From: Greg Kroah-Hartman Date: Tue, 20 Jan 2026 15:08:17 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.12.67~17 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7dfb8ee1a14c81f505aecaa26c65fd91cca7dcfc;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch --- diff --git a/queue-5.10/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch b/queue-5.10/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch new file mode 100644 index 0000000000..ef1297a3d9 --- /dev/null +++ b/queue-5.10/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch @@ -0,0 +1,53 @@ +From b9074b2d7a230b6e28caa23165e9d8bc0677d333 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:43 +0100 +Subject: dmaengine: at_hdmac: fix device leak on of_dma_xlate() + +From: Johan Hovold + +commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream. + +Make sure to drop the reference taken when looking up the DMA platform +device during of_dma_xlate() when releasing channel resources. + +Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing +put_device() call in at_dma_xlate()") fixed the leak in a couple of +error paths but the reference is still leaking on successful allocation. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") +Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2 +Cc: Yu Kuai +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_hdmac.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1320,6 +1320,7 @@ static int atc_config(struct dma_chan *c + struct dma_slave_config *sconfig) + { + struct at_dma_chan *atchan = to_at_dma_chan(chan); ++ struct at_dma_slave *atslave; + + dev_vdbg(chan2dev(chan), "%s\n", __func__); + +@@ -1579,8 +1580,12 @@ static void atc_free_chan_resources(stru + /* + * Free atslave allocated in at_dma_xlate() + */ +- kfree(chan->private); +- chan->private = NULL; ++ atslave = chan->private; ++ if (atslave) { ++ put_device(atslave->dma_dev); ++ kfree(atslave); ++ chan->private = NULL; ++ } + + dev_vdbg(chan2dev(chan), "free_chan_resources: done\n"); + } diff --git a/queue-5.10/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch b/queue-5.10/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch new file mode 100644 index 0000000000..bd28ca0238 --- /dev/null +++ b/queue-5.10/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch @@ -0,0 +1,51 @@ +From 7c3a46ebf15a9796b763a54272407fdbf945bed8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:45 +0100 +Subject: dmaengine: bcm-sba-raid: fix device leak on probe + +From: Johan Hovold + +commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream. + +Make sure to drop the reference taken when looking up the mailbox device +during probe on probe failures and on driver unbind. + +Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver") +Cc: stable@vger.kernel.org # 4.13 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/bcm-sba-raid.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/dma/bcm-sba-raid.c ++++ b/drivers/dma/bcm-sba-raid.c +@@ -1707,7 +1707,7 @@ static int sba_probe(struct platform_dev + /* Prealloc channel resource */ + ret = sba_prealloc_channel_resources(sba); + if (ret) +- goto fail_free_mchan; ++ goto fail_put_mbox; + + /* Check availability of debugfs */ + if (!debugfs_initialized()) +@@ -1737,6 +1737,8 @@ skip_debugfs: + fail_free_resources: + debugfs_remove_recursive(sba->root); + sba_freeup_channel_resources(sba); ++fail_put_mbox: ++ put_device(sba->mbox_dev); + fail_free_mchan: + mbox_free_channel(sba->mchan); + return ret; +@@ -1752,6 +1754,8 @@ static int sba_remove(struct platform_de + + sba_freeup_channel_resources(sba); + ++ put_device(sba->mbox_dev); ++ + mbox_free_channel(sba->mchan); + + return 0; diff --git a/queue-5.10/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch b/queue-5.10/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch new file mode 100644 index 0000000000..c2ffa8986c --- /dev/null +++ b/queue-5.10/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch @@ -0,0 +1,89 @@ +From d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:49 +0100 +Subject: dmaengine: lpc18xx-dmamux: fix device leak on route allocation + +From: Johan Hovold + +commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream. + +Make sure to drop the reference taken when looking up the DMA mux +platform device during route allocation. + +Note that holding a reference to a device does not prevent its driver +data from going away so there is no point in keeping the reference. + +Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux") +Cc: stable@vger.kernel.org # 4.3 +Signed-off-by: Johan Hovold +Reviewed-by: Vladimir Zapolskiy +Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/dma/lpc18xx-dmamux.c ++++ b/drivers/dma/lpc18xx-dmamux.c +@@ -55,30 +55,31 @@ static void *lpc18xx_dmamux_reserve(stru + struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev); + unsigned long flags; + unsigned mux; ++ int ret = -EINVAL; + + if (dma_spec->args_count != 3) { + dev_err(&pdev->dev, "invalid number of dma mux args\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + mux = dma_spec->args[0]; + if (mux >= dmamux->dma_master_requests) { + dev_err(&pdev->dev, "invalid mux number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) { + dev_err(&pdev->dev, "invalid dma mux value: %d\n", + dma_spec->args[1]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + /* The of_node_put() will be done in the core for the node */ + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "can't get dma master\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + spin_lock_irqsave(&dmamux->lock, flags); +@@ -87,7 +88,8 @@ static void *lpc18xx_dmamux_reserve(stru + dev_err(&pdev->dev, "dma request %u busy with %u.%u\n", + mux, mux, dmamux->muxes[mux].value); + of_node_put(dma_spec->np); +- return ERR_PTR(-EBUSY); ++ ret = -EBUSY; ++ goto err_put_pdev; + } + + dmamux->muxes[mux].busy = true; +@@ -104,7 +106,14 @@ static void *lpc18xx_dmamux_reserve(stru + dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux, + dmamux->muxes[mux].value, mux); + ++ put_device(&pdev->dev); ++ + return &dmamux->muxes[mux]; ++ ++err_put_pdev: ++ put_device(&pdev->dev); ++ ++ return ERR_PTR(ret); + } + + static int lpc18xx_dmamux_probe(struct platform_device *pdev) diff --git a/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch b/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch new file mode 100644 index 0000000000..b7012d7703 --- /dev/null +++ b/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch @@ -0,0 +1,77 @@ +From 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:56 +0100 +Subject: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation + +From: Johan Hovold + +commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream. + +Make sure to drop the reference taken when looking up the crossbar +platform device during am335x route allocation. + +Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx") +Cc: stable@vger.kernel.org # 4.4 +Cc: Peter Ujfalusi +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/dma/ti/dma-crossbar.c ++++ b/drivers/dma/ti/dma-crossbar.c +@@ -78,34 +78,35 @@ static void *ti_am335x_xbar_route_alloca + { + struct platform_device *pdev = of_find_device_by_node(ofdma->of_node); + struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev); +- struct ti_am335x_xbar_map *map; ++ struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL); + + if (dma_spec->args_count != 3) +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + + if (dma_spec->args[2] >= xbar->xbar_events) { + dev_err(&pdev->dev, "Invalid XBAR event number: %d\n", + dma_spec->args[2]); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + if (dma_spec->args[0] >= xbar->dma_requests) { + dev_err(&pdev->dev, "Invalid DMA request line number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + /* The of_node_put() will be done in the core for the node */ + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "Can't get DMA master\n"); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (!map) { + of_node_put(dma_spec->np); +- return ERR_PTR(-ENOMEM); ++ map = ERR_PTR(-ENOMEM); ++ goto out_put_pdev; + } + + map->dma_line = (u16)dma_spec->args[0]; +@@ -119,6 +120,9 @@ static void *ti_am335x_xbar_route_alloca + + ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val); + ++out_put_pdev: ++ put_device(&pdev->dev); ++ + return map; + } + diff --git a/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch b/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch new file mode 100644 index 0000000000..153a68b27b --- /dev/null +++ b/queue-5.10/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch @@ -0,0 +1,40 @@ +From dc7e44db01fc2498644e3106db3e62a9883a93d5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:55 +0100 +Subject: dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation + +From: Johan Hovold + +commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream. + +Make sure to drop the reference taken when looking up the crossbar +platform device during dra7x route allocation. + +Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in +ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the +reference is still leaking on successful allocation. + +Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x") +Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") +Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e +Cc: Peter Ujfalusi +Cc: Miaoqian Lin +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/dma-crossbar.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/dma/ti/dma-crossbar.c ++++ b/drivers/dma/ti/dma-crossbar.c +@@ -287,6 +287,8 @@ static void *ti_dra7_xbar_route_allocate + + ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in); + ++ put_device(&pdev->dev); ++ + return map; + } + diff --git a/queue-5.10/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch b/queue-5.10/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch new file mode 100644 index 0000000000..515f4e90e6 --- /dev/null +++ b/queue-5.10/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch @@ -0,0 +1,42 @@ +From 430f7803b69cd5e5694e5dfc884c6628870af36e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:58 +0100 +Subject: dmaengine: ti: k3-udma: fix device leak on udma lookup + +From: Johan Hovold + +commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream. + +Make sure to drop the reference taken when looking up the UDMA platform +device. + +Note that holding a reference to a platform device does not prevent its +driver data from going away so there is no point in keeping the +reference after the lookup helper returns. + +Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users") +Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()") +Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c +Cc: Grygorii Strashko +Cc: Yu Kuai +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/k3-udma-private.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/ti/k3-udma-private.c ++++ b/drivers/dma/ti/k3-udma-private.c +@@ -40,9 +40,9 @@ struct udma_dev *of_xudma_dev_get(struct + } + + ud = platform_get_drvdata(pdev); ++ put_device(&pdev->dev); + if (!ud) { + pr_debug("UDMA has not been probed\n"); +- put_device(&pdev->dev); + return ERR_PTR(-EPROBE_DEFER); + } + diff --git a/queue-5.10/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch b/queue-5.10/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch new file mode 100644 index 0000000000..5a910c6c3b --- /dev/null +++ b/queue-5.10/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch @@ -0,0 +1,56 @@ +From 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Fri, 19 Dec 2025 16:52:02 -0500 +Subject: drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare + +From: Lyude Paul + +commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream. + +For a while, I've been seeing a strange issue where some (usually not all) +of the display DMA channels will suddenly hang, particularly when there is +a visible cursor on the screen that is being frequently updated, and +especially when said cursor happens to go between two screens. While this +brings back lovely memories of fixing Intel Skylake bugs, I would quite +like to fix it :). + +It turns out the problem that's happening here is that we're managing to +reach nv50_head_flush_set() in our atomic commit path without actually +holding nv50_disp->mutex. This means that cursor updates happening in +parallel (along with any other atomic updates that need to use the core +channel) will race with eachother, which eventually causes us to corrupt +the pushbuffer - leading to a plethora of various GSP errors, usually: + + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001 + +The reason this is happening is because generally we check whether we need +to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). +However, curs507a_prepare is called from the fb_prepare callback, which +happens after the atomic check phase. As a result, this can lead to commits +that both touch the core channel but also don't grab nv50_disp->mutex. + +So, fix this by making sure that we set nv50_atom->lock_core in +cus507a_prepare(). + +Reviewed-by: Dave Airlie +Signed-off-by: Lyude Paul +Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") +Cc: # v4.18+ +Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c +@@ -84,6 +84,7 @@ curs507a_prepare(struct nv50_wndw *wndw, + asyh->curs.handle = handle; + asyh->curs.offset = offset; + asyh->set.curs = asyh->curs.visible; ++ nv50_atom(asyh->state.state)->lock_core = true; + } + } + diff --git a/queue-5.10/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch b/queue-5.10/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch new file mode 100644 index 0000000000..04702d6da6 --- /dev/null +++ b/queue-5.10/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch @@ -0,0 +1,42 @@ +From 6ab3d4353bf75005eaa375677c9fed31148154d6 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sat, 10 Jan 2026 16:27:28 +0100 +Subject: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel + +From: Marek Vasut + +commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream. + +The connector type for the DataImage SCF0700C48GGU18 panel is missing and +devm_drm_panel_bridge_add() requires connector type to be set. This leads +to a warning and a backtrace in the kernel log and panel does not work: +" +WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8 +" +The warning is triggered by a check for valid connector type in +devm_drm_panel_bridge_add(). If there is no valid connector type +set for a panel, the warning is printed and panel is not added. +Fill in the missing connector type to fix the warning and make +the panel operational once again. + +Cc: stable@vger.kernel.org +Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18") +Signed-off-by: Marek Vasut +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panel/panel-simple.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1627,6 +1627,7 @@ static const struct panel_desc dataimage + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X24, + .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, ++ .connector_type = DRM_MODE_CONNECTOR_DPI, + }; + + static const struct display_timing dlc_dlc0700yzg_1_timing = { diff --git a/queue-5.10/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch b/queue-5.10/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch new file mode 100644 index 0000000000..0660ca611f --- /dev/null +++ b/queue-5.10/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch @@ -0,0 +1,38 @@ +From bf72b4b7bb7dbb643d204fa41e7463894a95999f Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Dec 2025 17:11:05 +0800 +Subject: drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() + +From: Haoxiang Li + +commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream. + +In vmw_compat_shader_add(), the return value check of vmw_shader_alloc() +is not proper. Modify the check for the return pointer 'res'. + +Found by code review and compiled on ubuntu 20.04. + +Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +@@ -1004,8 +1004,10 @@ int vmw_compat_shader_add(struct vmw_pri + ttm_bo_unreserve(&buf->base); + + res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type); +- if (unlikely(ret != 0)) ++ if (IS_ERR(res)) { ++ ret = PTR_ERR(res); + goto no_reserve; ++ } + + ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader, + vmw_shader_key(user_key, shader_type), diff --git a/queue-5.10/series b/queue-5.10/series index 80630fa7bf..208d7338ad 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -31,3 +31,12 @@ edac-x38-fix-a-resource-leak-in-x38_probe1.patch edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch +drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch +drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch +drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch +dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch +dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch +dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch +dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch +dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch +dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch