--- /dev/null
+From 87c4e1459e80bf65066f864c762ef4dc932fad4b Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Fri, 20 Jun 2025 19:08:09 +0100
+Subject: ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 87c4e1459e80bf65066f864c762ef4dc932fad4b upstream.
+
+After commit d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper
+flags and language target"), which updated as-instr to use the
+'assembler-with-cpp' language option, the Kbuild version of as-instr
+always fails internally for arch/arm with
+
+ <command-line>: fatal error: asm/unified.h: No such file or directory
+ compilation terminated.
+
+because '-include' flags are now taken into account by the compiler
+driver and as-instr does not have '$(LINUXINCLUDE)', so unified.h is not
+found.
+
+This went unnoticed at the time of the Kbuild change because the last
+use of as-instr in Kbuild that arch/arm could reach was removed in 5.7
+by commit 541ad0150ca4 ("arm: Remove 32bit KVM host support") but a
+stable backport of the Kbuild change to before that point exposed this
+potential issue if one were to be reintroduced.
+
+Follow the general pattern of '-include' paths throughout the tree and
+make unified.h absolute using '$(srctree)' to ensure KBUILD_AFLAGS can
+be used independently.
+
+Closes: https://lore.kernel.org/CACo-S-1qbCX4WAVFA63dWfHtrRHZBTyyr2js8Lx=Az03XHTTHg@mail.gmail.com/
+
+Cc: stable@vger.kernel.org
+Fixes: d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target")
+Reported-by: KernelCI bot <bot@kernelci.org>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -149,7 +149,7 @@ endif
+ # Need -Uarm for gcc < 3.x
+ KBUILD_CPPFLAGS +=$(cpp-y)
+ KBUILD_CFLAGS +=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
+-KBUILD_AFLAGS +=$(CFLAGS_ABI) $(AFLAGS_ISA) -Wa,$(arch-y) $(tune-y) -include asm/unified.h -msoft-float
++KBUILD_AFLAGS +=$(CFLAGS_ABI) $(AFLAGS_ISA) -Wa,$(arch-y) $(tune-y) -include $(srctree)/arch/arm/include/asm/unified.h -msoft-float
+ KBUILD_RUSTFLAGS += --target=arm-unknown-linux-gnueabi
+
+ CHECKFLAGS += -D__arm__
--- /dev/null
+From 53e7e1fb81cc8ba2da1cb31f8917ef397caafe91 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Mon, 14 Jul 2025 20:56:47 +0100
+Subject: ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 53e7e1fb81cc8ba2da1cb31f8917ef397caafe91 upstream.
+
+Commit e7607f7d6d81 ("ARM: 9443/1: Require linker to support KEEP within
+OVERLAY for DCE") accidentally broke the binutils version restriction
+that was added in commit 0d437918fb64 ("ARM: 9414/1: Fix build issue
+with LD_DEAD_CODE_DATA_ELIMINATION"), reintroducing the segmentation
+fault addressed by that workaround.
+
+Restore the binutils version dependency by using
+CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY as an additional condition to ensure
+that CONFIG_HAVE_LD_DEAD_CODE_DATA_ELIMINATION is only enabled with
+binutils >= 2.36 and ld.lld >= 21.0.0.
+
+Closes: https://lore.kernel.org/6739da7d-e555-407a-b5cb-e5681da71056@landley.net/
+Closes: https://lore.kernel.org/CAFERDQ0zPoya5ZQfpbeuKVZEo_fKsonLf6tJbp32QnSGAtbi+Q@mail.gmail.com/
+
+Cc: stable@vger.kernel.org
+Fixes: e7607f7d6d81 ("ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE")
+Reported-by: Rob Landley <rob@landley.net>
+Tested-by: Rob Landley <rob@landley.net>
+Reported-by: Martin Wetterwald <martin@wetterwald.eu>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -121,7 +121,7 @@ config ARM
+ select HAVE_KERNEL_XZ
+ select HAVE_KPROBES if !XIP_KERNEL && !CPU_ENDIAN_BE32 && !CPU_V7M
+ select HAVE_KRETPROBES if HAVE_KPROBES
+- select HAVE_LD_DEAD_CODE_DATA_ELIMINATION if (LD_VERSION >= 23600 || LD_CAN_USE_KEEP_IN_OVERLAY)
++ select HAVE_LD_DEAD_CODE_DATA_ELIMINATION if (LD_VERSION >= 23600 || LD_IS_LLD) && LD_CAN_USE_KEEP_IN_OVERLAY
+ select HAVE_MOD_ARCH_SPECIFIC
+ select HAVE_NMI
+ select HAVE_OPTPROBES if !THUMB2_KERNEL
--- /dev/null
+From bddbe13d36a02d5097b99cf02354d5752ad1ac60 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Thu, 17 Jul 2025 10:23:07 +0800
+Subject: bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 upstream.
+
+The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup()
+twice, which would increment the device's reference count twice if
+both lookups find a device. This could lead to a reference count leak.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found")
+Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-bus.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
+@@ -943,6 +943,7 @@ struct fsl_mc_device *fsl_mc_get_endpoin
+ struct fsl_mc_obj_desc endpoint_desc = {{ 0 }};
+ struct dprc_endpoint endpoint1 = {{ 0 }};
+ struct dprc_endpoint endpoint2 = {{ 0 }};
++ struct fsl_mc_bus *mc_bus;
+ int state, err;
+
+ mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent);
+@@ -966,6 +967,8 @@ struct fsl_mc_device *fsl_mc_get_endpoin
+ strcpy(endpoint_desc.type, endpoint2.type);
+ endpoint_desc.id = endpoint2.id;
+ endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev);
++ if (endpoint)
++ return endpoint;
+
+ /*
+ * We know that the device has an endpoint because we verified by
+@@ -973,17 +976,13 @@ struct fsl_mc_device *fsl_mc_get_endpoin
+ * yet discovered by the fsl-mc bus, thus the lookup returned NULL.
+ * Force a rescan of the devices in this container and retry the lookup.
+ */
+- if (!endpoint) {
+- struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev);
+-
+- if (mutex_trylock(&mc_bus->scan_mutex)) {
+- err = dprc_scan_objects(mc_bus_dev, true);
+- mutex_unlock(&mc_bus->scan_mutex);
+- }
+-
+- if (err < 0)
+- return ERR_PTR(err);
++ mc_bus = to_fsl_mc_bus(mc_bus_dev);
++ if (mutex_trylock(&mc_bus->scan_mutex)) {
++ err = dprc_scan_objects(mc_bus_dev, true);
++ mutex_unlock(&mc_bus->scan_mutex);
+ }
++ if (err < 0)
++ return ERR_PTR(err);
+
+ endpoint = fsl_mc_device_lookup(&endpoint_desc, mc_bus_dev);
+ /*
--- /dev/null
+From 95a16160ca1d75c66bf7a1c5e0bcaffb18e7c7fc Mon Sep 17 00:00:00 2001
+From: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+Date: Wed, 16 Jul 2025 13:21:24 +0530
+Subject: drm/amdgpu: Reset the clear flag in buddy during resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+
+commit 95a16160ca1d75c66bf7a1c5e0bcaffb18e7c7fc upstream.
+
+- Added a handler in DRM buddy manager to reset the cleared
+ flag for the blocks in the freelist.
+
+- This is necessary because, upon resuming, the VRAM becomes
+ cluttered with BIOS data, yet the VRAM backend manager
+ believes that everything has been cleared.
+
+v2:
+ - Add lock before accessing drm_buddy_clear_reset_blocks()(Matthew Auld)
+ - Force merge the two dirty blocks.(Matthew Auld)
+ - Add a new unit test case for this issue.(Matthew Auld)
+ - Having this function being able to flip the state either way would be
+ good. (Matthew Brost)
+
+v3(Matthew Auld):
+ - Do merge step first to avoid the use of extra reset flag.
+
+Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
+Suggested-by: Christian König <christian.koenig@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Cc: stable@vger.kernel.org
+Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3812
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Link: https://lore.kernel.org/r/20250716075125.240637-2-Arunpravin.PaneerSelvam@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 1
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 17 ++++++++++
+ drivers/gpu/drm/drm_buddy.c | 43 +++++++++++++++++++++++++++
+ include/drm/drm_buddy.h | 2 +
+ 5 files changed, 65 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -5123,6 +5123,8 @@ exit:
+ dev->dev->power.disable_depth--;
+ #endif
+ }
++
++ amdgpu_vram_mgr_clear_reset_blocks(adev);
+ adev->in_suspend = false;
+
+ if (adev->enable_mes)
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+@@ -154,6 +154,7 @@ int amdgpu_vram_mgr_reserve_range(struct
+ uint64_t start, uint64_t size);
+ int amdgpu_vram_mgr_query_page_status(struct amdgpu_vram_mgr *mgr,
+ uint64_t start);
++void amdgpu_vram_mgr_clear_reset_blocks(struct amdgpu_device *adev);
+
+ bool amdgpu_res_cpu_visible(struct amdgpu_device *adev,
+ struct ttm_resource *res);
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -783,6 +783,23 @@ uint64_t amdgpu_vram_mgr_vis_usage(struc
+ }
+
+ /**
++ * amdgpu_vram_mgr_clear_reset_blocks - reset clear blocks
++ *
++ * @adev: amdgpu device pointer
++ *
++ * Reset the cleared drm buddy blocks.
++ */
++void amdgpu_vram_mgr_clear_reset_blocks(struct amdgpu_device *adev)
++{
++ struct amdgpu_vram_mgr *mgr = &adev->mman.vram_mgr;
++ struct drm_buddy *mm = &mgr->mm;
++
++ mutex_lock(&mgr->lock);
++ drm_buddy_reset_clear(mm, false);
++ mutex_unlock(&mgr->lock);
++}
++
++/**
+ * amdgpu_vram_mgr_intersects - test each drm buddy block for intersection
+ *
+ * @man: TTM memory type manager
+--- a/drivers/gpu/drm/drm_buddy.c
++++ b/drivers/gpu/drm/drm_buddy.c
+@@ -405,6 +405,49 @@ drm_get_buddy(struct drm_buddy_block *bl
+ EXPORT_SYMBOL(drm_get_buddy);
+
+ /**
++ * drm_buddy_reset_clear - reset blocks clear state
++ *
++ * @mm: DRM buddy manager
++ * @is_clear: blocks clear state
++ *
++ * Reset the clear state based on @is_clear value for each block
++ * in the freelist.
++ */
++void drm_buddy_reset_clear(struct drm_buddy *mm, bool is_clear)
++{
++ u64 root_size, size, start;
++ unsigned int order;
++ int i;
++
++ size = mm->size;
++ for (i = 0; i < mm->n_roots; ++i) {
++ order = ilog2(size) - ilog2(mm->chunk_size);
++ start = drm_buddy_block_offset(mm->roots[i]);
++ __force_merge(mm, start, start + size, order);
++
++ root_size = mm->chunk_size << order;
++ size -= root_size;
++ }
++
++ for (i = 0; i <= mm->max_order; ++i) {
++ struct drm_buddy_block *block;
++
++ list_for_each_entry_reverse(block, &mm->free_list[i], link) {
++ if (is_clear != drm_buddy_block_is_clear(block)) {
++ if (is_clear) {
++ mark_cleared(block);
++ mm->clear_avail += drm_buddy_block_size(mm, block);
++ } else {
++ clear_reset(block);
++ mm->clear_avail -= drm_buddy_block_size(mm, block);
++ }
++ }
++ }
++ }
++}
++EXPORT_SYMBOL(drm_buddy_reset_clear);
++
++/**
+ * drm_buddy_free_block - free a block
+ *
+ * @mm: DRM buddy manager
+--- a/include/drm/drm_buddy.h
++++ b/include/drm/drm_buddy.h
+@@ -160,6 +160,8 @@ int drm_buddy_block_trim(struct drm_budd
+ u64 new_size,
+ struct list_head *blocks);
+
++void drm_buddy_reset_clear(struct drm_buddy *mm, bool is_clear);
++
+ void drm_buddy_free_block(struct drm_buddy *mm, struct drm_buddy_block *block);
+
+ void drm_buddy_free_list(struct drm_buddy *mm,
--- /dev/null
+From 9e0c433d0c05fde284025264b89eaa4ad59f0a3e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 10 Jul 2025 23:17:12 +0300
+Subject: drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 9e0c433d0c05fde284025264b89eaa4ad59f0a3e upstream.
+
+On g4x we currently use the 96MHz non-SSC refclk, which can't actually
+generate an exact 2.7 Gbps link rate. In practice we end up with 2.688
+Gbps which seems to be close enough to actually work, but link training
+is currently failing due to miscalculating the DP_LINK_BW value (we
+calcualte it directly from port_clock which reflects the actual PLL
+outpout frequency).
+
+Ideas how to fix this:
+- nudge port_clock back up to 270000 during PLL computation/readout
+- track port_clock and the nominal link rate separately so they might
+ differ a bit
+- switch to the 100MHz refclk, but that one should be SSC so perhaps
+ not something we want
+
+While we ponder about a better solution apply some band aid to the
+immediate issue of miscalculated DP_LINK_BW value. With this
+I can again use 2.7 Gbps link rate on g4x.
+
+Cc: stable@vger.kernel.org
+Fixes: 665a7b04092c ("drm/i915: Feed the DPLL output freq back into crtc_state")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250710201718.25310-2-ville.syrjala@linux.intel.com
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+(cherry picked from commit a8b874694db5cae7baaf522756f87acd956e6e66)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -1603,6 +1603,12 @@ int intel_dp_rate_select(struct intel_dp
+ void intel_dp_compute_rate(struct intel_dp *intel_dp, int port_clock,
+ u8 *link_bw, u8 *rate_select)
+ {
++ struct intel_display *display = to_intel_display(intel_dp);
++
++ /* FIXME g4x can't generate an exact 2.7GHz with the 96MHz non-SSC refclk */
++ if (display->platform.g4x && port_clock == 268800)
++ port_clock = 270000;
++
+ /* eDP 1.4 rate select method. */
+ if (intel_dp->use_rate_select) {
+ *link_bw = 0;
--- /dev/null
+From 15f77764e90a713ee3916ca424757688e4f565b9 Mon Sep 17 00:00:00 2001
+From: "Lin.Cao" <lincao12@amd.com>
+Date: Thu, 17 Jul 2025 16:44:53 +0800
+Subject: drm/sched: Remove optimization that causes hang when killing dependent jobs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lin.Cao <lincao12@amd.com>
+
+commit 15f77764e90a713ee3916ca424757688e4f565b9 upstream.
+
+When application A submits jobs and application B submits a job with a
+dependency on A's fence, the normal flow wakes up the scheduler after
+processing each job. However, the optimization in
+drm_sched_entity_add_dependency_cb() uses a callback that only clears
+dependencies without waking up the scheduler.
+
+When application A is killed before its jobs can run, the callback gets
+triggered but only clears the dependency without waking up the scheduler,
+causing the scheduler to enter sleep state and application B to hang.
+
+Remove the optimization by deleting drm_sched_entity_clear_dep() and its
+usage, ensuring the scheduler is always woken up when dependencies are
+cleared.
+
+Fixes: 777dbd458c89 ("drm/amdgpu: drop a dummy wakeup scheduler")
+Cc: stable@vger.kernel.org # v4.6+
+Signed-off-by: Lin.Cao <lincao12@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Philipp Stanner <phasta@kernel.org>
+Link: https://lore.kernel.org/r/20250717084453.921097-1-lincao12@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/scheduler/sched_entity.c | 21 ++-------------------
+ 1 file changed, 2 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/scheduler/sched_entity.c
++++ b/drivers/gpu/drm/scheduler/sched_entity.c
+@@ -355,17 +355,6 @@ void drm_sched_entity_destroy(struct drm
+ }
+ EXPORT_SYMBOL(drm_sched_entity_destroy);
+
+-/* drm_sched_entity_clear_dep - callback to clear the entities dependency */
+-static void drm_sched_entity_clear_dep(struct dma_fence *f,
+- struct dma_fence_cb *cb)
+-{
+- struct drm_sched_entity *entity =
+- container_of(cb, struct drm_sched_entity, cb);
+-
+- entity->dependency = NULL;
+- dma_fence_put(f);
+-}
+-
+ /*
+ * drm_sched_entity_wakeup - callback to clear the entity's dependency and
+ * wake up the scheduler
+@@ -376,7 +365,8 @@ static void drm_sched_entity_wakeup(stru
+ struct drm_sched_entity *entity =
+ container_of(cb, struct drm_sched_entity, cb);
+
+- drm_sched_entity_clear_dep(f, cb);
++ entity->dependency = NULL;
++ dma_fence_put(f);
+ drm_sched_wakeup(entity->rq->sched);
+ }
+
+@@ -429,13 +419,6 @@ static bool drm_sched_entity_add_depende
+ fence = dma_fence_get(&s_fence->scheduled);
+ dma_fence_put(entity->dependency);
+ entity->dependency = fence;
+- if (!dma_fence_add_callback(fence, &entity->cb,
+- drm_sched_entity_clear_dep))
+- return true;
+-
+- /* Ignore it when it is already scheduled */
+- dma_fence_put(fence);
+- return false;
+ }
+
+ if (!dma_fence_add_callback(entity->dependency, &entity->cb,
--- /dev/null
+From a7982a14b3012527a9583d12525cd0dc9f8d8934 Mon Sep 17 00:00:00 2001
+From: Yang Xiwen <forbidden405@outlook.com>
+Date: Mon, 16 Jun 2025 00:01:10 +0800
+Subject: i2c: qup: jump out of the loop in case of timeout
+
+From: Yang Xiwen <forbidden405@outlook.com>
+
+commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream.
+
+Original logic only sets the return value but doesn't jump out of the
+loop if the bus is kept active by a client. This is not expected. A
+malicious or buggy i2c client can hang the kernel in this case and
+should be avoided. This is observed during a long time test with a
+PCA953x GPIO extender.
+
+Fix it by changing the logic to not only sets the return value, but also
+jumps out of the loop and return to the caller with -ETIMEDOUT.
+
+Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1")
+Signed-off-by: Yang Xiwen <forbidden405@outlook.com>
+Cc: <stable@vger.kernel.org> # v4.17+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-qup.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -452,8 +452,10 @@ static int qup_i2c_bus_active(struct qup
+ if (!(status & I2C_STATUS_BUS_ACTIVE))
+ break;
+
+- if (time_after(jiffies, timeout))
++ if (time_after(jiffies, timeout)) {
+ ret = -ETIMEDOUT;
++ break;
++ }
+
+ usleep_range(len, len * 2);
+ }
--- /dev/null
+From 56344e241c543f17e8102fa13466ad5c3e7dc9ff Mon Sep 17 00:00:00 2001
+From: Akhil R <akhilrajeev@nvidia.com>
+Date: Thu, 10 Jul 2025 18:42:04 +0530
+Subject: i2c: tegra: Fix reset error handling with ACPI
+
+From: Akhil R <akhilrajeev@nvidia.com>
+
+commit 56344e241c543f17e8102fa13466ad5c3e7dc9ff upstream.
+
+The acpi_evaluate_object() returns an ACPI error code and not
+Linux one. For the some platforms the err will have positive code
+which may be interpreted incorrectly. Use device_reset() for
+reset control which handles it correctly.
+
+Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support")
+Reported-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
+Cc: <stable@vger.kernel.org> # v5.17+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250710131206.2316-2-akhilrajeev@nvidia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-tegra.c | 24 +-----------------------
+ 1 file changed, 1 insertion(+), 23 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -607,7 +607,6 @@ static int tegra_i2c_wait_for_config_loa
+ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev)
+ {
+ u32 val, clk_divisor, clk_multiplier, tsu_thd, tlow, thigh, non_hs_mode;
+- acpi_handle handle = ACPI_HANDLE(i2c_dev->dev);
+ struct i2c_timings *t = &i2c_dev->timings;
+ int err;
+
+@@ -619,11 +618,7 @@ static int tegra_i2c_init(struct tegra_i
+ * emit a noisy warning on error, which won't stay unnoticed and
+ * won't hose machine entirely.
+ */
+- if (handle)
+- err = acpi_evaluate_object(handle, "_RST", NULL, NULL);
+- else
+- err = reset_control_reset(i2c_dev->rst);
+-
++ err = device_reset(i2c_dev->dev);
+ WARN_ON_ONCE(err);
+
+ if (IS_DVC(i2c_dev))
+@@ -1666,19 +1661,6 @@ static void tegra_i2c_parse_dt(struct te
+ i2c_dev->is_vi = true;
+ }
+
+-static int tegra_i2c_init_reset(struct tegra_i2c_dev *i2c_dev)
+-{
+- if (ACPI_HANDLE(i2c_dev->dev))
+- return 0;
+-
+- i2c_dev->rst = devm_reset_control_get_exclusive(i2c_dev->dev, "i2c");
+- if (IS_ERR(i2c_dev->rst))
+- return dev_err_probe(i2c_dev->dev, PTR_ERR(i2c_dev->rst),
+- "failed to get reset control\n");
+-
+- return 0;
+-}
+-
+ static int tegra_i2c_init_clocks(struct tegra_i2c_dev *i2c_dev)
+ {
+ int err;
+@@ -1788,10 +1770,6 @@ static int tegra_i2c_probe(struct platfo
+
+ tegra_i2c_parse_dt(i2c_dev);
+
+- err = tegra_i2c_init_reset(i2c_dev);
+- if (err)
+- return err;
+-
+ err = tegra_i2c_init_clocks(i2c_dev);
+ if (err)
+ return err;
--- /dev/null
+From a663b3c47ab10f66130818cf94eb59c971541c3f Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Thu, 3 Jul 2025 17:01:02 +0530
+Subject: i2c: virtio: Avoid hang by using interruptible completion wait
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit a663b3c47ab10f66130818cf94eb59c971541c3f upstream.
+
+The current implementation uses wait_for_completion(), which can cause
+the caller to hang indefinitely if the transfer never completes.
+
+Switch to wait_for_completion_interruptible() so that the operation can
+be interrupted by signals.
+
+Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: <stable@vger.kernel.org> # v5.16+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-virtio.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-virtio.c
++++ b/drivers/i2c/busses/i2c-virtio.c
+@@ -116,15 +116,16 @@ static int virtio_i2c_complete_reqs(stru
+ for (i = 0; i < num; i++) {
+ struct virtio_i2c_req *req = &reqs[i];
+
+- wait_for_completion(&req->completion);
+-
+- if (!failed && req->in_hdr.status != VIRTIO_I2C_MSG_OK)
+- failed = true;
++ if (!failed) {
++ if (wait_for_completion_interruptible(&req->completion))
++ failed = true;
++ else if (req->in_hdr.status != VIRTIO_I2C_MSG_OK)
++ failed = true;
++ else
++ j++;
++ }
+
+ i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], !failed);
+-
+- if (!failed)
+- j++;
+ }
+
+ return j;
--- /dev/null
+From 153ad566724fe6f57b14f66e9726d295d22e576d Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 15 Jul 2025 12:56:16 -0700
+Subject: mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 153ad566724fe6f57b14f66e9726d295d22e576d upstream.
+
+After a recent change in clang to expose uninitialized warnings from const
+variables [1], there is a false positive warning from the if statement in
+advisor_mode_show().
+
+ mm/ksm.c:3687:11: error: variable 'output' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
+ 3687 | else if (ksm_advisor == KSM_ADVISOR_SCAN_TIME)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ mm/ksm.c:3690:33: note: uninitialized use occurs here
+ 3690 | return sysfs_emit(buf, "%s\n", output);
+ | ^~~~~~
+
+Rewrite the if statement to implicitly make KSM_ADVISOR_NONE the else
+branch so that it is obvious to the compiler that ksm_advisor can only be
+KSM_ADVISOR_NONE or KSM_ADVISOR_SCAN_TIME due to the assignments in
+advisor_mode_store().
+
+Link: https://lkml.kernel.org/r/20250715-ksm-fix-clang-21-uninit-warning-v1-1-f443feb4bfc4@kernel.org
+Fixes: 66790e9a735b ("mm/ksm: add sysfs knobs for advisor")
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2100
+Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1]
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Chengming Zhou <chengming.zhou@linux.dev>
+Cc: Stefan Roesch <shr@devkernel.io>
+Cc: xu xin <xu.xin16@zte.com.cn>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/ksm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -3669,10 +3669,10 @@ static ssize_t advisor_mode_show(struct
+ {
+ const char *output;
+
+- if (ksm_advisor == KSM_ADVISOR_NONE)
+- output = "[none] scan-time";
+- else if (ksm_advisor == KSM_ADVISOR_SCAN_TIME)
++ if (ksm_advisor == KSM_ADVISOR_SCAN_TIME)
+ output = "none [scan-time]";
++ else
++ output = "[none] scan-time";
+
+ return sysfs_emit(buf, "%s\n", output);
+ }
--- /dev/null
+From 8346c6af27f1c1410eb314f4be5875fdf1579a10 Mon Sep 17 00:00:00 2001
+From: Kurt Borja <kuurtb@gmail.com>
+Date: Mon, 7 Jul 2025 03:24:05 -0300
+Subject: platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kurt Borja <kuurtb@gmail.com>
+
+commit 8346c6af27f1c1410eb314f4be5875fdf1579a10 upstream.
+
+Add missing empty member to `awcc_dmi_table`.
+
+Cc: stable@vger.kernel.org
+Fixes: 6d7f1b1a5db6 ("platform/x86: alienware-wmi: Split DMI table")
+Signed-off-by: Kurt Borja <kuurtb@gmail.com>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Link: https://lore.kernel.org/r/20250707-dmi-fix-v1-1-6730835d824d@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/dell/alienware-wmi-wmax.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/platform/x86/dell/alienware-wmi-wmax.c
++++ b/drivers/platform/x86/dell/alienware-wmi-wmax.c
+@@ -205,6 +205,7 @@ static const struct dmi_system_id awcc_d
+ },
+ .driver_data = &g_series_quirks,
+ },
++ {}
+ };
+
+ enum WMAX_THERMAL_INFORMATION_OPERATIONS {
--- /dev/null
+From 9533b789df7e8d273543a5991aec92447be043d7 Mon Sep 17 00:00:00 2001
+From: Rong Zhang <i@rong.moe>
+Date: Tue, 8 Jul 2025 00:38:06 +0800
+Subject: platform/x86: ideapad-laptop: Fix FnLock not remembered among boots
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rong Zhang <i@rong.moe>
+
+commit 9533b789df7e8d273543a5991aec92447be043d7 upstream.
+
+On devices supported by ideapad-laptop, the HW/FW can remember the
+FnLock state among boots. However, since the introduction of the FnLock
+LED class device, it is turned off while shutting down, as a side effect
+of the LED class device unregistering sequence.
+
+Many users always turn on FnLock because they use function keys much
+more frequently than multimedia keys. The behavior change is
+inconvenient for them. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class
+device so that the FnLock state gets remembered, which also aligns with
+the behavior of manufacturer utilities on Windows.
+
+Fixes: 07f48f668fac ("platform/x86: ideapad-laptop: add FnLock LED class device")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Link: https://lore.kernel.org/r/20250707163808.155876-2-i@rong.moe
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/ideapad-laptop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -1728,7 +1728,7 @@ static int ideapad_fn_lock_led_init(stru
+ priv->fn_lock.led.name = "platform::" LED_FUNCTION_FNLOCK;
+ priv->fn_lock.led.brightness_get = ideapad_fn_lock_led_cdev_get;
+ priv->fn_lock.led.brightness_set_blocking = ideapad_fn_lock_led_cdev_set;
+- priv->fn_lock.led.flags = LED_BRIGHT_HW_CHANGED;
++ priv->fn_lock.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN;
+
+ err = led_classdev_register(&priv->platform_device->dev, &priv->fn_lock.led);
+ if (err)
--- /dev/null
+From e10981075adce203eac0be866389309eeb8ef11e Mon Sep 17 00:00:00 2001
+From: Rong Zhang <i@rong.moe>
+Date: Tue, 8 Jul 2025 00:38:07 +0800
+Subject: platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rong Zhang <i@rong.moe>
+
+commit e10981075adce203eac0be866389309eeb8ef11e upstream.
+
+On some models supported by ideapad-laptop, the HW/FW can remember the
+state of keyboard backlight among boots. However, it is always turned
+off while shutting down, as a side effect of the LED class device
+unregistering sequence.
+
+This is inconvenient for users who always prefer turning on the
+keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class
+device so that the state of keyboard backlight gets remembered, which
+also aligns with the behavior of manufacturer utilities on Windows.
+
+Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Link: https://lore.kernel.org/r/20250707163808.155876-3-i@rong.moe
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/ideapad-laptop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -1669,7 +1669,7 @@ static int ideapad_kbd_bl_init(struct id
+ priv->kbd_bl.led.name = "platform::" LED_FUNCTION_KBD_BACKLIGHT;
+ priv->kbd_bl.led.brightness_get = ideapad_kbd_bl_led_cdev_brightness_get;
+ priv->kbd_bl.led.brightness_set_blocking = ideapad_kbd_bl_led_cdev_brightness_set;
+- priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED;
++ priv->kbd_bl.led.flags = LED_BRIGHT_HW_CHANGED | LED_RETAIN_AT_SHUTDOWN;
+
+ err = led_classdev_register(&priv->platform_device->dev, &priv->kbd_bl.led);
+ if (err)
--- /dev/null
+From 1918e79be908b8a2c8757640289bc196c14d928a Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 15 Jul 2025 17:58:17 +0200
+Subject: Revert "drm/gem-dma: Use dma_buf from GEM object instance"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 1918e79be908b8a2c8757640289bc196c14d928a upstream.
+
+This reverts commit e8afa1557f4f963c9a511bd2c6074a941c308685.
+
+The dma_buf field in struct drm_gem_object is not stable over the
+object instance's lifetime. The field becomes NULL when user space
+releases the final GEM handle on the buffer object. This resulted
+in a NULL-pointer deref.
+
+Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
+GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
+Acquire internal references on GEM handles") only solved the problem
+partially. They especially don't work for buffer objects without a DRM
+framebuffer associated.
+
+Hence, this revert to going back to using .import_attach->dmabuf.
+
+v3:
+- cc stable
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
+Acked-by: Christian König <christian.koenig@amd.com>
+Acked-by: Zack Rusin <zack.rusin@broadcom.com>
+Cc: <stable@vger.kernel.org> # v6.15+
+Link: https://lore.kernel.org/r/20250715155934.150656-8-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gem_dma_helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_gem_dma_helper.c
++++ b/drivers/gpu/drm/drm_gem_dma_helper.c
+@@ -230,7 +230,7 @@ void drm_gem_dma_free(struct drm_gem_dma
+
+ if (drm_gem_is_imported(gem_obj)) {
+ if (dma_obj->vaddr)
+- dma_buf_vunmap_unlocked(gem_obj->dma_buf, &map);
++ dma_buf_vunmap_unlocked(gem_obj->import_attach->dmabuf, &map);
+ drm_prime_gem_destroy(gem_obj, dma_obj->sgt);
+ } else if (dma_obj->vaddr) {
+ if (dma_obj->map_noncoherent)
--- /dev/null
+From 2712ca878b688682ac2ce02aefc413fc76019cd9 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 15 Jul 2025 17:58:15 +0200
+Subject: Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 2712ca878b688682ac2ce02aefc413fc76019cd9 upstream.
+
+This reverts commit cce16fcd7446dcff7480cd9d2b6417075ed81065.
+
+The dma_buf field in struct drm_gem_object is not stable over the
+object instance's lifetime. The field becomes NULL when user space
+releases the final GEM handle on the buffer object. This resulted
+in a NULL-pointer deref.
+
+Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
+GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
+Acquire internal references on GEM handles") only solved the problem
+partially. They especially don't work for buffer objects without a DRM
+framebuffer associated.
+
+Hence, this revert to going back to using .import_attach->dmabuf.
+
+v3:
+- cc stable
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
+Acked-by: Christian König <christian.koenig@amd.com>
+Acked-by: Zack Rusin <zack.rusin@broadcom.com>
+Cc: <stable@vger.kernel.org> # v6.15+
+Link: https://lore.kernel.org/r/20250715155934.150656-6-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gem_framebuffer_helper.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
++++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
+@@ -419,6 +419,7 @@ EXPORT_SYMBOL(drm_gem_fb_vunmap);
+ static void __drm_gem_fb_end_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir,
+ unsigned int num_planes)
+ {
++ struct dma_buf_attachment *import_attach;
+ struct drm_gem_object *obj;
+ int ret;
+
+@@ -427,9 +428,10 @@ static void __drm_gem_fb_end_cpu_access(
+ obj = drm_gem_fb_get_obj(fb, num_planes);
+ if (!obj)
+ continue;
++ import_attach = obj->import_attach;
+ if (!drm_gem_is_imported(obj))
+ continue;
+- ret = dma_buf_end_cpu_access(obj->dma_buf, dir);
++ ret = dma_buf_end_cpu_access(import_attach->dmabuf, dir);
+ if (ret)
+ drm_err(fb->dev, "dma_buf_end_cpu_access(%u, %d) failed: %d\n",
+ ret, num_planes, dir);
+@@ -452,6 +454,7 @@ static void __drm_gem_fb_end_cpu_access(
+ */
+ int drm_gem_fb_begin_cpu_access(struct drm_framebuffer *fb, enum dma_data_direction dir)
+ {
++ struct dma_buf_attachment *import_attach;
+ struct drm_gem_object *obj;
+ unsigned int i;
+ int ret;
+@@ -462,9 +465,10 @@ int drm_gem_fb_begin_cpu_access(struct d
+ ret = -EINVAL;
+ goto err___drm_gem_fb_end_cpu_access;
+ }
++ import_attach = obj->import_attach;
+ if (!drm_gem_is_imported(obj))
+ continue;
+- ret = dma_buf_begin_cpu_access(obj->dma_buf, dir);
++ ret = dma_buf_begin_cpu_access(import_attach->dmabuf, dir);
+ if (ret)
+ goto err___drm_gem_fb_end_cpu_access;
+ }
--- /dev/null
+From fb4ef4a52b79a22ad382bfe77332642d02aef773 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 15 Jul 2025 17:58:14 +0200
+Subject: Revert "drm/prime: Use dma_buf from GEM object instance"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit fb4ef4a52b79a22ad382bfe77332642d02aef773 upstream.
+
+This reverts commit f83a9b8c7fd0557b0c50784bfdc1bbe9140c9bf8.
+
+The dma_buf field in struct drm_gem_object is not stable over the
+object instance's lifetime. The field becomes NULL when user space
+releases the final GEM handle on the buffer object. This resulted
+in a NULL-pointer deref.
+
+Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
+GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
+Acquire internal references on GEM handles") only solved the problem
+partially. They especially don't work for buffer objects without a DRM
+framebuffer associated.
+
+Hence, this revert to going back to using .import_attach->dmabuf.
+
+v3:
+- cc stable
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
+Acked-by: Christian König <christian.koenig@amd.com>
+Acked-by: Zack Rusin <zack.rusin@broadcom.com>
+Cc: <stable@vger.kernel.org> # v6.15+
+Link: https://lore.kernel.org/r/20250715155934.150656-5-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_prime.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
+index d828502268b8..a0a5d725eab0 100644
+--- a/drivers/gpu/drm/drm_prime.c
++++ b/drivers/gpu/drm/drm_prime.c
+@@ -453,7 +453,13 @@ struct dma_buf *drm_gem_prime_handle_to_dmabuf(struct drm_device *dev,
+ }
+
+ mutex_lock(&dev->object_name_lock);
+- /* re-export the original imported/exported object */
++ /* re-export the original imported object */
++ if (obj->import_attach) {
++ dmabuf = obj->import_attach->dmabuf;
++ get_dma_buf(dmabuf);
++ goto out_have_obj;
++ }
++
+ if (obj->dma_buf) {
+ get_dma_buf(obj->dma_buf);
+ dmabuf = obj->dma_buf;
+--
+2.50.1
+
net-hns3-disable-interrupt-when-ptp-init-failed.patch
net-hns3-fixed-vf-get-max-channels-bug.patch
net-hns3-default-enable-tx-bounce-buffer-when-smmu-e.patch
+platform-x86-alienware-wmi-wmax-fix-dmi_system_id-array.patch
+platform-x86-ideapad-laptop-fix-fnlock-not-remembered-among-boots.patch
+platform-x86-ideapad-laptop-fix-kbd-backlight-not-remembered-among-boots.patch
+drm-i915-dp-fix-2.7-gbps-dp_link_bw-value-on-g4x.patch
+revert-drm-prime-use-dma_buf-from-gem-object-instance.patch
+revert-drm-gem-framebuffer-use-dma_buf-from-gem-object-instance.patch
+revert-drm-gem-dma-use-dma_buf-from-gem-object-instance.patch
+drm-amdgpu-reset-the-clear-flag-in-buddy-during-resume.patch
+drm-sched-remove-optimization-that-causes-hang-when-killing-dependent-jobs.patch
+mm-ksm-fix-wsometimes-uninitialized-from-clang-21-in-advisor_mode_show.patch
+arm-9448-1-use-an-absolute-path-to-unified.h-in-kbuild_aflags.patch
+arm-9450-1-fix-allowing-linker-dce-with-binutils-2.36.patch
+timekeeping-zero-initialize-system_counterval-when-querying-time-from-phc-drivers.patch
+i2c-qup-jump-out-of-the-loop-in-case-of-timeout.patch
+i2c-tegra-fix-reset-error-handling-with-acpi.patch
+i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch
+bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch
+sprintf.h-requires-stdarg.h.patch
--- /dev/null
+From 0dec7201788b9152f06321d0dab46eed93834cda Mon Sep 17 00:00:00 2001
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+Date: Mon, 21 Jul 2025 16:15:57 +1000
+Subject: sprintf.h requires stdarg.h
+
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+
+commit 0dec7201788b9152f06321d0dab46eed93834cda upstream.
+
+In file included from drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c:4:
+include/linux/sprintf.h:11:54: error: unknown type name 'va_list'
+ 11 | __printf(2, 0) int vsprintf(char *buf, const char *, va_list);
+ | ^~~~~~~
+include/linux/sprintf.h:1:1: note: 'va_list' is defined in header '<stdarg.h>'; this is probably fixable by adding '#include <stdarg.h>'
+
+Link: https://lkml.kernel.org/r/20250721173754.42865913@canb.auug.org.au
+Fixes: 39ced19b9e60 ("lib/vsprintf: split out sprintf() and friends")
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Andriy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/sprintf.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/sprintf.h
++++ b/include/linux/sprintf.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/compiler_attributes.h>
+ #include <linux/types.h>
++#include <linux/stdarg.h>
+
+ int num_to_str(char *buf, int size, unsigned long long num, unsigned int width);
+
--- /dev/null
+From 67c632b4a7fbd6b76a08b86f4950f0f84de93439 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Markus=20Bl=C3=B6chl?= <markus@blochl.de>
+Date: Sun, 20 Jul 2025 15:54:51 +0200
+Subject: timekeeping: Zero initialize system_counterval when querying time from phc drivers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Blöchl <markus@blochl.de>
+
+commit 67c632b4a7fbd6b76a08b86f4950f0f84de93439 upstream.
+
+Most drivers only populate the fields cycles and cs_id of system_counterval
+in their get_time_fn() callback for get_device_system_crosststamp(), unless
+they explicitly provide nanosecond values.
+
+When the use_nsecs field was added to struct system_counterval, most
+drivers did not care. Clock sources other than CSID_GENERIC could then get
+converted in convert_base_to_cs() based on an uninitialized use_nsecs field,
+which usually results in -EINVAL during the following range check.
+
+Pass in a fully zero initialized system_counterval_t to cure that.
+
+Fixes: 6b2e29977518 ("timekeeping: Provide infrastructure for converting to/from a base clock")
+Signed-off-by: Markus Blöchl <markus@blochl.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: John Stultz <jstultz@google.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20250720-timekeeping_uninit_crossts-v2-1-f513c885b7c2@blochl.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/timekeeping.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1256,7 +1256,7 @@ int get_device_system_crosststamp(int (*
+ struct system_time_snapshot *history_begin,
+ struct system_device_crosststamp *xtstamp)
+ {
+- struct system_counterval_t system_counterval;
++ struct system_counterval_t system_counterval = {};
+ struct timekeeper *tk = &tk_core.timekeeper;
+ u64 cycles, now, interval_start;
+ unsigned int clock_was_set_seq = 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
