; i < ucsi->cap.num_connectors; i++)
+               lockdep_unregister_key(&connector[i].lock_key);
+ 
+-      for (con = connector; con->port; con++)
+-              ucsi_unregister_port(con);
+       kfree(connector);
+ err_reset:
+       memset(&ucsi->cap, 0, sizeof(ucsi->cap));