From 0e67e6cd5e256103c81ffb141da7dee2e9a1d4e1 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 7 Aug 2026 16:08:30 +0200 Subject: [PATCH] 6.6-stable patches added patches: drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch --- ...-assign-to-struct-drm_fb_helper.info.patch | 32 +++++++++++++ queue-6.6/series | 2 + ...own-ordering-in-ucsi_init-error-path.patch | 47 +++++++++++++++++++ 3 files changed, 81 insertions(+) create mode 100644 queue-6.6/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch create mode 100644 queue-6.6/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch diff --git a/queue-6.6/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch b/queue-6.6/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch new file mode 100644 index 0000000000..6abef8830a --- /dev/null +++ b/queue-6.6/drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch @@ -0,0 +1,32 @@ +From d23bd83f3e47a928e783c0d6a004737519dc77dc Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 21 Apr 2026 09:29:05 +0200 +Subject: drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info + +From: Thomas Zimmermann + +commit d23bd83f3e47a928e783c0d6a004737519dc77dc upstream. + +That field already contains the value being assigned. No need to do +this twice. + +Signed-off-by: Thomas Zimmermann +Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in single place") +Cc: linux-tegra@vger.kernel.org +Signed-off-by: Thierry Reding +Link: https://patch.msgid.link/20260421073646.144712-2-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tegra/fbdev.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/tegra/fbdev.c ++++ b/drivers/gpu/drm/tegra/fbdev.c +@@ -105,7 +105,6 @@ static int tegra_fbdev_probe(struct drm_ + } + + helper->fb = fb; +- helper->info = info; + + info->fbops = &tegra_fb_ops; + diff --git a/queue-6.6/series b/queue-6.6/series index 139b78db19..222305de89 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -257,3 +257,5 @@ drm-i915-hdcp-move-to-using-intel_display-in-intel_hdcp.patch drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch drm-i915-hdcp-check-streams-bounds-before-overflow.patch alsa-hda-codecs-hdmi-disable-keep-alive-before-audio-format-change.patch +drm-tegra-fbdev-do-not-assign-to-struct-drm_fb_helper.info.patch +usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch diff --git a/queue-6.6/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch b/queue-6.6/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch new file mode 100644 index 0000000000..ff5ddd1704 --- /dev/null +++ b/queue-6.6/usb-typec-ucsi-correct-teardown-ordering-in-ucsi_init-error-path.patch @@ -0,0 +1,47 @@ +From fb0bf289f5d529336ef490c8273e88a8a8b29f69 Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski +Date: Fri, 17 Jul 2026 10:46:14 +0000 +Subject: usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path + +From: Andrei Kuchynski + +commit fb0bf289f5d529336ef490c8273e88a8a8b29f69 upstream. + +The commit 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and +ordering in port unregistration") consolidated port teardown into the +ucsi_unregister_port() helper. However, it introduced an ordering problem +in the ucsi_init() error path. + +Fix this by ensuring ucsi_unregister_port() is called before we unregister +their corresponding lockdep keys. + +Cc: stable@vger.kernel.org +Fixes: 7aa7d4bf9d3f ("usb: typec: ucsi: Fix race condition and ordering in port unregistration") +Reported-by: "Borah, Chaitanya Kumar" +Closes: https://lore.kernel.org/all/22064276-6c56-411a-9f20-6917ceeb865f@intel.com/ +Signed-off-by: Andrei Kuchynski +Tested-by: Chaitanya Kumar Borah +Reviewed-by: Heikki Krogerus +Link: https://patch.msgid.link/20260717104614.325250-1-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1548,11 +1548,11 @@ static int ucsi_init(struct ucsi *ucsi) + return 0; + + err_unregister: ++ for (con = connector; con->port; con++) ++ ucsi_unregister_port(con); + for (i = 0; i < ucsi->cap.num_connectors; i++) + lockdep_unregister_key(&connector[i].lock_key); + +- for (con = connector; con->port; con++) +- ucsi_unregister_port(con); + kfree(connector); + err_reset: + memset(&ucsi->cap, 0, sizeof(ucsi->cap)); -- 2.47.3