--- /dev/null
+From ec9d588391761a08aab5eb4523a48ef3df2c910f Mon Sep 17 00:00:00 2001
+From: Luca Weiss <luca.weiss@fairphone.com>
+Date: Thu, 23 Oct 2025 13:39:26 +0200
+Subject: arm64: dts: qcom: sm6350: Fix wrong order of freq-table-hz for UFS
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+commit ec9d588391761a08aab5eb4523a48ef3df2c910f upstream.
+
+During upstreaming the order of clocks was adjusted to match the
+upstream sort order, but mistakently freq-table-hz wasn't re-ordered
+with the new order.
+
+Fix that by moving the entry for the ICE clk to the last place.
+
+Fixes: 5a814af5fc22 ("arm64: dts: qcom: sm6350: Add UFS nodes")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Link: https://lore.kernel.org/r/20251023-sm6350-ufs-things-v3-1-b68b74e29d35@fairphone.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sm6350.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+index 14788d60faf0..0d2eb51ecc50 100644
+--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+@@ -1180,11 +1180,11 @@
+ <0 0>,
+ <0 0>,
+ <37500000 150000000>,
+- <75000000 300000000>,
+ <0 0>,
+ <0 0>,
+ <0 0>,
+- <0 0>;
++ <0 0>,
++ <75000000 300000000>;
+
+ status = "disabled";
+ };
+--
+2.52.0
+
--- /dev/null
+From 22f0ae971cf5536349521853737d3e06203286d8 Mon Sep 17 00:00:00 2001
+From: Patrice Chotard <patrice.chotard@foss.st.com>
+Date: Fri, 31 Oct 2025 15:07:03 +0100
+Subject: arm64: dts: st: Add memory-region-names property for stm32mp257f-ev1
+
+From: Patrice Chotard <patrice.chotard@foss.st.com>
+
+commit 22f0ae971cf5536349521853737d3e06203286d8 upstream.
+
+In order to set the AMCR register, which configures the
+memory-region split between ospi1 and ospi2, we need to
+identify the ospi instance.
+
+By using memory-region-names, it allows to identify the
+ospi instance this memory-region belongs to.
+
+Fixes: cad2492de91c ("arm64: dts: st: Add SPI NOR flash support on stm32mp257f-ev1 board")
+Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20251031-upstream_fix_dts_omm-v4-1-e4a059a50074@foss.st.com
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/st/stm32mp257f-ev1.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts b/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts
+index 6e165073f732..bb6d6393d2e4 100644
+--- a/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts
++++ b/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts
+@@ -266,6 +266,7 @@
+
+ &ommanager {
+ memory-region = <&mm_ospi1>;
++ memory-region-names = "ospi1";
+ pinctrl-0 = <&ospi_port1_clk_pins_a
+ &ospi_port1_io03_pins_a
+ &ospi_port1_cs0_pins_a>;
+--
+2.52.0
+
--- /dev/null
+From 394b02210a81c06c4cb879d65ba83d0f1c468c84 Mon Sep 17 00:00:00 2001
+From: Paresh Bhagat <p-bhagat@ti.com>
+Date: Wed, 29 Oct 2025 03:06:44 +0530
+Subject: arm64: dts: ti: k3-am62d2-evm: Fix PMIC padconfig
+
+From: Paresh Bhagat <p-bhagat@ti.com>
+
+commit 394b02210a81c06c4cb879d65ba83d0f1c468c84 upstream.
+
+Fix the PMIC padconfig for AM62D. PMIC's INT pin is connected to the
+SoC's EXTINTn input.
+
+Reference Docs
+Datasheet - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf
+Schematics - https://www.ti.com/lit/zip/sprcal5
+
+Fixes: 1544bca2f188e ("arm64: dts: ti: Add support for AM62D2-EVM")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
+Link: https://patch.msgid.link/20251028213645.437957-2-p-bhagat@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62d2-evm.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+index d202484eec3f..9a74df221f2a 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+@@ -201,7 +201,7 @@
+
+ pmic_irq_pins_default: pmic-irq-default-pins {
+ pinctrl-single,pins = <
+- AM62DX_MCU_IOPAD(0x000, PIN_INPUT, 7) /* (E11) MCU_GPIO0_0 */
++ AM62DX_IOPAD(0x01f4, PIN_INPUT, 7) /* (F17) EXTINTn.GPIO1_31 */
+ >;
+ };
+
+--
+2.52.0
+
--- /dev/null
+From 0103435072bf5c54bb43d1a9376d08396c825827 Mon Sep 17 00:00:00 2001
+From: Paresh Bhagat <p-bhagat@ti.com>
+Date: Wed, 29 Oct 2025 02:31:53 +0530
+Subject: arm64: dts: ti: k3-am62d2-evm: Fix regulator properties
+
+From: Paresh Bhagat <p-bhagat@ti.com>
+
+commit 0103435072bf5c54bb43d1a9376d08396c825827 upstream.
+
+Fix missing supply for regulators TLV7103318QDSERQ1 and TPS22918DBVR.
+Correct padconfig and gpio for TLV7103318QDSERQ1.
+
+Reference Docs
+Datasheet - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf
+Schematics - https://www.ti.com/lit/zip/sprcal5
+
+Fixes: 1544bca2f188e ("arm64: dts: ti: Add support for AM62D2-EVM")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
+Reviewed-by: Shree Ramamoorthy <s-ramamoorthy@ti.com>
+Link: https://patch.msgid.link/20251028210153.420473-1-p-bhagat@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62d2-evm.dts | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+index 83af889e790a..d202484eec3f 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+@@ -146,6 +146,7 @@
+ regulator-name = "vdd_mmc1";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
++ vin-supply = <&vcc_3v3_sys>;
+ regulator-boot-on;
+ enable-active-high;
+ gpio = <&exp1 3 GPIO_ACTIVE_HIGH>;
+@@ -165,14 +166,16 @@
+ };
+
+ vddshv_sdio: regulator-6 {
++ /* output of TLV7103318QDSERQ1 */
+ compatible = "regulator-gpio";
+ regulator-name = "vddshv_sdio";
+ pinctrl-names = "default";
+ pinctrl-0 = <&vddshv_sdio_pins_default>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
++ vin-supply = <&vcc_5v0>;
+ regulator-boot-on;
+- gpios = <&main_gpio1 31 GPIO_ACTIVE_HIGH>;
++ gpios = <&main_gpio0 59 GPIO_ACTIVE_HIGH>;
+ states = <1800000 0x0>,
+ <3300000 0x1>;
+ bootph-all;
+@@ -334,7 +337,7 @@
+
+ vddshv_sdio_pins_default: vddshv-sdio-default-pins {
+ pinctrl-single,pins = <
+- AM62DX_IOPAD(0x1f4, PIN_OUTPUT, 7) /* (M19) GPMC0_CLK.GPIO1_31 */
++ AM62DX_IOPAD(0x00f0, PIN_INPUT, 7) /* (Y21) GPIO0_59 */
+ >;
+ bootph-all;
+ };
+--
+2.52.0
+
--- /dev/null
+From d0ac06ae53be0cdb61f5fe6b62d25d3317c51657 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 20 Oct 2025 14:48:13 +0200
+Subject: dm-bufio: align write boundary on physical block size
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d0ac06ae53be0cdb61f5fe6b62d25d3317c51657 upstream.
+
+There may be devices with physical block size larger than 4k.
+
+If dm-bufio sends I/O that is not aligned on physical block size,
+performance is degraded.
+
+The 4k minimum alignment limit is there because some SSDs report logical
+and physical block size 512 despite having 4k internally - so dm-bufio
+shouldn't send I/Os not aligned on 4k boundary, because they perform
+badly (the SSD does read-modify-write for them).
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reported-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-bufio.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1374,7 +1374,7 @@ static void submit_io(struct dm_buffer *
+ {
+ unsigned int n_sectors;
+ sector_t sector;
+- unsigned int offset, end;
++ unsigned int offset, end, align;
+
+ b->end_io = end_io;
+
+@@ -1388,9 +1388,11 @@ static void submit_io(struct dm_buffer *
+ b->c->write_callback(b);
+ offset = b->write_start;
+ end = b->write_end;
+- offset &= -DM_BUFIO_WRITE_ALIGN;
+- end += DM_BUFIO_WRITE_ALIGN - 1;
+- end &= -DM_BUFIO_WRITE_ALIGN;
++ align = max(DM_BUFIO_WRITE_ALIGN,
++ bdev_physical_block_size(b->c->bdev));
++ offset &= -align;
++ end += align - 1;
++ end &= -align;
+ if (unlikely(end > b->c->block_size))
+ end = b->c->block_size;
+
--- /dev/null
+From 7fa3e7d114abc9cc71cc35d768e116641074ddb4 Mon Sep 17 00:00:00 2001
+From: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
+Date: Mon, 17 Nov 2025 11:59:45 +0100
+Subject: dm-ebs: Mark full buffer dirty even on partial write
+
+From: Uladzislau Rezki (Sony) <urezki@gmail.com>
+
+commit 7fa3e7d114abc9cc71cc35d768e116641074ddb4 upstream.
+
+When performing a read-modify-write(RMW) operation, any modification
+to a buffered block must cause the entire buffer to be marked dirty.
+
+Marking only a subrange as dirty is incorrect because the underlying
+device block size(ubs) defines the minimum read/write granularity. A
+lower device can perform I/O only on regions which are fully aligned
+and sized to ubs.
+
+This change ensures that write-back operations always occur in full
+ubs-sized chunks, matching the intended emulation semantics of the
+EBS target.
+
+As for user space visible impact, submitting sub-ubs and misaligned
+I/O for devices which are tuned to ubs sizes only, will reject such
+requests, therefore it can lead to losing data. Example:
+
+1) Create a 8K nvme device in qemu by adding
+
+-device nvme,drive=drv0,serial=foo,logical_block_size=8192,physical_block_size=8192
+
+2) Setup dm-ebs to emulate 512B to 8K mapping
+
+urezki@pc638:~/bin$ cat dmsetup.sh
+
+lower=/dev/nvme0n1
+len=$(blockdev --getsz "$lower")
+
+echo "0 $len ebs $lower 0 1 16" | dmsetup create nvme-8k
+urezki@pc638:~/bin$
+
+offset 0, ebs=1 and ubs=16(in sectors).
+
+3) Create an ext4 filesystem(default 4K block size)
+
+urezki@pc638:~/bin$ sudo mkfs.ext4 -F /dev/dm-0
+mke2fs 1.47.0 (5-Feb-2023)
+Discarding device blocks: done
+Creating filesystem with 2072576 4k blocks and 518144 inodes
+Filesystem UUID: bd0b6ca6-0506-4e31-86da-8d22c9d50b63
+Superblock backups stored on blocks:
+ 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632
+
+Allocating group tables: done
+Writing inode tables: done
+Creating journal (16384 blocks): done
+Writing superblocks and filesystem accounting information: mkfs.ext4: Input/output error while writing out and closing file system
+urezki@pc638:~/bin$ dmesg
+
+<snip>
+[ 1618.875449] buffer_io_error: 1028 callbacks suppressed
+[ 1618.875456] Buffer I/O error on dev dm-0, logical block 0, lost async page write
+[ 1618.875527] Buffer I/O error on dev dm-0, logical block 1, lost async page write
+[ 1618.875602] Buffer I/O error on dev dm-0, logical block 2, lost async page write
+[ 1618.875620] Buffer I/O error on dev dm-0, logical block 3, lost async page write
+[ 1618.875639] Buffer I/O error on dev dm-0, logical block 4, lost async page write
+[ 1618.894316] Buffer I/O error on dev dm-0, logical block 5, lost async page write
+[ 1618.894358] Buffer I/O error on dev dm-0, logical block 6, lost async page write
+[ 1618.894380] Buffer I/O error on dev dm-0, logical block 7, lost async page write
+[ 1618.894405] Buffer I/O error on dev dm-0, logical block 8, lost async page write
+[ 1618.894427] Buffer I/O error on dev dm-0, logical block 9, lost async page write
+<snip>
+
+Many I/O errors because the lower 8K device rejects sub-ubs/misaligned
+requests.
+
+with a patch:
+
+urezki@pc638:~/bin$ sudo mkfs.ext4 -F /dev/dm-0
+mke2fs 1.47.0 (5-Feb-2023)
+Discarding device blocks: done
+Creating filesystem with 2072576 4k blocks and 518144 inodes
+Filesystem UUID: 9b54f44f-ef55-4bd4-9e40-c8b775a616ac
+Superblock backups stored on blocks:
+ 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632
+
+Allocating group tables: done
+Writing inode tables: done
+Creating journal (16384 blocks): done
+Writing superblocks and filesystem accounting information: done
+
+urezki@pc638:~/bin$ sudo mount /dev/dm-0 /mnt/
+urezki@pc638:~/bin$ ls -al /mnt/
+total 24
+drwxr-xr-x 3 root root 4096 Oct 17 15:13 .
+drwxr-xr-x 19 root root 4096 Jul 10 19:42 ..
+drwx------ 2 root root 16384 Oct 17 15:13 lost+found
+urezki@pc638:~/bin$
+
+After this change: mkfs completes; mount succeeds.
+
+Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-ebs-target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-ebs-target.c
++++ b/drivers/md/dm-ebs-target.c
+@@ -103,7 +103,7 @@ static int __ebs_rw_bvec(struct ebs_c *e
+ } else {
+ flush_dcache_page(bv->bv_page);
+ memcpy(ba, pa, cur_len);
+- dm_bufio_mark_partial_buffer_dirty(b, buf_off, buf_off + cur_len);
++ dm_bufio_mark_buffer_dirty(b);
+ }
+
+ dm_bufio_release(b);
--- /dev/null
+From ee7633178321f5d983db3adfdea9322456cfdaaa Mon Sep 17 00:00:00 2001
+From: Li Chen <chenl311@chinatelecom.cn>
+Date: Fri, 5 Dec 2025 05:46:19 +0000
+Subject: dm pcache: fix cache info indexing
+
+From: Li Chen <chenl311@chinatelecom.cn>
+
+commit ee7633178321f5d983db3adfdea9322456cfdaaa upstream.
+
+The on-media cache_info index used sizeof(struct) instead of the
+4K metadata stride, so gc_percent updates from dmsetup message
+were written between slots and lost after reboot. Use
+PCACHE_CACHE_INFO_SIZE in get_cache_info_addr() and align
+info_index with the slot returned by pcache_meta_find_latest().
+
+Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
+Signed-off-by: Dongsheng Yang <dongsheng.yang@linux.dev>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reviewed-by: Zheng Gu <cengku@gmail.com>
+Cc: stable@vger.kernel.org # 6.18
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-pcache/cache.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-pcache/cache.c
++++ b/drivers/md/dm-pcache/cache.c
+@@ -10,7 +10,8 @@ struct kmem_cache *key_cache;
+
+ static inline struct pcache_cache_info *get_cache_info_addr(struct pcache_cache *cache)
+ {
+- return cache->cache_info_addr + cache->info_index;
++ return (struct pcache_cache_info *)((char *)cache->cache_info_addr +
++ (size_t)cache->info_index * PCACHE_CACHE_INFO_SIZE);
+ }
+
+ static void cache_info_write(struct pcache_cache *cache)
+@@ -49,6 +50,8 @@ static int cache_info_init(struct pcache
+ return -EINVAL;
+ }
+
++ cache->info_index = ((char *)cache_info_addr - (char *)cache->cache_info_addr) / PCACHE_CACHE_INFO_SIZE;
++
+ return 0;
+ }
+
--- /dev/null
+From 13ea55ea20176736516b20b9ea2d8cf97dbe74f5 Mon Sep 17 00:00:00 2001
+From: Li Chen <chenl311@chinatelecom.cn>
+Date: Fri, 5 Dec 2025 05:46:20 +0000
+Subject: dm pcache: fix segment info indexing
+
+From: Li Chen <chenl311@chinatelecom.cn>
+
+commit 13ea55ea20176736516b20b9ea2d8cf97dbe74f5 upstream.
+
+Segment info indexing also used sizeof(struct) instead of the
+4K metadata stride, so info_index could point between slots and
+subsequent writes would advance incorrectly. Derive info_index
+from the pointer returned by the segment meta search using
+PCACHE_SEG_INFO_SIZE and advance to the next slot for future
+updates.
+
+Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
+Signed-off-by: Dongsheng Yang <dongsheng.yang@linux.dev>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reviewed-by: Zheng Gu <cengku@gmail.com>
+Cc: stable@vger.kernel.org # 6.18
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-pcache/cache_segment.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-pcache/cache_segment.c b/drivers/md/dm-pcache/cache_segment.c
+index ae57cc261422..9d92e2b067ed 100644
+--- a/drivers/md/dm-pcache/cache_segment.c
++++ b/drivers/md/dm-pcache/cache_segment.c
+@@ -56,7 +56,10 @@ static int cache_seg_info_load(struct pcache_cache_segment *cache_seg)
+ ret = -EIO;
+ goto out;
+ }
+- cache_seg->info_index = cache_seg_info_addr - cache_seg_info_addr_base;
++
++ cache_seg->info_index =
++ ((char *)cache_seg_info_addr - (char *)cache_seg_info_addr_base) /
++ PCACHE_SEG_INFO_SIZE;
+ out:
+ mutex_unlock(&cache_seg->info_lock);
+
+--
+2.52.0
+
--- /dev/null
+From e3f44742bbb10537fe53d83d20dea2a7c167674d Mon Sep 17 00:00:00 2001
+From: Rene Rebe <rene@exactco.de>
+Date: Fri, 14 Nov 2025 16:00:42 +0100
+Subject: fbdev: gbefb: fix to use physical address instead of dma address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rene Rebe <rene@exactco.de>
+
+commit e3f44742bbb10537fe53d83d20dea2a7c167674d upstream.
+
+While debuggigng why X would not start on mips64 Sgi/O2 I found the
+phys adress being off. Turns out the gbefb passed the internal
+dma_addr as phys. May be broken pre git history. Fix by converting
+dma_to_phys.
+
+Signed-off-by: René Rebe <rene@exactco.de>
+Cc: <stable@vger.kernel.org> # v4.0+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/gbefb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/gbefb.c
++++ b/drivers/video/fbdev/gbefb.c
+@@ -12,6 +12,7 @@
+ #include <linux/delay.h>
+ #include <linux/platform_device.h>
+ #include <linux/dma-mapping.h>
++#include <linux/dma-direct.h>
+ #include <linux/errno.h>
+ #include <linux/gfp.h>
+ #include <linux/fb.h>
+@@ -65,7 +66,7 @@ struct gbefb_par {
+ static unsigned int gbe_mem_size = CONFIG_FB_GBE_MEM * 1024*1024;
+ static void *gbe_mem;
+ static dma_addr_t gbe_dma_addr;
+-static unsigned long gbe_mem_phys;
++static phys_addr_t gbe_mem_phys;
+
+ static struct {
+ uint16_t *cpu;
+@@ -1183,7 +1184,7 @@ static int gbefb_probe(struct platform_d
+ goto out_release_mem_region;
+ }
+
+- gbe_mem_phys = (unsigned long) gbe_dma_addr;
++ gbe_mem_phys = dma_to_phys(&p_dev->dev, gbe_dma_addr);
+ }
+
+ par = info->par;
--- /dev/null
+From 0155e868cbc111846cc2809c1546ea53810a56ae Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Tue, 2 Dec 2025 19:15:32 +0100
+Subject: fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit 0155e868cbc111846cc2809c1546ea53810a56ae upstream.
+
+The variables were never clamped because the return value of clamp_val()
+was not used. Fix this by assigning the clamped values, and use clamp()
+instead of clamp_val().
+
+Cc: stable@vger.kernel.org
+Fixes: 3f16ff608a75 ("[ARM] pxafb: cleanup of the timing checking code")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/pxafb.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/video/fbdev/pxafb.c
++++ b/drivers/video/fbdev/pxafb.c
+@@ -419,12 +419,12 @@ static int pxafb_adjust_timing(struct px
+ var->yres = max_t(int, var->yres, MIN_YRES);
+
+ if (!(fbi->lccr0 & LCCR0_LCDT)) {
+- clamp_val(var->hsync_len, 1, 64);
+- clamp_val(var->vsync_len, 1, 64);
+- clamp_val(var->left_margin, 1, 255);
+- clamp_val(var->right_margin, 1, 255);
+- clamp_val(var->upper_margin, 1, 255);
+- clamp_val(var->lower_margin, 1, 255);
++ var->hsync_len = clamp(var->hsync_len, 1, 64);
++ var->vsync_len = clamp(var->vsync_len, 1, 64);
++ var->left_margin = clamp(var->left_margin, 1, 255);
++ var->right_margin = clamp(var->right_margin, 1, 255);
++ var->upper_margin = clamp(var->upper_margin, 1, 255);
++ var->lower_margin = clamp(var->lower_margin, 1, 255);
+ }
+
+ /* make sure each line is aligned on word boundary */
--- /dev/null
+From 35fa2b4bf96415b88d7edaa5cf8af5185d9ce76e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ren=C3=A9=20Rebe?= <rene@exactco.de>
+Date: Thu, 20 Nov 2025 14:24:00 +0100
+Subject: fbdev: tcx.c fix mem_map to correct smem_start offset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+commit 35fa2b4bf96415b88d7edaa5cf8af5185d9ce76e upstream.
+
+403ae52ac047 ("sparc: fix drivers/video/tcx.c warning") changed the
+physbase initializing breaking the user-space mmap, e.g. for Xorg
+entirely.
+
+Fix fbdev mmap table so the sbus mmap helper work correctly, and
+not try to map vastly (physbase) offset memory.
+
+Fixes: 403ae52ac047 ("sparc: fix drivers/video/tcx.c warning")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: René Rebe <rene@exactco.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/tcx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/tcx.c
++++ b/drivers/video/fbdev/tcx.c
+@@ -428,7 +428,7 @@ static int tcx_probe(struct platform_dev
+ j = i;
+ break;
+ }
+- par->mmap_map[i].poff = op->resource[j].start;
++ par->mmap_map[i].poff = op->resource[j].start - info->fix.smem_start;
+ }
+
+ info->fbops = &tcx_ops;
--- /dev/null
+From 85f96cbbbc67b59652b2c1ec394b8ddc0ddf1b0b Mon Sep 17 00:00:00 2001
+From: Mahesh Rao <mahesh.rao@altera.com>
+Date: Mon, 27 Oct 2025 22:54:40 +0800
+Subject: firmware: stratix10-svc: Add mutex in stratix10 memory management
+
+From: Mahesh Rao <mahesh.rao@altera.com>
+
+commit 85f96cbbbc67b59652b2c1ec394b8ddc0ddf1b0b upstream.
+
+Add mutex lock to stratix10_svc_allocate_memory and
+stratix10_svc_free_memory for thread safety. This prevents race
+conditions and ensures proper synchronization during memory operations.
+This is required for parallel communication with the Stratix10 service
+channel.
+
+Fixes: 7ca5ce896524f ("firmware: add Intel Stratix10 service layer driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mahesh Rao <mahesh.rao@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/stratix10-svc.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+ * Copyright (C) 2017-2018, Intel Corporation
++ * Copyright (C) 2025, Altera Corporation
+ */
+
+ #include <linux/completion.h>
+@@ -176,6 +177,12 @@ static LIST_HEAD(svc_ctrl);
+ static LIST_HEAD(svc_data_mem);
+
+ /**
++ * svc_mem_lock protects access to the svc_data_mem list for
++ * concurrent multi-client operations
++ */
++static DEFINE_MUTEX(svc_mem_lock);
++
++/**
+ * svc_pa_to_va() - translate physical address to virtual address
+ * @addr: to be translated physical address
+ *
+@@ -187,6 +194,7 @@ static void *svc_pa_to_va(unsigned long
+ struct stratix10_svc_data_mem *pmem;
+
+ pr_debug("claim back P-addr=0x%016x\n", (unsigned int)addr);
++ guard(mutex)(&svc_mem_lock);
+ list_for_each_entry(pmem, &svc_data_mem, node)
+ if (pmem->paddr == addr)
+ return pmem->vaddr;
+@@ -993,6 +1001,7 @@ int stratix10_svc_send(struct stratix10_
+ p_data->flag = ct->flags;
+ }
+ } else {
++ guard(mutex)(&svc_mem_lock);
+ list_for_each_entry(p_mem, &svc_data_mem, node)
+ if (p_mem->vaddr == p_msg->payload) {
+ p_data->paddr = p_mem->paddr;
+@@ -1075,6 +1084,7 @@ void *stratix10_svc_allocate_memory(stru
+ if (!pmem)
+ return ERR_PTR(-ENOMEM);
+
++ guard(mutex)(&svc_mem_lock);
+ va = gen_pool_alloc(genpool, s);
+ if (!va)
+ return ERR_PTR(-ENOMEM);
+@@ -1103,6 +1113,7 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate
+ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
+ {
+ struct stratix10_svc_data_mem *pmem;
++ guard(mutex)(&svc_mem_lock);
+
+ list_for_each_entry(pmem, &svc_data_mem, node)
+ if (pmem->vaddr == kaddr) {
--- /dev/null
+From bf3fa8f232a1eec8d7b88dcd9e925e60f04f018d Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Sat, 6 Dec 2025 10:39:49 +0800
+Subject: LoongArch: Add new PCI ID for pci_fixup_vgadev()
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit bf3fa8f232a1eec8d7b88dcd9e925e60f04f018d upstream.
+
+Loongson-2K3000 has a new PCI ID (0x7a46) for its display controller,
+Add it for pci_fixup_vgadev() since we prefer a discrete graphics card
+as default boot device if present.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Tianrui Zhao <zhaotianrui@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/pci/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/loongarch/pci/pci.c
++++ b/arch/loongarch/pci/pci.c
+@@ -14,6 +14,7 @@
+ #define PCI_DEVICE_ID_LOONGSON_HOST 0x7a00
+ #define PCI_DEVICE_ID_LOONGSON_DC1 0x7a06
+ #define PCI_DEVICE_ID_LOONGSON_DC2 0x7a36
++#define PCI_DEVICE_ID_LOONGSON_DC3 0x7a46
+
+ int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
+ int reg, int len, u32 *val)
+@@ -97,3 +98,4 @@ static void pci_fixup_vgadev(struct pci_
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC1, pci_fixup_vgadev);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC2, pci_fixup_vgadev);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC3, pci_fixup_vgadev);
--- /dev/null
+From 1de0ae21f136efa6c5d8a4d3e07b7d1ca39c750f Mon Sep 17 00:00:00 2001
+From: Qiang Ma <maqianga@uniontech.com>
+Date: Sat, 6 Dec 2025 10:39:49 +0800
+Subject: LoongArch: Correct the calculation logic of thread_count
+
+From: Qiang Ma <maqianga@uniontech.com>
+
+commit 1de0ae21f136efa6c5d8a4d3e07b7d1ca39c750f upstream.
+
+For thread_count, the current calculation method has a maximum of 255,
+which may not be sufficient in the future. Therefore, we are correcting
+it now.
+
+Reference: SMBIOS Specification, 7.5 Processor Information (Type 4)[1]
+
+[1]: https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.9.0.pdf
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Qiang Ma <maqianga@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/setup.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -56,6 +56,7 @@
+ #define SMBIOS_FREQLOW_MASK 0xFF
+ #define SMBIOS_CORE_PACKAGE_OFFSET 0x23
+ #define SMBIOS_THREAD_PACKAGE_OFFSET 0x25
++#define SMBIOS_THREAD_PACKAGE_2_OFFSET 0x2E
+ #define LOONGSON_EFI_ENABLE (1 << 3)
+
+ unsigned long fw_arg0, fw_arg1, fw_arg2;
+@@ -126,7 +127,12 @@ static void __init parse_cpu_table(const
+ cpu_clock_freq = freq_temp * 1000000;
+
+ loongson_sysconf.cpuname = (void *)dmi_string_parse(dm, dmi_data[16]);
+- loongson_sysconf.cores_per_package = *(dmi_data + SMBIOS_THREAD_PACKAGE_OFFSET);
++ loongson_sysconf.cores_per_package = *(u8 *)(dmi_data + SMBIOS_THREAD_PACKAGE_OFFSET);
++ if (dm->length >= 0x30 && loongson_sysconf.cores_per_package == 0xff) {
++ /* SMBIOS 3.0+ has ThreadCount2 for more than 255 threads */
++ loongson_sysconf.cores_per_package =
++ *(u16 *)(dmi_data + SMBIOS_THREAD_PACKAGE_2_OFFSET);
++ }
+
+ pr_info("CpuClock = %llu\n", cpu_clock_freq);
+ }
--- /dev/null
+From a91b446e359aa96cc2655318789fd37441337415 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Sat, 6 Dec 2025 10:39:48 +0800
+Subject: LoongArch: Fix arch_dup_task_struct() for CONFIG_RANDSTRUCT
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit a91b446e359aa96cc2655318789fd37441337415 upstream.
+
+Now the optimized version of arch_dup_task_struct() for LoongArch
+assumes 'thread' is the last member of 'task_struct'. But this is
+not true if CONFIG_RANDSTRUCT is enabled after Linux-6.16.
+
+So fix the arch_dup_task_struct() function for CONFIG_RANDSTRUCT by
+copying the whole 'task_struct'.
+
+Cc: stable@vger.kernel.org # 6.16+
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/process.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/loongarch/kernel/process.c
++++ b/arch/loongarch/kernel/process.c
+@@ -130,6 +130,11 @@ int arch_dup_task_struct(struct task_str
+
+ preempt_enable();
+
++ if (IS_ENABLED(CONFIG_RANDSTRUCT)) {
++ memcpy(dst, src, sizeof(struct task_struct));
++ return 0;
++ }
++
+ if (!used_math())
+ memcpy(dst, src, offsetof(struct task_struct, thread.fpu.fpr));
+ else
--- /dev/null
+From 3c250aecef62da81deb38ac6738ac0a88d91f1fc Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Sat, 6 Dec 2025 10:39:40 +0800
+Subject: LoongArch: Fix build errors for CONFIG_RANDSTRUCT
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit 3c250aecef62da81deb38ac6738ac0a88d91f1fc upstream.
+
+When CONFIG_RANDSTRUCT enabled, members of task_struct are randomized.
+There is a chance that TASK_STACK_CANARY be out of 12bit immediate's
+range and causes build errors. TASK_STACK_CANARY is naturally aligned,
+so fix it by replacing ld.d/st.d with ldptr.d/stptr.d which have 14bit
+immediates.
+
+Cc: stable@vger.kernel.org
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202511240656.0NaPcJs1-lkp@intel.com/
+Suggested-by: Rui Wang <wangrui@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/switch.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/kernel/switch.S
++++ b/arch/loongarch/kernel/switch.S
+@@ -25,8 +25,8 @@ SYM_FUNC_START(__switch_to)
+ stptr.d a4, a0, THREAD_SCHED_CFA
+ #if defined(CONFIG_STACKPROTECTOR) && !defined(CONFIG_SMP)
+ la t7, __stack_chk_guard
+- LONG_L t8, a1, TASK_STACK_CANARY
+- LONG_S t8, t7, 0
++ ldptr.d t8, a1, TASK_STACK_CANARY
++ stptr.d t8, t7, 0
+ #endif
+ move tp, a2
+ cpu_restore_nonscratch a1
--- /dev/null
+From 4a71df151e703b5e7e85b33369cee59ef2665e61 Mon Sep 17 00:00:00 2001
+From: Yuli Wang <wangyl5933@chinaunicom.cn>
+Date: Sat, 6 Dec 2025 10:39:48 +0800
+Subject: LoongArch: Use __pmd()/__pte() for swap entry conversions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: WangYuli <wangyl5933@chinaunicom.cn>
+
+commit 4a71df151e703b5e7e85b33369cee59ef2665e61 upstream.
+
+The __pmd() and __pte() helper macros provide the correct initialization
+syntax and abstraction for the pmd_t and pte_t types.
+
+Use __pmd() to fix follow warning about __swp_entry_to_pmd() with gcc-15
+under specific configs [1] :
+
+ In file included from ./include/linux/pgtable.h:6,
+ from ./include/linux/mm.h:31,
+ from ./include/linux/pagemap.h:8,
+ from arch/loongarch/mm/init.c:14:
+ ./include/linux/swapops.h: In function ‘swp_entry_to_pmd’:
+ ./arch/loongarch/include/asm/pgtable.h:302:34: error: missing braces around initializer [-Werror=missing-braces]
+ 302 | #define __swp_entry_to_pmd(x) ((pmd_t) { (x).val | _PAGE_HUGE })
+ | ^
+ ./include/linux/swapops.h:559:16: note: in expansion of macro ‘__swp_entry_to_pmd’
+ 559 | return __swp_entry_to_pmd(arch_entry);
+ | ^~~~~~~~~~~~~~~~~~
+ cc1: all warnings being treated as errors
+
+Also update __swp_entry_to_pte() to use __pte() for consistency.
+
+[1]. https://download.01.org/0day-ci/archive/20251119/202511190316.luI90kAo-lkp@intel.com/config
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Yuli Wang <wangyl5933@chinaunicom.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/include/asm/pgtable.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/include/asm/pgtable.h
++++ b/arch/loongarch/include/asm/pgtable.h
+@@ -297,9 +297,9 @@ static inline pte_t mk_swap_pte(unsigned
+ #define __swp_offset(x) ((x).val >> 24)
+ #define __swp_entry(type, offset) ((swp_entry_t) { pte_val(mk_swap_pte((type), (offset))) })
+ #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
+-#define __swp_entry_to_pte(x) ((pte_t) { (x).val })
++#define __swp_entry_to_pte(x) __pte((x).val)
+ #define __pmd_to_swp_entry(pmd) ((swp_entry_t) { pmd_val(pmd) })
+-#define __swp_entry_to_pmd(x) ((pmd_t) { (x).val | _PAGE_HUGE })
++#define __swp_entry_to_pmd(x) __pmd((x).val | _PAGE_HUGE)
+
+ static inline bool pte_swp_exclusive(pte_t pte)
+ {
--- /dev/null
+From a258a3cb1895e3acf5f2fe245d17426e894bc935 Mon Sep 17 00:00:00 2001
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+Date: Sat, 6 Dec 2025 10:39:48 +0800
+Subject: LoongArch: Use unsigned long for _end and _text
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+commit a258a3cb1895e3acf5f2fe245d17426e894bc935 upstream.
+
+It is better to use unsigned long rather than long for _end and _text to
+calculate the kernel length.
+
+Cc: stable@vger.kernel.org # v6.3+
+Fixes: e5f02b51fa0c ("LoongArch: Add support for kernel address space layout randomization (KASLR)")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/relocate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/kernel/relocate.c
++++ b/arch/loongarch/kernel/relocate.c
+@@ -183,7 +183,7 @@ static inline void __init *determine_rel
+ if (kaslr_disabled())
+ return destination;
+
+- kernel_length = (long)_end - (long)_text;
++ kernel_length = (unsigned long)_end - (unsigned long)_text;
+
+ random_offset = get_random_boot() << 16;
+ random_offset &= (CONFIG_RANDOMIZE_BASE_MAX_OFFSET - 1);
+@@ -232,7 +232,7 @@ unsigned long __init relocate_kernel(voi
+ early_memunmap(cmdline, COMMAND_LINE_SIZE);
+
+ if (random_offset) {
+- kernel_length = (long)(_end) - (long)(_text);
++ kernel_length = (unsigned long)(_end) - (unsigned long)(_text);
+
+ /* Copy the kernel to it's new location */
+ memcpy(location_new, _text, kernel_length);
--- /dev/null
+From 8163419e3e05d71dcfa8fb49c8fdf8d76908fe51 Mon Sep 17 00:00:00 2001
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+Date: Wed, 3 Sep 2025 02:23:31 +0300
+Subject: media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
+
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+
+commit 8163419e3e05d71dcfa8fb49c8fdf8d76908fe51 upstream.
+
+It's possible for cp_read() and hdmi_read() to return -EIO. Those
+values are further used as indexes for accessing arrays.
+
+Fix that by checking return values where it's needed.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: a89bcd4c6c20 ("[media] adv7842: add new video decoder driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/adv7842.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -2699,6 +2699,7 @@ static int adv7842_cp_log_status(struct
+ /* CP block */
+ struct adv7842_state *state = to_state(sd);
+ struct v4l2_dv_timings timings;
++ int temp;
+ u8 reg_io_0x02 = io_read(sd, 0x02);
+ u8 reg_io_0x21 = io_read(sd, 0x21);
+ u8 reg_rep_0x77 = rep_read(sd, 0x77);
+@@ -2821,8 +2822,9 @@ static int adv7842_cp_log_status(struct
+ (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ?
+ "(16-235)" : "(0-255)",
+ (reg_io_0x02 & 0x08) ? "enabled" : "disabled");
++ temp = cp_read(sd, 0xf4) >> 4;
+ v4l2_info(sd, "Color space conversion: %s\n",
+- csc_coeff_sel_rb[cp_read(sd, 0xf4) >> 4]);
++ temp < 0 ? "" : csc_coeff_sel_rb[temp]);
+
+ if (!is_digital_input(sd))
+ return 0;
+@@ -2852,8 +2854,9 @@ static int adv7842_cp_log_status(struct
+ hdmi_read(sd, 0x5f));
+ v4l2_info(sd, "AV Mute: %s\n",
+ (hdmi_read(sd, 0x04) & 0x40) ? "on" : "off");
++ temp = hdmi_read(sd, 0x0b) >> 6;
+ v4l2_info(sd, "Deep color mode: %s\n",
+- deep_color_mode_txt[hdmi_read(sd, 0x0b) >> 6]);
++ temp < 0 ? "" : deep_color_mode_txt[temp]);
+
+ adv7842_log_infoframes(sd);
+
--- /dev/null
+From ae246b0032146e352c4c06a7bf03cd3d5bcb2ecd Mon Sep 17 00:00:00 2001
+From: Ming Qian <ming.qian@oss.nxp.com>
+Date: Tue, 16 Sep 2025 14:10:07 +0800
+Subject: media: amphion: Cancel message work before releasing the VPU core
+
+From: Ming Qian <ming.qian@oss.nxp.com>
+
+commit ae246b0032146e352c4c06a7bf03cd3d5bcb2ecd upstream.
+
+To avoid accessing the VPU register after release of the VPU core,
+cancel the message work and destroy the workqueue that handles the
+VPU message before release of the VPU core.
+
+Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/amphion/vpu_v4l2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -703,15 +703,15 @@ static int vpu_v4l2_release(struct vpu_i
+ {
+ vpu_trace(inst->vpu->dev, "%p\n", inst);
+
+- vpu_release_core(inst->core);
+- put_device(inst->dev);
+-
+ if (inst->workqueue) {
+ cancel_work_sync(&inst->msg_work);
+ destroy_workqueue(inst->workqueue);
+ inst->workqueue = NULL;
+ }
+
++ vpu_release_core(inst->core);
++ put_device(inst->dev);
++
+ v4l2_ctrl_handler_free(&inst->ctrl_handler);
+ mutex_destroy(&inst->lock);
+
--- /dev/null
+From 634c2cd17bd021487c57b95973bddb14be8002ff Mon Sep 17 00:00:00 2001
+From: Ming Qian <ming.qian@oss.nxp.com>
+Date: Tue, 16 Sep 2025 14:08:53 +0800
+Subject: media: amphion: Remove vpu_vb_is_codecconfig
+
+From: Ming Qian <ming.qian@oss.nxp.com>
+
+commit 634c2cd17bd021487c57b95973bddb14be8002ff upstream.
+
+Currently the function vpu_vb_is_codecconfig() always returns 0.
+Delete it and its related code.
+
+Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/amphion/vpu_malone.c | 23 +++--------------------
+ drivers/media/platform/amphion/vpu_v4l2.c | 10 ----------
+ drivers/media/platform/amphion/vpu_v4l2.h | 10 ----------
+ 3 files changed, 3 insertions(+), 40 deletions(-)
+
+--- a/drivers/media/platform/amphion/vpu_malone.c
++++ b/drivers/media/platform/amphion/vpu_malone.c
+@@ -1337,22 +1337,18 @@ static int vpu_malone_insert_scode_vc1_g
+ {
+ if (!scode->inst->total_input_count)
+ return 0;
+- if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
+- scode->need_data = 0;
+ return 0;
+ }
+
+ static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode)
+ {
+- struct vb2_v4l2_buffer *vbuf;
+ u8 nal_hdr[MALONE_VC1_NAL_HEADER_LEN];
+ u32 *data = NULL;
+ int ret;
+
+- vbuf = to_vb2_v4l2_buffer(scode->vb);
+ data = vb2_plane_vaddr(scode->vb, 0);
+
+- if (scode->inst->total_input_count == 0 || vpu_vb_is_codecconfig(vbuf))
++ if (scode->inst->total_input_count == 0)
+ return 0;
+ if (MALONE_VC1_CONTAIN_NAL(*data))
+ return 0;
+@@ -1373,8 +1369,6 @@ static int vpu_malone_insert_scode_vc1_l
+ int size = 0;
+ u8 rcv_seqhdr[MALONE_VC1_RCV_SEQ_HEADER_LEN];
+
+- if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb)))
+- scode->need_data = 0;
+ if (scode->inst->total_input_count)
+ return 0;
+ scode->need_data = 0;
+@@ -1560,7 +1554,7 @@ static int vpu_malone_input_frame_data(s
+ scode.vb = vb;
+ scode.wptr = wptr;
+ scode.need_data = 1;
+- if (vbuf->sequence == 0 || vpu_vb_is_codecconfig(vbuf))
++ if (vbuf->sequence == 0)
+ ret = vpu_malone_insert_scode(&scode, SCODE_SEQUENCE);
+
+ if (ret < 0)
+@@ -1596,7 +1590,7 @@ static int vpu_malone_input_frame_data(s
+ * This module is currently only supported for the H264 and HEVC formats,
+ * for other formats, vpu_malone_add_scode() will return 0.
+ */
+- if ((disp_imm || low_latency) && !vpu_vb_is_codecconfig(vbuf)) {
++ if (disp_imm || low_latency) {
+ ret = vpu_malone_add_scode(inst->core->iface,
+ inst->id,
+ &inst->stream_buffer,
+@@ -1643,7 +1637,6 @@ int vpu_malone_input_frame(struct vpu_sh
+ struct vpu_inst *inst, struct vb2_buffer *vb)
+ {
+ struct vpu_dec_ctrl *hc = shared->priv;
+- struct vb2_v4l2_buffer *vbuf;
+ struct vpu_malone_str_buffer __iomem *str_buf = hc->str_buf[inst->id];
+ u32 disp_imm = hc->codec_param[inst->id].disp_imm;
+ u32 size;
+@@ -1657,16 +1650,6 @@ int vpu_malone_input_frame(struct vpu_sh
+ return ret;
+ size = ret;
+
+- /*
+- * if buffer only contain codec data, and the timestamp is invalid,
+- * don't put the invalid timestamp to resync
+- * merge the data to next frame
+- */
+- vbuf = to_vb2_v4l2_buffer(vb);
+- if (vpu_vb_is_codecconfig(vbuf)) {
+- inst->extra_size += size;
+- return 0;
+- }
+ if (inst->extra_size) {
+ size += inst->extra_size;
+ inst->extra_size = 0;
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -349,16 +349,6 @@ struct vb2_v4l2_buffer *vpu_next_src_buf
+ if (!src_buf || vpu_get_buffer_state(src_buf) == VPU_BUF_STATE_IDLE)
+ return NULL;
+
+- while (vpu_vb_is_codecconfig(src_buf)) {
+- v4l2_m2m_src_buf_remove(inst->fh.m2m_ctx);
+- vpu_set_buffer_state(src_buf, VPU_BUF_STATE_IDLE);
+- v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_DONE);
+-
+- src_buf = v4l2_m2m_next_src_buf(inst->fh.m2m_ctx);
+- if (!src_buf || vpu_get_buffer_state(src_buf) == VPU_BUF_STATE_IDLE)
+- return NULL;
+- }
+-
+ return src_buf;
+ }
+
+--- a/drivers/media/platform/amphion/vpu_v4l2.h
++++ b/drivers/media/platform/amphion/vpu_v4l2.h
+@@ -39,14 +39,4 @@ static inline struct vpu_format *vpu_get
+ else
+ return &inst->cap_format;
+ }
+-
+-static inline int vpu_vb_is_codecconfig(struct vb2_v4l2_buffer *vbuf)
+-{
+-#ifdef V4L2_BUF_FLAG_CODECCONFIG
+- return (vbuf->flags & V4L2_BUF_FLAG_CODECCONFIG) ? 1 : 0;
+-#else
+- return 0;
+-#endif
+-}
+-
+ #endif
--- /dev/null
+From c43bcd2b2aa3c2ca9d2433c3990ecbc2c47d10eb Mon Sep 17 00:00:00 2001
+From: Haotian Zhang <vulab@iscas.ac.cn>
+Date: Mon, 29 Sep 2025 19:12:29 +0800
+Subject: media: cec: Fix debugfs leak on bus_register() failure
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+commit c43bcd2b2aa3c2ca9d2433c3990ecbc2c47d10eb upstream.
+
+In cec_devnode_init(), the debugfs directory created with
+debugfs_create_dir() is not removed if bus_register() fails.
+This leaves a stale "cec" entry in debugfs and prevents
+proper module reloading.
+
+Fix this by removing the debugfs directory in the error path.
+
+Fixes: a56960e8b406 ("[media] cec: add HDMI CEC framework (core)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/cec/core/cec-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/cec/core/cec-core.c
++++ b/drivers/media/cec/core/cec-core.c
+@@ -421,6 +421,7 @@ static int __init cec_devnode_init(void)
+
+ ret = bus_register(&cec_bus_type);
+ if (ret < 0) {
++ debugfs_remove_recursive(top_cec_dir);
+ unregister_chrdev_region(cec_dev_t, CEC_NUM_DEVICES);
+ pr_warn("cec: bus_register failed\n");
+ return -EIO;
--- /dev/null
+From 8f34f24355a607b98ecd9924837aab13c676eeca Mon Sep 17 00:00:00 2001
+From: Duoming Zhou <duoming@zju.edu.cn>
+Date: Tue, 2 Sep 2025 09:53:37 +0800
+Subject: media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+commit 8f34f24355a607b98ecd9924837aab13c676eeca upstream.
+
+The delayed_work delayed_work_enable_hotplug is initialized with
+INIT_DELAYED_WORK() in adv76xx_probe(), but it is never scheduled
+anywhere in the probe function.
+
+Calling cancel_delayed_work() on a work that has never been
+scheduled is redundant and unnecessary, as there is no pending
+work to cancel.
+
+Remove the redundant cancel_delayed_work() from error handling
+path and adjust the goto label accordingly to simplify the code
+and avoid potential confusion.
+
+Fixes: 54450f591c99 ("[media] adv7604: driver for the Analog Devices ADV7604 video decoder")
+Cc: stable@vger.kernel.org
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/adv7604.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -3670,7 +3670,7 @@ static int adv76xx_probe(struct i2c_clie
+ err = media_entity_pads_init(&sd->entity, state->source_pad + 1,
+ state->pads);
+ if (err)
+- goto err_work_queues;
++ goto err_i2c;
+
+ /* Configure regmaps */
+ err = configure_regmaps(state);
+@@ -3711,8 +3711,6 @@ static int adv76xx_probe(struct i2c_clie
+
+ err_entity:
+ media_entity_cleanup(&sd->entity);
+-err_work_queues:
+- cancel_delayed_work(&state->delayed_work_enable_hotplug);
+ err_i2c:
+ adv76xx_unregister_clients(state);
+ err_hdl:
--- /dev/null
+From e66a5cc606c58e72f18f9cdd868a3672e918f9f8 Mon Sep 17 00:00:00 2001
+From: Duoming Zhou <duoming@zju.edu.cn>
+Date: Tue, 2 Sep 2025 09:10:31 +0800
+Subject: media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+commit e66a5cc606c58e72f18f9cdd868a3672e918f9f8 upstream.
+
+The delayed_work delayed_work_enable_hotplug is initialized with
+INIT_DELAYED_WORK() in adv7842_probe(), but it is never scheduled
+anywhere in the probe function.
+
+Calling cancel_delayed_work() on a work that has never been
+scheduled is redundant and unnecessary, as there is no pending
+work to cancel.
+
+Remove the redundant cancel_delayed_work() from error handling
+path and adjust the goto label accordingly to simplify the code
+and avoid potential confusion.
+
+Fixes: a89bcd4c6c20 ("[media] adv7842: add new video decoder driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/adv7842.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -3629,7 +3629,7 @@ static int adv7842_probe(struct i2c_clie
+ err = media_entity_pads_init(&sd->entity, ADV7842_PAD_SOURCE + 1,
+ state->pads);
+ if (err)
+- goto err_work_queues;
++ goto err_i2c;
+
+ err = adv7842_core_init(sd);
+ if (err)
+@@ -3650,8 +3650,6 @@ static int adv7842_probe(struct i2c_clie
+
+ err_entity:
+ media_entity_cleanup(&sd->entity);
+-err_work_queues:
+- cancel_delayed_work(&state->delayed_work_enable_hotplug);
+ err_i2c:
+ adv7842_unregister_clients(sd);
+ err_hdl:
--- /dev/null
+From 9ef6e4db152c34580cc52792f32485c193945395 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 17 Oct 2025 13:43:49 +0530
+Subject: media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+commit 9ef6e4db152c34580cc52792f32485c193945395 upstream.
+
+Commit 0af46fbc333d ("media: i2c: imx219: Calculate crop rectangle
+dynamically") meant that the 1920x1080 mode switched from using no
+binning to using vertical binning but no horizontal binning, which
+resulted in stretched pixels.
+
+Until proper controls are available to independently select horizontal
+and vertical binning, restore the original 1:1 pixel aspect ratio by
+forcing binning to be uniform in both directions.
+
+Cc: stable@vger.kernel.org
+Fixes: 0af46fbc333d ("media: i2c: imx219: Calculate crop rectangle dynamically")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+[Add comment & reword commit message]
+Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/imx219.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -856,7 +856,7 @@ static int imx219_set_pad_format(struct
+ const struct imx219_mode *mode;
+ struct v4l2_mbus_framefmt *format;
+ struct v4l2_rect *crop;
+- u8 bin_h, bin_v;
++ u8 bin_h, bin_v, binning;
+ u32 prev_line_len;
+
+ format = v4l2_subdev_state_get_format(state, 0);
+@@ -877,9 +877,12 @@ static int imx219_set_pad_format(struct
+ bin_h = min(IMX219_PIXEL_ARRAY_WIDTH / format->width, 2U);
+ bin_v = min(IMX219_PIXEL_ARRAY_HEIGHT / format->height, 2U);
+
++ /* Ensure bin_h and bin_v are same to avoid 1:2 or 2:1 stretching */
++ binning = min(bin_h, bin_v);
++
+ crop = v4l2_subdev_state_get_crop(state, 0);
+- crop->width = format->width * bin_h;
+- crop->height = format->height * bin_v;
++ crop->width = format->width * binning;
++ crop->height = format->height * binning;
+ crop->left = (IMX219_NATIVE_WIDTH - crop->width) / 2;
+ crop->top = (IMX219_NATIVE_HEIGHT - crop->height) / 2;
+
--- /dev/null
+From aec75e355c633e4b0967c99580bd8ef93e0cdc98 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Date: Wed, 5 Nov 2025 11:17:37 +0530
+Subject: media: iris: Refine internal buffer reconfiguration logic for resolution change
+
+From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+
+commit aec75e355c633e4b0967c99580bd8ef93e0cdc98 upstream.
+
+Improve the condition used to determine when input internal buffers need
+to be reconfigured during streamon on the capture port. Previously, the
+check relied on the INPUT_PAUSE sub-state, which was also being set
+during seek operations. This led to input buffers being queued multiple
+times to the firmware, causing session errors due to duplicate buffer
+submissions.
+
+This change introduces a more accurate check using the FIRST_IPSC and
+DRC sub-states to ensure that input buffer reconfiguration is triggered
+only during resolution change scenarios, such as streamoff/on on the
+capture port. This avoids duplicate buffer queuing during seek
+operations.
+
+Fixes: c1f8b2cc72ec ("media: iris: handle streamoff/on from client in dynamic resolution change")
+Cc: stable@vger.kernel.org
+Reported-by: Val Packett <val@packett.cool>
+Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4700
+Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_common.c
++++ b/drivers/media/platform/qcom/iris/iris_common.c
+@@ -91,12 +91,14 @@ int iris_process_streamon_input(struct i
+ int iris_process_streamon_output(struct iris_inst *inst)
+ {
+ const struct iris_hfi_command_ops *hfi_ops = inst->core->hfi_ops;
+- bool drain_active = false, drc_active = false;
+ enum iris_inst_sub_state clear_sub_state = 0;
++ bool drain_active, drc_active, first_ipsc;
+ int ret = 0;
+
+ iris_scale_power(inst);
+
++ first_ipsc = inst->sub_state & IRIS_INST_SUB_FIRST_IPSC;
++
+ drain_active = inst->sub_state & IRIS_INST_SUB_DRAIN &&
+ inst->sub_state & IRIS_INST_SUB_DRAIN_LAST;
+
+@@ -108,7 +110,8 @@ int iris_process_streamon_output(struct
+ else if (drain_active)
+ clear_sub_state = IRIS_INST_SUB_DRAIN | IRIS_INST_SUB_DRAIN_LAST;
+
+- if (inst->domain == DECODER && inst->sub_state & IRIS_INST_SUB_INPUT_PAUSE) {
++ /* Input internal buffer reconfiguration required in case of resolution change */
++ if (first_ipsc || drc_active) {
+ ret = iris_alloc_and_queue_input_int_bufs(inst);
+ if (ret)
+ return ret;
--- /dev/null
+From cdd0f118ef87db8a664fb5ea366fd1766d2df1cd Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Mon, 15 Sep 2025 20:09:38 +0800
+Subject: media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit cdd0f118ef87db8a664fb5ea366fd1766d2df1cd upstream.
+
+vpu_get_plat_device() increases the reference count of the returned
+platform device. However, when devm_kzalloc() fails, the reference
+is not released, causing a reference leak.
+
+Fix this by calling put_device() on fw_pdev->dev before returning
+on the error path.
+
+Fixes: e25a89f743b1 ("media: mtk-vcodec: potential dereference of null pointer")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -119,8 +119,10 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_
+ vpu_wdt_reg_handler(fw_pdev, mtk_vcodec_vpu_reset_enc_handler, priv, rst_id);
+
+ fw = devm_kzalloc(&plat_dev->dev, sizeof(*fw), GFP_KERNEL);
+- if (!fw)
++ if (!fw) {
++ put_device(&fw_pdev->dev);
+ return ERR_PTR(-ENOMEM);
++ }
+ fw->type = VPU;
+ fw->ops = &mtk_vcodec_vpu_msg;
+ fw->pdev = fw_pdev;
--- /dev/null
+From a5844227e0f030d2af2d85d4aed10c5eca6ca176 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wenst@chromium.org>
+Date: Wed, 20 Aug 2025 15:54:05 +0800
+Subject: media: mediatek: vcodec: Use spinlock for context list protection lock
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+commit a5844227e0f030d2af2d85d4aed10c5eca6ca176 upstream.
+
+Previously a mutex was added to protect the encoder and decoder context
+lists from unexpected changes originating from the SCP IP block, causing
+the context pointer to go invalid, resulting in a NULL pointer
+dereference in the IPI handler.
+
+Turns out on the MT8173, the VPU IPI handler is called from hard IRQ
+context. This causes a big warning from the scheduler. This was first
+reported downstream on the ChromeOS kernels, but is also reproducible
+on mainline using Fluster with the FFmpeg v4l2m2m decoders. Even though
+the actual capture format is not supported, the affected code paths
+are triggered.
+
+Since this lock just protects the context list and operations on it are
+very fast, it should be OK to switch to a spinlock.
+
+Fixes: 6467cda18c9f ("media: mediatek: vcodec: adding lock to protect decoder context list")
+Fixes: afaaf3a0f647 ("media: mediatek: vcodec: adding lock to protect encoder context list")
+Cc: Yunfei Dong <yunfei.dong@mediatek.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 10 +++++---
+ drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 12 +++++-----
+ drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 -
+ drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 5 ++--
+ drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 12 +++++-----
+ drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 -
+ drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c | 5 ++--
+ 7 files changed, 28 insertions(+), 20 deletions(-)
+
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -47,30 +47,32 @@ static void mtk_vcodec_vpu_reset_dec_han
+ {
+ struct mtk_vcodec_dec_dev *dev = priv;
+ struct mtk_vcodec_dec_ctx *ctx;
++ unsigned long flags;
+
+ dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+
+- mutex_lock(&dev->dev_ctx_lock);
++ spin_lock_irqsave(&dev->dev_ctx_lock, flags);
+ list_for_each_entry(ctx, &dev->ctx_list, list) {
+ ctx->state = MTK_STATE_ABORT;
+ mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+ }
+- mutex_unlock(&dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&dev->dev_ctx_lock, flags);
+ }
+
+ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
+ {
+ struct mtk_vcodec_enc_dev *dev = priv;
+ struct mtk_vcodec_enc_ctx *ctx;
++ unsigned long flags;
+
+ dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+
+- mutex_lock(&dev->dev_ctx_lock);
++ spin_lock_irqsave(&dev->dev_ctx_lock, flags);
+ list_for_each_entry(ctx, &dev->ctx_list, list) {
+ ctx->state = MTK_STATE_ABORT;
+ mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+ }
+- mutex_unlock(&dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&dev->dev_ctx_lock, flags);
+ }
+
+ static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = {
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+@@ -198,6 +198,7 @@ static int fops_vcodec_open(struct file
+ struct mtk_vcodec_dec_ctx *ctx = NULL;
+ int ret = 0, i, hw_count;
+ struct vb2_queue *src_vq;
++ unsigned long flags;
+
+ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ if (!ctx)
+@@ -267,9 +268,9 @@ static int fops_vcodec_open(struct file
+
+ ctx->dev->vdec_pdata->init_vdec_params(ctx);
+
+- mutex_lock(&dev->dev_ctx_lock);
++ spin_lock_irqsave(&dev->dev_ctx_lock, flags);
+ list_add(&ctx->list, &dev->ctx_list);
+- mutex_unlock(&dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&dev->dev_ctx_lock, flags);
+ mtk_vcodec_dbgfs_create(ctx);
+
+ mutex_unlock(&dev->dev_mutex);
+@@ -294,6 +295,7 @@ static int fops_vcodec_release(struct fi
+ {
+ struct mtk_vcodec_dec_dev *dev = video_drvdata(file);
+ struct mtk_vcodec_dec_ctx *ctx = file_to_dec_ctx(file);
++ unsigned long flags;
+
+ mtk_v4l2_vdec_dbg(0, ctx, "[%d] decoder", ctx->id);
+ mutex_lock(&dev->dev_mutex);
+@@ -312,9 +314,9 @@ static int fops_vcodec_release(struct fi
+ v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+
+ mtk_vcodec_dbgfs_remove(dev, ctx->id);
+- mutex_lock(&dev->dev_ctx_lock);
++ spin_lock_irqsave(&dev->dev_ctx_lock, flags);
+ list_del_init(&ctx->list);
+- mutex_unlock(&dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&dev->dev_ctx_lock, flags);
+ kfree(ctx);
+ mutex_unlock(&dev->dev_mutex);
+ return 0;
+@@ -407,7 +409,7 @@ static int mtk_vcodec_probe(struct platf
+ for (i = 0; i < MTK_VDEC_HW_MAX; i++)
+ mutex_init(&dev->dec_mutex[i]);
+ mutex_init(&dev->dev_mutex);
+- mutex_init(&dev->dev_ctx_lock);
++ spin_lock_init(&dev->dev_ctx_lock);
+ spin_lock_init(&dev->irqlock);
+
+ snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+@@ -285,7 +285,7 @@ struct mtk_vcodec_dec_dev {
+ /* decoder hardware mutex lock */
+ struct mutex dec_mutex[MTK_VDEC_HW_MAX];
+ struct mutex dev_mutex;
+- struct mutex dev_ctx_lock;
++ spinlock_t dev_ctx_lock;
+ struct workqueue_struct *decode_workqueue;
+
+ spinlock_t irqlock;
+--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+@@ -75,16 +75,17 @@ static void handle_get_param_msg_ack(con
+ static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vdec_vpu_inst *vpu)
+ {
+ struct mtk_vcodec_dec_ctx *ctx;
++ unsigned long flags;
+ int ret = false;
+
+- mutex_lock(&dec_dev->dev_ctx_lock);
++ spin_lock_irqsave(&dec_dev->dev_ctx_lock, flags);
+ list_for_each_entry(ctx, &dec_dev->ctx_list, list) {
+ if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+ ret = true;
+ break;
+ }
+ }
+- mutex_unlock(&dec_dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&dec_dev->dev_ctx_lock, flags);
+
+ return ret;
+ }
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+@@ -117,6 +117,7 @@ static int fops_vcodec_open(struct file
+ struct mtk_vcodec_enc_ctx *ctx = NULL;
+ int ret = 0;
+ struct vb2_queue *src_vq;
++ unsigned long flags;
+
+ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ if (!ctx)
+@@ -176,9 +177,9 @@ static int fops_vcodec_open(struct file
+ mtk_v4l2_venc_dbg(2, ctx, "Create instance [%d]@%p m2m_ctx=%p ",
+ ctx->id, ctx, ctx->m2m_ctx);
+
+- mutex_lock(&dev->dev_ctx_lock);
++ spin_lock_irqsave(&dev->dev_ctx_lock, flags);
+ list_add(&ctx->list, &dev->ctx_list);
+- mutex_unlock(&dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&dev->dev_ctx_lock, flags);
+
+ mutex_unlock(&dev->dev_mutex);
+ mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev),
+@@ -203,6 +204,7 @@ static int fops_vcodec_release(struct fi
+ {
+ struct mtk_vcodec_enc_dev *dev = video_drvdata(file);
+ struct mtk_vcodec_enc_ctx *ctx = file_to_enc_ctx(file);
++ unsigned long flags;
+
+ mtk_v4l2_venc_dbg(1, ctx, "[%d] encoder", ctx->id);
+ mutex_lock(&dev->dev_mutex);
+@@ -213,9 +215,9 @@ static int fops_vcodec_release(struct fi
+ v4l2_fh_exit(&ctx->fh);
+ v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+
+- mutex_lock(&dev->dev_ctx_lock);
++ spin_lock_irqsave(&dev->dev_ctx_lock, flags);
+ list_del_init(&ctx->list);
+- mutex_unlock(&dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&dev->dev_ctx_lock, flags);
+ kfree(ctx);
+ mutex_unlock(&dev->dev_mutex);
+ return 0;
+@@ -297,7 +299,7 @@ static int mtk_vcodec_probe(struct platf
+
+ mutex_init(&dev->enc_mutex);
+ mutex_init(&dev->dev_mutex);
+- mutex_init(&dev->dev_ctx_lock);
++ spin_lock_init(&dev->dev_ctx_lock);
+ spin_lock_init(&dev->irqlock);
+
+ snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+@@ -206,7 +206,7 @@ struct mtk_vcodec_enc_dev {
+ /* encoder hardware mutex lock */
+ struct mutex enc_mutex;
+ struct mutex dev_mutex;
+- struct mutex dev_ctx_lock;
++ spinlock_t dev_ctx_lock;
+ struct workqueue_struct *encode_workqueue;
+
+ int enc_irq;
+--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+@@ -45,16 +45,17 @@ static void handle_enc_encode_msg(struct
+ static bool vpu_enc_check_ap_inst(struct mtk_vcodec_enc_dev *enc_dev, struct venc_vpu_inst *vpu)
+ {
+ struct mtk_vcodec_enc_ctx *ctx;
++ unsigned long flags;
+ int ret = false;
+
+- mutex_lock(&enc_dev->dev_ctx_lock);
++ spin_lock_irqsave(&enc_dev->dev_ctx_lock, flags);
+ list_for_each_entry(ctx, &enc_dev->ctx_list, list) {
+ if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+ ret = true;
+ break;
+ }
+ }
+- mutex_unlock(&enc_dev->dev_ctx_lock);
++ spin_unlock_irqrestore(&enc_dev->dev_ctx_lock, flags);
+
+ return ret;
+ }
--- /dev/null
+From d2bceb2e20e783d57e739c71e4e50b4b9f4a3953 Mon Sep 17 00:00:00 2001
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+Date: Wed, 3 Sep 2025 02:28:14 +0300
+Subject: media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
+
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+
+commit d2bceb2e20e783d57e739c71e4e50b4b9f4a3953 upstream.
+
+It's possible for max1 to remain -1 if msp_read() always fail. This
+variable is further used as index for accessing arrays.
+
+Fix that by checking max1 prior to array accesses.
+
+It seems that restart is the preferable action in case of out-of-bounds
+value.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 8a4b275f9c19 ("V4L/DVB (3427): audmode and rxsubchans fixes (VIDIOC_G/S_TUNER)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/msp3400-kthreads.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/msp3400-kthreads.c
++++ b/drivers/media/i2c/msp3400-kthreads.c
+@@ -596,6 +596,8 @@ restart:
+ "carrier2 val: %5d / %s\n", val, cd[i].name);
+ }
+
++ if (max1 < 0 || max1 > 3)
++ goto restart;
+ /* program the msp3400 according to the results */
+ state->main = msp3400c_carrier_detect_main[max1].cdo;
+ switch (max1) {
--- /dev/null
+From 8f6f3aa21517ef34d50808af0c572e69580dca20 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 24 Sep 2025 16:39:19 +0200
+Subject: media: platform: mtk-mdp3: fix device leaks at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8f6f3aa21517ef34d50808af0c572e69580dca20 upstream.
+
+Make sure to drop the references taken when looking up the subsys
+devices during probe on probe failure (e.g. probe deferral) and on
+driver unbind.
+
+Similarly, drop the SCP device reference after retrieving its platform
+data during probe to avoid leaking it.
+
+Note that holding a reference to a device does not prevent its driver
+data from going away.
+
+Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
+Cc: stable@vger.kernel.org # 6.1
+Cc: Moudy Ho <moudy.ho@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
++++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
+@@ -157,10 +157,18 @@ void mdp_video_device_release(struct vid
+ kfree(mdp);
+ }
+
++static void mdp_put_device(void *_dev)
++{
++ struct device *dev = _dev;
++
++ put_device(dev);
++}
++
+ static int mdp_mm_subsys_deploy(struct mdp_dev *mdp, enum mdp_infra_id id)
+ {
+ struct platform_device *mm_pdev = NULL;
+ struct device **dev;
++ int ret;
+ int i;
+
+ if (!mdp)
+@@ -194,6 +202,11 @@ static int mdp_mm_subsys_deploy(struct m
+ if (WARN_ON(!mm_pdev))
+ return -ENODEV;
+
++ ret = devm_add_action_or_reset(&mdp->pdev->dev, mdp_put_device,
++ &mm_pdev->dev);
++ if (ret)
++ return ret;
++
+ *dev = &mm_pdev->dev;
+ }
+
+@@ -279,6 +292,7 @@ static int mdp_probe(struct platform_dev
+ goto err_destroy_clock_wq;
+ }
+ mdp->scp = platform_get_drvdata(mm_pdev);
++ put_device(&mm_pdev->dev);
+ }
+
+ mdp->rproc_handle = scp_get_rproc(mdp->scp);
--- /dev/null
+From 445e1658894fd74eab7e53071fa16233887574ed Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Wed, 3 Sep 2025 21:37:29 +0800
+Subject: media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 445e1658894fd74eab7e53071fa16233887574ed upstream.
+
+The function calls of_parse_phandle() which returns
+a device node with an incremented reference count. When the bonded device
+is not available, the function
+returns NULL without releasing the reference, causing a reference leak.
+
+Add of_node_put(np) to release the device node reference.
+The of_node_put function handles NULL pointers.
+
+Found through static analysis by reviewing the doc of of_parse_phandle()
+and cross-checking its usage patterns across the codebase.
+
+Fixes: 7625ee981af1 ("[media] media: platform: rcar_drif: Add DRIF support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/renesas/rcar_drif.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/renesas/rcar_drif.c
++++ b/drivers/media/platform/renesas/rcar_drif.c
+@@ -1246,6 +1246,7 @@ static struct device_node *rcar_drif_bon
+ if (np && of_device_is_available(np))
+ return np;
+
++ of_node_put(np);
+ return NULL;
+ }
+
--- /dev/null
+From 17dc8ccd6dd5ffe30aa9b0d36e2af1389344ce2b Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Tue, 14 Oct 2025 12:46:43 +0200
+Subject: media: samsung: exynos4-is: fix potential ABBA deadlock on init
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 17dc8ccd6dd5ffe30aa9b0d36e2af1389344ce2b upstream.
+
+v4l2_device_register_subdev_nodes() must called without taking
+media_dev->graph_mutex to avoid potential AB-BA deadlock on further
+subdevice driver initialization.
+
+Fixes: fa91f1056f17 ("[media] exynos4-is: Add support for asynchronous subdevices registration")
+Cc: stable@vger.kernel.org
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/samsung/exynos4-is/media-dev.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/samsung/exynos4-is/media-dev.c
++++ b/drivers/media/platform/samsung/exynos4-is/media-dev.c
+@@ -1399,12 +1399,14 @@ static int subdev_notifier_complete(stru
+ mutex_lock(&fmd->media_dev.graph_mutex);
+
+ ret = fimc_md_create_links(fmd);
+- if (ret < 0)
+- goto unlock;
++ if (ret < 0) {
++ mutex_unlock(&fmd->media_dev.graph_mutex);
++ return ret;
++ }
+
+- ret = v4l2_device_register_subdev_nodes(&fmd->v4l2_dev);
+-unlock:
+ mutex_unlock(&fmd->media_dev.graph_mutex);
++
++ ret = v4l2_device_register_subdev_nodes(&fmd->v4l2_dev);
+ if (ret < 0)
+ return ret;
+
--- /dev/null
+From 29de195ca39fc2ac0af6fd45522994df9f431f80 Mon Sep 17 00:00:00 2001
+From: Duoming Zhou <duoming@zju.edu.cn>
+Date: Mon, 1 Sep 2025 21:26:17 +0800
+Subject: media: TDA1997x: Remove redundant cancel_delayed_work in probe
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+commit 29de195ca39fc2ac0af6fd45522994df9f431f80 upstream.
+
+The delayed_work delayed_work_enable_hpd is initialized with
+INIT_DELAYED_WORK(), but it is never scheduled in tda1997x_probe().
+
+Calling cancel_delayed_work() on a work that has never been
+scheduled is redundant and unnecessary, as there is no pending
+work to cancel.
+
+Remove the redundant cancel_delayed_work() from error handling
+path in tda1997x_probe() to avoid potential confusion.
+
+Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/tda1997x.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/i2c/tda1997x.c
++++ b/drivers/media/i2c/tda1997x.c
+@@ -2797,7 +2797,6 @@ err_free_media:
+ err_free_handler:
+ v4l2_ctrl_handler_free(&state->hdl);
+ err_free_mutex:
+- cancel_delayed_work(&state->delayed_work_enable_hpd);
+ mutex_destroy(&state->page_lock);
+ mutex_destroy(&state->lock);
+ tda1997x_set_power(state, 0);
--- /dev/null
+From 47825b1646a6a9eca0f90baa3d4f98947c2add96 Mon Sep 17 00:00:00 2001
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Date: Mon, 22 Sep 2025 14:43:39 -0400
+Subject: media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+commit 47825b1646a6a9eca0f90baa3d4f98947c2add96 upstream.
+
+Fix the Hantro G2 HEVC decoder so that we use DPB index 0 whenever a
+ninvalid index is received from user space. This protects the hardware
+from doing faulty memory access which then leads to bus errors.
+
+To be noted that when a reference is missing, userspace such as GStreamer
+passes an invalid DPB index of 255. This issue was found by seeking to a
+CRA picture using GStreamer. The framework is currently missing the code
+to skip over RASL pictures placed after the CRA. This situation can also
+occur while doing live streaming over lossy transport.
+
+Fixes: cb5dd5a0fa518 ("media: hantro: Introduce G2/HEVC decoder")
+Cc: stable@vger.kernel.org
+Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
++++ b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
+@@ -283,6 +283,15 @@ static void set_params(struct hantro_ctx
+ hantro_reg_write(vpu, &g2_apf_threshold, 8);
+ }
+
++static u32 get_dpb_index(const struct v4l2_ctrl_hevc_decode_params *decode_params,
++ const u32 index)
++{
++ if (index > decode_params->num_active_dpb_entries)
++ return 0;
++
++ return index;
++}
++
+ static void set_ref_pic_list(struct hantro_ctx *ctx)
+ {
+ const struct hantro_hevc_dec_ctrls *ctrls = &ctx->hevc_dec.ctrls;
+@@ -355,8 +364,10 @@ static void set_ref_pic_list(struct hant
+ list1[j++] = list1[i++];
+
+ for (i = 0; i < V4L2_HEVC_DPB_ENTRIES_NUM_MAX; i++) {
+- hantro_reg_write(vpu, &ref_pic_regs0[i], list0[i]);
+- hantro_reg_write(vpu, &ref_pic_regs1[i], list1[i]);
++ hantro_reg_write(vpu, &ref_pic_regs0[i],
++ get_dpb_index(decode_params, list0[i]));
++ hantro_reg_write(vpu, &ref_pic_regs1[i],
++ get_dpb_index(decode_params, list1[i]));
+ }
+ }
+
--- /dev/null
+From 94de23a9aa487d7c1372efb161721d7949a177ae Mon Sep 17 00:00:00 2001
+From: Haotian Zhang <vulab@iscas.ac.cn>
+Date: Tue, 28 Oct 2025 14:44:43 +0800
+Subject: media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+commit 94de23a9aa487d7c1372efb161721d7949a177ae upstream.
+
+In vb2_dc_alloc(), get_device() is called to increment the device
+reference count. However, if subsequent DMA allocation fails
+(vb2_dc_alloc_coherent or vb2_dc_alloc_non_coherent returns error),
+the function returns without calling put_device(), causing a device
+reference leak.
+
+Add put_device() call in the error path before kfree() to properly
+release the device reference acquired earlier.
+
+Fixes: de27891f675e ("media: videobuf2: handle non-contiguous DMA allocations")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/common/videobuf2/videobuf2-dma-contig.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c
++++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
+@@ -258,6 +258,7 @@ static void *vb2_dc_alloc(struct vb2_buf
+
+ if (ret) {
+ dev_err(dev, "dma alloc of size %lu failed\n", size);
++ put_device(buf->dev);
+ kfree(buf);
+ return ERR_PTR(-ENOMEM);
+ }
--- /dev/null
+From 0ef841113724166c3c484d0e9ae6db1eb5634fde Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 17 Oct 2025 07:33:20 +0200
+Subject: media: vpif_capture: fix section mismatch
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 0ef841113724166c3c484d0e9ae6db1eb5634fde upstream.
+
+Platform drivers can be probed after their init sections have been
+discarded (e.g. on probe deferral or manual rebind through sysfs) so the
+probe function must not live in init.
+
+Note that commit ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section
+mismatch warning") incorrectly suppressed the modpost warning.
+
+Fixes: ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section mismatch warning")
+Fixes: 6ffefff5a9e7 ("V4L/DVB (12906c): V4L : vpif capture driver for DM6467")
+Cc: stable@vger.kernel.org # 2.6.32
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/ti/davinci/vpif_capture.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/ti/davinci/vpif_capture.c
++++ b/drivers/media/platform/ti/davinci/vpif_capture.c
+@@ -1600,7 +1600,7 @@ err_cleanup:
+ * This creates device entries by register itself to the V4L2 driver and
+ * initializes fields of each channel objects
+ */
+-static __init int vpif_probe(struct platform_device *pdev)
++static int vpif_probe(struct platform_device *pdev)
+ {
+ struct vpif_subdev_info *subdevdata;
+ struct i2c_adapter *i2c_adap;
+@@ -1807,7 +1807,7 @@ static int vpif_resume(struct device *de
+
+ static SIMPLE_DEV_PM_OPS(vpif_pm_ops, vpif_suspend, vpif_resume);
+
+-static __refdata struct platform_driver vpif_driver = {
++static struct platform_driver vpif_driver = {
+ .driver = {
+ .name = VPIF_DRIVER_NAME,
+ .pm = &vpif_pm_ops,
--- /dev/null
+From 59ca64bf98e4209df8ace8057d31ae3c80f948cd Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 17 Oct 2025 07:33:21 +0200
+Subject: media: vpif_display: fix section mismatch
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 59ca64bf98e4209df8ace8057d31ae3c80f948cd upstream.
+
+Platform drivers can be probed after their init sections have been
+discarded (e.g. on probe deferral or manual rebind through sysfs) so the
+probe function must not live in init.
+
+Note that commit ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section
+mismatch warning") incorrectly suppressed the modpost warning.
+
+Fixes: ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section mismatch warning")
+Fixes: e7332e3a552f ("V4L/DVB (12176): davinci/vpif_display: Add VPIF display driver")
+Cc: stable@vger.kernel.org # 2.6.32
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/ti/davinci/vpif_display.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/ti/davinci/vpif_display.c
++++ b/drivers/media/platform/ti/davinci/vpif_display.c
+@@ -1214,7 +1214,7 @@ probe_out:
+ * vpif_probe: This function creates device entries by register itself to the
+ * V4L2 driver and initializes fields of each channel objects
+ */
+-static __init int vpif_probe(struct platform_device *pdev)
++static int vpif_probe(struct platform_device *pdev)
+ {
+ struct vpif_subdev_info *subdevdata;
+ struct i2c_adapter *i2c_adap;
+@@ -1390,7 +1390,7 @@ static int vpif_resume(struct device *de
+
+ static SIMPLE_DEV_PM_OPS(vpif_pm_ops, vpif_suspend, vpif_resume);
+
+-static __refdata struct platform_driver vpif_driver = {
++static struct platform_driver vpif_driver = {
+ .driver = {
+ .name = VPIF_DRIVER_NAME,
+ .pm = &vpif_pm_ops,
--- /dev/null
+From b5ab490d85b772bc99d2648182a282f39f08feb6 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:19:55 -0700
+Subject: mm/damon/tests/core-kunit: fix memory leak in damon_test_set_filters_default_reject()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit b5ab490d85b772bc99d2648182a282f39f08feb6 upstream.
+
+Patch series "mm/damon/tests: fix memory bugs in kunit tests".
+
+DAMON kunit tests were initially written assuming those will be run on
+environments that are well controlled and therefore tolerant to transient
+test failures and bugs in the test code itself. The user-mode linux based
+manual run of the tests is one example of such an environment. And the
+test code was written for adding more test coverage as fast as possible,
+over making those safe and reliable.
+
+As a result, the tests resulted in having a number of bugs including real
+memory leaks, theoretical unhandled memory allocation failures, and unused
+memory allocations. The allocation failures that are not handled well are
+unlikely in the real world, since those allocations are too small to fail.
+But in theory, it can happen and cause inappropriate memory access.
+
+It is arguable if bugs in test code can really harm users. But, anyway
+bugs are bugs that need to be fixed. Fix the bugs one by one. Also Cc
+stable@ for the fixes of memory leak and unhandled memory allocation
+failures. The unused memory allocations are only a matter of memory
+efficiency, so not Cc-ing stable@.
+
+The first patch fixes memory leaks in the test code for the DAMON core
+layer.
+
+Following fifteen, three, and one patches respectively fix unhandled
+memory allocation failures in the test code for DAMON core layer, virtual
+address space DAMON operation set, and DAMON sysfs interface, one by one
+per test function.
+
+Final two patches remove memory allocations that are correctly deallocated
+at the end, but not really being used by any code.
+
+
+This patch (of 22):
+
+Kunit test function for damos_set_filters_default_reject() allocates two
+'struct damos_filter' objects and not deallocates those, so that the
+memory for the two objects are leaked for every time the test runs. Fix
+this by deallocating those objects at the end of the test code.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-1-sj@kernel.org
+Link: https://lkml.kernel.org/r/20251101182021.74868-2-sj@kernel.org
+Fixes: 094fb14913c7 ("mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject()")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.16+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/mm/damon/tests/core-kunit.h b/mm/damon/tests/core-kunit.h
+index 51369e35298b..69ca44f9270b 100644
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -598,6 +598,9 @@ static void damon_test_set_filters_default_reject(struct kunit *test)
+ */
+ KUNIT_EXPECT_EQ(test, scheme.core_filters_default_reject, false);
+ KUNIT_EXPECT_EQ(test, scheme.ops_filters_default_reject, true);
++
++ damos_free_filter(anon_filter);
++ damos_free_filter(target_filter);
+ }
+
+ static struct kunit_case damon_test_cases[] = {
+--
+2.52.0
+
--- /dev/null
+From 28ab2265e9422ccd81e4beafc0ace90f78de04c4 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:07 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 28ab2265e9422ccd81e4beafc0ace90f78de04c4 upstream.
+
+damon_test_new_filter() is assuming all dynamic memory allocation in it
+will succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-14-sj@kernel.org
+Fixes: 2a158e956b98 ("mm/damon/core-test: add a test for damos_new_filter()")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.6+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -412,6 +412,8 @@ static void damos_test_new_filter(struct
+ struct damos_filter *filter;
+
+ filter = damos_new_filter(DAMOS_FILTER_TYPE_ANON, true, false);
++ if (!filter)
++ kunit_skip(test, "filter alloc fail");
+ KUNIT_EXPECT_EQ(test, filter->type, DAMOS_FILTER_TYPE_ANON);
+ KUNIT_EXPECT_EQ(test, filter->matching, true);
+ KUNIT_EXPECT_PTR_EQ(test, filter->list.prev, &filter->list);
--- /dev/null
+From 915a2453d824a9b6bf724e3f970d86ae1d092a61 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:06 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 915a2453d824a9b6bf724e3f970d86ae1d092a61 upstream.
+
+damon_test_set_attrs() is assuming all dynamic memory allocation in it
+will succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-13-sj@kernel.org
+Fixes: aa13779be6b7 ("mm/damon/core-test: add a test for damon_set_attrs()")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.5+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -445,6 +445,9 @@ static void damon_test_set_attrs(struct
+ .sample_interval = 5000, .aggr_interval = 100000,};
+ struct damon_attrs invalid_attrs;
+
++ if (!c)
++ kunit_skip(test, "ctx alloc fail");
++
+ KUNIT_EXPECT_EQ(test, damon_set_attrs(c, &valid_attrs), 0);
+
+ invalid_attrs = valid_attrs;
--- /dev/null
+From 3e5c4a1a1737bd79abaaa184233d0f815e62273b Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:08 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failure on damos_test_commit_filter()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 3e5c4a1a1737bd79abaaa184233d0f815e62273b upstream.
+
+damon_test_commit_filter() is assuming all dynamic memory allocation in it
+will succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-15-sj@kernel.org
+Fixes: f6a4a150f1ec ("mm/damon/tests/core-kunit: add damos_commit_filter test")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.18+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -496,11 +496,16 @@ static void damos_test_new_filter(struct
+
+ static void damos_test_commit_filter(struct kunit *test)
+ {
+- struct damos_filter *src_filter = damos_new_filter(
+- DAMOS_FILTER_TYPE_ANON, true, true);
+- struct damos_filter *dst_filter = damos_new_filter(
+- DAMOS_FILTER_TYPE_ACTIVE, false, false);
++ struct damos_filter *src_filter, *dst_filter;
+
++ src_filter = damos_new_filter(DAMOS_FILTER_TYPE_ANON, true, true);
++ if (!src_filter)
++ kunit_skip(test, "src filter alloc fail");
++ dst_filter = damos_new_filter(DAMOS_FILTER_TYPE_ACTIVE, false, false);
++ if (!dst_filter) {
++ damos_destroy_filter(src_filter);
++ kunit_skip(test, "dst filter alloc fail");
++ }
+ damos_commit_filter(dst_filter, src_filter);
+ KUNIT_EXPECT_EQ(test, dst_filter->type, src_filter->type);
+ KUNIT_EXPECT_EQ(test, dst_filter->matching, src_filter->matching);
--- /dev/null
+From 4f835f4e8c863985f15abd69db033c2f66546094 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:03 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 4f835f4e8c863985f15abd69db033c2f66546094 upstream.
+
+damon_test_ops_registration() is assuming all dynamic memory allocation in
+it will succeed. Those are indeed likely in the real use cases since
+those allocations are too small to fail, but theoretically those could
+fail. In the case, inappropriate memory access can happen. Fix it by
+appropriately cleanup pre-allocated memory and skip the execution of the
+remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-10-sj@kernel.org
+Fixes: 4f540f5ab4f2 ("mm/damon/core-test: add a kunit test case for ops registration")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.19+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -300,6 +300,9 @@ static void damon_test_ops_registration(
+ struct damon_operations ops = {.id = DAMON_OPS_VADDR}, bak;
+ bool need_cleanup = false;
+
++ if (!c)
++ kunit_skip(test, "ctx alloc fail");
++
+ /* DAMON_OPS_VADDR is registered only if CONFIG_DAMON_VADDR is set */
+ if (!damon_is_registered_ops(DAMON_OPS_VADDR)) {
+ bak.id = DAMON_OPS_VADDR;
--- /dev/null
+From 74d5969995d129fd59dd93b9c7daa6669cb6810f Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:04 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 74d5969995d129fd59dd93b9c7daa6669cb6810f upstream.
+
+damon_test_set_regions() is assuming all dynamic memory allocation in it
+will succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-11-sj@kernel.org
+Fixes: 62f409560eb2 ("mm/damon/core-test: test damon_set_regions")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.1+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -345,13 +345,26 @@ static void damon_test_ops_registration(
+ static void damon_test_set_regions(struct kunit *test)
+ {
+ struct damon_target *t = damon_new_target();
+- struct damon_region *r1 = damon_new_region(4, 16);
+- struct damon_region *r2 = damon_new_region(24, 32);
++ struct damon_region *r1, *r2;
+ struct damon_addr_range range = {.start = 8, .end = 28};
+ unsigned long expects[] = {8, 16, 16, 24, 24, 28};
+ int expect_idx = 0;
+ struct damon_region *r;
+
++ if (!t)
++ kunit_skip(test, "target alloc fail");
++ r1 = damon_new_region(4, 16);
++ if (!r1) {
++ damon_free_target(t);
++ kunit_skip(test, "region alloc fail");
++ }
++ r2 = damon_new_region(24, 32);
++ if (!r2) {
++ damon_free_target(t);
++ damon_free_region(r1);
++ kunit_skip(test, "second region alloc fail");
++ }
++
+ damon_add_region(r1, t);
+ damon_add_region(r2, t);
+ damon_set_regions(t, &range, 1, DAMON_MIN_REGION);
--- /dev/null
+From 8cf298c01b7fdb08eef5b6b26d0fe98d48134d72 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:05 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 8cf298c01b7fdb08eef5b6b26d0fe98d48134d72 upstream.
+
+damon_test_update_monitoring_result() is assuming all dynamic memory
+allocation in it will succeed. Those are indeed likely in the real use
+cases since those allocations are too small to fail, but theoretically
+those could fail. In the case, inappropriate memory access can happen.
+Fix it by appropriately cleanup pre-allocated memory and skip the
+execution of the remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-12-sj@kernel.org
+Fixes: f4c978b6594b ("mm/damon/core-test: add a test for damon_update_monitoring_results()")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.3+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -406,6 +406,9 @@ static void damon_test_update_monitoring
+ struct damon_attrs new_attrs;
+ struct damon_region *r = damon_new_region(3, 7);
+
++ if (!r)
++ kunit_skip(test, "region alloc fail");
++
+ r->nr_accesses = 15;
+ r->nr_accesses_bp = 150000;
+ r->age = 20;
--- /dev/null
+From 3d443dd29a1db7efa587a4bb0c06a497e13ca9e4 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:00 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 3d443dd29a1db7efa587a4bb0c06a497e13ca9e4 upstream.
+
+damon_test_merge_two() is assuming all dynamic memory allocation in it
+will succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-7-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -188,11 +188,21 @@ static void damon_test_merge_two(struct
+ int i;
+
+ t = damon_new_target();
++ if (!t)
++ kunit_skip(test, "target alloc fail");
+ r = damon_new_region(0, 100);
++ if (!r) {
++ damon_free_target(t);
++ kunit_skip(test, "region alloc fail");
++ }
+ r->nr_accesses = 10;
+ r->nr_accesses_bp = 100000;
+ damon_add_region(r, t);
+ r2 = damon_new_region(100, 300);
++ if (!r2) {
++ damon_free_target(t);
++ kunit_skip(test, "second region alloc fail");
++ }
+ r2->nr_accesses = 20;
+ r2->nr_accesses_bp = 200000;
+ damon_add_region(r2, t);
--- /dev/null
+From 84be856cc87317bc60ff54bd7c8f8a5aa8f0e2c8 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:10 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures on damon_test_set_filters_default_reject()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 84be856cc87317bc60ff54bd7c8f8a5aa8f0e2c8 upstream.
+
+damon_test_set_filters_default_reject() is assuming all dynamic memory
+allocation in it will succeed. Those are indeed likely in the real use
+cases since those allocations are too small to fail, but theoretically
+those could fail. In the case, inappropriate memory access can happen.
+Fix it by appropriately cleanup pre-allocated memory and skip the
+execution of the remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-17-sj@kernel.org
+Fixes: 094fb14913c7 ("mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject()")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.16+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -617,6 +617,8 @@ static void damon_test_set_filters_defau
+ KUNIT_EXPECT_EQ(test, scheme.ops_filters_default_reject, false);
+
+ target_filter = damos_new_filter(DAMOS_FILTER_TYPE_TARGET, true, true);
++ if (!target_filter)
++ kunit_skip(test, "filter alloc fail");
+ damos_add_filter(&scheme, target_filter);
+ damos_set_filters_default_reject(&scheme);
+ /*
+@@ -642,6 +644,10 @@ static void damon_test_set_filters_defau
+ KUNIT_EXPECT_EQ(test, scheme.ops_filters_default_reject, false);
+
+ anon_filter = damos_new_filter(DAMOS_FILTER_TYPE_ANON, true, true);
++ if (!anon_filter) {
++ damos_free_filter(target_filter);
++ kunit_skip(test, "anon_filter alloc fail");
++ }
+ damos_add_filter(&scheme, anon_filter);
+
+ damos_set_filters_default_reject(&scheme);
--- /dev/null
+From 5e80d73f22043c59c8ad36452a3253937ed77955 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:19:59 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 5e80d73f22043c59c8ad36452a3253937ed77955 upstream.
+
+damon_test_split_at() is assuming all dynamic memory allocation in it will
+succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-6-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -124,8 +124,19 @@ static void damon_test_split_at(struct k
+ struct damon_target *t;
+ struct damon_region *r, *r_new;
+
++ if (!c)
++ kunit_skip(test, "ctx alloc fail");
+ t = damon_new_target();
++ if (!t) {
++ damon_destroy_ctx(c);
++ kunit_skip(test, "target alloc fail");
++ }
+ r = damon_new_region(0, 100);
++ if (!r) {
++ damon_destroy_ctx(c);
++ damon_free_target(t);
++ kunit_skip(test, "region alloc fail");
++ }
+ r->nr_accesses_bp = 420000;
+ r->nr_accesses = 42;
+ r->last_nr_accesses = 15;
--- /dev/null
+From d14d5671e7c9cc788c5a1edfa94e6f9064275905 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:09 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit d14d5671e7c9cc788c5a1edfa94e6f9064275905 upstream.
+
+damon_test_filter_out() is assuming all dynamic memory allocation in it
+will succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-16-sj@kernel.org
+Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filter_out()")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.6+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -511,11 +511,22 @@ static void damos_test_filter_out(struct
+ struct damos_filter *f;
+
+ f = damos_new_filter(DAMOS_FILTER_TYPE_ADDR, true, false);
++ if (!f)
++ kunit_skip(test, "filter alloc fail");
+ f->addr_range = (struct damon_addr_range){
+ .start = DAMON_MIN_REGION * 2, .end = DAMON_MIN_REGION * 6};
+
+ t = damon_new_target();
++ if (!t) {
++ damos_destroy_filter(f);
++ kunit_skip(test, "target alloc fail");
++ }
+ r = damon_new_region(DAMON_MIN_REGION * 3, DAMON_MIN_REGION * 5);
++ if (!r) {
++ damos_destroy_filter(f);
++ damon_free_target(t);
++ kunit_skip(test, "region alloc fail");
++ }
+ damon_add_region(r, t);
+
+ /* region in the range */
--- /dev/null
+From 0998d2757218771c59d5ca59ccf13d1542a38f17 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:01 -0700
+Subject: mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 0998d2757218771c59d5ca59ccf13d1542a38f17 upstream.
+
+damon_test_merge_regions_of() is assuming all dynamic memory allocation in
+it will succeed. Those are indeed likely in the real use cases since
+those allocations are too small to fail, but theoretically those could
+fail. In the case, inappropriate memory access can happen. Fix it by
+appropriately cleanup pre-allocated memory and skip the execution of the
+remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-8-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -238,8 +238,14 @@ static void damon_test_merge_regions_of(
+ int i;
+
+ t = damon_new_target();
++ if (!t)
++ kunit_skip(test, "target alloc fail");
+ for (i = 0; i < ARRAY_SIZE(sa); i++) {
+ r = damon_new_region(sa[i], ea[i]);
++ if (!r) {
++ damon_free_target(t);
++ kunit_skip(test, "region alloc fail");
++ }
+ r->nr_accesses = nrs[i];
+ r->nr_accesses_bp = nrs[i] * 10000;
+ damon_add_region(r, t);
--- /dev/null
+From e16fdd4f754048d6e23c56bd8d920b71e41e3777 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:19:56 -0700
+Subject: mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit e16fdd4f754048d6e23c56bd8d920b71e41e3777 upstream.
+
+damon_test_regions() is assuming all dynamic memory allocation in it will
+succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-3-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -20,11 +20,17 @@ static void damon_test_regions(struct ku
+ struct damon_target *t;
+
+ r = damon_new_region(1, 2);
++ if (!r)
++ kunit_skip(test, "region alloc fail");
+ KUNIT_EXPECT_EQ(test, 1ul, r->ar.start);
+ KUNIT_EXPECT_EQ(test, 2ul, r->ar.end);
+ KUNIT_EXPECT_EQ(test, 0u, r->nr_accesses);
+
+ t = damon_new_target();
++ if (!t) {
++ damon_free_region(r);
++ kunit_skip(test, "target alloc fail");
++ }
+ KUNIT_EXPECT_EQ(test, 0u, damon_nr_regions(t));
+
+ damon_add_region(r, t);
--- /dev/null
+From f79f2fc44ebd0ed655239046be3e80e8804b5545 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:19:58 -0700
+Subject: mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit f79f2fc44ebd0ed655239046be3e80e8804b5545 upstream.
+
+damon_test_aggregate() is assuming all dynamic memory allocation in it
+will succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-5-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -97,8 +97,15 @@ static void damon_test_aggregate(struct
+ struct damon_region *r;
+ int it, ir;
+
++ if (!ctx)
++ kunit_skip(test, "ctx alloc fail");
++
+ for (it = 0; it < 3; it++) {
+ t = damon_new_target();
++ if (!t) {
++ damon_destroy_ctx(ctx);
++ kunit_skip(test, "target alloc fail");
++ }
+ damon_add_target(ctx, t);
+ }
+
+@@ -106,6 +113,10 @@ static void damon_test_aggregate(struct
+ damon_for_each_target(t, ctx) {
+ for (ir = 0; ir < 3; ir++) {
+ r = damon_new_region(saddr[it][ir], eaddr[it][ir]);
++ if (!r) {
++ damon_destroy_ctx(ctx);
++ kunit_skip(test, "region alloc fail");
++ }
+ r->nr_accesses = accesses[it][ir];
+ r->nr_accesses_bp = accesses[it][ir] * 10000;
+ damon_add_region(r, t);
--- /dev/null
+From fafe953de2c661907c94055a2497c6b8dbfd26f3 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:19:57 -0700
+Subject: mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit fafe953de2c661907c94055a2497c6b8dbfd26f3 upstream.
+
+damon_test_target() is assuming all dynamic memory allocation in it will
+succeed. Those are indeed likely in the real use cases since those
+allocations are too small to fail, but theoretically those could fail. In
+the case, inappropriate memory access can happen. Fix it by appropriately
+cleanup pre-allocated memory and skip the execution of the remaining tests
+in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-4-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/core-kunit.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/mm/damon/tests/core-kunit.h
++++ b/mm/damon/tests/core-kunit.h
+@@ -58,7 +58,14 @@ static void damon_test_target(struct kun
+ struct damon_ctx *c = damon_new_ctx();
+ struct damon_target *t;
+
++ if (!c)
++ kunit_skip(test, "ctx alloc fail");
++
+ t = damon_new_target();
++ if (!t) {
++ damon_destroy_ctx(c);
++ kunit_skip(test, "target alloc fail");
++ }
+ KUNIT_EXPECT_EQ(test, 0u, nr_damon_targets(c));
+
+ damon_add_target(c, t);
--- /dev/null
+From 7d808bf13943f4c6a6142400bffe14267f6dc997 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:14 -0700
+Subject: mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 7d808bf13943f4c6a6142400bffe14267f6dc997 upstream.
+
+damon_sysfs_test_add_targets() is assuming all dynamic memory allocation
+in it will succeed. Those are indeed likely in the real use cases since
+those allocations are too small to fail, but theoretically those could
+fail. In the case, inappropriate memory access can happen. Fix it by
+appropriately cleanup pre-allocated memory and skip the execution of the
+remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-21-sj@kernel.org
+Fixes: b8ee5575f763 ("mm/damon/sysfs-test: add a unit test for damon_sysfs_set_targets()")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [6.7+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/sysfs-kunit.h | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/mm/damon/tests/sysfs-kunit.h
++++ b/mm/damon/tests/sysfs-kunit.h
+@@ -45,16 +45,41 @@ static void damon_sysfs_test_add_targets
+ struct damon_ctx *ctx;
+
+ sysfs_targets = damon_sysfs_targets_alloc();
++ if (!sysfs_targets)
++ kunit_skip(test, "sysfs_targets alloc fail");
+ sysfs_targets->nr = 1;
+ sysfs_targets->targets_arr = kmalloc_array(1,
+ sizeof(*sysfs_targets->targets_arr), GFP_KERNEL);
++ if (!sysfs_targets->targets_arr) {
++ kfree(sysfs_targets);
++ kunit_skip(test, "targets_arr alloc fail");
++ }
+
+ sysfs_target = damon_sysfs_target_alloc();
++ if (!sysfs_target) {
++ kfree(sysfs_targets->targets_arr);
++ kfree(sysfs_targets);
++ kunit_skip(test, "sysfs_target alloc fail");
++ }
+ sysfs_target->pid = __damon_sysfs_test_get_any_pid(12, 100);
+ sysfs_target->regions = damon_sysfs_regions_alloc();
++ if (!sysfs_target->regions) {
++ kfree(sysfs_targets->targets_arr);
++ kfree(sysfs_targets);
++ kfree(sysfs_target);
++ kunit_skip(test, "sysfs_regions alloc fail");
++ }
++
+ sysfs_targets->targets_arr[0] = sysfs_target;
+
+ ctx = damon_new_ctx();
++ if (!ctx) {
++ kfree(sysfs_targets->targets_arr);
++ kfree(sysfs_targets);
++ kfree(sysfs_target);
++ kfree(sysfs_target->regions);
++ kunit_skip(test, "ctx alloc fail");
++ }
+
+ damon_sysfs_add_targets(ctx, sysfs_targets);
+ KUNIT_EXPECT_EQ(test, 1u, nr_damon_targets(ctx));
--- /dev/null
+From 7890e5b5bb6e386155c6e755fe70e0cdcc77f18e Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:12 -0700
+Subject: mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 7890e5b5bb6e386155c6e755fe70e0cdcc77f18e upstream.
+
+damon_test_split_evenly_fail() is assuming all dynamic memory allocation
+in it will succeed. Those are indeed likely in the real use cases since
+those allocations are too small to fail, but theoretically those could
+fail. In the case, inappropriate memory access can happen. Fix it by
+appropriately cleanup pre-allocated memory and skip the execution of the
+remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-19-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/vaddr-kunit.h | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/mm/damon/tests/vaddr-kunit.h
++++ b/mm/damon/tests/vaddr-kunit.h
+@@ -256,7 +256,16 @@ static void damon_test_split_evenly_fail
+ unsigned long start, unsigned long end, unsigned int nr_pieces)
+ {
+ struct damon_target *t = damon_new_target();
+- struct damon_region *r = damon_new_region(start, end);
++ struct damon_region *r;
++
++ if (!t)
++ kunit_skip(test, "target alloc fail");
++
++ r = damon_new_region(start, end);
++ if (!r) {
++ damon_free_target(t);
++ kunit_skip(test, "region alloc fail");
++ }
+
+ damon_add_region(r, t);
+ KUNIT_EXPECT_EQ(test,
--- /dev/null
+From 2b22d0fcc6320ba29b2122434c1d2f0785fb0a25 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:11 -0700
+Subject: mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 2b22d0fcc6320ba29b2122434c1d2f0785fb0a25 upstream.
+
+damon_do_test_apply_three_regions() is assuming all dynamic memory
+allocation in it will succeed. Those are indeed likely in the real use
+cases since those allocations are too small to fail, but theoretically
+those could fail. In the case, inappropriate memory access can happen.
+Fix it by appropriately cleanup pre-allocated memory and skip the
+execution of the remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-18-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/vaddr-kunit.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/damon/tests/vaddr-kunit.h
++++ b/mm/damon/tests/vaddr-kunit.h
+@@ -136,8 +136,14 @@ static void damon_do_test_apply_three_re
+ int i;
+
+ t = damon_new_target();
++ if (!t)
++ kunit_skip(test, "target alloc fail");
+ for (i = 0; i < nr_regions / 2; i++) {
+ r = damon_new_region(regions[i * 2], regions[i * 2 + 1]);
++ if (!r) {
++ damon_destroy_target(t, NULL);
++ kunit_skip(test, "region alloc fail");
++ }
+ damon_add_region(r, t);
+ }
+
--- /dev/null
+From 0a63a0e7570b9b2631dfb8d836dc572709dce39e Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sat, 1 Nov 2025 11:20:13 -0700
+Subject: mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 0a63a0e7570b9b2631dfb8d836dc572709dce39e upstream.
+
+damon_test_split_evenly_succ() is assuming all dynamic memory allocation
+in it will succeed. Those are indeed likely in the real use cases since
+those allocations are too small to fail, but theoretically those could
+fail. In the case, inappropriate memory access can happen. Fix it by
+appropriately cleanup pre-allocated memory and skip the execution of the
+remaining tests in the failure cases.
+
+Link: https://lkml.kernel.org/r/20251101182021.74868-20-sj@kernel.org
+Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: Brendan Higgins <brendan.higgins@linux.dev>
+Cc: David Gow <davidgow@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: <stable@vger.kernel.org> [5.15+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/tests/vaddr-kunit.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/mm/damon/tests/vaddr-kunit.h
++++ b/mm/damon/tests/vaddr-kunit.h
+@@ -284,10 +284,17 @@ static void damon_test_split_evenly_succ
+ unsigned long start, unsigned long end, unsigned int nr_pieces)
+ {
+ struct damon_target *t = damon_new_target();
+- struct damon_region *r = damon_new_region(start, end);
++ struct damon_region *r;
+ unsigned long expected_width = (end - start) / nr_pieces;
+ unsigned long i = 0;
+
++ if (!t)
++ kunit_skip(test, "target alloc fail");
++ r = damon_new_region(start, end);
++ if (!r) {
++ damon_free_target(t);
++ kunit_skip(test, "region alloc fail");
++ }
+ damon_add_region(r, t);
+ KUNIT_EXPECT_EQ(test,
+ damon_va_evenly_split_region(t, r, nr_pieces), 0);
--- /dev/null
+From 64ef5f454e167bb66cf70104f033c3d71e6ef9c0 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sun, 9 Nov 2025 12:52:44 +0100
+Subject: mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+commit 64ef5f454e167bb66cf70104f033c3d71e6ef9c0 upstream.
+
+Commit 5c2f7727d437 ("mtd: mtdpart: check for subpartitions parsing
+result") introduced some kind of regression with parser on subpartitions
+where if a parser emits an error then the entire parsing process from the
+upper parser fails and partitions are deleted.
+
+Not checking for error in subpartitions was originally intended as
+special parser can emit error also in the case of the partition not
+correctly init (for example a wiped partition) or special case where the
+partition should be skipped due to some ENV variables externally
+provided (from bootloader for example)
+
+One example case is the TRX partition where, in the context of a wiped
+partition, returns a -ENOENT as the trx_magic is not found in the
+expected TRX header (as the partition is wiped)
+
+To better handle this and still keep some kind of error tracking (for
+example to catch -ENOMEM errors or -EINVAL errors), permit parser on
+subpartition to emit -ENOENT error, print a debug log and skip them
+accordingly.
+
+This results in giving better tracking of the status of the parser
+(instead of returning just 0, dropping any kind of signal that there is
+something wrong with the parser) and to some degree restore the original
+logic of the subpartitions parse.
+
+(worth to notice that some special partition might have all the special
+header present for the parser and declare 0 partition in it, this is why
+it would be wrong to simply return 0 in the case of a special partition
+that is NOT init for the scanning parser)
+
+Cc: stable@vger.kernel.org
+Fixes: 5c2f7727d437 ("mtd: mtdpart: check for subpartitions parsing result")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/mtdpart.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -425,9 +425,12 @@ int add_mtd_partitions(struct mtd_info *
+
+ mtd_add_partition_attrs(child);
+
+- /* Look for subpartitions */
++ /* Look for subpartitions (skip if no maching parser found) */
+ ret = parse_mtd_partitions(child, parts[i].types, NULL);
+- if (ret < 0) {
++ if (ret < 0 && ret == -ENOENT) {
++ pr_debug("Skip parsing subpartitions: %d\n", ret);
++ continue;
++ } else if (ret < 0) {
+ pr_err("Failed to parse subpartitions: %d\n", ret);
+ goto err_del_partitions;
+ }
--- /dev/null
+From 1df1fdbc7e63350b2962dc7d87ded124ee26f3ad Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 5 Nov 2025 18:27:04 +0100
+Subject: mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 1df1fdbc7e63350b2962dc7d87ded124ee26f3ad upstream.
+
+These chips must be described as none of the block protection
+information are discoverable. This chip supports 4 bits plus the
+top/bottom addressing capability to identify the protected blocks.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/winbond.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/winbond.c
++++ b/drivers/mtd/spi-nor/winbond.c
+@@ -359,6 +359,10 @@ static const struct flash_info winbond_n
+ /* W25H512NWxxAM */
+ .id = SNOR_ID(0xef, 0xa0, 0x20),
+ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
++ }, {
++ /* W25H01NWxxAM */
++ .id = SNOR_ID(0xef, 0xa0, 0x21),
++ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
+ },
+ };
+
--- /dev/null
+From 604cf6a40157abba4677dea9834de8df9047d798 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 5 Nov 2025 18:27:05 +0100
+Subject: mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 604cf6a40157abba4677dea9834de8df9047d798 upstream.
+
+These chips must be described as none of the block protection
+information are discoverable. This chip supports 4 bits plus the
+top/bottom addressing capability to identify the protected blocks.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/winbond.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/winbond.c
++++ b/drivers/mtd/spi-nor/winbond.c
+@@ -363,6 +363,10 @@ static const struct flash_info winbond_n
+ /* W25H01NWxxAM */
+ .id = SNOR_ID(0xef, 0xa0, 0x21),
+ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
++ }, {
++ /* W25H02NWxxAM */
++ .id = SNOR_ID(0xef, 0xa0, 0x22),
++ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
+ },
+ };
+
--- /dev/null
+From f21d2c7d37553b24825918f2f61df123e182b712 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 5 Nov 2025 18:27:03 +0100
+Subject: mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit f21d2c7d37553b24825918f2f61df123e182b712 upstream.
+
+These chips must be described as none of the block protection
+information are discoverable. This chip supports 4 bits plus the
+top/bottom addressing capability to identify the protected blocks.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/winbond.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/winbond.c
++++ b/drivers/mtd/spi-nor/winbond.c
+@@ -355,6 +355,10 @@ static const struct flash_info winbond_n
+ /* W25Q02NWxxIM */
+ .id = SNOR_ID(0xef, 0x80, 0x22),
+ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
++ }, {
++ /* W25H512NWxxAM */
++ .id = SNOR_ID(0xef, 0xa0, 0x20),
++ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
+ },
+ };
+
--- /dev/null
+From a607e676c8b9258eabc3fc88f45bcd70ea178b41 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 5 Nov 2025 18:27:01 +0100
+Subject: mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit a607e676c8b9258eabc3fc88f45bcd70ea178b41 upstream.
+
+These chips must be described as none of the block protection
+information are discoverable. This chip supports 4 bits plus the
+top/bottom addressing capability to identify the protected blocks.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/winbond.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/winbond.c
++++ b/drivers/mtd/spi-nor/winbond.c
+@@ -347,6 +347,10 @@ static const struct flash_info winbond_n
+ /* W25Q01NWxxIQ */
+ .id = SNOR_ID(0xef, 0x60, 0x21),
+ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
++ }, {
++ /* W25Q01NWxxIM */
++ .id = SNOR_ID(0xef, 0x80, 0x21),
++ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
+ },
+ };
+
--- /dev/null
+From aee8c4d9d48d661624d72de670ebe5c6b5687842 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 5 Nov 2025 18:27:00 +0100
+Subject: mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit aee8c4d9d48d661624d72de670ebe5c6b5687842 upstream.
+
+This chip must be described as none of the block protection information
+are discoverable. This chip supports 4 bits plus the top/bottom
+addressing capability to identify the protected blocks.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/winbond.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/winbond.c
++++ b/drivers/mtd/spi-nor/winbond.c
+@@ -343,6 +343,10 @@ static const struct flash_info winbond_n
+ .id = SNOR_ID(0xef, 0x80, 0x20),
+ .name = "w25q512nwm",
+ .otp = SNOR_OTP(256, 3, 0x1000, 0x1000),
++ }, {
++ /* W25Q01NWxxIQ */
++ .id = SNOR_ID(0xef, 0x60, 0x21),
++ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
+ },
+ };
+
--- /dev/null
+From 71c239348d9fbdb1f0d6f36013f1697cc06c3e9c Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 5 Nov 2025 18:27:02 +0100
+Subject: mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 71c239348d9fbdb1f0d6f36013f1697cc06c3e9c upstream.
+
+These chips must be described as none of the block protection
+information are discoverable. This chip supports 4 bits plus the
+top/bottom addressing capability to identify the protected blocks.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/spi-nor/winbond.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/spi-nor/winbond.c
++++ b/drivers/mtd/spi-nor/winbond.c
+@@ -351,6 +351,10 @@ static const struct flash_info winbond_n
+ /* W25Q01NWxxIM */
+ .id = SNOR_ID(0xef, 0x80, 0x21),
+ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
++ }, {
++ /* W25Q02NWxxIM */
++ .id = SNOR_ID(0xef, 0x80, 0x22),
++ .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB | SPI_NOR_TB_SR_BIT6 | SPI_NOR_4BIT_BP,
+ },
+ };
+
--- /dev/null
+From e3e8e176ca4876e6212582022ad80835dddc9de4 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Tue, 11 Nov 2025 09:59:30 -0500
+Subject: NFSD: Make FILE_SYNC WRITEs comply with spec
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit e3e8e176ca4876e6212582022ad80835dddc9de4 upstream.
+
+Mike noted that when NFSD responds to an NFS_FILE_SYNC WRITE, it
+does not also persist file time stamps. To wit, Section 18.32.3
+of RFC 8881 mandates:
+
+> The client specifies with the stable parameter the method of how
+> the data is to be processed by the server. If stable is
+> FILE_SYNC4, the server MUST commit the data written plus all file
+> system metadata to stable storage before returning results. This
+> corresponds to the NFSv2 protocol semantics. Any other behavior
+> constitutes a protocol violation. If stable is DATA_SYNC4, then
+> the server MUST commit all of the data to stable storage and
+> enough of the metadata to retrieve the data before returning.
+
+Commit 3f3503adb332 ("NFSD: Use vfs_iocb_iter_write()") replaced:
+
+- flags |= RWF_SYNC;
+
+with:
+
++ kiocb.ki_flags |= IOCB_DSYNC;
+
+which appears to be correct given:
+
+ if (flags & RWF_SYNC)
+ kiocb_flags |= IOCB_DSYNC;
+
+in kiocb_set_rw_flags(). However the author of that commit did not
+appreciate that the previous line in kiocb_set_rw_flags() results
+in IOCB_SYNC also being set:
+
+ kiocb_flags |= (__force int) (flags & RWF_SUPPORTED);
+
+RWF_SUPPORTED contains RWF_SYNC, and RWF_SYNC is the same bit as
+IOCB_SYNC. Reviewers at the time did not catch the omission.
+
+Reported-by: Mike Snitzer <snitzer@kernel.org>
+Closes: https://lore.kernel.org/linux-nfs/20251018005431.3403-1-cel@kernel.org/T/#t
+Fixes: 3f3503adb332 ("NFSD: Use vfs_iocb_iter_write()")
+Cc: stable@vger.kernel.org
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: NeilBrown <neil@brown.name>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/vfs.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1228,8 +1228,18 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ stable = NFS_UNSTABLE;
+ init_sync_kiocb(&kiocb, file);
+ kiocb.ki_pos = offset;
+- if (stable && !fhp->fh_use_wgather)
+- kiocb.ki_flags |= IOCB_DSYNC;
++ if (likely(!fhp->fh_use_wgather)) {
++ switch (stable) {
++ case NFS_FILE_SYNC:
++ /* persist data and timestamps */
++ kiocb.ki_flags |= IOCB_DSYNC | IOCB_SYNC;
++ break;
++ case NFS_DATA_SYNC:
++ /* persist data only */
++ kiocb.ki_flags |= IOCB_DSYNC;
++ break;
++ }
++ }
+
+ nvecs = xdr_buf_to_bvec(rqstp->rq_bvec, rqstp->rq_maxpages, payload);
+ iov_iter_bvec(&iter, ITER_SOURCE, rqstp->rq_bvec, nvecs, *cnt);
--- /dev/null
+From 511b3b644e28d9b66e32515a74c57ff599e89035 Mon Sep 17 00:00:00 2001
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Date: Tue, 9 Sep 2025 13:21:22 +0200
+Subject: nvmet: pci-epf: move DMA initialization to EPC init callback
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+commit 511b3b644e28d9b66e32515a74c57ff599e89035 upstream.
+
+For DMA initialization to work across all EPC drivers, the DMA
+initialization has to be done in the .init() callback.
+
+This is because not all EPC drivers will have a refclock (which is often
+needed to access registers of a DMA controller embedded in a PCIe
+controller) at the time the .bind() callback is called.
+
+However, all EPC drivers are guaranteed to have a refclock by the time
+the .init() callback is called.
+
+Thus, move the DMA initialization to the .init() callback.
+
+This change was already done for other EPF drivers in
+commit 60bd3e039aa2 ("PCI: endpoint: pci-epf-{mhi/test}: Move DMA
+initialization to EPC init callback").
+
+Cc: stable@vger.kernel.org
+Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver")
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/pci-epf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvme/target/pci-epf.c
++++ b/drivers/nvme/target/pci-epf.c
+@@ -2325,6 +2325,8 @@ static int nvmet_pci_epf_epc_init(struct
+ return ret;
+ }
+
++ nvmet_pci_epf_init_dma(nvme_epf);
++
+ /* Set device ID, class, etc. */
+ epf->header->vendorid = ctrl->tctrl->subsys->vendor_id;
+ epf->header->subsys_vendor_id = ctrl->tctrl->subsys->subsys_vendor_id;
+@@ -2422,8 +2424,6 @@ static int nvmet_pci_epf_bind(struct pci
+ if (ret)
+ return ret;
+
+- nvmet_pci_epf_init_dma(nvme_epf);
+-
+ return 0;
+ }
+
--- /dev/null
+From 5fb1d3ce3e74a4530042795e1e065422295f1371 Mon Sep 17 00:00:00 2001
+From: Sven Schnelle <svens@stackframe.org>
+Date: Wed, 15 Oct 2025 23:21:41 +0200
+Subject: parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
+
+From: Sven Schnelle <svens@stackframe.org>
+
+commit 5fb1d3ce3e74a4530042795e1e065422295f1371 upstream.
+
+When the kernel leaves to userspace via syscall_restore_rfi(), the
+W bit is not set in the new PSW. This doesn't cause any problems
+because there's no 64 bit userspace for parisc. Simple static binaries
+are usually loaded at addresses way below the 32 bit limit so the W bit
+doesn't matter.
+
+Fix this by setting the W bit when TIF_32BIT is not set.
+
+Signed-off-by: Sven Schnelle <svens@stackframe.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/kernel/asm-offsets.c | 2 ++
+ arch/parisc/kernel/entry.S | 5 ++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/parisc/kernel/asm-offsets.c
++++ b/arch/parisc/kernel/asm-offsets.c
+@@ -258,6 +258,8 @@ int main(void)
+ BLANK();
+ DEFINE(TIF_BLOCKSTEP_PA_BIT, 31-TIF_BLOCKSTEP);
+ DEFINE(TIF_SINGLESTEP_PA_BIT, 31-TIF_SINGLESTEP);
++ DEFINE(TIF_32BIT_PA_BIT, 31-TIF_32BIT);
++
+ BLANK();
+ DEFINE(ASM_PMD_SHIFT, PMD_SHIFT);
+ DEFINE(ASM_PGDIR_SHIFT, PGDIR_SHIFT);
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -1846,6 +1846,10 @@ syscall_restore_rfi:
+ extru,= %r19,TIF_BLOCKSTEP_PA_BIT,1,%r0
+ depi -1,7,1,%r20 /* T bit */
+
++#ifdef CONFIG_64BIT
++ extru,<> %r19,TIF_32BIT_PA_BIT,1,%r0
++ depi -1,4,1,%r20 /* W bit */
++#endif
+ STREG %r20,TASK_PT_PSW(%r1)
+
+ /* Always store space registers, since sr3 can be changed (e.g. fork) */
+@@ -1859,7 +1863,6 @@ syscall_restore_rfi:
+ STREG %r25,TASK_PT_IASQ0(%r1)
+ STREG %r25,TASK_PT_IASQ1(%r1)
+
+- /* XXX W bit??? */
+ /* Now if old D bit is clear, it means we didn't save all registers
+ * on syscall entry, so do that now. This only happens on TRACEME
+ * calls, or if someone attached to us while we were on a syscall.
--- /dev/null
+From 1aa4524c0c1b54842c4c0a370171d11b12d0709b Mon Sep 17 00:00:00 2001
+From: Sven Schnelle <svens@stackframe.org>
+Date: Thu, 30 Oct 2025 08:56:05 +0100
+Subject: parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
+
+From: Sven Schnelle <svens@stackframe.org>
+
+commit 1aa4524c0c1b54842c4c0a370171d11b12d0709b upstream.
+
+In wide mode, the IASQ contain the upper part of the GVA
+during interruption. This needs to be reversed before
+the space is used - otherwise it contains parts of IAOQ.
+See Page 2-13 "Processing Resources / Interruption Instruction
+Address Queues" in the Parisc 2.0 Architecture Manual page 2-13
+for an explanation.
+
+The IAOQ/IASQ space_adjust was skipped for other interruptions
+than itlb misses. However, the code in handle_interruption()
+checks whether iasq[0] contains a valid space. Due to the not
+masked out bits this match failed and the process was killed.
+
+Also add space_adjust for IAOQ1/IASQ1 so ptregs contains sane values.
+
+Signed-off-by: Sven Schnelle <svens@stackframe.org>
+Cc: stable@vger.kernel.org # v6.0+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/kernel/entry.S | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -1059,8 +1059,6 @@ ENTRY_CFI(intr_save) /* for os_hpmc */
+ STREG %r17, PT_IOR(%r29)
+
+ #if defined(CONFIG_64BIT)
+- b,n intr_save2
+-
+ skip_save_ior:
+ /* We have a itlb miss, and when executing code above 4 Gb on ILP64, we
+ * need to adjust iasq/iaoq here in the same way we adjusted isr/ior
+@@ -1069,10 +1067,17 @@ skip_save_ior:
+ bb,COND(>=),n %r8,PSW_W_BIT,intr_save2
+ LDREG PT_IASQ0(%r29), %r16
+ LDREG PT_IAOQ0(%r29), %r17
+- /* adjust iasq/iaoq */
++ /* adjust iasq0/iaoq0 */
+ space_adjust %r16,%r17,%r1
+ STREG %r16, PT_IASQ0(%r29)
+ STREG %r17, PT_IAOQ0(%r29)
++
++ LDREG PT_IASQ1(%r29), %r16
++ LDREG PT_IAOQ1(%r29), %r17
++ /* adjust iasq1/iaoq1 */
++ space_adjust %r16,%r17,%r1
++ STREG %r16, PT_IASQ1(%r29)
++ STREG %r17, PT_IAOQ1(%r29)
+ #else
+ skip_save_ior:
+ #endif
--- /dev/null
+From 9583f9d22991d2cfb5cc59a2552040c4ae98d998 Mon Sep 17 00:00:00 2001
+From: Jim Quinlan <james.quinlan@broadcom.com>
+Date: Fri, 3 Oct 2025 13:04:36 -0400
+Subject: PCI: brcmstb: Fix disabling L0s capability
+
+From: Jim Quinlan <james.quinlan@broadcom.com>
+
+commit 9583f9d22991d2cfb5cc59a2552040c4ae98d998 upstream.
+
+caab002d5069 ("PCI: brcmstb: Disable L0s component of ASPM if requested")
+set PCI_EXP_LNKCAP_ASPM_L1 and (optionally) PCI_EXP_LNKCAP_ASPM_L0S in
+PCI_EXP_LNKCAP (aka PCIE_RC_CFG_PRIV1_LINK_CAPABILITY in brcmstb).
+
+But instead of using PCI_EXP_LNKCAP_ASPM_L1 and PCI_EXP_LNKCAP_ASPM_L0S
+directly, it used PCIE_LINK_STATE_L1 and PCIE_LINK_STATE_L0S, which are
+Linux-created values that only coincidentally matched the PCIe spec.
+b478e162f227 ("PCI/ASPM: Consolidate link state defines") later changed
+them so they no longer matched the PCIe spec, so the bits ended up in the
+wrong place in PCI_EXP_LNKCAP.
+
+Use PCI_EXP_LNKCAP_ASPM_L0S to clear L0s support when there's an
+'aspm-no-l0s' property. Rely on brcmstb hardware to advertise L0s and/or
+L1 support otherwise.
+
+Fixes: caab002d5069 ("PCI: brcmstb: Disable L0s component of ASPM if requested")
+Reported-by: Bjorn Helgaas <bhelgaas@google.com>
+Closes: https://lore.kernel.org/linux-pci/20250925194424.GA2197200@bhelgaas
+Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com>
+[mani: reworded subject and description, added closes tag and CCed stable]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251003170436.1446030-1-james.quinlan@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -48,7 +48,6 @@
+
+ #define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY 0x04dc
+ #define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_MAX_LINK_WIDTH_MASK 0x1f0
+-#define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK 0xc00
+
+ #define PCIE_RC_CFG_PRIV1_ROOT_CAP 0x4f8
+ #define PCIE_RC_CFG_PRIV1_ROOT_CAP_L1SS_MODE_MASK 0xf8
+@@ -1075,7 +1074,7 @@ static int brcm_pcie_setup(struct brcm_p
+ void __iomem *base = pcie->base;
+ struct pci_host_bridge *bridge;
+ struct resource_entry *entry;
+- u32 tmp, burst, aspm_support, num_lanes, num_lanes_cap;
++ u32 tmp, burst, num_lanes, num_lanes_cap;
+ u8 num_out_wins = 0;
+ int num_inbound_wins = 0;
+ int memc, ret;
+@@ -1175,12 +1174,9 @@ static int brcm_pcie_setup(struct brcm_p
+
+
+ /* Don't advertise L0s capability if 'aspm-no-l0s' */
+- aspm_support = PCIE_LINK_STATE_L1;
+- if (!of_property_read_bool(pcie->np, "aspm-no-l0s"))
+- aspm_support |= PCIE_LINK_STATE_L0S;
+ tmp = readl(base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
+- u32p_replace_bits(&tmp, aspm_support,
+- PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK);
++ if (of_property_read_bool(pcie->np, "aspm-no-l0s"))
++ tmp &= ~PCI_EXP_LNKCAP_ASPM_L0S;
+ writel(tmp, base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
+
+ /* 'tmp' still holds the contents of PRIV1_LINK_CAPABILITY */
--- /dev/null
+From eff0306b109f2d611e44f0155b0324f6cfec3ef4 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Date: Sat, 1 Nov 2025 09:59:42 +0530
+Subject: PCI: meson: Fix parsing the DBI register region
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+
+commit eff0306b109f2d611e44f0155b0324f6cfec3ef4 upstream.
+
+First of all, the driver was parsing the 'dbi' register region as 'elbi'.
+This was due to DT mistakenly passing 'dbi' as 'elbi'. Since the DT is
+now fixed to supply 'dbi' region, this driver can rely on the DWC core
+driver to parse and map it.
+
+However, to support the old DTs, if the 'elbi' region is found in DT, parse
+and map the region as both 'dw_pcie::elbi_base' as 'dw_pcie::dbi_base'.
+This will allow the driver to work with both broken and fixed DTs.
+
+Also, skip parsing the 'elbi' region in DWC core if 'pci->elbi_base' was
+already populated.
+
+Fixes: 9c0ef6d34fdb ("PCI: amlogic: Add the Amlogic Meson PCIe controller driver")
+Fixes: c96992a24bec ("PCI: dwc: Add support for ELBI resource mapping")
+Reported-by: Linnaea Lavia <linnaea-von-lavia@live.com>
+Closes: https://lore.kernel.org/linux-pci/DM4PR05MB102707B8CDF84D776C39F22F2C7F0A@DM4PR05MB10270.namprd05.prod.outlook.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on Bananapi-M2S
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Cc: stable@vger.kernel.org # 6.2
+Link: https://patch.msgid.link/20251101-pci-meson-fix-v1-3-c50dcc56ed6a@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-meson.c | 18 +++++++++++++++---
+ drivers/pci/controller/dwc/pcie-designware.c | 12 +++++++-----
+ 2 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pci-meson.c
++++ b/drivers/pci/controller/dwc/pci-meson.c
+@@ -108,10 +108,22 @@ static int meson_pcie_get_mems(struct pl
+ struct meson_pcie *mp)
+ {
+ struct dw_pcie *pci = &mp->pci;
++ struct resource *res;
+
+- pci->dbi_base = devm_platform_ioremap_resource_byname(pdev, "elbi");
+- if (IS_ERR(pci->dbi_base))
+- return PTR_ERR(pci->dbi_base);
++ /*
++ * For the broken DTs that supply 'dbi' as 'elbi', parse the 'elbi'
++ * region and assign it to both 'pci->elbi_base' and 'pci->dbi_space' so
++ * that the DWC core can skip parsing both regions.
++ */
++ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "elbi");
++ if (res) {
++ pci->elbi_base = devm_pci_remap_cfg_resource(pci->dev, res);
++ if (IS_ERR(pci->elbi_base))
++ return PTR_ERR(pci->elbi_base);
++
++ pci->dbi_base = pci->elbi_base;
++ pci->dbi_phys_addr = res->start;
++ }
+
+ mp->cfg_base = devm_platform_ioremap_resource_byname(pdev, "cfg");
+ if (IS_ERR(mp->cfg_base))
+--- a/drivers/pci/controller/dwc/pcie-designware.c
++++ b/drivers/pci/controller/dwc/pcie-designware.c
+@@ -168,11 +168,13 @@ int dw_pcie_get_resources(struct dw_pcie
+ }
+
+ /* ELBI is an optional resource */
+- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "elbi");
+- if (res) {
+- pci->elbi_base = devm_ioremap_resource(pci->dev, res);
+- if (IS_ERR(pci->elbi_base))
+- return PTR_ERR(pci->elbi_base);
++ if (!pci->elbi_base) {
++ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "elbi");
++ if (res) {
++ pci->elbi_base = devm_ioremap_resource(pci->dev, res);
++ if (IS_ERR(pci->elbi_base))
++ return PTR_ERR(pci->elbi_base);
++ }
+ }
+
+ /* LLDD is supposed to manually switch the clocks and resets state */
--- /dev/null
+From 01439286514ce9d13b8123f8ec3717d7135ff1d6 Mon Sep 17 00:00:00 2001
+From: Sandipan Das <sandipan.das@amd.com>
+Date: Tue, 9 Dec 2025 13:56:38 +0530
+Subject: perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+commit 01439286514ce9d13b8123f8ec3717d7135ff1d6 upstream.
+
+If amd_uncore_event_init() fails, return an error irrespective of the
+pmu_version. Setting hwc->config should be safe even if there is an
+error so use this opportunity to simplify the code.
+
+Closes: https://lore.kernel.org/all/aTaI0ci3vZ44lmBn@stanley.mountain/
+
+Fixes: d6389d3ccc13 ("perf/x86/amd/uncore: Refactor uncore management")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/076935e23a70335d33bd6e23308b75ae0ad35ba2.1765268667.git.sandipan.das@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/amd/uncore.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/arch/x86/events/amd/uncore.c
++++ b/arch/x86/events/amd/uncore.c
+@@ -656,14 +656,11 @@ static int amd_uncore_df_event_init(stru
+ struct hw_perf_event *hwc = &event->hw;
+ int ret = amd_uncore_event_init(event);
+
+- if (ret || pmu_version < 2)
+- return ret;
+-
+ hwc->config = event->attr.config &
+ (pmu_version >= 2 ? AMD64_PERFMON_V2_RAW_EVENT_MASK_NB :
+ AMD64_RAW_EVENT_MASK_NB);
+
+- return 0;
++ return ret;
+ }
+
+ static int amd_uncore_df_add(struct perf_event *event, int flags)
--- /dev/null
+From 1cb053ea2e1dedd8f2d9653b7c3ca5b93c8c9275 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Thu, 23 Oct 2025 12:29:06 +0200
+Subject: power: supply: max77705: Fix potential IRQ chip conflict when probing two devices
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 1cb053ea2e1dedd8f2d9653b7c3ca5b93c8c9275 upstream.
+
+MAX77705 charger is most likely always a single device on the board,
+however nothing stops board designers to have two of them, thus same
+device driver could probe twice. Or user could manually try to probing
+second time.
+
+Device driver is not ready for that case, because it allocates
+statically 'struct regmap_irq_chip' as non-const and stores during
+probe in 'irq_drv_data' member a pointer to per-probe state
+container ('struct max77705_charger_data'). devm_regmap_add_irq_chip()
+does not make a copy of 'struct regmap_irq_chip' but stores the pointer.
+
+Second probe - either successful or failure - would overwrite the
+'irq_drv_data' from previous device probe, so interrupts would be
+executed in a wrong context.
+
+Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20251023102905.71535-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/max77705_charger.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/power/supply/max77705_charger.c
++++ b/drivers/power/supply/max77705_charger.c
+@@ -60,7 +60,7 @@ static const struct regmap_irq max77705_
+ REGMAP_IRQ_REG_LINE(MAX77705_AICL_I, BITS_PER_BYTE),
+ };
+
+-static struct regmap_irq_chip max77705_charger_irq_chip = {
++static const struct regmap_irq_chip max77705_charger_irq_chip = {
+ .name = "max77705-charger",
+ .status_base = MAX77705_CHG_REG_INT,
+ .mask_base = MAX77705_CHG_REG_INT_MASK,
+@@ -567,6 +567,7 @@ static int max77705_charger_probe(struct
+ {
+ struct power_supply_config pscfg = {};
+ struct max77705_charger_data *chg;
++ struct regmap_irq_chip *chip_desc;
+ struct device *dev;
+ struct regmap_irq_chip_data *irq_data;
+ int ret;
+@@ -580,6 +581,13 @@ static int max77705_charger_probe(struct
+ chg->dev = dev;
+ i2c_set_clientdata(i2c, chg);
+
++ chip_desc = devm_kmemdup(dev, &max77705_charger_irq_chip,
++ sizeof(max77705_charger_irq_chip),
++ GFP_KERNEL);
++ if (!chip_desc)
++ return -ENOMEM;
++ chip_desc->irq_drv_data = chg;
++
+ chg->regmap = devm_regmap_init_i2c(i2c, &max77705_chg_regmap_config);
+ if (IS_ERR(chg->regmap))
+ return PTR_ERR(chg->regmap);
+@@ -599,11 +607,9 @@ static int max77705_charger_probe(struct
+ if (IS_ERR(chg->psy_chg))
+ return PTR_ERR(chg->psy_chg);
+
+- max77705_charger_irq_chip.irq_drv_data = chg;
+ ret = devm_regmap_add_irq_chip(chg->dev, chg->regmap, i2c->irq,
+ IRQF_ONESHOT, 0,
+- &max77705_charger_irq_chip,
+- &irq_data);
++ chip_desc, &irq_data);
+ if (ret)
+ return dev_err_probe(dev, ret, "failed to add irq chip\n");
+
--- /dev/null
+From 0da2ba35c0d532ca0fe7af698b17d74c4d084b9a Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Tue, 21 Oct 2025 12:06:06 +0200
+Subject: powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
+
+From: David Hildenbrand <david@redhat.com>
+
+commit 0da2ba35c0d532ca0fe7af698b17d74c4d084b9a upstream.
+
+Let's properly adjust BALLOON_MIGRATE like the other drivers.
+
+Note that the INFLATE/DEFLATE events are triggered from the core when
+enqueueing/dequeueing pages.
+
+This was found by code inspection.
+
+Link: https://lkml.kernel.org/r/20251021100606.148294-3-david@redhat.com
+Fixes: fe030c9b85e6 ("powerpc/pseries/cmm: Implement balloon compaction")
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/pseries/cmm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/platforms/pseries/cmm.c
++++ b/arch/powerpc/platforms/pseries/cmm.c
+@@ -532,6 +532,7 @@ static int cmm_migratepage(struct balloo
+
+ spin_lock_irqsave(&b_dev_info->pages_lock, flags);
+ balloon_page_insert(b_dev_info, newpage);
++ __count_vm_event(BALLOON_MIGRATE);
+ b_dev_info->isolated_pages--;
+ spin_unlock_irqrestore(&b_dev_info->pages_lock, flags);
+
--- /dev/null
+From fc6bcf9ac4de76f5e7bcd020b3c0a86faff3f2d5 Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Tue, 21 Oct 2025 12:06:05 +0200
+Subject: powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
+
+From: David Hildenbrand <david@redhat.com>
+
+commit fc6bcf9ac4de76f5e7bcd020b3c0a86faff3f2d5 upstream.
+
+Patch series "powerpc/pseries/cmm: two smaller fixes".
+
+Two smaller fixes identified while doing a bigger rework.
+
+
+This patch (of 2):
+
+We always have to initialize the balloon_dev_info, even when compaction is
+not configured in: otherwise the containing list and the lock are left
+uninitialized.
+
+Likely not many such configs exist in practice, but let's CC stable to
+be sure.
+
+This was found by code inspection.
+
+Link: https://lkml.kernel.org/r/20251021100606.148294-1-david@redhat.com
+Link: https://lkml.kernel.org/r/20251021100606.148294-2-david@redhat.com
+Fixes: fe030c9b85e6 ("powerpc/pseries/cmm: Implement balloon compaction")
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/pseries/cmm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/pseries/cmm.c
++++ b/arch/powerpc/platforms/pseries/cmm.c
+@@ -551,7 +551,6 @@ static int cmm_migratepage(struct balloo
+
+ static void cmm_balloon_compaction_init(void)
+ {
+- balloon_devinfo_init(&b_dev_info);
+ b_dev_info.migratepage = cmm_migratepage;
+ }
+ #else /* CONFIG_BALLOON_COMPACTION */
+@@ -573,6 +572,7 @@ static int cmm_init(void)
+ if (!firmware_has_feature(FW_FEATURE_CMO) && !simulate)
+ return -EOPNOTSUPP;
+
++ balloon_devinfo_init(&b_dev_info);
+ cmm_balloon_compaction_init();
+
+ rc = register_oom_notifier(&cmm_oom_nb);
mfd-max77620-fix-potential-irq-chip-conflict-when-probing-two-devices.patch
media-rc-st_rc-fix-reset-control-resource-leak.patch
media-verisilicon-fix-cpu-stalls-on-g2-bus-error.patch
+arm64-dts-ti-k3-am62d2-evm-fix-regulator-properties.patch
+arm64-dts-ti-k3-am62d2-evm-fix-pmic-padconfig.patch
+arm64-dts-st-add-memory-region-names-property-for-stm32mp257f-ev1.patch
+arm64-dts-qcom-sm6350-fix-wrong-order-of-freq-table-hz-for-ufs.patch
+mtd-mtdpart-ignore-error-enoent-from-parsers-on-subpartitions.patch
+mtd-spi-nor-winbond-add-support-for-w25q01nwxxiq-chips.patch
+mtd-spi-nor-winbond-add-support-for-w25q01nwxxim-chips.patch
+mtd-spi-nor-winbond-add-support-for-w25q02nwxxim-chips.patch
+mtd-spi-nor-winbond-add-support-for-w25h512nwxxam-chips.patch
+mtd-spi-nor-winbond-add-support-for-w25h01nwxxam-chips.patch
+mtd-spi-nor-winbond-add-support-for-w25h02nwxxam-chips.patch
+nfsd-make-file_sync-writes-comply-with-spec.patch
+nvmet-pci-epf-move-dma-initialization-to-epc-init-callback.patch
+parisc-entry.s-fix-space-adjustment-on-interruption-for-64-bit-userspace.patch
+parisc-entry-set-w-bit-for-compat-tasks-in-syscall_restore_rfi.patch
+pci-brcmstb-fix-disabling-l0s-capability.patch
+pci-meson-fix-parsing-the-dbi-register-region.patch
+perf-x86-amd-uncore-fix-the-return-value-of-amd_uncore_df_event_init-on-error.patch
+power-supply-max77705-fix-potential-irq-chip-conflict-when-probing-two-devices.patch
+powerpc-pseries-cmm-adjust-balloon_migrate-when-migrating-pages.patch
+powerpc-pseries-cmm-call-balloon_devinfo_init-also-without-config_balloon_compaction.patch
+media-adv7842-avoid-possible-out-of-bounds-array-accesses-in-adv7842_cp_log_status.patch
+firmware-stratix10-svc-add-mutex-in-stratix10-memory-management.patch
+dm-ebs-mark-full-buffer-dirty-even-on-partial-write.patch
+dm-bufio-align-write-boundary-on-physical-block-size.patch
+dm-pcache-fix-cache-info-indexing.patch
+dm-pcache-fix-segment-info-indexing.patch
+fbdev-gbefb-fix-to-use-physical-address-instead-of-dma-address.patch
+fbdev-pxafb-fix-multiple-clamped-values-in-pxafb_adjust_timing.patch
+fbdev-tcx.c-fix-mem_map-to-correct-smem_start-offset.patch
+media-cec-fix-debugfs-leak-on-bus_register-failure.patch
+media-iris-refine-internal-buffer-reconfiguration-logic-for-resolution-change.patch
+media-msp3400-avoid-possible-out-of-bounds-array-accesses-in-msp3400c_thread.patch
+media-platform-mtk-mdp3-fix-device-leaks-at-probe.patch
+media-renesas-rcar_drif-fix-device-node-reference-leak-in-rcar_drif_bond_enabled.patch
+media-samsung-exynos4-is-fix-potential-abba-deadlock-on-init.patch
+media-tda1997x-remove-redundant-cancel_delayed_work-in-probe.patch
+media-verisilicon-protect-g2-hevc-decoder-against-invalid-dpb-index.patch
+media-videobuf2-fix-device-reference-leak-in-vb2_dc_alloc-error-path.patch
+media-vpif_capture-fix-section-mismatch.patch
+media-vpif_display-fix-section-mismatch.patch
+media-amphion-remove-vpu_vb_is_codecconfig.patch
+media-amphion-cancel-message-work-before-releasing-the-vpu-core.patch
+media-i2c-adv7604-remove-redundant-cancel_delayed_work-in-probe.patch
+media-i2c-adv7842-remove-redundant-cancel_delayed_work-in-probe.patch
+media-i2c-imx219-fix-1920x1080-mode-to-use-1-1-pixel-aspect-ratio.patch
+media-mediatek-vcodec-use-spinlock-for-context-list-protection-lock.patch
+media-mediatek-vcodec-fix-a-reference-leak-in-mtk_vcodec_fw_vpu_init.patch
+loongarch-add-new-pci-id-for-pci_fixup_vgadev.patch
+loongarch-correct-the-calculation-logic-of-thread_count.patch
+loongarch-fix-arch_dup_task_struct-for-config_randstruct.patch
+loongarch-fix-build-errors-for-config_randstruct.patch
+loongarch-use-__pmd-__pte-for-swap-entry-conversions.patch
+loongarch-use-unsigned-long-for-_end-and-_text.patch
+mm-damon-tests-sysfs-kunit-handle-alloc-failures-on-damon_sysfs_test_add_targets.patch
+mm-damon-tests-vaddr-kunit-handle-alloc-failures-on-damon_do_test_apply_three_regions.patch
+mm-damon-tests-vaddr-kunit-handle-alloc-failures-in-damon_test_split_evenly_fail.patch
+mm-damon-tests-vaddr-kunit-handle-alloc-failures-on-damon_test_split_evenly_succ.patch
+mm-damon-tests-core-kunit-fix-memory-leak-in-damon_test_set_filters_default_reject.patch
+mm-damon-tests-core-kunit-handle-alloc-failres-in-damon_test_new_filter.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-on-damon_test_split_at.patch
+mm-damon-tests-core-kunit-handle-allocation-failures-in-damon_test_regions.patch
+mm-damon-tests-core-kunit-handle-memory-failure-from-damon_test_target.patch
+mm-damon-tests-core-kunit-handle-memory-alloc-failure-from-damon_test_aggregate.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-on-dasmon_test_merge_regions_of.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-on-damon_test_merge_two.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-in-damon_test_set_regions.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-in-damon_test_update_monitoring_result.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-on-damon_test_set_filters_default_reject.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-on-damos_test_filter_out.patch
+mm-damon-tests-core-kunit-handle-alloc-failures-in-damon_test_ops_registration.patch
+mm-damon-tests-core-kunit-handle-alloc-failure-on-damon_test_set_attrs.patch
+mm-damon-tests-core-kunit-handle-alloc-failure-on-damos_test_commit_filter.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
