From: Greg Kroah-Hartman Date: Fri, 7 Aug 2026 13:29:48 +0000 (+0200) Subject: 7.1-stable patches X-Git-Tag: v6.6.151~14 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7caecf29d011fdbb906d5428e910fb56c9a96344;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch --- diff --git a/queue-7.1/series b/queue-7.1/series index 6c40b5463e..156918a1b1 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -435,3 +435,4 @@ drm-xe-wait-on-external-bo-kernel-fences-in-exec-ioctl.patch media-chips-media-wave5-support-cbp-profile.patch drm-amd-display-check-grph_flip-status-before-sendin.patch drm-amd-display-exit-idle-optimizations-before-progr.patch +usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch diff --git a/queue-7.1/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch b/queue-7.1/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch new file mode 100644 index 0000000000..11f432e74c --- /dev/null +++ b/queue-7.1/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch @@ -0,0 +1,47 @@ +From fb0bf289f5d529336ef490c8273e88a8a8b29f69 Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski +Date: Fri, 17 Jul 2026 10:46:14 +0000 +Subject: usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path + +From: Andrei Kuchynski + +commit fb0bf289f5d529336ef490c8273e88a8a8b29f69 upstream. + +The commit 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and +ordering in port unregistration") consolidated port teardown into the +ucsi_unregister_port() helper. However, it introduced an ordering problem +in the ucsi_init() error path. + +Fix this by ensuring ucsi_unregister_port() is called before we unregister +their corresponding lockdep keys. + +Cc: stable@vger.kernel.org +Fixes: 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and ordering in port unregistration") +Reported-by: "Borah, Chaitanya Kumar" +Closes: https://lore.kernel.org/all/22064276-6c56-411a-9f20-6917ceeb865f@intel.com/ +Signed-off-by: Andrei Kuchynski +Tested-by: Chaitanya Kumar Borah +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20260717104614.325250-1-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -2110,11 +2110,11 @@ static int ucsi_init(struct ucsi *ucsi) + return 0; + + err_unregister: ++ for (con = connector; con->port; con++) ++ ucsi_unregister_port(con); + for (i = 0; i < ucsi->cap.num_connectors; i++) + lockdep_unregister_key(&connector[i].lock_key); + +- for (con = connector; con->port; con++) +- ucsi_unregister_port(con); + kfree(connector); + err_reset: + memset(&ucsi->cap, 0, sizeof(ucsi->cap));