--- /dev/null
+From a2f895f3c852063258d62e9f74b081de07ca95df Mon Sep 17 00:00:00 2001
+From: Zhu Lingshan <lingshan.zhu@amd.com>
+Date: Wed, 1 Jul 2026 18:53:21 +0800
+Subject: drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhu Lingshan <lingshan.zhu@amd.com>
+
+commit a2f895f3c852063258d62e9f74b081de07ca95df upstream.
+
+amdgpu_bo_create_reserved() only allocates a new BO when
+*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is
+NULL, it simply skips creation when *bo_ptr is non-NULL.
+But it unconditionally reserves, pins, gart allocates
+and maps the BO afterwards.
+
+When the same non-NULL BO pointer is passed in again,
+for example firmware buffers that live in adev and are
+re-loaded on every resume / cp_resume / start
+under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases
+pin_count unconditionally, however the matching teardown only unpins
+once, so pin_count never drops to zero, so TTM is not able
+to move, swap or evict a BO, causing BO leaks.
+
+This commit fixes this issue by only pinning the bo
+once at creation, and repeated calls no longer
+take additional pin references.
+
+Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -267,10 +267,12 @@ int amdgpu_bo_create_reserved(struct amd
+ goto error_free;
+ }
+
+- r = amdgpu_bo_pin(*bo_ptr, domain);
+- if (r) {
+- dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
+- goto error_unreserve;
++ if (free) {
++ r = amdgpu_bo_pin(*bo_ptr, domain);
++ if (r) {
++ dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
++ goto error_unreserve;
++ }
+ }
+
+ r = amdgpu_ttm_alloc_gart(&(*bo_ptr)->tbo);
+@@ -293,7 +295,8 @@ int amdgpu_bo_create_reserved(struct amd
+ return 0;
+
+ error_unpin:
+- amdgpu_bo_unpin(*bo_ptr);
++ if (free)
++ amdgpu_bo_unpin(*bo_ptr);
+ error_unreserve:
+ amdgpu_bo_unreserve(*bo_ptr);
+
--- /dev/null
+From a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 Mon Sep 17 00:00:00 2001
+From: Ian Forbes <ian.forbes@broadcom.com>
+Date: Tue, 23 Jun 2026 14:33:14 -0500
+Subject: drm/vmwgfx: Validate vmw_surface_metadata::array_size
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream.
+
+This field comes from userspace and should be validated against specific
+limits depending on which Shader Model (SM) is available.
+
+Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
+Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+@@ -98,7 +98,7 @@ static int vmw_gb_surface_unbind(struct
+ static int vmw_gb_surface_destroy(struct vmw_resource *res);
+ static int
+ vmw_gb_surface_define_internal(struct drm_device *dev,
+- struct drm_vmw_gb_surface_create_ext_req *req,
++ const struct drm_vmw_gb_surface_create_ext_req *req,
+ struct drm_vmw_gb_surface_create_rep *rep,
+ struct drm_file *file_priv);
+ static int
+@@ -1406,7 +1406,7 @@ int vmw_gb_surface_reference_ext_ioctl(s
+ */
+ static int
+ vmw_gb_surface_define_internal(struct drm_device *dev,
+- struct drm_vmw_gb_surface_create_ext_req *req,
++ const struct drm_vmw_gb_surface_create_ext_req *req,
+ struct drm_vmw_gb_surface_create_rep *rep,
+ struct drm_file *file_priv)
+ {
+@@ -1424,9 +1424,21 @@ vmw_gb_surface_define_internal(struct dr
+ req->base.svga3d_flags);
+
+ /* array_size must be null for non-GL3 host. */
+- if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) {
+- VMW_DEBUG_USER("SM4 surface not supported.\n");
+- return -EINVAL;
++ if (req->base.array_size > 0) {
++ if (has_sm5_context(dev_priv)) {
++ if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) {
++ VMW_DEBUG_USER("Invalid Surface Array Size.\n");
++ return -EINVAL;
++ }
++ } else if (has_sm4_context(dev_priv)) {
++ if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) {
++ VMW_DEBUG_USER("Invalid Surface Array Size.\n");
++ return -EINVAL;
++ }
++ } else {
++ VMW_DEBUG_USER("SM4+ surface not supported.\n");
++ return -EINVAL;
++ }
+ }
+
+ if (!has_sm4_1_context(dev_priv)) {
--- /dev/null
+From 04344d0b4929caa94c0df72f767752aa0935ef5d Mon Sep 17 00:00:00 2001
+From: Valery Borovsky <vebohr@gmail.com>
+Date: Mon, 11 May 2026 20:12:06 +0300
+Subject: media: airspy: Return queued buffers on start_streaming() failure
+
+From: Valery Borovsky <vebohr@gmail.com>
+
+commit 04344d0b4929caa94c0df72f767752aa0935ef5d upstream.
+
+The vb2 framework hands buffers to the driver via buf_queue() before
+calling start_streaming(). If start_streaming() returns an error
+without first returning those buffers via vb2_buffer_done(),
+vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
+buffers leak.
+
+airspy_start_streaming() returned -ENODEV early when the USB device had
+been disconnected (s->udev == NULL) without returning any buffers that
+buf_queue() had already accepted. Take v4l2_lock first and jump to the
+existing err_clear_bit label, which already drains s->queued_bufs via
+vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking.
+
+This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
+Return queued buffers on start_streaming() failure").
+
+Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Valery Borovsky <vebohr@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/airspy/airspy.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/airspy/airspy.c
++++ b/drivers/media/usb/airspy/airspy.c
+@@ -521,11 +521,13 @@ static int airspy_start_streaming(struct
+
+ dev_dbg(s->dev, "\n");
+
+- if (!s->udev)
+- return -ENODEV;
+-
+ mutex_lock(&s->v4l2_lock);
+
++ if (!s->udev) {
++ ret = -ENODEV;
++ goto err_clear_bit;
++ }
++
+ s->sequence = 0;
+
+ set_bit(POWER_ON, &s->flags);
--- /dev/null
+From 253c8ef7d57da0c74db251f385324faaa5ae2257 Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Sat, 28 Mar 2026 11:23:30 +0000
+Subject: media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
+
+From: David Carlier <devnexen@gmail.com>
+
+commit 253c8ef7d57da0c74db251f385324faaa5ae2257 upstream.
+
+aspeed_video_init() calls of_reserved_mem_device_init() to associate
+reserved memory regions with the device. When aspeed_video_setup_video()
+subsequently fails in aspeed_video_probe(), the error path frees the
+JPEG buffer and unprepares the clocks but does not release the reserved
+memory association, leaking the rmem_assigned_device entry on the global
+list.
+
+The normal remove path already calls of_reserved_mem_device_release()
+correctly; only the probe error path was missing it.
+
+Add the missing of_reserved_mem_device_release() call to the
+aspeed_video_setup_video() failure cleanup.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/aspeed/aspeed-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/aspeed/aspeed-video.c
++++ b/drivers/media/platform/aspeed/aspeed-video.c
+@@ -1994,6 +1994,7 @@ static int aspeed_video_probe(struct pla
+ rc = aspeed_video_setup_video(video);
+ if (rc) {
+ aspeed_video_free_buf(video, &video->jpeg);
++ of_reserved_mem_device_release(&pdev->dev);
+ clk_unprepare(video->vclk);
+ clk_unprepare(video->eclk);
+ return rc;
--- /dev/null
+From c3a78691be8245e52ced489f268e413f18061ac2 Mon Sep 17 00:00:00 2001
+From: Myeonghun Pak <mhun512@gmail.com>
+Date: Fri, 24 Apr 2026 23:36:01 +0900
+Subject: media: cec: seco: unregister adapter on IR probe failure
+
+From: Myeonghun Pak <mhun512@gmail.com>
+
+commit c3a78691be8245e52ced489f268e413f18061ac2 upstream.
+
+If secocec_ir_probe() fails after cec_register_adapter() succeeds,
+probe returns an error and the driver remove callback is not called.
+The current unwind path unregisters the notifier and then falls through
+to cec_delete_adapter(), which violates the CEC adapter lifetime rules
+after a successful registration.
+
+Add a registered-adapter unwind path that unregisters the notifier and
+the adapter instead.
+
+Fixes: daef95769b3a ("media: seco-cec: add Consumer-IR support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/cec/platform/seco/seco-cec.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/cec/platform/seco/seco-cec.c
++++ b/drivers/media/cec/platform/seco/seco-cec.c
+@@ -649,7 +649,7 @@ static int secocec_probe(struct platform
+
+ ret = secocec_ir_probe(secocec);
+ if (ret)
+- goto err_notifier;
++ goto err_unregister_adapter;
+
+ platform_set_drvdata(pdev, secocec);
+
+@@ -657,6 +657,10 @@ static int secocec_probe(struct platform
+
+ return ret;
+
++err_unregister_adapter:
++ cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap);
++ cec_unregister_adapter(secocec->cec_adap);
++ goto err;
+ err_notifier:
+ cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap);
+ err_delete_adapter:
--- /dev/null
+From 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 Mon Sep 17 00:00:00 2001
+From: Myeonghun Pak <mhun512@gmail.com>
+Date: Wed, 6 May 2026 21:41:16 +0900
+Subject: media: cedrus: clean up media device on probe failure
+
+From: Myeonghun Pak <mhun512@gmail.com>
+
+commit 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 upstream.
+
+cedrus_probe() initializes the media device before registering the video
+device, the media controller, and the media device. If any of those later
+steps fails, probe returns without calling media_device_cleanup(), so the
+media device internals initialized by media_device_init() are left behind.
+
+Add a media-device cleanup label to the probe unwind path and route video
+registration failures through it as well.
+
+Fixes: 50e761516f2b8c ("media: platform: Add Cedrus VPU decoder driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Paul Kocialkowski <paulk@sys-base.io>
+Co-developed-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Ijae Kim <ae878000@gmail.com>
+Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
+@@ -503,7 +503,7 @@ static int cedrus_probe(struct platform_
+ ret = video_register_device(vfd, VFL_TYPE_VIDEO, 0);
+ if (ret) {
+ v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+- goto err_m2m;
++ goto err_media;
+ }
+
+ v4l2_info(&dev->v4l2_dev,
+@@ -529,7 +529,8 @@ err_m2m_mc:
+ v4l2_m2m_unregister_media_controller(dev->m2m_dev);
+ err_video:
+ video_unregister_device(&dev->vfd);
+-err_m2m:
++err_media:
++ media_device_cleanup(&dev->mdev);
+ v4l2_m2m_release(dev->m2m_dev);
+ err_v4l2:
+ v4l2_device_unregister(&dev->v4l2_dev);
--- /dev/null
+From d99732334aaf33b9f93926b70b6a11c2cef3de39 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Tue, 7 Apr 2026 01:14:02 +0300
+Subject: media: cedrus: Fix missing cleanup in error path
+
+From: Samuel Holland <samuel@sholland.org>
+
+commit d99732334aaf33b9f93926b70b6a11c2cef3de39 upstream.
+
+According to the documentation struct v4l2_fh has to be cleaned up with
+v4l2_fh_exit() before being freed. [1]
+Currently there is no actual bug here, when v4l2_fh_exit() isn't called.
+v4l2_fh_exit() in this case only destroys internal mutex. But it may
+change in the future, when v4l2_fh_init/v4l2_fh_exit will be enhanced.
+
+1. https://docs.kernel.org/driver-api/media/v4l2-fh.html
+
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver")
+Cc: stable@vger.kernel.org
+Acked-by: Paul Kocialkowski <paulk@sys-base.io>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
+@@ -381,6 +381,7 @@ static int cedrus_open(struct file *file
+ err_ctrls:
+ v4l2_ctrl_handler_free(&ctx->hdl);
+ err_free:
++ v4l2_fh_exit(&ctx->fh);
+ kfree(ctx);
+ mutex_unlock(&dev->dev_mutex);
+
--- /dev/null
+From 10358ea986c3c85516d1c8206486464f79d36e76 Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Tue, 24 Mar 2026 16:08:56 +0800
+Subject: media: cedrus: skip invalid H.264 reference list entries
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 10358ea986c3c85516d1c8206486464f79d36e76 upstream.
+
+Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the
+stateless slice control and later uses their indices to look up
+decode->dpb[] in _cedrus_write_ref_list().
+
+Rejecting such controls in cedrus_try_ctrl() would break existing
+userspace, since stateless H.264 reference lists may legitimately carry
+out-of-range indices for missing references. Instead, guard the actual
+DPB lookup in Cedrus and skip entries whose indices do not fit the fixed
+V4L2_H264_NUM_DPB_ENTRIES array.
+
+This keeps the fix local to the driver use site and avoids out-of-bounds
+reads from malformed or unsupported reference list entries.
+
+Fixes: e000e1fa4bdbd ("media: uapi: h264: Update reference lists")
+Cc: stable@vger.kernel.org
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Tested-by: Chen-Yu Tsai <wens@kernel.org>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+@@ -190,6 +190,9 @@ static void _cedrus_write_ref_list(struc
+ u8 dpb_idx;
+
+ dpb_idx = ref_list[i].index;
++ if (dpb_idx >= V4L2_H264_NUM_DPB_ENTRIES)
++ continue;
++
+ dpb = &decode->dpb[dpb_idx];
+
+ if (!(dpb->flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE))
--- /dev/null
+From 7d6358ab02866e5b7ed8d3a00805297617bbb0ec Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 30 Mar 2026 11:37:27 +0200
+Subject: media: cx231xx: fix devres lifetime
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7d6358ab02866e5b7ed8d3a00805297617bbb0ec upstream.
+
+USB drivers bind to USB interfaces and any device managed resources
+should have their lifetime tied to the interface rather than parent USB
+device. This avoids issues like memory leaks when drivers are unbound
+without their devices being physically disconnected (e.g. on probe
+deferral or configuration changes).
+
+Fix the driver state lifetime so that it is released on driver unbind.
+
+Fixes: 184a82784d50 ("[media] cx231xx: use devm_ functions to allocate memory")
+Cc: stable@vger.kernel.org # 3.17
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
+@@ -1577,7 +1577,8 @@ static int cx231xx_init_v4l2(struct cx23
+ dev->video_mode.end_point_addr,
+ dev->video_mode.num_alt);
+
+- dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->video_mode.num_alt, GFP_KERNEL);
++ dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->video_mode.num_alt, GFP_KERNEL);
+ if (dev->video_mode.alt_max_pkt_size == NULL)
+ return -ENOMEM;
+
+@@ -1618,7 +1619,8 @@ static int cx231xx_init_v4l2(struct cx23
+ dev->vbi_mode.num_alt);
+
+ /* compute alternate max packet sizes for vbi */
+- dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->vbi_mode.num_alt, GFP_KERNEL);
++ dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->vbi_mode.num_alt, GFP_KERNEL);
+ if (dev->vbi_mode.alt_max_pkt_size == NULL)
+ return -ENOMEM;
+
+@@ -1660,7 +1662,9 @@ static int cx231xx_init_v4l2(struct cx23
+ "sliced CC EndPoint Addr 0x%x, Alternate settings: %i\n",
+ dev->sliced_cc_mode.end_point_addr,
+ dev->sliced_cc_mode.num_alt);
+- dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->sliced_cc_mode.num_alt, GFP_KERNEL);
++ dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->sliced_cc_mode.num_alt,
++ GFP_KERNEL);
+ if (dev->sliced_cc_mode.alt_max_pkt_size == NULL)
+ return -ENOMEM;
+
+@@ -1724,7 +1728,7 @@ static int cx231xx_usb_probe(struct usb_
+ udev = usb_get_dev(interface_to_usbdev(interface));
+
+ /* allocate memory for our device state and initialize it */
+- dev = devm_kzalloc(&udev->dev, sizeof(*dev), GFP_KERNEL);
++ dev = devm_kzalloc(&interface->dev, sizeof(*dev), GFP_KERNEL);
+ if (dev == NULL) {
+ retval = -ENOMEM;
+ goto err_if;
+@@ -1854,7 +1858,9 @@ static int cx231xx_usb_probe(struct usb_
+ dev->ts1_mode.end_point_addr,
+ dev->ts1_mode.num_alt);
+
+- dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->ts1_mode.num_alt, GFP_KERNEL);
++ dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32,
++ dev->ts1_mode.num_alt,
++ GFP_KERNEL);
+ if (dev->ts1_mode.alt_max_pkt_size == NULL) {
+ retval = -ENOMEM;
+ goto err_video_alt;
--- /dev/null
+From a0701e387b46e2481c05b47f1235b954bfc2af3e Mon Sep 17 00:00:00 2001
+From: Wang Jun <1742789905@qq.com>
+Date: Fri, 20 Mar 2026 15:04:53 +0800
+Subject: media: cx23885: add ioremap return check and cleanup
+
+From: Wang Jun <1742789905@qq.com>
+
+commit a0701e387b46e2481c05b47f1235b954bfc2af3e upstream.
+
+Add a check for the return value of pci_ioremap_bar()
+in cx23885_dev_setup().
+If ioremap for BAR0 fails, release the already allocated
+PCI memory region,
+decrement the device count, and return -ENODEV.
+
+This prevents a potential null pointer dereference and
+ensures proper cleanup
+on memory mapping failure.
+
+Fixes: d19770e5178a ("V4L/DVB (6150): Add CX23885/CX23887 PCIe bridge driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wang Jun <1742789905@qq.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx23885/cx23885-core.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/pci/cx23885/cx23885-core.c
++++ b/drivers/media/pci/cx23885/cx23885-core.c
+@@ -990,8 +990,12 @@ static int cx23885_dev_setup(struct cx23
+ }
+
+ /* PCIe stuff */
+- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0),
+- pci_resource_len(dev->pci, 0));
++ dev->lmmio = pci_ioremap_bar(dev->pci, 0);
++ if (!dev->lmmio) {
++ dev_err(&dev->pci->dev, "CORE %s: can't ioremap MMIO memory\n",
++ dev->name);
++ goto err_release_region;
++ }
+
+ dev->bmmio = (u8 __iomem *)dev->lmmio;
+
+@@ -1096,6 +1100,12 @@ static int cx23885_dev_setup(struct cx23
+ }
+
+ return 0;
++
++err_release_region:
++ release_mem_region(pci_resource_start(dev->pci, 0),
++ pci_resource_len(dev->pci, 0));
++ cx23885_devcount--;
++ return -ENODEV;
+ }
+
+ static void cx23885_dev_unregister(struct cx23885_dev *dev)
--- /dev/null
+From 033ff0420e4c9c240ae5523fff39770298efa964 Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Fri, 17 Apr 2026 14:53:30 +0800
+Subject: media: marvell-cam: fix missing pci_disable_device() on remove
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit 033ff0420e4c9c240ae5523fff39770298efa964 upstream.
+
+During manual code audit, we found that cafe_pci_probe() enables the
+PCI device with pci_enable_device(), and its probe error path properly
+calls pci_disable_device() on failure.
+
+However, cafe_pci_remove() tears down the controller and frees the
+driver data without disabling the PCI device, leaving the remove path
+inconsistent with probe cleanup.
+
+Add the missing pci_disable_device() call to cafe_pci_remove().
+
+Fixes: abfa3df36c01 ("[media] marvell-cam: Separate out the Marvell camera core")
+Cc: stable@vger.kernel.org
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/marvell/cafe-driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/marvell/cafe-driver.c
++++ b/drivers/media/platform/marvell/cafe-driver.c
+@@ -601,6 +601,7 @@ static void cafe_pci_remove(struct pci_d
+ return;
+ }
+ cafe_shutdown(cam);
++ pci_disable_device(pdev);
+ kfree(cam);
+ }
+
--- /dev/null
+From 940f161f734b25f175a95d2684c2021f6323693a Mon Sep 17 00:00:00 2001
+From: Anand Moon <linux.amoon@gmail.com>
+Date: Wed, 20 May 2026 10:10:41 +0530
+Subject: media: meson: vdec: Fix memory leak in error path of vdec_open
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+commit 940f161f734b25f175a95d2684c2021f6323693a upstream.
+
+The vdec_open() function previously jumped directly to
+err_m2m_release when vdec_init_ctrls() failed, skipping
+release of the m2m context. This caused a resource leak.
+
+Fix it by introducing a proper err_m2m_ctx_release label
+that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before
+releasing the m2m device.
+
+This was identified via kmemleak:
+unreferenced object 0xffff0000205d6878 (size 8):
+ comm "v4l_id", pid 5289, jiffies 4294938580
+ hex dump (first 8 bytes):
+ 40 d2 49 18 00 00 ff ff @.I.....
+ backtrace (crc d3204599):
+ kmemleak_alloc+0xc8/0xf0
+ __kvmalloc_node_noprof+0x60c/0x850
+ v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev]
+ vdec_open+0x1f4/0x788 [meson_vdec]
+ v4l2_open+0x144/0x460 [videodev]
+ chrdev_open+0x1ac/0x500
+ do_dentry_open+0x3f0/0xfe8
+ vfs_open+0x68/0x320
+ do_open+0x2d8/0x9a8
+ path_openat+0x1d0/0x4f0
+ do_filp_open+0x190/0x380
+ do_sys_openat2+0xf8/0x1b0
+ __arm64_sys_openat+0x13c/0x1e8
+ invoke_syscall+0xdc/0x268
+ el0_svc_common.constprop.0+0x178/0x258
+ do_el0_svc+0x4c/0x70
+
+Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/meson/vdec/vdec.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/media/meson/vdec/vdec.c
++++ b/drivers/staging/media/meson/vdec/vdec.c
+@@ -897,7 +897,7 @@ static int vdec_open(struct file *file)
+
+ ret = vdec_init_ctrls(sess);
+ if (ret)
+- goto err_m2m_release;
++ goto err_m2m_ctx_release;
+
+ sess->pixfmt_cap = formats[0].pixfmts_cap[0];
+ sess->fmt_out = &formats[0];
+@@ -922,6 +922,8 @@ static int vdec_open(struct file *file)
+
+ return 0;
+
++err_m2m_ctx_release:
++ v4l2_m2m_ctx_release(sess->m2m_ctx);
+ err_m2m_release:
+ v4l2_m2m_release(sess->m2m_dev);
+ err_free_sess:
--- /dev/null
+From 7201c17786a498497bca57752883b90914d405ac Mon Sep 17 00:00:00 2001
+From: Valery Borovsky <vebohr@gmail.com>
+Date: Mon, 11 May 2026 20:12:07 +0300
+Subject: media: msi2500: Return queued buffers on start_streaming() failure
+
+From: Valery Borovsky <vebohr@gmail.com>
+
+commit 7201c17786a498497bca57752883b90914d405ac upstream.
+
+The vb2 framework hands buffers to the driver via buf_queue() before
+calling start_streaming(). If start_streaming() returns an error
+without first returning those buffers via vb2_buffer_done(),
+vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
+buffers leak.
+
+msi2500_start_streaming() had five error paths that all hit this trap
+and were further tangled by ret-overwriting between calls:
+
+ - -ENODEV when the USB device was already disconnected
+ - -ERESTARTSYS when mutex_lock_interruptible() was interrupted
+ - msi2500_set_usb_adc() failure: ret was silently overwritten by
+ the next call (msi2500_isoc_init), so the error was lost entirely
+ - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but
+ the function then fell through to msi2500_ctrl_msg() and again
+ masked the original error by overwriting ret
+ - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all,
+ leaving isoc URBs submitted with no way for the driver to consume
+ them
+
+Consolidate the error paths into a small goto chain. Every failure
+now stops the function, drains the queued-buffer list, and returns
+the real error code. The ctrl_msg failure path also rolls back the
+preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before
+unlocking and draining.
+
+The cleanup helper takes a vb2_buffer_state argument so that the
+start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as
+expected by userspace on start_streaming failure) while stop_streaming
+keeps its existing VB2_BUF_STATE_ERROR semantics.
+
+This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
+Return queued buffers on start_streaming() failure").
+
+Fixes: 977e444f59ad ("[media] Mirics MSi3101 SDR Dongle driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Valery Borovsky <vebohr@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/msi2500/msi2500.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/usb/msi2500/msi2500.c
++++ b/drivers/media/usb/msi2500/msi2500.c
+@@ -541,7 +541,8 @@ static int msi2500_isoc_init(struct msi2
+ }
+
+ /* Must be called with vb_queue_lock hold */
+-static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev)
++static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev,
++ enum vb2_buffer_state state)
+ {
+ unsigned long flags;
+
+@@ -554,7 +555,7 @@ static void msi2500_cleanup_queued_bufs(
+ buf = list_entry(dev->queued_bufs.next,
+ struct msi2500_frame_buf, list);
+ list_del(&buf->list);
+- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++ vb2_buffer_done(&buf->vb.vb2_buf, state);
+ }
+ spin_unlock_irqrestore(&dev->queued_bufs_lock, flags);
+ }
+@@ -830,25 +831,40 @@ static int msi2500_start_streaming(struc
+
+ dev_dbg(dev->dev, "\n");
+
+- if (!dev->udev)
+- return -ENODEV;
++ if (!dev->udev) {
++ ret = -ENODEV;
++ goto err_cleanup;
++ }
+
+- if (mutex_lock_interruptible(&dev->v4l2_lock))
+- return -ERESTARTSYS;
++ if (mutex_lock_interruptible(&dev->v4l2_lock)) {
++ ret = -ERESTARTSYS;
++ goto err_cleanup;
++ }
+
+ /* wake-up tuner */
+ v4l2_subdev_call(dev->v4l2_subdev, core, s_power, 1);
+
+ ret = msi2500_set_usb_adc(dev);
++ if (ret)
++ goto err_unlock_cleanup;
+
+ ret = msi2500_isoc_init(dev);
+ if (ret)
+- msi2500_cleanup_queued_bufs(dev);
++ goto err_unlock_cleanup;
+
+ ret = msi2500_ctrl_msg(dev, CMD_START_STREAMING, 0);
++ if (ret)
++ goto err_isoc_cleanup;
+
+ mutex_unlock(&dev->v4l2_lock);
++ return 0;
+
++err_isoc_cleanup:
++ msi2500_isoc_cleanup(dev);
++err_unlock_cleanup:
++ mutex_unlock(&dev->v4l2_lock);
++err_cleanup:
++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED);
+ return ret;
+ }
+
+@@ -863,7 +879,7 @@ static void msi2500_stop_streaming(struc
+ if (dev->udev)
+ msi2500_isoc_cleanup(dev);
+
+- msi2500_cleanup_queued_bufs(dev);
++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_ERROR);
+
+ /* according to tests, at least 700us delay is required */
+ msleep(20);
drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch
drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch
+drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch
+drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch
+media-airspy-return-queued-buffers-on-start_streaming-failure.patch
+media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch
+media-cec-seco-unregister-adapter-on-ir-probe-failure.patch
+media-cedrus-clean-up-media-device-on-probe-failure.patch
+media-cedrus-fix-missing-cleanup-in-error-path.patch
+media-cedrus-skip-invalid-h.264-reference-list-entries.patch
+media-cx231xx-fix-devres-lifetime.patch
+media-cx23885-add-ioremap-return-check-and-cleanup.patch
+media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch
+media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch
+media-msi2500-return-queued-buffers-on-start_streaming-failure.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
