--- /dev/null
+From 2496b2aaacf137250f4ca449f465e2cadaabb0e8 Mon Sep 17 00:00:00 2001
+From: Dragan Simic <dsimic@manjaro.org>
+Date: Thu, 19 Sep 2024 21:15:26 +0200
+Subject: arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
+
+From: Dragan Simic <dsimic@manjaro.org>
+
+commit 2496b2aaacf137250f4ca449f465e2cadaabb0e8 upstream.
+
+The way InvenSense MPU-6050 accelerometer is mounted on the user-facing side
+of the Pine64 PinePhone mainboard, which makes it rotated 90 degrees counter-
+clockwise, [1] requires the accelerometer's x- and y-axis to be swapped, and
+the direction of the accelerometer's y-axis to be inverted.
+
+Rectify this by adding a mount-matrix to the accelerometer definition in the
+Pine64 PinePhone dtsi file.
+
+[1] https://files.pine64.org/doc/PinePhone/PinePhone%20mainboard%20bottom%20placement%20v1.1%2020191031.pdf
+
+Fixes: 91f480d40942 ("arm64: dts: allwinner: Add initial support for Pine64 PinePhone")
+Cc: stable@vger.kernel.org
+Suggested-by: Ondrej Jirman <megi@xff.cz>
+Suggested-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Signed-off-by: Dragan Simic <dsimic@manjaro.org>
+Reviewed-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Link: https://patch.msgid.link/129f0c754d071cca1db5d207d9d4a7bd9831dff7.1726773282.git.dsimic@manjaro.org
+[wens@csie.org: Replaced Helped-by with Suggested-by]
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
+@@ -212,6 +212,9 @@
+ interrupts = <7 5 IRQ_TYPE_EDGE_RISING>; /* PH5 */
+ vdd-supply = <®_dldo1>;
+ vddio-supply = <®_dldo1>;
++ mount-matrix = "0", "1", "0",
++ "-1", "0", "0",
++ "0", "0", "1";
+ };
+ };
+
--- /dev/null
+From 0ca7699c376743b633b6419a42888dba386d5351 Mon Sep 17 00:00:00 2001
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+Date: Thu, 24 Oct 2024 15:06:50 +0200
+Subject: arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+commit 0ca7699c376743b633b6419a42888dba386d5351 upstream.
+
+The power switch used to power the SD card interface might have
+more than 2ms turn-on time, increase the startup delay to 20ms to
+prevent failures.
+
+Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini")
+Cc: stable@vger.kernel.org
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
+@@ -162,7 +162,7 @@
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+ regulator-name = "+V3.3_SD";
+- startup-delay-us = <2000>;
++ startup-delay-us = <20000>;
+ };
+
+ reserved-memory {
--- /dev/null
+From 6c5789c9d2c06968532243daa235f6ff809ad71e Mon Sep 17 00:00:00 2001
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+Date: Thu, 24 Oct 2024 15:06:51 +0200
+Subject: arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+commit 6c5789c9d2c06968532243daa235f6ff809ad71e upstream.
+
+The power switch used to power the SD card interface might have
+more than 2ms turn-on time, increase the startup delay to 20ms to
+prevent failures.
+
+Fixes: a39ed23bdf6e ("arm64: dts: freescale: add initial support for verdin imx8m plus")
+Cc: stable@vger.kernel.org
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi
+@@ -175,7 +175,7 @@
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+ regulator-name = "+V3.3_SD";
+- startup-delay-us = <2000>;
++ startup-delay-us = <20000>;
+ };
+
+ reserved-memory {
--- /dev/null
+From 2f1aab0cb0661d533f008e4975325080351cdfc8 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wenst@chromium.org>
+Date: Mon, 21 Oct 2024 22:05:36 +0800
+Subject: arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+commit 2f1aab0cb0661d533f008e4975325080351cdfc8 upstream.
+
+The GPU SRAM supply is supposed to be always at least 0.1V higher than
+the GPU supply. However when the DT was upstreamed, the spread was
+incorrectly set to 0.01V.
+
+Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241021140537.3049232-1-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
+index 0c0b3ac59745..eb06b343a540 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
+@@ -1336,7 +1336,7 @@ mt6366_vgpu_reg: vgpu {
+ regulator-allowed-modes = <MT6397_BUCK_MODE_AUTO
+ MT6397_BUCK_MODE_FORCE_PWM>;
+ regulator-coupled-with = <&mt6366_vsram_gpu_reg>;
+- regulator-coupled-max-spread = <10000>;
++ regulator-coupled-max-spread = <100000>;
+ };
+
+ mt6366_vproc11_reg: vproc11 {
+@@ -1545,7 +1545,7 @@ mt6366_vsram_gpu_reg: vsram-gpu {
+ regulator-ramp-delay = <6250>;
+ regulator-enable-ramp-delay = <240>;
+ regulator-coupled-with = <&mt6366_vgpu_reg>;
+- regulator-coupled-max-spread = <10000>;
++ regulator-coupled-max-spread = <100000>;
+ };
+
+ mt6366_vsram_others_reg: vsram-others {
+--
+2.47.1
+
--- /dev/null
+From fbcc95fceb6d179dd150df2dc613dfd9b013052c Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wenst@chromium.org>
+Date: Tue, 29 Oct 2024 18:02:25 +0800
+Subject: arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+commit fbcc95fceb6d179dd150df2dc613dfd9b013052c upstream.
+
+The reset line of the IT6505 bridge chip is active low, not active high.
+It was incorrectly inverted in the device tree as the implementation at
+the time incorrectly inverted the polarity in its driver, due to a prior
+device having an inline inverting level shifter.
+
+Fix the polarity now while the external display pipeline is incomplete,
+thereby avoiding any impact to running systems.
+
+A matching fix for the driver should be included if this change is
+backported.
+
+Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20241029100226.660263-1-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
+@@ -423,7 +423,7 @@
+ #sound-dai-cells = <0>;
+ ovdd-supply = <&mt6366_vsim2_reg>;
+ pwr18-supply = <&pp1800_dpbrdg_dx>;
+- reset-gpios = <&pio 177 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&pio 177 GPIO_ACTIVE_LOW>;
+
+ ports {
+ #address-cells = <1>;
--- /dev/null
+From 2213ca51998fef61d3df4ca156054cdcc37c42b8 Mon Sep 17 00:00:00 2001
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+Date: Thu, 24 Oct 2024 15:06:28 +0200
+Subject: arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+commit 2213ca51998fef61d3df4ca156054cdcc37c42b8 upstream.
+
+The power switch used to power the SD card interface might have
+more than 2ms turn-on time, increase the startup delay to 20ms to
+prevent failures.
+
+Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62")
+Cc: stable@vger.kernel.org
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://lore.kernel.org/r/20241024130628.49650-1-francesco@dolcini.it
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+@@ -160,7 +160,7 @@
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+ regulator-name = "+V3.3_SD";
+- startup-delay-us = <2000>;
++ startup-delay-us = <20000>;
+ };
+
+ reg_sdhc1_vqmmc: regulator-sdhci1-vqmmc {
--- /dev/null
+From 6012169e8aae9c0eda38bbedcd7a1540a81220ae Mon Sep 17 00:00:00 2001
+From: Yuan Can <yuancan@huawei.com>
+Date: Tue, 5 Nov 2024 21:01:05 +0800
+Subject: md/md-bitmap: Add missing destroy_work_on_stack()
+
+From: Yuan Can <yuancan@huawei.com>
+
+commit 6012169e8aae9c0eda38bbedcd7a1540a81220ae upstream.
+
+This commit add missed destroy_work_on_stack() operations for
+unplug_work.work in bitmap_unplug_async().
+
+Fixes: a022325ab970 ("md/md-bitmap: add a new helper to unplug bitmap asynchrously")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20241105130105.127336-1-yuancan@huawei.com
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md-bitmap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -1285,6 +1285,7 @@ static void bitmap_unplug_async(struct b
+
+ queue_work(md_bitmap_wq, &unplug_work.work);
+ wait_for_completion(&done);
++ destroy_work_on_stack(&unplug_work.work);
+ }
+
+ static void bitmap_unplug(struct mddev *mddev, bool sync)
--- /dev/null
+From fa1944bbe6220eb929e2c02e5e8706b908565711 Mon Sep 17 00:00:00 2001
+From: Xiao Ni <xni@redhat.com>
+Date: Wed, 6 Nov 2024 17:51:24 +0800
+Subject: md/raid5: Wait sync io to finish before changing group cnt
+
+From: Xiao Ni <xni@redhat.com>
+
+commit fa1944bbe6220eb929e2c02e5e8706b908565711 upstream.
+
+One customer reports a bug: raid5 is hung when changing thread cnt
+while resync is running. The stripes are all in conf->handle_list
+and new threads can't handle them.
+
+Commit b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removes
+pers->quiesce from mddev_suspend/resume. Before this patch, mddev_suspend
+needs to wait for all ios including sync io to finish. Now it's used
+to only wait normal io.
+
+Fix this by calling raid5_quiesce from raid5_store_group_thread_cnt
+directly to wait all sync requests to finish before changing the group
+cnt.
+
+Fixes: b39f35ebe86d ("md: don't quiesce in mddev_suspend()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xiao Ni <xni@redhat.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20241106095124.74577-1-xni@redhat.com
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid5.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7177,6 +7177,8 @@ raid5_store_group_thread_cnt(struct mdde
+ err = mddev_suspend_and_lock(mddev);
+ if (err)
+ return err;
++ raid5_quiesce(mddev, true);
++
+ conf = mddev->private;
+ if (!conf)
+ err = -ENODEV;
+@@ -7198,6 +7200,8 @@ raid5_store_group_thread_cnt(struct mdde
+ kfree(old_groups);
+ }
+ }
++
++ raid5_quiesce(mddev, false);
+ mddev_unlock_and_resume(mddev);
+
+ return err ?: len;
--- /dev/null
+From 8cbb1a7bd5973b57898b26eb804fe44af440bb63 Mon Sep 17 00:00:00 2001
+From: Ming Qian <ming.qian@nxp.com>
+Date: Fri, 13 Sep 2024 15:21:45 +0900
+Subject: media: amphion: Set video drvdata before register video device
+
+From: Ming Qian <ming.qian@nxp.com>
+
+commit 8cbb1a7bd5973b57898b26eb804fe44af440bb63 upstream.
+
+The video drvdata should be set before the video device is registered,
+otherwise video_drvdata() may return NULL in the open() file ops, and led
+to oops.
+
+Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Reviewed-by: TaoJiang <tao.jiang_2@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/amphion/vpu_v4l2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -841,6 +841,7 @@ int vpu_add_func(struct vpu_dev *vpu, st
+ vfd->fops = vdec_get_fops();
+ vfd->ioctl_ops = vdec_get_ioctl_ops();
+ }
++ video_set_drvdata(vfd, vpu);
+
+ ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1);
+ if (ret) {
+@@ -848,7 +849,6 @@ int vpu_add_func(struct vpu_dev *vpu, st
+ v4l2_m2m_release(func->m2m_dev);
+ return ret;
+ }
+- video_set_drvdata(vfd, vpu);
+ func->vfd = vfd;
+
+ ret = v4l2_m2m_register_media_controller(func->m2m_dev, func->vfd, func->function);
--- /dev/null
+From d6594d50761728d09f23238cf9c368bab6260ef3 Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Fri, 1 Nov 2024 17:40:48 +0800
+Subject: media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit d6594d50761728d09f23238cf9c368bab6260ef3 upstream.
+
+It is not valid to call pm_runtime_set_suspended() and
+pm_runtime_set_active() for devices with runtime PM enabled because it
+returns -EAGAIN if it is enabled already and working. So, adjust the
+order to fix it.
+
+Cc: stable@vger.kernel.org
+Fixes: 5f9a089b6de3 ("dw9768: Enable low-power probe on ACPI")
+Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/dw9768.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/dw9768.c
++++ b/drivers/media/i2c/dw9768.c
+@@ -471,10 +471,9 @@ static int dw9768_probe(struct i2c_clien
+ * to be powered on in an ACPI system. Similarly for power off in
+ * remove.
+ */
+- pm_runtime_enable(dev);
+ full_power = (is_acpi_node(dev_fwnode(dev)) &&
+ acpi_dev_state_d0(dev)) ||
+- (is_of_node(dev_fwnode(dev)) && !pm_runtime_enabled(dev));
++ (is_of_node(dev_fwnode(dev)) && !IS_ENABLED(CONFIG_PM));
+ if (full_power) {
+ ret = dw9768_runtime_resume(dev);
+ if (ret < 0) {
+@@ -484,6 +483,7 @@ static int dw9768_probe(struct i2c_clien
+ pm_runtime_set_active(dev);
+ }
+
++ pm_runtime_enable(dev);
+ ret = v4l2_async_register_subdev(&dw9768->sd);
+ if (ret < 0) {
+ dev_err(dev, "failed to register V4L2 subdev: %d", ret);
+@@ -495,12 +495,12 @@ static int dw9768_probe(struct i2c_clien
+ return 0;
+
+ err_power_off:
++ pm_runtime_disable(dev);
+ if (full_power) {
+ dw9768_runtime_suspend(dev);
+ pm_runtime_set_suspended(dev);
+ }
+ err_clean_entity:
+- pm_runtime_disable(dev);
+ media_entity_cleanup(&dw9768->sd.entity);
+ err_free_handler:
+ v4l2_ctrl_handler_free(&dw9768->ctrls);
+@@ -517,12 +517,12 @@ static void dw9768_remove(struct i2c_cli
+ v4l2_async_unregister_subdev(&dw9768->sd);
+ v4l2_ctrl_handler_free(&dw9768->ctrls);
+ media_entity_cleanup(&dw9768->sd.entity);
++ pm_runtime_disable(dev);
+ if ((is_acpi_node(dev_fwnode(dev)) && acpi_dev_state_d0(dev)) ||
+- (is_of_node(dev_fwnode(dev)) && !pm_runtime_enabled(dev))) {
++ (is_of_node(dev_fwnode(dev)) && !IS_ENABLED(CONFIG_PM))) {
+ dw9768_runtime_suspend(dev);
+ pm_runtime_set_suspended(dev);
+ }
+- pm_runtime_disable(dev);
+ }
+
+ static const struct of_device_id dw9768_of_table[] = {
--- /dev/null
+From d2b7ecc26bd5406d5ba927be1748aa99c568696c Mon Sep 17 00:00:00 2001
+From: Ming Qian <ming.qian@nxp.com>
+Date: Fri, 13 Sep 2024 15:21:44 +0900
+Subject: media: imx-jpeg: Set video drvdata before register video device
+
+From: Ming Qian <ming.qian@nxp.com>
+
+commit d2b7ecc26bd5406d5ba927be1748aa99c568696c upstream.
+
+The video drvdata should be set before the video device is registered,
+otherwise video_drvdata() may return NULL in the open() file ops, and led
+to oops.
+
+Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Reviewed-by: TaoJiang <tao.jiang_2@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+@@ -2842,6 +2842,7 @@ static int mxc_jpeg_probe(struct platfor
+ jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
+ jpeg->dec_vdev->device_caps = V4L2_CAP_STREAMING |
+ V4L2_CAP_VIDEO_M2M_MPLANE;
++ video_set_drvdata(jpeg->dec_vdev, jpeg);
+ if (mode == MXC_JPEG_ENCODE) {
+ v4l2_disable_ioctl(jpeg->dec_vdev, VIDIOC_DECODER_CMD);
+ v4l2_disable_ioctl(jpeg->dec_vdev, VIDIOC_TRY_DECODER_CMD);
+@@ -2854,7 +2855,6 @@ static int mxc_jpeg_probe(struct platfor
+ dev_err(dev, "failed to register video device\n");
+ goto err_vdev_register;
+ }
+- video_set_drvdata(jpeg->dec_vdev, jpeg);
+ if (mode == MXC_JPEG_ENCODE)
+ v4l2_info(&jpeg->v4l2_dev,
+ "encoder device registered as /dev/video%d (%d,%d)\n",
--- /dev/null
+From 17af2b39daf12870cac61ffc360e62bc35798afb Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <guoqing.jiang@canonical.com>
+Date: Thu, 12 Sep 2024 10:48:01 +0800
+Subject: media: mtk-jpeg: Fix null-ptr-deref during unload module
+
+From: Guoqing Jiang <guoqing.jiang@canonical.com>
+
+commit 17af2b39daf12870cac61ffc360e62bc35798afb upstream.
+
+The workqueue should be destroyed in mtk_jpeg_core.c since commit
+09aea13ecf6f ("media: mtk-jpeg: refactor some variables"), otherwise
+the below calltrace can be easily triggered.
+
+[ 677.862514] Unable to handle kernel paging request at virtual address dfff800000000023
+[ 677.863633] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
+...
+[ 677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G O 6.8.12-mtk+gfa1a78e5d24b+ #17
+...
+[ 677.882838] pc : destroy_workqueue+0x3c/0x770
+[ 677.883413] lr : mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
+[ 677.884314] sp : ffff80008ad974f0
+[ 677.884744] x29: ffff80008ad974f0 x28: ffff0000d7115580 x27: ffff0000dd691070
+[ 677.885669] x26: ffff0000dd691408 x25: ffff8000844af3e0 x24: ffff80008ad97690
+[ 677.886592] x23: ffff0000e051d400 x22: ffff0000dd691010 x21: dfff800000000000
+[ 677.887515] x20: 0000000000000000 x19: 0000000000000000 x18: ffff800085397ac0
+[ 677.888438] x17: 0000000000000000 x16: ffff8000801b87c8 x15: 1ffff000115b2e10
+[ 677.889361] x14: 00000000f1f1f1f1 x13: 0000000000000000 x12: ffff7000115b2e4d
+[ 677.890285] x11: 1ffff000115b2e4c x10: ffff7000115b2e4c x9 : ffff80000aa43e90
+[ 677.891208] x8 : 00008fffeea4d1b4 x7 : ffff80008ad97267 x6 : 0000000000000001
+[ 677.892131] x5 : ffff80008ad97260 x4 : ffff7000115b2e4d x3 : 0000000000000000
+[ 677.893054] x2 : 0000000000000023 x1 : dfff800000000000 x0 : 0000000000000118
+[ 677.893977] Call trace:
+[ 677.894297] destroy_workqueue+0x3c/0x770
+[ 677.894826] mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
+[ 677.895677] devm_action_release+0x50/0x90
+[ 677.896211] release_nodes+0xe8/0x170
+[ 677.896688] devres_release_all+0xf8/0x178
+[ 677.897219] device_unbind_cleanup+0x24/0x170
+[ 677.897785] device_release_driver_internal+0x35c/0x480
+[ 677.898461] device_release_driver+0x20/0x38
+...
+[ 677.912665] ---[ end trace 0000000000000000 ]---
+
+Fixes: 09aea13ecf6f ("media: mtk-jpeg: refactor some variables")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 ++++++++++
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 -----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+@@ -1293,6 +1293,11 @@ static int mtk_jpeg_single_core_init(str
+ return 0;
+ }
+
++static void mtk_jpeg_destroy_workqueue(void *data)
++{
++ destroy_workqueue(data);
++}
++
+ static int mtk_jpeg_probe(struct platform_device *pdev)
+ {
+ struct mtk_jpeg_dev *jpeg;
+@@ -1337,6 +1342,11 @@ static int mtk_jpeg_probe(struct platfor
+ | WQ_FREEZABLE);
+ if (!jpeg->workqueue)
+ return -EINVAL;
++ ret = devm_add_action_or_reset(&pdev->dev,
++ mtk_jpeg_destroy_workqueue,
++ jpeg->workqueue);
++ if (ret)
++ return ret;
+ }
+
+ ret = v4l2_device_register(&pdev->dev, &jpeg->v4l2_dev);
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
+@@ -578,11 +578,6 @@ static int mtk_jpegdec_hw_init_irq(struc
+ return 0;
+ }
+
+-static void mtk_jpegdec_destroy_workqueue(void *data)
+-{
+- destroy_workqueue(data);
+-}
+-
+ static int mtk_jpegdec_hw_probe(struct platform_device *pdev)
+ {
+ struct mtk_jpegdec_clk *jpegdec_clk;
+@@ -606,12 +601,6 @@ static int mtk_jpegdec_hw_probe(struct p
+ dev->plat_dev = pdev;
+ dev->dev = &pdev->dev;
+
+- ret = devm_add_action_or_reset(&pdev->dev,
+- mtk_jpegdec_destroy_workqueue,
+- master_dev->workqueue);
+- if (ret)
+- return ret;
+-
+ spin_lock_init(&dev->hw_lock);
+ dev->hw_state = MTK_JPEG_HW_IDLE;
+
--- /dev/null
+From 4f45d65b781499d2a79eca12155532739c876aa2 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Date: Wed, 14 Aug 2024 00:03:42 +0300
+Subject: media: qcom: camss: fix error path on configuration of power domains
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+commit 4f45d65b781499d2a79eca12155532739c876aa2 upstream.
+
+There is a chance to meet runtime issues during configuration of CAMSS
+power domains, because on the error path dev_pm_domain_detach() is
+unexpectedly called with NULL or error pointer.
+
+One of the simplest ways to reproduce the problem is to probe CAMSS
+driver before registration of CAMSS power domains, for instance if
+a platform CAMCC driver is simply not built.
+
+Warning backtrace example:
+
+ Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2
+
+ <snip>
+
+ pc : dev_pm_domain_detach+0x8/0x48
+ lr : camss_probe+0x374/0x9c0
+
+ <snip>
+
+ Call trace:
+ dev_pm_domain_detach+0x8/0x48
+ platform_probe+0x70/0xf0
+ really_probe+0xc4/0x2a8
+ __driver_probe_device+0x80/0x140
+ driver_probe_device+0x48/0x170
+ __device_attach_driver+0xc0/0x148
+ bus_for_each_drv+0x88/0xf0
+ __device_attach+0xb0/0x1c0
+ device_initial_probe+0x1c/0x30
+ bus_probe_device+0xb4/0xc0
+ deferred_probe_work_func+0x90/0xd0
+ process_one_work+0x164/0x3e0
+ worker_thread+0x310/0x420
+ kthread+0x120/0x130
+ ret_from_fork+0x10/0x20
+
+Fixes: 23aa4f0cd327 ("media: qcom: camss: Move VFE power-domain specifics into vfe.c")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -2130,10 +2130,8 @@ static int camss_configure_pd(struct cam
+ if (camss->res->pd_name) {
+ camss->genpd = dev_pm_domain_attach_by_name(camss->dev,
+ camss->res->pd_name);
+- if (IS_ERR(camss->genpd)) {
+- ret = PTR_ERR(camss->genpd);
+- goto fail_pm;
+- }
++ if (IS_ERR(camss->genpd))
++ return PTR_ERR(camss->genpd);
+ }
+
+ if (!camss->genpd) {
+@@ -2143,14 +2141,13 @@ static int camss_configure_pd(struct cam
+ */
+ camss->genpd = dev_pm_domain_attach_by_id(camss->dev,
+ camss->genpd_num - 1);
++ if (IS_ERR(camss->genpd))
++ return PTR_ERR(camss->genpd);
+ }
+- if (IS_ERR_OR_NULL(camss->genpd)) {
+- if (!camss->genpd)
+- ret = -ENODEV;
+- else
+- ret = PTR_ERR(camss->genpd);
+- goto fail_pm;
+- }
++
++ if (!camss->genpd)
++ return -ENODEV;
++
+ camss->genpd_link = device_link_add(camss->dev, camss->genpd,
+ DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME |
+ DL_FLAG_RPM_ACTIVE);
btrfs-ref-verify-fix-use-after-free-after-invalid-re.patch
iommu-tegra241-cmdqv-fix-unused-variable-warning.patch
netkit-add-option-for-scrubbing-skb-meta-data.patch
+md-raid5-wait-sync-io-to-finish-before-changing-group-cnt.patch
+md-md-bitmap-add-missing-destroy_work_on_stack.patch
+arm64-dts-allwinner-pinephone-add-mount-matrix-to-accelerometer.patch
+arm64-dts-mediatek-mt8186-corsola-fix-gpu-supply-coupling-max-spread.patch
+arm64-dts-freescale-imx8mm-verdin-fix-sd-regulator-startup-delay.patch
+arm64-dts-ti-k3-am62-verdin-fix-sd-regulator-startup-delay.patch
+arm64-dts-mediatek-mt8186-corsola-fix-it6505-reset-line-polarity.patch
+media-qcom-camss-fix-error-path-on-configuration-of-power-domains.patch
+media-amphion-set-video-drvdata-before-register-video-device.patch
+media-imx-jpeg-set-video-drvdata-before-register-video-device.patch
+media-mtk-jpeg-fix-null-ptr-deref-during-unload-module.patch
+media-i2c-dw9768-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch
+arm64-dts-freescale-imx8mp-verdin-fix-sd-regulator-startup-delay.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
