--- /dev/null
+From f5ef65adf81da3dbce4e692e48c1754c0bb95da0 Mon Sep 17 00:00:00 2001
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+Date: Tue, 30 Jun 2026 19:22:21 +0000
+Subject: drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+commit f5ef65adf81da3dbce4e692e48c1754c0bb95da0 upstream.
+
+When CONFIG_DRM_GPUSVM=n (e.g. um-allyesconfig), the only caller of
+xe_pt_svm_userptr_notifier_lock() is compiled out, triggering:
+
+ drivers/gpu/drm/xe/xe_pt.c:1418:13: warning:
+ 'xe_pt_svm_userptr_notifier_lock' defined but not used
+ [-Wunused-function]
+
+The helpers cannot simply be removed in this case: the matching
+xe_pt_svm_userptr_notifier_unlock() is also referenced from
+xe_pt_update_ops_run(), which lives outside any DRM_GPUSVM ifdef and is
+gated only at runtime by pt_update_ops->needs_svm_lock. The symbol must
+exist in all builds.
+
+Provide empty static inline stubs for !DRM_GPUSVM, matching the pattern
+used by xe_svm_notifier_lock()/_unlock() in xe_svm.h.
+
+Fixes: dca6e08c923a ("drm/xe/userptr: Hold notifier_lock for write on inject test path")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202606302210.QqcLbOEN-lkp@intel.com/
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260630192221.2998168-1-shuicheng.lin@intel.com
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+(cherry picked from commit 3359422bf0a1140e96d783a19a397686e580a3ca)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_pt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/xe/xe_pt.c
++++ b/drivers/gpu/drm/xe/xe_pt.c
+@@ -1388,6 +1388,7 @@ static int xe_pt_pre_commit(struct xe_mi
+ pt_update_ops, rftree);
+ }
+
++#if IS_ENABLED(CONFIG_DRM_GPUSVM)
+ /*
+ * Acquire/release the svm notifier_lock around xe_pt_svm_userptr_pre_commit()
+ * and the matching late release in xe_pt_update_ops_run(). Read mode by
+@@ -1414,6 +1415,10 @@ static void xe_pt_svm_userptr_notifier_u
+ xe_svm_notifier_unlock(vm);
+ #endif
+ }
++#else
++static inline void xe_pt_svm_userptr_notifier_lock(struct xe_vm *vm) { }
++static inline void xe_pt_svm_userptr_notifier_unlock(struct xe_vm *vm) { }
++#endif
+
+ #if IS_ENABLED(CONFIG_DRM_GPUSVM)
+ #ifdef CONFIG_DRM_XE_USERPTR_INVAL_INJECT
--- /dev/null
+From 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 Mon Sep 17 00:00:00 2001
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+Date: Tue, 30 Jun 2026 11:09:22 -0400
+Subject: net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
+
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+
+commit 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 upstream.
+
+This is a followup based on sashiko comments [1] on commit e5b811fe7931
+("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
+
+Use plain rcu_read_lock()/spin_lock() in teql_master_xmit() instead of the
+_bh variants, since ndo_start_xmit is already invoked with BH disabled
+by the core stack and the _bh primitives can warn in_hardirq() when xmit
+is reached through netpoll or a softirq xmit path with hard IRQs disabled.
+
+Moves rcu_read_lock() after restart: label + adds rcu_read_unlock() before
+goto restart (fixes the unbounded RCU hold across retries)
+
+[1] https://sashiko.dev/#/patchset/20260628111229.669751-1-jhs%40mojatatu.com
+
+Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF")
+Link: https://patch.msgid.link/20260630150922.238714-1-jhs@mojatatu.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_teql.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+--- a/net/sched/sch_teql.c
++++ b/net/sched/sch_teql.c
+@@ -311,14 +311,14 @@ static netdev_tx_t teql_master_xmit(stru
+ int subq = skb_get_queue_mapping(skb);
+ struct sk_buff *skb_res = NULL;
+
+- rcu_read_lock_bh();
+-
+- start = rcu_dereference_bh(master->slaves);
+-
+ restart:
+ nores = 0;
+ busy = 0;
+
++ rcu_read_lock();
++
++ start = rcu_dereference(master->slaves);
++
+ q = start;
+ if (!q)
+ goto drop;
+@@ -345,17 +345,17 @@ restart:
+ netdev_start_xmit(skb, slave, slave_txq, false) ==
+ NETDEV_TX_OK) {
+ __netif_tx_unlock(slave_txq);
+- spin_lock_bh(&master->slaves_lock);
++ spin_lock(&master->slaves_lock);
+ if (rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock)) == q)
+ rcu_assign_pointer(master->slaves,
+ rcu_dereference_protected(NEXT_SLAVE(q),
+ lockdep_is_held(&master->slaves_lock)));
+- spin_unlock_bh(&master->slaves_lock);
++ spin_unlock(&master->slaves_lock);
+ netif_wake_queue(dev);
+ master->tx_packets++;
+ master->tx_bytes += length;
+- rcu_read_unlock_bh();
++ rcu_read_unlock();
+ return NETDEV_TX_OK;
+ }
+ __netif_tx_unlock(slave_txq);
+@@ -364,37 +364,38 @@ restart:
+ busy = 1;
+ break;
+ case 1:
+- spin_lock_bh(&master->slaves_lock);
++ spin_lock(&master->slaves_lock);
+ if (rcu_dereference_protected(master->slaves,
+ lockdep_is_held(&master->slaves_lock)) == q)
+ rcu_assign_pointer(master->slaves,
+ rcu_dereference_protected(NEXT_SLAVE(q),
+ lockdep_is_held(&master->slaves_lock)));
+- spin_unlock_bh(&master->slaves_lock);
+- rcu_read_unlock_bh();
++ spin_unlock(&master->slaves_lock);
++ rcu_read_unlock();
+ return NETDEV_TX_OK;
+ default:
+ nores = 1;
+ break;
+ }
+ __skb_pull(skb, skb_network_offset(skb));
+- } while ((q = rcu_dereference_bh(NEXT_SLAVE(q))) != start);
++ } while ((q = rcu_dereference(NEXT_SLAVE(q))) != start);
+
+ if (nores && skb_res == NULL) {
+ skb_res = skb;
++ rcu_read_unlock();
+ goto restart;
+ }
+
+ if (busy) {
+ netif_stop_queue(dev);
+- rcu_read_unlock_bh();
++ rcu_read_unlock();
+ return NETDEV_TX_BUSY;
+ }
+ master->tx_errors++;
+
+ drop:
+ master->tx_dropped++;
+- rcu_read_unlock_bh();
++ rcu_read_unlock();
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+ }
--- /dev/null
+From a0738abd042f7406edd2175a819cf2e66388ed97 Mon Sep 17 00:00:00 2001
+From: Daniel Gibson <daniel@gibson.sh>
+Date: Sat, 27 Jun 2026 00:02:10 +0200
+Subject: platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Gibson <daniel@gibson.sh>
+
+commit a0738abd042f7406edd2175a819cf2e66388ed97 upstream.
+
+dmi_get_system_info(...) can return NULL. Using that as %s arguments
+of dev_info() would log "(null)" (as part of a message like
+'... System Vendor: "(null)", Product Name: "(null)" ...'), which may
+be confusing for users.
+
+Use Elvis operator to print "(Unknown)" instead.
+
+Fixes: 428b9fd2dce5 ("platform/x86/amd/pmc: Add delay_suspend module parameter")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202606251540.Nr2BtaNu-lkp@intel.com/
+Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Daniel Gibson <daniel@gibson.sh>
+Link: https://patch.msgid.link/20260626220210.1761783-2-daniel@gibson.sh
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -660,11 +660,11 @@ static bool amd_pmc_want_suspend_delay(s
+ } else if (delay_suspend == 1) {
+ if (!intermediate_wakeup)
+ dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n",
+- dmi_get_system_info(DMI_SYS_VENDOR),
+- dmi_get_system_info(DMI_PRODUCT_NAME),
+- dmi_get_system_info(DMI_PRODUCT_FAMILY),
+- dmi_get_system_info(DMI_BOARD_VENDOR),
+- dmi_get_system_info(DMI_BOARD_NAME));
++ dmi_get_system_info(DMI_SYS_VENDOR) ?: "(Unknown)",
++ dmi_get_system_info(DMI_PRODUCT_NAME) ?: "(Unknown)",
++ dmi_get_system_info(DMI_PRODUCT_FAMILY) ?: "(Unknown)",
++ dmi_get_system_info(DMI_BOARD_VENDOR) ?: "(Unknown)",
++ dmi_get_system_info(DMI_BOARD_NAME) ?: "(Unknown)");
+ return true;
+ }
+ return false;
ieee802154-ca8210-fix-cas_ctl-leak-on-spi_async-failure.patch
ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch
gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch
+platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch
+net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch
+drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
