From: Greg Kroah-Hartman Date: Wed, 20 May 2026 16:01:03 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.6.141~38 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0454bec53b792b03ad3418d4eae50fa4e30b7baf;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch --- diff --git a/queue-6.18/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch b/queue-6.18/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch new file mode 100644 index 0000000000..d4c4cd96fd --- /dev/null +++ b/queue-6.18/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch @@ -0,0 +1,32 @@ +From 950953f774b3f69da6f413e045ef075e1f3da2df Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:44 +0200 +Subject: drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup + +From: Johan Hovold + +commit 950953f774b3f69da6f413e045ef075e1f3da2df upstream. + +Make sure to drop the reference taken to the I2C adapter (and its +module) when setting up HDMI to allow the adapter to be deregistered. + +Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") +Cc: stable@vger.kernel.org # 3.3 +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c ++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c +@@ -579,6 +579,7 @@ static int oaktrail_hdmi_get_modes(struc + } else { + edid = (struct edid *)raw_edid; + /* FIXME ? edid = drm_get_edid(connector, i2c_adap); */ ++ i2c_put_adapter(i2c_adap); + } + + if (edid) { diff --git a/queue-6.18/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch b/queue-6.18/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch new file mode 100644 index 0000000000..70a08bcff0 --- /dev/null +++ b/queue-6.18/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch @@ -0,0 +1,54 @@ +From 657a091ab6d01d0091b77660c75cfed573c9a53e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:45 +0200 +Subject: drm/gma500/oaktrail_lvds: fix hang on init failure + +From: Johan Hovold + +commit 657a091ab6d01d0091b77660c75cfed573c9a53e upstream. + +The LVDS init code looks up an I2C adapter using i2c_get_adapter() and +tries to read the EDID before falling back to allocating and registering +its own adapter. + +The error handling does not separate these cases so on a late init +failure it will try to deregister and free also an adapter that had +previously been registered. Since i2c_get_adapter() takes another +reference to the adapter, deregistration hangs indefinitely while +waiting for the reference to be released. + +Fix this by only destroying adapters allocated during LVDS init on +errors. + +Fixes: a57ebfc0b4da ("drm/gma500: Make oaktrail lvds use ddc adapter from drm_connector") +Cc: stable@vger.kernel.org # 6.0 +Cc: Patrik Jakobsson +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_lvds.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c ++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c +@@ -292,7 +292,7 @@ void oaktrail_lvds_init(struct drm_devic + { + struct gma_encoder *gma_encoder; + struct gma_connector *gma_connector; +- struct gma_i2c_chan *ddc_bus; ++ struct gma_i2c_chan *ddc_bus = NULL; + struct drm_connector *connector; + struct drm_encoder *encoder; + struct drm_psb_private *dev_priv = to_drm_psb_private(dev); +@@ -420,7 +420,8 @@ out: + + err_unlock: + mutex_unlock(&dev->mode_config.mutex); +- gma_i2c_destroy(to_gma_i2c_chan(connector->ddc)); ++ if (!IS_ERR_OR_NULL(ddc_bus)) ++ gma_i2c_destroy(ddc_bus); + drm_encoder_cleanup(encoder); + err_connector_cleanup: + drm_connector_cleanup(connector); diff --git a/queue-6.18/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch b/queue-6.18/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch new file mode 100644 index 0000000000..ede3ab8bbc --- /dev/null +++ b/queue-6.18/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch @@ -0,0 +1,47 @@ +From 84d1c9b416d54afe760ca4c378bd95c89261254c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:46 +0200 +Subject: drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init + +From: Johan Hovold + +commit 84d1c9b416d54afe760ca4c378bd95c89261254c upstream. + +The LVDS init code looks up an I2C adapter using i2c_get_adapter() and +tries to read the EDID before falling back to allocating and registering +its own adapter. + +Make sure to drop the references taken by i2c_get_adapter() when falling +back to allocating an adapter as well as on late errors to allow the +looked up adapter to be deregistered. + +Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") +Cc: stable@vger.kernel.org # 3.3 +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_lvds.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c ++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c +@@ -366,6 +366,8 @@ void oaktrail_lvds_init(struct drm_devic + if (edid == NULL && dev_priv->lpc_gpio_base) { + ddc_bus = oaktrail_lvds_i2c_init(dev); + if (!IS_ERR(ddc_bus)) { ++ if (i2c_adap) ++ i2c_put_adapter(i2c_adap); + i2c_adap = &ddc_bus->base; + edid = drm_get_edid(connector, i2c_adap); + } +@@ -422,6 +424,8 @@ err_unlock: + mutex_unlock(&dev->mode_config.mutex); + if (!IS_ERR_OR_NULL(ddc_bus)) + gma_i2c_destroy(ddc_bus); ++ else if (i2c_adap) ++ i2c_put_adapter(i2c_adap); + drm_encoder_cleanup(encoder); + err_connector_cleanup: + drm_connector_cleanup(connector); diff --git a/queue-6.18/series b/queue-6.18/series index b777c89e3b..3426404886 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -942,3 +942,6 @@ drm-panfrost-fix-wait_bo-ioctl-leaking-positive-return-from-dma_resv_wait_timeou drm-xe-dma-buf-handle-empty-bo-and-uaf-races.patch drm-xe-dma-buf-fix-uaf-with-retry-loop.patch drm-ttm-convert-eagain-from-dmem_cgroup_try_charge-to-enospc.patch +drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch +drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch +drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch