From: Greg Kroah-Hartman Date: Tue, 20 Jan 2026 15:08:40 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.12.67~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cec6a970dedef58abd72b32ea530363742278918;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch --- diff --git a/queue-6.1/dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch b/queue-6.1/dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch new file mode 100644 index 0000000000..5454fb6c86 --- /dev/null +++ b/queue-6.1/dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch @@ -0,0 +1,37 @@ +From 76cba1e60b69c9cd53b9127d017a7dc5945455b1 Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Wed, 31 Dec 2025 13:34:59 +0100 +Subject: dmaengine: apple-admac: Add "apple,t8103-admac" compatible + +From: Janne Grunau + +commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream. + +After discussion with the devicetree maintainers we agreed to not extend +lists with the generic compatible "apple,admac" anymore [1]. Use +"apple,t8103-admac" as base compatible as it is the SoC the driver and +bindings were written for. + +[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ + +Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") +Cc: stable@vger.kernel.org +Reviewed-by: Neal Gompa +Signed-off-by: Janne Grunau +Link: https://patch.msgid.link/20251231-apple-admac-t8103-base-compat-v1-1-ec24a3708f76@jannau.net +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/apple-admac.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/dma/apple-admac.c ++++ b/drivers/dma/apple-admac.c +@@ -937,6 +937,7 @@ static int admac_remove(struct platform_ + } + + static const struct of_device_id admac_of_match[] = { ++ { .compatible = "apple,t8103-admac", }, + { .compatible = "apple,admac", }, + { } + }; diff --git a/queue-6.1/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch b/queue-6.1/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch new file mode 100644 index 0000000000..1f41b43111 --- /dev/null +++ b/queue-6.1/dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch @@ -0,0 +1,53 @@ +From b9074b2d7a230b6e28caa23165e9d8bc0677d333 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:43 +0100 +Subject: dmaengine: at_hdmac: fix device leak on of_dma_xlate() + +From: Johan Hovold + +commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream. + +Make sure to drop the reference taken when looking up the DMA platform +device during of_dma_xlate() when releasing channel resources. + +Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing +put_device() call in at_dma_xlate()") fixed the leak in a couple of +error paths but the reference is still leaking on successful allocation. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") +Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2 +Cc: Yu Kuai +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_hdmac.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1347,6 +1347,7 @@ static int atc_config(struct dma_chan *c + struct dma_slave_config *sconfig) + { + struct at_dma_chan *atchan = to_at_dma_chan(chan); ++ struct at_dma_slave *atslave; + + dev_vdbg(chan2dev(chan), "%s\n", __func__); + +@@ -1606,8 +1607,12 @@ static void atc_free_chan_resources(stru + /* + * Free atslave allocated in at_dma_xlate() + */ +- kfree(chan->private); +- chan->private = NULL; ++ atslave = chan->private; ++ if (atslave) { ++ put_device(atslave->dma_dev); ++ kfree(atslave); ++ chan->private = NULL; ++ } + + dev_vdbg(chan2dev(chan), "free_chan_resources: done\n"); + } diff --git a/queue-6.1/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch b/queue-6.1/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch new file mode 100644 index 0000000000..8fd4762032 --- /dev/null +++ b/queue-6.1/dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch @@ -0,0 +1,51 @@ +From 7c3a46ebf15a9796b763a54272407fdbf945bed8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:45 +0100 +Subject: dmaengine: bcm-sba-raid: fix device leak on probe + +From: Johan Hovold + +commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream. + +Make sure to drop the reference taken when looking up the mailbox device +during probe on probe failures and on driver unbind. + +Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver") +Cc: stable@vger.kernel.org # 4.13 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/bcm-sba-raid.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/dma/bcm-sba-raid.c ++++ b/drivers/dma/bcm-sba-raid.c +@@ -1697,7 +1697,7 @@ static int sba_probe(struct platform_dev + /* Prealloc channel resource */ + ret = sba_prealloc_channel_resources(sba); + if (ret) +- goto fail_free_mchan; ++ goto fail_put_mbox; + + /* Check availability of debugfs */ + if (!debugfs_initialized()) +@@ -1727,6 +1727,8 @@ skip_debugfs: + fail_free_resources: + debugfs_remove_recursive(sba->root); + sba_freeup_channel_resources(sba); ++fail_put_mbox: ++ put_device(sba->mbox_dev); + fail_free_mchan: + mbox_free_channel(sba->mchan); + return ret; +@@ -1742,6 +1744,8 @@ static int sba_remove(struct platform_de + + sba_freeup_channel_resources(sba); + ++ put_device(sba->mbox_dev); ++ + mbox_free_channel(sba->mchan); + + return 0; diff --git a/queue-6.1/dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch b/queue-6.1/dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch new file mode 100644 index 0000000000..112b2303bc --- /dev/null +++ b/queue-6.1/dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch @@ -0,0 +1,44 @@ +From ec25e60f9f95464aa11411db31d0906b3fb7b9f2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:47 +0100 +Subject: dmaengine: dw: dmamux: fix OF node leak on route allocation failure + +From: Johan Hovold + +commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream. + +Make sure to drop the reference taken to the DMA master OF node also on +late route allocation failures. + +Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support") +Cc: stable@vger.kernel.org # 5.19 +Cc: Miquel Raynal +Signed-off-by: Johan Hovold +Reviewed-by: Miquel Raynal +Link: https://patch.msgid.link/20251117161258.10679-6-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dw/rzn1-dmamux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/dw/rzn1-dmamux.c ++++ b/drivers/dma/dw/rzn1-dmamux.c +@@ -88,7 +88,7 @@ static void *rzn1_dmamux_route_allocate( + + if (test_and_set_bit(map->req_idx, dmamux->used_chans)) { + ret = -EBUSY; +- goto free_map; ++ goto put_dma_spec_np; + } + + mask = BIT(map->req_idx); +@@ -101,6 +101,8 @@ static void *rzn1_dmamux_route_allocate( + + clear_bitmap: + clear_bit(map->req_idx, dmamux->used_chans); ++put_dma_spec_np: ++ of_node_put(dma_spec->np); + free_map: + kfree(map); + put_device: diff --git a/queue-6.1/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch b/queue-6.1/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch new file mode 100644 index 0000000000..663a7d59c4 --- /dev/null +++ b/queue-6.1/dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch @@ -0,0 +1,80 @@ +From 799900f01792cf8b525a44764f065f83fcafd468 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:48 +0100 +Subject: dmaengine: idxd: fix device leaks on compat bind and unbind + +From: Johan Hovold + +commit 799900f01792cf8b525a44764f065f83fcafd468 upstream. + +Make sure to drop the reference taken when looking up the idxd device as +part of the compat bind and unbind sysfs interface. + +Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode") +Cc: stable@vger.kernel.org # 5.15 +Cc: Dave Jiang +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/idxd/compat.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/dma/idxd/compat.c ++++ b/drivers/dma/idxd/compat.c +@@ -21,11 +21,16 @@ static ssize_t unbind_store(struct devic + int rc = -ENODEV; + + dev = bus_find_device_by_name(bus, NULL, buf); +- if (dev && dev->driver) { ++ if (!dev) ++ return -ENODEV; ++ ++ if (dev->driver) { + device_driver_detach(dev); + rc = count; + } + ++ put_device(dev); ++ + return rc; + } + static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store); +@@ -39,9 +44,12 @@ static ssize_t bind_store(struct device_ + struct idxd_dev *idxd_dev; + + dev = bus_find_device_by_name(bus, NULL, buf); +- if (!dev || dev->driver || drv != &dsa_drv.drv) ++ if (!dev) + return -ENODEV; + ++ if (dev->driver || drv != &dsa_drv.drv) ++ goto err_put_dev; ++ + idxd_dev = confdev_to_idxd_dev(dev); + if (is_idxd_dev(idxd_dev)) { + alt_drv = driver_find("idxd", bus); +@@ -54,13 +62,20 @@ static ssize_t bind_store(struct device_ + alt_drv = driver_find("user", bus); + } + if (!alt_drv) +- return -ENODEV; ++ goto err_put_dev; + + rc = device_driver_attach(alt_drv, dev); + if (rc < 0) +- return rc; ++ goto err_put_dev; ++ ++ put_device(dev); + + return count; ++ ++err_put_dev: ++ put_device(dev); ++ ++ return rc; + } + static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store); + diff --git a/queue-6.1/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch b/queue-6.1/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch new file mode 100644 index 0000000000..c2ffa8986c --- /dev/null +++ b/queue-6.1/dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch @@ -0,0 +1,89 @@ +From d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:49 +0100 +Subject: dmaengine: lpc18xx-dmamux: fix device leak on route allocation + +From: Johan Hovold + +commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream. + +Make sure to drop the reference taken when looking up the DMA mux +platform device during route allocation. + +Note that holding a reference to a device does not prevent its driver +data from going away so there is no point in keeping the reference. + +Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux") +Cc: stable@vger.kernel.org # 4.3 +Signed-off-by: Johan Hovold +Reviewed-by: Vladimir Zapolskiy +Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/dma/lpc18xx-dmamux.c ++++ b/drivers/dma/lpc18xx-dmamux.c +@@ -55,30 +55,31 @@ static void *lpc18xx_dmamux_reserve(stru + struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev); + unsigned long flags; + unsigned mux; ++ int ret = -EINVAL; + + if (dma_spec->args_count != 3) { + dev_err(&pdev->dev, "invalid number of dma mux args\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + mux = dma_spec->args[0]; + if (mux >= dmamux->dma_master_requests) { + dev_err(&pdev->dev, "invalid mux number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) { + dev_err(&pdev->dev, "invalid dma mux value: %d\n", + dma_spec->args[1]); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + /* The of_node_put() will be done in the core for the node */ + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "can't get dma master\n"); +- return ERR_PTR(-EINVAL); ++ goto err_put_pdev; + } + + spin_lock_irqsave(&dmamux->lock, flags); +@@ -87,7 +88,8 @@ static void *lpc18xx_dmamux_reserve(stru + dev_err(&pdev->dev, "dma request %u busy with %u.%u\n", + mux, mux, dmamux->muxes[mux].value); + of_node_put(dma_spec->np); +- return ERR_PTR(-EBUSY); ++ ret = -EBUSY; ++ goto err_put_pdev; + } + + dmamux->muxes[mux].busy = true; +@@ -104,7 +106,14 @@ static void *lpc18xx_dmamux_reserve(stru + dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux, + dmamux->muxes[mux].value, mux); + ++ put_device(&pdev->dev); ++ + return &dmamux->muxes[mux]; ++ ++err_put_pdev: ++ put_device(&pdev->dev); ++ ++ return ERR_PTR(ret); + } + + static int lpc18xx_dmamux_probe(struct platform_device *pdev) diff --git a/queue-6.1/dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch b/queue-6.1/dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch new file mode 100644 index 0000000000..d15f09faa1 --- /dev/null +++ b/queue-6.1/dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch @@ -0,0 +1,56 @@ +From 3f747004bbd641131d9396d87b5d2d3d1e182728 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Wed, 29 Oct 2025 20:34:19 +0800 +Subject: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() + +From: Miaoqian Lin + +commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream. + +Fix a memory leak in gpi_peripheral_config() where the original memory +pointed to by gchan->config could be lost if krealloc() fails. + +The issue occurs when: +1. gchan->config points to previously allocated memory +2. krealloc() fails and returns NULL +3. The function directly assigns NULL to gchan->config, losing the + reference to the original memory +4. The original memory becomes unreachable and cannot be freed + +Fix this by using a temporary variable to hold the krealloc() result +and only updating gchan->config when the allocation succeeds. + +Found via static analysis and code review. + +Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") +Cc: stable@vger.kernel.org +Signed-off-by: Miaoqian Lin +Reviewed-by: Bjorn Andersson +Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/qcom/gpi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/dma/qcom/gpi.c ++++ b/drivers/dma/qcom/gpi.c +@@ -1621,14 +1621,16 @@ static int + gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) + { + struct gchan *gchan = to_gchan(chan); ++ void *new_config; + + if (!config->peripheral_config) + return -EINVAL; + +- gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); +- if (!gchan->config) ++ new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); ++ if (!new_config) + return -ENOMEM; + ++ gchan->config = new_config; + memcpy(gchan->config, config->peripheral_config, config->peripheral_size); + + return 0; diff --git a/queue-6.1/dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch b/queue-6.1/dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch new file mode 100644 index 0000000000..09e44ec714 --- /dev/null +++ b/queue-6.1/dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch @@ -0,0 +1,49 @@ +From 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Thu, 13 Nov 2025 19:50:48 +0000 +Subject: dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() + +From: Biju Das + +commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream. + +After audio full duplex testing, playing the recorded file contains a few +playback frames from the previous time. The rz_dmac_terminate_all() does +not reset all the hardware descriptors queued previously, leading to the +wrong descriptor being picked up during the next DMA transfer. Fix the +above issue by resetting all the descriptor headers for a channel in +rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper +descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg(). + +Cc: stable@kernel.org +Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Biju Das +Reviewed-by: Claudiu Beznea +Tested-by: Claudiu Beznea +Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/sh/rz-dmac.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/dma/sh/rz-dmac.c ++++ b/drivers/dma/sh/rz-dmac.c +@@ -533,11 +533,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *c + static int rz_dmac_terminate_all(struct dma_chan *chan) + { + struct rz_dmac_chan *channel = to_rz_dmac_chan(chan); ++ struct rz_lmdesc *lmdesc = channel->lmdesc.base; + unsigned long flags; ++ unsigned int i; + LIST_HEAD(head); + + rz_dmac_disable_hw(channel); + spin_lock_irqsave(&channel->vc.lock, flags); ++ for (i = 0; i < DMAC_NR_LMDESC; i++) ++ lmdesc[i].header = 0; ++ + list_splice_tail_init(&channel->ld_active, &channel->ld_free); + list_splice_tail_init(&channel->ld_queue, &channel->ld_free); + spin_unlock_irqrestore(&channel->vc.lock, flags); diff --git a/queue-6.1/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch b/queue-6.1/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch new file mode 100644 index 0000000000..b7012d7703 --- /dev/null +++ b/queue-6.1/dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch @@ -0,0 +1,77 @@ +From 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:56 +0100 +Subject: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation + +From: Johan Hovold + +commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream. + +Make sure to drop the reference taken when looking up the crossbar +platform device during am335x route allocation. + +Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx") +Cc: stable@vger.kernel.org # 4.4 +Cc: Peter Ujfalusi +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/dma/ti/dma-crossbar.c ++++ b/drivers/dma/ti/dma-crossbar.c +@@ -78,34 +78,35 @@ static void *ti_am335x_xbar_route_alloca + { + struct platform_device *pdev = of_find_device_by_node(ofdma->of_node); + struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev); +- struct ti_am335x_xbar_map *map; ++ struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL); + + if (dma_spec->args_count != 3) +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + + if (dma_spec->args[2] >= xbar->xbar_events) { + dev_err(&pdev->dev, "Invalid XBAR event number: %d\n", + dma_spec->args[2]); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + if (dma_spec->args[0] >= xbar->dma_requests) { + dev_err(&pdev->dev, "Invalid DMA request line number: %d\n", + dma_spec->args[0]); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + /* The of_node_put() will be done in the core for the node */ + dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0); + if (!dma_spec->np) { + dev_err(&pdev->dev, "Can't get DMA master\n"); +- return ERR_PTR(-EINVAL); ++ goto out_put_pdev; + } + + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (!map) { + of_node_put(dma_spec->np); +- return ERR_PTR(-ENOMEM); ++ map = ERR_PTR(-ENOMEM); ++ goto out_put_pdev; + } + + map->dma_line = (u16)dma_spec->args[0]; +@@ -119,6 +120,9 @@ static void *ti_am335x_xbar_route_alloca + + ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val); + ++out_put_pdev: ++ put_device(&pdev->dev); ++ + return map; + } + diff --git a/queue-6.1/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch b/queue-6.1/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch new file mode 100644 index 0000000000..153a68b27b --- /dev/null +++ b/queue-6.1/dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch @@ -0,0 +1,40 @@ +From dc7e44db01fc2498644e3106db3e62a9883a93d5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:55 +0100 +Subject: dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation + +From: Johan Hovold + +commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream. + +Make sure to drop the reference taken when looking up the crossbar +platform device during dra7x route allocation. + +Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in +ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the +reference is still leaking on successful allocation. + +Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x") +Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") +Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e +Cc: Peter Ujfalusi +Cc: Miaoqian Lin +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/dma-crossbar.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/dma/ti/dma-crossbar.c ++++ b/drivers/dma/ti/dma-crossbar.c +@@ -287,6 +287,8 @@ static void *ti_dra7_xbar_route_allocate + + ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in); + ++ put_device(&pdev->dev); ++ + return map; + } + diff --git a/queue-6.1/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch b/queue-6.1/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch new file mode 100644 index 0000000000..515f4e90e6 --- /dev/null +++ b/queue-6.1/dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch @@ -0,0 +1,42 @@ +From 430f7803b69cd5e5694e5dfc884c6628870af36e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 17 Nov 2025 17:12:58 +0100 +Subject: dmaengine: ti: k3-udma: fix device leak on udma lookup + +From: Johan Hovold + +commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream. + +Make sure to drop the reference taken when looking up the UDMA platform +device. + +Note that holding a reference to a platform device does not prevent its +driver data from going away so there is no point in keeping the +reference after the lookup helper returns. + +Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users") +Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()") +Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c +Cc: Grygorii Strashko +Cc: Yu Kuai +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ti/k3-udma-private.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/ti/k3-udma-private.c ++++ b/drivers/dma/ti/k3-udma-private.c +@@ -40,9 +40,9 @@ struct udma_dev *of_xudma_dev_get(struct + } + + ud = platform_get_drvdata(pdev); ++ put_device(&pdev->dev); + if (!ud) { + pr_debug("UDMA has not been probed\n"); +- put_device(&pdev->dev); + return ERR_PTR(-EPROBE_DEFER); + } + diff --git a/queue-6.1/drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch b/queue-6.1/drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch new file mode 100644 index 0000000000..64018dca0c --- /dev/null +++ b/queue-6.1/drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch @@ -0,0 +1,46 @@ +From 28695ca09d326461f8078332aa01db516983e8a2 Mon Sep 17 00:00:00 2001 +From: "Mario Limonciello (AMD)" +Date: Wed, 7 Jan 2026 15:37:28 -0600 +Subject: drm/amd: Clean up kfd node on surprise disconnect + +From: Mario Limonciello (AMD) + +commit 28695ca09d326461f8078332aa01db516983e8a2 upstream. + +When an eGPU is unplugged the KFD topology should also be destroyed +for that GPU. This never happens because the fini_sw callbacks never +get to run. Run them manually before calling amdgpu_device_ip_fini_early() +when a device has already been disconnected. + +This location is intentionally chosen to make sure that the kfd locking +refcount doesn't get incremented unintentionally. + +Cc: kent.russell@amd.com +Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33 +Signed-off-by: Mario Limonciello (AMD) +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4102,6 +4102,14 @@ void amdgpu_device_fini_hw(struct amdgpu + /* disable ras feature must before hw fini */ + amdgpu_ras_pre_fini(adev); + ++ /* ++ * device went through surprise hotplug; we need to destroy topology ++ * before ip_fini_early to prevent kfd locking refcount issues by calling ++ * amdgpu_amdkfd_suspend() ++ */ ++ if (drm_dev_is_unplugged(adev_to_drm(adev))) ++ amdgpu_amdkfd_device_fini_sw(adev); ++ + amdgpu_device_ip_fini_early(adev); + + amdgpu_irq_fini_hw(adev); diff --git a/queue-6.1/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch b/queue-6.1/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch new file mode 100644 index 0000000000..a2949ed7c4 --- /dev/null +++ b/queue-6.1/drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch @@ -0,0 +1,56 @@ +From 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Fri, 19 Dec 2025 16:52:02 -0500 +Subject: drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare + +From: Lyude Paul + +commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream. + +For a while, I've been seeing a strange issue where some (usually not all) +of the display DMA channels will suddenly hang, particularly when there is +a visible cursor on the screen that is being frequently updated, and +especially when said cursor happens to go between two screens. While this +brings back lovely memories of fixing Intel Skylake bugs, I would quite +like to fix it :). + +It turns out the problem that's happening here is that we're managing to +reach nv50_head_flush_set() in our atomic commit path without actually +holding nv50_disp->mutex. This means that cursor updates happening in +parallel (along with any other atomic updates that need to use the core +channel) will race with eachother, which eventually causes us to corrupt +the pushbuffer - leading to a plethora of various GSP errors, usually: + + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 + nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001 + +The reason this is happening is because generally we check whether we need +to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). +However, curs507a_prepare is called from the fb_prepare callback, which +happens after the atomic check phase. As a result, this can lead to commits +that both touch the core channel but also don't grab nv50_disp->mutex. + +So, fix this by making sure that we set nv50_atom->lock_core in +cus507a_prepare(). + +Reviewed-by: Dave Airlie +Signed-off-by: Lyude Paul +Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") +Cc: # v4.18+ +Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c +@@ -83,6 +83,7 @@ curs507a_prepare(struct nv50_wndw *wndw, + asyh->curs.handle = handle; + asyh->curs.offset = offset; + asyh->set.curs = asyh->curs.visible; ++ nv50_atom(asyh->state.state)->lock_core = true; + } + } + diff --git a/queue-6.1/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch b/queue-6.1/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch new file mode 100644 index 0000000000..82fe58ece3 --- /dev/null +++ b/queue-6.1/drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch @@ -0,0 +1,42 @@ +From 6ab3d4353bf75005eaa375677c9fed31148154d6 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sat, 10 Jan 2026 16:27:28 +0100 +Subject: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel + +From: Marek Vasut + +commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream. + +The connector type for the DataImage SCF0700C48GGU18 panel is missing and +devm_drm_panel_bridge_add() requires connector type to be set. This leads +to a warning and a backtrace in the kernel log and panel does not work: +" +WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8 +" +The warning is triggered by a check for valid connector type in +devm_drm_panel_bridge_add(). If there is no valid connector type +set for a panel, the warning is printed and panel is not added. +Fill in the missing connector type to fix the warning and make +the panel operational once again. + +Cc: stable@vger.kernel.org +Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18") +Signed-off-by: Marek Vasut +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panel/panel-simple.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1518,6 +1518,7 @@ static const struct panel_desc dataimage + }, + .bus_format = MEDIA_BUS_FMT_RGB888_1X24, + .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, ++ .connector_type = DRM_MODE_CONNECTOR_DPI, + }; + + static const struct display_timing dlc_dlc0700yzg_1_timing = { diff --git a/queue-6.1/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch b/queue-6.1/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch new file mode 100644 index 0000000000..ffc2b7036c --- /dev/null +++ b/queue-6.1/drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch @@ -0,0 +1,38 @@ +From bf72b4b7bb7dbb643d204fa41e7463894a95999f Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Wed, 24 Dec 2025 17:11:05 +0800 +Subject: drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() + +From: Haoxiang Li + +commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream. + +In vmw_compat_shader_add(), the return value check of vmw_shader_alloc() +is not proper. Modify the check for the return pointer 'res'. + +Found by code review and compiled on ubuntu 20.04. + +Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +@@ -917,8 +917,10 @@ int vmw_compat_shader_add(struct vmw_pri + ttm_bo_unreserve(&buf->base); + + res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type); +- if (unlikely(ret != 0)) ++ if (IS_ERR(res)) { ++ ret = PTR_ERR(res); + goto no_reserve; ++ } + + ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader, + vmw_shader_key(user_key, shader_type), diff --git a/queue-6.1/series b/queue-6.1/series index 7e4f41cac5..2e230652da 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -59,3 +59,18 @@ x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch +drm-amd-clean-up-kfd-node-on-surprise-disconnect.patch +drm-nouveau-disp-nv50-set-lock_core-in-curs507a_prepare.patch +drm-panel-simple-fix-connector-type-for-dataimage-scf0700c48ggu18-panel.patch +drm-vmwgfx-fix-an-error-return-check-in-vmw_compat_shader_add.patch +dmaengine-apple-admac-add-apple-t8103-admac-compatible.patch +dmaengine-at_hdmac-fix-device-leak-on-of_dma_xlate.patch +dmaengine-bcm-sba-raid-fix-device-leak-on-probe.patch +dmaengine-dw-dmamux-fix-of-node-leak-on-route-allocation-failure.patch +dmaengine-idxd-fix-device-leaks-on-compat-bind-and-unbind.patch +dmaengine-lpc18xx-dmamux-fix-device-leak-on-route-allocation.patch +dmaengine-qcom-gpi-fix-memory-leak-in-gpi_peripheral_config.patch +dmaengine-sh-rz-dmac-fix-rz_dmac_terminate_all.patch +dmaengine-ti-dma-crossbar-fix-device-leak-on-dra7x-route-allocation.patch +dmaengine-ti-dma-crossbar-fix-device-leak-on-am335x-route-allocation.patch +dmaengine-ti-k3-udma-fix-device-leak-on-udma-lookup.patch