From: Greg Kroah-Hartman Date: Fri, 7 Aug 2026 13:29:34 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.6.151~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=898eed7394711c77cd0f599337628c693958c307;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch --- diff --git a/queue-6.18/series b/queue-6.18/series index 64f4507416..bdd3e9b52c 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -391,3 +391,4 @@ drm-xe-add-page-reclamation-info-to-device-info.patch drm-xe-pt-reset-current_op-in-xe_pt_update_ops_init.patch can-use-skb-hash-instead-of-private-variable-in-headroom.patch can-isotp-fix-timer-drain-order-wakeup-handling-and-tx_gen-ordering.patch +usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch diff --git a/queue-6.18/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch b/queue-6.18/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch new file mode 100644 index 0000000000..b0c0a6a592 --- /dev/null +++ b/queue-6.18/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch @@ -0,0 +1,47 @@ +From fb0bf289f5d529336ef490c8273e88a8a8b29f69 Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski +Date: Fri, 17 Jul 2026 10:46:14 +0000 +Subject: usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path + +From: Andrei Kuchynski + +commit fb0bf289f5d529336ef490c8273e88a8a8b29f69 upstream. + +The commit 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and +ordering in port unregistration") consolidated port teardown into the +ucsi_unregister_port() helper. However, it introduced an ordering problem +in the ucsi_init() error path. + +Fix this by ensuring ucsi_unregister_port() is called before we unregister +their corresponding lockdep keys. + +Cc: stable@vger.kernel.org +Fixes: 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and ordering in port unregistration") +Reported-by: "Borah, Chaitanya Kumar" +Closes: https://lore.kernel.org/all/22064276-6c56-411a-9f20-6917ceeb865f@intel.com/ +Signed-off-by: Andrei Kuchynski +Tested-by: Chaitanya Kumar Borah +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20260717104614.325250-1-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -2050,11 +2050,11 @@ static int ucsi_init(struct ucsi *ucsi) + return 0; + + err_unregister: ++ for (con = connector; con->port; con++) ++ ucsi_unregister_port(con); + for (i = 0; i < ucsi->cap.num_connectors; i++) + lockdep_unregister_key(&connector[i].lock_key); + +- for (con = connector; con->port; con++) +- ucsi_unregister_port(con); + kfree(connector); + err_reset: + memset(&ucsi->cap, 0, sizeof(ucsi->cap));