From: Greg Kroah-Hartman Date: Tue, 20 Jan 2026 15:09:13 +0000 (+0100) Subject: 6.18-stable patches X-Git-Tag: v6.12.67~12 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=25311d48ad7887ae034b1fadcb6d8338f51c23b4;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch dmaengine-cv1800b-dmamux-fix-device-leak-on-route-allocation.patch dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch dmaengine-fsl-edma-fix-clk-leak-on-alloc_chan_resources-failure.patch dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch dmaengine-lpc32xx-dmamux-fix-device-leak-on-route-allocation.patch dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch dmaengine-sh-rz-dmac-fix-device-leak-on-probe-failure.patch dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch dmaengine-stm32-dmamux-fix-device-leak-on-route-allocation.patch dmaengine-stm32-dmamux-fix-of-node-leak-on-route-allocation-failure.patch dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch drm-amd-display-bump-the-hdmi-clock-to-340mhz.patch drm-amd-display-initialise-backlight-level-values-from-hw.patch drm-amdgpu-fix-gfx9-update-pte-mtype-flag.patch drm-amdgpu-make-sure-userqs-are-enabled-in-userq-ioctls.patch drm-amdkfd-fix-a-memory-leak-in-device_queue_manager_init.patch drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch drm-panel-simple-restore-connector_type-fallback.patch drm-sysfb-remove-duplicate-declarations.patch drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch loongarch-dts-loongson-2k0500-add-default-interrupt-controller-address-cells.patch loongarch-dts-loongson-2k1000-add-default-interrupt-controller-address-cells.patch loongarch-dts-loongson-2k1000-fix-i2c-gpio-node-names.patch loongarch-dts-loongson-2k2000-add-default-interrupt-controller-address-cells.patch loongarch-kvm-fix-kvm_device-leak-in-kvm_eiointc_destroy.patch loongarch-kvm-fix-kvm_device-leak-in-kvm_ipi_destroy.patch loongarch-kvm-fix-kvm_device-leak-in-kvm_pch_pic_destroy.patch --- diff --git a/queue-6.18/dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch b/queue-6.18/dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch new file mode 100644 index 0000000000..0f99f0de89 --- /dev/null +++ b/queue-6.18/dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch @@ -0,0 +1,37 @@ +From 76cba1e60b69c9cd53b9127d017a7dc5945455b1 Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Wed, 31 Dec 2025 13:34:59 +0100 +Subject: dmaengine: apple-admac: Add "apple,t8103-admac" compatible + +From: Janne Grunau + +commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream. + +After discussion with the devicetree maintainers we agreed to not extend +lists with the generic compatible "apple,admac" anymore [1]. Use +"apple,t8103-admac" as base compatible as it is the SoC the driver and +bindings were written for. + +[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ + +Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") +Cc: stable@vger.kernel.org +Reviewed-by: Neal Gompa +Signed-off-by: Janne Grunau +Link: https://patch.msgid.link/20251231-apple-admac-t8103-base-compat-v1-1-ec24a3708f76@jannau.net +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/apple-admac.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/dma/apple-admac.c ++++ b/drivers/dma/apple-admac.c +@@ -936,6 +936,7 @@ static void admac_remove(struct platform + } + + static const struct of_device_id admac_of_match[] = { ++ { .compatible = "apple,t8103-admac", }, + { .compatible = "apple,admac", }, + { } + }; diff --git a/queue-6.18/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch b/queue-6.18/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch new file mode 100644 index 0000000000..0ca916cbd7 --- /dev/null +++ b/queue-6.18/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch @@ -0,0 +1,53 @@ +From b9074b2d7a230b6e28caa23165e9d8bc0677d333 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:43 +0100 +Subject: dmaengine: at_hdmac: fix device leak on of_dma_xlate() + +From: Johan Hovold + +commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream. + +Make sure to drop the reference taken when looking up the DMA platform +device during of_dma_xlate() when releasing channel resources. + +Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing +put_device() call in at_dma_xlate()") fixed the leak in a couple of +error paths but the reference is still leaking on successful allocation. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") +Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2 +Cc: Yu Kuai +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_hdmac.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1765,6 +1765,7 @@ static int atc_alloc_chan_resources(stru + static void atc_free_chan_resources(struct dma_chan *chan) + { + struct at_dma_chan *atchan = to_at_dma_chan(chan); ++ struct at_dma_slave *atslave; + + BUG_ON(atc_chan_is_enabled(atchan)); + +@@ -1774,8 +1775,12 @@ static void atc_free_chan_resources(stru + /* + * Free atslave allocated in at_dma_xlate() + */ +- kfree(chan->private); +- chan->private = NULL; ++ atslave = chan->private; ++ if (atslave) { ++ put_device(atslave->dma_dev); ++ kfree(atslave); ++ chan->private = NULL; ++ } + + dev_vdbg(chan2dev(chan), "free_chan_resources: done\n"); + } diff --git a/queue-6.18/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch b/queue-6.18/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch new file mode 100644 index 0000000000..92a75eb498 --- /dev/null +++ b/queue-6.18/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch @@ -0,0 +1,51 @@ +From 7c3a46ebf15a9796b763a54272407fdbf945bed8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:45 +0100 +Subject: dmaengine: bcm-sba-raid: fix device leak on probe + +From: Johan Hovold + +commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream. + +Make sure to drop the reference taken when looking up the mailbox device +during probe on probe failures and on driver unbind. + +Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver") +Cc: stable@vger.kernel.org # 4.13 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/bcm-sba-raid.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/dma/bcm-sba-raid.c ++++ b/drivers/dma/bcm-sba-raid.c +@@ -1699,7 +1699,7 @@ static int sba_probe(struct platform_dev + /* Prealloc channel resource */ + ret = sba_prealloc_channel_resources(sba); + if (ret) +- goto fail_free_mchan; ++ goto fail_put_mbox; + + /* Check availability of debugfs */ + if (!debugfs_initialized()) +@@ -1729,6 +1729,8 @@ skip_debugfs: + fail_free_resources: + debugfs_remove_recursive(sba->root); + sba_freeup_channel_resources(sba); ++fail_put_mbox: ++ put_device(sba->mbox_dev); + fail_free_mchan: + mbox_free_channel(sba->mchan); + return ret; +@@ -1744,6 +1746,8 @@ static void sba_remove(struct platform_d + + sba_freeup_channel_resources(sba); + ++ put_device(sba->mbox_dev); ++ + mbox_free_channel(sba->mchan); + } + diff --git a/queue-6.18/dmaengine-cv1800b-dmamux-fix-device-leak-on-route-allocation.patch b/queue-6.18/dmaengine-cv1800b-dmamux-fix-device-leak-on-route-allocation.patch new file mode 100644 index 0000000000..e086bf6448 --- /dev/null +++ b/queue-6.18/dmaengine-cv1800b-dmamux-fix-device-leak-on-route-allocation.patch @@ -0,0 +1,96 @@ +From 7bb7d696e0361bbfc1411462c784998cca0afcbb Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:46 +0100 +Subject: dmaengine: cv1800b-dmamux: fix device leak on route allocation + +From: Johan Hovold + +commit 7bb7d696e0361bbfc1411462c784998cca0afcbb upstream. + +Make sure to drop the reference taken when looking up the DMA mux +platform device during route allocation. + +Note that holding a reference to a device does not prevent its driver +data from going away so there is no point in keeping the reference. + +Fixes: db7d07b5add4 ("dmaengine: add driver for Sophgo CV18XX/SG200X dmamux") +Cc: stable@vger.kernel.org # 6.17 +Cc: Inochi Amaoto +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-5-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/cv1800b-dmamux.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/dma/cv1800b-dmamux.c b/drivers/dma/cv1800b-dmamux.c +index e900d6595617..f7a952fcbc7d 100644 +--- a/drivers/dma/cv1800b-dmamux.c ++++ b/drivers/dma/cv1800b-dmamux.c +@@ -102,11 +102,11 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec, + struct llist_node *node; + unsigned long flags; + unsigned int chid, devid, cpuid; +- int ret; ++ int ret = -EINVAL; + + if (dma_spec->args_count != DMAMUX_NCELLS) { + dev_err(&pdev->dev, "invalid number of dma mux args\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + devid = dma_spec->args[0]; +@@ -115,18 +115,18 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec, + + if (devid > MAX_DMA_MAPPING_ID) { + dev_err(&pdev->dev, "invalid device id: %u\n", devid); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + if (cpuid > MAX_DMA_CPU_ID) { + dev_err(&pdev->dev, "invalid cpu id: %u\n", cpuid); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "can't get dma master\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + spin_lock_irqsave(&dmamux->lock, flags); +@@ -136,8 +136,6 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec, + if (map->peripheral == devid && map->cpu == cpuid) + goto found; + } +- +- ret = -EINVAL; + goto failed; + } else { + node = llist_del_first(&dmamux->free_maps); +@@ -171,12 +169,17 @@ static void *cv1800_dmamux_route_allocate(struct of_phandle_args *dma_spec, + dev_dbg(&pdev->dev, "register channel %u for req %u (cpu %u)\n", + chid, devid, cpuid); + ++ put_device(&pdev->dev); ++ + return map; + + failed: + spin_unlock_irqrestore(&dmamux->lock, flags); + of_node_put(dma_spec->np); + dev_err(&pdev->dev, "errno %d\n", ret); ++err_put_pdev: ++ put_device(&pdev->dev); ++ + return ERR_PTR(ret); + } + +-- +2.52.0 + diff --git a/queue-6.18/dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch b/queue-6.18/dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch new file mode 100644 index 0000000000..ac434de6f6 --- /dev/null +++ b/queue-6.18/dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch @@ -0,0 +1,44 @@ +From ec25e60f9f95464aa11411db31d0906b3fb7b9f2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:47 +0100 +Subject: dmaengine: dw: dmamux: fix OF node leak on route allocation failure + +From: Johan Hovold + +commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream. + +Make sure to drop the reference taken to the DMA master OF node also on +late route allocation failures. + +Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support") +Cc: stable@vger.kernel.org # 5.19 +Cc: Miquel Raynal +Signed-off-by: Johan Hovold +Reviewed-by: Miquel Raynal +Link: https://patch.msgid.link/20251117161258.10679-6-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dw/rzn1-dmamux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/dw/rzn1-dmamux.c ++++ b/drivers/dma/dw/rzn1-dmamux.c +@@ -90,7 +90,7 @@ static void *rzn1_dmamux_route_allocate( + + if (test_and_set_bit(map->req_idx, dmamux->used_chans)) { + ret = -EBUSY; +- goto free_map; ++ goto put_dma_spec_np; + } + + mask = BIT(map->req_idx); +@@ -103,6 +103,8 @@ static void *rzn1_dmamux_route_allocate( + + clear_bitmap: + clear_bit(map->req_idx, dmamux->used_chans); ++put_dma_spec_np: ++ of_node_put(dma_spec->np); + free_map: + kfree(map); + put_device: diff --git a/queue-6.18/dmaengine-fsl-edma-fix-clk-leak-on-alloc_chan_resources-failure.patch b/queue-6.18/dmaengine-fsl-edma-fix-clk-leak-on-alloc_chan_resources-failure.patch new file mode 100644 index 0000000000..0a2aba7a8d --- /dev/null +++ b/queue-6.18/dmaengine-fsl-edma-fix-clk-leak-on-alloc_chan_resources-failure.patch @@ -0,0 +1,38 @@ +From b18cd8b210417f90537d914ffb96e390c85a7379 Mon Sep 17 00:00:00 2001 +From: Zhen Ni +Date: Tue, 14 Oct 2025 17:05:22 +0800 +Subject: dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure + +From: Zhen Ni + +commit b18cd8b210417f90537d914ffb96e390c85a7379 upstream. + +When fsl_edma_alloc_chan_resources() fails after clk_prepare_enable(), +the error paths only free IRQs and destroy the TCD pool, but forget to +call clk_disable_unprepare(). This causes the channel clock to remain +enabled, leaking power and resources. + +Fix it by disabling the channel clock in the error unwind path. + +Fixes: d8d4355861d8 ("dmaengine: fsl-edma: add i.MX8ULP edma support") +Cc: stable@vger.kernel.org +Suggested-by: Frank Li +Signed-off-by: Zhen Ni +Reviewed-by: Frank Li +Link: https://patch.msgid.link/20251014090522.827726-1-zhen.ni@easystack.cn +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/fsl-edma-common.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/dma/fsl-edma-common.c ++++ b/drivers/dma/fsl-edma-common.c +@@ -852,6 +852,7 @@ err_errirq: + free_irq(fsl_chan->txirq, fsl_chan); + err_txirq: + dma_pool_destroy(fsl_chan->tcd_pool); ++ clk_disable_unprepare(fsl_chan->clk); + + return ret; + } diff --git a/queue-6.18/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch b/queue-6.18/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch new file mode 100644 index 0000000000..51fe2cdd0d --- /dev/null +++ b/queue-6.18/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch @@ -0,0 +1,80 @@ +From 799900f01792cf8b525a44764f065f83fcafd468 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:48 +0100 +Subject: dmaengine: idxd: fix device leaks on compat bind and unbind + +From: Johan Hovold + +commit 799900f01792cf8b525a44764f065f83fcafd468 upstream. + +Make sure to drop the reference taken when looking up the idxd device as +part of the compat bind and unbind sysfs interface. + +Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode") +Cc: stable@vger.kernel.org # 5.15 +Cc: Dave Jiang +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/idxd/compat.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/dma/idxd/compat.c ++++ b/drivers/dma/idxd/compat.c +@@ -20,11 +20,16 @@ static ssize_t unbind_store(struct devic + int rc = -ENODEV; + + dev = bus_find_device_by_name(bus, NULL, buf); +- if (dev && dev->driver) { ++ if (!dev) ++ return -ENODEV; ++ ++ if (dev->driver) { + device_driver_detach(dev); + rc = count; + } + ++ put_device(dev); ++ + return rc; + } + static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store); +@@ -38,9 +43,12 @@ static ssize_t bind_store(struct device_ + struct idxd_dev *idxd_dev; + + dev = bus_find_device_by_name(bus, NULL, buf); +- if (!dev || dev->driver || drv != &dsa_drv.drv) ++ if (!dev) + return -ENODEV; + ++ if (dev->driver || drv != &dsa_drv.drv) ++ goto err_put_dev; ++ + idxd_dev = confdev_to_idxd_dev(dev); + if (is_idxd_dev(idxd_dev)) { + alt_drv = driver_find("idxd", bus); +@@ -53,13 +61,20 @@ static ssize_t bind_store(struct device_ + alt_drv = driver_find("user", bus); + } + if (!alt_drv) +- return -ENODEV; ++ goto err_put_dev; + + rc = device_driver_attach(alt_drv, dev); + if (rc < 0) +- return rc; ++ goto err_put_dev; ++ ++ put_device(dev); + + return count; ++ ++err_put_dev: ++ put_device(dev); ++ ++ return rc; + } + static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store); + diff --git a/queue-6.18/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch b/queue-6.18/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch new file mode 100644 index 0000000000..daaa627285 --- /dev/null +++ b/queue-6.18/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch @@ -0,0 +1,89 @@ +From d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:49 +0100 +Subject: dmaengine: lpc18xx-dmamux: fix device leak on route allocation + +From: Johan Hovold + +commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream. + +Make sure to drop the reference taken when looking up the DMA mux +platform device during route allocation. + +Note that holding a reference to a device does not prevent its driver +data from going away so there is no point in keeping the reference. + +Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux") +Cc: stable@vger.kernel.org # 4.3 +Signed-off-by: Johan Hovold +Reviewed-by: Vladimir Zapolskiy +Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/dma/lpc18xx-dmamux.c ++++ b/drivers/dma/lpc18xx-dmamux.c +@@ -57,30 +57,31 @@ static void *lpc18xx_dmamux_reserve(stru + struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev); + unsigned long flags; + unsigned mux; ++ int ret = -EINVAL; + + if (dma_spec->args_count != 3) { + dev_err(&pdev->dev, "invalid number of dma mux args\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + mux = dma_spec->args[0]; + if (mux >= dmamux->dma_master_requests) { + dev_err(&pdev->dev, "invalid mux number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) { + dev_err(&pdev->dev, "invalid dma mux value: %d\n", + dma_spec->args[1]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + /* The of_node_put() will be done in the core for the node */ + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "can't get dma master\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + spin_lock_irqsave(&dmamux->lock, flags); +@@ -89,7 +90,8 @@ static void *lpc18xx_dmamux_reserve(stru + dev_err(&pdev->dev, "dma request %u busy with %u.%u\n", + mux, mux, dmamux->muxes[mux].value); + of_node_put(dma_spec->np); +- return ERR_PTR(-EBUSY); ++ ret = -EBUSY; ++ goto err_put_pdev; + } + + dmamux->muxes[mux].busy = true; +@@ -106,7 +108,14 @@ static void *lpc18xx_dmamux_reserve(stru + dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux, + dmamux->muxes[mux].value, mux); + ++ put_device(&pdev->dev); ++ + return &dmamux->muxes[mux]; ++ ++err_put_pdev: ++ put_device(&pdev->dev); ++ ++ return ERR_PTR(ret); + } + + static int lpc18xx_dmamux_probe(struct platform_device *pdev) diff --git a/queue-6.18/dmaengine-lpc32xx-dmamux-fix-device-leak-on-route-allocation.patch b/queue-6.18/dmaengine-lpc32xx-dmamux-fix-device-leak-on-route-allocation.patch new file mode 100644 index 0000000000..520de388b2 --- /dev/null +++ b/queue-6.18/dmaengine-lpc32xx-dmamux-fix-device-leak-on-route-allocation.patch @@ -0,0 +1,92 @@ +From d9847e6d1d91462890ba297f7888fa598d47e76e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:50 +0100 +Subject: dmaengine: lpc32xx-dmamux: fix device leak on route allocation + +From: Johan Hovold + +commit d9847e6d1d91462890ba297f7888fa598d47e76e upstream. + +Make sure to drop the reference taken when looking up the DMA mux +platform device during route allocation. + +Note that holding a reference to a device does not prevent its driver +data from going away so there is no point in keeping the reference. + +Fixes: 5d318b595982 ("dmaengine: Add dma router for pl08x in LPC32XX SoC") +Cc: stable@vger.kernel.org # 6.12 +Cc: Piotr Wojtaszczyk +Signed-off-by: Johan Hovold +Reviewed-by: Vladimir Zapolskiy +Link: https://patch.msgid.link/20251117161258.10679-9-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/lpc32xx-dmamux.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/dma/lpc32xx-dmamux.c ++++ b/drivers/dma/lpc32xx-dmamux.c +@@ -95,11 +95,12 @@ static void *lpc32xx_dmamux_reserve(stru + struct lpc32xx_dmamux_data *dmamux = platform_get_drvdata(pdev); + unsigned long flags; + struct lpc32xx_dmamux *mux = NULL; ++ int ret = -EINVAL; + int i; + + if (dma_spec->args_count != 3) { + dev_err(&pdev->dev, "invalid number of dma mux args\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + for (i = 0; i < ARRAY_SIZE(lpc32xx_muxes); i++) { +@@ -111,20 +112,20 @@ static void *lpc32xx_dmamux_reserve(stru + if (!mux) { + dev_err(&pdev->dev, "invalid mux request number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + if (dma_spec->args[2] > 1) { + dev_err(&pdev->dev, "invalid dma mux value: %d\n", + dma_spec->args[1]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + /* The of_node_put() will be done in the core for the node */ + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "can't get dma master\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + spin_lock_irqsave(&dmamux->lock, flags); +@@ -133,7 +134,8 @@ static void *lpc32xx_dmamux_reserve(stru + dev_err(dev, "dma request signal %d busy, routed to %s\n", + mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1); + of_node_put(dma_spec->np); +- return ERR_PTR(-EBUSY); ++ ret = -EBUSY; ++ goto err_put_pdev; + } + + mux->busy = true; +@@ -148,7 +150,14 @@ static void *lpc32xx_dmamux_reserve(stru + dev_dbg(dev, "dma request signal %d routed to %s\n", + mux->signal, mux->muxval ? mux->name_sel1 : mux->name_sel1); + ++ put_device(&pdev->dev); ++ + return mux; ++ ++err_put_pdev: ++ put_device(&pdev->dev); ++ ++ return ERR_PTR(ret); + } + + static int lpc32xx_dmamux_probe(struct platform_device *pdev) diff --git a/queue-6.18/dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch b/queue-6.18/dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch new file mode 100644 index 0000000000..e2b019ef1d --- /dev/null +++ b/queue-6.18/dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch @@ -0,0 +1,56 @@ +From 3f747004bbd641131d9396d87b5d2d3d1e182728 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Wed, 29 Oct 2025 20:34:19 +0800 +Subject: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() + +From: Miaoqian Lin + +commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream. + +Fix a memory leak in gpi_peripheral_config() where the original memory +pointed to by gchan->config could be lost if krealloc() fails. + +The issue occurs when: +1. gchan->config points to previously allocated memory +2. krealloc() fails and returns NULL +3. The function directly assigns NULL to gchan->config, losing the + reference to the original memory +4. The original memory becomes unreachable and cannot be freed + +Fix this by using a temporary variable to hold the krealloc() result +and only updating gchan->config when the allocation succeeds. + +Found via static analysis and code review. + +Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") +Cc: stable@vger.kernel.org +Signed-off-by: Miaoqian Lin +Reviewed-by: Bjorn Andersson +Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/qcom/gpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/dma/qcom/gpi.c ++++ b/drivers/dma/qcom/gpi.c +@@ -1605,14 +1605,16 @@ static int + gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) + { + struct gchan *gchan = to_gchan(chan); ++ void *new_config; + + if (!config->peripheral_config) + return -EINVAL; + +- gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); +- if (!gchan->config) ++ new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); ++ if (!new_config) + return -ENOMEM; + ++ gchan->config = new_config; + memcpy(gchan->config, config->peripheral_config, config->peripheral_size); + + return 0; diff --git a/queue-6.18/dmaengine-sh-rz-dmac-fix-device-leak-on-probe-failure.patch b/queue-6.18/dmaengine-sh-rz-dmac-fix-device-leak-on-probe-failure.patch new file mode 100644 index 0000000000..86c59ea8b9 --- /dev/null +++ b/queue-6.18/dmaengine-sh-rz-dmac-fix-device-leak-on-probe-failure.patch @@ -0,0 +1,60 @@ +From 9fb490323997dcb6f749cd2660a17a39854600cd Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:51 +0100 +Subject: dmaengine: sh: rz-dmac: fix device leak on probe failure + +From: Johan Hovold + +commit 9fb490323997dcb6f749cd2660a17a39854600cd upstream. + +Make sure to drop the reference taken when looking up the ICU device +during probe also on probe failures (e.g. probe deferral). + +Fixes: 7de873201c44 ("dmaengine: sh: rz-dmac: Add RZ/V2H(P) support") +Cc: stable@vger.kernel.org # 6.16 +Cc: Fabrizio Castro +Signed-off-by: Johan Hovold +Reviewed-by: Fabrizio Castro +Link: https://patch.msgid.link/20251117161258.10679-10-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/sh/rz-dmac.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/dma/sh/rz-dmac.c ++++ b/drivers/dma/sh/rz-dmac.c +@@ -854,6 +854,13 @@ static int rz_dmac_chan_probe(struct rz_ + return 0; + } + ++static void rz_dmac_put_device(void *_dev) ++{ ++ struct device *dev = _dev; ++ ++ put_device(dev); ++} ++ + static int rz_dmac_parse_of_icu(struct device *dev, struct rz_dmac *dmac) + { + struct device_node *np = dev->of_node; +@@ -876,6 +883,10 @@ static int rz_dmac_parse_of_icu(struct d + return -ENODEV; + } + ++ ret = devm_add_action_or_reset(dev, rz_dmac_put_device, &dmac->icu.pdev->dev); ++ if (ret) ++ return ret; ++ + dmac_index = args.args[0]; + if (dmac_index > RZV2H_MAX_DMAC_INDEX) { + dev_err(dev, "DMAC index %u invalid.\n", dmac_index); +@@ -1055,8 +1066,6 @@ static void rz_dmac_remove(struct platfo + reset_control_assert(dmac->rstc); + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- +- platform_device_put(dmac->icu.pdev); + } + + static const struct of_device_id of_rz_dmac_match[] = { diff --git a/queue-6.18/dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch b/queue-6.18/dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch new file mode 100644 index 0000000000..d0be4ac521 --- /dev/null +++ b/queue-6.18/dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch @@ -0,0 +1,49 @@ +From 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Thu, 13 Nov 2025 19:50:48 +0000 +Subject: dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() + +From: Biju Das + +commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream. + +After audio full duplex testing, playing the recorded file contains a few +playback frames from the previous time. The rz_dmac_terminate_all() does +not reset all the hardware descriptors queued previously, leading to the +wrong descriptor being picked up during the next DMA transfer. Fix the +above issue by resetting all the descriptor headers for a channel in +rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper +descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg(). + +Cc: stable@kernel.org +Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Biju Das +Reviewed-by: Claudiu Beznea +Tested-by: Claudiu Beznea +Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/sh/rz-dmac.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/dma/sh/rz-dmac.c ++++ b/drivers/dma/sh/rz-dmac.c +@@ -557,11 +557,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *c + static int rz_dmac_terminate_all(struct dma_chan *chan) + { + struct rz_dmac_chan *channel = to_rz_dmac_chan(chan); ++ struct rz_lmdesc *lmdesc = channel->lmdesc.base; + unsigned long flags; ++ unsigned int i; + LIST_HEAD(head); + + rz_dmac_disable_hw(channel); + spin_lock_irqsave(&channel->vc.lock, flags); ++ for (i = 0; i < DMAC_NR_LMDESC; i++) ++ lmdesc[i].header = 0; ++ + list_splice_tail_init(&channel->ld_active, &channel->ld_free); + list_splice_tail_init(&channel->ld_queue, &channel->ld_free); + vchan_get_all_descriptors(&channel->vc, &head); diff --git a/queue-6.18/dmaengine-stm32-dmamux-fix-device-leak-on-route-allocation.patch b/queue-6.18/dmaengine-stm32-dmamux-fix-device-leak-on-route-allocation.patch new file mode 100644 index 0000000000..8eb6453992 --- /dev/null +++ b/queue-6.18/dmaengine-stm32-dmamux-fix-device-leak-on-route-allocation.patch @@ -0,0 +1,87 @@ +From dd6e4943889fb354efa3f700e42739da9bddb6ef Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:52 +0100 +Subject: dmaengine: stm32: dmamux: fix device leak on route allocation + +From: Johan Hovold + +commit dd6e4943889fb354efa3f700e42739da9bddb6ef upstream. + +Make sure to drop the reference taken when looking up the DMA mux +platform device during route allocation. + +Note that holding a reference to a device does not prevent its driver +data from going away so there is no point in keeping the reference. + +Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver") +Cc: stable@vger.kernel.org # 4.15 +Cc: Pierre-Yves MORDRET +Signed-off-by: Johan Hovold +Reviewed-by: Amelie Delaunay +Link: https://patch.msgid.link/20251117161258.10679-11-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/stm32/stm32-dmamux.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/dma/stm32/stm32-dmamux.c ++++ b/drivers/dma/stm32/stm32-dmamux.c +@@ -90,23 +90,25 @@ static void *stm32_dmamux_route_allocate + struct stm32_dmamux_data *dmamux = platform_get_drvdata(pdev); + struct stm32_dmamux *mux; + u32 i, min, max; +- int ret; ++ int ret = -EINVAL; + unsigned long flags; + + if (dma_spec->args_count != 3) { + dev_err(&pdev->dev, "invalid number of dma mux args\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + if (dma_spec->args[0] > dmamux->dmamux_requests) { + dev_err(&pdev->dev, "invalid mux request number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + mux = kzalloc(sizeof(*mux), GFP_KERNEL); +- if (!mux) +- return ERR_PTR(-ENOMEM); ++ if (!mux) { ++ ret = -ENOMEM; ++ goto err_put_pdev; ++ } + + spin_lock_irqsave(&dmamux->lock, flags); + mux->chan_id = find_first_zero_bit(dmamux->dma_inuse, +@@ -133,7 +135,6 @@ static void *stm32_dmamux_route_allocate + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", i - 1); + if (!dma_spec->np) { + dev_err(&pdev->dev, "can't get dma master\n"); +- ret = -EINVAL; + goto error; + } + +@@ -160,6 +161,8 @@ static void *stm32_dmamux_route_allocate + dev_dbg(&pdev->dev, "Mapping DMAMUX(%u) to DMA%u(%u)\n", + mux->request, mux->master, mux->chan_id); + ++ put_device(&pdev->dev); ++ + return mux; + + error: +@@ -167,6 +170,9 @@ error: + + error_chan_id: + kfree(mux); ++err_put_pdev: ++ put_device(&pdev->dev); ++ + return ERR_PTR(ret); + } + diff --git a/queue-6.18/dmaengine-stm32-dmamux-fix-of-node-leak-on-route-allocation-failure.patch b/queue-6.18/dmaengine-stm32-dmamux-fix-of-node-leak-on-route-allocation-failure.patch new file mode 100644 index 0000000000..b3c292f88d --- /dev/null +++ b/queue-6.18/dmaengine-stm32-dmamux-fix-of-node-leak-on-route-allocation-failure.patch @@ -0,0 +1,44 @@ +From b1b590a590af13ded598e70f0b72bc1e515787a1 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:53 +0100 +Subject: dmaengine: stm32: dmamux: fix OF node leak on route allocation failure + +From: Johan Hovold + +commit b1b590a590af13ded598e70f0b72bc1e515787a1 upstream. + +Make sure to drop the reference taken to the DMA master OF node also on +late route allocation failures. + +Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver") +Cc: stable@vger.kernel.org # 4.15 +Cc: Pierre-Yves MORDRET +Signed-off-by: Johan Hovold +Reviewed-by: Amelie Delaunay +Link: https://patch.msgid.link/20251117161258.10679-12-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/stm32/stm32-dmamux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/stm32/stm32-dmamux.c ++++ b/drivers/dma/stm32/stm32-dmamux.c +@@ -143,7 +143,7 @@ static void *stm32_dmamux_route_allocate + ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) { + spin_unlock_irqrestore(&dmamux->lock, flags); +- goto error; ++ goto err_put_dma_spec_np; + } + spin_unlock_irqrestore(&dmamux->lock, flags); + +@@ -165,6 +165,8 @@ static void *stm32_dmamux_route_allocate + + return mux; + ++err_put_dma_spec_np: ++ of_node_put(dma_spec->np); + error: + clear_bit(mux->chan_id, dmamux->dma_inuse); + diff --git a/queue-6.18/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch b/queue-6.18/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch new file mode 100644 index 0000000000..bc78d3d2ae --- /dev/null +++ b/queue-6.18/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch @@ -0,0 +1,77 @@ +From 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:56 +0100 +Subject: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation + +From: Johan Hovold + +commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream. + +Make sure to drop the reference taken when looking up the crossbar +platform device during am335x route allocation. + +Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx") +Cc: stable@vger.kernel.org # 4.4 +Cc: Peter Ujfalusi +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/dma/ti/dma-crossbar.c ++++ b/drivers/dma/ti/dma-crossbar.c +@@ -79,34 +79,35 @@ static void *ti_am335x_xbar_route_alloca + { + struct platform_device *pdev = of_find_device_by_node(ofdma->of_node); + struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev); +- struct ti_am335x_xbar_map *map; ++ struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL); + + if (dma_spec->args_count != 3) +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + + if (dma_spec->args[2] >= xbar->xbar_events) { + dev_err(&pdev->dev, "Invalid XBAR event number: %d\n", + dma_spec->args[2]); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + if (dma_spec->args[0] >= xbar->dma_requests) { + dev_err(&pdev->dev, "Invalid DMA request line number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + /* The of_node_put() will be done in the core for the node */ + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "Can't get DMA master\n"); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (!map) { + of_node_put(dma_spec->np); +- return ERR_PTR(-ENOMEM); ++ map = ERR_PTR(-ENOMEM); ++ goto out_put_pdev; + } + + map->dma_line = (u16)dma_spec->args[0]; +@@ -120,6 +121,9 @@ static void *ti_am335x_xbar_route_alloca + + ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val); + ++out_put_pdev: ++ put_device(&pdev->dev); ++ + return map; + } + diff --git a/queue-6.18/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch b/queue-6.18/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch new file mode 100644 index 0000000000..7fce3fed88 --- /dev/null +++ b/queue-6.18/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch @@ -0,0 +1,40 @@ +From dc7e44db01fc2498644e3106db3e62a9883a93d5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:55 +0100 +Subject: dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation + +From: Johan Hovold + +commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream. + +Make sure to drop the reference taken when looking up the crossbar +platform device during dra7x route allocation. + +Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in +ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the +reference is still leaking on successful allocation. + +Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x") +Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") +Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e +Cc: Peter Ujfalusi +Cc: Miaoqian Lin +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/dma-crossbar.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/dma/ti/dma-crossbar.c ++++ b/drivers/dma/ti/dma-crossbar.c +@@ -288,6 +288,8 @@ static void *ti_dra7_xbar_route_allocate + + ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in); + ++ put_device(&pdev->dev); ++ + return map; + } + diff --git a/queue-6.18/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch b/queue-6.18/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch new file mode 100644 index 0000000000..e881700af6 --- /dev/null +++ b/queue-6.18/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch @@ -0,0 +1,42 @@ +From 430f7803b69cd5e5694e5dfc884c6628870af36e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:58 +0100 +Subject: dmaengine: ti: k3-udma: fix device leak on udma lookup + +From: Johan Hovold + +commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream. + +Make sure to drop the reference taken when looking up the UDMA platform +device. + +Note that holding a reference to a platform device does not prevent its +driver data from going away so there is no point in keeping the +reference after the lookup helper returns. + +Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users") +Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()") +Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c +Cc: Grygorii Strashko +Cc: Yu Kuai +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/k3-udma-private.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/ti/k3-udma-private.c ++++ b/drivers/dma/ti/k3-udma-private.c +@@ -42,9 +42,9 @@ struct udma_dev *of_xudma_dev_get(struct + } + + ud = platform_get_drvdata(pdev); ++ put_device(&pdev->dev); + if (!ud) { + pr_debug("UDMA has not been probed\n"); +- put_device(&pdev->dev); + return ERR_PTR(-EPROBE_DEFER); + } + diff --git a/queue-6.18/drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch b/queue-6.18/drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch new file mode 100644 index 0000000000..a4060e6134 --- /dev/null +++ b/queue-6.18/drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch @@ -0,0 +1,46 @@ +From 28695ca09d326461f8078332aa01db516983e8a2 Mon Sep 17 00:00:00 2001 +From: "Mario Limonciello (AMD)" +Date: Wed, 7 Jan 2026 15:37:28 -0600 +Subject: drm/amd: Clean up kfd node on surprise disconnect + +From: Mario Limonciello (AMD) + +commit 28695ca09d326461f8078332aa01db516983e8a2 upstream. + +When an eGPU is unplugged the KFD topology should also be destroyed +for that GPU. This never happens because the fini_sw callbacks never +get to run. Run them manually before calling amdgpu_device_ip_fini_early() +when a device has already been disconnected. + +This location is intentionally chosen to make sure that the kfd locking +refcount doesn't get incremented unintentionally. + +Cc: kent.russell@amd.com +Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33 +Signed-off-by: Mario Limonciello (AMD) +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4985,6 +4985,14 @@ void amdgpu_device_fini_hw(struct amdgpu + + amdgpu_ttm_set_buffer_funcs_status(adev, false); + ++ /* ++ * device went through surprise hotplug; we need to destroy topology ++ * before ip_fini_early to prevent kfd locking refcount issues by calling ++ * amdgpu_amdkfd_suspend() ++ */ ++ if (drm_dev_is_unplugged(adev_to_drm(adev))) ++ amdgpu_amdkfd_device_fini_sw(adev); ++ + amdgpu_device_ip_fini_early(adev); + + amdgpu_irq_fini_hw(adev); diff --git a/queue-6.18/drm-amd-display-bump-the-hdmi-clock-to-340mhz.patch b/queue-6.18/drm-amd-display-bump-the-hdmi-clock-to-340mhz.patch new file mode 100644 index 0000000000..50299c099b --- /dev/null +++ b/queue-6.18/drm-amd-display-bump-the-hdmi-clock-to-340mhz.patch @@ -0,0 +1,65 @@ +From fee50077656d8a58011f13bca48f743d1b6d6015 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Mon, 15 Dec 2025 14:08:30 -0600 +Subject: drm/amd/display: Bump the HDMI clock to 340MHz + +From: Mario Limonciello + +commit fee50077656d8a58011f13bca48f743d1b6d6015 upstream. + +[Why] +DP-HDMI dongles can execeed bandwidth requirements on high resolution +monitors. This can lead to pruning the high resolution modes. + +HDMI 1.3 bumped the clock to 340MHz, but display code never matched it. + +[How] +Set default to (DVI) 165MHz. Once HDMI display is identified update +to 340MHz. + +Reported-by: Dianne Skoll +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4780 +Reviewed-by: Chris Park +Signed-off-by: Mario Limonciello +Signed-off-by: Matthew Stewart +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit ac1e65d8ade46c09fb184579b81acadf36dcb91e) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h | 2 +- + drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_hdmi_types.h +@@ -41,7 +41,7 @@ + /* kHZ*/ + #define DP_ADAPTOR_DVI_MAX_TMDS_CLK 165000 + /* kHZ*/ +-#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 165000 ++#define DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK 340000 + + struct dp_hdmi_dongle_signature_data { + int8_t id[15];/* "DP-HDMI ADAPTOR"*/ +--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c +@@ -332,7 +332,7 @@ static void query_dp_dual_mode_adaptor( + + /* Assume we have no valid DP passive dongle connected */ + *dongle = DISPLAY_DONGLE_NONE; +- sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK; ++ sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_DVI_MAX_TMDS_CLK; + + /* Read DP-HDMI dongle I2c (no response interpreted as DP-DVI dongle)*/ + if (!i2c_read( +@@ -388,6 +388,8 @@ static void query_dp_dual_mode_adaptor( + + } + } ++ if (is_valid_hdmi_signature) ++ sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_HDMI_SAFE_MAX_TMDS_CLK; + + if (is_type2_dongle) { + uint32_t max_tmds_clk = diff --git a/queue-6.18/drm-amd-display-initialise-backlight-level-values-from-hw.patch b/queue-6.18/drm-amd-display-initialise-backlight-level-values-from-hw.patch new file mode 100644 index 0000000000..4e58414b60 --- /dev/null +++ b/queue-6.18/drm-amd-display-initialise-backlight-level-values-from-hw.patch @@ -0,0 +1,80 @@ +From 52d3d115e9cc975b90b1fc49abf6d36ad5e8847a Mon Sep 17 00:00:00 2001 +From: Vivek Das Mohapatra +Date: Mon, 12 Jan 2026 15:28:56 +0000 +Subject: drm/amd/display: Initialise backlight level values from hw + +From: Vivek Das Mohapatra + +commit 52d3d115e9cc975b90b1fc49abf6d36ad5e8847a upstream. + +Internal backlight levels are initialised from ACPI but the values +are sometimes out of sync with the levels in effect until there has +been a read from hardware (eg triggered by reading from sysfs). + +This means that the first drm_commit can cause the levels to be set +to a different value than the actual starting one, which results in +a sudden change in brightness. + +This path shows the problem (when the values are out of sync): + + amdgpu_dm_atomic_commit_tail() + -> amdgpu_dm_commit_streams() + -> amdgpu_dm_backlight_set_level(..., dm->brightness[n]) + +This patch calls the backlight ops get_brightness explicitly +at the end of backlight registration to make sure dm->brightness[n] +is in sync with the actual hardware levels. + +Fixes: 2fe87f54abdc ("drm/amd/display: Set default brightness according to ACPI") +Signed-off-by: Vivek Das Mohapatra +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Alex Deucher +(cherry picked from commit 318b1c36d82a0cd2b06a4bb43272fa6f1bc8adc1) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5193,6 +5193,8 @@ amdgpu_dm_register_backlight_device(stru + struct amdgpu_dm_backlight_caps *caps; + char bl_name[16]; + int min, max; ++ int real_brightness; ++ int init_brightness; + + if (aconnector->bl_idx == -1) + return; +@@ -5217,6 +5219,8 @@ amdgpu_dm_register_backlight_device(stru + } else + props.brightness = props.max_brightness = MAX_BACKLIGHT_LEVEL; + ++ init_brightness = props.brightness; ++ + if (caps->data_points && !(amdgpu_dc_debug_mask & DC_DISABLE_CUSTOM_BRIGHTNESS_CURVE)) { + drm_info(drm, "Using custom brightness curve\n"); + props.scale = BACKLIGHT_SCALE_NON_LINEAR; +@@ -5235,8 +5239,20 @@ amdgpu_dm_register_backlight_device(stru + if (IS_ERR(dm->backlight_dev[aconnector->bl_idx])) { + drm_err(drm, "DM: Backlight registration failed!\n"); + dm->backlight_dev[aconnector->bl_idx] = NULL; +- } else ++ } else { ++ /* ++ * dm->brightness[x] can be inconsistent just after startup until ++ * ops.get_brightness is called. ++ */ ++ real_brightness = ++ amdgpu_dm_backlight_ops.get_brightness(dm->backlight_dev[aconnector->bl_idx]); ++ ++ if (real_brightness != init_brightness) { ++ dm->actual_brightness[aconnector->bl_idx] = real_brightness; ++ dm->brightness[aconnector->bl_idx] = real_brightness; ++ } + drm_dbg_driver(drm, "DM: Registered Backlight device: %s\n", bl_name); ++ } + } + + static int initialize_plane(struct amdgpu_display_manager *dm, diff --git a/queue-6.18/drm-amdgpu-fix-gfx9-update-pte-mtype-flag.patch b/queue-6.18/drm-amdgpu-fix-gfx9-update-pte-mtype-flag.patch new file mode 100644 index 0000000000..80c73782e1 --- /dev/null +++ b/queue-6.18/drm-amdgpu-fix-gfx9-update-pte-mtype-flag.patch @@ -0,0 +1,48 @@ +From 292e5757b2229c0c6f1d059123a85f8a28f4464d Mon Sep 17 00:00:00 2001 +From: Philip Yang +Date: Thu, 4 Dec 2025 12:13:05 -0500 +Subject: drm/amdgpu: Fix gfx9 update PTE mtype flag +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philip Yang + +commit 292e5757b2229c0c6f1d059123a85f8a28f4464d upstream. + +Fix copy&paste error, that should have been an assignment instead of an or, +otherwise MTYPE_UC 0x3 can not be updated to MTYPE_RW 0x1. + +Signed-off-by: Philip Yang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit fc1366016abe4103c0f0fac882811aea961ef213) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -1233,16 +1233,16 @@ static void gmc_v9_0_get_vm_pte(struct a + *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_NC); + break; + case AMDGPU_VM_MTYPE_WC: +- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_WC); ++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_WC); + break; + case AMDGPU_VM_MTYPE_RW: +- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_RW); ++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_RW); + break; + case AMDGPU_VM_MTYPE_CC: +- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_CC); ++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_CC); + break; + case AMDGPU_VM_MTYPE_UC: +- *flags |= AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_UC); ++ *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_UC); + break; + } + diff --git a/queue-6.18/drm-amdgpu-make-sure-userqs-are-enabled-in-userq-ioctls.patch b/queue-6.18/drm-amdgpu-make-sure-userqs-are-enabled-in-userq-ioctls.patch new file mode 100644 index 0000000000..3465b166db --- /dev/null +++ b/queue-6.18/drm-amdgpu-make-sure-userqs-are-enabled-in-userq-ioctls.patch @@ -0,0 +1,90 @@ +From b6dff005fcf32dd072f6f2d08ca461394a21bd4f Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 9 Jan 2026 08:54:55 -0500 +Subject: drm/amdgpu: make sure userqs are enabled in userq IOCTLs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit b6dff005fcf32dd072f6f2d08ca461394a21bd4f upstream. + +These IOCTLs shouldn't be called when userqs are not +enabled. Make sure they are enabled before executing +the IOCTLs. + +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit d967509651601cddce7ff2a9f09479f3636f684d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 16 ++++++++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 6 ++++++ + 3 files changed, 23 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +@@ -681,12 +681,28 @@ static int amdgpu_userq_input_args_valid + return 0; + } + ++bool amdgpu_userq_enabled(struct drm_device *dev) ++{ ++ struct amdgpu_device *adev = drm_to_adev(dev); ++ int i; ++ ++ for (i = 0; i < AMDGPU_HW_IP_NUM; i++) { ++ if (adev->userq_funcs[i]) ++ return true; ++ } ++ ++ return false; ++} ++ + int amdgpu_userq_ioctl(struct drm_device *dev, void *data, + struct drm_file *filp) + { + union drm_amdgpu_userq *args = data; + int r; + ++ if (!amdgpu_userq_enabled(dev)) ++ return -ENOTSUPP; ++ + if (amdgpu_userq_input_args_validate(dev, args, filp) < 0) + return -EINVAL; + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h +@@ -135,6 +135,7 @@ uint64_t amdgpu_userq_get_doorbell_index + struct drm_file *filp); + + u32 amdgpu_userq_get_supported_ip_mask(struct amdgpu_device *adev); ++bool amdgpu_userq_enabled(struct drm_device *dev); + + int amdgpu_userq_suspend(struct amdgpu_device *adev); + int amdgpu_userq_resume(struct amdgpu_device *adev); +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c +@@ -472,6 +472,9 @@ int amdgpu_userq_signal_ioctl(struct drm + struct drm_exec exec; + u64 wptr; + ++ if (!amdgpu_userq_enabled(dev)) ++ return -ENOTSUPP; ++ + num_syncobj_handles = args->num_syncobj_handles; + syncobj_handles = memdup_user(u64_to_user_ptr(args->syncobj_handles), + size_mul(sizeof(u32), num_syncobj_handles)); +@@ -654,6 +657,9 @@ int amdgpu_userq_wait_ioctl(struct drm_d + int r, i, rentry, wentry, cnt; + struct drm_exec exec; + ++ if (!amdgpu_userq_enabled(dev)) ++ return -ENOTSUPP; ++ + num_read_bo_handles = wait_info->num_bo_read_handles; + bo_handles_read = memdup_user(u64_to_user_ptr(wait_info->bo_read_handles), + size_mul(sizeof(u32), num_read_bo_handles)); diff --git a/queue-6.18/drm-amdkfd-fix-a-memory-leak-in-device_queue_manager_init.patch b/queue-6.18/drm-amdkfd-fix-a-memory-leak-in-device_queue_manager_init.patch new file mode 100644 index 0000000000..e742efd7e4 --- /dev/null +++ b/queue-6.18/drm-amdkfd-fix-a-memory-leak-in-device_queue_manager_init.patch @@ -0,0 +1,67 @@ +From 80614c509810fc051312d1a7ccac8d0012d6b8d0 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Thu, 8 Jan 2026 15:18:22 +0800 +Subject: drm/amdkfd: fix a memory leak in device_queue_manager_init() + +From: Haoxiang Li + +commit 80614c509810fc051312d1a7ccac8d0012d6b8d0 upstream. + +If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd() +to release the memory allocated by allocate_hiq_sdma_mqd(). +Move deallocate_hiq_sdma_mqd() up to ensure proper function +visibility at the point of use. + +Fixes: 11614c36bc8f ("drm/amdkfd: Allocate MQD trunk for HIQ and SDMA") +Signed-off-by: Haoxiang Li +Signed-off-by: Felix Kuehling +Reviewed-by: Oak Zeng +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +(cherry picked from commit b7cccc8286bb9919a0952c812872da1dcfe9d390) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 19 ++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -2905,6 +2905,14 @@ static int allocate_hiq_sdma_mqd(struct + return retval; + } + ++static void deallocate_hiq_sdma_mqd(struct kfd_node *dev, ++ struct kfd_mem_obj *mqd) ++{ ++ WARN(!mqd, "No hiq sdma mqd trunk to free"); ++ ++ amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem); ++} ++ + struct device_queue_manager *device_queue_manager_init(struct kfd_node *dev) + { + struct device_queue_manager *dqm; +@@ -3028,19 +3036,14 @@ struct device_queue_manager *device_queu + return dqm; + } + ++ if (!dev->kfd->shared_resources.enable_mes) ++ deallocate_hiq_sdma_mqd(dev, &dqm->hiq_sdma_mqd); ++ + out_free: + kfree(dqm); + return NULL; + } + +-static void deallocate_hiq_sdma_mqd(struct kfd_node *dev, +- struct kfd_mem_obj *mqd) +-{ +- WARN(!mqd, "No hiq sdma mqd trunk to free"); +- +- amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem); +-} +- + void device_queue_manager_uninit(struct device_queue_manager *dqm) + { + dqm->ops.stop(dqm); diff --git a/queue-6.18/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch b/queue-6.18/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch new file mode 100644 index 0000000000..5a910c6c3b --- /dev/null +++ b/queue-6.18/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch @@ -0,0 +1,56 @@ +From 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Fri, 19 Dec 2025 16:52:02 -0500 +Subject: drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare + +From: Lyude Paul + +commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream. + +For a while, I've been seeing a strange issue where some (usually not all) +of the display DMA channels will suddenly hang, particularly when there is +a visible cursor on the screen that is being frequently updated, and +especially when said cursor happens to go between two screens. While this +brings back lovely memories of fixing Intel Skylake bugs, I would quite +like to fix it :). + +It turns out the problem that's happening here is that we're managing to +reach nv50_head_flush_set() in our atomic commit path without actually +holding nv50_disp->mutex. This means that cursor updates happening in +parallel (along with any other atomic updates that need to use the core +channel) will race with eachother, which eventually causes us to corrupt +the pushbuffer - leading to a plethora of various GSP errors, usually: + + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001 + +The reason this is happening is because generally we check whether we need +to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). +However, curs507a_prepare is called from the fb_prepare callback, which +happens after the atomic check phase. As a result, this can lead to commits +that both touch the core channel but also don't grab nv50_disp->mutex. + +So, fix this by making sure that we set nv50_atom->lock_core in +cus507a_prepare(). + +Reviewed-by: Dave Airlie +Signed-off-by: Lyude Paul +Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") +Cc: # v4.18+ +Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c +@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw, + asyh->curs.handle = handle; + asyh->curs.offset = offset; + asyh->set.curs = asyh->curs.visible; ++ nv50_atom(asyh->state.state)->lock_core = true; + } + } + diff --git a/queue-6.18/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch b/queue-6.18/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch new file mode 100644 index 0000000000..5eaaffc633 --- /dev/null +++ b/queue-6.18/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch @@ -0,0 +1,42 @@ +From 6ab3d4353bf75005eaa375677c9fed31148154d6 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sat, 10 Jan 2026 16:27:28 +0100 +Subject: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel + +From: Marek Vasut + +commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream. + +The connector type for the DataImage SCF0700C48GGU18 panel is missing and +devm_drm_panel_bridge_add() requires connector type to be set. This leads +to a warning and a backtrace in the kernel log and panel does not work: +" +WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8 +" +The warning is triggered by a check for valid connector type in +devm_drm_panel_bridge_add(). If there is no valid connector type +set for a panel, the warning is printed and panel is not added. +Fill in the missing connector type to fix the warning and make +the panel operational once again. + +Cc: stable@vger.kernel.org +Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18") +Signed-off-by: Marek Vasut +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panel/panel-simple.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1900,6 +1900,7 @@ static const struct panel_desc dataimage + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X24, + .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, ++ .connector_type = DRM_MODE_CONNECTOR_DPI, + }; + + static const struct display_timing dlc_dlc0700yzg_1_timing = { diff --git a/queue-6.18/drm-panel-simple-restore-connector_type-fallback.patch b/queue-6.18/drm-panel-simple-restore-connector_type-fallback.patch new file mode 100644 index 0000000000..847c2cc383 --- /dev/null +++ b/queue-6.18/drm-panel-simple-restore-connector_type-fallback.patch @@ -0,0 +1,149 @@ +From 9380dc33cd6ae4a6857818fcefce31cf716f3fae Mon Sep 17 00:00:00 2001 +From: Ludovic Desroches +Date: Thu, 18 Dec 2025 14:34:43 +0100 +Subject: drm/panel: simple: restore connector_type fallback + +From: Ludovic Desroches + +commit 9380dc33cd6ae4a6857818fcefce31cf716f3fae upstream. + +The switch from devm_kzalloc() + drm_panel_init() to +devm_drm_panel_alloc() introduced a regression. + +Several panel descriptors do not set connector_type. For those panels, +panel_simple_probe() used to compute a connector type (currently DPI as a +fallback) and pass that value to drm_panel_init(). After the conversion +to devm_drm_panel_alloc(), the call unconditionally used +desc->connector_type instead, ignoring the computed fallback and +potentially passing DRM_MODE_CONNECTOR_Unknown, which +drm_panel_bridge_add() does not allow. + +Move the connector_type validation / fallback logic before the +devm_drm_panel_alloc() call and pass the computed connector_type to +devm_drm_panel_alloc(), so panels without an explicit connector_type +once again get the DPI default. + +Signed-off-by: Ludovic Desroches +Fixes: de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") +Cc: stable@vger.kernel.org +Reviewed-by: Luca Ceresoli +Link: https://lore.kernel.org/stable/20251126-lcd_panel_connector_type_fix-v2-1-c15835d1f7cb%40microchip.com +Signed-off-by: Neil Armstrong +Link: https://patch.msgid.link/20251218-lcd_panel_connector_type_fix-v3-1-ddcea6d8d7ef@microchip.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panel/panel-simple.c | 89 +++++++++++++++++------------------ + 1 file changed, 44 insertions(+), 45 deletions(-) + +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -623,49 +623,6 @@ static struct panel_simple *panel_simple + if (IS_ERR(desc)) + return ERR_CAST(desc); + +- panel = devm_drm_panel_alloc(dev, struct panel_simple, base, +- &panel_simple_funcs, desc->connector_type); +- if (IS_ERR(panel)) +- return ERR_CAST(panel); +- +- panel->desc = desc; +- +- panel->supply = devm_regulator_get(dev, "power"); +- if (IS_ERR(panel->supply)) +- return ERR_CAST(panel->supply); +- +- panel->enable_gpio = devm_gpiod_get_optional(dev, "enable", +- GPIOD_OUT_LOW); +- if (IS_ERR(panel->enable_gpio)) +- return dev_err_cast_probe(dev, panel->enable_gpio, +- "failed to request GPIO\n"); +- +- err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation); +- if (err) { +- dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err); +- return ERR_PTR(err); +- } +- +- ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0); +- if (ddc) { +- panel->ddc = of_find_i2c_adapter_by_node(ddc); +- of_node_put(ddc); +- +- if (!panel->ddc) +- return ERR_PTR(-EPROBE_DEFER); +- } +- +- if (!of_device_is_compatible(dev->of_node, "panel-dpi") && +- !of_get_display_timing(dev->of_node, "panel-timing", &dt)) +- panel_simple_parse_panel_timing_node(dev, panel, &dt); +- +- if (desc->connector_type == DRM_MODE_CONNECTOR_LVDS) { +- /* Optional data-mapping property for overriding bus format */ +- err = panel_simple_override_nondefault_lvds_datamapping(dev, panel); +- if (err) +- goto free_ddc; +- } +- + connector_type = desc->connector_type; + /* Catch common mistakes for panels. */ + switch (connector_type) { +@@ -690,8 +647,7 @@ static struct panel_simple *panel_simple + break; + case DRM_MODE_CONNECTOR_eDP: + dev_warn(dev, "eDP panels moved to panel-edp\n"); +- err = -EINVAL; +- goto free_ddc; ++ return ERR_PTR(-EINVAL); + case DRM_MODE_CONNECTOR_DSI: + if (desc->bpc != 6 && desc->bpc != 8) + dev_warn(dev, "Expected bpc in {6,8} but got: %u\n", desc->bpc); +@@ -720,6 +676,49 @@ static struct panel_simple *panel_simple + break; + } + ++ panel = devm_drm_panel_alloc(dev, struct panel_simple, base, ++ &panel_simple_funcs, connector_type); ++ if (IS_ERR(panel)) ++ return ERR_CAST(panel); ++ ++ panel->desc = desc; ++ ++ panel->supply = devm_regulator_get(dev, "power"); ++ if (IS_ERR(panel->supply)) ++ return ERR_CAST(panel->supply); ++ ++ panel->enable_gpio = devm_gpiod_get_optional(dev, "enable", ++ GPIOD_OUT_LOW); ++ if (IS_ERR(panel->enable_gpio)) ++ return dev_err_cast_probe(dev, panel->enable_gpio, ++ "failed to request GPIO\n"); ++ ++ err = of_drm_get_panel_orientation(dev->of_node, &panel->orientation); ++ if (err) { ++ dev_err(dev, "%pOF: failed to get orientation %d\n", dev->of_node, err); ++ return ERR_PTR(err); ++ } ++ ++ ddc = of_parse_phandle(dev->of_node, "ddc-i2c-bus", 0); ++ if (ddc) { ++ panel->ddc = of_find_i2c_adapter_by_node(ddc); ++ of_node_put(ddc); ++ ++ if (!panel->ddc) ++ return ERR_PTR(-EPROBE_DEFER); ++ } ++ ++ if (!of_device_is_compatible(dev->of_node, "panel-dpi") && ++ !of_get_display_timing(dev->of_node, "panel-timing", &dt)) ++ panel_simple_parse_panel_timing_node(dev, panel, &dt); ++ ++ if (desc->connector_type == DRM_MODE_CONNECTOR_LVDS) { ++ /* Optional data-mapping property for overriding bus format */ ++ err = panel_simple_override_nondefault_lvds_datamapping(dev, panel); ++ if (err) ++ goto free_ddc; ++ } ++ + dev_set_drvdata(dev, panel); + + /* diff --git a/queue-6.18/drm-sysfb-remove-duplicate-declarations.patch b/queue-6.18/drm-sysfb-remove-duplicate-declarations.patch new file mode 100644 index 0000000000..5041f4df8c --- /dev/null +++ b/queue-6.18/drm-sysfb-remove-duplicate-declarations.patch @@ -0,0 +1,45 @@ +From b91a565ed14fcf900b4d95e86882b4b763860986 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Thu, 8 Jan 2026 15:19:46 +0100 +Subject: drm/sysfb: Remove duplicate declarations + +From: Thomas Zimmermann + +commit b91a565ed14fcf900b4d95e86882b4b763860986 upstream. + +Commit 6046b49bafff ("drm/sysfb: Share helpers for integer validation") +and commit e8c086880b2b ("drm/sysfb: Share helpers for screen_info +validation") added duplicate function declarations. Remove the latter +ones. + +Signed-off-by: Thomas Zimmermann +Fixes: e8c086880b2b ("drm/sysfb: Share helpers for screen_info validation") +Cc: Thomas Zimmermann +Cc: Javier Martinez Canillas +Cc: dri-devel@lists.freedesktop.org +Cc: # v6.16+ +Reviewed-by: Javier Martinez Canillas +Link: https://patch.msgid.link/20260108145058.56943-7-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sysfb/drm_sysfb_helper.h | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/gpu/drm/sysfb/drm_sysfb_helper.h ++++ b/drivers/gpu/drm/sysfb/drm_sysfb_helper.h +@@ -48,15 +48,6 @@ const struct drm_format_info *drm_sysfb_ + #endif + + /* +- * Input parsing +- */ +- +-int drm_sysfb_get_validated_int(struct drm_device *dev, const char *name, +- u64 value, u32 max); +-int drm_sysfb_get_validated_int0(struct drm_device *dev, const char *name, +- u64 value, u32 max); +- +-/* + * Display modes + */ + diff --git a/queue-6.18/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch b/queue-6.18/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch new file mode 100644 index 0000000000..d1584a7034 --- /dev/null +++ b/queue-6.18/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch @@ -0,0 +1,38 @@ +From bf72b4b7bb7dbb643d204fa41e7463894a95999f Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Dec 2025 17:11:05 +0800 +Subject: drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() + +From: Haoxiang Li + +commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream. + +In vmw_compat_shader_add(), the return value check of vmw_shader_alloc() +is not proper. Modify the check for the return pointer 'res'. + +Found by code review and compiled on ubuntu 20.04. + +Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +@@ -923,8 +923,10 @@ int vmw_compat_shader_add(struct vmw_pri + ttm_bo_unreserve(&buf->tbo); + + res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type); +- if (unlikely(ret != 0)) ++ if (IS_ERR(res)) { ++ ret = PTR_ERR(res); + goto no_reserve; ++ } + + ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader, + vmw_shader_key(user_key, shader_type), diff --git a/queue-6.18/loongarch-dts-loongson-2k0500-add-default-interrupt-controller-address-cells.patch b/queue-6.18/loongarch-dts-loongson-2k0500-add-default-interrupt-controller-address-cells.patch new file mode 100644 index 0000000000..e80d630e76 --- /dev/null +++ b/queue-6.18/loongarch-dts-loongson-2k0500-add-default-interrupt-controller-address-cells.patch @@ -0,0 +1,56 @@ +From c4461754e6fe7e12a3ff198cce4707e3e20e43d4 Mon Sep 17 00:00:00 2001 +From: Binbin Zhou +Date: Sat, 17 Jan 2026 10:56:52 +0800 +Subject: LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells + +From: Binbin Zhou + +commit c4461754e6fe7e12a3ff198cce4707e3e20e43d4 upstream. + +Add missing address-cells 0 to the Local I/O and Extend I/O interrupt +controller node to silence W=1 warning: + + loongson-2k0500.dtsi:513.5-51: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@0,0:interrupt-map: + Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe11600, using 0 as fallback + +Value '0' is correct because: +1. The Local I/O & Extend I/O interrupt controller do not have children, +2. interrupt-map property (in PCI node) consists of five components and + the fourth component "parent unit address", which size is defined by + '#address-cells' of the node pointed to by the interrupt-parent + component, is not used (=0) + +Cc: stable@vger.kernel.org +Signed-off-by: Binbin Zhou +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/boot/dts/loongson-2k0500.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/loongarch/boot/dts/loongson-2k0500.dtsi ++++ b/arch/loongarch/boot/dts/loongson-2k0500.dtsi +@@ -131,6 +131,7 @@ + reg-names = "main", "isr0"; + + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <2>; + interrupt-parent = <&cpuintc>; + interrupts = <2>; +@@ -149,6 +150,7 @@ + reg-names = "main", "isr0"; + + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <2>; + interrupt-parent = <&cpuintc>; + interrupts = <4>; +@@ -164,6 +166,7 @@ + compatible = "loongson,ls2k0500-eiointc"; + reg = <0x0 0x1fe11600 0x0 0xea00>; + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <1>; + interrupt-parent = <&cpuintc>; + interrupts = <3>; diff --git a/queue-6.18/loongarch-dts-loongson-2k1000-add-default-interrupt-controller-address-cells.patch b/queue-6.18/loongarch-dts-loongson-2k1000-add-default-interrupt-controller-address-cells.patch new file mode 100644 index 0000000000..cdc4408a0c --- /dev/null +++ b/queue-6.18/loongarch-dts-loongson-2k1000-add-default-interrupt-controller-address-cells.patch @@ -0,0 +1,48 @@ +From 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 Mon Sep 17 00:00:00 2001 +From: Binbin Zhou +Date: Sat, 17 Jan 2026 10:56:53 +0800 +Subject: LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells + +From: Binbin Zhou + +commit 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 upstream. + +Add missing address-cells 0 to the Local I/O interrupt controller node +to silence W=1 warning: + + loongson-2k1000.dtsi:498.5-55: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map: + Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe01440, using 0 as fallback + +Value '0' is correct because: +1. The Local I/O interrupt controller does not have children, +2. interrupt-map property (in PCI node) consists of five components and + the fourth component "parent unit address", which size is defined by + '#address-cells' of the node pointed to by the interrupt-parent + component, is not used (=0) + +Cc: stable@vger.kernel.org +Signed-off-by: Binbin Zhou +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/boot/dts/loongson-2k1000.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/loongarch/boot/dts/loongson-2k1000.dtsi ++++ b/arch/loongarch/boot/dts/loongson-2k1000.dtsi +@@ -114,6 +114,7 @@ + <0x0 0x1fe01140 0x0 0x8>; + reg-names = "main", "isr0", "isr1"; + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <2>; + interrupt-parent = <&cpuintc>; + interrupts = <2>; +@@ -131,6 +132,7 @@ + <0x0 0x1fe01148 0x0 0x8>; + reg-names = "main", "isr0", "isr1"; + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <2>; + interrupt-parent = <&cpuintc>; + interrupts = <3>; diff --git a/queue-6.18/loongarch-dts-loongson-2k1000-fix-i2c-gpio-node-names.patch b/queue-6.18/loongarch-dts-loongson-2k1000-fix-i2c-gpio-node-names.patch new file mode 100644 index 0000000000..2fe98b9cea --- /dev/null +++ b/queue-6.18/loongarch-dts-loongson-2k1000-fix-i2c-gpio-node-names.patch @@ -0,0 +1,44 @@ +From 14ea5a3625881d79f75418c66e3a7d98db8518e1 Mon Sep 17 00:00:00 2001 +From: Binbin Zhou +Date: Sat, 17 Jan 2026 10:56:53 +0800 +Subject: LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names + +From: Binbin Zhou + +commit 14ea5a3625881d79f75418c66e3a7d98db8518e1 upstream. + +The binding wants the node to be named "i2c-number", but those are named +"i2c-gpio-number" instead. + +Thus rename those to i2c-0, i2c-1 to adhere to the binding and suppress +dtbs_check warnings. + +Cc: stable@vger.kernel.org +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Binbin Zhou +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/boot/dts/loongson-2k1000.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/loongarch/boot/dts/loongson-2k1000.dtsi ++++ b/arch/loongarch/boot/dts/loongson-2k1000.dtsi +@@ -46,7 +46,7 @@ + }; + + /* i2c of the dvi eeprom edid */ +- i2c-gpio-0 { ++ i2c-0 { + compatible = "i2c-gpio"; + scl-gpios = <&gpio0 0 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; +@@ -57,7 +57,7 @@ + }; + + /* i2c of the eeprom edid */ +- i2c-gpio-1 { ++ i2c-1 { + compatible = "i2c-gpio"; + scl-gpios = <&gpio0 33 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio0 32 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; diff --git a/queue-6.18/loongarch-dts-loongson-2k2000-add-default-interrupt-controller-address-cells.patch b/queue-6.18/loongarch-dts-loongson-2k2000-add-default-interrupt-controller-address-cells.patch new file mode 100644 index 0000000000..f1d53bb247 --- /dev/null +++ b/queue-6.18/loongarch-dts-loongson-2k2000-add-default-interrupt-controller-address-cells.patch @@ -0,0 +1,56 @@ +From e65df3f77ecd59d3a8647d19df82b22a6ce210a9 Mon Sep 17 00:00:00 2001 +From: Binbin Zhou +Date: Sat, 17 Jan 2026 10:56:53 +0800 +Subject: LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells + +From: Binbin Zhou + +commit e65df3f77ecd59d3a8647d19df82b22a6ce210a9 upstream. + +Add missing address-cells 0 to the Local I/O, Extend I/O and PCH-PIC +Interrupt Controller node to silence W=1 warning: + + loongson-2k2000.dtsi:364.5-49: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map: + Missing property '#address-cells' in node /bus@10000000/interrupt-controller@10000000, using 0 as fallback + +Value '0' is correct because: +1. The LIO/EIO/PCH interrupt controller does not have children, +2. interrupt-map property (in PCI node) consists of five components and + the fourth component "parent unit address", which size is defined by + '#address-cells' of the node pointed to by the interrupt-parent + component, is not used (=0) + +Cc: stable@vger.kernel.org +Signed-off-by: Binbin Zhou +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/boot/dts/loongson-2k2000.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/loongarch/boot/dts/loongson-2k2000.dtsi ++++ b/arch/loongarch/boot/dts/loongson-2k2000.dtsi +@@ -126,6 +126,7 @@ + reg = <0x0 0x1fe01400 0x0 0x64>; + + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <2>; + interrupt-parent = <&cpuintc>; + interrupts = <2>; +@@ -140,6 +141,7 @@ + compatible = "loongson,ls2k2000-eiointc"; + reg = <0x0 0x1fe01600 0x0 0xea00>; + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <1>; + interrupt-parent = <&cpuintc>; + interrupts = <3>; +@@ -149,6 +151,7 @@ + compatible = "loongson,pch-pic-1.0"; + reg = <0x0 0x10000000 0x0 0x400>; + interrupt-controller; ++ #address-cells = <0>; + #interrupt-cells = <2>; + loongson,pic-base-vec = <0>; + interrupt-parent = <&eiointc>; diff --git a/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_eiointc_destroy.patch b/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_eiointc_destroy.patch new file mode 100644 index 0000000000..3738306c22 --- /dev/null +++ b/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_eiointc_destroy.patch @@ -0,0 +1,35 @@ +From 7d8553fc75aefa7ec936af0cf8443ff90b51732e Mon Sep 17 00:00:00 2001 +From: Qiang Ma +Date: Sat, 17 Jan 2026 10:57:02 +0800 +Subject: LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() + +From: Qiang Ma + +commit 7d8553fc75aefa7ec936af0cf8443ff90b51732e upstream. + +In kvm_ioctl_create_device(), kvm_device has allocated memory, +kvm_device->destroy() seems to be supposed to free its kvm_device +struct, but kvm_eiointc_destroy() is not currently doing this, that +would lead to a memory leak. + +So, fix it. + +Cc: stable@vger.kernel.org +Reviewed-by: Bibo Mao +Signed-off-by: Qiang Ma +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kvm/intc/eiointc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/loongarch/kvm/intc/eiointc.c ++++ b/arch/loongarch/kvm/intc/eiointc.c +@@ -679,6 +679,7 @@ static void kvm_eiointc_destroy(struct k + kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device); + kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &eiointc->device_vext); + kfree(eiointc); ++ kfree(dev); + } + + static struct kvm_device_ops kvm_eiointc_dev_ops = { diff --git a/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_ipi_destroy.patch b/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_ipi_destroy.patch new file mode 100644 index 0000000000..5e1f6bd1e2 --- /dev/null +++ b/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_ipi_destroy.patch @@ -0,0 +1,35 @@ +From 0bf58cb7288a4d3de6d8ecbb3a65928a9362bf21 Mon Sep 17 00:00:00 2001 +From: Qiang Ma +Date: Sat, 17 Jan 2026 10:57:02 +0800 +Subject: LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() + +From: Qiang Ma + +commit 0bf58cb7288a4d3de6d8ecbb3a65928a9362bf21 upstream. + +In kvm_ioctl_create_device(), kvm_device has allocated memory, +kvm_device->destroy() seems to be supposed to free its kvm_device +struct, but kvm_ipi_destroy() is not currently doing this, that +would lead to a memory leak. + +So, fix it. + +Cc: stable@vger.kernel.org +Reviewed-by: Bibo Mao +Signed-off-by: Qiang Ma +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kvm/intc/ipi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/loongarch/kvm/intc/ipi.c ++++ b/arch/loongarch/kvm/intc/ipi.c +@@ -459,6 +459,7 @@ static void kvm_ipi_destroy(struct kvm_d + ipi = kvm->arch.ipi; + kvm_io_bus_unregister_dev(kvm, KVM_IOCSR_BUS, &ipi->device); + kfree(ipi); ++ kfree(dev); + } + + static struct kvm_device_ops kvm_ipi_dev_ops = { diff --git a/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_pch_pic_destroy.patch b/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_pch_pic_destroy.patch new file mode 100644 index 0000000000..39929fe374 --- /dev/null +++ b/queue-6.18/loongarch-kvm-fix-kvm_device-leak-in-kvm_pch_pic_destroy.patch @@ -0,0 +1,35 @@ +From 1cf342a7c3adc5877837b53bbceb5cc9eff60bbf Mon Sep 17 00:00:00 2001 +From: Qiang Ma +Date: Sat, 17 Jan 2026 10:57:03 +0800 +Subject: LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() + +From: Qiang Ma + +commit 1cf342a7c3adc5877837b53bbceb5cc9eff60bbf upstream. + +In kvm_ioctl_create_device(), kvm_device has allocated memory, +kvm_device->destroy() seems to be supposed to free its kvm_device +struct, but kvm_pch_pic_destroy() is not currently doing this, that +would lead to a memory leak. + +So, fix it. + +Cc: stable@vger.kernel.org +Reviewed-by: Bibo Mao +Signed-off-by: Qiang Ma +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kvm/intc/pch_pic.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/loongarch/kvm/intc/pch_pic.c ++++ b/arch/loongarch/kvm/intc/pch_pic.c +@@ -475,6 +475,7 @@ static void kvm_pch_pic_destroy(struct k + /* unregister pch pic device and free it's memory */ + kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &s->device); + kfree(s); ++ kfree(dev); + } + + static struct kvm_device_ops kvm_pch_pic_dev_ops = { diff --git a/queue-6.18/series b/queue-6.18/series index f125d3ea50..2de29eaa05 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -146,3 +146,38 @@ mm-damon-sysfs-cleanup-intervals-subdirs-on-attrs-dir-setup-failure.patch mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch loongarch-dts-describe-pci-sideband-irq-through-interrupt-extended.patch +drm-amd-display-bump-the-hdmi-clock-to-340mhz.patch +drm-amd-display-initialise-backlight-level-values-from-hw.patch +drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch +drm-amdgpu-fix-gfx9-update-pte-mtype-flag.patch +drm-amdgpu-make-sure-userqs-are-enabled-in-userq-ioctls.patch +drm-amdkfd-fix-a-memory-leak-in-device_queue_manager_init.patch +drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch +drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch +drm-panel-simple-restore-connector_type-fallback.patch +drm-sysfb-remove-duplicate-declarations.patch +drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch +loongarch-dts-loongson-2k0500-add-default-interrupt-controller-address-cells.patch +loongarch-dts-loongson-2k1000-add-default-interrupt-controller-address-cells.patch +loongarch-dts-loongson-2k1000-fix-i2c-gpio-node-names.patch +loongarch-dts-loongson-2k2000-add-default-interrupt-controller-address-cells.patch +loongarch-kvm-fix-kvm_device-leak-in-kvm_eiointc_destroy.patch +loongarch-kvm-fix-kvm_device-leak-in-kvm_ipi_destroy.patch +loongarch-kvm-fix-kvm_device-leak-in-kvm_pch_pic_destroy.patch +dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch +dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch +dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch +dmaengine-cv1800b-dmamux-fix-device-leak-on-route-allocation.patch +dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch +dmaengine-fsl-edma-fix-clk-leak-on-alloc_chan_resources-failure.patch +dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch +dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch +dmaengine-lpc32xx-dmamux-fix-device-leak-on-route-allocation.patch +dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch +dmaengine-sh-rz-dmac-fix-device-leak-on-probe-failure.patch +dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch +dmaengine-stm32-dmamux-fix-device-leak-on-route-allocation.patch +dmaengine-stm32-dmamux-fix-of-node-leak-on-route-allocation-failure.patch +dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch +dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch +dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch