From: Greg Kroah-Hartman Date: Thu, 16 Oct 2025 09:11:21 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.15.195~94 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a87755e0a8b17442aa3c6f3da9e5addf701ce306;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch firmware-meson_sm-fix-device-leak-at-probe.patch media-cx18-add-missing-check-after-dma-map.patch media-i2c-mt9v111-fix-incorrect-type-for-ret.patch media-lirc-fix-error-handling-in-lirc_register.patch media-mc-fix-must_connect-handling-for-pads-with-no-links.patch media-pci-ivtv-add-missing-check-after-dma-map.patch xen-events-cleanup-find_virq-return-codes.patch xen-manage-fix-suspend-error-path.patch --- diff --git a/queue-6.1/dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch b/queue-6.1/dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch new file mode 100644 index 0000000000..0b09373ac7 --- /dev/null +++ b/queue-6.1/dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch @@ -0,0 +1,54 @@ +From c254815b02673cc77a84103c4c0d6197bd90c0ef Mon Sep 17 00:00:00 2001 +From: Michael Riesch +Date: Wed, 3 Sep 2025 19:04:50 +0200 +Subject: dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required + +From: Michael Riesch + +commit c254815b02673cc77a84103c4c0d6197bd90c0ef upstream. + +There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568 +variant) that are powered on by default as they are part of the ALIVE power +domain. +Remove 'power-domains' from the required properties in order to avoid false +positives. + +Fixes: 22c8e0a69b7f ("dt-bindings: phy: add compatible for rk356x to rockchip-inno-csi-dphy") +Cc: stable@kernel.org +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Michael Riesch +Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-2-a4f340a7f0cf@collabora.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml ++++ b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml +@@ -57,11 +57,24 @@ required: + - clocks + - clock-names + - '#phy-cells' +- - power-domains + - resets + - reset-names + - rockchip,grf + ++allOf: ++ - if: ++ properties: ++ compatible: ++ contains: ++ enum: ++ - rockchip,px30-csi-dphy ++ - rockchip,rk1808-csi-dphy ++ - rockchip,rk3326-csi-dphy ++ - rockchip,rk3368-csi-dphy ++ then: ++ required: ++ - power-domains ++ + additionalProperties: false + + examples: diff --git a/queue-6.1/firmware-meson_sm-fix-device-leak-at-probe.patch b/queue-6.1/firmware-meson_sm-fix-device-leak-at-probe.patch new file mode 100644 index 0000000000..821d8e4dc9 --- /dev/null +++ b/queue-6.1/firmware-meson_sm-fix-device-leak-at-probe.patch @@ -0,0 +1,49 @@ +From 8ece3173f87df03935906d0c612c2aeda9db92ca Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 25 Jul 2025 09:40:19 +0200 +Subject: firmware: meson_sm: fix device leak at probe + +From: Johan Hovold + +commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream. + +Make sure to drop the reference to the secure monitor device taken by +of_find_device_by_node() when looking up its driver data on behalf of +other drivers (e.g. during probe). + +Note that holding a reference to the platform device does not prevent +its driver data from going away so there is no point in keeping the +reference after the helper returns. + +Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver") +Cc: stable@vger.kernel.org # 5.5 +Cc: Carlo Caione +Signed-off-by: Johan Hovold +Acked-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725074019.8765-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/meson/meson_sm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/firmware/meson/meson_sm.c ++++ b/drivers/firmware/meson/meson_sm.c +@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write); + struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node) + { + struct platform_device *pdev = of_find_device_by_node(sm_node); ++ struct meson_sm_firmware *fw; + + if (!pdev) + return NULL; + +- return platform_get_drvdata(pdev); ++ fw = platform_get_drvdata(pdev); ++ ++ put_device(&pdev->dev); ++ ++ return fw; + } + EXPORT_SYMBOL_GPL(meson_sm_get); + diff --git a/queue-6.1/media-cx18-add-missing-check-after-dma-map.patch b/queue-6.1/media-cx18-add-missing-check-after-dma-map.patch new file mode 100644 index 0000000000..fbd3e96cae --- /dev/null +++ b/queue-6.1/media-cx18-add-missing-check-after-dma-map.patch @@ -0,0 +1,49 @@ +From 23b53639a793477326fd57ed103823a8ab63084f Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Wed, 9 Jul 2025 13:35:40 +0200 +Subject: media: cx18: Add missing check after DMA map + +From: Thomas Fourier + +commit 23b53639a793477326fd57ed103823a8ab63084f upstream. + +The DMA map functions can fail and should be tested for errors. +If the mapping fails, dealloc buffers, and return. + +Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Fourier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/cx18/cx18-queue.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/media/pci/cx18/cx18-queue.c ++++ b/drivers/media/pci/cx18/cx18-queue.c +@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_stream + break; + } + ++ buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, ++ buf->buf, s->buf_size, ++ s->dma); ++ if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) { ++ kfree(buf->buf); ++ kfree(mdl); ++ kfree(buf); ++ break; ++ } ++ + INIT_LIST_HEAD(&mdl->list); + INIT_LIST_HEAD(&mdl->buf_list); + mdl->id = s->mdl_base_idx; /* a somewhat safe value */ + cx18_enqueue(s, mdl, &s->q_idle); + + INIT_LIST_HEAD(&buf->list); +- buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, +- buf->buf, s->buf_size, +- s->dma); + cx18_buf_sync_for_cpu(s, buf); + list_add_tail(&buf->list, &s->buf_pool); + } diff --git a/queue-6.1/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch b/queue-6.1/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..099b9dabaa --- /dev/null +++ b/queue-6.1/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From bacd713145443dce7764bb2967d30832a95e5ec8 Mon Sep 17 00:00:00 2001 +From: Qianfeng Rong +Date: Wed, 27 Aug 2025 20:39:10 +0800 +Subject: media: i2c: mt9v111: fix incorrect type for ret + +From: Qianfeng Rong + +commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream. + +Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() +to store negative error codes or zero returned by __mt9v111_hw_reset() +and other functions. + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: aab7ed1c3927 ("media: i2c: Add driver for Aptina MT9V111") +Cc: stable@vger.kernel.org +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/mt9v111.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/mt9v111.c ++++ b/drivers/media/i2c/mt9v111.c +@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(struc + static int mt9v111_hw_config(struct mt9v111_dev *mt9v111) + { + struct i2c_client *c = mt9v111->client; +- unsigned int ret; + u16 outfmtctrl2; ++ int ret; + + /* Force device reset. */ + ret = __mt9v111_hw_reset(mt9v111); diff --git a/queue-6.1/media-lirc-fix-error-handling-in-lirc_register.patch b/queue-6.1/media-lirc-fix-error-handling-in-lirc_register.patch new file mode 100644 index 0000000000..de3db01420 --- /dev/null +++ b/queue-6.1/media-lirc-fix-error-handling-in-lirc_register.patch @@ -0,0 +1,52 @@ +From 4f4098c57e139ad972154077fb45c3e3141555dd Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Fri, 18 Jul 2025 17:50:54 +0800 +Subject: media: lirc: Fix error handling in lirc_register() + +From: Ma Ke + +commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream. + +When cdev_device_add() failed, calling put_device() to explicitly +release dev->lirc_dev. Otherwise, it could cause the fault of the +reference count. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi") +Signed-off-by: Ma Ke +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/lirc_dev.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -735,11 +735,11 @@ int lirc_register(struct rc_dev *dev) + + cdev_init(&dev->lirc_cdev, &lirc_fops); + ++ get_device(&dev->dev); ++ + err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev); + if (err) +- goto out_ida; +- +- get_device(&dev->dev); ++ goto out_put_device; + + switch (dev->driver_type) { + case RC_DRIVER_SCANCODE: +@@ -763,7 +763,8 @@ int lirc_register(struct rc_dev *dev) + + return 0; + +-out_ida: ++out_put_device: ++ put_device(&dev->lirc_dev); + ida_free(&lirc_ida, minor); + return err; + } diff --git a/queue-6.1/media-mc-fix-must_connect-handling-for-pads-with-no-links.patch b/queue-6.1/media-mc-fix-must_connect-handling-for-pads-with-no-links.patch new file mode 100644 index 0000000000..1ee3d6cd98 --- /dev/null +++ b/queue-6.1/media-mc-fix-must_connect-handling-for-pads-with-no-links.patch @@ -0,0 +1,47 @@ +From eec81250219a209b863f11d02128ec1dd8e20877 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Wed, 20 Aug 2025 17:00:20 +0300 +Subject: media: mc: Fix MUST_CONNECT handling for pads with no links +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurent Pinchart + +commit eec81250219a209b863f11d02128ec1dd8e20877 upstream. + +Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always +require an enabled link") expanded the meaning of the MUST_CONNECT flag +to require an enabled link in all cases. To do so, the link exploration +code was expanded to cover unconnected pads, in order to reject those +that have the MUST_CONNECT flag set. The implementation was however +incorrect, ignoring unconnected pads instead of ignoring connected pads. +Fix it. + +Reported-by: Martin Kepplinger-Novaković +Closes: https://lore.kernel.org/linux-media/20250205172957.182362-1-martink@posteo.de +Reported-by: Maud Spierings +Closes: https://lore.kernel.org/linux-media/20250818-imx8_isi-v1-1-e9cfe994c435@gocontroll.com +Fixes: b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link") +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Laurent Pinchart +Tested-by: Maud Spierings +Tested-by: Martin Kepplinger-Novaković +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/mc/mc-entity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -665,7 +665,7 @@ done: + * (already discovered through iterating over links) and pads + * not internally connected. + */ +- if (origin == local || !local->num_links || ++ if (origin == local || local->num_links || + !media_entity_has_pad_interdep(origin->entity, origin->index, + local->index)) + continue; diff --git a/queue-6.1/media-pci-ivtv-add-missing-check-after-dma-map.patch b/queue-6.1/media-pci-ivtv-add-missing-check-after-dma-map.patch new file mode 100644 index 0000000000..c3f2b079a3 --- /dev/null +++ b/queue-6.1/media-pci-ivtv-add-missing-check-after-dma-map.patch @@ -0,0 +1,59 @@ +From 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Wed, 16 Jul 2025 15:26:30 +0200 +Subject: media: pci: ivtv: Add missing check after DMA map + +From: Thomas Fourier + +commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 upstream. + +The DMA map functions can fail and should be tested for errors. +If the mapping fails, free blanking_ptr and set it to 0. As 0 is a +valid DMA address, use blanking_ptr to test if the DMA address +is set. + +Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Fourier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/ivtv/ivtv-irq.c | 2 +- + drivers/media/pci/ivtv/ivtv-yuv.c | 8 +++++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/pci/ivtv/ivtv-irq.c ++++ b/drivers/media/pci/ivtv/ivtv-irq.c +@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct + + /* Insert buffer block for YUV if needed */ + if (s->type == IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) { +- if (yi->blanking_dmaptr) { ++ if (yi->blanking_ptr) { + s->sg_pending[idx].src = yi->blanking_dmaptr; + s->sg_pending[idx].dst = offset; + s->sg_pending[idx].size = 720 * 16; +--- a/drivers/media/pci/ivtv/ivtv-yuv.c ++++ b/drivers/media/pci/ivtv/ivtv-yuv.c +@@ -126,7 +126,7 @@ static int ivtv_yuv_prep_user_dma(struct + ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size); + + /* If we've offset the y plane, ensure top area is blanked */ +- if (f->offset_y && yi->blanking_dmaptr) { ++ if (f->offset_y && yi->blanking_ptr) { + dma->SGarray[dma->SG_length].size = cpu_to_le32(720*16); + dma->SGarray[dma->SG_length].src = cpu_to_le32(yi->blanking_dmaptr); + dma->SGarray[dma->SG_length].dst = cpu_to_le32(IVTV_DECODER_OFFSET + yuv_offset[frame]); +@@ -930,6 +930,12 @@ static void ivtv_yuv_init(struct ivtv *i + yi->blanking_dmaptr = dma_map_single(&itv->pdev->dev, + yi->blanking_ptr, + 720 * 16, DMA_TO_DEVICE); ++ if (dma_mapping_error(&itv->pdev->dev, yi->blanking_dmaptr)) { ++ kfree(yi->blanking_ptr); ++ yi->blanking_ptr = NULL; ++ yi->blanking_dmaptr = 0; ++ IVTV_DEBUG_WARN("Failed to dma_map yuv blanking buffer\n"); ++ } + } else { + yi->blanking_dmaptr = 0; + IVTV_DEBUG_WARN("Failed to allocate yuv blanking buffer\n"); diff --git a/queue-6.1/series b/queue-6.1/series index aedd655d4a..fe00f4993d 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -57,3 +57,12 @@ arm64-dts-ti-k3-am62a-main-fix-main-padcfg-length.patch arm64-kprobes-call-set_memory_rox-for-kprobe-page.patch arm-omap2-pm33xx-core-ix-device-node-reference-leaks-in-amx3_idle_init.patch cpuidle-governors-menu-avoid-using-invalid-recent-intervals-data.patch +dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch +xen-events-cleanup-find_virq-return-codes.patch +xen-manage-fix-suspend-error-path.patch +firmware-meson_sm-fix-device-leak-at-probe.patch +media-cx18-add-missing-check-after-dma-map.patch +media-i2c-mt9v111-fix-incorrect-type-for-ret.patch +media-mc-fix-must_connect-handling-for-pads-with-no-links.patch +media-pci-ivtv-add-missing-check-after-dma-map.patch +media-lirc-fix-error-handling-in-lirc_register.patch diff --git a/queue-6.1/xen-events-cleanup-find_virq-return-codes.patch b/queue-6.1/xen-events-cleanup-find_virq-return-codes.patch new file mode 100644 index 0000000000..bb69af5ca1 --- /dev/null +++ b/queue-6.1/xen-events-cleanup-find_virq-return-codes.patch @@ -0,0 +1,55 @@ +From 08df2d7dd4ab2db8a172d824cda7872d5eca460a Mon Sep 17 00:00:00 2001 +From: Jason Andryuk +Date: Wed, 27 Aug 2025 20:36:01 -0400 +Subject: xen/events: Cleanup find_virq() return codes + +From: Jason Andryuk + +commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream. + +rc is overwritten by the evtchn_status hypercall in each iteration, so +the return value will be whatever the last iteration is. This could +incorrectly return success even if the event channel was not found. +Change to an explicit -ENOENT for an un-found virq and return 0 on a +successful match. + +Fixes: 62cc5fc7b2e0 ("xen/pv-on-hvm kexec: rebind virqs to existing eventchannel ports") +Cc: stable@vger.kernel.org +Signed-off-by: Jason Andryuk +Reviewed-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20250828003604.8949-2-jason.andryuk@amd.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/events/events_base.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -1332,10 +1332,11 @@ static int find_virq(unsigned int virq, + { + struct evtchn_status status; + evtchn_port_t port; +- int rc = -ENOENT; + + memset(&status, 0, sizeof(status)); + for (port = 0; port < xen_evtchn_max_channels(); port++) { ++ int rc; ++ + status.dom = DOMID_SELF; + status.port = port; + rc = HYPERVISOR_event_channel_op(EVTCHNOP_status, &status); +@@ -1345,10 +1346,10 @@ static int find_virq(unsigned int virq, + continue; + if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) { + *evtchn = port; +- break; ++ return 0; + } + } +- return rc; ++ return -ENOENT; + } + + /** diff --git a/queue-6.1/xen-manage-fix-suspend-error-path.patch b/queue-6.1/xen-manage-fix-suspend-error-path.patch new file mode 100644 index 0000000000..a9eb44d08a --- /dev/null +++ b/queue-6.1/xen-manage-fix-suspend-error-path.patch @@ -0,0 +1,54 @@ +From f770c3d858687252f1270265ba152d5c622e793f Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Thu, 4 Sep 2025 15:11:09 +0200 +Subject: xen/manage: Fix suspend error path + +From: Lukas Wunner + +commit f770c3d858687252f1270265ba152d5c622e793f upstream. + +The device power management API has the following asymmetry: +* dpm_suspend_start() does not clean up on failure + (it requires a call to dpm_resume_end()) +* dpm_suspend_end() does clean up on failure + (it does not require a call to dpm_resume_start()) + +The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related +patches for 2.6.27") in June 2008: It removed a call to device_resume() +from device_suspend() (which was later renamed to dpm_suspend_start()). + +When Xen began using the device power management API in May 2008 with +commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did +not yet exist. But since it was introduced, a call to dpm_resume_end() +is missing in the error path of dpm_suspend_start(). Fix it. + +Fixes: d8f3de0d2412 ("Suspend-related patches for 2.6.27") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v2.6.27 +Reviewed-by: "Rafael J. Wysocki (Intel)" +Signed-off-by: Juergen Gross +Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/manage.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -116,7 +116,7 @@ static void do_suspend(void) + err = dpm_suspend_start(PMSG_FREEZE); + if (err) { + pr_err("%s: dpm_suspend_start %d\n", __func__, err); +- goto out_thaw; ++ goto out_resume_end; + } + + printk(KERN_DEBUG "suspending xenstore...\n"); +@@ -156,6 +156,7 @@ out_resume: + else + xs_suspend_cancel(); + ++out_resume_end: + dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE); + + out_thaw: