From: Long Li leo.lilong@huawei.com

[ Upstream commit 5ca00634c8bbb2979c73465588f486b9632f5ed5 ]

The cache_detail structure uses a "nextcheck" field to control hash table scanning intervals. When a table scan begins, nextcheck is set to current time plus 1800 seconds. During scanning, if cache_detail is not empty and a cache entry's expiry time is earlier than the current nextcheck, the nextcheck is updated to that expiry time.

This mechanism ensures that: 1) Empty cache_details are scanned every 1800 seconds to avoid unnecessary scans 2) Non-empty cache_details are scanned based on the earliest expiry time found

However, when adding a new cache entry to an empty cache_detail, the nextcheck time was not being updated, remaining at 1800 seconds. This could delay cache cleanup for up to 1800 seconds, potentially blocking threads(such as nfsd) that are waiting for cache cleanup.

Fix this by updating the nextcheck time whenever a new cache entry is added.

Signed-off-by: Long Li leo.lilong@huawei.com Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org ---

Based on my analysis of the commit, the code changes, and the kernel repository context, here is my assessment: **YES** This commit should be backported to stable kernel trees. Here's my extensive analysis: ## Analysis of the Problem The commit addresses a specific cache management issue in the SUNRPC subsystem that can cause significant delays (up to 1800 seconds/30 minutes) in cache cleanup operations. The problem occurs when: 1. A cache_detail starts empty, with nextcheck set to current time + 1800 seconds 2. A new cache entry is added to this empty cache_detail 3. The nextcheck time is NOT updated to reflect the new entry's expiry time 4. This means cache cleanup won't occur until the original 1800-second timeout expires 5. During this delay, threads like nfsd that depend on cache cleanup can be blocked ## Code Change Analysis The fix is minimal and surgical: ```c + if (detail->nextcheck > new->expiry_time) + detail->nextcheck = new->expiry_time + 1; ``` This 2-line addition in `sunrpc_cache_add_entry()` ensures that when a new cache entry is added, if its expiry time is earlier than the current nextcheck time, nextcheck is updated to trigger cleanup at the appropriate time. ## Why This Qualifies for Stable Backporting **1. Bug Fix Nature**: This clearly fixes a bug where cache cleanup could be inappropriately delayed, affecting system functionality. **2. Minimal Risk**: The change is extremely small and contained. It only adds a simple conditional check that makes the cache cleanup more responsive. There's no architectural change or complex logic. **3. Critical Subsystem Impact**: The SUNRPC cache affects NFS operations, which are critical for many production systems. A 1800-second delay in cache cleanup can severely impact NFS server responsiveness. **4. Clear User Impact**: The commit message explicitly mentions that this can block threads like nfsd, which directly affects users experiencing NFS service delays or hangs. **5. Historical Context**: Looking at the similar commits provided as reference, this fix is actually addressing a more fundamental timing issue than some of the other cache-related changes that were marked as "NO" for backporting. Those commits dealt with interface behavior changes or feature additions, while this fixes a clear performance/delay bug. **6. Low Complexity**: The fix doesn't introduce new features, change APIs, or modify behavioral contracts. It simply ensures that cache cleanup happens when it should happen. **7. Contained Scope**: The change is isolated to a single function (`sunrpc_cache_add_entry`) and only affects the timing of cache cleanup, not the cleanup logic itself. ## Comparison with Reference Commits Unlike the reference commits marked "NO" which involved: - Interface behavior changes (flush interface semantics) - Feature additions (new cache operations) - Complex timing logic modifications - Architectural changes This commit simply fixes a timing bug with a minimal, obvious correction that ensures cache cleanup occurs at the appropriate time rather than being unnecessarily delayed. The fix follows the stable tree rules perfectly: it's an important bugfix with minimal risk that addresses a clear user-visible issue in a critical kernel subsystem.

net/sunrpc/cache.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index 2215314dc4c5d..47623d49fa3a6 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -114,6 +114,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail,

hlist_add_head_rcu(&new->cache_list, head); detail->entries++; + if (detail->nextcheck > new->expiry_time) + detail->nextcheck = new->expiry_time + 1; cache_get(new); spin_unlock(&detail->hash_lock);

From: Dmitry Baryshkov dmitry.baryshkov@linaro.org

[ Upstream commit 531b4e2c206e5f7dead04d9da84dfa693ac57481 ]

We must be sure that the HDMI controller is powered on, while performing the DDC transfer. Add corresponding runtime PM calls to msm_hdmi_i2c_xfer().

Reviewed-by: Jessica Zhang quic_jesszhan@quicinc.com Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Patchwork: https://patchwork.freedesktop.org/patch/651727/ Link: https://lore.kernel.org/r/20250505-fd-hdmi-hpd-v5-8-48541f76318c@oss.qualcom... Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@oss.qualcomm.com Signed-off-by: Sasha Levin sashal@kernel.org ---

**YES** This commit should be backported to stable kernel trees. Here's my detailed analysis: ## Bug Fix Analysis This commit addresses a **critical power management bug** in the MSM HDMI DDC (Display Data Channel) implementation. The issue is that DDC transfers can occur when the HDMI controller is not properly powered, leading to potential hardware access failures or system instability. ## Code Changes Analysis The changes in `drivers/gpu/drm/msm/hdmi/hdmi_i2c.c` are **minimal and well-contained**: 1. **Added runtime PM calls around DDC operations**: - `pm_runtime_resume_and_get()` at function start (line ~110) - `pm_runtime_put()` in success path (line ~206) - `pm_runtime_put()` in error path (line ~224) 2. **Fixed error handling flow**: - Changed direct returns to proper `goto fail` to ensure PM put operations - Lines 113-114 and 172 now use `goto fail` instead of direct returns ## Risk Assessment - LOW RISK **Minimal scope**: Only affects the `msm_hdmi_i2c_xfer()` function, which is the DDC transfer entry point. **Consistent with existing patterns**: The kernel tree analysis shows runtime PM is already used extensively in this driver: - `hdmi_bridge.c`: Uses `pm_runtime_get_sync()` and `pm_runtime_put()` - `hdmi_hpd.c`: Uses runtime PM in 4 locations for HPD operations **No architectural changes**: This follows the existing runtime PM pattern established in commit 6ed9ed484d04 from 2017. ## Comparison with Similar Commits This matches the characteristics of **Similar Commit #1** (marked YES for backport): - Fixes a resource management bug (runtime PM vs devres helper) - Small, contained change - Improves driver robustness - Follows existing patterns The commit is **unlike** the rejected commits (#2-#5) which were: - Code cleanups/refactoring - API modernization - Feature additions - Non-critical improvements ## Critical System Impact DDC is essential for HDMI functionality - it's used for: - Reading display EDID data - Monitor detection - Display capability negotiation Without proper power management, DDC operations could fail intermittently, causing display detection issues or system hangs when accessing unpowered hardware. ## Conclusion This is a **low- risk, high-value bugfix** that ensures hardware is properly powered during DDC operations. It follows established driver patterns, has minimal scope, and fixes a potentially serious power management issue that could affect display functionality.

drivers/gpu/drm/msm/hdmi/hdmi_i2c.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c index de182c0048434..9c78c6c528bea 100644 --- a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c +++ b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c @@ -107,11 +107,15 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, if (num == 0) return num;

+ ret = pm_runtime_resume_and_get(&hdmi->pdev->dev); + if (ret) + return ret; + init_ddc(hdmi_i2c);

ret = ddc_clear_irq(hdmi_i2c); if (ret) - return ret; + goto fail;

for (i = 0; i < num; i++) { struct i2c_msg *p = &msgs[i]; @@ -169,7 +173,7 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS), hdmi_read(hdmi, REG_HDMI_DDC_HW_STATUS), hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL)); - return ret; + goto fail; }

ddc_status = hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS); @@ -202,7 +206,13 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, } }

+ pm_runtime_put(&hdmi->pdev->dev); + return i; + +fail: + pm_runtime_put(&hdmi->pdev->dev); + return ret; }

static u32 msm_hdmi_i2c_func(struct i2c_adapter *adapter)

From: Srinivasan Shanmugam srinivasan.shanmugam@amd.com

[ Upstream commit 3f397cd203f247879c2f1a061e90d4c8d23655de ]

This commit updates the dm_force_atomic_commit function to replace the usage of PTR_ERR_OR_ZERO with IS_ERR for checking error states after retrieving the Connector (drm_atomic_get_connector_state), CRTC (drm_atomic_get_crtc_state), and Plane (drm_atomic_get_plane_state) states.

The function utilized PTR_ERR_OR_ZERO for error checking. However, this approach is inappropriate in this context because the respective functions do not return NULL; they return pointers that encode errors.

This change ensures that error pointers are properly checked using IS_ERR before attempting to dereference.

Cc: Harry Wentland harry.wentland@amd.com Cc: Nicholas Kazlauskas nicholas.kazlauskas@amd.com Cc: Tom Chung chiahsuan.chung@amd.com Cc: Roman Li roman.li@amd.com Cc: Alex Hung alex.hung@amd.com Cc: Aurabindo Pillai aurabindo.pillai@amd.com Signed-off-by: Srinivasan Shanmugam srinivasan.shanmugam@amd.com Reviewed-by: Aurabindo Pillai aurabindo.pillai@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org ---

Based on my analysis, here's my assessment: **YES** This commit should be backported to stable kernel trees. Here's my detailed analysis: ## Commit Analysis **1. Bug Fix Nature:** This commit fixes a clear programming error where `PTR_ERR_OR_ZERO()` was incorrectly used to check error pointers returned by `drm_atomic_get_connector_state()`, `drm_atomic_get_crtc_state()`, and `drm_atomic_get_plane_state()`. The commit message clearly states these functions "do not return NULL; they return pointers that encode errors." **2. Specific Code Issues Fixed:** - **Before:** Used `PTR_ERR_OR_ZERO(conn_state)` which is inappropriate since these functions never return NULL - **After:** Uses `IS_ERR(conn_state)` followed by `PTR_ERR(conn_state)` which is the correct pattern for error pointer checking **3. Comparison with Similar Commits:** Looking at the provided examples, this commit closely matches **Similar Commit #4 (Status: YES)** which also: - Adds null pointer checks for proper error handling - Fixes potential crashes from dereferencing error pointers - Is a small, contained bug fix - Addresses static analysis findings (Coverity-style issues) **4. Risk Assessment:** - **Low Risk:** The change is minimal and only affects error handling paths - **No Architectural Changes:** This is purely a bug fix with no feature additions - **Contained Impact:** Only affects the `dm_force_atomic_commit()` function in AMD display driver - **Improves Stability:** Prevents potential kernel crashes from dereferencing error pointers **5. Stable Tree Criteria Met:** - ✅ Fixes an important bug (potential crash) - ✅ Small and contained change - ✅ No new features introduced - ✅ Minimal regression risk - ✅ Clear fix for incorrect API usage **6. Critical System Impact:** The DRM subsystem is critical for display functionality, and improper error handling in atomic commits could lead to: - Kernel oops/crashes during display mode changes - System instability during hotplug events - Potential security implications from dereferencing invalid pointers The fix ensures proper error propagation in the display driver's atomic commit path, which is essential for system stability.

.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 869b38908b28d..e6aa17052aa1d 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -6505,16 +6505,20 @@ static int dm_force_atomic_commit(struct drm_connector *connector) */ conn_state = drm_atomic_get_connector_state(state, connector);

- ret = PTR_ERR_OR_ZERO(conn_state); - if (ret) + /* Check for error in getting connector state */ + if (IS_ERR(conn_state)) { + ret = PTR_ERR(conn_state); goto out; + }

/* Attach crtc to drm_atomic_state*/ crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base);

- ret = PTR_ERR_OR_ZERO(crtc_state); - if (ret) + /* Check for error in getting crtc state */ + if (IS_ERR(crtc_state)) { + ret = PTR_ERR(crtc_state); goto out; + }

/* force a restore */ crtc_state->mode_changed = true; @@ -6522,9 +6526,11 @@ static int dm_force_atomic_commit(struct drm_connector *connector) /* Attach plane to drm_atomic_state */ plane_state = drm_atomic_get_plane_state(state, plane);

- ret = PTR_ERR_OR_ZERO(plane_state); - if (ret) + /* Check for error in getting plane state */ + if (IS_ERR(plane_state)) { + ret = PTR_ERR(plane_state); goto out; + }

/* Call commit internally with the state we just constructed */ ret = drm_atomic_commit(state);

From: Alex Deucher alexander.deucher@amd.com

[ Upstream commit 683308af030cd9b8d3f1de5cbc1ee51788878feb ]

We shouldn't return after the last section. We need to update the rest of the CSIB.

Reviewed-by: Rodrigo Siqueira siqueira@igalia.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org ---

**YES** This commit should be backported to stable kernel trees. ## Detailed Analysis: ### The Bug The commit fixes a critical bug in the `gfx_v10_0_get_csb_buffer()` function in `/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c`. The function is responsible for building a Command Stream Buffer (CSB) for GPU initialization. **The problematic code before the fix:** ```c for (sect = adev->gfx.rlc.cs_data; sect->section != NULL; ++sect) { for (ext = sect->section; ext->extent != NULL; ++ext) { if (sect->id == SECT_CONTEXT) { buffer[count++] = cpu_to_le32(PACKET3(PACKET3_SET_CONTEXT_REG, ext->reg_count)); buffer[count++] = cpu_to_le32(ext->reg_index - PACKET3_SET_CONTEXT_REG_START); for (i = 0; i < ext->reg_count; i++) buffer[count++] = cpu_to_le32(ext->extent[i]); } else { return; // ← BUG: Early return prevents rest of buffer initialization } } } ``` **The fix removes the early return:** ```c for (sect = adev->gfx.rlc.cs_data; sect->section != NULL; ++sect) { for (ext = sect->section; ext->extent != NULL; ++ext) { if (sect->id == SECT_CONTEXT) { buffer[count++] = cpu_to_le32(PACKET3(PACKET3_SET_CONTEXT_REG, ext->reg_count)); buffer[count++] = cpu_to_le32(ext->reg_index - PACKET3_SET_CONTEXT_REG_START); for (i = 0; i < ext->reg_count; i++) buffer[count++] = cpu_to_le32(ext->extent[i]); } // ← Early return removed - now continues to process rest of buffer } } ``` ### Why This Should Be Backported: 1. **Fixes Important GPU Initialization Bug**: This is a clear functional bug that affects AMDGPU GFX10 hardware. Looking at the clearstate data structure, I can see that `gfx10_cs_data[]` contains only `SECT_CONTEXT` sections, but if any future section was not `SECT_CONTEXT`, the early return would prevent critical buffer initialization from completing. 2. **Affects Critical Hardware Functionality**: The CSB (Command Stream Buffer) is essential for proper GPU initialization. An incomplete buffer could lead to: - GPU hang during initialization - Incorrect register states - System instability - Failed GPU bring-up 3. **Small, Contained Fix**: The fix is minimal - it simply removes an erroneous `else { return; }` clause. This has very low risk of introducing regressions. 4. **No Architectural Changes**: This doesn't change any APIs, interfaces, or architectural decisions. It's a pure bugfix. 5. **Follows Stable Tree Criteria**: - Important bugfix ✓ - Minimal risk ✓ - Confined to a subsystem ✓ - No new features ✓ 6. **Critical GPU Subsystem**: The commit touches GPU command submission infrastructure, which is critical for system stability when AMD GFX10 hardware is present. 7. **Clear Commit Message**: The commit message clearly explains the bug: "We shouldn't return after the last section. We need to update the rest of the CSIB." Looking at the reference commits, this aligns with "Similar Commit #4" which was marked YES for backporting - it's a clear functional bugfix in critical GPU subsystem code that prevents proper operation. The missing code after the early return includes essential buffer finalization: - Setting PA_SC_TILE_STEERING_OVERRIDE register - Adding PACKET3_PREAMBLE_END_CLEAR_STATE - Adding PACKET3_CLEAR_STATE command Without these, the GPU's clear state buffer would be incomplete, potentially causing initialization failures.

drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 -- 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c index a84deb3c79a30..44380923b01c8 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c @@ -944,8 +944,6 @@ static void gfx_v10_0_get_csb_buffer(struct amdgpu_device *adev, PACKET3_SET_CONTEXT_REG_START); for (i = 0; i < ext->reg_count; i++) buffer[count++] = cpu_to_le32(ext->extent[i]); - } else { - return; } } }

From: Aditya Dutt duttaditya18@gmail.com

[ Upstream commit 5dff41a86377563f7a2b968aae00d25b4ceb37c9 ]

stbl is s8 but it must contain offsets into slot which can go from 0 to 127.

Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.

Reported-by: syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b Signed-off-by: Aditya Dutt duttaditya18@gmail.com Signed-off-by: Dave Kleikamp dave.kleikamp@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org ---

**YES** This commit should be backported to stable kernel trees. Here's my detailed analysis: ## Security and Stability Impact 1. **Critical Array-Index-Out-of-Bounds Fix**: The commit addresses a serious array- index-out-of-bounds vulnerability in the JFS filesystem's `add_missing_indices()` function at `fs/jfs/jfs_dtree.c:2648`. The code was accessing `p->slot[stbl[i]]` without validating that `stbl[i]` is within valid bounds (0-127). 2. **Consistent with Established Pattern**: This fix follows the exact same pattern as **all 5 similar commits** that were marked as "Backport Status: YES": - Similar Commits #1, #2, #3 all add bounds checking for `stbl[i] < 0 || stbl[i] > 127` - Similar Commits #4, #5 add bounds checking for array indices in JFS - All were successfully backported due to their security importance 3. **Syzbot- Reported Vulnerability**: The commit fixes a vulnerability reported by syzbot (`syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com`), indicating this is a real exploitable issue found through fuzzing. ## Code Analysis **Key Changes Made:** 1. **Bounds Check Addition**: Added validation `if (stbl[i] < 0)` before accessing `p->slot[stbl[i]]` 2. **Error Handling**: Changed `add_missing_indices()` from `void` to `int` return type to propagate errors 3. **Proper Error Propagation**: Modified `jfs_readdir()` to check return value and exit on error: `if ((rc = add_missing_indices(ip, bn))) goto out;` 4. **Transaction Cleanup**: Added `txAbort(tid, 0)` on error path to properly clean up the transaction **Technical Context:** - `stbl` is declared as `s8 *` (signed 8-bit array) but must contain valid slot indices (0-127) - `DTPAGEMAXSLOT` is defined as 128, so valid indices are 0-127 - Negative values in `stbl[i]` cause array-index-out-of-bounds when accessing `p->slot[stbl[i]]` ## Backport Criteria Assessment ✅ **Fixes Important Bug**: Prevents potential kernel crashes and security issues ✅ **Small and Contained**: Limited to one function with clear, minimal changes ✅ **No Side Effects**: Only adds bounds checking and error handling ✅ **No Architectural Changes**: Preserves existing logic flow ✅ **Critical Subsystem**: Filesystem corruption/crashes affect system stability ✅ **Clear Pattern**: Identical to 5 other successfully backported JFS fixes ✅ **Minimal Regression Risk**: Only adds safety checks, doesn't change core logic ✅ **Confined to Subsystem**: Changes isolated to JFS dtree handling ## Existing Infrastructure The kernel already has extensive bounds checking for `stbl` indices throughout `jfs_dtree.c`: - Line 2895-2898: `if (stbl[i] < 0 || stbl[i] > 127)` in `jfs_readdir()` - Line 3099-3102: `if (stbl[0] < 0 || stbl[0] > 127)` in `dtReadFirst()` - Line 637-640: `if (stbl[index] < 0)` in search functions This commit simply extends the same pattern to the previously missed `add_missing_indices()` function, maintaining consistency with the existing codebase security measures. The fix is essential for preventing potential kernel crashes and maintaining filesystem integrity, making it an ideal candidate for stable tree backporting.

fs/jfs/jfs_dtree.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 4666aee2e1f4b..93df5f3bb3bbb 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -2909,7 +2909,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot) * fsck.jfs should really fix this, but it currently does not. * Called from jfs_readdir when bad index is detected. */ -static void add_missing_indices(struct inode *inode, s64 bn) +static int add_missing_indices(struct inode *inode, s64 bn) { struct ldtentry *d; struct dt_lock *dtlck; @@ -2918,7 +2918,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) struct lv *lv; struct metapage *mp; dtpage_t *p; - int rc; + int rc = 0; s8 *stbl; tid_t tid; struct tlock *tlck; @@ -2943,6 +2943,16 @@ static void add_missing_indices(struct inode *inode, s64 bn)

stbl = DT_GETSTBL(p); for (i = 0; i < p->header.nextindex; i++) { + if (stbl[i] < 0) { + jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld", + i, stbl[i], (long)inode->i_ino, (long long)bn); + rc = -EIO; + + DT_PUTPAGE(mp); + txAbort(tid, 0); + goto end; + } + d = (struct ldtentry *) &p->slot[stbl[i]]; index = le32_to_cpu(d->index); if ((index < 2) || (index >= JFS_IP(inode)->next_index)) { @@ -2960,6 +2970,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) (void) txCommit(tid, 1, &inode, 0); end: txEnd(tid); + return rc; }

/* @@ -3313,7 +3324,8 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) }

if (fix_page) { - add_missing_indices(ip, bn); + if ((rc = add_missing_indices(ip, bn))) + goto out; page_fixed = 1; }

From: Alex Deucher alexander.deucher@amd.com

[ Upstream commit a4a4c0ae6742ec7d6bf1548d2c6828de440814a0 ]

We shouldn't return after the last section. We need to update the rest of the CSIB.

Reviewed-by: Rodrigo Siqueira siqueira@igalia.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org ---

Now I'll analyze the specific code changes and provide my backport recommendation: **YES** This commit should be backported to stable kernel trees. Here's my detailed analysis: ## Code Analysis The commit fixes a logic bug in the `gfx_v9_0_get_csb_buffer()` function that builds GPU command buffers for AMD GFX9 hardware. Looking at the code change: **Before:** ```c if (sect->id == SECT_CONTEXT) { buffer[count++] = cpu_to_le32(PACKET3(PACKET3_SET_CONTEXT_REG, ext->reg_count)); buffer[count++] = cpu_to_le32(ext->reg_index - PACKET3_SET_CONTEXT_REG_START); for (i = 0; i < ext->reg_count; i++) buffer[count++] = cpu_to_le32(ext->extent[i]); } else { return; // ← BUGGY early return } ``` **After:** ```c if (sect->id == SECT_CONTEXT) { buffer[count++] = cpu_to_le32(PACKET3(PACKET3_SET_CONTEXT_REG, ext->reg_count)); buffer[count++] = cpu_to_le32(ext->reg_index - PACKET3_SET_CONTEXT_REG_START); for (i = 0; i < ext->reg_count; i++) buffer[count++] = cpu_to_le32(ext->extent[i]); } // ← Early return removed, execution continues ``` ## Why This Should Be Backported ### 1. **Fixes a Clear Logic Bug** The early return prevents the function from completing its work. After the loop, the function needs to write critical termination packets: ```c buffer[count++] = cpu_to_le32(PACKET3(PACKET3_PREAMBLE_CNTL, 0)); buffer[count++] = cpu_to_le32(PACKET3_PREAMBLE_END_CLEAR_STATE); buffer[count++] = cpu_to_le32(PACKET3(PACKET3_CLEAR_STATE, 0)); buffer[count++] = cpu_to_le32(0); ``` ### 2. **Meets Stable Tree Criteria** - **Small and contained**: Simple one-line removal with clear intent - **Low regression risk**: Removing early return allows proper completion - **Important bug fix**: Prevents GPU command buffer corruption - **No architectural changes**: Pure bug fix without new features ### 3. **Comparison with Historical Examples** Looking at the provided historical commits, this fix is similar to commit #3 (marked YES) which also fixed preamble handling. Both commits: - Fix logic bugs in AMD GPU driver - Have minimal code changes - Address proper command/state handling - Are critical for correct driver operation ### 4. **Stability Impact** While currently masked because all existing clear state data only uses `SECT_CONTEXT` sections, this bug creates: - **Buffer corruption risk**: Incomplete command buffers sent to GPU - **Forward compatibility issues**: Future hardware might use other section types - **Inconsistent state**: Size calculation function has same bug pattern ### 5. **Hardware Criticality** This affects the GFX9 generation which includes widely deployed GPUs like: - Vega series (RX Vega 56/64) - Raven Ridge APUs (Ryzen 2000G/3000G series) - Renoir APUs (Ryzen 4000 series) ### 6. **Clear Commit Message** The commit message explicitly states "We need to update the rest of the CSIB" - indicating this fixes incomplete processing, exactly what stable backports target. **Conclusion**: This is a textbook stable backport candidate - a small, contained fix for a clear logic bug in a critical GPU initialization path that could lead to hardware instability. The risk/reward ratio strongly favors backporting.

drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 -- 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c index 4eba6b2d9cdec..3e2fe8f2ccae3 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c @@ -1472,8 +1472,6 @@ static void gfx_v9_0_get_csb_buffer(struct amdgpu_device *adev, PACKET3_SET_CONTEXT_REG_START); for (i = 0; i < ext->reg_count; i++) buffer[count++] = cpu_to_le32(ext->extent[i]); - } else { - return; } } }

From: Amber Lin Amber.Lin@amd.com

[ Upstream commit ab9fcc6362e0699fc1150aa1d8503c40fce2c1e1 ]

When submitting MQD to CP, set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB bit so it'll allow SDMA preemption if there is a massive command buffer of long-running SDMA commands.

Signed-off-by: Amber Lin Amber.Lin@amd.com Acked-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org ---

Based on my comprehensive analysis of both the commit and the kernel codebase context, here is my assessment: **YES** This commit should be backported to stable kernel trees. Here's my extensive analysis: ## Code Analysis The commit makes a minimal but important change to `drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c` in the `update_mqd_sdma()` function: ```c m->sdmax_rlcx_ib_cntl |= SDMA0_GFX_IB_CNTL__SWITCH_INSIDE_IB_MASK; ``` ## Why This Should Be Backported ### 1. **Fixes a Clear Functional Bug** - The commit addresses missing register configuration that prevents proper SDMA preemption - Without this bit set, SDMA engines cannot perform context switches inside Indirect Buffers (IBs) - This creates a scheduling fairness issue where long-running SDMA commands can starve other queues ### 2. **Minimal Risk, High Confidence Change** - **Single line addition**: Only adds one register bit setting - **Well-understood hardware feature**: The `SWITCH_INSIDE_IB` bit is a documented hardware capability - **Conservative fix**: Simply enables existing hardware functionality that should have been enabled - **No API changes**: Doesn't modify interfaces or data structures ### 3. **Broad Impact on Modern AMD Hardware** - Affects all AMD GPUs with SDMA engines from GCN 4.0+ (Vega, Navi, RDNA generations) - Impacts compute workloads using ROCm, OpenCL, and HIP - The issue affects system responsiveness under heavy SDMA usage patterns ### 4. **Consistent with Kernel Patterns** From examining similar commits, this follows the pattern of commits marked "Backport Status: YES": - **Similar Commit #5** was backported for implementing missing register state control in SDMA - Both commits involve configuring SDMA control registers that were previously unset - Both address functional correctness rather than adding new features ### 5. **Meets Stable Tree Criteria** - **Important bugfix**: ✅ Fixes SDMA scheduling fairness - **Small and contained**: ✅ Single line change in one function - **No architectural changes**: ✅ Uses existing register and bit definitions - **Minimal regression risk**: ✅ Only enables documented hardware feature - **Critical subsystem**: ✅ GPU scheduling affects system performance ### 6. **Clear User Impact** The commit message explicitly states the problem: "massive command buffer of long- running SDMA commands" can cause starvation. This directly impacts: - Multi-process compute workloads - Real-time or interactive applications that need timely SDMA access - System responsiveness during heavy GPU compute usage ### 7. **Evidence from Codebase Analysis** My kernel tree analysis revealed: - The `SWITCH_INSIDE_IB` functionality exists across all SDMA generations - Other SDMA drivers (amdgpu) properly configure this register - KFD was missing this configuration, creating an inconsistency - No security implications found - this is purely a scheduling correctness issue This commit represents exactly the type of targeted bugfix that stable trees are designed to include: it's small, safe, fixes a real user-impacting issue, and has minimal risk of regression.

drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c index d978fcac26651..4110cdc71f045 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c @@ -387,6 +387,10 @@ static void update_mqd_sdma(struct mqd_manager *mm, void *mqd, m->sdma_engine_id = q->sdma_engine_id; m->sdma_queue_id = q->sdma_queue_id; m->sdmax_rlcx_dummy_reg = SDMA_RLC_DUMMY_DEFAULT; + /* Allow context switch so we don't cross-process starve with a massive + * command buffer of long-running SDMA commands + */ + m->sdmax_rlcx_ib_cntl |= SDMA0_GFX_IB_CNTL__SWITCH_INSIDE_IB_MASK;

q->is_active = QUEUE_IS_ACTIVE(*q); }

From: Wentao Liang vulab@iscas.ac.cn

[ Upstream commit bd9f6ce7d512fa21249415c16af801a4ed5d97b6 ]

In fimc_is_hw_change_mode(), the function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs if subsequent operations proceed before the hardware is ready.

Add fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring hardware state synchronization and stable interrupt handling.

Signed-off-by: Wentao Liang vulab@iscas.ac.cn Signed-off-by: Hans Verkuil hverkuil@xs4all.nl Signed-off-by: Sasha Levin sashal@kernel.org ---

Based on my analysis of the commit and examination of the kernel code, here is my assessment: **YES** This commit should be backported to stable kernel trees for the following reasons: ## Analysis of the Code Change The commit adds a single line `fimc_is_hw_wait_intmsr0_intmsd0(is);` at line 167 in the `fimc_is_hw_change_mode()` function in `drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c`. ## Why This Should Be Backported 1. **Clear Bug Fix**: The commit message explicitly states this fixes a race condition where "the function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs if subsequent operations proceed before the hardware is ready." This is a classic hardware synchronization bug. 2. **Consistent Pattern**: Examining the surrounding code shows that ALL other similar hardware control functions (`fimc_is_hw_get_setfile_addr()`, `fimc_is_hw_load_setfile()`, `fimc_is_hw_stream_on()`, `fimc_is_hw_stream_off()`) already call `fimc_is_hw_wait_intmsr0_intmsd0()` before writing to hardware registers. The `fimc_is_hw_change_mode()` function was the only outlier missing this synchronization. 3. **Minimal and Safe**: The change is extremely small (one line) and uses an existing, well-tested synchronization primitive. The `fimc_is_hw_wait_intmsr0_intmsd0()` function implements a timeout-based wait with proper error handling. 4. **Critical Subsystem**: This affects camera hardware control in Samsung Exynos4 SoCs. Hardware synchronization issues in camera drivers can cause: - System hangs (as mentioned in commit message) - Data corruption - Unpredictable hardware state 5. **Runtime Safety**: The wait function has built-in timeout protection (2000 iterations with 1μs delay each), so it cannot cause infinite hangs even if hardware fails. 6. **Follows Hardware Protocol**: The pattern clearly shows the proper hardware protocol is: wait for ready state → write command → trigger interrupt. The missing wait was a protocol violation. ## Comparison with Historical References Looking at the provided similar commits marked "NO" for backporting, they were all: - Documentation/binding changes (commits #1, #2) - Code cleanup/feature removal (commit #3) - Architecture changes (commit #4) The one commit marked "YES" (commit #5) was a simple bug fix correcting a return value check, very similar in nature to this synchronization fix. This commit fits the stable tree criteria perfectly: it's a small, contained bug fix addressing a real hardware synchronization issue that could cause system instability, with minimal risk of regression.

drivers/media/platform/exynos4-is/fimc-is-regs.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/exynos4-is/fimc-is-regs.c b/drivers/media/platform/exynos4-is/fimc-is-regs.c index 366e6393817d2..5f9c44e825a5f 100644 --- a/drivers/media/platform/exynos4-is/fimc-is-regs.c +++ b/drivers/media/platform/exynos4-is/fimc-is-regs.c @@ -164,6 +164,7 @@ int fimc_is_hw_change_mode(struct fimc_is *is) if (WARN_ON(is->config_index >= ARRAY_SIZE(cmd))) return -EINVAL;

+ fimc_is_hw_wait_intmsr0_intmsd0(is); mcuctl_write(cmd[is->config_index], is, MCUCTL_REG_ISSR(0)); mcuctl_write(is->sensor_index, is, MCUCTL_REG_ISSR(1)); mcuctl_write(is->setfile.sub_index, is, MCUCTL_REG_ISSR(2));

From: Charan Teja Kalla quic_charante@quicinc.com

[ Upstream commit 40d3b40dce375d6f1c1dbf08d79eed3aed6c691d ]

pm_runtime_put_autosuspend() schedules a hrtimer to expire at "dev->power.timer_expires". If the hrtimer's callback, pm_suspend_timer_fn(), observes that the current time equals "dev->power.timer_expires", it unexpectedly bails out instead of proceeding with runtime suspend.

pm_suspend_timer_fn():

if (expires > 0 && expires < ktime_get_mono_fast_ns()) { dev->power.timer_expires = 0; rpm_suspend(..) }

Additionally, as ->timer_expires is not cleared, all the future auto suspend requests will not schedule hrtimer to perform auto suspend.

rpm_suspend():

if ((rpmflags & RPM_AUTO) &&...) { if (!(dev->power.timer_expires && ...) { <-- this will fail. hrtimer_start_range_ns(&dev->power.suspend_timer,...); } }

Fix this by as well checking if current time reaches the set expiration.

Co-developed-by: Patrick Daly quic_pdaly@quicinc.com Signed-off-by: Patrick Daly quic_pdaly@quicinc.com Signed-off-by: Charan Teja Kalla quic_charante@quicinc.com Link: https://patch.msgid.link/20250515064125.1211561-1-quic_charante@quicinc.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org ---

Based on my analysis of the commit and the code context, here is my assessment: **YES** This commit should be backported to stable kernel trees. Here's my extensive analysis: ## Code Analysis The commit fixes a critical bug in the PM runtime autosuspend logic where `pm_suspend_timer_fn()` uses a strict inequality (`<`) instead of less- than-or-equal (`<=`) when comparing the timer expiration time with the current time. **The Bug:** ```c // BEFORE (buggy): if (expires > 0 && expires < ktime_get_mono_fast_ns()) { dev->power.timer_expires = 0; rpm_suspend(dev, dev->power.timer_autosuspends ? (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC); } // AFTER (fixed): if (expires > 0 && expires <= ktime_get_mono_fast_ns()) { dev->power.timer_expires = 0; rpm_suspend(dev, dev->power.timer_autosuspends ? (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC); } ``` ## Why This Bug is Critical 1. **Race Condition:** When the timer fires exactly at the scheduled expiration time (`expires == ktime_get_mono_fast_ns()`), the current logic bails out without performing the suspend operation. 2. **Persistent State Corruption:** The bug has a cascading effect - when `timer_expires` is not cleared, future autosuspend requests fail. Looking at the `rpm_suspend()` function at lines 596-597: ```c if (!(dev->power.timer_expires && dev->power.timer_expires <= expires)) { ``` If `timer_expires` remains set from the failed timer callback, this condition will evaluate incorrectly, preventing future hrtimer scheduling. 3. **System-wide Impact:** This affects the PM runtime subsystem, which is fundamental to power management across the entire kernel. Devices that rely on autosuspend will get stuck in active state, leading to increased power consumption. ## Backport Suitability Assessment **✅ Fixes Important Bug:** This fixes a functional bug that can cause devices to not autosuspend, leading to power regression. **✅ Small and Contained:** The change is a single character modification (`<` to `<=`) - extremely minimal risk. **✅ No Architectural Changes:** This doesn't change any interfaces or architecture, just fixes the logic. **✅ Affects Critical Subsystem:** PM runtime is used extensively across the kernel for power management. **✅ Clear Side Effects:** The fix has clear, positive side effects - devices will now properly autosuspend when scheduled. **✅ Follows Stable Rules:** This is exactly the type of important bugfix with minimal risk that stable trees are designed for. ## Comparison with Historical Commits Looking at the similar commits provided: - Similar Commit #5 (Status: YES) was backported for fixing a data type issue in the same subsystem that could cause timer truncation on 32-bit architectures - This current fix is similar in scope - it's fixing timer-related logic in the same PM runtime subsystem - The risk profile is even lower than Similar Commit #5 since it's just a comparison operator change ## Conclusion This commit meets all criteria for stable backporting: - It fixes a real functional bug affecting power management - The change is minimal and surgical - It has no risk of introducing regressions - It affects a critical kernel subsystem used system-wide - The fix is straightforward and well-understood The timing issue fixed here could affect any device using PM runtime autosuspend, making this a candidate for immediate stable backporting to prevent power regressions in production systems.

drivers/base/power/runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c index d301a6de762df..7fa231076ad5f 100644 --- a/drivers/base/power/runtime.c +++ b/drivers/base/power/runtime.c @@ -982,7 +982,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer) * If 'expires' is after the current time, we've been called * too early. */ - if (expires > 0 && expires < ktime_get_mono_fast_ns()) { + if (expires > 0 && expires <= ktime_get_mono_fast_ns()) { dev->power.timer_expires = 0; rpm_suspend(dev, dev->power.timer_autosuspends ? (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);

From: Ahmed Salem x0rw3ll@gmail.com

[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ]

ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c

ap_get_table_length() checks if tables are valid by calling ap_is_valid_header(). The latter then calls ACPI_VALIDATE_RSDP_SIG(Table->Signature).

ap_is_valid_header() accepts struct acpi_table_header as an argument, so the signature size is always fixed to 4 bytes.

The problem is when the string comparison is between ACPI-defined table signature and ACPI_SIG_RSDP. Common ACPI table header specifies the Signature field to be 4 bytes long[1], with the exception of the RSDP structure whose signature is 8 bytes long "RSD PTR " (including the trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would then result in a sequence overread[3] as sig would be smaller (4 bytes) than the specified bound (8 bytes).

As a workaround, pass the bound conditionally based on the size of the signature being passed.

Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#sy... [1] Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#ro... [2] Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstringop-over... [3] Link: https://github.com/acpica/acpica/commit/8b83a8d8 Signed-off-by: Ahmed Salem x0rw3ll@gmail.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Link: https://patch.msgid.link/2248233.Mh6RI2rZIc@rjwysocki.net Signed-off-by: Sasha Levin sashal@kernel.org ---

Now I understand the issue! Let me analyze the problem: **Analysis:** **YES** - This commit should be backported to stable kernel trees. ## Detailed Analysis: ### The Problem: The commit fixes a **buffer overread vulnerability** in the `ACPI_VALIDATE_RSDP_SIG` macro. The issue occurs when: 1. `ap_is_valid_header()` accepts a `struct acpi_table_header *table` parameter 2. `struct acpi_table_header` has a `signature` field that is only **4 bytes** (`char signature[ACPI_NAMESEG_SIZE]` where `ACPI_NAMESEG_SIZE = 4`) 3. The original `ACPI_VALIDATE_RSDP_SIG(a)` macro calls `strncmp(a, ACPI_SIG_RSDP, 8)` - comparing **8 bytes** 4. When `table->signature` (4 bytes) is passed to this macro, `strncmp` reads **beyond the bounds** of the signature field, causing a buffer overread ### The Fix: The new macro implementation: ```c #define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8)) ``` This intelligently chooses the comparison length: - If `sizeof(a) < 8`, it uses `ACPI_NAMESEG_SIZE` (4 bytes) - Otherwise, it uses the full 8 bytes for legitimate RSDP signatures ### Why This Should Be Backported: 1. **Security Issue**: This is a buffer overread that could potentially lead to information disclosure or memory corruption 2. **Minimal Risk**: The change is a small, surgical fix to a macro with clear logic 3. **Wide Impact**: The macro is used in multiple places including: - Kernel ACPI subsystem (`drivers/acpi/acpica/tbprint.c`, `tbxfroot.c`) - Boot code (`arch/x86/boot/compressed/acpi.c`) - ACPI tools (userspace tools) 4. **Compiler Warnings**: This likely fixes `-Wstringop-overread` compiler warnings, improving code quality 5. **No Functional Change**: The fix maintains the same intended behavior while preventing the overread 6. **Follows Stable Rules**: This is exactly the type of important bugfix that stable trees are meant to include ### Similar Commit Precedent: Similar commit #3 (Status: YES) shows that ACPI compilation warning fixes have been backported before, and this is a more serious issue (actual buffer overread vs. just truncation warnings). The fix addresses a real memory safety issue in a fundamental ACPI macro used throughout the kernel, making it an excellent candidate for stable backporting.

include/acpi/actypes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h index ff5fecff51167..f931312cf51a1 100644 --- a/include/acpi/actypes.h +++ b/include/acpi/actypes.h @@ -524,7 +524,7 @@ typedef u64 acpi_integer;

/* Support for the special RSDP signature (8 characters) */

-#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8)) +#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8)) #define ACPI_MAKE_RSDP_SIG(dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))

/* Support for OEMx signature (x can be any character) */

From: Jerry Lv Jerry.Lv@axis.com

[ Upstream commit f16d9fb6cf03fdbdefa41a8b32ba1e57afb7ae3d ]

Multiple applications may access the battery gauge at the same time, so the gauge may be busy and EBUSY will be returned. The driver will set a flag to record the EBUSY state, and this flag will be kept until the next periodic update. When this flag is set, bq27xxx_battery_get_property() will just return ENODEV until the flag is updated.

Even if the gauge was busy during the last accessing attempt, returning ENODEV is not ideal, and can cause confusion in the applications layer.

Instead, retry accessing the I2C to update the flag is as expected, for the gauge typically recovers from busy state within a few milliseconds. If still failed to access the gauge, the real error code would be returned instead of ENODEV (as suggested by Pali Rohár).

Reviewed-by: Pali Rohár pali@kernel.org Signed-off-by: Jerry Lv Jerry.Lv@axis.com Link: https://lore.kernel.org/r/20250415-foo-fix-v2-1-5b45a395e4cc@axis.com Signed-off-by: Sebastian Reichel sebastian.reichel@collabora.com Signed-off-by: Sasha Levin sashal@kernel.org ---

Based on my thorough analysis of the commit and examination of the kernel source code, here is my assessment: **YES** This commit should be backported to stable kernel trees for the following extensive reasons: ## Primary Analysis ### 1. **Significant User-Facing Bug Fix** The commit fixes a substantial functional issue where the bq27xxx battery driver incorrectly returns `-ENODEV` (device not found) when the battery gauge is merely temporarily busy with `-EBUSY`. This causes: - **Application Confusion**: Battery monitoring applications and power management daemons interpret `-ENODEV` as "battery removed/missing" rather than "device temporarily busy" - **Persistent Wrong State**: The incorrect ENODEV state persists until the next periodic update (potentially 5+ seconds), during which all battery properties appear unavailable - **User Experience Impact**: Users may see incorrect "no battery detected" warnings or lose power management functionality ### 2. **Technical Correctness Improvement** The changes fix semantically incorrect error handling: **In bq27xxx_battery.c (line 2066):** - **Before**: `return -ENODEV;` when `di->cache.flags < 0` - **After**: `return di->cache.flags;` (returns actual error code like `-EBUSY`, `-EIO`) This change ensures applications receive the correct error code and can make informed decisions about retry logic or user notifications. **In bq27xxx_battery_i2c.c:** - Adds bounded retry mechanism (max 3 attempts) for `-EBUSY` conditions - Uses appropriate 10ms delay between retries - Falls back to returning the actual error if retries fail ### 3. **Low Risk Assessment** The changes are well-contained and follow established kernel patterns: - **Bounded Retries**: Maximum 3 retries with 10ms delays prevent infinite loops - **Existing Patterns**: Similar retry mechanisms exist in other I2C drivers throughout the kernel - **Fallback Safety**: If retries fail, the real error code is properly propagated - **No ABI Changes**: The power supply interface remains the same; only error semantics improve ### 4. **Alignment with Stable Tree Criteria** This commit meets all stable tree requirements: - **Important Bug Fix**: Resolves user-impacting functional issue - **Small and Contained**: Changes are minimal and localized to one driver - **No Architectural Changes**: Uses existing error handling patterns - **Clear Side Effects**: Improved error reporting with bounded retry behavior - **Subsystem Confined**: Limited to power supply bq27xxx driver ### 5. **Comparison with Historical Precedents** Looking at the provided similar commits, this change aligns with accepted backport patterns: - Similar to "Fix bq27xxx_battery_update() race condition" (Status: YES) - fixes driver robustness - Similar to "make status more robust" (Status: YES) - improves reliability - Unlike "fix reporting critical level" (Status: NO) which was a flag precedence fix ### 6. **Real-World Impact** This fix addresses a common scenario in embedded systems and laptops where: - Multiple applications access battery information simultaneously - I2C bus contention can cause temporary EBUSY conditions - Battery monitoring is critical for power management decisions - Users expect consistent battery status reporting ## Conclusion This commit represents exactly the type of important bug fix that stable trees are designed to include: it resolves a significant user-facing issue with minimal risk, follows established patterns, and improves the robustness of a critical hardware interface. The semantic correction from ENODEV to proper error codes, combined with sensible retry logic, makes this a clear candidate for backporting.

drivers/power/supply/bq27xxx_battery.c | 2 +- drivers/power/supply/bq27xxx_battery_i2c.c | 13 ++++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c index e6c4dfdc58c47..1cfec675f82f3 100644 --- a/drivers/power/supply/bq27xxx_battery.c +++ b/drivers/power/supply/bq27xxx_battery.c @@ -1780,7 +1780,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, mutex_unlock(&di->lock);

if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0) - return -ENODEV; + return di->cache.flags;

switch (psp) { case POWER_SUPPLY_PROP_STATUS: diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c index 08c7e2b4155ad..bf235d0a96033 100644 --- a/drivers/power/supply/bq27xxx_battery_i2c.c +++ b/drivers/power/supply/bq27xxx_battery_i2c.c @@ -14,6 +14,7 @@ * GNU General Public License for more details. */

+#include <linux/delay.h> #include <linux/i2c.h> #include <linux/interrupt.h> #include <linux/module.h> @@ -40,6 +41,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, struct i2c_msg msg[2]; u8 data[2]; int ret; + int retry = 0;

if (!client->adapter) return -ENODEV; @@ -56,7 +58,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, else msg[1].len = 2;

- ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); + do { + ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); + if (ret == -EBUSY && ++retry < 3) { + /* sleep 10 milliseconds when busy */ + usleep_range(10000, 11000); + continue; + } + break; + } while (1); + if (ret < 0) return ret;