From: Greg Kroah-Hartman Date: Mon, 13 Apr 2026 15:11:50 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b31eb385b264887ce8198addcf2cf8ec4fff155b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch --- diff --git a/queue-5.10/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch b/queue-5.10/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch new file mode 100644 index 0000000000..a1ac57caf4 --- /dev/null +++ b/queue-5.10/io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch @@ -0,0 +1,96 @@ +From 371526a85a9b24970036b10365d5b0a9c6021fb9 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Fri, 13 Mar 2026 15:50:21 -0600 +Subject: io_uring/poll: correctly handle io_poll_add() return value on update + +From: Jens Axboe + +Commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e upstream. + +When the core of io_uring was updated to handle completions +consistently and with fixed return codes, the POLL_REMOVE opcode +with updates got slightly broken. If a POLL_ADD is pending and +then POLL_REMOVE is used to update the events of that request, if that +update causes the POLL_ADD to now trigger, then that completion is lost +and a CQE is never posted. + +Additionally, ensure that if an update does cause an existing POLL_ADD +to complete, that the completion value isn't always overwritten with +-ECANCELED. For that case, whatever io_poll_add() set the value to +should just be retained. + +Cc: stable@vger.kernel.org +Fixes: 97b388d70b53 ("io_uring: handle completions in the core") +Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com +Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io_uring.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -5980,7 +5980,7 @@ static int io_poll_add_prep(struct io_ki + return 0; + } + +-static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) ++static int __io_poll_add(struct io_kiocb *req, unsigned int issue_flags) + { + struct io_poll_iocb *poll = &req->poll; + struct io_poll_table ipt; +@@ -5992,11 +5992,21 @@ static int io_poll_add(struct io_kiocb * + if (!ret && ipt.error) + req_set_fail(req); + ret = ret ?: ipt.error; +- if (ret) ++ if (ret > 0) { + __io_req_complete(req, issue_flags, ret, 0); ++ return ret; ++ } + return 0; + } + ++static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags) ++{ ++ int ret; ++ ++ ret = __io_poll_add(req, issue_flags); ++ return ret < 0 ? ret : 0; ++} ++ + static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) + { + struct io_ring_ctx *ctx = req->ctx; +@@ -6012,6 +6022,7 @@ static int io_poll_update(struct io_kioc + ret = preq ? -EALREADY : -ENOENT; + goto out; + } ++ preq->result = -ECANCELED; + spin_unlock(&ctx->completion_lock); + + if (req->poll_update.update_events || req->poll_update.update_user_data) { +@@ -6024,16 +6035,17 @@ static int io_poll_update(struct io_kioc + if (req->poll_update.update_user_data) + preq->user_data = req->poll_update.new_user_data; + +- ret2 = io_poll_add(preq, issue_flags); ++ ret2 = __io_poll_add(preq, issue_flags); + /* successfully updated, don't complete poll request */ + if (!ret2) + goto out; ++ preq->result = ret2; ++ + } +- req_set_fail(preq); +- io_req_complete(preq, -ECANCELED); ++ if (preq->result < 0) ++ req_set_fail(preq); ++ io_req_complete(preq, preq->result); + out: +- if (ret < 0) +- req_set_fail(req); + /* complete update request, we're done with it */ + io_req_complete(req, ret); + io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); diff --git a/queue-5.10/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch b/queue-5.10/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch new file mode 100644 index 0000000000..6fcbbd521f --- /dev/null +++ b/queue-5.10/revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch @@ -0,0 +1,95 @@ +From manivannan.sadhasivam@oss.qualcomm.com Mon Apr 13 17:02:30 2026 +From: Manivannan Sadhasivam +Date: Tue, 31 Mar 2026 14:44:55 +0530 +Subject: Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" +To: stable@vger.kernel.org +Cc: bhelgaas@google.com, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, robin.murphy@arm.com, Manivannan Sadhasivam , John Hancock , bjorn.forsman@gmail.com, Linux kernel regressions list +Message-ID: <20260331091455.30394-1-manivannan.sadhasivam@oss.qualcomm.com> + +From: Manivannan Sadhasivam + +This reverts commit 573497f350b3cdb526c8c38955ddd287c5d4cc53 which is +commit c41e2fb67e26b04d919257875fa954aa5f6e392e upstream. + +The original commit attempted to enable ACS in pci_dma_configure() prior +to IOMMU group assignment in iommu_init_device() to fix the ACS enablement +issue for OF platforms. But that assumption doesn't hold true for kernel +versions prior to v6.15, because on these older kernels, +pci_dma_configure() is called *after* iommu_init_device(). So the IOMMU +groups are already created before the ACS gets enabled. This causes the +devices that should have been split into separate groups by ACS, getting +merged into one group, thereby breaking the IOMMU isolation as reported on +the AMD machines. + +So revert the offending commit to restore the IOMMU group assignment on +those affected machines. It should be noted that ACS has never really +worked on kernel versions prior to v6.15, so the revert doesn't make any +difference for OF platforms. + +Reported-by: John Hancock +Reported-by: bjorn.forsman@gmail.com +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221234 +Fixes: b20b659c2c6a ("PCI: Enable ACS after configuring IOMMU for OF platforms") +Cc: Linux kernel regressions list +Link: https://lore.kernel.org/regressions/2c30f181-ffc6-4d63-a64e-763cf4528f48@leemhuis.info +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci-driver.c | 8 -------- + drivers/pci/pci.c | 10 +++++++++- + drivers/pci/pci.h | 1 - + 3 files changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1601,14 +1601,6 @@ static int pci_dma_configure(struct devi + ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev)); + } + +- /* +- * Attempt to enable ACS regardless of capability because some Root +- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +- * the standard ACS capability but still support ACS via those +- * quirks. +- */ +- pci_enable_acs(to_pci_dev(dev)); +- + pci_put_host_bridge_device(bridge); + return ret; + } +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -894,7 +894,7 @@ static void pci_std_enable_acs(struct pc + * pci_enable_acs - enable ACS if hardware support it + * @dev: the PCI device + */ +-void pci_enable_acs(struct pci_dev *dev) ++static void pci_enable_acs(struct pci_dev *dev) + { + if (!pci_acs_enable) + goto disable_acs_redir; +@@ -3548,6 +3548,14 @@ bool pci_acs_path_enabled(struct pci_dev + void pci_acs_init(struct pci_dev *dev) + { + dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS); ++ ++ /* ++ * Attempt to enable ACS regardless of capability because some Root ++ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have ++ * the standard ACS capability but still support ACS via those ++ * quirks. ++ */ ++ pci_enable_acs(dev); + } + + /** +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -547,7 +547,6 @@ static inline resource_size_t pci_resour + } + + void pci_acs_init(struct pci_dev *dev); +-void pci_enable_acs(struct pci_dev *dev); + #ifdef CONFIG_PCI_QUIRKS + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); diff --git a/queue-5.10/series b/queue-5.10/series index 9c971a34c7..f02315f5cd 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -491,3 +491,5 @@ device-property-allow-secondary-lookup-in-fwnode_get_next_child_node.patch batman-adv-avoid-ogm-aggregation-when-skb-tailroom-is-insufficient.patch s390-syscalls-add-spectre-boundary-for-syscall-dispatch-table.patch device-property-fix-of-node-refcount-leak-in-fwnode_graph_get_next_endpoint.patch +revert-pci-enable-acs-after-configuring-iommu-for-of-platforms.patch +io_uring-poll-correctly-handle-io_poll_add-return-value-on-update.patch