From: Greg Kroah-Hartman Date: Mon, 28 Jul 2025 12:04:30 +0000 (+0200) Subject: 6.15-stable patches X-Git-Tag: v6.6.101~36 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=33b1eb2857eb9ff863b06b2e3d3aeee0f3b308ce;p=thirdparty%2Fkernel%2Fstable-queue.git 6.15-stable patches added patches: arm-9448-1-use-an-absolute-path-to-unified.h-in-kbuild_aflags.patch arm-9450-1-fix-allowing-linker-dce-with-binutils-2.36.patch bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch drm-amdgpu-reset-the-clear-flag-in-buddy-during-resume.patch drm-i915-dp-fix-2.7-gbps-dp_link_bw-value-on-g4x.patch drm-sched-remove-optimization-that-causes-hang-when-killing-dependent-jobs.patch i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch i2c-tegra-fix-reset-error-handling-with-acpi.patch i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch mm-ksm-fix-wsometimes-uninitialized-from-clang-21-in-advisor_mode_show.patch platform-x86-alienware-wmi-wmax-fix-dmi_system_id-array.patch platform-x86-ideapad-laptop-fix-fnlock-not-remembered-among-boots.patch platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch revert-drm-gem-dma-use-dma_buf-from-gem-object-instance.patch revert-drm-gem-framebuffer-use-dma_buf-from-gem-object-instance.patch revert-drm-prime-use-dma_buf-from-gem-object-instance.patch sprintf.h-requires-stdarg.h.patch timekeeping-zero-initialize-system_counterval-when-querying-time-from-phc-drivers.patch --- diff --git a/queue-6.15/arm-9448-1-use-an-absolute-path-to-unified.h-in-kbuild_aflags.patch b/queue-6.15/arm-9448-1-use-an-absolute-path-to-unified.h-in-kbuild_aflags.patch new file mode 100644 index 0000000000..5eee003d5f --- /dev/null +++ b/queue-6.15/arm-9448-1-use-an-absolute-path-to-unified.h-in-kbuild_aflags.patch @@ -0,0 +1,55 @@ +From 87c4e1459e80bf65066f864c762ef4dc932fad4b Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 20 Jun 2025 19:08:09 +0100 +Subject: ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS + +From: Nathan Chancellor + +commit 87c4e1459e80bf65066f864c762ef4dc932fad4b upstream. + +After commit d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper +flags and language target"), which updated as-instr to use the +'assembler-with-cpp' language option, the Kbuild version of as-instr +always fails internally for arch/arm with + + : fatal error: asm/unified.h: No such file or directory + compilation terminated. + +because '-include' flags are now taken into account by the compiler +driver and as-instr does not have '$(LINUXINCLUDE)', so unified.h is not +found. + +This went unnoticed at the time of the Kbuild change because the last +use of as-instr in Kbuild that arch/arm could reach was removed in 5.7 +by commit 541ad0150ca4 ("arm: Remove 32bit KVM host support") but a +stable backport of the Kbuild change to before that point exposed this +potential issue if one were to be reintroduced. + +Follow the general pattern of '-include' paths throughout the tree and +make unified.h absolute using '$(srctree)' to ensure KBUILD_AFLAGS can +be used independently. + +Closes: https://lore.kernel.org/CACo-S-1qbCX4WAVFA63dWfHtrRHZBTyyr2js8Lx=Az03XHTTHg@mail.gmail.com/ + +Cc: stable@vger.kernel.org +Fixes: d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target") +Reported-by: KernelCI bot +Reviewed-by: Masahiro Yamada +Signed-off-by: Nathan Chancellor +Signed-off-by: Russell King (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/Makefile ++++ b/arch/arm/Makefile +@@ -149,7 +149,7 @@ endif + # Need -Uarm for gcc < 3.x + KBUILD_CPPFLAGS +=$(cpp-y) + KBUILD_CFLAGS +=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm +-KBUILD_AFLAGS +=$(CFLAGS_ABI) $(AFLAGS_ISA) -Wa,$(arch-y) $(tune-y) -include asm/unified.h -msoft-float ++KBUILD_AFLAGS +=$(CFLAGS_ABI) $(AFLAGS_ISA) -Wa,$(arch-y) $(tune-y) -include $(srctree)/arch/arm/include/asm/unified.h -msoft-float + KBUILD_RUSTFLAGS += --target=arm-unknown-linux-gnueabi + + CHECKFLAGS += -D__arm__ diff --git a/queue-6.15/arm-9450-1-fix-allowing-linker-dce-with-binutils-2.36.patch b/queue-6.15/arm-9450-1-fix-allowing-linker-dce-with-binutils-2.36.patch new file mode 100644 index 0000000000..7a32cdc7fa --- /dev/null +++ b/queue-6.15/arm-9450-1-fix-allowing-linker-dce-with-binutils-2.36.patch @@ -0,0 +1,46 @@ +From 53e7e1fb81cc8ba2da1cb31f8917ef397caafe91 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 14 Jul 2025 20:56:47 +0100 +Subject: ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36 + +From: Nathan Chancellor + +commit 53e7e1fb81cc8ba2da1cb31f8917ef397caafe91 upstream. + +Commit e7607f7d6d81 ("ARM: 9443/1: Require linker to support KEEP within +OVERLAY for DCE") accidentally broke the binutils version restriction +that was added in commit 0d437918fb64 ("ARM: 9414/1: Fix build issue +with LD_DEAD_CODE_DATA_ELIMINATION"), reintroducing the segmentation +fault addressed by that workaround. + +Restore the binutils version dependency by using +CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY as an additional condition to ensure +that CONFIG_HAVE_LD_DEAD_CODE_DATA_ELIMINATION is only enabled with +binutils >= 2.36 and ld.lld >= 21.0.0. + +Closes: https://lore.kernel.org/6739da7d-e555-407a-b5cb-e5681da71056@landley.net/ +Closes: https://lore.kernel.org/CAFERDQ0zPoya5ZQfpbeuKVZEo_fKsonLf6tJbp32QnSGAtbi+Q@mail.gmail.com/ + +Cc: stable@vger.kernel.org +Fixes: e7607f7d6d81 ("ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE") +Reported-by: Rob Landley +Tested-by: Rob Landley +Reported-by: Martin Wetterwald +Signed-off-by: Nathan Chancellor +Signed-off-by: Russell King (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -121,7 +121,7 @@ config ARM + select HAVE_KERNEL_XZ + select HAVE_KPROBES if !XIP_KERNEL && !CPU_ENDIAN_BE32 && !CPU_V7M + select HAVE_KRETPROBES if HAVE_KPROBES +- select HAVE_LD_DEAD_CODE_DATA_ELIMINATION if (LD_VERSION >= 23600 || LD_CAN_USE_KEEP_IN_OVERLAY) ++ select HAVE_LD_DEAD_CODE_DATA_ELIMINATION if (LD_VERSION >= 23600 || LD_IS_LLD) && LD_CAN_USE_KEEP_IN_OVERLAY + select HAVE_MOD_ARCH_SPECIFIC + select HAVE_NMI + select HAVE_OPTPROBES if !THUMB2_KERNEL diff --git a/queue-6.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch b/queue-6.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch new file mode 100644 index 0000000000..e7fd0a8044 --- /dev/null +++ b/queue-6.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch @@ -0,0 +1,71 @@ +From bddbe13d36a02d5097b99cf02354d5752ad1ac60 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 17 Jul 2025 10:23:07 +0800 +Subject: bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() + +From: Ma Ke + +commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 upstream. + +The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup() +twice, which would increment the device's reference count twice if +both lookups find a device. This could lead to a reference count leak. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function") +Signed-off-by: Ma Ke +Tested-by: Ioana Ciornei +Reviewed-by: Simon Horman +Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found") +Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/fsl-mc/fsl-mc-bus.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/bus/fsl-mc/fsl-mc-bus.c ++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c +@@ -943,6 +943,7 @@ struct fsl_mc_device *fsl_mc_get_endpoin + struct fsl_mc_obj_desc endpoint_desc = {{ 0 }}; + struct dprc_endpoint endpoint1 = {{ 0 }}; + struct dprc_endpoint endpoint2 = {{ 0 }}; ++ struct fsl_mc_bus *mc_bus; + int state, err; + + mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent); +@@ -966,6 +967,8 @@ struct fsl_mc_device *fsl_mc_get_endpoin + strcpy(endpoint_desc.type, endpoint2.type); + endpoint_desc.id = endpoint2.id; + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); ++ if (endpoint) ++ return endpoint; + + /* + * We know that the device has an endpoint because we verified by +@@ -973,17 +976,13 @@ struct fsl_mc_device *fsl_mc_get_endpoin + * yet discovered by the fsl-mc bus, thus the lookup returned NULL. + * Force a rescan of the devices in this container and retry the lookup. + */ +- if (!endpoint) { +- struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev); +- +- if (mutex_trylock(&mc_bus->scan_mutex)) { +- err = dprc_scan_objects(mc_bus_dev, true); +- mutex_unlock(&mc_bus->scan_mutex); +- } +- +- if (err < 0) +- return ERR_PTR(err); ++ mc_bus = to_fsl_mc_bus(mc_bus_dev); ++ if (mutex_trylock(&mc_bus->scan_mutex)) { ++ err = dprc_scan_objects(mc_bus_dev, true); ++ mutex_unlock(&mc_bus->scan_mutex); + } ++ if (err < 0) ++ return ERR_PTR(err); + + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); + /* diff --git a/queue-6.15/drm-amdgpu-reset-the-clear-flag-in-buddy-during-resume.patch b/queue-6.15/drm-amdgpu-reset-the-clear-flag-in-buddy-during-resume.patch new file mode 100644 index 0000000000..ac9d100308 --- /dev/null +++ b/queue-6.15/drm-amdgpu-reset-the-clear-flag-in-buddy-during-resume.patch @@ -0,0 +1,157 @@ +From 95a16160ca1d75c66bf7a1c5e0bcaffb18e7c7fc Mon Sep 17 00:00:00 2001 +From: Arunpravin Paneer Selvam +Date: Wed, 16 Jul 2025 13:21:24 +0530 +Subject: drm/amdgpu: Reset the clear flag in buddy during resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arunpravin Paneer Selvam + +commit 95a16160ca1d75c66bf7a1c5e0bcaffb18e7c7fc upstream. + +- Added a handler in DRM buddy manager to reset the cleared + flag for the blocks in the freelist. + +- This is necessary because, upon resuming, the VRAM becomes + cluttered with BIOS data, yet the VRAM backend manager + believes that everything has been cleared. + +v2: + - Add lock before accessing drm_buddy_clear_reset_blocks()(Matthew Auld) + - Force merge the two dirty blocks.(Matthew Auld) + - Add a new unit test case for this issue.(Matthew Auld) + - Having this function being able to flip the state either way would be + good. (Matthew Brost) + +v3(Matthew Auld): + - Do merge step first to avoid the use of extra reset flag. + +Signed-off-by: Arunpravin Paneer Selvam +Suggested-by: Christian König +Acked-by: Christian König +Reviewed-by: Matthew Auld +Cc: stable@vger.kernel.org +Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3812 +Signed-off-by: Christian König +Link: https://lore.kernel.org/r/20250716075125.240637-2-Arunpravin.PaneerSelvam@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 17 ++++++++++ + drivers/gpu/drm/drm_buddy.c | 43 +++++++++++++++++++++++++++ + include/drm/drm_buddy.h | 2 + + 5 files changed, 65 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -5123,6 +5123,8 @@ exit: + dev->dev->power.disable_depth--; + #endif + } ++ ++ amdgpu_vram_mgr_clear_reset_blocks(adev); + adev->in_suspend = false; + + if (adev->enable_mes) +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h +@@ -154,6 +154,7 @@ int amdgpu_vram_mgr_reserve_range(struct + uint64_t start, uint64_t size); + int amdgpu_vram_mgr_query_page_status(struct amdgpu_vram_mgr *mgr, + uint64_t start); ++void amdgpu_vram_mgr_clear_reset_blocks(struct amdgpu_device *adev); + + bool amdgpu_res_cpu_visible(struct amdgpu_device *adev, + struct ttm_resource *res); +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +@@ -783,6 +783,23 @@ uint64_t amdgpu_vram_mgr_vis_usage(struc + } + + /** ++ * amdgpu_vram_mgr_clear_reset_blocks - reset clear blocks ++ * ++ * @adev: amdgpu device pointer ++ * ++ * Reset the cleared drm buddy blocks. ++ */ ++void amdgpu_vram_mgr_clear_reset_blocks(struct amdgpu_device *adev) ++{ ++ struct amdgpu_vram_mgr *mgr = &adev->mman.vram_mgr; ++ struct drm_buddy *mm = &mgr->mm; ++ ++ mutex_lock(&mgr->lock); ++ drm_buddy_reset_clear(mm, false); ++ mutex_unlock(&mgr->lock); ++} ++ ++/** + * amdgpu_vram_mgr_intersects - test each drm buddy block for intersection + * + * @man: TTM memory type manager +--- a/drivers/gpu/drm/drm_buddy.c ++++ b/drivers/gpu/drm/drm_buddy.c +@@ -405,6 +405,49 @@ drm_get_buddy(struct drm_buddy_block *bl + EXPORT_SYMBOL(drm_get_buddy); + + /** ++ * drm_buddy_reset_clear - reset blocks clear state ++ * ++ * @mm: DRM buddy manager ++ * @is_clear: blocks clear state ++ * ++ * Reset the clear state based on @is_clear value for each block ++ * in the freelist. ++ */ ++void drm_buddy_reset_clear(struct drm_buddy *mm, bool is_clear) ++{ ++ u64 root_size, size, start; ++ unsigned int order; ++ int i; ++ ++ size = mm->size; ++ for (i = 0; i < mm->n_roots; ++i) { ++ order = ilog2(size) - ilog2(mm->chunk_size); ++ start = drm_buddy_block_offset(mm->roots[i]); ++ __force_merge(mm, start, start + size, order); ++ ++ root_size = mm->chunk_size << order; ++ size -= root_size; ++ } ++ ++ for (i = 0; i <= mm->max_order; ++i) { ++ struct drm_buddy_block *block; ++ ++ list_for_each_entry_reverse(block, &mm->free_list[i], link) { ++ if (is_clear != drm_buddy_block_is_clear(block)) { ++ if (is_clear) { ++ mark_cleared(block); ++ mm->clear_avail += drm_buddy_block_size(mm, block); ++ } else { ++ clear_reset(block); ++ mm->clear_avail -= drm_buddy_block_size(mm, block); ++ } ++ } ++ } ++ } ++} ++EXPORT_SYMBOL(drm_buddy_reset_clear); ++ ++/** + * drm_buddy_free_block - free a block + * + * @mm: DRM buddy manager +--- a/include/drm/drm_buddy.h ++++ b/include/drm/drm_buddy.h +@@ -160,6 +160,8 @@ int drm_buddy_block_trim(struct drm_budd + u64 new_size, + struct list_head *blocks); + ++void drm_buddy_reset_clear(struct drm_buddy *mm, bool is_clear); ++ + void drm_buddy_free_block(struct drm_buddy *mm, struct drm_buddy_block *block); + + void drm_buddy_free_list(struct drm_buddy *mm, diff --git a/queue-6.15/drm-i915-dp-fix-2.7-gbps-dp_link_bw-value-on-g4x.patch b/queue-6.15/drm-i915-dp-fix-2.7-gbps-dp_link_bw-value-on-g4x.patch new file mode 100644 index 0000000000..6ca0b18b69 --- /dev/null +++ b/queue-6.15/drm-i915-dp-fix-2.7-gbps-dp_link_bw-value-on-g4x.patch @@ -0,0 +1,57 @@ +From 9e0c433d0c05fde284025264b89eaa4ad59f0a3e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 10 Jul 2025 23:17:12 +0300 +Subject: drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 9e0c433d0c05fde284025264b89eaa4ad59f0a3e upstream. + +On g4x we currently use the 96MHz non-SSC refclk, which can't actually +generate an exact 2.7 Gbps link rate. In practice we end up with 2.688 +Gbps which seems to be close enough to actually work, but link training +is currently failing due to miscalculating the DP_LINK_BW value (we +calcualte it directly from port_clock which reflects the actual PLL +outpout frequency). + +Ideas how to fix this: +- nudge port_clock back up to 270000 during PLL computation/readout +- track port_clock and the nominal link rate separately so they might + differ a bit +- switch to the 100MHz refclk, but that one should be SSC so perhaps + not something we want + +While we ponder about a better solution apply some band aid to the +immediate issue of miscalculated DP_LINK_BW value. With this +I can again use 2.7 Gbps link rate on g4x. + +Cc: stable@vger.kernel.org +Fixes: 665a7b04092c ("drm/i915: Feed the DPLL output freq back into crtc_state") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-2-ville.syrjala@linux.intel.com +Reviewed-by: Imre Deak +(cherry picked from commit a8b874694db5cae7baaf522756f87acd956e6e66) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -1603,6 +1603,12 @@ int intel_dp_rate_select(struct intel_dp + void intel_dp_compute_rate(struct intel_dp *intel_dp, int port_clock, + u8 *link_bw, u8 *rate_select) + { ++ struct intel_display *display = to_intel_display(intel_dp); ++ ++ /* FIXME g4x can't generate an exact 2.7GHz with the 96MHz non-SSC refclk */ ++ if (display->platform.g4x && port_clock == 268800) ++ port_clock = 270000; ++ + /* eDP 1.4 rate select method. */ + if (intel_dp->use_rate_select) { + *link_bw = 0; diff --git a/queue-6.15/drm-sched-remove-optimization-that-causes-hang-when-killing-dependent-jobs.patch b/queue-6.15/drm-sched-remove-optimization-that-causes-hang-when-killing-dependent-jobs.patch new file mode 100644 index 0000000000..2e22d9facf --- /dev/null +++ b/queue-6.15/drm-sched-remove-optimization-that-causes-hang-when-killing-dependent-jobs.patch @@ -0,0 +1,81 @@ +From 15f77764e90a713ee3916ca424757688e4f565b9 Mon Sep 17 00:00:00 2001 +From: "Lin.Cao" +Date: Thu, 17 Jul 2025 16:44:53 +0800 +Subject: drm/sched: Remove optimization that causes hang when killing dependent jobs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lin.Cao + +commit 15f77764e90a713ee3916ca424757688e4f565b9 upstream. + +When application A submits jobs and application B submits a job with a +dependency on A's fence, the normal flow wakes up the scheduler after +processing each job. However, the optimization in +drm_sched_entity_add_dependency_cb() uses a callback that only clears +dependencies without waking up the scheduler. + +When application A is killed before its jobs can run, the callback gets +triggered but only clears the dependency without waking up the scheduler, +causing the scheduler to enter sleep state and application B to hang. + +Remove the optimization by deleting drm_sched_entity_clear_dep() and its +usage, ensuring the scheduler is always woken up when dependencies are +cleared. + +Fixes: 777dbd458c89 ("drm/amdgpu: drop a dummy wakeup scheduler") +Cc: stable@vger.kernel.org # v4.6+ +Signed-off-by: Lin.Cao +Reviewed-by: Christian König +Signed-off-by: Philipp Stanner +Link: https://lore.kernel.org/r/20250717084453.921097-1-lincao12@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/scheduler/sched_entity.c | 21 ++------------------- + 1 file changed, 2 insertions(+), 19 deletions(-) + +--- a/drivers/gpu/drm/scheduler/sched_entity.c ++++ b/drivers/gpu/drm/scheduler/sched_entity.c +@@ -355,17 +355,6 @@ void drm_sched_entity_destroy(struct drm + } + EXPORT_SYMBOL(drm_sched_entity_destroy); + +-/* drm_sched_entity_clear_dep - callback to clear the entities dependency */ +-static void drm_sched_entity_clear_dep(struct dma_fence *f, +- struct dma_fence_cb *cb) +-{ +- struct drm_sched_entity *entity = +- container_of(cb, struct drm_sched_entity, cb); +- +- entity->dependency = NULL; +- dma_fence_put(f); +-} +- + /* + * drm_sched_entity_wakeup - callback to clear the entity's dependency and + * wake up the scheduler +@@ -376,7 +365,8 @@ static void drm_sched_entity_wakeup(stru + struct drm_sched_entity *entity = + container_of(cb, struct drm_sched_entity, cb); + +- drm_sched_entity_clear_dep(f, cb); ++ entity->dependency = NULL; ++ dma_fence_put(f); + drm_sched_wakeup(entity->rq->sched); + } + +@@ -429,13 +419,6 @@ static bool drm_sched_entity_add_depende + fence = dma_fence_get(&s_fence->scheduled); + dma_fence_put(entity->dependency); + entity->dependency = fence; +- if (!dma_fence_add_callback(fence, &entity->cb, +- drm_sched_entity_clear_dep)) +- return true; +- +- /* Ignore it when it is already scheduled */ +- dma_fence_put(fence); +- return false; + } + + if (!dma_fence_add_callback(entity->dependency, &entity->cb, diff --git a/queue-6.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch b/queue-6.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch new file mode 100644 index 0000000000..a1a258b62c --- /dev/null +++ b/queue-6.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch @@ -0,0 +1,42 @@ +From a7982a14b3012527a9583d12525cd0dc9f8d8934 Mon Sep 17 00:00:00 2001 +From: Yang Xiwen +Date: Mon, 16 Jun 2025 00:01:10 +0800 +Subject: i2c: qup: jump out of the loop in case of timeout + +From: Yang Xiwen + +commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream. + +Original logic only sets the return value but doesn't jump out of the +loop if the bus is kept active by a client. This is not expected. A +malicious or buggy i2c client can hang the kernel in this case and +should be avoided. This is observed during a long time test with a +PCA953x GPIO extender. + +Fix it by changing the logic to not only sets the return value, but also +jumps out of the loop and return to the caller with -ETIMEDOUT. + +Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1") +Signed-off-by: Yang Xiwen +Cc: # v4.17+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-qup.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-qup.c ++++ b/drivers/i2c/busses/i2c-qup.c +@@ -452,8 +452,10 @@ static int qup_i2c_bus_active(struct qup + if (!(status & I2C_STATUS_BUS_ACTIVE)) + break; + +- if (time_after(jiffies, timeout)) ++ if (time_after(jiffies, timeout)) { + ret = -ETIMEDOUT; ++ break; ++ } + + usleep_range(len, len * 2); + } diff --git a/queue-6.15/i2c-tegra-fix-reset-error-handling-with-acpi.patch b/queue-6.15/i2c-tegra-fix-reset-error-handling-with-acpi.patch new file mode 100644 index 0000000000..263a4fd46d --- /dev/null +++ b/queue-6.15/i2c-tegra-fix-reset-error-handling-with-acpi.patch @@ -0,0 +1,80 @@ +From 56344e241c543f17e8102fa13466ad5c3e7dc9ff Mon Sep 17 00:00:00 2001 +From: Akhil R +Date: Thu, 10 Jul 2025 18:42:04 +0530 +Subject: i2c: tegra: Fix reset error handling with ACPI + +From: Akhil R + +commit 56344e241c543f17e8102fa13466ad5c3e7dc9ff upstream. + +The acpi_evaluate_object() returns an ACPI error code and not +Linux one. For the some platforms the err will have positive code +which may be interpreted incorrectly. Use device_reset() for +reset control which handles it correctly. + +Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support") +Reported-by: Andy Shevchenko +Signed-off-by: Akhil R +Cc: # v5.17+ +Reviewed-by: Andy Shevchenko +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250710131206.2316-2-akhilrajeev@nvidia.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-tegra.c | 24 +----------------------- + 1 file changed, 1 insertion(+), 23 deletions(-) + +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -607,7 +607,6 @@ static int tegra_i2c_wait_for_config_loa + static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev) + { + u32 val, clk_divisor, clk_multiplier, tsu_thd, tlow, thigh, non_hs_mode; +- acpi_handle handle = ACPI_HANDLE(i2c_dev->dev); + struct i2c_timings *t = &i2c_dev->timings; + int err; + +@@ -619,11 +618,7 @@ static int tegra_i2c_init(struct tegra_i + * emit a noisy warning on error, which won't stay unnoticed and + * won't hose machine entirely. + */ +- if (handle) +- err = acpi_evaluate_object(handle, "_RST", NULL, NULL); +- else +- err = reset_control_reset(i2c_dev->rst); +- ++ err = device_reset(i2c_dev->dev); + WARN_ON_ONCE(err); + + if (IS_DVC(i2c_dev)) +@@ -1666,19 +1661,6 @@ static void tegra_i2c_parse_dt(struct te + i2c_dev->is_vi = true; + } + +-static int tegra_i2c_init_reset(struct tegra_i2c_dev *i2c_dev) +-{ +- if (ACPI_HANDLE(i2c_dev->dev)) +- return 0; +- +- i2c_dev->rst = devm_reset_control_get_exclusive(i2c_dev->dev, "i2c"); +- if (IS_ERR(i2c_dev->rst)) +- return dev_err_probe(i2c_dev->dev, PTR_ERR(i2c_dev->rst), +- "failed to get reset control\n"); +- +- return 0; +-} +- + static int tegra_i2c_init_clocks(struct tegra_i2c_dev *i2c_dev) + { + int err; +@@ -1788,10 +1770,6 @@ static int tegra_i2c_probe(struct platfo + + tegra_i2c_parse_dt(i2c_dev); + +- err = tegra_i2c_init_reset(i2c_dev); +- if (err) +- return err; +- + err = tegra_i2c_init_clocks(i2c_dev); + if (err) + return err; diff --git a/queue-6.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch b/queue-6.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch new file mode 100644 index 0000000000..c807397dfa --- /dev/null +++ b/queue-6.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch @@ -0,0 +1,51 @@ +From a663b3c47ab10f66130818cf94eb59c971541c3f Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Thu, 3 Jul 2025 17:01:02 +0530 +Subject: i2c: virtio: Avoid hang by using interruptible completion wait + +From: Viresh Kumar + +commit a663b3c47ab10f66130818cf94eb59c971541c3f upstream. + +The current implementation uses wait_for_completion(), which can cause +the caller to hang indefinitely if the transfer never completes. + +Switch to wait_for_completion_interruptible() so that the operation can +be interrupted by signals. + +Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling") +Signed-off-by: Viresh Kumar +Cc: # v5.16+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-virtio.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-virtio.c ++++ b/drivers/i2c/busses/i2c-virtio.c +@@ -116,15 +116,16 @@ static int virtio_i2c_complete_reqs(stru + for (i = 0; i < num; i++) { + struct virtio_i2c_req *req = &reqs[i]; + +- wait_for_completion(&req->completion); +- +- if (!failed && req->in_hdr.status != VIRTIO_I2C_MSG_OK) +- failed = true; ++ if (!failed) { ++ if (wait_for_completion_interruptible(&req->completion)) ++ failed = true; ++ else if (req->in_hdr.status != VIRTIO_I2C_MSG_OK) ++ failed = true; ++ else ++ j++; ++ } + + i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], !failed); +- +- if (!failed) +- j++; + } + + return j; diff --git a/queue-6.15/mm-ksm-fix-wsometimes-uninitialized-from-clang-21-in-advisor_mode_show.patch b/queue-6.15/mm-ksm-fix-wsometimes-uninitialized-from-clang-21-in-advisor_mode_show.patch new file mode 100644 index 0000000000..776476310d --- /dev/null +++ b/queue-6.15/mm-ksm-fix-wsometimes-uninitialized-from-clang-21-in-advisor_mode_show.patch @@ -0,0 +1,57 @@ +From 153ad566724fe6f57b14f66e9726d295d22e576d Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 15 Jul 2025 12:56:16 -0700 +Subject: mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() + +From: Nathan Chancellor + +commit 153ad566724fe6f57b14f66e9726d295d22e576d upstream. + +After a recent change in clang to expose uninitialized warnings from const +variables [1], there is a false positive warning from the if statement in +advisor_mode_show(). + + mm/ksm.c:3687:11: error: variable 'output' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] + 3687 | else if (ksm_advisor == KSM_ADVISOR_SCAN_TIME) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + mm/ksm.c:3690:33: note: uninitialized use occurs here + 3690 | return sysfs_emit(buf, "%s\n", output); + | ^~~~~~ + +Rewrite the if statement to implicitly make KSM_ADVISOR_NONE the else +branch so that it is obvious to the compiler that ksm_advisor can only be +KSM_ADVISOR_NONE or KSM_ADVISOR_SCAN_TIME due to the assignments in +advisor_mode_store(). + +Link: https://lkml.kernel.org/r/20250715-ksm-fix-clang-21-uninit-warning-v1-1-f443feb4bfc4@kernel.org +Fixes: 66790e9a735b ("mm/ksm: add sysfs knobs for advisor") +Signed-off-by: Nathan Chancellor +Closes: https://github.com/ClangBuiltLinux/linux/issues/2100 +Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] +Acked-by: David Hildenbrand +Cc: Chengming Zhou +Cc: Stefan Roesch +Cc: xu xin +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/ksm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -3669,10 +3669,10 @@ static ssize_t advisor_mode_show(struct + { + const char *output; + +- if (ksm_advisor == KSM_ADVISOR_NONE) +- output = "[none] scan-time"; +- else if (ksm_advisor == KSM_ADVISOR_SCAN_TIME) ++ if (ksm_advisor == KSM_ADVISOR_SCAN_TIME) + output = "none [scan-time]"; ++ else ++ output = "[none] scan-time"; + + return sysfs_emit(buf, "%s\n", output); + } diff --git a/queue-6.15/platform-x86-alienware-wmi-wmax-fix-dmi_system_id-array.patch b/queue-6.15/platform-x86-alienware-wmi-wmax-fix-dmi_system_id-array.patch new file mode 100644 index 0000000000..a22190fdff --- /dev/null +++ b/queue-6.15/platform-x86-alienware-wmi-wmax-fix-dmi_system_id-array.patch @@ -0,0 +1,36 @@ +From 8346c6af27f1c1410eb314f4be5875fdf1579a10 Mon Sep 17 00:00:00 2001 +From: Kurt Borja +Date: Mon, 7 Jul 2025 03:24:05 -0300 +Subject: platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kurt Borja + +commit 8346c6af27f1c1410eb314f4be5875fdf1579a10 upstream. + +Add missing empty member to `awcc_dmi_table`. + +Cc: stable@vger.kernel.org +Fixes: 6d7f1b1a5db6 ("platform/x86: alienware-wmi: Split DMI table") +Signed-off-by: Kurt Borja +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250707-dmi-fix-v1-1-6730835d824d@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/dell/alienware-wmi-wmax.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/platform/x86/dell/alienware-wmi-wmax.c ++++ b/drivers/platform/x86/dell/alienware-wmi-wmax.c +@@ -205,6 +205,7 @@ static const struct dmi_system_id awcc_d + }, + .driver_data = &g_series_quirks, + }, ++ {} + }; + + enum WMAX_THERMAL_INFORMATION_OPERATIONS { diff --git a/queue-6.15/platform-x86-ideapad-laptop-fix-fnlock-not-remembered-among-boots.patch b/queue-6.15/platform-x86-ideapad-laptop-fix-fnlock-not-remembered-among-boots.patch new file mode 100644 index 0000000000..8a2bd9a4dc --- /dev/null +++ b/queue-6.15/platform-x86-ideapad-laptop-fix-fnlock-not-remembered-among-boots.patch @@ -0,0 +1,46 @@ +From 9533b789df7e8d273543a5991aec92447be043d7 Mon Sep 17 00:00:00 2001 +From: Rong Zhang +Date: Tue, 8 Jul 2025 00:38:06 +0800 +Subject: platform/x86: ideapad-laptop: Fix FnLock not remembered among boots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rong Zhang + +commit 9533b789df7e8d273543a5991aec92447be043d7 upstream. + +On devices supported by ideapad-laptop, the HW/FW can remember the +FnLock state among boots. However, since the introduction of the FnLock +LED class device, it is turned off while shutting down, as a side effect +of the LED class device unregistering sequence. + +Many users always turn on FnLock because they use function keys much +more frequently than multimedia keys. The behavior change is +inconvenient for them. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class +device so that the FnLock state gets remembered, which also aligns with +the behavior of manufacturer utilities on Windows. + +Fixes: 07f48f668fac ("platform/x86: ideapad-laptop: add FnLock LED class device") +Cc: stable@vger.kernel.org +Signed-off-by: Rong Zhang +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250707163808.155876-2-i@rong.moe +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/ideapad-laptop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1728,7 +1728,7 @@ static int ideapad_fn_lock_led_init(stru + priv->fn_lock.led.name = "platform::" LED_FUNCTION_FNLOCK; + priv->fn_lock.led.brightness_get = ideapad_fn_lock_led_cdev_get; + priv->fn_lock.led.brightness_set_blocking = ideapad_fn_lock_led_cdev_set; +- priv->fn_lock.led.flags = LED_BRIGHT_HW_CHANGED; ++ priv->fn_lock.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN; + + err = led_classdev_register(&priv->platform_device->dev, &priv->fn_lock.led); + if (err) diff --git a/queue-6.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch b/queue-6.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch new file mode 100644 index 0000000000..5f5bc8f833 --- /dev/null +++ b/queue-6.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch @@ -0,0 +1,45 @@ +From e10981075adce203eac0be866389309eeb8ef11e Mon Sep 17 00:00:00 2001 +From: Rong Zhang +Date: Tue, 8 Jul 2025 00:38:07 +0800 +Subject: platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rong Zhang + +commit e10981075adce203eac0be866389309eeb8ef11e upstream. + +On some models supported by ideapad-laptop, the HW/FW can remember the +state of keyboard backlight among boots. However, it is always turned +off while shutting down, as a side effect of the LED class device +unregistering sequence. + +This is inconvenient for users who always prefer turning on the +keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class +device so that the state of keyboard backlight gets remembered, which +also aligns with the behavior of manufacturer utilities on Windows. + +Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support") +Cc: stable@vger.kernel.org +Signed-off-by: Rong Zhang +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250707163808.155876-3-i@rong.moe +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/ideapad-laptop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1669,7 +1669,7 @@ static int ideapad_kbd_bl_init(struct id + priv->kbd_bl.led.name = "platform::" LED_FUNCTION_KBD_BACKLIGHT; + priv->kbd_bl.led.brightness_get = ideapad_kbd_bl_led_cdev_brightness_get; + priv->kbd_bl.led.brightness_set_blocking = ideapad_kbd_bl_led_cdev_brightness_set; +- priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED; ++ priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN; + + err = led_classdev_register(&priv->platform_device->dev, &priv->kbd_bl.led); + if (err) diff --git a/queue-6.15/revert-drm-gem-dma-use-dma_buf-from-gem-object-instance.patch b/queue-6.15/revert-drm-gem-dma-use-dma_buf-from-gem-object-instance.patch new file mode 100644 index 0000000000..789a061612 --- /dev/null +++ b/queue-6.15/revert-drm-gem-dma-use-dma_buf-from-gem-object-instance.patch @@ -0,0 +1,52 @@ +From 1918e79be908b8a2c8757640289bc196c14d928a Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 15 Jul 2025 17:58:17 +0200 +Subject: Revert "drm/gem-dma: Use dma_buf from GEM object instance" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Zimmermann + +commit 1918e79be908b8a2c8757640289bc196c14d928a upstream. + +This reverts commit e8afa1557f4f963c9a511bd2c6074a941c308685. + +The dma_buf field in struct drm_gem_object is not stable over the +object instance's lifetime. The field becomes NULL when user space +releases the final GEM handle on the buffer object. This resulted +in a NULL-pointer deref. + +Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on +GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: +Acquire internal references on GEM handles") only solved the problem +partially. They especially don't work for buffer objects without a DRM +framebuffer associated. + +Hence, this revert to going back to using .import_attach->dmabuf. + +v3: +- cc stable + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Simona Vetter +Acked-by: Christian König +Acked-by: Zack Rusin +Cc: # v6.15+ +Link: https://lore.kernel.org/r/20250715155934.150656-8-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gem_dma_helper.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_gem_dma_helper.c ++++ b/drivers/gpu/drm/drm_gem_dma_helper.c +@@ -230,7 +230,7 @@ void drm_gem_dma_free(struct drm_gem_dma + + if (drm_gem_is_imported(gem_obj)) { + if (dma_obj->vaddr) +- dma_buf_vunmap_unlocked(gem_obj->dma_buf, &map); ++ dma_buf_vunmap_unlocked(gem_obj->import_attach->dmabuf, &map); + drm_prime_gem_destroy(gem_obj, dma_obj->sgt); + } else if (dma_obj->vaddr) { + if (dma_obj->map_noncoherent) diff --git a/queue-6.15/revert-drm-gem-framebuffer-use-dma_buf-from-gem-object-instance.patch b/queue-6.15/revert-drm-gem-framebuffer-use-dma_buf-from-gem-object-instance.patch new file mode 100644 index 0000000000..279fcec003 --- /dev/null +++ b/queue-6.15/revert-drm-gem-framebuffer-use-dma_buf-from-gem-object-instance.patch @@ -0,0 +1,83 @@ +From 2712ca878b688682ac2ce02aefc413fc76019cd9 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 15 Jul 2025 17:58:15 +0200 +Subject: Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Zimmermann + +commit 2712ca878b688682ac2ce02aefc413fc76019cd9 upstream. + +This reverts commit cce16fcd7446dcff7480cd9d2b6417075ed81065. + +The dma_buf field in struct drm_gem_object is not stable over the +object instance's lifetime. The field becomes NULL when user space +releases the final GEM handle on the buffer object. This resulted +in a NULL-pointer deref. + +Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on +GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: +Acquire internal references on GEM handles") only solved the problem +partially. They especially don't work for buffer objects without a DRM +framebuffer associated. + +Hence, this revert to going back to using .import_attach->dmabuf. + +v3: +- cc stable + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Simona Vetter +Acked-by: Christian König +Acked-by: Zack Rusin +Cc: # v6.15+ +Link: https://lore.kernel.org/r/20250715155934.150656-6-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gem_framebuffer_helper.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c ++++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c +@@ -419,6 +419,7 @@ EXPORT_SYMBOL(drm_gem_fb_vunmap); + static void __drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir, + unsigned int num_planes) + { ++ struct dma_buf_attachment *import_attach; + struct drm_gem_object *obj; + int ret; + +@@ -427,9 +428,10 @@ static void __drm_gem_fb_end_cpu_access( + obj = drm_gem_fb_get_obj(fb, num_planes); + if (!obj) + continue; ++ import_attach = obj->import_attach; + if (!drm_gem_is_imported(obj)) + continue; +- ret = dma_buf_end_cpu_access(obj->dma_buf, dir); ++ ret = dma_buf_end_cpu_access(import_attach->dmabuf, dir); + if (ret) + drm_err(fb->dev, "dma_buf_end_cpu_access(%u, %d) failed: %d\n", + ret, num_planes, dir); +@@ -452,6 +454,7 @@ static void __drm_gem_fb_end_cpu_access( + */ + int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir) + { ++ struct dma_buf_attachment *import_attach; + struct drm_gem_object *obj; + unsigned int i; + int ret; +@@ -462,9 +465,10 @@ int drm_gem_fb_begin_cpu_access(struct d + ret = -EINVAL; + goto err___drm_gem_fb_end_cpu_access; + } ++ import_attach = obj->import_attach; + if (!drm_gem_is_imported(obj)) + continue; +- ret = dma_buf_begin_cpu_access(obj->dma_buf, dir); ++ ret = dma_buf_begin_cpu_access(import_attach->dmabuf, dir); + if (ret) + goto err___drm_gem_fb_end_cpu_access; + } diff --git a/queue-6.15/revert-drm-prime-use-dma_buf-from-gem-object-instance.patch b/queue-6.15/revert-drm-prime-use-dma_buf-from-gem-object-instance.patch new file mode 100644 index 0000000000..2f11b8ac94 --- /dev/null +++ b/queue-6.15/revert-drm-prime-use-dma_buf-from-gem-object-instance.patch @@ -0,0 +1,63 @@ +From fb4ef4a52b79a22ad382bfe77332642d02aef773 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 15 Jul 2025 17:58:14 +0200 +Subject: Revert "drm/prime: Use dma_buf from GEM object instance" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Zimmermann + +commit fb4ef4a52b79a22ad382bfe77332642d02aef773 upstream. + +This reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8. + +The dma_buf field in struct drm_gem_object is not stable over the +object instance's lifetime. The field becomes NULL when user space +releases the final GEM handle on the buffer object. This resulted +in a NULL-pointer deref. + +Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on +GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: +Acquire internal references on GEM handles") only solved the problem +partially. They especially don't work for buffer objects without a DRM +framebuffer associated. + +Hence, this revert to going back to using .import_attach->dmabuf. + +v3: +- cc stable + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Simona Vetter +Acked-by: Christian König +Acked-by: Zack Rusin +Cc: # v6.15+ +Link: https://lore.kernel.org/r/20250715155934.150656-5-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_prime.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c +index d828502268b8..a0a5d725eab0 100644 +--- a/drivers/gpu/drm/drm_prime.c ++++ b/drivers/gpu/drm/drm_prime.c +@@ -453,7 +453,13 @@ struct dma_buf *drm_gem_prime_handle_to_dmabuf(struct drm_device *dev, + } + + mutex_lock(&dev->object_name_lock); +- /* re-export the original imported/exported object */ ++ /* re-export the original imported object */ ++ if (obj->import_attach) { ++ dmabuf = obj->import_attach->dmabuf; ++ get_dma_buf(dmabuf); ++ goto out_have_obj; ++ } ++ + if (obj->dma_buf) { + get_dma_buf(obj->dma_buf); + dmabuf = obj->dma_buf; +-- +2.50.1 + diff --git a/queue-6.15/series b/queue-6.15/series index a8cb7da39b..8ee1d2b92d 100644 --- a/queue-6.15/series +++ b/queue-6.15/series @@ -41,3 +41,21 @@ net-hns3-fix-concurrent-setting-vlan-filter-issue.patch net-hns3-disable-interrupt-when-ptp-init-failed.patch net-hns3-fixed-vf-get-max-channels-bug.patch net-hns3-default-enable-tx-bounce-buffer-when-smmu-e.patch +platform-x86-alienware-wmi-wmax-fix-dmi_system_id-array.patch +platform-x86-ideapad-laptop-fix-fnlock-not-remembered-among-boots.patch +platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch +drm-i915-dp-fix-2.7-gbps-dp_link_bw-value-on-g4x.patch +revert-drm-prime-use-dma_buf-from-gem-object-instance.patch +revert-drm-gem-framebuffer-use-dma_buf-from-gem-object-instance.patch +revert-drm-gem-dma-use-dma_buf-from-gem-object-instance.patch +drm-amdgpu-reset-the-clear-flag-in-buddy-during-resume.patch +drm-sched-remove-optimization-that-causes-hang-when-killing-dependent-jobs.patch +mm-ksm-fix-wsometimes-uninitialized-from-clang-21-in-advisor_mode_show.patch +arm-9448-1-use-an-absolute-path-to-unified.h-in-kbuild_aflags.patch +arm-9450-1-fix-allowing-linker-dce-with-binutils-2.36.patch +timekeeping-zero-initialize-system_counterval-when-querying-time-from-phc-drivers.patch +i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch +i2c-tegra-fix-reset-error-handling-with-acpi.patch +i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch +bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch +sprintf.h-requires-stdarg.h.patch diff --git a/queue-6.15/sprintf.h-requires-stdarg.h.patch b/queue-6.15/sprintf.h-requires-stdarg.h.patch new file mode 100644 index 0000000000..96cb5bb9f6 --- /dev/null +++ b/queue-6.15/sprintf.h-requires-stdarg.h.patch @@ -0,0 +1,41 @@ +From 0dec7201788b9152f06321d0dab46eed93834cda Mon Sep 17 00:00:00 2001 +From: Stephen Rothwell +Date: Mon, 21 Jul 2025 16:15:57 +1000 +Subject: sprintf.h requires stdarg.h + +From: Stephen Rothwell + +commit 0dec7201788b9152f06321d0dab46eed93834cda upstream. + +In file included from drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c:4: +include/linux/sprintf.h:11:54: error: unknown type name 'va_list' + 11 | __printf(2, 0) int vsprintf(char *buf, const char *, va_list); + | ^~~~~~~ +include/linux/sprintf.h:1:1: note: 'va_list' is defined in header ''; this is probably fixable by adding '#include ' + +Link: https://lkml.kernel.org/r/20250721173754.42865913@canb.auug.org.au +Fixes: 39ced19b9e60 ("lib/vsprintf: split out sprintf() and friends") +Signed-off-by: Stephen Rothwell +Cc: Andriy Shevchenko +Cc: Herbert Xu +Cc: Petr Mladek +Cc: Steven Rostedt +Cc: Rasmus Villemoes +Cc: Sergey Senozhatsky +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/sprintf.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/sprintf.h ++++ b/include/linux/sprintf.h +@@ -4,6 +4,7 @@ + + #include + #include ++#include + + int num_to_str(char *buf, int size, unsigned long long num, unsigned int width); + diff --git a/queue-6.15/timekeeping-zero-initialize-system_counterval-when-querying-time-from-phc-drivers.patch b/queue-6.15/timekeeping-zero-initialize-system_counterval-when-querying-time-from-phc-drivers.patch new file mode 100644 index 0000000000..7e0cc87db6 --- /dev/null +++ b/queue-6.15/timekeeping-zero-initialize-system_counterval-when-querying-time-from-phc-drivers.patch @@ -0,0 +1,45 @@ +From 67c632b4a7fbd6b76a08b86f4950f0f84de93439 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Markus=20Bl=C3=B6chl?= +Date: Sun, 20 Jul 2025 15:54:51 +0200 +Subject: timekeeping: Zero initialize system_counterval when querying time from phc drivers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Blöchl + +commit 67c632b4a7fbd6b76a08b86f4950f0f84de93439 upstream. + +Most drivers only populate the fields cycles and cs_id of system_counterval +in their get_time_fn() callback for get_device_system_crosststamp(), unless +they explicitly provide nanosecond values. + +When the use_nsecs field was added to struct system_counterval, most +drivers did not care. Clock sources other than CSID_GENERIC could then get +converted in convert_base_to_cs() based on an uninitialized use_nsecs field, +which usually results in -EINVAL during the following range check. + +Pass in a fully zero initialized system_counterval_t to cure that. + +Fixes: 6b2e29977518 ("timekeeping: Provide infrastructure for converting to/from a base clock") +Signed-off-by: Markus Blöchl +Signed-off-by: Thomas Gleixner +Acked-by: John Stultz +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20250720-timekeeping_uninit_crossts-v2-1-f513c885b7c2@blochl.de +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/timekeeping.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -1256,7 +1256,7 @@ int get_device_system_crosststamp(int (* + struct system_time_snapshot *history_begin, + struct system_device_crosststamp *xtstamp) + { +- struct system_counterval_t system_counterval; ++ struct system_counterval_t system_counterval = {}; + struct timekeeper *tk = &tk_core.timekeeper; + u64 cycles, now, interval_start; + unsigned int clock_was_set_seq = 0;