From 33977ded26b9b6f3dba1dbb32de8bb5fb180f2ea Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 28 Jul 2025 15:42:13 +0200 Subject: [PATCH] 6.6-stable patches added patches: bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch i2c-tegra-fix-reset-error-handling-with-acpi.patch i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch sprintf.h-requires-stdarg.h.patch --- ...ice-reference-in-fsl_mc_get_endpoint.patch | 71 ++++++++++++++++ ...p-out-of-the-loop-in-case-of-timeout.patch | 42 ++++++++++ ...a-fix-reset-error-handling-with-acpi.patch | 80 +++++++++++++++++++ ...-using-interruptible-completion-wait.patch | 51 ++++++++++++ ...backlight-not-remembered-among-boots.patch | 45 +++++++++++ queue-6.6/series | 6 ++ queue-6.6/sprintf.h-requires-stdarg.h.patch | 46 +++++++++++ 7 files changed, 341 insertions(+) create mode 100644 queue-6.6/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch create mode 100644 queue-6.6/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch create mode 100644 queue-6.6/i2c-tegra-fix-reset-error-handling-with-acpi.patch create mode 100644 queue-6.6/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch create mode 100644 queue-6.6/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch create mode 100644 queue-6.6/sprintf.h-requires-stdarg.h.patch diff --git a/queue-6.6/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch b/queue-6.6/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch new file mode 100644 index 0000000000..823f564e80 --- /dev/null +++ b/queue-6.6/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch @@ -0,0 +1,71 @@ +From bddbe13d36a02d5097b99cf02354d5752ad1ac60 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 17 Jul 2025 10:23:07 +0800 +Subject: bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() + +From: Ma Ke + +commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 upstream. + +The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup() +twice, which would increment the device's reference count twice if +both lookups find a device. This could lead to a reference count leak. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function") +Signed-off-by: Ma Ke +Tested-by: Ioana Ciornei +Reviewed-by: Simon Horman +Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found") +Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/fsl-mc/fsl-mc-bus.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/bus/fsl-mc/fsl-mc-bus.c ++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c +@@ -942,6 +942,7 @@ struct fsl_mc_device *fsl_mc_get_endpoin + struct fsl_mc_obj_desc endpoint_desc = {{ 0 }}; + struct dprc_endpoint endpoint1 = {{ 0 }}; + struct dprc_endpoint endpoint2 = {{ 0 }}; ++ struct fsl_mc_bus *mc_bus; + int state, err; + + mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent); +@@ -965,6 +966,8 @@ struct fsl_mc_device *fsl_mc_get_endpoin + strcpy(endpoint_desc.type, endpoint2.type); + endpoint_desc.id = endpoint2.id; + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); ++ if (endpoint) ++ return endpoint; + + /* + * We know that the device has an endpoint because we verified by +@@ -972,17 +975,13 @@ struct fsl_mc_device *fsl_mc_get_endpoin + * yet discovered by the fsl-mc bus, thus the lookup returned NULL. + * Force a rescan of the devices in this container and retry the lookup. + */ +- if (!endpoint) { +- struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev); +- +- if (mutex_trylock(&mc_bus->scan_mutex)) { +- err = dprc_scan_objects(mc_bus_dev, true); +- mutex_unlock(&mc_bus->scan_mutex); +- } +- +- if (err < 0) +- return ERR_PTR(err); ++ mc_bus = to_fsl_mc_bus(mc_bus_dev); ++ if (mutex_trylock(&mc_bus->scan_mutex)) { ++ err = dprc_scan_objects(mc_bus_dev, true); ++ mutex_unlock(&mc_bus->scan_mutex); + } ++ if (err < 0) ++ return ERR_PTR(err); + + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); + /* diff --git a/queue-6.6/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch b/queue-6.6/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch new file mode 100644 index 0000000000..a1a258b62c --- /dev/null +++ b/queue-6.6/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch @@ -0,0 +1,42 @@ +From a7982a14b3012527a9583d12525cd0dc9f8d8934 Mon Sep 17 00:00:00 2001 +From: Yang Xiwen +Date: Mon, 16 Jun 2025 00:01:10 +0800 +Subject: i2c: qup: jump out of the loop in case of timeout + +From: Yang Xiwen + +commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream. + +Original logic only sets the return value but doesn't jump out of the +loop if the bus is kept active by a client. This is not expected. A +malicious or buggy i2c client can hang the kernel in this case and +should be avoided. This is observed during a long time test with a +PCA953x GPIO extender. + +Fix it by changing the logic to not only sets the return value, but also +jumps out of the loop and return to the caller with -ETIMEDOUT. + +Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1") +Signed-off-by: Yang Xiwen +Cc: # v4.17+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-qup.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-qup.c ++++ b/drivers/i2c/busses/i2c-qup.c +@@ -452,8 +452,10 @@ static int qup_i2c_bus_active(struct qup + if (!(status & I2C_STATUS_BUS_ACTIVE)) + break; + +- if (time_after(jiffies, timeout)) ++ if (time_after(jiffies, timeout)) { + ret = -ETIMEDOUT; ++ break; ++ } + + usleep_range(len, len * 2); + } diff --git a/queue-6.6/i2c-tegra-fix-reset-error-handling-with-acpi.patch b/queue-6.6/i2c-tegra-fix-reset-error-handling-with-acpi.patch new file mode 100644 index 0000000000..e8b0db42eb --- /dev/null +++ b/queue-6.6/i2c-tegra-fix-reset-error-handling-with-acpi.patch @@ -0,0 +1,80 @@ +From 56344e241c543f17e8102fa13466ad5c3e7dc9ff Mon Sep 17 00:00:00 2001 +From: Akhil R +Date: Thu, 10 Jul 2025 18:42:04 +0530 +Subject: i2c: tegra: Fix reset error handling with ACPI + +From: Akhil R + +commit 56344e241c543f17e8102fa13466ad5c3e7dc9ff upstream. + +The acpi_evaluate_object() returns an ACPI error code and not +Linux one. For the some platforms the err will have positive code +which may be interpreted incorrectly. Use device_reset() for +reset control which handles it correctly. + +Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support") +Reported-by: Andy Shevchenko +Signed-off-by: Akhil R +Cc: # v5.17+ +Reviewed-by: Andy Shevchenko +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250710131206.2316-2-akhilrajeev@nvidia.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-tegra.c | 24 +----------------------- + 1 file changed, 1 insertion(+), 23 deletions(-) + +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -607,7 +607,6 @@ static int tegra_i2c_wait_for_config_loa + static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev) + { + u32 val, clk_divisor, clk_multiplier, tsu_thd, tlow, thigh, non_hs_mode; +- acpi_handle handle = ACPI_HANDLE(i2c_dev->dev); + struct i2c_timings *t = &i2c_dev->timings; + int err; + +@@ -619,11 +618,7 @@ static int tegra_i2c_init(struct tegra_i + * emit a noisy warning on error, which won't stay unnoticed and + * won't hose machine entirely. + */ +- if (handle) +- err = acpi_evaluate_object(handle, "_RST", NULL, NULL); +- else +- err = reset_control_reset(i2c_dev->rst); +- ++ err = device_reset(i2c_dev->dev); + WARN_ON_ONCE(err); + + if (IS_DVC(i2c_dev)) +@@ -1668,19 +1663,6 @@ static void tegra_i2c_parse_dt(struct te + i2c_dev->is_vi = true; + } + +-static int tegra_i2c_init_reset(struct tegra_i2c_dev *i2c_dev) +-{ +- if (ACPI_HANDLE(i2c_dev->dev)) +- return 0; +- +- i2c_dev->rst = devm_reset_control_get_exclusive(i2c_dev->dev, "i2c"); +- if (IS_ERR(i2c_dev->rst)) +- return dev_err_probe(i2c_dev->dev, PTR_ERR(i2c_dev->rst), +- "failed to get reset control\n"); +- +- return 0; +-} +- + static int tegra_i2c_init_clocks(struct tegra_i2c_dev *i2c_dev) + { + int err; +@@ -1790,10 +1772,6 @@ static int tegra_i2c_probe(struct platfo + + tegra_i2c_parse_dt(i2c_dev); + +- err = tegra_i2c_init_reset(i2c_dev); +- if (err) +- return err; +- + err = tegra_i2c_init_clocks(i2c_dev); + if (err) + return err; diff --git a/queue-6.6/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch b/queue-6.6/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch new file mode 100644 index 0000000000..c807397dfa --- /dev/null +++ b/queue-6.6/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch @@ -0,0 +1,51 @@ +From a663b3c47ab10f66130818cf94eb59c971541c3f Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Thu, 3 Jul 2025 17:01:02 +0530 +Subject: i2c: virtio: Avoid hang by using interruptible completion wait + +From: Viresh Kumar + +commit a663b3c47ab10f66130818cf94eb59c971541c3f upstream. + +The current implementation uses wait_for_completion(), which can cause +the caller to hang indefinitely if the transfer never completes. + +Switch to wait_for_completion_interruptible() so that the operation can +be interrupted by signals. + +Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling") +Signed-off-by: Viresh Kumar +Cc: # v5.16+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-virtio.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-virtio.c ++++ b/drivers/i2c/busses/i2c-virtio.c +@@ -116,15 +116,16 @@ static int virtio_i2c_complete_reqs(stru + for (i = 0; i < num; i++) { + struct virtio_i2c_req *req = &reqs[i]; + +- wait_for_completion(&req->completion); +- +- if (!failed && req->in_hdr.status != VIRTIO_I2C_MSG_OK) +- failed = true; ++ if (!failed) { ++ if (wait_for_completion_interruptible(&req->completion)) ++ failed = true; ++ else if (req->in_hdr.status != VIRTIO_I2C_MSG_OK) ++ failed = true; ++ else ++ j++; ++ } + + i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], !failed); +- +- if (!failed) +- j++; + } + + return j; diff --git a/queue-6.6/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch b/queue-6.6/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch new file mode 100644 index 0000000000..1cde0e84dd --- /dev/null +++ b/queue-6.6/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch @@ -0,0 +1,45 @@ +From e10981075adce203eac0be866389309eeb8ef11e Mon Sep 17 00:00:00 2001 +From: Rong Zhang +Date: Tue, 8 Jul 2025 00:38:07 +0800 +Subject: platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rong Zhang + +commit e10981075adce203eac0be866389309eeb8ef11e upstream. + +On some models supported by ideapad-laptop, the HW/FW can remember the +state of keyboard backlight among boots. However, it is always turned +off while shutting down, as a side effect of the LED class device +unregistering sequence. + +This is inconvenient for users who always prefer turning on the +keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class +device so that the state of keyboard backlight gets remembered, which +also aligns with the behavior of manufacturer utilities on Windows. + +Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support") +Cc: stable@vger.kernel.org +Signed-off-by: Rong Zhang +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250707163808.155876-3-i@rong.moe +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/ideapad-laptop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1600,7 +1600,7 @@ static int ideapad_kbd_bl_init(struct id + priv->kbd_bl.led.name = "platform::" LED_FUNCTION_KBD_BACKLIGHT; + priv->kbd_bl.led.brightness_get = ideapad_kbd_bl_led_cdev_brightness_get; + priv->kbd_bl.led.brightness_set_blocking = ideapad_kbd_bl_led_cdev_brightness_set; +- priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED; ++ priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN; + + err = led_classdev_register(&priv->platform_device->dev, &priv->kbd_bl.led); + if (err) diff --git a/queue-6.6/series b/queue-6.6/series index 5d500b16bf..d1bf3807e1 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -25,3 +25,9 @@ net-hns3-fix-concurrent-setting-vlan-filter-issue.patch net-hns3-disable-interrupt-when-ptp-init-failed.patch net-hns3-fixed-vf-get-max-channels-bug.patch net-hns3-default-enable-tx-bounce-buffer-when-smmu-e.patch +platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch +i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch +i2c-tegra-fix-reset-error-handling-with-acpi.patch +i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch +bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch +sprintf.h-requires-stdarg.h.patch diff --git a/queue-6.6/sprintf.h-requires-stdarg.h.patch b/queue-6.6/sprintf.h-requires-stdarg.h.patch new file mode 100644 index 0000000000..6fb358acfa --- /dev/null +++ b/queue-6.6/sprintf.h-requires-stdarg.h.patch @@ -0,0 +1,46 @@ +From 0dec7201788b9152f06321d0dab46eed93834cda Mon Sep 17 00:00:00 2001 +From: Stephen Rothwell +Date: Mon, 21 Jul 2025 16:15:57 +1000 +Subject: sprintf.h requires stdarg.h + +From: Stephen Rothwell + +commit 0dec7201788b9152f06321d0dab46eed93834cda upstream. + +In file included from drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c:4: +include/linux/sprintf.h:11:54: error: unknown type name 'va_list' + 11 | __printf(2, 0) int vsprintf(char *buf, const char *, va_list); + | ^~~~~~~ +include/linux/sprintf.h:1:1: note: 'va_list' is defined in header ''; this is probably fixable by adding '#include ' + +Link: https://lkml.kernel.org/r/20250721173754.42865913@canb.auug.org.au +Fixes: 39ced19b9e60 ("lib/vsprintf: split out sprintf() and friends") +Signed-off-by: Stephen Rothwell +Cc: Andriy Shevchenko +Cc: Herbert Xu +Cc: Petr Mladek +Cc: Steven Rostedt +Cc: Rasmus Villemoes +Cc: Sergey Senozhatsky +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/sprintf.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/sprintf.h b/include/linux/sprintf.h +index 51cab2def9ec..876130091384 100644 +--- a/include/linux/sprintf.h ++++ b/include/linux/sprintf.h +@@ -4,6 +4,7 @@ + + #include + #include ++#include + + int num_to_str(char *buf, int size, unsigned long long num, unsigned int width); + +-- +2.50.1 + -- 2.47.2