--- /dev/null
+From b36f2dec642305e3f8ad5074aa88395342501f31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 14:31:02 +0900
+Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
+
+From: Masami Ichikawa <masami256@gmail.com>
+
+[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
+
+Use a scope-based cleanup helper for the buffer allocated with kmalloc()
+in ntrig_report_version() to simplify the cleanup logic and prevent
+memory leaks (specifically the !hid_is_usb()-case one).
+
+[jkosina@suse.com: elaborate on the actual existing leak]
+Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
+Signed-off-by: Masami Ichikawa <masami256@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ntrig.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index a1128c5315fff..3c41f6841f775 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
+ int ret;
+ char buf[20];
+ struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+- unsigned char *data = kmalloc(8, GFP_KERNEL);
++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
+
+ if (!hid_is_usb(hdev))
+ return;
+
+ if (!data)
+- goto err_free;
++ return;
+
+ ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
+ USB_REQ_CLEAR_FEATURE,
+@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
+ hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
+ buf, data[2], data[3], data[4], data[5]);
+ }
+-
+-err_free:
+- kfree(data);
+ }
+
+ static ssize_t show_phys_width(struct device *dev,
+--
+2.51.0
+
lib-crypto-arm-curve25519-disable-on-cpu_big_endian.patch
mtd-onenand-pass-correct-pointer-to-irq-handler.patch
netfilter-nf_tables-reject-duplicate-device-on-updat.patch
+hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch
--- /dev/null
+From 3026368bd71423492a42ce1097742bbfebd562de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 14:31:02 +0900
+Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
+
+From: Masami Ichikawa <masami256@gmail.com>
+
+[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
+
+Use a scope-based cleanup helper for the buffer allocated with kmalloc()
+in ntrig_report_version() to simplify the cleanup logic and prevent
+memory leaks (specifically the !hid_is_usb()-case one).
+
+[jkosina@suse.com: elaborate on the actual existing leak]
+Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
+Signed-off-by: Masami Ichikawa <masami256@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ntrig.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index a1128c5315fff..3c41f6841f775 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
+ int ret;
+ char buf[20];
+ struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+- unsigned char *data = kmalloc(8, GFP_KERNEL);
++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
+
+ if (!hid_is_usb(hdev))
+ return;
+
+ if (!data)
+- goto err_free;
++ return;
+
+ ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
+ USB_REQ_CLEAR_FEATURE,
+@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
+ hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
+ buf, data[2], data[3], data[4], data[5]);
+ }
+-
+-err_free:
+- kfree(data);
+ }
+
+ static ssize_t show_phys_width(struct device *dev,
+--
+2.51.0
+
lib-crypto-arm-curve25519-disable-on-cpu_big_endian.patch
mtd-onenand-pass-correct-pointer-to-irq-handler.patch
netfilter-nf_tables-reject-duplicate-device-on-updat.patch
+hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch
--- /dev/null
+From 7d71ad304e8523ec1c529447f9052695df250272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 14:31:02 +0900
+Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
+
+From: Masami Ichikawa <masami256@gmail.com>
+
+[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
+
+Use a scope-based cleanup helper for the buffer allocated with kmalloc()
+in ntrig_report_version() to simplify the cleanup logic and prevent
+memory leaks (specifically the !hid_is_usb()-case one).
+
+[jkosina@suse.com: elaborate on the actual existing leak]
+Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
+Signed-off-by: Masami Ichikawa <masami256@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ntrig.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index a1128c5315fff..3c41f6841f775 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
+ int ret;
+ char buf[20];
+ struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+- unsigned char *data = kmalloc(8, GFP_KERNEL);
++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
+
+ if (!hid_is_usb(hdev))
+ return;
+
+ if (!data)
+- goto err_free;
++ return;
+
+ ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
+ USB_REQ_CLEAR_FEATURE,
+@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
+ hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
+ buf, data[2], data[3], data[4], data[5]);
+ }
+-
+-err_free:
+- kfree(data);
+ }
+
+ static ssize_t show_phys_width(struct device *dev,
+--
+2.51.0
+
asm-generic-unify-uapi-bitsperlong.h-for-arm64-riscv.patch
mtd-onenand-pass-correct-pointer-to-irq-handler.patch
netfilter-nf_tables-reject-duplicate-device-on-updat.patch
+hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch
--- /dev/null
+From 32a9ae5fb7323ceafb0ede54e8c92d4d2dbe6dd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 21:48:52 +0200
+Subject: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b ]
+
+Luxul XAP-1440 has BCM54210E PHY at address 25.
+
+Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
+index ac44c745bdf8e..a39a021a39107 100644
+--- a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
++++ b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
+@@ -55,8 +55,8 @@
+ mdio {
+ /delete-node/ switch@1e;
+
+- bcm54210e: ethernet-phy@0 {
+- reg = <0>;
++ bcm54210e: ethernet-phy@25 {
++ reg = <25>;
+ };
+ };
+ };
+--
+2.51.0
+
--- /dev/null
+From 66f7784ae75dd440ef7c2e859410742ddc1407ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 00:06:55 +0200
+Subject: ARM: dts: imx51-zii-rdu1: Fix audmux node names
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit f31e261712a0d107f09fb1d3dc8f094806149c83 ]
+
+Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the
+audmux configuration of imx51-zii-rdu1.dts to comply with the naming
+convention in imx-audmux.yaml.
+
+This fixes the following dt-schema warning:
+
+ imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2'
+ do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$'
+
+Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
+index 7cd17b43b4b26..33b0a427ed5ca 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
+@@ -259,7 +259,7 @@
+ pinctrl-0 = <&pinctrl_audmux>;
+ status = "okay";
+
+- ssi2 {
++ mux-ssi2 {
+ fsl,audmux-port = <1>;
+ fsl,port-config = <
+ (IMX_AUDMUX_V2_PTCR_SYN |
+@@ -271,7 +271,7 @@
+ >;
+ };
+
+- aud3 {
++ mux-aud3 {
+ fsl,audmux-port = <2>;
+ fsl,port-config = <
+ IMX_AUDMUX_V2_PTCR_SYN
+--
+2.51.0
+
--- /dev/null
+From f5760919e5d9f0a5f6294bdc680862a908ae4073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 12:01:22 +0200
+Subject: arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic
+
+From: Dragan Simic <dsimic@manjaro.org>
+
+[ Upstream commit b3fd04e23f6e4496f5a2279466a33fbdc83500f0 ]
+
+Unify the naming of the existing GPU OPP table nodes found in the RK3588
+and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following
+the more "modern" node naming scheme.
+
+Fixes: a7b2070505a2 ("arm64: dts: rockchip: Split GPU OPPs of RK3588 and RK3588j")
+Signed-off-by: Dragan Simic <dsimic@manjaro.org>
+[opp-table also is way too generic on systems with like 4-5 opp-tables]
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3588j.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi
+index 0f1a776973516..b5d630d2c879f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi
+@@ -115,7 +115,7 @@
+ };
+ };
+
+- gpu_opp_table: opp-table {
++ gpu_opp_table: opp-table-gpu {
+ compatible = "operating-points-v2";
+
+ opp-300000000 {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi
+index 3045cb3bd68c6..baa8b5b6bfe55 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi
+@@ -66,7 +66,7 @@
+ };
+ };
+
+- gpu_opp_table: opp-table {
++ gpu_opp_table: opp-table-gpu {
+ compatible = "operating-points-v2";
+
+ opp-300000000 {
+--
+2.51.0
+
--- /dev/null
+From d082c3c53054ad6c6fa33448c35b5f2cd4a1f19f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:50:03 +0530
+Subject: arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on
+ odroid-m1
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+[ Upstream commit d425aef66e62221fa6bb0ccb94296df29e4cc107 ]
+
+Enable proper pin multiplexing for the I2S1 8-channel transmit interface by
+adding the default pinctrl configuration which esures correct signal routing
+and avoids pinmux conflicts during audio playback.
+
+Changes fix the error
+[ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s
+[ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s)
+[ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl
+[ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back
+
+I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0
+and SDO0 signals, so limit the claimed pins to those.
+
+With this change audio output works as expected:
+
+$ aplay -l
+**** List of PLAYBACK Hardware Devices ****
+card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0]
+ Subdevices: 1/1
+ Subdevice #0: subdevice #0
+card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0]
+ Subdevices: 1/1
+ Subdevice #0: subdevice #0
+
+Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1")
+Cc: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+[adapted the commit message a bit]
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
+index 6a02db4f073f2..a5426b82552ed 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
+@@ -482,6 +482,8 @@
+ };
+
+ &i2s1_8ch {
++ pinctrl-names = "default";
++ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>;
+ rockchip,trcm-sync-tx-only;
+ status = "okay";
+ };
+--
+2.51.0
+
--- /dev/null
+From d57bb005a71f34061968c66337bf8699d3af94d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 14:31:02 +0900
+Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
+
+From: Masami Ichikawa <masami256@gmail.com>
+
+[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
+
+Use a scope-based cleanup helper for the buffer allocated with kmalloc()
+in ntrig_report_version() to simplify the cleanup logic and prevent
+memory leaks (specifically the !hid_is_usb()-case one).
+
+[jkosina@suse.com: elaborate on the actual existing leak]
+Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
+Signed-off-by: Masami Ichikawa <masami256@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ntrig.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 0f76e241e0afb..a7f10c45f62bd 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
+ int ret;
+ char buf[20];
+ struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+- unsigned char *data = kmalloc(8, GFP_KERNEL);
++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
+
+ if (!hid_is_usb(hdev))
+ return;
+
+ if (!data)
+- goto err_free;
++ return;
+
+ ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
+ USB_REQ_CLEAR_FEATURE,
+@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
+ hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
+ buf, data[2], data[3], data[4], data[5]);
+ }
+-
+-err_free:
+- kfree(data);
+ }
+
+ static ssize_t show_phys_width(struct device *dev,
+--
+2.51.0
+
--- /dev/null
+From 9a5034a6ebf0cddf000563cc2575f8a18b77c7e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 22:45:50 +0530
+Subject: HID: playstation: Fix memory leak in
+ dualshock4_get_calibration_data()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+[ Upstream commit 8513c154f8ad7097653dd9bf43d6155e5aad4ab3 ]
+
+The memory allocated for buf is not freed in the error paths when
+ps_get_report() fails. Free buf before jumping to transfer_failed label
+
+Fixes: 947992c7fa9e ("HID: playstation: DS4: Fix calibration workaround for clone devices")
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Silvan Jegen <s.jegen@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-playstation.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c
+index 1468fb11e39df..657e9ae1be1ee 100644
+--- a/drivers/hid/hid-playstation.c
++++ b/drivers/hid/hid-playstation.c
+@@ -1807,6 +1807,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)
+
+ hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret);
+ ret = -EILSEQ;
++ kfree(buf);
+ goto transfer_failed;
+ } else {
+ break;
+@@ -1824,6 +1825,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)
+
+ if (ret) {
+ hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret);
++ kfree(buf);
+ goto transfer_failed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 58fe6b54ae0bc7949f820de6ac29efc222814339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 22:59:41 +0530
+Subject: HID: uclogic: Fix potential memory leak in error path
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+[ Upstream commit a78eb69d60ce893de48dd75f725ba21309131fc2 ]
+
+In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for
+event_hook is not freed in the next error path. Fix that by freeing it.
+
+Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection")
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-uclogic-params.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index ef26c7defcf61..89fa2610f02ba 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -1367,8 +1367,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev,
+ event_hook->hdev = hdev;
+ event_hook->size = ARRAY_SIZE(reconnect_event);
+ event_hook->event = kmemdup(reconnect_event, event_hook->size, GFP_KERNEL);
+- if (!event_hook->event)
++ if (!event_hook->event) {
++ kfree(event_hook);
+ return -ENOMEM;
++ }
+
+ list_add_tail(&event_hook->list, &p->event_hooks->list);
+
+--
+2.51.0
+
--- /dev/null
+From a7bc3271611fe35357892963f9cdca660deb387b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 14:12:31 +0800
+Subject: net: dsa: sja1105: fix kasan out-of-bounds warning in
+ sja1105_table_delete_entry()
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 5f2b28b79d2d1946ee36ad8b3dc0066f73c90481 ]
+
+There are actually 2 problems:
+- deleting the last element doesn't require the memmove of elements
+ [i + 1, end) over it. Actually, element i+1 is out of bounds.
+- The memmove itself should move size - i - 1 elements, because the last
+ element is out of bounds.
+
+The out-of-bounds element still remains out of bounds after being
+accessed, so the problem is only that we touch it, not that it becomes
+in active use. But I suppose it can lead to issues if the out-of-bounds
+element is part of an unmapped page.
+
+Fixes: 6666cebc5e30 ("net: dsa: sja1105: Add support for VLAN operations")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250318115716.2124395-4-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Chen Yu <xnguchen@sina.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_static_config.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_static_config.c b/drivers/net/dsa/sja1105/sja1105_static_config.c
+index baba204ad62f6..2ac91fe2a79bc 100644
+--- a/drivers/net/dsa/sja1105/sja1105_static_config.c
++++ b/drivers/net/dsa/sja1105/sja1105_static_config.c
+@@ -1921,8 +1921,10 @@ int sja1105_table_delete_entry(struct sja1105_table *table, int i)
+ if (i > table->entry_count)
+ return -ERANGE;
+
+- memmove(entries + i * entry_size, entries + (i + 1) * entry_size,
+- (table->entry_count - i) * entry_size);
++ if (i + 1 < table->entry_count) {
++ memmove(entries + i * entry_size, entries + (i + 1) * entry_size,
++ (table->entry_count - i - 1) * entry_size);
++ }
+
+ table->entry_count--;
+
+--
+2.51.0
+
sched_ext-fix-unsafe-locking-in-the-scx_dump_state.patch
revert-netfilter-nf_tables-reintroduce-shortened-del.patch
netfilter-nf_tables-reject-duplicate-device-on-updat.patch
+arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch
+arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch
+arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch
+hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch
+arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch
+hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch
+hid-uclogic-fix-potential-memory-leak-in-error-path.patch
+net-dsa-sja1105-fix-kasan-out-of-bounds-warning-in-s.patch
--- /dev/null
+From 65f61155752f83efb72ce68654f6d0029878fe1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 21:48:52 +0200
+Subject: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b ]
+
+Luxul XAP-1440 has BCM54210E PHY at address 25.
+
+Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
+index ac44c745bdf8e..a39a021a39107 100644
+--- a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
++++ b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
+@@ -55,8 +55,8 @@
+ mdio {
+ /delete-node/ switch@1e;
+
+- bcm54210e: ethernet-phy@0 {
+- reg = <0>;
++ bcm54210e: ethernet-phy@25 {
++ reg = <25>;
+ };
+ };
+ };
+--
+2.51.0
+
--- /dev/null
+From d59d0df8dff803aa67b4bd6641c8aff06576340b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 00:06:55 +0200
+Subject: ARM: dts: imx51-zii-rdu1: Fix audmux node names
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit f31e261712a0d107f09fb1d3dc8f094806149c83 ]
+
+Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the
+audmux configuration of imx51-zii-rdu1.dts to comply with the naming
+convention in imx-audmux.yaml.
+
+This fixes the following dt-schema warning:
+
+ imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2'
+ do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$'
+
+Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
+index 06545a6052f71..43ff5eafb2bb8 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
+@@ -259,7 +259,7 @@
+ pinctrl-0 = <&pinctrl_audmux>;
+ status = "okay";
+
+- ssi2 {
++ mux-ssi2 {
+ fsl,audmux-port = <1>;
+ fsl,port-config = <
+ (IMX_AUDMUX_V2_PTCR_SYN |
+@@ -271,7 +271,7 @@
+ >;
+ };
+
+- aud3 {
++ mux-aud3 {
+ fsl,audmux-port = <2>;
+ fsl,port-config = <
+ IMX_AUDMUX_V2_PTCR_SYN
+--
+2.51.0
+
--- /dev/null
+From 63bc8cf0ecbc79daca6ce47009c5db42d85634d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 11:16:31 +0200
+Subject: ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 62bf7708fe80ec0db14b9179c25eeeda9f81e9d0 ]
+
+The 'report-rate-hz' property for the edt-ft5x06 driver was added and
+handled in the Linux kernel by me with patches [1] and [2] for this
+specific board.
+
+The v1 upstream version, which was the one applied to the customer's
+kernel, used the 'report-rate' property, which was written directly to
+the controller register. During review, the 'hz' suffix was added,
+changing its handling so that writing the value directly to the register
+was no longer possible for the M06 controller.
+
+Once the patches were accepted in mainline, I did not reapply them to
+the customer's kernel, and when upstreaming the DTS for this board, I
+forgot to correct the 'report-rate-hz' property value.
+
+The property must be set to 60 because this board uses the M06 controller,
+which expects the report rate in units of 10 Hz, meaning the actual value
+written to the register is 6.
+
+[1] 625f829586ea ("dt-bindings: input: touchscreen: edt-ft5x06: add report-rate-hz")
+[2] 5bcee83a406c ("Input: edt-ft5x06 - set report rate by dts property")
+Fixes: ffea3cac94ba ("ARM: dts: imx6ul: support Engicam MicroGEA RMM board")
+Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts b/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts
+index 5d1cc8a1f5558..8d41f76ae270b 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts
++++ b/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts
+@@ -136,7 +136,7 @@
+ interrupt-parent = <&gpio2>;
+ interrupts = <8 IRQ_TYPE_EDGE_FALLING>;
+ reset-gpios = <&gpio2 14 GPIO_ACTIVE_LOW>;
+- report-rate-hz = <6>;
++ report-rate-hz = <60>;
+ /* settings valid only for Hycon touchscreen */
+ touchscreen-size-x = <1280>;
+ touchscreen-size-y = <800>;
+--
+2.51.0
+
--- /dev/null
+From a9678472258ef7fc727b7fa95d5baacf42cbb739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 09:56:43 -0300
+Subject: arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: João Paulo Gonçalves <joao.goncalves@toradex.com>
+
+[ Upstream commit ec4daace64a44b53df76f0629e82684ef09ce869 ]
+
+The gpio0_mipi_csi DT nodes are enabled by default, but they are
+dependent on the irqsteer_csi nodes, which are not enabled. This causes
+the gpio0_mipi_csi GPIOs to be probe deferred. Since these GPIOs can be
+used independently of the CSI controller, enable irqsteer_csi by default
+too to prevent them from being deferred and to ensure they work out of
+the box.
+
+Fixes: 2217f8243714 ("arm64: dts: imx8: add capture controller for i.MX8's img subsystem")
+Signed-off-by: João Paulo Gonçalves <joao.goncalves@toradex.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi
+index 2cf0f7208350a..a72b2f1c4a1b2 100644
+--- a/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi
+@@ -67,7 +67,6 @@ img_subsys: bus@58000000 {
+ power-domains = <&pd IMX_SC_R_CSI_0>;
+ fsl,channel = <0>;
+ fsl,num-irqs = <32>;
+- status = "disabled";
+ };
+
+ gpio0_mipi_csi0: gpio@58222000 {
+@@ -144,7 +143,6 @@ img_subsys: bus@58000000 {
+ power-domains = <&pd IMX_SC_R_CSI_1>;
+ fsl,channel = <0>;
+ fsl,num-irqs = <32>;
+- status = "disabled";
+ };
+
+ gpio0_mipi_csi1: gpio@58242000 {
+--
+2.51.0
+
--- /dev/null
+From 81a02694b7f529b1e6aa9014d318eda74dacbae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Oct 2025 15:21:51 +0200
+Subject: arm64: dts: imx8mp-kontron: Fix USB OTG role switching
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 6504297872c7a5d0d06247970d32940eba26b8b3 ]
+
+The VBUS supply regulator is currently assigned to the PHY node.
+This causes the VBUS to be always on, even when the controller
+needs to be switched to peripheral mode.
+
+Fix the OTG role switching by adding a connector node and moving
+the VBUS supply regulator to that node. This way the VBUS gets
+correctly switched according to the current role.
+
+Fixes: 946ab10e3f40 ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mp-kontron-bl-osm-s.dts | 24 +++++++++++++++----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts
+index 0eb9e726a9b81..6c63f0a5fa91b 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts
+@@ -16,11 +16,20 @@
+ ethernet1 = &eqos;
+ };
+
+- extcon_usbc: usbc {
+- compatible = "linux,extcon-usb-gpio";
++ connector {
++ compatible = "gpio-usb-b-connector", "usb-b-connector";
++ id-gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>;
++ label = "Type-C";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usb1_id>;
+- id-gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>;
++ type = "micro";
++ vbus-supply = <®_usb1_vbus>;
++
++ port {
++ usb_dr_connector: endpoint {
++ remote-endpoint = <&usb3_dwc>;
++ };
++ };
+ };
+
+ leds {
+@@ -230,9 +239,15 @@
+ hnp-disable;
+ srp-disable;
+ dr_mode = "otg";
+- extcon = <&extcon_usbc>;
+ usb-role-switch;
++ role-switch-default-mode = "peripheral";
+ status = "okay";
++
++ port {
++ usb3_dwc: endpoint {
++ remote-endpoint = <&usb_dr_connector>;
++ };
++ };
+ };
+
+ &usb_dwc3_1 {
+@@ -261,7 +276,6 @@
+ };
+
+ &usb3_phy0 {
+- vbus-supply = <®_usb1_vbus>;
+ status = "okay";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a69a2d6491a5a38b710e042cf103d79cbf14d443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Nov 2025 22:01:01 +0800
+Subject: arm64: dts: rockchip: drop reset from rk3576 i2c9 node
+
+From: Chukun Pan <amadeus@jmu.edu.cn>
+
+[ Upstream commit 264152a97edf9f1b7ed5372e4033e46108e41422 ]
+
+The reset property is not part of the binding, so drop it.
+It is also not used by the driver, so it was likely copied
+from some vendor-kernel node.
+
+Fixes: 57b1ce903966 ("arm64: dts: rockchip: Add rk3576 SoC base DT")
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Link: https://patch.msgid.link/20251101140101.302229-1-amadeus@jmu.edu.cn
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3576.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3576.dtsi b/arch/arm64/boot/dts/rockchip/rk3576.dtsi
+index c3cdae8a54941..f236edcac3767 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3576.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3576.dtsi
+@@ -2311,8 +2311,6 @@
+ interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c9m0_xfer>;
+- resets = <&cru SRST_I2C9>, <&cru SRST_P_I2C9>;
+- reset-names = "i2c", "apb";
+ #address-cells = <1>;
+ #size-cells = <0>;
+ status = "disabled";
+--
+2.51.0
+
--- /dev/null
+From bae4d258941f561c7e100d1ac86fb983332e5b61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 14:33:36 +0200
+Subject: arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2
+ and Pi2
+
+From: Andrey Leonchikov <andreil499@gmail.com>
+
+[ Upstream commit e179de737d13ad99bd19ea0fafab759d4074a425 ]
+
+Fix typo into regulator GPIO definition. With current definition, PCIe
+doesn't start up. Valid definition is already used in "pinctrl" section,
+"pcie_drv" (gpio4, RK_PB1).
+
+Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2")
+Signed-off-by: Andrey Leonchikov <andreil499@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi
+index 7f578c50b4ad1..f74590af7e33f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi
+@@ -120,7 +120,7 @@
+ compatible = "regulator-fixed";
+ regulator-name = "vcc3v3_pcie";
+ enable-active-high;
+- gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio4 RK_PB1 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pcie_drv>;
+ regulator-always-on;
+--
+2.51.0
+
--- /dev/null
+From f5a9928f6c39372643d0a161248c649230107855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Nov 2025 22:07:33 +0100
+Subject: arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2
+
+From: Andrey Leonchikov <andreil499@gmail.com>
+
+[ Upstream commit a59e927ff46a967f84ddf94e89cbb045810e8974 ]
+
+ Fix typo into regulator GPIO definition. With current
+ definition - USB powered off. Valid definition can be found on "pinctrl"
+ section:
+ vcc5v0_usb2t_en: vcc5v0-usb2t-en {
+ rockchip,pins = <3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+
+ vcc5v0_usb2b_en: vcc5v0-usb2b-en {
+ rockchip,pins = <4 RK_PC4 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+
+Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2")
+Signed-off-by: Andrey Leonchikov <andreil499@gmail.com>
+Link: https://patch.msgid.link/20251105210741.850031-1-andreil499@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi
+index f74590af7e33f..b6cf03a7ba66b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi
+@@ -187,7 +187,7 @@
+ vcc5v0_usb2b: regulator-vcc5v0-usb2b {
+ compatible = "regulator-fixed";
+ enable-active-high;
+- gpio = <&gpio0 RK_PC4 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio4 RK_PC4 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_usb2b_en>;
+ regulator-name = "vcc5v0_usb2b";
+@@ -199,7 +199,7 @@
+ vcc5v0_usb2t: regulator-vcc5v0-usb2t {
+ compatible = "regulator-fixed";
+ enable-active-high;
+- gpios = <&gpio0 RK_PD5 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio3 RK_PD5 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_usb2t_en>;
+ regulator-name = "vcc5v0_usb2t";
+--
+2.51.0
+
--- /dev/null
+From a16ebc8a789d1e545d60c550a9c638ee5b785c30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 12:01:22 +0200
+Subject: arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic
+
+From: Dragan Simic <dsimic@manjaro.org>
+
+[ Upstream commit b3fd04e23f6e4496f5a2279466a33fbdc83500f0 ]
+
+Unify the naming of the existing GPU OPP table nodes found in the RK3588
+and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following
+the more "modern" node naming scheme.
+
+Fixes: a7b2070505a2 ("arm64: dts: rockchip: Split GPU OPPs of RK3588 and RK3588j")
+Signed-off-by: Dragan Simic <dsimic@manjaro.org>
+[opp-table also is way too generic on systems with like 4-5 opp-tables]
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3588j.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi
+index 0f1a776973516..b5d630d2c879f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi
+@@ -115,7 +115,7 @@
+ };
+ };
+
+- gpu_opp_table: opp-table {
++ gpu_opp_table: opp-table-gpu {
+ compatible = "operating-points-v2";
+
+ opp-300000000 {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi
+index 9884a5df47dfe..e1e0e3fc0ca70 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi
+@@ -66,7 +66,7 @@
+ };
+ };
+
+- gpu_opp_table: opp-table {
++ gpu_opp_table: opp-table-gpu {
+ compatible = "operating-points-v2";
+
+ opp-300000000 {
+--
+2.51.0
+
--- /dev/null
+From 8713acede5efaca102d198c834676e0fbd0b2217 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:50:03 +0530
+Subject: arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on
+ odroid-m1
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+[ Upstream commit d425aef66e62221fa6bb0ccb94296df29e4cc107 ]
+
+Enable proper pin multiplexing for the I2S1 8-channel transmit interface by
+adding the default pinctrl configuration which esures correct signal routing
+and avoids pinmux conflicts during audio playback.
+
+Changes fix the error
+[ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s
+[ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s)
+[ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl
+[ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back
+
+I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0
+and SDO0 signals, so limit the claimed pins to those.
+
+With this change audio output works as expected:
+
+$ aplay -l
+**** List of PLAYBACK Hardware Devices ****
+card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0]
+ Subdevices: 1/1
+ Subdevice #0: subdevice #0
+card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0]
+ Subdevices: 1/1
+ Subdevice #0: subdevice #0
+
+Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1")
+Cc: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+[adapted the commit message a bit]
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
+index 0f844806ec542..442a2bc43ba8e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
+@@ -482,6 +482,8 @@
+ };
+
+ &i2s1_8ch {
++ pinctrl-names = "default";
++ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>;
+ rockchip,trcm-sync-tx-only;
+ status = "okay";
+ };
+--
+2.51.0
+
--- /dev/null
+From ad400f8ffd0ea667b34f2c2bdaa0b1612eb136d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 14:31:02 +0900
+Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
+
+From: Masami Ichikawa <masami256@gmail.com>
+
+[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
+
+Use a scope-based cleanup helper for the buffer allocated with kmalloc()
+in ntrig_report_version() to simplify the cleanup logic and prevent
+memory leaks (specifically the !hid_is_usb()-case one).
+
+[jkosina@suse.com: elaborate on the actual existing leak]
+Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
+Signed-off-by: Masami Ichikawa <masami256@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ntrig.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 0f76e241e0afb..a7f10c45f62bd 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
+ int ret;
+ char buf[20];
+ struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+- unsigned char *data = kmalloc(8, GFP_KERNEL);
++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
+
+ if (!hid_is_usb(hdev))
+ return;
+
+ if (!data)
+- goto err_free;
++ return;
+
+ ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
+ USB_REQ_CLEAR_FEATURE,
+@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
+ hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
+ buf, data[2], data[3], data[4], data[5]);
+ }
+-
+-err_free:
+- kfree(data);
+ }
+
+ static ssize_t show_phys_width(struct device *dev,
+--
+2.51.0
+
--- /dev/null
+From 74a86cc797ce6ca9b367e58b8c02ff72b3a5b147 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 22:45:50 +0530
+Subject: HID: playstation: Fix memory leak in
+ dualshock4_get_calibration_data()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+[ Upstream commit 8513c154f8ad7097653dd9bf43d6155e5aad4ab3 ]
+
+The memory allocated for buf is not freed in the error paths when
+ps_get_report() fails. Free buf before jumping to transfer_failed label
+
+Fixes: 947992c7fa9e ("HID: playstation: DS4: Fix calibration workaround for clone devices")
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Reviewed-by: Silvan Jegen <s.jegen@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-playstation.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c
+index 1468fb11e39df..657e9ae1be1ee 100644
+--- a/drivers/hid/hid-playstation.c
++++ b/drivers/hid/hid-playstation.c
+@@ -1807,6 +1807,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)
+
+ hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret);
+ ret = -EILSEQ;
++ kfree(buf);
+ goto transfer_failed;
+ } else {
+ break;
+@@ -1824,6 +1825,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4)
+
+ if (ret) {
+ hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret);
++ kfree(buf);
+ goto transfer_failed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From e91aaf7f3d5994e8642d61993197a5488285b2ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 22:59:41 +0530
+Subject: HID: uclogic: Fix potential memory leak in error path
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+[ Upstream commit a78eb69d60ce893de48dd75f725ba21309131fc2 ]
+
+In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for
+event_hook is not freed in the next error path. Fix that by freeing it.
+
+Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection")
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-uclogic-params.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index 4a17f7332c3f5..016d1f08bd1db 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -1369,8 +1369,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev,
+ event_hook->hdev = hdev;
+ event_hook->size = ARRAY_SIZE(reconnect_event);
+ event_hook->event = kmemdup(reconnect_event, event_hook->size, GFP_KERNEL);
+- if (!event_hook->event)
++ if (!event_hook->event) {
++ kfree(event_hook);
+ return -ENOMEM;
++ }
+
+ list_add_tail(&event_hook->list, &p->event_hooks->list);
+
+--
+2.51.0
+
--- /dev/null
+From 2ba8c8a957c2d9b34250bd1a0426311e16ccb917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Nov 2025 14:53:08 +0800
+Subject: pwm: adp5585: Correct mismatched pwm chip info
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luke Wang <ziniu.wang_1@nxp.com>
+
+[ Upstream commit f84fd5bec502447df145f31734793714690ce27f ]
+
+The register addresses of ADP5585 and ADP5589 are swapped.
+
+Fixes: 75024f97e82e ("pwm: adp5585: add support for adp5589")
+Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
+Acked-by: Nuno Sá <nuno.sa@analog.com>
+Tested-by: Liu Ying <victor.liu@nxp.com> # ADP5585 PWM
+Link: https://patch.msgid.link/20251114065308.2074893-1-ziniu.wang_1@nxp.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-adp5585.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-adp5585.c b/drivers/pwm/pwm-adp5585.c
+index dc2860979e24e..806f8d79b0d7b 100644
+--- a/drivers/pwm/pwm-adp5585.c
++++ b/drivers/pwm/pwm-adp5585.c
+@@ -190,13 +190,13 @@ static int adp5585_pwm_probe(struct platform_device *pdev)
+ return 0;
+ }
+
+-static const struct adp5585_pwm_chip adp5589_pwm_chip_info = {
++static const struct adp5585_pwm_chip adp5585_pwm_chip_info = {
+ .pwm_cfg = ADP5585_PWM_CFG,
+ .pwm_offt_low = ADP5585_PWM_OFFT_LOW,
+ .pwm_ont_low = ADP5585_PWM_ONT_LOW,
+ };
+
+-static const struct adp5585_pwm_chip adp5585_pwm_chip_info = {
++static const struct adp5585_pwm_chip adp5589_pwm_chip_info = {
+ .pwm_cfg = ADP5589_PWM_CFG,
+ .pwm_offt_low = ADP5589_PWM_OFFT_LOW,
+ .pwm_ont_low = ADP5589_PWM_ONT_LOW,
+--
+2.51.0
+
perf-lock-fix-segfault-due-to-missing-kernel-map.patch
perf-test-shell-lock_contention-extra-debug-diagnost.patch
perf-test-fix-lock-contention-test.patch
+arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch
+arm64-dts-rockchip-fix-pcie-power-enable-pin-for-big.patch
+arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch
+arm-dts-imx6ull-engicam-microgea-rmm-fix-report-rate.patch
+arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch
+arm64-dts-imx8-ss-img-avoid-gpio0_mipi_csi-gpios-bei.patch
+arm64-dts-imx8mp-kontron-fix-usb-otg-role-switching.patch
+hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch
+arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch
+arm64-dts-rockchip-fix-usb-power-enable-pin-for-btt-.patch
+arm64-dts-rockchip-drop-reset-from-rk3576-i2c9-node.patch
+pwm-adp5585-correct-mismatched-pwm-chip-info.patch
+hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch
+hid-uclogic-fix-potential-memory-leak-in-error-path.patch
--- /dev/null
+From 4719245e8b97fa950970578297f78924602ca8a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 21:48:52 +0200
+Subject: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b ]
+
+Luxul XAP-1440 has BCM54210E PHY at address 25.
+
+Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
+index ac44c745bdf8e..a39a021a39107 100644
+--- a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
++++ b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts
+@@ -55,8 +55,8 @@
+ mdio {
+ /delete-node/ switch@1e;
+
+- bcm54210e: ethernet-phy@0 {
+- reg = <0>;
++ bcm54210e: ethernet-phy@25 {
++ reg = <25>;
+ };
+ };
+ };
+--
+2.51.0
+
--- /dev/null
+From bf6840c07c4ea513798f7f899505fedd2e677c17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 00:06:55 +0200
+Subject: ARM: dts: imx51-zii-rdu1: Fix audmux node names
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit f31e261712a0d107f09fb1d3dc8f094806149c83 ]
+
+Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the
+audmux configuration of imx51-zii-rdu1.dts to comply with the naming
+convention in imx-audmux.yaml.
+
+This fixes the following dt-schema warning:
+
+ imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2'
+ do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$'
+
+Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
+index 5d4b29d765853..6cc4c2f08b15d 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts
+@@ -259,7 +259,7 @@
+ pinctrl-0 = <&pinctrl_audmux>;
+ status = "okay";
+
+- ssi2 {
++ mux-ssi2 {
+ fsl,audmux-port = <1>;
+ fsl,port-config = <
+ (IMX_AUDMUX_V2_PTCR_SYN |
+@@ -271,7 +271,7 @@
+ >;
+ };
+
+- aud3 {
++ mux-aud3 {
+ fsl,audmux-port = <2>;
+ fsl,port-config = <
+ IMX_AUDMUX_V2_PTCR_SYN
+--
+2.51.0
+
--- /dev/null
+From 885fb8b2c34d8f342191990e0c7c5aa09135900a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:50:03 +0530
+Subject: arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on
+ odroid-m1
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+[ Upstream commit d425aef66e62221fa6bb0ccb94296df29e4cc107 ]
+
+Enable proper pin multiplexing for the I2S1 8-channel transmit interface by
+adding the default pinctrl configuration which esures correct signal routing
+and avoids pinmux conflicts during audio playback.
+
+Changes fix the error
+[ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s
+[ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s)
+[ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl
+[ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back
+
+I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0
+and SDO0 signals, so limit the claimed pins to those.
+
+With this change audio output works as expected:
+
+$ aplay -l
+**** List of PLAYBACK Hardware Devices ****
+card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0]
+ Subdevices: 1/1
+ Subdevice #0: subdevice #0
+card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0]
+ Subdevices: 1/1
+ Subdevice #0: subdevice #0
+
+Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1")
+Cc: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+[adapted the commit message a bit]
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
+index 6a02db4f073f2..a5426b82552ed 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts
+@@ -482,6 +482,8 @@
+ };
+
+ &i2s1_8ch {
++ pinctrl-names = "default";
++ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>;
+ rockchip,trcm-sync-tx-only;
+ status = "okay";
+ };
+--
+2.51.0
+
--- /dev/null
+From 5035fbc97c00da0b8e0db75e9c8e1a9866f9d6b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 14:31:02 +0900
+Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
+
+From: Masami Ichikawa <masami256@gmail.com>
+
+[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
+
+Use a scope-based cleanup helper for the buffer allocated with kmalloc()
+in ntrig_report_version() to simplify the cleanup logic and prevent
+memory leaks (specifically the !hid_is_usb()-case one).
+
+[jkosina@suse.com: elaborate on the actual existing leak]
+Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
+Signed-off-by: Masami Ichikawa <masami256@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ntrig.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index a1128c5315fff..3c41f6841f775 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
+ int ret;
+ char buf[20];
+ struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+- unsigned char *data = kmalloc(8, GFP_KERNEL);
++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
+
+ if (!hid_is_usb(hdev))
+ return;
+
+ if (!data)
+- goto err_free;
++ return;
+
+ ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
+ USB_REQ_CLEAR_FEATURE,
+@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
+ hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
+ buf, data[2], data[3], data[4], data[5]);
+ }
+-
+-err_free:
+- kfree(data);
+ }
+
+ static ssize_t show_phys_width(struct device *dev,
+--
+2.51.0
+
--- /dev/null
+From 3fe4f44e02f0199944da63241c36305913b43c1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 22:59:41 +0530
+Subject: HID: uclogic: Fix potential memory leak in error path
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+[ Upstream commit a78eb69d60ce893de48dd75f725ba21309131fc2 ]
+
+In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for
+event_hook is not freed in the next error path. Fix that by freeing it.
+
+Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection")
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-uclogic-params.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index 9859dad36495a..eee05d668e361 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -1364,8 +1364,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev,
+ event_hook->hdev = hdev;
+ event_hook->size = ARRAY_SIZE(reconnect_event);
+ event_hook->event = kmemdup(reconnect_event, event_hook->size, GFP_KERNEL);
+- if (!event_hook->event)
++ if (!event_hook->event) {
++ kfree(event_hook);
+ return -ENOMEM;
++ }
+
+ list_add_tail(&event_hook->list, &p->event_hooks->list);
+
+--
+2.51.0
+
bluetooth-hci_sync-fix-double-free-in-hci_discovery_.patch
mtd-onenand-pass-correct-pointer-to-irq-handler.patch
netfilter-nf_tables-reject-duplicate-device-on-updat.patch
+arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch
+arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch
+hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch
+arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch
+hid-uclogic-fix-potential-memory-leak-in-error-path.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
