--- /dev/null
+From 950953f774b3f69da6f413e045ef075e1f3da2df Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:44 +0200
+Subject: drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 950953f774b3f69da6f413e045ef075e1f3da2df upstream.
+
+Make sure to drop the reference taken to the I2C adapter (and its
+module) when setting up HDMI to allow the adapter to be deregistered.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Cc: stable@vger.kernel.org # 3.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c
++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c
+@@ -577,6 +577,7 @@ static int oaktrail_hdmi_get_modes(struc
+ } else {
+ edid = (struct edid *)raw_edid;
+ /* FIXME ? edid = drm_get_edid(connector, i2c_adap); */
++ i2c_put_adapter(i2c_adap);
+ }
+
+ if (edid) {
--- /dev/null
+From 657a091ab6d01d0091b77660c75cfed573c9a53e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:45 +0200
+Subject: drm/gma500/oaktrail_lvds: fix hang on init failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 657a091ab6d01d0091b77660c75cfed573c9a53e upstream.
+
+The LVDS init code looks up an I2C adapter using i2c_get_adapter() and
+tries to read the EDID before falling back to allocating and registering
+its own adapter.
+
+The error handling does not separate these cases so on a late init
+failure it will try to deregister and free also an adapter that had
+previously been registered. Since i2c_get_adapter() takes another
+reference to the adapter, deregistration hangs indefinitely while
+waiting for the reference to be released.
+
+Fix this by only destroying adapters allocated during LVDS init on
+errors.
+
+Fixes: a57ebfc0b4da ("drm/gma500: Make oaktrail lvds use ddc adapter from drm_connector")
+Cc: stable@vger.kernel.org # 6.0
+Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_lvds.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+@@ -293,7 +293,7 @@ void oaktrail_lvds_init(struct drm_devic
+ {
+ struct gma_encoder *gma_encoder;
+ struct gma_connector *gma_connector;
+- struct gma_i2c_chan *ddc_bus;
++ struct gma_i2c_chan *ddc_bus = NULL;
+ struct drm_connector *connector;
+ struct drm_encoder *encoder;
+ struct drm_psb_private *dev_priv = to_drm_psb_private(dev);
+@@ -421,7 +421,8 @@ out:
+
+ err_unlock:
+ mutex_unlock(&dev->mode_config.mutex);
+- gma_i2c_destroy(to_gma_i2c_chan(connector->ddc));
++ if (!IS_ERR_OR_NULL(ddc_bus))
++ gma_i2c_destroy(ddc_bus);
+ drm_encoder_cleanup(encoder);
+ err_connector_cleanup:
+ drm_connector_cleanup(connector);
--- /dev/null
+From 84d1c9b416d54afe760ca4c378bd95c89261254c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:46 +0200
+Subject: drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 84d1c9b416d54afe760ca4c378bd95c89261254c upstream.
+
+The LVDS init code looks up an I2C adapter using i2c_get_adapter() and
+tries to read the EDID before falling back to allocating and registering
+its own adapter.
+
+Make sure to drop the references taken by i2c_get_adapter() when falling
+back to allocating an adapter as well as on late errors to allow the
+looked up adapter to be deregistered.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Cc: stable@vger.kernel.org # 3.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_lvds.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+@@ -367,6 +367,8 @@ void oaktrail_lvds_init(struct drm_devic
+ if (edid == NULL && dev_priv->lpc_gpio_base) {
+ ddc_bus = oaktrail_lvds_i2c_init(dev);
+ if (!IS_ERR(ddc_bus)) {
++ if (i2c_adap)
++ i2c_put_adapter(i2c_adap);
+ i2c_adap = &ddc_bus->base;
+ edid = drm_get_edid(connector, i2c_adap);
+ }
+@@ -423,6 +425,8 @@ err_unlock:
+ mutex_unlock(&dev->mode_config.mutex);
+ if (!IS_ERR_OR_NULL(ddc_bus))
+ gma_i2c_destroy(ddc_bus);
++ else if (i2c_adap)
++ i2c_put_adapter(i2c_adap);
+ drm_encoder_cleanup(encoder);
+ err_connector_cleanup:
+ drm_connector_cleanup(connector);
--- /dev/null
+From 70d4606c915f3a75277adda255cc7a2c7b0ab205 Mon Sep 17 00:00:00 2001
+From: Nicholas Carlini <nicholas@carlini.com>
+Date: Mon, 11 May 2026 18:02:16 +0000
+Subject: io-wq: check that the predecessor is hashed in io_wq_remove_pending()
+
+From: Nicholas Carlini <nicholas@carlini.com>
+
+io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled
+work was the tail of its hash bucket. When doing this, it checks whether
+the preceding entry in acct->work_list has the same hash value, but
+never checks that the predecessor is hashed at all. io_get_work_hash()
+is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash
+bits are never set for non-hashed work, so it returns 0. Thus, when a
+hashed bucket-0 work is cancelled while a non-hashed work is its list
+predecessor, the check spuriously passes and a pointer to the non-hashed
+io_kiocb is stored in wq->hash_tail[0].
+
+Because non-hashed work is dequeued via the fast path in
+io_get_next_work(), which never touches hash_tail[], the stale pointer
+is never cleared. Therefore, after the non-hashed io_kiocb completes and
+is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The
+io_wq is per-task (tctx->io_wq) and survives ring open/close, so the
+dangling pointer persists for the lifetime of the task; the next hashed
+bucket-0 enqueue dereferences it in io_wq_insert_work() and
+wq_list_add_after() writes through freed memory.
+
+Add the missing io_wq_is_hashed() check so a non-hashed predecessor
+never inherits a hash_tail[] slot.
+
+Cc: stable@vger.kernel.org # 5.7+
+Fixes: 204361a77f40 ("io-wq: fix hang after cancelling pending hashed work")
+Signed-off-by: Nicholas Carlini <nicholas@carlini.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io-wq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/io_uring/io-wq.c
++++ b/io_uring/io-wq.c
+@@ -1034,7 +1034,8 @@ static inline void io_wqe_remove_pending
+ if (io_wq_is_hashed(work) && work == wqe->hash_tail[hash]) {
+ if (prev)
+ prev_work = container_of(prev, struct io_wq_work, list);
+- if (prev_work && io_get_work_hash(prev_work) == hash)
++ if (prev_work && io_wq_is_hashed(prev_work) &&
++ io_get_work_hash(prev_work) == hash)
+ wqe->hash_tail[hash] = prev_work;
+ else
+ wqe->hash_tail[hash] = NULL;
iommu-vt-d-disable-dmar-for-intel-q35-igfx.patch
drm-i915-skip-__i915_request_skip-for-already-signaled-requests.patch
drm-panfrost-fix-wait_bo-ioctl-leaking-positive-return-from-dma_resv_wait_timeout.patch
+drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch
+drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch
+drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch
+io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
