From: Greg Kroah-Hartman Date: Mon, 13 Apr 2026 15:12:01 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=529f6d56a61e9867637cd9d68e869fd44340da36;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch --- diff --git a/queue-5.15/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch b/queue-5.15/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch new file mode 100644 index 0000000000..48f83b8610 --- /dev/null +++ b/queue-5.15/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch @@ -0,0 +1,96 @@ +From 371526a85a9b24970036b10365d5b0a9c6021fb9 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Fri, 13 Mar 2026 15:50:21 -0600 +Subject: io_uring/poll: correctly handle io_poll_add() return value on update + +From: Jens Axboe + +Commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e upstream. + +When the core of io_uring was updated to handle completions +consistently and with fixed return codes, the POLL_REMOVE opcode +with updates got slightly broken. If a POLL_ADD is pending and +then POLL_REMOVE is used to update the events of that request, if that +update causes the POLL_ADD to now trigger, then that completion is lost +and a CQE is never posted. + +Additionally, ensure that if an update does cause an existing POLL_ADD +to complete, that the completion value isn't always overwritten with +-ECANCELED. For that case, whatever io_poll_add() set the value to +should just be retained. + +Cc: stable@vger.kernel.org +Fixes: 97b388d70b53 ("io_uring: handle completions in the core") +Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com +Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io_uring.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -6127,7 +6127,7 @@ static int io_poll_add_prep(struct io_ki + return 0; + } + +-static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) ++static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags) + { + struct io_poll_iocb *poll = &req->poll; + struct io_poll_table ipt; +@@ -6139,11 +6139,21 @@ static int io_poll_add(struct io_kiocb * + if (!ret && ipt.error) + req_set_fail(req); + ret = ret ?: ipt.error; +- if (ret) ++ if (ret > 0) { + __io_req_complete(req, issue_flags, ret, 0); ++ return ret; ++ } + return 0; + } + ++static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) ++{ ++ int ret; ++ ++ ret = __io_poll_add(req, issue_flags); ++ return ret < 0 ? ret : 0; ++} ++ + static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) + { + struct io_ring_ctx *ctx = req->ctx; +@@ -6159,6 +6169,7 @@ static int io_poll_update(struct io_kioc + ret = preq ? -EALREADY : -ENOENT; + goto out; + } ++ preq->result = -ECANCELED; + spin_unlock(&ctx->completion_lock); + + if (req->poll_update.update_events || req->poll_update.update_user_data) { +@@ -6171,16 +6182,17 @@ static int io_poll_update(struct io_kioc + if (req->poll_update.update_user_data) + preq->user_data = req->poll_update.new_user_data; + +- ret2 = io_poll_add(preq, issue_flags); ++ ret2 = __io_poll_add(preq, issue_flags); + /* successfully updated, don't complete poll request */ + if (!ret2) + goto out; ++ preq->result = ret2; ++ + } +- req_set_fail(preq); +- io_req_complete(preq, -ECANCELED); ++ if (preq->result < 0) ++ req_set_fail(preq); ++ io_req_complete(preq, preq->result); + out: +- if (ret < 0) +- req_set_fail(req); + /* complete update request, we're done with it */ + io_req_complete(req, ret); + io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); diff --git a/queue-5.15/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch b/queue-5.15/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch new file mode 100644 index 0000000000..f9e2d3a09e --- /dev/null +++ b/queue-5.15/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch @@ -0,0 +1,95 @@ +From manivannan.sadhasivam@oss.qualcomm.com Mon Apr 13 17:02:30 2026 +From: Manivannan Sadhasivam +Date: Tue, 31 Mar 2026 14:44:55 +0530 +Subject: Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" +To: stable@vger.kernel.org +Cc: bhelgaas@google.com, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, robin.murphy@arm.com, Manivannan Sadhasivam , John Hancock , bjorn.forsman@gmail.com, Linux kernel regressions list +Message-ID: <20260331091455.30394-1-manivannan.sadhasivam@oss.qualcomm.com> + +From: Manivannan Sadhasivam + +This reverts commit b20b659c2c6a072560b360feda81ae52176034df which is +commit c41e2fb67e26b04d919257875fa954aa5f6e392e upstream. + +The original commit attempted to enable ACS in pci_dma_configure() prior +to IOMMU group assignment in iommu_init_device() to fix the ACS enablement +issue for OF platforms. But that assumption doesn't hold true for kernel +versions prior to v6.15, because on these older kernels, +pci_dma_configure() is called *after* iommu_init_device(). So the IOMMU +groups are already created before the ACS gets enabled. This causes the +devices that should have been split into separate groups by ACS, getting +merged into one group, thereby breaking the IOMMU isolation as reported on +the AMD machines. + +So revert the offending commit to restore the IOMMU group assignment on +those affected machines. It should be noted that ACS has never really +worked on kernel versions prior to v6.15, so the revert doesn't make any +difference for OF platforms. + +Reported-by: John Hancock +Reported-by: bjorn.forsman@gmail.com +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221234 +Fixes: b20b659c2c6a ("PCI: Enable ACS after configuring IOMMU for OF platforms") +Cc: Linux kernel regressions list +Link: https://lore.kernel.org/regressions/2c30f181-ffc6-4d63-a64e-763cf4528f48@leemhuis.info +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci-driver.c | 8 -------- + drivers/pci/pci.c | 10 +++++++++- + drivers/pci/pci.h | 1 - + 3 files changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1616,14 +1616,6 @@ static int pci_dma_configure(struct devi + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(to_pci_dev(dev)); +- + pci_put_host_bridge_device(bridge); + return ret; + } +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -936,7 +936,7 @@ static void pci_std_enable_acs(struct pc + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-void pci_enable_acs(struct pci_dev *dev) ++static void pci_enable_acs(struct pci_dev *dev) + { + if (!pci_acs_enable) + goto disable_acs_redir; +@@ -3609,6 +3609,14 @@ bool pci_acs_path_enabled(struct pci_dev + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); ++ ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(dev); + } + + /** +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -562,7 +562,6 @@ static inline resource_size_t pci_resour + } + + void pci_acs_init(struct pci_dev *dev); +-void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); diff --git a/queue-5.15/series b/queue-5.15/series index 0ad8b8a578..dd06b0ebe2 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -566,3 +566,5 @@ bluetooth-l2cap-fix-accepting-multiple-l2cap_ecred_conn_req.patch drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch ksmbd-fix-refcount-leak-when-invalid-session-is-found-on-session-lookup.patch ksmbd-fix-dangling-pointer-in-krb_authenticate.patch +revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch +io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch