From 802fba2a2bbace117ec682c45f8c2dbe7ce35879 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 7 May 2026 12:29:23 +0200 Subject: [PATCH] 5.10-stable patches added patches: acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch ipmi-add-limits-to-event-and-receive-message-requests.patch ipmi-check-event-message-buffer-response-for-bad-data.patch ipmi-si-return-state-to-normal-if-message-allocation-fails.patch scsi-target-configfs-bound-snprintf-return-in-tg_pt_gp_members_show.patch spi-rockchip-fix-controller-deregistration.patch --- ...-native-backlight-on-hp-omen-16-8a44.patch | 49 ++++ ...b_ops_mmap-to-prevent-use-after-free.patch | 111 ++++++++++ ...o-event-and-receive-message-requests.patch | 209 ++++++++++++++++++ ...message-buffer-response-for-bad-data.patch | 44 ++++ ...o-normal-if-message-allocation-fails.patch | 44 ++++ ...intf-return-in-tg_pt_gp_members_show.patch | 46 ++++ queue-5.10/series | 7 + ...ckchip-fix-controller-deregistration.patch | 43 ++++ 8 files changed, 553 insertions(+) create mode 100644 queue-5.10/acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch create mode 100644 queue-5.10/fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch create mode 100644 queue-5.10/ipmi-add-limits-to-event-and-receive-message-requests.patch create mode 100644 queue-5.10/ipmi-check-event-message-buffer-response-for-bad-data.patch create mode 100644 queue-5.10/ipmi-si-return-state-to-normal-if-message-allocation-fails.patch create mode 100644 queue-5.10/scsi-target-configfs-bound-snprintf-return-in-tg_pt_gp_members_show.patch create mode 100644 queue-5.10/spi-rockchip-fix-controller-deregistration.patch diff --git a/queue-5.10/acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch b/queue-5.10/acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch new file mode 100644 index 0000000000..23a6301701 --- /dev/null +++ b/queue-5.10/acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch @@ -0,0 +1,49 @@ +From 4b506ea5351a1f5937ac632a4a5c35f6f796cc41 Mon Sep 17 00:00:00 2001 +From: Shivam Kalra +Date: Sun, 26 Apr 2026 19:38:41 +0530 +Subject: ACPI: video: force native backlight on HP OMEN 16 (8A44) + +From: Shivam Kalra + +commit 4b506ea5351a1f5937ac632a4a5c35f6f796cc41 upstream. + +The HP OMEN 16 Gaming Laptop (board name 8A44) has a mux-less hybrid +GPU configuration with AMD Rembrandt (Radeon 680M) and NVIDIA GA104 +(RTX 3070 Ti). The internal eDP panel is wired to the AMD iGPU. + +When Nouveau loads without GSP firmware, the ACPI video backlight +device (acpi_video0) gets registered alongside the native AMD +backlight (amdgpu_bl2). In this state, writes to amdgpu_bl2 update +the software brightness value but fail to change the physical panel +brightness. + +Force native backlight to prevent acpi_video0 from registering. +Confirmed that booting with acpi_backlight=native resolves the +issue. + +Cc: All applicable +Signed-off-by: Shivam Kalra +Link: https://patch.msgid.link/20260426-omen-16-backlight-fix-v1-1-62364f268ea6@zohomail.in +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/video_detect.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -154,6 +154,14 @@ static const struct dmi_system_id video_ + DMI_MATCH(DMI_PRODUCT_NAME, "VPCEH3U1E"), + }, + }, ++ { ++ .callback = video_detect_force_native, ++ /* HP OMEN Gaming Laptop 16-n0xxx */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-n0xxx"), ++ }, ++ }, + + /* + * These models have a working acpi_video backlight control, and using diff --git a/queue-5.10/fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch b/queue-5.10/fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch new file mode 100644 index 0000000000..53d1d44b34 --- /dev/null +++ b/queue-5.10/fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch @@ -0,0 +1,111 @@ +From 8de779dc40d35d39fa07387b6f921eb11df0f511 Mon Sep 17 00:00:00 2001 +From: Rajat Gupta +Date: Sun, 3 May 2026 20:51:10 -0700 +Subject: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free + +From: Rajat Gupta + +commit 8de779dc40d35d39fa07387b6f921eb11df0f511 upstream. + +dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages +to userspace but sets no vm_ops on the VMA. This means the kernel cannot +track active mmaps. When dlfb_realloc_framebuffer() replaces the backing +buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. +On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages +while userspace PTEs still reference them, resulting in a use-after-free: +the process retains read/write access to freed kernel pages. + +Add vm_operations_struct with open/close callbacks that maintain an +atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), +check mmap_count and return -EBUSY if the buffer is currently mapped, +preventing buffer replacement while userspace holds stale PTEs. + +Tested with PoC using dummy_hcd + raw_gadget USB device emulation. + +Signed-off-by: Rajat Gupta +Acked-by: Greg Kroah-Hartman +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/udlfb.c | 31 ++++++++++++++++++++++++++++++- + include/video/udlfb.h | 1 + + 2 files changed, 31 insertions(+), 1 deletion(-) + +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -321,12 +321,32 @@ static int dlfb_set_video_mode(struct dl + return retval; + } + ++static void dlfb_vm_open(struct vm_area_struct *vma) ++{ ++ struct dlfb_data *dlfb = vma->vm_private_data; ++ ++ atomic_inc(&dlfb->mmap_count); ++} ++ ++static void dlfb_vm_close(struct vm_area_struct *vma) ++{ ++ struct dlfb_data *dlfb = vma->vm_private_data; ++ ++ atomic_dec(&dlfb->mmap_count); ++} ++ ++static const struct vm_operations_struct dlfb_vm_ops = { ++ .open = dlfb_vm_open, ++ .close = dlfb_vm_close, ++}; ++ + static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma) + { + unsigned long start = vma->vm_start; + unsigned long size = vma->vm_end - vma->vm_start; + unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; + unsigned long page, pos; ++ struct dlfb_data *dlfb = info->par; + + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; +@@ -353,6 +373,9 @@ static int dlfb_ops_mmap(struct fb_info + size = 0; + } + ++ vma->vm_ops = &dlfb_vm_ops; ++ vma->vm_private_data = dlfb; ++ atomic_inc(&dlfb->mmap_count); + return 0; + } + +@@ -1218,7 +1241,6 @@ static void dlfb_deferred_vfree(struct d + + /* + * Assumes &info->lock held by caller +- * Assumes no active clients have framebuffer open + */ + static int dlfb_realloc_framebuffer(struct dlfb_data *dlfb, struct fb_info *info, u32 new_len) + { +@@ -1230,6 +1252,13 @@ static int dlfb_realloc_framebuffer(stru + new_len = PAGE_ALIGN(new_len); + + if (new_len > old_len) { ++ if (atomic_read(&dlfb->mmap_count) > 0) { ++ dev_warn(info->dev, ++ "refusing realloc: %d active mmaps\n", ++ atomic_read(&dlfb->mmap_count)); ++ return -EBUSY; ++ } ++ + /* + * Alloc system memory for virtual framebuffer + */ +--- a/include/video/udlfb.h ++++ b/include/video/udlfb.h +@@ -56,6 +56,7 @@ struct dlfb_data { + spinlock_t damage_lock; + struct work_struct damage_work; + struct fb_ops ops; ++ atomic_t mmap_count; + /* blit-only rendering path metrics, exposed through sysfs */ + atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */ + atomic_t bytes_identical; /* saved effort with backbuffer comparison */ diff --git a/queue-5.10/ipmi-add-limits-to-event-and-receive-message-requests.patch b/queue-5.10/ipmi-add-limits-to-event-and-receive-message-requests.patch new file mode 100644 index 0000000000..f31467f402 --- /dev/null +++ b/queue-5.10/ipmi-add-limits-to-event-and-receive-message-requests.patch @@ -0,0 +1,209 @@ +From c4cca236968683eb0d59abfb12d5c7e4d8514227 Mon Sep 17 00:00:00 2001 +From: Corey Minyard +Date: Mon, 20 Apr 2026 12:39:51 -0500 +Subject: ipmi: Add limits to event and receive message requests + +From: Corey Minyard + +commit c4cca236968683eb0d59abfb12d5c7e4d8514227 upstream. + +The driver would just fetch events and receive messages until the +BMC said it was done. To avoid issues with BMCs that never say they are +done, add a limit of 10 fetches at a time. + +In addition, an si interface has an attn state it can return from the +hardware which is supposed to cause a flag fetch to see if the driver +needs to fetch events or message or a few other things. If the attn +bit gets stuck, it's a similar problem. So allow messages in between +flag fetches so the driver itself doesn't get stuck. + +This is a more general fix than the previous fix for the specific bad +BMC, but should fix the more general issue of a BMC that won't stop +saying it has data. + +This has been there from the beginning of the driver. It's not a bug +per-se, but it is accounting for bugs in BMCs. + +Reported-by: Matt Fleming +Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/ +Fixes: <1da177e4c3f4> ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_si_intf.c | 54 +++++++++++++++++++++++++++++++-------- + drivers/char/ipmi/ipmi_ssif.c | 23 +++++++++++++++- + 2 files changed, 64 insertions(+), 13 deletions(-) + +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -161,6 +161,10 @@ struct smi_info { + OEM2_DATA_AVAIL) + unsigned char msg_flags; + ++ /* When requesting events and messages, don't do it forever. */ ++ unsigned int num_requests_in_a_row; ++ bool last_was_flag_fetch; ++ + /* Does the BMC have an event buffer? */ + bool has_event_buffer; + +@@ -392,7 +396,10 @@ static void start_getting_msg_queue(stru + + start_new_msg(smi_info, smi_info->curr_msg->data, + smi_info->curr_msg->data_size); +- smi_info->si_state = SI_GETTING_MESSAGES; ++ if (smi_info->si_state != SI_GETTING_MESSAGES) { ++ smi_info->num_requests_in_a_row = 0; ++ smi_info->si_state = SI_GETTING_MESSAGES; ++ } + } + + static void start_getting_events(struct smi_info *smi_info) +@@ -403,7 +410,10 @@ static void start_getting_events(struct + + start_new_msg(smi_info, smi_info->curr_msg->data, + smi_info->curr_msg->data_size); +- smi_info->si_state = SI_GETTING_EVENTS; ++ if (smi_info->si_state != SI_GETTING_EVENTS) { ++ smi_info->num_requests_in_a_row = 0; ++ smi_info->si_state = SI_GETTING_EVENTS; ++ } + } + + /* +@@ -577,6 +587,7 @@ static void handle_transaction_done(stru + smi_info->si_state = SI_NORMAL; + } else { + smi_info->msg_flags = msg[3]; ++ smi_info->last_was_flag_fetch = true; + handle_flags(smi_info); + } + break; +@@ -622,6 +633,11 @@ static void handle_transaction_done(stru + } else { + smi_inc_stat(smi_info, events); + ++ smi_info->num_requests_in_a_row++; ++ if (smi_info->num_requests_in_a_row > 10) ++ /* Stop if we do this too many times. */ ++ smi_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL; ++ + /* + * Do this before we deliver the message + * because delivering the message releases the +@@ -660,6 +676,11 @@ static void handle_transaction_done(stru + } else { + smi_inc_stat(smi_info, incoming_messages); + ++ smi_info->num_requests_in_a_row++; ++ if (smi_info->num_requests_in_a_row > 10) ++ /* Stop if we do this too many times. */ ++ smi_info->msg_flags &= ~RECEIVE_MSG_AVAIL; ++ + /* + * Do this before we deliver the message + * because delivering the message releases the +@@ -788,6 +809,26 @@ restart: + } + + /* ++ * If we are currently idle, or if the last thing that was ++ * done was a flag fetch and there is a message pending, try ++ * to start the next message. ++ * ++ * We do the waiting message check to avoid a stuck flag ++ * completely wedging the driver. Let a message through ++ * in between flag operations if that happens. ++ */ ++ if (si_sm_result == SI_SM_IDLE || ++ (si_sm_result == SI_SM_ATTN && smi_info->waiting_msg && ++ smi_info->last_was_flag_fetch)) { ++ smi_info->last_was_flag_fetch = false; ++ smi_inc_stat(smi_info, idles); ++ ++ si_sm_result = start_next_msg(smi_info); ++ if (si_sm_result != SI_SM_IDLE) ++ goto restart; ++ } ++ ++ /* + * We prefer handling attn over new messages. But don't do + * this if there is not yet an upper layer to handle anything. + */ +@@ -820,15 +861,6 @@ restart: + } + } + +- /* If we are currently idle, try to start the next message. */ +- if (si_sm_result == SI_SM_IDLE) { +- smi_inc_stat(smi_info, idles); +- +- si_sm_result = start_next_msg(smi_info); +- if (si_sm_result != SI_SM_IDLE) +- goto restart; +- } +- + if ((si_sm_result == SI_SM_IDLE) + && (atomic_read(&smi_info->req_events))) { + /* +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -225,6 +225,9 @@ struct ssif_info { + bool has_event_buffer; + bool supports_alert; + ++ /* When requesting events and messages, don't do it forever. */ ++ unsigned int num_requests_in_a_row; ++ + /* + * Used to tell what we should do with alerts. If we are + * waiting on a response, read the data immediately. +@@ -419,7 +422,10 @@ static void start_event_fetch(struct ssi + } + + ssif_info->curr_msg = msg; +- ssif_info->ssif_state = SSIF_GETTING_EVENTS; ++ if (ssif_info->ssif_state != SSIF_GETTING_EVENTS) { ++ ssif_info->num_requests_in_a_row = 0; ++ ssif_info->ssif_state = SSIF_GETTING_EVENTS; ++ } + ipmi_ssif_unlock_cond(ssif_info, flags); + + msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); +@@ -442,7 +448,10 @@ static void start_recv_msg_fetch(struct + } + + ssif_info->curr_msg = msg; +- ssif_info->ssif_state = SSIF_GETTING_MESSAGES; ++ if (ssif_info->ssif_state != SSIF_GETTING_MESSAGES) { ++ ssif_info->num_requests_in_a_row = 0; ++ ssif_info->ssif_state = SSIF_GETTING_MESSAGES; ++ } + ipmi_ssif_unlock_cond(ssif_info, flags); + + msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); +@@ -851,6 +860,11 @@ static void msg_done_handler(struct ssif + ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL; + handle_flags(ssif_info, flags); + } else { ++ ssif_info->num_requests_in_a_row++; ++ if (ssif_info->num_requests_in_a_row > 10) ++ /* Stop if we do this too many times. */ ++ ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL; ++ + handle_flags(ssif_info, flags); + ssif_inc_stat(ssif_info, events); + deliver_recv_msg(ssif_info, msg); +@@ -884,6 +898,11 @@ static void msg_done_handler(struct ssif + ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL; + handle_flags(ssif_info, flags); + } else { ++ ssif_info->num_requests_in_a_row++; ++ if (ssif_info->num_requests_in_a_row > 10) ++ /* Stop if we do this too many times. */ ++ ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL; ++ + ssif_inc_stat(ssif_info, incoming_messages); + handle_flags(ssif_info, flags); + deliver_recv_msg(ssif_info, msg); diff --git a/queue-5.10/ipmi-check-event-message-buffer-response-for-bad-data.patch b/queue-5.10/ipmi-check-event-message-buffer-response-for-bad-data.patch new file mode 100644 index 0000000000..b4fb1ff0d6 --- /dev/null +++ b/queue-5.10/ipmi-check-event-message-buffer-response-for-bad-data.patch @@ -0,0 +1,44 @@ +From 36920f30e78e69df01f9691c470b6f3ba8aebf98 Mon Sep 17 00:00:00 2001 +From: Corey Minyard +Date: Mon, 20 Apr 2026 12:50:09 -0500 +Subject: ipmi: Check event message buffer response for bad data + +From: Corey Minyard + +commit 36920f30e78e69df01f9691c470b6f3ba8aebf98 upstream. + +The event message buffer response data size got checked later when +processing, but check it right after the response comes back. It +appears some BMCs may return an empty message instead of an error +when fetching events. + +There are apparently some new BMCs that make this error, so we need to +compensate. + +Reported-by: Matt Fleming +Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/ +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_si_intf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -623,7 +623,13 @@ static void handle_transaction_done(stru + */ + msg = smi_info->curr_msg; + smi_info->curr_msg = NULL; +- if (msg->rsp[2] != 0) { ++ /* ++ * It appears some BMCs, with no event data, return no ++ * data in the message and not a 0x80 error as the ++ * spec says they should. Shut down processing if ++ * the data is not the right length. ++ */ ++ if (msg->rsp[2] != 0 || msg->rsp_size != 19) { + /* Error getting event, probably done. */ + msg->done(msg); + diff --git a/queue-5.10/ipmi-si-return-state-to-normal-if-message-allocation-fails.patch b/queue-5.10/ipmi-si-return-state-to-normal-if-message-allocation-fails.patch new file mode 100644 index 0000000000..622d34c5ca --- /dev/null +++ b/queue-5.10/ipmi-si-return-state-to-normal-if-message-allocation-fails.patch @@ -0,0 +1,44 @@ +From 09dd798270ff582d7309f285d4aaf5dbebae01cb Mon Sep 17 00:00:00 2001 +From: Corey Minyard +Date: Mon, 20 Apr 2026 13:02:18 -0500 +Subject: ipmi:si: Return state to normal if message allocation fails + +From: Corey Minyard + +commit 09dd798270ff582d7309f285d4aaf5dbebae01cb upstream. + +There were places where nothing would get started if a message +allocation failed, so the driver needs to return to normal state. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_si_intf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -479,15 +479,19 @@ retry: + } else if (smi_info->msg_flags & RECEIVE_MSG_AVAIL) { + /* Messages available. */ + smi_info->curr_msg = alloc_msg_handle_irq(smi_info); +- if (!smi_info->curr_msg) ++ if (!smi_info->curr_msg) { ++ smi_info->si_state = SI_NORMAL; + return; ++ } + + start_getting_msg_queue(smi_info); + } else if (smi_info->msg_flags & EVENT_MSG_BUFFER_FULL) { + /* Events available. */ + smi_info->curr_msg = alloc_msg_handle_irq(smi_info); +- if (!smi_info->curr_msg) ++ if (!smi_info->curr_msg) { ++ smi_info->si_state = SI_NORMAL; + return; ++ } + + start_getting_events(smi_info); + } else if (smi_info->msg_flags & OEM_DATA_AVAIL && diff --git a/queue-5.10/scsi-target-configfs-bound-snprintf-return-in-tg_pt_gp_members_show.patch b/queue-5.10/scsi-target-configfs-bound-snprintf-return-in-tg_pt_gp_members_show.patch new file mode 100644 index 0000000000..6d4ba44605 --- /dev/null +++ b/queue-5.10/scsi-target-configfs-bound-snprintf-return-in-tg_pt_gp_members_show.patch @@ -0,0 +1,46 @@ +From 772a896a56e0e3ef9424a025cec9176f9d8f4552 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sat, 11 Apr 2026 14:06:00 +0200 +Subject: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() + +From: Greg Kroah-Hartman + +commit 772a896a56e0e3ef9424a025cec9176f9d8f4552 upstream. + +target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a +256-byte stack buffer, then will memcpy() cur_len bytes from that +buffer. snprintf() returns the length the output would have had, which +can exceed the buffer size when the fabric WWN is long because iSCSI IQN +names can be up to 223 bytes. The check at the memcpy() site only +guards the destination page write, not the source read, so memcpy() will +read past the stack buffer and copy adjacent stack contents to the sysfs +reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() +will be triggered. + +Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length +check to avoid buffer overflow") added the same bound to the +target_lu_gp_members_show() but the tg_pt_gp variant was missed so +resolve that here. + +Cc: Martin K. Petersen +Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") +Assisted-by: gregkh_clanker_t1000 +Signed-off-by: Greg Kroah-Hartman +Link: https://patch.msgid.link/2026041159-garter-theft-3be0@gregkh +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/target/target_core_configfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/target_core_configfs.c ++++ b/drivers/target/target_core_configfs.c +@@ -3043,7 +3043,7 @@ static ssize_t target_tg_pt_gp_members_s + config_item_name(&lun->lun_group.cg_item)); + cur_len++; /* Extra byte for NULL terminator */ + +- if ((cur_len + len) > PAGE_SIZE) { ++ if (cur_len > TG_PT_GROUP_NAME_BUF || (cur_len + len) > PAGE_SIZE) { + pr_warn("Ran out of lu_gp_show_attr" + "_members buffer\n"); + break; diff --git a/queue-5.10/series b/queue-5.10/series index ba29f6ed19..d3bfb91492 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -205,3 +205,10 @@ ipv6-rpl-reserve-mac_len-headroom-when-recompressed-srh-grows.patch drm-amdgpu-fix-zero-size-gds-range-init-on-rdna4.patch alsa-caiaq-fix-usb_dev-refcount-leak-on-probe-failure.patch netfilter-reject-zero-shift-in-nft_bitwise.patch +scsi-target-configfs-bound-snprintf-return-in-tg_pt_gp_members_show.patch +ipmi-add-limits-to-event-and-receive-message-requests.patch +ipmi-check-event-message-buffer-response-for-bad-data.patch +ipmi-si-return-state-to-normal-if-message-allocation-fails.patch +fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch +acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch +spi-rockchip-fix-controller-deregistration.patch diff --git a/queue-5.10/spi-rockchip-fix-controller-deregistration.patch b/queue-5.10/spi-rockchip-fix-controller-deregistration.patch new file mode 100644 index 0000000000..ef6bc573d5 --- /dev/null +++ b/queue-5.10/spi-rockchip-fix-controller-deregistration.patch @@ -0,0 +1,43 @@ +From 53e7a16070feb7d1d4d81a583eaac5e25048b9c3 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 24 Mar 2026 09:23:23 +0100 +Subject: spi: rockchip: fix controller deregistration + +From: Johan Hovold + +commit 53e7a16070feb7d1d4d81a583eaac5e25048b9c3 upstream. + +Make sure to deregister the controller before freeing underlying +resources like DMA channels during driver unbind. + +Fixes: 64e36824b32b ("spi/rockchip: add driver for Rockchip RK3xxx SoCs integrated SPI") +Cc: stable@vger.kernel.org # 3.17 +Cc: addy ke +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260324082326.901043-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-rockchip.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-rockchip.c ++++ b/drivers/spi/spi-rockchip.c +@@ -792,7 +792,7 @@ static int rockchip_spi_probe(struct pla + ctlr->can_dma = rockchip_spi_can_dma; + } + +- ret = devm_spi_register_controller(&pdev->dev, ctlr); ++ ret = spi_register_controller(ctlr); + if (ret < 0) { + dev_err(&pdev->dev, "Failed to register controller\n"); + goto err_free_dma_rx; +@@ -828,6 +828,8 @@ static int rockchip_spi_remove(struct pl + clk_disable_unprepare(rs->spiclk); + clk_disable_unprepare(rs->apb_pclk); + ++ spi_unregister_controller(ctlr); ++ + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + pm_runtime_set_suspended(&pdev->dev); -- 2.47.3