--- /dev/null
+From 82730dba0cf9d9524af0ceeb7eb6b5c3ab1bdb87 Mon Sep 17 00:00:00 2001
+From: Leo Li <sunpeng.li@amd.com>
+Date: Thu, 23 Jul 2026 14:01:59 -0400
+Subject: drm/amd/display: Fix flip-done timeouts on mode1 reset
+
+From: Leo Li <sunpeng.li@amd.com>
+
+commit 82730dba0cf9d9524af0ceeb7eb6b5c3ab1bdb87 upstream.
+
+The vblank on/off callbacks mixed use of amdgpu_irq_get/put() and
+amdgpu_dm_crtc_set_vupdate_irq() to enable and disable IRQs.
+
+With get/put, base driver will callback into DC to disable IRQs when
+refcount == 0. With set_vupdate_irq(), DC is called directly to disable
+IRQs, bypassing base driver's refcount tracking.
+
+During gpu reset, base driver can restore IRQs via
+amdgpu_irq_gpu_reset_resume_helper() > amdgpu_irq_update(). So if
+get/put() is not used (i.e. refcount == 0), then vupdate_irq will be
+disabled.
+
+This is problematic if DRM requests vblank on before amdgpu_irq_update()
+is called: drm_vblank_on() > set_vupdate_irq() enables vupdate_irq, but
+the refcount is still 0. gpu_reset_resume_helper() > irq_update() then
+immediately disables it, thus leading to flip done timeouts.
+
+This is made worse on DCN since VUPDATE_NO_LOCK is the only IRQ enabled.
+Prior to 8382cd234981, a combination of GRPH_FLIP and VSTARTUP IRQs were
+used, and they used get/put(). This explains why 8382cd234981 exposed
+this issue.
+
+Fix by using get/put() instead of set_vupdate_irq(). DCE is unchanged,
+since it relies on unbalanced enable/disable calls based on VRR status,
+and hence requires direct set_vupdate_irq(). Plus, it also uses
+GRPH_FLIP and VLINE IRQs, which are properly tracked by get/put().
+
+Cc: stable@vger.kernel.org
+Fixes: 8382cd234981 ("drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock")
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20260723180159.52121-1-sunpeng.li@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+@@ -333,10 +333,19 @@ static inline int amdgpu_dm_crtc_set_vbl
+ * is enabled. On DCE, vupdate is only needed in VRR mode.
+ */
+ if (amdgpu_ip_version(adev, DCE_HWIP, 0) != 0) {
+- rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, enable);
++ if (enable) {
++ rc = amdgpu_irq_get(adev, &adev->vupdate_irq, irq_type);
++ drm_dbg_vbl(crtc->dev, "Get vupdate_irq ret=%d\n", rc);
++ } else {
++ rc = amdgpu_irq_put(adev, &adev->vupdate_irq, irq_type);
++ drm_dbg_vbl(crtc->dev, "Put vupdate_irq ret=%d\n", rc);
++ }
+ } else if (dc_supports_vrr(dm->dc->ctx->dce_version)) {
+ if (enable) {
+- /* vblank irq on -> Only need vupdate irq in vrr mode */
++ /* vblank irq on -> Only need vupdate irq in vrr mode
++ * Not ref-counted since we need explicit enable/disable
++ * for DCE VRR handling
++ */
+ if (amdgpu_dm_crtc_vrr_active(acrtc_state))
+ rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, true);
+ } else {
--- /dev/null
+From fbbaca9e208733652828ea98d00f09f260a7770e Mon Sep 17 00:00:00 2001
+From: Leo Li <sunpeng.li@amd.com>
+Date: Thu, 23 Jul 2026 09:44:50 -0400
+Subject: drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
+
+From: Leo Li <sunpeng.li@amd.com>
+
+commit fbbaca9e208733652828ea98d00f09f260a7770e upstream.
+
+This line was lost when cping from amd-staging-drm-next to drm-fixes.
+So add it back.
+
+Cc: stable@vger.kernel.org
+Fixes: 8382cd234981 ("drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock")
+Reported-by: Lu Yao <yaolu@kylinos.cn>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20260723134450.13838-1-sunpeng.li@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3068,7 +3068,8 @@ static void dm_gpureset_toggle_interrupt
+ acrtc = get_crtc_by_otg_inst(
+ adev, state->stream_status[i].primary_otg_inst);
+
+- if (acrtc && state->stream_status[i].plane_count != 0) {
++ if (acrtc && state->stream_status[i].plane_count != 0 &&
++ amdgpu_ip_version(adev, DCE_HWIP, 0) == 0) {
+ irq_source = IRQ_TYPE_PFLIP + acrtc->otg_inst;
+ rc = dc_interrupt_set(adev->dm.dc, irq_source, enable) ? 0 : -EBUSY;
+ if (rc)
--- /dev/null
+From 0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Wed, 8 Jul 2026 22:15:20 -0500
+Subject: drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2 upstream.
+
+AMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs have
+PCI controllers that don't support PCIe dynamic speed switching,
+causing system freezes during GPU initialization when enabled.
+
+Disable dynamic speed switching when this CPU is detected.
+
+Assisted-by: Claude:sonnet
+Fixes: 466a7d115326 ("drm/amd: Use the first non-dGPU PCI device for BW limits")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5436
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Link: https://patch.msgid.link/20260709031520.841611-1-mario.limonciello@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9ceb4e034a327a04155f32f1cd1a5031dfa5fe02)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1878,6 +1878,15 @@ static bool amdgpu_device_pcie_dynamic_s
+
+ if (c->x86_vendor == X86_VENDOR_INTEL)
+ return false;
++
++ /*
++ * AMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs don't
++ * support PCIe dynamic speed switching.
++ * https://gitlab.freedesktop.org/drm/amd/-/work_items/5436
++ */
++ if (c->x86_vendor == X86_VENDOR_AMD && c->x86 == 0x17 &&
++ c->x86_model == 0x08)
++ return false;
+ #endif
+ return true;
+ }
--- /dev/null
+From a2f895f3c852063258d62e9f74b081de07ca95df Mon Sep 17 00:00:00 2001
+From: Zhu Lingshan <lingshan.zhu@amd.com>
+Date: Wed, 1 Jul 2026 18:53:21 +0800
+Subject: drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhu Lingshan <lingshan.zhu@amd.com>
+
+commit a2f895f3c852063258d62e9f74b081de07ca95df upstream.
+
+amdgpu_bo_create_reserved() only allocates a new BO when
+*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is
+NULL, it simply skips creation when *bo_ptr is non-NULL.
+But it unconditionally reserves, pins, gart allocates
+and maps the BO afterwards.
+
+When the same non-NULL BO pointer is passed in again,
+for example firmware buffers that live in adev and are
+re-loaded on every resume / cp_resume / start
+under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases
+pin_count unconditionally, however the matching teardown only unpins
+once, so pin_count never drops to zero, so TTM is not able
+to move, swap or evict a BO, causing BO leaks.
+
+This commit fixes this issue by only pinning the bo
+once at creation, and repeated calls no longer
+take additional pin references.
+
+Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -284,10 +284,12 @@ int amdgpu_bo_create_reserved(struct amd
+ goto error_free;
+ }
+
+- r = amdgpu_bo_pin(*bo_ptr, domain);
+- if (r) {
+- dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
+- goto error_unreserve;
++ if (free) {
++ r = amdgpu_bo_pin(*bo_ptr, domain);
++ if (r) {
++ dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
++ goto error_unreserve;
++ }
+ }
+
+ r = amdgpu_ttm_alloc_gart(&(*bo_ptr)->tbo);
+@@ -310,7 +312,8 @@ int amdgpu_bo_create_reserved(struct amd
+ return 0;
+
+ error_unpin:
+- amdgpu_bo_unpin(*bo_ptr);
++ if (free)
++ amdgpu_bo_unpin(*bo_ptr);
+ error_unreserve:
+ amdgpu_bo_unreserve(*bo_ptr);
+
--- /dev/null
+From 847b371debf3c8c72384ab7b9a0c4123a74cc925 Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Tue, 14 Jul 2026 10:00:25 -0700
+Subject: drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit 847b371debf3c8c72384ab7b9a0c4123a74cc925 upstream.
+
+If kvmalloc_array() fails in drm_gpusvm_range_evict(), the MM
+reference acquired earlier is not released, resulting in a reference
+leak.
+
+Fix this by dropping the MM reference on the kvmalloc_array()
+failure path.
+
+Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Link: https://patch.msgid.link/20260714170025.3487974-1-matthew.brost@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gpusvm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_gpusvm.c
++++ b/drivers/gpu/drm/drm_gpusvm.c
+@@ -1566,8 +1566,10 @@ int drm_gpusvm_range_evict(struct drm_gp
+ return -EFAULT;
+
+ pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
+- if (!pfns)
++ if (!pfns) {
++ mmput(mm);
+ return -ENOMEM;
++ }
+
+ hmm_range.hmm_pfns = pfns;
+ while (!time_after(jiffies, timeout)) {
--- /dev/null
+From f7df2da0d1c375c1c4c70e1e0b569592de0d6b73 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Sat, 18 Jul 2026 10:44:36 -0300
+Subject: drm/v3d: Reach the GMP through the hub registers on V3D 7.x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+commit f7df2da0d1c375c1c4c70e1e0b569592de0d6b73 upstream.
+
+v3d_idle_axi() drains the GPU's memory interface for a safe powerdown by
+using the V3D_GMP_CFG register. It reached both registers with the macros
+V3D_CORE_READ and V3D_CORE_WRITE.
+
+On V3D 7.x the GMP is no longer a per-core block; it lives in the hub
+register region. Reaching it through the per-core register block addresses
+the wrong region.
+
+Select the hub accessors (V3D_{READ,WRITE}) for the GMP on V3D 7.x and
+keep the per-core path for earlier generations.
+
+Cc: stable@vger.kernel.org
+Fixes: 0ad5bc1ce463 ("drm/v3d: fix up register addresses for V3D 7.x")
+Link: https://patch.msgid.link/20260718-v3d-pm-axi-transactions-v1-1-4ecd7729ed70@igalia.com
+Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/v3d/v3d_gem.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -45,6 +45,18 @@ v3d_init_hw_state(struct v3d_dev *v3d)
+ static void
+ v3d_idle_axi(struct v3d_dev *v3d, int core)
+ {
++ if (v3d->ver >= V3D_GEN_71) {
++ V3D_WRITE(V3D_GMP_CFG(v3d->ver), V3D_GMP_CFG_STOP_REQ);
++
++ if (wait_for((V3D_READ(V3D_GMP_STATUS(v3d->ver)) &
++ (V3D_GMP_STATUS_RD_COUNT_MASK |
++ V3D_GMP_STATUS_WR_COUNT_MASK |
++ V3D_GMP_STATUS_CFG_BUSY)) == 0, 100)) {
++ drm_err(&v3d->drm, "Failed to wait for safe GMP shutdown\n");
++ }
++ return;
++ }
++
+ V3D_CORE_WRITE(core, V3D_GMP_CFG(v3d->ver), V3D_GMP_CFG_STOP_REQ);
+
+ if (wait_for((V3D_CORE_READ(core, V3D_GMP_STATUS(v3d->ver)) &
--- /dev/null
+From 0c9e6367639548307d3f578f6943ce72c9d39087 Mon Sep 17 00:00:00 2001
+From: Linmao Li <lilinmao@kylinos.cn>
+Date: Tue, 21 Jul 2026 09:15:58 +0800
+Subject: drm/vc4: Prevent shader BO mappings from becoming writable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+commit 0c9e6367639548307d3f578f6943ce72c9d39087 upstream.
+
+vc4_gem_object_mmap() rejects a writable mapping of a validated shader
+BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and
+then turn it writable with mprotect().
+
+Validated shader BOs must stay read-only: the validator checks the
+instructions once and the GPU trusts them afterwards. A writable
+mapping lets userspace rewrite the code after validation, bypassing the
+validator.
+
+Clear VM_MAYWRITE on the read-only path so the mapping cannot be
+upgraded, as i915 already does for its read-only objects.
+
+Fixes: 463873d57014 ("drm/vc4: Add an API for creating GPU shaders in GEM BOs.")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Closes: https://lore.kernel.org/dri-devel/20260720085554.B0AF01F000E9@smtp.kernel.org/
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Link: https://patch.msgid.link/20260721011558.1672477-1-lilinmao@kylinos.cn
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_bo.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -733,9 +733,13 @@ static int vc4_gem_object_mmap(struct dr
+ {
+ struct vc4_bo *bo = to_vc4_bo(obj);
+
+- if (bo->validated_shader && (vma->vm_flags & VM_WRITE)) {
+- DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n");
+- return -EINVAL;
++ if (bo->validated_shader) {
++ if (vma->vm_flags & VM_WRITE) {
++ DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n");
++ return -EINVAL;
++ }
++
++ vm_flags_clear(vma, VM_MAYWRITE);
+ }
+
+ mutex_lock(&bo->madv_lock);
--- /dev/null
+From 6273dd3ffb54ec581855b82ae77331b66028249c Mon Sep 17 00:00:00 2001
+From: Linmao Li <lilinmao@kylinos.cn>
+Date: Mon, 20 Jul 2026 16:44:26 +0800
+Subject: drm/vc4: Shut down BO cache timer before teardown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+commit 6273dd3ffb54ec581855b82ae77331b66028249c upstream.
+
+The BO cache timer callback schedules time_work, and time_work can rearm
+the timer through vc4_bo_cache_free_old().
+
+vc4_bo_cache_destroy() deletes the timer and then cancels the work, which
+does not break that cycle: the work being cancelled can rearm the timer,
+and the timer then queues work again after teardown.
+
+Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the
+cycle ends with cancel_work_sync().
+
+Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Link: https://patch.msgid.link/20260720084426.1632508-1-lilinmao@kylinos.cn
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_bo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -1046,7 +1046,7 @@ static void vc4_bo_cache_destroy(struct
+ struct vc4_dev *vc4 = to_vc4_dev(dev);
+ int i;
+
+- timer_delete(&vc4->bo_cache.time_timer);
++ timer_shutdown_sync(&vc4->bo_cache.time_timer);
+ cancel_work_sync(&vc4->bo_cache.time_work);
+
+ vc4_bo_cache_purge(dev);
--- /dev/null
+From a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 Mon Sep 17 00:00:00 2001
+From: Ian Forbes <ian.forbes@broadcom.com>
+Date: Tue, 23 Jun 2026 14:33:14 -0500
+Subject: drm/vmwgfx: Validate vmw_surface_metadata::array_size
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream.
+
+This field comes from userspace and should be validated against specific
+limits depending on which Shader Model (SM) is available.
+
+Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
+Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+@@ -77,7 +77,7 @@ static int vmw_gb_surface_unbind(struct
+ static int vmw_gb_surface_destroy(struct vmw_resource *res);
+ static int
+ vmw_gb_surface_define_internal(struct drm_device *dev,
+- struct drm_vmw_gb_surface_create_ext_req *req,
++ const struct drm_vmw_gb_surface_create_ext_req *req,
+ struct drm_vmw_gb_surface_create_rep *rep,
+ struct drm_file *file_priv);
+ static int
+@@ -1503,7 +1503,7 @@ int vmw_gb_surface_reference_ext_ioctl(s
+ */
+ static int
+ vmw_gb_surface_define_internal(struct drm_device *dev,
+- struct drm_vmw_gb_surface_create_ext_req *req,
++ const struct drm_vmw_gb_surface_create_ext_req *req,
+ struct drm_vmw_gb_surface_create_rep *rep,
+ struct drm_file *file_priv)
+ {
+@@ -1521,9 +1521,21 @@ vmw_gb_surface_define_internal(struct dr
+ req->base.svga3d_flags);
+
+ /* array_size must be null for non-GL3 host. */
+- if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) {
+- VMW_DEBUG_USER("SM4 surface not supported.\n");
+- return -EINVAL;
++ if (req->base.array_size > 0) {
++ if (has_sm5_context(dev_priv)) {
++ if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) {
++ VMW_DEBUG_USER("Invalid Surface Array Size.\n");
++ return -EINVAL;
++ }
++ } else if (has_sm4_context(dev_priv)) {
++ if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) {
++ VMW_DEBUG_USER("Invalid Surface Array Size.\n");
++ return -EINVAL;
++ }
++ } else {
++ VMW_DEBUG_USER("SM4+ surface not supported.\n");
++ return -EINVAL;
++ }
+ }
+
+ if (!has_sm4_1_context(dev_priv)) {
--- /dev/null
+From 04344d0b4929caa94c0df72f767752aa0935ef5d Mon Sep 17 00:00:00 2001
+From: Valery Borovsky <vebohr@gmail.com>
+Date: Mon, 11 May 2026 20:12:06 +0300
+Subject: media: airspy: Return queued buffers on start_streaming() failure
+
+From: Valery Borovsky <vebohr@gmail.com>
+
+commit 04344d0b4929caa94c0df72f767752aa0935ef5d upstream.
+
+The vb2 framework hands buffers to the driver via buf_queue() before
+calling start_streaming(). If start_streaming() returns an error
+without first returning those buffers via vb2_buffer_done(),
+vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
+buffers leak.
+
+airspy_start_streaming() returned -ENODEV early when the USB device had
+been disconnected (s->udev == NULL) without returning any buffers that
+buf_queue() had already accepted. Take v4l2_lock first and jump to the
+existing err_clear_bit label, which already drains s->queued_bufs via
+vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking.
+
+This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
+Return queued buffers on start_streaming() failure").
+
+Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Valery Borovsky <vebohr@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/airspy/airspy.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/airspy/airspy.c
++++ b/drivers/media/usb/airspy/airspy.c
+@@ -522,11 +522,13 @@ static int airspy_start_streaming(struct
+
+ dev_dbg(s->dev, "\n");
+
+- if (!s->udev)
+- return -ENODEV;
+-
+ mutex_lock(&s->v4l2_lock);
+
++ if (!s->udev) {
++ ret = -ENODEV;
++ goto err_clear_bit;
++ }
++
+ s->sequence = 0;
+
+ set_bit(POWER_ON, &s->flags);
--- /dev/null
+From 9724164f71974a2a44a5e026614fbcc05bab6d91 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Thu, 7 May 2026 20:58:11 +0000
+Subject: media: amlogic-c3: Add validations for ae and awb config
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 9724164f71974a2a44a5e026614fbcc05bab6d91 upstream.
+
+Avoid invalid memory access if the zones_num is bigger than
+zone_weight.
+
+This patch fixes the following smatch errors:
+drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
+drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
+drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
+drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
+
+Cc: stable@vger.kernel.org
+Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver")
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Keke Li <keke.li@amlogic.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
++++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+@@ -107,6 +107,8 @@ static void c3_isp_params_awb_wt(struct
+ c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
+
+ zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
++ if (zones_num > C3_ISP_AWB_MAX_ZONES)
++ zones_num = C3_ISP_AWB_MAX_ZONES;
+
+ /* Need to write 8 weights at once */
+ for (i = 0; i < zones_num / 8; i++) {
+@@ -223,6 +225,8 @@ static void c3_isp_params_ae_wt(struct c
+ c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
+
+ zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
++ if (zones_num > C3_ISP_AE_MAX_ZONES)
++ zones_num = C3_ISP_AE_MAX_ZONES;
+
+ /* Need to write 8 weights at once */
+ for (i = 0; i < zones_num / 8; i++) {
--- /dev/null
+From 253c8ef7d57da0c74db251f385324faaa5ae2257 Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Sat, 28 Mar 2026 11:23:30 +0000
+Subject: media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
+
+From: David Carlier <devnexen@gmail.com>
+
+commit 253c8ef7d57da0c74db251f385324faaa5ae2257 upstream.
+
+aspeed_video_init() calls of_reserved_mem_device_init() to associate
+reserved memory regions with the device. When aspeed_video_setup_video()
+subsequently fails in aspeed_video_probe(), the error path frees the
+JPEG buffer and unprepares the clocks but does not release the reserved
+memory association, leaking the rmem_assigned_device entry on the global
+list.
+
+The normal remove path already calls of_reserved_mem_device_release()
+correctly; only the probe error path was missing it.
+
+Add the missing of_reserved_mem_device_release() call to the
+aspeed_video_setup_video() failure cleanup.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/aspeed/aspeed-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/aspeed/aspeed-video.c
++++ b/drivers/media/platform/aspeed/aspeed-video.c
+@@ -2327,6 +2327,7 @@ static int aspeed_video_probe(struct pla
+ rc = aspeed_video_setup_video(video);
+ if (rc) {
+ aspeed_video_free_buf(video, &video->jpeg);
++ of_reserved_mem_device_release(&pdev->dev);
+ clk_unprepare(video->vclk);
+ clk_unprepare(video->eclk);
+ return rc;
--- /dev/null
+From c3a78691be8245e52ced489f268e413f18061ac2 Mon Sep 17 00:00:00 2001
+From: Myeonghun Pak <mhun512@gmail.com>
+Date: Fri, 24 Apr 2026 23:36:01 +0900
+Subject: media: cec: seco: unregister adapter on IR probe failure
+
+From: Myeonghun Pak <mhun512@gmail.com>
+
+commit c3a78691be8245e52ced489f268e413f18061ac2 upstream.
+
+If secocec_ir_probe() fails after cec_register_adapter() succeeds,
+probe returns an error and the driver remove callback is not called.
+The current unwind path unregisters the notifier and then falls through
+to cec_delete_adapter(), which violates the CEC adapter lifetime rules
+after a successful registration.
+
+Add a registered-adapter unwind path that unregisters the notifier and
+the adapter instead.
+
+Fixes: daef95769b3a ("media: seco-cec: add Consumer-IR support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/cec/platform/seco/seco-cec.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/cec/platform/seco/seco-cec.c
++++ b/drivers/media/cec/platform/seco/seco-cec.c
+@@ -649,7 +649,7 @@ static int secocec_probe(struct platform
+
+ ret = secocec_ir_probe(secocec);
+ if (ret)
+- goto err_notifier;
++ goto err_unregister_adapter;
+
+ platform_set_drvdata(pdev, secocec);
+
+@@ -657,6 +657,10 @@ static int secocec_probe(struct platform
+
+ return ret;
+
++err_unregister_adapter:
++ cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap);
++ cec_unregister_adapter(secocec->cec_adap);
++ goto err;
+ err_notifier:
+ cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap);
+ err_delete_adapter:
--- /dev/null
+From 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 Mon Sep 17 00:00:00 2001
+From: Myeonghun Pak <mhun512@gmail.com>
+Date: Wed, 6 May 2026 21:41:16 +0900
+Subject: media: cedrus: clean up media device on probe failure
+
+From: Myeonghun Pak <mhun512@gmail.com>
+
+commit 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 upstream.
+
+cedrus_probe() initializes the media device before registering the video
+device, the media controller, and the media device. If any of those later
+steps fails, probe returns without calling media_device_cleanup(), so the
+media device internals initialized by media_device_init() are left behind.
+
+Add a media-device cleanup label to the probe unwind path and route video
+registration failures through it as well.
+
+Fixes: 50e761516f2b8c ("media: platform: Add Cedrus VPU decoder driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Paul Kocialkowski <paulk@sys-base.io>
+Co-developed-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
+@@ -507,7 +507,7 @@ static int cedrus_probe(struct platform_
+ ret = video_register_device(vfd, VFL_TYPE_VIDEO, 0);
+ if (ret) {
+ v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+- goto err_m2m;
++ goto err_media;
+ }
+
+ v4l2_info(&dev->v4l2_dev,
+@@ -533,7 +533,8 @@ err_m2m_mc:
+ v4l2_m2m_unregister_media_controller(dev->m2m_dev);
+ err_video:
+ video_unregister_device(&dev->vfd);
+-err_m2m:
++err_media:
++ media_device_cleanup(&dev->mdev);
+ v4l2_m2m_release(dev->m2m_dev);
+ err_v4l2:
+ v4l2_device_unregister(&dev->v4l2_dev);
--- /dev/null
+From d99732334aaf33b9f93926b70b6a11c2cef3de39 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Tue, 7 Apr 2026 01:14:02 +0300
+Subject: media: cedrus: Fix missing cleanup in error path
+
+From: Samuel Holland <samuel@sholland.org>
+
+commit d99732334aaf33b9f93926b70b6a11c2cef3de39 upstream.
+
+According to the documentation struct v4l2_fh has to be cleaned up with
+v4l2_fh_exit() before being freed. [1]
+Currently there is no actual bug here, when v4l2_fh_exit() isn't called.
+v4l2_fh_exit() in this case only destroys internal mutex. But it may
+change in the future, when v4l2_fh_init/v4l2_fh_exit will be enhanced.
+
+1. https://docs.kernel.org/driver-api/media/v4l2-fh.html
+
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver")
+Cc: stable@vger.kernel.org
+Acked-by: Paul Kocialkowski <paulk@sys-base.io>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
+@@ -391,6 +391,7 @@ static int cedrus_open(struct file *file
+ err_m2m_release:
+ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+ err_free:
++ v4l2_fh_exit(&ctx->fh);
+ kfree(ctx);
+ mutex_unlock(&dev->dev_mutex);
+
--- /dev/null
+From 10358ea986c3c85516d1c8206486464f79d36e76 Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Tue, 24 Mar 2026 16:08:56 +0800
+Subject: media: cedrus: skip invalid H.264 reference list entries
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 10358ea986c3c85516d1c8206486464f79d36e76 upstream.
+
+Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the
+stateless slice control and later uses their indices to look up
+decode->dpb[] in _cedrus_write_ref_list().
+
+Rejecting such controls in cedrus_try_ctrl() would break existing
+userspace, since stateless H.264 reference lists may legitimately carry
+out-of-range indices for missing references. Instead, guard the actual
+DPB lookup in Cedrus and skip entries whose indices do not fit the fixed
+V4L2_H264_NUM_DPB_ENTRIES array.
+
+This keeps the fix local to the driver use site and avoids out-of-bounds
+reads from malformed or unsupported reference list entries.
+
+Fixes: e000e1fa4bdbd ("media: uapi: h264: Update reference lists")
+Cc: stable@vger.kernel.org
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Tested-by: Chen-Yu Tsai <wens@kernel.org>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+@@ -210,6 +210,9 @@ static void _cedrus_write_ref_list(struc
+ u8 dpb_idx;
+
+ dpb_idx = ref_list[i].index;
++ if (dpb_idx >= V4L2_H264_NUM_DPB_ENTRIES)
++ continue;
++
+ dpb = &decode->dpb[dpb_idx];
+
+ if (!(dpb->flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE))
--- /dev/null
+From b20157147089a9c16a38c7810e2fe6f2df8e3277 Mon Sep 17 00:00:00 2001
+From: Brandon Brnich <b-brnich@ti.com>
+Date: Fri, 20 Mar 2026 13:05:26 -0500
+Subject: media: chips-media: wave5: Move src_buf Removal to finish_encode
+
+From: Brandon Brnich <b-brnich@ti.com>
+
+commit b20157147089a9c16a38c7810e2fe6f2df8e3277 upstream.
+
+During encoder processing, there is a case where the IRQ response could
+return the buffer back to userspace via v4l2_m2m_buf_done call. In this
+time, userspace could queue up this same buffer before start_encode removes
+the index from the ready queue. This would then lead to a case where the
+buffer in the ready queue could be a self loop due to the
+WRITE_ONCE(prev->next, new) call in __list_add.
+
+When __list_del is finally called, the loop is already made so nothing
+points back to ready queue list head and pointers are poisoned.
+
+A buffer should not be marked as DONE before the buffer is removed from
+m2m ready queue. Move removal entirely to finish_encode.
+
+Fixes: 9707a6254a8a6 ("media: chips-media: wave5: Add the v4l2 layer")
+Cc: stable@vger.kernel.org
+Signed-off-by: Brandon Brnich <b-brnich@ti.com>
+Tested-by: Jackson Lee <jackson.lee@chipsnmedia.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 29 ++-------------
+ 1 file changed, 4 insertions(+), 25 deletions(-)
+
+--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+@@ -226,13 +226,6 @@ static int start_encode(struct vpu_insta
+ } else {
+ dev_dbg(inst->dev->dev, "%s: wave5_vpu_enc_start_one_frame success\n",
+ __func__);
+- /*
+- * Remove the source buffer from the ready-queue now and finish
+- * it in the videobuf2 framework once the index is returned by the
+- * firmware in finish_encode
+- */
+- if (src_buf)
+- v4l2_m2m_src_buf_remove_by_idx(m2m_ctx, src_buf->vb2_buf.index);
+ }
+
+ return 0;
+@@ -259,27 +252,13 @@ static void wave5_vpu_enc_finish_encode(
+ __func__, enc_output_info.pic_type, enc_output_info.recon_frame_index,
+ enc_output_info.enc_src_idx, enc_output_info.enc_pic_byte, enc_output_info.pts);
+
+- /*
+- * The source buffer will not be found in the ready-queue as it has been
+- * dropped after sending of the encode firmware command, locate it in
+- * the videobuf2 queue directly
+- */
+ if (enc_output_info.enc_src_idx >= 0) {
+- struct vb2_buffer *vb = vb2_get_buffer(v4l2_m2m_get_src_vq(m2m_ctx),
+- enc_output_info.enc_src_idx);
+- if (vb->state != VB2_BUF_STATE_ACTIVE)
+- dev_warn(inst->dev->dev,
+- "%s: encoded buffer (%d) was not in ready queue %i.",
+- __func__, enc_output_info.enc_src_idx, vb->state);
+- else
+- src_buf = to_vb2_v4l2_buffer(vb);
+-
+- if (src_buf) {
++ src_buf = v4l2_m2m_src_buf_remove_by_idx(m2m_ctx, enc_output_info.enc_src_idx);
++ if (!src_buf) {
++ dev_warn(inst->dev->dev, "%s: no source buffer found\n", __func__);
++ } else {
+ inst->timestamp = src_buf->vb2_buf.timestamp;
+ v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_DONE);
+- } else {
+- dev_warn(inst->dev->dev, "%s: no source buffer with index: %d found\n",
+- __func__, enc_output_info.enc_src_idx);
+ }
+ }
+
--- /dev/null
+From 7d6358ab02866e5b7ed8d3a00805297617bbb0ec Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 30 Mar 2026 11:37:27 +0200
+Subject: media: cx231xx: fix devres lifetime
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7d6358ab02866e5b7ed8d3a00805297617bbb0ec upstream.
+
+USB drivers bind to USB interfaces and any device managed resources
+should have their lifetime tied to the interface rather than parent USB
+device. This avoids issues like memory leaks when drivers are unbound
+without their devices being physically disconnected (e.g. on probe
+deferral or configuration changes).
+
+Fix the driver state lifetime so that it is released on driver unbind.
+
+Fixes: 184a82784d50 ("[media] cx231xx: use devm_ functions to allocate memory")
+Cc: stable@vger.kernel.org # 3.17
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
+@@ -1575,7 +1575,8 @@ static int cx231xx_init_v4l2(struct cx23
+ dev->video_mode.end_point_addr,
+ dev->video_mode.num_alt);
+
+- dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->video_mode.num_alt, GFP_KERNEL);
++ dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->video_mode.num_alt, GFP_KERNEL);
+ if (dev->video_mode.alt_max_pkt_size == NULL)
+ return -ENOMEM;
+
+@@ -1616,7 +1617,8 @@ static int cx231xx_init_v4l2(struct cx23
+ dev->vbi_mode.num_alt);
+
+ /* compute alternate max packet sizes for vbi */
+- dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->vbi_mode.num_alt, GFP_KERNEL);
++ dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->vbi_mode.num_alt, GFP_KERNEL);
+ if (dev->vbi_mode.alt_max_pkt_size == NULL)
+ return -ENOMEM;
+
+@@ -1658,7 +1660,9 @@ static int cx231xx_init_v4l2(struct cx23
+ "sliced CC EndPoint Addr 0x%x, Alternate settings: %i\n",
+ dev->sliced_cc_mode.end_point_addr,
+ dev->sliced_cc_mode.num_alt);
+- dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->sliced_cc_mode.num_alt, GFP_KERNEL);
++ dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->sliced_cc_mode.num_alt,
++ GFP_KERNEL);
+ if (dev->sliced_cc_mode.alt_max_pkt_size == NULL)
+ return -ENOMEM;
+
+@@ -1722,7 +1726,7 @@ static int cx231xx_usb_probe(struct usb_
+ udev = usb_get_dev(interface_to_usbdev(interface));
+
+ /* allocate memory for our device state and initialize it */
+- dev = devm_kzalloc(&udev->dev, sizeof(*dev), GFP_KERNEL);
++ dev = devm_kzalloc(&interface->dev, sizeof(*dev), GFP_KERNEL);
+ if (dev == NULL) {
+ retval = -ENOMEM;
+ goto err_if;
+@@ -1852,7 +1856,9 @@ static int cx231xx_usb_probe(struct usb_
+ dev->ts1_mode.end_point_addr,
+ dev->ts1_mode.num_alt);
+
+- dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->ts1_mode.num_alt, GFP_KERNEL);
++ dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->ts1_mode.num_alt,
++ GFP_KERNEL);
+ if (dev->ts1_mode.alt_max_pkt_size == NULL) {
+ retval = -ENOMEM;
+ goto err_video_alt;
--- /dev/null
+From a0701e387b46e2481c05b47f1235b954bfc2af3e Mon Sep 17 00:00:00 2001
+From: Wang Jun <1742789905@qq.com>
+Date: Fri, 20 Mar 2026 15:04:53 +0800
+Subject: media: cx23885: add ioremap return check and cleanup
+
+From: Wang Jun <1742789905@qq.com>
+
+commit a0701e387b46e2481c05b47f1235b954bfc2af3e upstream.
+
+Add a check for the return value of pci_ioremap_bar()
+in cx23885_dev_setup().
+If ioremap for BAR0 fails, release the already allocated
+PCI memory region,
+decrement the device count, and return -ENODEV.
+
+This prevents a potential null pointer dereference and
+ensures proper cleanup
+on memory mapping failure.
+
+Fixes: d19770e5178a ("V4L/DVB (6150): Add CX23885/CX23887 PCIe bridge driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wang Jun <1742789905@qq.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx23885/cx23885-core.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/pci/cx23885/cx23885-core.c
++++ b/drivers/media/pci/cx23885/cx23885-core.c
+@@ -990,8 +990,12 @@ static int cx23885_dev_setup(struct cx23
+ }
+
+ /* PCIe stuff */
+- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0),
+- pci_resource_len(dev->pci, 0));
++ dev->lmmio = pci_ioremap_bar(dev->pci, 0);
++ if (!dev->lmmio) {
++ dev_err(&dev->pci->dev, "CORE %s: can't ioremap MMIO memory\n",
++ dev->name);
++ goto err_release_region;
++ }
+
+ dev->bmmio = (u8 __iomem *)dev->lmmio;
+
+@@ -1096,6 +1100,12 @@ static int cx23885_dev_setup(struct cx23
+ }
+
+ return 0;
++
++err_release_region:
++ release_mem_region(pci_resource_start(dev->pci, 0),
++ pci_resource_len(dev->pci, 0));
++ cx23885_devcount--;
++ return -ENODEV;
+ }
+
+ static void cx23885_dev_unregister(struct cx23885_dev *dev)
--- /dev/null
+From 4f6f28ff24709710c08557c127b3e4c3fb1b4159 Mon Sep 17 00:00:00 2001
+From: Martin Hecht <mhecht73@gmail.com>
+Date: Fri, 8 May 2026 11:59:03 +0200
+Subject: media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
+
+From: Martin Hecht <mhecht73@gmail.com>
+
+commit 4f6f28ff24709710c08557c127b3e4c3fb1b4159 upstream.
+
+The current implementation of alvium_ctrl_init creates several controls in
+function alvium_ctrl_init and uses the returned pointer without check. That
+can cause write access over NULL-pointer for several controls. The reworked
+code checks the pointers before adding flags.
+
+Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
+Cc: stable@vger.kernel.org
+Signed-off-by: Martin Hecht <mhecht73@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/alvium-csi2.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/i2c/alvium-csi2.c
++++ b/drivers/media/i2c/alvium-csi2.c
+@@ -2100,20 +2100,21 @@ static int alvium_ctrl_init(struct alviu
+ V4L2_CID_PIXEL_RATE, 0,
+ ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1,
+ ALVIUM_DEFAULT_PIXEL_RATE_MHZ);
+- ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+
+ /* Link freq is fixed */
+ ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops,
+ V4L2_CID_LINK_FREQ,
+ 0, 0, &alvium->link_freq);
+- ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++ if (ctrls->link_freq)
++ ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+
+ /* Auto/manual white balance */
+ if (alvium->avail_ft.auto_whiteb) {
+ ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops,
+ V4L2_CID_AUTO_WHITE_BALANCE,
+ 0, 1, 1, 1);
+- v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
++ if (ctrls->auto_wb)
++ v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
+ }
+
+ ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
+@@ -2122,6 +2123,7 @@ static int alvium_ctrl_init(struct alviu
+ alvium->max_bbalance,
+ alvium->inc_bbalance,
+ alvium->dft_bbalance);
++
+ ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
+ V4L2_CID_RED_BALANCE,
+ alvium->min_rbalance,
+@@ -2136,7 +2138,9 @@ static int alvium_ctrl_init(struct alviu
+ V4L2_CID_EXPOSURE_AUTO,
+ V4L2_EXPOSURE_MANUAL, 0,
+ V4L2_EXPOSURE_AUTO);
+- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
++ if (ctrls->auto_exp)
++ v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp,
++ V4L2_EXPOSURE_MANUAL, true);
+ }
+
+ ctrls->exposure = v4l2_ctrl_new_std(hdl, ops,
+@@ -2145,14 +2149,16 @@ static int alvium_ctrl_init(struct alviu
+ alvium->max_exp,
+ alvium->inc_exp,
+ alvium->dft_exp);
+- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
++ if (ctrls->exposure)
++ ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
+
+ /* Auto/manual gain */
+ if (alvium->avail_ft.auto_gain) {
+ ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
+ V4L2_CID_AUTOGAIN,
+ 0, 1, 1, 1);
+- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
++ if (ctrls->auto_gain)
++ v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
+ }
+
+ if (alvium->avail_ft.gain) {
+@@ -2162,7 +2168,8 @@ static int alvium_ctrl_init(struct alviu
+ alvium->max_gain,
+ alvium->inc_gain,
+ alvium->dft_gain);
+- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
++ if (ctrls->gain)
++ ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
+ }
+
+ if (alvium->avail_ft.sat)
--- /dev/null
+From 2c4f1ba7354312ad2d6e34e70a518a51a9344715 Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Sat, 21 Feb 2026 01:38:15 +0200
+Subject: media: imx219: Fix maximum frame length in lines
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit 2c4f1ba7354312ad2d6e34e70a518a51a9344715 upstream.
+
+The driver used the maximum frame length in lines value of 0xffff, but the
+maximum appears to be 0xfffe instead. Fix it.
+
+Fixes: 1283b3b8f82b ("media: i2c: Add driver for Sony IMX219 sensor")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/imx219.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -71,7 +71,7 @@
+
+ /* V_TIMING internal */
+ #define IMX219_REG_FRM_LENGTH_A CCI_REG16(0x0160)
+-#define IMX219_FLL_MAX 0xffff
++#define IMX219_FLL_MAX 0xfffe
+ #define IMX219_VBLANK_MIN 32
+ #define IMX219_REG_LINE_LENGTH_A CCI_REG16(0x0162)
+ #define IMX219_LLP_MIN 0x0d78
--- /dev/null
+From 477620dccf3e9481ed6ae67cb5c747f25751c531 Mon Sep 17 00:00:00 2001
+From: Marco Nenciarini <mnencia@kcore.it>
+Date: Wed, 1 Apr 2026 18:25:47 +0200
+Subject: media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges
+
+From: Marco Nenciarini <mnencia@kcore.it>
+
+commit 477620dccf3e9481ed6ae67cb5c747f25751c531 upstream.
+
+The get_hsfreq_by_mbps() function searches the freqranges[] table
+backward (from highest to lowest index). Because adjacent frequency
+bands overlap, a data rate that falls in the overlap region always
+lands on the higher-indexed band.
+
+For data rates up to 1500 Mbps (index 42) every band uses
+osc_freq_target 335. Starting at index 43 (1461-1640 Mbps) the
+osc_freq_target drops to 208. A sensor running at 1498 Mbps sits in
+the overlap between index 42 (1414-1588, osc 335) and index 43
+(1461-1640, osc 208). The backward search picks index 43, programming
+the lower osc_freq_target of 208 instead of the optimal 335.
+
+This causes DDL lock instability and CSI-2 CRC errors on affected
+configurations, such as the OmniVision OV08X40 sensor on Intel Arrow
+Lake platforms (Dell Pro Max 16).
+
+Rewrite get_hsfreq_by_mbps() to select the optimal band:
+
+1. Among bands whose min/max range covers the data rate, prefer
+ the one with the higher osc_freq_target.
+2. If osc_freq_target is equal, prefer the band whose default_mbps
+ is closest to the requested rate.
+
+Since the frequency ranges are monotonically increasing, the loop
+exits early once min exceeds the requested rate.
+
+For 1498 Mbps this now correctly selects index 42 (osc_freq_target
+335, range 1414-1588) instead of index 43 (osc_freq_target 208,
+range 1461-1640).
+
+Fixes: 1e7eeb301696 ("media: intel/ipu6: add the CSI2 DPHY implementation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Marco Nenciarini <mnencia@kcore.it>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c | 24 +++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c
+@@ -288,15 +288,27 @@ static const struct dwc_dphy_freq_range
+
+ static u16 get_hsfreq_by_mbps(u32 mbps)
+ {
+- unsigned int i = DPHY_FREQ_RANGE_NUM;
++ u16 best = DPHY_FREQ_RANGE_INVALID_INDEX;
++ unsigned int i;
+
+- while (i--) {
+- if (freqranges[i].default_mbps == mbps ||
+- (mbps >= freqranges[i].min && mbps <= freqranges[i].max))
+- return i;
++ for (i = 0; i < DPHY_FREQ_RANGE_NUM; i++) {
++ if (mbps > freqranges[i].max)
++ continue;
++
++ if (mbps < freqranges[i].min)
++ break;
++
++ if (best == DPHY_FREQ_RANGE_INVALID_INDEX ||
++ freqranges[i].osc_freq_target >
++ freqranges[best].osc_freq_target ||
++ (freqranges[i].osc_freq_target ==
++ freqranges[best].osc_freq_target &&
++ abs((int)mbps - (int)freqranges[i].default_mbps) <
++ abs((int)mbps - (int)freqranges[best].default_mbps)))
++ best = i;
+ }
+
+- return DPHY_FREQ_RANGE_INVALID_INDEX;
++ return best;
+ }
+
+ static int ipu6_isys_dwc_phy_config(struct ipu6_isys *isys,
--- /dev/null
+From 45ac2230f929b9f0fae899c4a5c6bf763250fc13 Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Date: Fri, 29 May 2026 14:27:10 +0300
+Subject: media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+commit 45ac2230f929b9f0fae899c4a5c6bf763250fc13 upstream.
+
+Requesting the IRQ and then immediately disabling it is fragile as it
+leaves a window when the IRQ is still enabled although the underlying
+device might be not completely setup for IRQ handling. Pass
+IRQF_NO_AUTOEN instead of calling disable_irq_nosync().
+
+Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+[bod: Appended Fix to patch title for -stable clarity]
+[bod: Added cc stable for backporting]
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_probe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_probe.c
++++ b/drivers/media/platform/qcom/iris/iris_probe.c
+@@ -256,12 +256,12 @@ static int iris_probe(struct platform_de
+ core->iris_platform_data = of_device_get_match_data(core->dev);
+
+ ret = devm_request_threaded_irq(core->dev, core->irq, iris_hfi_isr,
+- iris_hfi_isr_handler, IRQF_TRIGGER_HIGH, "iris", core);
++ iris_hfi_isr_handler,
++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
++ "iris", core);
+ if (ret)
+ return ret;
+
+- disable_irq_nosync(core->irq);
+-
+ iris_init_ops(core);
+ core->iris_platform_data->init_hfi_command_ops(core);
+ core->iris_platform_data->init_hfi_response_ops(core);
--- /dev/null
+From 033ff0420e4c9c240ae5523fff39770298efa964 Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Fri, 17 Apr 2026 14:53:30 +0800
+Subject: media: marvell-cam: fix missing pci_disable_device() on remove
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit 033ff0420e4c9c240ae5523fff39770298efa964 upstream.
+
+During manual code audit, we found that cafe_pci_probe() enables the
+PCI device with pci_enable_device(), and its probe error path properly
+calls pci_disable_device() on failure.
+
+However, cafe_pci_remove() tears down the controller and frees the
+driver data without disabling the PCI device, leaving the remove path
+inconsistent with probe cleanup.
+
+Add the missing pci_disable_device() call to cafe_pci_remove().
+
+Fixes: abfa3df36c01 ("[media] marvell-cam: Separate out the Marvell camera core")
+Cc: stable@vger.kernel.org
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/marvell/cafe-driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/marvell/cafe-driver.c
++++ b/drivers/media/platform/marvell/cafe-driver.c
+@@ -609,6 +609,7 @@ static void cafe_pci_remove(struct pci_d
+ return;
+ }
+ cafe_shutdown(cam);
++ pci_disable_device(pdev);
+ kfree(cam);
+ }
+
--- /dev/null
+From 940f161f734b25f175a95d2684c2021f6323693a Mon Sep 17 00:00:00 2001
+From: Anand Moon <linux.amoon@gmail.com>
+Date: Wed, 20 May 2026 10:10:41 +0530
+Subject: media: meson: vdec: Fix memory leak in error path of vdec_open
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+commit 940f161f734b25f175a95d2684c2021f6323693a upstream.
+
+The vdec_open() function previously jumped directly to
+err_m2m_release when vdec_init_ctrls() failed, skipping
+release of the m2m context. This caused a resource leak.
+
+Fix it by introducing a proper err_m2m_ctx_release label
+that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before
+releasing the m2m device.
+
+This was identified via kmemleak:
+unreferenced object 0xffff0000205d6878 (size 8):
+ comm "v4l_id", pid 5289, jiffies 4294938580
+ hex dump (first 8 bytes):
+ 40 d2 49 18 00 00 ff ff @.I.....
+ backtrace (crc d3204599):
+ kmemleak_alloc+0xc8/0xf0
+ __kvmalloc_node_noprof+0x60c/0x850
+ v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev]
+ vdec_open+0x1f4/0x788 [meson_vdec]
+ v4l2_open+0x144/0x460 [videodev]
+ chrdev_open+0x1ac/0x500
+ do_dentry_open+0x3f0/0xfe8
+ vfs_open+0x68/0x320
+ do_open+0x2d8/0x9a8
+ path_openat+0x1d0/0x4f0
+ do_filp_open+0x190/0x380
+ do_sys_openat2+0xf8/0x1b0
+ __arm64_sys_openat+0x13c/0x1e8
+ invoke_syscall+0xdc/0x268
+ el0_svc_common.constprop.0+0x178/0x258
+ do_el0_svc+0x4c/0x70
+
+Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/meson/vdec/vdec.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/media/meson/vdec/vdec.c
++++ b/drivers/staging/media/meson/vdec/vdec.c
+@@ -889,7 +889,7 @@ static int vdec_open(struct file *file)
+
+ ret = vdec_init_ctrls(sess);
+ if (ret)
+- goto err_m2m_release;
++ goto err_m2m_ctx_release;
+
+ sess->pixfmt_cap = formats[0].pixfmts_cap[0];
+ sess->fmt_out = &formats[0];
+@@ -913,6 +913,8 @@ static int vdec_open(struct file *file)
+
+ return 0;
+
++err_m2m_ctx_release:
++ v4l2_m2m_ctx_release(sess->m2m_ctx);
+ err_m2m_release:
+ v4l2_m2m_release(sess->m2m_dev);
+ err_free_sess:
--- /dev/null
+From 7201c17786a498497bca57752883b90914d405ac Mon Sep 17 00:00:00 2001
+From: Valery Borovsky <vebohr@gmail.com>
+Date: Mon, 11 May 2026 20:12:07 +0300
+Subject: media: msi2500: Return queued buffers on start_streaming() failure
+
+From: Valery Borovsky <vebohr@gmail.com>
+
+commit 7201c17786a498497bca57752883b90914d405ac upstream.
+
+The vb2 framework hands buffers to the driver via buf_queue() before
+calling start_streaming(). If start_streaming() returns an error
+without first returning those buffers via vb2_buffer_done(),
+vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
+buffers leak.
+
+msi2500_start_streaming() had five error paths that all hit this trap
+and were further tangled by ret-overwriting between calls:
+
+ - -ENODEV when the USB device was already disconnected
+ - -ERESTARTSYS when mutex_lock_interruptible() was interrupted
+ - msi2500_set_usb_adc() failure: ret was silently overwritten by
+ the next call (msi2500_isoc_init), so the error was lost entirely
+ - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but
+ the function then fell through to msi2500_ctrl_msg() and again
+ masked the original error by overwriting ret
+ - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all,
+ leaving isoc URBs submitted with no way for the driver to consume
+ them
+
+Consolidate the error paths into a small goto chain. Every failure
+now stops the function, drains the queued-buffer list, and returns
+the real error code. The ctrl_msg failure path also rolls back the
+preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before
+unlocking and draining.
+
+The cleanup helper takes a vb2_buffer_state argument so that the
+start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as
+expected by userspace on start_streaming failure) while stop_streaming
+keeps its existing VB2_BUF_STATE_ERROR semantics.
+
+This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
+Return queued buffers on start_streaming() failure").
+
+Fixes: 977e444f59ad ("[media] Mirics MSi3101 SDR Dongle driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Valery Borovsky <vebohr@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/msi2500/msi2500.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/usb/msi2500/msi2500.c
++++ b/drivers/media/usb/msi2500/msi2500.c
+@@ -541,7 +541,8 @@ static int msi2500_isoc_init(struct msi2
+ }
+
+ /* Must be called with vb_queue_lock hold */
+-static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev)
++static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev,
++ enum vb2_buffer_state state)
+ {
+ unsigned long flags;
+
+@@ -554,7 +555,7 @@ static void msi2500_cleanup_queued_bufs(
+ buf = list_entry(dev->queued_bufs.next,
+ struct msi2500_frame_buf, list);
+ list_del(&buf->list);
+- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++ vb2_buffer_done(&buf->vb.vb2_buf, state);
+ }
+ spin_unlock_irqrestore(&dev->queued_bufs_lock, flags);
+ }
+@@ -830,25 +831,40 @@ static int msi2500_start_streaming(struc
+
+ dev_dbg(dev->dev, "\n");
+
+- if (!dev->udev)
+- return -ENODEV;
++ if (!dev->udev) {
++ ret = -ENODEV;
++ goto err_cleanup;
++ }
+
+- if (mutex_lock_interruptible(&dev->v4l2_lock))
+- return -ERESTARTSYS;
++ if (mutex_lock_interruptible(&dev->v4l2_lock)) {
++ ret = -ERESTARTSYS;
++ goto err_cleanup;
++ }
+
+ /* wake-up tuner */
+ v4l2_subdev_call(dev->v4l2_subdev, core, s_power, 1);
+
+ ret = msi2500_set_usb_adc(dev);
++ if (ret)
++ goto err_unlock_cleanup;
+
+ ret = msi2500_isoc_init(dev);
+ if (ret)
+- msi2500_cleanup_queued_bufs(dev);
++ goto err_unlock_cleanup;
+
+ ret = msi2500_ctrl_msg(dev, CMD_START_STREAMING, 0);
++ if (ret)
++ goto err_isoc_cleanup;
+
+ mutex_unlock(&dev->v4l2_lock);
++ return 0;
+
++err_isoc_cleanup:
++ msi2500_isoc_cleanup(dev);
++err_unlock_cleanup:
++ mutex_unlock(&dev->v4l2_lock);
++err_cleanup:
++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED);
+ return ret;
+ }
+
+@@ -863,7 +879,7 @@ static void msi2500_stop_streaming(struc
+ if (dev->udev)
+ msi2500_isoc_cleanup(dev);
+
+- msi2500_cleanup_queued_bufs(dev);
++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_ERROR);
+
+ /* according to tests, at least 700us delay is required */
+ msleep(20);
--- /dev/null
+From 60ca00792bce46ec170c7ed101f376186d4cf8a9 Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Sat, 28 Mar 2026 18:17:49 +0000
+Subject: media: nuvoton: npcm-video: fix error handling in npcm_video_init()
+
+From: David Carlier <devnexen@gmail.com>
+
+commit 60ca00792bce46ec170c7ed101f376186d4cf8a9 upstream.
+
+npcm_video_init() has two error handling issues after
+of_reserved_mem_device_init() is called:
+
+When dma_set_mask_and_coherent() fails, the function releases the
+reserved memory but does not return, allowing execution to fall through
+into npcm_video_ece_init() with a failed DMA configuration.
+
+When npcm_video_ece_init() fails, the function returns an error without
+calling of_reserved_mem_device_release(), leaking the reserved memory
+association.
+
+Fix both by adding the missing return after the DMA mask failure and
+adding the missing of_reserved_mem_device_release() call on the ECE init
+error path.
+
+Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/nuvoton/npcm-video.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/platform/nuvoton/npcm-video.c
++++ b/drivers/media/platform/nuvoton/npcm-video.c
+@@ -1720,10 +1720,12 @@ static int npcm_video_init(struct npcm_v
+ if (rc) {
+ dev_err(dev, "Failed to set DMA mask\n");
+ of_reserved_mem_device_release(dev);
++ return rc;
+ }
+
+ rc = npcm_video_ece_init(video);
+ if (rc) {
++ of_reserved_mem_device_release(dev);
+ dev_err(dev, "Failed to initialize ECE\n");
+ return rc;
+ }
--- /dev/null
+From 50cc0e547da50b887e63dfa1ad203cd5b735d01e Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Sat, 28 Mar 2026 18:18:09 +0000
+Subject: media: nuvoton: npcm-video: fix memory leaks in probe and remove
+
+From: David Carlier <devnexen@gmail.com>
+
+commit 50cc0e547da50b887e63dfa1ad203cd5b735d01e upstream.
+
+npcm_video_probe() allocates the npcm_video structure with kzalloc_obj()
+but never frees it on any probe error path or in npcm_video_remove(),
+leaking the allocation on every failed probe and every normal unbind.
+
+Additionally, when npcm_video_setup_video() fails, the reserved memory
+association established by of_reserved_mem_device_init() in
+npcm_video_init() is not released, leaking the rmem_assigned_device
+entry on the global list.
+
+Fix both by adding kfree(video) to all probe error paths and to
+npcm_video_remove(), and adding the missing
+of_reserved_mem_device_release() call when npcm_video_setup_video()
+fails.
+
+Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/nuvoton/npcm-video.c | 32 ++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 9 deletions(-)
+
+--- a/drivers/media/platform/nuvoton/npcm-video.c
++++ b/drivers/media/platform/nuvoton/npcm-video.c
+@@ -1750,42 +1750,55 @@ static int npcm_video_probe(struct platf
+ regs = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(regs)) {
+ dev_err(&pdev->dev, "Failed to parse VCD reg in DTS\n");
+- return PTR_ERR(regs);
++ rc = PTR_ERR(regs);
++ goto err_free;
+ }
+
+ video->vcd_regmap = devm_regmap_init_mmio(&pdev->dev, regs,
+ &npcm_video_regmap_cfg);
+ if (IS_ERR(video->vcd_regmap)) {
+ dev_err(&pdev->dev, "Failed to initialize VCD regmap\n");
+- return PTR_ERR(video->vcd_regmap);
++ rc = PTR_ERR(video->vcd_regmap);
++ goto err_free;
+ }
+
+ video->reset = devm_reset_control_get(&pdev->dev, NULL);
+ if (IS_ERR(video->reset)) {
+ dev_err(&pdev->dev, "Failed to get VCD reset control in DTS\n");
+- return PTR_ERR(video->reset);
++ rc = PTR_ERR(video->reset);
++ goto err_free;
+ }
+
+ video->gcr_regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
+ "nuvoton,sysgcr");
+- if (IS_ERR(video->gcr_regmap))
+- return PTR_ERR(video->gcr_regmap);
++ if (IS_ERR(video->gcr_regmap)) {
++ rc = PTR_ERR(video->gcr_regmap);
++ goto err_free;
++ }
+
+ video->gfx_regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
+ "nuvoton,sysgfxi");
+- if (IS_ERR(video->gfx_regmap))
+- return PTR_ERR(video->gfx_regmap);
++ if (IS_ERR(video->gfx_regmap)) {
++ rc = PTR_ERR(video->gfx_regmap);
++ goto err_free;
++ }
+
+ rc = npcm_video_init(video);
+ if (rc)
+- return rc;
++ goto err_free;
+
+ rc = npcm_video_setup_video(video);
+ if (rc)
+- return rc;
++ goto err_release_mem;
+
+ dev_info(video->dev, "NPCM video driver probed\n");
+ return 0;
++
++err_release_mem:
++ of_reserved_mem_device_release(&pdev->dev);
++err_free:
++ kfree(video);
++ return rc;
+ }
+
+ static void npcm_video_remove(struct platform_device *pdev)
+@@ -1800,6 +1813,7 @@ static void npcm_video_remove(struct pla
+ v4l2_device_unregister(v4l2_dev);
+ if (video->ece.enable)
+ npcm_video_ece_stop(video);
++ kfree(video);
+ of_reserved_mem_device_release(dev);
+ }
+
--- /dev/null
+From 567418eedd25b3d86d489807682030b4b98b73d9 Mon Sep 17 00:00:00 2001
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+Date: Thu, 7 May 2026 12:13:16 +0800
+Subject: media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+commit 567418eedd25b3d86d489807682030b4b98b73d9 upstream.
+
+Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call
+v4l2_subdev_init_finalize() which allocates the subdev active state,
+but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()
+calls v4l2_subdev_cleanup() to free it.
+
+This causes a memory leak on every rmmod, reported by kmemleak:
+
+ unreferenced object 0xffff0000d06fc800 (size 192):
+ comm "(udev-worker)", pid 254, jiffies 4294913455
+ backtrace (crc 36eeae58):
+ kmemleak_alloc+0x34/0x40
+ __kvmalloc_node_noprof+0x5f8/0x7d8
+ __v4l2_subdev_state_alloc+0x1fc/0x30c
+ __v4l2_subdev_init_finalize+0x178/0x368
+
+Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()
+in both crossbar and pipe cleanup paths.
+
+Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patch.msgid.link/20260507041318.491594-3-xiaolei.wang@windriver.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 +
+ drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
+@@ -492,6 +492,7 @@ err_free:
+
+ void mxc_isi_crossbar_cleanup(struct mxc_isi_crossbar *xbar)
+ {
++ v4l2_subdev_cleanup(&xbar->sd);
+ media_entity_cleanup(&xbar->sd.entity);
+ kfree(xbar->pads);
+ kfree(xbar->inputs);
+--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
+@@ -819,6 +819,7 @@ void mxc_isi_pipe_cleanup(struct mxc_isi
+ {
+ struct v4l2_subdev *sd = &pipe->sd;
+
++ v4l2_subdev_cleanup(sd);
+ media_entity_cleanup(&sd->entity);
+ mutex_destroy(&pipe->lock);
+ }
drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch
drm-amd-display-force-pwm-backlight-on-lenovo-legion-5-15arh05.patch
drm-amd-display-fix-backlight-max_brightness-to-match-exported-range.patch
+drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch
+drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch
+drm-amd-display-fix-flip-done-timeouts-on-mode1-reset.patch
+drm-vc4-shut-down-bo-cache-timer-before-teardown.patch
+drm-amd-display-fix-missing-dce-check-in-dm_gpureset_toggle_interrupts.patch
+drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch
+drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch
+drm-gpusvm-fix-mm-reference-leak-in-drm_gpusvm_range_evict.patch
+drm-v3d-reach-the-gmp-through-the-hub-registers-on-v3d-7.x.patch
+media-airspy-return-queued-buffers-on-start_streaming-failure.patch
+media-amlogic-c3-add-validations-for-ae-and-awb-config.patch
+media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch
+media-cec-seco-unregister-adapter-on-ir-probe-failure.patch
+media-cedrus-clean-up-media-device-on-probe-failure.patch
+media-cedrus-fix-missing-cleanup-in-error-path.patch
+media-cedrus-skip-invalid-h.264-reference-list-entries.patch
+media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch
+media-cx231xx-fix-devres-lifetime.patch
+media-cx23885-add-ioremap-return-check-and-cleanup.patch
+media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch
+media-imx219-fix-maximum-frame-length-in-lines.patch
+media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch
+media-iris-fix-use-irqf_no_autoen-when-requesting-the-irq.patch
+media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch
+media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch
+media-msi2500-return-queued-buffers-on-start_streaming-failure.patch
+media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch
+media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch
+media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
