From: Greg Kroah-Hartman Date: Wed, 20 May 2026 16:00:40 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.6.141~41 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=5a05d2ee3d76e376078f487a1abfcaf7434b5973;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch --- diff --git a/queue-6.1/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch b/queue-6.1/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch new file mode 100644 index 0000000000..67ce58fd99 --- /dev/null +++ b/queue-6.1/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch @@ -0,0 +1,32 @@ +From 950953f774b3f69da6f413e045ef075e1f3da2df Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:44 +0200 +Subject: drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup + +From: Johan Hovold + +commit 950953f774b3f69da6f413e045ef075e1f3da2df upstream. + +Make sure to drop the reference taken to the I2C adapter (and its +module) when setting up HDMI to allow the adapter to be deregistered. + +Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") +Cc: stable@vger.kernel.org # 3.3 +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c ++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c +@@ -577,6 +577,7 @@ static int oaktrail_hdmi_get_modes(struc + } else { + edid = (struct edid *)raw_edid; + /* FIXME ? edid = drm_get_edid(connector, i2c_adap); */ ++ i2c_put_adapter(i2c_adap); + } + + if (edid) { diff --git a/queue-6.1/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch b/queue-6.1/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch new file mode 100644 index 0000000000..e499c424d1 --- /dev/null +++ b/queue-6.1/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch @@ -0,0 +1,54 @@ +From 657a091ab6d01d0091b77660c75cfed573c9a53e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:45 +0200 +Subject: drm/gma500/oaktrail_lvds: fix hang on init failure + +From: Johan Hovold + +commit 657a091ab6d01d0091b77660c75cfed573c9a53e upstream. + +The LVDS init code looks up an I2C adapter using i2c_get_adapter() and +tries to read the EDID before falling back to allocating and registering +its own adapter. + +The error handling does not separate these cases so on a late init +failure it will try to deregister and free also an adapter that had +previously been registered. Since i2c_get_adapter() takes another +reference to the adapter, deregistration hangs indefinitely while +waiting for the reference to be released. + +Fix this by only destroying adapters allocated during LVDS init on +errors. + +Fixes: a57ebfc0b4da ("drm/gma500: Make oaktrail lvds use ddc adapter from drm_connector") +Cc: stable@vger.kernel.org # 6.0 +Cc: Patrik Jakobsson +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_lvds.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c ++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c +@@ -293,7 +293,7 @@ void oaktrail_lvds_init(struct drm_devic + { + struct gma_encoder *gma_encoder; + struct gma_connector *gma_connector; +- struct gma_i2c_chan *ddc_bus; ++ struct gma_i2c_chan *ddc_bus = NULL; + struct drm_connector *connector; + struct drm_encoder *encoder; + struct drm_psb_private *dev_priv = to_drm_psb_private(dev); +@@ -421,7 +421,8 @@ out: + + err_unlock: + mutex_unlock(&dev->mode_config.mutex); +- gma_i2c_destroy(to_gma_i2c_chan(connector->ddc)); ++ if (!IS_ERR_OR_NULL(ddc_bus)) ++ gma_i2c_destroy(ddc_bus); + drm_encoder_cleanup(encoder); + err_connector_cleanup: + drm_connector_cleanup(connector); diff --git a/queue-6.1/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch b/queue-6.1/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch new file mode 100644 index 0000000000..de3d8f65dd --- /dev/null +++ b/queue-6.1/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch @@ -0,0 +1,47 @@ +From 84d1c9b416d54afe760ca4c378bd95c89261254c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:46 +0200 +Subject: drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init + +From: Johan Hovold + +commit 84d1c9b416d54afe760ca4c378bd95c89261254c upstream. + +The LVDS init code looks up an I2C adapter using i2c_get_adapter() and +tries to read the EDID before falling back to allocating and registering +its own adapter. + +Make sure to drop the references taken by i2c_get_adapter() when falling +back to allocating an adapter as well as on late errors to allow the +looked up adapter to be deregistered. + +Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") +Cc: stable@vger.kernel.org # 3.3 +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_lvds.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c ++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c +@@ -367,6 +367,8 @@ void oaktrail_lvds_init(struct drm_devic + if (edid == NULL && dev_priv->lpc_gpio_base) { + ddc_bus = oaktrail_lvds_i2c_init(dev); + if (!IS_ERR(ddc_bus)) { ++ if (i2c_adap) ++ i2c_put_adapter(i2c_adap); + i2c_adap = &ddc_bus->base; + edid = drm_get_edid(connector, i2c_adap); + } +@@ -423,6 +425,8 @@ err_unlock: + mutex_unlock(&dev->mode_config.mutex); + if (!IS_ERR_OR_NULL(ddc_bus)) + gma_i2c_destroy(ddc_bus); ++ else if (i2c_adap) ++ i2c_put_adapter(i2c_adap); + drm_encoder_cleanup(encoder); + err_connector_cleanup: + drm_connector_cleanup(connector); diff --git a/queue-6.1/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch b/queue-6.1/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch new file mode 100644 index 0000000000..62e8097f13 --- /dev/null +++ b/queue-6.1/io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch @@ -0,0 +1,49 @@ +From 70d4606c915f3a75277adda255cc7a2c7b0ab205 Mon Sep 17 00:00:00 2001 +From: Nicholas Carlini +Date: Mon, 11 May 2026 18:02:16 +0000 +Subject: io-wq: check that the predecessor is hashed in io_wq_remove_pending() + +From: Nicholas Carlini + +io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled +work was the tail of its hash bucket. When doing this, it checks whether +the preceding entry in acct->work_list has the same hash value, but +never checks that the predecessor is hashed at all. io_get_work_hash() +is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash +bits are never set for non-hashed work, so it returns 0. Thus, when a +hashed bucket-0 work is cancelled while a non-hashed work is its list +predecessor, the check spuriously passes and a pointer to the non-hashed +io_kiocb is stored in wq->hash_tail[0]. + +Because non-hashed work is dequeued via the fast path in +io_get_next_work(), which never touches hash_tail[], the stale pointer +is never cleared. Therefore, after the non-hashed io_kiocb completes and +is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The +io_wq is per-task (tctx->io_wq) and survives ring open/close, so the +dangling pointer persists for the lifetime of the task; the next hashed +bucket-0 enqueue dereferences it in io_wq_insert_work() and +wq_list_add_after() writes through freed memory. + +Add the missing io_wq_is_hashed() check so a non-hashed predecessor +never inherits a hash_tail[] slot. + +Cc: stable@vger.kernel.org # 5.7+ +Fixes: 204361a77f40 ("io-wq: fix hang after cancelling pending hashed work") +Signed-off-by: Nicholas Carlini +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io-wq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/io_uring/io-wq.c ++++ b/io_uring/io-wq.c +@@ -1034,7 +1034,8 @@ static inline void io_wqe_remove_pending + if (io_wq_is_hashed(work) && work == wqe->hash_tail[hash]) { + if (prev) + prev_work = container_of(prev, struct io_wq_work, list); +- if (prev_work && io_get_work_hash(prev_work) == hash) ++ if (prev_work && io_wq_is_hashed(prev_work) && ++ io_get_work_hash(prev_work) == hash) + wqe->hash_tail[hash] = prev_work; + else + wqe->hash_tail[hash] = NULL; diff --git a/queue-6.1/series b/queue-6.1/series index efea20eab8..24705c3373 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -828,3 +828,7 @@ libceph-handle-rbtree-insertion-error-in-decode_choose_args.patch iommu-vt-d-disable-dmar-for-intel-q35-igfx.patch drm-i915-skip-__i915_request_skip-for-already-signaled-requests.patch drm-panfrost-fix-wait_bo-ioctl-leaking-positive-return-from-dma_resv_wait_timeout.patch +drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch +drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch +drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch +io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch