6.12-stable patches

added patches:
	usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch

diff --git a/queue-6.12/series b/queue-6.12/series
index 7c7b1af07a1accf22513dc2bcf9303e8440e1f4a..ab26b276e32e54fc966f7ea208a59cfe70789804 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -332,3 +332,4 @@ rxrpc-manage-rtt-per-call-rather-than-per-peer.patch
 rxrpc-fix-irq-disabled-in-local_bh_enable.patch
 can-use-skb-hash-instead-of-private-variable-in-headroom.patch
 can-isotp-fix-timer-drain-order-wakeup-handling-and-tx_gen-ordering.patch
+usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch

diff --git a/queue-6.12/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch b/queue-6.12/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch
new file mode 100644 (file)
index 0000000..aba4d3a
--- /dev/null
+++ b/queue-6.12/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch
@@ -0,0 +1,47 @@
+From fb0bf289f5d529336ef490c8273e88a8a8b29f69 Mon Sep 17 00:00:00 2001
+From: Andrei Kuchynski <akuchynski@chromium.org>
+Date: Fri, 17 Jul 2026 10:46:14 +0000
+Subject: usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
+
+From: Andrei Kuchynski <akuchynski@chromium.org>
+
+commit fb0bf289f5d529336ef490c8273e88a8a8b29f69 upstream.
+
+The commit 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and
+ordering in port unregistration") consolidated port teardown into the
+ucsi_unregister_port() helper. However, it introduced an ordering problem
+in the ucsi_init() error path.
+
+Fix this by ensuring ucsi_unregister_port() is called before we unregister
+their corresponding lockdep keys.
+
+Cc: stable@vger.kernel.org
+Fixes: 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and ordering in port unregistration")
+Reported-by: "Borah, Chaitanya Kumar" <chaitanya.kumar.borah@intel.com>
+Closes: https://lore.kernel.org/all/22064276-6c56-411a-9f20-6917ceeb865f@intel.com/
+Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
+Tested-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20260717104614.325250-1-akuchynski@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1877,11 +1877,11 @@ static int ucsi_init(struct ucsi *ucsi)
+       return 0;
+ 
+ err_unregister:
++      for (con = connector; con->port; con++)
++              ucsi_unregister_port(con);
+       for (i = 0; i < ucsi->cap.num_connectors; i++)
+               lockdep_unregister_key(&connector[i].lock_key);
+ 
+-      for (con = connector; con->port; con++)
+-              ucsi_unregister_port(con);
+       kfree(connector);
+ err_reset:
+       memset(&ucsi->cap, 0, sizeof(ucsi->cap));