From: Greg Kroah-Hartman Date: Mon, 28 Jul 2025 11:44:15 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.6.101~37 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=92440c141429ab81236d93a7b5c74c13b3df9481;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch i2c-tegra-fix-reset-error-handling-with-acpi.patch i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch --- diff --git a/queue-6.1/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch b/queue-6.1/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch new file mode 100644 index 0000000000..a85b9d9681 --- /dev/null +++ b/queue-6.1/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch @@ -0,0 +1,71 @@ +From bddbe13d36a02d5097b99cf02354d5752ad1ac60 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 17 Jul 2025 10:23:07 +0800 +Subject: bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() + +From: Ma Ke + +commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 upstream. + +The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup() +twice, which would increment the device's reference count twice if +both lookups find a device. This could lead to a reference count leak. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function") +Signed-off-by: Ma Ke +Tested-by: Ioana Ciornei +Reviewed-by: Simon Horman +Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found") +Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/fsl-mc/fsl-mc-bus.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/bus/fsl-mc/fsl-mc-bus.c ++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c +@@ -947,6 +947,7 @@ struct fsl_mc_device *fsl_mc_get_endpoin + struct fsl_mc_obj_desc endpoint_desc = {{ 0 }}; + struct dprc_endpoint endpoint1 = {{ 0 }}; + struct dprc_endpoint endpoint2 = {{ 0 }}; ++ struct fsl_mc_bus *mc_bus; + int state, err; + + mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent); +@@ -970,6 +971,8 @@ struct fsl_mc_device *fsl_mc_get_endpoin + strcpy(endpoint_desc.type, endpoint2.type); + endpoint_desc.id = endpoint2.id; + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); ++ if (endpoint) ++ return endpoint; + + /* + * We know that the device has an endpoint because we verified by +@@ -977,17 +980,13 @@ struct fsl_mc_device *fsl_mc_get_endpoin + * yet discovered by the fsl-mc bus, thus the lookup returned NULL. + * Force a rescan of the devices in this container and retry the lookup. + */ +- if (!endpoint) { +- struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev); +- +- if (mutex_trylock(&mc_bus->scan_mutex)) { +- err = dprc_scan_objects(mc_bus_dev, true); +- mutex_unlock(&mc_bus->scan_mutex); +- } +- +- if (err < 0) +- return ERR_PTR(err); ++ mc_bus = to_fsl_mc_bus(mc_bus_dev); ++ if (mutex_trylock(&mc_bus->scan_mutex)) { ++ err = dprc_scan_objects(mc_bus_dev, true); ++ mutex_unlock(&mc_bus->scan_mutex); + } ++ if (err < 0) ++ return ERR_PTR(err); + + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); + /* diff --git a/queue-6.1/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch b/queue-6.1/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch new file mode 100644 index 0000000000..a1a258b62c --- /dev/null +++ b/queue-6.1/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch @@ -0,0 +1,42 @@ +From a7982a14b3012527a9583d12525cd0dc9f8d8934 Mon Sep 17 00:00:00 2001 +From: Yang Xiwen +Date: Mon, 16 Jun 2025 00:01:10 +0800 +Subject: i2c: qup: jump out of the loop in case of timeout + +From: Yang Xiwen + +commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream. + +Original logic only sets the return value but doesn't jump out of the +loop if the bus is kept active by a client. This is not expected. A +malicious or buggy i2c client can hang the kernel in this case and +should be avoided. This is observed during a long time test with a +PCA953x GPIO extender. + +Fix it by changing the logic to not only sets the return value, but also +jumps out of the loop and return to the caller with -ETIMEDOUT. + +Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1") +Signed-off-by: Yang Xiwen +Cc: # v4.17+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-qup.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-qup.c ++++ b/drivers/i2c/busses/i2c-qup.c +@@ -452,8 +452,10 @@ static int qup_i2c_bus_active(struct qup + if (!(status & I2C_STATUS_BUS_ACTIVE)) + break; + +- if (time_after(jiffies, timeout)) ++ if (time_after(jiffies, timeout)) { + ret = -ETIMEDOUT; ++ break; ++ } + + usleep_range(len, len * 2); + } diff --git a/queue-6.1/i2c-tegra-fix-reset-error-handling-with-acpi.patch b/queue-6.1/i2c-tegra-fix-reset-error-handling-with-acpi.patch new file mode 100644 index 0000000000..f060b8e787 --- /dev/null +++ b/queue-6.1/i2c-tegra-fix-reset-error-handling-with-acpi.patch @@ -0,0 +1,80 @@ +From 56344e241c543f17e8102fa13466ad5c3e7dc9ff Mon Sep 17 00:00:00 2001 +From: Akhil R +Date: Thu, 10 Jul 2025 18:42:04 +0530 +Subject: i2c: tegra: Fix reset error handling with ACPI + +From: Akhil R + +commit 56344e241c543f17e8102fa13466ad5c3e7dc9ff upstream. + +The acpi_evaluate_object() returns an ACPI error code and not +Linux one. For the some platforms the err will have positive code +which may be interpreted incorrectly. Use device_reset() for +reset control which handles it correctly. + +Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support") +Reported-by: Andy Shevchenko +Signed-off-by: Akhil R +Cc: # v5.17+ +Reviewed-by: Andy Shevchenko +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250710131206.2316-2-akhilrajeev@nvidia.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-tegra.c | 24 +----------------------- + 1 file changed, 1 insertion(+), 23 deletions(-) + +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -623,7 +623,6 @@ static int tegra_i2c_wait_for_config_loa + static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev) + { + u32 val, clk_divisor, clk_multiplier, tsu_thd, tlow, thigh, non_hs_mode; +- acpi_handle handle = ACPI_HANDLE(i2c_dev->dev); + struct i2c_timings *t = &i2c_dev->timings; + int err; + +@@ -635,11 +634,7 @@ static int tegra_i2c_init(struct tegra_i + * emit a noisy warning on error, which won't stay unnoticed and + * won't hose machine entirely. + */ +- if (handle) +- err = acpi_evaluate_object(handle, "_RST", NULL, NULL); +- else +- err = reset_control_reset(i2c_dev->rst); +- ++ err = device_reset(i2c_dev->dev); + WARN_ON_ONCE(err); + + if (IS_DVC(i2c_dev)) +@@ -1696,19 +1691,6 @@ static void tegra_i2c_parse_dt(struct te + i2c_dev->is_vi = true; + } + +-static int tegra_i2c_init_reset(struct tegra_i2c_dev *i2c_dev) +-{ +- if (ACPI_HANDLE(i2c_dev->dev)) +- return 0; +- +- i2c_dev->rst = devm_reset_control_get_exclusive(i2c_dev->dev, "i2c"); +- if (IS_ERR(i2c_dev->rst)) +- return dev_err_probe(i2c_dev->dev, PTR_ERR(i2c_dev->rst), +- "failed to get reset control\n"); +- +- return 0; +-} +- + static int tegra_i2c_init_clocks(struct tegra_i2c_dev *i2c_dev) + { + int err; +@@ -1818,10 +1800,6 @@ static int tegra_i2c_probe(struct platfo + + tegra_i2c_parse_dt(i2c_dev); + +- err = tegra_i2c_init_reset(i2c_dev); +- if (err) +- return err; +- + err = tegra_i2c_init_clocks(i2c_dev); + if (err) + return err; diff --git a/queue-6.1/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch b/queue-6.1/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch new file mode 100644 index 0000000000..c807397dfa --- /dev/null +++ b/queue-6.1/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch @@ -0,0 +1,51 @@ +From a663b3c47ab10f66130818cf94eb59c971541c3f Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Thu, 3 Jul 2025 17:01:02 +0530 +Subject: i2c: virtio: Avoid hang by using interruptible completion wait + +From: Viresh Kumar + +commit a663b3c47ab10f66130818cf94eb59c971541c3f upstream. + +The current implementation uses wait_for_completion(), which can cause +the caller to hang indefinitely if the transfer never completes. + +Switch to wait_for_completion_interruptible() so that the operation can +be interrupted by signals. + +Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling") +Signed-off-by: Viresh Kumar +Cc: # v5.16+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-virtio.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-virtio.c ++++ b/drivers/i2c/busses/i2c-virtio.c +@@ -116,15 +116,16 @@ static int virtio_i2c_complete_reqs(stru + for (i = 0; i < num; i++) { + struct virtio_i2c_req *req = &reqs[i]; + +- wait_for_completion(&req->completion); +- +- if (!failed && req->in_hdr.status != VIRTIO_I2C_MSG_OK) +- failed = true; ++ if (!failed) { ++ if (wait_for_completion_interruptible(&req->completion)) ++ failed = true; ++ else if (req->in_hdr.status != VIRTIO_I2C_MSG_OK) ++ failed = true; ++ else ++ j++; ++ } + + i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], !failed); +- +- if (!failed) +- j++; + } + + return j; diff --git a/queue-6.1/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch b/queue-6.1/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch new file mode 100644 index 0000000000..6d4b9bab52 --- /dev/null +++ b/queue-6.1/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch @@ -0,0 +1,45 @@ +From e10981075adce203eac0be866389309eeb8ef11e Mon Sep 17 00:00:00 2001 +From: Rong Zhang +Date: Tue, 8 Jul 2025 00:38:07 +0800 +Subject: platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rong Zhang + +commit e10981075adce203eac0be866389309eeb8ef11e upstream. + +On some models supported by ideapad-laptop, the HW/FW can remember the +state of keyboard backlight among boots. However, it is always turned +off while shutting down, as a side effect of the LED class device +unregistering sequence. + +This is inconvenient for users who always prefer turning on the +keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class +device so that the state of keyboard backlight gets remembered, which +also aligns with the behavior of manufacturer utilities on Windows. + +Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support") +Cc: stable@vger.kernel.org +Signed-off-by: Rong Zhang +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250707163808.155876-3-i@rong.moe +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/ideapad-laptop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1498,7 +1498,7 @@ static int ideapad_kbd_bl_init(struct id + priv->kbd_bl.led.max_brightness = 1; + priv->kbd_bl.led.brightness_get = ideapad_kbd_bl_led_cdev_brightness_get; + priv->kbd_bl.led.brightness_set_blocking = ideapad_kbd_bl_led_cdev_brightness_set; +- priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED; ++ priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN; + + err = led_classdev_register(&priv->platform_device->dev, &priv->kbd_bl.led); + if (err) diff --git a/queue-6.1/series b/queue-6.1/series index 8ce0f67824..0590ed5445 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -23,3 +23,8 @@ drm-bridge-ti-sn65dsi86-remove-extra-semicolon-in-ti.patch net-hns3-fix-concurrent-setting-vlan-filter-issue.patch net-hns3-disable-interrupt-when-ptp-init-failed.patch net-hns3-fixed-vf-get-max-channels-bug.patch +platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch +i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch +i2c-tegra-fix-reset-error-handling-with-acpi.patch +i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch +bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch