From 00f7067ffa6254648dfe5f4b3a4ced0a99baa92a Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 20 Nov 2025 09:32:13 -0500 Subject: [PATCH] Fixes for all trees Signed-off-by: Sasha Levin --- ...event-memory-leak-in-ntrig_report_ve.patch | 55 +++++++++++++ queue-5.10/series | 1 + ...event-memory-leak-in-ntrig_report_ve.patch | 55 +++++++++++++ queue-5.15/series | 1 + ...event-memory-leak-in-ntrig_report_ve.patch | 55 +++++++++++++ queue-6.1/series | 1 + ...-fix-address-of-luxul-xap-1440-s-eth.patch | 41 ++++++++++ ...imx51-zii-rdu1-fix-audmux-node-names.patch | 51 ++++++++++++ ...ip-make-rk3588-gpu-opp-table-naming-.patch | 52 ++++++++++++ ...ip-set-correct-pinctrl-for-i2s1-8ch-.patch | 60 ++++++++++++++ ...event-memory-leak-in-ntrig_report_ve.patch | 55 +++++++++++++ ...fix-memory-leak-in-dualshock4_get_ca.patch | 45 +++++++++++ ...-potential-memory-leak-in-error-path.patch | 39 +++++++++ ...fix-kasan-out-of-bounds-warning-in-s.patch | 52 ++++++++++++ queue-6.12/series | 8 ++ ...-fix-address-of-luxul-xap-1440-s-eth.patch | 41 ++++++++++ ...imx51-zii-rdu1-fix-audmux-node-names.patch | 51 ++++++++++++ ...engicam-microgea-rmm-fix-report-rate.patch | 55 +++++++++++++ ...s-img-avoid-gpio0_mipi_csi-gpios-bei.patch | 51 ++++++++++++ ...p-kontron-fix-usb-otg-role-switching.patch | 81 +++++++++++++++++++ ...hip-drop-reset-from-rk3576-i2c9-node.patch | 38 +++++++++ ...ip-fix-pcie-power-enable-pin-for-big.patch | 38 +++++++++ ...ip-fix-usb-power-enable-pin-for-btt-.patch | 54 +++++++++++++ ...ip-make-rk3588-gpu-opp-table-naming-.patch | 52 ++++++++++++ ...ip-set-correct-pinctrl-for-i2s1-8ch-.patch | 60 ++++++++++++++ ...event-memory-leak-in-ntrig_report_ve.patch | 55 +++++++++++++ ...fix-memory-leak-in-dualshock4_get_ca.patch | 45 +++++++++++ ...-potential-memory-leak-in-error-path.patch | 39 +++++++++ ...585-correct-mismatched-pwm-chip-info.patch | 48 +++++++++++ queue-6.17/series | 14 ++++ ...-fix-address-of-luxul-xap-1440-s-eth.patch | 41 ++++++++++ ...imx51-zii-rdu1-fix-audmux-node-names.patch | 51 ++++++++++++ ...ip-set-correct-pinctrl-for-i2s1-8ch-.patch | 60 ++++++++++++++ ...event-memory-leak-in-ntrig_report_ve.patch | 55 +++++++++++++ ...-potential-memory-leak-in-error-path.patch | 39 +++++++++ queue-6.6/series | 5 ++ 36 files changed, 1544 insertions(+) create mode 100644 queue-5.10/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch create mode 100644 queue-5.15/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch create mode 100644 queue-6.1/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch create mode 100644 queue-6.12/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch create mode 100644 queue-6.12/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch create mode 100644 queue-6.12/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch create mode 100644 queue-6.12/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch create mode 100644 queue-6.12/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch create mode 100644 queue-6.12/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch create mode 100644 queue-6.12/hid-uclogic-fix-potential-memory-leak-in-error-path.patch create mode 100644 queue-6.12/net-dsa-sja1105-fix-kasan-out-of-bounds-warning-in-s.patch create mode 100644 queue-6.17/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch create mode 100644 queue-6.17/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch create mode 100644 queue-6.17/arm-dts-imx6ull-engicam-microgea-rmm-fix-report-rate.patch create mode 100644 queue-6.17/arm64-dts-imx8-ss-img-avoid-gpio0_mipi_csi-gpios-bei.patch create mode 100644 queue-6.17/arm64-dts-imx8mp-kontron-fix-usb-otg-role-switching.patch create mode 100644 queue-6.17/arm64-dts-rockchip-drop-reset-from-rk3576-i2c9-node.patch create mode 100644 queue-6.17/arm64-dts-rockchip-fix-pcie-power-enable-pin-for-big.patch create mode 100644 queue-6.17/arm64-dts-rockchip-fix-usb-power-enable-pin-for-btt-.patch create mode 100644 queue-6.17/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch create mode 100644 queue-6.17/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch create mode 100644 queue-6.17/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch create mode 100644 queue-6.17/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch create mode 100644 queue-6.17/hid-uclogic-fix-potential-memory-leak-in-error-path.patch create mode 100644 queue-6.17/pwm-adp5585-correct-mismatched-pwm-chip-info.patch create mode 100644 queue-6.6/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch create mode 100644 queue-6.6/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch create mode 100644 queue-6.6/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch create mode 100644 queue-6.6/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch create mode 100644 queue-6.6/hid-uclogic-fix-potential-memory-leak-in-error-path.patch diff --git a/queue-5.10/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch b/queue-5.10/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch new file mode 100644 index 0000000000..48fadcebd4 --- /dev/null +++ b/queue-5.10/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch @@ -0,0 +1,55 @@ +From b36f2dec642305e3f8ad5074aa88395342501f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Sep 2025 14:31:02 +0900 +Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version() + +From: Masami Ichikawa + +[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ] + +Use a scope-based cleanup helper for the buffer allocated with kmalloc() +in ntrig_report_version() to simplify the cleanup logic and prevent +memory leaks (specifically the !hid_is_usb()-case one). + +[jkosina@suse.com: elaborate on the actual existing leak] +Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") +Signed-off-by: Masami Ichikawa +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ntrig.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index a1128c5315fff..3c41f6841f775 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev) + int ret; + char buf[20]; + struct usb_device *usb_dev = hid_to_usb_dev(hdev); +- unsigned char *data = kmalloc(8, GFP_KERNEL); ++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL); + + if (!hid_is_usb(hdev)) + return; + + if (!data) +- goto err_free; ++ return; + + ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), + USB_REQ_CLEAR_FEATURE, +@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev) + hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n", + buf, data[2], data[3], data[4], data[5]); + } +- +-err_free: +- kfree(data); + } + + static ssize_t show_phys_width(struct device *dev, +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 674be8875d..2aa2a18e1f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -202,3 +202,4 @@ mm-ksm-fix-flag-dropping-behavior-in-ksm_madvise.patch lib-crypto-arm-curve25519-disable-on-cpu_big_endian.patch mtd-onenand-pass-correct-pointer-to-irq-handler.patch netfilter-nf_tables-reject-duplicate-device-on-updat.patch +hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch diff --git a/queue-5.15/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch b/queue-5.15/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch new file mode 100644 index 0000000000..dd9335bad4 --- /dev/null +++ b/queue-5.15/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch @@ -0,0 +1,55 @@ +From 3026368bd71423492a42ce1097742bbfebd562de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Sep 2025 14:31:02 +0900 +Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version() + +From: Masami Ichikawa + +[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ] + +Use a scope-based cleanup helper for the buffer allocated with kmalloc() +in ntrig_report_version() to simplify the cleanup logic and prevent +memory leaks (specifically the !hid_is_usb()-case one). + +[jkosina@suse.com: elaborate on the actual existing leak] +Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") +Signed-off-by: Masami Ichikawa +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ntrig.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index a1128c5315fff..3c41f6841f775 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev) + int ret; + char buf[20]; + struct usb_device *usb_dev = hid_to_usb_dev(hdev); +- unsigned char *data = kmalloc(8, GFP_KERNEL); ++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL); + + if (!hid_is_usb(hdev)) + return; + + if (!data) +- goto err_free; ++ return; + + ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), + USB_REQ_CLEAR_FEATURE, +@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev) + hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n", + buf, data[2], data[3], data[4], data[5]); + } +- +-err_free: +- kfree(data); + } + + static ssize_t show_phys_width(struct device *dev, +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 917edc2521..4755f31dad 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -268,3 +268,4 @@ mm-ksm-fix-flag-dropping-behavior-in-ksm_madvise.patch lib-crypto-arm-curve25519-disable-on-cpu_big_endian.patch mtd-onenand-pass-correct-pointer-to-irq-handler.patch netfilter-nf_tables-reject-duplicate-device-on-updat.patch +hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch diff --git a/queue-6.1/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch b/queue-6.1/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch new file mode 100644 index 0000000000..bdc4cade0f --- /dev/null +++ b/queue-6.1/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch @@ -0,0 +1,55 @@ +From 7d71ad304e8523ec1c529447f9052695df250272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Sep 2025 14:31:02 +0900 +Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version() + +From: Masami Ichikawa + +[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ] + +Use a scope-based cleanup helper for the buffer allocated with kmalloc() +in ntrig_report_version() to simplify the cleanup logic and prevent +memory leaks (specifically the !hid_is_usb()-case one). + +[jkosina@suse.com: elaborate on the actual existing leak] +Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") +Signed-off-by: Masami Ichikawa +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ntrig.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index a1128c5315fff..3c41f6841f775 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev) + int ret; + char buf[20]; + struct usb_device *usb_dev = hid_to_usb_dev(hdev); +- unsigned char *data = kmalloc(8, GFP_KERNEL); ++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL); + + if (!hid_is_usb(hdev)) + return; + + if (!data) +- goto err_free; ++ return; + + ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), + USB_REQ_CLEAR_FEATURE, +@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev) + hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n", + buf, data[2], data[3], data[4], data[5]); + } +- +-err_free: +- kfree(data); + } + + static ssize_t show_phys_width(struct device *dev, +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 0e7a763ad7..3c39b1b494 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -395,3 +395,4 @@ lib-crypto-arm-curve25519-disable-on-cpu_big_endian.patch asm-generic-unify-uapi-bitsperlong.h-for-arm64-riscv.patch mtd-onenand-pass-correct-pointer-to-irq-handler.patch netfilter-nf_tables-reject-duplicate-device-on-updat.patch +hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch diff --git a/queue-6.12/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch b/queue-6.12/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch new file mode 100644 index 0000000000..d5114d7eed --- /dev/null +++ b/queue-6.12/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch @@ -0,0 +1,41 @@ +From 32a9ae5fb7323ceafb0ede54e8c92d4d2dbe6dd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 21:48:52 +0200 +Subject: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b ] + +Luxul XAP-1440 has BCM54210E PHY at address 25. + +Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts +index ac44c745bdf8e..a39a021a39107 100644 +--- a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts ++++ b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts +@@ -55,8 +55,8 @@ + mdio { + /delete-node/ switch@1e; + +- bcm54210e: ethernet-phy@0 { +- reg = <0>; ++ bcm54210e: ethernet-phy@25 { ++ reg = <25>; + }; + }; + }; +-- +2.51.0 + diff --git a/queue-6.12/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch b/queue-6.12/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch new file mode 100644 index 0000000000..09101d4f0d --- /dev/null +++ b/queue-6.12/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch @@ -0,0 +1,51 @@ +From 66f7784ae75dd440ef7c2e859410742ddc1407ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 00:06:55 +0200 +Subject: ARM: dts: imx51-zii-rdu1: Fix audmux node names + +From: Jihed Chaibi + +[ Upstream commit f31e261712a0d107f09fb1d3dc8f094806149c83 ] + +Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the +audmux configuration of imx51-zii-rdu1.dts to comply with the naming +convention in imx-audmux.yaml. + +This fixes the following dt-schema warning: + + imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2' + do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$' + +Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board") +Signed-off-by: Jihed Chaibi +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts +index 7cd17b43b4b26..33b0a427ed5ca 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts +@@ -259,7 +259,7 @@ + pinctrl-0 = <&pinctrl_audmux>; + status = "okay"; + +- ssi2 { ++ mux-ssi2 { + fsl,audmux-port = <1>; + fsl,port-config = < + (IMX_AUDMUX_V2_PTCR_SYN | +@@ -271,7 +271,7 @@ + >; + }; + +- aud3 { ++ mux-aud3 { + fsl,audmux-port = <2>; + fsl,port-config = < + IMX_AUDMUX_V2_PTCR_SYN +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch b/queue-6.12/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch new file mode 100644 index 0000000000..5d6ea666f3 --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch @@ -0,0 +1,52 @@ +From f5760919e5d9f0a5f6294bdc680862a908ae4073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 12:01:22 +0200 +Subject: arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic + +From: Dragan Simic + +[ Upstream commit b3fd04e23f6e4496f5a2279466a33fbdc83500f0 ] + +Unify the naming of the existing GPU OPP table nodes found in the RK3588 +and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following +the more "modern" node naming scheme. + +Fixes: a7b2070505a2 ("arm64: dts: rockchip: Split GPU OPPs of RK3588 and RK3588j") +Signed-off-by: Dragan Simic +[opp-table also is way too generic on systems with like 4-5 opp-tables] +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi | 2 +- + arch/arm64/boot/dts/rockchip/rk3588j.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi +index 0f1a776973516..b5d630d2c879f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi +@@ -115,7 +115,7 @@ + }; + }; + +- gpu_opp_table: opp-table { ++ gpu_opp_table: opp-table-gpu { + compatible = "operating-points-v2"; + + opp-300000000 { +diff --git a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi +index 3045cb3bd68c6..baa8b5b6bfe55 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi +@@ -66,7 +66,7 @@ + }; + }; + +- gpu_opp_table: opp-table { ++ gpu_opp_table: opp-table-gpu { + compatible = "operating-points-v2"; + + opp-300000000 { +-- +2.51.0 + diff --git a/queue-6.12/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch b/queue-6.12/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch new file mode 100644 index 0000000000..6404b0edbe --- /dev/null +++ b/queue-6.12/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch @@ -0,0 +1,60 @@ +From d082c3c53054ad6c6fa33448c35b5f2cd4a1f19f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:50:03 +0530 +Subject: arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on + odroid-m1 + +From: Anand Moon + +[ Upstream commit d425aef66e62221fa6bb0ccb94296df29e4cc107 ] + +Enable proper pin multiplexing for the I2S1 8-channel transmit interface by +adding the default pinctrl configuration which esures correct signal routing +and avoids pinmux conflicts during audio playback. + +Changes fix the error +[ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s +[ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s) +[ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl +[ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back + +I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0 +and SDO0 signals, so limit the claimed pins to those. + +With this change audio output works as expected: + +$ aplay -l +**** List of PLAYBACK Hardware Devices **** +card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0] + Subdevices: 1/1 + Subdevice #0: subdevice #0 +card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0] + Subdevices: 1/1 + Subdevice #0: subdevice #0 + +Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1") +Cc: Aurelien Jarno +Signed-off-by: Anand Moon +[adapted the commit message a bit] +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +index 6a02db4f073f2..a5426b82552ed 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +@@ -482,6 +482,8 @@ + }; + + &i2s1_8ch { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>; + rockchip,trcm-sync-tx-only; + status = "okay"; + }; +-- +2.51.0 + diff --git a/queue-6.12/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch b/queue-6.12/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch new file mode 100644 index 0000000000..26ee6bd386 --- /dev/null +++ b/queue-6.12/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch @@ -0,0 +1,55 @@ +From d57bb005a71f34061968c66337bf8699d3af94d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Sep 2025 14:31:02 +0900 +Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version() + +From: Masami Ichikawa + +[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ] + +Use a scope-based cleanup helper for the buffer allocated with kmalloc() +in ntrig_report_version() to simplify the cleanup logic and prevent +memory leaks (specifically the !hid_is_usb()-case one). + +[jkosina@suse.com: elaborate on the actual existing leak] +Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") +Signed-off-by: Masami Ichikawa +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ntrig.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index 0f76e241e0afb..a7f10c45f62bd 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev) + int ret; + char buf[20]; + struct usb_device *usb_dev = hid_to_usb_dev(hdev); +- unsigned char *data = kmalloc(8, GFP_KERNEL); ++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL); + + if (!hid_is_usb(hdev)) + return; + + if (!data) +- goto err_free; ++ return; + + ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), + USB_REQ_CLEAR_FEATURE, +@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev) + hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n", + buf, data[2], data[3], data[4], data[5]); + } +- +-err_free: +- kfree(data); + } + + static ssize_t show_phys_width(struct device *dev, +-- +2.51.0 + diff --git a/queue-6.12/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch b/queue-6.12/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch new file mode 100644 index 0000000000..9e81cf0103 --- /dev/null +++ b/queue-6.12/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch @@ -0,0 +1,45 @@ +From 9a5034a6ebf0cddf000563cc2575f8a18b77c7e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 22:45:50 +0530 +Subject: HID: playstation: Fix memory leak in + dualshock4_get_calibration_data() + +From: Abdun Nihaal + +[ Upstream commit 8513c154f8ad7097653dd9bf43d6155e5aad4ab3 ] + +The memory allocated for buf is not freed in the error paths when +ps_get_report() fails. Free buf before jumping to transfer_failed label + +Fixes: 947992c7fa9e ("HID: playstation: DS4: Fix calibration workaround for clone devices") +Signed-off-by: Abdun Nihaal +Reviewed-by: Silvan Jegen +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-playstation.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c +index 1468fb11e39df..657e9ae1be1ee 100644 +--- a/drivers/hid/hid-playstation.c ++++ b/drivers/hid/hid-playstation.c +@@ -1807,6 +1807,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4) + + hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret); + ret = -EILSEQ; ++ kfree(buf); + goto transfer_failed; + } else { + break; +@@ -1824,6 +1825,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4) + + if (ret) { + hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret); ++ kfree(buf); + goto transfer_failed; + } + } +-- +2.51.0 + diff --git a/queue-6.12/hid-uclogic-fix-potential-memory-leak-in-error-path.patch b/queue-6.12/hid-uclogic-fix-potential-memory-leak-in-error-path.patch new file mode 100644 index 0000000000..a879cce796 --- /dev/null +++ b/queue-6.12/hid-uclogic-fix-potential-memory-leak-in-error-path.patch @@ -0,0 +1,39 @@ +From 58fe6b54ae0bc7949f820de6ac29efc222814339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 22:59:41 +0530 +Subject: HID: uclogic: Fix potential memory leak in error path + +From: Abdun Nihaal + +[ Upstream commit a78eb69d60ce893de48dd75f725ba21309131fc2 ] + +In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for +event_hook is not freed in the next error path. Fix that by freeing it. + +Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection") +Signed-off-by: Abdun Nihaal +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-params.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index ef26c7defcf61..89fa2610f02ba 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -1367,8 +1367,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev, + event_hook->hdev = hdev; + event_hook->size = ARRAY_SIZE(reconnect_event); + event_hook->event = kmemdup(reconnect_event, event_hook->size, GFP_KERNEL); +- if (!event_hook->event) ++ if (!event_hook->event) { ++ kfree(event_hook); + return -ENOMEM; ++ } + + list_add_tail(&event_hook->list, &p->event_hooks->list); + +-- +2.51.0 + diff --git a/queue-6.12/net-dsa-sja1105-fix-kasan-out-of-bounds-warning-in-s.patch b/queue-6.12/net-dsa-sja1105-fix-kasan-out-of-bounds-warning-in-s.patch new file mode 100644 index 0000000000..4562e153c0 --- /dev/null +++ b/queue-6.12/net-dsa-sja1105-fix-kasan-out-of-bounds-warning-in-s.patch @@ -0,0 +1,52 @@ +From a7bc3271611fe35357892963f9cdca660deb387b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 14:12:31 +0800 +Subject: net: dsa: sja1105: fix kasan out-of-bounds warning in + sja1105_table_delete_entry() + +From: Vladimir Oltean + +[ Upstream commit 5f2b28b79d2d1946ee36ad8b3dc0066f73c90481 ] + +There are actually 2 problems: +- deleting the last element doesn't require the memmove of elements + [i + 1, end) over it. Actually, element i+1 is out of bounds. +- The memmove itself should move size - i - 1 elements, because the last + element is out of bounds. + +The out-of-bounds element still remains out of bounds after being +accessed, so the problem is only that we touch it, not that it becomes +in active use. But I suppose it can lead to issues if the out-of-bounds +element is part of an unmapped page. + +Fixes: 6666cebc5e30 ("net: dsa: sja1105: Add support for VLAN operations") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250318115716.2124395-4-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Chen Yu +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_static_config.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_static_config.c b/drivers/net/dsa/sja1105/sja1105_static_config.c +index baba204ad62f6..2ac91fe2a79bc 100644 +--- a/drivers/net/dsa/sja1105/sja1105_static_config.c ++++ b/drivers/net/dsa/sja1105/sja1105_static_config.c +@@ -1921,8 +1921,10 @@ int sja1105_table_delete_entry(struct sja1105_table *table, int i) + if (i > table->entry_count) + return -ERANGE; + +- memmove(entries + i * entry_size, entries + (i + 1) * entry_size, +- (table->entry_count - i) * entry_size); ++ if (i + 1 < table->entry_count) { ++ memmove(entries + i * entry_size, entries + (i + 1) * entry_size, ++ (table->entry_count - i - 1) * entry_size); ++ } + + table->entry_count--; + +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 2dc803def6..5c8450da16 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -96,3 +96,11 @@ fs-namespace-correctly-handle-errors-returned-by-gra.patch sched_ext-fix-unsafe-locking-in-the-scx_dump_state.patch revert-netfilter-nf_tables-reintroduce-shortened-del.patch netfilter-nf_tables-reject-duplicate-device-on-updat.patch +arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch +arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch +arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch +hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch +arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch +hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch +hid-uclogic-fix-potential-memory-leak-in-error-path.patch +net-dsa-sja1105-fix-kasan-out-of-bounds-warning-in-s.patch diff --git a/queue-6.17/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch b/queue-6.17/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch new file mode 100644 index 0000000000..f280a77357 --- /dev/null +++ b/queue-6.17/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch @@ -0,0 +1,41 @@ +From 65f61155752f83efb72ce68654f6d0029878fe1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 21:48:52 +0200 +Subject: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b ] + +Luxul XAP-1440 has BCM54210E PHY at address 25. + +Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts +index ac44c745bdf8e..a39a021a39107 100644 +--- a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts ++++ b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts +@@ -55,8 +55,8 @@ + mdio { + /delete-node/ switch@1e; + +- bcm54210e: ethernet-phy@0 { +- reg = <0>; ++ bcm54210e: ethernet-phy@25 { ++ reg = <25>; + }; + }; + }; +-- +2.51.0 + diff --git a/queue-6.17/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch b/queue-6.17/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch new file mode 100644 index 0000000000..de7231a85c --- /dev/null +++ b/queue-6.17/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch @@ -0,0 +1,51 @@ +From d59d0df8dff803aa67b4bd6641c8aff06576340b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 00:06:55 +0200 +Subject: ARM: dts: imx51-zii-rdu1: Fix audmux node names + +From: Jihed Chaibi + +[ Upstream commit f31e261712a0d107f09fb1d3dc8f094806149c83 ] + +Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the +audmux configuration of imx51-zii-rdu1.dts to comply with the naming +convention in imx-audmux.yaml. + +This fixes the following dt-schema warning: + + imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2' + do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$' + +Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board") +Signed-off-by: Jihed Chaibi +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts +index 06545a6052f71..43ff5eafb2bb8 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts +@@ -259,7 +259,7 @@ + pinctrl-0 = <&pinctrl_audmux>; + status = "okay"; + +- ssi2 { ++ mux-ssi2 { + fsl,audmux-port = <1>; + fsl,port-config = < + (IMX_AUDMUX_V2_PTCR_SYN | +@@ -271,7 +271,7 @@ + >; + }; + +- aud3 { ++ mux-aud3 { + fsl,audmux-port = <2>; + fsl,port-config = < + IMX_AUDMUX_V2_PTCR_SYN +-- +2.51.0 + diff --git a/queue-6.17/arm-dts-imx6ull-engicam-microgea-rmm-fix-report-rate.patch b/queue-6.17/arm-dts-imx6ull-engicam-microgea-rmm-fix-report-rate.patch new file mode 100644 index 0000000000..a882869d2e --- /dev/null +++ b/queue-6.17/arm-dts-imx6ull-engicam-microgea-rmm-fix-report-rate.patch @@ -0,0 +1,55 @@ +From 63bc8cf0ecbc79daca6ce47009c5db42d85634d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Sep 2025 11:16:31 +0200 +Subject: ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value + +From: Dario Binacchi + +[ Upstream commit 62bf7708fe80ec0db14b9179c25eeeda9f81e9d0 ] + +The 'report-rate-hz' property for the edt-ft5x06 driver was added and +handled in the Linux kernel by me with patches [1] and [2] for this +specific board. + +The v1 upstream version, which was the one applied to the customer's +kernel, used the 'report-rate' property, which was written directly to +the controller register. During review, the 'hz' suffix was added, +changing its handling so that writing the value directly to the register +was no longer possible for the M06 controller. + +Once the patches were accepted in mainline, I did not reapply them to +the customer's kernel, and when upstreaming the DTS for this board, I +forgot to correct the 'report-rate-hz' property value. + +The property must be set to 60 because this board uses the M06 controller, +which expects the report rate in units of 10 Hz, meaning the actual value +written to the register is 6. + +[1] 625f829586ea ("dt-bindings: input: touchscreen: edt-ft5x06: add report-rate-hz") +[2] 5bcee83a406c ("Input: edt-ft5x06 - set report rate by dts property") +Fixes: ffea3cac94ba ("ARM: dts: imx6ul: support Engicam MicroGEA RMM board") +Co-developed-by: Michael Trimarchi +Signed-off-by: Michael Trimarchi +Signed-off-by: Dario Binacchi +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts b/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts +index 5d1cc8a1f5558..8d41f76ae270b 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts +@@ -136,7 +136,7 @@ + interrupt-parent = <&gpio2>; + interrupts = <8 IRQ_TYPE_EDGE_FALLING>; + reset-gpios = <&gpio2 14 GPIO_ACTIVE_LOW>; +- report-rate-hz = <6>; ++ report-rate-hz = <60>; + /* settings valid only for Hycon touchscreen */ + touchscreen-size-x = <1280>; + touchscreen-size-y = <800>; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-imx8-ss-img-avoid-gpio0_mipi_csi-gpios-bei.patch b/queue-6.17/arm64-dts-imx8-ss-img-avoid-gpio0_mipi_csi-gpios-bei.patch new file mode 100644 index 0000000000..d886c25e99 --- /dev/null +++ b/queue-6.17/arm64-dts-imx8-ss-img-avoid-gpio0_mipi_csi-gpios-bei.patch @@ -0,0 +1,51 @@ +From a9678472258ef7fc727b7fa95d5baacf42cbb739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 09:56:43 -0300 +Subject: arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: João Paulo Gonçalves + +[ Upstream commit ec4daace64a44b53df76f0629e82684ef09ce869 ] + +The gpio0_mipi_csi DT nodes are enabled by default, but they are +dependent on the irqsteer_csi nodes, which are not enabled. This causes +the gpio0_mipi_csi GPIOs to be probe deferred. Since these GPIOs can be +used independently of the CSI controller, enable irqsteer_csi by default +too to prevent them from being deferred and to ensure they work out of +the box. + +Fixes: 2217f8243714 ("arm64: dts: imx8: add capture controller for i.MX8's img subsystem") +Signed-off-by: João Paulo Gonçalves +Reviewed-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi +index 2cf0f7208350a..a72b2f1c4a1b2 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi +@@ -67,7 +67,6 @@ img_subsys: bus@58000000 { + power-domains = <&pd IMX_SC_R_CSI_0>; + fsl,channel = <0>; + fsl,num-irqs = <32>; +- status = "disabled"; + }; + + gpio0_mipi_csi0: gpio@58222000 { +@@ -144,7 +143,6 @@ img_subsys: bus@58000000 { + power-domains = <&pd IMX_SC_R_CSI_1>; + fsl,channel = <0>; + fsl,num-irqs = <32>; +- status = "disabled"; + }; + + gpio0_mipi_csi1: gpio@58242000 { +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-imx8mp-kontron-fix-usb-otg-role-switching.patch b/queue-6.17/arm64-dts-imx8mp-kontron-fix-usb-otg-role-switching.patch new file mode 100644 index 0000000000..19d6db7315 --- /dev/null +++ b/queue-6.17/arm64-dts-imx8mp-kontron-fix-usb-otg-role-switching.patch @@ -0,0 +1,81 @@ +From 81a02694b7f529b1e6aa9014d318eda74dacbae5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Oct 2025 15:21:51 +0200 +Subject: arm64: dts: imx8mp-kontron: Fix USB OTG role switching + +From: Frieder Schrempf + +[ Upstream commit 6504297872c7a5d0d06247970d32940eba26b8b3 ] + +The VBUS supply regulator is currently assigned to the PHY node. +This causes the VBUS to be always on, even when the controller +needs to be switched to peripheral mode. + +Fix the OTG role switching by adding a connector node and moving +the VBUS supply regulator to that node. This way the VBUS gets +correctly switched according to the current role. + +Fixes: 946ab10e3f40 ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board") +Signed-off-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/freescale/imx8mp-kontron-bl-osm-s.dts | 24 +++++++++++++++---- + 1 file changed, 19 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts +index 0eb9e726a9b81..6c63f0a5fa91b 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts +@@ -16,11 +16,20 @@ + ethernet1 = &eqos; + }; + +- extcon_usbc: usbc { +- compatible = "linux,extcon-usb-gpio"; ++ connector { ++ compatible = "gpio-usb-b-connector", "usb-b-connector"; ++ id-gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>; ++ label = "Type-C"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb1_id>; +- id-gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>; ++ type = "micro"; ++ vbus-supply = <®_usb1_vbus>; ++ ++ port { ++ usb_dr_connector: endpoint { ++ remote-endpoint = <&usb3_dwc>; ++ }; ++ }; + }; + + leds { +@@ -230,9 +239,15 @@ + hnp-disable; + srp-disable; + dr_mode = "otg"; +- extcon = <&extcon_usbc>; + usb-role-switch; ++ role-switch-default-mode = "peripheral"; + status = "okay"; ++ ++ port { ++ usb3_dwc: endpoint { ++ remote-endpoint = <&usb_dr_connector>; ++ }; ++ }; + }; + + &usb_dwc3_1 { +@@ -261,7 +276,6 @@ + }; + + &usb3_phy0 { +- vbus-supply = <®_usb1_vbus>; + status = "okay"; + }; + +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-drop-reset-from-rk3576-i2c9-node.patch b/queue-6.17/arm64-dts-rockchip-drop-reset-from-rk3576-i2c9-node.patch new file mode 100644 index 0000000000..92bcdbdc0e --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-drop-reset-from-rk3576-i2c9-node.patch @@ -0,0 +1,38 @@ +From a69a2d6491a5a38b710e042cf103d79cbf14d443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Nov 2025 22:01:01 +0800 +Subject: arm64: dts: rockchip: drop reset from rk3576 i2c9 node + +From: Chukun Pan + +[ Upstream commit 264152a97edf9f1b7ed5372e4033e46108e41422 ] + +The reset property is not part of the binding, so drop it. +It is also not used by the driver, so it was likely copied +from some vendor-kernel node. + +Fixes: 57b1ce903966 ("arm64: dts: rockchip: Add rk3576 SoC base DT") +Signed-off-by: Chukun Pan +Link: https://patch.msgid.link/20251101140101.302229-1-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3576.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3576.dtsi b/arch/arm64/boot/dts/rockchip/rk3576.dtsi +index c3cdae8a54941..f236edcac3767 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3576.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3576.dtsi +@@ -2311,8 +2311,6 @@ + interrupts = ; + pinctrl-names = "default"; + pinctrl-0 = <&i2c9m0_xfer>; +- resets = <&cru SRST_I2C9>, <&cru SRST_P_I2C9>; +- reset-names = "i2c", "apb"; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-fix-pcie-power-enable-pin-for-big.patch b/queue-6.17/arm64-dts-rockchip-fix-pcie-power-enable-pin-for-big.patch new file mode 100644 index 0000000000..1407cc99d8 --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-fix-pcie-power-enable-pin-for-big.patch @@ -0,0 +1,38 @@ +From bae4d258941f561c7e100d1ac86fb983332e5b61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Oct 2025 14:33:36 +0200 +Subject: arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2 + and Pi2 + +From: Andrey Leonchikov + +[ Upstream commit e179de737d13ad99bd19ea0fafab759d4074a425 ] + +Fix typo into regulator GPIO definition. With current definition, PCIe +doesn't start up. Valid definition is already used in "pinctrl" section, +"pcie_drv" (gpio4, RK_PB1). + +Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") +Signed-off-by: Andrey Leonchikov +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi +index 7f578c50b4ad1..f74590af7e33f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi +@@ -120,7 +120,7 @@ + compatible = "regulator-fixed"; + regulator-name = "vcc3v3_pcie"; + enable-active-high; +- gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>; ++ gpios = <&gpio4 RK_PB1 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&pcie_drv>; + regulator-always-on; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-fix-usb-power-enable-pin-for-btt-.patch b/queue-6.17/arm64-dts-rockchip-fix-usb-power-enable-pin-for-btt-.patch new file mode 100644 index 0000000000..325a87bd55 --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-fix-usb-power-enable-pin-for-btt-.patch @@ -0,0 +1,54 @@ +From f5a9928f6c39372643d0a161248c649230107855 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Nov 2025 22:07:33 +0100 +Subject: arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2 + +From: Andrey Leonchikov + +[ Upstream commit a59e927ff46a967f84ddf94e89cbb045810e8974 ] + + Fix typo into regulator GPIO definition. With current + definition - USB powered off. Valid definition can be found on "pinctrl" + section: + vcc5v0_usb2t_en: vcc5v0-usb2t-en { + rockchip,pins = <3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_none>; + }; + + vcc5v0_usb2b_en: vcc5v0-usb2b-en { + rockchip,pins = <4 RK_PC4 RK_FUNC_GPIO &pcfg_pull_none>; + }; + +Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") +Signed-off-by: Andrey Leonchikov +Link: https://patch.msgid.link/20251105210741.850031-1-andreil499@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi +index f74590af7e33f..b6cf03a7ba66b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi +@@ -187,7 +187,7 @@ + vcc5v0_usb2b: regulator-vcc5v0-usb2b { + compatible = "regulator-fixed"; + enable-active-high; +- gpio = <&gpio0 RK_PC4 GPIO_ACTIVE_HIGH>; ++ gpio = <&gpio4 RK_PC4 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&vcc5v0_usb2b_en>; + regulator-name = "vcc5v0_usb2b"; +@@ -199,7 +199,7 @@ + vcc5v0_usb2t: regulator-vcc5v0-usb2t { + compatible = "regulator-fixed"; + enable-active-high; +- gpios = <&gpio0 RK_PD5 GPIO_ACTIVE_HIGH>; ++ gpios = <&gpio3 RK_PD5 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&vcc5v0_usb2t_en>; + regulator-name = "vcc5v0_usb2t"; +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch b/queue-6.17/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch new file mode 100644 index 0000000000..9b06a7fc77 --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch @@ -0,0 +1,52 @@ +From a16ebc8a789d1e545d60c550a9c638ee5b785c30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Sep 2025 12:01:22 +0200 +Subject: arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic + +From: Dragan Simic + +[ Upstream commit b3fd04e23f6e4496f5a2279466a33fbdc83500f0 ] + +Unify the naming of the existing GPU OPP table nodes found in the RK3588 +and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following +the more "modern" node naming scheme. + +Fixes: a7b2070505a2 ("arm64: dts: rockchip: Split GPU OPPs of RK3588 and RK3588j") +Signed-off-by: Dragan Simic +[opp-table also is way too generic on systems with like 4-5 opp-tables] +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi | 2 +- + arch/arm64/boot/dts/rockchip/rk3588j.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi +index 0f1a776973516..b5d630d2c879f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi +@@ -115,7 +115,7 @@ + }; + }; + +- gpu_opp_table: opp-table { ++ gpu_opp_table: opp-table-gpu { + compatible = "operating-points-v2"; + + opp-300000000 { +diff --git a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi +index 9884a5df47dfe..e1e0e3fc0ca70 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588j.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588j.dtsi +@@ -66,7 +66,7 @@ + }; + }; + +- gpu_opp_table: opp-table { ++ gpu_opp_table: opp-table-gpu { + compatible = "operating-points-v2"; + + opp-300000000 { +-- +2.51.0 + diff --git a/queue-6.17/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch b/queue-6.17/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch new file mode 100644 index 0000000000..553e25cfa8 --- /dev/null +++ b/queue-6.17/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch @@ -0,0 +1,60 @@ +From 8713acede5efaca102d198c834676e0fbd0b2217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:50:03 +0530 +Subject: arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on + odroid-m1 + +From: Anand Moon + +[ Upstream commit d425aef66e62221fa6bb0ccb94296df29e4cc107 ] + +Enable proper pin multiplexing for the I2S1 8-channel transmit interface by +adding the default pinctrl configuration which esures correct signal routing +and avoids pinmux conflicts during audio playback. + +Changes fix the error +[ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s +[ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s) +[ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl +[ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back + +I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0 +and SDO0 signals, so limit the claimed pins to those. + +With this change audio output works as expected: + +$ aplay -l +**** List of PLAYBACK Hardware Devices **** +card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0] + Subdevices: 1/1 + Subdevice #0: subdevice #0 +card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0] + Subdevices: 1/1 + Subdevice #0: subdevice #0 + +Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1") +Cc: Aurelien Jarno +Signed-off-by: Anand Moon +[adapted the commit message a bit] +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +index 0f844806ec542..442a2bc43ba8e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +@@ -482,6 +482,8 @@ + }; + + &i2s1_8ch { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>; + rockchip,trcm-sync-tx-only; + status = "okay"; + }; +-- +2.51.0 + diff --git a/queue-6.17/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch b/queue-6.17/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch new file mode 100644 index 0000000000..0efb869360 --- /dev/null +++ b/queue-6.17/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch @@ -0,0 +1,55 @@ +From ad400f8ffd0ea667b34f2c2bdaa0b1612eb136d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Sep 2025 14:31:02 +0900 +Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version() + +From: Masami Ichikawa + +[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ] + +Use a scope-based cleanup helper for the buffer allocated with kmalloc() +in ntrig_report_version() to simplify the cleanup logic and prevent +memory leaks (specifically the !hid_is_usb()-case one). + +[jkosina@suse.com: elaborate on the actual existing leak] +Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") +Signed-off-by: Masami Ichikawa +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ntrig.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index 0f76e241e0afb..a7f10c45f62bd 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev) + int ret; + char buf[20]; + struct usb_device *usb_dev = hid_to_usb_dev(hdev); +- unsigned char *data = kmalloc(8, GFP_KERNEL); ++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL); + + if (!hid_is_usb(hdev)) + return; + + if (!data) +- goto err_free; ++ return; + + ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), + USB_REQ_CLEAR_FEATURE, +@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev) + hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n", + buf, data[2], data[3], data[4], data[5]); + } +- +-err_free: +- kfree(data); + } + + static ssize_t show_phys_width(struct device *dev, +-- +2.51.0 + diff --git a/queue-6.17/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch b/queue-6.17/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch new file mode 100644 index 0000000000..d8e0814093 --- /dev/null +++ b/queue-6.17/hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch @@ -0,0 +1,45 @@ +From 74a86cc797ce6ca9b367e58b8c02ff72b3a5b147 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 22:45:50 +0530 +Subject: HID: playstation: Fix memory leak in + dualshock4_get_calibration_data() + +From: Abdun Nihaal + +[ Upstream commit 8513c154f8ad7097653dd9bf43d6155e5aad4ab3 ] + +The memory allocated for buf is not freed in the error paths when +ps_get_report() fails. Free buf before jumping to transfer_failed label + +Fixes: 947992c7fa9e ("HID: playstation: DS4: Fix calibration workaround for clone devices") +Signed-off-by: Abdun Nihaal +Reviewed-by: Silvan Jegen +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-playstation.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c +index 1468fb11e39df..657e9ae1be1ee 100644 +--- a/drivers/hid/hid-playstation.c ++++ b/drivers/hid/hid-playstation.c +@@ -1807,6 +1807,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4) + + hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret); + ret = -EILSEQ; ++ kfree(buf); + goto transfer_failed; + } else { + break; +@@ -1824,6 +1825,7 @@ static int dualshock4_get_calibration_data(struct dualshock4 *ds4) + + if (ret) { + hid_warn(hdev, "Failed to retrieve DualShock4 calibration info: %d\n", ret); ++ kfree(buf); + goto transfer_failed; + } + } +-- +2.51.0 + diff --git a/queue-6.17/hid-uclogic-fix-potential-memory-leak-in-error-path.patch b/queue-6.17/hid-uclogic-fix-potential-memory-leak-in-error-path.patch new file mode 100644 index 0000000000..d57926180c --- /dev/null +++ b/queue-6.17/hid-uclogic-fix-potential-memory-leak-in-error-path.patch @@ -0,0 +1,39 @@ +From e91aaf7f3d5994e8642d61993197a5488285b2ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 22:59:41 +0530 +Subject: HID: uclogic: Fix potential memory leak in error path + +From: Abdun Nihaal + +[ Upstream commit a78eb69d60ce893de48dd75f725ba21309131fc2 ] + +In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for +event_hook is not freed in the next error path. Fix that by freeing it. + +Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection") +Signed-off-by: Abdun Nihaal +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-params.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 4a17f7332c3f5..016d1f08bd1db 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -1369,8 +1369,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev, + event_hook->hdev = hdev; + event_hook->size = ARRAY_SIZE(reconnect_event); + event_hook->event = kmemdup(reconnect_event, event_hook->size, GFP_KERNEL); +- if (!event_hook->event) ++ if (!event_hook->event) { ++ kfree(event_hook); + return -ENOMEM; ++ } + + list_add_tail(&event_hook->list, &p->event_hooks->list); + +-- +2.51.0 + diff --git a/queue-6.17/pwm-adp5585-correct-mismatched-pwm-chip-info.patch b/queue-6.17/pwm-adp5585-correct-mismatched-pwm-chip-info.patch new file mode 100644 index 0000000000..c68e20a2d1 --- /dev/null +++ b/queue-6.17/pwm-adp5585-correct-mismatched-pwm-chip-info.patch @@ -0,0 +1,48 @@ +From 2ba8c8a957c2d9b34250bd1a0426311e16ccb917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Nov 2025 14:53:08 +0800 +Subject: pwm: adp5585: Correct mismatched pwm chip info +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luke Wang + +[ Upstream commit f84fd5bec502447df145f31734793714690ce27f ] + +The register addresses of ADP5585 and ADP5589 are swapped. + +Fixes: 75024f97e82e ("pwm: adp5585: add support for adp5589") +Signed-off-by: Luke Wang +Acked-by: Nuno Sá +Tested-by: Liu Ying # ADP5585 PWM +Link: https://patch.msgid.link/20251114065308.2074893-1-ziniu.wang_1@nxp.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-adp5585.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-adp5585.c b/drivers/pwm/pwm-adp5585.c +index dc2860979e24e..806f8d79b0d7b 100644 +--- a/drivers/pwm/pwm-adp5585.c ++++ b/drivers/pwm/pwm-adp5585.c +@@ -190,13 +190,13 @@ static int adp5585_pwm_probe(struct platform_device *pdev) + return 0; + } + +-static const struct adp5585_pwm_chip adp5589_pwm_chip_info = { ++static const struct adp5585_pwm_chip adp5585_pwm_chip_info = { + .pwm_cfg = ADP5585_PWM_CFG, + .pwm_offt_low = ADP5585_PWM_OFFT_LOW, + .pwm_ont_low = ADP5585_PWM_ONT_LOW, + }; + +-static const struct adp5585_pwm_chip adp5585_pwm_chip_info = { ++static const struct adp5585_pwm_chip adp5589_pwm_chip_info = { + .pwm_cfg = ADP5589_PWM_CFG, + .pwm_offt_low = ADP5589_PWM_OFFT_LOW, + .pwm_ont_low = ADP5589_PWM_ONT_LOW, +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series index bd1abc9ff7..9a49d0e730 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -132,3 +132,17 @@ perf-build-don-t-fail-fast-path-feature-detection-wh.patch perf-lock-fix-segfault-due-to-missing-kernel-map.patch perf-test-shell-lock_contention-extra-debug-diagnost.patch perf-test-fix-lock-contention-test.patch +arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch +arm64-dts-rockchip-fix-pcie-power-enable-pin-for-big.patch +arm64-dts-rockchip-make-rk3588-gpu-opp-table-naming-.patch +arm-dts-imx6ull-engicam-microgea-rmm-fix-report-rate.patch +arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch +arm64-dts-imx8-ss-img-avoid-gpio0_mipi_csi-gpios-bei.patch +arm64-dts-imx8mp-kontron-fix-usb-otg-role-switching.patch +hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch +arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch +arm64-dts-rockchip-fix-usb-power-enable-pin-for-btt-.patch +arm64-dts-rockchip-drop-reset-from-rk3576-i2c9-node.patch +pwm-adp5585-correct-mismatched-pwm-chip-info.patch +hid-playstation-fix-memory-leak-in-dualshock4_get_ca.patch +hid-uclogic-fix-potential-memory-leak-in-error-path.patch diff --git a/queue-6.6/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch b/queue-6.6/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch new file mode 100644 index 0000000000..5336e01895 --- /dev/null +++ b/queue-6.6/arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch @@ -0,0 +1,41 @@ +From 4719245e8b97fa950970578297f78924602ca8a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Oct 2025 21:48:52 +0200 +Subject: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b ] + +Luxul XAP-1440 has BCM54210E PHY at address 25. + +Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts +index ac44c745bdf8e..a39a021a39107 100644 +--- a/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts ++++ b/arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dts +@@ -55,8 +55,8 @@ + mdio { + /delete-node/ switch@1e; + +- bcm54210e: ethernet-phy@0 { +- reg = <0>; ++ bcm54210e: ethernet-phy@25 { ++ reg = <25>; + }; + }; + }; +-- +2.51.0 + diff --git a/queue-6.6/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch b/queue-6.6/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch new file mode 100644 index 0000000000..99cad8f22c --- /dev/null +++ b/queue-6.6/arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch @@ -0,0 +1,51 @@ +From bf6840c07c4ea513798f7f899505fedd2e677c17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 00:06:55 +0200 +Subject: ARM: dts: imx51-zii-rdu1: Fix audmux node names + +From: Jihed Chaibi + +[ Upstream commit f31e261712a0d107f09fb1d3dc8f094806149c83 ] + +Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the +audmux configuration of imx51-zii-rdu1.dts to comply with the naming +convention in imx-audmux.yaml. + +This fixes the following dt-schema warning: + + imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2' + do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$' + +Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board") +Signed-off-by: Jihed Chaibi +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts +index 5d4b29d765853..6cc4c2f08b15d 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts +@@ -259,7 +259,7 @@ + pinctrl-0 = <&pinctrl_audmux>; + status = "okay"; + +- ssi2 { ++ mux-ssi2 { + fsl,audmux-port = <1>; + fsl,port-config = < + (IMX_AUDMUX_V2_PTCR_SYN | +@@ -271,7 +271,7 @@ + >; + }; + +- aud3 { ++ mux-aud3 { + fsl,audmux-port = <2>; + fsl,port-config = < + IMX_AUDMUX_V2_PTCR_SYN +-- +2.51.0 + diff --git a/queue-6.6/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch b/queue-6.6/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch new file mode 100644 index 0000000000..60c042a183 --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch @@ -0,0 +1,60 @@ +From 885fb8b2c34d8f342191990e0c7c5aa09135900a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Oct 2025 20:50:03 +0530 +Subject: arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on + odroid-m1 + +From: Anand Moon + +[ Upstream commit d425aef66e62221fa6bb0ccb94296df29e4cc107 ] + +Enable proper pin multiplexing for the I2S1 8-channel transmit interface by +adding the default pinctrl configuration which esures correct signal routing +and avoids pinmux conflicts during audio playback. + +Changes fix the error +[ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s +[ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s) +[ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl +[ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back + +I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0 +and SDO0 signals, so limit the claimed pins to those. + +With this change audio output works as expected: + +$ aplay -l +**** List of PLAYBACK Hardware Devices **** +card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0] + Subdevices: 1/1 + Subdevice #0: subdevice #0 +card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0] + Subdevices: 1/1 + Subdevice #0: subdevice #0 + +Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1") +Cc: Aurelien Jarno +Signed-off-by: Anand Moon +[adapted the commit message a bit] +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +index 6a02db4f073f2..a5426b82552ed 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts +@@ -482,6 +482,8 @@ + }; + + &i2s1_8ch { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>; + rockchip,trcm-sync-tx-only; + status = "okay"; + }; +-- +2.51.0 + diff --git a/queue-6.6/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch b/queue-6.6/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch new file mode 100644 index 0000000000..31e908a4bf --- /dev/null +++ b/queue-6.6/hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch @@ -0,0 +1,55 @@ +From 5035fbc97c00da0b8e0db75e9c8e1a9866f9d6b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Sep 2025 14:31:02 +0900 +Subject: HID: hid-ntrig: Prevent memory leak in ntrig_report_version() + +From: Masami Ichikawa + +[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ] + +Use a scope-based cleanup helper for the buffer allocated with kmalloc() +in ntrig_report_version() to simplify the cleanup logic and prevent +memory leaks (specifically the !hid_is_usb()-case one). + +[jkosina@suse.com: elaborate on the actual existing leak] +Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") +Signed-off-by: Masami Ichikawa +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ntrig.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index a1128c5315fff..3c41f6841f775 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev) + int ret; + char buf[20]; + struct usb_device *usb_dev = hid_to_usb_dev(hdev); +- unsigned char *data = kmalloc(8, GFP_KERNEL); ++ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL); + + if (!hid_is_usb(hdev)) + return; + + if (!data) +- goto err_free; ++ return; + + ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0), + USB_REQ_CLEAR_FEATURE, +@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev) + hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n", + buf, data[2], data[3], data[4], data[5]); + } +- +-err_free: +- kfree(data); + } + + static ssize_t show_phys_width(struct device *dev, +-- +2.51.0 + diff --git a/queue-6.6/hid-uclogic-fix-potential-memory-leak-in-error-path.patch b/queue-6.6/hid-uclogic-fix-potential-memory-leak-in-error-path.patch new file mode 100644 index 0000000000..361ecef241 --- /dev/null +++ b/queue-6.6/hid-uclogic-fix-potential-memory-leak-in-error-path.patch @@ -0,0 +1,39 @@ +From 3fe4f44e02f0199944da63241c36305913b43c1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 22:59:41 +0530 +Subject: HID: uclogic: Fix potential memory leak in error path + +From: Abdun Nihaal + +[ Upstream commit a78eb69d60ce893de48dd75f725ba21309131fc2 ] + +In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for +event_hook is not freed in the next error path. Fix that by freeing it. + +Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection") +Signed-off-by: Abdun Nihaal +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-params.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 9859dad36495a..eee05d668e361 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -1364,8 +1364,10 @@ static int uclogic_params_ugee_v2_init_event_hooks(struct hid_device *hdev, + event_hook->hdev = hdev; + event_hook->size = ARRAY_SIZE(reconnect_event); + event_hook->event = kmemdup(reconnect_event, event_hook->size, GFP_KERNEL); +- if (!event_hook->event) ++ if (!event_hook->event) { ++ kfree(event_hook); + return -ENOMEM; ++ } + + list_add_tail(&event_hook->list, &p->event_hooks->list); + +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 3687ae605a..1428650e03 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -454,3 +454,8 @@ lib-crypto-arm-curve25519-disable-on-cpu_big_endian.patch bluetooth-hci_sync-fix-double-free-in-hci_discovery_.patch mtd-onenand-pass-correct-pointer-to-irq-handler.patch netfilter-nf_tables-reject-duplicate-device-on-updat.patch +arm64-dts-rockchip-set-correct-pinctrl-for-i2s1-8ch-.patch +arm-dts-imx51-zii-rdu1-fix-audmux-node-names.patch +hid-hid-ntrig-prevent-memory-leak-in-ntrig_report_ve.patch +arm-dts-bcm53573-fix-address-of-luxul-xap-1440-s-eth.patch +hid-uclogic-fix-potential-memory-leak-in-error-path.patch -- 2.47.3