From: Greg Kroah-Hartman Date: Mon, 20 Oct 2025 11:23:06 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.6.114~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dd47502b0743bb9ff8c59507959cd4f128cb0fb3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: blk-crypto-fix-missing-blktrace-bio-split-events.patch cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch crypto-rockchip-fix-dma_unmap_sg-nents-value.patch drm-exynos-exynos7_drm_decon-fix-uninitialized-crtc-reference-in-functions.patch drm-exynos-exynos7_drm_decon-properly-clear-channels-during-bind.patch drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch media-lirc-fix-error-handling-in-lirc_register.patch media-rc-directly-use-ida_free.patch media-s5p-mfc-remove-an-unused-uninitialized-variable.patch --- diff --git a/queue-5.15/blk-crypto-fix-missing-blktrace-bio-split-events.patch b/queue-5.15/blk-crypto-fix-missing-blktrace-bio-split-events.patch new file mode 100644 index 0000000000..93d762aa94 --- /dev/null +++ b/queue-5.15/blk-crypto-fix-missing-blktrace-bio-split-events.patch @@ -0,0 +1,48 @@ +From stable+bounces-187842-greg=kroah.com@vger.kernel.org Sat Oct 18 16:51:38 2025 +From: Sasha Levin +Date: Sat, 18 Oct 2025 10:51:29 -0400 +Subject: blk-crypto: fix missing blktrace bio split events +To: stable@vger.kernel.org +Cc: Yu Kuai , Bart Van Assche , Christoph Hellwig , Jens Axboe , Sasha Levin +Message-ID: <20251018145130.791122-1-sashal@kernel.org> + +From: Yu Kuai + +[ Upstream commit 06d712d297649f48ebf1381d19bd24e942813b37 ] + +trace_block_split() is missing, resulting in blktrace inability to catch +BIO split events and making it harder to analyze the BIO sequence. + +Cc: stable@vger.kernel.org +Fixes: 488f6682c832 ("block: blk-crypto-fallback for Inline Encryption") +Signed-off-by: Yu Kuai +Reviewed-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +[ changed blk_crypto_fallback_split_bio_if_needed() to blk_crypto_split_bio_if_needed() ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-crypto-fallback.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/block/blk-crypto-fallback.c ++++ b/block/blk-crypto-fallback.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #include "blk-crypto-internal.h" + +@@ -231,7 +232,9 @@ static bool blk_crypto_split_bio_if_need + bio->bi_status = BLK_STS_RESOURCE; + return false; + } ++ + bio_chain(split_bio, bio); ++ trace_block_split(split_bio, bio->bi_iter.bi_sector); + submit_bio_noacct(bio); + *bio_ptr = split_bio; + } diff --git a/queue-5.15/cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch b/queue-5.15/cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch new file mode 100644 index 0000000000..794c6ba873 --- /dev/null +++ b/queue-5.15/cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch @@ -0,0 +1,85 @@ +From stable+bounces-187856-greg=kroah.com@vger.kernel.org Sat Oct 18 18:55:18 2025 +From: Sasha Levin +Date: Sat, 18 Oct 2025 12:55:09 -0400 +Subject: cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay +To: stable@vger.kernel.org +Cc: "Rafael J. Wysocki" , "Mario Limonciello (AMD)" , Jie Zhan , Viresh Kumar , Qais Yousef , Sasha Levin +Message-ID: <20251018165510.848330-1-sashal@kernel.org> + +From: "Rafael J. Wysocki" + +[ Upstream commit f965d111e68f4a993cc44d487d416e3d954eea11 ] + +If cppc_get_transition_latency() returns CPUFREQ_ETERNAL to indicate a +failure to retrieve the transition latency value from the platform +firmware, the CPPC cpufreq driver will use that value (converted to +microseconds) as the policy transition delay, but it is way too large +for any practical use. + +Address this by making the driver use the cpufreq's default +transition latency value (in microseconds) as the transition delay +if CPUFREQ_ETERNAL is returned by cppc_get_transition_latency(). + +Fixes: d4f3388afd48 ("cpufreq / CPPC: Set platform specific transition_delay_us") +Cc: 5.19+ # 5.19 +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mario Limonciello (AMD) +Reviewed-by: Jie Zhan +Acked-by: Viresh Kumar +Reviewed-by: Qais Yousef +[ added CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS definition to include/linux/cpufreq.h ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/cppc_cpufreq.c | 14 ++++++++++++-- + include/linux/cpufreq.h | 3 +++ + 2 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -395,6 +395,16 @@ static int cppc_verify_policy(struct cpu + return 0; + } + ++static unsigned int __cppc_cpufreq_get_transition_delay_us(unsigned int cpu) ++{ ++ unsigned int transition_latency_ns = cppc_get_transition_latency(cpu); ++ ++ if (transition_latency_ns == CPUFREQ_ETERNAL) ++ return CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS / NSEC_PER_USEC; ++ ++ return transition_latency_ns / NSEC_PER_USEC; ++} ++ + /* + * The PCC subspace describes the rate at which platform can accept commands + * on the shared PCC channel (including READs which do not count towards freq +@@ -417,14 +427,14 @@ static unsigned int cppc_cpufreq_get_tra + return 10000; + } + } +- return cppc_get_transition_latency(cpu) / NSEC_PER_USEC; ++ return __cppc_cpufreq_get_transition_delay_us(cpu); + } + + #else + + static unsigned int cppc_cpufreq_get_transition_delay_us(unsigned int cpu) + { +- return cppc_get_transition_latency(cpu) / NSEC_PER_USEC; ++ return __cppc_cpufreq_get_transition_delay_us(cpu); + } + #endif + +--- a/include/linux/cpufreq.h ++++ b/include/linux/cpufreq.h +@@ -32,6 +32,9 @@ + */ + + #define CPUFREQ_ETERNAL (-1) ++ ++#define CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS NSEC_PER_MSEC ++ + #define CPUFREQ_NAME_LEN 16 + /* Print length for names. Extra 1 space for accommodating '\n' in prints */ + #define CPUFREQ_NAME_PLEN (CPUFREQ_NAME_LEN + 1) diff --git a/queue-5.15/crypto-rockchip-fix-dma_unmap_sg-nents-value.patch b/queue-5.15/crypto-rockchip-fix-dma_unmap_sg-nents-value.patch new file mode 100644 index 0000000000..f51517615f --- /dev/null +++ b/queue-5.15/crypto-rockchip-fix-dma_unmap_sg-nents-value.patch @@ -0,0 +1,40 @@ +From stable+bounces-187869-greg=kroah.com@vger.kernel.org Sat Oct 18 21:42:44 2025 +From: Sasha Levin +Date: Sat, 18 Oct 2025 15:42:37 -0400 +Subject: crypto: rockchip - Fix dma_unmap_sg() nents value +To: stable@vger.kernel.org +Cc: Thomas Fourier , Herbert Xu , Sasha Levin +Message-ID: <20251018194237.892519-1-sashal@kernel.org> + +From: Thomas Fourier + +[ Upstream commit 21140e5caf019e4a24e1ceabcaaa16bd693b393f ] + +The dma_unmap_sg() functions should be called with the same nents as the +dma_map_sg(), not the value the map function returned. + +Fixes: 57d67c6e8219 ("crypto: rockchip - rework by using crypto_engine") +Cc: +Signed-off-by: Thomas Fourier +Signed-off-by: Herbert Xu +[ removed unused rctx variable declaration since device pointer already came from tctx->dev->dev instead of rctx->dev ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/rockchip/rk3288_crypto_ahash.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/crypto/rockchip/rk3288_crypto_ahash.c ++++ b/drivers/crypto/rockchip/rk3288_crypto_ahash.c +@@ -236,10 +236,9 @@ static int rk_hash_unprepare(struct cryp + { + struct ahash_request *areq = container_of(breq, struct ahash_request, base); + struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq); +- struct rk_ahash_rctx *rctx = ahash_request_ctx(areq); + struct rk_ahash_ctx *tctx = crypto_ahash_ctx(tfm); + +- dma_unmap_sg(tctx->dev->dev, areq->src, rctx->nrsg, DMA_TO_DEVICE); ++ dma_unmap_sg(tctx->dev->dev, areq->src, sg_nents(areq->src), DMA_TO_DEVICE); + return 0; + } + diff --git a/queue-5.15/drm-exynos-exynos7_drm_decon-fix-uninitialized-crtc-reference-in-functions.patch b/queue-5.15/drm-exynos-exynos7_drm_decon-fix-uninitialized-crtc-reference-in-functions.patch new file mode 100644 index 0000000000..df33b099ee --- /dev/null +++ b/queue-5.15/drm-exynos-exynos7_drm_decon-fix-uninitialized-crtc-reference-in-functions.patch @@ -0,0 +1,67 @@ +From stable+bounces-187795-greg=kroah.com@vger.kernel.org Sat Oct 18 04:35:09 2025 +From: Sasha Levin +Date: Fri, 17 Oct 2025 22:34:55 -0400 +Subject: drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions +To: stable@vger.kernel.org +Cc: Kaustabh Chakraborty , Inki Dae , Sasha Levin +Message-ID: <20251018023457.221641-1-sashal@kernel.org> + +From: Kaustabh Chakraborty + +[ Upstream commit d31bbacf783daf1e71fbe5c68df93550c446bf44 ] + +Modify the functions to accept a pointer to struct decon_context +instead. + +Signed-off-by: Kaustabh Chakraborty +Signed-off-by: Inki Dae +Stable-dep-of: e1361a4f1be9 ("drm/exynos: exynos7_drm_decon: remove ctx->suspended") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos7_drm_decon.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +@@ -81,10 +81,8 @@ static const enum drm_plane_type decon_w + DRM_PLANE_TYPE_CURSOR, + }; + +-static void decon_wait_for_vblank(struct exynos_drm_crtc *crtc) ++static void decon_wait_for_vblank(struct decon_context *ctx) + { +- struct decon_context *ctx = crtc->ctx; +- + if (ctx->suspended) + return; + +@@ -100,9 +98,8 @@ static void decon_wait_for_vblank(struct + DRM_DEV_DEBUG_KMS(ctx->dev, "vblank wait timed out.\n"); + } + +-static void decon_clear_channels(struct exynos_drm_crtc *crtc) ++static void decon_clear_channels(struct decon_context *ctx) + { +- struct decon_context *ctx = crtc->ctx; + unsigned int win, ch_enabled = 0; + + /* Check if any channel is enabled. */ +@@ -118,7 +115,7 @@ static void decon_clear_channels(struct + + /* Wait for vsync, as disable channel takes effect at next vsync */ + if (ch_enabled) +- decon_wait_for_vblank(ctx->crtc); ++ decon_wait_for_vblank(ctx); + } + + static int decon_ctx_initialize(struct decon_context *ctx, +@@ -126,7 +123,7 @@ static int decon_ctx_initialize(struct d + { + ctx->drm_dev = drm_dev; + +- decon_clear_channels(ctx->crtc); ++ decon_clear_channels(ctx); + + return exynos_drm_register_dma(drm_dev, ctx->dev, &ctx->dma_priv); + } diff --git a/queue-5.15/drm-exynos-exynos7_drm_decon-properly-clear-channels-during-bind.patch b/queue-5.15/drm-exynos-exynos7_drm_decon-properly-clear-channels-during-bind.patch new file mode 100644 index 0000000000..0433ca0870 --- /dev/null +++ b/queue-5.15/drm-exynos-exynos7_drm_decon-properly-clear-channels-during-bind.patch @@ -0,0 +1,117 @@ +From stable+bounces-187797-greg=kroah.com@vger.kernel.org Sat Oct 18 04:35:12 2025 +From: Sasha Levin +Date: Fri, 17 Oct 2025 22:34:56 -0400 +Subject: drm/exynos: exynos7_drm_decon: properly clear channels during bind +To: stable@vger.kernel.org +Cc: Kaustabh Chakraborty , Inki Dae , Sasha Levin +Message-ID: <20251018023457.221641-2-sashal@kernel.org> + +From: Kaustabh Chakraborty + +[ Upstream commit 5f1a453974204175f20b3788824a0fe23cc36f79 ] + +The DECON channels are not cleared properly as the windows aren't +shadow protected. When accompanied with an IOMMU, it pagefaults, and +the kernel panics. + +Implement shadow protect/unprotect, along with a standalone update, +for channel clearing to properly take effect. + +Signed-off-by: Kaustabh Chakraborty +Signed-off-by: Inki Dae +Stable-dep-of: e1361a4f1be9 ("drm/exynos: exynos7_drm_decon: remove ctx->suspended") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos7_drm_decon.c | 55 ++++++++++++++++------------- + 1 file changed, 32 insertions(+), 23 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +@@ -81,6 +81,28 @@ static const enum drm_plane_type decon_w + DRM_PLANE_TYPE_CURSOR, + }; + ++/** ++ * decon_shadow_protect_win() - disable updating values from shadow registers at vsync ++ * ++ * @ctx: display and enhancement controller context ++ * @win: window to protect registers for ++ * @protect: 1 to protect (disable updates) ++ */ ++static void decon_shadow_protect_win(struct decon_context *ctx, ++ unsigned int win, bool protect) ++{ ++ u32 bits, val; ++ ++ bits = SHADOWCON_WINx_PROTECT(win); ++ ++ val = readl(ctx->regs + SHADOWCON); ++ if (protect) ++ val |= bits; ++ else ++ val &= ~bits; ++ writel(val, ctx->regs + SHADOWCON); ++} ++ + static void decon_wait_for_vblank(struct decon_context *ctx) + { + if (ctx->suspended) +@@ -101,18 +123,27 @@ static void decon_wait_for_vblank(struct + static void decon_clear_channels(struct decon_context *ctx) + { + unsigned int win, ch_enabled = 0; ++ u32 val; + + /* Check if any channel is enabled. */ + for (win = 0; win < WINDOWS_NR; win++) { +- u32 val = readl(ctx->regs + WINCON(win)); ++ val = readl(ctx->regs + WINCON(win)); + + if (val & WINCONx_ENWIN) { ++ decon_shadow_protect_win(ctx, win, true); ++ + val &= ~WINCONx_ENWIN; + writel(val, ctx->regs + WINCON(win)); + ch_enabled = 1; ++ ++ decon_shadow_protect_win(ctx, win, false); + } + } + ++ val = readl(ctx->regs + DECON_UPDATE); ++ val |= DECON_UPDATE_STANDALONE_F; ++ writel(val, ctx->regs + DECON_UPDATE); ++ + /* Wait for vsync, as disable channel takes effect at next vsync */ + if (ch_enabled) + decon_wait_for_vblank(ctx); +@@ -340,28 +371,6 @@ static void decon_win_set_colkey(struct + writel(keycon1, ctx->regs + WKEYCON1_BASE(win)); + } + +-/** +- * decon_shadow_protect_win() - disable updating values from shadow registers at vsync +- * +- * @ctx: display and enhancement controller context +- * @win: window to protect registers for +- * @protect: 1 to protect (disable updates) +- */ +-static void decon_shadow_protect_win(struct decon_context *ctx, +- unsigned int win, bool protect) +-{ +- u32 bits, val; +- +- bits = SHADOWCON_WINx_PROTECT(win); +- +- val = readl(ctx->regs + SHADOWCON); +- if (protect) +- val |= bits; +- else +- val &= ~bits; +- writel(val, ctx->regs + SHADOWCON); +-} +- + static void decon_atomic_begin(struct exynos_drm_crtc *crtc) + { + struct decon_context *ctx = crtc->ctx; diff --git a/queue-5.15/drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch b/queue-5.15/drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch new file mode 100644 index 0000000000..5b29e25764 --- /dev/null +++ b/queue-5.15/drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch @@ -0,0 +1,166 @@ +From stable+bounces-187796-greg=kroah.com@vger.kernel.org Sat Oct 18 04:35:07 2025 +From: Sasha Levin +Date: Fri, 17 Oct 2025 22:34:57 -0400 +Subject: drm/exynos: exynos7_drm_decon: remove ctx->suspended +To: stable@vger.kernel.org +Cc: Kaustabh Chakraborty , Inki Dae , Sasha Levin +Message-ID: <20251018023457.221641-3-sashal@kernel.org> + +From: Kaustabh Chakraborty + +[ Upstream commit e1361a4f1be9cb69a662c6d7b5ce218007d6e82b ] + +Condition guards are found to be redundant, as the call flow is properly +managed now, as also observed in the Exynos5433 DECON driver. Since +state checking is no longer necessary, remove it. + +This also fixes an issue which prevented decon_commit() from +decon_atomic_enable() due to an incorrect state change setting. + +Fixes: 96976c3d9aff ("drm/exynos: Add DECON driver") +Cc: stable@vger.kernel.org +Suggested-by: Inki Dae +Signed-off-by: Kaustabh Chakraborty +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 ----------------------------- + 1 file changed, 36 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +@@ -51,7 +51,6 @@ struct decon_context { + void __iomem *regs; + unsigned long irq_flags; + bool i80_if; +- bool suspended; + wait_queue_head_t wait_vsync_queue; + atomic_t wait_vsync_event; + +@@ -105,9 +104,6 @@ static void decon_shadow_protect_win(str + + static void decon_wait_for_vblank(struct decon_context *ctx) + { +- if (ctx->suspended) +- return; +- + atomic_set(&ctx->wait_vsync_event, 1); + + /* +@@ -183,9 +179,6 @@ static void decon_commit(struct exynos_d + struct drm_display_mode *mode = &crtc->base.state->adjusted_mode; + u32 val, clkdiv; + +- if (ctx->suspended) +- return; +- + /* nothing to do if we haven't set the mode yet */ + if (mode->htotal == 0 || mode->vtotal == 0) + return; +@@ -247,9 +240,6 @@ static int decon_enable_vblank(struct ex + struct decon_context *ctx = crtc->ctx; + u32 val; + +- if (ctx->suspended) +- return -EPERM; +- + if (!test_and_set_bit(0, &ctx->irq_flags)) { + val = readl(ctx->regs + VIDINTCON0); + +@@ -272,9 +262,6 @@ static void decon_disable_vblank(struct + struct decon_context *ctx = crtc->ctx; + u32 val; + +- if (ctx->suspended) +- return; +- + if (test_and_clear_bit(0, &ctx->irq_flags)) { + val = readl(ctx->regs + VIDINTCON0); + +@@ -376,9 +363,6 @@ static void decon_atomic_begin(struct ex + struct decon_context *ctx = crtc->ctx; + int i; + +- if (ctx->suspended) +- return; +- + for (i = 0; i < WINDOWS_NR; i++) + decon_shadow_protect_win(ctx, i, true); + } +@@ -398,9 +382,6 @@ static void decon_update_plane(struct ex + unsigned int cpp = fb->format->cpp[0]; + unsigned int pitch = fb->pitches[0]; + +- if (ctx->suspended) +- return; +- + /* + * SHADOWCON/PRTCON register is used for enabling timing. + * +@@ -488,9 +469,6 @@ static void decon_disable_plane(struct e + unsigned int win = plane->index; + u32 val; + +- if (ctx->suspended) +- return; +- + /* protect windows */ + decon_shadow_protect_win(ctx, win, true); + +@@ -509,9 +487,6 @@ static void decon_atomic_flush(struct ex + struct decon_context *ctx = crtc->ctx; + int i; + +- if (ctx->suspended) +- return; +- + for (i = 0; i < WINDOWS_NR; i++) + decon_shadow_protect_win(ctx, i, false); + exynos_crtc_handle_event(crtc); +@@ -539,9 +514,6 @@ static void decon_atomic_enable(struct e + struct decon_context *ctx = crtc->ctx; + int ret; + +- if (!ctx->suspended) +- return; +- + ret = pm_runtime_resume_and_get(ctx->dev); + if (ret < 0) { + DRM_DEV_ERROR(ctx->dev, "failed to enable DECON device.\n"); +@@ -555,8 +527,6 @@ static void decon_atomic_enable(struct e + decon_enable_vblank(ctx->crtc); + + decon_commit(ctx->crtc); +- +- ctx->suspended = false; + } + + static void decon_atomic_disable(struct exynos_drm_crtc *crtc) +@@ -564,9 +534,6 @@ static void decon_atomic_disable(struct + struct decon_context *ctx = crtc->ctx; + int i; + +- if (ctx->suspended) +- return; +- + /* + * We need to make sure that all windows are disabled before we + * suspend that connector. Otherwise we might try to scan from +@@ -576,8 +543,6 @@ static void decon_atomic_disable(struct + decon_disable_plane(crtc, &ctx->planes[i]); + + pm_runtime_put_sync(ctx->dev); +- +- ctx->suspended = true; + } + + static const struct exynos_drm_crtc_ops decon_crtc_ops = { +@@ -699,7 +664,6 @@ static int decon_probe(struct platform_d + return -ENOMEM; + + ctx->dev = dev; +- ctx->suspended = true; + + i80_if_timings = of_get_child_by_name(dev->of_node, "i80-if-timings"); + if (i80_if_timings) diff --git a/queue-5.15/media-lirc-fix-error-handling-in-lirc_register.patch b/queue-5.15/media-lirc-fix-error-handling-in-lirc_register.patch new file mode 100644 index 0000000000..670d7f9b49 --- /dev/null +++ b/queue-5.15/media-lirc-fix-error-handling-in-lirc_register.patch @@ -0,0 +1,56 @@ +From stable+bounces-187336-greg=kroah.com@vger.kernel.org Fri Oct 17 17:48:05 2025 +From: Sasha Levin +Date: Fri, 17 Oct 2025 11:43:04 -0400 +Subject: media: lirc: Fix error handling in lirc_register() +To: stable@vger.kernel.org +Cc: Ma Ke , Sean Young , Hans Verkuil , Sasha Levin +Message-ID: <20251017154304.4038374-2-sashal@kernel.org> + +From: Ma Ke + +[ Upstream commit 4f4098c57e139ad972154077fb45c3e3141555dd ] + +When cdev_device_add() failed, calling put_device() to explicitly +release dev->lirc_dev. Otherwise, it could cause the fault of the +reference count. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi") +Signed-off-by: Ma Ke +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/lirc_dev.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -748,11 +748,11 @@ int lirc_register(struct rc_dev *dev) + + cdev_init(&dev->lirc_cdev, &lirc_fops); + ++ get_device(&dev->dev); ++ + err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev); + if (err) +- goto out_ida; +- +- get_device(&dev->dev); ++ goto out_put_device; + + switch (dev->driver_type) { + case RC_DRIVER_SCANCODE: +@@ -776,7 +776,8 @@ int lirc_register(struct rc_dev *dev) + + return 0; + +-out_ida: ++out_put_device: ++ put_device(&dev->lirc_dev); + ida_free(&lirc_ida, minor); + return err; + } diff --git a/queue-5.15/media-rc-directly-use-ida_free.patch b/queue-5.15/media-rc-directly-use-ida_free.patch new file mode 100644 index 0000000000..3627a2cd01 --- /dev/null +++ b/queue-5.15/media-rc-directly-use-ida_free.patch @@ -0,0 +1,84 @@ +From stable+bounces-187337-greg=kroah.com@vger.kernel.org Fri Oct 17 18:02:16 2025 +From: Sasha Levin +Date: Fri, 17 Oct 2025 11:43:03 -0400 +Subject: media: rc: Directly use ida_free() +To: stable@vger.kernel.org +Cc: keliu , Sean Young , Mauro Carvalho Chehab , Sasha Levin +Message-ID: <20251017154304.4038374-1-sashal@kernel.org> + +From: keliu + +[ Upstream commit cd54ff938091d890edf78e6555ec30c63dcd2eb5 ] + +Use ida_alloc() and ida_free() instead of the deprecated +ida_simple_get() and ida_simple_remove(). + +Signed-off-by: keliu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 4f4098c57e13 ("media: lirc: Fix error handling in lirc_register()") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/lirc_dev.c | 6 +++--- + drivers/media/rc/rc-main.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -732,7 +732,7 @@ int lirc_register(struct rc_dev *dev) + const char *rx_type, *tx_type; + int err, minor; + +- minor = ida_simple_get(&lirc_ida, 0, RC_DEV_MAX, GFP_KERNEL); ++ minor = ida_alloc_max(&lirc_ida, RC_DEV_MAX - 1, GFP_KERNEL); + if (minor < 0) + return minor; + +@@ -777,7 +777,7 @@ int lirc_register(struct rc_dev *dev) + return 0; + + out_ida: +- ida_simple_remove(&lirc_ida, minor); ++ ida_free(&lirc_ida, minor); + return err; + } + +@@ -795,7 +795,7 @@ void lirc_unregister(struct rc_dev *dev) + spin_unlock_irqrestore(&dev->lirc_fh_lock, flags); + + cdev_device_del(&dev->lirc_cdev, &dev->lirc_dev); +- ida_simple_remove(&lirc_ida, MINOR(dev->lirc_dev.devt)); ++ ida_free(&lirc_ida, MINOR(dev->lirc_dev.devt)); + } + + int __init lirc_dev_init(void) +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1897,7 +1897,7 @@ int rc_register_device(struct rc_dev *de + if (!dev) + return -EINVAL; + +- minor = ida_simple_get(&rc_ida, 0, RC_DEV_MAX, GFP_KERNEL); ++ minor = ida_alloc_max(&rc_ida, RC_DEV_MAX - 1, GFP_KERNEL); + if (minor < 0) + return minor; + +@@ -1980,7 +1980,7 @@ out_rx_free: + out_raw: + ir_raw_event_free(dev); + out_minor: +- ida_simple_remove(&rc_ida, minor); ++ ida_free(&rc_ida, minor); + return rc; + } + EXPORT_SYMBOL_GPL(rc_register_device); +@@ -2040,7 +2040,7 @@ void rc_unregister_device(struct rc_dev + + device_del(&dev->dev); + +- ida_simple_remove(&rc_ida, dev->minor); ++ ida_free(&rc_ida, dev->minor); + + if (!dev->managed_alloc) + rc_free_device(dev); diff --git a/queue-5.15/media-s5p-mfc-remove-an-unused-uninitialized-variable.patch b/queue-5.15/media-s5p-mfc-remove-an-unused-uninitialized-variable.patch new file mode 100644 index 0000000000..79b0416ca3 --- /dev/null +++ b/queue-5.15/media-s5p-mfc-remove-an-unused-uninitialized-variable.patch @@ -0,0 +1,135 @@ +From stable+bounces-187373-greg=kroah.com@vger.kernel.org Fri Oct 17 17:49:34 2025 +From: Sasha Levin +Date: Fri, 17 Oct 2025 11:44:44 -0400 +Subject: media: s5p-mfc: remove an unused/uninitialized variable +To: stable@vger.kernel.org +Cc: Arnd Bergmann , Hans Verkuil , Sasha Levin +Message-ID: <20251017154444.4040031-1-sashal@kernel.org> + +From: Arnd Bergmann + +[ Upstream commit 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c ] + +The s5p_mfc_cmd_args structure in the v6 driver is never used, not +initialized to anything other than zero, but as of clang-21 this +causes a warning: + +drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c:45:7: error: variable 'h2r_args' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] + 45 | &h2r_args); + | ^~~~~~~~ + +Just remove this for simplicity. Since the function is also called +through a callback, this does require adding a trivial wrapper with +the correct prototype. + +Fixes: f96f3cfa0bb8 ("[media] s5p-mfc: Update MFC v4l2 driver to support MFC6.x") +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c | 35 ++++++++---------------- + 1 file changed, 13 insertions(+), 22 deletions(-) + +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_cmd_v6.c +@@ -14,8 +14,7 @@ + #include "s5p_mfc_opr.h" + #include "s5p_mfc_cmd_v6.h" + +-static int s5p_mfc_cmd_host2risc_v6(struct s5p_mfc_dev *dev, int cmd, +- struct s5p_mfc_cmd_args *args) ++static int s5p_mfc_cmd_host2risc_v6(struct s5p_mfc_dev *dev, int cmd) + { + mfc_debug(2, "Issue the command: %d\n", cmd); + +@@ -31,7 +30,6 @@ static int s5p_mfc_cmd_host2risc_v6(stru + + static int s5p_mfc_sys_init_cmd_v6(struct s5p_mfc_dev *dev) + { +- struct s5p_mfc_cmd_args h2r_args; + struct s5p_mfc_buf_size_v6 *buf_size = dev->variant->buf_size->priv; + int ret; + +@@ -41,33 +39,23 @@ static int s5p_mfc_sys_init_cmd_v6(struc + + mfc_write(dev, dev->ctx_buf.dma, S5P_FIMV_CONTEXT_MEM_ADDR_V6); + mfc_write(dev, buf_size->dev_ctx, S5P_FIMV_CONTEXT_MEM_SIZE_V6); +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SYS_INIT_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SYS_INIT_V6); + } + + static int s5p_mfc_sleep_cmd_v6(struct s5p_mfc_dev *dev) + { +- struct s5p_mfc_cmd_args h2r_args; +- +- memset(&h2r_args, 0, sizeof(struct s5p_mfc_cmd_args)); +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SLEEP_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SLEEP_V6); + } + + static int s5p_mfc_wakeup_cmd_v6(struct s5p_mfc_dev *dev) + { +- struct s5p_mfc_cmd_args h2r_args; +- +- memset(&h2r_args, 0, sizeof(struct s5p_mfc_cmd_args)); +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_WAKEUP_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_WAKEUP_V6); + } + + /* Open a new instance and get its number */ + static int s5p_mfc_open_inst_cmd_v6(struct s5p_mfc_ctx *ctx) + { + struct s5p_mfc_dev *dev = ctx->dev; +- struct s5p_mfc_cmd_args h2r_args; + int codec_type; + + mfc_debug(2, "Requested codec mode: %d\n", ctx->codec_mode); +@@ -129,23 +117,20 @@ static int s5p_mfc_open_inst_cmd_v6(stru + mfc_write(dev, ctx->ctx.size, S5P_FIMV_CONTEXT_MEM_SIZE_V6); + mfc_write(dev, 0, S5P_FIMV_D_CRC_CTRL_V6); /* no crc */ + +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6); + } + + /* Close instance */ + static int s5p_mfc_close_inst_cmd_v6(struct s5p_mfc_ctx *ctx) + { + struct s5p_mfc_dev *dev = ctx->dev; +- struct s5p_mfc_cmd_args h2r_args; + int ret = 0; + + dev->curr_ctx = ctx->num; + if (ctx->state != MFCINST_FREE) { + mfc_write(dev, ctx->inst_no, S5P_FIMV_INSTANCE_ID_V6); + ret = s5p_mfc_cmd_host2risc_v6(dev, +- S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6, +- &h2r_args); ++ S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6); + } else { + ret = -EINVAL; + } +@@ -153,9 +138,15 @@ static int s5p_mfc_close_inst_cmd_v6(str + return ret; + } + ++static int s5p_mfc_cmd_host2risc_v6_args(struct s5p_mfc_dev *dev, int cmd, ++ struct s5p_mfc_cmd_args *ignored) ++{ ++ return s5p_mfc_cmd_host2risc_v6(dev, cmd); ++} ++ + /* Initialize cmd function pointers for MFC v6 */ + static struct s5p_mfc_hw_cmds s5p_mfc_cmds_v6 = { +- .cmd_host2risc = s5p_mfc_cmd_host2risc_v6, ++ .cmd_host2risc = s5p_mfc_cmd_host2risc_v6_args, + .sys_init_cmd = s5p_mfc_sys_init_cmd_v6, + .sleep_cmd = s5p_mfc_sleep_cmd_v6, + .wakeup_cmd = s5p_mfc_wakeup_cmd_v6, diff --git a/queue-5.15/series b/queue-5.15/series index bafcad6e03..dafec9e1ab 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -3,3 +3,12 @@ kvm-arm64-prevent-access-to-vcpu-events-before-init.patch jbd2-ensure-that-all-ongoing-i-o-complete-before-freeing-blocks.patch ext4-detect-invalid-inline_data-extents-flag-combination.patch btrfs-fix-clearing-of-btrfs_fs_reloc_running-if-relocation-already-running.patch +media-s5p-mfc-remove-an-unused-uninitialized-variable.patch +media-rc-directly-use-ida_free.patch +media-lirc-fix-error-handling-in-lirc_register.patch +blk-crypto-fix-missing-blktrace-bio-split-events.patch +drm-exynos-exynos7_drm_decon-fix-uninitialized-crtc-reference-in-functions.patch +drm-exynos-exynos7_drm_decon-properly-clear-channels-during-bind.patch +drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch +crypto-rockchip-fix-dma_unmap_sg-nents-value.patch +cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch