From: Greg Kroah-Hartman Date: Fri, 7 Aug 2026 13:44:06 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.6.151~13 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57a1b95d1785e53ebad9df60997930df685587c8;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch --- diff --git a/queue-6.12/drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch b/queue-6.12/drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch new file mode 100644 index 0000000000..7e712cc5cc --- /dev/null +++ b/queue-6.12/drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch @@ -0,0 +1,46 @@ +From bd64240dc88caaf7b96dd869f36f165f51b52039 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Fri, 3 Apr 2026 13:53:54 -0700 +Subject: drm/fb-helper: Fix a locking bug in an error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bart Van Assche + +commit bd64240dc88caaf7b96dd869f36f165f51b52039 upstream. + +The name of the function __drm_fb_helper_initial_config_and_unlock() and +also the comment above that function make it clear that all code paths +in this function should unlock fb_helper->lock before returning. Add a +mutex_unlock() call in the only code path where it is missing. This has +been detected by the Clang thread-safety analyzer. + +Cc: Thomas Zimmermann +Cc: Christian König # radeon +Cc: Dmitry Baryshkov # msm +Cc: Javier Martinez Canillas +Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in single place") +Signed-off-by: Bart Van Assche +Signed-off-by: Thomas Zimmermann +Reviewed-by: Thomas Zimmermann +Link: https://patch.msgid.link/20260403205355.1181984-1-bvanassche@acm.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_fb_helper.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1782,8 +1782,10 @@ __drm_fb_helper_initial_config_and_unloc + drm_client_modeset_probe(&fb_helper->client, width, height); + + info = drm_fb_helper_alloc_info(fb_helper); +- if (IS_ERR(info)) ++ if (IS_ERR(info)) { ++ mutex_unlock(&fb_helper->lock); + return PTR_ERR(info); ++ } + + ret = drm_fb_helper_single_fb_probe(fb_helper); + if (ret < 0) { diff --git a/queue-6.12/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch b/queue-6.12/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch new file mode 100644 index 0000000000..6abef8830a --- /dev/null +++ b/queue-6.12/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch @@ -0,0 +1,32 @@ +From d23bd83f3e47a928e783c0d6a004737519dc77dc Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 21 Apr 2026 09:29:05 +0200 +Subject: drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info + +From: Thomas Zimmermann + +commit d23bd83f3e47a928e783c0d6a004737519dc77dc upstream. + +That field already contains the value being assigned. No need to do +this twice. + +Signed-off-by: Thomas Zimmermann +Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in single place") +Cc: linux-tegra@vger.kernel.org +Signed-off-by: Thierry Reding +Link: https://patch.msgid.link/20260421073646.144712-2-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tegra/fbdev.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/tegra/fbdev.c ++++ b/drivers/gpu/drm/tegra/fbdev.c +@@ -105,7 +105,6 @@ static int tegra_fbdev_probe(struct drm_ + } + + helper->fb = fb; +- helper->info = info; + + info->fbops = &tegra_fb_ops; + diff --git a/queue-6.12/series b/queue-6.12/series index ab26b276e3..b18e990558 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -333,3 +333,5 @@ rxrpc-fix-irq-disabled-in-local_bh_enable.patch can-use-skb-hash-instead-of-private-variable-in-headroom.patch can-isotp-fix-timer-drain-order-wakeup-handling-and-tx_gen-ordering.patch usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch +drm-fb-helper-fix-a-locking-bug-in-an-error-path.patch +drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch