From: Greg Kroah-Hartman Date: Wed, 20 May 2026 16:01:10 +0000 (+0200) Subject: 7.0-stable patches X-Git-Tag: v6.6.141~37 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=fde62de05d4a5e1b0ff6402c7a1a0cb086d98284;p=thirdparty%2Fkernel%2Fstable-queue.git 7.0-stable patches added patches: arm_mpam-check-whether-the-config-array-is-allocated-before-destroying-it.patch arm_mpam-fix-false-positive-assert-failure-during-mpam_disable.patch arm_mpam-fix-monitor-instance-selection-when-checking-for-hardware-nrdy.patch arm_mpam-improve-check-for-whether-or-not-nrdy-is-hardware-managed.patch arm_mpam-pretend-that-nrdy-is-always-hardware-managed.patch drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch --- diff --git a/queue-7.0/arm_mpam-check-whether-the-config-array-is-allocated-before-destroying-it.patch b/queue-7.0/arm_mpam-check-whether-the-config-array-is-allocated-before-destroying-it.patch new file mode 100644 index 0000000000..1cbc46d527 --- /dev/null +++ b/queue-7.0/arm_mpam-check-whether-the-config-array-is-allocated-before-destroying-it.patch @@ -0,0 +1,46 @@ +From 6ccbb613b42a1f1ba7bfd547a148f644a902a25c Mon Sep 17 00:00:00 2001 +From: James Morse +Date: Fri, 8 May 2026 17:23:39 +0100 +Subject: arm_mpam: Check whether the config array is allocated before destroying it + +From: James Morse + +commit 6ccbb613b42a1f1ba7bfd547a148f644a902a25c upstream. + +__destroy_component_cfg() is called to free the configuration array. +It uses the embedded 'garbage' structure, which means the array has +to be allocated. + +If __destroy_component_cfg() is called from mpam_disable() before the +configuration was ever allocated, then a NULL pointer is dereferenced. + +Check for this case and return early if the configuration is not +allocated. + +__destroy_component_cfg() also frees the mbwu_state as this is allocated +by __allocate_component_cfg(). As the mbwu_state is allocated after +comp->cfg is set, and is also under mpam_list_lock, only the first +pointer needs checking. + +Fixes: 3bd04fe7d807 ("arm_mpam: Extend reset logic to allow devices to be reset any time") +Cc: +Signed-off-by: James Morse +Reviewed-by: Ben Horgan +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/resctrl/mpam_devices.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/resctrl/mpam_devices.c ++++ b/drivers/resctrl/mpam_devices.c +@@ -2359,6 +2359,9 @@ static void __destroy_component_cfg(stru + + lockdep_assert_held(&mpam_list_lock); + ++ if (!comp->cfg) ++ return; ++ + add_to_garbage(comp->cfg); + list_for_each_entry(vmsc, &comp->vmsc, comp_list) { + msc = vmsc->msc; diff --git a/queue-7.0/arm_mpam-fix-false-positive-assert-failure-during-mpam_disable.patch b/queue-7.0/arm_mpam-fix-false-positive-assert-failure-during-mpam_disable.patch new file mode 100644 index 0000000000..f495eeee51 --- /dev/null +++ b/queue-7.0/arm_mpam-fix-false-positive-assert-failure-during-mpam_disable.patch @@ -0,0 +1,53 @@ +From f1caff3335ea6eab88cdc84ec8f2e3c45ca05486 Mon Sep 17 00:00:00 2001 +From: James Morse +Date: Fri, 8 May 2026 17:23:38 +0100 +Subject: arm_mpam: Fix false positive assert failure during mpam_disable() + +From: James Morse + +commit f1caff3335ea6eab88cdc84ec8f2e3c45ca05486 upstream. + +mpam_assert_partid_sizes_fixed() is used to document that the caller +doesn't expect the discovered PARTID size to change while it is walking +a list sized by PARTID. Typically the MSC state is not written to until +all the MSC have been discovered and this value is set. + +However, if discovering the MSC fails and schedules mpam_disable(), +then the MSC state is written to reset it. In this case the +discovered PARTID size may be become smaller - but only PARTID 0 +will be used once resctrl_exit() has been called. + +Skip the WARN_ON_ONCE() if mpam_disable_reason has been set. + +Fixes: 3bd04fe7d807 ("arm_mpam: Extend reset logic to allow devices to be reset any time") +Cc: +Signed-off-by: James Morse +Reviewed-by: Ben Horgan +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/resctrl/mpam_devices.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/resctrl/mpam_devices.c ++++ b/drivers/resctrl/mpam_devices.c +@@ -148,11 +148,17 @@ static void mpam_free_garbage(void) + /* + * Once mpam is enabled, new requestors cannot further reduce the available + * partid. Assert that the size is fixed, and new requestors will be turned +- * away. ++ * away. This is needed when walking over structures sized by PARTID. ++ * ++ * During mpam_disable() these structures are not fixed, but the MSC state ++ * is still reset using whatever sizes have been discovered so far. As only ++ * PARTID 0 will be used after mpam_disable(), any race would be benign. ++ * Skip the check if a mpam_disable_reason has been set. + */ + static void mpam_assert_partid_sizes_fixed(void) + { +- WARN_ON_ONCE(!partid_max_published); ++ if (!mpam_disable_reason) ++ WARN_ON_ONCE(!partid_max_published); + } + + static u32 __mpam_read_reg(struct mpam_msc *msc, u16 reg) diff --git a/queue-7.0/arm_mpam-fix-monitor-instance-selection-when-checking-for-hardware-nrdy.patch b/queue-7.0/arm_mpam-fix-monitor-instance-selection-when-checking-for-hardware-nrdy.patch new file mode 100644 index 0000000000..09e2c5fce0 --- /dev/null +++ b/queue-7.0/arm_mpam-fix-monitor-instance-selection-when-checking-for-hardware-nrdy.patch @@ -0,0 +1,46 @@ +From 1ef2a89584b7b788b2603590d886db076b2f24cc Mon Sep 17 00:00:00 2001 +From: Ben Horgan +Date: Thu, 7 May 2026 16:28:12 +0100 +Subject: arm_mpam: Fix monitor instance selection when checking for hardware NRDY + +From: Ben Horgan + +commit 1ef2a89584b7b788b2603590d886db076b2f24cc upstream. + +In _mpam_ris_hw_probe_hw_nrdy() a new register value to select the first +monitor and relevant RIS is prepared in mon_sel. However, it is written to +the monitor value register, e.g. MSMON_CSU, rather than MSMON_CFG_MON_SEL. + +As MSMON_CFG_MON_SEL is a 32 bit register update the type of mon_sel to +u32. Write mon_sel to the intended register, MSMON_CFG_MON_SEL. + +Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports") +Cc: +Signed-off-by: Ben Horgan +Reviewed-by: James Morse +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/resctrl/mpam_devices.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/resctrl/mpam_devices.c ++++ b/drivers/resctrl/mpam_devices.c +@@ -635,7 +635,7 @@ static struct mpam_msc_ris *mpam_get_or_ + static bool _mpam_ris_hw_probe_hw_nrdy(struct mpam_msc_ris *ris, u32 mon_reg) + { + u32 now; +- u64 mon_sel; ++ u32 mon_sel; + bool can_set, can_clear; + struct mpam_msc *msc = ris->vmsc->msc; + +@@ -644,7 +644,7 @@ static bool _mpam_ris_hw_probe_hw_nrdy(s + + mon_sel = FIELD_PREP(MSMON_CFG_MON_SEL_MON_SEL, 0) | + FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx); +- _mpam_write_monsel_reg(msc, mon_reg, mon_sel); ++ mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel); + + _mpam_write_monsel_reg(msc, mon_reg, MSMON___NRDY); + now = _mpam_read_monsel_reg(msc, mon_reg); diff --git a/queue-7.0/arm_mpam-improve-check-for-whether-or-not-nrdy-is-hardware-managed.patch b/queue-7.0/arm_mpam-improve-check-for-whether-or-not-nrdy-is-hardware-managed.patch new file mode 100644 index 0000000000..5d7904e9c0 --- /dev/null +++ b/queue-7.0/arm_mpam-improve-check-for-whether-or-not-nrdy-is-hardware-managed.patch @@ -0,0 +1,63 @@ +From ccad6001be5c38426ccf45790c411467ad3c03c6 Mon Sep 17 00:00:00 2001 +From: Ben Horgan +Date: Thu, 7 May 2026 16:28:14 +0100 +Subject: arm_mpam: Improve check for whether or not NRDY is hardware managed + +From: Ben Horgan + +commit ccad6001be5c38426ccf45790c411467ad3c03c6 upstream. + +mpam_ris_hw_probe_csu_nrdy() sets and clears MSMON_CSU.NRDY and checks +whether it's configuration sticks. However, hardware isn't given a chance +to disagree. Based on rule LRTGP, in MPAM specification IHI0099 version +B.b, the hardware will set NRDY if it needs time to establish a count after +a configuration change. + +Enable the monitor so that NRDY becomes relevant and change the +configuration after clearing NRDY to try and coax the hardware into setting +it. + +Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports") +Cc: +Signed-off-by: Ben Horgan +Reviewed-by: James Morse +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/resctrl/mpam_devices.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/resctrl/mpam_devices.c ++++ b/drivers/resctrl/mpam_devices.c +@@ -634,8 +634,7 @@ static struct mpam_msc_ris *mpam_get_or_ + */ + static bool mpam_ris_hw_probe_csu_nrdy(struct mpam_msc_ris *ris) + { +- u32 now; +- u32 mon_sel; ++ u32 now, mon_sel, ctl_val; + bool can_set, can_clear; + struct mpam_msc *msc = ris->vmsc->msc; + +@@ -646,11 +645,21 @@ static bool mpam_ris_hw_probe_csu_nrdy(s + FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx); + mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel); + ++ /* Hardware might ignore nrdy if it's not enabled */ ++ ctl_val = MSMON_CFG_CSU_CTL_TYPE_CSU; ++ ctl_val |= MSMON_CFG_x_CTL_MATCH_PARTID; ++ ctl_val |= MSMON_CFG_x_CTL_MATCH_PMG; ++ ctl_val |= MSMON_CFG_x_CTL_EN; ++ mpam_write_monsel_reg(msc, CFG_CSU_FLT, 0); ++ mpam_write_monsel_reg(msc, CFG_CSU_CTL, ctl_val); ++ + _mpam_write_monsel_reg(msc, MSMON_CSU, MSMON___NRDY); + now = _mpam_read_monsel_reg(msc, MSMON_CSU); + can_set = now & MSMON___NRDY; + + _mpam_write_monsel_reg(msc, MSMON_CSU, 0); ++ /* Configuration change to try and coax hardware into setting nrdy */ ++ mpam_write_monsel_reg(msc, CFG_CSU_FLT, 0x1); + now = _mpam_read_monsel_reg(msc, MSMON_CSU); + can_clear = !(now & MSMON___NRDY); + mpam_mon_sel_unlock(msc); diff --git a/queue-7.0/arm_mpam-pretend-that-nrdy-is-always-hardware-managed.patch b/queue-7.0/arm_mpam-pretend-that-nrdy-is-always-hardware-managed.patch new file mode 100644 index 0000000000..b19e22661f --- /dev/null +++ b/queue-7.0/arm_mpam-pretend-that-nrdy-is-always-hardware-managed.patch @@ -0,0 +1,176 @@ +From 4387970bbd84fd14e0c49c3089c5061ccd86b98a Mon Sep 17 00:00:00 2001 +From: Ben Horgan +Date: Thu, 7 May 2026 16:28:13 +0100 +Subject: arm_mpam: Pretend that NRDY is always hardware managed + +From: Ben Horgan + +commit 4387970bbd84fd14e0c49c3089c5061ccd86b98a upstream. + +Rule ZTXDS of the MPAM specification, IHI009 version B.b, states: "If a +monitor does not support automatic updates of NRDY, software can use that +bit for any purpose." + +As software is not reliably informed whether or not the monitor supports +automatic updates of NRDY always assume that hardware may manage NRDY but +don't rely on it. When NRDY is truly untouched by hardware then, as it is +written to 0 on configuration, it will always read 0. + +At probe it's checked if MSMON_CSU.NRDY and MSMON_MBWU.NRDY are hardware +managed but not MSMON_MBWU_L.NDRY. Specialize the checking for hardware +managed NRDY to CSU counters as this is the only case where hardware +management makes sense. Continue to inform the user if MSMON_CSU.NRDY +appears to be hardware managed but the firmware doesn't provide the +associated time limit for the automatic clearing of NRDY. Remove the NRDY +feature flags as they are now unused. + +Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports") +Cc: +Signed-off-by: Ben Horgan +Reviewed-by: James Morse +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/resctrl/mpam_devices.c | 53 ++++++++++++---------------------------- + drivers/resctrl/mpam_internal.h | 2 - + 2 files changed, 17 insertions(+), 38 deletions(-) + +--- a/drivers/resctrl/mpam_devices.c ++++ b/drivers/resctrl/mpam_devices.c +@@ -632,7 +632,7 @@ static struct mpam_msc_ris *mpam_get_or_ + * Try and see what values stick in this bit. If we can write either value, + * its probably not implemented by hardware. + */ +-static bool _mpam_ris_hw_probe_hw_nrdy(struct mpam_msc_ris *ris, u32 mon_reg) ++static bool mpam_ris_hw_probe_csu_nrdy(struct mpam_msc_ris *ris) + { + u32 now; + u32 mon_sel; +@@ -646,21 +646,18 @@ static bool _mpam_ris_hw_probe_hw_nrdy(s + FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx); + mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel); + +- _mpam_write_monsel_reg(msc, mon_reg, MSMON___NRDY); +- now = _mpam_read_monsel_reg(msc, mon_reg); ++ _mpam_write_monsel_reg(msc, MSMON_CSU, MSMON___NRDY); ++ now = _mpam_read_monsel_reg(msc, MSMON_CSU); + can_set = now & MSMON___NRDY; + +- _mpam_write_monsel_reg(msc, mon_reg, 0); +- now = _mpam_read_monsel_reg(msc, mon_reg); ++ _mpam_write_monsel_reg(msc, MSMON_CSU, 0); ++ now = _mpam_read_monsel_reg(msc, MSMON_CSU); + can_clear = !(now & MSMON___NRDY); + mpam_mon_sel_unlock(msc); + + return (!can_set || !can_clear); + } + +-#define mpam_ris_hw_probe_hw_nrdy(_ris, _mon_reg) \ +- _mpam_ris_hw_probe_hw_nrdy(_ris, MSMON_##_mon_reg) +- + static void mpam_ris_hw_probe(struct mpam_msc_ris *ris) + { + int err; +@@ -770,20 +767,18 @@ static void mpam_ris_hw_probe(struct mpa + mpam_set_feature(mpam_feat_msmon_csu_xcl, props); + + /* Is NRDY hardware managed? */ +- hw_managed = mpam_ris_hw_probe_hw_nrdy(ris, CSU); +- if (hw_managed) +- mpam_set_feature(mpam_feat_msmon_csu_hw_nrdy, props); +- } ++ hw_managed = mpam_ris_hw_probe_csu_nrdy(ris); + +- /* +- * Accept the missing firmware property if NRDY appears +- * un-implemented. +- */ +- if (err && mpam_has_feature(mpam_feat_msmon_csu_hw_nrdy, props)) +- dev_err_once(dev, "Counters are not usable because not-ready timeout was not provided by firmware."); ++ /* ++ * Accept the missing firmware property if NRDY appears ++ * un-implemented. ++ */ ++ if (err && hw_managed) ++ dev_err_once(dev, "Counters are not usable because not-ready timeout was not provided by firmware."); ++ } + } + if (FIELD_GET(MPAMF_MSMON_IDR_MSMON_MBWU, msmon_features)) { +- bool has_long, hw_managed; ++ bool has_long; + u32 mbwumon_idr = mpam_read_partsel_reg(msc, MBWUMON_IDR); + + props->num_mbwu_mon = FIELD_GET(MPAMF_MBWUMON_IDR_NUM_MON, mbwumon_idr); +@@ -802,16 +797,6 @@ static void mpam_ris_hw_probe(struct mpa + } else { + mpam_set_feature(mpam_feat_msmon_mbwu_31counter, props); + } +- +- /* Is NRDY hardware managed? */ +- hw_managed = mpam_ris_hw_probe_hw_nrdy(ris, MBWU); +- if (hw_managed) +- mpam_set_feature(mpam_feat_msmon_mbwu_hw_nrdy, props); +- +- /* +- * Don't warn about any missing firmware property for +- * MBWU NRDY - it doesn't make any sense! +- */ + } + } + } +@@ -1078,7 +1063,6 @@ static void __ris_msmon_read(void *arg) + bool reset_on_next_read = false; + struct mpam_msc_ris *ris = m->ris; + struct msmon_mbwu_state *mbwu_state; +- struct mpam_props *rprops = &ris->props; + struct mpam_msc *msc = m->ris->vmsc->msc; + u32 mon_sel, ctl_val, flt_val, cur_ctl, cur_flt; + +@@ -1134,8 +1118,7 @@ static void __ris_msmon_read(void *arg) + switch (m->type) { + case mpam_feat_msmon_csu: + now = mpam_read_monsel_reg(msc, CSU); +- if (mpam_has_feature(mpam_feat_msmon_csu_hw_nrdy, rprops)) +- nrdy = now & MSMON___NRDY; ++ nrdy = now & MSMON___NRDY; + now = FIELD_GET(MSMON___VALUE, now); + break; + case mpam_feat_msmon_mbwu_31counter: +@@ -1143,8 +1126,7 @@ static void __ris_msmon_read(void *arg) + case mpam_feat_msmon_mbwu_63counter: + if (m->type != mpam_feat_msmon_mbwu_31counter) { + now = mpam_msc_read_mbwu_l(msc); +- if (mpam_has_feature(mpam_feat_msmon_mbwu_hw_nrdy, rprops)) +- nrdy = now & MSMON___L_NRDY; ++ nrdy = now & MSMON___L_NRDY; + + if (m->type == mpam_feat_msmon_mbwu_63counter) + now = FIELD_GET(MSMON___LWD_VALUE, now); +@@ -1152,8 +1134,7 @@ static void __ris_msmon_read(void *arg) + now = FIELD_GET(MSMON___L_VALUE, now); + } else { + now = mpam_read_monsel_reg(msc, MBWU); +- if (mpam_has_feature(mpam_feat_msmon_mbwu_hw_nrdy, rprops)) +- nrdy = now & MSMON___NRDY; ++ nrdy = now & MSMON___NRDY; + now = FIELD_GET(MSMON___VALUE, now); + } + +--- a/drivers/resctrl/mpam_internal.h ++++ b/drivers/resctrl/mpam_internal.h +@@ -167,14 +167,12 @@ enum mpam_device_features { + mpam_feat_msmon_csu, + mpam_feat_msmon_csu_capture, + mpam_feat_msmon_csu_xcl, +- mpam_feat_msmon_csu_hw_nrdy, + mpam_feat_msmon_mbwu, + mpam_feat_msmon_mbwu_31counter, + mpam_feat_msmon_mbwu_44counter, + mpam_feat_msmon_mbwu_63counter, + mpam_feat_msmon_mbwu_capture, + mpam_feat_msmon_mbwu_rwbw, +- mpam_feat_msmon_mbwu_hw_nrdy, + mpam_feat_partid_nrw, + MPAM_FEATURE_LAST + }; diff --git a/queue-7.0/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch b/queue-7.0/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch new file mode 100644 index 0000000000..0b5b85f0e1 --- /dev/null +++ b/queue-7.0/drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch @@ -0,0 +1,32 @@ +From 950953f774b3f69da6f413e045ef075e1f3da2df Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:44 +0200 +Subject: drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup + +From: Johan Hovold + +commit 950953f774b3f69da6f413e045ef075e1f3da2df upstream. + +Make sure to drop the reference taken to the I2C adapter (and its +module) when setting up HDMI to allow the adapter to be deregistered. + +Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") +Cc: stable@vger.kernel.org # 3.3 +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c ++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c +@@ -580,6 +580,7 @@ static int oaktrail_hdmi_get_modes(struc + } else { + edid = (struct edid *)raw_edid; + /* FIXME ? edid = drm_get_edid(connector, i2c_adap); */ ++ i2c_put_adapter(i2c_adap); + } + + if (edid) { diff --git a/queue-7.0/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch b/queue-7.0/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch new file mode 100644 index 0000000000..e499c424d1 --- /dev/null +++ b/queue-7.0/drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch @@ -0,0 +1,54 @@ +From 657a091ab6d01d0091b77660c75cfed573c9a53e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:45 +0200 +Subject: drm/gma500/oaktrail_lvds: fix hang on init failure + +From: Johan Hovold + +commit 657a091ab6d01d0091b77660c75cfed573c9a53e upstream. + +The LVDS init code looks up an I2C adapter using i2c_get_adapter() and +tries to read the EDID before falling back to allocating and registering +its own adapter. + +The error handling does not separate these cases so on a late init +failure it will try to deregister and free also an adapter that had +previously been registered. Since i2c_get_adapter() takes another +reference to the adapter, deregistration hangs indefinitely while +waiting for the reference to be released. + +Fix this by only destroying adapters allocated during LVDS init on +errors. + +Fixes: a57ebfc0b4da ("drm/gma500: Make oaktrail lvds use ddc adapter from drm_connector") +Cc: stable@vger.kernel.org # 6.0 +Cc: Patrik Jakobsson +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_lvds.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c ++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c +@@ -293,7 +293,7 @@ void oaktrail_lvds_init(struct drm_devic + { + struct gma_encoder *gma_encoder; + struct gma_connector *gma_connector; +- struct gma_i2c_chan *ddc_bus; ++ struct gma_i2c_chan *ddc_bus = NULL; + struct drm_connector *connector; + struct drm_encoder *encoder; + struct drm_psb_private *dev_priv = to_drm_psb_private(dev); +@@ -421,7 +421,8 @@ out: + + err_unlock: + mutex_unlock(&dev->mode_config.mutex); +- gma_i2c_destroy(to_gma_i2c_chan(connector->ddc)); ++ if (!IS_ERR_OR_NULL(ddc_bus)) ++ gma_i2c_destroy(ddc_bus); + drm_encoder_cleanup(encoder); + err_connector_cleanup: + drm_connector_cleanup(connector); diff --git a/queue-7.0/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch b/queue-7.0/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch new file mode 100644 index 0000000000..de3d8f65dd --- /dev/null +++ b/queue-7.0/drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch @@ -0,0 +1,47 @@ +From 84d1c9b416d54afe760ca4c378bd95c89261254c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 May 2026 16:44:46 +0200 +Subject: drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init + +From: Johan Hovold + +commit 84d1c9b416d54afe760ca4c378bd95c89261254c upstream. + +The LVDS init code looks up an I2C adapter using i2c_get_adapter() and +tries to read the EDID before falling back to allocating and registering +its own adapter. + +Make sure to drop the references taken by i2c_get_adapter() when falling +back to allocating an adapter as well as on late errors to allow the +looked up adapter to be deregistered. + +Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") +Cc: stable@vger.kernel.org # 3.3 +Signed-off-by: Johan Hovold +Signed-off-by: Patrik Jakobsson +Link: https://patch.msgid.link/20260508144446.59722-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/oaktrail_lvds.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c ++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c +@@ -367,6 +367,8 @@ void oaktrail_lvds_init(struct drm_devic + if (edid == NULL && dev_priv->lpc_gpio_base) { + ddc_bus = oaktrail_lvds_i2c_init(dev); + if (!IS_ERR(ddc_bus)) { ++ if (i2c_adap) ++ i2c_put_adapter(i2c_adap); + i2c_adap = &ddc_bus->base; + edid = drm_get_edid(connector, i2c_adap); + } +@@ -423,6 +425,8 @@ err_unlock: + mutex_unlock(&dev->mode_config.mutex); + if (!IS_ERR_OR_NULL(ddc_bus)) + gma_i2c_destroy(ddc_bus); ++ else if (i2c_adap) ++ i2c_put_adapter(i2c_adap); + drm_encoder_cleanup(encoder); + err_connector_cleanup: + drm_connector_cleanup(connector); diff --git a/queue-7.0/series b/queue-7.0/series index 6d98396fba..f384273966 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -1131,3 +1131,11 @@ drm-xe-dma-buf-handle-empty-bo-and-uaf-races.patch drm-xe-dma-buf-fix-uaf-with-retry-loop.patch drm-ttm-fix-ttm_bo_shrink-infinite-lru-walk-on-backup-failure.patch drm-ttm-convert-eagain-from-dmem_cgroup_try_charge-to-enospc.patch +drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch +drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch +drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch +arm_mpam-fix-monitor-instance-selection-when-checking-for-hardware-nrdy.patch +arm_mpam-pretend-that-nrdy-is-always-hardware-managed.patch +arm_mpam-improve-check-for-whether-or-not-nrdy-is-hardware-managed.patch +arm_mpam-fix-false-positive-assert-failure-during-mpam_disable.patch +arm_mpam-check-whether-the-config-array-is-allocated-before-destroying-it.patch