--- /dev/null
+From 950953f774b3f69da6f413e045ef075e1f3da2df Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:44 +0200
+Subject: drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 950953f774b3f69da6f413e045ef075e1f3da2df upstream.
+
+Make sure to drop the reference taken to the I2C adapter (and its
+module) when setting up HDMI to allow the adapter to be deregistered.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Cc: stable@vger.kernel.org # 3.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c
++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c
+@@ -579,6 +579,7 @@ static int oaktrail_hdmi_get_modes(struc
+ } else {
+ edid = (struct edid *)raw_edid;
+ /* FIXME ? edid = drm_get_edid(connector, i2c_adap); */
++ i2c_put_adapter(i2c_adap);
+ }
+
+ if (edid) {
--- /dev/null
+From 657a091ab6d01d0091b77660c75cfed573c9a53e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:45 +0200
+Subject: drm/gma500/oaktrail_lvds: fix hang on init failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 657a091ab6d01d0091b77660c75cfed573c9a53e upstream.
+
+The LVDS init code looks up an I2C adapter using i2c_get_adapter() and
+tries to read the EDID before falling back to allocating and registering
+its own adapter.
+
+The error handling does not separate these cases so on a late init
+failure it will try to deregister and free also an adapter that had
+previously been registered. Since i2c_get_adapter() takes another
+reference to the adapter, deregistration hangs indefinitely while
+waiting for the reference to be released.
+
+Fix this by only destroying adapters allocated during LVDS init on
+errors.
+
+Fixes: a57ebfc0b4da ("drm/gma500: Make oaktrail lvds use ddc adapter from drm_connector")
+Cc: stable@vger.kernel.org # 6.0
+Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_lvds.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+@@ -292,7 +292,7 @@ void oaktrail_lvds_init(struct drm_devic
+ {
+ struct gma_encoder *gma_encoder;
+ struct gma_connector *gma_connector;
+- struct gma_i2c_chan *ddc_bus;
++ struct gma_i2c_chan *ddc_bus = NULL;
+ struct drm_connector *connector;
+ struct drm_encoder *encoder;
+ struct drm_psb_private *dev_priv = to_drm_psb_private(dev);
+@@ -420,7 +420,8 @@ out:
+
+ err_unlock:
+ mutex_unlock(&dev->mode_config.mutex);
+- gma_i2c_destroy(to_gma_i2c_chan(connector->ddc));
++ if (!IS_ERR_OR_NULL(ddc_bus))
++ gma_i2c_destroy(ddc_bus);
+ drm_encoder_cleanup(encoder);
+ err_connector_cleanup:
+ drm_connector_cleanup(connector);
--- /dev/null
+From 84d1c9b416d54afe760ca4c378bd95c89261254c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:46 +0200
+Subject: drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 84d1c9b416d54afe760ca4c378bd95c89261254c upstream.
+
+The LVDS init code looks up an I2C adapter using i2c_get_adapter() and
+tries to read the EDID before falling back to allocating and registering
+its own adapter.
+
+Make sure to drop the references taken by i2c_get_adapter() when falling
+back to allocating an adapter as well as on late errors to allow the
+looked up adapter to be deregistered.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Cc: stable@vger.kernel.org # 3.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_lvds.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+@@ -366,6 +366,8 @@ void oaktrail_lvds_init(struct drm_devic
+ if (edid == NULL && dev_priv->lpc_gpio_base) {
+ ddc_bus = oaktrail_lvds_i2c_init(dev);
+ if (!IS_ERR(ddc_bus)) {
++ if (i2c_adap)
++ i2c_put_adapter(i2c_adap);
+ i2c_adap = &ddc_bus->base;
+ edid = drm_get_edid(connector, i2c_adap);
+ }
+@@ -422,6 +424,8 @@ err_unlock:
+ mutex_unlock(&dev->mode_config.mutex);
+ if (!IS_ERR_OR_NULL(ddc_bus))
+ gma_i2c_destroy(ddc_bus);
++ else if (i2c_adap)
++ i2c_put_adapter(i2c_adap);
+ drm_encoder_cleanup(encoder);
+ err_connector_cleanup:
+ drm_connector_cleanup(connector);
drm-i915-skip-__i915_request_skip-for-already-signaled-requests.patch
drm-panfrost-fix-wait_bo-ioctl-leaking-positive-return-from-dma_resv_wait_timeout.patch
drm-xe-dma-buf-handle-empty-bo-and-uaf-races.patch
+drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch
+drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch
+drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
