From: Greg Kroah-Hartman Date: Fri, 15 May 2026 06:03:53 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.10.256~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=958e43052c4a2488f770565de3179a6b67b23bfb;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: hid-playstation-clamp-num_touch_reports.patch media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch media-rc-streamzap-error-handling-in-probe.patch media-rc-xbox_remote-heed-dma-restrictions.patch media-saa7164-add-ioremap-return-checks-and-cleanups.patch media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch regulator-act8945a-fix-of-node-reference-imbalance.patch regulator-bd9571mwv-fix-of-node-reference-imbalance.patch regulator-max77650-fix-of-node-reference-imbalance.patch regulator-mt6357-fix-of-node-reference-imbalance.patch regulator-rk808-fix-of-node-reference-imbalance.patch spi-at91-usart-fix-controller-deregistration.patch spi-atmel-fix-controller-deregistration.patch spi-bcm63xx-fix-controller-deregistration.patch spi-lantiq-ssc-fix-controller-deregistration.patch spi-qup-fix-controller-deregistration.patch staging-media-atomisp-disallow-all-private-ioctls.patch --- diff --git a/queue-6.6/hid-playstation-clamp-num_touch_reports.patch b/queue-6.6/hid-playstation-clamp-num_touch_reports.patch new file mode 100644 index 0000000000..00a7a029d8 --- /dev/null +++ b/queue-6.6/hid-playstation-clamp-num_touch_reports.patch @@ -0,0 +1,50 @@ +From cac61b58a3b6340c52afa06bb15eac033158db2f Mon Sep 17 00:00:00 2001 +From: "T.J. Mercier" +Date: Fri, 17 Apr 2026 08:47:02 -0700 +Subject: HID: playstation: Clamp num_touch_reports + +From: T.J. Mercier + +commit cac61b58a3b6340c52afa06bb15eac033158db2f upstream. + +A device would never lie about the number of touch reports would it? + +If it does the loop in dualshock4_parse_report will read off the end of +the touch_reports array, up to about 2 KiB for the maximum number of 256 +loop iteraions. The data that is read is emitted via evdev if the +DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by +clamping the num_touch_reports value provided by the device to the +maximum size of the touch_reports array. + +Fixes: 752038248808 ("HID: playstation: add DualShock4 touchpad support.") +Cc: stable@vger.kernel.org +Reported-by: Xingyu Jin +Signed-off-by: T.J. Mercier +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-playstation.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-playstation.c ++++ b/drivers/hid/hid-playstation.c +@@ -2200,7 +2200,8 @@ static int dualshock4_parse_report(struc + struct dualshock4_input_report_usb *usb = (struct dualshock4_input_report_usb *)data; + + ds4_report = &usb->common; +- num_touch_reports = usb->num_touch_reports; ++ num_touch_reports = min_t(u8, usb->num_touch_reports, ++ ARRAY_SIZE(usb->touch_reports)); + touch_reports = usb->touch_reports; + } else if (hdev->bus == BUS_BLUETOOTH && report->id == DS4_INPUT_REPORT_BT && + size == DS4_INPUT_REPORT_BT_SIZE) { +@@ -2214,7 +2215,8 @@ static int dualshock4_parse_report(struc + } + + ds4_report = &bt->common; +- num_touch_reports = bt->num_touch_reports; ++ num_touch_reports = min_t(u8, bt->num_touch_reports, ++ ARRAY_SIZE(bt->touch_reports)); + touch_reports = bt->touch_reports; + } else { + hid_err(hdev, "Unhandled reportID=%d\n", report->id); diff --git a/queue-6.6/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch b/queue-6.6/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch new file mode 100644 index 0000000000..b42723db2f --- /dev/null +++ b/queue-6.6/media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch @@ -0,0 +1,45 @@ +From f75e160745663ce9b13362ae6e90bd439c58df69 Mon Sep 17 00:00:00 2001 +From: Alexander Koskovich +Date: Thu, 12 Mar 2026 17:16:20 +0000 +Subject: media: i2c: ov8856: free control handler on error in ov8856_init_controls() + +From: Alexander Koskovich + +commit f75e160745663ce9b13362ae6e90bd439c58df69 upstream. + +The control handler wasn't freed if adding controls failed, add an error +exit label and convert the existing error return to use it. + +Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor") +Cc: stable@vger.kernel.org +Signed-off-by: Alexander Koskovich +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ov8856.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/ov8856.c ++++ b/drivers/media/i2c/ov8856.c +@@ -1954,12 +1954,18 @@ static int ov8856_init_controls(struct o + V4L2_CID_HFLIP, 0, 1, 1, 0); + v4l2_ctrl_new_std(ctrl_hdlr, &ov8856_ctrl_ops, + V4L2_CID_VFLIP, 0, 1, 1, 0); +- if (ctrl_hdlr->error) +- return ctrl_hdlr->error; ++ if (ctrl_hdlr->error) { ++ ret = ctrl_hdlr->error; ++ goto err_ctrl_handler_free; ++ } + + ov8856->sd.ctrl_handler = ctrl_hdlr; + + return 0; ++ ++err_ctrl_handler_free: ++ v4l2_ctrl_handler_free(ctrl_hdlr); ++ return ret; + } + + static void ov8856_update_pad_format(struct ov8856 *ov8856, diff --git a/queue-6.6/media-rc-streamzap-error-handling-in-probe.patch b/queue-6.6/media-rc-streamzap-error-handling-in-probe.patch new file mode 100644 index 0000000000..d5495be003 --- /dev/null +++ b/queue-6.6/media-rc-streamzap-error-handling-in-probe.patch @@ -0,0 +1,54 @@ +From 42844992664f03ef9f930e64f7370fa481e9c267 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:06:21 +0100 +Subject: media: rc: streamzap: Error handling in probe + +From: Oliver Neukum + +commit 42844992664f03ef9f930e64f7370fa481e9c267 upstream. + +If submitting the URB fails, the device will be unusable. +Probe() must fail. + +Fixes: 7a569f524dd36 ("V4L/DVB: IR/streamzap: functional in-kernel decoding") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/streamzap.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/streamzap.c ++++ b/drivers/media/rc/streamzap.c +@@ -219,9 +219,8 @@ static void streamzap_callback(struct ur + case -ESHUTDOWN: + /* + * this urb is terminated, clean up. +- * sz might already be invalid at this point + */ +- dev_err(sz->dev, "urb terminated, status: %d\n", urb->status); ++ dev_dbg(sz->dev, "urb terminated, status: %d\n", urb->status); + return; + default: + break; +@@ -358,11 +357,16 @@ static int streamzap_probe(struct usb_in + + usb_set_intfdata(intf, sz); + +- if (usb_submit_urb(sz->urb_in, GFP_ATOMIC)) ++ retval = usb_submit_urb(sz->urb_in, GFP_ATOMIC); ++ if (retval < 0) { + dev_err(sz->dev, "urb submit failed\n"); ++ goto rc_submit_fail; ++ } + + return 0; +- ++rc_submit_fail: ++ rc_free_device(sz->rdev); ++ usb_set_intfdata(intf, NULL); + rc_dev_fail: + usb_free_urb(sz->urb_in); + free_buf_in: diff --git a/queue-6.6/media-rc-xbox_remote-heed-dma-restrictions.patch b/queue-6.6/media-rc-xbox_remote-heed-dma-restrictions.patch new file mode 100644 index 0000000000..1daf7c3564 --- /dev/null +++ b/queue-6.6/media-rc-xbox_remote-heed-dma-restrictions.patch @@ -0,0 +1,61 @@ +From e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 11 Feb 2026 19:09:44 +0100 +Subject: media: rc: xbox_remote: heed DMA restrictions + +From: Oliver Neukum + +commit e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff upstream. + +The buffer for IO must not be part of the device structure +because that violates the DMA coherency rules. + +Fixes: 02d32bdad3123 ("media: rc: add driver for Xbox DVD Movie Playback Kit") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/xbox_remote.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/media/rc/xbox_remote.c ++++ b/drivers/media/rc/xbox_remote.c +@@ -55,7 +55,7 @@ struct xbox_remote { + struct usb_interface *interface; + + struct urb *irq_urb; +- unsigned char inbuf[DATA_BUFSIZE] __aligned(sizeof(u16)); ++ u8 *inbuf; + + char rc_name[NAME_BUFSIZE]; + char rc_phys[NAME_BUFSIZE]; +@@ -218,6 +218,10 @@ static int xbox_remote_probe(struct usb_ + if (!xbox_remote || !rc_dev) + goto exit_free_dev_rdev; + ++ xbox_remote->inbuf = kzalloc(DATA_BUFSIZE, GFP_KERNEL); ++ if (!xbox_remote->inbuf) ++ goto exit_free_inbuf; ++ + /* Allocate URB buffer */ + xbox_remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!xbox_remote->irq_urb) +@@ -262,6 +266,8 @@ exit_kill_urbs: + usb_kill_urb(xbox_remote->irq_urb); + exit_free_buffers: + usb_free_urb(xbox_remote->irq_urb); ++exit_free_inbuf: ++ kfree(xbox_remote->inbuf); + exit_free_dev_rdev: + rc_free_device(rc_dev); + kfree(xbox_remote); +@@ -286,6 +292,7 @@ static void xbox_remote_disconnect(struc + usb_kill_urb(xbox_remote->irq_urb); + rc_unregister_device(xbox_remote->rdev); + usb_free_urb(xbox_remote->irq_urb); ++ kfree(xbox_remote->inbuf); + kfree(xbox_remote); + } + diff --git a/queue-6.6/media-saa7164-add-ioremap-return-checks-and-cleanups.patch b/queue-6.6/media-saa7164-add-ioremap-return-checks-and-cleanups.patch new file mode 100644 index 0000000000..bfcec5a6e8 --- /dev/null +++ b/queue-6.6/media-saa7164-add-ioremap-return-checks-and-cleanups.patch @@ -0,0 +1,110 @@ +From d51c60a498e83c9a79884c8e420f97e3885c9583 Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Mon, 16 Mar 2026 20:24:01 +0800 +Subject: media: saa7164: add ioremap return checks and cleanups + +From: Wang Jun <1742789905@qq.com> + +commit d51c60a498e83c9a79884c8e420f97e3885c9583 upstream. + +Add checks for ioremap return values in saa7164_dev_setup(). If +ioremap for BAR0 or BAR2 fails, release the already allocated PCI +memory regions, remove the device from the global list, decrement +the device count, and return -ENODEV. + +This prevents potential null pointer dereferences and ensures proper +cleanup on memory mapping failures. + +Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/saa7164/saa7164-core.c | 47 +++++++++++++++++++++++-------- + 1 file changed, 35 insertions(+), 12 deletions(-) + +--- a/drivers/media/pci/saa7164/saa7164-core.c ++++ b/drivers/media/pci/saa7164/saa7164-core.c +@@ -888,6 +888,15 @@ static int get_resources(struct saa7164_ + return -EBUSY; + } + ++static void release_resources(struct saa7164_dev *dev) ++{ ++ release_mem_region(pci_resource_start(dev->pci, 0), ++ pci_resource_len(dev->pci, 0)); ++ ++ release_mem_region(pci_resource_start(dev->pci, 2), ++ pci_resource_len(dev->pci, 2)); ++} ++ + static int saa7164_port_init(struct saa7164_dev *dev, int portnr) + { + struct saa7164_port *port = NULL; +@@ -947,9 +956,9 @@ static int saa7164_dev_setup(struct saa7 + + snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr); + +- mutex_lock(&devlist); +- list_add_tail(&dev->devlist, &saa7164_devlist); +- mutex_unlock(&devlist); ++ scoped_guard(mutex, &devlist) { ++ list_add_tail(&dev->devlist, &saa7164_devlist); ++ } + + /* board config */ + dev->board = UNSET; +@@ -996,11 +1005,17 @@ static int saa7164_dev_setup(struct saa7 + } + + /* PCI/e allocations */ +- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); ++ dev->lmmio = pci_ioremap_bar(dev->pci, 0); ++ if (!dev->lmmio) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n"); ++ goto err_ioremap_bar0; ++ } + +- dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ dev->lmmio2 = pci_ioremap_bar(dev->pci, 2); ++ if (!dev->lmmio2) { ++ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n"); ++ goto err_ioremap_bar2; ++ } + + dev->bmmio = (u8 __iomem *)dev->lmmio; + dev->bmmio2 = (u8 __iomem *)dev->lmmio2; +@@ -1019,17 +1034,25 @@ static int saa7164_dev_setup(struct saa7 + saa7164_pci_quirks(dev); + + return 0; ++ ++err_ioremap_bar2: ++ iounmap(dev->lmmio); ++err_ioremap_bar0: ++ release_resources(dev); ++ ++ scoped_guard(mutex, &devlist) { ++ list_del(&dev->devlist); ++ } ++ saa7164_devcount--; ++ ++ return -ENODEV; + } + + static void saa7164_dev_unregister(struct saa7164_dev *dev) + { + dprintk(1, "%s()\n", __func__); + +- release_mem_region(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); +- +- release_mem_region(pci_resource_start(dev->pci, 2), +- pci_resource_len(dev->pci, 2)); ++ release_resources(dev); + + if (!atomic_dec_and_test(&dev->refcount)) + return; diff --git a/queue-6.6/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch b/queue-6.6/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch new file mode 100644 index 0000000000..1042e4621f --- /dev/null +++ b/queue-6.6/media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch @@ -0,0 +1,51 @@ +From fbac03467e53d8d72e5099c03df26d9adae11416 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 9 Mar 2026 15:01:54 +0000 +Subject: media: uvcvideo: Enable VB2_DMABUF for metadata stream + +From: Ricardo Ribalda + +commit fbac03467e53d8d72e5099c03df26d9adae11416 upstream. + +The UVC driver has two video streams, one for the frames and another one +for the metadata. Both streams share most of the codebase, but only the +data stream declares support for DMABUF transfer mode. + +I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM +and the frames looked correct. + +This patch announces the support for DMABUF for the metadata stream. +This is useful for apps/HALs that only want to support DMABUF. + +Cc: stable@vger.kernel.org +Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_queue.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -218,7 +218,7 @@ int uvc_queue_init(struct uvc_video_queu + int ret; + + queue->queue.type = type; +- queue->queue.io_modes = VB2_MMAP | VB2_USERPTR; ++ queue->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF; + queue->queue.drv_priv = queue; + queue->queue.buf_struct_size = sizeof(struct uvc_buffer); + queue->queue.mem_ops = &vb2_vmalloc_memops; +@@ -231,7 +231,6 @@ int uvc_queue_init(struct uvc_video_queu + queue->queue.ops = &uvc_meta_queue_qops; + break; + default: +- queue->queue.io_modes |= VB2_DMABUF; + queue->queue.ops = &uvc_queue_qops; + break; + } diff --git a/queue-6.6/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch b/queue-6.6/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch new file mode 100644 index 0000000000..483551972d --- /dev/null +++ b/queue-6.6/media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch @@ -0,0 +1,99 @@ +From 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Sun, 15 Feb 2026 18:42:59 +0100 +Subject: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap + +From: Janne Grunau + +commit 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 upstream. + +vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not +see a reason why vb2_dma_sg should behave differently. This avoids +hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in +drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of +tree Apple ISP camera capture driver which uses vb2_dma_sg_memops. + +gst-launch-1.0 v4l2src ! gtk4paintablesink + +[ 38.201528] ------------[ cut here ]------------ +[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210 +[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer +snd_seq snd_seq_device uinput nf_conntrack_netbios_ns +nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib +nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat +nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep +nls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc +hid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic +cfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev +aop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2 +snd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor +macsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi +macsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3 +snd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon +apple_sart apple_dockchannel macsmc apple_rtkit_helper +spmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses +pinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core +spi_apple +[ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram +[ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full) +[ 38.219040] Tainted: [W]=WARN +[ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT) +[ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +[ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210 +[ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210 +[ 38.222178] sp : ffffc0008dc678e0 +[ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480 +[ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968 +[ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0 +[ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968 +[ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8 +[ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff +[ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8 +[ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000 +[ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038 +[ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb +[ 38.231488] Call trace: +[ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P) +[ 38.232342] drm_gem_mmap+0x140/0x260 +[ 38.232813] __mmap_region+0x488/0x9a0 +[ 38.233277] mmap_region+0xd0/0x148 +[ 38.233703] do_mmap+0x350/0x5c0 +[ 38.234148] vm_mmap_pgoff+0x14c/0x200 +[ 38.234612] ksys_mmap_pgoff+0x150/0x208 +[ 38.235107] __arm64_sys_mmap+0x34/0x50 +[ 38.235611] invoke_syscall+0x50/0x120 +[ 38.236075] el0_svc_common.constprop.0+0x48/0xf0 +[ 38.236680] do_el0_svc+0x24/0x38 +[ 38.237113] el0_svc+0x38/0x168 +[ 38.237507] el0t_64_sync_handler+0xa0/0xe8 +[ 38.238034] el0t_64_sync+0x198/0x1a0 +[ 38.238491] ---[ end trace 0000000000000000 ]--- + +There were discussions in [1] at the end of 2023 that mmap() on imported +dma-bufs should not be supported but as of v6.17 drm_gem_shmem_mmap() in +drm_gem_shmem_helper.c still supports it. +This might affect all gpu or accel drivers using drm_gem_shmem_mmap() or +the wrapper drm_gem_shmem_object_mmap(). + +[1] https://lore.kernel.org/dri-devel/bc7f7844-0aa3-4802-b203-69d58e8be2fa@linux.intel.com/ + +Cc: stable@vger.kernel.org +Fixes: 5ba3f757f059 ("[media] v4l: videobuf2: add DMA scatter/gather allocator") +Signed-off-by: Janne Grunau +Acked-by: Marek Szyprowski +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c ++++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c +@@ -345,6 +345,7 @@ static int vb2_dma_sg_mmap(void *buf_pri + return err; + } + ++ vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP); + /* + * Use common vm_area operations to track buffer refcount. + */ diff --git a/queue-6.6/platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch b/queue-6.6/platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch new file mode 100644 index 0000000000..df2e8ccd3e --- /dev/null +++ b/queue-6.6/platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch @@ -0,0 +1,45 @@ +From e8c597368b8500a824c639bfb5ed0044068c6870 Mon Sep 17 00:00:00 2001 +From: Krishna Chomal +Date: Fri, 3 Apr 2026 13:31:55 +0530 +Subject: platform/x86: hp-wmi: Ignore backlight and FnLock events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krishna Chomal + +commit e8c597368b8500a824c639bfb5ed0044068c6870 upstream. + +On HP OmniBook 7 the keyboard backlight and FnLock keys are handled +directly by the firmware. However, they still trigger WMI events which +results in "Unknown key code" warnings in dmesg. + +Add these key codes to the keymap with KE_IGNORE to silence the warnings +since no software action is needed. + +Tested-by: Artem S. Tashkinov +Reported-by: Artem S. Tashkinov +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221181 +Signed-off-by: Krishna Chomal +Link: https://patch.msgid.link/20260403080155.169653-1-krishna.chomal108@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/hp/hp-wmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/platform/x86/hp/hp-wmi.c ++++ b/drivers/platform/x86/hp/hp-wmi.c +@@ -238,6 +238,11 @@ static const struct key_entry hp_wmi_key + { KE_KEY, 0x21a9, { KEY_TOUCHPAD_OFF } }, + { KE_KEY, 0x121a9, { KEY_TOUCHPAD_ON } }, + { KE_KEY, 0x231b, { KEY_HELP } }, ++ { KE_IGNORE, 0x21ab, }, /* FnLock on */ ++ { KE_IGNORE, 0x121ab, }, /* FnLock off */ ++ { KE_IGNORE, 0x30021aa, }, /* kbd backlight: level 2 -> off */ ++ { KE_IGNORE, 0x33221aa, }, /* kbd backlight: off -> level 1 */ ++ { KE_IGNORE, 0x36421aa, }, /* kbd backlight: level 1 -> level 2*/ + { KE_END, 0 } + }; + diff --git a/queue-6.6/regulator-act8945a-fix-of-node-reference-imbalance.patch b/queue-6.6/regulator-act8945a-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..8b48bff340 --- /dev/null +++ b/queue-6.6/regulator-act8945a-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 0d15ce31375ccef4162f960b34547a821b7619d2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:54 +0200 +Subject: regulator: act8945a: fix OF node reference imbalance + +From: Johan Hovold + +commit 0d15ce31375ccef4162f960b34547a821b7619d2 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 38c09961048b ("regulator: act8945a: add regulator driver for ACT8945A") +Cc: stable@vger.kernel.org # 4.6 +Cc: Wenyou Yang +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-7-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/act8945a-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/act8945a-regulator.c ++++ b/drivers/regulator/act8945a-regulator.c +@@ -302,8 +302,9 @@ static int act8945a_pmic_probe(struct pl + num_regulators = ARRAY_SIZE(act8945a_regulators); + } + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = act8945a; + for (i = 0; i < num_regulators; i++) { + rdev = devm_regulator_register(&pdev->dev, ®ulators[i], diff --git a/queue-6.6/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch b/queue-6.6/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..c7d9a5fa04 --- /dev/null +++ b/queue-6.6/regulator-bd9571mwv-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 8498100ee1d00422b8c5b161b3e332278b92a59a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:55 +0200 +Subject: regulator: bd9571mwv: fix OF node reference imbalance + +From: Johan Hovold + +commit 8498100ee1d00422b8c5b161b3e332278b92a59a upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: e85c5a153fe2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver") +Cc: stable@vger.kernel.org # 4.12 +Cc: Marek Vasut +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-8-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/bd9571mwv-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/bd9571mwv-regulator.c ++++ b/drivers/regulator/bd9571mwv-regulator.c +@@ -288,8 +288,9 @@ static int bd9571mwv_regulator_probe(str + + platform_set_drvdata(pdev, bdreg); + ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); ++ + config.dev = &pdev->dev; +- config.dev->of_node = pdev->dev.parent->of_node; + config.driver_data = bdreg; + config.regmap = bdreg->regmap; + diff --git a/queue-6.6/regulator-max77650-fix-of-node-reference-imbalance.patch b/queue-6.6/regulator-max77650-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..78598551b0 --- /dev/null +++ b/queue-6.6/regulator-max77650-fix-of-node-reference-imbalance.patch @@ -0,0 +1,38 @@ +From 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:51 +0200 +Subject: regulator: max77650: fix OF node reference imbalance + +From: Johan Hovold + +commit 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: bcc61f1c44fd ("regulator: max77650: add regulator support") +Cc: stable@vger.kernel.org # 5.1 +Reviewed-by: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/max77650-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/max77650-regulator.c ++++ b/drivers/regulator/max77650-regulator.c +@@ -339,7 +339,7 @@ static int max77650_regulator_probe(stru + parent = dev->parent; + + if (!dev->of_node) +- dev->of_node = parent->of_node; ++ device_set_of_node_from_dev(dev, parent); + + rdescs = devm_kcalloc(dev, MAX77650_REGULATOR_NUM_REGULATORS, + sizeof(*rdescs), GFP_KERNEL); diff --git a/queue-6.6/regulator-mt6357-fix-of-node-reference-imbalance.patch b/queue-6.6/regulator-mt6357-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..d32f2f7ad9 --- /dev/null +++ b/queue-6.6/regulator-mt6357-fix-of-node-reference-imbalance.patch @@ -0,0 +1,37 @@ +From 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:52 +0200 +Subject: regulator: mt6357: fix OF node reference imbalance + +From: Johan Hovold + +commit 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: dafc7cde23dc ("regulator: add mt6357 regulator") +Cc: stable@vger.kernel.org # 6.2 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-5-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/mt6357-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/mt6357-regulator.c ++++ b/drivers/regulator/mt6357-regulator.c +@@ -410,7 +410,7 @@ static int mt6357_regulator_probe(struct + struct regulator_dev *rdev; + int i; + +- pdev->dev.of_node = pdev->dev.parent->of_node; ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); + + for (i = 0; i < MT6357_MAX_REGULATOR; i++) { + config.dev = &pdev->dev; diff --git a/queue-6.6/regulator-rk808-fix-of-node-reference-imbalance.patch b/queue-6.6/regulator-rk808-fix-of-node-reference-imbalance.patch new file mode 100644 index 0000000000..080ec8172e --- /dev/null +++ b/queue-6.6/regulator-rk808-fix-of-node-reference-imbalance.patch @@ -0,0 +1,40 @@ +From 65290b24d8a5f0b8cd065201e653db824c4a4da6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 8 Apr 2026 09:30:50 +0200 +Subject: regulator: rk808: fix OF node reference imbalance + +From: Johan Hovold + +commit 65290b24d8a5f0b8cd065201e653db824c4a4da6 upstream. + +The driver reuses the OF node of the parent multi-function device but +fails to take another reference to balance the one dropped by the +platform bus code when unbinding the MFD and deregistering the child +devices. + +Fix this by using the intended helper for reusing OF nodes. + +Fixes: 647e57351f8e ("regulator: rk808: reduce 'struct rk808' usage") +Cc: stable@vger.kernel.org # 6.2 +Reviewed-by: Sebastian Reichel +Reviewed-by: Douglas Anderson +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260408073055.5183-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/rk808-regulator.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/regulator/rk808-regulator.c ++++ b/drivers/regulator/rk808-regulator.c +@@ -1674,8 +1674,7 @@ static int rk808_regulator_probe(struct + struct regmap *regmap; + int ret, i, nregulators; + +- pdev->dev.of_node = pdev->dev.parent->of_node; +- pdev->dev.of_node_reused = true; ++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent); + + regmap = dev_get_regmap(pdev->dev.parent, NULL); + if (!regmap) diff --git a/queue-6.6/series b/queue-6.6/series index 446aa57bc4..0b527d3883 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -296,3 +296,22 @@ loongarch-use-per-root-bridge-pcih-flag-to-skip-mem-resource-fixup.patch x86-cpu-amd-prevent-improper-isolation-of-shared-resources-in-zen2-s-op-cache.patch exit-sleep-at-task_idle-when-waiting-for-application-core-dump.patch ptrace-slightly-saner-get_dumpable-logic.patch +hid-playstation-clamp-num_touch_reports.patch +media-uvcvideo-enable-vb2_dmabuf-for-metadata-stream.patch +media-i2c-ov8856-free-control-handler-on-error-in-ov8856_init_controls.patch +spi-bcm63xx-fix-controller-deregistration.patch +spi-atmel-fix-controller-deregistration.patch +staging-media-atomisp-disallow-all-private-ioctls.patch +regulator-mt6357-fix-of-node-reference-imbalance.patch +regulator-max77650-fix-of-node-reference-imbalance.patch +media-rc-xbox_remote-heed-dma-restrictions.patch +media-rc-streamzap-error-handling-in-probe.patch +regulator-rk808-fix-of-node-reference-imbalance.patch +media-videobuf2-set-vma_flags-in-vb2_dma_sg_mmap.patch +regulator-act8945a-fix-of-node-reference-imbalance.patch +regulator-bd9571mwv-fix-of-node-reference-imbalance.patch +spi-lantiq-ssc-fix-controller-deregistration.patch +spi-qup-fix-controller-deregistration.patch +spi-at91-usart-fix-controller-deregistration.patch +media-saa7164-add-ioremap-return-checks-and-cleanups.patch +platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch diff --git a/queue-6.6/spi-at91-usart-fix-controller-deregistration.patch b/queue-6.6/spi-at91-usart-fix-controller-deregistration.patch new file mode 100644 index 0000000000..4eda17bc65 --- /dev/null +++ b/queue-6.6/spi-at91-usart-fix-controller-deregistration.patch @@ -0,0 +1,49 @@ +From 9acecc9bcff058eaef40fd7a4c3650e88b06b220 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:02 +0200 +Subject: spi: at91-usart: fix controller deregistration + +From: Johan Hovold + +commit 9acecc9bcff058eaef40fd7a4c3650e88b06b220 upstream. + +Make sure to deregister the controller before disabling and releasing +underlying resources like clocks and DMA during driver unbind. + +Fixes: e1892546ff66 ("spi: at91-usart: Add driver for at91-usart as SPI") +Cc: stable@vger.kernel.org # 4.20 +Cc: Radu Pirea +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-at91-usart.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-at91-usart.c ++++ b/drivers/spi/spi-at91-usart.c +@@ -570,7 +570,7 @@ static int at91_usart_spi_probe(struct p + spin_lock_init(&aus->lock); + init_completion(&aus->xfer_completion); + +- ret = devm_spi_register_controller(&pdev->dev, controller); ++ ret = spi_register_controller(controller); + if (ret) + goto at91_usart_fail_register_controller; + +@@ -648,8 +648,14 @@ static void at91_usart_spi_remove(struct + struct spi_controller *ctlr = platform_get_drvdata(pdev); + struct at91_usart_spi *aus = spi_controller_get_devdata(ctlr); + ++ spi_controller_get(ctlr); ++ ++ spi_unregister_controller(ctlr); ++ + at91_usart_spi_release_dma(ctlr); + clk_disable_unprepare(aus->clk); ++ ++ spi_controller_put(ctlr); + } + + static const struct dev_pm_ops at91_usart_spi_pm_ops = { diff --git a/queue-6.6/spi-atmel-fix-controller-deregistration.patch b/queue-6.6/spi-atmel-fix-controller-deregistration.patch new file mode 100644 index 0000000000..94c8aac2de --- /dev/null +++ b/queue-6.6/spi-atmel-fix-controller-deregistration.patch @@ -0,0 +1,55 @@ +From 8d4de97e83520be89d0ff40610ca633b3963a7de Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:03 +0200 +Subject: spi: atmel: fix controller deregistration + +From: Johan Hovold + +commit 8d4de97e83520be89d0ff40610ca633b3963a7de upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 754ce4f29937 ("[PATCH] SPI: atmel_spi driver") +Cc: stable@vger.kernel.org # 2.6.21 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-5-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-atmel.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1647,7 +1647,7 @@ static int atmel_spi_probe(struct platfo + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) + goto out_free_dma; + +@@ -1679,8 +1679,12 @@ static void atmel_spi_remove(struct plat + struct spi_controller *host = platform_get_drvdata(pdev); + struct atmel_spi *as = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ + pm_runtime_get_sync(&pdev->dev); + ++ spi_unregister_controller(host); ++ + /* reset the hardware and block queue progress */ + if (as->use_dma) { + atmel_spi_stop_dma(host); +@@ -1705,6 +1709,8 @@ static void atmel_spi_remove(struct plat + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++ spi_controller_put(host); + } + + static int atmel_spi_runtime_suspend(struct device *dev) diff --git a/queue-6.6/spi-bcm63xx-fix-controller-deregistration.patch b/queue-6.6/spi-bcm63xx-fix-controller-deregistration.patch new file mode 100644 index 0000000000..756546b884 --- /dev/null +++ b/queue-6.6/spi-bcm63xx-fix-controller-deregistration.patch @@ -0,0 +1,52 @@ +From c39e65a4e3b8e764efed0b2f5152a1a8547b80fd Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:04 +0200 +Subject: spi: bcm63xx: fix controller deregistration + +From: Johan Hovold + +commit c39e65a4e3b8e764efed0b2f5152a1a8547b80fd upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") +Cc: stable@vger.kernel.org # 3.4 +Cc: Florian Fainelli +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-6-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm63xx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -603,7 +603,7 @@ static int bcm63xx_spi_probe(struct plat + goto out_clk_disable; + + /* register and we are done */ +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(dev, "spi register failed\n"); + goto out_clk_disable; +@@ -626,11 +626,17 @@ static void bcm63xx_spi_remove(struct pl + struct spi_controller *host = platform_get_drvdata(pdev); + struct bcm63xx_spi *bs = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + /* reset spi block */ + bcm_spi_writeb(bs, 0, SPI_INT_MASK); + + /* HW shutdown */ + clk_disable_unprepare(bs->clk); ++ ++ spi_controller_put(host); + } + + static int bcm63xx_spi_suspend(struct device *dev) diff --git a/queue-6.6/spi-lantiq-ssc-fix-controller-deregistration.patch b/queue-6.6/spi-lantiq-ssc-fix-controller-deregistration.patch new file mode 100644 index 0000000000..53973e9d2a --- /dev/null +++ b/queue-6.6/spi-lantiq-ssc-fix-controller-deregistration.patch @@ -0,0 +1,54 @@ +From b99206710d032c16b7f8b75e4bc18414d8e4b9f4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:15 +0200 +Subject: spi: lantiq-ssc: fix controller deregistration + +From: Johan Hovold + +commit b99206710d032c16b7f8b75e4bc18414d8e4b9f4 upstream. + +Make sure to deregister the controller before releasing underlying +resources like clocks during driver unbind. + +Fixes: 17f84b793c01 ("spi: lantiq-ssc: add support for Lantiq SSC SPI controller") +Cc: stable@vger.kernel.org # 4.11 +Cc: Hauke Mehrtens +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-17-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-lantiq-ssc.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-lantiq-ssc.c ++++ b/drivers/spi/spi-lantiq-ssc.c +@@ -998,7 +998,7 @@ static int lantiq_ssc_probe(struct platf + "Lantiq SSC SPI controller (Rev %i, TXFS %u, RXFS %u, DMA %u)\n", + revision, spi->tx_fifo_size, spi->rx_fifo_size, supports_dma); + +- err = devm_spi_register_controller(dev, host); ++ err = spi_register_controller(host); + if (err) { + dev_err(dev, "failed to register spi host\n"); + goto err_wq_destroy; +@@ -1022,6 +1022,10 @@ static void lantiq_ssc_remove(struct pla + { + struct lantiq_ssc_spi *spi = platform_get_drvdata(pdev); + ++ spi_controller_get(spi->host); ++ ++ spi_unregister_controller(spi->host); ++ + lantiq_ssc_writel(spi, 0, LTQ_SPI_IRNEN); + lantiq_ssc_writel(spi, 0, LTQ_SPI_CLC); + rx_fifo_flush(spi); +@@ -1031,6 +1035,8 @@ static void lantiq_ssc_remove(struct pla + destroy_workqueue(spi->wq); + clk_disable_unprepare(spi->spi_clk); + clk_put(spi->fpi_clk); ++ ++ spi_controller_put(spi->host); + } + + static struct platform_driver lantiq_ssc_driver = { diff --git a/queue-6.6/spi-qup-fix-controller-deregistration.patch b/queue-6.6/spi-qup-fix-controller-deregistration.patch new file mode 100644 index 0000000000..508e833cdb --- /dev/null +++ b/queue-6.6/spi-qup-fix-controller-deregistration.patch @@ -0,0 +1,53 @@ +From 443e3a0005a4342b218b6dbd4c6387d3c7fed85a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:39 +0200 +Subject: spi: qup: fix controller deregistration + +From: Johan Hovold + +commit 443e3a0005a4342b218b6dbd4c6387d3c7fed85a upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") +Cc: stable@vger.kernel.org # 3.15 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-10-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-qup.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1149,7 +1149,7 @@ static int spi_qup_probe(struct platform + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret) + goto disable_pm; + +@@ -1274,6 +1274,10 @@ static void spi_qup_remove(struct platfo + struct spi_qup *controller = spi_controller_get_devdata(host); + int ret; + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + ret = pm_runtime_get_sync(&pdev->dev); + + if (ret >= 0) { +@@ -1293,6 +1297,8 @@ static void spi_qup_remove(struct platfo + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++ spi_controller_put(host); + } + + static const struct of_device_id spi_qup_dt_match[] = { diff --git a/queue-6.6/staging-media-atomisp-disallow-all-private-ioctls.patch b/queue-6.6/staging-media-atomisp-disallow-all-private-ioctls.patch new file mode 100644 index 0000000000..bf14819557 --- /dev/null +++ b/queue-6.6/staging-media-atomisp-disallow-all-private-ioctls.patch @@ -0,0 +1,39 @@ +From 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Thu, 26 Feb 2026 15:10:54 +0200 +Subject: staging: media: atomisp: Disallow all private IOCTLs + +From: Sakari Ailus + +commit 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c upstream. + +Disallow all private IOCTLs. These aren't quite as safe as one could +assume of IOCTL handlers; disable them for now. Instead of removing the +code, return in the beginning of the function if cmd is non-zero in order +to keep static checkers happy. + +Reported-by: Soufiane Dani +Closes: https://lore.kernel.org/linux-staging/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com/ +Cc: stable@vger.kernel.org +Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") +Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -1780,6 +1780,10 @@ static long atomisp_vidioc_default(struc + struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd; + int err; + ++ /* Disable all private IOCTLs for now! */ ++ if (cmd) ++ return -EINVAL; ++ + switch (cmd) { + case ATOMISP_IOC_S_SENSOR_RUNMODE: + if (IS_ISP2401)