--- /dev/null
+From 4db9cd554883e051df1840d4d58d636043101034 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Tue, 22 Jul 2025 17:58:29 +0200
+Subject: drm/amd/display: Don't overwrite dce60_clk_mgr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 4db9cd554883e051df1840d4d58d636043101034 upstream.
+
+dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr
+with the dce_clk_mgr, causing incorrect behaviour on DCE6.
+Fix it by removing the extra dce_clk_mgr_construct.
+
+Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs")
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c
+@@ -158,7 +158,6 @@ struct clk_mgr *dc_clk_mgr_create(struct
+ return NULL;
+ }
+ dce60_clk_mgr_construct(ctx, clk_mgr);
+- dce_clk_mgr_construct(ctx, clk_mgr);
+ return &clk_mgr->base;
+ }
+ #endif
--- /dev/null
+From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Thu, 24 Jul 2025 22:12:21 -0500
+Subject: drm/amd: Restore cached power limit during resume
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream.
+
+The power limit will be cached in smu->current_power_limit but
+if the ASIC goes into S3 this value won't be restored.
+
+Restore the value during SMU resume.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -1738,6 +1738,12 @@ static int smu_resume(void *handle)
+
+ adev->pm.dpm_enabled = true;
+
++ if (smu->current_power_limit) {
++ ret = smu_set_power_limit(smu, smu->current_power_limit);
++ if (ret && ret != -EOPNOTSUPP)
++ return ret;
++ }
++
+ dev_info(adev->dev, "SMU is resumed successfully!\n");
+
+ return 0;
--- /dev/null
+From 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 Mon Sep 17 00:00:00 2001
+From: Gang Ba <Gang.Ba@amd.com>
+Date: Tue, 8 Jul 2025 14:36:13 -0400
+Subject: drm/amdgpu: Avoid extra evict-restore process.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gang Ba <Gang.Ba@amd.com>
+
+commit 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 upstream.
+
+If vm belongs to another process, this is fclose after fork,
+wait may enable signaling KFD eviction fence and cause parent process queue evicted.
+
+[677852.634569] amdkfd_fence_enable_signaling+0x56/0x70 [amdgpu]
+[677852.634814] __dma_fence_enable_signaling+0x3e/0xe0
+[677852.634820] dma_fence_wait_timeout+0x3a/0x140
+[677852.634825] amddma_resv_wait_timeout+0x7f/0xf0 [amdkcl]
+[677852.634831] amdgpu_vm_wait_idle+0x2d/0x60 [amdgpu]
+[677852.635026] amdgpu_flush+0x34/0x50 [amdgpu]
+[677852.635208] filp_flush+0x38/0x90
+[677852.635213] filp_close+0x14/0x30
+[677852.635216] do_close_on_exec+0xdd/0x130
+[677852.635221] begin_new_exec+0x1da/0x490
+[677852.635225] load_elf_binary+0x307/0xea0
+[677852.635231] ? srso_alias_return_thunk+0x5/0xfbef5
+[677852.635235] ? ima_bprm_check+0xa2/0xd0
+[677852.635240] search_binary_handler+0xda/0x260
+[677852.635245] exec_binprm+0x58/0x1a0
+[677852.635249] bprm_execve.part.0+0x16f/0x210
+[677852.635254] bprm_execve+0x45/0x80
+[677852.635257] do_execveat_common.isra.0+0x190/0x200
+
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Gang Ba <Gang.Ba@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2024,13 +2024,11 @@ void amdgpu_vm_adjust_size(struct amdgpu
+ */
+ long amdgpu_vm_wait_idle(struct amdgpu_vm *vm, long timeout)
+ {
+- timeout = dma_resv_wait_timeout(vm->root.bo->tbo.base.resv,
+- DMA_RESV_USAGE_BOOKKEEP,
+- true, timeout);
++ timeout = drm_sched_entity_flush(&vm->immediate, timeout);
+ if (timeout <= 0)
+ return timeout;
+
+- return dma_fence_wait_timeout(vm->last_unlocked, true, timeout);
++ return drm_sched_entity_flush(&vm->delayed, timeout);
+ }
+
+ /**
--- /dev/null
+From 0bae62cc989fa99ac9cb564eb573aad916d1eb61 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 18 Jul 2025 15:52:04 -0400
+Subject: drm/amdgpu: update mmhub 3.0.1 client id mappings
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0bae62cc989fa99ac9cb564eb573aad916d1eb61 upstream.
+
+Update the client id mapping so the correct clients
+get printed when there is a mmhub page fault.
+
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2a2681eda73b99a2c1ee8cdb006099ea5d0c2505)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 57 ++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 25 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
+@@ -36,40 +36,47 @@
+
+ static const char *mmhub_client_ids_v3_0_1[][2] = {
+ [0][0] = "VMC",
++ [1][0] = "ISPXT",
++ [2][0] = "ISPIXT",
+ [4][0] = "DCEDMC",
+ [5][0] = "DCEVGA",
+ [6][0] = "MP0",
+ [7][0] = "MP1",
+- [8][0] = "MPIO",
+- [16][0] = "HDP",
+- [17][0] = "LSDMA",
+- [18][0] = "JPEG",
+- [19][0] = "VCNU0",
+- [21][0] = "VSCH",
+- [22][0] = "VCNU1",
+- [23][0] = "VCN1",
+- [32+20][0] = "VCN0",
+- [2][1] = "DBGUNBIO",
++ [8][0] = "MPM",
++ [12][0] = "ISPTNR",
++ [14][0] = "ISPCRD0",
++ [15][0] = "ISPCRD1",
++ [16][0] = "ISPCRD2",
++ [22][0] = "HDP",
++ [23][0] = "LSDMA",
++ [24][0] = "JPEG",
++ [27][0] = "VSCH",
++ [28][0] = "VCNU",
++ [29][0] = "VCN",
++ [1][1] = "ISPXT",
++ [2][1] = "ISPIXT",
+ [3][1] = "DCEDWB",
+ [4][1] = "DCEDMC",
+ [5][1] = "DCEVGA",
+ [6][1] = "MP0",
+ [7][1] = "MP1",
+- [8][1] = "MPIO",
+- [10][1] = "DBGU0",
+- [11][1] = "DBGU1",
+- [12][1] = "DBGU2",
+- [13][1] = "DBGU3",
+- [14][1] = "XDP",
+- [15][1] = "OSSSYS",
+- [16][1] = "HDP",
+- [17][1] = "LSDMA",
+- [18][1] = "JPEG",
+- [19][1] = "VCNU0",
+- [20][1] = "VCN0",
+- [21][1] = "VSCH",
+- [22][1] = "VCNU1",
+- [23][1] = "VCN1",
++ [8][1] = "MPM",
++ [10][1] = "ISPMWR0",
++ [11][1] = "ISPMWR1",
++ [12][1] = "ISPTNR",
++ [13][1] = "ISPSWR",
++ [14][1] = "ISPCWR0",
++ [15][1] = "ISPCWR1",
++ [16][1] = "ISPCWR2",
++ [17][1] = "ISPCWR3",
++ [18][1] = "XDP",
++ [21][1] = "OSSSYS",
++ [22][1] = "HDP",
++ [23][1] = "LSDMA",
++ [24][1] = "JPEG",
++ [27][1] = "VSCH",
++ [28][1] = "VCNU",
++ [29][1] = "VCN",
+ };
+
+ static uint32_t mmhub_v3_0_1_get_invalidate_req(unsigned int vmid,
--- /dev/null
+From 2e58401a24e7b2d4ec619104e1a76590c1284a4c Mon Sep 17 00:00:00 2001
+From: Amber Lin <Amber.Lin@amd.com>
+Date: Thu, 31 Jul 2025 20:45:00 -0400
+Subject: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+commit 2e58401a24e7b2d4ec619104e1a76590c1284a4c upstream.
+
+Since KFD proc content was moved to kernel debugfs, we can't destroy KFD
+debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior
+to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens
+when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but
+kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line
+ debugfs_remove_recursive(entry->proc_dentry);
+tries to remove /sys/kernel/debug/kfd/proc/<pid> while
+/sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel
+NULL pointer.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Eric Huang <jinhuieric.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
+@@ -78,8 +78,8 @@ err_ioctl:
+ static void kfd_exit(void)
+ {
+ kfd_cleanup_processes();
+- kfd_debugfs_fini();
+ kfd_process_destroy_wq();
++ kfd_debugfs_fini();
+ kfd_procfs_shutdown();
+ kfd_topology_shutdown();
+ kfd_chardev_exit();
--- /dev/null
+From 69080ec3d0daba8a894025476c98ab16b5a505a4 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Date: Tue, 13 May 2025 17:23:45 +0300
+Subject: media: qcom: camss: cleanup media device allocated resource on error path
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+commit 69080ec3d0daba8a894025476c98ab16b5a505a4 upstream.
+
+A call to media_device_init() requires media_device_cleanup() counterpart
+to complete cleanup and release any allocated resources.
+
+This has been done in the driver .remove() right from the beginning, but
+error paths on .probe() shall also be fixed.
+
+Fixes: a1d7c116fcf7 ("media: camms: Add core files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -1658,7 +1658,7 @@ static int camss_probe(struct platform_d
+ ret = v4l2_device_register(camss->dev, &camss->v4l2_dev);
+ if (ret < 0) {
+ dev_err(dev, "Failed to register V4L2 device: %d\n", ret);
+- goto err_genpd_cleanup;
++ goto err_media_device_cleanup;
+ }
+
+ v4l2_async_nf_init(&camss->notifier);
+@@ -1710,6 +1710,8 @@ err_v4l2_device_unregister:
+ v4l2_device_unregister(&camss->v4l2_dev);
+ v4l2_async_nf_cleanup(&camss->notifier);
+ pm_runtime_disable(dev);
++err_media_device_cleanup:
++ media_device_cleanup(&camss->media_dev);
+ err_genpd_cleanup:
+ camss_genpd_cleanup(camss);
+
--- /dev/null
+From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+Date: Mon, 19 May 2025 12:42:21 +0530
+Subject: media: venus: Add a check for packet size after reading from shared memory
+
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+
+commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream.
+
+Add a check to ensure that the packet size does not exceed the number of
+available words after reading the packet header from shared memory. This
+ensures that the size provided by the firmware is safe to process and
+prevent potential out-of-bounds memory access.
+
+Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vedang Nagar <quic_vnagar@quicinc.com>
+Co-developed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -239,6 +239,7 @@ static int venus_write_queue(struct venu
+ static int venus_read_queue(struct venus_hfi_device *hdev,
+ struct iface_queue *queue, void *pkt, u32 *tx_req)
+ {
++ struct hfi_pkt_hdr *pkt_hdr = NULL;
+ struct hfi_queue_header *qhdr;
+ u32 dwords, new_rd_idx;
+ u32 rd_idx, wr_idx, type, qsize;
+@@ -304,6 +305,9 @@ static int venus_read_queue(struct venus
+ memcpy(pkt, rd_ptr, len);
+ memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2);
+ }
++ pkt_hdr = (struct hfi_pkt_hdr *)(pkt);
++ if ((pkt_hdr->size >> 2) != dwords)
++ return -EINVAL;
+ } else {
+ /* bad packet received, dropping */
+ new_rd_idx = qhdr->write_idx;
--- /dev/null
+From 640803003cd903cea73dc6a86bf6963e238e2b3f Mon Sep 17 00:00:00 2001
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Date: Thu, 19 Jun 2025 09:48:30 +0200
+Subject: media: venus: hfi: explicitly release IRQ during teardown
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+
+commit 640803003cd903cea73dc6a86bf6963e238e2b3f upstream.
+
+Ensure the IRQ is disabled - and all pending handlers completed - before
+dismantling the interrupt routing and clearing related pointers.
+
+This prevents any possibility of the interrupt triggering after the
+handler context has been invalidated.
+
+Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Dikshita Agarwal <quic_dikshita@quicinc.com> # RB5
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -1711,6 +1711,7 @@ void venus_hfi_destroy(struct venus_core
+ venus_interface_queues_release(hdev);
+ mutex_destroy(&hdev->lock);
+ kfree(hdev);
++ disable_irq(core->irq);
+ core->ops = NULL;
+ }
+
--- /dev/null
+From 3200144a2fa4209dc084a19941b9b203b43580f0 Mon Sep 17 00:00:00 2001
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Date: Fri, 6 Jun 2025 17:25:22 +0200
+Subject: media: venus: protect against spurious interrupts during probe
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+
+commit 3200144a2fa4209dc084a19941b9b203b43580f0 upstream.
+
+Make sure the interrupt handler is initialized before the interrupt is
+registered.
+
+If the IRQ is registered before hfi_create(), it's possible that an
+interrupt fires before the handler setup is complete, leading to a NULL
+dereference.
+
+This error condition has been observed during system boot on Rb3Gen2.
+
+Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Dikshita Agarwal <quic_dikshita@quicinc.com> # RB5
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -333,13 +333,13 @@ static int venus_probe(struct platform_d
+ INIT_DELAYED_WORK(&core->work, venus_sys_error_handler);
+ init_waitqueue_head(&core->sys_err_done);
+
+- ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+- "venus", core);
++ ret = hfi_create(core, &venus_core_ops);
+ if (ret)
+ goto err_core_put;
+
+- ret = hfi_create(core, &venus_core_ops);
++ ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
++ "venus", core);
+ if (ret)
+ goto err_core_put;
+
--- /dev/null
+From 377dc500d253f0b26732b2cb062e89668aef890a Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 16 Jun 2025 15:29:14 +0000
+Subject: media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 377dc500d253f0b26732b2cb062e89668aef890a upstream.
+
+The driver uses "whole" fps in all its calculations (e.g. in
+load_per_instance()). Those calculation expect an fps bigger than 1, and
+not big enough to overflow.
+
+Clamp the value if the user provides a param that will result in an invalid
+fps.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0
+Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files")
+Cc: stable@vger.kernel.org
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # qrb5615-rb5
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+[bod: Change "parm" to "param"]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/core.h | 2 ++
+ drivers/media/platform/qcom/venus/vdec.c | 5 ++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/core.h
++++ b/drivers/media/platform/qcom/venus/core.h
+@@ -28,6 +28,8 @@
+ #define VIDC_PMDOMAINS_NUM_MAX 3
+ #define VIDC_RESETS_NUM_MAX 2
+
++#define VENUS_MAX_FPS 240
++
+ extern int venus_fw_debug;
+
+ struct freq_tbl {
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -458,11 +458,10 @@ static int vdec_s_parm(struct file *file
+ us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
+ do_div(us_per_frame, timeperframe->denominator);
+
+- if (!us_per_frame)
+- return -EINVAL;
+-
++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC);
+ fps = (u64)USEC_PER_SEC;
+ do_div(fps, us_per_frame);
++ fps = min(VENUS_MAX_FPS, fps);
+
+ inst->fps = fps;
+ inst->timeperframe = *timeperframe;
--- /dev/null
+From 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 16 Jun 2025 15:29:15 +0000
+Subject: media: venus: venc: Clamp param smaller than 1fps and bigger than 240
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 upstream.
+
+The driver uses "whole" fps in all its calculations (e.g. in
+load_per_instance()). Those calculation expect an fps bigger than 1, and
+not big enough to overflow.
+
+Clamp the param if the user provides a value that will result in an invalid
+fps.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0
+Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+[bod: Change "parm" to "param"]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/venc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -406,11 +406,10 @@ static int venc_s_parm(struct file *file
+ us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
+ do_div(us_per_frame, timeperframe->denominator);
+
+- if (!us_per_frame)
+- return -EINVAL;
+-
++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC);
+ fps = (u64)USEC_PER_SEC;
+ do_div(fps, us_per_frame);
++ fps = min(VENUS_MAX_FPS, fps);
+
+ inst->timeperframe = *timeperframe;
+ inst->fps = fps;
media-usbtv-lock-resolution-while-streaming.patch
media-rainshadow-cec-fix-toctou-race-condition-in-rain_interrupt.patch
media-ov2659-fix-memory-leaks-in-ov2659_probe.patch
+media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch
+media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch
+media-venus-hfi-explicitly-release-irq-during-teardown.patch
+media-venus-protect-against-spurious-interrupts-during-probe.patch
+media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch
+media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch
+drm-amd-restore-cached-power-limit-during-resume.patch
+drm-amdgpu-avoid-extra-evict-restore-process.patch
+drm-amdgpu-update-mmhub-3.0.1-client-id-mappings.patch
+drm-amdkfd-destroy-kfd-debugfs-after-destroy-kfd-wq.patch
+drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
