--- /dev/null
+From 76cba1e60b69c9cd53b9127d017a7dc5945455b1 Mon Sep 17 00:00:00 2001
+From: Janne Grunau <j@jannau.net>
+Date: Wed, 31 Dec 2025 13:34:59 +0100
+Subject: dmaengine: apple-admac: Add "apple,t8103-admac" compatible
+
+From: Janne Grunau <j@jannau.net>
+
+commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream.
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,admac" anymore [1]. Use
+"apple,t8103-admac" as base compatible as it is the SoC the driver and
+bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://patch.msgid.link/20251231-apple-admac-t8103-base-compat-v1-1-ec24a3708f76@jannau.net
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/apple-admac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/dma/apple-admac.c
++++ b/drivers/dma/apple-admac.c
+@@ -936,6 +936,7 @@ static void admac_remove(struct platform
+ }
+
+ static const struct of_device_id admac_of_match[] = {
++ { .compatible = "apple,t8103-admac", },
+ { .compatible = "apple,admac", },
+ { }
+ };
--- /dev/null
+From b9074b2d7a230b6e28caa23165e9d8bc0677d333 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:43 +0100
+Subject: dmaengine: at_hdmac: fix device leak on of_dma_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
+
+Make sure to drop the reference taken when looking up the DMA platform
+device during of_dma_xlate() when releasing channel resources.
+
+Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing
+put_device() call in at_dma_xlate()") fixed the leak in a couple of
+error paths but the reference is still leaking on successful allocation.
+
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()")
+Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_hdmac.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1765,6 +1765,7 @@ static int atc_alloc_chan_resources(stru
+ static void atc_free_chan_resources(struct dma_chan *chan)
+ {
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
++ struct at_dma_slave *atslave;
+
+ BUG_ON(atc_chan_is_enabled(atchan));
+
+@@ -1774,8 +1775,12 @@ static void atc_free_chan_resources(stru
+ /*
+ * Free atslave allocated in at_dma_xlate()
+ */
+- kfree(chan->private);
+- chan->private = NULL;
++ atslave = chan->private;
++ if (atslave) {
++ put_device(atslave->dma_dev);
++ kfree(atslave);
++ chan->private = NULL;
++ }
+
+ dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
--- /dev/null
+From 7c3a46ebf15a9796b763a54272407fdbf945bed8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:45 +0100
+Subject: dmaengine: bcm-sba-raid: fix device leak on probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
+
+Make sure to drop the reference taken when looking up the mailbox device
+during probe on probe failures and on driver unbind.
+
+Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver")
+Cc: stable@vger.kernel.org # 4.13
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/bcm-sba-raid.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm-sba-raid.c
++++ b/drivers/dma/bcm-sba-raid.c
+@@ -1699,7 +1699,7 @@ static int sba_probe(struct platform_dev
+ /* Prealloc channel resource */
+ ret = sba_prealloc_channel_resources(sba);
+ if (ret)
+- goto fail_free_mchan;
++ goto fail_put_mbox;
+
+ /* Check availability of debugfs */
+ if (!debugfs_initialized())
+@@ -1729,6 +1729,8 @@ skip_debugfs:
+ fail_free_resources:
+ debugfs_remove_recursive(sba->root);
+ sba_freeup_channel_resources(sba);
++fail_put_mbox:
++ put_device(sba->mbox_dev);
+ fail_free_mchan:
+ mbox_free_channel(sba->mchan);
+ return ret;
+@@ -1744,6 +1746,8 @@ static void sba_remove(struct platform_d
+
+ sba_freeup_channel_resources(sba);
+
++ put_device(sba->mbox_dev);
++
+ mbox_free_channel(sba->mchan);
+ }
+
--- /dev/null
+From ec25e60f9f95464aa11411db31d0906b3fb7b9f2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:47 +0100
+Subject: dmaengine: dw: dmamux: fix OF node leak on route allocation failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream.
+
+Make sure to drop the reference taken to the DMA master OF node also on
+late route allocation failures.
+
+Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support")
+Cc: stable@vger.kernel.org # 5.19
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20251117161258.10679-6-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dw/rzn1-dmamux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dw/rzn1-dmamux.c
++++ b/drivers/dma/dw/rzn1-dmamux.c
+@@ -90,7 +90,7 @@ static void *rzn1_dmamux_route_allocate(
+
+ if (test_and_set_bit(map->req_idx, dmamux->used_chans)) {
+ ret = -EBUSY;
+- goto free_map;
++ goto put_dma_spec_np;
+ }
+
+ mask = BIT(map->req_idx);
+@@ -103,6 +103,8 @@ static void *rzn1_dmamux_route_allocate(
+
+ clear_bitmap:
+ clear_bit(map->req_idx, dmamux->used_chans);
++put_dma_spec_np:
++ of_node_put(dma_spec->np);
+ free_map:
+ kfree(map);
+ put_device:
--- /dev/null
+From 799900f01792cf8b525a44764f065f83fcafd468 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:48 +0100
+Subject: dmaengine: idxd: fix device leaks on compat bind and unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 799900f01792cf8b525a44764f065f83fcafd468 upstream.
+
+Make sure to drop the reference taken when looking up the idxd device as
+part of the compat bind and unbind sysfs interface.
+
+Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")
+Cc: stable@vger.kernel.org # 5.15
+Cc: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/compat.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma/idxd/compat.c
++++ b/drivers/dma/idxd/compat.c
+@@ -20,11 +20,16 @@ static ssize_t unbind_store(struct devic
+ int rc = -ENODEV;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+- if (dev && dev->driver) {
++ if (!dev)
++ return -ENODEV;
++
++ if (dev->driver) {
+ device_driver_detach(dev);
+ rc = count;
+ }
+
++ put_device(dev);
++
+ return rc;
+ }
+ static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
+@@ -38,9 +43,12 @@ static ssize_t bind_store(struct device_
+ struct idxd_dev *idxd_dev;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+- if (!dev || dev->driver || drv != &dsa_drv.drv)
++ if (!dev)
+ return -ENODEV;
+
++ if (dev->driver || drv != &dsa_drv.drv)
++ goto err_put_dev;
++
+ idxd_dev = confdev_to_idxd_dev(dev);
+ if (is_idxd_dev(idxd_dev)) {
+ alt_drv = driver_find("idxd", bus);
+@@ -53,13 +61,20 @@ static ssize_t bind_store(struct device_
+ alt_drv = driver_find("user", bus);
+ }
+ if (!alt_drv)
+- return -ENODEV;
++ goto err_put_dev;
+
+ rc = device_driver_attach(alt_drv, dev);
+ if (rc < 0)
+- return rc;
++ goto err_put_dev;
++
++ put_device(dev);
+
+ return count;
++
++err_put_dev:
++ put_device(dev);
++
++ return rc;
+ }
+ static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
+
--- /dev/null
+From d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:49 +0100
+Subject: dmaengine: lpc18xx-dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux")
+Cc: stable@vger.kernel.org # 4.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/lpc18xx-dmamux.c
++++ b/drivers/dma/lpc18xx-dmamux.c
+@@ -57,30 +57,31 @@ static void *lpc18xx_dmamux_reserve(stru
+ struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev);
+ unsigned long flags;
+ unsigned mux;
++ int ret = -EINVAL;
+
+ if (dma_spec->args_count != 3) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ mux = dma_spec->args[0];
+ if (mux >= dmamux->dma_master_requests) {
+ dev_err(&pdev->dev, "invalid mux number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) {
+ dev_err(&pdev->dev, "invalid dma mux value: %d\n",
+ dma_spec->args[1]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+@@ -89,7 +90,8 @@ static void *lpc18xx_dmamux_reserve(stru
+ dev_err(&pdev->dev, "dma request %u busy with %u.%u\n",
+ mux, mux, dmamux->muxes[mux].value);
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-EBUSY);
++ ret = -EBUSY;
++ goto err_put_pdev;
+ }
+
+ dmamux->muxes[mux].busy = true;
+@@ -106,7 +108,14 @@ static void *lpc18xx_dmamux_reserve(stru
+ dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux,
+ dmamux->muxes[mux].value, mux);
+
++ put_device(&pdev->dev);
++
+ return &dmamux->muxes[mux];
++
++err_put_pdev:
++ put_device(&pdev->dev);
++
++ return ERR_PTR(ret);
+ }
+
+ static int lpc18xx_dmamux_probe(struct platform_device *pdev)
--- /dev/null
+From d9847e6d1d91462890ba297f7888fa598d47e76e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:50 +0100
+Subject: dmaengine: lpc32xx-dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d9847e6d1d91462890ba297f7888fa598d47e76e upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: 5d318b595982 ("dmaengine: Add dma router for pl08x in LPC32XX SoC")
+Cc: stable@vger.kernel.org # 6.12
+Cc: Piotr Wojtaszczyk <piotr.wojtaszczyk@timesys.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://patch.msgid.link/20251117161258.10679-9-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/lpc32xx-dmamux.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/lpc32xx-dmamux.c
++++ b/drivers/dma/lpc32xx-dmamux.c
+@@ -95,11 +95,12 @@ static void *lpc32xx_dmamux_reserve(stru
+ struct lpc32xx_dmamux_data *dmamux = platform_get_drvdata(pdev);
+ unsigned long flags;
+ struct lpc32xx_dmamux *mux = NULL;
++ int ret = -EINVAL;
+ int i;
+
+ if (dma_spec->args_count != 3) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lpc32xx_muxes); i++) {
+@@ -111,20 +112,20 @@ static void *lpc32xx_dmamux_reserve(stru
+ if (!mux) {
+ dev_err(&pdev->dev, "invalid mux request number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (dma_spec->args[2] > 1) {
+ dev_err(&pdev->dev, "invalid dma mux value: %d\n",
+ dma_spec->args[1]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+@@ -133,7 +134,8 @@ static void *lpc32xx_dmamux_reserve(stru
+ dev_err(dev, "dma request signal %d busy, routed to %s\n",
+ mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1);
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-EBUSY);
++ ret = -EBUSY;
++ goto err_put_pdev;
+ }
+
+ mux->busy = true;
+@@ -148,7 +150,14 @@ static void *lpc32xx_dmamux_reserve(stru
+ dev_dbg(dev, "dma request signal %d routed to %s\n",
+ mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1);
+
++ put_device(&pdev->dev);
++
+ return mux;
++
++err_put_pdev:
++ put_device(&pdev->dev);
++
++ return ERR_PTR(ret);
+ }
+
+ static int lpc32xx_dmamux_probe(struct platform_device *pdev)
--- /dev/null
+From 3f747004bbd641131d9396d87b5d2d3d1e182728 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 29 Oct 2025 20:34:19 +0800
+Subject: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
+
+Fix a memory leak in gpi_peripheral_config() where the original memory
+pointed to by gchan->config could be lost if krealloc() fails.
+
+The issue occurs when:
+1. gchan->config points to previously allocated memory
+2. krealloc() fails and returns NULL
+3. The function directly assigns NULL to gchan->config, losing the
+ reference to the original memory
+4. The original memory becomes unreachable and cannot be freed
+
+Fix this by using a temporary variable to hold the krealloc() result
+and only updating gchan->config when the allocation succeeds.
+
+Found via static analysis and code review.
+
+Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/qcom/gpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/qcom/gpi.c
++++ b/drivers/dma/qcom/gpi.c
+@@ -1614,14 +1614,16 @@ static int
+ gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)
+ {
+ struct gchan *gchan = to_gchan(chan);
++ void *new_config;
+
+ if (!config->peripheral_config)
+ return -EINVAL;
+
+- gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
+- if (!gchan->config)
++ new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
++ if (!new_config)
+ return -ENOMEM;
+
++ gchan->config = new_config;
+ memcpy(gchan->config, config->peripheral_config, config->peripheral_size);
+
+ return 0;
--- /dev/null
+From 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Thu, 13 Nov 2025 19:50:48 +0000
+Subject: dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream.
+
+After audio full duplex testing, playing the recorded file contains a few
+playback frames from the previous time. The rz_dmac_terminate_all() does
+not reset all the hardware descriptors queued previously, leading to the
+wrong descriptor being picked up during the next DMA transfer. Fix the
+above issue by resetting all the descriptor headers for a channel in
+rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper
+descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg().
+
+Cc: stable@kernel.org
+Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/sh/rz-dmac.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/dma/sh/rz-dmac.c
++++ b/drivers/dma/sh/rz-dmac.c
+@@ -533,11 +533,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *c
+ static int rz_dmac_terminate_all(struct dma_chan *chan)
+ {
+ struct rz_dmac_chan *channel = to_rz_dmac_chan(chan);
++ struct rz_lmdesc *lmdesc = channel->lmdesc.base;
+ unsigned long flags;
++ unsigned int i;
+ LIST_HEAD(head);
+
+ rz_dmac_disable_hw(channel);
+ spin_lock_irqsave(&channel->vc.lock, flags);
++ for (i = 0; i < DMAC_NR_LMDESC; i++)
++ lmdesc[i].header = 0;
++
+ list_splice_tail_init(&channel->ld_active, &channel->ld_free);
+ list_splice_tail_init(&channel->ld_queue, &channel->ld_free);
+ vchan_get_all_descriptors(&channel->vc, &head);
--- /dev/null
+From dd6e4943889fb354efa3f700e42739da9bddb6ef Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:52 +0100
+Subject: dmaengine: stm32: dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit dd6e4943889fb354efa3f700e42739da9bddb6ef upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver")
+Cc: stable@vger.kernel.org # 4.15
+Cc: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251117161258.10679-11-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/stm32/stm32-dmamux.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/stm32/stm32-dmamux.c
++++ b/drivers/dma/stm32/stm32-dmamux.c
+@@ -90,23 +90,25 @@ static void *stm32_dmamux_route_allocate
+ struct stm32_dmamux_data *dmamux = platform_get_drvdata(pdev);
+ struct stm32_dmamux *mux;
+ u32 i, min, max;
+- int ret;
++ int ret = -EINVAL;
+ unsigned long flags;
+
+ if (dma_spec->args_count != 3) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (dma_spec->args[0] > dmamux->dmamux_requests) {
+ dev_err(&pdev->dev, "invalid mux request number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ mux = kzalloc(sizeof(*mux), GFP_KERNEL);
+- if (!mux)
+- return ERR_PTR(-ENOMEM);
++ if (!mux) {
++ ret = -ENOMEM;
++ goto err_put_pdev;
++ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+ mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
+@@ -133,7 +135,6 @@ static void *stm32_dmamux_route_allocate
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", i - 1);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- ret = -EINVAL;
+ goto error;
+ }
+
+@@ -160,6 +161,8 @@ static void *stm32_dmamux_route_allocate
+ dev_dbg(&pdev->dev, "Mapping DMAMUX(%u) to DMA%u(%u)\n",
+ mux->request, mux->master, mux->chan_id);
+
++ put_device(&pdev->dev);
++
+ return mux;
+
+ error:
+@@ -167,6 +170,9 @@ error:
+
+ error_chan_id:
+ kfree(mux);
++err_put_pdev:
++ put_device(&pdev->dev);
++
+ return ERR_PTR(ret);
+ }
+
--- /dev/null
+From b1b590a590af13ded598e70f0b72bc1e515787a1 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:53 +0100
+Subject: dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b1b590a590af13ded598e70f0b72bc1e515787a1 upstream.
+
+Make sure to drop the reference taken to the DMA master OF node also on
+late route allocation failures.
+
+Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver")
+Cc: stable@vger.kernel.org # 4.15
+Cc: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://patch.msgid.link/20251117161258.10679-12-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/stm32/stm32-dmamux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/stm32/stm32-dmamux.c
++++ b/drivers/dma/stm32/stm32-dmamux.c
+@@ -143,7 +143,7 @@ static void *stm32_dmamux_route_allocate
+ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0) {
+ spin_unlock_irqrestore(&dmamux->lock, flags);
+- goto error;
++ goto err_put_dma_spec_np;
+ }
+ spin_unlock_irqrestore(&dmamux->lock, flags);
+
+@@ -165,6 +165,8 @@ static void *stm32_dmamux_route_allocate
+
+ return mux;
+
++err_put_dma_spec_np:
++ of_node_put(dma_spec->np);
+ error:
+ clear_bit(mux->chan_id, dmamux->dma_inuse);
+
--- /dev/null
+From 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:56 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during am335x route allocation.
+
+Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx")
+Cc: stable@vger.kernel.org # 4.4
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -79,34 +79,35 @@ static void *ti_am335x_xbar_route_alloca
+ {
+ struct platform_device *pdev = of_find_device_by_node(ofdma->of_node);
+ struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev);
+- struct ti_am335x_xbar_map *map;
++ struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL);
+
+ if (dma_spec->args_count != 3)
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+
+ if (dma_spec->args[2] >= xbar->xbar_events) {
+ dev_err(&pdev->dev, "Invalid XBAR event number: %d\n",
+ dma_spec->args[2]);
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ if (dma_spec->args[0] >= xbar->dma_requests) {
+ dev_err(&pdev->dev, "Invalid DMA request line number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "Can't get DMA master\n");
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map) {
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-ENOMEM);
++ map = ERR_PTR(-ENOMEM);
++ goto out_put_pdev;
+ }
+
+ map->dma_line = (u16)dma_spec->args[0];
+@@ -120,6 +121,9 @@ static void *ti_am335x_xbar_route_alloca
+
+ ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val);
+
++out_put_pdev:
++ put_device(&pdev->dev);
++
+ return map;
+ }
+
--- /dev/null
+From dc7e44db01fc2498644e3106db3e62a9883a93d5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:55 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during dra7x route allocation.
+
+Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in
+ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the
+reference is still leaking on successful allocation.
+
+Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x")
+Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate")
+Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -288,6 +288,8 @@ static void *ti_dra7_xbar_route_allocate
+
+ ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in);
+
++ put_device(&pdev->dev);
++
+ return map;
+ }
+
--- /dev/null
+From 430f7803b69cd5e5694e5dfc884c6628870af36e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:58 +0100
+Subject: dmaengine: ti: k3-udma: fix device leak on udma lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
+
+Make sure to drop the reference taken when looking up the UDMA platform
+device.
+
+Note that holding a reference to a platform device does not prevent its
+driver data from going away so there is no point in keeping the
+reference after the lookup helper returns.
+
+Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users")
+Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()")
+Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/k3-udma-private.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/ti/k3-udma-private.c
++++ b/drivers/dma/ti/k3-udma-private.c
+@@ -42,9 +42,9 @@ struct udma_dev *of_xudma_dev_get(struct
+ }
+
+ ud = platform_get_drvdata(pdev);
++ put_device(&pdev->dev);
+ if (!ud) {
+ pr_debug("UDMA has not been probed\n");
+- put_device(&pdev->dev);
+ return ERR_PTR(-EPROBE_DEFER);
+ }
+
--- /dev/null
+From 28695ca09d326461f8078332aa01db516983e8a2 Mon Sep 17 00:00:00 2001
+From: "Mario Limonciello (AMD)" <superm1@kernel.org>
+Date: Wed, 7 Jan 2026 15:37:28 -0600
+Subject: drm/amd: Clean up kfd node on surprise disconnect
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
+
+When an eGPU is unplugged the KFD topology should also be destroyed
+for that GPU. This never happens because the fini_sw callbacks never
+get to run. Run them manually before calling amdgpu_device_ip_fini_early()
+when a device has already been disconnected.
+
+This location is intentionally chosen to make sure that the kfd locking
+refcount doesn't get incremented unintentionally.
+
+Cc: kent.russell@amd.com
+Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4642,6 +4642,14 @@ void amdgpu_device_fini_hw(struct amdgpu
+
+ amdgpu_ttm_set_buffer_funcs_status(adev, false);
+
++ /*
++ * device went through surprise hotplug; we need to destroy topology
++ * before ip_fini_early to prevent kfd locking refcount issues by calling
++ * amdgpu_amdkfd_suspend()
++ */
++ if (drm_dev_is_unplugged(adev_to_drm(adev)))
++ amdgpu_amdkfd_device_fini_sw(adev);
++
+ amdgpu_device_ip_fini_early(adev);
+
+ amdgpu_irq_fini_hw(adev);
--- /dev/null
+From fee50077656d8a58011f13bca48f743d1b6d6015 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Mon, 15 Dec 2025 14:08:30 -0600
+Subject: drm/amd/display: Bump the HDMI clock to 340MHz
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit fee50077656d8a58011f13bca48f743d1b6d6015 upstream.
+
+[Why]
+DP-HDMI dongles can execeed bandwidth requirements on high resolution
+monitors. This can lead to pruning the high resolution modes.
+
+HDMI 1.3 bumped the clock to 340MHz, but display code never matched it.
+
+[How]
+Set default to (DVI) 165MHz. Once HDMI display is identified update
+to 340MHz.
+
+Reported-by: Dianne Skoll <dianne@skoll.ca>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4780
+Reviewed-by: Chris Park <chris.park@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ac1e65d8ade46c09fb184579b81acadf36dcb91e)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h | 2 +-
+ drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h
+@@ -41,7 +41,7 @@
+ /* kHZ*/
+ #define DP_ADAPTOR_DVI_MAX_TMDS_CLK 165000
+ /* kHZ*/
+-#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 165000
++#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 340000
+
+ struct dp_hdmi_dongle_signature_data {
+ int8_t id[15];/* "DP-HDMI ADAPTOR"*/
+--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+@@ -329,7 +329,7 @@ static void query_dp_dual_mode_adaptor(
+
+ /* Assume we have no valid DP passive dongle connected */
+ *dongle = DISPLAY_DONGLE_NONE;
+- sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK;
++ sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_DVI_MAX_TMDS_CLK;
+
+ /* Read DP-HDMI dongle I2c (no response interpreted as DP-DVI dongle)*/
+ if (!i2c_read(
+@@ -385,6 +385,8 @@ static void query_dp_dual_mode_adaptor(
+
+ }
+ }
++ if (is_valid_hdmi_signature)
++ sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK;
+
+ if (is_type2_dongle) {
+ uint32_t max_tmds_clk =
--- /dev/null
+From 80614c509810fc051312d1a7ccac8d0012d6b8d0 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Thu, 8 Jan 2026 15:18:22 +0800
+Subject: drm/amdkfd: fix a memory leak in device_queue_manager_init()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 80614c509810fc051312d1a7ccac8d0012d6b8d0 upstream.
+
+If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd()
+to release the memory allocated by allocate_hiq_sdma_mqd().
+Move deallocate_hiq_sdma_mqd() up to ensure proper function
+visibility at the point of use.
+
+Fixes: 11614c36bc8f ("drm/amdkfd: Allocate MQD trunk for HIQ and SDMA")
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Oak Zeng <Oak.Zeng@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b7cccc8286bb9919a0952c812872da1dcfe9d390)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 19 ++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -2756,6 +2756,14 @@ static int allocate_hiq_sdma_mqd(struct
+ return retval;
+ }
+
++static void deallocate_hiq_sdma_mqd(struct kfd_node *dev,
++ struct kfd_mem_obj *mqd)
++{
++ WARN(!mqd, "No hiq sdma mqd trunk to free");
++
++ amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
++}
++
+ struct device_queue_manager *device_queue_manager_init(struct kfd_node *dev)
+ {
+ struct device_queue_manager *dqm;
+@@ -2879,19 +2887,14 @@ struct device_queue_manager *device_queu
+ return dqm;
+ }
+
++ if (!dev->kfd->shared_resources.enable_mes)
++ deallocate_hiq_sdma_mqd(dev, &dqm->hiq_sdma_mqd);
++
+ out_free:
+ kfree(dqm);
+ return NULL;
+ }
+
+-static void deallocate_hiq_sdma_mqd(struct kfd_node *dev,
+- struct kfd_mem_obj *mqd)
+-{
+- WARN(!mqd, "No hiq sdma mqd trunk to free");
+-
+- amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
+-}
+-
+ void device_queue_manager_uninit(struct device_queue_manager *dqm)
+ {
+ dqm->ops.stop(dqm);
--- /dev/null
+From 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 19 Dec 2025 16:52:02 -0500
+Subject: drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
+
+For a while, I've been seeing a strange issue where some (usually not all)
+of the display DMA channels will suddenly hang, particularly when there is
+a visible cursor on the screen that is being frequently updated, and
+especially when said cursor happens to go between two screens. While this
+brings back lovely memories of fixing Intel Skylake bugs, I would quite
+like to fix it :).
+
+It turns out the problem that's happening here is that we're managing to
+reach nv50_head_flush_set() in our atomic commit path without actually
+holding nv50_disp->mutex. This means that cursor updates happening in
+parallel (along with any other atomic updates that need to use the core
+channel) will race with eachother, which eventually causes us to corrupt
+the pushbuffer - leading to a plethora of various GSP errors, usually:
+
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
+
+The reason this is happening is because generally we check whether we need
+to set nv50_atom->lock_core at the end of nv50_head_atomic_check().
+However, curs507a_prepare is called from the fb_prepare callback, which
+happens after the atomic check phase. As a result, this can lead to commits
+that both touch the core channel but also don't grab nv50_disp->mutex.
+
+So, fix this by making sure that we set nv50_atom->lock_core in
+cus507a_prepare().
+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
+Cc: <stable@vger.kernel.org> # v4.18+
+Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
+@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw,
+ asyh->curs.handle = handle;
+ asyh->curs.offset = offset;
+ asyh->set.curs = asyh->curs.visible;
++ nv50_atom(asyh->state.state)->lock_core = true;
+ }
+ }
+
--- /dev/null
+From 6ab3d4353bf75005eaa375677c9fed31148154d6 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@nabladev.com>
+Date: Sat, 10 Jan 2026 16:27:28 +0100
+Subject: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
+
+From: Marek Vasut <marex@nabladev.com>
+
+commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
+
+The connector type for the DataImage SCF0700C48GGU18 panel is missing and
+devm_drm_panel_bridge_add() requires connector type to be set. This leads
+to a warning and a backtrace in the kernel log and panel does not work:
+"
+WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
+"
+The warning is triggered by a check for valid connector type in
+devm_drm_panel_bridge_add(). If there is no valid connector type
+set for a panel, the warning is printed and panel is not added.
+Fill in the missing connector type to fix the warning and make
+the panel operational once again.
+
+Cc: stable@vger.kernel.org
+Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18")
+Signed-off-by: Marek Vasut <marex@nabladev.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1782,6 +1782,7 @@ static const struct panel_desc dataimage
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
++ .connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+
+ static const struct display_timing dlc_dlc0700yzg_1_timing = {
--- /dev/null
+From bf72b4b7bb7dbb643d204fa41e7463894a95999f Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Wed, 24 Dec 2025 17:11:05 +0800
+Subject: drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
+
+In vmw_compat_shader_add(), the return value check of vmw_shader_alloc()
+is not proper. Modify the check for the return pointer 'res'.
+
+Found by code review and compiled on ubuntu 20.04.
+
+Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+@@ -923,8 +923,10 @@ int vmw_compat_shader_add(struct vmw_pri
+ ttm_bo_unreserve(&buf->tbo);
+
+ res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type);
+- if (unlikely(ret != 0))
++ if (IS_ERR(res)) {
++ ret = PTR_ERR(res);
+ goto no_reserve;
++ }
+
+ ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader,
+ vmw_shader_key(user_key, shader_type),
--- /dev/null
+From c4461754e6fe7e12a3ff198cce4707e3e20e43d4 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:52 +0800
+Subject: LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit c4461754e6fe7e12a3ff198cce4707e3e20e43d4 upstream.
+
+Add missing address-cells 0 to the Local I/O and Extend I/O interrupt
+controller node to silence W=1 warning:
+
+ loongson-2k0500.dtsi:513.5-51: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@0,0:interrupt-map:
+ Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe11600, using 0 as fallback
+
+Value '0' is correct because:
+1. The Local I/O & Extend I/O interrupt controller do not have children,
+2. interrupt-map property (in PCI node) consists of five components and
+ the fourth component "parent unit address", which size is defined by
+ '#address-cells' of the node pointed to by the interrupt-parent
+ component, is not used (=0)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k0500.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/loongarch/boot/dts/loongson-2k0500.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k0500.dtsi
+@@ -131,6 +131,7 @@
+ reg-names = "main", "isr0";
+
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <2>;
+@@ -149,6 +150,7 @@
+ reg-names = "main", "isr0";
+
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <4>;
+@@ -164,6 +166,7 @@
+ compatible = "loongson,ls2k0500-eiointc";
+ reg = <0x0 0x1fe11600 0x0 0xea00>;
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <1>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <3>;
--- /dev/null
+From 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:53 +0800
+Subject: LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 upstream.
+
+Add missing address-cells 0 to the Local I/O interrupt controller node
+to silence W=1 warning:
+
+ loongson-2k1000.dtsi:498.5-55: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map:
+ Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe01440, using 0 as fallback
+
+Value '0' is correct because:
+1. The Local I/O interrupt controller does not have children,
+2. interrupt-map property (in PCI node) consists of five components and
+ the fourth component "parent unit address", which size is defined by
+ '#address-cells' of the node pointed to by the interrupt-parent
+ component, is not used (=0)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k1000.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/loongarch/boot/dts/loongson-2k1000.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k1000.dtsi
+@@ -114,6 +114,7 @@
+ <0x0 0x1fe01140 0x0 0x8>;
+ reg-names = "main", "isr0", "isr1";
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <2>;
+@@ -131,6 +132,7 @@
+ <0x0 0x1fe01148 0x0 0x8>;
+ reg-names = "main", "isr0", "isr1";
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <3>;
--- /dev/null
+From 14ea5a3625881d79f75418c66e3a7d98db8518e1 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:53 +0800
+Subject: LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit 14ea5a3625881d79f75418c66e3a7d98db8518e1 upstream.
+
+The binding wants the node to be named "i2c-number", but those are named
+"i2c-gpio-number" instead.
+
+Thus rename those to i2c-0, i2c-1 to adhere to the binding and suppress
+dtbs_check warnings.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k1000.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/boot/dts/loongson-2k1000.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k1000.dtsi
+@@ -46,7 +46,7 @@
+ };
+
+ /* i2c of the dvi eeprom edid */
+- i2c-gpio-0 {
++ i2c-0 {
+ compatible = "i2c-gpio";
+ scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+@@ -57,7 +57,7 @@
+ };
+
+ /* i2c of the eeprom edid */
+- i2c-gpio-1 {
++ i2c-1 {
+ compatible = "i2c-gpio";
+ scl-gpios = <&gpio0 33 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ sda-gpios = <&gpio0 32 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
--- /dev/null
+From e65df3f77ecd59d3a8647d19df82b22a6ce210a9 Mon Sep 17 00:00:00 2001
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+Date: Sat, 17 Jan 2026 10:56:53 +0800
+Subject: LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+commit e65df3f77ecd59d3a8647d19df82b22a6ce210a9 upstream.
+
+Add missing address-cells 0 to the Local I/O, Extend I/O and PCH-PIC
+Interrupt Controller node to silence W=1 warning:
+
+ loongson-2k2000.dtsi:364.5-49: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map:
+ Missing property '#address-cells' in node /bus@10000000/interrupt-controller@10000000, using 0 as fallback
+
+Value '0' is correct because:
+1. The LIO/EIO/PCH interrupt controller does not have children,
+2. interrupt-map property (in PCI node) consists of five components and
+ the fourth component "parent unit address", which size is defined by
+ '#address-cells' of the node pointed to by the interrupt-parent
+ component, is not used (=0)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/boot/dts/loongson-2k2000.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/loongarch/boot/dts/loongson-2k2000.dtsi
++++ b/arch/loongarch/boot/dts/loongson-2k2000.dtsi
+@@ -126,6 +126,7 @@
+ reg = <0x0 0x1fe01400 0x0 0x64>;
+
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <2>;
+@@ -140,6 +141,7 @@
+ compatible = "loongson,ls2k2000-eiointc";
+ reg = <0x0 0x1fe01600 0x0 0xea00>;
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <1>;
+ interrupt-parent = <&cpuintc>;
+ interrupts = <3>;
+@@ -149,6 +151,7 @@
+ compatible = "loongson,pch-pic-1.0";
+ reg = <0x0 0x10000000 0x0 0x400>;
+ interrupt-controller;
++ #address-cells = <0>;
+ #interrupt-cells = <2>;
+ loongson,pic-base-vec = <0>;
+ interrupt-parent = <&eiointc>;
mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch
mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch
loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch
+drm-amd-display-bump-the-hdmi-clock-to-340mhz.patch
+drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch
+drm-amdkfd-fix-a-memory-leak-in-device_queue_manager_init.patch
+drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch
+drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch
+drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch
+loongarch-dts-loongson-2k0500-add-default-interrupt-controller-address-cells.patch
+loongarch-dts-loongson-2k1000-add-default-interrupt-controller-address-cells.patch
+loongarch-dts-loongson-2k1000-fix-i2c-gpio-node-names.patch
+loongarch-dts-loongson-2k2000-add-default-interrupt-controller-address-cells.patch
+dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch
+dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch
+dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch
+dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch
+dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch
+dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-lpc32xx-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch
+dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch
+dmaengine-stm32-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-stm32-dmamux-fix-of-node-leak-on-route-allocation-failure.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch
+dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
