--- /dev/null
+From 76cba1e60b69c9cd53b9127d017a7dc5945455b1 Mon Sep 17 00:00:00 2001
+From: Janne Grunau <j@jannau.net>
+Date: Wed, 31 Dec 2025 13:34:59 +0100
+Subject: dmaengine: apple-admac: Add "apple,t8103-admac" compatible
+
+From: Janne Grunau <j@jannau.net>
+
+commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream.
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,admac" anymore [1]. Use
+"apple,t8103-admac" as base compatible as it is the SoC the driver and
+bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://patch.msgid.link/20251231-apple-admac-t8103-base-compat-v1-1-ec24a3708f76@jannau.net
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/apple-admac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/dma/apple-admac.c
++++ b/drivers/dma/apple-admac.c
+@@ -936,6 +936,7 @@ static void admac_remove(struct platform
+ }
+
+ static const struct of_device_id admac_of_match[] = {
++ { .compatible = "apple,t8103-admac", },
+ { .compatible = "apple,admac", },
+ { }
+ };
--- /dev/null
+From b9074b2d7a230b6e28caa23165e9d8bc0677d333 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:43 +0100
+Subject: dmaengine: at_hdmac: fix device leak on of_dma_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
+
+Make sure to drop the reference taken when looking up the DMA platform
+device during of_dma_xlate() when releasing channel resources.
+
+Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing
+put_device() call in at_dma_xlate()") fixed the leak in a couple of
+error paths but the reference is still leaking on successful allocation.
+
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()")
+Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_hdmac.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1765,6 +1765,7 @@ static int atc_alloc_chan_resources(stru
+ static void atc_free_chan_resources(struct dma_chan *chan)
+ {
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
++ struct at_dma_slave *atslave;
+
+ BUG_ON(atc_chan_is_enabled(atchan));
+
+@@ -1774,8 +1775,12 @@ static void atc_free_chan_resources(stru
+ /*
+ * Free atslave allocated in at_dma_xlate()
+ */
+- kfree(chan->private);
+- chan->private = NULL;
++ atslave = chan->private;
++ if (atslave) {
++ put_device(atslave->dma_dev);
++ kfree(atslave);
++ chan->private = NULL;
++ }
+
+ dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
--- /dev/null
+From 7c3a46ebf15a9796b763a54272407fdbf945bed8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:45 +0100
+Subject: dmaengine: bcm-sba-raid: fix device leak on probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
+
+Make sure to drop the reference taken when looking up the mailbox device
+during probe on probe failures and on driver unbind.
+
+Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver")
+Cc: stable@vger.kernel.org # 4.13
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/bcm-sba-raid.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm-sba-raid.c
++++ b/drivers/dma/bcm-sba-raid.c
+@@ -1699,7 +1699,7 @@ static int sba_probe(struct platform_dev
+ /* Prealloc channel resource */
+ ret = sba_prealloc_channel_resources(sba);
+ if (ret)
+- goto fail_free_mchan;
++ goto fail_put_mbox;
+
+ /* Check availability of debugfs */
+ if (!debugfs_initialized())
+@@ -1729,6 +1729,8 @@ skip_debugfs:
+ fail_free_resources:
+ debugfs_remove_recursive(sba->root);
+ sba_freeup_channel_resources(sba);
++fail_put_mbox:
++ put_device(sba->mbox_dev);
+ fail_free_mchan:
+ mbox_free_channel(sba->mchan);
+ return ret;
+@@ -1744,6 +1746,8 @@ static void sba_remove(struct platform_d
+
+ sba_freeup_channel_resources(sba);
+
++ put_device(sba->mbox_dev);
++
+ mbox_free_channel(sba->mchan);
+ }
+
--- /dev/null
+From 7bb7d696e0361bbfc1411462c784998cca0afcbb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:46 +0100
+Subject: dmaengine: cv1800b-dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7bb7d696e0361bbfc1411462c784998cca0afcbb upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: db7d07b5add4 ("dmaengine: add driver for Sophgo CV18XX/SG200X dmamux")
+Cc: stable@vger.kernel.org # 6.17
+Cc: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-5-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/cv1800b-dmamux.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/dma/cv1800b-dmamux.c b/drivers/dma/cv1800b-dmamux.c
+index e900d6595617..f7a952fcbc7d 100644
+--- a/drivers/dma/cv1800b-dmamux.c
++++ b/drivers/dma/cv1800b-dmamux.c
+@@ -102,11 +102,11 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec,
+ struct llist_node *node;
+ unsigned long flags;
+ unsigned int chid, devid, cpuid;
+- int ret;
++ int ret = -EINVAL;
+
+ if (dma_spec->args_count != DMAMUX_NCELLS) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ devid = dma_spec->args[0];
+@@ -115,18 +115,18 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec,
+
+ if (devid > MAX_DMA_MAPPING_ID) {
+ dev_err(&pdev->dev, "invalid device id: %u\n", devid);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (cpuid > MAX_DMA_CPU_ID) {
+ dev_err(&pdev->dev, "invalid cpu id: %u\n", cpuid);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+@@ -136,8 +136,6 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec,
+ if (map->peripheral == devid && map->cpu == cpuid)
+ goto found;
+ }
+-
+- ret = -EINVAL;
+ goto failed;
+ } else {
+ node = llist_del_first(&dmamux->free_maps);
+@@ -171,12 +169,17 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec,
+ dev_dbg(&pdev->dev, "register channel %u for req %u (cpu %u)\n",
+ chid, devid, cpuid);
+
++ put_device(&pdev->dev);
++
+ return map;
+
+ failed:
+ spin_unlock_irqrestore(&dmamux->lock, flags);
+ of_node_put(dma_spec->np);
+ dev_err(&pdev->dev, "errno %d\n", ret);
++err_put_pdev:
++ put_device(&pdev->dev);
++
+ return ERR_PTR(ret);
+ }
+
+--
+2.52.0
+
--- /dev/null
+From ec25e60f9f95464aa11411db31d0906b3fb7b9f2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:47 +0100
+Subject: dmaengine: dw: dmamux: fix OF node leak on route allocation failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream.
+
+Make sure to drop the reference taken to the DMA master OF node also on
+late route allocation failures.
+
+Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support")
+Cc: stable@vger.kernel.org # 5.19
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20251117161258.10679-6-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dw/rzn1-dmamux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dw/rzn1-dmamux.c
++++ b/drivers/dma/dw/rzn1-dmamux.c
+@@ -90,7 +90,7 @@ static void *rzn1_dmamux_route_allocate(
+
+ if (test_and_set_bit(map->req_idx, dmamux->used_chans)) {
+ ret = -EBUSY;
+- goto free_map;
++ goto put_dma_spec_np;
+ }
+
+ mask = BIT(map->req_idx);
+@@ -103,6 +103,8 @@ static void *rzn1_dmamux_route_allocate(
+
+ clear_bitmap:
+ clear_bit(map->req_idx, dmamux->used_chans);
++put_dma_spec_np:
++ of_node_put(dma_spec->np);
+ free_map:
+ kfree(map);
+ put_device:
--- /dev/null
+From b18cd8b210417f90537d914ffb96e390c85a7379 Mon Sep 17 00:00:00 2001
+From: Zhen Ni <zhen.ni@easystack.cn>
+Date: Tue, 14 Oct 2025 17:05:22 +0800
+Subject: dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+commit b18cd8b210417f90537d914ffb96e390c85a7379 upstream.
+
+When fsl_edma_alloc_chan_resources() fails after clk_prepare_enable(),
+the error paths only free IRQs and destroy the TCD pool, but forget to
+call clk_disable_unprepare(). This causes the channel clock to remain
+enabled, leaking power and resources.
+
+Fix it by disabling the channel clock in the error unwind path.
+
+Fixes: d8d4355861d8 ("dmaengine: fsl-edma: add i.MX8ULP edma support")
+Cc: stable@vger.kernel.org
+Suggested-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20251014090522.827726-1-zhen.ni@easystack.cn
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/fsl-edma-common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/dma/fsl-edma-common.c
++++ b/drivers/dma/fsl-edma-common.c
+@@ -852,6 +852,7 @@ err_errirq:
+ free_irq(fsl_chan->txirq, fsl_chan);
+ err_txirq:
+ dma_pool_destroy(fsl_chan->tcd_pool);
++ clk_disable_unprepare(fsl_chan->clk);
+
+ return ret;
+ }
--- /dev/null
+From 799900f01792cf8b525a44764f065f83fcafd468 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:48 +0100
+Subject: dmaengine: idxd: fix device leaks on compat bind and unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 799900f01792cf8b525a44764f065f83fcafd468 upstream.
+
+Make sure to drop the reference taken when looking up the idxd device as
+part of the compat bind and unbind sysfs interface.
+
+Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")
+Cc: stable@vger.kernel.org # 5.15
+Cc: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/compat.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma/idxd/compat.c
++++ b/drivers/dma/idxd/compat.c
+@@ -20,11 +20,16 @@ static ssize_t unbind_store(struct devic
+ int rc = -ENODEV;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+- if (dev && dev->driver) {
++ if (!dev)
++ return -ENODEV;
++
++ if (dev->driver) {
+ device_driver_detach(dev);
+ rc = count;
+ }
+
++ put_device(dev);
++
+ return rc;
+ }
+ static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
+@@ -38,9 +43,12 @@ static ssize_t bind_store(struct device_
+ struct idxd_dev *idxd_dev;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+- if (!dev || dev->driver || drv != &dsa_drv.drv)
++ if (!dev)
+ return -ENODEV;
+
++ if (dev->driver || drv != &dsa_drv.drv)
++ goto err_put_dev;
++
+ idxd_dev = confdev_to_idxd_dev(dev);
+ if (is_idxd_dev(idxd_dev)) {
+ alt_drv = driver_find("idxd", bus);
+@@ -53,13 +61,20 @@ static ssize_t bind_store(struct device_
+ alt_drv = driver_find("user", bus);
+ }
+ if (!alt_drv)
+- return -ENODEV;
++ goto err_put_dev;
+
+ rc = device_driver_attach(alt_drv, dev);
+ if (rc < 0)
+- return rc;
++ goto err_put_dev;
++
++ put_device(dev);
+
+ return count;
++
++err_put_dev:
++ put_device(dev);
++
++ return rc;
+ }
+ static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
+
--- /dev/null
+From d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:49 +0100
+Subject: dmaengine: lpc18xx-dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux")
+Cc: stable@vger.kernel.org # 4.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/lpc18xx-dmamux.c
++++ b/drivers/dma/lpc18xx-dmamux.c
+@@ -57,30 +57,31 @@ static void *lpc18xx_dmamux_reserve(stru
+ struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev);
+ unsigned long flags;
+ unsigned mux;
++ int ret = -EINVAL;
+
+ if (dma_spec->args_count != 3) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ mux = dma_spec->args[0];
+ if (mux >= dmamux->dma_master_requests) {
+ dev_err(&pdev->dev, "invalid mux number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) {
+ dev_err(&pdev->dev, "invalid dma mux value: %d\n",
+ dma_spec->args[1]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+@@ -89,7 +90,8 @@ static void *lpc18xx_dmamux_reserve(stru
+ dev_err(&pdev->dev, "dma request %u busy with %u.%u\n",
+ mux, mux, dmamux->muxes[mux].value);
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-EBUSY);
++ ret = -EBUSY;
++ goto err_put_pdev;
+ }
+
+ dmamux->muxes[mux].busy = true;
+@@ -106,7 +108,14 @@ static void *lpc18xx_dmamux_reserve(stru
+ dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux,
+ dmamux->muxes[mux].value, mux);
+
++ put_device(&pdev->dev);
++
+ return &dmamux->muxes[mux];
++
++err_put_pdev:
++ put_device(&pdev->dev);
++
++ return ERR_PTR(ret);
+ }
+
+ static int lpc18xx_dmamux_probe(struct platform_device *pdev)
--- /dev/null
+From d9847e6d1d91462890ba297f7888fa598d47e76e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:50 +0100
+Subject: dmaengine: lpc32xx-dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d9847e6d1d91462890ba297f7888fa598d47e76e upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: 5d318b595982 ("dmaengine: Add dma router for pl08x in LPC32XX SoC")
+Cc: stable@vger.kernel.org # 6.12
+Cc: Piotr Wojtaszczyk <piotr.wojtaszczyk@timesys.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://patch.msgid.link/20251117161258.10679-9-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/lpc32xx-dmamux.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/lpc32xx-dmamux.c
++++ b/drivers/dma/lpc32xx-dmamux.c
+@@ -95,11 +95,12 @@ static void *lpc32xx_dmamux_reserve(stru
+ struct lpc32xx_dmamux_data *dmamux = platform_get_drvdata(pdev);
+ unsigned long flags;
+ struct lpc32xx_dmamux *mux = NULL;
++ int ret = -EINVAL;
+ int i;
+
+ if (dma_spec->args_count != 3) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lpc32xx_muxes); i++) {
+@@ -111,20 +112,20 @@ static void *lpc32xx_dmamux_reserve(stru
+ if (!mux) {
+ dev_err(&pdev->dev, "invalid mux request number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (dma_spec->args[2] > 1) {
+ dev_err(&pdev->dev, "invalid dma mux value: %d\n",
+ dma_spec->args[1]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+@@ -133,7 +134,8 @@ static void *lpc32xx_dmamux_reserve(stru
+ dev_err(dev, "dma request signal %d busy, routed to %s\n",
+ mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1);
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-EBUSY);
++ ret = -EBUSY;
++ goto err_put_pdev;
+ }
+
+ mux->busy = true;
+@@ -148,7 +150,14 @@ static void *lpc32xx_dmamux_reserve(stru
+ dev_dbg(dev, "dma request signal %d routed to %s\n",
+ mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1);
+
++ put_device(&pdev->dev);
++
+ return mux;
++
++err_put_pdev:
++ put_device(&pdev->dev);
++
++ return ERR_PTR(ret);
+ }
+
+ static int lpc32xx_dmamux_probe(struct platform_device *pdev)
--- /dev/null
+From 3f747004bbd641131d9396d87b5d2d3d1e182728 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 29 Oct 2025 20:34:19 +0800
+Subject: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
+
+Fix a memory leak in gpi_peripheral_config() where the original memory
+pointed to by gchan->config could be lost if krealloc() fails.
+
+The issue occurs when:
+1. gchan->config points to previously allocated memory
+2. krealloc() fails and returns NULL
+3. The function directly assigns NULL to gchan->config, losing the
+ reference to the original memory
+4. The original memory becomes unreachable and cannot be freed
+
+Fix this by using a temporary variable to hold the krealloc() result
+and only updating gchan->config when the allocation succeeds.
+
+Found via static analysis and code review.
+
+Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/qcom/gpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/qcom/gpi.c
++++ b/drivers/dma/qcom/gpi.c
+@@ -1605,14 +1605,16 @@ static int
+ gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)
+ {
+ struct gchan *gchan = to_gchan(chan);
++ void *new_config;
+
+ if (!config->peripheral_config)
+ return -EINVAL;
+
+- gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
+- if (!gchan->config)
++ new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
++ if (!new_config)
+ return -ENOMEM;
+
++ gchan->config = new_config;
+ memcpy(gchan->config, config->peripheral_config, config->peripheral_size);
+
+ return 0;
--- /dev/null
+From 9fb490323997dcb6f749cd2660a17a39854600cd Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:51 +0100
+Subject: dmaengine: sh: rz-dmac: fix device leak on probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 9fb490323997dcb6f749cd2660a17a39854600cd upstream.
+
+Make sure to drop the reference taken when looking up the ICU device
+during probe also on probe failures (e.g. probe deferral).
+
+Fixes: 7de873201c44 ("dmaengine: sh: rz-dmac: Add RZ/V2H(P) support")
+Cc: stable@vger.kernel.org # 6.16
+Cc: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Link: https://patch.msgid.link/20251117161258.10679-10-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/sh/rz-dmac.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/sh/rz-dmac.c
++++ b/drivers/dma/sh/rz-dmac.c
+@@ -854,6 +854,13 @@ static int rz_dmac_chan_probe(struct rz_
+ return 0;
+ }
+
++static void rz_dmac_put_device(void *_dev)
++{
++ struct device *dev = _dev;
++
++ put_device(dev);
++}
++
+ static int rz_dmac_parse_of_icu(struct device *dev, struct rz_dmac *dmac)
+ {
+ struct device_node *np = dev->of_node;
+@@ -876,6 +883,10 @@ static int rz_dmac_parse_of_icu(struct d
+ return -ENODEV;
+ }
+
++ ret = devm_add_action_or_reset(dev, rz_dmac_put_device, &dmac->icu.pdev->dev);
++ if (ret)
++ return ret;
++
+ dmac_index = args.args[0];
+ if (dmac_index > RZV2H_MAX_DMAC_INDEX) {
+ dev_err(dev, "DMAC index %u invalid.\n", dmac_index);
+@@ -1055,8 +1066,6 @@ static void rz_dmac_remove(struct platfo
+ reset_control_assert(dmac->rstc);
+ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+-
+- platform_device_put(dmac->icu.pdev);
+ }
+
+ static const struct of_device_id of_rz_dmac_match[] = {
--- /dev/null
+From 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Thu, 13 Nov 2025 19:50:48 +0000
+Subject: dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream.
+
+After audio full duplex testing, playing the recorded file contains a few
+playback frames from the previous time. The rz_dmac_terminate_all() does
+not reset all the hardware descriptors queued previously, leading to the
+wrong descriptor being picked up during the next DMA transfer. Fix the
+above issue by resetting all the descriptor headers for a channel in
+rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper
+descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg().
+
+Cc: stable@kernel.org
+Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/sh/rz-dmac.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/dma/sh/rz-dmac.c
++++ b/drivers/dma/sh/rz-dmac.c
+@@ -557,11 +557,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *c
+ static int rz_dmac_terminate_all(struct dma_chan *chan)
+ {
+ struct rz_dmac_chan *channel = to_rz_dmac_chan(chan);
++ struct rz_lmdesc *lmdesc = channel->lmdesc.base;
+ unsigned long flags;
++ unsigned int i;
+ LIST_HEAD(head);
+
+ rz_dmac_disable_hw(channel);
+ spin_lock_irqsave(&channel->vc.lock, flags);
++ for (i = 0; i < DMAC_NR_LMDESC; i++)
++ lmdesc[i].header = 0;
++
+ list_splice_tail_init(&channel->ld_active, &channel->ld_free);
+ list_splice_tail_init(&channel->ld_queue, &channel->ld_free);
+ vchan_get_all_descriptors(&channel->vc, &head);
--- /dev/null
+From dd6e4943889fb354efa3f700e42739da9bddb6ef Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:52 +0100
+Subject: dmaengine: stm32: dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit dd6e4943889fb354efa3f700e42739da9bddb6ef upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver")
+Cc: stable@vger.kernel.org # 4.15
+Cc: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251117161258.10679-11-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/stm32/stm32-dmamux.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/stm32/stm32-dmamux.c
++++ b/drivers/dma/stm32/stm32-dmamux.c
+@@ -90,23 +90,25 @@ static void *stm32_dmamux_route_allocate
+ struct stm32_dmamux_data *dmamux = platform_get_drvdata(pdev);
+ struct stm32_dmamux *mux;
+ u32 i, min, max;
+- int ret;
++ int ret = -EINVAL;
+ unsigned long flags;
+
+ if (dma_spec->args_count != 3) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (dma_spec->args[0] > dmamux->dmamux_requests) {
+ dev_err(&pdev->dev, "invalid mux request number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ mux = kzalloc(sizeof(*mux), GFP_KERNEL);
+- if (!mux)
+- return ERR_PTR(-ENOMEM);
++ if (!mux) {
++ ret = -ENOMEM;
++ goto err_put_pdev;
++ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+ mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
+@@ -133,7 +135,6 @@ static void *stm32_dmamux_route_allocate
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", i - 1);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- ret = -EINVAL;
+ goto error;
+ }
+
+@@ -160,6 +161,8 @@ static void *stm32_dmamux_route_allocate
+ dev_dbg(&pdev->dev, "Mapping DMAMUX(%u) to DMA%u(%u)\n",
+ mux->request, mux->master, mux->chan_id);
+
++ put_device(&pdev->dev);
++
+ return mux;
+
+ error:
+@@ -167,6 +170,9 @@ error:
+
+ error_chan_id:
+ kfree(mux);
++err_put_pdev:
++ put_device(&pdev->dev);
++
+ return ERR_PTR(ret);
+ }
+
--- /dev/null
+From b1b590a590af13ded598e70f0b72bc1e515787a1 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:53 +0100
+Subject: dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b1b590a590af13ded598e70f0b72bc1e515787a1 upstream.
+
+Make sure to drop the reference taken to the DMA master OF node also on
+late route allocation failures.
+
+Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver")
+Cc: stable@vger.kernel.org # 4.15
+Cc: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251117161258.10679-12-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/stm32/stm32-dmamux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/stm32/stm32-dmamux.c
++++ b/drivers/dma/stm32/stm32-dmamux.c
+@@ -143,7 +143,7 @@ static void *stm32_dmamux_route_allocate
+ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0) {
+ spin_unlock_irqrestore(&dmamux->lock, flags);
+- goto error;
++ goto err_put_dma_spec_np;
+ }
+ spin_unlock_irqrestore(&dmamux->lock, flags);
+
+@@ -165,6 +165,8 @@ static void *stm32_dmamux_route_allocate
+
+ return mux;
+
++err_put_dma_spec_np:
++ of_node_put(dma_spec->np);
+ error:
+ clear_bit(mux->chan_id, dmamux->dma_inuse);
+
--- /dev/null
+From 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:56 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during am335x route allocation.
+
+Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx")
+Cc: stable@vger.kernel.org # 4.4
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -79,34 +79,35 @@ static void *ti_am335x_xbar_route_alloca
+ {
+ struct platform_device *pdev = of_find_device_by_node(ofdma->of_node);
+ struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev);
+- struct ti_am335x_xbar_map *map;
++ struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL);
+
+ if (dma_spec->args_count != 3)
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+
+ if (dma_spec->args[2] >= xbar->xbar_events) {
+ dev_err(&pdev->dev, "Invalid XBAR event number: %d\n",
+ dma_spec->args[2]);
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ if (dma_spec->args[0] >= xbar->dma_requests) {
+ dev_err(&pdev->dev, "Invalid DMA request line number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "Can't get DMA master\n");
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map) {
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-ENOMEM);
++ map = ERR_PTR(-ENOMEM);
++ goto out_put_pdev;
+ }
+
+ map->dma_line = (u16)dma_spec->args[0];
+@@ -120,6 +121,9 @@ static void *ti_am335x_xbar_route_alloca
+
+ ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val);
+
++out_put_pdev:
++ put_device(&pdev->dev);
++
+ return map;
+ }
+
--- /dev/null
+From dc7e44db01fc2498644e3106db3e62a9883a93d5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:55 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during dra7x route allocation.
+
+Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in
+ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the
+reference is still leaking on successful allocation.
+
+Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x")
+Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate")
+Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -288,6 +288,8 @@ static void *ti_dra7_xbar_route_allocate
+
+ ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in);
+
++ put_device(&pdev->dev);
++
+ return map;
+ }
+
--- /dev/null
+From 430f7803b69cd5e5694e5dfc884c6628870af36e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:58 +0100
+Subject: dmaengine: ti: k3-udma: fix device leak on udma lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
+
+Make sure to drop the reference taken when looking up the UDMA platform
+device.
+
+Note that holding a reference to a platform device does not prevent its
+driver data from going away so there is no point in keeping the
+reference after the lookup helper returns.
+
+Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users")
+Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()")
+Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/k3-udma-private.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/ti/k3-udma-private.c
++++ b/drivers/dma/ti/k3-udma-private.c
+@@ -42,9 +42,9 @@ struct udma_dev *of_xudma_dev_get(struct
+ }
+
+ ud = platform_get_drvdata(pdev);
++ put_device(&pdev->dev);
+ if (!ud) {
+ pr_debug("UDMA has not been probed\n");
+- put_device(&pdev->dev);
+ return ERR_PTR(-EPROBE_DEFER);
+ }
+
--- /dev/null
+From 28695ca09d326461f8078332aa01db516983e8a2 Mon Sep 17 00:00:00 2001
+From: "Mario Limonciello (AMD)" <superm1@kernel.org>
+Date: Wed, 7 Jan 2026 15:37:28 -0600
+Subject: drm/amd: Clean up kfd node on surprise disconnect
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
+
+When an eGPU is unplugged the KFD topology should also be destroyed
+for that GPU. This never happens because the fini_sw callbacks never
+get to run. Run them manually before calling amdgpu_device_ip_fini_early()
+when a device has already been disconnected.
+
+This location is intentionally chosen to make sure that the kfd locking
+refcount doesn't get incremented unintentionally.
+
+Cc: kent.russell@amd.com
+Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4985,6 +4985,14 @@ void amdgpu_device_fini_hw(struct amdgpu
+
+ amdgpu_ttm_set_buffer_funcs_status(adev, false);
+
++ /*
++ * device went through surprise hotplug; we need to destroy topology
++ * before ip_fini_early to prevent kfd locking refcount issues by calling
++ * amdgpu_amdkfd_suspend()
++ */
++ if (drm_dev_is_unplugged(adev_to_drm(adev)))
++ amdgpu_amdkfd_device_fini_sw(adev);
++
+ amdgpu_device_ip_fini_early(adev);
+
+ amdgpu_irq_fini_hw(adev);
--- /dev/null
+From fee50077656d8a58011f13bca48f743d1b6d6015 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Mon, 15 Dec 2025 14:08:30 -0600
+Subject: drm/amd/display: Bump the HDMI clock to 340MHz
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit fee50077656d8a58011f13bca48f743d1b6d6015 upstream.
+
+[Why]
+DP-HDMI dongles can execeed bandwidth requirements on high resolution
+monitors. This can lead to pruning the high resolution modes.
+
+HDMI 1.3 bumped the clock to 340MHz, but display code never matched it.
+
+[How]
+Set default to (DVI) 165MHz. Once HDMI display is identified update
+to 340MHz.
+
+Reported-by: Dianne Skoll <dianne@skoll.ca>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4780
+Reviewed-by: Chris Park <chris.park@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ac1e65d8ade46c09fb184579b81acadf36dcb91e)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h | 2 +-
+ drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h
+@@ -41,7 +41,7 @@
+ /* kHZ*/
+ #define DP_ADAPTOR_DVI_MAX_TMDS_CLK 165000
+ /* kHZ*/
+-#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 165000
++#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 340000
+
+ struct dp_hdmi_dongle_signature_data {
+ int8_t id[15];/* "DP-HDMI ADAPTOR"*/
+--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+@@ -332,7 +332,7 @@ static void query_dp_dual_mode_adaptor(
+
+ /* Assume we have no valid DP passive dongle connected */
+ *dongle = DISPLAY_DONGLE_NONE;
+- sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK;
++ sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_DVI_MAX_TMDS_CLK;
+
+ /* Read DP-HDMI dongle I2c (no response interpreted as DP-DVI dongle)*/
+ if (!i2c_read(
+@@ -388,6 +388,8 @@ static void query_dp_dual_mode_adaptor(
+
+ }
+ }
++ if (is_valid_hdmi_signature)
++ sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK;
+
+ if (is_type2_dongle) {
+ uint32_t max_tmds_clk =
--- /dev/null
+From 52d3d115e9cc975b90b1fc49abf6d36ad5e8847a Mon Sep 17 00:00:00 2001
+From: Vivek Das Mohapatra <vivek@collabora.com>
+Date: Mon, 12 Jan 2026 15:28:56 +0000
+Subject: drm/amd/display: Initialise backlight level values from hw
+
+From: Vivek Das Mohapatra <vivek@collabora.com>
+
+commit 52d3d115e9cc975b90b1fc49abf6d36ad5e8847a upstream.
+
+Internal backlight levels are initialised from ACPI but the values
+are sometimes out of sync with the levels in effect until there has
+been a read from hardware (eg triggered by reading from sysfs).
+
+This means that the first drm_commit can cause the levels to be set
+to a different value than the actual starting one, which results in
+a sudden change in brightness.
+
+This path shows the problem (when the values are out of sync):
+
+ amdgpu_dm_atomic_commit_tail()
+ -> amdgpu_dm_commit_streams()
+ -> amdgpu_dm_backlight_set_level(..., dm->brightness[n])
+
+This patch calls the backlight ops get_brightness explicitly
+at the end of backlight registration to make sure dm->brightness[n]
+is in sync with the actual hardware levels.
+
+Fixes: 2fe87f54abdc ("drm/amd/display: Set default brightness according to ACPI")
+Signed-off-by: Vivek Das Mohapatra <vivek@collabora.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 318b1c36d82a0cd2b06a4bb43272fa6f1bc8adc1)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5193,6 +5193,8 @@ amdgpu_dm_register_backlight_device(stru
+ struct amdgpu_dm_backlight_caps *caps;
+ char bl_name[16];
+ int min, max;
++ int real_brightness;
++ int init_brightness;
+
+ if (aconnector->bl_idx == -1)
+ return;
+@@ -5217,6 +5219,8 @@ amdgpu_dm_register_backlight_device(stru
+ } else
+ props.brightness = props.max_brightness = MAX_BACKLIGHT_LEVEL;
+
++ init_brightness = props.brightness;
++
+ if (caps->data_points && !(amdgpu_dc_debug_mask & DC_DISABLE_CUSTOM_BRIGHTNESS_CURVE)) {
+ drm_info(drm, "Using custom brightness curve\n");
+ props.scale = BACKLIGHT_SCALE_NON_LINEAR;
+@@ -5235,8 +5239,20 @@ amdgpu_dm_register_backlight_device(stru
+ if (IS_ERR(dm->backlight_dev[aconnector->bl_idx])) {
+ drm_err(drm, "DM: Backlight registration failed!\n");
+ dm->backlight_dev[aconnector->bl_idx] = NULL;
+- } else
++ } else {
++ /*
++ * dm->brightness[x] can be inconsistent just after startup until
++ * ops.get_brightness is called.
++ */
++ real_brightness =
++ amdgpu_dm_backlight_ops.get_brightness(dm->backlight_dev[aconnector->bl_idx]);
++
++ if (real_brightness != init_brightness) {
++ dm->actual_brightness[aconnector->bl_idx] = real_brightness;
++ dm->brightness[aconnector->bl_idx] = real_brightness;
++ }
+ drm_dbg_driver(drm, "DM: Registered Backlight device: %s\n", bl_name);
++ }
+ }
+
+ static int initialize_plane(struct amdgpu_display_manager *dm,
--- /dev/null
+From 292e5757b2229c0c6f1d059123a85f8a28f4464d Mon Sep 17 00:00:00 2001
+From: Philip Yang <Philip.Yang@amd.com>
+Date: Thu, 4 Dec 2025 12:13:05 -0500
+Subject: drm/amdgpu: Fix gfx9 update PTE mtype flag
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+commit 292e5757b2229c0c6f1d059123a85f8a28f4464d upstream.
+
+Fix copy&paste error, that should have been an assignment instead of an or,
+otherwise MTYPE_UC 0x3 can not be updated to MTYPE_RW 0x1.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit fc1366016abe4103c0f0fac882811aea961ef213)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -1233,16 +1233,16 @@ static void gmc_v9_0_get_vm_pte(struct a
+ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_NC);
+ break;
+ case AMDGPU_VM_MTYPE_WC:
+- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_WC);
++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_WC);
+ break;
+ case AMDGPU_VM_MTYPE_RW:
+- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_RW);
++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_RW);
+ break;
+ case AMDGPU_VM_MTYPE_CC:
+- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_CC);
++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_CC);
+ break;
+ case AMDGPU_VM_MTYPE_UC:
+- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_UC);
++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_UC);
+ break;
+ }
+
--- /dev/null
+From b6dff005fcf32dd072f6f2d08ca461394a21bd4f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 9 Jan 2026 08:54:55 -0500
+Subject: drm/amdgpu: make sure userqs are enabled in userq IOCTLs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b6dff005fcf32dd072f6f2d08ca461394a21bd4f upstream.
+
+These IOCTLs shouldn't be called when userqs are not
+enabled. Make sure they are enabled before executing
+the IOCTLs.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d967509651601cddce7ff2a9f09479f3636f684d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 16 ++++++++++++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 1 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 6 ++++++
+ 3 files changed, 23 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+@@ -681,12 +681,28 @@ static int amdgpu_userq_input_args_valid
+ return 0;
+ }
+
++bool amdgpu_userq_enabled(struct drm_device *dev)
++{
++ struct amdgpu_device *adev = drm_to_adev(dev);
++ int i;
++
++ for (i = 0; i < AMDGPU_HW_IP_NUM; i++) {
++ if (adev->userq_funcs[i])
++ return true;
++ }
++
++ return false;
++}
++
+ int amdgpu_userq_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *filp)
+ {
+ union drm_amdgpu_userq *args = data;
+ int r;
+
++ if (!amdgpu_userq_enabled(dev))
++ return -ENOTSUPP;
++
+ if (amdgpu_userq_input_args_validate(dev, args, filp) < 0)
+ return -EINVAL;
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
+@@ -135,6 +135,7 @@ uint64_t amdgpu_userq_get_doorbell_index
+ struct drm_file *filp);
+
+ u32 amdgpu_userq_get_supported_ip_mask(struct amdgpu_device *adev);
++bool amdgpu_userq_enabled(struct drm_device *dev);
+
+ int amdgpu_userq_suspend(struct amdgpu_device *adev);
+ int amdgpu_userq_resume(struct amdgpu_device *adev);
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
+@@ -472,6 +472,9 @@ int amdgpu_userq_signal_ioctl(struct drm
+ struct drm_exec exec;
+ u64 wptr;
+
++ if (!amdgpu_userq_enabled(dev))
++ return -ENOTSUPP;
++
+ num_syncobj_handles = args->num_syncobj_handles;
+ syncobj_handles = memdup_user(u64_to_user_ptr(args->syncobj_handles),
+ size_mul(sizeof(u32), num_syncobj_handles));
+@@ -654,6 +657,9 @@ int amdgpu_userq_wait_ioctl(struct drm_d
+ int r, i, rentry, wentry, cnt;
+ struct drm_exec exec;
+
++ if (!amdgpu_userq_enabled(dev))
++ return -ENOTSUPP;
++
+ num_read_bo_handles = wait_info->num_bo_read_handles;
+ bo_handles_read = memdup_user(u64_to_user_ptr(wait_info->bo_read_handles),
+ size_mul(sizeof(u32), num_read_bo_handles));
--- /dev/null
+From 80614c509810fc051312d1a7ccac8d0012d6b8d0 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Thu, 8 Jan 2026 15:18:22 +0800
+Subject: drm/amdkfd: fix a memory leak in device_queue_manager_init()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 80614c509810fc051312d1a7ccac8d0012d6b8d0 upstream.
+
+If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd()
+to release the memory allocated by allocate_hiq_sdma_mqd().
+Move deallocate_hiq_sdma_mqd() up to ensure proper function
+visibility at the point of use.
+
+Fixes: 11614c36bc8f ("drm/amdkfd: Allocate MQD trunk for HIQ and SDMA")
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Oak Zeng <Oak.Zeng@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b7cccc8286bb9919a0952c812872da1dcfe9d390)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 19 ++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -2905,6 +2905,14 @@ static int allocate_hiq_sdma_mqd(struct
+ return retval;
+ }
+
++static void deallocate_hiq_sdma_mqd(struct kfd_node *dev,
++ struct kfd_mem_obj *mqd)
++{
++ WARN(!mqd, "No hiq sdma mqd trunk to free");
++
++ amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
++}
++
+ struct device_queue_manager *device_queue_manager_init(struct kfd_node *dev)
+ {
+ struct device_queue_manager *dqm;
+@@ -3028,19 +3036,14 @@ struct device_queue_manager *device_queu
+ return dqm;
+ }
+
++ if (!dev->kfd->shared_resources.enable_mes)
++ deallocate_hiq_sdma_mqd(dev, &dqm->hiq_sdma_mqd);
++
+ out_free:
+ kfree(dqm);
+ return NULL;
+ }
+
+-static void deallocate_hiq_sdma_mqd(struct kfd_node *dev,
+- struct kfd_mem_obj *mqd)
+-{
+- WARN(!mqd, "No hiq sdma mqd trunk to free");
+-
+- amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
+-}
+-
+ void device_queue_manager_uninit(struct device_queue_manager *dqm)
+ {
+ dqm->ops.stop(dqm);
--- /dev/null
+From 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 19 Dec 2025 16:52:02 -0500
+Subject: drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
+
+For a while, I've been seeing a strange issue where some (usually not all)
+of the display DMA channels will suddenly hang, particularly when there is
+a visible cursor on the screen that is being frequently updated, and
+especially when said cursor happens to go between two screens. While this
+brings back lovely memories of fixing Intel Skylake bugs, I would quite
+like to fix it :).
+
+It turns out the problem that's happening here is that we're managing to
+reach nv50_head_flush_set() in our atomic commit path without actually
+holding nv50_disp->mutex. This means that cursor updates happening in
+parallel (along with any other atomic updates that need to use the core
+channel) will race with eachother, which eventually causes us to corrupt
+the pushbuffer - leading to a plethora of various GSP errors, usually:
+
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
+
+The reason this is happening is because generally we check whether we need
+to set nv50_atom->lock_core at the end of nv50_head_atomic_check().
+However, curs507a_prepare is called from the fb_prepare callback, which
+happens after the atomic check phase. As a result, this can lead to commits
+that both touch the core channel but also don't grab nv50_disp->mutex.
+
+So, fix this by making sure that we set nv50_atom->lock_core in
+cus507a_prepare().
+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
+Cc: <stable@vger.kernel.org> # v4.18+
+Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
+@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw,
+ asyh->curs.handle = handle;
+ asyh->curs.offset = offset;
+ asyh->set.curs = asyh->curs.visible;
++ nv50_atom(asyh->state.state)->lock_core = true;
+ }
+ }
+
--- /dev/null
+From 6ab3d4353bf75005eaa375677c9fed31148154d6 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@nabladev.com>
+Date: Sat, 10 Jan 2026 16:27:28 +0100
+Subject: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
+
+From: Marek Vasut <marex@nabladev.com>
+
+commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
+
+The connector type for the DataImage SCF0700C48GGU18 panel is missing and
+devm_drm_panel_bridge_add() requires connector type to be set. This leads
+to a warning and a backtrace in the kernel log and panel does not work:
+"
+WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
+"
+The warning is triggered by a check for valid connector type in
+devm_drm_panel_bridge_add(). If there is no valid connector type
+set for a panel, the warning is printed and panel is not added.
+Fill in the missing connector type to fix the warning and make
+the panel operational once again.
+
+Cc: stable@vger.kernel.org
+Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18")
+Signed-off-by: Marek Vasut <marex@nabladev.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1900,6 +1900,7 @@ static const struct panel_desc dataimage
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
++ .connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+
+ static const struct display_timing dlc_dlc0700yzg_1_timing = {
--- /dev/null
+From 9380dc33cd6ae4a6857818fcefce31cf716f3fae Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+Date: Thu, 18 Dec 2025 14:34:43 +0100
+Subject: drm/panel: simple: restore connector_type fallback
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+commit 9380dc33cd6ae4a6857818fcefce31cf716f3fae upstream.
+
+The switch from devm_kzalloc() + drm_panel_init() to
+devm_drm_panel_alloc() introduced a regression.
+
+Several panel descriptors do not set connector_type. For those panels,
+panel_simple_probe() used to compute a connector type (currently DPI as a
+fallback) and pass that value to drm_panel_init(). After the conversion
+to devm_drm_panel_alloc(), the call unconditionally used
+desc->connector_type instead, ignoring the computed fallback and
+potentially passing DRM_MODE_CONNECTOR_Unknown, which
+drm_panel_bridge_add() does not allow.
+
+Move the connector_type validation / fallback logic before the
+devm_drm_panel_alloc() call and pass the computed connector_type to
+devm_drm_panel_alloc(), so panels without an explicit connector_type
+once again get the DPI default.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Fixes: de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()")
+Cc: stable@vger.kernel.org
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://lore.kernel.org/stable/20251126-lcd_panel_connector_type_fix-v2-1-c15835d1f7cb%40microchip.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20251218-lcd_panel_connector_type_fix-v3-1-ddcea6d8d7ef@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 89 +++++++++++++++++------------------
+ 1 file changed, 44 insertions(+), 45 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -623,49 +623,6 @@ static struct panel_simple *panel_simple
+ if (IS_ERR(desc))
+ return ERR_CAST(desc);
+
+- panel = devm_drm_panel_alloc(dev, struct panel_simple, base,
+- &panel_simple_funcs, desc->connector_type);
+- if (IS_ERR(panel))
+- return ERR_CAST(panel);
+-
+- panel->desc = desc;
+-
+- panel->supply = devm_regulator_get(dev, "power");
+- if (IS_ERR(panel->supply))
+- return ERR_CAST(panel->supply);
+-
+- panel->enable_gpio = devm_gpiod_get_optional(dev, "enable",
+- GPIOD_OUT_LOW);
+- if (IS_ERR(panel->enable_gpio))
+- return dev_err_cast_probe(dev, panel->enable_gpio,
+- "failed to request GPIO\n");
+-
+- err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation);
+- if (err) {
+- dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err);
+- return ERR_PTR(err);
+- }
+-
+- ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0);
+- if (ddc) {
+- panel->ddc = of_find_i2c_adapter_by_node(ddc);
+- of_node_put(ddc);
+-
+- if (!panel->ddc)
+- return ERR_PTR(-EPROBE_DEFER);
+- }
+-
+- if (!of_device_is_compatible(dev->of_node, "panel-dpi") &&
+- !of_get_display_timing(dev->of_node, "panel-timing", &dt))
+- panel_simple_parse_panel_timing_node(dev, panel, &dt);
+-
+- if (desc->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+- /* Optional data-mapping property for overriding bus format */
+- err = panel_simple_override_nondefault_lvds_datamapping(dev, panel);
+- if (err)
+- goto free_ddc;
+- }
+-
+ connector_type = desc->connector_type;
+ /* Catch common mistakes for panels. */
+ switch (connector_type) {
+@@ -690,8 +647,7 @@ static struct panel_simple *panel_simple
+ break;
+ case DRM_MODE_CONNECTOR_eDP:
+ dev_warn(dev, "eDP panels moved to panel-edp\n");
+- err = -EINVAL;
+- goto free_ddc;
++ return ERR_PTR(-EINVAL);
+ case DRM_MODE_CONNECTOR_DSI:
+ if (desc->bpc != 6 && desc->bpc != 8)
+ dev_warn(dev, "Expected bpc in {6,8} but got: %u\n", desc->bpc);
+@@ -720,6 +676,49 @@ static struct panel_simple *panel_simple
+ break;
+ }
+
++ panel = devm_drm_panel_alloc(dev, struct panel_simple, base,
++ &panel_simple_funcs, connector_type);
++ if (IS_ERR(panel))
++ return ERR_CAST(panel);
++
++ panel->desc = desc;
++
++ panel->supply = devm_regulator_get(dev, "power");
++ if (IS_ERR(panel->supply))
++ return ERR_CAST(panel->supply);
++
++ panel->enable_gpio = devm_gpiod_get_optional(dev, "enable",
++ GPIOD_OUT_LOW);
++ if (IS_ERR(panel->enable_gpio))
++ return dev_err_cast_probe(dev, panel->enable_gpio,
++ "failed to request GPIO\n");
++
++ err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation);
++ if (err) {
++ dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err);
++ return ERR_PTR(err);
++ }
++
++ ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0);
++ if (ddc) {
++ panel->ddc = of_find_i2c_adapter_by_node(ddc);
++ of_node_put(ddc);
++
++ if (!panel->ddc)
++ return ERR_PTR(-EPROBE_DEFER);
++ }
++
++ if (!of_device_is_compatible(dev->of_node, "panel-dpi") &&
++ !of_get_display_timing(dev->of_node, "panel-timing", &dt))
++ panel_simple_parse_panel_timing_node(dev, panel, &dt);
++
++ if (desc->connector_type == DRM_MODE_CONNECTOR_LVDS) {
++ /* Optional data-mapping property for overriding bus format */
++ err = panel_simple_override_nondefault_lvds_datamapping(dev, panel);
++ if (err)
++ goto free_ddc;
++ }
++
+ dev_set_drvdata(dev, panel);
+
+ /*
--- /dev/null
+From b91a565ed14fcf900b4d95e86882b4b763860986 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Thu, 8 Jan 2026 15:19:46 +0100
+Subject: drm/sysfb: Remove duplicate declarations
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit b91a565ed14fcf900b4d95e86882b4b763860986 upstream.
+
+Commit 6046b49bafff ("drm/sysfb: Share helpers for integer validation")
+and commit e8c086880b2b ("drm/sysfb: Share helpers for screen_info
+validation") added duplicate function declarations. Remove the latter
+ones.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: e8c086880b2b ("drm/sysfb: Share helpers for screen_info validation")
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v6.16+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patch.msgid.link/20260108145058.56943-7-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sysfb/drm_sysfb_helper.h | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
++++ b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h
+@@ -48,15 +48,6 @@ const struct drm_format_info *drm_sysfb_
+ #endif
+
+ /*
+- * Input parsing
+- */
+-
+-int drm_sysfb_get_validated_int(struct drm_device *dev, const char *name,
+- u64 value, u32 max);
+-int drm_sysfb_get_validated_int0(struct drm_device *dev, const char *name,
+- u64 value, u32 max);
+-
+-/*
+ * Display modes
+ */
+
--- /dev/null
+From bf72b4b7bb7dbb643d204fa41e7463894a95999f Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Wed, 24 Dec 2025 17:11:05 +0800
+Subject: drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
+
+In vmw_compat_shader_add(), the return value check of vmw_shader_alloc()
+is not proper. Modify the check for the return pointer 'res'.
+
+Found by code review and compiled on ubuntu 20.04.
+
+Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+@@ -923,8 +923,10 @@ int vmw_compat_shader_add(struct vmw_pri
+ ttm_bo_unreserve(&buf->tbo);
+
+ res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type);
+- if (unlikely(ret != 0))
++ if (IS_ERR(res)) {
++ ret = PTR_ERR(res);
+ goto no_reserve;
++ }
+
+ ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader,
+ vmw_shader_key(user_key, shader_type),
--- /dev/null
+From c4461754e6fe7e12a3ff198cce4707e3e20e43d4 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:52 +0800
+Subject: LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit c4461754e6fe7e12a3ff198cce4707e3e20e43d4 upstream.
+
+Add missing address-cells 0 to the Local I/O and Extend I/O interrupt
+controller node to silence W=1 warning:
+
+ loongson-2k0500.dtsi:513.5-51: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@0,0:interrupt-map:
+ Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe11600, using 0 as fallback
+
+Value '0' is correct because:
+1. The Local I/O & Extend I/O interrupt controller do not have children,
+2. interrupt-map property (in PCI node) consists of five components and
+ the fourth component "parent unit address", which size is defined by
+ '#address-cells' of the node pointed to by the interrupt-parent
+ component, is not used (=0)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k0500.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/loongarch/boot/dts/loongson-2k0500.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k0500.dtsi
+@@ -131,6 +131,7 @@
+ reg-names = "main", "isr0";
+
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <2>;
+@@ -149,6 +150,7 @@
+ reg-names = "main", "isr0";
+
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <4>;
+@@ -164,6 +166,7 @@
+ compatible = "loongson,ls2k0500-eiointc";
+ reg = <0x0 0x1fe11600 0x0 0xea00>;
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <1>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <3>;
--- /dev/null
+From 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:53 +0800
+Subject: LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 upstream.
+
+Add missing address-cells 0 to the Local I/O interrupt controller node
+to silence W=1 warning:
+
+ loongson-2k1000.dtsi:498.5-55: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map:
+ Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe01440, using 0 as fallback
+
+Value '0' is correct because:
+1. The Local I/O interrupt controller does not have children,
+2. interrupt-map property (in PCI node) consists of five components and
+ the fourth component "parent unit address", which size is defined by
+ '#address-cells' of the node pointed to by the interrupt-parent
+ component, is not used (=0)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k1000.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/loongarch/boot/dts/loongson-2k1000.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k1000.dtsi
+@@ -114,6 +114,7 @@
+ <0x0 0x1fe01140 0x0 0x8>;
+ reg-names = "main", "isr0", "isr1";
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <2>;
+@@ -131,6 +132,7 @@
+ <0x0 0x1fe01148 0x0 0x8>;
+ reg-names = "main", "isr0", "isr1";
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <3>;
--- /dev/null
+From 14ea5a3625881d79f75418c66e3a7d98db8518e1 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:53 +0800
+Subject: LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit 14ea5a3625881d79f75418c66e3a7d98db8518e1 upstream.
+
+The binding wants the node to be named "i2c-number", but those are named
+"i2c-gpio-number" instead.
+
+Thus rename those to i2c-0, i2c-1 to adhere to the binding and suppress
+dtbs_check warnings.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k1000.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/boot/dts/loongson-2k1000.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k1000.dtsi
+@@ -46,7 +46,7 @@
+ };
+
+ /* i2c of the dvi eeprom edid */
+- i2c-gpio-0 {
++ i2c-0 {
+ compatible = "i2c-gpio";
+ scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+@@ -57,7 +57,7 @@
+ };
+
+ /* i2c of the eeprom edid */
+- i2c-gpio-1 {
++ i2c-1 {
+ compatible = "i2c-gpio";
+ scl-gpios = <&gpio0 33 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ sda-gpios = <&gpio0 32 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
--- /dev/null
+From e65df3f77ecd59d3a8647d19df82b22a6ce210a9 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:53 +0800
+Subject: LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit e65df3f77ecd59d3a8647d19df82b22a6ce210a9 upstream.
+
+Add missing address-cells 0 to the Local I/O, Extend I/O and PCH-PIC
+Interrupt Controller node to silence W=1 warning:
+
+ loongson-2k2000.dtsi:364.5-49: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map:
+ Missing property '#address-cells' in node /bus@10000000/interrupt-controller@10000000, using 0 as fallback
+
+Value '0' is correct because:
+1. The LIO/EIO/PCH interrupt controller does not have children,
+2. interrupt-map property (in PCI node) consists of five components and
+ the fourth component "parent unit address", which size is defined by
+ '#address-cells' of the node pointed to by the interrupt-parent
+ component, is not used (=0)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k2000.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/loongarch/boot/dts/loongson-2k2000.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k2000.dtsi
+@@ -126,6 +126,7 @@
+ reg = <0x0 0x1fe01400 0x0 0x64>;
+
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <2>;
+@@ -140,6 +141,7 @@
+ compatible = "loongson,ls2k2000-eiointc";
+ reg = <0x0 0x1fe01600 0x0 0xea00>;
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <1>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <3>;
+@@ -149,6 +151,7 @@
+ compatible = "loongson,pch-pic-1.0";
+ reg = <0x0 0x10000000 0x0 0x400>;
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ loongson,pic-base-vec = <0>;
+ interrupt-parent = <&eiointc>;
--- /dev/null
+From 7d8553fc75aefa7ec936af0cf8443ff90b51732e Mon Sep 17 00:00:00 2001
+From: Qiang Ma <maqianga@uniontech.com>
+Date: Sat, 17 Jan 2026 10:57:02 +0800
+Subject: LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()
+
+From: Qiang Ma <maqianga@uniontech.com>
+
+commit 7d8553fc75aefa7ec936af0cf8443ff90b51732e upstream.
+
+In kvm_ioctl_create_device(), kvm_device has allocated memory,
+kvm_device->destroy() seems to be supposed to free its kvm_device
+struct, but kvm_eiointc_destroy() is not currently doing this, that
+would lead to a memory leak.
+
+So, fix it.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Qiang Ma <maqianga@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/intc/eiointc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/loongarch/kvm/intc/eiointc.c
++++ b/arch/loongarch/kvm/intc/eiointc.c
+@@ -679,6 +679,7 @@ static void kvm_eiointc_destroy(struct k
+ kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device);
+ kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device_vext);
+ kfree(eiointc);
++ kfree(dev);
+ }
+
+ static struct kvm_device_ops kvm_eiointc_dev_ops = {
--- /dev/null
+From 0bf58cb7288a4d3de6d8ecbb3a65928a9362bf21 Mon Sep 17 00:00:00 2001
+From: Qiang Ma <maqianga@uniontech.com>
+Date: Sat, 17 Jan 2026 10:57:02 +0800
+Subject: LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()
+
+From: Qiang Ma <maqianga@uniontech.com>
+
+commit 0bf58cb7288a4d3de6d8ecbb3a65928a9362bf21 upstream.
+
+In kvm_ioctl_create_device(), kvm_device has allocated memory,
+kvm_device->destroy() seems to be supposed to free its kvm_device
+struct, but kvm_ipi_destroy() is not currently doing this, that
+would lead to a memory leak.
+
+So, fix it.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Qiang Ma <maqianga@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/intc/ipi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/loongarch/kvm/intc/ipi.c
++++ b/arch/loongarch/kvm/intc/ipi.c
+@@ -459,6 +459,7 @@ static void kvm_ipi_destroy(struct kvm_d
+ ipi = kvm->arch.ipi;
+ kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &ipi->device);
+ kfree(ipi);
++ kfree(dev);
+ }
+
+ static struct kvm_device_ops kvm_ipi_dev_ops = {
--- /dev/null
+From 1cf342a7c3adc5877837b53bbceb5cc9eff60bbf Mon Sep 17 00:00:00 2001
+From: Qiang Ma <maqianga@uniontech.com>
+Date: Sat, 17 Jan 2026 10:57:03 +0800
+Subject: LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()
+
+From: Qiang Ma <maqianga@uniontech.com>
+
+commit 1cf342a7c3adc5877837b53bbceb5cc9eff60bbf upstream.
+
+In kvm_ioctl_create_device(), kvm_device has allocated memory,
+kvm_device->destroy() seems to be supposed to free its kvm_device
+struct, but kvm_pch_pic_destroy() is not currently doing this, that
+would lead to a memory leak.
+
+So, fix it.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Qiang Ma <maqianga@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/intc/pch_pic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/loongarch/kvm/intc/pch_pic.c
++++ b/arch/loongarch/kvm/intc/pch_pic.c
+@@ -475,6 +475,7 @@ static void kvm_pch_pic_destroy(struct k
+ /* unregister pch pic device and free it's memory */
+ kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &s->device);
+ kfree(s);
++ kfree(dev);
+ }
+
+ static struct kvm_device_ops kvm_pch_pic_dev_ops = {
mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch
loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch
loongarch-dts-describe-pci-sideband-irq-through-interrupt-extended.patch
+drm-amd-display-bump-the-hdmi-clock-to-340mhz.patch
+drm-amd-display-initialise-backlight-level-values-from-hw.patch
+drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch
+drm-amdgpu-fix-gfx9-update-pte-mtype-flag.patch
+drm-amdgpu-make-sure-userqs-are-enabled-in-userq-ioctls.patch
+drm-amdkfd-fix-a-memory-leak-in-device_queue_manager_init.patch
+drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch
+drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch
+drm-panel-simple-restore-connector_type-fallback.patch
+drm-sysfb-remove-duplicate-declarations.patch
+drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch
+loongarch-dts-loongson-2k0500-add-default-interrupt-controller-address-cells.patch
+loongarch-dts-loongson-2k1000-add-default-interrupt-controller-address-cells.patch
+loongarch-dts-loongson-2k1000-fix-i2c-gpio-node-names.patch
+loongarch-dts-loongson-2k2000-add-default-interrupt-controller-address-cells.patch
+loongarch-kvm-fix-kvm_device-leak-in-kvm_eiointc_destroy.patch
+loongarch-kvm-fix-kvm_device-leak-in-kvm_ipi_destroy.patch
+loongarch-kvm-fix-kvm_device-leak-in-kvm_pch_pic_destroy.patch
+dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch
+dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch
+dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch
+dmaengine-cv1800b-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch
+dmaengine-fsl-edma-fix-clk-leak-on-alloc_chan_resources-failure.patch
+dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch
+dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-lpc32xx-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch
+dmaengine-sh-rz-dmac-fix-device-leak-on-probe-failure.patch
+dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch
+dmaengine-stm32-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-stm32-dmamux-fix-of-node-leak-on-route-allocation-failure.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch
+dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
