--- /dev/null
+From 74cc4f3ea4e99262ba0d619c6a4ee33e2cd47f65 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Date: Thu, 23 Oct 2025 11:24:26 +0100
+Subject: ASoC: qcom: q6adm: the the copp device only during last instance
+
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+
+commit 74cc4f3ea4e99262ba0d619c6a4ee33e2cd47f65 upstream.
+
+A matching Common object post processing instance is normally resused
+across multiple streams. However currently we close this on DSP
+even though there is a refcount on this copp object, this can result in
+below error.
+
+q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0
+qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2
+q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2]
+q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0
+qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2
+q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2]
+qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2
+qcom-q6adm aprsvc:service:4:8: DSP returned error[2]
+qcom-q6adm aprsvc:service:4:8: Failed to close copp -22
+qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2
+qcom-q6adm aprsvc:service:4:8: DSP returned error[2]
+qcom-q6adm aprsvc:service:4:8: Failed to close copp -22
+
+Fix this by addressing moving the adm_close to copp_kref destructor
+callback.
+
+Fixes: 7b20b2be51e1 ("ASoC: qdsp6: q6adm: Add q6adm driver")
+Cc: Stable@vger.kernel.org
+Reported-by: Martino Facchin <m.facchin@arduino.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # RB5, RB3
+Link: https://patch.msgid.link/20251023102444.88158-3-srinivas.kandagatla@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6adm.c | 146 ++++++++++++++++++++-----------------------
+ 1 file changed, 71 insertions(+), 75 deletions(-)
+
+--- a/sound/soc/qcom/qdsp6/q6adm.c
++++ b/sound/soc/qcom/qdsp6/q6adm.c
+@@ -109,11 +109,75 @@ static struct q6copp *q6adm_find_copp(st
+
+ }
+
++static int q6adm_apr_send_copp_pkt(struct q6adm *adm, struct q6copp *copp,
++ struct apr_pkt *pkt, uint32_t rsp_opcode)
++{
++ struct device *dev = adm->dev;
++ uint32_t opcode = pkt->hdr.opcode;
++ int ret;
++
++ mutex_lock(&adm->lock);
++ copp->result.opcode = 0;
++ copp->result.status = 0;
++ ret = apr_send_pkt(adm->apr, pkt);
++ if (ret < 0) {
++ dev_err(dev, "Failed to send APR packet\n");
++ ret = -EINVAL;
++ goto err;
++ }
++
++ /* Wait for the callback with copp id */
++ if (rsp_opcode)
++ ret = wait_event_timeout(copp->wait,
++ (copp->result.opcode == opcode) ||
++ (copp->result.opcode == rsp_opcode),
++ msecs_to_jiffies(TIMEOUT_MS));
++ else
++ ret = wait_event_timeout(copp->wait,
++ (copp->result.opcode == opcode),
++ msecs_to_jiffies(TIMEOUT_MS));
++
++ if (!ret) {
++ dev_err(dev, "ADM copp cmd timedout\n");
++ ret = -ETIMEDOUT;
++ } else if (copp->result.status > 0) {
++ dev_err(dev, "DSP returned error[%d]\n",
++ copp->result.status);
++ ret = -EINVAL;
++ }
++
++err:
++ mutex_unlock(&adm->lock);
++ return ret;
++}
++
++static int q6adm_device_close(struct q6adm *adm, struct q6copp *copp,
++ int port_id, int copp_idx)
++{
++ struct apr_pkt close;
++
++ close.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD,
++ APR_HDR_LEN(APR_HDR_SIZE),
++ APR_PKT_VER);
++ close.hdr.pkt_size = sizeof(close);
++ close.hdr.src_port = port_id;
++ close.hdr.dest_port = copp->id;
++ close.hdr.token = port_id << 16 | copp_idx;
++ close.hdr.opcode = ADM_CMD_DEVICE_CLOSE_V5;
++
++ return q6adm_apr_send_copp_pkt(adm, copp, &close, 0);
++}
++
+ static void q6adm_free_copp(struct kref *ref)
+ {
+ struct q6copp *c = container_of(ref, struct q6copp, refcount);
+ struct q6adm *adm = c->adm;
+ unsigned long flags;
++ int ret;
++
++ ret = q6adm_device_close(adm, c, c->afe_port, c->copp_idx);
++ if (ret < 0)
++ dev_err(adm->dev, "Failed to close copp %d\n", ret);
+
+ spin_lock_irqsave(&adm->copps_list_lock, flags);
+ clear_bit(c->copp_idx, &adm->copp_bitmap[c->afe_port]);
+@@ -155,13 +219,13 @@ static int q6adm_callback(struct apr_dev
+ switch (result->opcode) {
+ case ADM_CMD_DEVICE_OPEN_V5:
+ case ADM_CMD_DEVICE_CLOSE_V5:
+- copp = q6adm_find_copp(adm, port_idx, copp_idx);
+- if (!copp)
+- return 0;
+-
+- copp->result = *result;
+- wake_up(&copp->wait);
+- kref_put(&copp->refcount, q6adm_free_copp);
++ list_for_each_entry(copp, &adm->copps_list, node) {
++ if ((port_idx == copp->afe_port) && (copp_idx == copp->copp_idx)) {
++ copp->result = *result;
++ wake_up(&copp->wait);
++ break;
++ }
++ }
+ break;
+ case ADM_CMD_MATRIX_MAP_ROUTINGS_V5:
+ adm->result = *result;
+@@ -234,65 +298,6 @@ static struct q6copp *q6adm_alloc_copp(s
+ return c;
+ }
+
+-static int q6adm_apr_send_copp_pkt(struct q6adm *adm, struct q6copp *copp,
+- struct apr_pkt *pkt, uint32_t rsp_opcode)
+-{
+- struct device *dev = adm->dev;
+- uint32_t opcode = pkt->hdr.opcode;
+- int ret;
+-
+- mutex_lock(&adm->lock);
+- copp->result.opcode = 0;
+- copp->result.status = 0;
+- ret = apr_send_pkt(adm->apr, pkt);
+- if (ret < 0) {
+- dev_err(dev, "Failed to send APR packet\n");
+- ret = -EINVAL;
+- goto err;
+- }
+-
+- /* Wait for the callback with copp id */
+- if (rsp_opcode)
+- ret = wait_event_timeout(copp->wait,
+- (copp->result.opcode == opcode) ||
+- (copp->result.opcode == rsp_opcode),
+- msecs_to_jiffies(TIMEOUT_MS));
+- else
+- ret = wait_event_timeout(copp->wait,
+- (copp->result.opcode == opcode),
+- msecs_to_jiffies(TIMEOUT_MS));
+-
+- if (!ret) {
+- dev_err(dev, "ADM copp cmd timedout\n");
+- ret = -ETIMEDOUT;
+- } else if (copp->result.status > 0) {
+- dev_err(dev, "DSP returned error[%d]\n",
+- copp->result.status);
+- ret = -EINVAL;
+- }
+-
+-err:
+- mutex_unlock(&adm->lock);
+- return ret;
+-}
+-
+-static int q6adm_device_close(struct q6adm *adm, struct q6copp *copp,
+- int port_id, int copp_idx)
+-{
+- struct apr_pkt close;
+-
+- close.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD,
+- APR_HDR_LEN(APR_HDR_SIZE),
+- APR_PKT_VER);
+- close.hdr.pkt_size = sizeof(close);
+- close.hdr.src_port = port_id;
+- close.hdr.dest_port = copp->id;
+- close.hdr.token = port_id << 16 | copp_idx;
+- close.hdr.opcode = ADM_CMD_DEVICE_CLOSE_V5;
+-
+- return q6adm_apr_send_copp_pkt(adm, copp, &close, 0);
+-}
+-
+ static struct q6copp *q6adm_find_matching_copp(struct q6adm *adm,
+ int port_id, int topology,
+ int mode, int rate,
+@@ -567,15 +572,6 @@ EXPORT_SYMBOL_GPL(q6adm_matrix_map);
+ */
+ int q6adm_close(struct device *dev, struct q6copp *copp)
+ {
+- struct q6adm *adm = dev_get_drvdata(dev->parent);
+- int ret = 0;
+-
+- ret = q6adm_device_close(adm, copp, copp->afe_port, copp->copp_idx);
+- if (ret < 0) {
+- dev_err(adm->dev, "Failed to close copp %d\n", ret);
+- return ret;
+- }
+-
+ kref_put(&copp->refcount, q6adm_free_copp);
+
+ return 0;
--- /dev/null
+From bfbb12dfa144d45575bcfe139a71360b3ce80237 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Date: Thu, 23 Oct 2025 11:24:28 +0100
+Subject: ASoC: qcom: q6asm-dai: perform correct state check before closing
+
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+
+commit bfbb12dfa144d45575bcfe139a71360b3ce80237 upstream.
+
+Do not stop a q6asm stream if its not started, this can result in
+unnecessary dsp command which will timeout anyway something like below:
+
+q6asm-dai ab00000.remoteproc:glink-edge:apr:service@7:dais: CMD 10bcd timeout
+
+Fix this by correctly checking the state.
+
+Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver")
+Cc: Stable@vger.kernel.org
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # RB5, RB3
+Link: https://patch.msgid.link/20251023102444.88158-5-srinivas.kandagatla@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6asm-dai.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
+@@ -237,13 +237,14 @@ static int q6asm_dai_prepare(struct snd_
+ prtd->pcm_count = snd_pcm_lib_period_bytes(substream);
+ prtd->pcm_irq_pos = 0;
+ /* rate and channels are sent to audio driver */
+- if (prtd->state) {
++ if (prtd->state == Q6ASM_STREAM_RUNNING) {
+ /* clear the previous setup if any */
+ q6asm_cmd(prtd->audio_client, prtd->stream_id, CMD_CLOSE);
+ q6asm_unmap_memory_regions(substream->stream,
+ prtd->audio_client);
+ q6routing_stream_close(soc_prtd->dai_link->id,
+ substream->stream);
++ prtd->state = Q6ASM_STREAM_STOPPED;
+ }
+
+ ret = q6asm_map_memory_regions(substream->stream, prtd->audio_client,
--- /dev/null
+From 81c53b52de21b8d5a3de55ebd06b6bf188bf7efd Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Date: Thu, 23 Oct 2025 11:24:27 +0100
+Subject: ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
+
+From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+
+commit 81c53b52de21b8d5a3de55ebd06b6bf188bf7efd upstream.
+
+DSP expects the periods to be aligned to fragment sizes, currently
+setting up to hw constriants on periods bytes is not going to work
+correctly as we can endup with periods sizes aligned to 32 bytes however
+not aligned to fragment size.
+
+Update the constriants to use fragment size, and also set at step of
+10ms for period size to accommodate DSP requirements of 10ms latency.
+
+Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver")
+Cc: Stable@vger.kernel.org
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # RB5, RB3
+Link: https://patch.msgid.link/20251023102444.88158-4-srinivas.kandagatla@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6asm-dai.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
+@@ -413,13 +413,13 @@ static int q6asm_dai_open(struct snd_soc
+ }
+
+ ret = snd_pcm_hw_constraint_step(runtime, 0,
+- SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 32);
++ SNDRV_PCM_HW_PARAM_PERIOD_SIZE, 480);
+ if (ret < 0) {
+ dev_err(dev, "constraint for period bytes step ret = %d\n",
+ ret);
+ }
+ ret = snd_pcm_hw_constraint_step(runtime, 0,
+- SNDRV_PCM_HW_PARAM_BUFFER_BYTES, 32);
++ SNDRV_PCM_HW_PARAM_BUFFER_SIZE, 480);
+ if (ret < 0) {
+ dev_err(dev, "constraint for buffer bytes step ret = %d\n",
+ ret);
--- /dev/null
+From e26ff429eaf10c4ef1bc3dabd9bf27eb54b7e1f4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 24 Nov 2025 11:49:05 +0100
+Subject: ASoC: stm32: sai: fix device leak on probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit e26ff429eaf10c4ef1bc3dabd9bf27eb54b7e1f4 upstream.
+
+Make sure to drop the reference taken when looking up the sync provider
+device and its driver data during DAI probe on probe failures and on
+unbind.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: 7dd0d835582f ("ASoC: stm32: sai: simplify sync modes management")
+Fixes: 1c3816a19487 ("ASoC: stm32: sai: add missing put_device()")
+Cc: stable@vger.kernel.org # 4.16: 1c3816a19487
+Cc: olivier moysan <olivier.moysan@st.com>
+Cc: Wen Yang <yellowriver2010@hotmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: olivier moysan <olivier.moysan@foss.st.com>
+Link: https://patch.msgid.link/20251124104908.15754-2-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/stm/stm32_sai.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/stm/stm32_sai.c
++++ b/sound/soc/stm/stm32_sai.c
+@@ -127,6 +127,7 @@ static int stm32_sai_set_sync(struct stm
+ }
+
+ sai_provider = platform_get_drvdata(pdev);
++ put_device(&pdev->dev);
+ if (!sai_provider) {
+ dev_err(&sai_client->pdev->dev,
+ "SAI sync provider data not found\n");
+@@ -143,7 +144,6 @@ static int stm32_sai_set_sync(struct stm
+ ret = stm32_sai_sync_conf_provider(sai_provider, synco);
+
+ error:
+- put_device(&pdev->dev);
+ of_node_put(np_provider);
+ return ret;
+ }
--- /dev/null
+From ca389a55d8b2d86a817433bf82e0602b68c4d541 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Date: Sat, 8 Nov 2025 22:03:18 +0100
+Subject: HID: logitech-dj: Remove duplicate error logging
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+commit ca389a55d8b2d86a817433bf82e0602b68c4d541 upstream.
+
+logi_dj_recv_query_paired_devices() and logi_dj_recv_switch_to_dj_mode()
+both have 2 callers which all log an error if the function fails. Move
+the error logging to inside these 2 functions to remove the duplicated
+error logging in the callers.
+
+While at it also move the logi_dj_recv_send_report() call error handling
+in logi_dj_recv_switch_to_dj_mode() to directly after the call. That call
+only fails if the report cannot be found and in that case it does nothing,
+so the msleep() is not necessary on failures.
+
+Fixes: 6f20d3261265 ("HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-logitech-dj.c | 56 +++++++++++++++++-------------------------
+ 1 file changed, 23 insertions(+), 33 deletions(-)
+
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -755,7 +755,6 @@ static void delayedwork_callback(struct
+ struct dj_workitem workitem;
+ unsigned long flags;
+ int count;
+- int retval;
+
+ dbg_hid("%s\n", __func__);
+
+@@ -792,11 +791,7 @@ static void delayedwork_callback(struct
+ logi_dj_recv_destroy_djhid_device(djrcv_dev, &workitem);
+ break;
+ case WORKITEM_TYPE_UNKNOWN:
+- retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+- if (retval) {
+- hid_err(djrcv_dev->hidpp, "%s: logi_dj_recv_query_paired_devices error: %d\n",
+- __func__, retval);
+- }
++ logi_dj_recv_query_paired_devices(djrcv_dev);
+ break;
+ case WORKITEM_TYPE_EMPTY:
+ dbg_hid("%s: device list is empty\n", __func__);
+@@ -1173,8 +1168,10 @@ static int logi_dj_recv_query_paired_dev
+
+ djrcv_dev->last_query = jiffies;
+
+- if (djrcv_dev->type != recvr_type_dj)
+- return logi_dj_recv_query_hidpp_devices(djrcv_dev);
++ if (djrcv_dev->type != recvr_type_dj) {
++ retval = logi_dj_recv_query_hidpp_devices(djrcv_dev);
++ goto out;
++ }
+
+ dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
+ if (!dj_report)
+@@ -1184,6 +1181,10 @@ static int logi_dj_recv_query_paired_dev
+ dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
+ retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
+ kfree(dj_report);
++out:
++ if (retval < 0)
++ hid_err(djrcv_dev->hidpp, "%s error:%d\n", __func__, retval);
++
+ return retval;
+ }
+
+@@ -1209,6 +1210,8 @@ static int logi_dj_recv_switch_to_dj_mod
+ (u8)timeout;
+
+ retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
++ if (retval)
++ goto out;
+
+ /*
+ * Ugly sleep to work around a USB 3.0 bug when the receiver is
+@@ -1217,11 +1220,6 @@ static int logi_dj_recv_switch_to_dj_mod
+ * 50 msec should gives enough time to the receiver to be ready.
+ */
+ msleep(50);
+-
+- if (retval) {
+- kfree(dj_report);
+- return retval;
+- }
+ }
+
+ /*
+@@ -1247,7 +1245,12 @@ static int logi_dj_recv_switch_to_dj_mod
+ HIDPP_REPORT_SHORT_LENGTH, HID_OUTPUT_REPORT,
+ HID_REQ_SET_REPORT);
+
++out:
+ kfree(dj_report);
++
++ if (retval < 0)
++ hid_err(hdev, "%s error:%d\n", __func__, retval);
++
+ return retval;
+ }
+
+@@ -1753,11 +1756,8 @@ static int logi_dj_probe(struct hid_devi
+
+ if (has_hidpp) {
+ retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
+- if (retval < 0) {
+- hid_err(hdev, "%s: logi_dj_recv_switch_to_dj_mode returned error:%d\n",
+- __func__, retval);
++ if (retval < 0)
+ goto switch_to_dj_mode_fail;
+- }
+ }
+
+ /* This is enabling the polling urb on the IN endpoint */
+@@ -1775,15 +1775,11 @@ static int logi_dj_probe(struct hid_devi
+ spin_lock_irqsave(&djrcv_dev->lock, flags);
+ djrcv_dev->ready = true;
+ spin_unlock_irqrestore(&djrcv_dev->lock, flags);
+- retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+- if (retval < 0) {
+- hid_err(hdev, "%s: logi_dj_recv_query_paired_devices error:%d\n",
+- __func__, retval);
+- /*
+- * This can happen with a KVM, let the probe succeed,
+- * logi_dj_recv_queue_unknown_work will retry later.
+- */
+- }
++ /*
++ * This can fail with a KVM. Ignore errors to let the probe
++ * succeed, logi_dj_recv_queue_unknown_work will retry later.
++ */
++ logi_dj_recv_query_paired_devices(djrcv_dev);
+ }
+
+ return 0;
+@@ -1800,18 +1796,12 @@ hid_hw_start_fail:
+ #ifdef CONFIG_PM
+ static int logi_dj_reset_resume(struct hid_device *hdev)
+ {
+- int retval;
+ struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
+
+ if (!djrcv_dev || djrcv_dev->hidpp != hdev)
+ return 0;
+
+- retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
+- if (retval < 0) {
+- hid_err(hdev, "%s: logi_dj_recv_switch_to_dj_mode returned error:%d\n",
+- __func__, retval);
+- }
+-
++ logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
+ return 0;
+ }
+ #endif
--- /dev/null
+From 05913cc43cb122f9afecdbe775115c058b906e1b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 20 Oct 2025 06:53:07 +0200
+Subject: iommu/exynos: fix device leak on of_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 05913cc43cb122f9afecdbe775115c058b906e1b upstream.
+
+Make sure to drop the reference taken to the iommu platform device when
+looking up its driver data during of_xlate().
+
+Note that commit 1a26044954a6 ("iommu/exynos: add missing put_device()
+call in exynos_iommu_of_xlate()") fixed the leak in a couple of error
+paths, but the reference is still leaking on success.
+
+Fixes: aa759fd376fb ("iommu/exynos: Add callback for initializing devices from device tree")
+Cc: stable@vger.kernel.org # 4.2: 1a26044954a6
+Cc: Yu Kuai <yukuai3@huawei.com>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/exynos-iommu.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/iommu/exynos-iommu.c
++++ b/drivers/iommu/exynos-iommu.c
+@@ -1299,17 +1299,14 @@ static int exynos_iommu_of_xlate(struct
+ return -ENODEV;
+
+ data = platform_get_drvdata(sysmmu);
+- if (!data) {
+- put_device(&sysmmu->dev);
++ put_device(&sysmmu->dev);
++ if (!data)
+ return -ENODEV;
+- }
+
+ if (!owner) {
+ owner = kzalloc(sizeof(*owner), GFP_KERNEL);
+- if (!owner) {
+- put_device(&sysmmu->dev);
++ if (!owner)
+ return -ENOMEM;
+- }
+
+ INIT_LIST_HEAD(&owner->controllers);
+ mutex_init(&owner->rpm_lock);
--- /dev/null
+From 80aa518452c4aceb9459f9a8e3184db657d1b441 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 20 Oct 2025 06:53:08 +0200
+Subject: iommu/ipmmu-vmsa: fix device leak on of_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 80aa518452c4aceb9459f9a8e3184db657d1b441 upstream.
+
+Make sure to drop the reference taken to the iommu platform device when
+looking up its driver data during of_xlate().
+
+Fixes: 7b2d59611fef ("iommu/ipmmu-vmsa: Replace local utlb code with fwspec ids")
+Cc: stable@vger.kernel.org # 4.14
+Cc: Magnus Damm <damm+renesas@opensource.se>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/ipmmu-vmsa.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -732,6 +732,8 @@ static int ipmmu_init_platform_device(st
+
+ dev_iommu_priv_set(dev, platform_get_drvdata(ipmmu_pdev));
+
++ put_device(&ipmmu_pdev->dev);
++
+ return 0;
+ }
+
--- /dev/null
+From b3f1ee18280363ef17f82b564fc379ceba9ec86f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 20 Oct 2025 06:53:09 +0200
+Subject: iommu/mediatek: fix device leak on of_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b3f1ee18280363ef17f82b564fc379ceba9ec86f upstream.
+
+Make sure to drop the reference taken to the iommu platform device when
+looking up its driver data during of_xlate().
+
+Fixes: 0df4fabe208d ("iommu/mediatek: Add mt8173 IOMMU driver")
+Cc: stable@vger.kernel.org # 4.6
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Yong Wu <yong.wu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/mtk_iommu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -526,6 +526,8 @@ static int mtk_iommu_of_xlate(struct dev
+ return -EINVAL;
+
+ dev_iommu_priv_set(dev, platform_get_drvdata(m4updev));
++
++ put_device(&m4updev->dev);
+ }
+
+ return iommu_fwspec_add_ids(dev, args->args, 1);
--- /dev/null
+From c77ad28bfee0df9cbc719eb5adc9864462cfb65b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 20 Oct 2025 06:53:12 +0200
+Subject: iommu/mediatek-v1: fix device leak on probe_device()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c77ad28bfee0df9cbc719eb5adc9864462cfb65b upstream.
+
+Make sure to drop the reference taken to the iommu platform device when
+looking up its driver data during probe_device().
+
+Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")
+Cc: stable@vger.kernel.org # 4.8
+Cc: Honghui Zhang <honghui.zhang@mediatek.com>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Yong Wu <yong.wu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/mtk_iommu_v1.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iommu/mtk_iommu_v1.c
++++ b/drivers/iommu/mtk_iommu_v1.c
+@@ -393,6 +393,8 @@ static int mtk_iommu_create_mapping(stru
+ return -EINVAL;
+
+ dev_iommu_priv_set(dev, platform_get_drvdata(m4updev));
++
++ put_device(&m4updev->dev);
+ }
+
+ ret = iommu_fwspec_add_ids(dev, args->args, 1);
--- /dev/null
+From b5870691065e6bbe6ba0650c0412636c6a239c5a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 20 Oct 2025 06:53:15 +0200
+Subject: iommu/omap: fix device leaks on probe_device()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b5870691065e6bbe6ba0650c0412636c6a239c5a upstream.
+
+Make sure to drop the references taken to the iommu platform devices
+when looking up their driver data during probe_device().
+
+Note that the arch data device pointer added by commit 604629bcb505
+("iommu/omap: add support for late attachment of iommu devices") has
+never been used. Remove it to underline that the references are not
+needed.
+
+Fixes: 9d5018deec86 ("iommu/omap: Add support to program multiple iommus")
+Fixes: 7d6827748d54 ("iommu/omap: Fix iommu archdata name for DT-based devices")
+Cc: stable@vger.kernel.org # 3.18
+Cc: Suman Anna <s-anna@ti.com>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/omap-iommu.c | 2 +-
+ drivers/iommu/omap-iommu.h | 2 --
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/iommu/omap-iommu.c
++++ b/drivers/iommu/omap-iommu.c
+@@ -1686,6 +1686,7 @@ static struct iommu_device *omap_iommu_p
+ }
+
+ oiommu = platform_get_drvdata(pdev);
++ put_device(&pdev->dev);
+ if (!oiommu) {
+ of_node_put(np);
+ kfree(arch_data);
+@@ -1693,7 +1694,6 @@ static struct iommu_device *omap_iommu_p
+ }
+
+ tmp->iommu_dev = oiommu;
+- tmp->dev = &pdev->dev;
+
+ of_node_put(np);
+ }
+--- a/drivers/iommu/omap-iommu.h
++++ b/drivers/iommu/omap-iommu.h
+@@ -88,7 +88,6 @@ struct omap_iommu {
+ /**
+ * struct omap_iommu_arch_data - omap iommu private data
+ * @iommu_dev: handle of the OMAP iommu device
+- * @dev: handle of the iommu device
+ *
+ * This is an omap iommu private data object, which binds an iommu user
+ * to its iommu device. This object should be placed at the iommu user's
+@@ -97,7 +96,6 @@ struct omap_iommu {
+ */
+ struct omap_iommu_arch_data {
+ struct omap_iommu *iommu_dev;
+- struct device *dev;
+ };
+
+ struct cr_regs {
--- /dev/null
+From f916109bf53864605d10bf6f4215afa023a80406 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 20 Oct 2025 06:53:17 +0200
+Subject: iommu/sun50i: fix device leak on of_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit f916109bf53864605d10bf6f4215afa023a80406 upstream.
+
+Make sure to drop the reference taken to the iommu platform device when
+looking up its driver data during of_xlate().
+
+Fixes: 4100b8c229b3 ("iommu: Add Allwinner H6 IOMMU driver")
+Cc: stable@vger.kernel.org # 5.8
+Cc: Maxime Ripard <mripard@kernel.org>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/sun50i-iommu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iommu/sun50i-iommu.c
++++ b/drivers/iommu/sun50i-iommu.c
+@@ -767,6 +767,8 @@ static int sun50i_iommu_of_xlate(struct
+
+ dev_iommu_priv_set(dev, platform_get_drvdata(iommu_pdev));
+
++ put_device(&iommu_pdev->dev);
++
+ return iommu_fwspec_add_ids(dev, &id, 1);
+ }
+
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- .../ftrace/test.d/ftrace/func_traceonoff_triggers.tc | 5 +++--
+ tools/testing/selftests/ftrace/test.d/ftrace/func_traceonoff_triggers.tc | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_traceonoff_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_traceonoff_triggers.tc
-index aee22289536b..1b57771dbfdf 100644
--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_traceonoff_triggers.tc
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_traceonoff_triggers.tc
@@ -90,9 +90,10 @@ if [ $on != "0" ]; then
if [ "$csum1" != "$csum2" ]; then
fail "Tracing file is still changing"
---
-2.51.0
-
rdma-bnxt_re-fix-to-use-correct-page-size-for-pde-ta.patch
rdma-bnxt_re-fix-dma_free_coherent-pointer.patch
selftests-ftrace-traceonoff_triggers-strip-off-names.patch
+asoc-stm32-sai-fix-device-leak-on-probe.patch
+asoc-qcom-q6asm-dai-perform-correct-state-check-before-closing.patch
+asoc-qcom-q6adm-the-the-copp-device-only-during-last-instance.patch
+asoc-qcom-qdsp6-q6asm-dai-set-10-ms-period-and-buffer-alignment.patch
+iommu-exynos-fix-device-leak-on-of_xlate.patch
+iommu-ipmmu-vmsa-fix-device-leak-on-of_xlate.patch
+iommu-mediatek-v1-fix-device-leak-on-probe_device.patch
+iommu-mediatek-fix-device-leak-on-of_xlate.patch
+iommu-omap-fix-device-leaks-on-probe_device.patch
+iommu-sun50i-fix-device-leak-on-of_xlate.patch
+hid-logitech-dj-remove-duplicate-error-logging.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
