--- /dev/null
+From 0c9d379d436e119285ef39a4f96b012f576ed74c Mon Sep 17 00:00:00 2001
+From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+Date: Thu, 29 Jan 2026 11:47:35 +0100
+Subject: arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label position
+
+From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+
+commit 0c9d379d436e119285ef39a4f96b012f576ed74c upstream.
+
+Fix the PMIC_SD2_VSEL gpio-line-name position. It should be on line 19
+of gpio3, not line 20.
+
+Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95")
+Cc: stable@vger.kernel.org
+Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi b/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi
+index 5932ba238a8a..f64c05dc50f8 100644
+--- a/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi
+@@ -262,7 +262,6 @@ &gpio3 {
+ "",
+ "",
+ "",
+- "",
+ "PMIC_SD2_VSEL";
+ status = "okay";
+ };
+--
+2.54.0
+
--- /dev/null
+From 70008aee892bbb5c2969bbe9e5778fc081b14bd2 Mon Sep 17 00:00:00 2001
+From: Josua Mayer <josua@solid-run.com>
+Date: Tue, 24 Mar 2026 13:40:55 +0100
+Subject: arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
+
+From: Josua Mayer <josua@solid-run.com>
+
+commit 70008aee892bbb5c2969bbe9e5778fc081b14bd2 upstream.
+
+Commit 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to
+support bus recovery") introduced pinmux nodes for lx2160 i2c
+interfaces, allowing runtime change between i2c and gpio functions
+implementing bus recovery.
+
+However, the dynamic configuration area (overwrite MUX) used by the
+pinctrl-single driver initially reads as zero and does not reflect the
+actual hardware state set by the Reset Configuration Word (RCW) at
+power-on.
+
+Because multiple groups of pins are configured from a single 32-bit
+register, the first write from the pinctrl driver unintentionally clears
+all other bits to zero.
+
+For example, on the LX2162A Clearfog, RCWSR12 is initialized to
+0x08000006. When any i2c pinmux is applied, it clears all other fields.
+This inadvertently disables SD card-detect (IIC2_PMUX) and some GPIOs
+(SDHC1_DIR_PMUX):
+
+LX2162-CF RCWSR12: 0b0000100000000000 0000000000000110
+IIC2_PMUX ||| ||| || | ||| |||XXX : I2C/GPIO/CD-WP
+SDHC1_DIR_PMUX XXX ||| || | ||| ||| : SDHC/GPIO/SPI
+
+Reverting the commit in question was considered but bus recovery is an
+important feature.
+
+Instead add pinmux nodes for those pins that were unintentionally
+reconfigured on SolidRun LX2160A Clearfog-CX and LX2162A Clearfog
+boards.
+
+Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery")
+Cc: stable@vger.kernel.org
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 +++
+ arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 +
+ arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++++++++++++
+ arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 +
+ arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 +++
+ 5 files changed, 42 insertions(+)
+
+--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi
+@@ -162,6 +162,8 @@
+ };
+
+ &fspi {
++ pinctrl-names = "default";
++ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>;
+ status = "okay";
+
+ flash@0 {
+@@ -177,6 +179,11 @@
+ };
+ };
+
++&pinmux_i2crv {
++ pinctrl-names = "default";
++ pinctrl-0 = <&gpio0_14_12_pins>;
++};
++
+ &usb0 {
+ status = "okay";
+ };
+--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi
+@@ -89,6 +89,8 @@
+ };
+
+ &esdhc0 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>;
+ sd-uhs-sdr104;
+ sd-uhs-sdr50;
+ sd-uhs-sdr25;
+--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
+@@ -1721,6 +1721,10 @@
+ pinctrl-single,bits = <0x0 0x1 0x7>;
+ };
+
++ esdhc0_cd_wp_pins: iic2-sdhc-pins {
++ pinctrl-single,bits = <0x0 0x6 0x7>;
++ };
++
+ i2c2_scl: i2c2-scl-pins {
+ pinctrl-single,bits = <0x0 0 (0x7 << 3)>;
+ };
+@@ -1753,6 +1757,26 @@
+ pinctrl-single,bits = <0x0 (0x1 << 12) (0x7 << 12)>;
+ };
+
++ fspi_data74_pins: xspi1-data74-pins {
++ pinctrl-single,bits = <0x0 0x0 (0x7 << 15)>;
++ };
++
++ fspi_data30_pins: xspi1-data30-pins {
++ pinctrl-single,bits = <0x0 0x0 (0x7 << 18)>;
++ };
++
++ fspi_dqs_sck_cs10_pins: xspi1-base-pins {
++ pinctrl-single,bits = <0x0 0x0 (0x7 << 21)>;
++ };
++
++ esdhc0_cmd_data30_clk_vsel_pins: sdhc1-base-sdhc-vsel-pins {
++ pinctrl-single,bits = <0x0 0x0 (0x7 << 24)>;
++ };
++
++ gpio0_14_12_pins: sdhc1-dir-gpio-pins {
++ pinctrl-single,bits = <0x0 (0x1 << 27) (0x7 << 27)>;
++ };
++
+ i2c6_scl: i2c6-scl-pins {
+ pinctrl-single,bits = <0x4 0x2 0x7>;
+ };
+--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts
+@@ -223,6 +223,8 @@
+ };
+
+ &esdhc0 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>;
+ sd-uhs-sdr104;
+ sd-uhs-sdr50;
+ sd-uhs-sdr25;
+--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi
+@@ -30,6 +30,8 @@
+ };
+
+ &fspi {
++ pinctrl-names = "default";
++ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>;
+ status = "okay";
+
+ flash@0 {
+@@ -80,3 +82,8 @@
+ reg = <0x6f>;
+ };
+ };
++
++&pinmux_i2crv {
++ pinctrl-names = "default";
++ pinctrl-0 = <&gpio0_14_12_pins>;
++};
--- /dev/null
+From 8cfb2e517113543e0de9e8df5754d5e09cb3627e Mon Sep 17 00:00:00 2001
+From: Franz Schnyder <franz.schnyder@toradex.com>
+Date: Mon, 2 Feb 2026 09:36:01 +0100
+Subject: arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO
+
+From: Franz Schnyder <franz.schnyder@toradex.com>
+
+commit 8cfb2e517113543e0de9e8df5754d5e09cb3627e upstream.
+
+Correct the DP regulator enable GPIO to index 21.
+The 3.3V DP regulator was not being enabled by the assigned GPIO, as it
+is routed to GPIO index 21 and not 37, which was causing instability
+with displays connected over DP or via an active DP-to-HDMI adapter.
+
+Fixes: 9f748a6177e1 ("arm64: dts: ti: am69-aquila: Add Clover")
+Cc: stable@vger.kernel.org
+Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com>
+Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://patch.msgid.link/20260202083604.325060-3-fra.schnyder@gmail.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts b/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts
+index ec8ff4587715..dc0d3cf2f985 100644
+--- a/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts
++++ b/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts
+@@ -26,7 +26,7 @@ reg_3v3_dp: regulator-3v3-dp {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_21_dp>;
+ /* Aquila GPIO_21_DP (AQUILA B57) */
+- gpio = <&main_gpio0 37 GPIO_ACTIVE_HIGH>;
++ gpio = <&main_gpio0 21 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+--
+2.54.0
+
--- /dev/null
+From 6955d6bca0531ffbbaeecac844b7bae84345b3fb Mon Sep 17 00:00:00 2001
+From: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Date: Tue, 10 Mar 2026 17:02:38 +0530
+Subject: drm/atomic: Add affected colorops with affected planes
+
+From: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+
+commit 6955d6bca0531ffbbaeecac844b7bae84345b3fb upstream.
+
+When drm_atomic_add_affected_planes() adds a plane to the atomic
+state, the associated colorops are not guaranteed to be included.
+This can leave colorop state out of the transaction when planes
+are pulled in implicitly (eg. during modeset or internal commits).
+
+Also add affected colorops when adding affected planes to keep
+plane and color pipeline state consistent within the atomic
+transaction.
+
+v2: Add affected colorops only when a pipeline is enabled
+
+Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property")
+Cc: <stable@vger.kernel.org> #v6.19+
+Reviewed-by: Uma Shankar <uma.shankar@intel.com> #v1
+Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://patch.msgid.link/20260310113238.3495981-3-chaitanya.kumar.borah@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1569,6 +1569,7 @@ drm_atomic_add_affected_planes(struct dr
+ const struct drm_crtc_state *old_crtc_state =
+ drm_atomic_get_old_crtc_state(state, crtc);
+ struct drm_plane *plane;
++ int ret;
+
+ WARN_ON(!drm_atomic_get_new_crtc_state(state, crtc));
+
+@@ -1582,6 +1583,12 @@ drm_atomic_add_affected_planes(struct dr
+
+ if (IS_ERR(plane_state))
+ return PTR_ERR(plane_state);
++
++ if (plane_state->color_pipeline) {
++ ret = drm_atomic_add_affected_colorops(state, plane);
++ if (ret)
++ return ret;
++ }
+ }
+ return 0;
+ }
--- /dev/null
+From 0d9710aeb6959ae244f255986187562fa50504b9 Mon Sep 17 00:00:00 2001
+From: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Date: Tue, 10 Mar 2026 17:02:37 +0530
+Subject: drm/colorop: Preserve bypass value in duplicate_state()
+
+From: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+
+commit 0d9710aeb6959ae244f255986187562fa50504b9 upstream.
+
+__drm_atomic_helper_colorop_duplicate_state() unconditionally
+sets state->bypass = true after copying the existing state.
+
+This override causes the new atomic state to no longer reflect
+the currently committed hardware state. Since the bypass property
+directly controls whether the colorop is active in hardware,
+resetting it to true can inadvertently disable an active colorop
+during a subsequent commit, particularly for internal driver commits
+where userspace does not touch the property.
+
+Drop the unconditional assignment and preserve the duplicated
+bypass value.
+
+Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property")
+Cc: <stable@vger.kernel.org> #v6.19+
+Reviewed-by: Uma Shankar <uma.shankar@intel.com>
+Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://patch.msgid.link/20260310113238.3495981-2-chaitanya.kumar.borah@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_colorop.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_colorop.c
++++ b/drivers/gpu/drm/drm_colorop.c
+@@ -441,8 +441,6 @@ static void __drm_atomic_helper_colorop_
+
+ if (state->data)
+ drm_property_blob_get(state->data);
+-
+- state->bypass = true;
+ }
+
+ struct drm_colorop_state *
--- /dev/null
+From ec49857ad181f2a68a3bea15422f2936ff366d47 Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Fri, 30 Jan 2026 11:49:28 -0800
+Subject: drm/gpusvm: Allow device pages to be mapped in mixed mappings after system pages
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit ec49857ad181f2a68a3bea15422f2936ff366d47 upstream.
+
+The current code rejects device mappings whenever system pages have
+already been encountered. This is not the intended behavior when
+allow_mixed is set.
+
+Relax the restriction by permitting a single pagemap to be selected when
+allow_mixed is enabled, even if system pages were found earlier.
+
+Fixes: bce13d6ecd6c ("drm/gpusvm, drm/xe: Allow mixed mappings for userptr")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Francois Dugast <francois.dugast@intel.com>
+Link: https://patch.msgid.link/20260130194928.3255613-3-matthew.brost@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gpusvm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_gpusvm.c
++++ b/drivers/gpu/drm/drm_gpusvm.c
+@@ -1495,7 +1495,7 @@ map_pages:
+ }
+ zdd = page->zone_device_data;
+ if (pagemap != page_pgmap(page)) {
+- if (i > 0) {
++ if (pagemap) {
+ err = -EOPNOTSUPP;
+ goto err_unmap;
+ }
--- /dev/null
+From 556dba95473900073a6c03121361c11f646dc551 Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Fri, 30 Jan 2026 11:49:27 -0800
+Subject: drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit 556dba95473900073a6c03121361c11f646dc551 upstream.
+
+drm_gpusvm_get_pages() only sets the local flags prior to committing the
+pages. If an error occurs mid-mapping, has_dma_mapping will be clear,
+causing the unmap function to skip unmapping pages that were
+successfully mapped before the error. Fix this by forcibly setting
+has_dma_mapping in the error path to ensure all previously mapped pages
+are properly unmapped.
+
+Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Francois Dugast <francois.dugast@intel.com>
+Link: https://patch.msgid.link/20260130194928.3255613-2-matthew.brost@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gpusvm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/drm_gpusvm.c
++++ b/drivers/gpu/drm/drm_gpusvm.c
+@@ -1572,6 +1572,7 @@ set_seqno:
+ return 0;
+
+ err_unmap:
++ svm_pages->flags.has_dma_mapping = true;
+ __drm_gpusvm_unmap_pages(gpusvm, svm_pages, num_dma_mapped);
+ drm_gpusvm_notifier_unlock(gpusvm);
+ err_free:
--- /dev/null
+From 8c6c93b7db42d15c6e8c2540a648d32986a04b1a Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Date: Wed, 11 Mar 2026 20:16:21 +0100
+Subject: drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+
+commit 8c6c93b7db42d15c6e8c2540a648d32986a04b1a upstream.
+
+Commit 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi
+framework") changed the unconditional register writes in few places to
+updates: read, apply mask, write. The new code reads
+REG_HDMI_INFOFRAME_CTRL1 register, applies fields/mask for
+HDMI_INFOFRAME_CTRL0 register and finally writes to
+HDMI_INFOFRAME_CTRL0. This difference between CTRL1 and CTRL0 looks
+unintended and may result in wrong data being written to HDMI bridge
+registers.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi framework")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/711156/
+Link: https://lore.kernel.org/r/20260311191620.245394-2-krzysztof.kozlowski@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+@@ -153,7 +153,7 @@ static int msm_hdmi_bridge_write_avi_inf
+ for (i = 0; i < ARRAY_SIZE(buf); i++)
+ hdmi_write(hdmi, REG_HDMI_AVI_INFO(i), buf[i]);
+
+- val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL1);
++ val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL0);
+ val |= HDMI_INFOFRAME_CTRL0_AVI_SEND |
+ HDMI_INFOFRAME_CTRL0_AVI_CONT;
+ hdmi_write(hdmi, REG_HDMI_INFOFRAME_CTRL0, val);
+@@ -193,7 +193,7 @@ static int msm_hdmi_bridge_write_audio_i
+ buffer[9] << 16 |
+ buffer[10] << 24);
+
+- val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL1);
++ val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL0);
+ val |= HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SEND |
+ HDMI_INFOFRAME_CTRL0_AUDIO_INFO_CONT |
+ HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SOURCE |
--- /dev/null
+From 4db2af929279c799b5653a39eb0795c72baffca4 Mon Sep 17 00:00:00 2001
+From: Sangyun Kim <sangyun.kim@snu.ac.kr>
+Date: Mon, 20 Apr 2026 14:13:17 +0900
+Subject: HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
+
+From: Sangyun Kim <sangyun.kim@snu.ac.kr>
+
+commit 4db2af929279c799b5653a39eb0795c72baffca4 upstream.
+
+Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in
+appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to
+both the probe close_hw error path and appletb_kbd_remove(), but the
+way it was wired in left the inactivity timer reachable during driver
+tear-down via two distinct windows.
+
+Window A -- put_device() before timer_delete_sync():
+
+ put_device(&kbd->backlight_dev->dev);
+ timer_delete_sync(&kbd->inactivity_timer);
+
+The inactivity_timer softirq reads kbd->backlight_dev and calls
+backlight_device_set_brightness() -> mutex_lock(&ops_lock). If a
+concurrent hid_appletb_bl unbind drops the last devm reference
+between these two calls, the backlight_device is freed and the
+mutex_lock() touches freed memory.
+
+Window B -- backlight cleanup before hid_hw_stop():
+
+ if (kbd->backlight_dev) {
+ timer_delete_sync(...);
+ put_device(...);
+ }
+ hid_hw_close(hdev);
+ hid_hw_stop(hdev);
+
+Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run
+afterwards, so a late ".event" callback from the HID core (USB URB
+completion on real Apple hardware) can arrive after
+timer_delete_sync() drained the softirq but before put_device() drops
+the reference. That callback reaches reset_inactivity_timer(), which
+calls mod_timer() and re-arms the timer. The freshly re-armed timer
+can then fire on the about-to-be-freed backlight_device.
+
+Both windows produce the same KASAN slab-use-after-free:
+
+ BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0
+ Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0
+ Call Trace:
+ <IRQ>
+ __mutex_lock
+ backlight_device_set_brightness
+ appletb_inactivity_timer
+ call_timer_fn
+ run_timer_softirq
+ handle_softirqs
+ Allocated by task N:
+ devm_backlight_device_register
+ appletb_bl_probe
+ Freed by task M:
+ (concurrent hid_appletb_bl unbind path)
+
+Close both windows at once by reworking the tear-down in
+appletb_kbd_remove() and in the probe close_hw error path so that
+
+ 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup,
+ guaranteeing no further .event callback can fire and re-arm the
+ timer, and
+ 2) inside the "if (kbd->backlight_dev)" block, timer_delete_sync()
+ runs before put_device(), so the softirq is drained before the
+ final reference is dropped.
+
+Fixes: 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-appletb-kbd.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/hid/hid-appletb-kbd.c
++++ b/drivers/hid/hid-appletb-kbd.c
+@@ -440,13 +440,13 @@ static int appletb_kbd_probe(struct hid_
+ unregister_handler:
+ input_unregister_handler(&kbd->inp_handler);
+ close_hw:
+- if (kbd->backlight_dev) {
+- put_device(&kbd->backlight_dev->dev);
+- timer_delete_sync(&kbd->inactivity_timer);
+- }
+ hid_hw_close(hdev);
+ stop_hw:
+ hid_hw_stop(hdev);
++ if (kbd->backlight_dev) {
++ timer_delete_sync(&kbd->inactivity_timer);
++ put_device(&kbd->backlight_dev->dev);
++ }
+ return ret;
+ }
+
+@@ -457,13 +457,13 @@ static void appletb_kbd_remove(struct hi
+ appletb_kbd_set_mode(kbd, APPLETB_KBD_MODE_OFF);
+
+ input_unregister_handler(&kbd->inp_handler);
++ hid_hw_close(hdev);
++ hid_hw_stop(hdev);
++
+ if (kbd->backlight_dev) {
+- put_device(&kbd->backlight_dev->dev);
+ timer_delete_sync(&kbd->inactivity_timer);
++ put_device(&kbd->backlight_dev->dev);
+ }
+-
+- hid_hw_close(hdev);
+- hid_hw_stop(hdev);
+ }
+
+ static int appletb_kbd_suspend(struct hid_device *hdev, pm_message_t msg)
--- /dev/null
+From 1654e53349d4e657b331de354313461f401f5063 Mon Sep 17 00:00:00 2001
+From: Sangyun Kim <sangyun.kim@snu.ac.kr>
+Date: Mon, 20 Apr 2026 14:13:18 +0900
+Subject: HID: appletb-kbd: run inactivity autodim from workqueues
+
+From: Sangyun Kim <sangyun.kim@snu.ac.kr>
+
+commit 1654e53349d4e657b331de354313461f401f5063 upstream.
+
+The autodim code in hid-appletb-kbd takes backlight_device->ops_lock
+via backlight_device_set_brightness() -> mutex_lock() from two
+different atomic contexts:
+
+ * appletb_inactivity_timer() is a struct timer_list callback, so it
+ runs in softirq context. Every expiry triggers
+
+ BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
+ Call Trace:
+ <IRQ>
+ __might_resched
+ __mutex_lock
+ backlight_device_set_brightness
+ appletb_inactivity_timer
+ call_timer_fn
+ run_timer_softirq
+
+ * reset_inactivity_timer() is called from appletb_kbd_hid_event() and
+ appletb_kbd_inp_event(). On real USB hardware these run in
+ softirq/IRQ context (URB completion and input-event dispatch).
+ When the Touch Bar has already been dimmed or turned off, the
+ reset path calls backlight_device_set_brightness() directly to
+ restore brightness, producing the same warning.
+
+Both call sites hit the same mutex_lock()-from-atomic bug. Fix them
+together by moving the blocking work onto the system workqueue:
+
+ * Convert the inactivity timer from struct timer_list to
+ struct delayed_work; the callback (appletb_inactivity_work) now
+ runs in process context where mutex_lock() is legal.
+ * Add a dedicated struct work_struct restore_brightness_work and have
+ reset_inactivity_timer() schedule it instead of calling
+ backlight_device_set_brightness() directly.
+
+Cancel both works synchronously during driver tear-down alongside the
+existing backlight reference drop.
+
+The semantics are unchanged (same delays, same state transitions on
+dim, turn-off and user activity); only the execution context of the
+sleeping call changes. The timer field and callback are renamed to
+match their new type; reset_inactivity_timer() keeps its name because
+it is invoked from input event paths that read naturally as "reset
+the inactivity timer".
+
+Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-appletb-kbd.c | 44 ++++++++++++++++++++++++++++--------------
+ 1 file changed, 30 insertions(+), 14 deletions(-)
+
+--- a/drivers/hid/hid-appletb-kbd.c
++++ b/drivers/hid/hid-appletb-kbd.c
+@@ -17,7 +17,7 @@
+ #include <linux/module.h>
+ #include <linux/string.h>
+ #include <linux/backlight.h>
+-#include <linux/timer.h>
++#include <linux/workqueue.h>
+ #include <linux/input/sparse-keymap.h>
+
+ #include "hid-ids.h"
+@@ -62,7 +62,8 @@ struct appletb_kbd {
+ struct input_handle kbd_handle;
+ struct input_handle tpd_handle;
+ struct backlight_device *backlight_dev;
+- struct timer_list inactivity_timer;
++ struct delayed_work inactivity_work;
++ struct work_struct restore_brightness_work;
+ bool has_dimmed;
+ bool has_turned_off;
+ u8 saved_mode;
+@@ -164,16 +165,18 @@ static int appletb_tb_key_to_slot(unsign
+ }
+ }
+
+-static void appletb_inactivity_timer(struct timer_list *t)
++static void appletb_inactivity_work(struct work_struct *work)
+ {
+- struct appletb_kbd *kbd = timer_container_of(kbd, t, inactivity_timer);
++ struct appletb_kbd *kbd = container_of(to_delayed_work(work),
++ struct appletb_kbd,
++ inactivity_work);
+
+ if (kbd->backlight_dev && appletb_tb_autodim) {
+ if (!kbd->has_dimmed) {
+ backlight_device_set_brightness(kbd->backlight_dev, 1);
+ kbd->has_dimmed = true;
+- mod_timer(&kbd->inactivity_timer,
+- jiffies + secs_to_jiffies(appletb_tb_idle_timeout));
++ mod_delayed_work(system_wq, &kbd->inactivity_work,
++ secs_to_jiffies(appletb_tb_idle_timeout));
+ } else if (!kbd->has_turned_off) {
+ backlight_device_set_brightness(kbd->backlight_dev, 0);
+ kbd->has_turned_off = true;
+@@ -181,16 +184,25 @@ static void appletb_inactivity_timer(str
+ }
+ }
+
++static void appletb_restore_brightness_work(struct work_struct *work)
++{
++ struct appletb_kbd *kbd = container_of(work, struct appletb_kbd,
++ restore_brightness_work);
++
++ if (kbd->backlight_dev)
++ backlight_device_set_brightness(kbd->backlight_dev, 2);
++}
++
+ static void reset_inactivity_timer(struct appletb_kbd *kbd)
+ {
+ if (kbd->backlight_dev && appletb_tb_autodim) {
+ if (kbd->has_dimmed || kbd->has_turned_off) {
+- backlight_device_set_brightness(kbd->backlight_dev, 2);
+ kbd->has_dimmed = false;
+ kbd->has_turned_off = false;
++ schedule_work(&kbd->restore_brightness_work);
+ }
+- mod_timer(&kbd->inactivity_timer,
+- jiffies + secs_to_jiffies(appletb_tb_dim_timeout));
++ mod_delayed_work(system_wq, &kbd->inactivity_work,
++ secs_to_jiffies(appletb_tb_dim_timeout));
+ }
+ }
+
+@@ -408,9 +420,11 @@ static int appletb_kbd_probe(struct hid_
+ dev_err_probe(dev, -ENODEV, "Failed to get backlight device\n");
+ } else {
+ backlight_device_set_brightness(kbd->backlight_dev, 2);
+- timer_setup(&kbd->inactivity_timer, appletb_inactivity_timer, 0);
+- mod_timer(&kbd->inactivity_timer,
+- jiffies + secs_to_jiffies(appletb_tb_dim_timeout));
++ INIT_DELAYED_WORK(&kbd->inactivity_work, appletb_inactivity_work);
++ INIT_WORK(&kbd->restore_brightness_work,
++ appletb_restore_brightness_work);
++ mod_delayed_work(system_wq, &kbd->inactivity_work,
++ secs_to_jiffies(appletb_tb_dim_timeout));
+ }
+
+ kbd->inp_handler.event = appletb_kbd_inp_event;
+@@ -444,7 +458,8 @@ close_hw:
+ stop_hw:
+ hid_hw_stop(hdev);
+ if (kbd->backlight_dev) {
+- timer_delete_sync(&kbd->inactivity_timer);
++ cancel_delayed_work_sync(&kbd->inactivity_work);
++ cancel_work_sync(&kbd->restore_brightness_work);
+ put_device(&kbd->backlight_dev->dev);
+ }
+ return ret;
+@@ -461,7 +476,8 @@ static void appletb_kbd_remove(struct hi
+ hid_hw_stop(hdev);
+
+ if (kbd->backlight_dev) {
+- timer_delete_sync(&kbd->inactivity_timer);
++ cancel_delayed_work_sync(&kbd->inactivity_work);
++ cancel_work_sync(&kbd->restore_brightness_work);
+ put_device(&kbd->backlight_dev->dev);
+ }
+ }
--- /dev/null
+From 206342541fc887ae919774a43942dc883161fece Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Mon, 4 May 2026 10:47:23 +0200
+Subject: HID: core: introduce hid_safe_input_report()
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit 206342541fc887ae919774a43942dc883161fece upstream.
+
+hid_input_report() is used in too many places to have a commit that
+doesn't cross subsystem borders. Instead of changing the API, introduce
+a new one when things matters in the transport layers:
+- usbhid
+- i2chid
+
+This effectively revert to the old behavior for those two transport
+layers.
+
+Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-core.c | 25 +++++++++++++++++++++++++
+ drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++++---
+ drivers/hid/usbhid/hid-core.c | 11 ++++++-----
+ include/linux/hid.h | 2 ++
+ 4 files changed, 37 insertions(+), 8 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2177,6 +2177,7 @@ unlock:
+ * @interrupt: distinguish between interrupt and control transfers
+ *
+ * This is data entry for lower layers.
++ * Legacy, please use hid_safe_input_report() instead.
+ */
+ int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
+ int interrupt)
+@@ -2187,6 +2188,30 @@ int hid_input_report(struct hid_device *
+ }
+ EXPORT_SYMBOL_GPL(hid_input_report);
+
++/**
++ * hid_safe_input_report - report data from lower layer (usb, bt...)
++ *
++ * @hid: hid device
++ * @type: HID report type (HID_*_REPORT)
++ * @data: report contents
++ * @bufsize: allocated size of the data buffer
++ * @size: useful size of data parameter
++ * @interrupt: distinguish between interrupt and control transfers
++ *
++ * This is data entry for lower layers.
++ * Please use this function instead of the non safe version because we provide
++ * here the size of the buffer, allowing hid-core to make smarter decisions
++ * regarding the incoming buffer.
++ */
++int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
++ size_t bufsize, u32 size, int interrupt)
++{
++ return __hid_input_report(hid, type, data, bufsize, size, interrupt, 0,
++ false, /* from_bpf */
++ false /* lock_already_taken */);
++}
++EXPORT_SYMBOL_GPL(hid_safe_input_report);
++
+ bool hid_match_one_id(const struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -574,9 +574,10 @@ static void i2c_hid_get_input(struct i2c
+ if (ihid->hid->group != HID_GROUP_RMI)
+ pm_wakeup_event(&ihid->client->dev, 0);
+
+- hid_input_report(ihid->hid, HID_INPUT_REPORT,
+- ihid->inbuf + sizeof(__le16),
+- ret_size - sizeof(__le16), 1);
++ hid_safe_input_report(ihid->hid, HID_INPUT_REPORT,
++ ihid->inbuf + sizeof(__le16),
++ ihid->bufsize - sizeof(__le16),
++ ret_size - sizeof(__le16), 1);
+ }
+
+ return;
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -283,9 +283,9 @@ static void hid_irq_in(struct urb *urb)
+ break;
+ usbhid_mark_busy(usbhid);
+ if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
+- hid_input_report(urb->context, HID_INPUT_REPORT,
+- urb->transfer_buffer,
+- urb->actual_length, 1);
++ hid_safe_input_report(urb->context, HID_INPUT_REPORT,
++ urb->transfer_buffer, urb->transfer_buffer_length,
++ urb->actual_length, 1);
+ /*
+ * autosuspend refused while keys are pressed
+ * because most keyboards don't wake up when
+@@ -482,9 +482,10 @@ static void hid_ctrl(struct urb *urb)
+ switch (status) {
+ case 0: /* success */
+ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
+- hid_input_report(urb->context,
++ hid_safe_input_report(urb->context,
+ usbhid->ctrl[usbhid->ctrltail].report->type,
+- urb->transfer_buffer, urb->actual_length, 0);
++ urb->transfer_buffer, urb->transfer_buffer_length,
++ urb->actual_length, 0);
+ break;
+ case -ESHUTDOWN: /* unplug */
+ unplug = 1;
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -998,6 +998,8 @@ struct hid_field *hid_find_field(struct
+ int hid_set_field(struct hid_field *, unsigned, __s32);
+ int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
+ int interrupt);
++int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
++ size_t bufsize, u32 size, int interrupt);
+ struct hid_field *hidinput_get_led_field(struct hid_device *hid);
+ unsigned int hidinput_count_leds(struct hid_device *hid);
+ __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code);
--- /dev/null
+From 2c85c61d1332e1e16f020d76951baf167dcb6f7a Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Mon, 4 May 2026 10:47:22 +0200
+Subject: HID: pass the buffer size to hid_report_raw_event
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit 2c85c61d1332e1e16f020d76951baf167dcb6f7a upstream.
+
+commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
+bogus memset()") enforced the provided data to be at least the size of
+the declared buffer in the report descriptor to prevent a buffer
+overflow. However, we can try to be smarter by providing both the buffer
+size and the data size, meaning that hid_report_raw_event() can make
+better decision whether we should plaining reject the buffer (buffer
+overflow attempt) or if we can safely memset it to 0 and pass it to the
+rest of the stack.
+
+Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Acked-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/bpf/hid_bpf_dispatch.c | 6 +++--
+ drivers/hid/hid-core.c | 42 ++++++++++++++++++++++++-------------
+ drivers/hid/hid-gfrm.c | 4 +--
+ drivers/hid/hid-logitech-hidpp.c | 2 -
+ drivers/hid/hid-multitouch.c | 2 -
+ drivers/hid/hid-primax.c | 2 -
+ drivers/hid/hid-vivaldi-common.c | 2 -
+ drivers/hid/wacom_sys.c | 6 ++---
+ drivers/staging/greybus/hid.c | 2 -
+ include/linux/hid.h | 4 +--
+ include/linux/hid_bpf.h | 14 +++++++-----
+ 11 files changed, 53 insertions(+), 33 deletions(-)
+
+--- a/drivers/hid/bpf/hid_bpf_dispatch.c
++++ b/drivers/hid/bpf/hid_bpf_dispatch.c
+@@ -24,7 +24,8 @@ EXPORT_SYMBOL(hid_ops);
+
+ u8 *
+ dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type, u8 *data,
+- u32 *size, int interrupt, u64 source, bool from_bpf)
++ size_t *buf_size, u32 *size, int interrupt, u64 source,
++ bool from_bpf)
+ {
+ struct hid_bpf_ctx_kern ctx_kern = {
+ .ctx = {
+@@ -74,6 +75,7 @@ dispatch_hid_bpf_device_event(struct hid
+ *size = ret;
+ }
+
++ *buf_size = ctx_kern.ctx.allocated_size;
+ return ctx_kern.data;
+ }
+ EXPORT_SYMBOL_GPL(dispatch_hid_bpf_device_event);
+@@ -505,7 +507,7 @@ __hid_bpf_input_report(struct hid_bpf_ct
+ if (ret)
+ return ret;
+
+- return hid_ops->hid_input_report(ctx->hid, type, buf, size, 0, (u64)(long)ctx, true,
++ return hid_ops->hid_input_report(ctx->hid, type, buf, size, size, 0, (u64)(long)ctx, true,
+ lock_already_taken);
+ }
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2029,24 +2029,32 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(__hid_request);
+
+-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
+- int interrupt)
++int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
++ size_t bufsize, u32 size, int interrupt)
+ {
+ struct hid_report_enum *report_enum = hid->report_enum + type;
+ struct hid_report *report;
+ struct hid_driver *hdrv;
+ int max_buffer_size = HID_MAX_BUFFER_SIZE;
+ u32 rsize, csize = size;
++ size_t bsize = bufsize;
+ u8 *cdata = data;
+ int ret = 0;
+
+ report = hid_get_report(report_enum, data);
+ if (!report)
+- goto out;
++ return 0;
++
++ if (unlikely(bsize < csize)) {
++ hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n",
++ report->id, csize, bsize);
++ return -EINVAL;
++ }
+
+ if (report_enum->numbered) {
+ cdata++;
+ csize--;
++ bsize--;
+ }
+
+ rsize = hid_compute_report_size(report);
+@@ -2059,11 +2067,16 @@ int hid_report_raw_event(struct hid_devi
+ else if (rsize > max_buffer_size)
+ rsize = max_buffer_size;
+
++ if (bsize < rsize) {
++ hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %ld)\n",
++ report->id, rsize, bsize);
++ return -EINVAL;
++ }
++
+ if (csize < rsize) {
+- hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
+- report->id, rsize, csize);
+- ret = -EINVAL;
+- goto out;
++ dbg_hid("report %d is too short, (%d < %d)\n", report->id,
++ csize, rsize);
++ memset(cdata + csize, 0, rsize - csize);
+ }
+
+ if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
+@@ -2071,7 +2084,7 @@ int hid_report_raw_event(struct hid_devi
+ if (hid->claimed & HID_CLAIMED_HIDRAW) {
+ ret = hidraw_report_event(hid, data, size);
+ if (ret)
+- goto out;
++ return ret;
+ }
+
+ if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) {
+@@ -2083,15 +2096,15 @@ int hid_report_raw_event(struct hid_devi
+
+ if (hid->claimed & HID_CLAIMED_INPUT)
+ hidinput_report_event(hid, report);
+-out:
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(hid_report_raw_event);
+
+
+ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
+- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
+- bool lock_already_taken)
++ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
++ bool from_bpf, bool lock_already_taken)
+ {
+ struct hid_report_enum *report_enum;
+ struct hid_driver *hdrv;
+@@ -2116,7 +2129,8 @@ static int __hid_input_report(struct hid
+ report_enum = hid->report_enum + type;
+ hdrv = hid->driver;
+
+- data = dispatch_hid_bpf_device_event(hid, type, data, &size, interrupt, source, from_bpf);
++ data = dispatch_hid_bpf_device_event(hid, type, data, &bufsize, &size, interrupt,
++ source, from_bpf);
+ if (IS_ERR(data)) {
+ ret = PTR_ERR(data);
+ goto unlock;
+@@ -2145,7 +2159,7 @@ static int __hid_input_report(struct hid
+ goto unlock;
+ }
+
+- ret = hid_report_raw_event(hid, type, data, size, interrupt);
++ ret = hid_report_raw_event(hid, type, data, bufsize, size, interrupt);
+
+ unlock:
+ if (!lock_already_taken)
+@@ -2167,7 +2181,7 @@ unlock:
+ int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
+ int interrupt)
+ {
+- return __hid_input_report(hid, type, data, size, interrupt, 0,
++ return __hid_input_report(hid, type, data, size, size, interrupt, 0,
+ false, /* from_bpf */
+ false /* lock_already_taken */);
+ }
+--- a/drivers/hid/hid-gfrm.c
++++ b/drivers/hid/hid-gfrm.c
+@@ -66,7 +66,7 @@ static int gfrm_raw_event(struct hid_dev
+ switch (data[1]) {
+ case GFRM100_SEARCH_KEY_DOWN:
+ ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_dn,
+- sizeof(search_key_dn), 1);
++ sizeof(search_key_dn), sizeof(search_key_dn), 1);
+ break;
+
+ case GFRM100_SEARCH_KEY_AUDIO_DATA:
+@@ -74,7 +74,7 @@ static int gfrm_raw_event(struct hid_dev
+
+ case GFRM100_SEARCH_KEY_UP:
+ ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_up,
+- sizeof(search_key_up), 1);
++ sizeof(search_key_up), sizeof(search_key_up), 1);
+ break;
+
+ default:
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -3665,7 +3665,7 @@ static int hidpp10_consumer_keys_raw_eve
+ memcpy(&consumer_report[1], &data[3], 4);
+ /* We are called from atomic context */
+ hid_report_raw_event(hidpp->hid_dev, HID_INPUT_REPORT,
+- consumer_report, 5, 1);
++ consumer_report, sizeof(consumer_report), 5, 1);
+
+ return 1;
+ }
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -533,7 +533,7 @@ static void mt_get_feature(struct hid_de
+ }
+
+ ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
+- size, 0);
++ size, size, 0);
+ if (ret)
+ dev_warn(&hdev->dev, "failed to report feature\n");
+ }
+--- a/drivers/hid/hid-primax.c
++++ b/drivers/hid/hid-primax.c
+@@ -44,7 +44,7 @@ static int px_raw_event(struct hid_devic
+ data[0] |= (1 << (data[idx] - 0xE0));
+ data[idx] = 0;
+ }
+- hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, 0);
++ hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, size, 0);
+ return 1;
+
+ default: /* unknown report */
+--- a/drivers/hid/hid-vivaldi-common.c
++++ b/drivers/hid/hid-vivaldi-common.c
+@@ -85,7 +85,7 @@ void vivaldi_feature_mapping(struct hid_
+ }
+
+ ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, report_data,
+- report_len, 0);
++ report_len, report_len, 0);
+ if (ret) {
+ dev_warn(&hdev->dev, "failed to report feature %d\n",
+ field->report->id);
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -90,7 +90,7 @@ static void wacom_wac_queue_flush(struct
+ kfree(buf);
+ continue;
+ }
+- err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, false);
++ err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
+ if (err) {
+ hid_warn(hdev, "%s: unable to flush event due to error %d\n",
+ __func__, err);
+@@ -334,7 +334,7 @@ static void wacom_feature_mapping(struct
+ data, n, WAC_CMD_RETRIES);
+ if (ret == n && features->type == HID_GENERIC) {
+ ret = hid_report_raw_event(hdev,
+- HID_FEATURE_REPORT, data, n, 0);
++ HID_FEATURE_REPORT, data, n, n, 0);
+ } else if (ret == 2 && features->type != HID_GENERIC) {
+ features->touch_max = data[1];
+ } else {
+@@ -395,7 +395,7 @@ static void wacom_feature_mapping(struct
+ data, n, WAC_CMD_RETRIES);
+ if (ret == n) {
+ ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT,
+- data, n, 0);
++ data, n, n, 0);
+ } else {
+ hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
+ __func__);
+--- a/drivers/staging/greybus/hid.c
++++ b/drivers/staging/greybus/hid.c
+@@ -201,7 +201,7 @@ static void gb_hid_init_report(struct gb
+ * we just need to setup the input fields, so using
+ * hid_report_raw_event is safe.
+ */
+- hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, size, 1);
++ hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, ghid->bufsize, size, 1);
+ }
+
+ static void gb_hid_init_reports(struct gb_hid *ghid)
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -1266,8 +1266,8 @@ static inline u32 hid_report_len(struct
+ return DIV_ROUND_UP(report->size, 8) + (report->id > 0);
+ }
+
+-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
+- int interrupt);
++int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
++ size_t bufsize, u32 size, int interrupt);
+
+ /* HID quirks API */
+ unsigned long hid_lookup_quirk(const struct hid_device *hdev);
+--- a/include/linux/hid_bpf.h
++++ b/include/linux/hid_bpf.h
+@@ -72,8 +72,8 @@ struct hid_ops {
+ int (*hid_hw_output_report)(struct hid_device *hdev, __u8 *buf, size_t len,
+ u64 source, bool from_bpf);
+ int (*hid_input_report)(struct hid_device *hid, enum hid_report_type type,
+- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
+- bool lock_already_taken);
++ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
++ bool from_bpf, bool lock_already_taken);
+ struct module *owner;
+ const struct bus_type *bus_type;
+ };
+@@ -200,7 +200,8 @@ struct hid_bpf {
+
+ #ifdef CONFIG_HID_BPF
+ u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
+- u32 *size, int interrupt, u64 source, bool from_bpf);
++ size_t *buf_size, u32 *size, int interrupt, u64 source,
++ bool from_bpf);
+ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
+ unsigned char reportnum, __u8 *buf,
+ u32 size, enum hid_report_type rtype,
+@@ -215,8 +216,11 @@ int hid_bpf_device_init(struct hid_devic
+ const u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, const u8 *rdesc, unsigned int *size);
+ #else /* CONFIG_HID_BPF */
+ static inline u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type,
+- u8 *data, u32 *size, int interrupt,
+- u64 source, bool from_bpf) { return data; }
++ u8 *data, size_t *buf_size, u32 *size,
++ int interrupt, u64 source, bool from_bpf)
++{
++ return data;
++}
+ static inline int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
+ unsigned char reportnum, u8 *buf,
+ u32 size, enum hid_report_type rtype,
--- /dev/null
+From 48d1677779ad6816978ad4a4f7588aec5ec960fe Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomasz=20Paku=C5=82a?= <tomasz.pakula.oficjalny@gmail.com>
+Date: Sun, 10 May 2026 14:23:52 +0200
+Subject: HID: pidff: Fix integer overflow in pidff_rescale
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+commit 48d1677779ad6816978ad4a4f7588aec5ec960fe upstream.
+
+Rescaling values close to the max (U16_MAX) temporarily creates values
+that exceed the s32 range. This caused value overflow in case when, for
+example, a periodic effect phase was higer than 180 degrees. In turn,
+rescale function could return values outised of the logical range of the
+HID field.
+
+Fix by using 64 bit signed integer to store the value during calculation
+but still return only 32 bit integer.
+
+Closes: https://github.com/JacKeTUs/universal-pidff/issues/116
+Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/usbhid/hid-pidff.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -11,6 +11,7 @@
+ #include "hid-pidff.h"
+ #include <linux/hid.h>
+ #include <linux/input.h>
++#include <linux/math64.h>
+ #include <linux/minmax.h>
+ #include <linux/slab.h>
+ #include <linux/usb.h>
+@@ -325,8 +326,10 @@ static s32 pidff_clamp(s32 i, struct hid
+ */
+ static int pidff_rescale(int i, int max, struct hid_field *field)
+ {
+- return i * (field->logical_maximum - field->logical_minimum) / max +
+- field->logical_minimum;
++ /* 64 bits needed for big values during rescale */
++ s64 result = field->logical_maximum - field->logical_minimum;
++
++ return div_s64(result * i, max) + field->logical_minimum;
+ }
+
+ /*
--- /dev/null
+From cac61b58a3b6340c52afa06bb15eac033158db2f Mon Sep 17 00:00:00 2001
+From: "T.J. Mercier" <tjmercier@google.com>
+Date: Fri, 17 Apr 2026 08:47:02 -0700
+Subject: HID: playstation: Clamp num_touch_reports
+
+From: T.J. Mercier <tjmercier@google.com>
+
+commit cac61b58a3b6340c52afa06bb15eac033158db2f upstream.
+
+A device would never lie about the number of touch reports would it?
+
+If it does the loop in dualshock4_parse_report will read off the end of
+the touch_reports array, up to about 2 KiB for the maximum number of 256
+loop iteraions. The data that is read is emitted via evdev if the
+DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by
+clamping the num_touch_reports value provided by the device to the
+maximum size of the touch_reports array.
+
+Fixes: 752038248808 ("HID: playstation: add DualShock4 touchpad support.")
+Cc: stable@vger.kernel.org
+Reported-by: Xingyu Jin <xingyuj@google.com>
+Signed-off-by: T.J. Mercier <tjmercier@google.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-playstation.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-playstation.c
++++ b/drivers/hid/hid-playstation.c
+@@ -2378,7 +2378,8 @@ static int dualshock4_parse_report(struc
+ (struct dualshock4_input_report_usb *)data;
+
+ ds4_report = &usb->common;
+- num_touch_reports = usb->num_touch_reports;
++ num_touch_reports = min_t(u8, usb->num_touch_reports,
++ ARRAY_SIZE(usb->touch_reports));
+ touch_reports = usb->touch_reports;
+ } else if (hdev->bus == BUS_BLUETOOTH && report->id == DS4_INPUT_REPORT_BT &&
+ size == DS4_INPUT_REPORT_BT_SIZE) {
+@@ -2392,7 +2393,8 @@ static int dualshock4_parse_report(struc
+ }
+
+ ds4_report = &bt->common;
+- num_touch_reports = bt->num_touch_reports;
++ num_touch_reports = min_t(u8, bt->num_touch_reports,
++ ARRAY_SIZE(bt->touch_reports));
+ touch_reports = bt->touch_reports;
+ } else if (hdev->bus == BUS_BLUETOOTH &&
+ report->id == DS4_INPUT_REPORT_BT_MINIMAL &&
--- /dev/null
+From cb8bdd3ffca280d014311ab395651d33f58a8708 Mon Sep 17 00:00:00 2001
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Date: Sat, 31 Jan 2026 22:19:07 +0000
+Subject: media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+commit cb8bdd3ffca280d014311ab395651d33f58a8708 upstream.
+
+Add spin_lock_irqsave()/spin_unlock_irqrestore() around the
+handle_dynamic_resolution_change() call in initialize_sequence() to fix
+the missing lock protection.
+
+initialize_sequence() calls handle_dynamic_resolution_change() without
+holding inst->state_spinlock. However, handle_dynamic_resolution_change()
+has lockdep_assert_held(&inst->state_spinlock) indicating that callers
+must hold this lock.
+
+Other callers of handle_dynamic_resolution_change() properly acquire the
+spinlock:
+- wave5_vpu_dec_finish_decode()
+- wave5_vpu_dec_device_run()
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+@@ -1593,6 +1593,7 @@ static int initialize_sequence(struct vp
+ {
+ struct dec_initial_info initial_info;
+ int ret = 0;
++ unsigned long flags;
+
+ memset(&initial_info, 0, sizeof(struct dec_initial_info));
+
+@@ -1614,7 +1615,9 @@ static int initialize_sequence(struct vp
+ return ret;
+ }
+
++ spin_lock_irqsave(&inst->state_spinlock, flags);
+ handle_dynamic_resolution_change(inst);
++ spin_unlock_irqrestore(&inst->state_spinlock, flags);
+
+ return 0;
+ }
--- /dev/null
+From f48050436746be75227fbc90066a8658cbe94d17 Mon Sep 17 00:00:00 2001
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Date: Sat, 31 Jan 2026 22:03:23 +0000
+Subject: media: chips-media: wave5: add missing spinlock protection for send_eos_event()
+
+From: Ziyi Guo <n7l8m4@u.northwestern.edu>
+
+commit f48050436746be75227fbc90066a8658cbe94d17 upstream.
+
+Add spin_lock_irqsave()/spin_unlock_irqrestore() around send_eos_event()
+calls in the VB2 buffer queue and streamoff callbacks to fix the missing
+lock protection.
+
+wave5_vpu_dec_buf_queue_dst() and streamoff_output() call send_eos_event()
+without holding inst->state_spinlock. However, send_eos_event() has
+lockdep_assert_held(&inst->state_spinlock) indicating that callers must
+hold this lock.
+
+Other callers of send_eos_event() properly acquire the spinlock:
+- wave5_vpu_dec_finish_decode() acquires lock at line 431
+- wave5_vpu_dec_encoder_cmd() acquires lock at line 821
+- wave5_vpu_dec_device_run() acquires lock at line 1592
+
+Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+@@ -1303,13 +1303,17 @@ static void wave5_vpu_dec_buf_queue_dst(
+
+ if (vb2_is_streaming(vb->vb2_queue) && v4l2_m2m_dst_buf_is_last(m2m_ctx)) {
+ unsigned int i;
++ unsigned long flags;
+
+ for (i = 0; i < vb->num_planes; i++)
+ vb2_set_plane_payload(vb, i, 0);
+
+ vbuf->field = V4L2_FIELD_NONE;
+
++ spin_lock_irqsave(&inst->state_spinlock, flags);
+ send_eos_event(inst);
++ spin_unlock_irqrestore(&inst->state_spinlock, flags);
++
+ v4l2_m2m_last_buffer_done(m2m_ctx, vbuf);
+ } else {
+ v4l2_m2m_buf_queue(m2m_ctx, vbuf);
+@@ -1462,8 +1466,13 @@ static int streamoff_output(struct vb2_q
+ inst->codec_info->dec_info.stream_rd_ptr = new_rd_ptr;
+ inst->codec_info->dec_info.stream_wr_ptr = new_rd_ptr;
+
+- if (v4l2_m2m_has_stopped(m2m_ctx))
++ if (v4l2_m2m_has_stopped(m2m_ctx)) {
++ unsigned long flags;
++
++ spin_lock_irqsave(&inst->state_spinlock, flags);
+ send_eos_event(inst);
++ spin_unlock_irqrestore(&inst->state_spinlock, flags);
++ }
+
+ /* streamoff on output cancels any draining operation */
+ inst->eos = false;
--- /dev/null
+From 95bd174a453f77b09ea66e1e22834680754ba501 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Sun, 25 Jan 2026 22:19:15 +0800
+Subject: media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 95bd174a453f77b09ea66e1e22834680754ba501 upstream.
+
+Add wave5_vdi_free_dma_memory() in the error path of
+wave5_vdi_init() to prevent a potential memory leak.
+
+Fixes: 45d1a2b93277 ("media: chips-media: wave5: Add vpuapi layer")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vdi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/chips-media/wave5/wave5-vdi.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vdi.c
+@@ -49,6 +49,7 @@ int wave5_vdi_init(struct device *dev)
+
+ if (!PRODUCT_CODE_W_SERIES(vpu_dev->product_code)) {
+ WARN_ONCE(1, "unsupported product code: 0x%x\n", vpu_dev->product_code);
++ wave5_vdi_free_dma_memory(vpu_dev, &vpu_dev->common_mem);
+ return -EOPNOTSUPP;
+ }
+
--- /dev/null
+From 35c8178ed2bd9821a75a406d762b2f2e161f9c70 Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Wed, 4 Mar 2026 23:00:41 +0200
+Subject: media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88}
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+commit 35c8178ed2bd9821a75a406d762b2f2e161f9c70 upstream.
+
+With the introduction of the RK3588 SoC, and RK3576 afterwards, three
+register blocks have been provided for the video decoder unit instead of
+just one, which are further referenced in vendor's datasheet by 'link
+table', 'function' and 'cache'. The former is present at the top of the
+listing, starting at video decoder unit base address.
+
+However, while documenting RK3588, the binding broke the convention
+expecting the unit address to indicate the start of the primary register
+range, i.e. the 'function' block got listed before the 'link' one.
+
+Since the binding changes have been already released and a fix would
+bring up an ABI break, mark the current 'reg-names' ordering as
+deprecated and introduce an alternative 'link,function,cache' listing
+which follows the address-based ordering according to the TRM.
+
+Additionally, drop the 'reg' description items as the order is not fixed
+anymore, while the information they offer is not very relevant anyway.
+
+It's worth noting there are currently no (known) users impacted by these
+binding changes, since the video decoder support for the aforementioned
+SoCs in mainline driver and devicetrees hasn't been released yet - it
+landed in v7.0-rc1 while all DTS updates resulting from this will be
+handled before v7.0 is out.
+
+Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings")
+Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings")
+Cc: stable@vger.kernel.org
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/media/rockchip,vdec.yaml | 20 +++++++------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
++++ b/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
+@@ -28,16 +28,20 @@ properties:
+
+ reg:
+ minItems: 1
+- items:
+- - description: The function configuration registers base
+- - description: The link table configuration registers base
+- - description: The cache configuration registers base
++ maxItems: 3
+
+ reg-names:
+- items:
+- - const: function
+- - const: link
+- - const: cache
++ oneOf:
++ - items:
++ - const: link
++ - const: function
++ - const: cache
++ - items:
++ - const: function
++ - const: link
++ - const: cache
++ deprecated: true
++ description: Use link,function,cache block order instead.
+
+ interrupts:
+ maxItems: 1
--- /dev/null
+From a11db8d8b403eba1f82728f440727128e9997edd Mon Sep 17 00:00:00 2001
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Date: Wed, 4 Mar 2026 23:00:40 +0200
+Subject: media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88}
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+commit a11db8d8b403eba1f82728f440727128e9997edd upstream.
+
+The Rockchip Video Decoder driver expects reg-names to be mandatory for
+RK3576 and RK3588 SoCs, however the binding does not currently require
+the use of them.
+
+As a consequence, driver would fail to probe with a hypothetical
+devicetree that doesn't provide the reg-names for these SoCs, but which
+is otherwise a perfectly valid DT from the binding perspective.
+
+Update the binding and make reg-names required for the aforementioned
+SoCs. While this change introduces an ABI break, the expected impact on
+potential users would be minimal, if any, since the old SoCs are
+unaffected, while the video decoder support for these newer variants in
+mainline driver and devicetrees hasn't been released yet.
+
+Moreover, this is also a prerequisite for a subsequent binding update
+introducing an alternative reg-names order, according to the
+address-based listing in the vendor's datasheet.
+
+Reported-by: Conor Dooley <conor@kernel.org>
+Closes: https://lore.kernel.org/all/20260227-urologist-gratitude-7984733f2d41@spud/
+Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings")
+Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/media/rockchip,vdec.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
++++ b/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
+@@ -127,6 +127,8 @@ allOf:
+ minItems: 5
+ reset-names:
+ minItems: 5
++ required:
++ - reg-names
+ else:
+ properties:
+ reg:
--- /dev/null
+From bce1349dbf6348ddee47308e2ed08878356de317 Mon Sep 17 00:00:00 2001
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+Date: Sat, 14 Feb 2026 18:35:21 +0530
+Subject: media: i2c: imx283: Enter full standby when stopping streaming
+
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+
+commit bce1349dbf6348ddee47308e2ed08878356de317 upstream.
+
+Use IMX283_STANDBY (bit 0) instead of IMX283_STBLOGIC (bit 1) when
+stopping streaming. STBLOGIC only puts the sensor logic into standby but
+leaves the MIPI interface (along with other components) in an
+indeterminate state.
+
+This (presumably) causes the CSI receiver (e.g. Raspberry Pi's CFE) to
+miss the LP-11 to HS transition when streaming restarts, resulting in a
+hang of 10+ seconds. The issue is most visible when immediately
+restarting a full-resolution stream after stopping a 3x3 binned one, so
+that runtime suspend hasn't yet been triggered.
+
+Writing IMX283_STANDBY puts the entire sensor into standby. The
+imx283_standby_cancel() sequence already handles the full wakeup from
+this suspended state.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/raspberrypi/linux/issues/7153
+Link: https://github.com/will127534/OneInchEye/issues/12
+Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver")
+Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
+Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/imx283.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx283.c
++++ b/drivers/media/i2c/imx283.c
+@@ -1158,7 +1158,7 @@ static int imx283_disable_streams(struct
+ if (pad != IMAGE_PAD)
+ return -EINVAL;
+
+- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STBLOGIC, NULL);
++ ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL);
+ if (ret)
+ dev_err(imx283->dev, "Failed to stop stream\n");
+
--- /dev/null
+From 9206359b2c396ff594adf39bc7daaadab0fcb367 Mon Sep 17 00:00:00 2001
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+Date: Sat, 14 Feb 2026 18:35:22 +0530
+Subject: media: i2c: imx283: Fix hang when going from large to small resolution
+
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+
+commit 9206359b2c396ff594adf39bc7daaadab0fcb367 upstream.
+
+When switching between modes (e.g. full resolution to binned),
+standby_cancel() previously cleared XMSTA (starting master mode data
+output) before the new mode's MDSEL, crop, and timing registers were
+programmed in start_streaming(). This caused the sensor to briefly
+output MIPI data using the previous mode's configuration.
+
+On receivers like imx-mipi-csis, this leads to FIFO overflow errors
+when switching from a higher to a lower resolution, as the receiver is
+configured for the new smaller frame size but receives stale
+full-resolution data.
+
+Fix this by moving the XMSTA and SYNCDRV register writes from
+standby_cancel() to the end of start_streaming(), after all mode,
+crop, and timing registers have been configured. Also explicitly stop
+master mode (XMSTA=1) when stopping the stream, matching the pattern
+used by other Sony sensor drivers (imx290, imx415).
+
+Use named macros IMX283_XMSTA_START/STOP instead of raw 0/BIT(0) for
+readability.
+
+Cc: stable@vger.kernel.org
+Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver")
+Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
+Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/imx283.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx283.c
++++ b/drivers/media/i2c/imx283.c
+@@ -129,7 +129,8 @@
+
+ /* Master Mode Operation Control */
+ #define IMX283_REG_XMSTA CCI_REG8(0x3105)
+-#define IMX283_XMSTA BIT(0)
++#define IMX283_XMSTA_START 0
++#define IMX283_XMSTA_STOP BIT(0)
+
+ #define IMX283_REG_SYNCDRV CCI_REG8(0x3107)
+ #define IMX283_SYNCDRV_XHS_XVS (0xa0 | 0x02)
+@@ -1023,8 +1024,6 @@ static int imx283_standby_cancel(struct
+ usleep_range(19000, 20000);
+
+ cci_write(imx283->cci, IMX283_REG_CLAMP, IMX283_CLPSQRST, &ret);
+- cci_write(imx283->cci, IMX283_REG_XMSTA, 0, &ret);
+- cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret);
+
+ return ret;
+ }
+@@ -1117,6 +1116,10 @@ static int imx283_start_streaming(struct
+ /* Apply customized values from controls (HMAX/VMAX/SHR) */
+ ret = __v4l2_ctrl_handler_setup(imx283->sd.ctrl_handler);
+
++ /* Start master mode */
++ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_START, &ret);
++ cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret);
++
+ return ret;
+ }
+
+@@ -1153,12 +1156,14 @@ static int imx283_disable_streams(struct
+ u64 streams_mask)
+ {
+ struct imx283 *imx283 = to_imx283(sd);
+- int ret;
++ int ret = 0;
+
+ if (pad != IMAGE_PAD)
+ return -EINVAL;
+
+- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL);
++ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_STOP, &ret);
++ cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, &ret);
++
+ if (ret)
+ dev_err(imx283->dev, "Failed to stop stream\n");
+
--- /dev/null
+From f11ae9c04f8368a3b5a0280ef595198dace1c983 Mon Sep 17 00:00:00 2001
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+Date: Wed, 25 Feb 2026 16:56:21 +0800
+Subject: media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+commit f11ae9c04f8368a3b5a0280ef595198dace1c983 upstream.
+
+Three control cases (AUTOGAIN, EXPOSURE_AUTO, ANALOGUE_GAIN) directly
+return without calling pm_runtime_put(), causing runtime PM reference
+count leaks.
+
+Change these cases from 'return' to 'ret = ... break' pattern to ensure
+pm_runtime_put() is always called before function exit.
+
+Fixes: 4f66f36388d5 ("media: i2c: ov5647: Convert to CCI register access helpers")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Reviewed-by: Tarang Raval <tarang.raval@siliconsignals.io>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ov5647.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
+index 6a46ef7233ac..db9bd2892140 100644
+--- a/drivers/media/i2c/ov5647.c
++++ b/drivers/media/i2c/ov5647.c
+@@ -967,21 +967,21 @@ static int ov5647_s_ctrl(struct v4l2_ctrl *ctrl)
+ break;
+ case V4L2_CID_AUTOGAIN:
+ /* Non-zero turns on AGC by clearing bit 1.*/
+- return cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(1),
+- ctrl->val ? 0 : BIT(1), NULL);
++ ret = cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(1),
++ ctrl->val ? 0 : BIT(1), NULL);
+ break;
+ case V4L2_CID_EXPOSURE_AUTO:
+ /*
+ * Everything except V4L2_EXPOSURE_MANUAL turns on AEC by
+ * clearing bit 0.
+ */
+- return cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(0),
+- ctrl->val == V4L2_EXPOSURE_MANUAL ? BIT(0) : 0, NULL);
++ ret = cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(0),
++ ctrl->val == V4L2_EXPOSURE_MANUAL ? BIT(0) : 0, NULL);
+ break;
+ case V4L2_CID_ANALOGUE_GAIN:
+ /* 10 bits of gain, 2 in the high register. */
+- return cci_write(sensor->regmap, OV5647_REG_GAIN,
+- ctrl->val & 0x3ff, NULL);
++ ret = cci_write(sensor->regmap, OV5647_REG_GAIN,
++ ctrl->val & 0x3ff, NULL);
+ break;
+ case V4L2_CID_EXPOSURE:
+ /*
+--
+2.54.0
+
--- /dev/null
+From f75e160745663ce9b13362ae6e90bd439c58df69 Mon Sep 17 00:00:00 2001
+From: Alexander Koskovich <akoskovich@pm.me>
+Date: Thu, 12 Mar 2026 17:16:20 +0000
+Subject: media: i2c: ov8856: free control handler on error in ov8856_init_controls()
+
+From: Alexander Koskovich <akoskovich@pm.me>
+
+commit f75e160745663ce9b13362ae6e90bd439c58df69 upstream.
+
+The control handler wasn't freed if adding controls failed, add an error
+exit label and convert the existing error return to use it.
+
+Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor")
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Koskovich <akoskovich@pm.me>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ov8856.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ov8856.c
++++ b/drivers/media/i2c/ov8856.c
+@@ -1951,12 +1951,18 @@ static int ov8856_init_controls(struct o
+ V4L2_CID_HFLIP, 0, 1, 1, 0);
+ v4l2_ctrl_new_std(ctrl_hdlr, &ov8856_ctrl_ops,
+ V4L2_CID_VFLIP, 0, 1, 1, 0);
+- if (ctrl_hdlr->error)
+- return ctrl_hdlr->error;
++ if (ctrl_hdlr->error) {
++ ret = ctrl_hdlr->error;
++ goto err_ctrl_handler_free;
++ }
+
+ ov8856->sd.ctrl_handler = ctrl_hdlr;
+
+ return 0;
++
++err_ctrl_handler_free:
++ v4l2_ctrl_handler_free(ctrl_hdlr);
++ return ret;
+ }
+
+ static void ov8856_update_pad_format(struct ov8856 *ov8856,
--- /dev/null
+From 8dd088b8b106f7b119664f965b691785998edcfb Mon Sep 17 00:00:00 2001
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+Date: Fri, 6 Mar 2026 21:03:55 -0600
+Subject: media: intel/ipu6: fix error pointer dereference
+
+From: Ethan Tidmore <ethantidmore06@gmail.com>
+
+commit 8dd088b8b106f7b119664f965b691785998edcfb upstream.
+
+In a error path isp->psys is confirmed to be an error pointer not NULL so
+this condition is true and the error pointer is dereferenced. So isp-psys
+should be set to NULL before going to out_ipu6_bus_del_devices.
+
+Detected by Smatch:
+drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error:
+'isp->psys' dereferencing possible ERR_PTR()
+
+Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
+[Sakari Ailus: Fix commit message.]
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/pci/intel/ipu6/ipu6.c
++++ b/drivers/media/pci/intel/ipu6/ipu6.c
+@@ -686,7 +686,7 @@ out_free_irq:
+ out_ipu6_rpm_put:
+ pm_runtime_put_sync(&isp->psys->auxdev.dev);
+ out_ipu6_bus_del_devices:
+- if (isp->psys) {
++ if (!IS_ERR_OR_NULL(isp->psys)) {
+ ipu6_cpd_free_pkg_dir(isp->psys);
+ ipu6_buttress_unmap_fw_image(isp->psys, &isp->psys->fw_sgt);
+ }
--- /dev/null
+From 2c10400e4a233200046d023ab2377bc56fd48dea Mon Sep 17 00:00:00 2001
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Date: Wed, 25 Feb 2026 21:30:54 +0100
+Subject: media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340 and XPS 14 9440
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+commit 2c10400e4a233200046d023ab2377bc56fd48dea upstream.
+
+The Dell XPS 13 9340 and XPS 14 9440 have an upside-down mounted OV02C10
+sensor, just like the XPS 13 9350 and XPS 16 9640 models.
+
+Extend the existing DMI matches for handling these laptops with DMI
+matches for these 2 models
+
+Reported-by: Heimir Thor Sverrisson <heimir.sverrisson@gmail.com> # XPS 14 9440
+Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2440581 # XPS 13 9340
+Fixes: d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/intel/ipu-bridge.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/media/pci/intel/ipu-bridge.c
++++ b/drivers/media/pci/intel/ipu-bridge.c
+@@ -107,10 +107,24 @@ static const struct dmi_system_id upside
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS 13 9340"),
++ },
++ .driver_data = "OVTI02C1",
++ },
++ {
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS 13 9350"),
+ },
+ .driver_data = "OVTI02C1",
+ },
++ {
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS 14 9440"),
++ },
++ .driver_data = "OVTI02C1",
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
--- /dev/null
+From db7faf488ecf846c46884310ff1bf28daf2ad39a Mon Sep 17 00:00:00 2001
+From: Daniel Scally <dan.scally@ideasonboard.com>
+Date: Thu, 12 Feb 2026 11:03:09 +0000
+Subject: media: mali-c55: Fix Iridix bypass macros
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Scally <dan.scally@ideasonboard.com>
+
+commit db7faf488ecf846c46884310ff1bf28daf2ad39a upstream.
+
+The Mali C55 Iridix block has a digital gain function and tone mapping
+function, whose enablement is controlled by two different bits
+in the BYPASS_3 register.
+
+Unfortunately, the "Gain" and "Tonemap" bypass bit definitions are the
+wrong way around. Swap them.
+
+Cc: stable@vger.kernel.org
+Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
+Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
+Reviewed-by: Barnabás Pőcze <barnabas.pocze@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/arm/mali-c55/mali-c55-registers.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/arm/mali-c55/mali-c55-registers.h
++++ b/drivers/media/platform/arm/mali-c55/mali-c55-registers.h
+@@ -128,8 +128,8 @@ enum mali_c55_interrupts {
+ #define MALI_C55_REG_BYPASS_3_SENSOR_OFFSET_PRE_SH BIT(1)
+ #define MALI_C55_REG_BYPASS_3_MESH_SHADING BIT(3)
+ #define MALI_C55_REG_BYPASS_3_WHITE_BALANCE BIT(4)
+-#define MALI_C55_REG_BYPASS_3_IRIDIX BIT(5)
+-#define MALI_C55_REG_BYPASS_3_IRIDIX_GAIN BIT(6)
++#define MALI_C55_REG_BYPASS_3_IRIDIX_GAIN BIT(5)
++#define MALI_C55_REG_BYPASS_3_IRIDIX BIT(6)
+ #define MALI_C55_REG_BYPASS_4 0x18ec0
+ #define MALI_C55_REG_BYPASS_4_DEMOSAIC_RGB BIT(1)
+ #define MALI_C55_REG_BYPASS_4_PF_CORRECTION BIT(3)
--- /dev/null
+From df16624248296ce4e8890c7ddcc95f0ccb642bcd Mon Sep 17 00:00:00 2001
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Date: Mon, 19 Jan 2026 11:00:23 +0100
+Subject: media: mali-c55: Fix wrong comment of ISP block types
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+commit df16624248296ce4e8890c7ddcc95f0ccb642bcd upstream.
+
+Some bad copy&paste happened in the description of the ISP block types
+and AWB_CONFIG got mixed up with SHADING_CONFIG.
+
+Fix it by assigning to each block the correct type.
+
+As only the comment is changed, there is no uABI breakage or regression.
+
+Cc: stable@vger.kernel.org
+Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Reviewed-by: Barnabás Pőcze <barnabas.pocze@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/arm/mali-c55/mali-c55-params.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
+index be0e909bcf29..c03a6120ddbf 100644
+--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c
++++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
+@@ -43,9 +43,9 @@
+ * @digital_gain: For header->type == MALI_C55_PARAM_BLOCK_DIGITAL_GAIN
+ * @awb_gains: For header->type == MALI_C55_PARAM_BLOCK_AWB_GAINS and
+ * header->type = MALI_C55_PARAM_BLOCK_AWB_GAINS_AEXP
+- * @awb_config: For header->type == MALI_C55_PARAM_MESH_SHADING_CONFIG
+- * @shading_config: For header->type == MALI_C55_PARAM_MESH_SHADING_SELECTION
+- * @shading_selection: For header->type == MALI_C55_PARAM_BLOCK_SENSOR_OFFS
++ * @awb_config: For header->type == MALI_C55_PARAM_BLOCK_AWB_CONFIG
++ * @shading_config: For header->type == MALI_C55_PARAM_MESH_SHADING_CONFIG
++ * @shading_selection: For header->type == MALI_C55_PARAM_MESH_SHADING_SELECTION
+ * @data: Allows easy initialisation of a union variable with a
+ * pointer into a __u8 array.
+ */
+--
+2.54.0
+
--- /dev/null
+From 26ad493bea57efdccc32ffedbf731da2b7463b6c Mon Sep 17 00:00:00 2001
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Date: Mon, 19 Jan 2026 12:50:26 +0100
+Subject: media: mali-c55: Fully reset the ISP configuration
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+commit 26ad493bea57efdccc32ffedbf731da2b7463b6c upstream.
+
+The Mali C55 driver uses an auto-suspend delay of 2000 milli-seconds.
+
+As the delay is quite large, it is certainly possible that two
+consecutive calls to enable_streams() do not go through a suspend of the
+peripheral, meaning we cannot rely on POW register values for the ISP
+configuration.
+
+To prevent a streaming session to be initialized with settings from the
+previous one, reset the full ISP configuration to know state disabling or
+bypassing all the ISP blocks the driver supports.
+
+Cc: stable@vger.kernel.org
+Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../platform/arm/mali-c55/mali-c55-params.c | 50 +++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
+index c84a6047a570..773e5b6a2b7e 100644
+--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c
++++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
+@@ -781,6 +781,43 @@ void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55,
+ MALI_C55_REG_BYPASS_3_SQUARE_BE,
+ MALI_C55_REG_BYPASS_3_SQUARE_BE);
+
++ /* Bypass the sensor offset correction (BLS) module */
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_3,
++ MALI_C55_REG_BYPASS_3_SENSOR_OFFSET_PRE_SH,
++ MALI_C55_REG_BYPASS_3_SENSOR_OFFSET_PRE_SH);
++
++ /* Configure 1x digital gain. */
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_DIGITAL_GAIN,
++ MALI_C55_DIGITAL_GAIN_MASK, 256);
++
++ /* Set all AWB gains to 1x. at both AWB configuration points*/
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1,
++ MALI_C55_AWB_GAIN00_MASK, 256);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1,
++ MALI_C55_AWB_GAIN01_MASK,
++ MALI_C55_AWB_GAIN01(256));
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2,
++ MALI_C55_AWB_GAIN10_MASK, 256);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2,
++ MALI_C55_AWB_GAIN11_MASK,
++ MALI_C55_AWB_GAIN11(256));
++
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1_AEXP,
++ MALI_C55_AWB_GAIN00_MASK, 256);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1_AEXP,
++ MALI_C55_AWB_GAIN01_MASK,
++ MALI_C55_AWB_GAIN01(256));
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2_AEXP,
++ MALI_C55_AWB_GAIN10_MASK, 256);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2_AEXP,
++ MALI_C55_AWB_GAIN11_MASK,
++ MALI_C55_AWB_GAIN11(256));
++
++ /* Bypass mesh shading corrections (LSC). */
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_MESH_SHADING_CONFIG,
++ MALI_C55_MESH_SHADING_ENABLE_MASK,
++ false);
++
+ /* Bypass the temper module */
+ mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_2,
+ MALI_C55_REG_BYPASS_2_TEMPER);
+@@ -802,6 +839,19 @@ void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55,
+
+ /* Disable the colour correction matrix */
+ mali_c55_ctx_write(mali_c55, MALI_C55_REG_CCM_ENABLE, 0);
++
++ /* Disable AWB stats. */
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_METERING_CONFIG,
++ MALI_C55_AWB_DISABLE_MASK,
++ MALI_C55_AWB_DISABLE_MASK);
++
++ /* Disable auto-exposure 1024-bin histograms at both tap points. */
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_METERING_CONFIG,
++ MALI_C55_AEXP_HIST_DISABLE_MASK,
++ MALI_C55_AEXP_HIST_DISABLE);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_METERING_CONFIG,
++ MALI_C55_AEXP_IHIST_DISABLE_MASK,
++ MALI_C55_AEXP_IHIST_DISABLE);
+ }
+
+ void mali_c55_unregister_params(struct mali_c55 *mali_c55)
+--
+2.54.0
+
--- /dev/null
+From d5c24b71da547fdb5bea51a69d62f9e2a609431d Mon Sep 17 00:00:00 2001
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Date: Mon, 19 Jan 2026 12:20:56 +0100
+Subject: media: mali-c55: Initialize the ISP in enable_streams()
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+commit d5c24b71da547fdb5bea51a69d62f9e2a609431d upstream.
+
+The Mali C55 driver initializes the ISP in two points:
+
+1) At probe time it disables ISP blocks by configuring them in bypass
+ mode
+2) At enable_streams() it initializes the crop rectangles and the image
+ processing pipeline using the current image format
+
+However, as ISP blocks are configured by userspace, if their
+configuration is not reset, from the second enable_streams() call
+onwards the ISP configuration will depend on the previous streaming
+session configuration.
+
+To re-initialize the ISP completely at enable_streams() time consolidate
+the ISP block bypass configuration and the image processing path
+configuration in a single function to be called at enabled_streams()
+time.
+
+Cc: stable@vger.kernel.org
+Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/arm/mali-c55/mali-c55-common.h | 2
+ drivers/media/platform/arm/mali-c55/mali-c55-core.c | 35 --------
+ drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 37 +--------
+ drivers/media/platform/arm/mali-c55/mali-c55-params.c | 72 ++++++++++++++++++
+ 4 files changed, 79 insertions(+), 67 deletions(-)
+
+--- a/drivers/media/platform/arm/mali-c55/mali-c55-common.h
++++ b/drivers/media/platform/arm/mali-c55/mali-c55-common.h
+@@ -306,5 +306,7 @@ bool mali_c55_pipeline_ready(struct mali
+ void mali_c55_stats_fill_buffer(struct mali_c55 *mali_c55,
+ enum mali_c55_config_spaces cfg_space);
+ void mali_c55_params_write_config(struct mali_c55 *mali_c55);
++void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55,
++ const struct v4l2_subdev_state *state);
+
+ #endif /* _MALI_C55_COMMON_H */
+--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
++++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
+@@ -663,41 +663,6 @@ static int mali_c55_init_context(struct
+ mali_c55->base + config_space_addrs[MALI_C55_CONFIG_PING],
+ MALI_C55_CONFIG_SPACE_SIZE);
+
+- /*
+- * Some features of the ISP need to be disabled by default and only
+- * enabled at the same time as they're configured by a parameters buffer
+- */
+-
+- /* Bypass the sqrt and square compression and expansion modules */
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_1,
+- MALI_C55_REG_BYPASS_1_FE_SQRT,
+- MALI_C55_REG_BYPASS_1_FE_SQRT);
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_3,
+- MALI_C55_REG_BYPASS_3_SQUARE_BE,
+- MALI_C55_REG_BYPASS_3_SQUARE_BE);
+-
+- /* Bypass the temper module */
+- mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_2,
+- MALI_C55_REG_BYPASS_2_TEMPER);
+-
+- /* Disable the temper module's DMA read/write */
+- mali_c55_ctx_write(mali_c55, MALI_C55_REG_TEMPER_DMA_IO, 0x0);
+-
+- /* Bypass the colour noise reduction */
+- mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_4,
+- MALI_C55_REG_BYPASS_4_CNR);
+-
+- /* Disable the sinter module */
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_SINTER_CONFIG,
+- MALI_C55_SINTER_ENABLE_MASK, 0);
+-
+- /* Disable the RGB Gamma module for each output */
+- mali_c55_ctx_write(mali_c55, MALI_C55_REG_FR_GAMMA_RGB_ENABLE, 0);
+- mali_c55_ctx_write(mali_c55, MALI_C55_REG_DS_GAMMA_RGB_ENABLE, 0);
+-
+- /* Disable the colour correction matrix */
+- mali_c55_ctx_write(mali_c55, MALI_C55_REG_CCM_ENABLE, 0);
+-
+ return 0;
+ }
+
+--- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
++++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c
+@@ -112,9 +112,6 @@ static int mali_c55_isp_start(struct mal
+ const struct v4l2_subdev_state *state)
+ {
+ struct mali_c55_context *ctx = mali_c55_get_active_context(mali_c55);
+- const struct mali_c55_isp_format_info *cfg;
+- const struct v4l2_mbus_framefmt *format;
+- const struct v4l2_rect *crop;
+ u32 val;
+ int ret;
+
+@@ -122,35 +119,11 @@ static int mali_c55_isp_start(struct mal
+ MALI_C55_REG_MCU_CONFIG_WRITE_MASK,
+ MALI_C55_REG_MCU_CONFIG_WRITE_PING);
+
+- /* Apply input windowing */
+- crop = v4l2_subdev_state_get_crop(state, MALI_C55_ISP_PAD_SINK_VIDEO);
+- format = v4l2_subdev_state_get_format(state,
+- MALI_C55_ISP_PAD_SINK_VIDEO);
+- cfg = mali_c55_isp_get_mbus_config_by_code(format->code);
+-
+- mali_c55_write(mali_c55, MALI_C55_REG_HC_START,
+- MALI_C55_HC_START(crop->left));
+- mali_c55_write(mali_c55, MALI_C55_REG_HC_SIZE,
+- MALI_C55_HC_SIZE(crop->width));
+- mali_c55_write(mali_c55, MALI_C55_REG_VC_START_SIZE,
+- MALI_C55_VC_START(crop->top) |
+- MALI_C55_VC_SIZE(crop->height));
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR,
+- MALI_C55_REG_ACTIVE_WIDTH_MASK, format->width);
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR,
+- MALI_C55_REG_ACTIVE_HEIGHT_MASK,
+- format->height << 16);
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BAYER_ORDER,
+- MALI_C55_BAYER_ORDER_MASK, cfg->order);
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_INPUT_WIDTH,
+- MALI_C55_INPUT_WIDTH_MASK,
+- MALI_C55_INPUT_WIDTH_20BIT);
+-
+- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_ISP_RAW_BYPASS,
+- MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK,
+- cfg->bypass ? MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK :
+- 0x00);
+-
++ /*
++ * Apply default ISP configuration and the apply configurations from
++ * the first available parameters buffer.
++ */
++ mali_c55_params_init_isp_config(mali_c55, state);
+ mali_c55_params_write_config(mali_c55);
+ ret = mali_c55_config_write(ctx, MALI_C55_CONFIG_PING, true);
+ if (ret) {
+--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c
++++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c
+@@ -732,6 +732,78 @@ void mali_c55_params_write_config(struct
+ vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
+ }
+
++void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55,
++ const struct v4l2_subdev_state *state)
++{
++ const struct mali_c55_isp_format_info *cfg;
++ const struct v4l2_mbus_framefmt *format;
++ const struct v4l2_rect *crop;
++
++ /* Apply input windowing */
++ crop = v4l2_subdev_state_get_crop(state, MALI_C55_ISP_PAD_SINK_VIDEO);
++ format = v4l2_subdev_state_get_format(state,
++ MALI_C55_ISP_PAD_SINK_VIDEO);
++ cfg = mali_c55_isp_get_mbus_config_by_code(format->code);
++
++ mali_c55_write(mali_c55, MALI_C55_REG_HC_START,
++ MALI_C55_HC_START(crop->left));
++ mali_c55_write(mali_c55, MALI_C55_REG_HC_SIZE,
++ MALI_C55_HC_SIZE(crop->width));
++ mali_c55_write(mali_c55, MALI_C55_REG_VC_START_SIZE,
++ MALI_C55_VC_START(crop->top) |
++ MALI_C55_VC_SIZE(crop->height));
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR,
++ MALI_C55_REG_ACTIVE_WIDTH_MASK, format->width);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR,
++ MALI_C55_REG_ACTIVE_HEIGHT_MASK,
++ format->height << 16);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BAYER_ORDER,
++ MALI_C55_BAYER_ORDER_MASK, cfg->order);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_INPUT_WIDTH,
++ MALI_C55_INPUT_WIDTH_MASK,
++ MALI_C55_INPUT_WIDTH_20BIT);
++
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_ISP_RAW_BYPASS,
++ MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK,
++ cfg->bypass ? MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK :
++ 0x00);
++
++ /*
++ * Some features of the ISP need to be disabled by default and only
++ * enabled at the same time as they're configured by a parameters buffer
++ */
++
++ /* Bypass the sqrt and square compression and expansion modules */
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_1,
++ MALI_C55_REG_BYPASS_1_FE_SQRT,
++ MALI_C55_REG_BYPASS_1_FE_SQRT);
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_3,
++ MALI_C55_REG_BYPASS_3_SQUARE_BE,
++ MALI_C55_REG_BYPASS_3_SQUARE_BE);
++
++ /* Bypass the temper module */
++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_2,
++ MALI_C55_REG_BYPASS_2_TEMPER);
++
++ /* Disable the temper module's DMA read/write */
++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_TEMPER_DMA_IO, 0x0);
++
++ /* Bypass the colour noise reduction */
++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_4,
++ MALI_C55_REG_BYPASS_4_CNR);
++
++ /* Disable the sinter module */
++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_SINTER_CONFIG,
++ MALI_C55_SINTER_ENABLE_MASK, 0);
++
++ /* Disable the RGB Gamma module for each output */
++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_FR_GAMMA_RGB_ENABLE, 0);
++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_DS_GAMMA_RGB_ENABLE, 0);
++
++ /* Disable the colour correction matrix */
++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_CCM_ENABLE, 0);
++}
++
+ void mali_c55_unregister_params(struct mali_c55 *mali_c55)
+ {
+ struct mali_c55_params *params = &mali_c55->params;
--- /dev/null
+From 2f38622d0f85f317be9e6b131da6cd511db94fd2 Mon Sep 17 00:00:00 2001
+From: Guoniu Zhou <guoniu.zhou@nxp.com>
+Date: Thu, 12 Mar 2026 11:12:34 +0800
+Subject: media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
+
+From: Guoniu Zhou <guoniu.zhou@nxp.com>
+
+commit 2f38622d0f85f317be9e6b131da6cd511db94fd2 upstream.
+
+Fix a hang issue when capturing a single frame with applications like cam
+in libcamera. It would hang waiting for the driver to complete the buffer,
+but streaming never starts because min_queued_buffers was set to 2.
+
+The ISI module uses a ping-pong buffer mechanism that requires two buffers
+to be programmed at all times. However, when fewer than 2 user buffers are
+available, the driver use internal discard buffers to fill the remaining
+slot(s). Reduce minimum queued buffers from 2 to 0 allows streaming to
+start without any queued buffers.
+
+Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Guoniu Zhou <guoniu.zhou@nxp.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20260312-isi_min_buffers-v2-1-d5ea1c79ad81@nxp.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
+@@ -1410,7 +1410,7 @@ int mxc_isi_video_register(struct mxc_is
+ q->mem_ops = &vb2_dma_contig_memops;
+ q->buf_struct_size = sizeof(struct mxc_isi_buffer);
+ q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+- q->min_queued_buffers = 2;
++ q->min_queued_buffers = 0;
+ q->lock = &video->lock;
+ q->dev = pipe->isi->dev;
+
--- /dev/null
+From 42844992664f03ef9f930e64f7370fa481e9c267 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 11 Feb 2026 19:06:21 +0100
+Subject: media: rc: streamzap: Error handling in probe
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 42844992664f03ef9f930e64f7370fa481e9c267 upstream.
+
+If submitting the URB fails, the device will be unusable.
+Probe() must fail.
+
+Fixes: 7a569f524dd36 ("V4L/DVB: IR/streamzap: functional in-kernel decoding")
+Cc: stable@vger.kernel.org
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/streamzap.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/rc/streamzap.c
++++ b/drivers/media/rc/streamzap.c
+@@ -219,9 +219,8 @@ static void streamzap_callback(struct ur
+ case -ESHUTDOWN:
+ /*
+ * this urb is terminated, clean up.
+- * sz might already be invalid at this point
+ */
+- dev_err(sz->dev, "urb terminated, status: %d\n", urb->status);
++ dev_dbg(sz->dev, "urb terminated, status: %d\n", urb->status);
+ return;
+ default:
+ break;
+@@ -358,11 +357,16 @@ static int streamzap_probe(struct usb_in
+
+ usb_set_intfdata(intf, sz);
+
+- if (usb_submit_urb(sz->urb_in, GFP_ATOMIC))
++ retval = usb_submit_urb(sz->urb_in, GFP_ATOMIC);
++ if (retval < 0) {
+ dev_err(sz->dev, "urb submit failed\n");
++ goto rc_submit_fail;
++ }
+
+ return 0;
+-
++rc_submit_fail:
++ rc_free_device(sz->rdev);
++ usb_set_intfdata(intf, NULL);
+ rc_dev_fail:
+ usb_free_urb(sz->urb_in);
+ free_buf_in:
--- /dev/null
+From e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 11 Feb 2026 19:09:44 +0100
+Subject: media: rc: xbox_remote: heed DMA restrictions
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff upstream.
+
+The buffer for IO must not be part of the device structure
+because that violates the DMA coherency rules.
+
+Fixes: 02d32bdad3123 ("media: rc: add driver for Xbox DVD Movie Playback Kit")
+Cc: stable@vger.kernel.org
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/xbox_remote.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/rc/xbox_remote.c
++++ b/drivers/media/rc/xbox_remote.c
+@@ -55,7 +55,7 @@ struct xbox_remote {
+ struct usb_interface *interface;
+
+ struct urb *irq_urb;
+- unsigned char inbuf[DATA_BUFSIZE] __aligned(sizeof(u16));
++ u8 *inbuf;
+
+ char rc_name[NAME_BUFSIZE];
+ char rc_phys[NAME_BUFSIZE];
+@@ -218,6 +218,10 @@ static int xbox_remote_probe(struct usb_
+ if (!xbox_remote || !rc_dev)
+ goto exit_free_dev_rdev;
+
++ xbox_remote->inbuf = kzalloc(DATA_BUFSIZE, GFP_KERNEL);
++ if (!xbox_remote->inbuf)
++ goto exit_free_inbuf;
++
+ /* Allocate URB buffer */
+ xbox_remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!xbox_remote->irq_urb)
+@@ -262,6 +266,8 @@ exit_kill_urbs:
+ usb_kill_urb(xbox_remote->irq_urb);
+ exit_free_buffers:
+ usb_free_urb(xbox_remote->irq_urb);
++exit_free_inbuf:
++ kfree(xbox_remote->inbuf);
+ exit_free_dev_rdev:
+ rc_free_device(rc_dev);
+ kfree(xbox_remote);
+@@ -286,6 +292,7 @@ static void xbox_remote_disconnect(struc
+ usb_kill_urb(xbox_remote->irq_urb);
+ rc_unregister_device(xbox_remote->rdev);
+ usb_free_urb(xbox_remote->irq_urb);
++ kfree(xbox_remote->inbuf);
+ kfree(xbox_remote);
+ }
+
--- /dev/null
+From 40c6da8a9c0f897f99a439330584d93ca7d41226 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+Date: Tue, 27 Jan 2026 10:56:12 +0200
+Subject: media: renesas: vin: Fix RAW8 (again)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+
+commit 40c6da8a9c0f897f99a439330584d93ca7d41226 upstream.
+
+Commit e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8
+formats") removed dividing the stride by two for RAW8 formats. It is
+unclear how this was tested, but in any of the recent tests this does
+not seem to work and produces quite distorted images.
+
+However, reverting the patch fixes the issues only partially. VNIS_REG
+requires alignment to 16 bytes, and when dividing the stride by 2, in
+some cases we end up with a non-aligned stride, producing a tilted
+image. This issue has to be fixed in rvin_format_bytesperline() where we
+do the alignment for bytesperline.
+
+Adding back the stride division and increasing the alignment for RAW8
+formats to 0x20 fixes the problems related to RAW8.
+
+Fixes: e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 formats")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++++++++++++++++++++
+ drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 ++++++++++
+ 2 files changed, 34 insertions(+)
+
+--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
++++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
+@@ -676,8 +676,30 @@ void rvin_crop_scale_comp(struct rvin_de
+ if (vin->scaler)
+ vin->scaler(vin);
+
++ /*
++ * VNIS_REG has four lowest bits always 0, i.e. the stride has to be
++ * aligned to 16 bytes. This is done in rvin_format_bytesperline().
++ */
++
+ fmt = rvin_format_from_pixel(vin, vin->format.pixelformat);
+ stride = vin->format.bytesperline / fmt->bpp;
++
++ /*
++ * RAW8 format bpp is 1, but the hardware process RAW8 format in 2 pixel
++ * units, so we need to divide the stride by 2.
++ */
++ switch (vin->format.pixelformat) {
++ case V4L2_PIX_FMT_SBGGR8:
++ case V4L2_PIX_FMT_SGBRG8:
++ case V4L2_PIX_FMT_SGRBG8:
++ case V4L2_PIX_FMT_SRGGB8:
++ case V4L2_PIX_FMT_GREY:
++ stride /= 2;
++ break;
++ default:
++ break;
++ }
++
+ rvin_write(vin, stride, VNIS_REG);
+ }
+
+--- a/drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c
++++ b/drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c
+@@ -155,6 +155,18 @@ static u32 rvin_format_bytesperline(stru
+ case V4L2_PIX_FMT_NV16:
+ align = 0x20;
+ break;
++ case V4L2_PIX_FMT_SBGGR8:
++ case V4L2_PIX_FMT_SGBRG8:
++ case V4L2_PIX_FMT_SGRBG8:
++ case V4L2_PIX_FMT_SRGGB8:
++ case V4L2_PIX_FMT_GREY:
++ /*
++ * RAW8 format bpp is 1, but the hardware process RAW8 format in
++ * 2 pixel units, and we need to align to 32 bytes. See
++ * rvin_crop_scale_comp().
++ */
++ align = 0x20;
++ break;
+ default:
+ align = 0x10;
+ break;
--- /dev/null
+From 58b1e9664d8f74d55d8411cc7a7b275a76a6f24f Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+Date: Thu, 15 Jan 2026 11:22:35 +0200
+Subject: media: renesas: vsp1: Fix NULL pointer deref on module unload
+
+From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+
+commit 58b1e9664d8f74d55d8411cc7a7b275a76a6f24f upstream.
+
+When unloading the module on gen 4, we hit a NULL pointer dereference.
+This is caused by the cleanup code calling vsp1_drm_cleanup() where it
+should be calling vsp1_vspx_cleanup().
+
+Fix this by checking the IP version and calling the drm or vspx function
+accordingly, the same way as the init code does.
+
+Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
+@@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct
+ media_device_unregister(&vsp1->media_dev);
+ media_device_cleanup(&vsp1->media_dev);
+
+- if (!vsp1->info->uapi)
+- vsp1_drm_cleanup(vsp1);
++ if (!vsp1->info->uapi) {
++ if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
++ vsp1_vspx_cleanup(vsp1);
++ else
++ vsp1_drm_cleanup(vsp1);
++ }
+ }
+
+ static int vsp1_create_entities(struct vsp1_device *vsp1)
--- /dev/null
+From 8e3c751259dc2d1325838eff26f41032523c7b57 Mon Sep 17 00:00:00 2001
+From: Dang Huynh <dang.huynh@mainlining.org>
+Date: Thu, 29 Jan 2026 14:24:02 +0700
+Subject: media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads
+
+From: Dang Huynh <dang.huynh@mainlining.org>
+
+commit 8e3c751259dc2d1325838eff26f41032523c7b57 upstream.
+
+The pads missed checks for connected devices which may a null dereference
+when the stream is enabled.
+
+Unable to handle kernel NULL pointer dereference at virtual address
+0000000000000020
+pc : rkcif_interface_enable_streams+0x48/0xf0
+lr : rkcif_interface_enable_streams+0x44/0xf0
+Call trace:
+ rkcif_interface_enable_streams+0x48/0xf0
+ v4l2_subdev_enable_streams+0x26c/0x3f0
+ rkcif_stream_start_streaming+0x140/0x278
+ vb2_start_streaming+0x74/0x188
+ vb2_core_streamon+0xe0/0x1d8
+ vb2_ioctl_streamon+0x60/0xa8
+ v4l_streamon+0x2c/0x40
+ __video_do_ioctl+0x34c/0x400
+ video_usercopy+0x2d0/0x800
+ video_ioctl2+0x20/0x60
+ v4l2_ioctl+0x48/0x78
+
+Fixes: 501802e2ad51 ("media: rockchip: rkcif: add abstraction for dma blocks")
+Fixes: 85411d17bee9 ("media: rockchip: rkcif: add abstraction for interface and crop blocks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dang Huynh <dang.huynh@mainlining.org>
+Reviewed-by: Michael Riesch <michael.riesch@collabora.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/rockchip/rkcif/rkcif-interface.c | 3 ++-
+ drivers/media/platform/rockchip/rkcif/rkcif-stream.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkcif/rkcif-interface.c b/drivers/media/platform/rockchip/rkcif/rkcif-interface.c
+index 523103872b7a..414a9980cf2e 100644
+--- a/drivers/media/platform/rockchip/rkcif/rkcif-interface.c
++++ b/drivers/media/platform/rockchip/rkcif/rkcif-interface.c
+@@ -378,7 +378,8 @@ int rkcif_interface_register(struct rkcif_device *rkcif,
+ snprintf(sd->name, sizeof(sd->name), "rkcif-mipi%d",
+ interface->index - RKCIF_MIPI_BASE);
+
+- pads[RKCIF_IF_PAD_SINK].flags = MEDIA_PAD_FL_SINK;
++ pads[RKCIF_IF_PAD_SINK].flags = MEDIA_PAD_FL_SINK |
++ MEDIA_PAD_FL_MUST_CONNECT;
+ pads[RKCIF_IF_PAD_SRC].flags = MEDIA_PAD_FL_SOURCE;
+ ret = media_entity_pads_init(&sd->entity, RKCIF_IF_PAD_MAX, pads);
+ if (ret)
+diff --git a/drivers/media/platform/rockchip/rkcif/rkcif-stream.c b/drivers/media/platform/rockchip/rkcif/rkcif-stream.c
+index f15bee4f7cd7..3130d420ad55 100644
+--- a/drivers/media/platform/rockchip/rkcif/rkcif-stream.c
++++ b/drivers/media/platform/rockchip/rkcif/rkcif-stream.c
+@@ -555,7 +555,7 @@ int rkcif_stream_register(struct rkcif_device *rkcif,
+ vdev->vfl_dir = VFL_DIR_RX;
+ video_set_drvdata(vdev, stream);
+
+- stream->pad.flags = MEDIA_PAD_FL_SINK;
++ stream->pad.flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT;
+
+ stream->pix.height = CIF_MIN_HEIGHT;
+ stream->pix.width = CIF_MIN_WIDTH;
+--
+2.54.0
+
--- /dev/null
+From b1de0940a19c1b0001425f8069d6a82369986af7 Mon Sep 17 00:00:00 2001
+From: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
+Date: Wed, 11 Feb 2026 15:30:00 +0100
+Subject: media: rzv2h-ivc: Avoid double job scheduling
+
+From: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
+
+commit b1de0940a19c1b0001425f8069d6a82369986af7 upstream.
+
+The scheduling of a new buffer transfer in the IVC driver is triggered
+by two occurrences of the "frame completed" interrupt.
+
+The first interrupt occurrence identifies when all image data have been
+transferred to the ISP, the second occurrence identifies when the
+post-transfer VBLANK has completed and a new buffer can be transferred.
+
+Under heavy system load conditions the actual execution of the workqueue
+item might be delayed and two items might happen to run concurrently,
+leading to a new frame transfer being triggered while the previous one
+has not yet finished.
+
+This error condition is only visible because the driver maintains a
+status variable that counts the number of interrupts since the last
+transfer, and warns in case an IRQ happens before the counter has been
+reset.
+
+To ensure sequential execution of the worqueue items and avoid a double
+buffer transfer to run concurrently, protect the whole function body
+with the spinlock that so far was solely used to reset the counter and
+inspect the interrupt counter variable at the beginning of the buffer
+transfer function.
+
+As soon as the ongoing transfer completes, the workqueue item will be
+re-scheduled and will consume the pending buffer.
+
+Cc: stable@vger.kernel.org
+Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
+@@ -149,6 +149,11 @@ static void rzv2h_ivc_transfer_buffer(st
+ buffers.work);
+ struct rzv2h_ivc_buf *buf;
+
++ guard(spinlock_irqsave)(&ivc->spinlock);
++
++ if (ivc->vvalid_ifp)
++ return;
++
+ /* Setup buffers */
+ scoped_guard(spinlock_irqsave, &ivc->buffers.lock) {
+ buf = list_first_entry_or_null(&ivc->buffers.queue,
+@@ -164,9 +169,7 @@ static void rzv2h_ivc_transfer_buffer(st
+ buf->addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
+ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_SADDL_P0, buf->addr);
+
+- scoped_guard(spinlock_irqsave, &ivc->spinlock) {
+- ivc->vvalid_ifp = 2;
+- }
++ ivc->vvalid_ifp = 2;
+ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_FM_FRCON, 0x1);
+ }
+
+@@ -201,7 +204,7 @@ static void rzv2h_ivc_buf_queue(struct v
+ }
+
+ scoped_guard(spinlock_irq, &ivc->spinlock) {
+- if (vb2_is_streaming(vb->vb2_queue) && !ivc->vvalid_ifp)
++ if (vb2_is_streaming(vb->vb2_queue))
+ queue_work(ivc->buffers.async_wq, &ivc->buffers.work);
+ }
+ }
--- /dev/null
+From 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?=
+ <barnabas.pocze+renesas@ideasonboard.com>
+Date: Fri, 6 Feb 2026 17:30:54 +0100
+Subject: media: rzv2h-ivc: Fix concurrent buffer list access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
+
+commit 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 upstream.
+
+The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a
+spinlock (`rzv2h_ivc::buffers.lock`). However, in
+`rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the
+`list_del()` call is executed without holding the spinlock, which makes
+it possible for the list to be concurrently modified
+
+Fix that by removing a buffer from the list in the lock protected section.
+
+Cc: stable@vger.kernel.org
+Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
+[assign ivc->buffers.curr in critical section as reported by Barnabas]
+Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
+@@ -158,14 +158,13 @@ static void rzv2h_ivc_transfer_buffer(st
+ scoped_guard(spinlock_irqsave, &ivc->buffers.lock) {
+ buf = list_first_entry_or_null(&ivc->buffers.queue,
+ struct rzv2h_ivc_buf, queue);
+- }
+-
+- if (!buf)
+- return;
++ if (!buf)
++ return;
+
+- list_del(&buf->queue);
++ list_del(&buf->queue);
++ ivc->buffers.curr = buf;
++ }
+
+- ivc->buffers.curr = buf;
+ buf->addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
+ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_SADDL_P0, buf->addr);
+
--- /dev/null
+From 562d2e0a672075292e92538dad61664e89b34d30 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?=
+ <barnabas.pocze+renesas@ideasonboard.com>
+Date: Thu, 12 Feb 2026 16:51:29 +0100
+Subject: media: rzv2h-ivc: Fix FM_STOP register write
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
+
+commit 562d2e0a672075292e92538dad61664e89b34d30 upstream.
+
+Bit 20 should be written in this register to stop frame processing.
+So fix that, as well as the poll condition.
+
+Cc: stable@vger.kernel.org
+Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 5 +++--
+ drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
+@@ -300,9 +300,10 @@ static void rzv2h_ivc_stop_streaming(str
+ struct rzv2h_ivc *ivc = vb2_get_drv_priv(q);
+ u32 val = 0;
+
+- rzv2h_ivc_write(ivc, RZV2H_IVC_REG_FM_STOP, 0x1);
++ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_FM_STOP, RZV2H_IVC_REG_FM_STOP_FSTOP);
+ readl_poll_timeout(ivc->base + RZV2H_IVC_REG_FM_STOP,
+- val, !val, 10 * USEC_PER_MSEC, 250 * USEC_PER_MSEC);
++ val, !(val & RZV2H_IVC_REG_FM_STOP_FSTOP),
++ 10 * USEC_PER_MSEC, 250 * USEC_PER_MSEC);
+
+ rzv2h_ivc_return_buffers(ivc, VB2_BUF_STATE_ERROR);
+ video_device_pipeline_stop(&ivc->vdev.dev);
+--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h
++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h
+@@ -46,6 +46,7 @@
+ #define RZV2H_IVC_REG_FM_MCON 0x0104
+ #define RZV2H_IVC_REG_FM_FRCON 0x0108
+ #define RZV2H_IVC_REG_FM_STOP 0x010c
++#define RZV2H_IVC_REG_FM_STOP_FSTOP BIT(20)
+ #define RZV2H_IVC_REG_FM_INT_EN 0x0120
+ #define RZV2H_IVC_VVAL_IFPE BIT(0)
+ #define RZV2H_IVC_REG_FM_INT_STA 0x0124
--- /dev/null
+From d901c428350245f2b26431e03c4ba0bdc7a71243 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?=
+ <barnabas.pocze+renesas@ideasonboard.com>
+Date: Thu, 12 Feb 2026 16:45:48 +0100
+Subject: media: rzv2h-ivc: Write AXIRX_PIXFMT once
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
+
+commit d901c428350245f2b26431e03c4ba0bdc7a71243 upstream.
+
+The documentation prescribes that invalid formats should not be set,
+so do a single write to ensure that both the CLFMT and DTYPE fields
+are set to valid values.
+
+Cc: stable@vger.kernel.org
+Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver")
+Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
+Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 8 ++++----
+ drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 7 ++++---
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c
+@@ -218,10 +218,10 @@ static void rzv2h_ivc_format_configure(s
+
+ /* Currently only CRU packed pixel formats are supported */
+ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_PXFMT,
+- RZV2H_IVC_INPUT_FMT_CRU_PACKED);
+-
+- rzv2h_ivc_update_bits(ivc, RZV2H_IVC_REG_AXIRX_PXFMT,
+- RZV2H_IVC_PXFMT_DTYPE, fmt->dtype);
++ FIELD_PREP(RZV2H_IVC_AXIRX_PXFMT_FIELD_DTYPE,
++ fmt->dtype) |
++ FIELD_PREP(RZV2H_IVC_AXIRX_PXFMT_FIELD_CLFMT,
++ RZV2H_IVC_CLFMT_CRU_PACKED));
+
+ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_HSIZE, pix->width);
+ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_VSIZE, pix->height);
+--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h
++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h
+@@ -24,9 +24,10 @@
+ #define RZV2H_IVC_ONE_EXPOSURE 0x00
+ #define RZV2H_IVC_TWO_EXPOSURE 0x01
+ #define RZV2H_IVC_REG_AXIRX_PXFMT 0x0004
+-#define RZV2H_IVC_INPUT_FMT_MIPI (0 << 16)
+-#define RZV2H_IVC_INPUT_FMT_CRU_PACKED BIT(16)
+-#define RZV2H_IVC_PXFMT_DTYPE GENMASK(7, 0)
++#define RZV2H_IVC_AXIRX_PXFMT_FIELD_CLFMT GENMASK(17, 16)
++#define RZV2H_IVC_CLFMT_MIPI 0
++#define RZV2H_IVC_CLFMT_CRU_PACKED 1
++#define RZV2H_IVC_AXIRX_PXFMT_FIELD_DTYPE GENMASK(7, 0)
+ #define RZV2H_IVC_REG_AXIRX_SADDL_P0 0x0010
+ #define RZV2H_IVC_REG_AXIRX_SADDH_P0 0x0014
+ #define RZV2H_IVC_REG_AXIRX_SADDL_P1 0x0018
--- /dev/null
+From d51c60a498e83c9a79884c8e420f97e3885c9583 Mon Sep 17 00:00:00 2001
+From: Wang Jun <1742789905@qq.com>
+Date: Mon, 16 Mar 2026 20:24:01 +0800
+Subject: media: saa7164: add ioremap return checks and cleanups
+
+From: Wang Jun <1742789905@qq.com>
+
+commit d51c60a498e83c9a79884c8e420f97e3885c9583 upstream.
+
+Add checks for ioremap return values in saa7164_dev_setup(). If
+ioremap for BAR0 or BAR2 fails, release the already allocated PCI
+memory regions, remove the device from the global list, decrement
+the device count, and return -ENODEV.
+
+This prevents potential null pointer dereferences and ensures proper
+cleanup on memory mapping failures.
+
+Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wang Jun <1742789905@qq.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/saa7164/saa7164-core.c | 47 +++++++++++++++++++++++--------
+ 1 file changed, 35 insertions(+), 12 deletions(-)
+
+--- a/drivers/media/pci/saa7164/saa7164-core.c
++++ b/drivers/media/pci/saa7164/saa7164-core.c
+@@ -888,6 +888,15 @@ static int get_resources(struct saa7164_
+ return -EBUSY;
+ }
+
++static void release_resources(struct saa7164_dev *dev)
++{
++ release_mem_region(pci_resource_start(dev->pci, 0),
++ pci_resource_len(dev->pci, 0));
++
++ release_mem_region(pci_resource_start(dev->pci, 2),
++ pci_resource_len(dev->pci, 2));
++}
++
+ static int saa7164_port_init(struct saa7164_dev *dev, int portnr)
+ {
+ struct saa7164_port *port = NULL;
+@@ -947,9 +956,9 @@ static int saa7164_dev_setup(struct saa7
+
+ snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr);
+
+- mutex_lock(&devlist);
+- list_add_tail(&dev->devlist, &saa7164_devlist);
+- mutex_unlock(&devlist);
++ scoped_guard(mutex, &devlist) {
++ list_add_tail(&dev->devlist, &saa7164_devlist);
++ }
+
+ /* board config */
+ dev->board = UNSET;
+@@ -996,11 +1005,17 @@ static int saa7164_dev_setup(struct saa7
+ }
+
+ /* PCI/e allocations */
+- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0),
+- pci_resource_len(dev->pci, 0));
++ dev->lmmio = pci_ioremap_bar(dev->pci, 0);
++ if (!dev->lmmio) {
++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n");
++ goto err_ioremap_bar0;
++ }
+
+- dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2),
+- pci_resource_len(dev->pci, 2));
++ dev->lmmio2 = pci_ioremap_bar(dev->pci, 2);
++ if (!dev->lmmio2) {
++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n");
++ goto err_ioremap_bar2;
++ }
+
+ dev->bmmio = (u8 __iomem *)dev->lmmio;
+ dev->bmmio2 = (u8 __iomem *)dev->lmmio2;
+@@ -1019,17 +1034,25 @@ static int saa7164_dev_setup(struct saa7
+ saa7164_pci_quirks(dev);
+
+ return 0;
++
++err_ioremap_bar2:
++ iounmap(dev->lmmio);
++err_ioremap_bar0:
++ release_resources(dev);
++
++ scoped_guard(mutex, &devlist) {
++ list_del(&dev->devlist);
++ }
++ saa7164_devcount--;
++
++ return -ENODEV;
+ }
+
+ static void saa7164_dev_unregister(struct saa7164_dev *dev)
+ {
+ dprintk(1, "%s()\n", __func__);
+
+- release_mem_region(pci_resource_start(dev->pci, 0),
+- pci_resource_len(dev->pci, 0));
+-
+- release_mem_region(pci_resource_start(dev->pci, 2),
+- pci_resource_len(dev->pci, 2));
++ release_resources(dev);
+
+ if (!atomic_dec_and_test(&dev->refcount))
+ return;
--- /dev/null
+From f3e969a5b54304cab6891a58d9dd8b29072bde4c Mon Sep 17 00:00:00 2001
+From: Felix Gu <ustc.gu@gmail.com>
+Date: Sun, 1 Mar 2026 21:39:25 +0800
+Subject: media: ti: vpe: Add missing v4l2_device_unregister in vip_remove()
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+commit f3e969a5b54304cab6891a58d9dd8b29072bde4c upstream.
+
+The v4l2_device is registered during probe but was not being unregistered
+during remove. Add the missing v4l2_device_unregister() call to properly
+clean up resources.
+
+Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/ti/vpe/vip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/ti/vpe/vip.c b/drivers/media/platform/ti/vpe/vip.c
+index a4b616a5ece7..0e91e87bda9b 100644
+--- a/drivers/media/platform/ti/vpe/vip.c
++++ b/drivers/media/platform/ti/vpe/vip.c
+@@ -3641,6 +3641,7 @@ static void vip_remove(struct platform_device *pdev)
+ }
+
+ v4l2_ctrl_handler_free(&shared->ctrl_handler);
++ v4l2_device_unregister(&shared->v4l2_dev);
+
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+--
+2.54.0
+
--- /dev/null
+From fbac03467e53d8d72e5099c03df26d9adae11416 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 9 Mar 2026 15:01:54 +0000
+Subject: media: uvcvideo: Enable VB2_DMABUF for metadata stream
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit fbac03467e53d8d72e5099c03df26d9adae11416 upstream.
+
+The UVC driver has two video streams, one for the frames and another one
+for the metadata. Both streams share most of the codebase, but only the
+data stream declares support for DMABUF transfer mode.
+
+I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM
+and the frames looked correct.
+
+This patch announces the support for DMABUF for the metadata stream.
+This is useful for apps/HALs that only want to support DMABUF.
+
+Cc: stable@vger.kernel.org
+Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_queue.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_queue.c
++++ b/drivers/media/usb/uvc/uvc_queue.c
+@@ -243,7 +243,7 @@ int uvc_queue_init(struct uvc_video_queu
+ int ret;
+
+ queue->queue.type = type;
+- queue->queue.io_modes = VB2_MMAP | VB2_USERPTR;
++ queue->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF;
+ queue->queue.drv_priv = queue;
+ queue->queue.buf_struct_size = sizeof(struct uvc_buffer);
+ queue->queue.mem_ops = &vb2_vmalloc_memops;
+@@ -256,7 +256,6 @@ int uvc_queue_init(struct uvc_video_queu
+ queue->queue.ops = &uvc_meta_queue_qops;
+ break;
+ default:
+- queue->queue.io_modes |= VB2_DMABUF;
+ queue->queue.ops = &uvc_queue_qops;
+ break;
+ }
--- /dev/null
+From 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 Mon Sep 17 00:00:00 2001
+From: Janne Grunau <j@jannau.net>
+Date: Sun, 15 Feb 2026 18:42:59 +0100
+Subject: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
+
+From: Janne Grunau <j@jannau.net>
+
+commit 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 upstream.
+
+vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not
+see a reason why vb2_dma_sg should behave differently. This avoids
+hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in
+drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of
+tree Apple ISP camera capture driver which uses vb2_dma_sg_memops.
+
+gst-launch-1.0 v4l2src ! gtk4paintablesink
+
+[ 38.201528] ------------[ cut here ]------------
+[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210
+[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer
+snd_seq snd_seq_device uinput nf_conntrack_netbios_ns
+nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib
+nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat
+nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep
+nls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc
+hid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic
+cfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev
+aop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2
+snd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor
+macsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi
+macsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3
+snd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon
+apple_sart apple_dockchannel macsmc apple_rtkit_helper
+spmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses
+pinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core
+spi_apple
+[ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram
+[ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full)
+[ 38.219040] Tainted: [W]=WARN
+[ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT)
+[ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+[ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210
+[ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210
+[ 38.222178] sp : ffffc0008dc678e0
+[ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480
+[ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968
+[ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0
+[ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968
+[ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8
+[ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff
+[ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8
+[ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000
+[ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038
+[ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb
+[ 38.231488] Call trace:
+[ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P)
+[ 38.232342] drm_gem_mmap+0x140/0x260
+[ 38.232813] __mmap_region+0x488/0x9a0
+[ 38.233277] mmap_region+0xd0/0x148
+[ 38.233703] do_mmap+0x350/0x5c0
+[ 38.234148] vm_mmap_pgoff+0x14c/0x200
+[ 38.234612] ksys_mmap_pgoff+0x150/0x208
+[ 38.235107] __arm64_sys_mmap+0x34/0x50
+[ 38.235611] invoke_syscall+0x50/0x120
+[ 38.236075] el0_svc_common.constprop.0+0x48/0xf0
+[ 38.236680] do_el0_svc+0x24/0x38
+[ 38.237113] el0_svc+0x38/0x168
+[ 38.237507] el0t_64_sync_handler+0xa0/0xe8
+[ 38.238034] el0t_64_sync+0x198/0x1a0
+[ 38.238491] ---[ end trace 0000000000000000 ]---
+
+There were discussions in [1] at the end of 2023 that mmap() on imported
+dma-bufs should not be supported but as of v6.17 drm_gem_shmem_mmap() in
+drm_gem_shmem_helper.c still supports it.
+This might affect all gpu or accel drivers using drm_gem_shmem_mmap() or
+the wrapper drm_gem_shmem_object_mmap().
+
+[1] https://lore.kernel.org/dri-devel/bc7f7844-0aa3-4802-b203-69d58e8be2fa@linux.intel.com/
+
+Cc: stable@vger.kernel.org
+Fixes: 5ba3f757f059 ("[media] v4l: videobuf2: add DMA scatter/gather allocator")
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
++++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+@@ -345,6 +345,7 @@ static int vb2_dma_sg_mmap(void *buf_pri
+ return err;
+ }
+
++ vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP);
+ /*
+ * Use common vm_area operations to track buffer refcount.
+ */
--- /dev/null
+From 0d15ce31375ccef4162f960b34547a821b7619d2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 8 Apr 2026 09:30:54 +0200
+Subject: regulator: act8945a: fix OF node reference imbalance
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 0d15ce31375ccef4162f960b34547a821b7619d2 upstream.
+
+The driver reuses the OF node of the parent multi-function device but
+fails to take another reference to balance the one dropped by the
+platform bus code when unbinding the MFD and deregistering the child
+devices.
+
+Fix this by using the intended helper for reusing OF nodes.
+
+Fixes: 38c09961048b ("regulator: act8945a: add regulator driver for ACT8945A")
+Cc: stable@vger.kernel.org # 4.6
+Cc: Wenyou Yang <wenyou.yang@atmel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260408073055.5183-7-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/act8945a-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/act8945a-regulator.c
++++ b/drivers/regulator/act8945a-regulator.c
+@@ -302,8 +302,9 @@ static int act8945a_pmic_probe(struct pl
+ num_regulators = ARRAY_SIZE(act8945a_regulators);
+ }
+
++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
++
+ config.dev = &pdev->dev;
+- config.dev->of_node = pdev->dev.parent->of_node;
+ config.driver_data = act8945a;
+ for (i = 0; i < num_regulators; i++) {
+ rdev = devm_regulator_register(&pdev->dev, ®ulators[i],
--- /dev/null
+From 8498100ee1d00422b8c5b161b3e332278b92a59a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 8 Apr 2026 09:30:55 +0200
+Subject: regulator: bd9571mwv: fix OF node reference imbalance
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8498100ee1d00422b8c5b161b3e332278b92a59a upstream.
+
+The driver reuses the OF node of the parent multi-function device but
+fails to take another reference to balance the one dropped by the
+platform bus code when unbinding the MFD and deregistering the child
+devices.
+
+Fix this by using the intended helper for reusing OF nodes.
+
+Fixes: e85c5a153fe2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver")
+Cc: stable@vger.kernel.org # 4.12
+Cc: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260408073055.5183-8-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/bd9571mwv-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/bd9571mwv-regulator.c
++++ b/drivers/regulator/bd9571mwv-regulator.c
+@@ -287,8 +287,9 @@ static int bd9571mwv_regulator_probe(str
+
+ platform_set_drvdata(pdev, bdreg);
+
++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
++
+ config.dev = &pdev->dev;
+- config.dev->of_node = pdev->dev.parent->of_node;
+ config.driver_data = bdreg;
+ config.regmap = bdreg->regmap;
+
--- /dev/null
+From 7ea07bc030d8d6395524dec22ff3267441a28c0d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 8 Apr 2026 09:30:49 +0200
+Subject: regulator: bq257xx: fix OF node reference imbalance
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7ea07bc030d8d6395524dec22ff3267441a28c0d upstream.
+
+The driver reuses the OF node of the parent multi-function device but
+fails to take another reference to balance the one dropped by the
+platform bus code when unbinding the MFD and deregistering the child
+devices.
+
+Fix this by using the intended helper for reusing OF nodes.
+
+Fixes: 981dd162b635 ("regulator: bq257xx: Add bq257xx boost regulator driver")
+Cc: stable@vger.kernel.org # 6.18
+Cc: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260408073055.5183-2-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/bq257xx-regulator.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/regulator/bq257xx-regulator.c
++++ b/drivers/regulator/bq257xx-regulator.c
+@@ -142,8 +142,7 @@ static int bq257xx_regulator_probe(struc
+ struct device_node *np = dev->of_node;
+ struct regulator_config cfg = {};
+
+- pdev->dev.of_node = pdev->dev.parent->of_node;
+- pdev->dev.of_node_reused = true;
++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
+
+ pdata = devm_kzalloc(&pdev->dev, sizeof(struct bq257xx_reg_data), GFP_KERNEL);
+ if (!pdata)
--- /dev/null
+From 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 8 Apr 2026 09:30:51 +0200
+Subject: regulator: max77650: fix OF node reference imbalance
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 upstream.
+
+The driver reuses the OF node of the parent multi-function device but
+fails to take another reference to balance the one dropped by the
+platform bus code when unbinding the MFD and deregistering the child
+devices.
+
+Fix this by using the intended helper for reusing OF nodes.
+
+Fixes: bcc61f1c44fd ("regulator: max77650: add regulator support")
+Cc: stable@vger.kernel.org # 5.1
+Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260408073055.5183-4-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/max77650-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/max77650-regulator.c
++++ b/drivers/regulator/max77650-regulator.c
+@@ -337,7 +337,7 @@ static int max77650_regulator_probe(stru
+ parent = dev->parent;
+
+ if (!dev->of_node)
+- dev->of_node = parent->of_node;
++ device_set_of_node_from_dev(dev, parent);
+
+ rdescs = devm_kcalloc(dev, MAX77650_REGULATOR_NUM_REGULATORS,
+ sizeof(*rdescs), GFP_KERNEL);
--- /dev/null
+From 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 8 Apr 2026 09:30:52 +0200
+Subject: regulator: mt6357: fix OF node reference imbalance
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 upstream.
+
+The driver reuses the OF node of the parent multi-function device but
+fails to take another reference to balance the one dropped by the
+platform bus code when unbinding the MFD and deregistering the child
+devices.
+
+Fix this by using the intended helper for reusing OF nodes.
+
+Fixes: dafc7cde23dc ("regulator: add mt6357 regulator")
+Cc: stable@vger.kernel.org # 6.2
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260408073055.5183-5-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/mt6357-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/mt6357-regulator.c
++++ b/drivers/regulator/mt6357-regulator.c
+@@ -410,7 +410,7 @@ static int mt6357_regulator_probe(struct
+ struct regulator_dev *rdev;
+ int i;
+
+- pdev->dev.of_node = pdev->dev.parent->of_node;
++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
+
+ for (i = 0; i < MT6357_MAX_REGULATOR; i++) {
+ config.dev = &pdev->dev;
--- /dev/null
+From 65290b24d8a5f0b8cd065201e653db824c4a4da6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 8 Apr 2026 09:30:50 +0200
+Subject: regulator: rk808: fix OF node reference imbalance
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 65290b24d8a5f0b8cd065201e653db824c4a4da6 upstream.
+
+The driver reuses the OF node of the parent multi-function device but
+fails to take another reference to balance the one dropped by the
+platform bus code when unbinding the MFD and deregistering the child
+devices.
+
+Fix this by using the intended helper for reusing OF nodes.
+
+Fixes: 647e57351f8e ("regulator: rk808: reduce 'struct rk808' usage")
+Cc: stable@vger.kernel.org # 6.2
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260408073055.5183-3-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/rk808-regulator.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/regulator/rk808-regulator.c
++++ b/drivers/regulator/rk808-regulator.c
+@@ -2114,8 +2114,7 @@ static int rk808_regulator_probe(struct
+ struct regmap *regmap;
+ int ret, i, nregulators;
+
+- pdev->dev.of_node = pdev->dev.parent->of_node;
+- pdev->dev.of_node_reused = true;
++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
+
+ regmap = dev_get_regmap(pdev->dev.parent, NULL);
+ if (!regmap)
--- /dev/null
+From ebe694d67f159899b063eee61bacda4cb825ed7b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 8 Apr 2026 09:30:53 +0200
+Subject: regulator: s2dos05: fix OF node reference imbalance
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ebe694d67f159899b063eee61bacda4cb825ed7b upstream.
+
+The driver reuses the OF node of the parent multi-function device but
+fails to take another reference to balance the one dropped by the
+platform bus code when unbinding the MFD and deregistering the child
+devices.
+
+Fix this by using the intended helper for reusing OF nodes.
+
+Fixes: bb2441402392 ("regulator: add s2dos05 regulator support")
+Cc: stable@vger.kernel.org # 6.18
+Cc: Dzmitry Sankouski <dsankouski@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260408073055.5183-6-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/s2dos05-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/s2dos05-regulator.c
++++ b/drivers/regulator/s2dos05-regulator.c
+@@ -126,7 +126,7 @@ static int s2dos05_pmic_probe(struct pla
+ s2dos05->regmap = iodev->regmap_pmic;
+ s2dos05->dev = dev;
+ if (!dev->of_node)
+- dev->of_node = dev->parent->of_node;
++ device_set_of_node_from_dev(dev, dev->parent);
+
+ config.dev = dev;
+ config.driver_data = s2dos05;
ptrace-slightly-saner-get_dumpable-logic.patch
+hid-playstation-clamp-num_touch_reports.patch
+hid-appletb-kbd-fix-uaf-in-inactivity-timer-cleanup-path.patch
+hid-appletb-kbd-run-inactivity-autodim-from-workqueues.patch
+hid-pass-the-buffer-size-to-hid_report_raw_event.patch
+hid-core-introduce-hid_safe_input_report.patch
+hid-pidff-fix-integer-overflow-in-pidff_rescale.patch
+media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch
+drm-msm-hdmi-fix-wrong-ctrl1-register-used-in-writing-info-frames.patch
+media-rzv2h-ivc-avoid-double-job-scheduling.patch
+media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch
+media-rzv2h-ivc-write-axirx_pixfmt-once.patch
+media-rzv2h-ivc-fix-fm_stop-register-write.patch
+media-rzv2h-ivc-fix-concurrent-buffer-list-access.patch
+media-mali-c55-initialize-the-isp-in-enable_streams.patch
+media-mali-c55-fix-iridix-bypass-macros.patch
+media-mali-c55-fix-wrong-comment-of-isp-block-types.patch
+media-renesas-vsp1-fix-null-pointer-deref-on-module-unload.patch
+media-renesas-vin-fix-raw8-again.patch
+media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch
+media-dt-bindings-rockchip-vdec-add-alternative-reg-names-order-for-rk35-76-88.patch
+media-dt-bindings-rockchip-vdec-mark-reg-names-required-for-rk35-76-88.patch
+media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch
+media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch
+media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch
+arm64-dts-freescale-imx95-toradex-smarc-fix-pmic_sd2_vsel-label-position.patch
+drm-gpusvm-allow-device-pages-to-be-mapped-in-mixed-mappings-after-system-pages.patch
+drm-gpusvm-force-unmapping-on-error-in-drm_gpusvm_get_pages.patch
+spi-bcm63xx-fix-controller-deregistration.patch
+spi-atmel-fix-controller-deregistration.patch
+arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch
+staging-media-atomisp-disallow-all-private-ioctls.patch
+regulator-mt6357-fix-of-node-reference-imbalance.patch
+spi-st-ssc4-fix-controller-deregistration.patch
+regulator-max77650-fix-of-node-reference-imbalance.patch
+media-ti-vpe-add-missing-v4l2_device_unregister-in-vip_remove.patch
+media-rc-xbox_remote-heed-dma-restrictions.patch
+media-rc-streamzap-error-handling-in-probe.patch
+media-i2c-ov5647-fix-runtime-pm-refcount-leak-in-s_ctrl.patch
+media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch
+regulator-bq257xx-fix-of-node-reference-imbalance.patch
+regulator-rk808-fix-of-node-reference-imbalance.patch
+media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch
+media-rockchip-rkcif-add-missing-must_connect-flag-to-pads.patch
+media-mali-c55-fully-reset-the-isp-configuration.patch
+media-intel-ipu6-fix-error-pointer-dereference.patch
+media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch
+regulator-act8945a-fix-of-node-reference-imbalance.patch
+regulator-s2dos05-fix-of-node-reference-imbalance.patch
+regulator-bd9571mwv-fix-of-node-reference-imbalance.patch
+spi-lantiq-ssc-fix-controller-deregistration.patch
+spi-meson-spicc-fix-controller-deregistration.patch
+spi-qup-fix-controller-deregistration.patch
+arm64-dts-ti-k3-am69-aquila-clover-fix-dp-regulator-enable-gpio.patch
+spi-at91-usart-fix-controller-deregistration.patch
+media-ipu-bridge-add-upside-down-sensor-dmi-quirk-for-dell-xps-13-9340-and-xps-14-9440.patch
+media-saa7164-add-ioremap-return-checks-and-cleanups.patch
+spi-amlogic-spisg-fix-controller-deregistration.patch
+spi-aspeed-smc-fix-controller-deregistration.patch
+drm-colorop-preserve-bypass-value-in-duplicate_state.patch
+drm-atomic-add-affected-colorops-with-affected-planes.patch
--- /dev/null
+From 84d31bb1f6256eea0db6cf64a3c7a53145f92bb9 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:00 +0200
+Subject: spi: amlogic-spisg: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 84d31bb1f6256eea0db6cf64a3c7a53145f92bb9 upstream.
+
+Make sure to deregister the controller before disabling underlying
+resources like clocks during driver unbind.
+
+Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver")
+Cc: stable@vger.kernel.org # 6.17: b8db95529979
+Cc: stable@vger.kernel.org # 6.17
+Cc: Sunny Luo <sunny.luo@amlogic.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-2-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-amlogic-spisg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-amlogic-spisg.c
++++ b/drivers/spi/spi-amlogic-spisg.c
+@@ -800,7 +800,7 @@ static int aml_spisg_probe(struct platfo
+ goto out_clk;
+ }
+
+- ret = devm_spi_register_controller(dev, ctlr);
++ ret = spi_register_controller(ctlr);
+ if (ret) {
+ dev_err(&pdev->dev, "spi controller registration failed\n");
+ goto out_clk;
+@@ -823,6 +823,8 @@ static void aml_spisg_remove(struct plat
+ {
+ struct spisg_device *spisg = platform_get_drvdata(pdev);
+
++ spi_unregister_controller(spisg->controller);
++
+ if (!pm_runtime_suspended(&pdev->dev)) {
+ pinctrl_pm_select_sleep_state(&spisg->pdev->dev);
+ clk_disable_unprepare(spisg->core);
--- /dev/null
+From 1044e5a4ccd57bf5a64f90100a321b498e0267a2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:01 +0200
+Subject: spi: aspeed-smc: fix controller deregistration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 1044e5a4ccd57bf5a64f90100a321b498e0267a2 upstream.
+
+Make sure to deregister the controller before disabling it to allow
+SPI device drivers to do I/O during deregistration.
+
+Fixes: e3228ed92893 ("spi: spi-mem: Convert Aspeed SMC driver to spi-mem")
+Cc: stable@vger.kernel.org # 5.19
+Cc: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-3-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-aspeed-smc.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi-aspeed-smc.c
++++ b/drivers/spi/spi-aspeed-smc.c
+@@ -972,7 +972,7 @@ static int aspeed_spi_probe(struct platf
+ return -ENOMEM;
+
+ aspi = spi_controller_get_devdata(ctlr);
+- platform_set_drvdata(pdev, aspi);
++ platform_set_drvdata(pdev, ctlr);
+ aspi->data = data;
+ aspi->dev = dev;
+
+@@ -1021,7 +1021,7 @@ static int aspeed_spi_probe(struct platf
+ return ret;
+ }
+
+- ret = devm_spi_register_controller(dev, ctlr);
++ ret = spi_register_controller(ctlr);
+ if (ret)
+ dev_err(&pdev->dev, "spi_register_controller failed\n");
+
+@@ -1030,7 +1030,10 @@ static int aspeed_spi_probe(struct platf
+
+ static void aspeed_spi_remove(struct platform_device *pdev)
+ {
+- struct aspeed_spi *aspi = platform_get_drvdata(pdev);
++ struct spi_controller *ctlr = platform_get_drvdata(pdev);
++ struct aspeed_spi *aspi = spi_controller_get_devdata(ctlr);
++
++ spi_unregister_controller(ctlr);
+
+ aspeed_spi_enable(aspi, false);
+ }
--- /dev/null
+From 9acecc9bcff058eaef40fd7a4c3650e88b06b220 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:02 +0200
+Subject: spi: at91-usart: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 9acecc9bcff058eaef40fd7a4c3650e88b06b220 upstream.
+
+Make sure to deregister the controller before disabling and releasing
+underlying resources like clocks and DMA during driver unbind.
+
+Fixes: e1892546ff66 ("spi: at91-usart: Add driver for at91-usart as SPI")
+Cc: stable@vger.kernel.org # 4.20
+Cc: Radu Pirea <radu.pirea@microchip.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-4-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-at91-usart.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-at91-usart.c
++++ b/drivers/spi/spi-at91-usart.c
+@@ -556,7 +556,7 @@ static int at91_usart_spi_probe(struct p
+ spin_lock_init(&aus->lock);
+ init_completion(&aus->xfer_completion);
+
+- ret = devm_spi_register_controller(&pdev->dev, controller);
++ ret = spi_register_controller(controller);
+ if (ret)
+ goto at91_usart_fail_register_controller;
+
+@@ -634,8 +634,14 @@ static void at91_usart_spi_remove(struct
+ struct spi_controller *ctlr = platform_get_drvdata(pdev);
+ struct at91_usart_spi *aus = spi_controller_get_devdata(ctlr);
+
++ spi_controller_get(ctlr);
++
++ spi_unregister_controller(ctlr);
++
+ at91_usart_spi_release_dma(ctlr);
+ clk_disable_unprepare(aus->clk);
++
++ spi_controller_put(ctlr);
+ }
+
+ static const struct dev_pm_ops at91_usart_spi_pm_ops = {
--- /dev/null
+From 8d4de97e83520be89d0ff40610ca633b3963a7de Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:03 +0200
+Subject: spi: atmel: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8d4de97e83520be89d0ff40610ca633b3963a7de upstream.
+
+Make sure to deregister the controller before disabling underlying
+resources like clocks during driver unbind.
+
+Fixes: 754ce4f29937 ("[PATCH] SPI: atmel_spi driver")
+Cc: stable@vger.kernel.org # 2.6.21
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-5-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-atmel.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1654,7 +1654,7 @@ static int atmel_spi_probe(struct platfo
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+
+- ret = devm_spi_register_controller(&pdev->dev, host);
++ ret = spi_register_controller(host);
+ if (ret)
+ goto out_free_dma;
+
+@@ -1688,8 +1688,12 @@ static void atmel_spi_remove(struct plat
+ struct spi_controller *host = platform_get_drvdata(pdev);
+ struct atmel_spi *as = spi_controller_get_devdata(host);
+
++ spi_controller_get(host);
++
+ pm_runtime_get_sync(&pdev->dev);
+
++ spi_unregister_controller(host);
++
+ /* reset the hardware and block queue progress */
+ if (as->use_dma) {
+ atmel_spi_stop_dma(host);
+@@ -1716,6 +1720,8 @@ static void atmel_spi_remove(struct plat
+
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++
++ spi_controller_put(host);
+ }
+
+ static int atmel_spi_runtime_suspend(struct device *dev)
--- /dev/null
+From c39e65a4e3b8e764efed0b2f5152a1a8547b80fd Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:04 +0200
+Subject: spi: bcm63xx: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c39e65a4e3b8e764efed0b2f5152a1a8547b80fd upstream.
+
+Make sure to deregister the controller before disabling underlying
+resources like clocks during driver unbind.
+
+Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver")
+Cc: stable@vger.kernel.org # 3.4
+Cc: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-6-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm63xx.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -602,7 +602,7 @@ static int bcm63xx_spi_probe(struct plat
+ goto out_clk_disable;
+
+ /* register and we are done */
+- ret = devm_spi_register_controller(dev, host);
++ ret = spi_register_controller(host);
+ if (ret) {
+ dev_err(dev, "spi register failed\n");
+ goto out_clk_disable;
+@@ -625,11 +625,17 @@ static void bcm63xx_spi_remove(struct pl
+ struct spi_controller *host = platform_get_drvdata(pdev);
+ struct bcm63xx_spi *bs = spi_controller_get_devdata(host);
+
++ spi_controller_get(host);
++
++ spi_unregister_controller(host);
++
+ /* reset spi block */
+ bcm_spi_writeb(bs, 0, SPI_INT_MASK);
+
+ /* HW shutdown */
+ clk_disable_unprepare(bs->clk);
++
++ spi_controller_put(host);
+ }
+
+ static int bcm63xx_spi_suspend(struct device *dev)
--- /dev/null
+From b99206710d032c16b7f8b75e4bc18414d8e4b9f4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:15 +0200
+Subject: spi: lantiq-ssc: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b99206710d032c16b7f8b75e4bc18414d8e4b9f4 upstream.
+
+Make sure to deregister the controller before releasing underlying
+resources like clocks during driver unbind.
+
+Fixes: 17f84b793c01 ("spi: lantiq-ssc: add support for Lantiq SSC SPI controller")
+Cc: stable@vger.kernel.org # 4.11
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-17-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-lantiq-ssc.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-lantiq-ssc.c
++++ b/drivers/spi/spi-lantiq-ssc.c
+@@ -994,7 +994,7 @@ static int lantiq_ssc_probe(struct platf
+ "Lantiq SSC SPI controller (Rev %i, TXFS %u, RXFS %u, DMA %u)\n",
+ revision, spi->tx_fifo_size, spi->rx_fifo_size, supports_dma);
+
+- err = devm_spi_register_controller(dev, host);
++ err = spi_register_controller(host);
+ if (err) {
+ dev_err(dev, "failed to register spi host\n");
+ goto err_wq_destroy;
+@@ -1016,6 +1016,10 @@ static void lantiq_ssc_remove(struct pla
+ {
+ struct lantiq_ssc_spi *spi = platform_get_drvdata(pdev);
+
++ spi_controller_get(spi->host);
++
++ spi_unregister_controller(spi->host);
++
+ lantiq_ssc_writel(spi, 0, LTQ_SPI_IRNEN);
+ lantiq_ssc_writel(spi, 0, LTQ_SPI_CLC);
+ rx_fifo_flush(spi);
+@@ -1024,6 +1028,8 @@ static void lantiq_ssc_remove(struct pla
+
+ destroy_workqueue(spi->wq);
+ clk_put(spi->fpi_clk);
++
++ spi_controller_put(spi->host);
+ }
+
+ static struct platform_driver lantiq_ssc_driver = {
--- /dev/null
+From 77953c76bec9af4191f8692a10225dd816208718 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:16 +0200
+Subject: spi: meson-spicc: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 77953c76bec9af4191f8692a10225dd816208718 upstream.
+
+Make sure to deregister the controller before disabling it to allow SPI
+device drivers to do I/O during deregistration.
+
+Fixes: 454fa271bc4e ("spi: Add Meson SPICC driver")
+Cc: stable@vger.kernel.org # 4.13
+Cc: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-18-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-meson-spicc.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-meson-spicc.c
++++ b/drivers/spi/spi-meson-spicc.c
+@@ -1081,7 +1081,7 @@ static int meson_spicc_probe(struct plat
+ }
+ }
+
+- ret = devm_spi_register_controller(&pdev->dev, host);
++ ret = spi_register_controller(host);
+ if (ret) {
+ dev_err(&pdev->dev, "spi registration failed\n");
+ goto out_host;
+@@ -1099,8 +1099,14 @@ static void meson_spicc_remove(struct pl
+ {
+ struct meson_spicc_device *spicc = platform_get_drvdata(pdev);
+
++ spi_controller_get(spicc->host);
++
++ spi_unregister_controller(spicc->host);
++
+ /* Disable SPI */
+ writel(0, spicc->base + SPICC_CONREG);
++
++ spi_controller_put(spicc->host);
+ }
+
+ static const struct meson_spicc_data meson_spicc_gx_data = {
--- /dev/null
+From 443e3a0005a4342b218b6dbd4c6387d3c7fed85a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:39 +0200
+Subject: spi: qup: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 443e3a0005a4342b218b6dbd4c6387d3c7fed85a upstream.
+
+Make sure to deregister the controller before disabling underlying
+resources like clocks during driver unbind.
+
+Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support")
+Cc: stable@vger.kernel.org # 3.15
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-10-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-qup.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1193,7 +1193,7 @@ static int spi_qup_probe(struct platform
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+
+- ret = devm_spi_register_controller(dev, host);
++ ret = spi_register_controller(host);
+ if (ret)
+ goto disable_pm;
+
+@@ -1320,6 +1320,10 @@ static void spi_qup_remove(struct platfo
+ struct spi_qup *controller = spi_controller_get_devdata(host);
+ int ret;
+
++ spi_controller_get(host);
++
++ spi_unregister_controller(host);
++
+ ret = pm_runtime_get_sync(&pdev->dev);
+
+ if (ret >= 0) {
+@@ -1339,6 +1343,8 @@ static void spi_qup_remove(struct platfo
+
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++
++ spi_controller_put(host);
+ }
+
+ static const struct of_device_id spi_qup_dt_match[] = {
--- /dev/null
+From 19857374010d06ca6a2f7c2c53464122eb804df0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:47 +0200
+Subject: spi: st-ssc4: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 19857374010d06ca6a2f7c2c53464122eb804df0 upstream.
+
+Make sure to deregister the controller before disabling underlying
+resources like clocks during driver unbind.
+
+Fixes: 9e862375c542 ("spi: Add new driver for STMicroelectronics' SPI Controller")
+Cc: stable@vger.kernel.org # 4.0
+Cc: Lee Jones <lee@kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-18-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-st-ssc4.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-st-ssc4.c
++++ b/drivers/spi/spi-st-ssc4.c
+@@ -349,7 +349,7 @@ static int spi_st_probe(struct platform_
+
+ platform_set_drvdata(pdev, host);
+
+- ret = devm_spi_register_controller(&pdev->dev, host);
++ ret = spi_register_controller(host);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to register host\n");
+ goto rpm_disable;
+@@ -371,10 +371,16 @@ static void spi_st_remove(struct platfor
+ struct spi_controller *host = platform_get_drvdata(pdev);
+ struct spi_st *spi_st = spi_controller_get_devdata(host);
+
++ spi_controller_get(host);
++
++ spi_unregister_controller(host);
++
+ pm_runtime_disable(&pdev->dev);
+
+ clk_disable_unprepare(spi_st->clk);
+
++ spi_controller_put(host);
++
+ pinctrl_pm_select_sleep_state(&pdev->dev);
+ }
+
--- /dev/null
+From 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Thu, 26 Feb 2026 15:10:54 +0200
+Subject: staging: media: atomisp: Disallow all private IOCTLs
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c upstream.
+
+Disallow all private IOCTLs. These aren't quite as safe as one could
+assume of IOCTL handlers; disable them for now. Instead of removing the
+code, return in the beginning of the function if cmd is non-zero in order
+to keep static checkers happy.
+
+Reported-by: Soufiane Dani <soufianeda@tutanota.com>
+Closes: https://lore.kernel.org/linux-staging/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com/
+Cc: stable@vger.kernel.org
+Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
+Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+@@ -1356,6 +1356,10 @@ static int atomisp_s_parm(struct file *f
+ static long atomisp_vidioc_default(struct file *file, void *fh,
+ bool valid_prio, unsigned int cmd, void *arg)
+ {
++ /* Disable all private IOCTLs for now! */
++ if (cmd)
++ return -EINVAL;
++
+ struct video_device *vdev = video_devdata(file);
+ struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
+ int err;
projects / thirdparty / kernel / stable-queue.git / commitdiff
