From: Greg Kroah-Hartman Date: Fri, 9 Jan 2026 11:01:59 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.1.160~6 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b295fc8205b09509544edb08946b1440b9c26229;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch scsi-core-ufs-fix-a-hang-in-the-error-handler.patch usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch --- diff --git a/queue-5.10/net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch b/queue-5.10/net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch new file mode 100644 index 0000000000..d3a5bb0300 --- /dev/null +++ b/queue-5.10/net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch @@ -0,0 +1,38 @@ +From 0dcc53abf58d572d34c5313de85f607cd33fc691 Mon Sep 17 00:00:00 2001 +From: Su Hui +Date: Wed, 5 Jun 2024 11:47:43 +0800 +Subject: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() + +From: Su Hui + +commit 0dcc53abf58d572d34c5313de85f607cd33fc691 upstream. + +Clang static checker (scan-build) warning: +net/ethtool/ioctl.c:line 2233, column 2 +Called function pointer is null (null dereference). + +Return '-EOPNOTSUPP' when 'ops->get_ethtool_phy_stats' is NULL to fix +this typo error. + +Fixes: 201ed315f967 ("net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers") +Signed-off-by: Su Hui +Reviewed-by: Przemek Kitszel +Reviewed-by: Hariprasad Kelam +Link: https://lore.kernel.org/r/20240605034742.921751-1-suhui@nfschina.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/ethtool/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ethtool/ioctl.c ++++ b/net/ethtool/ioctl.c +@@ -2089,7 +2089,7 @@ static int ethtool_get_phy_stats_ethtool + const struct ethtool_ops *ops = dev->ethtool_ops; + int n_stats, ret; + +- if (!ops || !ops->get_sset_count || ops->get_ethtool_phy_stats) ++ if (!ops || !ops->get_sset_count || !ops->get_ethtool_phy_stats) + return -EOPNOTSUPP; + + n_stats = ops->get_sset_count(dev, ETH_SS_PHY_STATS); diff --git a/queue-5.10/scsi-core-ufs-fix-a-hang-in-the-error-handler.patch b/queue-5.10/scsi-core-ufs-fix-a-hang-in-the-error-handler.patch new file mode 100644 index 0000000000..4e59abbef4 --- /dev/null +++ b/queue-5.10/scsi-core-ufs-fix-a-hang-in-the-error-handler.patch @@ -0,0 +1,68 @@ +From 8a3514d348de87a9d5e2ac00fbac4faae0b97996 Mon Sep 17 00:00:00 2001 +From: Sanjeev Yadav +Date: Fri, 23 May 2025 13:14:01 -0700 +Subject: scsi: core: ufs: Fix a hang in the error handler + +From: Sanjeev Yadav + +commit 8a3514d348de87a9d5e2ac00fbac4faae0b97996 upstream. + +ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter +function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because +resuming involves submitting a SCSI command and ufshcd_queuecommand() +returns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this +hang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has +been called instead of before. + +Backtrace: +__switch_to+0x174/0x338 +__schedule+0x600/0x9e4 +schedule+0x7c/0xe8 +schedule_timeout+0xa4/0x1c8 +io_schedule_timeout+0x48/0x70 +wait_for_common_io+0xa8/0x160 //waiting on START_STOP +wait_for_completion_io_timeout+0x10/0x20 +blk_execute_rq+0xe4/0x1e4 +scsi_execute_cmd+0x108/0x244 +ufshcd_set_dev_pwr_mode+0xe8/0x250 +__ufshcd_wl_resume+0x94/0x354 +ufshcd_wl_runtime_resume+0x3c/0x174 +scsi_runtime_resume+0x64/0xa4 +rpm_resume+0x15c/0xa1c +__pm_runtime_resume+0x4c/0x90 // Runtime resume ongoing +ufshcd_err_handler+0x1a0/0xd08 +process_one_work+0x174/0x808 +worker_thread+0x15c/0x490 +kthread+0xf4/0x1ec +ret_from_fork+0x10/0x20 + +Signed-off-by: Sanjeev Yadav +[ bvanassche: rewrote patch description ] +Fixes: 62694735ca95 ("[SCSI] ufs: Add runtime PM support for UFS host controller driver") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20250523201409.1676055-1-bvanassche@acm.org +Reviewed-by: Peter Wang +Signed-off-by: Martin K. Petersen +[Shivani: Modified to apply on 5.10.y] +Signed-off-by: Shivani Agarwal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ufs/ufshcd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -5766,10 +5766,12 @@ static void ufshcd_err_handler(struct wo + spin_unlock_irqrestore(hba->host->host_lock, flags); + return; + } +- ufshcd_set_eh_in_progress(hba); + spin_unlock_irqrestore(hba->host->host_lock, flags); ++ + ufshcd_err_handling_prepare(hba); ++ + spin_lock_irqsave(hba->host->host_lock, flags); ++ ufshcd_set_eh_in_progress(hba); + ufshcd_scsi_block_requests(hba); + /* + * A full reset and restore might have happened after preparation diff --git a/queue-5.10/series b/queue-5.10/series index c9060092f6..c0bba41783 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -407,3 +407,6 @@ leds-lp50xx-remove-duplicated-error-reporting-in-.remove.patch leds-leds-lp50xx-enable-chip-before-any-communication.patch pwm-stm32-always-program-polarity.patch revert-iommu-amd-skip-enabling-command-event-buffers-for-kdump.patch +scsi-core-ufs-fix-a-hang-in-the-error-handler.patch +net-ethtool-fix-the-error-condition-in-ethtool_get_phy_stats_ethtool.patch +usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch diff --git a/queue-5.10/usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch b/queue-5.10/usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch new file mode 100644 index 0000000000..9c88c491f3 --- /dev/null +++ b/queue-5.10/usb-gadget-lpc32xx_udc-fix-clock-imbalance-in-error-path.patch @@ -0,0 +1,102 @@ +From 782be79e4551550d7a82b1957fc0f7347e6d461f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 18 Dec 2025 16:35:15 +0100 +Subject: usb: gadget: lpc32xx_udc: fix clock imbalance in error path + +From: Johan Hovold + +commit 782be79e4551550d7a82b1957fc0f7347e6d461f upstream. + +A recent change fixing a device reference leak introduced a clock +imbalance by reusing an error path so that the clock may be disabled +before having been enabled. + +Note that the clock framework allows for passing in NULL clocks so there +is no risk for a NULL pointer dereference. + +Also drop the bogus I2C client NULL check added by the offending commit +as the pointer has already been verified to be non-NULL. + +Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe") +Cc: stable@vger.kernel.org +Cc: Ma Ke +Signed-off-by: Johan Hovold +Reviewed-by: Vladimir Zapolskiy +Link: https://patch.msgid.link/20251218153519.19453-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/lpc32xx_udc.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/usb/gadget/udc/lpc32xx_udc.c ++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c +@@ -3026,7 +3026,7 @@ static int lpc32xx_udc_probe(struct plat + pdev->dev.dma_mask = &lpc32xx_usbd_dmamask; + retval = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (retval) +- goto i2c_fail; ++ goto err_put_client; + + udc->board = &lpc32xx_usbddata; + +@@ -3046,7 +3046,7 @@ static int lpc32xx_udc_probe(struct plat + udc->udp_irq[i] = platform_get_irq(pdev, i); + if (udc->udp_irq[i] < 0) { + retval = udc->udp_irq[i]; +- goto i2c_fail; ++ goto err_put_client; + } + } + +@@ -3054,7 +3054,7 @@ static int lpc32xx_udc_probe(struct plat + if (IS_ERR(udc->udp_baseaddr)) { + dev_err(udc->dev, "IO map failure\n"); + retval = PTR_ERR(udc->udp_baseaddr); +- goto i2c_fail; ++ goto err_put_client; + } + + /* Get USB device clock */ +@@ -3062,14 +3062,14 @@ static int lpc32xx_udc_probe(struct plat + if (IS_ERR(udc->usb_slv_clk)) { + dev_err(udc->dev, "failed to acquire USB device clock\n"); + retval = PTR_ERR(udc->usb_slv_clk); +- goto i2c_fail; ++ goto err_put_client; + } + + /* Enable USB device clock */ + retval = clk_prepare_enable(udc->usb_slv_clk); + if (retval < 0) { + dev_err(udc->dev, "failed to start USB device clock\n"); +- goto i2c_fail; ++ goto err_put_client; + } + + /* Setup deferred workqueue data */ +@@ -3171,9 +3171,10 @@ dma_alloc_fail: + dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, + udc->udca_v_base, udc->udca_p_base); + i2c_fail: +- if (udc->isp1301_i2c_client) +- put_device(&udc->isp1301_i2c_client->dev); + clk_disable_unprepare(udc->usb_slv_clk); ++err_put_client: ++ put_device(&udc->isp1301_i2c_client->dev); ++ + dev_err(udc->dev, "%s probe failed, %d\n", driver_name, retval); + + return retval; +@@ -3198,11 +3199,9 @@ static int lpc32xx_udc_remove(struct pla + dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE, + udc->udca_v_base, udc->udca_p_base); + +- if (udc->isp1301_i2c_client) +- put_device(&udc->isp1301_i2c_client->dev); +- + clk_disable_unprepare(udc->usb_slv_clk); + ++ put_device(&udc->isp1301_i2c_client->dev); + return 0; + } +