]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 20 Jan 2026 15:08:17 +0000 (16:08 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 20 Jan 2026 15:08:17 +0000 (16:08 +0100)
added patches:
dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch
dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch
dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch
dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch
dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch
dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch
drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch
drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch
drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch

queue-5.10/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch [new file with mode: 0644]
queue-5.10/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch [new file with mode: 0644]
queue-5.10/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch [new file with mode: 0644]
queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch [new file with mode: 0644]
queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch [new file with mode: 0644]
queue-5.10/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch [new file with mode: 0644]
queue-5.10/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch [new file with mode: 0644]
queue-5.10/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch [new file with mode: 0644]
queue-5.10/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch [new file with mode: 0644]
queue-5.10/series

diff --git a/queue-5.10/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch b/queue-5.10/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch
new file mode 100644 (file)
index 0000000..ef1297a
--- /dev/null
@@ -0,0 +1,53 @@
+From b9074b2d7a230b6e28caa23165e9d8bc0677d333 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:43 +0100
+Subject: dmaengine: at_hdmac: fix device leak on of_dma_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
+
+Make sure to drop the reference taken when looking up the DMA platform
+device during of_dma_xlate() when releasing channel resources.
+
+Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing
+put_device() call in at_dma_xlate()") fixed the leak in a couple of
+error paths but the reference is still leaking on successful allocation.
+
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()")
+Cc: stable@vger.kernel.org     # 3.10: 3832b78b3ec2
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_hdmac.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1320,6 +1320,7 @@ static int atc_config(struct dma_chan *c
+                     struct dma_slave_config *sconfig)
+ {
+       struct at_dma_chan      *atchan = to_at_dma_chan(chan);
++      struct at_dma_slave     *atslave;
+       dev_vdbg(chan2dev(chan), "%s\n", __func__);
+@@ -1579,8 +1580,12 @@ static void atc_free_chan_resources(stru
+       /*
+        * Free atslave allocated in at_dma_xlate()
+        */
+-      kfree(chan->private);
+-      chan->private = NULL;
++      atslave = chan->private;
++      if (atslave) {
++              put_device(atslave->dma_dev);
++              kfree(atslave);
++              chan->private = NULL;
++      }
+       dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
diff --git a/queue-5.10/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch b/queue-5.10/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch
new file mode 100644 (file)
index 0000000..bd28ca0
--- /dev/null
@@ -0,0 +1,51 @@
+From 7c3a46ebf15a9796b763a54272407fdbf945bed8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:45 +0100
+Subject: dmaengine: bcm-sba-raid: fix device leak on probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
+
+Make sure to drop the reference taken when looking up the mailbox device
+during probe on probe failures and on driver unbind.
+
+Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver")
+Cc: stable@vger.kernel.org     # 4.13
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/bcm-sba-raid.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm-sba-raid.c
++++ b/drivers/dma/bcm-sba-raid.c
+@@ -1707,7 +1707,7 @@ static int sba_probe(struct platform_dev
+       /* Prealloc channel resource */
+       ret = sba_prealloc_channel_resources(sba);
+       if (ret)
+-              goto fail_free_mchan;
++              goto fail_put_mbox;
+       /* Check availability of debugfs */
+       if (!debugfs_initialized())
+@@ -1737,6 +1737,8 @@ skip_debugfs:
+ fail_free_resources:
+       debugfs_remove_recursive(sba->root);
+       sba_freeup_channel_resources(sba);
++fail_put_mbox:
++      put_device(sba->mbox_dev);
+ fail_free_mchan:
+       mbox_free_channel(sba->mchan);
+       return ret;
+@@ -1752,6 +1754,8 @@ static int sba_remove(struct platform_de
+       sba_freeup_channel_resources(sba);
++      put_device(sba->mbox_dev);
++
+       mbox_free_channel(sba->mchan);
+       return 0;
diff --git a/queue-5.10/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch b/queue-5.10/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch
new file mode 100644 (file)
index 0000000..c2ffa89
--- /dev/null
@@ -0,0 +1,89 @@
+From d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:49 +0100
+Subject: dmaengine: lpc18xx-dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux")
+Cc: stable@vger.kernel.org     # 4.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/lpc18xx-dmamux.c |   19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/lpc18xx-dmamux.c
++++ b/drivers/dma/lpc18xx-dmamux.c
+@@ -55,30 +55,31 @@ static void *lpc18xx_dmamux_reserve(stru
+       struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev);
+       unsigned long flags;
+       unsigned mux;
++      int ret = -EINVAL;
+       if (dma_spec->args_count != 3) {
+               dev_err(&pdev->dev, "invalid number of dma mux args\n");
+-              return ERR_PTR(-EINVAL);
++              goto err_put_pdev;
+       }
+       mux = dma_spec->args[0];
+       if (mux >= dmamux->dma_master_requests) {
+               dev_err(&pdev->dev, "invalid mux number: %d\n",
+                       dma_spec->args[0]);
+-              return ERR_PTR(-EINVAL);
++              goto err_put_pdev;
+       }
+       if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) {
+               dev_err(&pdev->dev, "invalid dma mux value: %d\n",
+                       dma_spec->args[1]);
+-              return ERR_PTR(-EINVAL);
++              goto err_put_pdev;
+       }
+       /* The of_node_put() will be done in the core for the node */
+       dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+       if (!dma_spec->np) {
+               dev_err(&pdev->dev, "can't get dma master\n");
+-              return ERR_PTR(-EINVAL);
++              goto err_put_pdev;
+       }
+       spin_lock_irqsave(&dmamux->lock, flags);
+@@ -87,7 +88,8 @@ static void *lpc18xx_dmamux_reserve(stru
+               dev_err(&pdev->dev, "dma request %u busy with %u.%u\n",
+                       mux, mux, dmamux->muxes[mux].value);
+               of_node_put(dma_spec->np);
+-              return ERR_PTR(-EBUSY);
++              ret = -EBUSY;
++              goto err_put_pdev;
+       }
+       dmamux->muxes[mux].busy = true;
+@@ -104,7 +106,14 @@ static void *lpc18xx_dmamux_reserve(stru
+       dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux,
+               dmamux->muxes[mux].value, mux);
++      put_device(&pdev->dev);
++
+       return &dmamux->muxes[mux];
++
++err_put_pdev:
++      put_device(&pdev->dev);
++
++      return ERR_PTR(ret);
+ }
+ static int lpc18xx_dmamux_probe(struct platform_device *pdev)
diff --git a/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch b/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch
new file mode 100644 (file)
index 0000000..b7012d7
--- /dev/null
@@ -0,0 +1,77 @@
+From 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:56 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during am335x route allocation.
+
+Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx")
+Cc: stable@vger.kernel.org     # 4.4
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c |   16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -78,34 +78,35 @@ static void *ti_am335x_xbar_route_alloca
+ {
+       struct platform_device *pdev = of_find_device_by_node(ofdma->of_node);
+       struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev);
+-      struct ti_am335x_xbar_map *map;
++      struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL);
+       if (dma_spec->args_count != 3)
+-              return ERR_PTR(-EINVAL);
++              goto out_put_pdev;
+       if (dma_spec->args[2] >= xbar->xbar_events) {
+               dev_err(&pdev->dev, "Invalid XBAR event number: %d\n",
+                       dma_spec->args[2]);
+-              return ERR_PTR(-EINVAL);
++              goto out_put_pdev;
+       }
+       if (dma_spec->args[0] >= xbar->dma_requests) {
+               dev_err(&pdev->dev, "Invalid DMA request line number: %d\n",
+                       dma_spec->args[0]);
+-              return ERR_PTR(-EINVAL);
++              goto out_put_pdev;
+       }
+       /* The of_node_put() will be done in the core for the node */
+       dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+       if (!dma_spec->np) {
+               dev_err(&pdev->dev, "Can't get DMA master\n");
+-              return ERR_PTR(-EINVAL);
++              goto out_put_pdev;
+       }
+       map = kzalloc(sizeof(*map), GFP_KERNEL);
+       if (!map) {
+               of_node_put(dma_spec->np);
+-              return ERR_PTR(-ENOMEM);
++              map = ERR_PTR(-ENOMEM);
++              goto out_put_pdev;
+       }
+       map->dma_line = (u16)dma_spec->args[0];
+@@ -119,6 +120,9 @@ static void *ti_am335x_xbar_route_alloca
+       ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val);
++out_put_pdev:
++      put_device(&pdev->dev);
++
+       return map;
+ }
diff --git a/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch b/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch
new file mode 100644 (file)
index 0000000..153a68b
--- /dev/null
@@ -0,0 +1,40 @@
+From dc7e44db01fc2498644e3106db3e62a9883a93d5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:55 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during dra7x route allocation.
+
+Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in
+ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the
+reference is still leaking on successful allocation.
+
+Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x")
+Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate")
+Cc: stable@vger.kernel.org     # 4.2: 615a4bfc426e
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -287,6 +287,8 @@ static void *ti_dra7_xbar_route_allocate
+       ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in);
++      put_device(&pdev->dev);
++
+       return map;
+ }
diff --git a/queue-5.10/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch b/queue-5.10/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch
new file mode 100644 (file)
index 0000000..515f4e9
--- /dev/null
@@ -0,0 +1,42 @@
+From 430f7803b69cd5e5694e5dfc884c6628870af36e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:58 +0100
+Subject: dmaengine: ti: k3-udma: fix device leak on udma lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
+
+Make sure to drop the reference taken when looking up the UDMA platform
+device.
+
+Note that holding a reference to a platform device does not prevent its
+driver data from going away so there is no point in keeping the
+reference after the lookup helper returns.
+
+Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users")
+Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()")
+Cc: stable@vger.kernel.org     # 5.6: 1438cde8fe9c
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/k3-udma-private.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/ti/k3-udma-private.c
++++ b/drivers/dma/ti/k3-udma-private.c
+@@ -40,9 +40,9 @@ struct udma_dev *of_xudma_dev_get(struct
+       }
+       ud = platform_get_drvdata(pdev);
++      put_device(&pdev->dev);
+       if (!ud) {
+               pr_debug("UDMA has not been probed\n");
+-              put_device(&pdev->dev);
+               return ERR_PTR(-EPROBE_DEFER);
+       }
diff --git a/queue-5.10/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch b/queue-5.10/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch
new file mode 100644 (file)
index 0000000..5a910c6
--- /dev/null
@@ -0,0 +1,56 @@
+From 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 19 Dec 2025 16:52:02 -0500
+Subject: drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
+
+For a while, I've been seeing a strange issue where some (usually not all)
+of the display DMA channels will suddenly hang, particularly when there is
+a visible cursor on the screen that is being frequently updated, and
+especially when said cursor happens to go between two screens. While this
+brings back lovely memories of fixing Intel Skylake bugs, I would quite
+like to fix it :).
+
+It turns out the problem that's happening here is that we're managing to
+reach nv50_head_flush_set() in our atomic commit path without actually
+holding nv50_disp->mutex. This means that cursor updates happening in
+parallel (along with any other atomic updates that need to use the core
+channel) will race with eachother, which eventually causes us to corrupt
+the pushbuffer - leading to a plethora of various GSP errors, usually:
+
+  nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003
+  nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001
+  nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
+
+The reason this is happening is because generally we check whether we need
+to set nv50_atom->lock_core at the end of nv50_head_atomic_check().
+However, curs507a_prepare is called from the fb_prepare callback, which
+happens after the atomic check phase. As a result, this can lead to commits
+that both touch the core channel but also don't grab nv50_disp->mutex.
+
+So, fix this by making sure that we set nv50_atom->lock_core in
+cus507a_prepare().
+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
+Cc: <stable@vger.kernel.org> # v4.18+
+Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/curs507a.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
+@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw,
+               asyh->curs.handle = handle;
+               asyh->curs.offset = offset;
+               asyh->set.curs = asyh->curs.visible;
++              nv50_atom(asyh->state.state)->lock_core = true;
+       }
+ }
diff --git a/queue-5.10/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch b/queue-5.10/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch
new file mode 100644 (file)
index 0000000..04702d6
--- /dev/null
@@ -0,0 +1,42 @@
+From 6ab3d4353bf75005eaa375677c9fed31148154d6 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@nabladev.com>
+Date: Sat, 10 Jan 2026 16:27:28 +0100
+Subject: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
+
+From: Marek Vasut <marex@nabladev.com>
+
+commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
+
+The connector type for the DataImage SCF0700C48GGU18 panel is missing and
+devm_drm_panel_bridge_add() requires connector type to be set. This leads
+to a warning and a backtrace in the kernel log and panel does not work:
+"
+WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
+"
+The warning is triggered by a check for valid connector type in
+devm_drm_panel_bridge_add(). If there is no valid connector type
+set for a panel, the warning is printed and panel is not added.
+Fill in the missing connector type to fix the warning and make
+the panel operational once again.
+
+Cc: stable@vger.kernel.org
+Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18")
+Signed-off-by: Marek Vasut <marex@nabladev.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1627,6 +1627,7 @@ static const struct panel_desc dataimage
+       },
+       .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+       .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
++      .connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+ static const struct display_timing dlc_dlc0700yzg_1_timing = {
diff --git a/queue-5.10/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch b/queue-5.10/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch
new file mode 100644 (file)
index 0000000..0660ca6
--- /dev/null
@@ -0,0 +1,38 @@
+From bf72b4b7bb7dbb643d204fa41e7463894a95999f Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Wed, 24 Dec 2025 17:11:05 +0800
+Subject: drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
+
+In vmw_compat_shader_add(), the return value check of vmw_shader_alloc()
+is not proper. Modify the check for the return pointer 'res'.
+
+Found by code review and compiled on ubuntu 20.04.
+
+Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_shader.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+@@ -1004,8 +1004,10 @@ int vmw_compat_shader_add(struct vmw_pri
+       ttm_bo_unreserve(&buf->base);
+       res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type);
+-      if (unlikely(ret != 0))
++      if (IS_ERR(res)) {
++              ret = PTR_ERR(res);
+               goto no_reserve;
++      }
+       ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader,
+                                vmw_shader_key(user_key, shader_type),
index 80630fa7bf8fc566f01eca7f21111b15671dd931..208d7338ad04be7a812085a56c6974cc7e1d71f1 100644 (file)
@@ -31,3 +31,12 @@ edac-x38-fix-a-resource-leak-in-x38_probe1.patch
 edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch
 x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch
 x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch
+drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch
+drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch
+drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch
+dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch
+dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch
+dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch
+dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch