From: Greg Kroah-Hartman Date: Mon, 23 Mar 2026 09:09:44 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.1.167~27 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=91ea00e13a87847c617e07c90891e889402e08ef;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch x86-platform-uv-handle-deconfigured-sockets.patch --- diff --git a/queue-6.6/i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch b/queue-6.6/i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch new file mode 100644 index 0000000000..b0aa685a73 --- /dev/null +++ b/queue-6.6/i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch @@ -0,0 +1,36 @@ +From be627abcc0d5dbd5882873bd85fbc18aa3d189ed Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 1 Mar 2026 17:21:01 +0100 +Subject: i2c: fsi: Fix a potential leak in fsi_i2c_probe() + +From: Christophe JAILLET + +commit be627abcc0d5dbd5882873bd85fbc18aa3d189ed upstream. + +In the commit in Fixes:, when the code has been updated to use an explicit +for loop, instead of for_each_available_child_of_node(), the assumption +that a reference to a device_node structure would be released at each +iteration has been broken. + +Now, an explicit of_node_put() is needed to release the reference. + +Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports") +Signed-off-by: Christophe JAILLET +Cc: # v5.3+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/fd805c39f8de51edf303856103d782138a1633c8.1772382022.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-fsi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/busses/i2c-fsi.c ++++ b/drivers/i2c/busses/i2c-fsi.c +@@ -728,6 +728,7 @@ static int fsi_i2c_probe(struct device * + rc = i2c_add_adapter(&port->adapter); + if (rc < 0) { + dev_err(dev, "Failed to register adapter: %d\n", rc); ++ of_node_put(np); + kfree(port); + continue; + } diff --git a/queue-6.6/i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch b/queue-6.6/i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch new file mode 100644 index 0000000000..a2c8660eba --- /dev/null +++ b/queue-6.6/i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch @@ -0,0 +1,130 @@ +From 78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc Mon Sep 17 00:00:00 2001 +From: Gabor Juhos +Date: Thu, 26 Feb 2026 14:11:27 +0100 +Subject: i2c: pxa: defer reset on Armada 3700 when recovery is used + +From: Gabor Juhos + +commit 78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc upstream. + +The I2C communication is completely broken on the Armada 3700 platform +since commit 0b01392c18b9 ("i2c: pxa: move to generic GPIO recovery"). + +For example, on the Methode uDPU board, probing of the two onboard +temperature sensors fails ... + + [ 7.271713] i2c i2c-0: using pinctrl states for GPIO recovery + [ 7.277503] i2c i2c-0: PXA I2C adapter + [ 7.282199] i2c i2c-1: using pinctrl states for GPIO recovery + [ 7.288241] i2c i2c-1: PXA I2C adapter + [ 7.292947] sfp sfp-eth1: Host maximum power 3.0W + [ 7.299614] sfp sfp-eth0: Host maximum power 3.0W + [ 7.308178] lm75 1-0048: supply vs not found, using dummy regulator + [ 32.489631] lm75 1-0048: probe with driver lm75 failed with error -121 + [ 32.496833] lm75 1-0049: supply vs not found, using dummy regulator + [ 82.890614] lm75 1-0049: probe with driver lm75 failed with error -121 + +... and accessing the plugged-in SFP modules also does not work: + + [ 511.298537] sfp sfp-eth1: please wait, module slow to respond + [ 536.488530] sfp sfp-eth0: please wait, module slow to respond + ... + [ 1065.688536] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO + [ 1090.888532] sfp sfp-eth0: failed to read EEPROM: -EREMOTEIO + +After a discussion [1], there was an attempt to fix the problem by +reverting the offending change by commit 7b211c767121 ("Revert "i2c: +pxa: move to generic GPIO recovery""), but that only helped to fix +the issue in the 6.1.y stable tree. The reason behind the partial succes +is that there was another change in commit 20cb3fce4d60 ("i2c: Set i2c +pinctrl recovery info from it's device pinctrl") in the 6.3-rc1 cycle +which broke things further. + +The cause of the problem is the same in case of both offending commits +mentioned above. Namely, the I2C core code changes the pinctrl state to +GPIO while running the recovery initialization code. Although the PXA +specific initialization also does this, but the key difference is that +it happens before the controller is getting enabled in i2c_pxa_reset(), +whereas in the case of the generic initialization it happens after that. + +Change the code to reset the controller only before the first transfer +instead of before registering the controller. This ensures that the +controller is not enabled at the time when the generic recovery code +performs the pinctrl state changes, thus avoids the problem described +above. + +As the result this change restores the original behaviour, which in +turn makes the I2C communication to work again as it can be seen from +the following log: + + [ 7.363250] i2c i2c-0: using pinctrl states for GPIO recovery + [ 7.369041] i2c i2c-0: PXA I2C adapter + [ 7.373673] i2c i2c-1: using pinctrl states for GPIO recovery + [ 7.379742] i2c i2c-1: PXA I2C adapter + [ 7.384506] sfp sfp-eth1: Host maximum power 3.0W + [ 7.393013] sfp sfp-eth0: Host maximum power 3.0W + [ 7.399266] lm75 1-0048: supply vs not found, using dummy regulator + [ 7.407257] hwmon hwmon0: temp1_input not attached to any thermal zone + [ 7.413863] lm75 1-0048: hwmon0: sensor 'tmp75c' + [ 7.418746] lm75 1-0049: supply vs not found, using dummy regulator + [ 7.426371] hwmon hwmon1: temp1_input not attached to any thermal zone + [ 7.432972] lm75 1-0049: hwmon1: sensor 'tmp75c' + [ 7.755092] sfp sfp-eth1: module MENTECHOPTO POS22-LDCC-KR rev 1.0 sn MNC208U90009 dc 200828 + [ 7.764997] mvneta d0040000.ethernet eth1: unsupported SFP module: no common interface modes + [ 7.785362] sfp sfp-eth0: module Mikrotik S-RJ01 rev 1.0 sn 61B103C55C58 dc 201022 + [ 7.803426] hwmon hwmon2: temp1_input not attached to any thermal zone + +Link: https://lore.kernel.org/r/20230926160255.330417-1-robert.marko@sartura.hr #1 + +Cc: stable@vger.kernel.org # 6.3+ +Fixes: 20cb3fce4d60 ("i2c: Set i2c pinctrl recovery info from it's device pinctrl") +Signed-off-by: Gabor Juhos +Tested-by: Robert Marko +Reviewed-by: Linus Walleij +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260226-i2c-pxa-fix-i2c-communication-v4-1-797a091dae87@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-pxa.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-pxa.c ++++ b/drivers/i2c/busses/i2c-pxa.c +@@ -267,6 +267,7 @@ struct pxa_i2c { + struct pinctrl *pinctrl; + struct pinctrl_state *pinctrl_default; + struct pinctrl_state *pinctrl_recovery; ++ bool reset_before_xfer; + }; + + #define _IBMR(i2c) ((i2c)->reg_ibmr) +@@ -1143,6 +1144,11 @@ static int i2c_pxa_xfer(struct i2c_adapt + { + struct pxa_i2c *i2c = adap->algo_data; + ++ if (i2c->reset_before_xfer) { ++ i2c_pxa_reset(i2c); ++ i2c->reset_before_xfer = false; ++ } ++ + return i2c_pxa_internal_xfer(i2c, msgs, num, i2c_pxa_do_xfer); + } + +@@ -1522,7 +1528,16 @@ static int i2c_pxa_probe(struct platform + } + } + +- i2c_pxa_reset(i2c); ++ /* ++ * Skip reset on Armada 3700 when recovery is used to avoid ++ * controller hang due to the pinctrl state changes done by ++ * the generic recovery initialization code. The reset will ++ * be performed later, prior to the first transfer. ++ */ ++ if (i2c_type == REGS_A3700 && i2c->adap.bus_recovery_info) ++ i2c->reset_before_xfer = true; ++ else ++ i2c_pxa_reset(i2c); + + ret = i2c_add_numbered_adapter(&i2c->adap); + if (ret < 0) diff --git a/queue-6.6/series b/queue-6.6/series index 7f4c3771a9..a4574dbffd 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -551,3 +551,6 @@ hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch bluetooth-l2cap-fix-accepting-multiple-l2cap_ecred_conn_req.patch usb-serial-f81232-fix-incomplete-serial-port-generation.patch +i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch +i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch +x86-platform-uv-handle-deconfigured-sockets.patch diff --git a/queue-6.6/x86-platform-uv-handle-deconfigured-sockets.patch b/queue-6.6/x86-platform-uv-handle-deconfigured-sockets.patch new file mode 100644 index 0000000000..2794363d3c --- /dev/null +++ b/queue-6.6/x86-platform-uv-handle-deconfigured-sockets.patch @@ -0,0 +1,53 @@ +From 1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3 Mon Sep 17 00:00:00 2001 +From: Kyle Meyer +Date: Fri, 20 Mar 2026 12:19:20 -0500 +Subject: x86/platform/uv: Handle deconfigured sockets + +From: Kyle Meyer + +commit 1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3 upstream. + +When a socket is deconfigured, it's mapped to SOCK_EMPTY (0xffff). This causes +a panic while allocating UV hub info structures. + +Fix this by using NUMA_NO_NODE, allowing UV hub info structures to be +allocated on valid nodes. + +Fixes: 8a50c5851927 ("x86/platform/uv: UV support for sub-NUMA clustering") +Signed-off-by: Kyle Meyer +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Steve Wahl +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/ab2BmGL0ehVkkjKk@hpe.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/apic/x2apic_uv_x.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -1760,8 +1760,22 @@ static void __init uv_system_init_hub(vo + struct uv_hub_info_s *new_hub; + + /* Allocate & fill new per hub info list */ +- new_hub = (bid == 0) ? &uv_hub_info_node0 +- : kzalloc_node(bytes, GFP_KERNEL, uv_blade_to_node(bid)); ++ if (bid == 0) { ++ new_hub = &uv_hub_info_node0; ++ } else { ++ int nid; ++ ++ /* ++ * Deconfigured sockets are mapped to SOCK_EMPTY. Use ++ * NUMA_NO_NODE to allocate on a valid node. ++ */ ++ nid = uv_blade_to_node(bid); ++ if (nid == SOCK_EMPTY) ++ nid = NUMA_NO_NODE; ++ ++ new_hub = kzalloc_node(bytes, GFP_KERNEL, nid); ++ } ++ + if (WARN_ON_ONCE(!new_hub)) { + /* do not kfree() bid 0, which is statically allocated */ + while (--bid > 0)