--- /dev/null
+From 4b506ea5351a1f5937ac632a4a5c35f6f796cc41 Mon Sep 17 00:00:00 2001
+From: Shivam Kalra <shivamkalra98@zohomail.in>
+Date: Sun, 26 Apr 2026 19:38:41 +0530
+Subject: ACPI: video: force native backlight on HP OMEN 16 (8A44)
+
+From: Shivam Kalra <shivamkalra98@zohomail.in>
+
+commit 4b506ea5351a1f5937ac632a4a5c35f6f796cc41 upstream.
+
+The HP OMEN 16 Gaming Laptop (board name 8A44) has a mux-less hybrid
+GPU configuration with AMD Rembrandt (Radeon 680M) and NVIDIA GA104
+(RTX 3070 Ti). The internal eDP panel is wired to the AMD iGPU.
+
+When Nouveau loads without GSP firmware, the ACPI video backlight
+device (acpi_video0) gets registered alongside the native AMD
+backlight (amdgpu_bl2). In this state, writes to amdgpu_bl2 update
+the software brightness value but fail to change the physical panel
+brightness.
+
+Force native backlight to prevent acpi_video0 from registering.
+Confirmed that booting with acpi_backlight=native resolves the
+issue.
+
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Shivam Kalra <shivamkalra98@zohomail.in>
+Link: https://patch.msgid.link/20260426-omen-16-backlight-fix-v1-1-62364f268ea6@zohomail.in
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -154,6 +154,14 @@ static const struct dmi_system_id video_
+ DMI_MATCH(DMI_PRODUCT_NAME, "VPCEH3U1E"),
+ },
+ },
++ {
++ .callback = video_detect_force_native,
++ /* HP OMEN Gaming Laptop 16-n0xxx */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-n0xxx"),
++ },
++ },
+
+ /*
+ * These models have a working acpi_video backlight control, and using
--- /dev/null
+From 8de779dc40d35d39fa07387b6f921eb11df0f511 Mon Sep 17 00:00:00 2001
+From: Rajat Gupta <rajgupt@qti.qualcomm.com>
+Date: Sun, 3 May 2026 20:51:10 -0700
+Subject: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
+
+From: Rajat Gupta <rajgupt@qti.qualcomm.com>
+
+commit 8de779dc40d35d39fa07387b6f921eb11df0f511 upstream.
+
+dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages
+to userspace but sets no vm_ops on the VMA. This means the kernel cannot
+track active mmaps. When dlfb_realloc_framebuffer() replaces the backing
+buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated.
+On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages
+while userspace PTEs still reference them, resulting in a use-after-free:
+the process retains read/write access to freed kernel pages.
+
+Add vm_operations_struct with open/close callbacks that maintain an
+atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(),
+check mmap_count and return -EBUSY if the buffer is currently mapped,
+preventing buffer replacement while userspace holds stale PTEs.
+
+Tested with PoC using dummy_hcd + raw_gadget USB device emulation.
+
+Signed-off-by: Rajat Gupta <rajgupt@qti.qualcomm.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/udlfb.c | 31 ++++++++++++++++++++++++++++++-
+ include/video/udlfb.h | 1 +
+ 2 files changed, 31 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -321,12 +321,32 @@ static int dlfb_set_video_mode(struct dl
+ return retval;
+ }
+
++static void dlfb_vm_open(struct vm_area_struct *vma)
++{
++ struct dlfb_data *dlfb = vma->vm_private_data;
++
++ atomic_inc(&dlfb->mmap_count);
++}
++
++static void dlfb_vm_close(struct vm_area_struct *vma)
++{
++ struct dlfb_data *dlfb = vma->vm_private_data;
++
++ atomic_dec(&dlfb->mmap_count);
++}
++
++static const struct vm_operations_struct dlfb_vm_ops = {
++ .open = dlfb_vm_open,
++ .close = dlfb_vm_close,
++};
++
+ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
+ {
+ unsigned long start = vma->vm_start;
+ unsigned long size = vma->vm_end - vma->vm_start;
+ unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+ unsigned long page, pos;
++ struct dlfb_data *dlfb = info->par;
+
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+@@ -353,6 +373,9 @@ static int dlfb_ops_mmap(struct fb_info
+ size = 0;
+ }
+
++ vma->vm_ops = &dlfb_vm_ops;
++ vma->vm_private_data = dlfb;
++ atomic_inc(&dlfb->mmap_count);
+ return 0;
+ }
+
+@@ -1218,7 +1241,6 @@ static void dlfb_deferred_vfree(struct d
+
+ /*
+ * Assumes &info->lock held by caller
+- * Assumes no active clients have framebuffer open
+ */
+ static int dlfb_realloc_framebuffer(struct dlfb_data *dlfb, struct fb_info *info, u32 new_len)
+ {
+@@ -1230,6 +1252,13 @@ static int dlfb_realloc_framebuffer(stru
+ new_len = PAGE_ALIGN(new_len);
+
+ if (new_len > old_len) {
++ if (atomic_read(&dlfb->mmap_count) > 0) {
++ dev_warn(info->dev,
++ "refusing realloc: %d active mmaps\n",
++ atomic_read(&dlfb->mmap_count));
++ return -EBUSY;
++ }
++
+ /*
+ * Alloc system memory for virtual framebuffer
+ */
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -56,6 +56,7 @@ struct dlfb_data {
+ spinlock_t damage_lock;
+ struct work_struct damage_work;
+ struct fb_ops ops;
++ atomic_t mmap_count;
+ /* blit-only rendering path metrics, exposed through sysfs */
+ atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
+ atomic_t bytes_identical; /* saved effort with backbuffer comparison */
--- /dev/null
+From c4cca236968683eb0d59abfb12d5c7e4d8514227 Mon Sep 17 00:00:00 2001
+From: Corey Minyard <corey@minyard.net>
+Date: Mon, 20 Apr 2026 12:39:51 -0500
+Subject: ipmi: Add limits to event and receive message requests
+
+From: Corey Minyard <corey@minyard.net>
+
+commit c4cca236968683eb0d59abfb12d5c7e4d8514227 upstream.
+
+The driver would just fetch events and receive messages until the
+BMC said it was done. To avoid issues with BMCs that never say they are
+done, add a limit of 10 fetches at a time.
+
+In addition, an si interface has an attn state it can return from the
+hardware which is supposed to cause a flag fetch to see if the driver
+needs to fetch events or message or a few other things. If the attn
+bit gets stuck, it's a similar problem. So allow messages in between
+flag fetches so the driver itself doesn't get stuck.
+
+This is a more general fix than the previous fix for the specific bad
+BMC, but should fix the more general issue of a BMC that won't stop
+saying it has data.
+
+This has been there from the beginning of the driver. It's not a bug
+per-se, but it is accounting for bugs in BMCs.
+
+Reported-by: Matt Fleming <mfleming@cloudflare.com>
+Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/
+Fixes: <1da177e4c3f4> ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_si_intf.c | 54 +++++++++++++++++++++++++++++++--------
+ drivers/char/ipmi/ipmi_ssif.c | 23 +++++++++++++++-
+ 2 files changed, 64 insertions(+), 13 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -161,6 +161,10 @@ struct smi_info {
+ OEM2_DATA_AVAIL)
+ unsigned char msg_flags;
+
++ /* When requesting events and messages, don't do it forever. */
++ unsigned int num_requests_in_a_row;
++ bool last_was_flag_fetch;
++
+ /* Does the BMC have an event buffer? */
+ bool has_event_buffer;
+
+@@ -392,7 +396,10 @@ static void start_getting_msg_queue(stru
+
+ start_new_msg(smi_info, smi_info->curr_msg->data,
+ smi_info->curr_msg->data_size);
+- smi_info->si_state = SI_GETTING_MESSAGES;
++ if (smi_info->si_state != SI_GETTING_MESSAGES) {
++ smi_info->num_requests_in_a_row = 0;
++ smi_info->si_state = SI_GETTING_MESSAGES;
++ }
+ }
+
+ static void start_getting_events(struct smi_info *smi_info)
+@@ -403,7 +410,10 @@ static void start_getting_events(struct
+
+ start_new_msg(smi_info, smi_info->curr_msg->data,
+ smi_info->curr_msg->data_size);
+- smi_info->si_state = SI_GETTING_EVENTS;
++ if (smi_info->si_state != SI_GETTING_EVENTS) {
++ smi_info->num_requests_in_a_row = 0;
++ smi_info->si_state = SI_GETTING_EVENTS;
++ }
+ }
+
+ /*
+@@ -577,6 +587,7 @@ static void handle_transaction_done(stru
+ smi_info->si_state = SI_NORMAL;
+ } else {
+ smi_info->msg_flags = msg[3];
++ smi_info->last_was_flag_fetch = true;
+ handle_flags(smi_info);
+ }
+ break;
+@@ -622,6 +633,11 @@ static void handle_transaction_done(stru
+ } else {
+ smi_inc_stat(smi_info, events);
+
++ smi_info->num_requests_in_a_row++;
++ if (smi_info->num_requests_in_a_row > 10)
++ /* Stop if we do this too many times. */
++ smi_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL;
++
+ /*
+ * Do this before we deliver the message
+ * because delivering the message releases the
+@@ -660,6 +676,11 @@ static void handle_transaction_done(stru
+ } else {
+ smi_inc_stat(smi_info, incoming_messages);
+
++ smi_info->num_requests_in_a_row++;
++ if (smi_info->num_requests_in_a_row > 10)
++ /* Stop if we do this too many times. */
++ smi_info->msg_flags &= ~RECEIVE_MSG_AVAIL;
++
+ /*
+ * Do this before we deliver the message
+ * because delivering the message releases the
+@@ -788,6 +809,26 @@ restart:
+ }
+
+ /*
++ * If we are currently idle, or if the last thing that was
++ * done was a flag fetch and there is a message pending, try
++ * to start the next message.
++ *
++ * We do the waiting message check to avoid a stuck flag
++ * completely wedging the driver. Let a message through
++ * in between flag operations if that happens.
++ */
++ if (si_sm_result == SI_SM_IDLE ||
++ (si_sm_result == SI_SM_ATTN && smi_info->waiting_msg &&
++ smi_info->last_was_flag_fetch)) {
++ smi_info->last_was_flag_fetch = false;
++ smi_inc_stat(smi_info, idles);
++
++ si_sm_result = start_next_msg(smi_info);
++ if (si_sm_result != SI_SM_IDLE)
++ goto restart;
++ }
++
++ /*
+ * We prefer handling attn over new messages. But don't do
+ * this if there is not yet an upper layer to handle anything.
+ */
+@@ -820,15 +861,6 @@ restart:
+ }
+ }
+
+- /* If we are currently idle, try to start the next message. */
+- if (si_sm_result == SI_SM_IDLE) {
+- smi_inc_stat(smi_info, idles);
+-
+- si_sm_result = start_next_msg(smi_info);
+- if (si_sm_result != SI_SM_IDLE)
+- goto restart;
+- }
+-
+ if ((si_sm_result == SI_SM_IDLE)
+ && (atomic_read(&smi_info->req_events))) {
+ /*
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -225,6 +225,9 @@ struct ssif_info {
+ bool has_event_buffer;
+ bool supports_alert;
+
++ /* When requesting events and messages, don't do it forever. */
++ unsigned int num_requests_in_a_row;
++
+ /*
+ * Used to tell what we should do with alerts. If we are
+ * waiting on a response, read the data immediately.
+@@ -419,7 +422,10 @@ static void start_event_fetch(struct ssi
+ }
+
+ ssif_info->curr_msg = msg;
+- ssif_info->ssif_state = SSIF_GETTING_EVENTS;
++ if (ssif_info->ssif_state != SSIF_GETTING_EVENTS) {
++ ssif_info->num_requests_in_a_row = 0;
++ ssif_info->ssif_state = SSIF_GETTING_EVENTS;
++ }
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+
+ msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
+@@ -442,7 +448,10 @@ static void start_recv_msg_fetch(struct
+ }
+
+ ssif_info->curr_msg = msg;
+- ssif_info->ssif_state = SSIF_GETTING_MESSAGES;
++ if (ssif_info->ssif_state != SSIF_GETTING_MESSAGES) {
++ ssif_info->num_requests_in_a_row = 0;
++ ssif_info->ssif_state = SSIF_GETTING_MESSAGES;
++ }
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+
+ msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2);
+@@ -851,6 +860,11 @@ static void msg_done_handler(struct ssif
+ ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL;
+ handle_flags(ssif_info, flags);
+ } else {
++ ssif_info->num_requests_in_a_row++;
++ if (ssif_info->num_requests_in_a_row > 10)
++ /* Stop if we do this too many times. */
++ ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL;
++
+ handle_flags(ssif_info, flags);
+ ssif_inc_stat(ssif_info, events);
+ deliver_recv_msg(ssif_info, msg);
+@@ -884,6 +898,11 @@ static void msg_done_handler(struct ssif
+ ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL;
+ handle_flags(ssif_info, flags);
+ } else {
++ ssif_info->num_requests_in_a_row++;
++ if (ssif_info->num_requests_in_a_row > 10)
++ /* Stop if we do this too many times. */
++ ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL;
++
+ ssif_inc_stat(ssif_info, incoming_messages);
+ handle_flags(ssif_info, flags);
+ deliver_recv_msg(ssif_info, msg);
--- /dev/null
+From 36920f30e78e69df01f9691c470b6f3ba8aebf98 Mon Sep 17 00:00:00 2001
+From: Corey Minyard <corey@minyard.net>
+Date: Mon, 20 Apr 2026 12:50:09 -0500
+Subject: ipmi: Check event message buffer response for bad data
+
+From: Corey Minyard <corey@minyard.net>
+
+commit 36920f30e78e69df01f9691c470b6f3ba8aebf98 upstream.
+
+The event message buffer response data size got checked later when
+processing, but check it right after the response comes back. It
+appears some BMCs may return an empty message instead of an error
+when fetching events.
+
+There are apparently some new BMCs that make this error, so we need to
+compensate.
+
+Reported-by: Matt Fleming <mfleming@cloudflare.com>
+Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_si_intf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -623,7 +623,13 @@ static void handle_transaction_done(stru
+ */
+ msg = smi_info->curr_msg;
+ smi_info->curr_msg = NULL;
+- if (msg->rsp[2] != 0) {
++ /*
++ * It appears some BMCs, with no event data, return no
++ * data in the message and not a 0x80 error as the
++ * spec says they should. Shut down processing if
++ * the data is not the right length.
++ */
++ if (msg->rsp[2] != 0 || msg->rsp_size != 19) {
+ /* Error getting event, probably done. */
+ msg->done(msg);
+
--- /dev/null
+From 09dd798270ff582d7309f285d4aaf5dbebae01cb Mon Sep 17 00:00:00 2001
+From: Corey Minyard <corey@minyard.net>
+Date: Mon, 20 Apr 2026 13:02:18 -0500
+Subject: ipmi:si: Return state to normal if message allocation fails
+
+From: Corey Minyard <corey@minyard.net>
+
+commit 09dd798270ff582d7309f285d4aaf5dbebae01cb upstream.
+
+There were places where nothing would get started if a message
+allocation failed, so the driver needs to return to normal state.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_si_intf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -479,15 +479,19 @@ retry:
+ } else if (smi_info->msg_flags & RECEIVE_MSG_AVAIL) {
+ /* Messages available. */
+ smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
+- if (!smi_info->curr_msg)
++ if (!smi_info->curr_msg) {
++ smi_info->si_state = SI_NORMAL;
+ return;
++ }
+
+ start_getting_msg_queue(smi_info);
+ } else if (smi_info->msg_flags & EVENT_MSG_BUFFER_FULL) {
+ /* Events available. */
+ smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
+- if (!smi_info->curr_msg)
++ if (!smi_info->curr_msg) {
++ smi_info->si_state = SI_NORMAL;
+ return;
++ }
+
+ start_getting_events(smi_info);
+ } else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
--- /dev/null
+From 772a896a56e0e3ef9424a025cec9176f9d8f4552 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Sat, 11 Apr 2026 14:06:00 +0200
+Subject: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 772a896a56e0e3ef9424a025cec9176f9d8f4552 upstream.
+
+target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a
+256-byte stack buffer, then will memcpy() cur_len bytes from that
+buffer. snprintf() returns the length the output would have had, which
+can exceed the buffer size when the fabric WWN is long because iSCSI IQN
+names can be up to 223 bytes. The check at the memcpy() site only
+guards the destination page write, not the source read, so memcpy() will
+read past the stack buffer and copy adjacent stack contents to the sysfs
+reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic()
+will be triggered.
+
+Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length
+check to avoid buffer overflow") added the same bound to the
+target_lu_gp_members_show() but the tg_pt_gp variant was missed so
+resolve that here.
+
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
+Assisted-by: gregkh_clanker_t1000
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/2026041159-garter-theft-3be0@gregkh
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/target_core_configfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_configfs.c
++++ b/drivers/target/target_core_configfs.c
+@@ -3043,7 +3043,7 @@ static ssize_t target_tg_pt_gp_members_s
+ config_item_name(&lun->lun_group.cg_item));
+ cur_len++; /* Extra byte for NULL terminator */
+
+- if ((cur_len + len) > PAGE_SIZE) {
++ if (cur_len > TG_PT_GROUP_NAME_BUF || (cur_len + len) > PAGE_SIZE) {
+ pr_warn("Ran out of lu_gp_show_attr"
+ "_members buffer\n");
+ break;
drm-amdgpu-fix-zero-size-gds-range-init-on-rdna4.patch
alsa-caiaq-fix-usb_dev-refcount-leak-on-probe-failure.patch
netfilter-reject-zero-shift-in-nft_bitwise.patch
+scsi-target-configfs-bound-snprintf-return-in-tg_pt_gp_members_show.patch
+ipmi-add-limits-to-event-and-receive-message-requests.patch
+ipmi-check-event-message-buffer-response-for-bad-data.patch
+ipmi-si-return-state-to-normal-if-message-allocation-fails.patch
+fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch
+acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch
+spi-rockchip-fix-controller-deregistration.patch
--- /dev/null
+From 53e7a16070feb7d1d4d81a583eaac5e25048b9c3 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 24 Mar 2026 09:23:23 +0100
+Subject: spi: rockchip: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 53e7a16070feb7d1d4d81a583eaac5e25048b9c3 upstream.
+
+Make sure to deregister the controller before freeing underlying
+resources like DMA channels during driver unbind.
+
+Fixes: 64e36824b32b ("spi/rockchip: add driver for Rockchip RK3xxx SoCs integrated SPI")
+Cc: stable@vger.kernel.org # 3.17
+Cc: addy ke <addy.ke@rock-chips.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260324082326.901043-3-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-rockchip.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -792,7 +792,7 @@ static int rockchip_spi_probe(struct pla
+ ctlr->can_dma = rockchip_spi_can_dma;
+ }
+
+- ret = devm_spi_register_controller(&pdev->dev, ctlr);
++ ret = spi_register_controller(ctlr);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Failed to register controller\n");
+ goto err_free_dma_rx;
+@@ -828,6 +828,8 @@ static int rockchip_spi_remove(struct pl
+ clk_disable_unprepare(rs->spiclk);
+ clk_disable_unprepare(rs->apb_pclk);
+
++ spi_unregister_controller(ctlr);
++
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
projects / thirdparty / kernel / stable-queue.git / commitdiff
