From 7b0001e76679e1bdfb44aa63953664f6991486c7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 28 Jul 2025 13:44:03 +0200 Subject: [PATCH] 5.15-stable patches added patches: bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch --- ...ice-reference-in-fsl_mc_get_endpoint.patch | 71 +++++++++++++++++++ ...p-out-of-the-loop-in-case-of-timeout.patch | 42 +++++++++++ ...-using-interruptible-completion-wait.patch | 51 +++++++++++++ ...backlight-not-remembered-among-boots.patch | 45 ++++++++++++ queue-5.15/series | 4 ++ 5 files changed, 213 insertions(+) create mode 100644 queue-5.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch create mode 100644 queue-5.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch create mode 100644 queue-5.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch create mode 100644 queue-5.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch diff --git a/queue-5.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch b/queue-5.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch new file mode 100644 index 0000000000..c07cbcd20f --- /dev/null +++ b/queue-5.15/bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch @@ -0,0 +1,71 @@ +From bddbe13d36a02d5097b99cf02354d5752ad1ac60 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 17 Jul 2025 10:23:07 +0800 +Subject: bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() + +From: Ma Ke + +commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 upstream. + +The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup() +twice, which would increment the device's reference count twice if +both lookups find a device. This could lead to a reference count leak. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function") +Signed-off-by: Ma Ke +Tested-by: Ioana Ciornei +Reviewed-by: Simon Horman +Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found") +Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/fsl-mc/fsl-mc-bus.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/bus/fsl-mc/fsl-mc-bus.c ++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c +@@ -944,6 +944,7 @@ struct fsl_mc_device *fsl_mc_get_endpoin + struct fsl_mc_obj_desc endpoint_desc = {{ 0 }}; + struct dprc_endpoint endpoint1 = {{ 0 }}; + struct dprc_endpoint endpoint2 = {{ 0 }}; ++ struct fsl_mc_bus *mc_bus; + int state, err; + + mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent); +@@ -967,6 +968,8 @@ struct fsl_mc_device *fsl_mc_get_endpoin + strcpy(endpoint_desc.type, endpoint2.type); + endpoint_desc.id = endpoint2.id; + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); ++ if (endpoint) ++ return endpoint; + + /* + * We know that the device has an endpoint because we verified by +@@ -974,17 +977,13 @@ struct fsl_mc_device *fsl_mc_get_endpoin + * yet discovered by the fsl-mc bus, thus the lookup returned NULL. + * Force a rescan of the devices in this container and retry the lookup. + */ +- if (!endpoint) { +- struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev); +- +- if (mutex_trylock(&mc_bus->scan_mutex)) { +- err = dprc_scan_objects(mc_bus_dev, true); +- mutex_unlock(&mc_bus->scan_mutex); +- } +- +- if (err < 0) +- return ERR_PTR(err); ++ mc_bus = to_fsl_mc_bus(mc_bus_dev); ++ if (mutex_trylock(&mc_bus->scan_mutex)) { ++ err = dprc_scan_objects(mc_bus_dev, true); ++ mutex_unlock(&mc_bus->scan_mutex); + } ++ if (err < 0) ++ return ERR_PTR(err); + + endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev); + /* diff --git a/queue-5.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch b/queue-5.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch new file mode 100644 index 0000000000..a1a258b62c --- /dev/null +++ b/queue-5.15/i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch @@ -0,0 +1,42 @@ +From a7982a14b3012527a9583d12525cd0dc9f8d8934 Mon Sep 17 00:00:00 2001 +From: Yang Xiwen +Date: Mon, 16 Jun 2025 00:01:10 +0800 +Subject: i2c: qup: jump out of the loop in case of timeout + +From: Yang Xiwen + +commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream. + +Original logic only sets the return value but doesn't jump out of the +loop if the bus is kept active by a client. This is not expected. A +malicious or buggy i2c client can hang the kernel in this case and +should be avoided. This is observed during a long time test with a +PCA953x GPIO extender. + +Fix it by changing the logic to not only sets the return value, but also +jumps out of the loop and return to the caller with -ETIMEDOUT. + +Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1") +Signed-off-by: Yang Xiwen +Cc: # v4.17+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-qup.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-qup.c ++++ b/drivers/i2c/busses/i2c-qup.c +@@ -452,8 +452,10 @@ static int qup_i2c_bus_active(struct qup + if (!(status & I2C_STATUS_BUS_ACTIVE)) + break; + +- if (time_after(jiffies, timeout)) ++ if (time_after(jiffies, timeout)) { + ret = -ETIMEDOUT; ++ break; ++ } + + usleep_range(len, len * 2); + } diff --git a/queue-5.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch b/queue-5.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch new file mode 100644 index 0000000000..3551b6bc5a --- /dev/null +++ b/queue-5.15/i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch @@ -0,0 +1,51 @@ +From a663b3c47ab10f66130818cf94eb59c971541c3f Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Thu, 3 Jul 2025 17:01:02 +0530 +Subject: i2c: virtio: Avoid hang by using interruptible completion wait + +From: Viresh Kumar + +commit a663b3c47ab10f66130818cf94eb59c971541c3f upstream. + +The current implementation uses wait_for_completion(), which can cause +the caller to hang indefinitely if the transfer never completes. + +Switch to wait_for_completion_interruptible() so that the operation can +be interrupted by signals. + +Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling") +Signed-off-by: Viresh Kumar +Cc: # v5.16+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-virtio.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-virtio.c ++++ b/drivers/i2c/busses/i2c-virtio.c +@@ -118,15 +118,16 @@ static int virtio_i2c_complete_reqs(stru + for (i = 0; i < num; i++) { + struct virtio_i2c_req *req = &reqs[i]; + +- wait_for_completion(&req->completion); +- +- if (!failed && req->in_hdr.status != VIRTIO_I2C_MSG_OK) +- failed = true; ++ if (!failed) { ++ if (wait_for_completion_interruptible(&req->completion)) ++ failed = true; ++ else if (req->in_hdr.status != VIRTIO_I2C_MSG_OK) ++ failed = true; ++ else ++ j++; ++ } + + i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], !failed); +- +- if (!failed) +- j++; + } + + return j; diff --git a/queue-5.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch b/queue-5.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch new file mode 100644 index 0000000000..edfe1f5cb0 --- /dev/null +++ b/queue-5.15/platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch @@ -0,0 +1,45 @@ +From e10981075adce203eac0be866389309eeb8ef11e Mon Sep 17 00:00:00 2001 +From: Rong Zhang +Date: Tue, 8 Jul 2025 00:38:07 +0800 +Subject: platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rong Zhang + +commit e10981075adce203eac0be866389309eeb8ef11e upstream. + +On some models supported by ideapad-laptop, the HW/FW can remember the +state of keyboard backlight among boots. However, it is always turned +off while shutting down, as a side effect of the LED class device +unregistering sequence. + +This is inconvenient for users who always prefer turning on the +keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class +device so that the state of keyboard backlight gets remembered, which +also aligns with the behavior of manufacturer utilities on Windows. + +Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support") +Cc: stable@vger.kernel.org +Signed-off-by: Rong Zhang +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250707163808.155876-3-i@rong.moe +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/ideapad-laptop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1357,7 +1357,7 @@ static int ideapad_kbd_bl_init(struct id + priv->kbd_bl.led.max_brightness = 1; + priv->kbd_bl.led.brightness_get = ideapad_kbd_bl_led_cdev_brightness_get; + priv->kbd_bl.led.brightness_set_blocking = ideapad_kbd_bl_led_cdev_brightness_set; +- priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED; ++ priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN; + + err = led_classdev_register(&priv->platform_device->dev, &priv->kbd_bl.led); + if (err) diff --git a/queue-5.15/series b/queue-5.15/series index 01b8acf874..c0b9e0f23e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -85,3 +85,7 @@ net-sched-sch_qfq-avoid-triggering-might_sleep-in-at.patch net-hns3-fix-concurrent-setting-vlan-filter-issue.patch net-hns3-disable-interrupt-when-ptp-init-failed.patch net-hns3-fixed-vf-get-max-channels-bug.patch +platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch +i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch +i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch +bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch -- 2.47.2