From: Sasha Levin Date: Tue, 7 Jul 2026 08:48:51 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=03353070a50bd1fcde1278a42f6a17766b6c8677;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/gpio-rockchip-change-the-gpio-version-judgment-logic.patch b/queue-6.12/gpio-rockchip-change-the-gpio-version-judgment-logic.patch new file mode 100644 index 0000000000..2536d20109 --- /dev/null +++ b/queue-6.12/gpio-rockchip-change-the-gpio-version-judgment-logic.patch @@ -0,0 +1,57 @@ +From ab00734bbf9dfebb0acd9c82438d03a3b314c7f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2026 18:17:11 +0200 +Subject: gpio: rockchip: change the GPIO version judgment logic + +From: Ye Zhang + +[ Upstream commit 41209307cad7f14c387c68375a93b50e54261a53 ] + +Have a list of valid IDs and default to -ENODEV. + +Signed-off-by: Ye Zhang +Reviewed-by: Sebastian Reichel +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20241112015408.3139996-3-ye.zhang@rock-chips.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-rockchip.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c +index 052713bd8d07a9..16c1ec3a5d0e79 100644 +--- a/drivers/gpio/gpio-rockchip.c ++++ b/drivers/gpio/gpio-rockchip.c +@@ -653,8 +653,9 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank) + + id = readl(bank->reg_base + gpio_regs_v2.version_id); + +- /* If not gpio v2, that is default to v1. */ +- if (id == GPIO_TYPE_V2 || id == GPIO_TYPE_V2_1) { ++ switch (id) { ++ case GPIO_TYPE_V2: ++ case GPIO_TYPE_V2_1: + bank->gpio_regs = &gpio_regs_v2; + bank->gpio_type = GPIO_TYPE_V2; + bank->db_clk = of_clk_get(bank->of_node, 1); +@@ -662,9 +663,14 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank) + dev_err(bank->dev, "cannot find debounce clk\n"); + return -EINVAL; + } +- } else { ++ break; ++ case GPIO_TYPE_V1: + bank->gpio_regs = &gpio_regs_v1; + bank->gpio_type = GPIO_TYPE_V1; ++ break; ++ default: ++ dev_err(bank->dev, "unsupported version ID: 0x%08x\n", id); ++ return -ENODEV; + } + + return 0; +-- +2.53.0 + diff --git a/queue-6.12/gpio-rockchip-fix-generic-irq-chip-leak-on-remove.patch b/queue-6.12/gpio-rockchip-fix-generic-irq-chip-leak-on-remove.patch new file mode 100644 index 0000000000..0d85e134e8 --- /dev/null +++ b/queue-6.12/gpio-rockchip-fix-generic-irq-chip-leak-on-remove.patch @@ -0,0 +1,55 @@ +From 84ba2ad3aa4cc91f15f1037ecf8c606c2853f1f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2026 18:17:13 +0200 +Subject: gpio: rockchip: fix generic IRQ chip leak on remove + +From: Marco Scardovi + +[ Upstream commit 1c1e0fc88d6ef65bf15d517853251f75ab9d18c3 ] + +The driver allocates domain generic chips using +irq_alloc_domain_generic_chips() during probe. However, on driver +remove/teardown, the generic chips are not automatically freed when the +IRQ domain is removed because the domain flags do not include +IRQ_DOMAIN_FLAG_DESTROY_GC. + +This causes both the domain generic chips structure and the associated +generic chips to be leaked. Additionally, the generic chips remain on +the global gc_list and may later be visited by generic IRQ chip suspend, +resume, or shutdown callbacks after the GPIO bank has been removed, +potentially resulting in a use-after-free and kernel crash. + +Fix the resource leak by explicitly calling +irq_domain_remove_generic_chips() before removing the IRQ domain in +rockchip_gpio_remove(). + +Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") +Assisted-by: Antigravity:gemini-3.5-flash +Signed-off-by: Marco Scardovi +Link: https://patch.msgid.link/20260607230504.35392-2-scardracs@disroot.org +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-rockchip.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c +index 0a93c74933f08b..9c419625c75332 100644 +--- a/drivers/gpio/gpio-rockchip.c ++++ b/drivers/gpio/gpio-rockchip.c +@@ -792,8 +792,10 @@ static void rockchip_gpio_remove(struct platform_device *pdev) + struct rockchip_pin_bank *bank = platform_get_drvdata(pdev); + + irq_set_chained_handler_and_data(bank->irq, NULL, NULL); +- if (bank->domain) ++ if (bank->domain) { ++ irq_domain_remove_generic_chips(bank->domain); + irq_domain_remove(bank->domain); ++ } + gpiochip_remove(&bank->gpio_chip); + } + +-- +2.53.0 + diff --git a/queue-6.12/gpio-rockchip-teardown-bugs-and-resource-leaks.patch b/queue-6.12/gpio-rockchip-teardown-bugs-and-resource-leaks.patch new file mode 100644 index 0000000000..1b592170b5 --- /dev/null +++ b/queue-6.12/gpio-rockchip-teardown-bugs-and-resource-leaks.patch @@ -0,0 +1,89 @@ +From 2b18fefdaf377798182b7ae970fc118200fef0c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2026 18:17:12 +0200 +Subject: gpio: rockchip: teardown bugs and resource leaks + +From: Marco Scardovi + +[ Upstream commit 9500077678230e36d22bf16d2b9539c13e59a801 ] + +Address several teardown issues and resource leaks in the driver's remove +path and error handling: + +1. Debounce clock reference leak: The debounce clock (bank->db_clk) is + obtained using of_clk_get() which increments the clock's reference + count, but clk_put() is never called. Register a devm action to + cleanly release it on unbind. Note that of_clk_get(..., 1) remains + necessary over devm_clk_get() because the DT binding does not define + clock-names, precluding name-based lookup. + +2. Unregistered chained IRQ handler: The chained IRQ handler is not + disconnected in remove(). If a stray interrupt fires after the driver + is removed, the kernel attempts to execute a stale handler, leading + to a panic. Fix this by clearing the handler in remove(). + +3. IRQ domain leak: The linear IRQ domain and its generic chips are + allocated manually during probe but never removed. Remove the IRQ + domain during driver teardown to free the associated generic chips + and mappings. + +Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") +Assisted-by: Antigravity:gemini-3.5-flash +Signed-off-by: Marco Scardovi +Link: https://patch.msgid.link/20260526171050.12785-3-scardracs@disroot.org +[Bartosz: don't emit an error message on devres allocation failure] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-rockchip.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c +index 16c1ec3a5d0e79..0a93c74933f08b 100644 +--- a/drivers/gpio/gpio-rockchip.c ++++ b/drivers/gpio/gpio-rockchip.c +@@ -629,10 +629,17 @@ static int rockchip_gpiolib_register(struct rockchip_pin_bank *bank) + return ret; + } + ++static void rockchip_clk_put(void *data) ++{ ++ struct clk *clk = data; ++ ++ clk_put(clk); ++} ++ + static int rockchip_get_bank_data(struct rockchip_pin_bank *bank) + { + struct resource res; +- int id = 0; ++ int id = 0, ret; + + if (of_address_to_resource(bank->of_node, 0, &res)) { + dev_err(bank->dev, "cannot find IO resource for bank\n"); +@@ -663,6 +670,11 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank) + dev_err(bank->dev, "cannot find debounce clk\n"); + return -EINVAL; + } ++ ++ ret = devm_add_action_or_reset(bank->dev, rockchip_clk_put, ++ bank->db_clk); ++ if (ret) ++ return ret; + break; + case GPIO_TYPE_V1: + bank->gpio_regs = &gpio_regs_v1; +@@ -779,6 +791,9 @@ static void rockchip_gpio_remove(struct platform_device *pdev) + { + struct rockchip_pin_bank *bank = platform_get_drvdata(pdev); + ++ irq_set_chained_handler_and_data(bank->irq, NULL, NULL); ++ if (bank->domain) ++ irq_domain_remove(bank->domain); + gpiochip_remove(&bank->gpio_chip); + } + +-- +2.53.0 + diff --git a/queue-6.12/mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch b/queue-6.12/mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch new file mode 100644 index 0000000000..8929a835cc --- /dev/null +++ b/queue-6.12/mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch @@ -0,0 +1,48 @@ +From 5b043580879cadfce56b2c61e0a7e54b1eae80af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 May 2026 15:10:50 -0400 +Subject: mm/vmalloc: take vmap_purge_lock in shrinker + +From: Uladzislau Rezki (Sony) + +[ Upstream commit ec05f51f1e65bce95528543eb73fda56fd201d94 ] + +decay_va_pool_node() can be invoked concurrently from two paths: +__purge_vmap_area_lazy() when pools are being purged, and the shrinker via +vmap_node_shrink_scan(). + +However, decay_va_pool_node() is not safe to run concurrently, and the +shrinker path currently lacks serialization, leading to races and possible +leaks. + +Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker +path to ensure serialization with purge users. + +Link: https://lore.kernel.org/20260413192646.14683-1-urezki@gmail.com +Fixes: 7679ba6b36db ("mm: vmalloc: add a shrinker to drain vmap pools") +Signed-off-by: Uladzislau Rezki (Sony) +Reviewed-by: Baoquan He +Cc: chenyichong +Cc: +Signed-off-by: Andrew Morton +[ kept index-based loop instead of for_each_vmap_node() helper ] +Signed-off-by: Sasha Levin +--- + mm/vmalloc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 1d2262fb541850..d4a42980b4d028 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -5204,6 +5204,7 @@ vmap_node_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + { + int i; + ++ guard(mutex)(&vmap_purge_lock); + for (i = 0; i < nr_vmap_nodes; i++) + decay_va_pool_node(&vmap_nodes[i], true); + +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index f58616fcc3..a914a68356 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -5,3 +5,7 @@ userfaultfd-gate-must_wait-writability-check-on-pte_.patch perf-fix-dangling-cgroup-pointer-in-cpuctx-backport.patch bcachefs-avoid-truncating-fiemap-extent-length.patch drm-amd-fix-set-but-not-used-warnings.patch +gpio-rockchip-change-the-gpio-version-judgment-logic.patch +gpio-rockchip-teardown-bugs-and-resource-leaks.patch +gpio-rockchip-fix-generic-irq-chip-leak-on-remove.patch +mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch