From: Greg Kroah-Hartman Date: Mon, 23 Mar 2026 09:09:53 +0000 (+0100) Subject: 6.12-stable patches X-Git-Tag: v6.1.167~26 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c703ad8a1c6658b91de9eb3503da98d6abbd060b;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: i2c-cp2615-fix-serial-string-null-deref-at-probe.patch i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch ring-buffer-fix-to-update-per-subbuf-entries-of-persistent-ring-buffer.patch x86-platform-uv-handle-deconfigured-sockets.patch --- diff --git a/queue-6.12/i2c-cp2615-fix-serial-string-null-deref-at-probe.patch b/queue-6.12/i2c-cp2615-fix-serial-string-null-deref-at-probe.patch new file mode 100644 index 0000000000..4aab603a4b --- /dev/null +++ b/queue-6.12/i2c-cp2615-fix-serial-string-null-deref-at-probe.patch @@ -0,0 +1,42 @@ +From aa79f996eb41e95aed85a1bd7f56bcd6a3842008 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 9 Mar 2026 08:50:16 +0100 +Subject: i2c: cp2615: fix serial string NULL-deref at probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johan Hovold + +commit aa79f996eb41e95aed85a1bd7f56bcd6a3842008 upstream. + +The cp2615 driver uses the USB device serial string as the i2c adapter +name but does not make sure that the string exists. + +Verify that the device has a serial number before accessing it to avoid +triggering a NULL-pointer dereference (e.g. with malicious devices). + +Fixes: 4a7695429ead ("i2c: cp2615: add i2c driver for Silicon Labs' CP2615 Digital Audio Bridge") +Cc: stable@vger.kernel.org # 5.13 +Cc: Bence Csókás +Signed-off-by: Johan Hovold +Reviewed-by: Bence Csókás +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260309075016.25612-1-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-cp2615.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/busses/i2c-cp2615.c ++++ b/drivers/i2c/busses/i2c-cp2615.c +@@ -298,6 +298,9 @@ cp2615_i2c_probe(struct usb_interface *u + if (!adap) + return -ENOMEM; + ++ if (!usbdev->serial) ++ return -EINVAL; ++ + strscpy(adap->name, usbdev->serial, sizeof(adap->name)); + adap->owner = THIS_MODULE; + adap->dev.parent = &usbif->dev; diff --git a/queue-6.12/i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch b/queue-6.12/i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch new file mode 100644 index 0000000000..b0aa685a73 --- /dev/null +++ b/queue-6.12/i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch @@ -0,0 +1,36 @@ +From be627abcc0d5dbd5882873bd85fbc18aa3d189ed Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 1 Mar 2026 17:21:01 +0100 +Subject: i2c: fsi: Fix a potential leak in fsi_i2c_probe() + +From: Christophe JAILLET + +commit be627abcc0d5dbd5882873bd85fbc18aa3d189ed upstream. + +In the commit in Fixes:, when the code has been updated to use an explicit +for loop, instead of for_each_available_child_of_node(), the assumption +that a reference to a device_node structure would be released at each +iteration has been broken. + +Now, an explicit of_node_put() is needed to release the reference. + +Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports") +Signed-off-by: Christophe JAILLET +Cc: # v5.3+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/fd805c39f8de51edf303856103d782138a1633c8.1772382022.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-fsi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/busses/i2c-fsi.c ++++ b/drivers/i2c/busses/i2c-fsi.c +@@ -728,6 +728,7 @@ static int fsi_i2c_probe(struct device * + rc = i2c_add_adapter(&port->adapter); + if (rc < 0) { + dev_err(dev, "Failed to register adapter: %d\n", rc); ++ of_node_put(np); + kfree(port); + continue; + } diff --git a/queue-6.12/i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch b/queue-6.12/i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch new file mode 100644 index 0000000000..371958f4f7 --- /dev/null +++ b/queue-6.12/i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch @@ -0,0 +1,130 @@ +From 78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc Mon Sep 17 00:00:00 2001 +From: Gabor Juhos +Date: Thu, 26 Feb 2026 14:11:27 +0100 +Subject: i2c: pxa: defer reset on Armada 3700 when recovery is used + +From: Gabor Juhos + +commit 78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc upstream. + +The I2C communication is completely broken on the Armada 3700 platform +since commit 0b01392c18b9 ("i2c: pxa: move to generic GPIO recovery"). + +For example, on the Methode uDPU board, probing of the two onboard +temperature sensors fails ... + + [ 7.271713] i2c i2c-0: using pinctrl states for GPIO recovery + [ 7.277503] i2c i2c-0: PXA I2C adapter + [ 7.282199] i2c i2c-1: using pinctrl states for GPIO recovery + [ 7.288241] i2c i2c-1: PXA I2C adapter + [ 7.292947] sfp sfp-eth1: Host maximum power 3.0W + [ 7.299614] sfp sfp-eth0: Host maximum power 3.0W + [ 7.308178] lm75 1-0048: supply vs not found, using dummy regulator + [ 32.489631] lm75 1-0048: probe with driver lm75 failed with error -121 + [ 32.496833] lm75 1-0049: supply vs not found, using dummy regulator + [ 82.890614] lm75 1-0049: probe with driver lm75 failed with error -121 + +... and accessing the plugged-in SFP modules also does not work: + + [ 511.298537] sfp sfp-eth1: please wait, module slow to respond + [ 536.488530] sfp sfp-eth0: please wait, module slow to respond + ... + [ 1065.688536] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO + [ 1090.888532] sfp sfp-eth0: failed to read EEPROM: -EREMOTEIO + +After a discussion [1], there was an attempt to fix the problem by +reverting the offending change by commit 7b211c767121 ("Revert "i2c: +pxa: move to generic GPIO recovery""), but that only helped to fix +the issue in the 6.1.y stable tree. The reason behind the partial succes +is that there was another change in commit 20cb3fce4d60 ("i2c: Set i2c +pinctrl recovery info from it's device pinctrl") in the 6.3-rc1 cycle +which broke things further. + +The cause of the problem is the same in case of both offending commits +mentioned above. Namely, the I2C core code changes the pinctrl state to +GPIO while running the recovery initialization code. Although the PXA +specific initialization also does this, but the key difference is that +it happens before the controller is getting enabled in i2c_pxa_reset(), +whereas in the case of the generic initialization it happens after that. + +Change the code to reset the controller only before the first transfer +instead of before registering the controller. This ensures that the +controller is not enabled at the time when the generic recovery code +performs the pinctrl state changes, thus avoids the problem described +above. + +As the result this change restores the original behaviour, which in +turn makes the I2C communication to work again as it can be seen from +the following log: + + [ 7.363250] i2c i2c-0: using pinctrl states for GPIO recovery + [ 7.369041] i2c i2c-0: PXA I2C adapter + [ 7.373673] i2c i2c-1: using pinctrl states for GPIO recovery + [ 7.379742] i2c i2c-1: PXA I2C adapter + [ 7.384506] sfp sfp-eth1: Host maximum power 3.0W + [ 7.393013] sfp sfp-eth0: Host maximum power 3.0W + [ 7.399266] lm75 1-0048: supply vs not found, using dummy regulator + [ 7.407257] hwmon hwmon0: temp1_input not attached to any thermal zone + [ 7.413863] lm75 1-0048: hwmon0: sensor 'tmp75c' + [ 7.418746] lm75 1-0049: supply vs not found, using dummy regulator + [ 7.426371] hwmon hwmon1: temp1_input not attached to any thermal zone + [ 7.432972] lm75 1-0049: hwmon1: sensor 'tmp75c' + [ 7.755092] sfp sfp-eth1: module MENTECHOPTO POS22-LDCC-KR rev 1.0 sn MNC208U90009 dc 200828 + [ 7.764997] mvneta d0040000.ethernet eth1: unsupported SFP module: no common interface modes + [ 7.785362] sfp sfp-eth0: module Mikrotik S-RJ01 rev 1.0 sn 61B103C55C58 dc 201022 + [ 7.803426] hwmon hwmon2: temp1_input not attached to any thermal zone + +Link: https://lore.kernel.org/r/20230926160255.330417-1-robert.marko@sartura.hr #1 + +Cc: stable@vger.kernel.org # 6.3+ +Fixes: 20cb3fce4d60 ("i2c: Set i2c pinctrl recovery info from it's device pinctrl") +Signed-off-by: Gabor Juhos +Tested-by: Robert Marko +Reviewed-by: Linus Walleij +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20260226-i2c-pxa-fix-i2c-communication-v4-1-797a091dae87@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-pxa.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-pxa.c ++++ b/drivers/i2c/busses/i2c-pxa.c +@@ -268,6 +268,7 @@ struct pxa_i2c { + struct pinctrl *pinctrl; + struct pinctrl_state *pinctrl_default; + struct pinctrl_state *pinctrl_recovery; ++ bool reset_before_xfer; + }; + + #define _IBMR(i2c) ((i2c)->reg_ibmr) +@@ -1144,6 +1145,11 @@ static int i2c_pxa_xfer(struct i2c_adapt + { + struct pxa_i2c *i2c = adap->algo_data; + ++ if (i2c->reset_before_xfer) { ++ i2c_pxa_reset(i2c); ++ i2c->reset_before_xfer = false; ++ } ++ + return i2c_pxa_internal_xfer(i2c, msgs, num, i2c_pxa_do_xfer); + } + +@@ -1521,7 +1527,16 @@ static int i2c_pxa_probe(struct platform + } + } + +- i2c_pxa_reset(i2c); ++ /* ++ * Skip reset on Armada 3700 when recovery is used to avoid ++ * controller hang due to the pinctrl state changes done by ++ * the generic recovery initialization code. The reset will ++ * be performed later, prior to the first transfer. ++ */ ++ if (i2c_type == REGS_A3700 && i2c->adap.bus_recovery_info) ++ i2c->reset_before_xfer = true; ++ else ++ i2c_pxa_reset(i2c); + + ret = i2c_add_numbered_adapter(&i2c->adap); + if (ret < 0) diff --git a/queue-6.12/ring-buffer-fix-to-update-per-subbuf-entries-of-persistent-ring-buffer.patch b/queue-6.12/ring-buffer-fix-to-update-per-subbuf-entries-of-persistent-ring-buffer.patch new file mode 100644 index 0000000000..426963c18a --- /dev/null +++ b/queue-6.12/ring-buffer-fix-to-update-per-subbuf-entries-of-persistent-ring-buffer.patch @@ -0,0 +1,37 @@ +From f35dbac6942171dc4ce9398d1d216a59224590a9 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 19 Mar 2026 18:12:19 +0900 +Subject: ring-buffer: Fix to update per-subbuf entries of persistent ring buffer + +From: Masami Hiramatsu (Google) + +commit f35dbac6942171dc4ce9398d1d216a59224590a9 upstream. + +Since the validation loop in rb_meta_validate_events() updates the same +cpu_buffer->head_page->entries, the other subbuf entries are not updated. +Fix to use head_page to update the entries field, since it is the cursor +in this loop. + +Cc: stable@vger.kernel.org +Cc: Mathieu Desnoyers +Cc: Ian Rogers +Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events") +Link: https://patch.msgid.link/177391153882.193994.17158784065013676533.stgit@mhiramat.tok.corp.google.com +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/ring_buffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1863,7 +1863,7 @@ static void rb_meta_validate_events(stru + + entries += ret; + entry_bytes += local_read(&head_page->page->commit); +- local_set(&cpu_buffer->head_page->entries, ret); ++ local_set(&head_page->entries, ret); + + if (head_page == cpu_buffer->commit_page) + break; diff --git a/queue-6.12/series b/queue-6.12/series index 59975aa6c8..c1c1bd064e 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -435,3 +435,8 @@ hwmon-pmbus-mp2975-add-error-check-for-pmbus_read_word_data-return-value.patch hwmon-pmbus-isl68137-fix-unchecked-return-value-and-use-sysfs_emit.patch drm-i915-psr-compute-psr-entry_setup_frames-into-intel_crtc_state.patch usb-serial-f81232-fix-incomplete-serial-port-generation.patch +i2c-cp2615-fix-serial-string-null-deref-at-probe.patch +i2c-fsi-fix-a-potential-leak-in-fsi_i2c_probe.patch +i2c-pxa-defer-reset-on-armada-3700-when-recovery-is-used.patch +ring-buffer-fix-to-update-per-subbuf-entries-of-persistent-ring-buffer.patch +x86-platform-uv-handle-deconfigured-sockets.patch diff --git a/queue-6.12/x86-platform-uv-handle-deconfigured-sockets.patch b/queue-6.12/x86-platform-uv-handle-deconfigured-sockets.patch new file mode 100644 index 0000000000..42ff53f02d --- /dev/null +++ b/queue-6.12/x86-platform-uv-handle-deconfigured-sockets.patch @@ -0,0 +1,53 @@ +From 1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3 Mon Sep 17 00:00:00 2001 +From: Kyle Meyer +Date: Fri, 20 Mar 2026 12:19:20 -0500 +Subject: x86/platform/uv: Handle deconfigured sockets + +From: Kyle Meyer + +commit 1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3 upstream. + +When a socket is deconfigured, it's mapped to SOCK_EMPTY (0xffff). This causes +a panic while allocating UV hub info structures. + +Fix this by using NUMA_NO_NODE, allowing UV hub info structures to be +allocated on valid nodes. + +Fixes: 8a50c5851927 ("x86/platform/uv: UV support for sub-NUMA clustering") +Signed-off-by: Kyle Meyer +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Steve Wahl +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/ab2BmGL0ehVkkjKk@hpe.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/apic/x2apic_uv_x.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -1708,8 +1708,22 @@ static void __init uv_system_init_hub(vo + struct uv_hub_info_s *new_hub; + + /* Allocate & fill new per hub info list */ +- new_hub = (bid == 0) ? &uv_hub_info_node0 +- : kzalloc_node(bytes, GFP_KERNEL, uv_blade_to_node(bid)); ++ if (bid == 0) { ++ new_hub = &uv_hub_info_node0; ++ } else { ++ int nid; ++ ++ /* ++ * Deconfigured sockets are mapped to SOCK_EMPTY. Use ++ * NUMA_NO_NODE to allocate on a valid node. ++ */ ++ nid = uv_blade_to_node(bid); ++ if (nid == SOCK_EMPTY) ++ nid = NUMA_NO_NODE; ++ ++ new_hub = kzalloc_node(bytes, GFP_KERNEL, nid); ++ } ++ + if (WARN_ON_ONCE(!new_hub)) { + /* do not kfree() bid 0, which is statically allocated */ + while (--bid > 0)