5.10-stable patches

added patches:
	net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch
	scsi-core-ufs-fix-a-hang-in-the-error-handler.patch
	usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch

diff --git a/queue-5.10/net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch b/queue-5.10/net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch
new file mode 100644 (file)
index 0000000..d3a5bb0
--- /dev/null
+++ b/queue-5.10/net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch
@@ -0,0 +1,38 @@
+From 0dcc53abf58d572d34c5313de85f607cd33fc691 Mon Sep 17 00:00:00 2001
+From: Su Hui <suhui@nfschina.com>
+Date: Wed, 5 Jun 2024 11:47:43 +0800
+Subject: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
+
+From: Su Hui <suhui@nfschina.com>
+
+commit 0dcc53abf58d572d34c5313de85f607cd33fc691 upstream.
+
+Clang static checker (scan-build) warning:
+net/ethtool/ioctl.c:line 2233, column 2
+Called function pointer is null (null dereference).
+
+Return '-EOPNOTSUPP' when 'ops->get_ethtool_phy_stats' is NULL to fix
+this typo error.
+
+Fixes: 201ed315f967 ("net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Hariprasad Kelam <hkelam@marvell.com>
+Link: https://lore.kernel.org/r/20240605034742.921751-1-suhui@nfschina.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ethtool/ioctl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ethtool/ioctl.c
++++ b/net/ethtool/ioctl.c
+@@ -2089,7 +2089,7 @@ static int ethtool_get_phy_stats_ethtool
+       const struct ethtool_ops *ops = dev->ethtool_ops;
+       int n_stats, ret;
+ 
+-      if (!ops || !ops->get_sset_count || ops->get_ethtool_phy_stats)
++      if (!ops || !ops->get_sset_count || !ops->get_ethtool_phy_stats)
+               return -EOPNOTSUPP;
+ 
+       n_stats = ops->get_sset_count(dev, ETH_SS_PHY_STATS);

diff --git a/queue-5.10/scsi-core-ufs-fix-a-hang-in-the-error-handler.patch b/queue-5.10/scsi-core-ufs-fix-a-hang-in-the-error-handler.patch
new file mode 100644 (file)
index 0000000..4e59abb
--- /dev/null
+++ b/queue-5.10/scsi-core-ufs-fix-a-hang-in-the-error-handler.patch
@@ -0,0 +1,68 @@
+From 8a3514d348de87a9d5e2ac00fbac4faae0b97996 Mon Sep 17 00:00:00 2001
+From: Sanjeev Yadav <sanjeev.y@mediatek.com>
+Date: Fri, 23 May 2025 13:14:01 -0700
+Subject: scsi: core: ufs: Fix a hang in the error handler
+
+From: Sanjeev Yadav <sanjeev.y@mediatek.com>
+
+commit 8a3514d348de87a9d5e2ac00fbac4faae0b97996 upstream.
+
+ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter
+function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because
+resuming involves submitting a SCSI command and ufshcd_queuecommand()
+returns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this
+hang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has
+been called instead of before.
+
+Backtrace:
+__switch_to+0x174/0x338
+__schedule+0x600/0x9e4
+schedule+0x7c/0xe8
+schedule_timeout+0xa4/0x1c8
+io_schedule_timeout+0x48/0x70
+wait_for_common_io+0xa8/0x160 //waiting on START_STOP
+wait_for_completion_io_timeout+0x10/0x20
+blk_execute_rq+0xe4/0x1e4
+scsi_execute_cmd+0x108/0x244
+ufshcd_set_dev_pwr_mode+0xe8/0x250
+__ufshcd_wl_resume+0x94/0x354
+ufshcd_wl_runtime_resume+0x3c/0x174
+scsi_runtime_resume+0x64/0xa4
+rpm_resume+0x15c/0xa1c
+__pm_runtime_resume+0x4c/0x90 // Runtime resume ongoing
+ufshcd_err_handler+0x1a0/0xd08
+process_one_work+0x174/0x808
+worker_thread+0x15c/0x490
+kthread+0xf4/0x1ec
+ret_from_fork+0x10/0x20
+
+Signed-off-by: Sanjeev Yadav <sanjeev.y@mediatek.com>
+[ bvanassche: rewrote patch description ]
+Fixes: 62694735ca95 ("[SCSI] ufs: Add runtime PM support for UFS host controller driver")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250523201409.1676055-1-bvanassche@acm.org
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+[Shivani: Modified to apply on 5.10.y]
+Signed-off-by: Shivani Agarwal <shivani.agarwal@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -5766,10 +5766,12 @@ static void ufshcd_err_handler(struct wo
+               spin_unlock_irqrestore(hba->host->host_lock, flags);
+               return;
+       }
+-      ufshcd_set_eh_in_progress(hba);
+       spin_unlock_irqrestore(hba->host->host_lock, flags);
++
+       ufshcd_err_handling_prepare(hba);
++
+       spin_lock_irqsave(hba->host->host_lock, flags);
++      ufshcd_set_eh_in_progress(hba);
+       ufshcd_scsi_block_requests(hba);
+       /*
+        * A full reset and restore might have happened after preparation

diff --git a/queue-5.10/series b/queue-5.10/series
index c9060092f607baaf5c681118b207415dcfdde9a3..c0bba41783c7b67fc08c7e87669be4e87e8a2f9f 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -407,3 +407,6 @@ leds-lp50xx-remove-duplicated-error-reporting-in-.remove.patch
 leds-leds-lp50xx-enable-chip-before-any-communication.patch
 pwm-stm32-always-program-polarity.patch
 revert-iommu-amd-skip-enabling-command-event-buffers-for-kdump.patch
+scsi-core-ufs-fix-a-hang-in-the-error-handler.patch
+net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch
+usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch

diff --git a/queue-5.10/usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch b/queue-5.10/usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch
new file mode 100644 (file)
index 0000000..9c88c49
--- /dev/null
+++ b/queue-5.10/usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch
@@ -0,0 +1,102 @@
+From 782be79e4551550d7a82b1957fc0f7347e6d461f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 18 Dec 2025 16:35:15 +0100
+Subject: usb: gadget: lpc32xx_udc: fix clock imbalance in error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 782be79e4551550d7a82b1957fc0f7347e6d461f upstream.
+
+A recent change fixing a device reference leak introduced a clock
+imbalance by reusing an error path so that the clock may be disabled
+before having been enabled.
+
+Note that the clock framework allows for passing in NULL clocks so there
+is no risk for a NULL pointer dereference.
+
+Also drop the bogus I2C client NULL check added by the offending commit
+as the pointer has already been verified to be non-NULL.
+
+Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe")
+Cc: stable@vger.kernel.org
+Cc: Ma Ke <make24@iscas.ac.cn>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://patch.msgid.link/20251218153519.19453-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/lpc32xx_udc.c |   19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -3026,7 +3026,7 @@ static int lpc32xx_udc_probe(struct plat
+       pdev->dev.dma_mask = &lpc32xx_usbd_dmamask;
+       retval = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+       if (retval)
+-              goto i2c_fail;
++              goto err_put_client;
+ 
+       udc->board = &lpc32xx_usbddata;
+ 
+@@ -3046,7 +3046,7 @@ static int lpc32xx_udc_probe(struct plat
+               udc->udp_irq[i] = platform_get_irq(pdev, i);
+               if (udc->udp_irq[i] < 0) {
+                       retval = udc->udp_irq[i];
+-                      goto i2c_fail;
++                      goto err_put_client;
+               }
+       }
+ 
+@@ -3054,7 +3054,7 @@ static int lpc32xx_udc_probe(struct plat
+       if (IS_ERR(udc->udp_baseaddr)) {
+               dev_err(udc->dev, "IO map failure\n");
+               retval = PTR_ERR(udc->udp_baseaddr);
+-              goto i2c_fail;
++              goto err_put_client;
+       }
+ 
+       /* Get USB device clock */
+@@ -3062,14 +3062,14 @@ static int lpc32xx_udc_probe(struct plat
+       if (IS_ERR(udc->usb_slv_clk)) {
+               dev_err(udc->dev, "failed to acquire USB device clock\n");
+               retval = PTR_ERR(udc->usb_slv_clk);
+-              goto i2c_fail;
++              goto err_put_client;
+       }
+ 
+       /* Enable USB device clock */
+       retval = clk_prepare_enable(udc->usb_slv_clk);
+       if (retval < 0) {
+               dev_err(udc->dev, "failed to start USB device clock\n");
+-              goto i2c_fail;
++              goto err_put_client;
+       }
+ 
+       /* Setup deferred workqueue data */
+@@ -3171,9 +3171,10 @@ dma_alloc_fail:
+       dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE,
+                         udc->udca_v_base, udc->udca_p_base);
+ i2c_fail:
+-      if (udc->isp1301_i2c_client)
+-              put_device(&udc->isp1301_i2c_client->dev);
+       clk_disable_unprepare(udc->usb_slv_clk);
++err_put_client:
++      put_device(&udc->isp1301_i2c_client->dev);
++
+       dev_err(udc->dev, "%s probe failed, %d\n", driver_name, retval);
+ 
+       return retval;
+@@ -3198,11 +3199,9 @@ static int lpc32xx_udc_remove(struct pla
+       dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE,
+                         udc->udca_v_base, udc->udca_p_base);
+ 
+-      if (udc->isp1301_i2c_client)
+-              put_device(&udc->isp1301_i2c_client->dev);
+-
+       clk_disable_unprepare(udc->usb_slv_clk);
+ 
++      put_device(&udc->isp1301_i2c_client->dev);
+       return 0;
+ }
+