From: Greg Kroah-Hartman Date: Thu, 3 Apr 2025 15:00:12 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.1.133~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e1d56a71b76485a4dac2453e331f7f7b20b2721e;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch usb-gadget-uvc-fix-err_ptr-dereference-in-uvc_v4l2.c.patch usb-typec-ucsi-fix-null-pointer-access.patch --- diff --git a/queue-6.1/arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch b/queue-6.1/arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch new file mode 100644 index 0000000000..17a8a0d975 --- /dev/null +++ b/queue-6.1/arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch @@ -0,0 +1,61 @@ +From 83964a29379cb08929a39172780a4c2992bc7c93 Mon Sep 17 00:00:00 2001 +From: Stefan Eichenberger +Date: Fri, 10 Jan 2025 16:18:29 +0100 +Subject: ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6 + +From: Stefan Eichenberger + +commit 83964a29379cb08929a39172780a4c2992bc7c93 upstream. + +The current solution for powering off the Apalis iMX6 is not functioning +as intended. To resolve this, it is necessary to power off the +vgen2_reg, which will also set the POWER_ENABLE_MOCI signal to a low +state. This ensures the carrier board is properly informed to initiate +its power-off sequence. + +The new solution uses the regulator-poweroff driver, which will power +off the regulator during a system shutdown. + +Cc: +Fixes: 4eb56e26f92e ("ARM: dts: imx6q-apalis: Command pmic to standby for poweroff") +Signed-off-by: Stefan Eichenberger +Signed-off-by: Shawn Guo +Signed-off-by: Stefan Eichenberger +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi +@@ -101,6 +101,11 @@ + }; + }; + ++ poweroff { ++ compatible = "regulator-poweroff"; ++ cpu-supply = <&vgen2_reg>; ++ }; ++ + reg_module_3v3: regulator-module-3v3 { + compatible = "regulator-fixed"; + regulator-always-on; +@@ -220,10 +225,6 @@ + status = "disabled"; + }; + +-&clks { +- fsl,pmic-stby-poweroff; +-}; +- + /* Apalis SPI1 */ + &ecspi1 { + cs-gpios = <&gpio5 25 GPIO_ACTIVE_LOW>; +@@ -511,7 +512,6 @@ + + pmic: pmic@8 { + compatible = "fsl,pfuze100"; +- fsl,pmic-stby-poweroff; + reg = <0x08>; + + regulators { diff --git a/queue-6.1/media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch b/queue-6.1/media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch new file mode 100644 index 0000000000..28c9b1d629 --- /dev/null +++ b/queue-6.1/media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch @@ -0,0 +1,53 @@ +From 545b215736c5c4b354e182d99c578a472ac9bfce Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Sun, 24 Mar 2024 17:00:44 +0100 +Subject: media: i2c: et8ek8: Don't strip remove function when driver is builtin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 545b215736c5c4b354e182d99c578a472ac9bfce upstream. + +Using __exit for the remove function results in the remove callback +being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets +unbound (e.g. using sysfs or hotplug), the driver is just removed +without the cleanup being performed. This results in resource leaks. Fix +it by compiling in the remove callback unconditionally. + +This also fixes a W=1 modpost warning: + + WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) + +Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Bin Lan +Signed-off-by: He Zhe +--- + drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/et8ek8/et8ek8_driver.c ++++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c +@@ -1460,7 +1460,7 @@ err_mutex: + return ret; + } + +-static void __exit et8ek8_remove(struct i2c_client *client) ++static void et8ek8_remove(struct i2c_client *client) + { + struct v4l2_subdev *subdev = i2c_get_clientdata(client); + struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); +@@ -1502,7 +1502,7 @@ static struct i2c_driver et8ek8_i2c_driv + .of_match_table = et8ek8_of_table, + }, + .probe_new = et8ek8_probe, +- .remove = __exit_p(et8ek8_remove), ++ .remove = et8ek8_remove, + .id_table = et8ek8_id_table, + }; + diff --git a/queue-6.1/series b/queue-6.1/series index d096e1bcf9..05cdfd51d1 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -16,3 +16,7 @@ net-usb-qmi_wwan-add-telit-cinterion-fe990b-composition.patch net-usb-usbnet-restore-usb-d-name-exception-for-local-mac-addresses.patch memstick-rtsx_usb_ms-fix-slab-use-after-free-in-rtsx_usb_ms_drv_remove.patch serial-8250_dma-terminate-correct-dma-in-tx_dma_flush.patch +usb-gadget-uvc-fix-err_ptr-dereference-in-uvc_v4l2.c.patch +usb-typec-ucsi-fix-null-pointer-access.patch +media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch +arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch diff --git a/queue-6.1/usb-gadget-uvc-fix-err_ptr-dereference-in-uvc_v4l2.c.patch b/queue-6.1/usb-gadget-uvc-fix-err_ptr-dereference-in-uvc_v4l2.c.patch new file mode 100644 index 0000000000..03b62cd1c9 --- /dev/null +++ b/queue-6.1/usb-gadget-uvc-fix-err_ptr-dereference-in-uvc_v4l2.c.patch @@ -0,0 +1,74 @@ +From a7bb96b18864225a694e3887ac2733159489e4b0 Mon Sep 17 00:00:00 2001 +From: Abhishek Tamboli +Date: Thu, 15 Aug 2024 15:52:02 +0530 +Subject: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c + +From: Abhishek Tamboli + +commit a7bb96b18864225a694e3887ac2733159489e4b0 upstream. + +Fix potential dereferencing of ERR_PTR() in find_format_by_pix() +and uvc_v4l2_enum_format(). + +Fix the following smatch errors: + +drivers/usb/gadget/function/uvc_v4l2.c:124 find_format_by_pix() +error: 'fmtdesc' dereferencing possible ERR_PTR() + +drivers/usb/gadget/function/uvc_v4l2.c:392 uvc_v4l2_enum_format() +error: 'fmtdesc' dereferencing possible ERR_PTR() + +Also, fix similar issue in uvc_v4l2_try_format() for potential +dereferencing of ERR_PTR(). + +Signed-off-by: Abhishek Tamboli +Link: https://lore.kernel.org/r/20240815102202.594812-1-abhishektamboli9@gmail.com +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/uvc_v4l2.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/uvc_v4l2.c ++++ b/drivers/usb/gadget/function/uvc_v4l2.c +@@ -121,6 +121,9 @@ static struct uvcg_format *find_format_b + list_for_each_entry(format, &uvc->header->formats, entry) { + struct uvc_format_desc *fmtdesc = to_uvc_format(format->fmt); + ++ if (IS_ERR(fmtdesc)) ++ continue; ++ + if (fmtdesc->fcc == pixelformat) { + uformat = format->fmt; + break; +@@ -240,6 +243,7 @@ uvc_v4l2_try_format(struct file *file, v + struct uvc_video *video = &uvc->video; + struct uvcg_format *uformat; + struct uvcg_frame *uframe; ++ const struct uvc_format_desc *fmtdesc; + u8 *fcc; + + if (fmt->type != video->queue.queue.type) +@@ -265,7 +269,10 @@ uvc_v4l2_try_format(struct file *file, v + fmt->fmt.pix.field = V4L2_FIELD_NONE; + fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(uformat, uframe); + fmt->fmt.pix.sizeimage = uvc_get_frame_size(uformat, uframe); +- fmt->fmt.pix.pixelformat = to_uvc_format(uformat)->fcc; ++ fmtdesc = to_uvc_format(uformat); ++ if (IS_ERR(fmtdesc)) ++ return PTR_ERR(fmtdesc); ++ fmt->fmt.pix.pixelformat = fmtdesc->fcc; + fmt->fmt.pix.colorspace = V4L2_COLORSPACE_SRGB; + fmt->fmt.pix.priv = 0; + +@@ -378,6 +385,9 @@ uvc_v4l2_enum_format(struct file *file, + f->flags |= V4L2_FMT_FLAG_COMPRESSED; + + fmtdesc = to_uvc_format(uformat); ++ if (IS_ERR(fmtdesc)) ++ return PTR_ERR(fmtdesc); ++ + f->pixelformat = fmtdesc->fcc; + + strscpy(f->description, fmtdesc->name, sizeof(f->description)); diff --git a/queue-6.1/usb-typec-ucsi-fix-null-pointer-access.patch b/queue-6.1/usb-typec-ucsi-fix-null-pointer-access.patch new file mode 100644 index 0000000000..138862cadd --- /dev/null +++ b/queue-6.1/usb-typec-ucsi-fix-null-pointer-access.patch @@ -0,0 +1,63 @@ +From b13abcb7ddd8d38de769486db5bd917537b32ab1 Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski +Date: Wed, 5 Mar 2025 11:17:39 +0000 +Subject: usb: typec: ucsi: Fix NULL pointer access + +From: Andrei Kuchynski + +commit b13abcb7ddd8d38de769486db5bd917537b32ab1 upstream. + +Resources should be released only after all threads that utilize them +have been destroyed. +This commit ensures that resources are not released prematurely by waiting +for the associated workqueue to complete before deallocating them. + +Cc: stable +Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking") +Signed-off-by: Andrei Kuchynski +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250305111739.1489003-2-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1313,11 +1313,11 @@ static int ucsi_init(struct ucsi *ucsi) + + err_unregister: + for (con = connector; con->port; con++) { ++ if (con->wq) ++ destroy_workqueue(con->wq); + ucsi_unregister_partner(con); + ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); + ucsi_unregister_port_psy(con); +- if (con->wq) +- destroy_workqueue(con->wq); + typec_unregister_port(con->port); + con->port = NULL; + } +@@ -1479,10 +1479,6 @@ void ucsi_unregister(struct ucsi *ucsi) + + for (i = 0; i < ucsi->cap.num_connectors; i++) { + cancel_work_sync(&ucsi->connector[i].work); +- ucsi_unregister_partner(&ucsi->connector[i]); +- ucsi_unregister_altmodes(&ucsi->connector[i], +- UCSI_RECIPIENT_CON); +- ucsi_unregister_port_psy(&ucsi->connector[i]); + + if (ucsi->connector[i].wq) { + struct ucsi_work *uwork; +@@ -1497,6 +1493,11 @@ void ucsi_unregister(struct ucsi *ucsi) + mutex_unlock(&ucsi->connector[i].lock); + destroy_workqueue(ucsi->connector[i].wq); + } ++ ++ ucsi_unregister_partner(&ucsi->connector[i]); ++ ucsi_unregister_altmodes(&ucsi->connector[i], ++ UCSI_RECIPIENT_CON); ++ ucsi_unregister_port_psy(&ucsi->connector[i]); + typec_unregister_port(ucsi->connector[i].port); + } +