5.15-stable patches

added patches:
	io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch
	revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch

diff --git a/queue-5.15/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch b/queue-5.15/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch
new file mode 100644 (file)
index 0000000..48f83b8
--- /dev/null
+++ b/queue-5.15/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch
@@ -0,0 +1,96 @@
+From 371526a85a9b24970036b10365d5b0a9c6021fb9 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Fri, 13 Mar 2026 15:50:21 -0600
+Subject: io_uring/poll: correctly handle io_poll_add() return value on update
+
+From: Jens Axboe <axboe@kernel.dk>
+
+Commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e upstream.
+
+When the core of io_uring was updated to handle completions
+consistently and with fixed return codes, the POLL_REMOVE opcode
+with updates got slightly broken. If a POLL_ADD is pending and
+then POLL_REMOVE is used to update the events of that request, if that
+update causes the POLL_ADD to now trigger, then that completion is lost
+and a CQE is never posted.
+
+Additionally, ensure that if an update does cause an existing POLL_ADD
+to complete, that the completion value isn't always overwritten with
+-ECANCELED. For that case, whatever io_poll_add() set the value to
+should just be retained.
+
+Cc: stable@vger.kernel.org
+Fixes: 97b388d70b53 ("io_uring: handle completions in the core")
+Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
+Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c |   26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -6127,7 +6127,7 @@ static int io_poll_add_prep(struct io_ki
+       return 0;
+ }
+ 
+-static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
++static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
+ {
+       struct io_poll_iocb *poll = &req->poll;
+       struct io_poll_table ipt;
+@@ -6139,11 +6139,21 @@ static int io_poll_add(struct io_kiocb *
+       if (!ret && ipt.error)
+               req_set_fail(req);
+       ret = ret ?: ipt.error;
+-      if (ret)
++      if (ret > 0) {
+               __io_req_complete(req, issue_flags, ret, 0);
++              return ret;
++      }
+       return 0;
+ }
+ 
++static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
++{
++      int ret;
++
++      ret = __io_poll_add(req, issue_flags);
++      return ret < 0 ? ret : 0;
++}
++
+ static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags)
+ {
+       struct io_ring_ctx *ctx = req->ctx;
+@@ -6159,6 +6169,7 @@ static int io_poll_update(struct io_kioc
+               ret = preq ? -EALREADY : -ENOENT;
+               goto out;
+       }
++      preq->result = -ECANCELED;
+       spin_unlock(&ctx->completion_lock);
+ 
+       if (req->poll_update.update_events || req->poll_update.update_user_data) {
+@@ -6171,16 +6182,17 @@ static int io_poll_update(struct io_kioc
+               if (req->poll_update.update_user_data)
+                       preq->user_data = req->poll_update.new_user_data;
+ 
+-              ret2 = io_poll_add(preq, issue_flags);
++              ret2 = __io_poll_add(preq, issue_flags);
+               /* successfully updated, don't complete poll request */
+               if (!ret2)
+                       goto out;
++              preq->result = ret2;
++
+       }
+-      req_set_fail(preq);
+-      io_req_complete(preq, -ECANCELED);
++      if (preq->result < 0)
++              req_set_fail(preq);
++      io_req_complete(preq, preq->result);
+ out:
+-      if (ret < 0)
+-              req_set_fail(req);
+       /* complete update request, we're done with it */
+       io_req_complete(req, ret);
+       io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK));

diff --git a/queue-5.15/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch b/queue-5.15/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch
new file mode 100644 (file)
index 0000000..f9e2d3a
--- /dev/null
+++ b/queue-5.15/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch
@@ -0,0 +1,95 @@
+From manivannan.sadhasivam@oss.qualcomm.com  Mon Apr 13 17:02:30 2026
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Date: Tue, 31 Mar 2026 14:44:55 +0530
+Subject: Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"
+To: stable@vger.kernel.org
+Cc: bhelgaas@google.com, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, robin.murphy@arm.com, Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>, John Hancock <john@kernel.doghat.io>, bjorn.forsman@gmail.com, Linux kernel regressions list <regressions@lists.linux.dev>
+Message-ID: <20260331091455.30394-1-manivannan.sadhasivam@oss.qualcomm.com>
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+This reverts commit b20b659c2c6a072560b360feda81ae52176034df which is
+commit c41e2fb67e26b04d919257875fa954aa5f6e392e upstream.
+
+The original commit attempted to enable ACS in pci_dma_configure() prior
+to IOMMU group assignment in iommu_init_device() to fix the ACS enablement
+issue for OF platforms. But that assumption doesn't hold true for kernel
+versions prior to v6.15, because on these older kernels,
+pci_dma_configure() is called *after* iommu_init_device(). So the IOMMU
+groups are already created before the ACS gets enabled. This causes the
+devices that should have been split into separate groups by ACS, getting
+merged into one group, thereby breaking the IOMMU isolation as reported on
+the AMD machines.
+
+So revert the offending commit to restore the IOMMU group assignment on
+those affected machines. It should be noted that ACS has never really
+worked on kernel versions prior to v6.15, so the revert doesn't make any
+difference for OF platforms.
+
+Reported-by: John Hancock <john@kernel.doghat.io>
+Reported-by: bjorn.forsman@gmail.com
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221234
+Fixes: b20b659c2c6a ("PCI: Enable ACS after configuring IOMMU for OF platforms")
+Cc: Linux kernel regressions list <regressions@lists.linux.dev>
+Link: https://lore.kernel.org/regressions/2c30f181-ffc6-4d63-a64e-763cf4528f48@leemhuis.info
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci-driver.c |    8 --------
+ drivers/pci/pci.c        |   10 +++++++++-
+ drivers/pci/pci.h        |    1 -
+ 3 files changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1616,14 +1616,6 @@ static int pci_dma_configure(struct devi
+               ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
+       }
+ 
+-      /*
+-       * Attempt to enable ACS regardless of capability because some Root
+-       * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+-       * the standard ACS capability but still support ACS via those
+-       * quirks.
+-       */
+-      pci_enable_acs(to_pci_dev(dev));
+-
+       pci_put_host_bridge_device(bridge);
+       return ret;
+ }
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -936,7 +936,7 @@ static void pci_std_enable_acs(struct pc
+  * pci_enable_acs - enable ACS if hardware support it
+  * @dev: the PCI device
+  */
+-void pci_enable_acs(struct pci_dev *dev)
++static void pci_enable_acs(struct pci_dev *dev)
+ {
+       if (!pci_acs_enable)
+               goto disable_acs_redir;
+@@ -3609,6 +3609,14 @@ bool pci_acs_path_enabled(struct pci_dev
+ void pci_acs_init(struct pci_dev *dev)
+ {
+       dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
++
++      /*
++       * Attempt to enable ACS regardless of capability because some Root
++       * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
++       * the standard ACS capability but still support ACS via those
++       * quirks.
++       */
++      pci_enable_acs(dev);
+ }
+ 
+ /**
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -562,7 +562,6 @@ static inline resource_size_t pci_resour
+ }
+ 
+ void pci_acs_init(struct pci_dev *dev);
+-void pci_enable_acs(struct pci_dev *dev);
+ #ifdef CONFIG_PCI_QUIRKS
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);

diff --git a/queue-5.15/series b/queue-5.15/series
index 0ad8b8a578ad0cbb43496524a54e892ac954532b..dd06b0ebe2663838704d01f437ad7a1fbcd0dbeb 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -566,3 +566,5 @@ bluetooth-l2cap-fix-accepting-multiple-l2cap_ecred_conn_req.patch
 drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
 ksmbd-fix-refcount-leak-when-invalid-session-is-found-on-session-lookup.patch
 ksmbd-fix-dangling-pointer-in-krb_authenticate.patch
+revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch
+io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch