--- /dev/null
+From 8d35217149daa33358c284aca6a56d5ab92cfc6c Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Date: Fri, 15 Dec 2023 03:32:22 +0200
+Subject: drm/msm/mdss: specify cfg bandwidth for SDM670
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+commit 8d35217149daa33358c284aca6a56d5ab92cfc6c upstream.
+
+Lower the requested CFG bus bandwidth for the SDM670 platform. The
+default value is 153600 kBps, which is twice as big as required by the
+platform according to the vendor kernel.
+
+Fixes: a55c8ff252d3 ("drm/msm/mdss: Handle the reg bus ICC path")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Tested-by: Richard Acayan <mailingradian@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/572182/
+Link: https://lore.kernel.org/r/20231215013222.827975-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/msm_mdss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/msm/msm_mdss.c
++++ b/drivers/gpu/drm/msm/msm_mdss.c
+@@ -600,6 +600,7 @@ static const struct msm_mdss_data sm6125
+ .ubwc_dec_version = UBWC_3_0,
+ .ubwc_swizzle = 1,
+ .highest_bank_bit = 1,
++ .reg_bus_bw = 76800,
+ };
+
+ static const struct msm_mdss_data sm8250_data = {
--- /dev/null
+From de8ac5696ebc3a2d89c88b70aa3996ee112e76ef Mon Sep 17 00:00:00 2001
+From: Jianhua Lu <lujianhua000@gmail.com>
+Date: Fri, 12 Jan 2024 22:00:47 +0800
+Subject: drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
+
+From: Jianhua Lu <lujianhua000@gmail.com>
+
+commit de8ac5696ebc3a2d89c88b70aa3996ee112e76ef upstream.
+
+After commit e6c0de5f4450 ("drm/msm/dpu: try multirect based on mdp clock limits")
+merged, 120Hz is working on xiaomi,elish panels, so feature it.
+
+Signed-off-by: Jianhua Lu <lujianhua000@gmail.com>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Link: https://lore.kernel.org/r/20240112140047.18123-1-lujianhua000@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240112140047.18123-1-lujianhua000@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt36523.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-novatek-nt36523.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt36523.c
+@@ -935,8 +935,7 @@ static int j606f_boe_init_sequence(struc
+
+ static const struct drm_display_mode elish_boe_modes[] = {
+ {
+- /* There is only one 120 Hz timing, but it doesn't work perfectly, 104 Hz preferred */
+- .clock = (1600 + 60 + 8 + 60) * (2560 + 26 + 4 + 168) * 104 / 1000,
++ .clock = (1600 + 60 + 8 + 60) * (2560 + 26 + 4 + 168) * 120 / 1000,
+ .hdisplay = 1600,
+ .hsync_start = 1600 + 60,
+ .hsync_end = 1600 + 60 + 8,
+@@ -950,8 +949,7 @@ static const struct drm_display_mode eli
+
+ static const struct drm_display_mode elish_csot_modes[] = {
+ {
+- /* There is only one 120 Hz timing, but it doesn't work perfectly, 104 Hz preferred */
+- .clock = (1600 + 200 + 40 + 52) * (2560 + 26 + 4 + 168) * 104 / 1000,
++ .clock = (1600 + 200 + 40 + 52) * (2560 + 26 + 4 + 168) * 120 / 1000,
+ .hdisplay = 1600,
+ .hsync_start = 1600 + 200,
+ .hsync_end = 1600 + 200 + 40,
--- /dev/null
+From a94ff8e50c20bde6d50864849a98b106e45d30c6 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 23 May 2024 17:47:14 +0200
+Subject: hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit a94ff8e50c20bde6d50864849a98b106e45d30c6 upstream.
+
+A new error path was added to the fwnode_for_each_available_node() loop
+in ltc2992_parse_dt(), which leads to an early return that requires a
+call to fwnode_handle_put() to avoid a memory leak in that case.
+
+Add the missing fwnode_handle_put() in the error path from a zero value
+shunt resistor.
+
+Cc: stable@vger.kernel.org
+Fixes: 10b029020487 ("hwmon: (ltc2992) Avoid division by zero")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://lore.kernel.org/r/20240523-fwnode_for_each_available_child_node_scoped-v2-1-701f3a03f2fb@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/ltc2992.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/ltc2992.c
++++ b/drivers/hwmon/ltc2992.c
+@@ -876,9 +876,11 @@ static int ltc2992_parse_dt(struct ltc29
+
+ ret = fwnode_property_read_u32(child, "shunt-resistor-micro-ohms", &val);
+ if (!ret) {
+- if (!val)
++ if (!val) {
++ fwnode_handle_put(child);
+ return dev_err_probe(&st->client->dev, -EINVAL,
+ "shunt resistor value cannot be zero\n");
++ }
+ st->r_sense_uohm[addr] = val;
+ }
+ }
--- /dev/null
+From 8c898ec07a2fc1d4694e81097a48e94a3816308d Mon Sep 17 00:00:00 2001
+From: Jithu Joseph <jithu.joseph@intel.com>
+Date: Thu, 25 Jan 2024 00:22:50 -0800
+Subject: platform/x86/intel/ifs: Call release_firmware() when handling errors.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jithu Joseph <jithu.joseph@intel.com>
+
+commit 8c898ec07a2fc1d4694e81097a48e94a3816308d upstream.
+
+Missing release_firmware() due to error handling blocked any future image
+loading.
+
+Fix the return code and release_fiwmare() to release the bad image.
+
+Fixes: 25a76dbb36dd ("platform/x86/intel/ifs: Validate image size")
+Reported-by: Pengfei Xu <pengfei.xu@intel.com>
+Signed-off-by: Jithu Joseph <jithu.joseph@intel.com>
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Tested-by: Pengfei Xu <pengfei.xu@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240125082254.424859-2-ashok.raj@intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel/ifs/load.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/intel/ifs/load.c
++++ b/drivers/platform/x86/intel/ifs/load.c
+@@ -279,7 +279,8 @@ int ifs_load_firmware(struct device *dev
+ if (fw->size != expected_size) {
+ dev_err(dev, "File size mismatch (expected %u, actual %zu). Corrupted IFS image.\n",
+ expected_size, fw->size);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto release;
+ }
+
+ ret = image_sanity_check(dev, (struct microcode_header_intel *)fw->data);
--- /dev/null
+From 8f4bdbc8e99db6ec9cb0520748e49a2f2d7d1727 Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@amd.com>
+Date: Wed, 11 Oct 2023 13:18:38 -0600
+Subject: Revert "drm/amd/display: Validate hw_points_num before using it"
+
+From: Alex Hung <alex.hung@amd.com>
+
+commit 8f4bdbc8e99db6ec9cb0520748e49a2f2d7d1727 upstream.
+
+This reverts commit 58c3b3341cea4f75dc8c003b89f8a6dd8ec55e50.
+
+[WHY & HOW]
+The writeback series cause a regression in thunderbolt display.
+
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
+@@ -243,9 +243,6 @@ static bool dwb3_program_ogam_lut(
+ return false;
+ }
+
+- if (params->hw_points_num == 0)
+- return false;
+-
+ REG_SET(DWB_OGAM_CONTROL, 0, DWB_OGAM_MODE, 2);
+
+ current_mode = dwb3_get_ogam_current(dwbc30);
--- /dev/null
+From dddc00f255415b826190cfbaa5d6dbc87cd9ded1 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 5 Oct 2023 10:51:04 +0200
+Subject: Revert "usb: gadget: uvc: cleanup request when not in correct state"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit dddc00f255415b826190cfbaa5d6dbc87cd9ded1 upstream.
+
+This reverts commit 52a39f2cf62bb5430ad1f54cd522dbfdab1d71ba.
+
+Based on review comments, it was applied too soon and needs more work.
+
+Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/20231005081716.GA13853@pendragon.ideasonboard.com
+Cc: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -259,12 +259,6 @@ uvc_video_complete(struct usb_ep *ep, st
+ struct uvc_device *uvc = video->uvc;
+ unsigned long flags;
+
+- if (uvc->state == UVC_STATE_CONNECTED) {
+- usb_ep_free_request(video->ep, ureq->req);
+- ureq->req = NULL;
+- return;
+- }
+-
+ switch (req->status) {
+ case 0:
+ break;
mptcp-pm-avoid-possible-uaf-when-selecting-endp.patch
selftests-mptcp-join-validate-fullmesh-endp-on-1st-sf.patch
selftests-mptcp-join-check-re-using-id-of-closed-subflow.patch
+revert-usb-gadget-uvc-cleanup-request-when-not-in-correct-state.patch
+revert-drm-amd-display-validate-hw_points_num-before-using-it.patch
+platform-x86-intel-ifs-call-release_firmware-when-handling-errors.patch
+tcp-do-not-export-tcp_twsk_purge.patch
+hwmon-ltc2992-fix-memory-leak-in-ltc2992_parse_dt.patch
+drm-msm-mdss-specify-cfg-bandwidth-for-sdm670.patch
+drm-panel-nt36523-set-120hz-fps-for-xiaomi-elish-panels.patch
--- /dev/null
+From c51db4ac10d57c366f9a92121e3889bfc6c324cd Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 19 Apr 2024 07:19:42 +0000
+Subject: tcp: do not export tcp_twsk_purge()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit c51db4ac10d57c366f9a92121e3889bfc6c324cd upstream.
+
+After commit 1eeb50435739 ("tcp/dccp: do not care about
+families in inet_twsk_purge()") tcp_twsk_purge() is
+no longer potentially called from a module.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_minisocks.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -378,7 +378,6 @@ void tcp_twsk_purge(struct list_head *ne
+ }
+ }
+ }
+-EXPORT_SYMBOL_GPL(tcp_twsk_purge);
+
+ /* Warning : This function is called without sk_listener being locked.
+ * Be sure to read socket fields once, as their value could change under us.