--- /dev/null
+From 76cba1e60b69c9cd53b9127d017a7dc5945455b1 Mon Sep 17 00:00:00 2001
+From: Janne Grunau <j@jannau.net>
+Date: Wed, 31 Dec 2025 13:34:59 +0100
+Subject: dmaengine: apple-admac: Add "apple,t8103-admac" compatible
+
+From: Janne Grunau <j@jannau.net>
+
+commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream.
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,admac" anymore [1]. Use
+"apple,t8103-admac" as base compatible as it is the SoC the driver and
+bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://patch.msgid.link/20251231-apple-admac-t8103-base-compat-v1-1-ec24a3708f76@jannau.net
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/apple-admac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/dma/apple-admac.c
++++ b/drivers/dma/apple-admac.c
+@@ -937,6 +937,7 @@ static int admac_remove(struct platform_
+ }
+
+ static const struct of_device_id admac_of_match[] = {
++ { .compatible = "apple,t8103-admac", },
+ { .compatible = "apple,admac", },
+ { }
+ };
--- /dev/null
+From b9074b2d7a230b6e28caa23165e9d8bc0677d333 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:43 +0100
+Subject: dmaengine: at_hdmac: fix device leak on of_dma_xlate()
+
+From: Johan Hovold <johan@kernel.org>
+
+commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
+
+Make sure to drop the reference taken when looking up the DMA platform
+device during of_dma_xlate() when releasing channel resources.
+
+Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing
+put_device() call in at_dma_xlate()") fixed the leak in a couple of
+error paths but the reference is still leaking on successful allocation.
+
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()")
+Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_hdmac.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1347,6 +1347,7 @@ static int atc_config(struct dma_chan *c
+ struct dma_slave_config *sconfig)
+ {
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
++ struct at_dma_slave *atslave;
+
+ dev_vdbg(chan2dev(chan), "%s\n", __func__);
+
+@@ -1606,8 +1607,12 @@ static void atc_free_chan_resources(stru
+ /*
+ * Free atslave allocated in at_dma_xlate()
+ */
+- kfree(chan->private);
+- chan->private = NULL;
++ atslave = chan->private;
++ if (atslave) {
++ put_device(atslave->dma_dev);
++ kfree(atslave);
++ chan->private = NULL;
++ }
+
+ dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
--- /dev/null
+From 7c3a46ebf15a9796b763a54272407fdbf945bed8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:45 +0100
+Subject: dmaengine: bcm-sba-raid: fix device leak on probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
+
+Make sure to drop the reference taken when looking up the mailbox device
+during probe on probe failures and on driver unbind.
+
+Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver")
+Cc: stable@vger.kernel.org # 4.13
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/bcm-sba-raid.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/bcm-sba-raid.c
++++ b/drivers/dma/bcm-sba-raid.c
+@@ -1697,7 +1697,7 @@ static int sba_probe(struct platform_dev
+ /* Prealloc channel resource */
+ ret = sba_prealloc_channel_resources(sba);
+ if (ret)
+- goto fail_free_mchan;
++ goto fail_put_mbox;
+
+ /* Check availability of debugfs */
+ if (!debugfs_initialized())
+@@ -1727,6 +1727,8 @@ skip_debugfs:
+ fail_free_resources:
+ debugfs_remove_recursive(sba->root);
+ sba_freeup_channel_resources(sba);
++fail_put_mbox:
++ put_device(sba->mbox_dev);
+ fail_free_mchan:
+ mbox_free_channel(sba->mchan);
+ return ret;
+@@ -1742,6 +1744,8 @@ static int sba_remove(struct platform_de
+
+ sba_freeup_channel_resources(sba);
+
++ put_device(sba->mbox_dev);
++
+ mbox_free_channel(sba->mchan);
+
+ return 0;
--- /dev/null
+From ec25e60f9f95464aa11411db31d0906b3fb7b9f2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:47 +0100
+Subject: dmaengine: dw: dmamux: fix OF node leak on route allocation failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream.
+
+Make sure to drop the reference taken to the DMA master OF node also on
+late route allocation failures.
+
+Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support")
+Cc: stable@vger.kernel.org # 5.19
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://patch.msgid.link/20251117161258.10679-6-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dw/rzn1-dmamux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dw/rzn1-dmamux.c
++++ b/drivers/dma/dw/rzn1-dmamux.c
+@@ -88,7 +88,7 @@ static void *rzn1_dmamux_route_allocate(
+
+ if (test_and_set_bit(map->req_idx, dmamux->used_chans)) {
+ ret = -EBUSY;
+- goto free_map;
++ goto put_dma_spec_np;
+ }
+
+ mask = BIT(map->req_idx);
+@@ -101,6 +101,8 @@ static void *rzn1_dmamux_route_allocate(
+
+ clear_bitmap:
+ clear_bit(map->req_idx, dmamux->used_chans);
++put_dma_spec_np:
++ of_node_put(dma_spec->np);
+ free_map:
+ kfree(map);
+ put_device:
--- /dev/null
+From 799900f01792cf8b525a44764f065f83fcafd468 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:48 +0100
+Subject: dmaengine: idxd: fix device leaks on compat bind and unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 799900f01792cf8b525a44764f065f83fcafd468 upstream.
+
+Make sure to drop the reference taken when looking up the idxd device as
+part of the compat bind and unbind sysfs interface.
+
+Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")
+Cc: stable@vger.kernel.org # 5.15
+Cc: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/compat.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma/idxd/compat.c
++++ b/drivers/dma/idxd/compat.c
+@@ -21,11 +21,16 @@ static ssize_t unbind_store(struct devic
+ int rc = -ENODEV;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+- if (dev && dev->driver) {
++ if (!dev)
++ return -ENODEV;
++
++ if (dev->driver) {
+ device_driver_detach(dev);
+ rc = count;
+ }
+
++ put_device(dev);
++
+ return rc;
+ }
+ static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
+@@ -39,9 +44,12 @@ static ssize_t bind_store(struct device_
+ struct idxd_dev *idxd_dev;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+- if (!dev || dev->driver || drv != &dsa_drv.drv)
++ if (!dev)
+ return -ENODEV;
+
++ if (dev->driver || drv != &dsa_drv.drv)
++ goto err_put_dev;
++
+ idxd_dev = confdev_to_idxd_dev(dev);
+ if (is_idxd_dev(idxd_dev)) {
+ alt_drv = driver_find("idxd", bus);
+@@ -54,13 +62,20 @@ static ssize_t bind_store(struct device_
+ alt_drv = driver_find("user", bus);
+ }
+ if (!alt_drv)
+- return -ENODEV;
++ goto err_put_dev;
+
+ rc = device_driver_attach(alt_drv, dev);
+ if (rc < 0)
+- return rc;
++ goto err_put_dev;
++
++ put_device(dev);
+
+ return count;
++
++err_put_dev:
++ put_device(dev);
++
++ return rc;
+ }
+ static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
+
--- /dev/null
+From d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:49 +0100
+Subject: dmaengine: lpc18xx-dmamux: fix device leak on route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
+
+Make sure to drop the reference taken when looking up the DMA mux
+platform device during route allocation.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away so there is no point in keeping the reference.
+
+Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux")
+Cc: stable@vger.kernel.org # 4.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/lpc18xx-dmamux.c
++++ b/drivers/dma/lpc18xx-dmamux.c
+@@ -55,30 +55,31 @@ static void *lpc18xx_dmamux_reserve(stru
+ struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev);
+ unsigned long flags;
+ unsigned mux;
++ int ret = -EINVAL;
+
+ if (dma_spec->args_count != 3) {
+ dev_err(&pdev->dev, "invalid number of dma mux args\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ mux = dma_spec->args[0];
+ if (mux >= dmamux->dma_master_requests) {
+ dev_err(&pdev->dev, "invalid mux number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) {
+ dev_err(&pdev->dev, "invalid dma mux value: %d\n",
+ dma_spec->args[1]);
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "can't get dma master\n");
+- return ERR_PTR(-EINVAL);
++ goto err_put_pdev;
+ }
+
+ spin_lock_irqsave(&dmamux->lock, flags);
+@@ -87,7 +88,8 @@ static void *lpc18xx_dmamux_reserve(stru
+ dev_err(&pdev->dev, "dma request %u busy with %u.%u\n",
+ mux, mux, dmamux->muxes[mux].value);
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-EBUSY);
++ ret = -EBUSY;
++ goto err_put_pdev;
+ }
+
+ dmamux->muxes[mux].busy = true;
+@@ -104,7 +106,14 @@ static void *lpc18xx_dmamux_reserve(stru
+ dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux,
+ dmamux->muxes[mux].value, mux);
+
++ put_device(&pdev->dev);
++
+ return &dmamux->muxes[mux];
++
++err_put_pdev:
++ put_device(&pdev->dev);
++
++ return ERR_PTR(ret);
+ }
+
+ static int lpc18xx_dmamux_probe(struct platform_device *pdev)
--- /dev/null
+From 3f747004bbd641131d9396d87b5d2d3d1e182728 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 29 Oct 2025 20:34:19 +0800
+Subject: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
+
+Fix a memory leak in gpi_peripheral_config() where the original memory
+pointed to by gchan->config could be lost if krealloc() fails.
+
+The issue occurs when:
+1. gchan->config points to previously allocated memory
+2. krealloc() fails and returns NULL
+3. The function directly assigns NULL to gchan->config, losing the
+ reference to the original memory
+4. The original memory becomes unreachable and cannot be freed
+
+Fix this by using a temporary variable to hold the krealloc() result
+and only updating gchan->config when the allocation succeeds.
+
+Found via static analysis and code review.
+
+Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/qcom/gpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/qcom/gpi.c
++++ b/drivers/dma/qcom/gpi.c
+@@ -1621,14 +1621,16 @@ static int
+ gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)
+ {
+ struct gchan *gchan = to_gchan(chan);
++ void *new_config;
+
+ if (!config->peripheral_config)
+ return -EINVAL;
+
+- gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
+- if (!gchan->config)
++ new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
++ if (!new_config)
+ return -ENOMEM;
+
++ gchan->config = new_config;
+ memcpy(gchan->config, config->peripheral_config, config->peripheral_size);
+
+ return 0;
--- /dev/null
+From 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Thu, 13 Nov 2025 19:50:48 +0000
+Subject: dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream.
+
+After audio full duplex testing, playing the recorded file contains a few
+playback frames from the previous time. The rz_dmac_terminate_all() does
+not reset all the hardware descriptors queued previously, leading to the
+wrong descriptor being picked up during the next DMA transfer. Fix the
+above issue by resetting all the descriptor headers for a channel in
+rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper
+descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg().
+
+Cc: stable@kernel.org
+Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/sh/rz-dmac.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/dma/sh/rz-dmac.c
++++ b/drivers/dma/sh/rz-dmac.c
+@@ -533,11 +533,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *c
+ static int rz_dmac_terminate_all(struct dma_chan *chan)
+ {
+ struct rz_dmac_chan *channel = to_rz_dmac_chan(chan);
++ struct rz_lmdesc *lmdesc = channel->lmdesc.base;
+ unsigned long flags;
++ unsigned int i;
+ LIST_HEAD(head);
+
+ rz_dmac_disable_hw(channel);
+ spin_lock_irqsave(&channel->vc.lock, flags);
++ for (i = 0; i < DMAC_NR_LMDESC; i++)
++ lmdesc[i].header = 0;
++
+ list_splice_tail_init(&channel->ld_active, &channel->ld_free);
+ list_splice_tail_init(&channel->ld_queue, &channel->ld_free);
+ spin_unlock_irqrestore(&channel->vc.lock, flags);
--- /dev/null
+From 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:56 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during am335x route allocation.
+
+Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx")
+Cc: stable@vger.kernel.org # 4.4
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -78,34 +78,35 @@ static void *ti_am335x_xbar_route_alloca
+ {
+ struct platform_device *pdev = of_find_device_by_node(ofdma->of_node);
+ struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev);
+- struct ti_am335x_xbar_map *map;
++ struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL);
+
+ if (dma_spec->args_count != 3)
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+
+ if (dma_spec->args[2] >= xbar->xbar_events) {
+ dev_err(&pdev->dev, "Invalid XBAR event number: %d\n",
+ dma_spec->args[2]);
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ if (dma_spec->args[0] >= xbar->dma_requests) {
+ dev_err(&pdev->dev, "Invalid DMA request line number: %d\n",
+ dma_spec->args[0]);
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ /* The of_node_put() will be done in the core for the node */
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "Can't get DMA master\n");
+- return ERR_PTR(-EINVAL);
++ goto out_put_pdev;
+ }
+
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map) {
+ of_node_put(dma_spec->np);
+- return ERR_PTR(-ENOMEM);
++ map = ERR_PTR(-ENOMEM);
++ goto out_put_pdev;
+ }
+
+ map->dma_line = (u16)dma_spec->args[0];
+@@ -119,6 +120,9 @@ static void *ti_am335x_xbar_route_alloca
+
+ ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val);
+
++out_put_pdev:
++ put_device(&pdev->dev);
++
+ return map;
+ }
+
--- /dev/null
+From dc7e44db01fc2498644e3106db3e62a9883a93d5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:55 +0100
+Subject: dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
+
+From: Johan Hovold <johan@kernel.org>
+
+commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
+
+Make sure to drop the reference taken when looking up the crossbar
+platform device during dra7x route allocation.
+
+Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in
+ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the
+reference is still leaking on successful allocation.
+
+Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x")
+Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate")
+Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/dma-crossbar.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -287,6 +287,8 @@ static void *ti_dra7_xbar_route_allocate
+
+ ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in);
+
++ put_device(&pdev->dev);
++
+ return map;
+ }
+
--- /dev/null
+From 430f7803b69cd5e5694e5dfc884c6628870af36e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 17 Nov 2025 17:12:58 +0100
+Subject: dmaengine: ti: k3-udma: fix device leak on udma lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
+
+Make sure to drop the reference taken when looking up the UDMA platform
+device.
+
+Note that holding a reference to a platform device does not prevent its
+driver data from going away so there is no point in keeping the
+reference after the lookup helper returns.
+
+Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users")
+Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()")
+Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ti/k3-udma-private.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/ti/k3-udma-private.c
++++ b/drivers/dma/ti/k3-udma-private.c
+@@ -40,9 +40,9 @@ struct udma_dev *of_xudma_dev_get(struct
+ }
+
+ ud = platform_get_drvdata(pdev);
++ put_device(&pdev->dev);
+ if (!ud) {
+ pr_debug("UDMA has not been probed\n");
+- put_device(&pdev->dev);
+ return ERR_PTR(-EPROBE_DEFER);
+ }
+
--- /dev/null
+From 28695ca09d326461f8078332aa01db516983e8a2 Mon Sep 17 00:00:00 2001
+From: "Mario Limonciello (AMD)" <superm1@kernel.org>
+Date: Wed, 7 Jan 2026 15:37:28 -0600
+Subject: drm/amd: Clean up kfd node on surprise disconnect
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
+
+When an eGPU is unplugged the KFD topology should also be destroyed
+for that GPU. This never happens because the fini_sw callbacks never
+get to run. Run them manually before calling amdgpu_device_ip_fini_early()
+when a device has already been disconnected.
+
+This location is intentionally chosen to make sure that the kfd locking
+refcount doesn't get incremented unintentionally.
+
+Cc: kent.russell@amd.com
+Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4102,6 +4102,14 @@ void amdgpu_device_fini_hw(struct amdgpu
+ /* disable ras feature must before hw fini */
+ amdgpu_ras_pre_fini(adev);
+
++ /*
++ * device went through surprise hotplug; we need to destroy topology
++ * before ip_fini_early to prevent kfd locking refcount issues by calling
++ * amdgpu_amdkfd_suspend()
++ */
++ if (drm_dev_is_unplugged(adev_to_drm(adev)))
++ amdgpu_amdkfd_device_fini_sw(adev);
++
+ amdgpu_device_ip_fini_early(adev);
+
+ amdgpu_irq_fini_hw(adev);
--- /dev/null
+From 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 19 Dec 2025 16:52:02 -0500
+Subject: drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
+
+For a while, I've been seeing a strange issue where some (usually not all)
+of the display DMA channels will suddenly hang, particularly when there is
+a visible cursor on the screen that is being frequently updated, and
+especially when said cursor happens to go between two screens. While this
+brings back lovely memories of fixing Intel Skylake bugs, I would quite
+like to fix it :).
+
+It turns out the problem that's happening here is that we're managing to
+reach nv50_head_flush_set() in our atomic commit path without actually
+holding nv50_disp->mutex. This means that cursor updates happening in
+parallel (along with any other atomic updates that need to use the core
+channel) will race with eachother, which eventually causes us to corrupt
+the pushbuffer - leading to a plethora of various GSP errors, usually:
+
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001
+ nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
+
+The reason this is happening is because generally we check whether we need
+to set nv50_atom->lock_core at the end of nv50_head_atomic_check().
+However, curs507a_prepare is called from the fb_prepare callback, which
+happens after the atomic check phase. As a result, this can lead to commits
+that both touch the core channel but also don't grab nv50_disp->mutex.
+
+So, fix this by making sure that we set nv50_atom->lock_core in
+cus507a_prepare().
+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
+Cc: <stable@vger.kernel.org> # v4.18+
+Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
+@@ -83,6 +83,7 @@ curs507a_prepare(struct nv50_wndw *wndw,
+ asyh->curs.handle = handle;
+ asyh->curs.offset = offset;
+ asyh->set.curs = asyh->curs.visible;
++ nv50_atom(asyh->state.state)->lock_core = true;
+ }
+ }
+
--- /dev/null
+From 6ab3d4353bf75005eaa375677c9fed31148154d6 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@nabladev.com>
+Date: Sat, 10 Jan 2026 16:27:28 +0100
+Subject: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
+
+From: Marek Vasut <marex@nabladev.com>
+
+commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
+
+The connector type for the DataImage SCF0700C48GGU18 panel is missing and
+devm_drm_panel_bridge_add() requires connector type to be set. This leads
+to a warning and a backtrace in the kernel log and panel does not work:
+"
+WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
+"
+The warning is triggered by a check for valid connector type in
+devm_drm_panel_bridge_add(). If there is no valid connector type
+set for a panel, the warning is printed and panel is not added.
+Fill in the missing connector type to fix the warning and make
+the panel operational once again.
+
+Cc: stable@vger.kernel.org
+Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18")
+Signed-off-by: Marek Vasut <marex@nabladev.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1518,6 +1518,7 @@ static const struct panel_desc dataimage
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
++ .connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+
+ static const struct display_timing dlc_dlc0700yzg_1_timing = {
--- /dev/null
+From bf72b4b7bb7dbb643d204fa41e7463894a95999f Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Wed, 24 Dec 2025 17:11:05 +0800
+Subject: drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
+
+In vmw_compat_shader_add(), the return value check of vmw_shader_alloc()
+is not proper. Modify the check for the return pointer 'res'.
+
+Found by code review and compiled on ubuntu 20.04.
+
+Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+@@ -917,8 +917,10 @@ int vmw_compat_shader_add(struct vmw_pri
+ ttm_bo_unreserve(&buf->base);
+
+ res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type);
+- if (unlikely(ret != 0))
++ if (IS_ERR(res)) {
++ ret = PTR_ERR(res);
+ goto no_reserve;
++ }
+
+ ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader,
+ vmw_shader_key(user_key, shader_type),
mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch
mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch
loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch
+drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch
+drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch
+drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch
+drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch
+dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch
+dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch
+dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch
+dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch
+dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch
+dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch
+dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch
+dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch
+dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch
+dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
