--- /dev/null
+From 6ccbb613b42a1f1ba7bfd547a148f644a902a25c Mon Sep 17 00:00:00 2001
+From: James Morse <james.morse@arm.com>
+Date: Fri, 8 May 2026 17:23:39 +0100
+Subject: arm_mpam: Check whether the config array is allocated before destroying it
+
+From: James Morse <james.morse@arm.com>
+
+commit 6ccbb613b42a1f1ba7bfd547a148f644a902a25c upstream.
+
+__destroy_component_cfg() is called to free the configuration array.
+It uses the embedded 'garbage' structure, which means the array has
+to be allocated.
+
+If __destroy_component_cfg() is called from mpam_disable() before the
+configuration was ever allocated, then a NULL pointer is dereferenced.
+
+Check for this case and return early if the configuration is not
+allocated.
+
+__destroy_component_cfg() also frees the mbwu_state as this is allocated
+by __allocate_component_cfg(). As the mbwu_state is allocated after
+comp->cfg is set, and is also under mpam_list_lock, only the first
+pointer needs checking.
+
+Fixes: 3bd04fe7d807 ("arm_mpam: Extend reset logic to allow devices to be reset any time")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: James Morse <james.morse@arm.com>
+Reviewed-by: Ben Horgan <ben.horgan@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/resctrl/mpam_devices.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/resctrl/mpam_devices.c
++++ b/drivers/resctrl/mpam_devices.c
+@@ -2359,6 +2359,9 @@ static void __destroy_component_cfg(stru
+
+ lockdep_assert_held(&mpam_list_lock);
+
++ if (!comp->cfg)
++ return;
++
+ add_to_garbage(comp->cfg);
+ list_for_each_entry(vmsc, &comp->vmsc, comp_list) {
+ msc = vmsc->msc;
--- /dev/null
+From f1caff3335ea6eab88cdc84ec8f2e3c45ca05486 Mon Sep 17 00:00:00 2001
+From: James Morse <james.morse@arm.com>
+Date: Fri, 8 May 2026 17:23:38 +0100
+Subject: arm_mpam: Fix false positive assert failure during mpam_disable()
+
+From: James Morse <james.morse@arm.com>
+
+commit f1caff3335ea6eab88cdc84ec8f2e3c45ca05486 upstream.
+
+mpam_assert_partid_sizes_fixed() is used to document that the caller
+doesn't expect the discovered PARTID size to change while it is walking
+a list sized by PARTID. Typically the MSC state is not written to until
+all the MSC have been discovered and this value is set.
+
+However, if discovering the MSC fails and schedules mpam_disable(),
+then the MSC state is written to reset it. In this case the
+discovered PARTID size may be become smaller - but only PARTID 0
+will be used once resctrl_exit() has been called.
+
+Skip the WARN_ON_ONCE() if mpam_disable_reason has been set.
+
+Fixes: 3bd04fe7d807 ("arm_mpam: Extend reset logic to allow devices to be reset any time")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: James Morse <james.morse@arm.com>
+Reviewed-by: Ben Horgan <ben.horgan@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/resctrl/mpam_devices.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/resctrl/mpam_devices.c
++++ b/drivers/resctrl/mpam_devices.c
+@@ -148,11 +148,17 @@ static void mpam_free_garbage(void)
+ /*
+ * Once mpam is enabled, new requestors cannot further reduce the available
+ * partid. Assert that the size is fixed, and new requestors will be turned
+- * away.
++ * away. This is needed when walking over structures sized by PARTID.
++ *
++ * During mpam_disable() these structures are not fixed, but the MSC state
++ * is still reset using whatever sizes have been discovered so far. As only
++ * PARTID 0 will be used after mpam_disable(), any race would be benign.
++ * Skip the check if a mpam_disable_reason has been set.
+ */
+ static void mpam_assert_partid_sizes_fixed(void)
+ {
+- WARN_ON_ONCE(!partid_max_published);
++ if (!mpam_disable_reason)
++ WARN_ON_ONCE(!partid_max_published);
+ }
+
+ static u32 __mpam_read_reg(struct mpam_msc *msc, u16 reg)
--- /dev/null
+From 1ef2a89584b7b788b2603590d886db076b2f24cc Mon Sep 17 00:00:00 2001
+From: Ben Horgan <ben.horgan@arm.com>
+Date: Thu, 7 May 2026 16:28:12 +0100
+Subject: arm_mpam: Fix monitor instance selection when checking for hardware NRDY
+
+From: Ben Horgan <ben.horgan@arm.com>
+
+commit 1ef2a89584b7b788b2603590d886db076b2f24cc upstream.
+
+In _mpam_ris_hw_probe_hw_nrdy() a new register value to select the first
+monitor and relevant RIS is prepared in mon_sel. However, it is written to
+the monitor value register, e.g. MSMON_CSU, rather than MSMON_CFG_MON_SEL.
+
+As MSMON_CFG_MON_SEL is a 32 bit register update the type of mon_sel to
+u32. Write mon_sel to the intended register, MSMON_CFG_MON_SEL.
+
+Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ben Horgan <ben.horgan@arm.com>
+Reviewed-by: James Morse <james.morse@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/resctrl/mpam_devices.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/resctrl/mpam_devices.c
++++ b/drivers/resctrl/mpam_devices.c
+@@ -635,7 +635,7 @@ static struct mpam_msc_ris *mpam_get_or_
+ static bool _mpam_ris_hw_probe_hw_nrdy(struct mpam_msc_ris *ris, u32 mon_reg)
+ {
+ u32 now;
+- u64 mon_sel;
++ u32 mon_sel;
+ bool can_set, can_clear;
+ struct mpam_msc *msc = ris->vmsc->msc;
+
+@@ -644,7 +644,7 @@ static bool _mpam_ris_hw_probe_hw_nrdy(s
+
+ mon_sel = FIELD_PREP(MSMON_CFG_MON_SEL_MON_SEL, 0) |
+ FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx);
+- _mpam_write_monsel_reg(msc, mon_reg, mon_sel);
++ mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel);
+
+ _mpam_write_monsel_reg(msc, mon_reg, MSMON___NRDY);
+ now = _mpam_read_monsel_reg(msc, mon_reg);
--- /dev/null
+From ccad6001be5c38426ccf45790c411467ad3c03c6 Mon Sep 17 00:00:00 2001
+From: Ben Horgan <ben.horgan@arm.com>
+Date: Thu, 7 May 2026 16:28:14 +0100
+Subject: arm_mpam: Improve check for whether or not NRDY is hardware managed
+
+From: Ben Horgan <ben.horgan@arm.com>
+
+commit ccad6001be5c38426ccf45790c411467ad3c03c6 upstream.
+
+mpam_ris_hw_probe_csu_nrdy() sets and clears MSMON_CSU.NRDY and checks
+whether it's configuration sticks. However, hardware isn't given a chance
+to disagree. Based on rule LRTGP, in MPAM specification IHI0099 version
+B.b, the hardware will set NRDY if it needs time to establish a count after
+a configuration change.
+
+Enable the monitor so that NRDY becomes relevant and change the
+configuration after clearing NRDY to try and coax the hardware into setting
+it.
+
+Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ben Horgan <ben.horgan@arm.com>
+Reviewed-by: James Morse <james.morse@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/resctrl/mpam_devices.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/resctrl/mpam_devices.c
++++ b/drivers/resctrl/mpam_devices.c
+@@ -634,8 +634,7 @@ static struct mpam_msc_ris *mpam_get_or_
+ */
+ static bool mpam_ris_hw_probe_csu_nrdy(struct mpam_msc_ris *ris)
+ {
+- u32 now;
+- u32 mon_sel;
++ u32 now, mon_sel, ctl_val;
+ bool can_set, can_clear;
+ struct mpam_msc *msc = ris->vmsc->msc;
+
+@@ -646,11 +645,21 @@ static bool mpam_ris_hw_probe_csu_nrdy(s
+ FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx);
+ mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel);
+
++ /* Hardware might ignore nrdy if it's not enabled */
++ ctl_val = MSMON_CFG_CSU_CTL_TYPE_CSU;
++ ctl_val |= MSMON_CFG_x_CTL_MATCH_PARTID;
++ ctl_val |= MSMON_CFG_x_CTL_MATCH_PMG;
++ ctl_val |= MSMON_CFG_x_CTL_EN;
++ mpam_write_monsel_reg(msc, CFG_CSU_FLT, 0);
++ mpam_write_monsel_reg(msc, CFG_CSU_CTL, ctl_val);
++
+ _mpam_write_monsel_reg(msc, MSMON_CSU, MSMON___NRDY);
+ now = _mpam_read_monsel_reg(msc, MSMON_CSU);
+ can_set = now & MSMON___NRDY;
+
+ _mpam_write_monsel_reg(msc, MSMON_CSU, 0);
++ /* Configuration change to try and coax hardware into setting nrdy */
++ mpam_write_monsel_reg(msc, CFG_CSU_FLT, 0x1);
+ now = _mpam_read_monsel_reg(msc, MSMON_CSU);
+ can_clear = !(now & MSMON___NRDY);
+ mpam_mon_sel_unlock(msc);
--- /dev/null
+From 4387970bbd84fd14e0c49c3089c5061ccd86b98a Mon Sep 17 00:00:00 2001
+From: Ben Horgan <ben.horgan@arm.com>
+Date: Thu, 7 May 2026 16:28:13 +0100
+Subject: arm_mpam: Pretend that NRDY is always hardware managed
+
+From: Ben Horgan <ben.horgan@arm.com>
+
+commit 4387970bbd84fd14e0c49c3089c5061ccd86b98a upstream.
+
+Rule ZTXDS of the MPAM specification, IHI009 version B.b, states: "If a
+monitor does not support automatic updates of NRDY, software can use that
+bit for any purpose."
+
+As software is not reliably informed whether or not the monitor supports
+automatic updates of NRDY always assume that hardware may manage NRDY but
+don't rely on it. When NRDY is truly untouched by hardware then, as it is
+written to 0 on configuration, it will always read 0.
+
+At probe it's checked if MSMON_CSU.NRDY and MSMON_MBWU.NRDY are hardware
+managed but not MSMON_MBWU_L.NDRY. Specialize the checking for hardware
+managed NRDY to CSU counters as this is the only case where hardware
+management makes sense. Continue to inform the user if MSMON_CSU.NRDY
+appears to be hardware managed but the firmware doesn't provide the
+associated time limit for the automatic clearing of NRDY. Remove the NRDY
+feature flags as they are now unused.
+
+Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ben Horgan <ben.horgan@arm.com>
+Reviewed-by: James Morse <james.morse@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/resctrl/mpam_devices.c | 53 ++++++++++++----------------------------
+ drivers/resctrl/mpam_internal.h | 2 -
+ 2 files changed, 17 insertions(+), 38 deletions(-)
+
+--- a/drivers/resctrl/mpam_devices.c
++++ b/drivers/resctrl/mpam_devices.c
+@@ -632,7 +632,7 @@ static struct mpam_msc_ris *mpam_get_or_
+ * Try and see what values stick in this bit. If we can write either value,
+ * its probably not implemented by hardware.
+ */
+-static bool _mpam_ris_hw_probe_hw_nrdy(struct mpam_msc_ris *ris, u32 mon_reg)
++static bool mpam_ris_hw_probe_csu_nrdy(struct mpam_msc_ris *ris)
+ {
+ u32 now;
+ u32 mon_sel;
+@@ -646,21 +646,18 @@ static bool _mpam_ris_hw_probe_hw_nrdy(s
+ FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx);
+ mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel);
+
+- _mpam_write_monsel_reg(msc, mon_reg, MSMON___NRDY);
+- now = _mpam_read_monsel_reg(msc, mon_reg);
++ _mpam_write_monsel_reg(msc, MSMON_CSU, MSMON___NRDY);
++ now = _mpam_read_monsel_reg(msc, MSMON_CSU);
+ can_set = now & MSMON___NRDY;
+
+- _mpam_write_monsel_reg(msc, mon_reg, 0);
+- now = _mpam_read_monsel_reg(msc, mon_reg);
++ _mpam_write_monsel_reg(msc, MSMON_CSU, 0);
++ now = _mpam_read_monsel_reg(msc, MSMON_CSU);
+ can_clear = !(now & MSMON___NRDY);
+ mpam_mon_sel_unlock(msc);
+
+ return (!can_set || !can_clear);
+ }
+
+-#define mpam_ris_hw_probe_hw_nrdy(_ris, _mon_reg) \
+- _mpam_ris_hw_probe_hw_nrdy(_ris, MSMON_##_mon_reg)
+-
+ static void mpam_ris_hw_probe(struct mpam_msc_ris *ris)
+ {
+ int err;
+@@ -770,20 +767,18 @@ static void mpam_ris_hw_probe(struct mpa
+ mpam_set_feature(mpam_feat_msmon_csu_xcl, props);
+
+ /* Is NRDY hardware managed? */
+- hw_managed = mpam_ris_hw_probe_hw_nrdy(ris, CSU);
+- if (hw_managed)
+- mpam_set_feature(mpam_feat_msmon_csu_hw_nrdy, props);
+- }
++ hw_managed = mpam_ris_hw_probe_csu_nrdy(ris);
+
+- /*
+- * Accept the missing firmware property if NRDY appears
+- * un-implemented.
+- */
+- if (err && mpam_has_feature(mpam_feat_msmon_csu_hw_nrdy, props))
+- dev_err_once(dev, "Counters are not usable because not-ready timeout was not provided by firmware.");
++ /*
++ * Accept the missing firmware property if NRDY appears
++ * un-implemented.
++ */
++ if (err && hw_managed)
++ dev_err_once(dev, "Counters are not usable because not-ready timeout was not provided by firmware.");
++ }
+ }
+ if (FIELD_GET(MPAMF_MSMON_IDR_MSMON_MBWU, msmon_features)) {
+- bool has_long, hw_managed;
++ bool has_long;
+ u32 mbwumon_idr = mpam_read_partsel_reg(msc, MBWUMON_IDR);
+
+ props->num_mbwu_mon = FIELD_GET(MPAMF_MBWUMON_IDR_NUM_MON, mbwumon_idr);
+@@ -802,16 +797,6 @@ static void mpam_ris_hw_probe(struct mpa
+ } else {
+ mpam_set_feature(mpam_feat_msmon_mbwu_31counter, props);
+ }
+-
+- /* Is NRDY hardware managed? */
+- hw_managed = mpam_ris_hw_probe_hw_nrdy(ris, MBWU);
+- if (hw_managed)
+- mpam_set_feature(mpam_feat_msmon_mbwu_hw_nrdy, props);
+-
+- /*
+- * Don't warn about any missing firmware property for
+- * MBWU NRDY - it doesn't make any sense!
+- */
+ }
+ }
+ }
+@@ -1078,7 +1063,6 @@ static void __ris_msmon_read(void *arg)
+ bool reset_on_next_read = false;
+ struct mpam_msc_ris *ris = m->ris;
+ struct msmon_mbwu_state *mbwu_state;
+- struct mpam_props *rprops = &ris->props;
+ struct mpam_msc *msc = m->ris->vmsc->msc;
+ u32 mon_sel, ctl_val, flt_val, cur_ctl, cur_flt;
+
+@@ -1134,8 +1118,7 @@ static void __ris_msmon_read(void *arg)
+ switch (m->type) {
+ case mpam_feat_msmon_csu:
+ now = mpam_read_monsel_reg(msc, CSU);
+- if (mpam_has_feature(mpam_feat_msmon_csu_hw_nrdy, rprops))
+- nrdy = now & MSMON___NRDY;
++ nrdy = now & MSMON___NRDY;
+ now = FIELD_GET(MSMON___VALUE, now);
+ break;
+ case mpam_feat_msmon_mbwu_31counter:
+@@ -1143,8 +1126,7 @@ static void __ris_msmon_read(void *arg)
+ case mpam_feat_msmon_mbwu_63counter:
+ if (m->type != mpam_feat_msmon_mbwu_31counter) {
+ now = mpam_msc_read_mbwu_l(msc);
+- if (mpam_has_feature(mpam_feat_msmon_mbwu_hw_nrdy, rprops))
+- nrdy = now & MSMON___L_NRDY;
++ nrdy = now & MSMON___L_NRDY;
+
+ if (m->type == mpam_feat_msmon_mbwu_63counter)
+ now = FIELD_GET(MSMON___LWD_VALUE, now);
+@@ -1152,8 +1134,7 @@ static void __ris_msmon_read(void *arg)
+ now = FIELD_GET(MSMON___L_VALUE, now);
+ } else {
+ now = mpam_read_monsel_reg(msc, MBWU);
+- if (mpam_has_feature(mpam_feat_msmon_mbwu_hw_nrdy, rprops))
+- nrdy = now & MSMON___NRDY;
++ nrdy = now & MSMON___NRDY;
+ now = FIELD_GET(MSMON___VALUE, now);
+ }
+
+--- a/drivers/resctrl/mpam_internal.h
++++ b/drivers/resctrl/mpam_internal.h
+@@ -167,14 +167,12 @@ enum mpam_device_features {
+ mpam_feat_msmon_csu,
+ mpam_feat_msmon_csu_capture,
+ mpam_feat_msmon_csu_xcl,
+- mpam_feat_msmon_csu_hw_nrdy,
+ mpam_feat_msmon_mbwu,
+ mpam_feat_msmon_mbwu_31counter,
+ mpam_feat_msmon_mbwu_44counter,
+ mpam_feat_msmon_mbwu_63counter,
+ mpam_feat_msmon_mbwu_capture,
+ mpam_feat_msmon_mbwu_rwbw,
+- mpam_feat_msmon_mbwu_hw_nrdy,
+ mpam_feat_partid_nrw,
+ MPAM_FEATURE_LAST
+ };
--- /dev/null
+From 950953f774b3f69da6f413e045ef075e1f3da2df Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:44 +0200
+Subject: drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 950953f774b3f69da6f413e045ef075e1f3da2df upstream.
+
+Make sure to drop the reference taken to the I2C adapter (and its
+module) when setting up HDMI to allow the adapter to be deregistered.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Cc: stable@vger.kernel.org # 3.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c
++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c
+@@ -580,6 +580,7 @@ static int oaktrail_hdmi_get_modes(struc
+ } else {
+ edid = (struct edid *)raw_edid;
+ /* FIXME ? edid = drm_get_edid(connector, i2c_adap); */
++ i2c_put_adapter(i2c_adap);
+ }
+
+ if (edid) {
--- /dev/null
+From 657a091ab6d01d0091b77660c75cfed573c9a53e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:45 +0200
+Subject: drm/gma500/oaktrail_lvds: fix hang on init failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 657a091ab6d01d0091b77660c75cfed573c9a53e upstream.
+
+The LVDS init code looks up an I2C adapter using i2c_get_adapter() and
+tries to read the EDID before falling back to allocating and registering
+its own adapter.
+
+The error handling does not separate these cases so on a late init
+failure it will try to deregister and free also an adapter that had
+previously been registered. Since i2c_get_adapter() takes another
+reference to the adapter, deregistration hangs indefinitely while
+waiting for the reference to be released.
+
+Fix this by only destroying adapters allocated during LVDS init on
+errors.
+
+Fixes: a57ebfc0b4da ("drm/gma500: Make oaktrail lvds use ddc adapter from drm_connector")
+Cc: stable@vger.kernel.org # 6.0
+Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_lvds.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+@@ -293,7 +293,7 @@ void oaktrail_lvds_init(struct drm_devic
+ {
+ struct gma_encoder *gma_encoder;
+ struct gma_connector *gma_connector;
+- struct gma_i2c_chan *ddc_bus;
++ struct gma_i2c_chan *ddc_bus = NULL;
+ struct drm_connector *connector;
+ struct drm_encoder *encoder;
+ struct drm_psb_private *dev_priv = to_drm_psb_private(dev);
+@@ -421,7 +421,8 @@ out:
+
+ err_unlock:
+ mutex_unlock(&dev->mode_config.mutex);
+- gma_i2c_destroy(to_gma_i2c_chan(connector->ddc));
++ if (!IS_ERR_OR_NULL(ddc_bus))
++ gma_i2c_destroy(ddc_bus);
+ drm_encoder_cleanup(encoder);
+ err_connector_cleanup:
+ drm_connector_cleanup(connector);
--- /dev/null
+From 84d1c9b416d54afe760ca4c378bd95c89261254c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 8 May 2026 16:44:46 +0200
+Subject: drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 84d1c9b416d54afe760ca4c378bd95c89261254c upstream.
+
+The LVDS init code looks up an I2C adapter using i2c_get_adapter() and
+tries to read the EDID before falling back to allocating and registering
+its own adapter.
+
+Make sure to drop the references taken by i2c_get_adapter() when falling
+back to allocating an adapter as well as on late errors to allow the
+looked up adapter to be deregistered.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Cc: stable@vger.kernel.org # 3.3
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patch.msgid.link/20260508144446.59722-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_lvds.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+@@ -367,6 +367,8 @@ void oaktrail_lvds_init(struct drm_devic
+ if (edid == NULL && dev_priv->lpc_gpio_base) {
+ ddc_bus = oaktrail_lvds_i2c_init(dev);
+ if (!IS_ERR(ddc_bus)) {
++ if (i2c_adap)
++ i2c_put_adapter(i2c_adap);
+ i2c_adap = &ddc_bus->base;
+ edid = drm_get_edid(connector, i2c_adap);
+ }
+@@ -423,6 +425,8 @@ err_unlock:
+ mutex_unlock(&dev->mode_config.mutex);
+ if (!IS_ERR_OR_NULL(ddc_bus))
+ gma_i2c_destroy(ddc_bus);
++ else if (i2c_adap)
++ i2c_put_adapter(i2c_adap);
+ drm_encoder_cleanup(encoder);
+ err_connector_cleanup:
+ drm_connector_cleanup(connector);
drm-xe-dma-buf-fix-uaf-with-retry-loop.patch
drm-ttm-fix-ttm_bo_shrink-infinite-lru-walk-on-backup-failure.patch
drm-ttm-convert-eagain-from-dmem_cgroup_try_charge-to-enospc.patch
+drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch
+drm-gma500-oaktrail_lvds-fix-hang-on-init-failure.patch
+drm-gma500-oaktrail_lvds-fix-i2c-adapter-leaks-on-init.patch
+arm_mpam-fix-monitor-instance-selection-when-checking-for-hardware-nrdy.patch
+arm_mpam-pretend-that-nrdy-is-always-hardware-managed.patch
+arm_mpam-improve-check-for-whether-or-not-nrdy-is-hardware-managed.patch
+arm_mpam-fix-false-positive-assert-failure-during-mpam_disable.patch
+arm_mpam-check-whether-the-config-array-is-allocated-before-destroying-it.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
