From: Greg Kroah-Hartman Date: Thu, 30 Jul 2026 13:28:16 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.6.148~26 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=387d757e98a39763650f6655046b9679e4be964e;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: gpu-fix-uninitialized-buddy-for-built-in-drivers.patch net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch --- diff --git a/queue-6.12/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch b/queue-6.12/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch new file mode 100644 index 0000000000..41cacafec1 --- /dev/null +++ b/queue-6.12/gpu-fix-uninitialized-buddy-for-built-in-drivers.patch @@ -0,0 +1,43 @@ +From cc27314c67516c138ee3829197d1c3b998e29fae Mon Sep 17 00:00:00 2001 +From: Koen Koning +Date: Fri, 13 Feb 2026 16:20:47 +0100 +Subject: gpu: Fix uninitialized buddy for built-in drivers + +From: Koen Koning + +commit cc27314c67516c138ee3829197d1c3b998e29fae upstream. + +Move buddy to the start of the link order, so its __init runs before any +other built-in drivers that may depend on it. Otherwise, a built-in +driver that tries to use the buddy allocator will run into a kernel NULL +pointer dereference because slab_blocks is uninitialized. + +Specifically, this fixes drm/xe (as built-in) running into a kernel +panic during boot, because it uses buddy during device probe. + +Fixes: ba110db8e1bc ("gpu: Move DRM buddy allocator one level up (part two)") +Cc: Joel Fernandes +Cc: Dave Airlie +Cc: intel-xe@lists.freedesktop.org +Reviewed-by: Dave Airlie +Tested-by: Peter Senna Tschudin +Signed-off-by: Koen Koning +Signed-off-by: Dave Airlie +Link: https://patch.msgid.link/20260213152047.179628-1-koen.koning@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/Makefile ++++ b/drivers/gpu/Makefile +@@ -2,7 +2,8 @@ + # drm/tegra depends on host1x, so if both drivers are built-in care must be + # taken to initialize them in the correct order. Link order is the only way + # to ensure this currently. ++# Similarly, buddy must come first since it is used by other drivers. ++obj-$(CONFIG_GPU_BUDDY) += buddy.o + obj-y += host1x/ drm/ vga/ tests/ + obj-$(CONFIG_IMX_IPUV3_CORE) += ipu-v3/ + obj-$(CONFIG_TRACE_GPU_MEM) += trace/ +-obj-$(CONFIG_GPU_BUDDY) += buddy.o diff --git a/queue-6.12/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch b/queue-6.12/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch new file mode 100644 index 0000000000..f7e97fd497 --- /dev/null +++ b/queue-6.12/net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch @@ -0,0 +1,45 @@ +From 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 Mon Sep 17 00:00:00 2001 +From: Gal Pressman +Date: Thu, 25 Dec 2025 15:27:15 +0200 +Subject: net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query + +From: Gal Pressman + +commit 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 upstream. + +The mlx5_query_mcia() function unconditionally dereferences the status +pointer to store the MCIA register status value. +However, mlx5e_get_module_id() passes NULL since it doesn't need the +status value. + +Add a NULL check before dereferencing the status pointer to prevent a +NULL pointer dereference. + +Fixes: 2e4c44b12f4d ("net/mlx5: Refactor EEPROM query error handling to return status separately") +Signed-off-by: Gal Pressman +Reviewed-by: Tariq Toukan +Reviewed-by: Dragos Tatulea +Signed-off-by: Mark Bloch +Link: https://patch.msgid.link/20251225132717.358820-4-mbloch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/port.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c +@@ -393,9 +393,11 @@ static int mlx5_query_mcia(struct mlx5_c + if (err) + return err; + +- *status = MLX5_GET(mcia_reg, out, status); +- if (*status) ++ if (MLX5_GET(mcia_reg, out, status)) { ++ if (status) ++ *status = MLX5_GET(mcia_reg, out, status); + return -EIO; ++ } + + ptr = MLX5_ADDR_OF(mcia_reg, out, dwords); + memcpy(data, ptr, size); diff --git a/queue-6.12/series b/queue-6.12/series index d763a57224..f8f2cc0d5a 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -584,3 +584,5 @@ usb-gadget-use-str_enable_disable-like-helpers.patch usb-gadget-fsl-udc-fix-dev_printk-device.patch usb-musb-omap2430-clean-up-probe-error-handling.patch usb-musb-omap2430-do-not-put-borrowed-of_node-in-probe.patch +net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eeprom-query.patch +gpu-fix-uninitialized-buddy-for-built-in-drivers.patch