6.12-stable patches

added patches:
	gpu-fix-uninitialized-buddy-for-built-in-drivers.patch
	net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch

diff --git a/queue-6.12/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch b/queue-6.12/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch
new file mode 100644 (file)
index 0000000..41cacaf
--- /dev/null
+++ b/queue-6.12/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch
@@ -0,0 +1,43 @@
+From cc27314c67516c138ee3829197d1c3b998e29fae Mon Sep 17 00:00:00 2001
+From: Koen Koning <koen.koning@linux.intel.com>
+Date: Fri, 13 Feb 2026 16:20:47 +0100
+Subject: gpu: Fix uninitialized buddy for built-in drivers
+
+From: Koen Koning <koen.koning@linux.intel.com>
+
+commit cc27314c67516c138ee3829197d1c3b998e29fae upstream.
+
+Move buddy to the start of the link order, so its __init runs before any
+other built-in drivers that may depend on it. Otherwise, a built-in
+driver that tries to use the buddy allocator will run into a kernel NULL
+pointer dereference because slab_blocks is uninitialized.
+
+Specifically, this fixes drm/xe (as built-in) running into a kernel
+panic during boot, because it uses buddy during device probe.
+
+Fixes: ba110db8e1bc ("gpu: Move DRM buddy allocator one level up (part two)")
+Cc: Joel Fernandes <joelagnelf@nvidia.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: intel-xe@lists.freedesktop.org
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Tested-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
+Signed-off-by: Koen Koning <koen.koning@linux.intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patch.msgid.link/20260213152047.179628-1-koen.koning@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/Makefile |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/Makefile
++++ b/drivers/gpu/Makefile
+@@ -2,7 +2,8 @@
+ # drm/tegra depends on host1x, so if both drivers are built-in care must be
+ # taken to initialize them in the correct order. Link order is the only way
+ # to ensure this currently.
++# Similarly, buddy must come first since it is used by other drivers.
++obj-$(CONFIG_GPU_BUDDY)       += buddy.o
+ obj-y                 += host1x/ drm/ vga/ tests/
+ obj-$(CONFIG_IMX_IPUV3_CORE)  += ipu-v3/
+ obj-$(CONFIG_TRACE_GPU_MEM)           += trace/
+-obj-$(CONFIG_GPU_BUDDY)               += buddy.o

diff --git a/queue-6.12/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch b/queue-6.12/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch
new file mode 100644 (file)
index 0000000..f7e97fd
--- /dev/null
+++ b/queue-6.12/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch
@@ -0,0 +1,45 @@
+From 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 Mon Sep 17 00:00:00 2001
+From: Gal Pressman <gal@nvidia.com>
+Date: Thu, 25 Dec 2025 15:27:15 +0200
+Subject: net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
+
+From: Gal Pressman <gal@nvidia.com>
+
+commit 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 upstream.
+
+The mlx5_query_mcia() function unconditionally dereferences the status
+pointer to store the MCIA register status value.
+However, mlx5e_get_module_id() passes NULL since it doesn't need the
+status value.
+
+Add a NULL check before dereferencing the status pointer to prevent a
+NULL pointer dereference.
+
+Fixes: 2e4c44b12f4d ("net/mlx5: Refactor EEPROM query error handling to return status separately")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-4-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -393,9 +393,11 @@ static int mlx5_query_mcia(struct mlx5_c
+       if (err)
+               return err;
+ 
+-      *status = MLX5_GET(mcia_reg, out, status);
+-      if (*status)
++      if (MLX5_GET(mcia_reg, out, status)) {
++              if (status)
++                      *status = MLX5_GET(mcia_reg, out, status);
+               return -EIO;
++      }
+ 
+       ptr = MLX5_ADDR_OF(mcia_reg, out, dwords);
+       memcpy(data, ptr, size);

diff --git a/queue-6.12/series b/queue-6.12/series
index d763a57224eb255ce1ad645ba36957e6104bea7a..f8f2cc0d5a7c50e520121d0d92809705cea5d68f 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -584,3 +584,5 @@ usb-gadget-use-str_enable_disable-like-helpers.patch
 usb-gadget-fsl-udc-fix-dev_printk-device.patch
 usb-musb-omap2430-clean-up-probe-error-handling.patch
 usb-musb-omap2430-do-not-put-borrowed-of_node-in-probe.patch
+net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch
+gpu-fix-uninitialized-buddy-for-built-in-drivers.patch