7.1-stable patches

added patches:
	usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch

diff --git a/queue-7.1/series b/queue-7.1/series
index 6c40b5463ef6c0284b369e8cda628c9e6841e001..156918a1b1482222eadf61bfe2911c2b7108cb78 100644 (file)
--- a/queue-7.1/series
+++ b/queue-7.1/series
@@ -435,3 +435,4 @@ drm-xe-wait-on-external-bo-kernel-fences-in-exec-ioctl.patch
 media-chips-media-wave5-support-cbp-profile.patch
 drm-amd-display-check-grph_flip-status-before-sendin.patch
 drm-amd-display-exit-idle-optimizations-before-progr.patch
+usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch

diff --git a/queue-7.1/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch b/queue-7.1/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch
new file mode 100644 (file)
index 0000000..11f432e
--- /dev/null
+++ b/queue-7.1/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch
@@ -0,0 +1,47 @@
+From fb0bf289f5d529336ef490c8273e88a8a8b29f69 Mon Sep 17 00:00:00 2001
+From: Andrei Kuchynski <akuchynski@chromium.org>
+Date: Fri, 17 Jul 2026 10:46:14 +0000
+Subject: usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
+
+From: Andrei Kuchynski <akuchynski@chromium.org>
+
+commit fb0bf289f5d529336ef490c8273e88a8a8b29f69 upstream.
+
+The commit 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and
+ordering in port unregistration") consolidated port teardown into the
+ucsi_unregister_port() helper. However, it introduced an ordering problem
+in the ucsi_init() error path.
+
+Fix this by ensuring ucsi_unregister_port() is called before we unregister
+their corresponding lockdep keys.
+
+Cc: stable@vger.kernel.org
+Fixes: 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and ordering in port unregistration")
+Reported-by: "Borah, Chaitanya Kumar" <chaitanya.kumar.borah@intel.com>
+Closes: https://lore.kernel.org/all/22064276-6c56-411a-9f20-6917ceeb865f@intel.com/
+Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
+Tested-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20260717104614.325250-1-akuchynski@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -2110,11 +2110,11 @@ static int ucsi_init(struct ucsi *ucsi)
+       return 0;
+ 
+ err_unregister:
++      for (con = connector; con->port; con++)
++              ucsi_unregister_port(con);
+       for (i = 0; i < ucsi->cap.num_connectors; i++)
+               lockdep_unregister_key(&connector[i].lock_key);
+ 
+-      for (con = connector; con->port; con++)
+-              ucsi_unregister_port(con);
+       kfree(connector);
+ err_reset:
+       memset(&ucsi->cap, 0, sizeof(ucsi->cap));