From: Greg Kroah-Hartman Date: Fri, 15 May 2026 05:34:11 +0000 (+0200) Subject: 7.0-stable patches X-Git-Tag: v5.10.256~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=20e17b372345bf7e97d9b039979b3a153af41b7b;p=thirdparty%2Fkernel%2Fstable-queue.git 7.0-stable patches added patches: arm64-dts-freescale-imx95-toradex-smarc-fix-pmic_sd2_vsel-label-position.patch arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch arm64-dts-ti-k3-am69-aquila-clover-fix-dp-regulator-enable-gpio.patch drm-atomic-add-affected-colorops-with-affected-planes.patch drm-colorop-preserve-bypass-value-in-duplicate_state.patch drm-gpusvm-allow-device-pages-to-be-mapped-in-mixed-mappings-after-system-pages.patch drm-gpusvm-force-unmapping-on-error-in-drm_gpusvm_get_pages.patch drm-msm-hdmi-fix-wrong-ctrl1-register-used-in-writing-info-frames.patch hid-appletb-kbd-fix-uaf-in-inactivity-timer-cleanup-path.patch hid-appletb-kbd-run-inactivity-autodim-from-workqueues.patch hid-core-introduce-hid_safe_input_report.patch hid-pass-the-buffer-size-to-hid_report_raw_event.patch hid-pidff-fix-integer-overflow-in-pidff_rescale.patch hid-playstation-clamp-num_touch_reports.patch media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch media-dt-bindings-rockchip-vdec-add-alternative-reg-names-order-for-rk35-76-88.patch media-dt-bindings-rockchip-vdec-mark-reg-names-required-for-rk35-76-88.patch media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch media-i2c-ov5647-fix-runtime-pm-refcount-leak-in-s_ctrl.patch media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch media-intel-ipu6-fix-error-pointer-dereference.patch media-ipu-bridge-add-upside-down-sensor-dmi-quirk-for-dell-xps-13-9340-and-xps-14-9440.patch media-mali-c55-fix-iridix-bypass-macros.patch media-mali-c55-fix-wrong-comment-of-isp-block-types.patch media-mali-c55-fully-reset-the-isp-configuration.patch media-mali-c55-initialize-the-isp-in-enable_streams.patch media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch media-rc-streamzap-error-handling-in-probe.patch media-rc-xbox_remote-heed-dma-restrictions.patch media-renesas-vin-fix-raw8-again.patch media-renesas-vsp1-fix-null-pointer-deref-on-module-unload.patch media-rockchip-rkcif-add-missing-must_connect-flag-to-pads.patch media-rzv2h-ivc-avoid-double-job-scheduling.patch media-rzv2h-ivc-fix-concurrent-buffer-list-access.patch media-rzv2h-ivc-fix-fm_stop-register-write.patch media-rzv2h-ivc-write-axirx_pixfmt-once.patch media-saa7164-add-ioremap-return-checks-and-cleanups.patch media-ti-vpe-add-missing-v4l2_device_unregister-in-vip_remove.patch media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch regulator-act8945a-fix-of-node-reference-imbalance.patch regulator-bd9571mwv-fix-of-node-reference-imbalance.patch regulator-bq257xx-fix-of-node-reference-imbalance.patch regulator-max77650-fix-of-node-reference-imbalance.patch regulator-mt6357-fix-of-node-reference-imbalance.patch regulator-rk808-fix-of-node-reference-imbalance.patch regulator-s2dos05-fix-of-node-reference-imbalance.patch spi-amlogic-spisg-fix-controller-deregistration.patch spi-aspeed-smc-fix-controller-deregistration.patch spi-at91-usart-fix-controller-deregistration.patch spi-atmel-fix-controller-deregistration.patch spi-bcm63xx-fix-controller-deregistration.patch spi-lantiq-ssc-fix-controller-deregistration.patch spi-meson-spicc-fix-controller-deregistration.patch spi-qup-fix-controller-deregistration.patch spi-st-ssc4-fix-controller-deregistration.patch staging-media-atomisp-disallow-all-private-ioctls.patch --- diff --git a/queue-7.0/arm64-dts-freescale-imx95-toradex-smarc-fix-pmic_sd2_vsel-label-position.patch b/queue-7.0/arm64-dts-freescale-imx95-toradex-smarc-fix-pmic_sd2_vsel-label-position.patch new file mode 100644 index 0000000000..d94fe291e9 --- /dev/null +++ b/queue-7.0/arm64-dts-freescale-imx95-toradex-smarc-fix-pmic_sd2_vsel-label-position.patch @@ -0,0 +1,38 @@ +From 0c9d379d436e119285ef39a4f96b012f576ed74c Mon Sep 17 00:00:00 2001 +From: Emanuele Ghidoli +Date: Thu, 29 Jan 2026 11:47:35 +0100 +Subject: arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label position + +From: Emanuele Ghidoli + +commit 0c9d379d436e119285ef39a4f96b012f576ed74c upstream. + +Fix the PMIC_SD2_VSEL gpio-line-name position. It should be on line 19 +of gpio3, not line 20. + +Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95") +Cc: stable@vger.kernel.org +Signed-off-by: Emanuele Ghidoli +Reviewed-by: Frank Li +Reviewed-by: Francesco Dolcini +Signed-off-by: Frank Li +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi b/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi +index 5932ba238a8a..f64c05dc50f8 100644 +--- a/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx95-toradex-smarc.dtsi +@@ -262,7 +262,6 @@ &gpio3 { + "", + "", + "", +- "", + "PMIC_SD2_VSEL"; + status = "okay"; + }; +-- +2.54.0 + diff --git a/queue-7.0/arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch b/queue-7.0/arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch new file mode 100644 index 0000000000..616c5b6051 --- /dev/null +++ b/queue-7.0/arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch @@ -0,0 +1,157 @@ +From 70008aee892bbb5c2969bbe9e5778fc081b14bd2 Mon Sep 17 00:00:00 2001 +From: Josua Mayer +Date: Tue, 24 Mar 2026 13:40:55 +0100 +Subject: arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux + +From: Josua Mayer + +commit 70008aee892bbb5c2969bbe9e5778fc081b14bd2 upstream. + +Commit 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to +support bus recovery") introduced pinmux nodes for lx2160 i2c +interfaces, allowing runtime change between i2c and gpio functions +implementing bus recovery. + +However, the dynamic configuration area (overwrite MUX) used by the +pinctrl-single driver initially reads as zero and does not reflect the +actual hardware state set by the Reset Configuration Word (RCW) at +power-on. + +Because multiple groups of pins are configured from a single 32-bit +register, the first write from the pinctrl driver unintentionally clears +all other bits to zero. + +For example, on the LX2162A Clearfog, RCWSR12 is initialized to +0x08000006. When any i2c pinmux is applied, it clears all other fields. +This inadvertently disables SD card-detect (IIC2_PMUX) and some GPIOs +(SDHC1_DIR_PMUX): + +LX2162-CF RCWSR12: 0b0000100000000000 0000000000000110 +IIC2_PMUX ||| ||| || | ||| |||XXX : I2C/GPIO/CD-WP +SDHC1_DIR_PMUX XXX ||| || | ||| ||| : SDHC/GPIO/SPI + +Reverting the commit in question was considered but bus recovery is an +important feature. + +Instead add pinmux nodes for those pins that were unintentionally +reconfigured on SolidRun LX2160A Clearfog-CX and LX2162A Clearfog +boards. + +Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") +Cc: stable@vger.kernel.org +Signed-off-by: Josua Mayer +Signed-off-by: Frank Li +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 +++ + arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++++++++++++ + arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + + arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 +++ + 5 files changed, 42 insertions(+) + +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi +@@ -162,6 +162,8 @@ + }; + + &fspi { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>; + status = "okay"; + + flash@0 { +@@ -177,6 +179,11 @@ + }; + }; + ++&pinmux_i2crv { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&gpio0_14_12_pins>; ++}; ++ + &usb0 { + status = "okay"; + }; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi +@@ -89,6 +89,8 @@ + }; + + &esdhc0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>; + sd-uhs-sdr104; + sd-uhs-sdr50; + sd-uhs-sdr25; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +@@ -1721,6 +1721,10 @@ + pinctrl-single,bits = <0x0 0x1 0x7>; + }; + ++ esdhc0_cd_wp_pins: iic2-sdhc-pins { ++ pinctrl-single,bits = <0x0 0x6 0x7>; ++ }; ++ + i2c2_scl: i2c2-scl-pins { + pinctrl-single,bits = <0x0 0 (0x7 << 3)>; + }; +@@ -1753,6 +1757,26 @@ + pinctrl-single,bits = <0x0 (0x1 << 12) (0x7 << 12)>; + }; + ++ fspi_data74_pins: xspi1-data74-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 15)>; ++ }; ++ ++ fspi_data30_pins: xspi1-data30-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 18)>; ++ }; ++ ++ fspi_dqs_sck_cs10_pins: xspi1-base-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 21)>; ++ }; ++ ++ esdhc0_cmd_data30_clk_vsel_pins: sdhc1-base-sdhc-vsel-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 24)>; ++ }; ++ ++ gpio0_14_12_pins: sdhc1-dir-gpio-pins { ++ pinctrl-single,bits = <0x0 (0x1 << 27) (0x7 << 27)>; ++ }; ++ + i2c6_scl: i2c6-scl-pins { + pinctrl-single,bits = <0x4 0x2 0x7>; + }; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts +@@ -223,6 +223,8 @@ + }; + + &esdhc0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>; + sd-uhs-sdr104; + sd-uhs-sdr50; + sd-uhs-sdr25; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi +@@ -30,6 +30,8 @@ + }; + + &fspi { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>; + status = "okay"; + + flash@0 { +@@ -80,3 +82,8 @@ + reg = <0x6f>; + }; + }; ++ ++&pinmux_i2crv { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&gpio0_14_12_pins>; ++}; diff --git a/queue-7.0/arm64-dts-ti-k3-am69-aquila-clover-fix-dp-regulator-enable-gpio.patch b/queue-7.0/arm64-dts-ti-k3-am69-aquila-clover-fix-dp-regulator-enable-gpio.patch new file mode 100644 index 0000000000..74bea51e5a --- /dev/null +++ b/queue-7.0/arm64-dts-ti-k3-am69-aquila-clover-fix-dp-regulator-enable-gpio.patch @@ -0,0 +1,41 @@ +From 8cfb2e517113543e0de9e8df5754d5e09cb3627e Mon Sep 17 00:00:00 2001 +From: Franz Schnyder +Date: Mon, 2 Feb 2026 09:36:01 +0100 +Subject: arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO + +From: Franz Schnyder + +commit 8cfb2e517113543e0de9e8df5754d5e09cb3627e upstream. + +Correct the DP regulator enable GPIO to index 21. +The 3.3V DP regulator was not being enabled by the assigned GPIO, as it +is routed to GPIO index 21 and not 37, which was causing instability +with displays connected over DP or via an active DP-to-HDMI adapter. + +Fixes: 9f748a6177e1 ("arm64: dts: ti: am69-aquila: Add Clover") +Cc: stable@vger.kernel.org +Signed-off-by: Franz Schnyder +Reviewed-by: Francesco Dolcini +Link: https://patch.msgid.link/20260202083604.325060-3-fra.schnyder@gmail.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts b/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts +index ec8ff4587715..dc0d3cf2f985 100644 +--- a/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts ++++ b/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts +@@ -26,7 +26,7 @@ reg_3v3_dp: regulator-3v3-dp { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_gpio_21_dp>; + /* Aquila GPIO_21_DP (AQUILA B57) */ +- gpio = <&main_gpio0 37 GPIO_ACTIVE_HIGH>; ++ gpio = <&main_gpio0 21 GPIO_ACTIVE_HIGH>; + enable-active-high; + regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <3300000>; +-- +2.54.0 + diff --git a/queue-7.0/drm-atomic-add-affected-colorops-with-affected-planes.patch b/queue-7.0/drm-atomic-add-affected-colorops-with-affected-planes.patch new file mode 100644 index 0000000000..e5eb0924a1 --- /dev/null +++ b/queue-7.0/drm-atomic-add-affected-colorops-with-affected-planes.patch @@ -0,0 +1,55 @@ +From 6955d6bca0531ffbbaeecac844b7bae84345b3fb Mon Sep 17 00:00:00 2001 +From: Chaitanya Kumar Borah +Date: Tue, 10 Mar 2026 17:02:38 +0530 +Subject: drm/atomic: Add affected colorops with affected planes + +From: Chaitanya Kumar Borah + +commit 6955d6bca0531ffbbaeecac844b7bae84345b3fb upstream. + +When drm_atomic_add_affected_planes() adds a plane to the atomic +state, the associated colorops are not guaranteed to be included. +This can leave colorop state out of the transaction when planes +are pulled in implicitly (eg. during modeset or internal commits). + +Also add affected colorops when adding affected planes to keep +plane and color pipeline state consistent within the atomic +transaction. + +v2: Add affected colorops only when a pipeline is enabled + +Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property") +Cc: #v6.19+ +Reviewed-by: Uma Shankar #v1 +Signed-off-by: Chaitanya Kumar Borah +Reviewed-by: Harry Wentland +Signed-off-by: Suraj Kandpal +Link: https://patch.msgid.link/20260310113238.3495981-3-chaitanya.kumar.borah@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_atomic.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -1569,6 +1569,7 @@ drm_atomic_add_affected_planes(struct dr + const struct drm_crtc_state *old_crtc_state = + drm_atomic_get_old_crtc_state(state, crtc); + struct drm_plane *plane; ++ int ret; + + WARN_ON(!drm_atomic_get_new_crtc_state(state, crtc)); + +@@ -1582,6 +1583,12 @@ drm_atomic_add_affected_planes(struct dr + + if (IS_ERR(plane_state)) + return PTR_ERR(plane_state); ++ ++ if (plane_state->color_pipeline) { ++ ret = drm_atomic_add_affected_colorops(state, plane); ++ if (ret) ++ return ret; ++ } + } + return 0; + } diff --git a/queue-7.0/drm-colorop-preserve-bypass-value-in-duplicate_state.patch b/queue-7.0/drm-colorop-preserve-bypass-value-in-duplicate_state.patch new file mode 100644 index 0000000000..204c28f31f --- /dev/null +++ b/queue-7.0/drm-colorop-preserve-bypass-value-in-duplicate_state.patch @@ -0,0 +1,45 @@ +From 0d9710aeb6959ae244f255986187562fa50504b9 Mon Sep 17 00:00:00 2001 +From: Chaitanya Kumar Borah +Date: Tue, 10 Mar 2026 17:02:37 +0530 +Subject: drm/colorop: Preserve bypass value in duplicate_state() + +From: Chaitanya Kumar Borah + +commit 0d9710aeb6959ae244f255986187562fa50504b9 upstream. + +__drm_atomic_helper_colorop_duplicate_state() unconditionally +sets state->bypass = true after copying the existing state. + +This override causes the new atomic state to no longer reflect +the currently committed hardware state. Since the bypass property +directly controls whether the colorop is active in hardware, +resetting it to true can inadvertently disable an active colorop +during a subsequent commit, particularly for internal driver commits +where userspace does not touch the property. + +Drop the unconditional assignment and preserve the duplicated +bypass value. + +Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property") +Cc: #v6.19+ +Reviewed-by: Uma Shankar +Signed-off-by: Chaitanya Kumar Borah +Reviewed-by: Harry Wentland +Signed-off-by: Suraj Kandpal +Link: https://patch.msgid.link/20260310113238.3495981-2-chaitanya.kumar.borah@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_colorop.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/gpu/drm/drm_colorop.c ++++ b/drivers/gpu/drm/drm_colorop.c +@@ -441,8 +441,6 @@ static void __drm_atomic_helper_colorop_ + + if (state->data) + drm_property_blob_get(state->data); +- +- state->bypass = true; + } + + struct drm_colorop_state * diff --git a/queue-7.0/drm-gpusvm-allow-device-pages-to-be-mapped-in-mixed-mappings-after-system-pages.patch b/queue-7.0/drm-gpusvm-allow-device-pages-to-be-mapped-in-mixed-mappings-after-system-pages.patch new file mode 100644 index 0000000000..b0126bcf93 --- /dev/null +++ b/queue-7.0/drm-gpusvm-allow-device-pages-to-be-mapped-in-mixed-mappings-after-system-pages.patch @@ -0,0 +1,37 @@ +From ec49857ad181f2a68a3bea15422f2936ff366d47 Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Fri, 30 Jan 2026 11:49:28 -0800 +Subject: drm/gpusvm: Allow device pages to be mapped in mixed mappings after system pages + +From: Matthew Brost + +commit ec49857ad181f2a68a3bea15422f2936ff366d47 upstream. + +The current code rejects device mappings whenever system pages have +already been encountered. This is not the intended behavior when +allow_mixed is set. + +Relax the restriction by permitting a single pagemap to be selected when +allow_mixed is enabled, even if system pages were found earlier. + +Fixes: bce13d6ecd6c ("drm/gpusvm, drm/xe: Allow mixed mappings for userptr") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Brost +Reviewed-by: Francois Dugast +Link: https://patch.msgid.link/20260130194928.3255613-3-matthew.brost@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gpusvm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_gpusvm.c ++++ b/drivers/gpu/drm/drm_gpusvm.c +@@ -1495,7 +1495,7 @@ map_pages: + } + zdd = page->zone_device_data; + if (pagemap != page_pgmap(page)) { +- if (i > 0) { ++ if (pagemap) { + err = -EOPNOTSUPP; + goto err_unmap; + } diff --git a/queue-7.0/drm-gpusvm-force-unmapping-on-error-in-drm_gpusvm_get_pages.patch b/queue-7.0/drm-gpusvm-force-unmapping-on-error-in-drm_gpusvm_get_pages.patch new file mode 100644 index 0000000000..1fe7ebe759 --- /dev/null +++ b/queue-7.0/drm-gpusvm-force-unmapping-on-error-in-drm_gpusvm_get_pages.patch @@ -0,0 +1,36 @@ +From 556dba95473900073a6c03121361c11f646dc551 Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Fri, 30 Jan 2026 11:49:27 -0800 +Subject: drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages + +From: Matthew Brost + +commit 556dba95473900073a6c03121361c11f646dc551 upstream. + +drm_gpusvm_get_pages() only sets the local flags prior to committing the +pages. If an error occurs mid-mapping, has_dma_mapping will be clear, +causing the unmap function to skip unmapping pages that were +successfully mapped before the error. Fix this by forcibly setting +has_dma_mapping in the error path to ensure all previously mapped pages +are properly unmapped. + +Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Brost +Reviewed-by: Francois Dugast +Link: https://patch.msgid.link/20260130194928.3255613-2-matthew.brost@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gpusvm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/drm_gpusvm.c ++++ b/drivers/gpu/drm/drm_gpusvm.c +@@ -1572,6 +1572,7 @@ set_seqno: + return 0; + + err_unmap: ++ svm_pages->flags.has_dma_mapping = true; + __drm_gpusvm_unmap_pages(gpusvm, svm_pages, num_dma_mapped); + drm_gpusvm_notifier_unlock(gpusvm); + err_free: diff --git a/queue-7.0/drm-msm-hdmi-fix-wrong-ctrl1-register-used-in-writing-info-frames.patch b/queue-7.0/drm-msm-hdmi-fix-wrong-ctrl1-register-used-in-writing-info-frames.patch new file mode 100644 index 0000000000..de98e5ba3e --- /dev/null +++ b/queue-7.0/drm-msm-hdmi-fix-wrong-ctrl1-register-used-in-writing-info-frames.patch @@ -0,0 +1,50 @@ +From 8c6c93b7db42d15c6e8c2540a648d32986a04b1a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 11 Mar 2026 20:16:21 +0100 +Subject: drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames + +From: Krzysztof Kozlowski + +commit 8c6c93b7db42d15c6e8c2540a648d32986a04b1a upstream. + +Commit 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi +framework") changed the unconditional register writes in few places to +updates: read, apply mask, write. The new code reads +REG_HDMI_INFOFRAME_CTRL1 register, applies fields/mask for +HDMI_INFOFRAME_CTRL0 register and finally writes to +HDMI_INFOFRAME_CTRL0. This difference between CTRL1 and CTRL0 looks +unintended and may result in wrong data being written to HDMI bridge +registers. + +Cc: +Fixes: 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi framework") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/711156/ +Link: https://lore.kernel.org/r/20260311191620.245394-2-krzysztof.kozlowski@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c +@@ -153,7 +153,7 @@ static int msm_hdmi_bridge_write_avi_inf + for (i = 0; i < ARRAY_SIZE(buf); i++) + hdmi_write(hdmi, REG_HDMI_AVI_INFO(i), buf[i]); + +- val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL1); ++ val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL0); + val |= HDMI_INFOFRAME_CTRL0_AVI_SEND | + HDMI_INFOFRAME_CTRL0_AVI_CONT; + hdmi_write(hdmi, REG_HDMI_INFOFRAME_CTRL0, val); +@@ -193,7 +193,7 @@ static int msm_hdmi_bridge_write_audio_i + buffer[9] << 16 | + buffer[10] << 24); + +- val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL1); ++ val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL0); + val |= HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SEND | + HDMI_INFOFRAME_CTRL0_AUDIO_INFO_CONT | + HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SOURCE | diff --git a/queue-7.0/hid-appletb-kbd-fix-uaf-in-inactivity-timer-cleanup-path.patch b/queue-7.0/hid-appletb-kbd-fix-uaf-in-inactivity-timer-cleanup-path.patch new file mode 100644 index 0000000000..2d699720d7 --- /dev/null +++ b/queue-7.0/hid-appletb-kbd-fix-uaf-in-inactivity-timer-cleanup-path.patch @@ -0,0 +1,118 @@ +From 4db2af929279c799b5653a39eb0795c72baffca4 Mon Sep 17 00:00:00 2001 +From: Sangyun Kim +Date: Mon, 20 Apr 2026 14:13:17 +0900 +Subject: HID: appletb-kbd: fix UAF in inactivity-timer cleanup path + +From: Sangyun Kim + +commit 4db2af929279c799b5653a39eb0795c72baffca4 upstream. + +Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in +appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to +both the probe close_hw error path and appletb_kbd_remove(), but the +way it was wired in left the inactivity timer reachable during driver +tear-down via two distinct windows. + +Window A -- put_device() before timer_delete_sync(): + + put_device(&kbd->backlight_dev->dev); + timer_delete_sync(&kbd->inactivity_timer); + +The inactivity_timer softirq reads kbd->backlight_dev and calls +backlight_device_set_brightness() -> mutex_lock(&ops_lock). If a +concurrent hid_appletb_bl unbind drops the last devm reference +between these two calls, the backlight_device is freed and the +mutex_lock() touches freed memory. + +Window B -- backlight cleanup before hid_hw_stop(): + + if (kbd->backlight_dev) { + timer_delete_sync(...); + put_device(...); + } + hid_hw_close(hdev); + hid_hw_stop(hdev); + +Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run +afterwards, so a late ".event" callback from the HID core (USB URB +completion on real Apple hardware) can arrive after +timer_delete_sync() drained the softirq but before put_device() drops +the reference. That callback reaches reset_inactivity_timer(), which +calls mod_timer() and re-arms the timer. The freshly re-armed timer +can then fire on the about-to-be-freed backlight_device. + +Both windows produce the same KASAN slab-use-after-free: + + BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0 + Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0 + Call Trace: + + __mutex_lock + backlight_device_set_brightness + appletb_inactivity_timer + call_timer_fn + run_timer_softirq + handle_softirqs + Allocated by task N: + devm_backlight_device_register + appletb_bl_probe + Freed by task M: + (concurrent hid_appletb_bl unbind path) + +Close both windows at once by reworking the tear-down in +appletb_kbd_remove() and in the probe close_hw error path so that + + 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup, + guaranteeing no further .event callback can fire and re-arm the + timer, and + 2) inside the "if (kbd->backlight_dev)" block, timer_delete_sync() + runs before put_device(), so the softirq is drained before the + final reference is dropped. + +Fixes: 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe") +Cc: stable@vger.kernel.org +Signed-off-by: Sangyun Kim +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-appletb-kbd.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/hid/hid-appletb-kbd.c ++++ b/drivers/hid/hid-appletb-kbd.c +@@ -440,13 +440,13 @@ static int appletb_kbd_probe(struct hid_ + unregister_handler: + input_unregister_handler(&kbd->inp_handler); + close_hw: +- if (kbd->backlight_dev) { +- put_device(&kbd->backlight_dev->dev); +- timer_delete_sync(&kbd->inactivity_timer); +- } + hid_hw_close(hdev); + stop_hw: + hid_hw_stop(hdev); ++ if (kbd->backlight_dev) { ++ timer_delete_sync(&kbd->inactivity_timer); ++ put_device(&kbd->backlight_dev->dev); ++ } + return ret; + } + +@@ -457,13 +457,13 @@ static void appletb_kbd_remove(struct hi + appletb_kbd_set_mode(kbd, APPLETB_KBD_MODE_OFF); + + input_unregister_handler(&kbd->inp_handler); ++ hid_hw_close(hdev); ++ hid_hw_stop(hdev); ++ + if (kbd->backlight_dev) { +- put_device(&kbd->backlight_dev->dev); + timer_delete_sync(&kbd->inactivity_timer); ++ put_device(&kbd->backlight_dev->dev); + } +- +- hid_hw_close(hdev); +- hid_hw_stop(hdev); + } + + static int appletb_kbd_suspend(struct hid_device *hdev, pm_message_t msg) diff --git a/queue-7.0/hid-appletb-kbd-run-inactivity-autodim-from-workqueues.patch b/queue-7.0/hid-appletb-kbd-run-inactivity-autodim-from-workqueues.patch new file mode 100644 index 0000000000..edeb2874af --- /dev/null +++ b/queue-7.0/hid-appletb-kbd-run-inactivity-autodim-from-workqueues.patch @@ -0,0 +1,170 @@ +From 1654e53349d4e657b331de354313461f401f5063 Mon Sep 17 00:00:00 2001 +From: Sangyun Kim +Date: Mon, 20 Apr 2026 14:13:18 +0900 +Subject: HID: appletb-kbd: run inactivity autodim from workqueues + +From: Sangyun Kim + +commit 1654e53349d4e657b331de354313461f401f5063 upstream. + +The autodim code in hid-appletb-kbd takes backlight_device->ops_lock +via backlight_device_set_brightness() -> mutex_lock() from two +different atomic contexts: + + * appletb_inactivity_timer() is a struct timer_list callback, so it + runs in softirq context. Every expiry triggers + + BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 + Call Trace: + + __might_resched + __mutex_lock + backlight_device_set_brightness + appletb_inactivity_timer + call_timer_fn + run_timer_softirq + + * reset_inactivity_timer() is called from appletb_kbd_hid_event() and + appletb_kbd_inp_event(). On real USB hardware these run in + softirq/IRQ context (URB completion and input-event dispatch). + When the Touch Bar has already been dimmed or turned off, the + reset path calls backlight_device_set_brightness() directly to + restore brightness, producing the same warning. + +Both call sites hit the same mutex_lock()-from-atomic bug. Fix them +together by moving the blocking work onto the system workqueue: + + * Convert the inactivity timer from struct timer_list to + struct delayed_work; the callback (appletb_inactivity_work) now + runs in process context where mutex_lock() is legal. + * Add a dedicated struct work_struct restore_brightness_work and have + reset_inactivity_timer() schedule it instead of calling + backlight_device_set_brightness() directly. + +Cancel both works synchronously during driver tear-down alongside the +existing backlight reference drop. + +The semantics are unchanged (same delays, same state transitions on +dim, turn-off and user activity); only the execution context of the +sleeping call changes. The timer field and callback are renamed to +match their new type; reset_inactivity_timer() keeps its name because +it is invoked from input event paths that read naturally as "reset +the inactivity timer". + +Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar") +Cc: stable@vger.kernel.org +Signed-off-by: Sangyun Kim +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-appletb-kbd.c | 44 ++++++++++++++++++++++++++++-------------- + 1 file changed, 30 insertions(+), 14 deletions(-) + +--- a/drivers/hid/hid-appletb-kbd.c ++++ b/drivers/hid/hid-appletb-kbd.c +@@ -17,7 +17,7 @@ + #include + #include + #include +-#include ++#include + #include + + #include "hid-ids.h" +@@ -62,7 +62,8 @@ struct appletb_kbd { + struct input_handle kbd_handle; + struct input_handle tpd_handle; + struct backlight_device *backlight_dev; +- struct timer_list inactivity_timer; ++ struct delayed_work inactivity_work; ++ struct work_struct restore_brightness_work; + bool has_dimmed; + bool has_turned_off; + u8 saved_mode; +@@ -164,16 +165,18 @@ static int appletb_tb_key_to_slot(unsign + } + } + +-static void appletb_inactivity_timer(struct timer_list *t) ++static void appletb_inactivity_work(struct work_struct *work) + { +- struct appletb_kbd *kbd = timer_container_of(kbd, t, inactivity_timer); ++ struct appletb_kbd *kbd = container_of(to_delayed_work(work), ++ struct appletb_kbd, ++ inactivity_work); + + if (kbd->backlight_dev && appletb_tb_autodim) { + if (!kbd->has_dimmed) { + backlight_device_set_brightness(kbd->backlight_dev, 1); + kbd->has_dimmed = true; +- mod_timer(&kbd->inactivity_timer, +- jiffies + secs_to_jiffies(appletb_tb_idle_timeout)); ++ mod_delayed_work(system_wq, &kbd->inactivity_work, ++ secs_to_jiffies(appletb_tb_idle_timeout)); + } else if (!kbd->has_turned_off) { + backlight_device_set_brightness(kbd->backlight_dev, 0); + kbd->has_turned_off = true; +@@ -181,16 +184,25 @@ static void appletb_inactivity_timer(str + } + } + ++static void appletb_restore_brightness_work(struct work_struct *work) ++{ ++ struct appletb_kbd *kbd = container_of(work, struct appletb_kbd, ++ restore_brightness_work); ++ ++ if (kbd->backlight_dev) ++ backlight_device_set_brightness(kbd->backlight_dev, 2); ++} ++ + static void reset_inactivity_timer(struct appletb_kbd *kbd) + { + if (kbd->backlight_dev && appletb_tb_autodim) { + if (kbd->has_dimmed || kbd->has_turned_off) { +- backlight_device_set_brightness(kbd->backlight_dev, 2); + kbd->has_dimmed = false; + kbd->has_turned_off = false; ++ schedule_work(&kbd->restore_brightness_work); + } +- mod_timer(&kbd->inactivity_timer, +- jiffies + secs_to_jiffies(appletb_tb_dim_timeout)); ++ mod_delayed_work(system_wq, &kbd->inactivity_work, ++ secs_to_jiffies(appletb_tb_dim_timeout)); + } + } + +@@ -408,9 +420,11 @@ static int appletb_kbd_probe(struct hid_ + dev_err_probe(dev, -ENODEV, "Failed to get backlight device\n"); + } else { + backlight_device_set_brightness(kbd->backlight_dev, 2); +- timer_setup(&kbd->inactivity_timer, appletb_inactivity_timer, 0); +- mod_timer(&kbd->inactivity_timer, +- jiffies + secs_to_jiffies(appletb_tb_dim_timeout)); ++ INIT_DELAYED_WORK(&kbd->inactivity_work, appletb_inactivity_work); ++ INIT_WORK(&kbd->restore_brightness_work, ++ appletb_restore_brightness_work); ++ mod_delayed_work(system_wq, &kbd->inactivity_work, ++ secs_to_jiffies(appletb_tb_dim_timeout)); + } + + kbd->inp_handler.event = appletb_kbd_inp_event; +@@ -444,7 +458,8 @@ close_hw: + stop_hw: + hid_hw_stop(hdev); + if (kbd->backlight_dev) { +- timer_delete_sync(&kbd->inactivity_timer); ++ cancel_delayed_work_sync(&kbd->inactivity_work); ++ cancel_work_sync(&kbd->restore_brightness_work); + put_device(&kbd->backlight_dev->dev); + } + return ret; +@@ -461,7 +476,8 @@ static void appletb_kbd_remove(struct hi + hid_hw_stop(hdev); + + if (kbd->backlight_dev) { +- timer_delete_sync(&kbd->inactivity_timer); ++ cancel_delayed_work_sync(&kbd->inactivity_work); ++ cancel_work_sync(&kbd->restore_brightness_work); + put_device(&kbd->backlight_dev->dev); + } + } diff --git a/queue-7.0/hid-core-introduce-hid_safe_input_report.patch b/queue-7.0/hid-core-introduce-hid_safe_input_report.patch new file mode 100644 index 0000000000..0a597f651d --- /dev/null +++ b/queue-7.0/hid-core-introduce-hid_safe_input_report.patch @@ -0,0 +1,126 @@ +From 206342541fc887ae919774a43942dc883161fece Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Mon, 4 May 2026 10:47:23 +0200 +Subject: HID: core: introduce hid_safe_input_report() + +From: Benjamin Tissoires + +commit 206342541fc887ae919774a43942dc883161fece upstream. + +hid_input_report() is used in too many places to have a commit that +doesn't cross subsystem borders. Instead of changing the API, introduce +a new one when things matters in the transport layers: +- usbhid +- i2chid + +This effectively revert to the old behavior for those two transport +layers. + +Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 25 +++++++++++++++++++++++++ + drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++++--- + drivers/hid/usbhid/hid-core.c | 11 ++++++----- + include/linux/hid.h | 2 ++ + 4 files changed, 37 insertions(+), 8 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -2177,6 +2177,7 @@ unlock: + * @interrupt: distinguish between interrupt and control transfers + * + * This is data entry for lower layers. ++ * Legacy, please use hid_safe_input_report() instead. + */ + int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size, + int interrupt) +@@ -2187,6 +2188,30 @@ int hid_input_report(struct hid_device * + } + EXPORT_SYMBOL_GPL(hid_input_report); + ++/** ++ * hid_safe_input_report - report data from lower layer (usb, bt...) ++ * ++ * @hid: hid device ++ * @type: HID report type (HID_*_REPORT) ++ * @data: report contents ++ * @bufsize: allocated size of the data buffer ++ * @size: useful size of data parameter ++ * @interrupt: distinguish between interrupt and control transfers ++ * ++ * This is data entry for lower layers. ++ * Please use this function instead of the non safe version because we provide ++ * here the size of the buffer, allowing hid-core to make smarter decisions ++ * regarding the incoming buffer. ++ */ ++int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, ++ size_t bufsize, u32 size, int interrupt) ++{ ++ return __hid_input_report(hid, type, data, bufsize, size, interrupt, 0, ++ false, /* from_bpf */ ++ false /* lock_already_taken */); ++} ++EXPORT_SYMBOL_GPL(hid_safe_input_report); ++ + bool hid_match_one_id(const struct hid_device *hdev, + const struct hid_device_id *id) + { +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -574,9 +574,10 @@ static void i2c_hid_get_input(struct i2c + if (ihid->hid->group != HID_GROUP_RMI) + pm_wakeup_event(&ihid->client->dev, 0); + +- hid_input_report(ihid->hid, HID_INPUT_REPORT, +- ihid->inbuf + sizeof(__le16), +- ret_size - sizeof(__le16), 1); ++ hid_safe_input_report(ihid->hid, HID_INPUT_REPORT, ++ ihid->inbuf + sizeof(__le16), ++ ihid->bufsize - sizeof(__le16), ++ ret_size - sizeof(__le16), 1); + } + + return; +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -283,9 +283,9 @@ static void hid_irq_in(struct urb *urb) + break; + usbhid_mark_busy(usbhid); + if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) { +- hid_input_report(urb->context, HID_INPUT_REPORT, +- urb->transfer_buffer, +- urb->actual_length, 1); ++ hid_safe_input_report(urb->context, HID_INPUT_REPORT, ++ urb->transfer_buffer, urb->transfer_buffer_length, ++ urb->actual_length, 1); + /* + * autosuspend refused while keys are pressed + * because most keyboards don't wake up when +@@ -482,9 +482,10 @@ static void hid_ctrl(struct urb *urb) + switch (status) { + case 0: /* success */ + if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN) +- hid_input_report(urb->context, ++ hid_safe_input_report(urb->context, + usbhid->ctrl[usbhid->ctrltail].report->type, +- urb->transfer_buffer, urb->actual_length, 0); ++ urb->transfer_buffer, urb->transfer_buffer_length, ++ urb->actual_length, 0); + break; + case -ESHUTDOWN: /* unplug */ + unplug = 1; +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -998,6 +998,8 @@ struct hid_field *hid_find_field(struct + int hid_set_field(struct hid_field *, unsigned, __s32); + int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size, + int interrupt); ++int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, ++ size_t bufsize, u32 size, int interrupt); + struct hid_field *hidinput_get_led_field(struct hid_device *hid); + unsigned int hidinput_count_leds(struct hid_device *hid); + __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code); diff --git a/queue-7.0/hid-pass-the-buffer-size-to-hid_report_raw_event.patch b/queue-7.0/hid-pass-the-buffer-size-to-hid_report_raw_event.patch new file mode 100644 index 0000000000..53a61b37bc --- /dev/null +++ b/queue-7.0/hid-pass-the-buffer-size-to-hid_report_raw_event.patch @@ -0,0 +1,337 @@ +From 2c85c61d1332e1e16f020d76951baf167dcb6f7a Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Mon, 4 May 2026 10:47:22 +0200 +Subject: HID: pass the buffer size to hid_report_raw_event + +From: Benjamin Tissoires + +commit 2c85c61d1332e1e16f020d76951baf167dcb6f7a upstream. + +commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing +bogus memset()") enforced the provided data to be at least the size of +the declared buffer in the report descriptor to prevent a buffer +overflow. However, we can try to be smarter by providing both the buffer +size and the data size, meaning that hid_report_raw_event() can make +better decision whether we should plaining reject the buffer (buffer +overflow attempt) or if we can safely memset it to 0 and pass it to the +rest of the stack. + +Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Tissoires +Acked-by: Johan Hovold +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/bpf/hid_bpf_dispatch.c | 6 +++-- + drivers/hid/hid-core.c | 42 ++++++++++++++++++++++++------------- + drivers/hid/hid-gfrm.c | 4 +-- + drivers/hid/hid-logitech-hidpp.c | 2 - + drivers/hid/hid-multitouch.c | 2 - + drivers/hid/hid-primax.c | 2 - + drivers/hid/hid-vivaldi-common.c | 2 - + drivers/hid/wacom_sys.c | 6 ++--- + drivers/staging/greybus/hid.c | 2 - + include/linux/hid.h | 4 +-- + include/linux/hid_bpf.h | 14 +++++++----- + 11 files changed, 53 insertions(+), 33 deletions(-) + +--- a/drivers/hid/bpf/hid_bpf_dispatch.c ++++ b/drivers/hid/bpf/hid_bpf_dispatch.c +@@ -24,7 +24,8 @@ EXPORT_SYMBOL(hid_ops); + + u8 * + dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type, u8 *data, +- u32 *size, int interrupt, u64 source, bool from_bpf) ++ size_t *buf_size, u32 *size, int interrupt, u64 source, ++ bool from_bpf) + { + struct hid_bpf_ctx_kern ctx_kern = { + .ctx = { +@@ -74,6 +75,7 @@ dispatch_hid_bpf_device_event(struct hid + *size = ret; + } + ++ *buf_size = ctx_kern.ctx.allocated_size; + return ctx_kern.data; + } + EXPORT_SYMBOL_GPL(dispatch_hid_bpf_device_event); +@@ -505,7 +507,7 @@ __hid_bpf_input_report(struct hid_bpf_ct + if (ret) + return ret; + +- return hid_ops->hid_input_report(ctx->hid, type, buf, size, 0, (u64)(long)ctx, true, ++ return hid_ops->hid_input_report(ctx->hid, type, buf, size, size, 0, (u64)(long)ctx, true, + lock_already_taken); + } + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -2029,24 +2029,32 @@ out: + } + EXPORT_SYMBOL_GPL(__hid_request); + +-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size, +- int interrupt) ++int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, ++ size_t bufsize, u32 size, int interrupt) + { + struct hid_report_enum *report_enum = hid->report_enum + type; + struct hid_report *report; + struct hid_driver *hdrv; + int max_buffer_size = HID_MAX_BUFFER_SIZE; + u32 rsize, csize = size; ++ size_t bsize = bufsize; + u8 *cdata = data; + int ret = 0; + + report = hid_get_report(report_enum, data); + if (!report) +- goto out; ++ return 0; ++ ++ if (unlikely(bsize < csize)) { ++ hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n", ++ report->id, csize, bsize); ++ return -EINVAL; ++ } + + if (report_enum->numbered) { + cdata++; + csize--; ++ bsize--; + } + + rsize = hid_compute_report_size(report); +@@ -2059,11 +2067,16 @@ int hid_report_raw_event(struct hid_devi + else if (rsize > max_buffer_size) + rsize = max_buffer_size; + ++ if (bsize < rsize) { ++ hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %ld)\n", ++ report->id, rsize, bsize); ++ return -EINVAL; ++ } ++ + if (csize < rsize) { +- hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n", +- report->id, rsize, csize); +- ret = -EINVAL; +- goto out; ++ dbg_hid("report %d is too short, (%d < %d)\n", report->id, ++ csize, rsize); ++ memset(cdata + csize, 0, rsize - csize); + } + + if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event) +@@ -2071,7 +2084,7 @@ int hid_report_raw_event(struct hid_devi + if (hid->claimed & HID_CLAIMED_HIDRAW) { + ret = hidraw_report_event(hid, data, size); + if (ret) +- goto out; ++ return ret; + } + + if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) { +@@ -2083,15 +2096,15 @@ int hid_report_raw_event(struct hid_devi + + if (hid->claimed & HID_CLAIMED_INPUT) + hidinput_report_event(hid, report); +-out: ++ + return ret; + } + EXPORT_SYMBOL_GPL(hid_report_raw_event); + + + static int __hid_input_report(struct hid_device *hid, enum hid_report_type type, +- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf, +- bool lock_already_taken) ++ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source, ++ bool from_bpf, bool lock_already_taken) + { + struct hid_report_enum *report_enum; + struct hid_driver *hdrv; +@@ -2116,7 +2129,8 @@ static int __hid_input_report(struct hid + report_enum = hid->report_enum + type; + hdrv = hid->driver; + +- data = dispatch_hid_bpf_device_event(hid, type, data, &size, interrupt, source, from_bpf); ++ data = dispatch_hid_bpf_device_event(hid, type, data, &bufsize, &size, interrupt, ++ source, from_bpf); + if (IS_ERR(data)) { + ret = PTR_ERR(data); + goto unlock; +@@ -2145,7 +2159,7 @@ static int __hid_input_report(struct hid + goto unlock; + } + +- ret = hid_report_raw_event(hid, type, data, size, interrupt); ++ ret = hid_report_raw_event(hid, type, data, bufsize, size, interrupt); + + unlock: + if (!lock_already_taken) +@@ -2167,7 +2181,7 @@ unlock: + int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size, + int interrupt) + { +- return __hid_input_report(hid, type, data, size, interrupt, 0, ++ return __hid_input_report(hid, type, data, size, size, interrupt, 0, + false, /* from_bpf */ + false /* lock_already_taken */); + } +--- a/drivers/hid/hid-gfrm.c ++++ b/drivers/hid/hid-gfrm.c +@@ -66,7 +66,7 @@ static int gfrm_raw_event(struct hid_dev + switch (data[1]) { + case GFRM100_SEARCH_KEY_DOWN: + ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_dn, +- sizeof(search_key_dn), 1); ++ sizeof(search_key_dn), sizeof(search_key_dn), 1); + break; + + case GFRM100_SEARCH_KEY_AUDIO_DATA: +@@ -74,7 +74,7 @@ static int gfrm_raw_event(struct hid_dev + + case GFRM100_SEARCH_KEY_UP: + ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_up, +- sizeof(search_key_up), 1); ++ sizeof(search_key_up), sizeof(search_key_up), 1); + break; + + default: +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -3665,7 +3665,7 @@ static int hidpp10_consumer_keys_raw_eve + memcpy(&consumer_report[1], &data[3], 4); + /* We are called from atomic context */ + hid_report_raw_event(hidpp->hid_dev, HID_INPUT_REPORT, +- consumer_report, 5, 1); ++ consumer_report, sizeof(consumer_report), 5, 1); + + return 1; + } +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -533,7 +533,7 @@ static void mt_get_feature(struct hid_de + } + + ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf, +- size, 0); ++ size, size, 0); + if (ret) + dev_warn(&hdev->dev, "failed to report feature\n"); + } +--- a/drivers/hid/hid-primax.c ++++ b/drivers/hid/hid-primax.c +@@ -44,7 +44,7 @@ static int px_raw_event(struct hid_devic + data[0] |= (1 << (data[idx] - 0xE0)); + data[idx] = 0; + } +- hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, 0); ++ hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, size, 0); + return 1; + + default: /* unknown report */ +--- a/drivers/hid/hid-vivaldi-common.c ++++ b/drivers/hid/hid-vivaldi-common.c +@@ -85,7 +85,7 @@ void vivaldi_feature_mapping(struct hid_ + } + + ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, report_data, +- report_len, 0); ++ report_len, report_len, 0); + if (ret) { + dev_warn(&hdev->dev, "failed to report feature %d\n", + field->report->id); +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -90,7 +90,7 @@ static void wacom_wac_queue_flush(struct + kfree(buf); + continue; + } +- err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, false); ++ err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false); + if (err) { + hid_warn(hdev, "%s: unable to flush event due to error %d\n", + __func__, err); +@@ -334,7 +334,7 @@ static void wacom_feature_mapping(struct + data, n, WAC_CMD_RETRIES); + if (ret == n && features->type == HID_GENERIC) { + ret = hid_report_raw_event(hdev, +- HID_FEATURE_REPORT, data, n, 0); ++ HID_FEATURE_REPORT, data, n, n, 0); + } else if (ret == 2 && features->type != HID_GENERIC) { + features->touch_max = data[1]; + } else { +@@ -395,7 +395,7 @@ static void wacom_feature_mapping(struct + data, n, WAC_CMD_RETRIES); + if (ret == n) { + ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, +- data, n, 0); ++ data, n, n, 0); + } else { + hid_warn(hdev, "%s: could not retrieve sensor offsets\n", + __func__); +--- a/drivers/staging/greybus/hid.c ++++ b/drivers/staging/greybus/hid.c +@@ -201,7 +201,7 @@ static void gb_hid_init_report(struct gb + * we just need to setup the input fields, so using + * hid_report_raw_event is safe. + */ +- hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, size, 1); ++ hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, ghid->bufsize, size, 1); + } + + static void gb_hid_init_reports(struct gb_hid *ghid) +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -1266,8 +1266,8 @@ static inline u32 hid_report_len(struct + return DIV_ROUND_UP(report->size, 8) + (report->id > 0); + } + +-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size, +- int interrupt); ++int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, ++ size_t bufsize, u32 size, int interrupt); + + /* HID quirks API */ + unsigned long hid_lookup_quirk(const struct hid_device *hdev); +--- a/include/linux/hid_bpf.h ++++ b/include/linux/hid_bpf.h +@@ -72,8 +72,8 @@ struct hid_ops { + int (*hid_hw_output_report)(struct hid_device *hdev, __u8 *buf, size_t len, + u64 source, bool from_bpf); + int (*hid_input_report)(struct hid_device *hid, enum hid_report_type type, +- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf, +- bool lock_already_taken); ++ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source, ++ bool from_bpf, bool lock_already_taken); + struct module *owner; + const struct bus_type *bus_type; + }; +@@ -200,7 +200,8 @@ struct hid_bpf { + + #ifdef CONFIG_HID_BPF + u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type, u8 *data, +- u32 *size, int interrupt, u64 source, bool from_bpf); ++ size_t *buf_size, u32 *size, int interrupt, u64 source, ++ bool from_bpf); + int dispatch_hid_bpf_raw_requests(struct hid_device *hdev, + unsigned char reportnum, __u8 *buf, + u32 size, enum hid_report_type rtype, +@@ -215,8 +216,11 @@ int hid_bpf_device_init(struct hid_devic + const u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, const u8 *rdesc, unsigned int *size); + #else /* CONFIG_HID_BPF */ + static inline u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type, +- u8 *data, u32 *size, int interrupt, +- u64 source, bool from_bpf) { return data; } ++ u8 *data, size_t *buf_size, u32 *size, ++ int interrupt, u64 source, bool from_bpf) ++{ ++ return data; ++} + static inline int dispatch_hid_bpf_raw_requests(struct hid_device *hdev, + unsigned char reportnum, u8 *buf, + u32 size, enum hid_report_type rtype, diff --git a/queue-7.0/hid-pidff-fix-integer-overflow-in-pidff_rescale.patch b/queue-7.0/hid-pidff-fix-integer-overflow-in-pidff_rescale.patch new file mode 100644 index 0000000000..9958e6a3f1 --- /dev/null +++ b/queue-7.0/hid-pidff-fix-integer-overflow-in-pidff_rescale.patch @@ -0,0 +1,54 @@ +From 48d1677779ad6816978ad4a4f7588aec5ec960fe Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tomasz=20Paku=C5=82a?= +Date: Sun, 10 May 2026 14:23:52 +0200 +Subject: HID: pidff: Fix integer overflow in pidff_rescale +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Pakuła + +commit 48d1677779ad6816978ad4a4f7588aec5ec960fe upstream. + +Rescaling values close to the max (U16_MAX) temporarily creates values +that exceed the s32 range. This caused value overflow in case when, for +example, a periodic effect phase was higer than 180 degrees. In turn, +rescale function could return values outised of the logical range of the +HID field. + +Fix by using 64 bit signed integer to store the value during calculation +but still return only 32 bit integer. + +Closes: https://github.com/JacKeTUs/universal-pidff/issues/116 +Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices") +Cc: stable@vger.kernel.org +Signed-off-by: Tomasz Pakuła +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/usbhid/hid-pidff.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/hid/usbhid/hid-pidff.c ++++ b/drivers/hid/usbhid/hid-pidff.c +@@ -11,6 +11,7 @@ + #include "hid-pidff.h" + #include + #include ++#include + #include + #include + #include +@@ -325,8 +326,10 @@ static s32 pidff_clamp(s32 i, struct hid + */ + static int pidff_rescale(int i, int max, struct hid_field *field) + { +- return i * (field->logical_maximum - field->logical_minimum) / max + +- field->logical_minimum; ++ /* 64 bits needed for big values during rescale */ ++ s64 result = field->logical_maximum - field->logical_minimum; ++ ++ return div_s64(result * i, max) + field->logical_minimum; + } + + /* diff --git a/queue-7.0/hid-playstation-clamp-num_touch_reports.patch b/queue-7.0/hid-playstation-clamp-num_touch_reports.patch new file mode 100644 index 0000000000..1277069ec6 --- /dev/null +++ b/queue-7.0/hid-playstation-clamp-num_touch_reports.patch @@ -0,0 +1,50 @@ +From cac61b58a3b6340c52afa06bb15eac033158db2f Mon Sep 17 00:00:00 2001 +From: "T.J. Mercier" +Date: Fri, 17 Apr 2026 08:47:02 -0700 +Subject: HID: playstation: Clamp num_touch_reports + +From: T.J. Mercier + +commit cac61b58a3b6340c52afa06bb15eac033158db2f upstream. + +A device would never lie about the number of touch reports would it? + +If it does the loop in dualshock4_parse_report will read off the end of +the touch_reports array, up to about 2 KiB for the maximum number of 256 +loop iteraions. The data that is read is emitted via evdev if the +DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by +clamping the num_touch_reports value provided by the device to the +maximum size of the touch_reports array. + +Fixes: 752038248808 ("HID: playstation: add DualShock4 touchpad support.") +Cc: stable@vger.kernel.org +Reported-by: Xingyu Jin +Signed-off-by: T.J. Mercier +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-playstation.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-playstation.c ++++ b/drivers/hid/hid-playstation.c +@@ -2378,7 +2378,8 @@ static int dualshock4_parse_report(struc + (struct dualshock4_input_report_usb *)data; + + ds4_report = &usb->common; +- num_touch_reports = usb->num_touch_reports; ++ num_touch_reports = min_t(u8, usb->num_touch_reports, ++ ARRAY_SIZE(usb->touch_reports)); + touch_reports = usb->touch_reports; + } else if (hdev->bus == BUS_BLUETOOTH && report->id == DS4_INPUT_REPORT_BT && + size == DS4_INPUT_REPORT_BT_SIZE) { +@@ -2392,7 +2393,8 @@ static int dualshock4_parse_report(struc + } + + ds4_report = &bt->common; +- num_touch_reports = bt->num_touch_reports; ++ num_touch_reports = min_t(u8, bt->num_touch_reports, ++ ARRAY_SIZE(bt->touch_reports)); + touch_reports = bt->touch_reports; + } else if (hdev->bus == BUS_BLUETOOTH && + report->id == DS4_INPUT_REPORT_BT_MINIMAL && diff --git a/queue-7.0/media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch b/queue-7.0/media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch new file mode 100644 index 0000000000..7754e53988 --- /dev/null +++ b/queue-7.0/media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch @@ -0,0 +1,54 @@ +From cb8bdd3ffca280d014311ab395651d33f58a8708 Mon Sep 17 00:00:00 2001 +From: Ziyi Guo +Date: Sat, 31 Jan 2026 22:19:07 +0000 +Subject: media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() + +From: Ziyi Guo + +commit cb8bdd3ffca280d014311ab395651d33f58a8708 upstream. + +Add spin_lock_irqsave()/spin_unlock_irqrestore() around the +handle_dynamic_resolution_change() call in initialize_sequence() to fix +the missing lock protection. + +initialize_sequence() calls handle_dynamic_resolution_change() without +holding inst->state_spinlock. However, handle_dynamic_resolution_change() +has lockdep_assert_held(&inst->state_spinlock) indicating that callers +must hold this lock. + +Other callers of handle_dynamic_resolution_change() properly acquire the +spinlock: +- wave5_vpu_dec_finish_decode() +- wave5_vpu_dec_device_run() + +Signed-off-by: Ziyi Guo +Reviewed-by: Nicolas Dufresne +Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer") +Cc: stable@vger.kernel.org +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c +@@ -1593,6 +1593,7 @@ static int initialize_sequence(struct vp + { + struct dec_initial_info initial_info; + int ret = 0; ++ unsigned long flags; + + memset(&initial_info, 0, sizeof(struct dec_initial_info)); + +@@ -1614,7 +1615,9 @@ static int initialize_sequence(struct vp + return ret; + } + ++ spin_lock_irqsave(&inst->state_spinlock, flags); + handle_dynamic_resolution_change(inst); ++ spin_unlock_irqrestore(&inst->state_spinlock, flags); + + return 0; + } diff --git a/queue-7.0/media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch b/queue-7.0/media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch new file mode 100644 index 0000000000..b6075cb66b --- /dev/null +++ b/queue-7.0/media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch @@ -0,0 +1,69 @@ +From f48050436746be75227fbc90066a8658cbe94d17 Mon Sep 17 00:00:00 2001 +From: Ziyi Guo +Date: Sat, 31 Jan 2026 22:03:23 +0000 +Subject: media: chips-media: wave5: add missing spinlock protection for send_eos_event() + +From: Ziyi Guo + +commit f48050436746be75227fbc90066a8658cbe94d17 upstream. + +Add spin_lock_irqsave()/spin_unlock_irqrestore() around send_eos_event() +calls in the VB2 buffer queue and streamoff callbacks to fix the missing +lock protection. + +wave5_vpu_dec_buf_queue_dst() and streamoff_output() call send_eos_event() +without holding inst->state_spinlock. However, send_eos_event() has +lockdep_assert_held(&inst->state_spinlock) indicating that callers must +hold this lock. + +Other callers of send_eos_event() properly acquire the spinlock: +- wave5_vpu_dec_finish_decode() acquires lock at line 431 +- wave5_vpu_dec_encoder_cmd() acquires lock at line 821 +- wave5_vpu_dec_device_run() acquires lock at line 1592 + +Signed-off-by: Ziyi Guo +Reviewed-by: Nicolas Dufresne +Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer") +Cc: stable@vger.kernel.org +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c +@@ -1303,13 +1303,17 @@ static void wave5_vpu_dec_buf_queue_dst( + + if (vb2_is_streaming(vb->vb2_queue) && v4l2_m2m_dst_buf_is_last(m2m_ctx)) { + unsigned int i; ++ unsigned long flags; + + for (i = 0; i < vb->num_planes; i++) + vb2_set_plane_payload(vb, i, 0); + + vbuf->field = V4L2_FIELD_NONE; + ++ spin_lock_irqsave(&inst->state_spinlock, flags); + send_eos_event(inst); ++ spin_unlock_irqrestore(&inst->state_spinlock, flags); ++ + v4l2_m2m_last_buffer_done(m2m_ctx, vbuf); + } else { + v4l2_m2m_buf_queue(m2m_ctx, vbuf); +@@ -1462,8 +1466,13 @@ static int streamoff_output(struct vb2_q + inst->codec_info->dec_info.stream_rd_ptr = new_rd_ptr; + inst->codec_info->dec_info.stream_wr_ptr = new_rd_ptr; + +- if (v4l2_m2m_has_stopped(m2m_ctx)) ++ if (v4l2_m2m_has_stopped(m2m_ctx)) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&inst->state_spinlock, flags); + send_eos_event(inst); ++ spin_unlock_irqrestore(&inst->state_spinlock, flags); ++ } + + /* streamoff on output cancels any draining operation */ + inst->eos = false; diff --git a/queue-7.0/media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch b/queue-7.0/media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch new file mode 100644 index 0000000000..c58ac89325 --- /dev/null +++ b/queue-7.0/media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch @@ -0,0 +1,33 @@ +From 95bd174a453f77b09ea66e1e22834680754ba501 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Sun, 25 Jan 2026 22:19:15 +0800 +Subject: media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() + +From: Haoxiang Li + +commit 95bd174a453f77b09ea66e1e22834680754ba501 upstream. + +Add wave5_vdi_free_dma_memory() in the error path of +wave5_vdi_init() to prevent a potential memory leak. + +Fixes: 45d1a2b93277 ("media: chips-media: wave5: Add vpuapi layer") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vdi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vdi.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vdi.c +@@ -49,6 +49,7 @@ int wave5_vdi_init(struct device *dev) + + if (!PRODUCT_CODE_W_SERIES(vpu_dev->product_code)) { + WARN_ONCE(1, "unsupported product code: 0x%x\n", vpu_dev->product_code); ++ wave5_vdi_free_dma_memory(vpu_dev, &vpu_dev->common_mem); + return -EOPNOTSUPP; + } + diff --git a/queue-7.0/media-dt-bindings-rockchip-vdec-add-alternative-reg-names-order-for-rk35-76-88.patch b/queue-7.0/media-dt-bindings-rockchip-vdec-add-alternative-reg-names-order-for-rk35-76-88.patch new file mode 100644 index 0000000000..ab8a3cb014 --- /dev/null +++ b/queue-7.0/media-dt-bindings-rockchip-vdec-add-alternative-reg-names-order-for-rk35-76-88.patch @@ -0,0 +1,77 @@ +From 35c8178ed2bd9821a75a406d762b2f2e161f9c70 Mon Sep 17 00:00:00 2001 +From: Cristian Ciocaltea +Date: Wed, 4 Mar 2026 23:00:41 +0200 +Subject: media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} + +From: Cristian Ciocaltea + +commit 35c8178ed2bd9821a75a406d762b2f2e161f9c70 upstream. + +With the introduction of the RK3588 SoC, and RK3576 afterwards, three +register blocks have been provided for the video decoder unit instead of +just one, which are further referenced in vendor's datasheet by 'link +table', 'function' and 'cache'. The former is present at the top of the +listing, starting at video decoder unit base address. + +However, while documenting RK3588, the binding broke the convention +expecting the unit address to indicate the start of the primary register +range, i.e. the 'function' block got listed before the 'link' one. + +Since the binding changes have been already released and a fix would +bring up an ABI break, mark the current 'reg-names' ordering as +deprecated and introduce an alternative 'link,function,cache' listing +which follows the address-based ordering according to the TRM. + +Additionally, drop the 'reg' description items as the order is not fixed +anymore, while the information they offer is not very relevant anyway. + +It's worth noting there are currently no (known) users impacted by these +binding changes, since the video decoder support for the aforementioned +SoCs in mainline driver and devicetrees hasn't been released yet - it +landed in v7.0-rc1 while all DTS updates resulting from this will be +handled before v7.0 is out. + +Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings") +Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings") +Cc: stable@vger.kernel.org +Reviewed-by: Nicolas Dufresne +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Cristian Ciocaltea +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/media/rockchip,vdec.yaml | 20 +++++++------ + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/Documentation/devicetree/bindings/media/rockchip,vdec.yaml ++++ b/Documentation/devicetree/bindings/media/rockchip,vdec.yaml +@@ -28,16 +28,20 @@ properties: + + reg: + minItems: 1 +- items: +- - description: The function configuration registers base +- - description: The link table configuration registers base +- - description: The cache configuration registers base ++ maxItems: 3 + + reg-names: +- items: +- - const: function +- - const: link +- - const: cache ++ oneOf: ++ - items: ++ - const: link ++ - const: function ++ - const: cache ++ - items: ++ - const: function ++ - const: link ++ - const: cache ++ deprecated: true ++ description: Use link,function,cache block order instead. + + interrupts: + maxItems: 1 diff --git a/queue-7.0/media-dt-bindings-rockchip-vdec-mark-reg-names-required-for-rk35-76-88.patch b/queue-7.0/media-dt-bindings-rockchip-vdec-mark-reg-names-required-for-rk35-76-88.patch new file mode 100644 index 0000000000..6cf3643cd8 --- /dev/null +++ b/queue-7.0/media-dt-bindings-rockchip-vdec-mark-reg-names-required-for-rk35-76-88.patch @@ -0,0 +1,53 @@ +From a11db8d8b403eba1f82728f440727128e9997edd Mon Sep 17 00:00:00 2001 +From: Cristian Ciocaltea +Date: Wed, 4 Mar 2026 23:00:40 +0200 +Subject: media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} + +From: Cristian Ciocaltea + +commit a11db8d8b403eba1f82728f440727128e9997edd upstream. + +The Rockchip Video Decoder driver expects reg-names to be mandatory for +RK3576 and RK3588 SoCs, however the binding does not currently require +the use of them. + +As a consequence, driver would fail to probe with a hypothetical +devicetree that doesn't provide the reg-names for these SoCs, but which +is otherwise a perfectly valid DT from the binding perspective. + +Update the binding and make reg-names required for the aforementioned +SoCs. While this change introduces an ABI break, the expected impact on +potential users would be minimal, if any, since the old SoCs are +unaffected, while the video decoder support for these newer variants in +mainline driver and devicetrees hasn't been released yet. + +Moreover, this is also a prerequisite for a subsequent binding update +introducing an alternative reg-names order, according to the +address-based listing in the vendor's datasheet. + +Reported-by: Conor Dooley +Closes: https://lore.kernel.org/all/20260227-urologist-gratitude-7984733f2d41@spud/ +Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings") +Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings") +Cc: stable@vger.kernel.org +Signed-off-by: Cristian Ciocaltea +Acked-by: Conor Dooley +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/media/rockchip,vdec.yaml | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/Documentation/devicetree/bindings/media/rockchip,vdec.yaml ++++ b/Documentation/devicetree/bindings/media/rockchip,vdec.yaml +@@ -127,6 +127,8 @@ allOf: + minItems: 5 + reset-names: + minItems: 5 ++ required: ++ - reg-names + else: + properties: + reg: diff --git a/queue-7.0/media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch b/queue-7.0/media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch new file mode 100644 index 0000000000..1fdd88f8a0 --- /dev/null +++ b/queue-7.0/media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch @@ -0,0 +1,49 @@ +From bce1349dbf6348ddee47308e2ed08878356de317 Mon Sep 17 00:00:00 2001 +From: Jai Luthra +Date: Sat, 14 Feb 2026 18:35:21 +0530 +Subject: media: i2c: imx283: Enter full standby when stopping streaming + +From: Jai Luthra + +commit bce1349dbf6348ddee47308e2ed08878356de317 upstream. + +Use IMX283_STANDBY (bit 0) instead of IMX283_STBLOGIC (bit 1) when +stopping streaming. STBLOGIC only puts the sensor logic into standby but +leaves the MIPI interface (along with other components) in an +indeterminate state. + +This (presumably) causes the CSI receiver (e.g. Raspberry Pi's CFE) to +miss the LP-11 to HS transition when streaming restarts, resulting in a +hang of 10+ seconds. The issue is most visible when immediately +restarting a full-resolution stream after stopping a 3x3 binned one, so +that runtime suspend hasn't yet been triggered. + +Writing IMX283_STANDBY puts the entire sensor into standby. The +imx283_standby_cancel() sequence already handles the full wakeup from +this suspended state. + +Cc: stable@vger.kernel.org +Link: https://github.com/raspberrypi/linux/issues/7153 +Link: https://github.com/will127534/OneInchEye/issues/12 +Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver") +Signed-off-by: Jai Luthra +Tested-by: Kieran Bingham +Reviewed-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/imx283.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/imx283.c ++++ b/drivers/media/i2c/imx283.c +@@ -1158,7 +1158,7 @@ static int imx283_disable_streams(struct + if (pad != IMAGE_PAD) + return -EINVAL; + +- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STBLOGIC, NULL); ++ ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL); + if (ret) + dev_err(imx283->dev, "Failed to stop stream\n"); + diff --git a/queue-7.0/media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch b/queue-7.0/media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch new file mode 100644 index 0000000000..5dde7128a2 --- /dev/null +++ b/queue-7.0/media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch @@ -0,0 +1,90 @@ +From 9206359b2c396ff594adf39bc7daaadab0fcb367 Mon Sep 17 00:00:00 2001 +From: Jai Luthra +Date: Sat, 14 Feb 2026 18:35:22 +0530 +Subject: media: i2c: imx283: Fix hang when going from large to small resolution + +From: Jai Luthra + +commit 9206359b2c396ff594adf39bc7daaadab0fcb367 upstream. + +When switching between modes (e.g. full resolution to binned), +standby_cancel() previously cleared XMSTA (starting master mode data +output) before the new mode's MDSEL, crop, and timing registers were +programmed in start_streaming(). This caused the sensor to briefly +output MIPI data using the previous mode's configuration. + +On receivers like imx-mipi-csis, this leads to FIFO overflow errors +when switching from a higher to a lower resolution, as the receiver is +configured for the new smaller frame size but receives stale +full-resolution data. + +Fix this by moving the XMSTA and SYNCDRV register writes from +standby_cancel() to the end of start_streaming(), after all mode, +crop, and timing registers have been configured. Also explicitly stop +master mode (XMSTA=1) when stopping the stream, matching the pattern +used by other Sony sensor drivers (imx290, imx415). + +Use named macros IMX283_XMSTA_START/STOP instead of raw 0/BIT(0) for +readability. + +Cc: stable@vger.kernel.org +Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver") +Signed-off-by: Jai Luthra +Tested-by: Kieran Bingham +Reviewed-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/imx283.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/media/i2c/imx283.c ++++ b/drivers/media/i2c/imx283.c +@@ -129,7 +129,8 @@ + + /* Master Mode Operation Control */ + #define IMX283_REG_XMSTA CCI_REG8(0x3105) +-#define IMX283_XMSTA BIT(0) ++#define IMX283_XMSTA_START 0 ++#define IMX283_XMSTA_STOP BIT(0) + + #define IMX283_REG_SYNCDRV CCI_REG8(0x3107) + #define IMX283_SYNCDRV_XHS_XVS (0xa0 | 0x02) +@@ -1023,8 +1024,6 @@ static int imx283_standby_cancel(struct + usleep_range(19000, 20000); + + cci_write(imx283->cci, IMX283_REG_CLAMP, IMX283_CLPSQRST, &ret); +- cci_write(imx283->cci, IMX283_REG_XMSTA, 0, &ret); +- cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret); + + return ret; + } +@@ -1117,6 +1116,10 @@ static int imx283_start_streaming(struct + /* Apply customized values from controls (HMAX/VMAX/SHR) */ + ret = __v4l2_ctrl_handler_setup(imx283->sd.ctrl_handler); + ++ /* Start master mode */ ++ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_START, &ret); ++ cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret); ++ + return ret; + } + +@@ -1153,12 +1156,14 @@ static int imx283_disable_streams(struct + u64 streams_mask) + { + struct imx283 *imx283 = to_imx283(sd); +- int ret; ++ int ret = 0; + + if (pad != IMAGE_PAD) + return -EINVAL; + +- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL); ++ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_STOP, &ret); ++ cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, &ret); ++ + if (ret) + dev_err(imx283->dev, "Failed to stop stream\n"); + diff --git a/queue-7.0/media-i2c-ov5647-fix-runtime-pm-refcount-leak-in-s_ctrl.patch b/queue-7.0/media-i2c-ov5647-fix-runtime-pm-refcount-leak-in-s_ctrl.patch new file mode 100644 index 0000000000..6b7c3bcaac --- /dev/null +++ b/queue-7.0/media-i2c-ov5647-fix-runtime-pm-refcount-leak-in-s_ctrl.patch @@ -0,0 +1,63 @@ +From f11ae9c04f8368a3b5a0280ef595198dace1c983 Mon Sep 17 00:00:00 2001 +From: Xiaolei Wang +Date: Wed, 25 Feb 2026 16:56:21 +0800 +Subject: media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl + +From: Xiaolei Wang + +commit f11ae9c04f8368a3b5a0280ef595198dace1c983 upstream. + +Three control cases (AUTOGAIN, EXPOSURE_AUTO, ANALOGUE_GAIN) directly +return without calling pm_runtime_put(), causing runtime PM reference +count leaks. + +Change these cases from 'return' to 'ret = ... break' pattern to ensure +pm_runtime_put() is always called before function exit. + +Fixes: 4f66f36388d5 ("media: i2c: ov5647: Convert to CCI register access helpers") +Cc: stable@vger.kernel.org +Signed-off-by: Xiaolei Wang +Reviewed-by: Tarang Raval +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ov5647.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c +index 6a46ef7233ac..db9bd2892140 100644 +--- a/drivers/media/i2c/ov5647.c ++++ b/drivers/media/i2c/ov5647.c +@@ -967,21 +967,21 @@ static int ov5647_s_ctrl(struct v4l2_ctrl *ctrl) + break; + case V4L2_CID_AUTOGAIN: + /* Non-zero turns on AGC by clearing bit 1.*/ +- return cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(1), +- ctrl->val ? 0 : BIT(1), NULL); ++ ret = cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(1), ++ ctrl->val ? 0 : BIT(1), NULL); + break; + case V4L2_CID_EXPOSURE_AUTO: + /* + * Everything except V4L2_EXPOSURE_MANUAL turns on AEC by + * clearing bit 0. + */ +- return cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(0), +- ctrl->val == V4L2_EXPOSURE_MANUAL ? BIT(0) : 0, NULL); ++ ret = cci_update_bits(sensor->regmap, OV5647_REG_AEC_AGC, BIT(0), ++ ctrl->val == V4L2_EXPOSURE_MANUAL ? BIT(0) : 0, NULL); + break; + case V4L2_CID_ANALOGUE_GAIN: + /* 10 bits of gain, 2 in the high register. */ +- return cci_write(sensor->regmap, OV5647_REG_GAIN, +- ctrl->val & 0x3ff, NULL); ++ ret = cci_write(sensor->regmap, OV5647_REG_GAIN, ++ ctrl->val & 0x3ff, NULL); + break; + case V4L2_CID_EXPOSURE: + /* +-- +2.54.0 + diff --git a/queue-7.0/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch b/queue-7.0/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch new file mode 100644 index 0000000000..3c662ca816 --- /dev/null +++ b/queue-7.0/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch @@ -0,0 +1,45 @@ +From f75e160745663ce9b13362ae6e90bd439c58df69 Mon Sep 17 00:00:00 2001 +From: Alexander Koskovich +Date: Thu, 12 Mar 2026 17:16:20 +0000 +Subject: media: i2c: ov8856: free control handler on error in ov8856_init_controls() + +From: Alexander Koskovich + +commit f75e160745663ce9b13362ae6e90bd439c58df69 upstream. + +The control handler wasn't freed if adding controls failed, add an error +exit label and convert the existing error return to use it. + +Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor") +Cc: stable@vger.kernel.org +Signed-off-by: Alexander Koskovich +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ov8856.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/ov8856.c ++++ b/drivers/media/i2c/ov8856.c +@@ -1951,12 +1951,18 @@ static int ov8856_init_controls(struct o + V4L2_CID_HFLIP, 0, 1, 1, 0); + v4l2_ctrl_new_std(ctrl_hdlr, &ov8856_ctrl_ops, + V4L2_CID_VFLIP, 0, 1, 1, 0); +- if (ctrl_hdlr->error) +- return ctrl_hdlr->error; ++ if (ctrl_hdlr->error) { ++ ret = ctrl_hdlr->error; ++ goto err_ctrl_handler_free; ++ } + + ov8856->sd.ctrl_handler = ctrl_hdlr; + + return 0; ++ ++err_ctrl_handler_free: ++ v4l2_ctrl_handler_free(ctrl_hdlr); ++ return ret; + } + + static void ov8856_update_pad_format(struct ov8856 *ov8856, diff --git a/queue-7.0/media-intel-ipu6-fix-error-pointer-dereference.patch b/queue-7.0/media-intel-ipu6-fix-error-pointer-dereference.patch new file mode 100644 index 0000000000..e136f54798 --- /dev/null +++ b/queue-7.0/media-intel-ipu6-fix-error-pointer-dereference.patch @@ -0,0 +1,39 @@ +From 8dd088b8b106f7b119664f965b691785998edcfb Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Fri, 6 Mar 2026 21:03:55 -0600 +Subject: media: intel/ipu6: fix error pointer dereference + +From: Ethan Tidmore + +commit 8dd088b8b106f7b119664f965b691785998edcfb upstream. + +In a error path isp->psys is confirmed to be an error pointer not NULL so +this condition is true and the error pointer is dereferenced. So isp-psys +should be set to NULL before going to out_ipu6_bus_del_devices. + +Detected by Smatch: +drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error: +'isp->psys' dereferencing possible ERR_PTR() + +Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Ethan Tidmore +[Sakari Ailus: Fix commit message.] +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/intel/ipu6/ipu6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/pci/intel/ipu6/ipu6.c ++++ b/drivers/media/pci/intel/ipu6/ipu6.c +@@ -686,7 +686,7 @@ out_free_irq: + out_ipu6_rpm_put: + pm_runtime_put_sync(&isp->psys->auxdev.dev); + out_ipu6_bus_del_devices: +- if (isp->psys) { ++ if (!IS_ERR_OR_NULL(isp->psys)) { + ipu6_cpd_free_pkg_dir(isp->psys); + ipu6_buttress_unmap_fw_image(isp->psys, &isp->psys->fw_sgt); + } diff --git a/queue-7.0/media-ipu-bridge-add-upside-down-sensor-dmi-quirk-for-dell-xps-13-9340-and-xps-14-9440.patch b/queue-7.0/media-ipu-bridge-add-upside-down-sensor-dmi-quirk-for-dell-xps-13-9340-and-xps-14-9440.patch new file mode 100644 index 0000000000..e23459cbf6 --- /dev/null +++ b/queue-7.0/media-ipu-bridge-add-upside-down-sensor-dmi-quirk-for-dell-xps-13-9340-and-xps-14-9440.patch @@ -0,0 +1,54 @@ +From 2c10400e4a233200046d023ab2377bc56fd48dea Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 25 Feb 2026 21:30:54 +0100 +Subject: media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340 and XPS 14 9440 + +From: Hans de Goede + +commit 2c10400e4a233200046d023ab2377bc56fd48dea upstream. + +The Dell XPS 13 9340 and XPS 14 9440 have an upside-down mounted OV02C10 +sensor, just like the XPS 13 9350 and XPS 16 9640 models. + +Extend the existing DMI matches for handling these laptops with DMI +matches for these 2 models + +Reported-by: Heimir Thor Sverrisson # XPS 14 9440 +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2440581 # XPS 13 9340 +Fixes: d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip") +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/intel/ipu-bridge.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/media/pci/intel/ipu-bridge.c ++++ b/drivers/media/pci/intel/ipu-bridge.c +@@ -107,10 +107,24 @@ static const struct dmi_system_id upside + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS 13 9340"), ++ }, ++ .driver_data = "OVTI02C1", ++ }, ++ { ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS 13 9350"), + }, + .driver_data = "OVTI02C1", + }, ++ { ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS 14 9440"), ++ }, ++ .driver_data = "OVTI02C1", ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), diff --git a/queue-7.0/media-mali-c55-fix-iridix-bypass-macros.patch b/queue-7.0/media-mali-c55-fix-iridix-bypass-macros.patch new file mode 100644 index 0000000000..2aee10dd30 --- /dev/null +++ b/queue-7.0/media-mali-c55-fix-iridix-bypass-macros.patch @@ -0,0 +1,43 @@ +From db7faf488ecf846c46884310ff1bf28daf2ad39a Mon Sep 17 00:00:00 2001 +From: Daniel Scally +Date: Thu, 12 Feb 2026 11:03:09 +0000 +Subject: media: mali-c55: Fix Iridix bypass macros +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Scally + +commit db7faf488ecf846c46884310ff1bf28daf2ad39a upstream. + +The Mali C55 Iridix block has a digital gain function and tone mapping +function, whose enablement is controlled by two different bits +in the BYPASS_3 register. + +Unfortunately, the "Gain" and "Tonemap" bypass bit definitions are the +wrong way around. Swap them. + +Cc: stable@vger.kernel.org +Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") +Signed-off-by: Daniel Scally +Reviewed-by: Barnabás Pőcze +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/arm/mali-c55/mali-c55-registers.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/arm/mali-c55/mali-c55-registers.h ++++ b/drivers/media/platform/arm/mali-c55/mali-c55-registers.h +@@ -128,8 +128,8 @@ enum mali_c55_interrupts { + #define MALI_C55_REG_BYPASS_3_SENSOR_OFFSET_PRE_SH BIT(1) + #define MALI_C55_REG_BYPASS_3_MESH_SHADING BIT(3) + #define MALI_C55_REG_BYPASS_3_WHITE_BALANCE BIT(4) +-#define MALI_C55_REG_BYPASS_3_IRIDIX BIT(5) +-#define MALI_C55_REG_BYPASS_3_IRIDIX_GAIN BIT(6) ++#define MALI_C55_REG_BYPASS_3_IRIDIX_GAIN BIT(5) ++#define MALI_C55_REG_BYPASS_3_IRIDIX BIT(6) + #define MALI_C55_REG_BYPASS_4 0x18ec0 + #define MALI_C55_REG_BYPASS_4_DEMOSAIC_RGB BIT(1) + #define MALI_C55_REG_BYPASS_4_PF_CORRECTION BIT(3) diff --git a/queue-7.0/media-mali-c55-fix-wrong-comment-of-isp-block-types.patch b/queue-7.0/media-mali-c55-fix-wrong-comment-of-isp-block-types.patch new file mode 100644 index 0000000000..e0f35e3b48 --- /dev/null +++ b/queue-7.0/media-mali-c55-fix-wrong-comment-of-isp-block-types.patch @@ -0,0 +1,50 @@ +From df16624248296ce4e8890c7ddcc95f0ccb642bcd Mon Sep 17 00:00:00 2001 +From: Jacopo Mondi +Date: Mon, 19 Jan 2026 11:00:23 +0100 +Subject: media: mali-c55: Fix wrong comment of ISP block types +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacopo Mondi + +commit df16624248296ce4e8890c7ddcc95f0ccb642bcd upstream. + +Some bad copy&paste happened in the description of the ISP block types +and AWB_CONFIG got mixed up with SHADING_CONFIG. + +Fix it by assigning to each block the correct type. + +As only the comment is changed, there is no uABI breakage or regression. + +Cc: stable@vger.kernel.org +Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") +Reviewed-by: Daniel Scally +Reviewed-by: Barnabás Pőcze +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/arm/mali-c55/mali-c55-params.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c +index be0e909bcf29..c03a6120ddbf 100644 +--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c ++++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c +@@ -43,9 +43,9 @@ + * @digital_gain: For header->type == MALI_C55_PARAM_BLOCK_DIGITAL_GAIN + * @awb_gains: For header->type == MALI_C55_PARAM_BLOCK_AWB_GAINS and + * header->type = MALI_C55_PARAM_BLOCK_AWB_GAINS_AEXP +- * @awb_config: For header->type == MALI_C55_PARAM_MESH_SHADING_CONFIG +- * @shading_config: For header->type == MALI_C55_PARAM_MESH_SHADING_SELECTION +- * @shading_selection: For header->type == MALI_C55_PARAM_BLOCK_SENSOR_OFFS ++ * @awb_config: For header->type == MALI_C55_PARAM_BLOCK_AWB_CONFIG ++ * @shading_config: For header->type == MALI_C55_PARAM_MESH_SHADING_CONFIG ++ * @shading_selection: For header->type == MALI_C55_PARAM_MESH_SHADING_SELECTION + * @data: Allows easy initialisation of a union variable with a + * pointer into a __u8 array. + */ +-- +2.54.0 + diff --git a/queue-7.0/media-mali-c55-fully-reset-the-isp-configuration.patch b/queue-7.0/media-mali-c55-fully-reset-the-isp-configuration.patch new file mode 100644 index 0000000000..bf4bd43212 --- /dev/null +++ b/queue-7.0/media-mali-c55-fully-reset-the-isp-configuration.patch @@ -0,0 +1,101 @@ +From 26ad493bea57efdccc32ffedbf731da2b7463b6c Mon Sep 17 00:00:00 2001 +From: Jacopo Mondi +Date: Mon, 19 Jan 2026 12:50:26 +0100 +Subject: media: mali-c55: Fully reset the ISP configuration + +From: Jacopo Mondi + +commit 26ad493bea57efdccc32ffedbf731da2b7463b6c upstream. + +The Mali C55 driver uses an auto-suspend delay of 2000 milli-seconds. + +As the delay is quite large, it is certainly possible that two +consecutive calls to enable_streams() do not go through a suspend of the +peripheral, meaning we cannot rely on POW register values for the ISP +configuration. + +To prevent a streaming session to be initialized with settings from the +previous one, reset the full ISP configuration to know state disabling or +bypassing all the ISP blocks the driver supports. + +Cc: stable@vger.kernel.org +Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") +Reviewed-by: Daniel Scally +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + .../platform/arm/mali-c55/mali-c55-params.c | 50 +++++++++++++++++++ + 1 file changed, 50 insertions(+) + +diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c +index c84a6047a570..773e5b6a2b7e 100644 +--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c ++++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c +@@ -781,6 +781,43 @@ void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55, + MALI_C55_REG_BYPASS_3_SQUARE_BE, + MALI_C55_REG_BYPASS_3_SQUARE_BE); + ++ /* Bypass the sensor offset correction (BLS) module */ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_3, ++ MALI_C55_REG_BYPASS_3_SENSOR_OFFSET_PRE_SH, ++ MALI_C55_REG_BYPASS_3_SENSOR_OFFSET_PRE_SH); ++ ++ /* Configure 1x digital gain. */ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_DIGITAL_GAIN, ++ MALI_C55_DIGITAL_GAIN_MASK, 256); ++ ++ /* Set all AWB gains to 1x. at both AWB configuration points*/ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1, ++ MALI_C55_AWB_GAIN00_MASK, 256); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1, ++ MALI_C55_AWB_GAIN01_MASK, ++ MALI_C55_AWB_GAIN01(256)); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2, ++ MALI_C55_AWB_GAIN10_MASK, 256); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2, ++ MALI_C55_AWB_GAIN11_MASK, ++ MALI_C55_AWB_GAIN11(256)); ++ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1_AEXP, ++ MALI_C55_AWB_GAIN00_MASK, 256); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS1_AEXP, ++ MALI_C55_AWB_GAIN01_MASK, ++ MALI_C55_AWB_GAIN01(256)); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2_AEXP, ++ MALI_C55_AWB_GAIN10_MASK, 256); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_AWB_GAINS2_AEXP, ++ MALI_C55_AWB_GAIN11_MASK, ++ MALI_C55_AWB_GAIN11(256)); ++ ++ /* Bypass mesh shading corrections (LSC). */ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_MESH_SHADING_CONFIG, ++ MALI_C55_MESH_SHADING_ENABLE_MASK, ++ false); ++ + /* Bypass the temper module */ + mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_2, + MALI_C55_REG_BYPASS_2_TEMPER); +@@ -802,6 +839,19 @@ void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55, + + /* Disable the colour correction matrix */ + mali_c55_ctx_write(mali_c55, MALI_C55_REG_CCM_ENABLE, 0); ++ ++ /* Disable AWB stats. */ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_METERING_CONFIG, ++ MALI_C55_AWB_DISABLE_MASK, ++ MALI_C55_AWB_DISABLE_MASK); ++ ++ /* Disable auto-exposure 1024-bin histograms at both tap points. */ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_METERING_CONFIG, ++ MALI_C55_AEXP_HIST_DISABLE_MASK, ++ MALI_C55_AEXP_HIST_DISABLE); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_METERING_CONFIG, ++ MALI_C55_AEXP_IHIST_DISABLE_MASK, ++ MALI_C55_AEXP_IHIST_DISABLE); + } + + void mali_c55_unregister_params(struct mali_c55 *mali_c55) +-- +2.54.0 + diff --git a/queue-7.0/media-mali-c55-initialize-the-isp-in-enable_streams.patch b/queue-7.0/media-mali-c55-initialize-the-isp-in-enable_streams.patch new file mode 100644 index 0000000000..5a9e4e2ddc --- /dev/null +++ b/queue-7.0/media-mali-c55-initialize-the-isp-in-enable_streams.patch @@ -0,0 +1,227 @@ +From d5c24b71da547fdb5bea51a69d62f9e2a609431d Mon Sep 17 00:00:00 2001 +From: Jacopo Mondi +Date: Mon, 19 Jan 2026 12:20:56 +0100 +Subject: media: mali-c55: Initialize the ISP in enable_streams() + +From: Jacopo Mondi + +commit d5c24b71da547fdb5bea51a69d62f9e2a609431d upstream. + +The Mali C55 driver initializes the ISP in two points: + +1) At probe time it disables ISP blocks by configuring them in bypass + mode +2) At enable_streams() it initializes the crop rectangles and the image + processing pipeline using the current image format + +However, as ISP blocks are configured by userspace, if their +configuration is not reset, from the second enable_streams() call +onwards the ISP configuration will depend on the previous streaming +session configuration. + +To re-initialize the ISP completely at enable_streams() time consolidate +the ISP block bypass configuration and the image processing path +configuration in a single function to be called at enabled_streams() +time. + +Cc: stable@vger.kernel.org +Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") +Reviewed-by: Daniel Scally +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/arm/mali-c55/mali-c55-common.h | 2 + drivers/media/platform/arm/mali-c55/mali-c55-core.c | 35 -------- + drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 37 +-------- + drivers/media/platform/arm/mali-c55/mali-c55-params.c | 72 ++++++++++++++++++ + 4 files changed, 79 insertions(+), 67 deletions(-) + +--- a/drivers/media/platform/arm/mali-c55/mali-c55-common.h ++++ b/drivers/media/platform/arm/mali-c55/mali-c55-common.h +@@ -306,5 +306,7 @@ bool mali_c55_pipeline_ready(struct mali + void mali_c55_stats_fill_buffer(struct mali_c55 *mali_c55, + enum mali_c55_config_spaces cfg_space); + void mali_c55_params_write_config(struct mali_c55 *mali_c55); ++void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55, ++ const struct v4l2_subdev_state *state); + + #endif /* _MALI_C55_COMMON_H */ +--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c ++++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c +@@ -663,41 +663,6 @@ static int mali_c55_init_context(struct + mali_c55->base + config_space_addrs[MALI_C55_CONFIG_PING], + MALI_C55_CONFIG_SPACE_SIZE); + +- /* +- * Some features of the ISP need to be disabled by default and only +- * enabled at the same time as they're configured by a parameters buffer +- */ +- +- /* Bypass the sqrt and square compression and expansion modules */ +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_1, +- MALI_C55_REG_BYPASS_1_FE_SQRT, +- MALI_C55_REG_BYPASS_1_FE_SQRT); +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_3, +- MALI_C55_REG_BYPASS_3_SQUARE_BE, +- MALI_C55_REG_BYPASS_3_SQUARE_BE); +- +- /* Bypass the temper module */ +- mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_2, +- MALI_C55_REG_BYPASS_2_TEMPER); +- +- /* Disable the temper module's DMA read/write */ +- mali_c55_ctx_write(mali_c55, MALI_C55_REG_TEMPER_DMA_IO, 0x0); +- +- /* Bypass the colour noise reduction */ +- mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_4, +- MALI_C55_REG_BYPASS_4_CNR); +- +- /* Disable the sinter module */ +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_SINTER_CONFIG, +- MALI_C55_SINTER_ENABLE_MASK, 0); +- +- /* Disable the RGB Gamma module for each output */ +- mali_c55_ctx_write(mali_c55, MALI_C55_REG_FR_GAMMA_RGB_ENABLE, 0); +- mali_c55_ctx_write(mali_c55, MALI_C55_REG_DS_GAMMA_RGB_ENABLE, 0); +- +- /* Disable the colour correction matrix */ +- mali_c55_ctx_write(mali_c55, MALI_C55_REG_CCM_ENABLE, 0); +- + return 0; + } + +--- a/drivers/media/platform/arm/mali-c55/mali-c55-isp.c ++++ b/drivers/media/platform/arm/mali-c55/mali-c55-isp.c +@@ -112,9 +112,6 @@ static int mali_c55_isp_start(struct mal + const struct v4l2_subdev_state *state) + { + struct mali_c55_context *ctx = mali_c55_get_active_context(mali_c55); +- const struct mali_c55_isp_format_info *cfg; +- const struct v4l2_mbus_framefmt *format; +- const struct v4l2_rect *crop; + u32 val; + int ret; + +@@ -122,35 +119,11 @@ static int mali_c55_isp_start(struct mal + MALI_C55_REG_MCU_CONFIG_WRITE_MASK, + MALI_C55_REG_MCU_CONFIG_WRITE_PING); + +- /* Apply input windowing */ +- crop = v4l2_subdev_state_get_crop(state, MALI_C55_ISP_PAD_SINK_VIDEO); +- format = v4l2_subdev_state_get_format(state, +- MALI_C55_ISP_PAD_SINK_VIDEO); +- cfg = mali_c55_isp_get_mbus_config_by_code(format->code); +- +- mali_c55_write(mali_c55, MALI_C55_REG_HC_START, +- MALI_C55_HC_START(crop->left)); +- mali_c55_write(mali_c55, MALI_C55_REG_HC_SIZE, +- MALI_C55_HC_SIZE(crop->width)); +- mali_c55_write(mali_c55, MALI_C55_REG_VC_START_SIZE, +- MALI_C55_VC_START(crop->top) | +- MALI_C55_VC_SIZE(crop->height)); +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR, +- MALI_C55_REG_ACTIVE_WIDTH_MASK, format->width); +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR, +- MALI_C55_REG_ACTIVE_HEIGHT_MASK, +- format->height << 16); +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BAYER_ORDER, +- MALI_C55_BAYER_ORDER_MASK, cfg->order); +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_INPUT_WIDTH, +- MALI_C55_INPUT_WIDTH_MASK, +- MALI_C55_INPUT_WIDTH_20BIT); +- +- mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_ISP_RAW_BYPASS, +- MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK, +- cfg->bypass ? MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK : +- 0x00); +- ++ /* ++ * Apply default ISP configuration and the apply configurations from ++ * the first available parameters buffer. ++ */ ++ mali_c55_params_init_isp_config(mali_c55, state); + mali_c55_params_write_config(mali_c55); + ret = mali_c55_config_write(ctx, MALI_C55_CONFIG_PING, true); + if (ret) { +--- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c ++++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c +@@ -732,6 +732,78 @@ void mali_c55_params_write_config(struct + vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE); + } + ++void mali_c55_params_init_isp_config(struct mali_c55 *mali_c55, ++ const struct v4l2_subdev_state *state) ++{ ++ const struct mali_c55_isp_format_info *cfg; ++ const struct v4l2_mbus_framefmt *format; ++ const struct v4l2_rect *crop; ++ ++ /* Apply input windowing */ ++ crop = v4l2_subdev_state_get_crop(state, MALI_C55_ISP_PAD_SINK_VIDEO); ++ format = v4l2_subdev_state_get_format(state, ++ MALI_C55_ISP_PAD_SINK_VIDEO); ++ cfg = mali_c55_isp_get_mbus_config_by_code(format->code); ++ ++ mali_c55_write(mali_c55, MALI_C55_REG_HC_START, ++ MALI_C55_HC_START(crop->left)); ++ mali_c55_write(mali_c55, MALI_C55_REG_HC_SIZE, ++ MALI_C55_HC_SIZE(crop->width)); ++ mali_c55_write(mali_c55, MALI_C55_REG_VC_START_SIZE, ++ MALI_C55_VC_START(crop->top) | ++ MALI_C55_VC_SIZE(crop->height)); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR, ++ MALI_C55_REG_ACTIVE_WIDTH_MASK, format->width); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BASE_ADDR, ++ MALI_C55_REG_ACTIVE_HEIGHT_MASK, ++ format->height << 16); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BAYER_ORDER, ++ MALI_C55_BAYER_ORDER_MASK, cfg->order); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_INPUT_WIDTH, ++ MALI_C55_INPUT_WIDTH_MASK, ++ MALI_C55_INPUT_WIDTH_20BIT); ++ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_ISP_RAW_BYPASS, ++ MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK, ++ cfg->bypass ? MALI_C55_ISP_RAW_BYPASS_BYPASS_MASK : ++ 0x00); ++ ++ /* ++ * Some features of the ISP need to be disabled by default and only ++ * enabled at the same time as they're configured by a parameters buffer ++ */ ++ ++ /* Bypass the sqrt and square compression and expansion modules */ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_1, ++ MALI_C55_REG_BYPASS_1_FE_SQRT, ++ MALI_C55_REG_BYPASS_1_FE_SQRT); ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_BYPASS_3, ++ MALI_C55_REG_BYPASS_3_SQUARE_BE, ++ MALI_C55_REG_BYPASS_3_SQUARE_BE); ++ ++ /* Bypass the temper module */ ++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_2, ++ MALI_C55_REG_BYPASS_2_TEMPER); ++ ++ /* Disable the temper module's DMA read/write */ ++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_TEMPER_DMA_IO, 0x0); ++ ++ /* Bypass the colour noise reduction */ ++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_BYPASS_4, ++ MALI_C55_REG_BYPASS_4_CNR); ++ ++ /* Disable the sinter module */ ++ mali_c55_ctx_update_bits(mali_c55, MALI_C55_REG_SINTER_CONFIG, ++ MALI_C55_SINTER_ENABLE_MASK, 0); ++ ++ /* Disable the RGB Gamma module for each output */ ++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_FR_GAMMA_RGB_ENABLE, 0); ++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_DS_GAMMA_RGB_ENABLE, 0); ++ ++ /* Disable the colour correction matrix */ ++ mali_c55_ctx_write(mali_c55, MALI_C55_REG_CCM_ENABLE, 0); ++} ++ + void mali_c55_unregister_params(struct mali_c55 *mali_c55) + { + struct mali_c55_params *params = &mali_c55->params; diff --git a/queue-7.0/media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch b/queue-7.0/media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch new file mode 100644 index 0000000000..f300776255 --- /dev/null +++ b/queue-7.0/media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch @@ -0,0 +1,42 @@ +From 2f38622d0f85f317be9e6b131da6cd511db94fd2 Mon Sep 17 00:00:00 2001 +From: Guoniu Zhou +Date: Thu, 12 Mar 2026 11:12:34 +0800 +Subject: media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 + +From: Guoniu Zhou + +commit 2f38622d0f85f317be9e6b131da6cd511db94fd2 upstream. + +Fix a hang issue when capturing a single frame with applications like cam +in libcamera. It would hang waiting for the driver to complete the buffer, +but streaming never starts because min_queued_buffers was set to 2. + +The ISI module uses a ping-pong buffer mechanism that requires two buffers +to be programmed at all times. However, when fewer than 2 user buffers are +available, the driver use internal discard buffers to fill the remaining +slot(s). Reduce minimum queued buffers from 2 to 0 allows streaming to +start without any queued buffers. + +Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") +Cc: stable@vger.kernel.org +Signed-off-by: Guoniu Zhou +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260312-isi_min_buffers-v2-1-d5ea1c79ad81@nxp.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c +@@ -1410,7 +1410,7 @@ int mxc_isi_video_register(struct mxc_is + q->mem_ops = &vb2_dma_contig_memops; + q->buf_struct_size = sizeof(struct mxc_isi_buffer); + q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC; +- q->min_queued_buffers = 2; ++ q->min_queued_buffers = 0; + q->lock = &video->lock; + q->dev = pipe->isi->dev; + diff --git a/queue-7.0/media-rc-streamzap-error-handling-in-probe.patch b/queue-7.0/media-rc-streamzap-error-handling-in-probe.patch new file mode 100644 index 0000000000..d5495be003 --- /dev/null +++ b/queue-7.0/media-rc-streamzap-error-handling-in-probe.patch @@ -0,0 +1,54 @@ +From 42844992664f03ef9f930e64f7370fa481e9c267 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:06:21 +0100 +Subject: media: rc: streamzap: Error handling in probe + +From: Oliver Neukum + +commit 42844992664f03ef9f930e64f7370fa481e9c267 upstream. + +If submitting the URB fails, the device will be unusable. +Probe() must fail. + +Fixes: 7a569f524dd36 ("V4L/DVB: IR/streamzap: functional in-kernel decoding") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/streamzap.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/streamzap.c ++++ b/drivers/media/rc/streamzap.c +@@ -219,9 +219,8 @@ static void streamzap_callback(struct ur + case -ESHUTDOWN: + /* + * this urb is terminated, clean up. +- * sz might already be invalid at this point + */ +- dev_err(sz->dev, "urb terminated, status: %d\n", urb->status); ++ dev_dbg(sz->dev, "urb terminated, status: %d\n", urb->status); + return; + default: + break; +@@ -358,11 +357,16 @@ static int streamzap_probe(struct usb_in + + usb_set_intfdata(intf, sz); + +- if (usb_submit_urb(sz->urb_in, GFP_ATOMIC)) ++ retval = usb_submit_urb(sz->urb_in, GFP_ATOMIC); ++ if (retval < 0) { + dev_err(sz->dev, "urb submit failed\n"); ++ goto rc_submit_fail; ++ } + + return 0; +- ++rc_submit_fail: ++ rc_free_device(sz->rdev); ++ usb_set_intfdata(intf, NULL); + rc_dev_fail: + usb_free_urb(sz->urb_in); + free_buf_in: diff --git a/queue-7.0/media-rc-xbox_remote-heed-dma-restrictions.patch b/queue-7.0/media-rc-xbox_remote-heed-dma-restrictions.patch new file mode 100644 index 0000000000..1daf7c3564 --- /dev/null +++ b/queue-7.0/media-rc-xbox_remote-heed-dma-restrictions.patch @@ -0,0 +1,61 @@ +From e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:09:44 +0100 +Subject: media: rc: xbox_remote: heed DMA restrictions + +From: Oliver Neukum + +commit e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff upstream. + +The buffer for IO must not be part of the device structure +because that violates the DMA coherency rules. + +Fixes: 02d32bdad3123 ("media: rc: add driver for Xbox DVD Movie Playback Kit") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/xbox_remote.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/media/rc/xbox_remote.c ++++ b/drivers/media/rc/xbox_remote.c +@@ -55,7 +55,7 @@ struct xbox_remote { + struct usb_interface *interface; + + struct urb *irq_urb; +- unsigned char inbuf[DATA_BUFSIZE] __aligned(sizeof(u16)); ++ u8 *inbuf; + + char rc_name[NAME_BUFSIZE]; + char rc_phys[NAME_BUFSIZE]; +@@ -218,6 +218,10 @@ static int xbox_remote_probe(struct usb_ + if (!xbox_remote || !rc_dev) + goto exit_free_dev_rdev; + ++ xbox_remote->inbuf = kzalloc(DATA_BUFSIZE, GFP_KERNEL); ++ if (!xbox_remote->inbuf) ++ goto exit_free_inbuf; ++ + /* Allocate URB buffer */ + xbox_remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!xbox_remote->irq_urb) +@@ -262,6 +266,8 @@ exit_kill_urbs: + usb_kill_urb(xbox_remote->irq_urb); + exit_free_buffers: + usb_free_urb(xbox_remote->irq_urb); ++exit_free_inbuf: ++ kfree(xbox_remote->inbuf); + exit_free_dev_rdev: + rc_free_device(rc_dev); + kfree(xbox_remote); +@@ -286,6 +292,7 @@ static void xbox_remote_disconnect(struc + usb_kill_urb(xbox_remote->irq_urb); + rc_unregister_device(xbox_remote->rdev); + usb_free_urb(xbox_remote->irq_urb); ++ kfree(xbox_remote->inbuf); + kfree(xbox_remote); + } + diff --git a/queue-7.0/media-renesas-vin-fix-raw8-again.patch b/queue-7.0/media-renesas-vin-fix-raw8-again.patch new file mode 100644 index 0000000000..a6c885a0c6 --- /dev/null +++ b/queue-7.0/media-renesas-vin-fix-raw8-again.patch @@ -0,0 +1,92 @@ +From 40c6da8a9c0f897f99a439330584d93ca7d41226 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Tue, 27 Jan 2026 10:56:12 +0200 +Subject: media: renesas: vin: Fix RAW8 (again) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomi Valkeinen + +commit 40c6da8a9c0f897f99a439330584d93ca7d41226 upstream. + +Commit e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 +formats") removed dividing the stride by two for RAW8 formats. It is +unclear how this was tested, but in any of the recent tests this does +not seem to work and produces quite distorted images. + +However, reverting the patch fixes the issues only partially. VNIS_REG +requires alignment to 16 bytes, and when dividing the stride by 2, in +some cases we end up with a non-aligned stride, producing a tilted +image. This issue has to be fixed in rvin_format_bytesperline() where we +do the alignment for bytesperline. + +Adding back the stride division and increasing the alignment for RAW8 +formats to 0x20 fixes the problems related to RAW8. + +Fixes: e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 formats") +Cc: stable@vger.kernel.org +Signed-off-by: Tomi Valkeinen +Reviewed-by: Niklas Söderlund +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++++++++++++++++++++ + drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 ++++++++++ + 2 files changed, 34 insertions(+) + +--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c +@@ -676,8 +676,30 @@ void rvin_crop_scale_comp(struct rvin_de + if (vin->scaler) + vin->scaler(vin); + ++ /* ++ * VNIS_REG has four lowest bits always 0, i.e. the stride has to be ++ * aligned to 16 bytes. This is done in rvin_format_bytesperline(). ++ */ ++ + fmt = rvin_format_from_pixel(vin, vin->format.pixelformat); + stride = vin->format.bytesperline / fmt->bpp; ++ ++ /* ++ * RAW8 format bpp is 1, but the hardware process RAW8 format in 2 pixel ++ * units, so we need to divide the stride by 2. ++ */ ++ switch (vin->format.pixelformat) { ++ case V4L2_PIX_FMT_SBGGR8: ++ case V4L2_PIX_FMT_SGBRG8: ++ case V4L2_PIX_FMT_SGRBG8: ++ case V4L2_PIX_FMT_SRGGB8: ++ case V4L2_PIX_FMT_GREY: ++ stride /= 2; ++ break; ++ default: ++ break; ++ } ++ + rvin_write(vin, stride, VNIS_REG); + } + +--- a/drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c +@@ -155,6 +155,18 @@ static u32 rvin_format_bytesperline(stru + case V4L2_PIX_FMT_NV16: + align = 0x20; + break; ++ case V4L2_PIX_FMT_SBGGR8: ++ case V4L2_PIX_FMT_SGBRG8: ++ case V4L2_PIX_FMT_SGRBG8: ++ case V4L2_PIX_FMT_SRGGB8: ++ case V4L2_PIX_FMT_GREY: ++ /* ++ * RAW8 format bpp is 1, but the hardware process RAW8 format in ++ * 2 pixel units, and we need to align to 32 bytes. See ++ * rvin_crop_scale_comp(). ++ */ ++ align = 0x20; ++ break; + default: + align = 0x10; + break; diff --git a/queue-7.0/media-renesas-vsp1-fix-null-pointer-deref-on-module-unload.patch b/queue-7.0/media-renesas-vsp1-fix-null-pointer-deref-on-module-unload.patch new file mode 100644 index 0000000000..c6e7be2f47 --- /dev/null +++ b/queue-7.0/media-renesas-vsp1-fix-null-pointer-deref-on-module-unload.patch @@ -0,0 +1,45 @@ +From 58b1e9664d8f74d55d8411cc7a7b275a76a6f24f Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Thu, 15 Jan 2026 11:22:35 +0200 +Subject: media: renesas: vsp1: Fix NULL pointer deref on module unload + +From: Tomi Valkeinen + +commit 58b1e9664d8f74d55d8411cc7a7b275a76a6f24f upstream. + +When unloading the module on gen 4, we hit a NULL pointer dereference. +This is caused by the cleanup code calling vsp1_drm_cleanup() where it +should be calling vsp1_vspx_cleanup(). + +Fix this by checking the IP version and calling the drm or vspx function +accordingly, the same way as the init code does. + +Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support") +Cc: stable@vger.kernel.org +Signed-off-by: Tomi Valkeinen +Reviewed-by: Kieran Bingham +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c ++++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c +@@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct + media_device_unregister(&vsp1->media_dev); + media_device_cleanup(&vsp1->media_dev); + +- if (!vsp1->info->uapi) +- vsp1_drm_cleanup(vsp1); ++ if (!vsp1->info->uapi) { ++ if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4) ++ vsp1_vspx_cleanup(vsp1); ++ else ++ vsp1_drm_cleanup(vsp1); ++ } + } + + static int vsp1_create_entities(struct vsp1_device *vsp1) diff --git a/queue-7.0/media-rockchip-rkcif-add-missing-must_connect-flag-to-pads.patch b/queue-7.0/media-rockchip-rkcif-add-missing-must_connect-flag-to-pads.patch new file mode 100644 index 0000000000..bec3f9f6c2 --- /dev/null +++ b/queue-7.0/media-rockchip-rkcif-add-missing-must_connect-flag-to-pads.patch @@ -0,0 +1,73 @@ +From 8e3c751259dc2d1325838eff26f41032523c7b57 Mon Sep 17 00:00:00 2001 +From: Dang Huynh +Date: Thu, 29 Jan 2026 14:24:02 +0700 +Subject: media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads + +From: Dang Huynh + +commit 8e3c751259dc2d1325838eff26f41032523c7b57 upstream. + +The pads missed checks for connected devices which may a null dereference +when the stream is enabled. + +Unable to handle kernel NULL pointer dereference at virtual address +0000000000000020 +pc : rkcif_interface_enable_streams+0x48/0xf0 +lr : rkcif_interface_enable_streams+0x44/0xf0 +Call trace: + rkcif_interface_enable_streams+0x48/0xf0 + v4l2_subdev_enable_streams+0x26c/0x3f0 + rkcif_stream_start_streaming+0x140/0x278 + vb2_start_streaming+0x74/0x188 + vb2_core_streamon+0xe0/0x1d8 + vb2_ioctl_streamon+0x60/0xa8 + v4l_streamon+0x2c/0x40 + __video_do_ioctl+0x34c/0x400 + video_usercopy+0x2d0/0x800 + video_ioctl2+0x20/0x60 + v4l2_ioctl+0x48/0x78 + +Fixes: 501802e2ad51 ("media: rockchip: rkcif: add abstraction for dma blocks") +Fixes: 85411d17bee9 ("media: rockchip: rkcif: add abstraction for interface and crop blocks") +Cc: stable@vger.kernel.org +Signed-off-by: Dang Huynh +Reviewed-by: Michael Riesch +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/rockchip/rkcif/rkcif-interface.c | 3 ++- + drivers/media/platform/rockchip/rkcif/rkcif-stream.c | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkcif/rkcif-interface.c b/drivers/media/platform/rockchip/rkcif/rkcif-interface.c +index 523103872b7a..414a9980cf2e 100644 +--- a/drivers/media/platform/rockchip/rkcif/rkcif-interface.c ++++ b/drivers/media/platform/rockchip/rkcif/rkcif-interface.c +@@ -378,7 +378,8 @@ int rkcif_interface_register(struct rkcif_device *rkcif, + snprintf(sd->name, sizeof(sd->name), "rkcif-mipi%d", + interface->index - RKCIF_MIPI_BASE); + +- pads[RKCIF_IF_PAD_SINK].flags = MEDIA_PAD_FL_SINK; ++ pads[RKCIF_IF_PAD_SINK].flags = MEDIA_PAD_FL_SINK | ++ MEDIA_PAD_FL_MUST_CONNECT; + pads[RKCIF_IF_PAD_SRC].flags = MEDIA_PAD_FL_SOURCE; + ret = media_entity_pads_init(&sd->entity, RKCIF_IF_PAD_MAX, pads); + if (ret) +diff --git a/drivers/media/platform/rockchip/rkcif/rkcif-stream.c b/drivers/media/platform/rockchip/rkcif/rkcif-stream.c +index f15bee4f7cd7..3130d420ad55 100644 +--- a/drivers/media/platform/rockchip/rkcif/rkcif-stream.c ++++ b/drivers/media/platform/rockchip/rkcif/rkcif-stream.c +@@ -555,7 +555,7 @@ int rkcif_stream_register(struct rkcif_device *rkcif, + vdev->vfl_dir = VFL_DIR_RX; + video_set_drvdata(vdev, stream); + +- stream->pad.flags = MEDIA_PAD_FL_SINK; ++ stream->pad.flags = MEDIA_PAD_FL_SINK | MEDIA_PAD_FL_MUST_CONNECT; + + stream->pix.height = CIF_MIN_HEIGHT; + stream->pix.width = CIF_MIN_WIDTH; +-- +2.54.0 + diff --git a/queue-7.0/media-rzv2h-ivc-avoid-double-job-scheduling.patch b/queue-7.0/media-rzv2h-ivc-avoid-double-job-scheduling.patch new file mode 100644 index 0000000000..53ae411237 --- /dev/null +++ b/queue-7.0/media-rzv2h-ivc-avoid-double-job-scheduling.patch @@ -0,0 +1,79 @@ +From b1de0940a19c1b0001425f8069d6a82369986af7 Mon Sep 17 00:00:00 2001 +From: Jacopo Mondi +Date: Wed, 11 Feb 2026 15:30:00 +0100 +Subject: media: rzv2h-ivc: Avoid double job scheduling + +From: Jacopo Mondi + +commit b1de0940a19c1b0001425f8069d6a82369986af7 upstream. + +The scheduling of a new buffer transfer in the IVC driver is triggered +by two occurrences of the "frame completed" interrupt. + +The first interrupt occurrence identifies when all image data have been +transferred to the ISP, the second occurrence identifies when the +post-transfer VBLANK has completed and a new buffer can be transferred. + +Under heavy system load conditions the actual execution of the workqueue +item might be delayed and two items might happen to run concurrently, +leading to a new frame transfer being triggered while the previous one +has not yet finished. + +This error condition is only visible because the driver maintains a +status variable that counts the number of interrupts since the last +transfer, and warns in case an IRQ happens before the counter has been +reset. + +To ensure sequential execution of the worqueue items and avoid a double +buffer transfer to run concurrently, protect the whole function body +with the spinlock that so far was solely used to reset the counter and +inspect the interrupt counter variable at the beginning of the buffer +transfer function. + +As soon as the ongoing transfer completes, the workqueue item will be +re-scheduled and will consume the pending buffer. + +Cc: stable@vger.kernel.org +Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") +Reviewed-by: Daniel Scally +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c ++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c +@@ -149,6 +149,11 @@ static void rzv2h_ivc_transfer_buffer(st + buffers.work); + struct rzv2h_ivc_buf *buf; + ++ guard(spinlock_irqsave)(&ivc->spinlock); ++ ++ if (ivc->vvalid_ifp) ++ return; ++ + /* Setup buffers */ + scoped_guard(spinlock_irqsave, &ivc->buffers.lock) { + buf = list_first_entry_or_null(&ivc->buffers.queue, +@@ -164,9 +169,7 @@ static void rzv2h_ivc_transfer_buffer(st + buf->addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0); + rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_SADDL_P0, buf->addr); + +- scoped_guard(spinlock_irqsave, &ivc->spinlock) { +- ivc->vvalid_ifp = 2; +- } ++ ivc->vvalid_ifp = 2; + rzv2h_ivc_write(ivc, RZV2H_IVC_REG_FM_FRCON, 0x1); + } + +@@ -201,7 +204,7 @@ static void rzv2h_ivc_buf_queue(struct v + } + + scoped_guard(spinlock_irq, &ivc->spinlock) { +- if (vb2_is_streaming(vb->vb2_queue) && !ivc->vvalid_ifp) ++ if (vb2_is_streaming(vb->vb2_queue)) + queue_work(ivc->buffers.async_wq, &ivc->buffers.work); + } + } diff --git a/queue-7.0/media-rzv2h-ivc-fix-concurrent-buffer-list-access.patch b/queue-7.0/media-rzv2h-ivc-fix-concurrent-buffer-list-access.patch new file mode 100644 index 0000000000..56a43113d3 --- /dev/null +++ b/queue-7.0/media-rzv2h-ivc-fix-concurrent-buffer-list-access.patch @@ -0,0 +1,55 @@ +From 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= + +Date: Fri, 6 Feb 2026 17:30:54 +0100 +Subject: media: rzv2h-ivc: Fix concurrent buffer list access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Pőcze + +commit 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 upstream. + +The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a +spinlock (`rzv2h_ivc::buffers.lock`). However, in +`rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the +`list_del()` call is executed without holding the spinlock, which makes +it possible for the list to be concurrently modified + +Fix that by removing a buffer from the list in the lock protected section. + +Cc: stable@vger.kernel.org +Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") +Reviewed-by: Daniel Scally +Signed-off-by: Barnabás Pőcze +[assign ivc->buffers.curr in critical section as reported by Barnabas] +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c ++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c +@@ -158,14 +158,13 @@ static void rzv2h_ivc_transfer_buffer(st + scoped_guard(spinlock_irqsave, &ivc->buffers.lock) { + buf = list_first_entry_or_null(&ivc->buffers.queue, + struct rzv2h_ivc_buf, queue); +- } +- +- if (!buf) +- return; ++ if (!buf) ++ return; + +- list_del(&buf->queue); ++ list_del(&buf->queue); ++ ivc->buffers.curr = buf; ++ } + +- ivc->buffers.curr = buf; + buf->addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0); + rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_SADDL_P0, buf->addr); + diff --git a/queue-7.0/media-rzv2h-ivc-fix-fm_stop-register-write.patch b/queue-7.0/media-rzv2h-ivc-fix-fm_stop-register-write.patch new file mode 100644 index 0000000000..03656c9fab --- /dev/null +++ b/queue-7.0/media-rzv2h-ivc-fix-fm_stop-register-write.patch @@ -0,0 +1,53 @@ +From 562d2e0a672075292e92538dad61664e89b34d30 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= + +Date: Thu, 12 Feb 2026 16:51:29 +0100 +Subject: media: rzv2h-ivc: Fix FM_STOP register write +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Pőcze + +commit 562d2e0a672075292e92538dad61664e89b34d30 upstream. + +Bit 20 should be written in this register to stop frame processing. +So fix that, as well as the poll condition. + +Cc: stable@vger.kernel.org +Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") +Reviewed-by: Daniel Scally +Signed-off-by: Barnabás Pőcze +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 5 +++-- + drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 1 + + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c ++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c +@@ -300,9 +300,10 @@ static void rzv2h_ivc_stop_streaming(str + struct rzv2h_ivc *ivc = vb2_get_drv_priv(q); + u32 val = 0; + +- rzv2h_ivc_write(ivc, RZV2H_IVC_REG_FM_STOP, 0x1); ++ rzv2h_ivc_write(ivc, RZV2H_IVC_REG_FM_STOP, RZV2H_IVC_REG_FM_STOP_FSTOP); + readl_poll_timeout(ivc->base + RZV2H_IVC_REG_FM_STOP, +- val, !val, 10 * USEC_PER_MSEC, 250 * USEC_PER_MSEC); ++ val, !(val & RZV2H_IVC_REG_FM_STOP_FSTOP), ++ 10 * USEC_PER_MSEC, 250 * USEC_PER_MSEC); + + rzv2h_ivc_return_buffers(ivc, VB2_BUF_STATE_ERROR); + video_device_pipeline_stop(&ivc->vdev.dev); +--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h ++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h +@@ -46,6 +46,7 @@ + #define RZV2H_IVC_REG_FM_MCON 0x0104 + #define RZV2H_IVC_REG_FM_FRCON 0x0108 + #define RZV2H_IVC_REG_FM_STOP 0x010c ++#define RZV2H_IVC_REG_FM_STOP_FSTOP BIT(20) + #define RZV2H_IVC_REG_FM_INT_EN 0x0120 + #define RZV2H_IVC_VVAL_IFPE BIT(0) + #define RZV2H_IVC_REG_FM_INT_STA 0x0124 diff --git a/queue-7.0/media-rzv2h-ivc-write-axirx_pixfmt-once.patch b/queue-7.0/media-rzv2h-ivc-write-axirx_pixfmt-once.patch new file mode 100644 index 0000000000..0fa752f54e --- /dev/null +++ b/queue-7.0/media-rzv2h-ivc-write-axirx_pixfmt-once.patch @@ -0,0 +1,62 @@ +From d901c428350245f2b26431e03c4ba0bdc7a71243 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= + +Date: Thu, 12 Feb 2026 16:45:48 +0100 +Subject: media: rzv2h-ivc: Write AXIRX_PIXFMT once +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Pőcze + +commit d901c428350245f2b26431e03c4ba0bdc7a71243 upstream. + +The documentation prescribes that invalid formats should not be set, +so do a single write to ensure that both the CLFMT and DTYPE fields +are set to valid values. + +Cc: stable@vger.kernel.org +Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") +Reviewed-by: Daniel Scally +Signed-off-by: Barnabás Pőcze +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 8 ++++---- + drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 7 ++++--- + 2 files changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c ++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c +@@ -218,10 +218,10 @@ static void rzv2h_ivc_format_configure(s + + /* Currently only CRU packed pixel formats are supported */ + rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_PXFMT, +- RZV2H_IVC_INPUT_FMT_CRU_PACKED); +- +- rzv2h_ivc_update_bits(ivc, RZV2H_IVC_REG_AXIRX_PXFMT, +- RZV2H_IVC_PXFMT_DTYPE, fmt->dtype); ++ FIELD_PREP(RZV2H_IVC_AXIRX_PXFMT_FIELD_DTYPE, ++ fmt->dtype) | ++ FIELD_PREP(RZV2H_IVC_AXIRX_PXFMT_FIELD_CLFMT, ++ RZV2H_IVC_CLFMT_CRU_PACKED)); + + rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_HSIZE, pix->width); + rzv2h_ivc_write(ivc, RZV2H_IVC_REG_AXIRX_VSIZE, pix->height); +--- a/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h ++++ b/drivers/media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h +@@ -24,9 +24,10 @@ + #define RZV2H_IVC_ONE_EXPOSURE 0x00 + #define RZV2H_IVC_TWO_EXPOSURE 0x01 + #define RZV2H_IVC_REG_AXIRX_PXFMT 0x0004 +-#define RZV2H_IVC_INPUT_FMT_MIPI (0 << 16) +-#define RZV2H_IVC_INPUT_FMT_CRU_PACKED BIT(16) +-#define RZV2H_IVC_PXFMT_DTYPE GENMASK(7, 0) ++#define RZV2H_IVC_AXIRX_PXFMT_FIELD_CLFMT GENMASK(17, 16) ++#define RZV2H_IVC_CLFMT_MIPI 0 ++#define RZV2H_IVC_CLFMT_CRU_PACKED 1 ++#define RZV2H_IVC_AXIRX_PXFMT_FIELD_DTYPE GENMASK(7, 0) + #define RZV2H_IVC_REG_AXIRX_SADDL_P0 0x0010 + #define RZV2H_IVC_REG_AXIRX_SADDH_P0 0x0014 + #define RZV2H_IVC_REG_AXIRX_SADDL_P1 0x0018 diff --git a/queue-7.0/media-saa7164-add-ioremap-return-checks-and-cleanups.patch b/queue-7.0/media-saa7164-add-ioremap-return-checks-and-cleanups.patch new file mode 100644 index 0000000000..bfcec5a6e8 --- /dev/null +++ b/queue-7.0/media-saa7164-add-ioremap-return-checks-and-cleanups.patch @@ -0,0 +1,110 @@ +From d51c60a498e83c9a79884c8e420f97e3885c9583 Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Mon, 16 Mar 2026 20:24:01 +0800 +Subject: media: saa7164: add ioremap return checks and cleanups + +From: Wang Jun <1742789905@qq.com> + +commit d51c60a498e83c9a79884c8e420f97e3885c9583 upstream. + +Add checks for ioremap return values in saa7164_dev_setup(). If +ioremap for BAR0 or BAR2 fails, release the already allocated PCI +memory regions, remove the device from the global list, decrement +the device count, and return -ENODEV. + +This prevents potential null pointer dereferences and ensures proper +cleanup on memory mapping failures. + +Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/saa7164/saa7164-core.c | 47 +++++++++++++++++++++++-------- + 1 file changed, 35 insertions(+), 12 deletions(-) + +--- a/drivers/media/pci/saa7164/saa7164-core.c ++++ b/drivers/media/pci/saa7164/saa7164-core.c +@@ -888,6 +888,15 @@ static int get_resources(struct saa7164_ + return -EBUSY; + } + ++static void release_resources(struct saa7164_dev *dev) ++{ ++ release_mem_region(pci_resource_start(dev->pci, 0), ++ pci_resource_len(dev->pci, 0)); ++ ++ release_mem_region(pci_resource_start(dev->pci, 2), ++ pci_resource_len(dev->pci, 2)); ++} ++ + static int saa7164_port_init(struct saa7164_dev *dev, int portnr) + { + struct saa7164_port *port = NULL; +@@ -947,9 +956,9 @@ static int saa7164_dev_setup(struct saa7 + + snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr); + +- mutex_lock(&devlist); +- list_add_tail(&dev->devlist, &saa7164_devlist); +- mutex_unlock(&devlist); ++ scoped_guard(mutex, &devlist) { ++ list_add_tail(&dev->devlist, &saa7164_devlist); ++ } + + /* board config */ + dev->board = UNSET; +@@ -996,11 +1005,17 @@ static int saa7164_dev_setup(struct saa7 + } + + /* PCI/e allocations */ +- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); ++ dev->lmmio = pci_ioremap_bar(dev->pci, 0); ++ if (!dev->lmmio) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n"); ++ goto err_ioremap_bar0; ++ } + +- dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ dev->lmmio2 = pci_ioremap_bar(dev->pci, 2); ++ if (!dev->lmmio2) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n"); ++ goto err_ioremap_bar2; ++ } + + dev->bmmio = (u8 __iomem *)dev->lmmio; + dev->bmmio2 = (u8 __iomem *)dev->lmmio2; +@@ -1019,17 +1034,25 @@ static int saa7164_dev_setup(struct saa7 + saa7164_pci_quirks(dev); + + return 0; ++ ++err_ioremap_bar2: ++ iounmap(dev->lmmio); ++err_ioremap_bar0: ++ release_resources(dev); ++ ++ scoped_guard(mutex, &devlist) { ++ list_del(&dev->devlist); ++ } ++ saa7164_devcount--; ++ ++ return -ENODEV; + } + + static void saa7164_dev_unregister(struct saa7164_dev *dev) + { + dprintk(1, "%s()\n", __func__); + +- release_mem_region(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); +- +- release_mem_region(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ release_resources(dev); + + if (!atomic_dec_and_test(&dev->refcount)) + return; diff --git a/queue-7.0/media-ti-vpe-add-missing-v4l2_device_unregister-in-vip_remove.patch b/queue-7.0/media-ti-vpe-add-missing-v4l2_device_unregister-in-vip_remove.patch new file mode 100644 index 0000000000..d576a8fa69 --- /dev/null +++ b/queue-7.0/media-ti-vpe-add-missing-v4l2_device_unregister-in-vip_remove.patch @@ -0,0 +1,38 @@ +From f3e969a5b54304cab6891a58d9dd8b29072bde4c Mon Sep 17 00:00:00 2001 +From: Felix Gu +Date: Sun, 1 Mar 2026 21:39:25 +0800 +Subject: media: ti: vpe: Add missing v4l2_device_unregister in vip_remove() + +From: Felix Gu + +commit f3e969a5b54304cab6891a58d9dd8b29072bde4c upstream. + +The v4l2_device is registered during probe but was not being unregistered +during remove. Add the missing v4l2_device_unregister() call to properly +clean up resources. + +Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver") +Cc: stable@vger.kernel.org +Signed-off-by: Felix Gu +Reviewed-by: Yemike Abhilash Chandra +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/ti/vpe/vip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/ti/vpe/vip.c b/drivers/media/platform/ti/vpe/vip.c +index a4b616a5ece7..0e91e87bda9b 100644 +--- a/drivers/media/platform/ti/vpe/vip.c ++++ b/drivers/media/platform/ti/vpe/vip.c +@@ -3641,6 +3641,7 @@ static void vip_remove(struct platform_device *pdev) + } + + v4l2_ctrl_handler_free(&shared->ctrl_handler); ++ v4l2_device_unregister(&shared->v4l2_dev); + + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.54.0 + diff --git a/queue-7.0/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch b/queue-7.0/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch new file mode 100644 index 0000000000..572ee158b1 --- /dev/null +++ b/queue-7.0/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch @@ -0,0 +1,51 @@ +From fbac03467e53d8d72e5099c03df26d9adae11416 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 9 Mar 2026 15:01:54 +0000 +Subject: media: uvcvideo: Enable VB2_DMABUF for metadata stream + +From: Ricardo Ribalda + +commit fbac03467e53d8d72e5099c03df26d9adae11416 upstream. + +The UVC driver has two video streams, one for the frames and another one +for the metadata. Both streams share most of the codebase, but only the +data stream declares support for DMABUF transfer mode. + +I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM +and the frames looked correct. + +This patch announces the support for DMABUF for the metadata stream. +This is useful for apps/HALs that only want to support DMABUF. + +Cc: stable@vger.kernel.org +Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_queue.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -243,7 +243,7 @@ int uvc_queue_init(struct uvc_video_queu + int ret; + + queue->queue.type = type; +- queue->queue.io_modes = VB2_MMAP | VB2_USERPTR; ++ queue->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF; + queue->queue.drv_priv = queue; + queue->queue.buf_struct_size = sizeof(struct uvc_buffer); + queue->queue.mem_ops = &vb2_vmalloc_memops; +@@ -256,7 +256,6 @@ int uvc_queue_init(struct uvc_video_queu + queue->queue.ops = &uvc_meta_queue_qops; + break; + default: +- queue->queue.io_modes |= VB2_DMABUF; + queue->queue.ops = &uvc_queue_qops; + break; + } diff --git a/queue-7.0/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch b/queue-7.0/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch new file mode 100644 index 0000000000..483551972d --- /dev/null +++ b/queue-7.0/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch @@ -0,0 +1,99 @@ +From 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Sun, 15 Feb 2026 18:42:59 +0100 +Subject: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap + +From: Janne Grunau + +commit 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 upstream. + +vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not +see a reason why vb2_dma_sg should behave differently. This avoids +hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in +drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of +tree Apple ISP camera capture driver which uses vb2_dma_sg_memops. + +gst-launch-1.0 v4l2src ! gtk4paintablesink + +[ 38.201528] ------------[ cut here ]------------ +[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210 +[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer +snd_seq snd_seq_device uinput nf_conntrack_netbios_ns +nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib +nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat +nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep +nls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc +hid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic +cfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev +aop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2 +snd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor +macsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi +macsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3 +snd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon +apple_sart apple_dockchannel macsmc apple_rtkit_helper +spmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses +pinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core +spi_apple +[ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram +[ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full) +[ 38.219040] Tainted: [W]=WARN +[ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT) +[ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210 +[ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210 +[ 38.222178] sp : ffffc0008dc678e0 +[ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480 +[ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968 +[ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0 +[ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968 +[ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8 +[ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff +[ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8 +[ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000 +[ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038 +[ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb +[ 38.231488] Call trace: +[ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P) +[ 38.232342] drm_gem_mmap+0x140/0x260 +[ 38.232813] __mmap_region+0x488/0x9a0 +[ 38.233277] mmap_region+0xd0/0x148 +[ 38.233703] do_mmap+0x350/0x5c0 +[ 38.234148] vm_mmap_pgoff+0x14c/0x200 +[ 38.234612] ksys_mmap_pgoff+0x150/0x208 +[ 38.235107] __arm64_sys_mmap+0x34/0x50 +[ 38.235611] invoke_syscall+0x50/0x120 +[ 38.236075] el0_svc_common.constprop.0+0x48/0xf0 +[ 38.236680] do_el0_svc+0x24/0x38 +[ 38.237113] el0_svc+0x38/0x168 +[ 38.237507] el0t_64_sync_handler+0xa0/0xe8 +[ 38.238034] el0t_64_sync+0x198/0x1a0 +[ 38.238491] ---[ end trace 0000000000000000 ]--- + +There were discussions in [1] at the end of 2023 that mmap() on imported +dma-bufs should not be supported but as of v6.17 drm_gem_shmem_mmap() in +drm_gem_shmem_helper.c still supports it. +This might affect all gpu or accel drivers using drm_gem_shmem_mmap() or +the wrapper drm_gem_shmem_object_mmap(). + +[1] https://lore.kernel.org/dri-devel/bc7f7844-0aa3-4802-b203-69d58e8be2fa@linux.intel.com/ + +Cc: stable@vger.kernel.org +Fixes: 5ba3f757f059 ("[media] v4l: videobuf2: add DMA scatter/gather allocator") +Signed-off-by: Janne Grunau +Acked-by: Marek Szyprowski +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c ++++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c +@@ -345,6 +345,7 @@ static int vb2_dma_sg_mmap(void *buf_pri + return err; + } + ++ vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP); + /* + * Use common vm_area operations to track buffer refcount. + */ diff --git a/queue-7.0/regulator-act8945a-fix-of-node-reference-imbalance.patch b/queue-7.0/regulator-act8945a-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..8b48bff340 --- /dev/null +++ b/queue-7.0/regulator-act8945a-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 0d15ce31375ccef4162f960b34547a821b7619d2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:54 +0200 +Subject: regulator: act8945a: fix OF node reference imbalance + +From: Johan Hovold + +commit 0d15ce31375ccef4162f960b34547a821b7619d2 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 38c09961048b ("regulator: act8945a: add regulator driver for ACT8945A") +Cc: stable@vger.kernel.org # 4.6 +Cc: Wenyou Yang +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-7-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/act8945a-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/act8945a-regulator.c ++++ b/drivers/regulator/act8945a-regulator.c +@@ -302,8 +302,9 @@ static int act8945a_pmic_probe(struct pl + num_regulators = ARRAY_SIZE(act8945a_regulators); + } + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = act8945a; + for (i = 0; i < num_regulators; i++) { + rdev = devm_regulator_register(&pdev->dev, ®ulators[i], diff --git a/queue-7.0/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch b/queue-7.0/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..94d8125ce9 --- /dev/null +++ b/queue-7.0/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 8498100ee1d00422b8c5b161b3e332278b92a59a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:55 +0200 +Subject: regulator: bd9571mwv: fix OF node reference imbalance + +From: Johan Hovold + +commit 8498100ee1d00422b8c5b161b3e332278b92a59a upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: e85c5a153fe2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver") +Cc: stable@vger.kernel.org # 4.12 +Cc: Marek Vasut +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-8-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/bd9571mwv-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/bd9571mwv-regulator.c ++++ b/drivers/regulator/bd9571mwv-regulator.c +@@ -287,8 +287,9 @@ static int bd9571mwv_regulator_probe(str + + platform_set_drvdata(pdev, bdreg); + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = bdreg; + config.regmap = bdreg->regmap; + diff --git a/queue-7.0/regulator-bq257xx-fix-of-node-reference-imbalance.patch b/queue-7.0/regulator-bq257xx-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..2bade4bb3e --- /dev/null +++ b/queue-7.0/regulator-bq257xx-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 7ea07bc030d8d6395524dec22ff3267441a28c0d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:49 +0200 +Subject: regulator: bq257xx: fix OF node reference imbalance + +From: Johan Hovold + +commit 7ea07bc030d8d6395524dec22ff3267441a28c0d upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 981dd162b635 ("regulator: bq257xx: Add bq257xx boost regulator driver") +Cc: stable@vger.kernel.org # 6.18 +Cc: Chris Morgan +Reviewed-by: Douglas Anderson +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-2-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/bq257xx-regulator.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/regulator/bq257xx-regulator.c ++++ b/drivers/regulator/bq257xx-regulator.c +@@ -142,8 +142,7 @@ static int bq257xx_regulator_probe(struc + struct device_node *np = dev->of_node; + struct regulator_config cfg = {}; + +- pdev->dev.of_node = pdev->dev.parent->of_node; +- pdev->dev.of_node_reused = true; ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); + + pdata = devm_kzalloc(&pdev->dev, sizeof(struct bq257xx_reg_data), GFP_KERNEL); + if (!pdata) diff --git a/queue-7.0/regulator-max77650-fix-of-node-reference-imbalance.patch b/queue-7.0/regulator-max77650-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..0e378bca7f --- /dev/null +++ b/queue-7.0/regulator-max77650-fix-of-node-reference-imbalance.patch @@ -0,0 +1,38 @@ +From 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:51 +0200 +Subject: regulator: max77650: fix OF node reference imbalance + +From: Johan Hovold + +commit 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: bcc61f1c44fd ("regulator: max77650: add regulator support") +Cc: stable@vger.kernel.org # 5.1 +Reviewed-by: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/max77650-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/max77650-regulator.c ++++ b/drivers/regulator/max77650-regulator.c +@@ -337,7 +337,7 @@ static int max77650_regulator_probe(stru + parent = dev->parent; + + if (!dev->of_node) +- dev->of_node = parent->of_node; ++ device_set_of_node_from_dev(dev, parent); + + rdescs = devm_kcalloc(dev, MAX77650_REGULATOR_NUM_REGULATORS, + sizeof(*rdescs), GFP_KERNEL); diff --git a/queue-7.0/regulator-mt6357-fix-of-node-reference-imbalance.patch b/queue-7.0/regulator-mt6357-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..d32f2f7ad9 --- /dev/null +++ b/queue-7.0/regulator-mt6357-fix-of-node-reference-imbalance.patch @@ -0,0 +1,37 @@ +From 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:52 +0200 +Subject: regulator: mt6357: fix OF node reference imbalance + +From: Johan Hovold + +commit 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: dafc7cde23dc ("regulator: add mt6357 regulator") +Cc: stable@vger.kernel.org # 6.2 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-5-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/mt6357-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/mt6357-regulator.c ++++ b/drivers/regulator/mt6357-regulator.c +@@ -410,7 +410,7 @@ static int mt6357_regulator_probe(struct + struct regulator_dev *rdev; + int i; + +- pdev->dev.of_node = pdev->dev.parent->of_node; ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); + + for (i = 0; i < MT6357_MAX_REGULATOR; i++) { + config.dev = &pdev->dev; diff --git a/queue-7.0/regulator-rk808-fix-of-node-reference-imbalance.patch b/queue-7.0/regulator-rk808-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..e8bb26fb9b --- /dev/null +++ b/queue-7.0/regulator-rk808-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 65290b24d8a5f0b8cd065201e653db824c4a4da6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:50 +0200 +Subject: regulator: rk808: fix OF node reference imbalance + +From: Johan Hovold + +commit 65290b24d8a5f0b8cd065201e653db824c4a4da6 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 647e57351f8e ("regulator: rk808: reduce 'struct rk808' usage") +Cc: stable@vger.kernel.org # 6.2 +Reviewed-by: Sebastian Reichel +Reviewed-by: Douglas Anderson +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/rk808-regulator.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/regulator/rk808-regulator.c ++++ b/drivers/regulator/rk808-regulator.c +@@ -2114,8 +2114,7 @@ static int rk808_regulator_probe(struct + struct regmap *regmap; + int ret, i, nregulators; + +- pdev->dev.of_node = pdev->dev.parent->of_node; +- pdev->dev.of_node_reused = true; ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); + + regmap = dev_get_regmap(pdev->dev.parent, NULL); + if (!regmap) diff --git a/queue-7.0/regulator-s2dos05-fix-of-node-reference-imbalance.patch b/queue-7.0/regulator-s2dos05-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..1b3ff5eb4c --- /dev/null +++ b/queue-7.0/regulator-s2dos05-fix-of-node-reference-imbalance.patch @@ -0,0 +1,38 @@ +From ebe694d67f159899b063eee61bacda4cb825ed7b Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:53 +0200 +Subject: regulator: s2dos05: fix OF node reference imbalance + +From: Johan Hovold + +commit ebe694d67f159899b063eee61bacda4cb825ed7b upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: bb2441402392 ("regulator: add s2dos05 regulator support") +Cc: stable@vger.kernel.org # 6.18 +Cc: Dzmitry Sankouski +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-6-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/s2dos05-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/s2dos05-regulator.c ++++ b/drivers/regulator/s2dos05-regulator.c +@@ -126,7 +126,7 @@ static int s2dos05_pmic_probe(struct pla + s2dos05->regmap = iodev->regmap_pmic; + s2dos05->dev = dev; + if (!dev->of_node) +- dev->of_node = dev->parent->of_node; ++ device_set_of_node_from_dev(dev, dev->parent); + + config.dev = dev; + config.driver_data = s2dos05; diff --git a/queue-7.0/series b/queue-7.0/series index fe11e174df..fbc8af3d5e 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -1 +1,61 @@ ptrace-slightly-saner-get_dumpable-logic.patch +hid-playstation-clamp-num_touch_reports.patch +hid-appletb-kbd-fix-uaf-in-inactivity-timer-cleanup-path.patch +hid-appletb-kbd-run-inactivity-autodim-from-workqueues.patch +hid-pass-the-buffer-size-to-hid_report_raw_event.patch +hid-core-introduce-hid_safe_input_report.patch +hid-pidff-fix-integer-overflow-in-pidff_rescale.patch +media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch +drm-msm-hdmi-fix-wrong-ctrl1-register-used-in-writing-info-frames.patch +media-rzv2h-ivc-avoid-double-job-scheduling.patch +media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch +media-rzv2h-ivc-write-axirx_pixfmt-once.patch +media-rzv2h-ivc-fix-fm_stop-register-write.patch +media-rzv2h-ivc-fix-concurrent-buffer-list-access.patch +media-mali-c55-initialize-the-isp-in-enable_streams.patch +media-mali-c55-fix-iridix-bypass-macros.patch +media-mali-c55-fix-wrong-comment-of-isp-block-types.patch +media-renesas-vsp1-fix-null-pointer-deref-on-module-unload.patch +media-renesas-vin-fix-raw8-again.patch +media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch +media-dt-bindings-rockchip-vdec-add-alternative-reg-names-order-for-rk35-76-88.patch +media-dt-bindings-rockchip-vdec-mark-reg-names-required-for-rk35-76-88.patch +media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch +media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch +media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch +arm64-dts-freescale-imx95-toradex-smarc-fix-pmic_sd2_vsel-label-position.patch +drm-gpusvm-allow-device-pages-to-be-mapped-in-mixed-mappings-after-system-pages.patch +drm-gpusvm-force-unmapping-on-error-in-drm_gpusvm_get_pages.patch +spi-bcm63xx-fix-controller-deregistration.patch +spi-atmel-fix-controller-deregistration.patch +arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch +staging-media-atomisp-disallow-all-private-ioctls.patch +regulator-mt6357-fix-of-node-reference-imbalance.patch +spi-st-ssc4-fix-controller-deregistration.patch +regulator-max77650-fix-of-node-reference-imbalance.patch +media-ti-vpe-add-missing-v4l2_device_unregister-in-vip_remove.patch +media-rc-xbox_remote-heed-dma-restrictions.patch +media-rc-streamzap-error-handling-in-probe.patch +media-i2c-ov5647-fix-runtime-pm-refcount-leak-in-s_ctrl.patch +media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch +regulator-bq257xx-fix-of-node-reference-imbalance.patch +regulator-rk808-fix-of-node-reference-imbalance.patch +media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch +media-rockchip-rkcif-add-missing-must_connect-flag-to-pads.patch +media-mali-c55-fully-reset-the-isp-configuration.patch +media-intel-ipu6-fix-error-pointer-dereference.patch +media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch +regulator-act8945a-fix-of-node-reference-imbalance.patch +regulator-s2dos05-fix-of-node-reference-imbalance.patch +regulator-bd9571mwv-fix-of-node-reference-imbalance.patch +spi-lantiq-ssc-fix-controller-deregistration.patch +spi-meson-spicc-fix-controller-deregistration.patch +spi-qup-fix-controller-deregistration.patch +arm64-dts-ti-k3-am69-aquila-clover-fix-dp-regulator-enable-gpio.patch +spi-at91-usart-fix-controller-deregistration.patch +media-ipu-bridge-add-upside-down-sensor-dmi-quirk-for-dell-xps-13-9340-and-xps-14-9440.patch +media-saa7164-add-ioremap-return-checks-and-cleanups.patch +spi-amlogic-spisg-fix-controller-deregistration.patch +spi-aspeed-smc-fix-controller-deregistration.patch +drm-colorop-preserve-bypass-value-in-duplicate_state.patch +drm-atomic-add-affected-colorops-with-affected-planes.patch diff --git a/queue-7.0/spi-amlogic-spisg-fix-controller-deregistration.patch b/queue-7.0/spi-amlogic-spisg-fix-controller-deregistration.patch new file mode 100644 index 0000000000..6e55350d93 --- /dev/null +++ b/queue-7.0/spi-amlogic-spisg-fix-controller-deregistration.patch @@ -0,0 +1,44 @@ +From 84d31bb1f6256eea0db6cf64a3c7a53145f92bb9 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:00 +0200 +Subject: spi: amlogic-spisg: fix controller deregistration + +From: Johan Hovold + +commit 84d31bb1f6256eea0db6cf64a3c7a53145f92bb9 upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver") +Cc: stable@vger.kernel.org # 6.17: b8db95529979 +Cc: stable@vger.kernel.org # 6.17 +Cc: Sunny Luo +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-2-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-amlogic-spisg.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-amlogic-spisg.c ++++ b/drivers/spi/spi-amlogic-spisg.c +@@ -800,7 +800,7 @@ static int aml_spisg_probe(struct platfo + goto out_clk; + } + +- ret = devm_spi_register_controller(dev, ctlr); ++ ret = spi_register_controller(ctlr); + if (ret) { + dev_err(&pdev->dev, "spi controller registration failed\n"); + goto out_clk; +@@ -823,6 +823,8 @@ static void aml_spisg_remove(struct plat + { + struct spisg_device *spisg = platform_get_drvdata(pdev); + ++ spi_unregister_controller(spisg->controller); ++ + if (!pm_runtime_suspended(&pdev->dev)) { + pinctrl_pm_select_sleep_state(&spisg->pdev->dev); + clk_disable_unprepare(spisg->core); diff --git a/queue-7.0/spi-aspeed-smc-fix-controller-deregistration.patch b/queue-7.0/spi-aspeed-smc-fix-controller-deregistration.patch new file mode 100644 index 0000000000..17f930a9f8 --- /dev/null +++ b/queue-7.0/spi-aspeed-smc-fix-controller-deregistration.patch @@ -0,0 +1,58 @@ +From 1044e5a4ccd57bf5a64f90100a321b498e0267a2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:01 +0200 +Subject: spi: aspeed-smc: fix controller deregistration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johan Hovold + +commit 1044e5a4ccd57bf5a64f90100a321b498e0267a2 upstream. + +Make sure to deregister the controller before disabling it to allow +SPI device drivers to do I/O during deregistration. + +Fixes: e3228ed92893 ("spi: spi-mem: Convert Aspeed SMC driver to spi-mem") +Cc: stable@vger.kernel.org # 5.19 +Cc: Cédric Le Goater +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-aspeed-smc.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-aspeed-smc.c ++++ b/drivers/spi/spi-aspeed-smc.c +@@ -972,7 +972,7 @@ static int aspeed_spi_probe(struct platf + return -ENOMEM; + + aspi = spi_controller_get_devdata(ctlr); +- platform_set_drvdata(pdev, aspi); ++ platform_set_drvdata(pdev, ctlr); + aspi->data = data; + aspi->dev = dev; + +@@ -1021,7 +1021,7 @@ static int aspeed_spi_probe(struct platf + return ret; + } + +- ret = devm_spi_register_controller(dev, ctlr); ++ ret = spi_register_controller(ctlr); + if (ret) + dev_err(&pdev->dev, "spi_register_controller failed\n"); + +@@ -1030,7 +1030,10 @@ static int aspeed_spi_probe(struct platf + + static void aspeed_spi_remove(struct platform_device *pdev) + { +- struct aspeed_spi *aspi = platform_get_drvdata(pdev); ++ struct spi_controller *ctlr = platform_get_drvdata(pdev); ++ struct aspeed_spi *aspi = spi_controller_get_devdata(ctlr); ++ ++ spi_unregister_controller(ctlr); + + aspeed_spi_enable(aspi, false); + } diff --git a/queue-7.0/spi-at91-usart-fix-controller-deregistration.patch b/queue-7.0/spi-at91-usart-fix-controller-deregistration.patch new file mode 100644 index 0000000000..1b39beb5f4 --- /dev/null +++ b/queue-7.0/spi-at91-usart-fix-controller-deregistration.patch @@ -0,0 +1,49 @@ +From 9acecc9bcff058eaef40fd7a4c3650e88b06b220 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:02 +0200 +Subject: spi: at91-usart: fix controller deregistration + +From: Johan Hovold + +commit 9acecc9bcff058eaef40fd7a4c3650e88b06b220 upstream. + +Make sure to deregister the controller before disabling and releasing +underlying resources like clocks and DMA during driver unbind. + +Fixes: e1892546ff66 ("spi: at91-usart: Add driver for at91-usart as SPI") +Cc: stable@vger.kernel.org # 4.20 +Cc: Radu Pirea +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-at91-usart.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-at91-usart.c ++++ b/drivers/spi/spi-at91-usart.c +@@ -556,7 +556,7 @@ static int at91_usart_spi_probe(struct p + spin_lock_init(&aus->lock); + init_completion(&aus->xfer_completion); + +- ret = devm_spi_register_controller(&pdev->dev, controller); ++ ret = spi_register_controller(controller); + if (ret) + goto at91_usart_fail_register_controller; + +@@ -634,8 +634,14 @@ static void at91_usart_spi_remove(struct + struct spi_controller *ctlr = platform_get_drvdata(pdev); + struct at91_usart_spi *aus = spi_controller_get_devdata(ctlr); + ++ spi_controller_get(ctlr); ++ ++ spi_unregister_controller(ctlr); ++ + at91_usart_spi_release_dma(ctlr); + clk_disable_unprepare(aus->clk); ++ ++ spi_controller_put(ctlr); + } + + static const struct dev_pm_ops at91_usart_spi_pm_ops = { diff --git a/queue-7.0/spi-atmel-fix-controller-deregistration.patch b/queue-7.0/spi-atmel-fix-controller-deregistration.patch new file mode 100644 index 0000000000..245d8271da --- /dev/null +++ b/queue-7.0/spi-atmel-fix-controller-deregistration.patch @@ -0,0 +1,55 @@ +From 8d4de97e83520be89d0ff40610ca633b3963a7de Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:03 +0200 +Subject: spi: atmel: fix controller deregistration + +From: Johan Hovold + +commit 8d4de97e83520be89d0ff40610ca633b3963a7de upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 754ce4f29937 ("[PATCH] SPI: atmel_spi driver") +Cc: stable@vger.kernel.org # 2.6.21 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-5-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-atmel.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1654,7 +1654,7 @@ static int atmel_spi_probe(struct platfo + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) + goto out_free_dma; + +@@ -1688,8 +1688,12 @@ static void atmel_spi_remove(struct plat + struct spi_controller *host = platform_get_drvdata(pdev); + struct atmel_spi *as = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ + pm_runtime_get_sync(&pdev->dev); + ++ spi_unregister_controller(host); ++ + /* reset the hardware and block queue progress */ + if (as->use_dma) { + atmel_spi_stop_dma(host); +@@ -1716,6 +1720,8 @@ static void atmel_spi_remove(struct plat + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++ spi_controller_put(host); + } + + static int atmel_spi_runtime_suspend(struct device *dev) diff --git a/queue-7.0/spi-bcm63xx-fix-controller-deregistration.patch b/queue-7.0/spi-bcm63xx-fix-controller-deregistration.patch new file mode 100644 index 0000000000..3a25a15ef1 --- /dev/null +++ b/queue-7.0/spi-bcm63xx-fix-controller-deregistration.patch @@ -0,0 +1,52 @@ +From c39e65a4e3b8e764efed0b2f5152a1a8547b80fd Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:04 +0200 +Subject: spi: bcm63xx: fix controller deregistration + +From: Johan Hovold + +commit c39e65a4e3b8e764efed0b2f5152a1a8547b80fd upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") +Cc: stable@vger.kernel.org # 3.4 +Cc: Florian Fainelli +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-6-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm63xx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -602,7 +602,7 @@ static int bcm63xx_spi_probe(struct plat + goto out_clk_disable; + + /* register and we are done */ +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(dev, "spi register failed\n"); + goto out_clk_disable; +@@ -625,11 +625,17 @@ static void bcm63xx_spi_remove(struct pl + struct spi_controller *host = platform_get_drvdata(pdev); + struct bcm63xx_spi *bs = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + /* reset spi block */ + bcm_spi_writeb(bs, 0, SPI_INT_MASK); + + /* HW shutdown */ + clk_disable_unprepare(bs->clk); ++ ++ spi_controller_put(host); + } + + static int bcm63xx_spi_suspend(struct device *dev) diff --git a/queue-7.0/spi-lantiq-ssc-fix-controller-deregistration.patch b/queue-7.0/spi-lantiq-ssc-fix-controller-deregistration.patch new file mode 100644 index 0000000000..620f55a21d --- /dev/null +++ b/queue-7.0/spi-lantiq-ssc-fix-controller-deregistration.patch @@ -0,0 +1,54 @@ +From b99206710d032c16b7f8b75e4bc18414d8e4b9f4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:15 +0200 +Subject: spi: lantiq-ssc: fix controller deregistration + +From: Johan Hovold + +commit b99206710d032c16b7f8b75e4bc18414d8e4b9f4 upstream. + +Make sure to deregister the controller before releasing underlying +resources like clocks during driver unbind. + +Fixes: 17f84b793c01 ("spi: lantiq-ssc: add support for Lantiq SSC SPI controller") +Cc: stable@vger.kernel.org # 4.11 +Cc: Hauke Mehrtens +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-17-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-lantiq-ssc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-lantiq-ssc.c ++++ b/drivers/spi/spi-lantiq-ssc.c +@@ -994,7 +994,7 @@ static int lantiq_ssc_probe(struct platf + "Lantiq SSC SPI controller (Rev %i, TXFS %u, RXFS %u, DMA %u)\n", + revision, spi->tx_fifo_size, spi->rx_fifo_size, supports_dma); + +- err = devm_spi_register_controller(dev, host); ++ err = spi_register_controller(host); + if (err) { + dev_err(dev, "failed to register spi host\n"); + goto err_wq_destroy; +@@ -1016,6 +1016,10 @@ static void lantiq_ssc_remove(struct pla + { + struct lantiq_ssc_spi *spi = platform_get_drvdata(pdev); + ++ spi_controller_get(spi->host); ++ ++ spi_unregister_controller(spi->host); ++ + lantiq_ssc_writel(spi, 0, LTQ_SPI_IRNEN); + lantiq_ssc_writel(spi, 0, LTQ_SPI_CLC); + rx_fifo_flush(spi); +@@ -1024,6 +1028,8 @@ static void lantiq_ssc_remove(struct pla + + destroy_workqueue(spi->wq); + clk_put(spi->fpi_clk); ++ ++ spi_controller_put(spi->host); + } + + static struct platform_driver lantiq_ssc_driver = { diff --git a/queue-7.0/spi-meson-spicc-fix-controller-deregistration.patch b/queue-7.0/spi-meson-spicc-fix-controller-deregistration.patch new file mode 100644 index 0000000000..fde320dff6 --- /dev/null +++ b/queue-7.0/spi-meson-spicc-fix-controller-deregistration.patch @@ -0,0 +1,49 @@ +From 77953c76bec9af4191f8692a10225dd816208718 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:16 +0200 +Subject: spi: meson-spicc: fix controller deregistration + +From: Johan Hovold + +commit 77953c76bec9af4191f8692a10225dd816208718 upstream. + +Make sure to deregister the controller before disabling it to allow SPI +device drivers to do I/O during deregistration. + +Fixes: 454fa271bc4e ("spi: Add Meson SPICC driver") +Cc: stable@vger.kernel.org # 4.13 +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-18-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-meson-spicc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -1081,7 +1081,7 @@ static int meson_spicc_probe(struct plat + } + } + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(&pdev->dev, "spi registration failed\n"); + goto out_host; +@@ -1099,8 +1099,14 @@ static void meson_spicc_remove(struct pl + { + struct meson_spicc_device *spicc = platform_get_drvdata(pdev); + ++ spi_controller_get(spicc->host); ++ ++ spi_unregister_controller(spicc->host); ++ + /* Disable SPI */ + writel(0, spicc->base + SPICC_CONREG); ++ ++ spi_controller_put(spicc->host); + } + + static const struct meson_spicc_data meson_spicc_gx_data = { diff --git a/queue-7.0/spi-qup-fix-controller-deregistration.patch b/queue-7.0/spi-qup-fix-controller-deregistration.patch new file mode 100644 index 0000000000..bffcf4329a --- /dev/null +++ b/queue-7.0/spi-qup-fix-controller-deregistration.patch @@ -0,0 +1,53 @@ +From 443e3a0005a4342b218b6dbd4c6387d3c7fed85a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:39 +0200 +Subject: spi: qup: fix controller deregistration + +From: Johan Hovold + +commit 443e3a0005a4342b218b6dbd4c6387d3c7fed85a upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") +Cc: stable@vger.kernel.org # 3.15 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-10-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-qup.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1193,7 +1193,7 @@ static int spi_qup_probe(struct platform + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret) + goto disable_pm; + +@@ -1320,6 +1320,10 @@ static void spi_qup_remove(struct platfo + struct spi_qup *controller = spi_controller_get_devdata(host); + int ret; + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + ret = pm_runtime_get_sync(&pdev->dev); + + if (ret >= 0) { +@@ -1339,6 +1343,8 @@ static void spi_qup_remove(struct platfo + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++ spi_controller_put(host); + } + + static const struct of_device_id spi_qup_dt_match[] = { diff --git a/queue-7.0/spi-st-ssc4-fix-controller-deregistration.patch b/queue-7.0/spi-st-ssc4-fix-controller-deregistration.patch new file mode 100644 index 0000000000..c29d4d9013 --- /dev/null +++ b/queue-7.0/spi-st-ssc4-fix-controller-deregistration.patch @@ -0,0 +1,51 @@ +From 19857374010d06ca6a2f7c2c53464122eb804df0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:47 +0200 +Subject: spi: st-ssc4: fix controller deregistration + +From: Johan Hovold + +commit 19857374010d06ca6a2f7c2c53464122eb804df0 upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 9e862375c542 ("spi: Add new driver for STMicroelectronics' SPI Controller") +Cc: stable@vger.kernel.org # 4.0 +Cc: Lee Jones +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-18-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-st-ssc4.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-st-ssc4.c ++++ b/drivers/spi/spi-st-ssc4.c +@@ -349,7 +349,7 @@ static int spi_st_probe(struct platform_ + + platform_set_drvdata(pdev, host); + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(&pdev->dev, "Failed to register host\n"); + goto rpm_disable; +@@ -371,10 +371,16 @@ static void spi_st_remove(struct platfor + struct spi_controller *host = platform_get_drvdata(pdev); + struct spi_st *spi_st = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + pm_runtime_disable(&pdev->dev); + + clk_disable_unprepare(spi_st->clk); + ++ spi_controller_put(host); ++ + pinctrl_pm_select_sleep_state(&pdev->dev); + } + diff --git a/queue-7.0/staging-media-atomisp-disallow-all-private-ioctls.patch b/queue-7.0/staging-media-atomisp-disallow-all-private-ioctls.patch new file mode 100644 index 0000000000..43ef403ced --- /dev/null +++ b/queue-7.0/staging-media-atomisp-disallow-all-private-ioctls.patch @@ -0,0 +1,39 @@ +From 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 26 Feb 2026 15:10:54 +0200 +Subject: staging: media: atomisp: Disallow all private IOCTLs + +From: Sakari Ailus + +commit 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c upstream. + +Disallow all private IOCTLs. These aren't quite as safe as one could +assume of IOCTL handlers; disable them for now. Instead of removing the +code, return in the beginning of the function if cmd is non-zero in order +to keep static checkers happy. + +Reported-by: Soufiane Dani +Closes: https://lore.kernel.org/linux-staging/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com/ +Cc: stable@vger.kernel.org +Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") +Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -1356,6 +1356,10 @@ static int atomisp_s_parm(struct file *f + static long atomisp_vidioc_default(struct file *file, void *fh, + bool valid_prio, unsigned int cmd, void *arg) + { ++ /* Disable all private IOCTLs for now! */ ++ if (cmd) ++ return -EINVAL; ++ + struct video_device *vdev = video_devdata(file); + struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd; + int err;