5.15-stable patches

added patches:
	bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch
	i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch
	i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch
	platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch

diff --git a/queue-5.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch b/queue-5.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch
new file mode 100644 (file)
index 0000000..c07cbcd
--- /dev/null
+++ b/queue-5.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch
@@ -0,0 +1,71 @@
+From bddbe13d36a02d5097b99cf02354d5752ad1ac60 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Thu, 17 Jul 2025 10:23:07 +0800
+Subject: bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 upstream.
+
+The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup()
+twice, which would increment the device's reference count twice if
+both lookups find a device. This could lead to a reference count leak.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found")
+Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-bus.c |   19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
+@@ -944,6 +944,7 @@ struct fsl_mc_device *fsl_mc_get_endpoin
+       struct fsl_mc_obj_desc endpoint_desc = {{ 0 }};
+       struct dprc_endpoint endpoint1 = {{ 0 }};
+       struct dprc_endpoint endpoint2 = {{ 0 }};
++      struct fsl_mc_bus *mc_bus;
+       int state, err;
+ 
+       mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent);
+@@ -967,6 +968,8 @@ struct fsl_mc_device *fsl_mc_get_endpoin
+       strcpy(endpoint_desc.type, endpoint2.type);
+       endpoint_desc.id = endpoint2.id;
+       endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev);
++      if (endpoint)
++              return endpoint;
+ 
+       /*
+        * We know that the device has an endpoint because we verified by
+@@ -974,17 +977,13 @@ struct fsl_mc_device *fsl_mc_get_endpoin
+        * yet discovered by the fsl-mc bus, thus the lookup returned NULL.
+        * Force a rescan of the devices in this container and retry the lookup.
+        */
+-      if (!endpoint) {
+-              struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev);
+-
+-              if (mutex_trylock(&mc_bus->scan_mutex)) {
+-                      err = dprc_scan_objects(mc_bus_dev, true);
+-                      mutex_unlock(&mc_bus->scan_mutex);
+-              }
+-
+-              if (err < 0)
+-                      return ERR_PTR(err);
++      mc_bus = to_fsl_mc_bus(mc_bus_dev);
++      if (mutex_trylock(&mc_bus->scan_mutex)) {
++              err = dprc_scan_objects(mc_bus_dev, true);
++              mutex_unlock(&mc_bus->scan_mutex);
+       }
++      if (err < 0)
++              return ERR_PTR(err);
+ 
+       endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev);
+       /*

diff --git a/queue-5.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch b/queue-5.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch
new file mode 100644 (file)
index 0000000..a1a258b
--- /dev/null
+++ b/queue-5.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch
@@ -0,0 +1,42 @@
+From a7982a14b3012527a9583d12525cd0dc9f8d8934 Mon Sep 17 00:00:00 2001
+From: Yang Xiwen <forbidden405@outlook.com>
+Date: Mon, 16 Jun 2025 00:01:10 +0800
+Subject: i2c: qup: jump out of the loop in case of timeout
+
+From: Yang Xiwen <forbidden405@outlook.com>
+
+commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream.
+
+Original logic only sets the return value but doesn't jump out of the
+loop if the bus is kept active by a client. This is not expected. A
+malicious or buggy i2c client can hang the kernel in this case and
+should be avoided. This is observed during a long time test with a
+PCA953x GPIO extender.
+
+Fix it by changing the logic to not only sets the return value, but also
+jumps out of the loop and return to the caller with -ETIMEDOUT.
+
+Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1")
+Signed-off-by: Yang Xiwen <forbidden405@outlook.com>
+Cc: <stable@vger.kernel.org> # v4.17+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-qup.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -452,8 +452,10 @@ static int qup_i2c_bus_active(struct qup
+               if (!(status & I2C_STATUS_BUS_ACTIVE))
+                       break;
+ 
+-              if (time_after(jiffies, timeout))
++              if (time_after(jiffies, timeout)) {
+                       ret = -ETIMEDOUT;
++                      break;
++              }
+ 
+               usleep_range(len, len * 2);
+       }

diff --git a/queue-5.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch b/queue-5.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch
new file mode 100644 (file)
index 0000000..3551b6b
--- /dev/null
+++ b/queue-5.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch
@@ -0,0 +1,51 @@
+From a663b3c47ab10f66130818cf94eb59c971541c3f Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Thu, 3 Jul 2025 17:01:02 +0530
+Subject: i2c: virtio: Avoid hang by using interruptible completion wait
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit a663b3c47ab10f66130818cf94eb59c971541c3f upstream.
+
+The current implementation uses wait_for_completion(), which can cause
+the caller to hang indefinitely if the transfer never completes.
+
+Switch to wait_for_completion_interruptible() so that the operation can
+be interrupted by signals.
+
+Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: <stable@vger.kernel.org> # v5.16+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-virtio.c |   15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-virtio.c
++++ b/drivers/i2c/busses/i2c-virtio.c
+@@ -118,15 +118,16 @@ static int virtio_i2c_complete_reqs(stru
+       for (i = 0; i < num; i++) {
+               struct virtio_i2c_req *req = &reqs[i];
+ 
+-              wait_for_completion(&req->completion);
+-
+-              if (!failed && req->in_hdr.status != VIRTIO_I2C_MSG_OK)
+-                      failed = true;
++              if (!failed) {
++                      if (wait_for_completion_interruptible(&req->completion))
++                              failed = true;
++                      else if (req->in_hdr.status != VIRTIO_I2C_MSG_OK)
++                              failed = true;
++                      else
++                              j++;
++              }
+ 
+               i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], !failed);
+-
+-              if (!failed)
+-                      j++;
+       }
+ 
+       return j;

diff --git a/queue-5.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch b/queue-5.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch
new file mode 100644 (file)
index 0000000..edfe1f5
--- /dev/null
+++ b/queue-5.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch
@@ -0,0 +1,45 @@
+From e10981075adce203eac0be866389309eeb8ef11e Mon Sep 17 00:00:00 2001
+From: Rong Zhang <i@rong.moe>
+Date: Tue, 8 Jul 2025 00:38:07 +0800
+Subject: platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rong Zhang <i@rong.moe>
+
+commit e10981075adce203eac0be866389309eeb8ef11e upstream.
+
+On some models supported by ideapad-laptop, the HW/FW can remember the
+state of keyboard backlight among boots. However, it is always turned
+off while shutting down, as a side effect of the LED class device
+unregistering sequence.
+
+This is inconvenient for users who always prefer turning on the
+keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class
+device so that the state of keyboard backlight gets remembered, which
+also aligns with the behavior of manufacturer utilities on Windows.
+
+Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Link: https://lore.kernel.org/r/20250707163808.155876-3-i@rong.moe
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/ideapad-laptop.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -1357,7 +1357,7 @@ static int ideapad_kbd_bl_init(struct id
+       priv->kbd_bl.led.max_brightness          = 1;
+       priv->kbd_bl.led.brightness_get          = ideapad_kbd_bl_led_cdev_brightness_get;
+       priv->kbd_bl.led.brightness_set_blocking = ideapad_kbd_bl_led_cdev_brightness_set;
+-      priv->kbd_bl.led.flags                   = LED_BRIGHT_HW_CHANGED;
++      priv->kbd_bl.led.flags                   = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN;
+ 
+       err = led_classdev_register(&priv->platform_device->dev, &priv->kbd_bl.led);
+       if (err)

diff --git a/queue-5.15/series b/queue-5.15/series
index 01b8acf874bfb20ba6c0d1b39049280b4c60c4da..c0b9e0f23eb16fdcccb99cdd82116bc434d6f762 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -85,3 +85,7 @@ net-sched-sch_qfq-avoid-triggering-might_sleep-in-at.patch
 net-hns3-fix-concurrent-setting-vlan-filter-issue.patch
 net-hns3-disable-interrupt-when-ptp-init-failed.patch
 net-hns3-fixed-vf-get-max-channels-bug.patch
+platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch
+i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch
+i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch
+bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch