From: Greg Kroah-Hartman Date: Fri, 15 May 2026 05:47:10 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.10.256~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6ea507000122c3d42144533605d3e7d3e503e36d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch hid-playstation-clamp-num_touch_reports.patch media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch media-intel-ipu6-fix-error-pointer-dereference.patch media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch media-rc-streamzap-error-handling-in-probe.patch media-rc-xbox_remote-heed-dma-restrictions.patch media-saa7164-add-ioremap-return-checks-and-cleanups.patch media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch regulator-act8945a-fix-of-node-reference-imbalance.patch regulator-bd9571mwv-fix-of-node-reference-imbalance.patch regulator-max77650-fix-of-node-reference-imbalance.patch regulator-mt6357-fix-of-node-reference-imbalance.patch regulator-rk808-fix-of-node-reference-imbalance.patch spi-aspeed-smc-fix-controller-deregistration.patch spi-at91-usart-fix-controller-deregistration.patch spi-atmel-fix-controller-deregistration.patch spi-bcm63xx-fix-controller-deregistration.patch spi-lantiq-ssc-fix-controller-deregistration.patch spi-meson-spicc-fix-controller-deregistration.patch spi-qup-fix-controller-deregistration.patch spi-st-ssc4-fix-controller-deregistration.patch staging-media-atomisp-disallow-all-private-ioctls.patch --- diff --git a/queue-6.12/arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch b/queue-6.12/arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch new file mode 100644 index 0000000000..db24ccdae4 --- /dev/null +++ b/queue-6.12/arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch @@ -0,0 +1,157 @@ +From 70008aee892bbb5c2969bbe9e5778fc081b14bd2 Mon Sep 17 00:00:00 2001 +From: Josua Mayer +Date: Tue, 24 Mar 2026 13:40:55 +0100 +Subject: arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux + +From: Josua Mayer + +commit 70008aee892bbb5c2969bbe9e5778fc081b14bd2 upstream. + +Commit 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to +support bus recovery") introduced pinmux nodes for lx2160 i2c +interfaces, allowing runtime change between i2c and gpio functions +implementing bus recovery. + +However, the dynamic configuration area (overwrite MUX) used by the +pinctrl-single driver initially reads as zero and does not reflect the +actual hardware state set by the Reset Configuration Word (RCW) at +power-on. + +Because multiple groups of pins are configured from a single 32-bit +register, the first write from the pinctrl driver unintentionally clears +all other bits to zero. + +For example, on the LX2162A Clearfog, RCWSR12 is initialized to +0x08000006. When any i2c pinmux is applied, it clears all other fields. +This inadvertently disables SD card-detect (IIC2_PMUX) and some GPIOs +(SDHC1_DIR_PMUX): + +LX2162-CF RCWSR12: 0b0000100000000000 0000000000000110 +IIC2_PMUX ||| ||| || | ||| |||XXX : I2C/GPIO/CD-WP +SDHC1_DIR_PMUX XXX ||| || | ||| ||| : SDHC/GPIO/SPI + +Reverting the commit in question was considered but bus recovery is an +important feature. + +Instead add pinmux nodes for those pins that were unintentionally +reconfigured on SolidRun LX2160A Clearfog-CX and LX2162A Clearfog +boards. + +Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") +Cc: stable@vger.kernel.org +Signed-off-by: Josua Mayer +Signed-off-by: Frank Li +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 +++ + arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++++++++++++ + arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + + arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 +++ + 5 files changed, 42 insertions(+) + +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi +@@ -163,6 +163,8 @@ + }; + + &fspi { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>; + status = "okay"; + + flash@0 { +@@ -178,6 +180,11 @@ + }; + }; + ++&pinmux_i2crv { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&gpio0_14_12_pins>; ++}; ++ + &usb0 { + status = "okay"; + }; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi +@@ -89,6 +89,8 @@ + }; + + &esdhc0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>; + sd-uhs-sdr104; + sd-uhs-sdr50; + sd-uhs-sdr25; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +@@ -1717,6 +1717,10 @@ + pinctrl-single,bits = <0x0 0x1 0x7>; + }; + ++ esdhc0_cd_wp_pins: iic2-sdhc-pins { ++ pinctrl-single,bits = <0x0 0x6 0x7>; ++ }; ++ + i2c2_scl: i2c2-scl-pins { + pinctrl-single,bits = <0x0 0 (0x7 << 3)>; + }; +@@ -1749,6 +1753,26 @@ + pinctrl-single,bits = <0x0 (0x1 << 12) (0x7 << 12)>; + }; + ++ fspi_data74_pins: xspi1-data74-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 15)>; ++ }; ++ ++ fspi_data30_pins: xspi1-data30-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 18)>; ++ }; ++ ++ fspi_dqs_sck_cs10_pins: xspi1-base-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 21)>; ++ }; ++ ++ esdhc0_cmd_data30_clk_vsel_pins: sdhc1-base-sdhc-vsel-pins { ++ pinctrl-single,bits = <0x0 0x0 (0x7 << 24)>; ++ }; ++ ++ gpio0_14_12_pins: sdhc1-dir-gpio-pins { ++ pinctrl-single,bits = <0x0 (0x1 << 27) (0x7 << 27)>; ++ }; ++ + i2c6_scl: i2c6-scl-pins { + pinctrl-single,bits = <0x4 0x2 0x7>; + }; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts +@@ -223,6 +223,8 @@ + }; + + &esdhc0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>; + sd-uhs-sdr104; + sd-uhs-sdr50; + sd-uhs-sdr25; +--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi +@@ -30,6 +30,8 @@ + }; + + &fspi { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>; + status = "okay"; + + flash@0 { +@@ -80,3 +82,8 @@ + reg = <0x6f>; + }; + }; ++ ++&pinmux_i2crv { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&gpio0_14_12_pins>; ++}; diff --git a/queue-6.12/hid-playstation-clamp-num_touch_reports.patch b/queue-6.12/hid-playstation-clamp-num_touch_reports.patch new file mode 100644 index 0000000000..86334549f5 --- /dev/null +++ b/queue-6.12/hid-playstation-clamp-num_touch_reports.patch @@ -0,0 +1,50 @@ +From cac61b58a3b6340c52afa06bb15eac033158db2f Mon Sep 17 00:00:00 2001 +From: "T.J. Mercier" +Date: Fri, 17 Apr 2026 08:47:02 -0700 +Subject: HID: playstation: Clamp num_touch_reports + +From: T.J. Mercier + +commit cac61b58a3b6340c52afa06bb15eac033158db2f upstream. + +A device would never lie about the number of touch reports would it? + +If it does the loop in dualshock4_parse_report will read off the end of +the touch_reports array, up to about 2 KiB for the maximum number of 256 +loop iteraions. The data that is read is emitted via evdev if the +DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by +clamping the num_touch_reports value provided by the device to the +maximum size of the touch_reports array. + +Fixes: 752038248808 ("HID: playstation: add DualShock4 touchpad support.") +Cc: stable@vger.kernel.org +Reported-by: Xingyu Jin +Signed-off-by: T.J. Mercier +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-playstation.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-playstation.c ++++ b/drivers/hid/hid-playstation.c +@@ -2248,7 +2248,8 @@ static int dualshock4_parse_report(struc + struct dualshock4_input_report_usb *usb = (struct dualshock4_input_report_usb *)data; + + ds4_report = &usb->common; +- num_touch_reports = usb->num_touch_reports; ++ num_touch_reports = min_t(u8, usb->num_touch_reports, ++ ARRAY_SIZE(usb->touch_reports)); + touch_reports = usb->touch_reports; + } else if (hdev->bus == BUS_BLUETOOTH && report->id == DS4_INPUT_REPORT_BT && + size == DS4_INPUT_REPORT_BT_SIZE) { +@@ -2262,7 +2263,8 @@ static int dualshock4_parse_report(struc + } + + ds4_report = &bt->common; +- num_touch_reports = bt->num_touch_reports; ++ num_touch_reports = min_t(u8, bt->num_touch_reports, ++ ARRAY_SIZE(bt->touch_reports)); + touch_reports = bt->touch_reports; + } else if (hdev->bus == BUS_BLUETOOTH && + report->id == DS4_INPUT_REPORT_BT_MINIMAL && diff --git a/queue-6.12/media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch b/queue-6.12/media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch new file mode 100644 index 0000000000..0a1cd611e0 --- /dev/null +++ b/queue-6.12/media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch @@ -0,0 +1,54 @@ +From cb8bdd3ffca280d014311ab395651d33f58a8708 Mon Sep 17 00:00:00 2001 +From: Ziyi Guo +Date: Sat, 31 Jan 2026 22:19:07 +0000 +Subject: media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() + +From: Ziyi Guo + +commit cb8bdd3ffca280d014311ab395651d33f58a8708 upstream. + +Add spin_lock_irqsave()/spin_unlock_irqrestore() around the +handle_dynamic_resolution_change() call in initialize_sequence() to fix +the missing lock protection. + +initialize_sequence() calls handle_dynamic_resolution_change() without +holding inst->state_spinlock. However, handle_dynamic_resolution_change() +has lockdep_assert_held(&inst->state_spinlock) indicating that callers +must hold this lock. + +Other callers of handle_dynamic_resolution_change() properly acquire the +spinlock: +- wave5_vpu_dec_finish_decode() +- wave5_vpu_dec_device_run() + +Signed-off-by: Ziyi Guo +Reviewed-by: Nicolas Dufresne +Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer") +Cc: stable@vger.kernel.org +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c +@@ -1625,6 +1625,7 @@ static int initialize_sequence(struct vp + { + struct dec_initial_info initial_info; + int ret = 0; ++ unsigned long flags; + + memset(&initial_info, 0, sizeof(struct dec_initial_info)); + +@@ -1646,7 +1647,9 @@ static int initialize_sequence(struct vp + return ret; + } + ++ spin_lock_irqsave(&inst->state_spinlock, flags); + handle_dynamic_resolution_change(inst); ++ spin_unlock_irqrestore(&inst->state_spinlock, flags); + + return 0; + } diff --git a/queue-6.12/media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch b/queue-6.12/media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch new file mode 100644 index 0000000000..32be1152a1 --- /dev/null +++ b/queue-6.12/media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch @@ -0,0 +1,69 @@ +From f48050436746be75227fbc90066a8658cbe94d17 Mon Sep 17 00:00:00 2001 +From: Ziyi Guo +Date: Sat, 31 Jan 2026 22:03:23 +0000 +Subject: media: chips-media: wave5: add missing spinlock protection for send_eos_event() + +From: Ziyi Guo + +commit f48050436746be75227fbc90066a8658cbe94d17 upstream. + +Add spin_lock_irqsave()/spin_unlock_irqrestore() around send_eos_event() +calls in the VB2 buffer queue and streamoff callbacks to fix the missing +lock protection. + +wave5_vpu_dec_buf_queue_dst() and streamoff_output() call send_eos_event() +without holding inst->state_spinlock. However, send_eos_event() has +lockdep_assert_held(&inst->state_spinlock) indicating that callers must +hold this lock. + +Other callers of send_eos_event() properly acquire the spinlock: +- wave5_vpu_dec_finish_decode() acquires lock at line 431 +- wave5_vpu_dec_encoder_cmd() acquires lock at line 821 +- wave5_vpu_dec_device_run() acquires lock at line 1592 + +Signed-off-by: Ziyi Guo +Reviewed-by: Nicolas Dufresne +Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer") +Cc: stable@vger.kernel.org +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c +@@ -1345,13 +1345,17 @@ static void wave5_vpu_dec_buf_queue_dst( + + if (vb2_is_streaming(vb->vb2_queue) && v4l2_m2m_dst_buf_is_last(m2m_ctx)) { + unsigned int i; ++ unsigned long flags; + + for (i = 0; i < vb->num_planes; i++) + vb2_set_plane_payload(vb, i, 0); + + vbuf->field = V4L2_FIELD_NONE; + ++ spin_lock_irqsave(&inst->state_spinlock, flags); + send_eos_event(inst); ++ spin_unlock_irqrestore(&inst->state_spinlock, flags); ++ + v4l2_m2m_last_buffer_done(m2m_ctx, vbuf); + } else { + v4l2_m2m_buf_queue(m2m_ctx, vbuf); +@@ -1492,8 +1496,13 @@ static int streamoff_output(struct vb2_q + inst->codec_info->dec_info.stream_rd_ptr = new_rd_ptr; + inst->codec_info->dec_info.stream_wr_ptr = new_rd_ptr; + +- if (v4l2_m2m_has_stopped(m2m_ctx)) ++ if (v4l2_m2m_has_stopped(m2m_ctx)) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&inst->state_spinlock, flags); + send_eos_event(inst); ++ spin_unlock_irqrestore(&inst->state_spinlock, flags); ++ } + + /* streamoff on output cancels any draining operation */ + inst->eos = false; diff --git a/queue-6.12/media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch b/queue-6.12/media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch new file mode 100644 index 0000000000..c58ac89325 --- /dev/null +++ b/queue-6.12/media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch @@ -0,0 +1,33 @@ +From 95bd174a453f77b09ea66e1e22834680754ba501 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Sun, 25 Jan 2026 22:19:15 +0800 +Subject: media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() + +From: Haoxiang Li + +commit 95bd174a453f77b09ea66e1e22834680754ba501 upstream. + +Add wave5_vdi_free_dma_memory() in the error path of +wave5_vdi_init() to prevent a potential memory leak. + +Fixes: 45d1a2b93277 ("media: chips-media: wave5: Add vpuapi layer") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Reviewed-by: Nicolas Dufresne +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vdi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vdi.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vdi.c +@@ -49,6 +49,7 @@ int wave5_vdi_init(struct device *dev) + + if (!PRODUCT_CODE_W_SERIES(vpu_dev->product_code)) { + WARN_ONCE(1, "unsupported product code: 0x%x\n", vpu_dev->product_code); ++ wave5_vdi_free_dma_memory(vpu_dev, &vpu_dev->common_mem); + return -EOPNOTSUPP; + } + diff --git a/queue-6.12/media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch b/queue-6.12/media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch new file mode 100644 index 0000000000..9a57db550a --- /dev/null +++ b/queue-6.12/media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch @@ -0,0 +1,49 @@ +From bce1349dbf6348ddee47308e2ed08878356de317 Mon Sep 17 00:00:00 2001 +From: Jai Luthra +Date: Sat, 14 Feb 2026 18:35:21 +0530 +Subject: media: i2c: imx283: Enter full standby when stopping streaming + +From: Jai Luthra + +commit bce1349dbf6348ddee47308e2ed08878356de317 upstream. + +Use IMX283_STANDBY (bit 0) instead of IMX283_STBLOGIC (bit 1) when +stopping streaming. STBLOGIC only puts the sensor logic into standby but +leaves the MIPI interface (along with other components) in an +indeterminate state. + +This (presumably) causes the CSI receiver (e.g. Raspberry Pi's CFE) to +miss the LP-11 to HS transition when streaming restarts, resulting in a +hang of 10+ seconds. The issue is most visible when immediately +restarting a full-resolution stream after stopping a 3x3 binned one, so +that runtime suspend hasn't yet been triggered. + +Writing IMX283_STANDBY puts the entire sensor into standby. The +imx283_standby_cancel() sequence already handles the full wakeup from +this suspended state. + +Cc: stable@vger.kernel.org +Link: https://github.com/raspberrypi/linux/issues/7153 +Link: https://github.com/will127534/OneInchEye/issues/12 +Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver") +Signed-off-by: Jai Luthra +Tested-by: Kieran Bingham +Reviewed-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/imx283.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/imx283.c ++++ b/drivers/media/i2c/imx283.c +@@ -1160,7 +1160,7 @@ static int imx283_disable_streams(struct + if (pad != IMAGE_PAD) + return -EINVAL; + +- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STBLOGIC, NULL); ++ ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL); + if (ret) + dev_err(imx283->dev, "Failed to stop stream\n"); + diff --git a/queue-6.12/media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch b/queue-6.12/media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch new file mode 100644 index 0000000000..7d9a4a4f33 --- /dev/null +++ b/queue-6.12/media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch @@ -0,0 +1,90 @@ +From 9206359b2c396ff594adf39bc7daaadab0fcb367 Mon Sep 17 00:00:00 2001 +From: Jai Luthra +Date: Sat, 14 Feb 2026 18:35:22 +0530 +Subject: media: i2c: imx283: Fix hang when going from large to small resolution + +From: Jai Luthra + +commit 9206359b2c396ff594adf39bc7daaadab0fcb367 upstream. + +When switching between modes (e.g. full resolution to binned), +standby_cancel() previously cleared XMSTA (starting master mode data +output) before the new mode's MDSEL, crop, and timing registers were +programmed in start_streaming(). This caused the sensor to briefly +output MIPI data using the previous mode's configuration. + +On receivers like imx-mipi-csis, this leads to FIFO overflow errors +when switching from a higher to a lower resolution, as the receiver is +configured for the new smaller frame size but receives stale +full-resolution data. + +Fix this by moving the XMSTA and SYNCDRV register writes from +standby_cancel() to the end of start_streaming(), after all mode, +crop, and timing registers have been configured. Also explicitly stop +master mode (XMSTA=1) when stopping the stream, matching the pattern +used by other Sony sensor drivers (imx290, imx415). + +Use named macros IMX283_XMSTA_START/STOP instead of raw 0/BIT(0) for +readability. + +Cc: stable@vger.kernel.org +Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver") +Signed-off-by: Jai Luthra +Tested-by: Kieran Bingham +Reviewed-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/imx283.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/media/i2c/imx283.c ++++ b/drivers/media/i2c/imx283.c +@@ -130,7 +130,8 @@ + + /* Master Mode Operation Control */ + #define IMX283_REG_XMSTA CCI_REG8(0x3105) +-#define IMX283_XMSTA BIT(0) ++#define IMX283_XMSTA_START 0 ++#define IMX283_XMSTA_STOP BIT(0) + + #define IMX283_REG_SYNCDRV CCI_REG8(0x3107) + #define IMX283_SYNCDRV_XHS_XVS (0xa0 | 0x02) +@@ -1024,8 +1025,6 @@ static int imx283_standby_cancel(struct + usleep_range(19000, 20000); + + cci_write(imx283->cci, IMX283_REG_CLAMP, IMX283_CLPSQRST, &ret); +- cci_write(imx283->cci, IMX283_REG_XMSTA, 0, &ret); +- cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret); + + return ret; + } +@@ -1118,6 +1117,10 @@ static int imx283_start_streaming(struct + /* Apply customized values from controls (HMAX/VMAX/SHR) */ + ret = __v4l2_ctrl_handler_setup(imx283->sd.ctrl_handler); + ++ /* Start master mode */ ++ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_START, &ret); ++ cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret); ++ + return ret; + } + +@@ -1155,12 +1158,14 @@ static int imx283_disable_streams(struct + u64 streams_mask) + { + struct imx283 *imx283 = to_imx283(sd); +- int ret; ++ int ret = 0; + + if (pad != IMAGE_PAD) + return -EINVAL; + +- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL); ++ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_STOP, &ret); ++ cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, &ret); ++ + if (ret) + dev_err(imx283->dev, "Failed to stop stream\n"); + diff --git a/queue-6.12/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch b/queue-6.12/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch new file mode 100644 index 0000000000..3c662ca816 --- /dev/null +++ b/queue-6.12/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch @@ -0,0 +1,45 @@ +From f75e160745663ce9b13362ae6e90bd439c58df69 Mon Sep 17 00:00:00 2001 +From: Alexander Koskovich +Date: Thu, 12 Mar 2026 17:16:20 +0000 +Subject: media: i2c: ov8856: free control handler on error in ov8856_init_controls() + +From: Alexander Koskovich + +commit f75e160745663ce9b13362ae6e90bd439c58df69 upstream. + +The control handler wasn't freed if adding controls failed, add an error +exit label and convert the existing error return to use it. + +Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor") +Cc: stable@vger.kernel.org +Signed-off-by: Alexander Koskovich +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ov8856.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/ov8856.c ++++ b/drivers/media/i2c/ov8856.c +@@ -1951,12 +1951,18 @@ static int ov8856_init_controls(struct o + V4L2_CID_HFLIP, 0, 1, 1, 0); + v4l2_ctrl_new_std(ctrl_hdlr, &ov8856_ctrl_ops, + V4L2_CID_VFLIP, 0, 1, 1, 0); +- if (ctrl_hdlr->error) +- return ctrl_hdlr->error; ++ if (ctrl_hdlr->error) { ++ ret = ctrl_hdlr->error; ++ goto err_ctrl_handler_free; ++ } + + ov8856->sd.ctrl_handler = ctrl_hdlr; + + return 0; ++ ++err_ctrl_handler_free: ++ v4l2_ctrl_handler_free(ctrl_hdlr); ++ return ret; + } + + static void ov8856_update_pad_format(struct ov8856 *ov8856, diff --git a/queue-6.12/media-intel-ipu6-fix-error-pointer-dereference.patch b/queue-6.12/media-intel-ipu6-fix-error-pointer-dereference.patch new file mode 100644 index 0000000000..eac5369495 --- /dev/null +++ b/queue-6.12/media-intel-ipu6-fix-error-pointer-dereference.patch @@ -0,0 +1,39 @@ +From 8dd088b8b106f7b119664f965b691785998edcfb Mon Sep 17 00:00:00 2001 +From: Ethan Tidmore +Date: Fri, 6 Mar 2026 21:03:55 -0600 +Subject: media: intel/ipu6: fix error pointer dereference + +From: Ethan Tidmore + +commit 8dd088b8b106f7b119664f965b691785998edcfb upstream. + +In a error path isp->psys is confirmed to be an error pointer not NULL so +this condition is true and the error pointer is dereferenced. So isp-psys +should be set to NULL before going to out_ipu6_bus_del_devices. + +Detected by Smatch: +drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error: +'isp->psys' dereferencing possible ERR_PTR() + +Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver") +Cc: stable@vger.kernel.org +Signed-off-by: Ethan Tidmore +[Sakari Ailus: Fix commit message.] +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/intel/ipu6/ipu6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/pci/intel/ipu6/ipu6.c ++++ b/drivers/media/pci/intel/ipu6/ipu6.c +@@ -685,7 +685,7 @@ out_free_irq: + out_ipu6_rpm_put: + pm_runtime_put_sync(&isp->psys->auxdev.dev); + out_ipu6_bus_del_devices: +- if (isp->psys) { ++ if (!IS_ERR_OR_NULL(isp->psys)) { + ipu6_cpd_free_pkg_dir(isp->psys); + ipu6_buttress_unmap_fw_image(isp->psys, &isp->psys->fw_sgt); + } diff --git a/queue-6.12/media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch b/queue-6.12/media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch new file mode 100644 index 0000000000..5a0770e45b --- /dev/null +++ b/queue-6.12/media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch @@ -0,0 +1,42 @@ +From 2f38622d0f85f317be9e6b131da6cd511db94fd2 Mon Sep 17 00:00:00 2001 +From: Guoniu Zhou +Date: Thu, 12 Mar 2026 11:12:34 +0800 +Subject: media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 + +From: Guoniu Zhou + +commit 2f38622d0f85f317be9e6b131da6cd511db94fd2 upstream. + +Fix a hang issue when capturing a single frame with applications like cam +in libcamera. It would hang waiting for the driver to complete the buffer, +but streaming never starts because min_queued_buffers was set to 2. + +The ISI module uses a ping-pong buffer mechanism that requires two buffers +to be programmed at all times. However, when fewer than 2 user buffers are +available, the driver use internal discard buffers to fill the remaining +slot(s). Reduce minimum queued buffers from 2 to 0 allows streaming to +start without any queued buffers. + +Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") +Cc: stable@vger.kernel.org +Signed-off-by: Guoniu Zhou +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260312-isi_min_buffers-v2-1-d5ea1c79ad81@nxp.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c +@@ -1416,7 +1416,7 @@ int mxc_isi_video_register(struct mxc_is + q->mem_ops = &vb2_dma_contig_memops; + q->buf_struct_size = sizeof(struct mxc_isi_buffer); + q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC; +- q->min_queued_buffers = 2; ++ q->min_queued_buffers = 0; + q->lock = &video->lock; + q->dev = pipe->isi->dev; + diff --git a/queue-6.12/media-rc-streamzap-error-handling-in-probe.patch b/queue-6.12/media-rc-streamzap-error-handling-in-probe.patch new file mode 100644 index 0000000000..d5495be003 --- /dev/null +++ b/queue-6.12/media-rc-streamzap-error-handling-in-probe.patch @@ -0,0 +1,54 @@ +From 42844992664f03ef9f930e64f7370fa481e9c267 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:06:21 +0100 +Subject: media: rc: streamzap: Error handling in probe + +From: Oliver Neukum + +commit 42844992664f03ef9f930e64f7370fa481e9c267 upstream. + +If submitting the URB fails, the device will be unusable. +Probe() must fail. + +Fixes: 7a569f524dd36 ("V4L/DVB: IR/streamzap: functional in-kernel decoding") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/streamzap.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/streamzap.c ++++ b/drivers/media/rc/streamzap.c +@@ -219,9 +219,8 @@ static void streamzap_callback(struct ur + case -ESHUTDOWN: + /* + * this urb is terminated, clean up. +- * sz might already be invalid at this point + */ +- dev_err(sz->dev, "urb terminated, status: %d\n", urb->status); ++ dev_dbg(sz->dev, "urb terminated, status: %d\n", urb->status); + return; + default: + break; +@@ -358,11 +357,16 @@ static int streamzap_probe(struct usb_in + + usb_set_intfdata(intf, sz); + +- if (usb_submit_urb(sz->urb_in, GFP_ATOMIC)) ++ retval = usb_submit_urb(sz->urb_in, GFP_ATOMIC); ++ if (retval < 0) { + dev_err(sz->dev, "urb submit failed\n"); ++ goto rc_submit_fail; ++ } + + return 0; +- ++rc_submit_fail: ++ rc_free_device(sz->rdev); ++ usb_set_intfdata(intf, NULL); + rc_dev_fail: + usb_free_urb(sz->urb_in); + free_buf_in: diff --git a/queue-6.12/media-rc-xbox_remote-heed-dma-restrictions.patch b/queue-6.12/media-rc-xbox_remote-heed-dma-restrictions.patch new file mode 100644 index 0000000000..1daf7c3564 --- /dev/null +++ b/queue-6.12/media-rc-xbox_remote-heed-dma-restrictions.patch @@ -0,0 +1,61 @@ +From e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:09:44 +0100 +Subject: media: rc: xbox_remote: heed DMA restrictions + +From: Oliver Neukum + +commit e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff upstream. + +The buffer for IO must not be part of the device structure +because that violates the DMA coherency rules. + +Fixes: 02d32bdad3123 ("media: rc: add driver for Xbox DVD Movie Playback Kit") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/xbox_remote.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/media/rc/xbox_remote.c ++++ b/drivers/media/rc/xbox_remote.c +@@ -55,7 +55,7 @@ struct xbox_remote { + struct usb_interface *interface; + + struct urb *irq_urb; +- unsigned char inbuf[DATA_BUFSIZE] __aligned(sizeof(u16)); ++ u8 *inbuf; + + char rc_name[NAME_BUFSIZE]; + char rc_phys[NAME_BUFSIZE]; +@@ -218,6 +218,10 @@ static int xbox_remote_probe(struct usb_ + if (!xbox_remote || !rc_dev) + goto exit_free_dev_rdev; + ++ xbox_remote->inbuf = kzalloc(DATA_BUFSIZE, GFP_KERNEL); ++ if (!xbox_remote->inbuf) ++ goto exit_free_inbuf; ++ + /* Allocate URB buffer */ + xbox_remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!xbox_remote->irq_urb) +@@ -262,6 +266,8 @@ exit_kill_urbs: + usb_kill_urb(xbox_remote->irq_urb); + exit_free_buffers: + usb_free_urb(xbox_remote->irq_urb); ++exit_free_inbuf: ++ kfree(xbox_remote->inbuf); + exit_free_dev_rdev: + rc_free_device(rc_dev); + kfree(xbox_remote); +@@ -286,6 +292,7 @@ static void xbox_remote_disconnect(struc + usb_kill_urb(xbox_remote->irq_urb); + rc_unregister_device(xbox_remote->rdev); + usb_free_urb(xbox_remote->irq_urb); ++ kfree(xbox_remote->inbuf); + kfree(xbox_remote); + } + diff --git a/queue-6.12/media-saa7164-add-ioremap-return-checks-and-cleanups.patch b/queue-6.12/media-saa7164-add-ioremap-return-checks-and-cleanups.patch new file mode 100644 index 0000000000..bfcec5a6e8 --- /dev/null +++ b/queue-6.12/media-saa7164-add-ioremap-return-checks-and-cleanups.patch @@ -0,0 +1,110 @@ +From d51c60a498e83c9a79884c8e420f97e3885c9583 Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Mon, 16 Mar 2026 20:24:01 +0800 +Subject: media: saa7164: add ioremap return checks and cleanups + +From: Wang Jun <1742789905@qq.com> + +commit d51c60a498e83c9a79884c8e420f97e3885c9583 upstream. + +Add checks for ioremap return values in saa7164_dev_setup(). If +ioremap for BAR0 or BAR2 fails, release the already allocated PCI +memory regions, remove the device from the global list, decrement +the device count, and return -ENODEV. + +This prevents potential null pointer dereferences and ensures proper +cleanup on memory mapping failures. + +Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/saa7164/saa7164-core.c | 47 +++++++++++++++++++++++-------- + 1 file changed, 35 insertions(+), 12 deletions(-) + +--- a/drivers/media/pci/saa7164/saa7164-core.c ++++ b/drivers/media/pci/saa7164/saa7164-core.c +@@ -888,6 +888,15 @@ static int get_resources(struct saa7164_ + return -EBUSY; + } + ++static void release_resources(struct saa7164_dev *dev) ++{ ++ release_mem_region(pci_resource_start(dev->pci, 0), ++ pci_resource_len(dev->pci, 0)); ++ ++ release_mem_region(pci_resource_start(dev->pci, 2), ++ pci_resource_len(dev->pci, 2)); ++} ++ + static int saa7164_port_init(struct saa7164_dev *dev, int portnr) + { + struct saa7164_port *port = NULL; +@@ -947,9 +956,9 @@ static int saa7164_dev_setup(struct saa7 + + snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr); + +- mutex_lock(&devlist); +- list_add_tail(&dev->devlist, &saa7164_devlist); +- mutex_unlock(&devlist); ++ scoped_guard(mutex, &devlist) { ++ list_add_tail(&dev->devlist, &saa7164_devlist); ++ } + + /* board config */ + dev->board = UNSET; +@@ -996,11 +1005,17 @@ static int saa7164_dev_setup(struct saa7 + } + + /* PCI/e allocations */ +- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); ++ dev->lmmio = pci_ioremap_bar(dev->pci, 0); ++ if (!dev->lmmio) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n"); ++ goto err_ioremap_bar0; ++ } + +- dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ dev->lmmio2 = pci_ioremap_bar(dev->pci, 2); ++ if (!dev->lmmio2) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n"); ++ goto err_ioremap_bar2; ++ } + + dev->bmmio = (u8 __iomem *)dev->lmmio; + dev->bmmio2 = (u8 __iomem *)dev->lmmio2; +@@ -1019,17 +1034,25 @@ static int saa7164_dev_setup(struct saa7 + saa7164_pci_quirks(dev); + + return 0; ++ ++err_ioremap_bar2: ++ iounmap(dev->lmmio); ++err_ioremap_bar0: ++ release_resources(dev); ++ ++ scoped_guard(mutex, &devlist) { ++ list_del(&dev->devlist); ++ } ++ saa7164_devcount--; ++ ++ return -ENODEV; + } + + static void saa7164_dev_unregister(struct saa7164_dev *dev) + { + dprintk(1, "%s()\n", __func__); + +- release_mem_region(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); +- +- release_mem_region(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ release_resources(dev); + + if (!atomic_dec_and_test(&dev->refcount)) + return; diff --git a/queue-6.12/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch b/queue-6.12/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch new file mode 100644 index 0000000000..1042e4621f --- /dev/null +++ b/queue-6.12/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch @@ -0,0 +1,51 @@ +From fbac03467e53d8d72e5099c03df26d9adae11416 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 9 Mar 2026 15:01:54 +0000 +Subject: media: uvcvideo: Enable VB2_DMABUF for metadata stream + +From: Ricardo Ribalda + +commit fbac03467e53d8d72e5099c03df26d9adae11416 upstream. + +The UVC driver has two video streams, one for the frames and another one +for the metadata. Both streams share most of the codebase, but only the +data stream declares support for DMABUF transfer mode. + +I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM +and the frames looked correct. + +This patch announces the support for DMABUF for the metadata stream. +This is useful for apps/HALs that only want to support DMABUF. + +Cc: stable@vger.kernel.org +Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_queue.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -218,7 +218,7 @@ int uvc_queue_init(struct uvc_video_queu + int ret; + + queue->queue.type = type; +- queue->queue.io_modes = VB2_MMAP | VB2_USERPTR; ++ queue->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF; + queue->queue.drv_priv = queue; + queue->queue.buf_struct_size = sizeof(struct uvc_buffer); + queue->queue.mem_ops = &vb2_vmalloc_memops; +@@ -231,7 +231,6 @@ int uvc_queue_init(struct uvc_video_queu + queue->queue.ops = &uvc_meta_queue_qops; + break; + default: +- queue->queue.io_modes |= VB2_DMABUF; + queue->queue.ops = &uvc_queue_qops; + break; + } diff --git a/queue-6.12/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch b/queue-6.12/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch new file mode 100644 index 0000000000..483551972d --- /dev/null +++ b/queue-6.12/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch @@ -0,0 +1,99 @@ +From 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Sun, 15 Feb 2026 18:42:59 +0100 +Subject: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap + +From: Janne Grunau + +commit 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 upstream. + +vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not +see a reason why vb2_dma_sg should behave differently. This avoids +hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in +drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of +tree Apple ISP camera capture driver which uses vb2_dma_sg_memops. + +gst-launch-1.0 v4l2src ! gtk4paintablesink + +[ 38.201528] ------------[ cut here ]------------ +[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210 +[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer +snd_seq snd_seq_device uinput nf_conntrack_netbios_ns +nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib +nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat +nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep +nls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc +hid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic +cfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev +aop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2 +snd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor +macsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi +macsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3 +snd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon +apple_sart apple_dockchannel macsmc apple_rtkit_helper +spmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses +pinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core +spi_apple +[ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram +[ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full) +[ 38.219040] Tainted: [W]=WARN +[ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT) +[ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210 +[ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210 +[ 38.222178] sp : ffffc0008dc678e0 +[ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480 +[ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968 +[ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0 +[ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968 +[ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8 +[ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff +[ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8 +[ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000 +[ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038 +[ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb +[ 38.231488] Call trace: +[ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P) +[ 38.232342] drm_gem_mmap+0x140/0x260 +[ 38.232813] __mmap_region+0x488/0x9a0 +[ 38.233277] mmap_region+0xd0/0x148 +[ 38.233703] do_mmap+0x350/0x5c0 +[ 38.234148] vm_mmap_pgoff+0x14c/0x200 +[ 38.234612] ksys_mmap_pgoff+0x150/0x208 +[ 38.235107] __arm64_sys_mmap+0x34/0x50 +[ 38.235611] invoke_syscall+0x50/0x120 +[ 38.236075] el0_svc_common.constprop.0+0x48/0xf0 +[ 38.236680] do_el0_svc+0x24/0x38 +[ 38.237113] el0_svc+0x38/0x168 +[ 38.237507] el0t_64_sync_handler+0xa0/0xe8 +[ 38.238034] el0t_64_sync+0x198/0x1a0 +[ 38.238491] ---[ end trace 0000000000000000 ]--- + +There were discussions in [1] at the end of 2023 that mmap() on imported +dma-bufs should not be supported but as of v6.17 drm_gem_shmem_mmap() in +drm_gem_shmem_helper.c still supports it. +This might affect all gpu or accel drivers using drm_gem_shmem_mmap() or +the wrapper drm_gem_shmem_object_mmap(). + +[1] https://lore.kernel.org/dri-devel/bc7f7844-0aa3-4802-b203-69d58e8be2fa@linux.intel.com/ + +Cc: stable@vger.kernel.org +Fixes: 5ba3f757f059 ("[media] v4l: videobuf2: add DMA scatter/gather allocator") +Signed-off-by: Janne Grunau +Acked-by: Marek Szyprowski +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c ++++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c +@@ -345,6 +345,7 @@ static int vb2_dma_sg_mmap(void *buf_pri + return err; + } + ++ vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP); + /* + * Use common vm_area operations to track buffer refcount. + */ diff --git a/queue-6.12/regulator-act8945a-fix-of-node-reference-imbalance.patch b/queue-6.12/regulator-act8945a-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..8b48bff340 --- /dev/null +++ b/queue-6.12/regulator-act8945a-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 0d15ce31375ccef4162f960b34547a821b7619d2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:54 +0200 +Subject: regulator: act8945a: fix OF node reference imbalance + +From: Johan Hovold + +commit 0d15ce31375ccef4162f960b34547a821b7619d2 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 38c09961048b ("regulator: act8945a: add regulator driver for ACT8945A") +Cc: stable@vger.kernel.org # 4.6 +Cc: Wenyou Yang +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-7-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/act8945a-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/act8945a-regulator.c ++++ b/drivers/regulator/act8945a-regulator.c +@@ -302,8 +302,9 @@ static int act8945a_pmic_probe(struct pl + num_regulators = ARRAY_SIZE(act8945a_regulators); + } + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = act8945a; + for (i = 0; i < num_regulators; i++) { + rdev = devm_regulator_register(&pdev->dev, ®ulators[i], diff --git a/queue-6.12/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch b/queue-6.12/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..94d8125ce9 --- /dev/null +++ b/queue-6.12/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 8498100ee1d00422b8c5b161b3e332278b92a59a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:55 +0200 +Subject: regulator: bd9571mwv: fix OF node reference imbalance + +From: Johan Hovold + +commit 8498100ee1d00422b8c5b161b3e332278b92a59a upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: e85c5a153fe2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver") +Cc: stable@vger.kernel.org # 4.12 +Cc: Marek Vasut +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-8-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/bd9571mwv-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/bd9571mwv-regulator.c ++++ b/drivers/regulator/bd9571mwv-regulator.c +@@ -287,8 +287,9 @@ static int bd9571mwv_regulator_probe(str + + platform_set_drvdata(pdev, bdreg); + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = bdreg; + config.regmap = bdreg->regmap; + diff --git a/queue-6.12/regulator-max77650-fix-of-node-reference-imbalance.patch b/queue-6.12/regulator-max77650-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..0e378bca7f --- /dev/null +++ b/queue-6.12/regulator-max77650-fix-of-node-reference-imbalance.patch @@ -0,0 +1,38 @@ +From 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:51 +0200 +Subject: regulator: max77650: fix OF node reference imbalance + +From: Johan Hovold + +commit 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: bcc61f1c44fd ("regulator: max77650: add regulator support") +Cc: stable@vger.kernel.org # 5.1 +Reviewed-by: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/max77650-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/max77650-regulator.c ++++ b/drivers/regulator/max77650-regulator.c +@@ -337,7 +337,7 @@ static int max77650_regulator_probe(stru + parent = dev->parent; + + if (!dev->of_node) +- dev->of_node = parent->of_node; ++ device_set_of_node_from_dev(dev, parent); + + rdescs = devm_kcalloc(dev, MAX77650_REGULATOR_NUM_REGULATORS, + sizeof(*rdescs), GFP_KERNEL); diff --git a/queue-6.12/regulator-mt6357-fix-of-node-reference-imbalance.patch b/queue-6.12/regulator-mt6357-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..d32f2f7ad9 --- /dev/null +++ b/queue-6.12/regulator-mt6357-fix-of-node-reference-imbalance.patch @@ -0,0 +1,37 @@ +From 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:52 +0200 +Subject: regulator: mt6357: fix OF node reference imbalance + +From: Johan Hovold + +commit 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: dafc7cde23dc ("regulator: add mt6357 regulator") +Cc: stable@vger.kernel.org # 6.2 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-5-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/mt6357-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/mt6357-regulator.c ++++ b/drivers/regulator/mt6357-regulator.c +@@ -410,7 +410,7 @@ static int mt6357_regulator_probe(struct + struct regulator_dev *rdev; + int i; + +- pdev->dev.of_node = pdev->dev.parent->of_node; ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); + + for (i = 0; i < MT6357_MAX_REGULATOR; i++) { + config.dev = &pdev->dev; diff --git a/queue-6.12/regulator-rk808-fix-of-node-reference-imbalance.patch b/queue-6.12/regulator-rk808-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..3b767b975d --- /dev/null +++ b/queue-6.12/regulator-rk808-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 65290b24d8a5f0b8cd065201e653db824c4a4da6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:50 +0200 +Subject: regulator: rk808: fix OF node reference imbalance + +From: Johan Hovold + +commit 65290b24d8a5f0b8cd065201e653db824c4a4da6 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 647e57351f8e ("regulator: rk808: reduce 'struct rk808' usage") +Cc: stable@vger.kernel.org # 6.2 +Reviewed-by: Sebastian Reichel +Reviewed-by: Douglas Anderson +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/rk808-regulator.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/regulator/rk808-regulator.c ++++ b/drivers/regulator/rk808-regulator.c +@@ -1878,8 +1878,7 @@ static int rk808_regulator_probe(struct + struct regmap *regmap; + int ret, i, nregulators; + +- pdev->dev.of_node = pdev->dev.parent->of_node; +- pdev->dev.of_node_reused = true; ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); + + regmap = dev_get_regmap(pdev->dev.parent, NULL); + if (!regmap) diff --git a/queue-6.12/series b/queue-6.12/series index fe11e174df..7cf5e7af72 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1 +1,30 @@ ptrace-slightly-saner-get_dumpable-logic.patch +hid-playstation-clamp-num_touch_reports.patch +media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch +media-nxp-imx8-isi-reduce-minimum-queued-buffers-from-2-to-0.patch +media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch +media-chips-media-wave5-fix-a-potential-memory-leak-in-wave5_vdi_init.patch +media-chips-media-wave5-add-missing-spinlock-protection-for-send_eos_event.patch +media-chips-media-wave5-add-missing-spinlock-protection-for-handle_dynamic_resolution_change.patch +spi-bcm63xx-fix-controller-deregistration.patch +spi-atmel-fix-controller-deregistration.patch +arm64-dts-lx2160a-cex7-lx2162a-sr-som-fix-usd-cd-gpio-pinmux.patch +staging-media-atomisp-disallow-all-private-ioctls.patch +regulator-mt6357-fix-of-node-reference-imbalance.patch +spi-st-ssc4-fix-controller-deregistration.patch +regulator-max77650-fix-of-node-reference-imbalance.patch +media-rc-xbox_remote-heed-dma-restrictions.patch +media-rc-streamzap-error-handling-in-probe.patch +media-i2c-imx283-enter-full-standby-when-stopping-streaming.patch +regulator-rk808-fix-of-node-reference-imbalance.patch +media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch +media-intel-ipu6-fix-error-pointer-dereference.patch +media-i2c-imx283-fix-hang-when-going-from-large-to-small-resolution.patch +regulator-act8945a-fix-of-node-reference-imbalance.patch +regulator-bd9571mwv-fix-of-node-reference-imbalance.patch +spi-lantiq-ssc-fix-controller-deregistration.patch +spi-meson-spicc-fix-controller-deregistration.patch +spi-qup-fix-controller-deregistration.patch +spi-at91-usart-fix-controller-deregistration.patch +media-saa7164-add-ioremap-return-checks-and-cleanups.patch +spi-aspeed-smc-fix-controller-deregistration.patch diff --git a/queue-6.12/spi-aspeed-smc-fix-controller-deregistration.patch b/queue-6.12/spi-aspeed-smc-fix-controller-deregistration.patch new file mode 100644 index 0000000000..e469d933ad --- /dev/null +++ b/queue-6.12/spi-aspeed-smc-fix-controller-deregistration.patch @@ -0,0 +1,58 @@ +From 1044e5a4ccd57bf5a64f90100a321b498e0267a2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:01 +0200 +Subject: spi: aspeed-smc: fix controller deregistration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johan Hovold + +commit 1044e5a4ccd57bf5a64f90100a321b498e0267a2 upstream. + +Make sure to deregister the controller before disabling it to allow +SPI device drivers to do I/O during deregistration. + +Fixes: e3228ed92893 ("spi: spi-mem: Convert Aspeed SMC driver to spi-mem") +Cc: stable@vger.kernel.org # 5.19 +Cc: Cédric Le Goater +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-aspeed-smc.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-aspeed-smc.c ++++ b/drivers/spi/spi-aspeed-smc.c +@@ -733,7 +733,7 @@ static int aspeed_spi_probe(struct platf + return -ENOMEM; + + aspi = spi_controller_get_devdata(ctlr); +- platform_set_drvdata(pdev, aspi); ++ platform_set_drvdata(pdev, ctlr); + aspi->data = data; + aspi->dev = dev; + +@@ -772,7 +772,7 @@ static int aspeed_spi_probe(struct platf + ctlr->num_chipselect = data->max_cs; + ctlr->dev.of_node = dev->of_node; + +- ret = devm_spi_register_controller(dev, ctlr); ++ ret = spi_register_controller(ctlr); + if (ret) + dev_err(&pdev->dev, "spi_register_controller failed\n"); + +@@ -781,7 +781,10 @@ static int aspeed_spi_probe(struct platf + + static void aspeed_spi_remove(struct platform_device *pdev) + { +- struct aspeed_spi *aspi = platform_get_drvdata(pdev); ++ struct spi_controller *ctlr = platform_get_drvdata(pdev); ++ struct aspeed_spi *aspi = spi_controller_get_devdata(ctlr); ++ ++ spi_unregister_controller(ctlr); + + aspeed_spi_enable(aspi, false); + } diff --git a/queue-6.12/spi-at91-usart-fix-controller-deregistration.patch b/queue-6.12/spi-at91-usart-fix-controller-deregistration.patch new file mode 100644 index 0000000000..1b39beb5f4 --- /dev/null +++ b/queue-6.12/spi-at91-usart-fix-controller-deregistration.patch @@ -0,0 +1,49 @@ +From 9acecc9bcff058eaef40fd7a4c3650e88b06b220 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:02 +0200 +Subject: spi: at91-usart: fix controller deregistration + +From: Johan Hovold + +commit 9acecc9bcff058eaef40fd7a4c3650e88b06b220 upstream. + +Make sure to deregister the controller before disabling and releasing +underlying resources like clocks and DMA during driver unbind. + +Fixes: e1892546ff66 ("spi: at91-usart: Add driver for at91-usart as SPI") +Cc: stable@vger.kernel.org # 4.20 +Cc: Radu Pirea +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-at91-usart.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-at91-usart.c ++++ b/drivers/spi/spi-at91-usart.c +@@ -556,7 +556,7 @@ static int at91_usart_spi_probe(struct p + spin_lock_init(&aus->lock); + init_completion(&aus->xfer_completion); + +- ret = devm_spi_register_controller(&pdev->dev, controller); ++ ret = spi_register_controller(controller); + if (ret) + goto at91_usart_fail_register_controller; + +@@ -634,8 +634,14 @@ static void at91_usart_spi_remove(struct + struct spi_controller *ctlr = platform_get_drvdata(pdev); + struct at91_usart_spi *aus = spi_controller_get_devdata(ctlr); + ++ spi_controller_get(ctlr); ++ ++ spi_unregister_controller(ctlr); ++ + at91_usart_spi_release_dma(ctlr); + clk_disable_unprepare(aus->clk); ++ ++ spi_controller_put(ctlr); + } + + static const struct dev_pm_ops at91_usart_spi_pm_ops = { diff --git a/queue-6.12/spi-atmel-fix-controller-deregistration.patch b/queue-6.12/spi-atmel-fix-controller-deregistration.patch new file mode 100644 index 0000000000..66ecabe99f --- /dev/null +++ b/queue-6.12/spi-atmel-fix-controller-deregistration.patch @@ -0,0 +1,55 @@ +From 8d4de97e83520be89d0ff40610ca633b3963a7de Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:03 +0200 +Subject: spi: atmel: fix controller deregistration + +From: Johan Hovold + +commit 8d4de97e83520be89d0ff40610ca633b3963a7de upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 754ce4f29937 ("[PATCH] SPI: atmel_spi driver") +Cc: stable@vger.kernel.org # 2.6.21 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-5-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-atmel.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1640,7 +1640,7 @@ static int atmel_spi_probe(struct platfo + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) + goto out_free_dma; + +@@ -1672,8 +1672,12 @@ static void atmel_spi_remove(struct plat + struct spi_controller *host = platform_get_drvdata(pdev); + struct atmel_spi *as = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ + pm_runtime_get_sync(&pdev->dev); + ++ spi_unregister_controller(host); ++ + /* reset the hardware and block queue progress */ + if (as->use_dma) { + atmel_spi_stop_dma(host); +@@ -1698,6 +1702,8 @@ static void atmel_spi_remove(struct plat + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++ spi_controller_put(host); + } + + static int atmel_spi_runtime_suspend(struct device *dev) diff --git a/queue-6.12/spi-bcm63xx-fix-controller-deregistration.patch b/queue-6.12/spi-bcm63xx-fix-controller-deregistration.patch new file mode 100644 index 0000000000..756546b884 --- /dev/null +++ b/queue-6.12/spi-bcm63xx-fix-controller-deregistration.patch @@ -0,0 +1,52 @@ +From c39e65a4e3b8e764efed0b2f5152a1a8547b80fd Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:04 +0200 +Subject: spi: bcm63xx: fix controller deregistration + +From: Johan Hovold + +commit c39e65a4e3b8e764efed0b2f5152a1a8547b80fd upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") +Cc: stable@vger.kernel.org # 3.4 +Cc: Florian Fainelli +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-6-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm63xx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -603,7 +603,7 @@ static int bcm63xx_spi_probe(struct plat + goto out_clk_disable; + + /* register and we are done */ +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(dev, "spi register failed\n"); + goto out_clk_disable; +@@ -626,11 +626,17 @@ static void bcm63xx_spi_remove(struct pl + struct spi_controller *host = platform_get_drvdata(pdev); + struct bcm63xx_spi *bs = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + /* reset spi block */ + bcm_spi_writeb(bs, 0, SPI_INT_MASK); + + /* HW shutdown */ + clk_disable_unprepare(bs->clk); ++ ++ spi_controller_put(host); + } + + static int bcm63xx_spi_suspend(struct device *dev) diff --git a/queue-6.12/spi-lantiq-ssc-fix-controller-deregistration.patch b/queue-6.12/spi-lantiq-ssc-fix-controller-deregistration.patch new file mode 100644 index 0000000000..065704a8ae --- /dev/null +++ b/queue-6.12/spi-lantiq-ssc-fix-controller-deregistration.patch @@ -0,0 +1,54 @@ +From b99206710d032c16b7f8b75e4bc18414d8e4b9f4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:15 +0200 +Subject: spi: lantiq-ssc: fix controller deregistration + +From: Johan Hovold + +commit b99206710d032c16b7f8b75e4bc18414d8e4b9f4 upstream. + +Make sure to deregister the controller before releasing underlying +resources like clocks during driver unbind. + +Fixes: 17f84b793c01 ("spi: lantiq-ssc: add support for Lantiq SSC SPI controller") +Cc: stable@vger.kernel.org # 4.11 +Cc: Hauke Mehrtens +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-17-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-lantiq-ssc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-lantiq-ssc.c ++++ b/drivers/spi/spi-lantiq-ssc.c +@@ -995,7 +995,7 @@ static int lantiq_ssc_probe(struct platf + "Lantiq SSC SPI controller (Rev %i, TXFS %u, RXFS %u, DMA %u)\n", + revision, spi->tx_fifo_size, spi->rx_fifo_size, supports_dma); + +- err = devm_spi_register_controller(dev, host); ++ err = spi_register_controller(host); + if (err) { + dev_err(dev, "failed to register spi host\n"); + goto err_wq_destroy; +@@ -1017,6 +1017,10 @@ static void lantiq_ssc_remove(struct pla + { + struct lantiq_ssc_spi *spi = platform_get_drvdata(pdev); + ++ spi_controller_get(spi->host); ++ ++ spi_unregister_controller(spi->host); ++ + lantiq_ssc_writel(spi, 0, LTQ_SPI_IRNEN); + lantiq_ssc_writel(spi, 0, LTQ_SPI_CLC); + rx_fifo_flush(spi); +@@ -1025,6 +1029,8 @@ static void lantiq_ssc_remove(struct pla + + destroy_workqueue(spi->wq); + clk_put(spi->fpi_clk); ++ ++ spi_controller_put(spi->host); + } + + static struct platform_driver lantiq_ssc_driver = { diff --git a/queue-6.12/spi-meson-spicc-fix-controller-deregistration.patch b/queue-6.12/spi-meson-spicc-fix-controller-deregistration.patch new file mode 100644 index 0000000000..b8ca860a37 --- /dev/null +++ b/queue-6.12/spi-meson-spicc-fix-controller-deregistration.patch @@ -0,0 +1,49 @@ +From 77953c76bec9af4191f8692a10225dd816208718 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:16 +0200 +Subject: spi: meson-spicc: fix controller deregistration + +From: Johan Hovold + +commit 77953c76bec9af4191f8692a10225dd816208718 upstream. + +Make sure to deregister the controller before disabling it to allow SPI +device drivers to do I/O during deregistration. + +Fixes: 454fa271bc4e ("spi: Add Meson SPICC driver") +Cc: stable@vger.kernel.org # 4.13 +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-18-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-meson-spicc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -883,7 +883,7 @@ static int meson_spicc_probe(struct plat + } + } + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(&pdev->dev, "spi registration failed\n"); + goto out_host; +@@ -901,8 +901,14 @@ static void meson_spicc_remove(struct pl + { + struct meson_spicc_device *spicc = platform_get_drvdata(pdev); + ++ spi_controller_get(spicc->host); ++ ++ spi_unregister_controller(spicc->host); ++ + /* Disable SPI */ + writel(0, spicc->base + SPICC_CONREG); ++ ++ spi_controller_put(spicc->host); + } + + static const struct meson_spicc_data meson_spicc_gx_data = { diff --git a/queue-6.12/spi-qup-fix-controller-deregistration.patch b/queue-6.12/spi-qup-fix-controller-deregistration.patch new file mode 100644 index 0000000000..fed4880251 --- /dev/null +++ b/queue-6.12/spi-qup-fix-controller-deregistration.patch @@ -0,0 +1,53 @@ +From 443e3a0005a4342b218b6dbd4c6387d3c7fed85a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:39 +0200 +Subject: spi: qup: fix controller deregistration + +From: Johan Hovold + +commit 443e3a0005a4342b218b6dbd4c6387d3c7fed85a upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") +Cc: stable@vger.kernel.org # 3.15 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-10-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-qup.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1194,7 +1194,7 @@ static int spi_qup_probe(struct platform + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret) + goto disable_pm; + +@@ -1321,6 +1321,10 @@ static void spi_qup_remove(struct platfo + struct spi_qup *controller = spi_controller_get_devdata(host); + int ret; + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + ret = pm_runtime_get_sync(&pdev->dev); + + if (ret >= 0) { +@@ -1340,6 +1344,8 @@ static void spi_qup_remove(struct platfo + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++ spi_controller_put(host); + } + + static const struct of_device_id spi_qup_dt_match[] = { diff --git a/queue-6.12/spi-st-ssc4-fix-controller-deregistration.patch b/queue-6.12/spi-st-ssc4-fix-controller-deregistration.patch new file mode 100644 index 0000000000..c29d4d9013 --- /dev/null +++ b/queue-6.12/spi-st-ssc4-fix-controller-deregistration.patch @@ -0,0 +1,51 @@ +From 19857374010d06ca6a2f7c2c53464122eb804df0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:47 +0200 +Subject: spi: st-ssc4: fix controller deregistration + +From: Johan Hovold + +commit 19857374010d06ca6a2f7c2c53464122eb804df0 upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 9e862375c542 ("spi: Add new driver for STMicroelectronics' SPI Controller") +Cc: stable@vger.kernel.org # 4.0 +Cc: Lee Jones +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-18-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-st-ssc4.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-st-ssc4.c ++++ b/drivers/spi/spi-st-ssc4.c +@@ -349,7 +349,7 @@ static int spi_st_probe(struct platform_ + + platform_set_drvdata(pdev, host); + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(&pdev->dev, "Failed to register host\n"); + goto rpm_disable; +@@ -371,10 +371,16 @@ static void spi_st_remove(struct platfor + struct spi_controller *host = platform_get_drvdata(pdev); + struct spi_st *spi_st = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + pm_runtime_disable(&pdev->dev); + + clk_disable_unprepare(spi_st->clk); + ++ spi_controller_put(host); ++ + pinctrl_pm_select_sleep_state(&pdev->dev); + } + diff --git a/queue-6.12/staging-media-atomisp-disallow-all-private-ioctls.patch b/queue-6.12/staging-media-atomisp-disallow-all-private-ioctls.patch new file mode 100644 index 0000000000..5e4bb47b75 --- /dev/null +++ b/queue-6.12/staging-media-atomisp-disallow-all-private-ioctls.patch @@ -0,0 +1,39 @@ +From 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 26 Feb 2026 15:10:54 +0200 +Subject: staging: media: atomisp: Disallow all private IOCTLs + +From: Sakari Ailus + +commit 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c upstream. + +Disallow all private IOCTLs. These aren't quite as safe as one could +assume of IOCTL handlers; disable them for now. Instead of removing the +code, return in the beginning of the function if cmd is non-zero in order +to keep static checkers happy. + +Reported-by: Soufiane Dani +Closes: https://lore.kernel.org/linux-staging/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com/ +Cc: stable@vger.kernel.org +Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") +Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -1371,6 +1371,10 @@ static int atomisp_s_parm(struct file *f + static long atomisp_vidioc_default(struct file *file, void *fh, + bool valid_prio, unsigned int cmd, void *arg) + { ++ /* Disable all private IOCTLs for now! */ ++ if (cmd) ++ return -EINVAL; ++ + struct video_device *vdev = video_devdata(file); + struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd; + int err;