--- /dev/null
+From 371526a85a9b24970036b10365d5b0a9c6021fb9 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Fri, 13 Mar 2026 15:50:21 -0600
+Subject: io_uring/poll: correctly handle io_poll_add() return value on update
+
+From: Jens Axboe <axboe@kernel.dk>
+
+Commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e upstream.
+
+When the core of io_uring was updated to handle completions
+consistently and with fixed return codes, the POLL_REMOVE opcode
+with updates got slightly broken. If a POLL_ADD is pending and
+then POLL_REMOVE is used to update the events of that request, if that
+update causes the POLL_ADD to now trigger, then that completion is lost
+and a CQE is never posted.
+
+Additionally, ensure that if an update does cause an existing POLL_ADD
+to complete, that the completion value isn't always overwritten with
+-ECANCELED. For that case, whatever io_poll_add() set the value to
+should just be retained.
+
+Cc: stable@vger.kernel.org
+Fixes: 97b388d70b53 ("io_uring: handle completions in the core")
+Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
+Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -5980,7 +5980,7 @@ static int io_poll_add_prep(struct io_ki
+ return 0;
+ }
+
+-static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
++static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
+ {
+ struct io_poll_iocb *poll = &req->poll;
+ struct io_poll_table ipt;
+@@ -5992,11 +5992,21 @@ static int io_poll_add(struct io_kiocb *
+ if (!ret && ipt.error)
+ req_set_fail(req);
+ ret = ret ?: ipt.error;
+- if (ret)
++ if (ret > 0) {
+ __io_req_complete(req, issue_flags, ret, 0);
++ return ret;
++ }
+ return 0;
+ }
+
++static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
++{
++ int ret;
++
++ ret = __io_poll_add(req, issue_flags);
++ return ret < 0 ? ret : 0;
++}
++
+ static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags)
+ {
+ struct io_ring_ctx *ctx = req->ctx;
+@@ -6012,6 +6022,7 @@ static int io_poll_update(struct io_kioc
+ ret = preq ? -EALREADY : -ENOENT;
+ goto out;
+ }
++ preq->result = -ECANCELED;
+ spin_unlock(&ctx->completion_lock);
+
+ if (req->poll_update.update_events || req->poll_update.update_user_data) {
+@@ -6024,16 +6035,17 @@ static int io_poll_update(struct io_kioc
+ if (req->poll_update.update_user_data)
+ preq->user_data = req->poll_update.new_user_data;
+
+- ret2 = io_poll_add(preq, issue_flags);
++ ret2 = __io_poll_add(preq, issue_flags);
+ /* successfully updated, don't complete poll request */
+ if (!ret2)
+ goto out;
++ preq->result = ret2;
++
+ }
+- req_set_fail(preq);
+- io_req_complete(preq, -ECANCELED);
++ if (preq->result < 0)
++ req_set_fail(preq);
++ io_req_complete(preq, preq->result);
+ out:
+- if (ret < 0)
+- req_set_fail(req);
+ /* complete update request, we're done with it */
+ io_req_complete(req, ret);
+ io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK));
--- /dev/null
+From manivannan.sadhasivam@oss.qualcomm.com Mon Apr 13 17:02:30 2026
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Date: Tue, 31 Mar 2026 14:44:55 +0530
+Subject: Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"
+To: stable@vger.kernel.org
+Cc: bhelgaas@google.com, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, robin.murphy@arm.com, Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>, John Hancock <john@kernel.doghat.io>, bjorn.forsman@gmail.com, Linux kernel regressions list <regressions@lists.linux.dev>
+Message-ID: <20260331091455.30394-1-manivannan.sadhasivam@oss.qualcomm.com>
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+This reverts commit 573497f350b3cdb526c8c38955ddd287c5d4cc53 which is
+commit c41e2fb67e26b04d919257875fa954aa5f6e392e upstream.
+
+The original commit attempted to enable ACS in pci_dma_configure() prior
+to IOMMU group assignment in iommu_init_device() to fix the ACS enablement
+issue for OF platforms. But that assumption doesn't hold true for kernel
+versions prior to v6.15, because on these older kernels,
+pci_dma_configure() is called *after* iommu_init_device(). So the IOMMU
+groups are already created before the ACS gets enabled. This causes the
+devices that should have been split into separate groups by ACS, getting
+merged into one group, thereby breaking the IOMMU isolation as reported on
+the AMD machines.
+
+So revert the offending commit to restore the IOMMU group assignment on
+those affected machines. It should be noted that ACS has never really
+worked on kernel versions prior to v6.15, so the revert doesn't make any
+difference for OF platforms.
+
+Reported-by: John Hancock <john@kernel.doghat.io>
+Reported-by: bjorn.forsman@gmail.com
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221234
+Fixes: b20b659c2c6a ("PCI: Enable ACS after configuring IOMMU for OF platforms")
+Cc: Linux kernel regressions list <regressions@lists.linux.dev>
+Link: https://lore.kernel.org/regressions/2c30f181-ffc6-4d63-a64e-763cf4528f48@leemhuis.info
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci-driver.c | 8 --------
+ drivers/pci/pci.c | 10 +++++++++-
+ drivers/pci/pci.h | 1 -
+ 3 files changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1601,14 +1601,6 @@ static int pci_dma_configure(struct devi
+ ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+ }
+
+- /*
+- * Attempt to enable ACS regardless of capability because some Root
+- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+- * the standard ACS capability but still support ACS via those
+- * quirks.
+- */
+- pci_enable_acs(to_pci_dev(dev));
+-
+ pci_put_host_bridge_device(bridge);
+ return ret;
+ }
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -894,7 +894,7 @@ static void pci_std_enable_acs(struct pc
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+-void pci_enable_acs(struct pci_dev *dev)
++static void pci_enable_acs(struct pci_dev *dev)
+ {
+ if (!pci_acs_enable)
+ goto disable_acs_redir;
+@@ -3548,6 +3548,14 @@ bool pci_acs_path_enabled(struct pci_dev
+ void pci_acs_init(struct pci_dev *dev)
+ {
+ dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
++
++ /*
++ * Attempt to enable ACS regardless of capability because some Root
++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++ * the standard ACS capability but still support ACS via those
++ * quirks.
++ */
++ pci_enable_acs(dev);
+ }
+
+ /**
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -547,7 +547,6 @@ static inline resource_size_t pci_resour
+ }
+
+ void pci_acs_init(struct pci_dev *dev);
+-void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
projects / thirdparty / kernel / stable-queue.git / commitdiff
