--- /dev/null
+From f223d27a546c1e1f48d38fd67760e78f068fe8c4 Mon Sep 17 00:00:00 2001
+From: Carlos Llamas <cmllamas@google.com>
+Date: Fri, 19 Jun 2026 18:52:31 +0000
+Subject: binder: fix UAF in binder_free_transaction()
+
+From: Carlos Llamas <cmllamas@google.com>
+
+commit f223d27a546c1e1f48d38fd67760e78f068fe8c4 upstream.
+
+In binder_free_transaction(), the t->to_proc is read under the t->lock.
+However, once the t->lock is dropped, the to_proc can die in parallel.
+This leads to a use-after-free error when we attempt to acquire its
+inner lock right afterwards:
+
+ ==================================================================
+ BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0
+ Write of size 4 at addr ffff00001125da70 by task B/672
+
+ CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT
+ Hardware name: linux,dummy-virt (DT)
+ Call trace:
+ _raw_spin_lock+0xe4/0x1a0
+ binder_free_transaction+0x8c/0x320
+ binder_send_failed_reply+0x21c/0x2f8
+ binder_thread_release+0x488/0x7e0
+ binder_ioctl+0x12c0/0x29a0
+ [...]
+
+ Allocated by task 675:
+ __kmalloc_cache_noprof+0x174/0x444
+ binder_open+0x118/0xb70
+ do_dentry_open+0x374/0x1040
+ vfs_open+0x58/0x3bc
+ [...]
+
+ Freed by task 212:
+ __kasan_slab_free+0x58/0x80
+ kfree+0x1a0/0x4a4
+ binder_proc_dec_tmpref+0x32c/0x5e0
+ binder_deferred_func+0xc48/0x104c
+ process_one_work+0x53c/0xbc0
+ [...]
+ ==================================================================
+
+To prevent this, pin the target thread (t->to_thread) to guarantee the
+target process remains alive. Undelivered transactions without a target
+thread are already safe, as the target process can only be the current
+context in those paths.
+
+Cc: stable <stable@kernel.org>
+Reported-by: Alice Ryhl <aliceryhl@google.com>
+Closes: https://lore.kernel.org/all/aikJKVuny_eOivwN@google.com/
+Fixes: a370003cc301 ("binder: fix possible UAF when freeing buffer")
+Signed-off-by: Carlos Llamas <cmllamas@google.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260619185233.2194678-2-cmllamas@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1566,10 +1566,19 @@ static void binder_txn_latency_free(stru
+
+ static void binder_free_transaction(struct binder_transaction *t)
+ {
++ struct binder_thread *target_thread;
+ struct binder_proc *target_proc;
+
+ spin_lock(&t->lock);
+ target_proc = t->to_proc;
++ target_thread = t->to_thread;
++ /*
++ * Pin target_thread to keep target_proc alive. Undelivered
++ * transactions with !target_thread are safe, as target_proc
++ * can only be the current context there.
++ */
++ if (target_thread)
++ atomic_inc(&target_thread->tmp_ref);
+ spin_unlock(&t->lock);
+
+ if (target_proc) {
+@@ -1584,6 +1593,10 @@ static void binder_free_transaction(stru
+ t->buffer->transaction = NULL;
+ binder_inner_proc_unlock(target_proc);
+ }
++
++ if (target_thread)
++ binder_thread_dec_tmpref(target_thread);
++
+ if (trace_binder_txn_latency_free_enabled())
+ binder_txn_latency_free(t);
+ /*
--- /dev/null
+From 114a116aaa5f0295376cdf12da743c5bce3b20ce Mon Sep 17 00:00:00 2001
+From: Carlos Llamas <cmllamas@google.com>
+Date: Fri, 19 Jun 2026 18:52:30 +0000
+Subject: binder: fix UAF in binder_thread_release()
+
+From: Carlos Llamas <cmllamas@google.com>
+
+commit 114a116aaa5f0295376cdf12da743c5bce3b20ce upstream.
+
+When a thread exits, binder_thread_release() walks its transaction stack
+to clear the t->from and t->to_proc that correspond with the exiting
+thread. However, a process dying in parallel might attempt to kfree some
+of these transactions. And if one of them has no associated t->to_proc,
+the t->to_proc->inner_lock will not be acquired.
+
+This means that transaction accesses in binder_thread_release() after
+t->to_proc has been cleared might race with binder_free_transaction()
+and cause a use-after-free error as reported by KASAN:
+
+ ==================================================================
+ BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798
+ Write of size 8 at addr ffff000016627500 by task X/715
+
+ CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT
+ Hardware name: linux,dummy-virt (DT)
+ Call trace:
+ binder_thread_release+0x5d0/0x798
+ binder_ioctl+0x12c0/0x299c
+ [...]
+
+ Allocated by task 717 on cpu 18 at 67.267803s:
+ __kasan_kmalloc+0xa0/0xbc
+ __kmalloc_cache_noprof+0x174/0x444
+ binder_transaction+0x554/0x8150
+ binder_thread_write+0xa30/0x4354
+ binder_ioctl+0x20f0/0x299c
+ [...]
+
+ Freed by task 202 on cpu 18 at 90.416221s:
+ __kasan_slab_free+0x58/0x80
+ kfree+0x1a0/0x4a4
+ binder_free_transaction+0x150/0x294
+ binder_send_failed_reply+0x398/0x6d8
+ binder_release_work+0x3e4/0x4ec
+ binder_deferred_func+0xbd8/0x104c
+ [...]
+ ==================================================================
+
+In order to avoid this, make sure that binder_free_transaction() reads
+the t->to_proc under the transaction lock. This will serialize the
+transaction release with the accesses in binder_thread_release(). Plus,
+it matches the documented locking rules for @to_proc.
+
+Cc: stable <stable@kernel.org>
+Fixes: 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe")
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Signed-off-by: Carlos Llamas <cmllamas@google.com>
+Link: https://patch.msgid.link/20260619185233.2194678-1-cmllamas@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1566,7 +1566,11 @@ static void binder_txn_latency_free(stru
+
+ static void binder_free_transaction(struct binder_transaction *t)
+ {
+- struct binder_proc *target_proc = t->to_proc;
++ struct binder_proc *target_proc;
++
++ spin_lock(&t->lock);
++ target_proc = t->to_proc;
++ spin_unlock(&t->lock);
+
+ if (target_proc) {
+ binder_inner_proc_lock(target_proc);
--- /dev/null
+From 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 Mon Sep 17 00:00:00 2001
+From: Zenm Chen <zenmchen@gmail.com>
+Date: Tue, 26 May 2026 00:19:42 +0800
+Subject: Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+commit 88b4d528eda4ac71c2952b3458f2abbc80a91cd2 upstream.
+
+Add USB ID 2c4e:0128 for Mercusys MA60XNB, an RTL8851BU-based
+Wi-Fi + Bluetooth adapter.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below:
+
+T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=2c4e ProdID=0128 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=802.11ax WLAN Adapter
+S: SerialNumber=00e04c000001
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org # 6.6.x
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -538,6 +538,8 @@ static const struct usb_device_id blackl
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x2c4e, 0x0128), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Realtek 8852BE Bluetooth devices */
+ { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
--- /dev/null
+From c5b600a3c05b1a7a110d558df935a8fc8a471c79 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 4 Jun 2026 08:37:37 +0200
+Subject: Bluetooth: btusb: fix use-after-free on marvell probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c5b600a3c05b1a7a110d558df935a8fc8a471c79 upstream.
+
+Make sure to stop any TX URBs submitted during Marvell OOB wakeup
+configuration on later probe failures to avoid use-after-free in the
+completion callback.
+
+This issue was reported by Sashiko while reviewing a fix for a wakeup
+source leak in the btusb probe errors paths.
+
+Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
+Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the pins for oob wakeup")
+Cc: stable@vger.kernel.org # 4.11
+Cc: Rajat Jain <rajatja@google.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -4015,7 +4015,7 @@ static int btusb_probe(struct usb_interf
+ if (id->driver_info & BTUSB_INTEL_COMBINED) {
+ err = btintel_configure_setup(hdev);
+ if (err)
+- goto out_free_dev;
++ goto err_kill_tx_urbs;
+
+ /* Transport specific configuration */
+ hdev->send = btusb_send_frame_intel;
+@@ -4163,7 +4163,7 @@ static int btusb_probe(struct usb_interf
+ err = usb_set_interface(data->udev, 0, 0);
+ if (err < 0) {
+ BT_ERR("failed to set interface 0, alt 0 %d", err);
+- goto out_free_dev;
++ goto err_kill_tx_urbs;
+ }
+ }
+
+@@ -4171,7 +4171,7 @@ static int btusb_probe(struct usb_interf
+ err = usb_driver_claim_interface(&btusb_driver,
+ data->isoc, data);
+ if (err < 0)
+- goto out_free_dev;
++ goto err_kill_tx_urbs;
+ }
+
+ if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
+@@ -4205,6 +4205,8 @@ err_release_siblings:
+ usb_set_intfdata(data->isoc, NULL);
+ usb_driver_release_interface(&btusb_driver, data->isoc);
+ }
++err_kill_tx_urbs:
++ usb_kill_anchored_urbs(&data->tx_anchor);
+ out_free_dev:
+ if (data->reset_gpio)
+ gpiod_put(data->reset_gpio);
--- /dev/null
+From eedc6867ebad73edbfaf9a0a65fbef7115cc4753 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 4 Jun 2026 08:37:36 +0200
+Subject: Bluetooth: btusb: fix use-after-free on registration failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 upstream.
+
+Make sure to release the sibling interfaces in case controller
+registration fails to avoid use-after-free and double-free when they are
+eventually disconnected.
+
+This issue was reported by Sashiko while reviewing a fix for a wakeup
+source leak in the btusb probe errors paths.
+
+Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
+Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver")
+Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
+Cc: stable@vger.kernel.org # 2.6.27
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -4187,7 +4187,7 @@ static int btusb_probe(struct usb_interf
+
+ err = hci_register_dev(hdev);
+ if (err < 0)
+- goto out_free_dev;
++ goto err_release_siblings;
+
+ usb_set_intfdata(intf, data);
+
+@@ -4196,6 +4196,15 @@ static int btusb_probe(struct usb_interf
+
+ return 0;
+
++err_release_siblings:
++ if (data->diag) {
++ usb_set_intfdata(data->diag, NULL);
++ usb_driver_release_interface(&btusb_driver, data->diag);
++ }
++ if (data->isoc) {
++ usb_set_intfdata(data->isoc, NULL);
++ usb_driver_release_interface(&btusb_driver, data->isoc);
++ }
+ out_free_dev:
+ if (data->reset_gpio)
+ gpiod_put(data->reset_gpio);
--- /dev/null
+From 3d93e1bb0fb881fe3ef961d1120556658e9cac4d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 4 Jun 2026 08:37:38 +0200
+Subject: Bluetooth: btusb: fix wakeup source leak on probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 3d93e1bb0fb881fe3ef961d1120556658e9cac4d upstream.
+
+Make sure to disable wakeup on probe failure to avoid leaking the wakeup
+source.
+
+Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support")
+Cc: stable@vger.kernel.org # 4.11
+Cc: Rajat Jain <rajatja@google.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -3157,6 +3157,11 @@ static int marvell_config_oob_wake(struc
+
+ return 0;
+ }
++#else
++static inline int marvell_config_oob_wake(struct hci_dev *hdev)
++{
++ return 0;
++}
+ #endif
+
+ static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
+@@ -3746,6 +3751,11 @@ static int btusb_config_oob_wake(struct
+ bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
+ return 0;
+ }
++#else
++static inline int btusb_config_oob_wake(struct hci_dev *hdev)
++{
++ return 0;
++}
+ #endif
+
+ static void btusb_check_needs_reset_resume(struct usb_interface *intf)
+@@ -3969,7 +3979,6 @@ static int btusb_probe(struct usb_interf
+ hdev->notify = btusb_notify;
+ hdev->wakeup = btusb_wakeup;
+
+-#ifdef CONFIG_PM
+ err = btusb_config_oob_wake(hdev);
+ if (err)
+ goto out_free_dev;
+@@ -3978,9 +3987,9 @@ static int btusb_probe(struct usb_interf
+ if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
+ err = marvell_config_oob_wake(hdev);
+ if (err)
+- goto out_free_dev;
++ goto err_disable_wakeup;
+ }
+-#endif
++
+ if (id->driver_info & BTUSB_CW6622)
+ set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
+
+@@ -4207,6 +4216,9 @@ err_release_siblings:
+ }
+ err_kill_tx_urbs:
+ usb_kill_anchored_urbs(&data->tx_anchor);
++err_disable_wakeup:
++ if (data->oob_wake_irq)
++ device_init_wakeup(&data->udev->dev, false);
+ out_free_dev:
+ if (data->reset_gpio)
+ gpiod_put(data->reset_gpio);
alsa-usb-audio-roll-back-quirk-control-caches-on-write-errors.patch
alsa-usb-audio-update-babyface-pro-control-caches-only-after-successful-writes.patch
alsa-usb-audio-update-us-16x08-eq-comp-shadow-state-after-successful-writes.patch
+vfio-pci-release-the-vga-arbiter-client-on-register_device-failure.patch
+bluetooth-btusb-add-usb-id-2c4e-0128-for-mercusys-ma60xnb.patch
+bluetooth-btusb-fix-use-after-free-on-registration-failure.patch
+bluetooth-btusb-fix-use-after-free-on-marvell-probe-failure.patch
+bluetooth-btusb-fix-wakeup-source-leak-on-probe-failure.patch
+binder-fix-uaf-in-binder_thread_release.patch
+binder-fix-uaf-in-binder_free_transaction.patch
--- /dev/null
+From daedde7f024ecf88bc8e832ed40cf2c795f0796a Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@nvidia.com>
+Date: Mon, 15 Jun 2026 13:12:30 -0600
+Subject: vfio/pci: Release the VGA arbiter client on register_device() failure
+
+From: Alex Williamson <alex.williamson@nvidia.com>
+
+commit daedde7f024ecf88bc8e832ed40cf2c795f0796a upstream.
+
+The re-order in the Fixes commit below displaced vfio_pci_vga_init() as
+the last failure point of what is now vfio_pci_core_register_device()
+without introducing an unwind for the VGA arbiter registration.
+
+In current kernels this is mostly benign because vfio_pci_set_decode()
+only uses pci_dev state, but the original failure path could leave a
+callback with a freed vdev cookie. The stale registration also becomes
+unsafe again once the callback follows drvdata to the vfio device.
+
+Add the required VGA unwind callout.
+
+Fixes: 4aeec3984ddc ("vfio/pci: Re-order vfio_pci_probe()")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20260615191241.688297-3-alex.williamson@nvidia.com
+Signed-off-by: Alex Williamson <alex@shazbot.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/pci/vfio_pci_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/vfio/pci/vfio_pci_core.c
++++ b/drivers/vfio/pci/vfio_pci_core.c
+@@ -2193,6 +2193,7 @@ out_power:
+ pm_runtime_get_noresume(dev);
+
+ pm_runtime_forbid(dev);
++ vfio_pci_vga_uninit(vdev);
+ out_vf:
+ vfio_pci_vf_uninit(vdev);
+ return ret;
projects / thirdparty / kernel / stable-queue.git / commitdiff
