From: Greg Kroah-Hartman Date: Fri, 15 May 2026 06:03:42 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.10.256~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=650d06f10fb81d0d795bc53867b8dc5bc6ce3366;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch media-rc-streamzap-error-handling-in-probe.patch media-rc-xbox_remote-heed-dma-restrictions.patch media-saa7164-add-ioremap-return-checks-and-cleanups.patch media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch regulator-act8945a-fix-of-node-reference-imbalance.patch regulator-bd9571mwv-fix-of-node-reference-imbalance.patch regulator-max77650-fix-of-node-reference-imbalance.patch staging-media-atomisp-disallow-all-private-ioctls.patch --- diff --git a/queue-6.1/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch b/queue-6.1/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch new file mode 100644 index 0000000000..b42723db2f --- /dev/null +++ b/queue-6.1/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch @@ -0,0 +1,45 @@ +From f75e160745663ce9b13362ae6e90bd439c58df69 Mon Sep 17 00:00:00 2001 +From: Alexander Koskovich +Date: Thu, 12 Mar 2026 17:16:20 +0000 +Subject: media: i2c: ov8856: free control handler on error in ov8856_init_controls() + +From: Alexander Koskovich + +commit f75e160745663ce9b13362ae6e90bd439c58df69 upstream. + +The control handler wasn't freed if adding controls failed, add an error +exit label and convert the existing error return to use it. + +Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor") +Cc: stable@vger.kernel.org +Signed-off-by: Alexander Koskovich +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ov8856.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/ov8856.c ++++ b/drivers/media/i2c/ov8856.c +@@ -1954,12 +1954,18 @@ static int ov8856_init_controls(struct o + V4L2_CID_HFLIP, 0, 1, 1, 0); + v4l2_ctrl_new_std(ctrl_hdlr, &ov8856_ctrl_ops, + V4L2_CID_VFLIP, 0, 1, 1, 0); +- if (ctrl_hdlr->error) +- return ctrl_hdlr->error; ++ if (ctrl_hdlr->error) { ++ ret = ctrl_hdlr->error; ++ goto err_ctrl_handler_free; ++ } + + ov8856->sd.ctrl_handler = ctrl_hdlr; + + return 0; ++ ++err_ctrl_handler_free: ++ v4l2_ctrl_handler_free(ctrl_hdlr); ++ return ret; + } + + static void ov8856_update_pad_format(struct ov8856 *ov8856, diff --git a/queue-6.1/media-rc-streamzap-error-handling-in-probe.patch b/queue-6.1/media-rc-streamzap-error-handling-in-probe.patch new file mode 100644 index 0000000000..d5495be003 --- /dev/null +++ b/queue-6.1/media-rc-streamzap-error-handling-in-probe.patch @@ -0,0 +1,54 @@ +From 42844992664f03ef9f930e64f7370fa481e9c267 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:06:21 +0100 +Subject: media: rc: streamzap: Error handling in probe + +From: Oliver Neukum + +commit 42844992664f03ef9f930e64f7370fa481e9c267 upstream. + +If submitting the URB fails, the device will be unusable. +Probe() must fail. + +Fixes: 7a569f524dd36 ("V4L/DVB: IR/streamzap: functional in-kernel decoding") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/streamzap.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/streamzap.c ++++ b/drivers/media/rc/streamzap.c +@@ -219,9 +219,8 @@ static void streamzap_callback(struct ur + case -ESHUTDOWN: + /* + * this urb is terminated, clean up. +- * sz might already be invalid at this point + */ +- dev_err(sz->dev, "urb terminated, status: %d\n", urb->status); ++ dev_dbg(sz->dev, "urb terminated, status: %d\n", urb->status); + return; + default: + break; +@@ -358,11 +357,16 @@ static int streamzap_probe(struct usb_in + + usb_set_intfdata(intf, sz); + +- if (usb_submit_urb(sz->urb_in, GFP_ATOMIC)) ++ retval = usb_submit_urb(sz->urb_in, GFP_ATOMIC); ++ if (retval < 0) { + dev_err(sz->dev, "urb submit failed\n"); ++ goto rc_submit_fail; ++ } + + return 0; +- ++rc_submit_fail: ++ rc_free_device(sz->rdev); ++ usb_set_intfdata(intf, NULL); + rc_dev_fail: + usb_free_urb(sz->urb_in); + free_buf_in: diff --git a/queue-6.1/media-rc-xbox_remote-heed-dma-restrictions.patch b/queue-6.1/media-rc-xbox_remote-heed-dma-restrictions.patch new file mode 100644 index 0000000000..1daf7c3564 --- /dev/null +++ b/queue-6.1/media-rc-xbox_remote-heed-dma-restrictions.patch @@ -0,0 +1,61 @@ +From e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:09:44 +0100 +Subject: media: rc: xbox_remote: heed DMA restrictions + +From: Oliver Neukum + +commit e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff upstream. + +The buffer for IO must not be part of the device structure +because that violates the DMA coherency rules. + +Fixes: 02d32bdad3123 ("media: rc: add driver for Xbox DVD Movie Playback Kit") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/xbox_remote.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/media/rc/xbox_remote.c ++++ b/drivers/media/rc/xbox_remote.c +@@ -55,7 +55,7 @@ struct xbox_remote { + struct usb_interface *interface; + + struct urb *irq_urb; +- unsigned char inbuf[DATA_BUFSIZE] __aligned(sizeof(u16)); ++ u8 *inbuf; + + char rc_name[NAME_BUFSIZE]; + char rc_phys[NAME_BUFSIZE]; +@@ -218,6 +218,10 @@ static int xbox_remote_probe(struct usb_ + if (!xbox_remote || !rc_dev) + goto exit_free_dev_rdev; + ++ xbox_remote->inbuf = kzalloc(DATA_BUFSIZE, GFP_KERNEL); ++ if (!xbox_remote->inbuf) ++ goto exit_free_inbuf; ++ + /* Allocate URB buffer */ + xbox_remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!xbox_remote->irq_urb) +@@ -262,6 +266,8 @@ exit_kill_urbs: + usb_kill_urb(xbox_remote->irq_urb); + exit_free_buffers: + usb_free_urb(xbox_remote->irq_urb); ++exit_free_inbuf: ++ kfree(xbox_remote->inbuf); + exit_free_dev_rdev: + rc_free_device(rc_dev); + kfree(xbox_remote); +@@ -286,6 +292,7 @@ static void xbox_remote_disconnect(struc + usb_kill_urb(xbox_remote->irq_urb); + rc_unregister_device(xbox_remote->rdev); + usb_free_urb(xbox_remote->irq_urb); ++ kfree(xbox_remote->inbuf); + kfree(xbox_remote); + } + diff --git a/queue-6.1/media-saa7164-add-ioremap-return-checks-and-cleanups.patch b/queue-6.1/media-saa7164-add-ioremap-return-checks-and-cleanups.patch new file mode 100644 index 0000000000..b50911c688 --- /dev/null +++ b/queue-6.1/media-saa7164-add-ioremap-return-checks-and-cleanups.patch @@ -0,0 +1,110 @@ +From d51c60a498e83c9a79884c8e420f97e3885c9583 Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Mon, 16 Mar 2026 20:24:01 +0800 +Subject: media: saa7164: add ioremap return checks and cleanups + +From: Wang Jun <1742789905@qq.com> + +commit d51c60a498e83c9a79884c8e420f97e3885c9583 upstream. + +Add checks for ioremap return values in saa7164_dev_setup(). If +ioremap for BAR0 or BAR2 fails, release the already allocated PCI +memory regions, remove the device from the global list, decrement +the device count, and return -ENODEV. + +This prevents potential null pointer dereferences and ensures proper +cleanup on memory mapping failures. + +Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/saa7164/saa7164-core.c | 47 +++++++++++++++++++++++-------- + 1 file changed, 35 insertions(+), 12 deletions(-) + +--- a/drivers/media/pci/saa7164/saa7164-core.c ++++ b/drivers/media/pci/saa7164/saa7164-core.c +@@ -890,6 +890,15 @@ static int get_resources(struct saa7164_ + return -EBUSY; + } + ++static void release_resources(struct saa7164_dev *dev) ++{ ++ release_mem_region(pci_resource_start(dev->pci, 0), ++ pci_resource_len(dev->pci, 0)); ++ ++ release_mem_region(pci_resource_start(dev->pci, 2), ++ pci_resource_len(dev->pci, 2)); ++} ++ + static int saa7164_port_init(struct saa7164_dev *dev, int portnr) + { + struct saa7164_port *port = NULL; +@@ -949,9 +958,9 @@ static int saa7164_dev_setup(struct saa7 + + snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr); + +- mutex_lock(&devlist); +- list_add_tail(&dev->devlist, &saa7164_devlist); +- mutex_unlock(&devlist); ++ scoped_guard(mutex, &devlist) { ++ list_add_tail(&dev->devlist, &saa7164_devlist); ++ } + + /* board config */ + dev->board = UNSET; +@@ -998,11 +1007,17 @@ static int saa7164_dev_setup(struct saa7 + } + + /* PCI/e allocations */ +- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); ++ dev->lmmio = pci_ioremap_bar(dev->pci, 0); ++ if (!dev->lmmio) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n"); ++ goto err_ioremap_bar0; ++ } + +- dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ dev->lmmio2 = pci_ioremap_bar(dev->pci, 2); ++ if (!dev->lmmio2) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n"); ++ goto err_ioremap_bar2; ++ } + + dev->bmmio = (u8 __iomem *)dev->lmmio; + dev->bmmio2 = (u8 __iomem *)dev->lmmio2; +@@ -1021,17 +1036,25 @@ static int saa7164_dev_setup(struct saa7 + saa7164_pci_quirks(dev); + + return 0; ++ ++err_ioremap_bar2: ++ iounmap(dev->lmmio); ++err_ioremap_bar0: ++ release_resources(dev); ++ ++ scoped_guard(mutex, &devlist) { ++ list_del(&dev->devlist); ++ } ++ saa7164_devcount--; ++ ++ return -ENODEV; + } + + static void saa7164_dev_unregister(struct saa7164_dev *dev) + { + dprintk(1, "%s()\n", __func__); + +- release_mem_region(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); +- +- release_mem_region(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ release_resources(dev); + + if (!atomic_dec_and_test(&dev->refcount)) + return; diff --git a/queue-6.1/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch b/queue-6.1/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch new file mode 100644 index 0000000000..1042e4621f --- /dev/null +++ b/queue-6.1/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch @@ -0,0 +1,51 @@ +From fbac03467e53d8d72e5099c03df26d9adae11416 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 9 Mar 2026 15:01:54 +0000 +Subject: media: uvcvideo: Enable VB2_DMABUF for metadata stream + +From: Ricardo Ribalda + +commit fbac03467e53d8d72e5099c03df26d9adae11416 upstream. + +The UVC driver has two video streams, one for the frames and another one +for the metadata. Both streams share most of the codebase, but only the +data stream declares support for DMABUF transfer mode. + +I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM +and the frames looked correct. + +This patch announces the support for DMABUF for the metadata stream. +This is useful for apps/HALs that only want to support DMABUF. + +Cc: stable@vger.kernel.org +Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_queue.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -218,7 +218,7 @@ int uvc_queue_init(struct uvc_video_queu + int ret; + + queue->queue.type = type; +- queue->queue.io_modes = VB2_MMAP | VB2_USERPTR; ++ queue->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF; + queue->queue.drv_priv = queue; + queue->queue.buf_struct_size = sizeof(struct uvc_buffer); + queue->queue.mem_ops = &vb2_vmalloc_memops; +@@ -231,7 +231,6 @@ int uvc_queue_init(struct uvc_video_queu + queue->queue.ops = &uvc_meta_queue_qops; + break; + default: +- queue->queue.io_modes |= VB2_DMABUF; + queue->queue.ops = &uvc_queue_qops; + break; + } diff --git a/queue-6.1/platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch b/queue-6.1/platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch new file mode 100644 index 0000000000..b8e329cd63 --- /dev/null +++ b/queue-6.1/platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch @@ -0,0 +1,45 @@ +From e8c597368b8500a824c639bfb5ed0044068c6870 Mon Sep 17 00:00:00 2001 +From: Krishna Chomal +Date: Fri, 3 Apr 2026 13:31:55 +0530 +Subject: platform/x86: hp-wmi: Ignore backlight and FnLock events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krishna Chomal + +commit e8c597368b8500a824c639bfb5ed0044068c6870 upstream. + +On HP OmniBook 7 the keyboard backlight and FnLock keys are handled +directly by the firmware. However, they still trigger WMI events which +results in "Unknown key code" warnings in dmesg. + +Add these key codes to the keymap with KE_IGNORE to silence the warnings +since no software action is needed. + +Tested-by: Artem S. Tashkinov +Reported-by: Artem S. Tashkinov +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221181 +Signed-off-by: Krishna Chomal +Link: https://patch.msgid.link/20260403080155.169653-1-krishna.chomal108@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/hp/hp-wmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/platform/x86/hp/hp-wmi.c ++++ b/drivers/platform/x86/hp/hp-wmi.c +@@ -223,6 +223,11 @@ static const struct key_entry hp_wmi_key + { KE_KEY, 0x21a9, { KEY_TOUCHPAD_OFF } }, + { KE_KEY, 0x121a9, { KEY_TOUCHPAD_ON } }, + { KE_KEY, 0x231b, { KEY_HELP } }, ++ { KE_IGNORE, 0x21ab, }, /* FnLock on */ ++ { KE_IGNORE, 0x121ab, }, /* FnLock off */ ++ { KE_IGNORE, 0x30021aa, }, /* kbd backlight: level 2 -> off */ ++ { KE_IGNORE, 0x33221aa, }, /* kbd backlight: off -> level 1 */ ++ { KE_IGNORE, 0x36421aa, }, /* kbd backlight: level 1 -> level 2*/ + { KE_END, 0 } + }; + diff --git a/queue-6.1/regulator-act8945a-fix-of-node-reference-imbalance.patch b/queue-6.1/regulator-act8945a-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..8b48bff340 --- /dev/null +++ b/queue-6.1/regulator-act8945a-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 0d15ce31375ccef4162f960b34547a821b7619d2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:54 +0200 +Subject: regulator: act8945a: fix OF node reference imbalance + +From: Johan Hovold + +commit 0d15ce31375ccef4162f960b34547a821b7619d2 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 38c09961048b ("regulator: act8945a: add regulator driver for ACT8945A") +Cc: stable@vger.kernel.org # 4.6 +Cc: Wenyou Yang +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-7-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/act8945a-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/act8945a-regulator.c ++++ b/drivers/regulator/act8945a-regulator.c +@@ -302,8 +302,9 @@ static int act8945a_pmic_probe(struct pl + num_regulators = ARRAY_SIZE(act8945a_regulators); + } + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = act8945a; + for (i = 0; i < num_regulators; i++) { + rdev = devm_regulator_register(&pdev->dev, ®ulators[i], diff --git a/queue-6.1/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch b/queue-6.1/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..c7d9a5fa04 --- /dev/null +++ b/queue-6.1/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 8498100ee1d00422b8c5b161b3e332278b92a59a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:55 +0200 +Subject: regulator: bd9571mwv: fix OF node reference imbalance + +From: Johan Hovold + +commit 8498100ee1d00422b8c5b161b3e332278b92a59a upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: e85c5a153fe2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver") +Cc: stable@vger.kernel.org # 4.12 +Cc: Marek Vasut +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-8-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/bd9571mwv-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/bd9571mwv-regulator.c ++++ b/drivers/regulator/bd9571mwv-regulator.c +@@ -288,8 +288,9 @@ static int bd9571mwv_regulator_probe(str + + platform_set_drvdata(pdev, bdreg); + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = bdreg; + config.regmap = bdreg->regmap; + diff --git a/queue-6.1/regulator-max77650-fix-of-node-reference-imbalance.patch b/queue-6.1/regulator-max77650-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..78598551b0 --- /dev/null +++ b/queue-6.1/regulator-max77650-fix-of-node-reference-imbalance.patch @@ -0,0 +1,38 @@ +From 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:51 +0200 +Subject: regulator: max77650: fix OF node reference imbalance + +From: Johan Hovold + +commit 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: bcc61f1c44fd ("regulator: max77650: add regulator support") +Cc: stable@vger.kernel.org # 5.1 +Reviewed-by: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/max77650-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/max77650-regulator.c ++++ b/drivers/regulator/max77650-regulator.c +@@ -339,7 +339,7 @@ static int max77650_regulator_probe(stru + parent = dev->parent; + + if (!dev->of_node) +- dev->of_node = parent->of_node; ++ device_set_of_node_from_dev(dev, parent); + + rdescs = devm_kcalloc(dev, MAX77650_REGULATOR_NUM_REGULATORS, + sizeof(*rdescs), GFP_KERNEL); diff --git a/queue-6.1/series b/queue-6.1/series index 6096717304..d9b272dab6 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -388,3 +388,13 @@ f2fs-compress-fix-uaf-of-f2fs_inode_info-in-f2fs_fre.patch x86-cpu-amd-prevent-improper-isolation-of-shared-resources-in-zen2-s-op-cache.patch exit-sleep-at-task_idle-when-waiting-for-application-core-dump.patch ptrace-slightly-saner-get_dumpable-logic.patch +media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch +media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch +staging-media-atomisp-disallow-all-private-ioctls.patch +regulator-max77650-fix-of-node-reference-imbalance.patch +media-rc-xbox_remote-heed-dma-restrictions.patch +media-rc-streamzap-error-handling-in-probe.patch +regulator-act8945a-fix-of-node-reference-imbalance.patch +regulator-bd9571mwv-fix-of-node-reference-imbalance.patch +media-saa7164-add-ioremap-return-checks-and-cleanups.patch +platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch diff --git a/queue-6.1/staging-media-atomisp-disallow-all-private-ioctls.patch b/queue-6.1/staging-media-atomisp-disallow-all-private-ioctls.patch new file mode 100644 index 0000000000..a06b67d3a1 --- /dev/null +++ b/queue-6.1/staging-media-atomisp-disallow-all-private-ioctls.patch @@ -0,0 +1,39 @@ +From 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 26 Feb 2026 15:10:54 +0200 +Subject: staging: media: atomisp: Disallow all private IOCTLs + +From: Sakari Ailus + +commit 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c upstream. + +Disallow all private IOCTLs. These aren't quite as safe as one could +assume of IOCTL handlers; disable them for now. Instead of removing the +code, return in the beginning of the function if cmd is non-zero in order +to keep static checkers happy. + +Reported-by: Soufiane Dani +Closes: https://lore.kernel.org/linux-staging/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com/ +Cc: stable@vger.kernel.org +Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") +Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -2456,6 +2456,10 @@ static long atomisp_vidioc_default(struc + struct v4l2_subdev *motor; + int err; + ++ /* Disable all private IOCTLs for now! */ ++ if (cmd) ++ return -EINVAL; ++ + if (!IS_ISP2401) + motor = isp->inputs[asd->input_curr].motor; + else