--- /dev/null
+From ab00734bbf9dfebb0acd9c82438d03a3b314c7f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2026 18:17:11 +0200
+Subject: gpio: rockchip: change the GPIO version judgment logic
+
+From: Ye Zhang <ye.zhang@rock-chips.com>
+
+[ Upstream commit 41209307cad7f14c387c68375a93b50e54261a53 ]
+
+Have a list of valid IDs and default to -ENODEV.
+
+Signed-off-by: Ye Zhang <ye.zhang@rock-chips.com>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20241112015408.3139996-3-ye.zhang@rock-chips.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-rockchip.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c
+index 052713bd8d07a9..16c1ec3a5d0e79 100644
+--- a/drivers/gpio/gpio-rockchip.c
++++ b/drivers/gpio/gpio-rockchip.c
+@@ -653,8 +653,9 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank)
+
+ id = readl(bank->reg_base + gpio_regs_v2.version_id);
+
+- /* If not gpio v2, that is default to v1. */
+- if (id == GPIO_TYPE_V2 || id == GPIO_TYPE_V2_1) {
++ switch (id) {
++ case GPIO_TYPE_V2:
++ case GPIO_TYPE_V2_1:
+ bank->gpio_regs = &gpio_regs_v2;
+ bank->gpio_type = GPIO_TYPE_V2;
+ bank->db_clk = of_clk_get(bank->of_node, 1);
+@@ -662,9 +663,14 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank)
+ dev_err(bank->dev, "cannot find debounce clk\n");
+ return -EINVAL;
+ }
+- } else {
++ break;
++ case GPIO_TYPE_V1:
+ bank->gpio_regs = &gpio_regs_v1;
+ bank->gpio_type = GPIO_TYPE_V1;
++ break;
++ default:
++ dev_err(bank->dev, "unsupported version ID: 0x%08x\n", id);
++ return -ENODEV;
+ }
+
+ return 0;
+--
+2.53.0
+
--- /dev/null
+From 84ba2ad3aa4cc91f15f1037ecf8c606c2853f1f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2026 18:17:13 +0200
+Subject: gpio: rockchip: fix generic IRQ chip leak on remove
+
+From: Marco Scardovi <scardracs@disroot.org>
+
+[ Upstream commit 1c1e0fc88d6ef65bf15d517853251f75ab9d18c3 ]
+
+The driver allocates domain generic chips using
+irq_alloc_domain_generic_chips() during probe. However, on driver
+remove/teardown, the generic chips are not automatically freed when the
+IRQ domain is removed because the domain flags do not include
+IRQ_DOMAIN_FLAG_DESTROY_GC.
+
+This causes both the domain generic chips structure and the associated
+generic chips to be leaked. Additionally, the generic chips remain on
+the global gc_list and may later be visited by generic IRQ chip suspend,
+resume, or shutdown callbacks after the GPIO bank has been removed,
+potentially resulting in a use-after-free and kernel crash.
+
+Fix the resource leak by explicitly calling
+irq_domain_remove_generic_chips() before removing the IRQ domain in
+rockchip_gpio_remove().
+
+Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio")
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Marco Scardovi <scardracs@disroot.org>
+Link: https://patch.msgid.link/20260607230504.35392-2-scardracs@disroot.org
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-rockchip.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c
+index 0a93c74933f08b..9c419625c75332 100644
+--- a/drivers/gpio/gpio-rockchip.c
++++ b/drivers/gpio/gpio-rockchip.c
+@@ -792,8 +792,10 @@ static void rockchip_gpio_remove(struct platform_device *pdev)
+ struct rockchip_pin_bank *bank = platform_get_drvdata(pdev);
+
+ irq_set_chained_handler_and_data(bank->irq, NULL, NULL);
+- if (bank->domain)
++ if (bank->domain) {
++ irq_domain_remove_generic_chips(bank->domain);
+ irq_domain_remove(bank->domain);
++ }
+ gpiochip_remove(&bank->gpio_chip);
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 2b18fefdaf377798182b7ae970fc118200fef0c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2026 18:17:12 +0200
+Subject: gpio: rockchip: teardown bugs and resource leaks
+
+From: Marco Scardovi <scardracs@disroot.org>
+
+[ Upstream commit 9500077678230e36d22bf16d2b9539c13e59a801 ]
+
+Address several teardown issues and resource leaks in the driver's remove
+path and error handling:
+
+1. Debounce clock reference leak: The debounce clock (bank->db_clk) is
+ obtained using of_clk_get() which increments the clock's reference
+ count, but clk_put() is never called. Register a devm action to
+ cleanly release it on unbind. Note that of_clk_get(..., 1) remains
+ necessary over devm_clk_get() because the DT binding does not define
+ clock-names, precluding name-based lookup.
+
+2. Unregistered chained IRQ handler: The chained IRQ handler is not
+ disconnected in remove(). If a stray interrupt fires after the driver
+ is removed, the kernel attempts to execute a stale handler, leading
+ to a panic. Fix this by clearing the handler in remove().
+
+3. IRQ domain leak: The linear IRQ domain and its generic chips are
+ allocated manually during probe but never removed. Remove the IRQ
+ domain during driver teardown to free the associated generic chips
+ and mappings.
+
+Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio")
+Assisted-by: Antigravity:gemini-3.5-flash
+Signed-off-by: Marco Scardovi <scardracs@disroot.org>
+Link: https://patch.msgid.link/20260526171050.12785-3-scardracs@disroot.org
+[Bartosz: don't emit an error message on devres allocation failure]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-rockchip.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-rockchip.c b/drivers/gpio/gpio-rockchip.c
+index 16c1ec3a5d0e79..0a93c74933f08b 100644
+--- a/drivers/gpio/gpio-rockchip.c
++++ b/drivers/gpio/gpio-rockchip.c
+@@ -629,10 +629,17 @@ static int rockchip_gpiolib_register(struct rockchip_pin_bank *bank)
+ return ret;
+ }
+
++static void rockchip_clk_put(void *data)
++{
++ struct clk *clk = data;
++
++ clk_put(clk);
++}
++
+ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank)
+ {
+ struct resource res;
+- int id = 0;
++ int id = 0, ret;
+
+ if (of_address_to_resource(bank->of_node, 0, &res)) {
+ dev_err(bank->dev, "cannot find IO resource for bank\n");
+@@ -663,6 +670,11 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank)
+ dev_err(bank->dev, "cannot find debounce clk\n");
+ return -EINVAL;
+ }
++
++ ret = devm_add_action_or_reset(bank->dev, rockchip_clk_put,
++ bank->db_clk);
++ if (ret)
++ return ret;
+ break;
+ case GPIO_TYPE_V1:
+ bank->gpio_regs = &gpio_regs_v1;
+@@ -779,6 +791,9 @@ static void rockchip_gpio_remove(struct platform_device *pdev)
+ {
+ struct rockchip_pin_bank *bank = platform_get_drvdata(pdev);
+
++ irq_set_chained_handler_and_data(bank->irq, NULL, NULL);
++ if (bank->domain)
++ irq_domain_remove(bank->domain);
+ gpiochip_remove(&bank->gpio_chip);
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 5b043580879cadfce56b2c61e0a7e54b1eae80af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 May 2026 15:10:50 -0400
+Subject: mm/vmalloc: take vmap_purge_lock in shrinker
+
+From: Uladzislau Rezki (Sony) <urezki@gmail.com>
+
+[ Upstream commit ec05f51f1e65bce95528543eb73fda56fd201d94 ]
+
+decay_va_pool_node() can be invoked concurrently from two paths:
+__purge_vmap_area_lazy() when pools are being purged, and the shrinker via
+vmap_node_shrink_scan().
+
+However, decay_va_pool_node() is not safe to run concurrently, and the
+shrinker path currently lacks serialization, leading to races and possible
+leaks.
+
+Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker
+path to ensure serialization with purge users.
+
+Link: https://lore.kernel.org/20260413192646.14683-1-urezki@gmail.com
+Fixes: 7679ba6b36db ("mm: vmalloc: add a shrinker to drain vmap pools")
+Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Reviewed-by: Baoquan He <baoquan.he@linux.dev>
+Cc: chenyichong <chenyichong@uniontech.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+[ kept index-based loop instead of for_each_vmap_node() helper ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/vmalloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 1d2262fb541850..d4a42980b4d028 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -5204,6 +5204,7 @@ vmap_node_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ {
+ int i;
+
++ guard(mutex)(&vmap_purge_lock);
+ for (i = 0; i < nr_vmap_nodes; i++)
+ decay_va_pool_node(&vmap_nodes[i], true);
+
+--
+2.53.0
+
perf-fix-dangling-cgroup-pointer-in-cpuctx-backport.patch
bcachefs-avoid-truncating-fiemap-extent-length.patch
drm-amd-fix-set-but-not-used-warnings.patch
+gpio-rockchip-change-the-gpio-version-judgment-logic.patch
+gpio-rockchip-teardown-bugs-and-resource-leaks.patch
+gpio-rockchip-fix-generic-irq-chip-leak-on-remove.patch
+mm-vmalloc-take-vmap_purge_lock-in-shrinker.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
