6.12-stable patches

added patches:
	drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch
	drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch

diff --git a/queue-6.12/drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch b/queue-6.12/drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch
new file mode 100644 (file)
index 0000000..7e712cc
--- /dev/null
+++ b/queue-6.12/drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch
@@ -0,0 +1,46 @@
+From bd64240dc88caaf7b96dd869f36f165f51b52039 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Fri, 3 Apr 2026 13:53:54 -0700
+Subject: drm/fb-helper: Fix a locking bug in an error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit bd64240dc88caaf7b96dd869f36f165f51b52039 upstream.
+
+The name of the function __drm_fb_helper_initial_config_and_unlock() and
+also the comment above that function make it clear that all code paths
+in this function should unlock fb_helper->lock before returning. Add a
+mutex_unlock() call in the only code path where it is missing. This has
+been detected by the Clang thread-safety analyzer.
+
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Christian König <christian.koenig@amd.com> # radeon
+Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> # msm
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in single place")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patch.msgid.link/20260403205355.1181984-1-bvanassche@acm.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_fb_helper.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1782,8 +1782,10 @@ __drm_fb_helper_initial_config_and_unloc
+       drm_client_modeset_probe(&fb_helper->client, width, height);
+ 
+       info = drm_fb_helper_alloc_info(fb_helper);
+-      if (IS_ERR(info))
++      if (IS_ERR(info)) {
++              mutex_unlock(&fb_helper->lock);
+               return PTR_ERR(info);
++      }
+ 
+       ret = drm_fb_helper_single_fb_probe(fb_helper);
+       if (ret < 0) {

diff --git a/queue-6.12/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch b/queue-6.12/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch
new file mode 100644 (file)
index 0000000..6abef88
--- /dev/null
+++ b/queue-6.12/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch
@@ -0,0 +1,32 @@
+From d23bd83f3e47a928e783c0d6a004737519dc77dc Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 21 Apr 2026 09:29:05 +0200
+Subject: drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit d23bd83f3e47a928e783c0d6a004737519dc77dc upstream.
+
+That field already contains the value being assigned. No need to do
+this twice.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in single place")
+Cc: linux-tegra@vger.kernel.org
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patch.msgid.link/20260421073646.144712-2-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tegra/fbdev.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/tegra/fbdev.c
++++ b/drivers/gpu/drm/tegra/fbdev.c
+@@ -105,7 +105,6 @@ static int tegra_fbdev_probe(struct drm_
+       }
+ 
+       helper->fb = fb;
+-      helper->info = info;
+ 
+       info->fbops = &tegra_fb_ops;
+ 

diff --git a/queue-6.12/series b/queue-6.12/series
index ab26b276e32e54fc966f7ea208a59cfe70789804..b18e9905585f5075f5b12ccf8b42d195a0250c0d 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -333,3 +333,5 @@ rxrpc-fix-irq-disabled-in-local_bh_enable.patch
 can-use-skb-hash-instead-of-private-variable-in-headroom.patch
 can-isotp-fix-timer-drain-order-wakeup-handling-and-tx_gen-ordering.patch
 usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch
+drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch
+drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch