--- /dev/null
+From 1a0e57eb96c3fca338665ffd7d9b59f351e5fea7 Mon Sep 17 00:00:00 2001
+From: Lijo Lazar <lijo.lazar@amd.com>
+Date: Tue, 5 Aug 2025 17:40:09 +0530
+Subject: drm/amdgpu/vcn: Fix double-free of vcn dump buffer
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+commit 1a0e57eb96c3fca338665ffd7d9b59f351e5fea7 upstream.
+
+The buffer is already freed as part of amdgpu_vcn_reg_dump_fini(). The
+issue is introduced by below patch series.
+
+Fixes: de55cbff5ce9 ("drm/amdgpu/vcn: Add regdump helper functions")
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 1 +
+ drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 1 -
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 --
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 2 --
+ 4 files changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -1573,6 +1573,7 @@ int amdgpu_vcn_reg_dump_init(struct amdg
+ static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev)
+ {
+ kfree(adev->vcn.ip_dump);
++ adev->vcn.ip_dump = NULL;
+ adev->vcn.reg_list = NULL;
+ adev->vcn.reg_count = 0;
+ }
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+@@ -361,7 +361,6 @@ static int vcn_v3_0_sw_fini(struct amdgp
+ return r;
+ }
+
+- kfree(adev->vcn.ip_dump);
+ return 0;
+ }
+
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+@@ -287,8 +287,6 @@ static int vcn_v4_0_3_sw_fini(struct amd
+ return r;
+ }
+
+- kfree(adev->vcn.ip_dump);
+-
+ return 0;
+ }
+
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+@@ -284,8 +284,6 @@ static int vcn_v4_0_5_sw_fini(struct amd
+ return r;
+ }
+
+- kfree(adev->vcn.ip_dump);
+-
+ return 0;
+ }
+
--- /dev/null
+From 0ba7a254afd037cfc2b656f379c54b43c6e574e8 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Mon, 29 Sep 2025 13:27:30 +0200
+Subject: scsi: ufs: core: Fix PM QoS mutex initialization
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 0ba7a254afd037cfc2b656f379c54b43c6e574e8 upstream.
+
+hba->pm_qos_mutex is used very early as a part of ufshcd_init(), so it
+need to be initialized before that call. This fixes the following
+warning:
+
+------------[ cut here ]------------
+DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+WARNING: kernel/locking/mutex.c:577 at __mutex_lock+0x268/0x894, CPU#4: kworker/u32:4/72
+Modules linked in:
+CPU: 4 UID: 0 PID: 72 Comm: kworker/u32:4 Not tainted 6.17.0-rc7-next-20250926+ #11223 PREEMPT
+Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
+Workqueue: events_unbound deferred_probe_work_func
+pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : __mutex_lock+0x268/0x894
+lr : __mutex_lock+0x268/0x894
+...
+Call trace:
+ __mutex_lock+0x268/0x894 (P)
+ mutex_lock_nested+0x24/0x30
+ ufshcd_pm_qos_update+0x30/0x78
+ ufshcd_setup_clocks+0x2d4/0x3c4
+ ufshcd_init+0x234/0x126c
+ ufshcd_pltfrm_init+0x62c/0x82c
+ ufs_qcom_probe+0x20/0x58
+ platform_probe+0x5c/0xac
+ really_probe+0xbc/0x298
+ __driver_probe_device+0x78/0x12c
+ driver_probe_device+0x40/0x164
+ __device_attach_driver+0xb8/0x138
+ bus_for_each_drv+0x80/0xdc
+ __device_attach+0xa8/0x1b0
+ device_initial_probe+0x14/0x20
+ bus_probe_device+0xb0/0xb4
+ deferred_probe_work_func+0x8c/0xc8
+ process_one_work+0x208/0x60c
+ worker_thread+0x244/0x388
+ kthread+0x150/0x228
+ ret_from_fork+0x10/0x20
+irq event stamp: 57267
+hardirqs last enabled at (57267): [<ffffd761485e868c>] _raw_spin_unlock_irqrestore+0x74/0x78
+hardirqs last disabled at (57266): [<ffffd76147b13c44>] clk_enable_lock+0x7c/0xf0
+softirqs last enabled at (56270): [<ffffd7614734446c>] handle_softirqs+0x4c4/0x4dc
+softirqs last disabled at (56265): [<ffffd76147290690>] __do_softirq+0x14/0x20
+---[ end trace 0000000000000000 ]---
+
+Fixes: 79dde5f7dc7c ("scsi: ufs: core: Fix data race in CPU latency PM QoS request handling")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Message-Id: <20250929112730.3782765-1-m.szyprowski@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ufs/core/ufshcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -10674,6 +10674,9 @@ int ufshcd_init(struct ufs_hba *hba, voi
+ */
+ spin_lock_init(&hba->clk_gating.lock);
+
++ /* Initialize mutex for PM QoS request synchronization */
++ mutex_init(&hba->pm_qos_mutex);
++
+ /*
+ * Set the default power management level for runtime and system PM.
+ * Host controller drivers can override them in their
+@@ -10762,9 +10765,6 @@ int ufshcd_init(struct ufs_hba *hba, voi
+
+ mutex_init(&hba->wb_mutex);
+
+- /* Initialize mutex for PM QoS request synchronization */
+- mutex_init(&hba->pm_qos_mutex);
+-
+ init_rwsem(&hba->clk_scaling_lock);
+
+ ufshcd_init_clk_gating(hba);
projects / thirdparty / kernel / stable-queue.git / commitdiff
