From: Greg Kroah-Hartman Date: Wed, 15 Oct 2025 11:08:45 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.15.195~113 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=07c49c00334d0f6d65ce96eceeb995dffd5a54ec;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch --- diff --git a/queue-6.6/asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch b/queue-6.6/asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch new file mode 100644 index 0000000000..270dc94605 --- /dev/null +++ b/queue-6.6/asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch @@ -0,0 +1,286 @@ +From 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 Mon Sep 17 00:00:00 2001 +From: Varad Gautam +Date: Sun, 30 Mar 2025 16:42:29 +0000 +Subject: asm-generic/io.h: Skip trace helpers if rwmmio events are disabled + +From: Varad Gautam + +commit 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 upstream. + +With `CONFIG_TRACE_MMIO_ACCESS=y`, the `{read,write}{b,w,l,q}{_relaxed}()` +mmio accessors unconditionally call `log_{post_}{read,write}_mmio()` +helpers, which in turn call the ftrace ops for `rwmmio` trace events + +This adds a performance penalty per mmio accessor call, even when +`rwmmio` events are disabled at runtime (~80% overhead on local +measurement). + +Guard these with `tracepoint_enabled()`. + +Signed-off-by: Varad Gautam +Fixes: 210031971cdd ("asm-generic/io: Add logging support for MMIO accessors") +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + include/asm-generic/io.h | 98 +++++++++++++++++++++++++++++++---------------- + 1 file changed, 66 insertions(+), 32 deletions(-) + +--- a/include/asm-generic/io.h ++++ b/include/asm-generic/io.h +@@ -74,6 +74,7 @@ + #if IS_ENABLED(CONFIG_TRACE_MMIO_ACCESS) && !(defined(__DISABLE_TRACE_MMIO__)) + #include + ++#define rwmmio_tracepoint_enabled(tracepoint) tracepoint_enabled(tracepoint) + DECLARE_TRACEPOINT(rwmmio_write); + DECLARE_TRACEPOINT(rwmmio_post_write); + DECLARE_TRACEPOINT(rwmmio_read); +@@ -90,6 +91,7 @@ void log_post_read_mmio(u64 val, u8 widt + + #else + ++#define rwmmio_tracepoint_enabled(tracepoint) false + static inline void log_write_mmio(u64 val, u8 width, volatile void __iomem *addr, + unsigned long caller_addr, unsigned long caller_addr0) {} + static inline void log_post_write_mmio(u64 val, u8 width, volatile void __iomem *addr, +@@ -188,11 +190,13 @@ static inline u8 readb(const volatile vo + { + u8 val; + +- log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __raw_readb(addr); + __io_ar(val); +- log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -203,11 +207,13 @@ static inline u16 readw(const volatile v + { + u16 val; + +- log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __le16_to_cpu((__le16 __force)__raw_readw(addr)); + __io_ar(val); +- log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -218,11 +224,13 @@ static inline u32 readl(const volatile v + { + u32 val; + +- log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __le32_to_cpu((__le32 __force)__raw_readl(addr)); + __io_ar(val); +- log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -234,11 +242,13 @@ static inline u64 readq(const volatile v + { + u64 val; + +- log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); + __io_br(); + val = __le64_to_cpu((__le64 __force)__raw_readq(addr)); + __io_ar(val); +- log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -248,11 +258,13 @@ static inline u64 readq(const volatile v + #define writeb writeb + static inline void writeb(u8 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writeb(value, addr); + __io_aw(); +- log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -260,11 +272,13 @@ static inline void writeb(u8 value, vola + #define writew writew + static inline void writew(u16 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writew((u16 __force)cpu_to_le16(value), addr); + __io_aw(); +- log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -272,11 +286,13 @@ static inline void writew(u16 value, vol + #define writel writel + static inline void writel(u32 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writel((u32 __force)__cpu_to_le32(value), addr); + __io_aw(); +- log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -285,11 +301,13 @@ static inline void writel(u32 value, vol + #define writeq writeq + static inline void writeq(u64 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + __io_bw(); + __raw_writeq((u64 __force)__cpu_to_le64(value), addr); + __io_aw(); +- log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + } + #endif + #endif /* CONFIG_64BIT */ +@@ -305,9 +323,11 @@ static inline u8 readb_relaxed(const vol + { + u8 val; + +- log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(8, addr, _THIS_IP_, _RET_IP_); + val = __raw_readb(addr); +- log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 8, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -318,9 +338,11 @@ static inline u16 readw_relaxed(const vo + { + u16 val; + +- log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(16, addr, _THIS_IP_, _RET_IP_); + val = __le16_to_cpu((__le16 __force)__raw_readw(addr)); +- log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 16, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -331,9 +353,11 @@ static inline u32 readl_relaxed(const vo + { + u32 val; + +- log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(32, addr, _THIS_IP_, _RET_IP_); + val = __le32_to_cpu((__le32 __force)__raw_readl(addr)); +- log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 32, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -344,9 +368,11 @@ static inline u64 readq_relaxed(const vo + { + u64 val; + +- log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_read)) ++ log_read_mmio(64, addr, _THIS_IP_, _RET_IP_); + val = __le64_to_cpu((__le64 __force)__raw_readq(addr)); +- log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_read)) ++ log_post_read_mmio(val, 64, addr, _THIS_IP_, _RET_IP_); + return val; + } + #endif +@@ -355,9 +381,11 @@ static inline u64 readq_relaxed(const vo + #define writeb_relaxed writeb_relaxed + static inline void writeb_relaxed(u8 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + __raw_writeb(value, addr); +- log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 8, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -365,9 +393,11 @@ static inline void writeb_relaxed(u8 val + #define writew_relaxed writew_relaxed + static inline void writew_relaxed(u16 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + __raw_writew((u16 __force)cpu_to_le16(value), addr); +- log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 16, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -375,9 +405,11 @@ static inline void writew_relaxed(u16 va + #define writel_relaxed writel_relaxed + static inline void writel_relaxed(u32 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + __raw_writel((u32 __force)__cpu_to_le32(value), addr); +- log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 32, addr, _THIS_IP_, _RET_IP_); + } + #endif + +@@ -385,9 +417,11 @@ static inline void writel_relaxed(u32 va + #define writeq_relaxed writeq_relaxed + static inline void writeq_relaxed(u64 value, volatile void __iomem *addr) + { +- log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_write)) ++ log_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + __raw_writeq((u64 __force)__cpu_to_le64(value), addr); +- log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); ++ if (rwmmio_tracepoint_enabled(rwmmio_post_write)) ++ log_post_write_mmio(value, 64, addr, _THIS_IP_, _RET_IP_); + } + #endif + diff --git a/queue-6.6/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch b/queue-6.6/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch new file mode 100644 index 0000000000..15590d7f71 --- /dev/null +++ b/queue-6.6/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch @@ -0,0 +1,67 @@ +From cd32e596f02fc981674573402c1138f616df1728 Mon Sep 17 00:00:00 2001 +From: Zhen Ni +Date: Thu, 14 Aug 2025 20:33:24 +0800 +Subject: clocksource/drivers/clps711x: Fix resource leaks in error paths + +From: Zhen Ni + +commit cd32e596f02fc981674573402c1138f616df1728 upstream. + +The current implementation of clps711x_timer_init() has multiple error +paths that directly return without releasing the base I/O memory mapped +via of_iomap(). Fix of_iomap leaks in error paths. + +Fixes: 04410efbb6bc ("clocksource/drivers/clps711x: Convert init function to return error") +Fixes: 2a6a8e2d9004 ("clocksource/drivers/clps711x: Remove board support") +Signed-off-by: Zhen Ni +Signed-off-by: Daniel Lezcano +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250814123324.1516495-1-zhen.ni@easystack.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +--- a/drivers/clocksource/clps711x-timer.c ++++ b/drivers/clocksource/clps711x-timer.c +@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(st + unsigned int irq = irq_of_parse_and_map(np, 0); + struct clk *clock = of_clk_get(np, 0); + void __iomem *base = of_iomap(np, 0); ++ int ret = 0; + + if (!base) + return -ENOMEM; +- if (!irq) +- return -EINVAL; +- if (IS_ERR(clock)) +- return PTR_ERR(clock); ++ if (!irq) { ++ ret = -EINVAL; ++ goto unmap_io; ++ } ++ if (IS_ERR(clock)) { ++ ret = PTR_ERR(clock); ++ goto unmap_io; ++ } + + switch (of_alias_get_id(np, "timer")) { + case CLPS711X_CLKSRC_CLOCKSOURCE: + clps711x_clksrc_init(clock, base); + break; + case CLPS711X_CLKSRC_CLOCKEVENT: +- return _clps711x_clkevt_init(clock, base, irq); ++ ret = _clps711x_clkevt_init(clock, base, irq); ++ break; + default: +- return -EINVAL; ++ ret = -EINVAL; ++ break; + } + +- return 0; ++unmap_io: ++ iounmap(base); ++ return ret; + } + TIMER_OF_DECLARE(clps711x, "cirrus,ep7209-timer", clps711x_timer_init); diff --git a/queue-6.6/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch b/queue-6.6/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch new file mode 100644 index 0000000000..f9badfca3a --- /dev/null +++ b/queue-6.6/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch @@ -0,0 +1,37 @@ +From 1d8fdabe19267338f29b58f968499e5b55e6a3b6 Mon Sep 17 00:00:00 2001 +From: Michael Hennerich +Date: Fri, 29 Aug 2025 12:25:43 +0100 +Subject: iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Hennerich + +commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream. + +The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it +accordingly. + +Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers") +Signed-off-by: Michael Hennerich +Signed-off-by: Nuno Sá +Link: https://patch.msgid.link/20250829-adf4350-fix-v2-2-0bf543ba797d@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/iio/frequency/adf4350.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/iio/frequency/adf4350.h ++++ b/include/linux/iio/frequency/adf4350.h +@@ -51,7 +51,7 @@ + + /* REG3 Bit Definitions */ + #define ADF4350_REG3_12BIT_CLKDIV(x) ((x) << 3) +-#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 16) ++#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 15) + #define ADF4350_REG3_12BIT_CSR_EN (1 << 18) + #define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21) + #define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22) diff --git a/queue-6.6/kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch b/queue-6.6/kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch new file mode 100644 index 0000000000..3ea777207f --- /dev/null +++ b/queue-6.6/kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch @@ -0,0 +1,84 @@ +From 68e61f6fd65610e73b17882f86fedfd784d99229 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 11 Jul 2025 10:27:46 -0700 +Subject: KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 + +From: Sean Christopherson + +commit 68e61f6fd65610e73b17882f86fedfd784d99229 upstream. + +Emulate PERF_CNTR_GLOBAL_STATUS_SET when PerfMonV2 is enumerated to the +guest, as the MSR is supposed to exist in all AMD v2 PMUs. + +Fixes: 4a2771895ca6 ("KVM: x86/svm/pmu: Add AMD PerfMonV2 support") +Cc: stable@vger.kernel.org +Cc: Sandipan Das +Link: https://lore.kernel.org/r/20250711172746.1579423-1-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/msr-index.h | 1 + + arch/x86/kvm/pmu.c | 5 +++++ + arch/x86/kvm/svm/pmu.c | 1 + + arch/x86/kvm/x86.c | 2 ++ + 4 files changed, 9 insertions(+) + +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -661,6 +661,7 @@ + #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS 0xc0000300 + #define MSR_AMD64_PERF_CNTR_GLOBAL_CTL 0xc0000301 + #define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR 0xc0000302 ++#define MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET 0xc0000303 + + /* AMD Last Branch Record MSRs */ + #define MSR_AMD64_LBR_SELECT 0xc000010e +--- a/arch/x86/kvm/pmu.c ++++ b/arch/x86/kvm/pmu.c +@@ -588,6 +588,7 @@ int kvm_pmu_get_msr(struct kvm_vcpu *vcp + msr_info->data = pmu->global_ctrl; + break; + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: + case MSR_CORE_PERF_GLOBAL_OVF_CTRL: + msr_info->data = 0; + break; +@@ -649,6 +650,10 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcp + if (!msr_info->host_initiated) + pmu->global_status &= ~data; + break; ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: ++ if (!msr_info->host_initiated) ++ pmu->global_status |= data & ~pmu->global_status_rsvd; ++ break; + default: + kvm_pmu_mark_pmc_in_use(vcpu, msr_info->index); + return static_call(kvm_x86_pmu_set_msr)(vcpu, msr_info); +--- a/arch/x86/kvm/svm/pmu.c ++++ b/arch/x86/kvm/svm/pmu.c +@@ -117,6 +117,7 @@ static bool amd_is_valid_msr(struct kvm_ + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS: + case MSR_AMD64_PERF_CNTR_GLOBAL_CTL: + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: + return pmu->version > 1; + default: + if (msr > MSR_F15H_PERF_CTR5 && +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1495,6 +1495,7 @@ static const u32 msrs_to_save_pmu[] = { + MSR_AMD64_PERF_CNTR_GLOBAL_CTL, + MSR_AMD64_PERF_CNTR_GLOBAL_STATUS, + MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR, ++ MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET, + }; + + static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_base) + +@@ -7194,6 +7195,7 @@ static void kvm_probe_msr_to_save(u32 ms + case MSR_AMD64_PERF_CNTR_GLOBAL_CTL: + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS: + case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_CLR: ++ case MSR_AMD64_PERF_CNTR_GLOBAL_STATUS_SET: + if (!kvm_cpu_cap_has(X86_FEATURE_PERFMON_V2)) + return; + break; diff --git a/queue-6.6/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch b/queue-6.6/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch new file mode 100644 index 0000000000..83ae4e5777 --- /dev/null +++ b/queue-6.6/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch @@ -0,0 +1,68 @@ +From f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Fri, 8 Aug 2025 11:59:15 +0300 +Subject: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() + +From: Tomi Valkeinen + +commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream. + +v4l2_subdev_call_state_try() macro allocates a subdev state with +__v4l2_subdev_state_alloc(), but does not check the returned value. If +__v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would +cause v4l2_subdev_call_state_try() to crash. + +Add proper error handling to v4l2_subdev_call_state_try(). + +Signed-off-by: Tomi Valkeinen +Fixes: 982c0487185b ("media: subdev: Add v4l2_subdev_call_state_try() macro") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/aJTNtpDUbTz7eyJc%40stanley.mountain/ +Cc: stable@vger.kernel.org +Reviewed-by: Dan Carpenter +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + include/media/v4l2-subdev.h | 30 +++++++++++++++++------------- + 1 file changed, 17 insertions(+), 13 deletions(-) + +--- a/include/media/v4l2-subdev.h ++++ b/include/media/v4l2-subdev.h +@@ -1881,19 +1881,23 @@ extern const struct v4l2_subdev_ops v4l2 + * + * Note: only legacy non-MC drivers may need this macro. + */ +-#define v4l2_subdev_call_state_try(sd, o, f, args...) \ +- ({ \ +- int __result; \ +- static struct lock_class_key __key; \ +- const char *name = KBUILD_BASENAME \ +- ":" __stringify(__LINE__) ":state->lock"; \ +- struct v4l2_subdev_state *state = \ +- __v4l2_subdev_state_alloc(sd, name, &__key); \ +- v4l2_subdev_lock_state(state); \ +- __result = v4l2_subdev_call(sd, o, f, state, ##args); \ +- v4l2_subdev_unlock_state(state); \ +- __v4l2_subdev_state_free(state); \ +- __result; \ ++#define v4l2_subdev_call_state_try(sd, o, f, args...) \ ++ ({ \ ++ int __result; \ ++ static struct lock_class_key __key; \ ++ const char *name = KBUILD_BASENAME \ ++ ":" __stringify(__LINE__) ":state->lock"; \ ++ struct v4l2_subdev_state *state = \ ++ __v4l2_subdev_state_alloc(sd, name, &__key); \ ++ if (IS_ERR(state)) { \ ++ __result = PTR_ERR(state); \ ++ } else { \ ++ v4l2_subdev_lock_state(state); \ ++ __result = v4l2_subdev_call(sd, o, f, state, ##args); \ ++ v4l2_subdev_unlock_state(state); \ ++ __v4l2_subdev_state_free(state); \ ++ } \ ++ __result; \ + }) + + /** diff --git a/queue-6.6/series b/queue-6.6/series index 04bfff757d..bdbd8be7be 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1,2 +1,7 @@ fs-always-return-zero-on-success-from-replace_fd.patch fscontext-do-not-consume-log-entries-when-returning-emsgsize.patch +clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch +kvm-svm-emulate-perf_cntr_global_status_set-for-perfmonv2.patch +iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch +media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch +asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch