From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:55:55 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.1.179~35 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=4b22e99a7832415ed2f1252adc89990a2eca4936;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-amd-display-fix-flip-done-timeouts-on-mode1-reset.patch drm-amd-display-fix-missing-dce-check-in-dm_gpureset_toggle_interrupts.patch drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch drm-gpusvm-fix-mm-reference-leak-in-drm_gpusvm_range_evict.patch drm-v3d-reach-the-gmp-through-the-hub-registers-on-v3d-7.x.patch drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch drm-vc4-shut-down-bo-cache-timer-before-teardown.patch drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch media-airspy-return-queued-buffers-on-start_streaming-failure.patch media-amlogic-c3-add-validations-for-ae-and-awb-config.patch media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch media-cec-seco-unregister-adapter-on-ir-probe-failure.patch media-cedrus-clean-up-media-device-on-probe-failure.patch media-cedrus-fix-missing-cleanup-in-error-path.patch media-cedrus-skip-invalid-h.264-reference-list-entries.patch media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch media-cx231xx-fix-devres-lifetime.patch media-cx23885-add-ioremap-return-check-and-cleanup.patch media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch media-imx219-fix-maximum-frame-length-in-lines.patch media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch media-iris-fix-use-irqf_no_autoen-when-requesting-the-irq.patch media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch media-msi2500-return-queued-buffers-on-start_streaming-failure.patch media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch --- diff --git a/queue-6.18/drm-amd-display-fix-flip-done-timeouts-on-mode1-reset.patch b/queue-6.18/drm-amd-display-fix-flip-done-timeouts-on-mode1-reset.patch new file mode 100644 index 0000000000..184bdbbbc2 --- /dev/null +++ b/queue-6.18/drm-amd-display-fix-flip-done-timeouts-on-mode1-reset.patch @@ -0,0 +1,71 @@ +From 82730dba0cf9d9524af0ceeb7eb6b5c3ab1bdb87 Mon Sep 17 00:00:00 2001 +From: Leo Li +Date: Thu, 23 Jul 2026 14:01:59 -0400 +Subject: drm/amd/display: Fix flip-done timeouts on mode1 reset + +From: Leo Li + +commit 82730dba0cf9d9524af0ceeb7eb6b5c3ab1bdb87 upstream. + +The vblank on/off callbacks mixed use of amdgpu_irq_get/put() and +amdgpu_dm_crtc_set_vupdate_irq() to enable and disable IRQs. + +With get/put, base driver will callback into DC to disable IRQs when +refcount == 0. With set_vupdate_irq(), DC is called directly to disable +IRQs, bypassing base driver's refcount tracking. + +During gpu reset, base driver can restore IRQs via +amdgpu_irq_gpu_reset_resume_helper() > amdgpu_irq_update(). So if +get/put() is not used (i.e. refcount == 0), then vupdate_irq will be +disabled. + +This is problematic if DRM requests vblank on before amdgpu_irq_update() +is called: drm_vblank_on() > set_vupdate_irq() enables vupdate_irq, but +the refcount is still 0. gpu_reset_resume_helper() > irq_update() then +immediately disables it, thus leading to flip done timeouts. + +This is made worse on DCN since VUPDATE_NO_LOCK is the only IRQ enabled. +Prior to 8382cd234981, a combination of GRPH_FLIP and VSTARTUP IRQs were +used, and they used get/put(). This explains why 8382cd234981 exposed +this issue. + +Fix by using get/put() instead of set_vupdate_irq(). DCE is unchanged, +since it relies on unbalanced enable/disable calls based on VRR status, +and hence requires direct set_vupdate_irq(). Plus, it also uses +GRPH_FLIP and VLINE IRQs, which are properly tracked by get/put(). + +Cc: stable@vger.kernel.org +Fixes: 8382cd234981 ("drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock") +Signed-off-by: Leo Li +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20260723180159.52121-1-sunpeng.li@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +@@ -333,10 +333,19 @@ static inline int amdgpu_dm_crtc_set_vbl + * is enabled. On DCE, vupdate is only needed in VRR mode. + */ + if (amdgpu_ip_version(adev, DCE_HWIP, 0) != 0) { +- rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, enable); ++ if (enable) { ++ rc = amdgpu_irq_get(adev, &adev->vupdate_irq, irq_type); ++ drm_dbg_vbl(crtc->dev, "Get vupdate_irq ret=%d\n", rc); ++ } else { ++ rc = amdgpu_irq_put(adev, &adev->vupdate_irq, irq_type); ++ drm_dbg_vbl(crtc->dev, "Put vupdate_irq ret=%d\n", rc); ++ } + } else if (dc_supports_vrr(dm->dc->ctx->dce_version)) { + if (enable) { +- /* vblank irq on -> Only need vupdate irq in vrr mode */ ++ /* vblank irq on -> Only need vupdate irq in vrr mode ++ * Not ref-counted since we need explicit enable/disable ++ * for DCE VRR handling ++ */ + if (amdgpu_dm_crtc_vrr_active(acrtc_state)) + rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, true); + } else { diff --git a/queue-6.18/drm-amd-display-fix-missing-dce-check-in-dm_gpureset_toggle_interrupts.patch b/queue-6.18/drm-amd-display-fix-missing-dce-check-in-dm_gpureset_toggle_interrupts.patch new file mode 100644 index 0000000000..76027e8542 --- /dev/null +++ b/queue-6.18/drm-amd-display-fix-missing-dce-check-in-dm_gpureset_toggle_interrupts.patch @@ -0,0 +1,36 @@ +From fbbaca9e208733652828ea98d00f09f260a7770e Mon Sep 17 00:00:00 2001 +From: Leo Li +Date: Thu, 23 Jul 2026 09:44:50 -0400 +Subject: drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() + +From: Leo Li + +commit fbbaca9e208733652828ea98d00f09f260a7770e upstream. + +This line was lost when cping from amd-staging-drm-next to drm-fixes. +So add it back. + +Cc: stable@vger.kernel.org +Fixes: 8382cd234981 ("drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock") +Reported-by: Lu Yao +Signed-off-by: Leo Li +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20260723134450.13838-1-sunpeng.li@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3068,7 +3068,8 @@ static void dm_gpureset_toggle_interrupt + acrtc = get_crtc_by_otg_inst( + adev, state->stream_status[i].primary_otg_inst); + +- if (acrtc && state->stream_status[i].plane_count != 0) { ++ if (acrtc && state->stream_status[i].plane_count != 0 && ++ amdgpu_ip_version(adev, DCE_HWIP, 0) == 0) { + irq_source = IRQ_TYPE_PFLIP + acrtc->otg_inst; + rc = dc_interrupt_set(adev->dm.dc, irq_source, enable) ? 0 : -EBUSY; + if (rc) diff --git a/queue-6.18/drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch b/queue-6.18/drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch new file mode 100644 index 0000000000..600ce68032 --- /dev/null +++ b/queue-6.18/drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch @@ -0,0 +1,47 @@ +From 0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Wed, 8 Jul 2026 22:15:20 -0500 +Subject: drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge + +From: Mario Limonciello + +commit 0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2 upstream. + +AMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs have +PCI controllers that don't support PCIe dynamic speed switching, +causing system freezes during GPU initialization when enabled. + +Disable dynamic speed switching when this CPU is detected. + +Assisted-by: Claude:sonnet +Fixes: 466a7d115326 ("drm/amd: Use the first non-dGPU PCI device for BW limits") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5436 +Reviewed-by: Lijo Lazar +Link: https://patch.msgid.link/20260709031520.841611-1-mario.limonciello@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 9ceb4e034a327a04155f32f1cd1a5031dfa5fe02) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -1878,6 +1878,15 @@ static bool amdgpu_device_pcie_dynamic_s + + if (c->x86_vendor == X86_VENDOR_INTEL) + return false; ++ ++ /* ++ * AMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs don't ++ * support PCIe dynamic speed switching. ++ * https://gitlab.freedesktop.org/drm/amd/-/work_items/5436 ++ */ ++ if (c->x86_vendor == X86_VENDOR_AMD && c->x86 == 0x17 && ++ c->x86_model == 0x08) ++ return false; + #endif + return true; + } diff --git a/queue-6.18/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch b/queue-6.18/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch new file mode 100644 index 0000000000..c3adb8fc94 --- /dev/null +++ b/queue-6.18/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch @@ -0,0 +1,70 @@ +From a2f895f3c852063258d62e9f74b081de07ca95df Mon Sep 17 00:00:00 2001 +From: Zhu Lingshan +Date: Wed, 1 Jul 2026 18:53:21 +0800 +Subject: drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhu Lingshan + +commit a2f895f3c852063258d62e9f74b081de07ca95df upstream. + +amdgpu_bo_create_reserved() only allocates a new BO when +*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is +NULL, it simply skips creation when *bo_ptr is non-NULL. +But it unconditionally reserves, pins, gart allocates +and maps the BO afterwards. + +When the same non-NULL BO pointer is passed in again, +for example firmware buffers that live in adev and are +re-loaded on every resume / cp_resume / start +under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases +pin_count unconditionally, however the matching teardown only unpins +once, so pin_count never drops to zero, so TTM is not able +to move, swap or evict a BO, causing BO leaks. + +This commit fixes this issue by only pinning the bo +once at creation, and repeated calls no longer +take additional pin references. + +Signed-off-by: Zhu Lingshan +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -284,10 +284,12 @@ int amdgpu_bo_create_reserved(struct amd + goto error_free; + } + +- r = amdgpu_bo_pin(*bo_ptr, domain); +- if (r) { +- dev_err(adev->dev, "(%d) kernel bo pin failed\n", r); +- goto error_unreserve; ++ if (free) { ++ r = amdgpu_bo_pin(*bo_ptr, domain); ++ if (r) { ++ dev_err(adev->dev, "(%d) kernel bo pin failed\n", r); ++ goto error_unreserve; ++ } + } + + r = amdgpu_ttm_alloc_gart(&(*bo_ptr)->tbo); +@@ -310,7 +312,8 @@ int amdgpu_bo_create_reserved(struct amd + return 0; + + error_unpin: +- amdgpu_bo_unpin(*bo_ptr); ++ if (free) ++ amdgpu_bo_unpin(*bo_ptr); + error_unreserve: + amdgpu_bo_unreserve(*bo_ptr); + diff --git a/queue-6.18/drm-gpusvm-fix-mm-reference-leak-in-drm_gpusvm_range_evict.patch b/queue-6.18/drm-gpusvm-fix-mm-reference-leak-in-drm_gpusvm_range_evict.patch new file mode 100644 index 0000000000..f2d0817263 --- /dev/null +++ b/queue-6.18/drm-gpusvm-fix-mm-reference-leak-in-drm_gpusvm_range_evict.patch @@ -0,0 +1,40 @@ +From 847b371debf3c8c72384ab7b9a0c4123a74cc925 Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Tue, 14 Jul 2026 10:00:25 -0700 +Subject: drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict + +From: Matthew Brost + +commit 847b371debf3c8c72384ab7b9a0c4123a74cc925 upstream. + +If kvmalloc_array() fails in drm_gpusvm_range_evict(), the MM +reference acquired earlier is not released, resulting in a reference +leak. + +Fix this by dropping the MM reference on the kvmalloc_array() +failure path. + +Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Brost +Reviewed-by: Himal Prasad Ghimiray +Link: https://patch.msgid.link/20260714170025.3487974-1-matthew.brost@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gpusvm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_gpusvm.c ++++ b/drivers/gpu/drm/drm_gpusvm.c +@@ -1566,8 +1566,10 @@ int drm_gpusvm_range_evict(struct drm_gp + return -EFAULT; + + pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL); +- if (!pfns) ++ if (!pfns) { ++ mmput(mm); + return -ENOMEM; ++ } + + hmm_range.hmm_pfns = pfns; + while (!time_after(jiffies, timeout)) { diff --git a/queue-6.18/drm-v3d-reach-the-gmp-through-the-hub-registers-on-v3d-7.x.patch b/queue-6.18/drm-v3d-reach-the-gmp-through-the-hub-registers-on-v3d-7.x.patch new file mode 100644 index 0000000000..4647a464bb --- /dev/null +++ b/queue-6.18/drm-v3d-reach-the-gmp-through-the-hub-registers-on-v3d-7.x.patch @@ -0,0 +1,54 @@ +From f7df2da0d1c375c1c4c70e1e0b569592de0d6b73 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ma=C3=ADra=20Canal?= +Date: Sat, 18 Jul 2026 10:44:36 -0300 +Subject: drm/v3d: Reach the GMP through the hub registers on V3D 7.x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +commit f7df2da0d1c375c1c4c70e1e0b569592de0d6b73 upstream. + +v3d_idle_axi() drains the GPU's memory interface for a safe powerdown by +using the V3D_GMP_CFG register. It reached both registers with the macros +V3D_CORE_READ and V3D_CORE_WRITE. + +On V3D 7.x the GMP is no longer a per-core block; it lives in the hub +register region. Reaching it through the per-core register block addresses +the wrong region. + +Select the hub accessors (V3D_{READ,WRITE}) for the GMP on V3D 7.x and +keep the per-core path for earlier generations. + +Cc: stable@vger.kernel.org +Fixes: 0ad5bc1ce463 ("drm/v3d: fix up register addresses for V3D 7.x") +Link: https://patch.msgid.link/20260718-v3d-pm-axi-transactions-v1-1-4ecd7729ed70@igalia.com +Reviewed-by: Iago Toral Quiroga +Signed-off-by: Maíra Canal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/v3d/v3d_gem.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/v3d/v3d_gem.c ++++ b/drivers/gpu/drm/v3d/v3d_gem.c +@@ -45,6 +45,18 @@ v3d_init_hw_state(struct v3d_dev *v3d) + static void + v3d_idle_axi(struct v3d_dev *v3d, int core) + { ++ if (v3d->ver >= V3D_GEN_71) { ++ V3D_WRITE(V3D_GMP_CFG(v3d->ver), V3D_GMP_CFG_STOP_REQ); ++ ++ if (wait_for((V3D_READ(V3D_GMP_STATUS(v3d->ver)) & ++ (V3D_GMP_STATUS_RD_COUNT_MASK | ++ V3D_GMP_STATUS_WR_COUNT_MASK | ++ V3D_GMP_STATUS_CFG_BUSY)) == 0, 100)) { ++ drm_err(&v3d->drm, "Failed to wait for safe GMP shutdown\n"); ++ } ++ return; ++ } ++ + V3D_CORE_WRITE(core, V3D_GMP_CFG(v3d->ver), V3D_GMP_CFG_STOP_REQ); + + if (wait_for((V3D_CORE_READ(core, V3D_GMP_STATUS(v3d->ver)) & diff --git a/queue-6.18/drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch b/queue-6.18/drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch new file mode 100644 index 0000000000..cb55a2160f --- /dev/null +++ b/queue-6.18/drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch @@ -0,0 +1,56 @@ +From 0c9e6367639548307d3f578f6943ce72c9d39087 Mon Sep 17 00:00:00 2001 +From: Linmao Li +Date: Tue, 21 Jul 2026 09:15:58 +0800 +Subject: drm/vc4: Prevent shader BO mappings from becoming writable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linmao Li + +commit 0c9e6367639548307d3f578f6943ce72c9d39087 upstream. + +vc4_gem_object_mmap() rejects a writable mapping of a validated shader +BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and +then turn it writable with mprotect(). + +Validated shader BOs must stay read-only: the validator checks the +instructions once and the GPU trusts them afterwards. A writable +mapping lets userspace rewrite the code after validation, bypassing the +validator. + +Clear VM_MAYWRITE on the read-only path so the mapping cannot be +upgraded, as i915 already does for its read-only objects. + +Fixes: 463873d57014 ("drm/vc4: Add an API for creating GPU shaders in GEM BOs.") +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Closes: https://lore.kernel.org/dri-devel/20260720085554.B0AF01F000E9@smtp.kernel.org/ +Signed-off-by: Linmao Li +Link: https://patch.msgid.link/20260721011558.1672477-1-lilinmao@kylinos.cn +Reviewed-by: Maíra Canal +Signed-off-by: Maíra Canal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_bo.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -733,9 +733,13 @@ static int vc4_gem_object_mmap(struct dr + { + struct vc4_bo *bo = to_vc4_bo(obj); + +- if (bo->validated_shader && (vma->vm_flags & VM_WRITE)) { +- DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n"); +- return -EINVAL; ++ if (bo->validated_shader) { ++ if (vma->vm_flags & VM_WRITE) { ++ DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n"); ++ return -EINVAL; ++ } ++ ++ vm_flags_clear(vma, VM_MAYWRITE); + } + + mutex_lock(&bo->madv_lock); diff --git a/queue-6.18/drm-vc4-shut-down-bo-cache-timer-before-teardown.patch b/queue-6.18/drm-vc4-shut-down-bo-cache-timer-before-teardown.patch new file mode 100644 index 0000000000..ba4d931c0c --- /dev/null +++ b/queue-6.18/drm-vc4-shut-down-bo-cache-timer-before-teardown.patch @@ -0,0 +1,44 @@ +From 6273dd3ffb54ec581855b82ae77331b66028249c Mon Sep 17 00:00:00 2001 +From: Linmao Li +Date: Mon, 20 Jul 2026 16:44:26 +0800 +Subject: drm/vc4: Shut down BO cache timer before teardown +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linmao Li + +commit 6273dd3ffb54ec581855b82ae77331b66028249c upstream. + +The BO cache timer callback schedules time_work, and time_work can rearm +the timer through vc4_bo_cache_free_old(). + +vc4_bo_cache_destroy() deletes the timer and then cancels the work, which +does not break that cycle: the work being cancelled can rearm the timer, +and the timer then queues work again after teardown. + +Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the +cycle ends with cancel_work_sync(). + +Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.") +Cc: stable@vger.kernel.org +Signed-off-by: Linmao Li +Link: https://patch.msgid.link/20260720084426.1632508-1-lilinmao@kylinos.cn +Reviewed-by: Maíra Canal +Signed-off-by: Maíra Canal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_bo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -1046,7 +1046,7 @@ static void vc4_bo_cache_destroy(struct + struct vc4_dev *vc4 = to_vc4_dev(dev); + int i; + +- timer_delete(&vc4->bo_cache.time_timer); ++ timer_shutdown_sync(&vc4->bo_cache.time_timer); + cancel_work_sync(&vc4->bo_cache.time_work); + + vc4_bo_cache_purge(dev); diff --git a/queue-6.18/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch b/queue-6.18/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch new file mode 100644 index 0000000000..1892bc6fd8 --- /dev/null +++ b/queue-6.18/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch @@ -0,0 +1,69 @@ +From a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 Mon Sep 17 00:00:00 2001 +From: Ian Forbes +Date: Tue, 23 Jun 2026 14:33:14 -0500 +Subject: drm/vmwgfx: Validate vmw_surface_metadata::array_size + +From: Ian Forbes + +commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream. + +This field comes from userspace and should be validated against specific +limits depending on which Shader Model (SM) is available. + +Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata") +Reported-by: Zero Day Initiative +Cc: stable@vger.kernel.org +Signed-off-by: Ian Forbes +Reviewed-by: Maaz Mombasawala +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +@@ -77,7 +77,7 @@ static int vmw_gb_surface_unbind(struct + static int vmw_gb_surface_destroy(struct vmw_resource *res); + static int + vmw_gb_surface_define_internal(struct drm_device *dev, +- struct drm_vmw_gb_surface_create_ext_req *req, ++ const struct drm_vmw_gb_surface_create_ext_req *req, + struct drm_vmw_gb_surface_create_rep *rep, + struct drm_file *file_priv); + static int +@@ -1503,7 +1503,7 @@ int vmw_gb_surface_reference_ext_ioctl(s + */ + static int + vmw_gb_surface_define_internal(struct drm_device *dev, +- struct drm_vmw_gb_surface_create_ext_req *req, ++ const struct drm_vmw_gb_surface_create_ext_req *req, + struct drm_vmw_gb_surface_create_rep *rep, + struct drm_file *file_priv) + { +@@ -1521,9 +1521,21 @@ vmw_gb_surface_define_internal(struct dr + req->base.svga3d_flags); + + /* array_size must be null for non-GL3 host. */ +- if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) { +- VMW_DEBUG_USER("SM4 surface not supported.\n"); +- return -EINVAL; ++ if (req->base.array_size > 0) { ++ if (has_sm5_context(dev_priv)) { ++ if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) { ++ VMW_DEBUG_USER("Invalid Surface Array Size.\n"); ++ return -EINVAL; ++ } ++ } else if (has_sm4_context(dev_priv)) { ++ if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) { ++ VMW_DEBUG_USER("Invalid Surface Array Size.\n"); ++ return -EINVAL; ++ } ++ } else { ++ VMW_DEBUG_USER("SM4+ surface not supported.\n"); ++ return -EINVAL; ++ } + } + + if (!has_sm4_1_context(dev_priv)) { diff --git a/queue-6.18/media-airspy-return-queued-buffers-on-start_streaming-failure.patch b/queue-6.18/media-airspy-return-queued-buffers-on-start_streaming-failure.patch new file mode 100644 index 0000000000..af38a3125e --- /dev/null +++ b/queue-6.18/media-airspy-return-queued-buffers-on-start_streaming-failure.patch @@ -0,0 +1,52 @@ +From 04344d0b4929caa94c0df72f767752aa0935ef5d Mon Sep 17 00:00:00 2001 +From: Valery Borovsky +Date: Mon, 11 May 2026 20:12:06 +0300 +Subject: media: airspy: Return queued buffers on start_streaming() failure + +From: Valery Borovsky + +commit 04344d0b4929caa94c0df72f767752aa0935ef5d upstream. + +The vb2 framework hands buffers to the driver via buf_queue() before +calling start_streaming(). If start_streaming() returns an error +without first returning those buffers via vb2_buffer_done(), +vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued +buffers leak. + +airspy_start_streaming() returned -ENODEV early when the USB device had +been disconnected (s->udev == NULL) without returning any buffers that +buf_queue() had already accepted. Take v4l2_lock first and jump to the +existing err_clear_bit label, which already drains s->queued_bufs via +vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. + +This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: +Return queued buffers on start_streaming() failure"). + +Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver") +Cc: stable@vger.kernel.org +Signed-off-by: Valery Borovsky +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/airspy/airspy.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/airspy/airspy.c ++++ b/drivers/media/usb/airspy/airspy.c +@@ -522,11 +522,13 @@ static int airspy_start_streaming(struct + + dev_dbg(s->dev, "\n"); + +- if (!s->udev) +- return -ENODEV; +- + mutex_lock(&s->v4l2_lock); + ++ if (!s->udev) { ++ ret = -ENODEV; ++ goto err_clear_bit; ++ } ++ + s->sequence = 0; + + set_bit(POWER_ON, &s->flags); diff --git a/queue-6.18/media-amlogic-c3-add-validations-for-ae-and-awb-config.patch b/queue-6.18/media-amlogic-c3-add-validations-for-ae-and-awb-config.patch new file mode 100644 index 0000000000..bd4a3c5313 --- /dev/null +++ b/queue-6.18/media-amlogic-c3-add-validations-for-ae-and-awb-config.patch @@ -0,0 +1,50 @@ +From 9724164f71974a2a44a5e026614fbcc05bab6d91 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Thu, 7 May 2026 20:58:11 +0000 +Subject: media: amlogic-c3: Add validations for ae and awb config + +From: Ricardo Ribalda + +commit 9724164f71974a2a44a5e026614fbcc05bab6d91 upstream. + +Avoid invalid memory access if the zones_num is bigger than +zone_weight. + +This patch fixes the following smatch errors: +drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max +drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max +drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max +drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max + +Cc: stable@vger.kernel.org +Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver") +Reviewed-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Signed-off-by: Ricardo Ribalda +Reviewed-by: Keke Li +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c ++++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c +@@ -107,6 +107,8 @@ static void c3_isp_params_awb_wt(struct + c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0); + + zones_num = cfg->horiz_zones_num * cfg->vert_zones_num; ++ if (zones_num > C3_ISP_AWB_MAX_ZONES) ++ zones_num = C3_ISP_AWB_MAX_ZONES; + + /* Need to write 8 weights at once */ + for (i = 0; i < zones_num / 8; i++) { +@@ -223,6 +225,8 @@ static void c3_isp_params_ae_wt(struct c + c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0); + + zones_num = cfg->horiz_zones_num * cfg->vert_zones_num; ++ if (zones_num > C3_ISP_AE_MAX_ZONES) ++ zones_num = C3_ISP_AE_MAX_ZONES; + + /* Need to write 8 weights at once */ + for (i = 0; i < zones_num / 8; i++) { diff --git a/queue-6.18/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch b/queue-6.18/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch new file mode 100644 index 0000000000..3fc1b4ab62 --- /dev/null +++ b/queue-6.18/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch @@ -0,0 +1,41 @@ +From 253c8ef7d57da0c74db251f385324faaa5ae2257 Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 28 Mar 2026 11:23:30 +0000 +Subject: media: aspeed: fix missing of_reserved_mem_device_release() on probe failure + +From: David Carlier + +commit 253c8ef7d57da0c74db251f385324faaa5ae2257 upstream. + +aspeed_video_init() calls of_reserved_mem_device_init() to associate +reserved memory regions with the device. When aspeed_video_setup_video() +subsequently fails in aspeed_video_probe(), the error path frees the +JPEG buffer and unprepares the clocks but does not release the reserved +memory association, leaking the rmem_assigned_device entry on the global +list. + +The normal remove path already calls of_reserved_mem_device_release() +correctly; only the probe error path was missing it. + +Add the missing of_reserved_mem_device_release() call to the +aspeed_video_setup_video() failure cleanup. + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/aspeed/aspeed-video.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/aspeed/aspeed-video.c ++++ b/drivers/media/platform/aspeed/aspeed-video.c +@@ -2327,6 +2327,7 @@ static int aspeed_video_probe(struct pla + rc = aspeed_video_setup_video(video); + if (rc) { + aspeed_video_free_buf(video, &video->jpeg); ++ of_reserved_mem_device_release(&pdev->dev); + clk_unprepare(video->vclk); + clk_unprepare(video->eclk); + return rc; diff --git a/queue-6.18/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch b/queue-6.18/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch new file mode 100644 index 0000000000..c19726177d --- /dev/null +++ b/queue-6.18/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch @@ -0,0 +1,49 @@ +From c3a78691be8245e52ced489f268e413f18061ac2 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Fri, 24 Apr 2026 23:36:01 +0900 +Subject: media: cec: seco: unregister adapter on IR probe failure + +From: Myeonghun Pak + +commit c3a78691be8245e52ced489f268e413f18061ac2 upstream. + +If secocec_ir_probe() fails after cec_register_adapter() succeeds, +probe returns an error and the driver remove callback is not called. +The current unwind path unregisters the notifier and then falls through +to cec_delete_adapter(), which violates the CEC adapter lifetime rules +after a successful registration. + +Add a registered-adapter unwind path that unregisters the notifier and +the adapter instead. + +Fixes: daef95769b3a ("media: seco-cec: add Consumer-IR support") +Cc: stable@vger.kernel.org +Signed-off-by: Myeonghun Pak +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/cec/platform/seco/seco-cec.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/media/cec/platform/seco/seco-cec.c ++++ b/drivers/media/cec/platform/seco/seco-cec.c +@@ -649,7 +649,7 @@ static int secocec_probe(struct platform + + ret = secocec_ir_probe(secocec); + if (ret) +- goto err_notifier; ++ goto err_unregister_adapter; + + platform_set_drvdata(pdev, secocec); + +@@ -657,6 +657,10 @@ static int secocec_probe(struct platform + + return ret; + ++err_unregister_adapter: ++ cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap); ++ cec_unregister_adapter(secocec->cec_adap); ++ goto err; + err_notifier: + cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap); + err_delete_adapter: diff --git a/queue-6.18/media-cedrus-clean-up-media-device-on-probe-failure.patch b/queue-6.18/media-cedrus-clean-up-media-device-on-probe-failure.patch new file mode 100644 index 0000000000..dd9a92f59e --- /dev/null +++ b/queue-6.18/media-cedrus-clean-up-media-device-on-probe-failure.patch @@ -0,0 +1,51 @@ +From 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Wed, 6 May 2026 21:41:16 +0900 +Subject: media: cedrus: clean up media device on probe failure + +From: Myeonghun Pak + +commit 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 upstream. + +cedrus_probe() initializes the media device before registering the video +device, the media controller, and the media device. If any of those later +steps fails, probe returns without calling media_device_cleanup(), so the +media device internals initialized by media_device_init() are left behind. + +Add a media-device cleanup label to the probe unwind path and route video +registration failures through it as well. + +Fixes: 50e761516f2b8c ("media: platform: Add Cedrus VPU decoder driver") +Cc: stable@vger.kernel.org +Reviewed-by: Paul Kocialkowski +Co-developed-by: Ijae Kim +Signed-off-by: Ijae Kim +Signed-off-by: Myeonghun Pak +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -507,7 +507,7 @@ static int cedrus_probe(struct platform_ + ret = video_register_device(vfd, VFL_TYPE_VIDEO, 0); + if (ret) { + v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); +- goto err_m2m; ++ goto err_media; + } + + v4l2_info(&dev->v4l2_dev, +@@ -533,7 +533,8 @@ err_m2m_mc: + v4l2_m2m_unregister_media_controller(dev->m2m_dev); + err_video: + video_unregister_device(&dev->vfd); +-err_m2m: ++err_media: ++ media_device_cleanup(&dev->mdev); + v4l2_m2m_release(dev->m2m_dev); + err_v4l2: + v4l2_device_unregister(&dev->v4l2_dev); diff --git a/queue-6.18/media-cedrus-fix-missing-cleanup-in-error-path.patch b/queue-6.18/media-cedrus-fix-missing-cleanup-in-error-path.patch new file mode 100644 index 0000000000..339e472eea --- /dev/null +++ b/queue-6.18/media-cedrus-fix-missing-cleanup-in-error-path.patch @@ -0,0 +1,39 @@ +From d99732334aaf33b9f93926b70b6a11c2cef3de39 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Tue, 7 Apr 2026 01:14:02 +0300 +Subject: media: cedrus: Fix missing cleanup in error path + +From: Samuel Holland + +commit d99732334aaf33b9f93926b70b6a11c2cef3de39 upstream. + +According to the documentation struct v4l2_fh has to be cleaned up with +v4l2_fh_exit() before being freed. [1] +Currently there is no actual bug here, when v4l2_fh_exit() isn't called. +v4l2_fh_exit() in this case only destroys internal mutex. But it may +change in the future, when v4l2_fh_init/v4l2_fh_exit will be enhanced. + +1. https://docs.kernel.org/driver-api/media/v4l2-fh.html + +Signed-off-by: Samuel Holland +Signed-off-by: Andrey Skvortsov +Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver") +Cc: stable@vger.kernel.org +Acked-by: Paul Kocialkowski +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -391,6 +391,7 @@ static int cedrus_open(struct file *file + err_m2m_release: + v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + err_free: ++ v4l2_fh_exit(&ctx->fh); + kfree(ctx); + mutex_unlock(&dev->dev_mutex); + diff --git a/queue-6.18/media-cedrus-skip-invalid-h.264-reference-list-entries.patch b/queue-6.18/media-cedrus-skip-invalid-h.264-reference-list-entries.patch new file mode 100644 index 0000000000..4a7020d42d --- /dev/null +++ b/queue-6.18/media-cedrus-skip-invalid-h.264-reference-list-entries.patch @@ -0,0 +1,47 @@ +From 10358ea986c3c85516d1c8206486464f79d36e76 Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Tue, 24 Mar 2026 16:08:56 +0800 +Subject: media: cedrus: skip invalid H.264 reference list entries + +From: Pengpeng Hou + +commit 10358ea986c3c85516d1c8206486464f79d36e76 upstream. + +Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the +stateless slice control and later uses their indices to look up +decode->dpb[] in _cedrus_write_ref_list(). + +Rejecting such controls in cedrus_try_ctrl() would break existing +userspace, since stateless H.264 reference lists may legitimately carry +out-of-range indices for missing references. Instead, guard the actual +DPB lookup in Cedrus and skip entries whose indices do not fit the fixed +V4L2_H264_NUM_DPB_ENTRIES array. + +This keeps the fix local to the driver use site and avoids out-of-bounds +reads from malformed or unsupported reference list entries. + +Fixes: e000e1fa4bdbd ("media: uapi: h264: Update reference lists") +Cc: stable@vger.kernel.org +Signed-off-by: Pengpeng Hou +Reviewed-by: Nicolas Dufresne +Acked-by: Jernej Skrabec +Tested-by: Chen-Yu Tsai +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +@@ -210,6 +210,9 @@ static void _cedrus_write_ref_list(struc + u8 dpb_idx; + + dpb_idx = ref_list[i].index; ++ if (dpb_idx >= V4L2_H264_NUM_DPB_ENTRIES) ++ continue; ++ + dpb = &decode->dpb[dpb_idx]; + + if (!(dpb->flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE)) diff --git a/queue-6.18/media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch b/queue-6.18/media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch new file mode 100644 index 0000000000..9f9edb9539 --- /dev/null +++ b/queue-6.18/media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch @@ -0,0 +1,81 @@ +From b20157147089a9c16a38c7810e2fe6f2df8e3277 Mon Sep 17 00:00:00 2001 +From: Brandon Brnich +Date: Fri, 20 Mar 2026 13:05:26 -0500 +Subject: media: chips-media: wave5: Move src_buf Removal to finish_encode + +From: Brandon Brnich + +commit b20157147089a9c16a38c7810e2fe6f2df8e3277 upstream. + +During encoder processing, there is a case where the IRQ response could +return the buffer back to userspace via v4l2_m2m_buf_done call. In this +time, userspace could queue up this same buffer before start_encode removes +the index from the ready queue. This would then lead to a case where the +buffer in the ready queue could be a self loop due to the +WRITE_ONCE(prev->next, new) call in __list_add. + +When __list_del is finally called, the loop is already made so nothing +points back to ready queue list head and pointers are poisoned. + +A buffer should not be marked as DONE before the buffer is removed from +m2m ready queue. Move removal entirely to finish_encode. + +Fixes: 9707a6254a8a6 ("media: chips-media: wave5: Add the v4l2 layer") +Cc: stable@vger.kernel.org +Signed-off-by: Brandon Brnich +Tested-by: Jackson Lee +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 29 ++------------- + 1 file changed, 4 insertions(+), 25 deletions(-) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -226,13 +226,6 @@ static int start_encode(struct vpu_insta + } else { + dev_dbg(inst->dev->dev, "%s: wave5_vpu_enc_start_one_frame success\n", + __func__); +- /* +- * Remove the source buffer from the ready-queue now and finish +- * it in the videobuf2 framework once the index is returned by the +- * firmware in finish_encode +- */ +- if (src_buf) +- v4l2_m2m_src_buf_remove_by_idx(m2m_ctx, src_buf->vb2_buf.index); + } + + return 0; +@@ -259,27 +252,13 @@ static void wave5_vpu_enc_finish_encode( + __func__, enc_output_info.pic_type, enc_output_info.recon_frame_index, + enc_output_info.enc_src_idx, enc_output_info.enc_pic_byte, enc_output_info.pts); + +- /* +- * The source buffer will not be found in the ready-queue as it has been +- * dropped after sending of the encode firmware command, locate it in +- * the videobuf2 queue directly +- */ + if (enc_output_info.enc_src_idx >= 0) { +- struct vb2_buffer *vb = vb2_get_buffer(v4l2_m2m_get_src_vq(m2m_ctx), +- enc_output_info.enc_src_idx); +- if (vb->state != VB2_BUF_STATE_ACTIVE) +- dev_warn(inst->dev->dev, +- "%s: encoded buffer (%d) was not in ready queue %i.", +- __func__, enc_output_info.enc_src_idx, vb->state); +- else +- src_buf = to_vb2_v4l2_buffer(vb); +- +- if (src_buf) { ++ src_buf = v4l2_m2m_src_buf_remove_by_idx(m2m_ctx, enc_output_info.enc_src_idx); ++ if (!src_buf) { ++ dev_warn(inst->dev->dev, "%s: no source buffer found\n", __func__); ++ } else { + inst->timestamp = src_buf->vb2_buf.timestamp; + v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_DONE); +- } else { +- dev_warn(inst->dev->dev, "%s: no source buffer with index: %d found\n", +- __func__, enc_output_info.enc_src_idx); + } + } + diff --git a/queue-6.18/media-cx231xx-fix-devres-lifetime.patch b/queue-6.18/media-cx231xx-fix-devres-lifetime.patch new file mode 100644 index 0000000000..54ba046315 --- /dev/null +++ b/queue-6.18/media-cx231xx-fix-devres-lifetime.patch @@ -0,0 +1,79 @@ +From 7d6358ab02866e5b7ed8d3a00805297617bbb0ec Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 30 Mar 2026 11:37:27 +0200 +Subject: media: cx231xx: fix devres lifetime + +From: Johan Hovold + +commit 7d6358ab02866e5b7ed8d3a00805297617bbb0ec upstream. + +USB drivers bind to USB interfaces and any device managed resources +should have their lifetime tied to the interface rather than parent USB +device. This avoids issues like memory leaks when drivers are unbound +without their devices being physically disconnected (e.g. on probe +deferral or configuration changes). + +Fix the driver state lifetime so that it is released on driver unbind. + +Fixes: 184a82784d50 ("[media] cx231xx: use devm_ functions to allocate memory") +Cc: stable@vger.kernel.org # 3.17 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/media/usb/cx231xx/cx231xx-cards.c ++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c +@@ -1575,7 +1575,8 @@ static int cx231xx_init_v4l2(struct cx23 + dev->video_mode.end_point_addr, + dev->video_mode.num_alt); + +- dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->video_mode.num_alt, GFP_KERNEL); ++ dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->video_mode.num_alt, GFP_KERNEL); + if (dev->video_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1616,7 +1617,8 @@ static int cx231xx_init_v4l2(struct cx23 + dev->vbi_mode.num_alt); + + /* compute alternate max packet sizes for vbi */ +- dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->vbi_mode.num_alt, GFP_KERNEL); ++ dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->vbi_mode.num_alt, GFP_KERNEL); + if (dev->vbi_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1658,7 +1660,9 @@ static int cx231xx_init_v4l2(struct cx23 + "sliced CC EndPoint Addr 0x%x, Alternate settings: %i\n", + dev->sliced_cc_mode.end_point_addr, + dev->sliced_cc_mode.num_alt); +- dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->sliced_cc_mode.num_alt, GFP_KERNEL); ++ dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->sliced_cc_mode.num_alt, ++ GFP_KERNEL); + if (dev->sliced_cc_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1722,7 +1726,7 @@ static int cx231xx_usb_probe(struct usb_ + udev = usb_get_dev(interface_to_usbdev(interface)); + + /* allocate memory for our device state and initialize it */ +- dev = devm_kzalloc(&udev->dev, sizeof(*dev), GFP_KERNEL); ++ dev = devm_kzalloc(&interface->dev, sizeof(*dev), GFP_KERNEL); + if (dev == NULL) { + retval = -ENOMEM; + goto err_if; +@@ -1852,7 +1856,9 @@ static int cx231xx_usb_probe(struct usb_ + dev->ts1_mode.end_point_addr, + dev->ts1_mode.num_alt); + +- dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->ts1_mode.num_alt, GFP_KERNEL); ++ dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->ts1_mode.num_alt, ++ GFP_KERNEL); + if (dev->ts1_mode.alt_max_pkt_size == NULL) { + retval = -ENOMEM; + goto err_video_alt; diff --git a/queue-6.18/media-cx23885-add-ioremap-return-check-and-cleanup.patch b/queue-6.18/media-cx23885-add-ioremap-return-check-and-cleanup.patch new file mode 100644 index 0000000000..93e2d196b3 --- /dev/null +++ b/queue-6.18/media-cx23885-add-ioremap-return-check-and-cleanup.patch @@ -0,0 +1,58 @@ +From a0701e387b46e2481c05b47f1235b954bfc2af3e Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Fri, 20 Mar 2026 15:04:53 +0800 +Subject: media: cx23885: add ioremap return check and cleanup + +From: Wang Jun <1742789905@qq.com> + +commit a0701e387b46e2481c05b47f1235b954bfc2af3e upstream. + +Add a check for the return value of pci_ioremap_bar() +in cx23885_dev_setup(). +If ioremap for BAR0 fails, release the already allocated +PCI memory region, +decrement the device count, and return -ENODEV. + +This prevents a potential null pointer dereference and +ensures proper cleanup +on memory mapping failure. + +Fixes: d19770e5178a ("V4L/DVB (6150): Add CX23885/CX23887 PCIe bridge driver") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/cx23885/cx23885-core.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -990,8 +990,12 @@ static int cx23885_dev_setup(struct cx23 + } + + /* PCIe stuff */ +- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); ++ dev->lmmio = pci_ioremap_bar(dev->pci, 0); ++ if (!dev->lmmio) { ++ dev_err(&dev->pci->dev, "CORE %s: can't ioremap MMIO memory\n", ++ dev->name); ++ goto err_release_region; ++ } + + dev->bmmio = (u8 __iomem *)dev->lmmio; + +@@ -1096,6 +1100,12 @@ static int cx23885_dev_setup(struct cx23 + } + + return 0; ++ ++err_release_region: ++ release_mem_region(pci_resource_start(dev->pci, 0), ++ pci_resource_len(dev->pci, 0)); ++ cx23885_devcount--; ++ return -ENODEV; + } + + static void cx23885_dev_unregister(struct cx23885_dev *dev) diff --git a/queue-6.18/media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch b/queue-6.18/media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch new file mode 100644 index 0000000000..1652471baa --- /dev/null +++ b/queue-6.18/media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch @@ -0,0 +1,98 @@ +From 4f6f28ff24709710c08557c127b3e4c3fb1b4159 Mon Sep 17 00:00:00 2001 +From: Martin Hecht +Date: Fri, 8 May 2026 11:59:03 +0200 +Subject: media: i2c: alvium: fix critical pointer access in alvium_ctrl_init + +From: Martin Hecht + +commit 4f6f28ff24709710c08557c127b3e4c3fb1b4159 upstream. + +The current implementation of alvium_ctrl_init creates several controls in +function alvium_ctrl_init and uses the returned pointer without check. That +can cause write access over NULL-pointer for several controls. The reworked +code checks the pointers before adding flags. + +Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera") +Cc: stable@vger.kernel.org +Signed-off-by: Martin Hecht +Signed-off-by: Sakari Ailus +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/alvium-csi2.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/media/i2c/alvium-csi2.c ++++ b/drivers/media/i2c/alvium-csi2.c +@@ -2100,20 +2100,21 @@ static int alvium_ctrl_init(struct alviu + V4L2_CID_PIXEL_RATE, 0, + ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1, + ALVIUM_DEFAULT_PIXEL_RATE_MHZ); +- ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY; + + /* Link freq is fixed */ + ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops, + V4L2_CID_LINK_FREQ, + 0, 0, &alvium->link_freq); +- ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY; ++ if (ctrls->link_freq) ++ ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY; + + /* Auto/manual white balance */ + if (alvium->avail_ft.auto_whiteb) { + ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops, + V4L2_CID_AUTO_WHITE_BALANCE, + 0, 1, 1, 1); +- v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false); ++ if (ctrls->auto_wb) ++ v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false); + } + + ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops, +@@ -2122,6 +2123,7 @@ static int alvium_ctrl_init(struct alviu + alvium->max_bbalance, + alvium->inc_bbalance, + alvium->dft_bbalance); ++ + ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops, + V4L2_CID_RED_BALANCE, + alvium->min_rbalance, +@@ -2136,7 +2138,9 @@ static int alvium_ctrl_init(struct alviu + V4L2_CID_EXPOSURE_AUTO, + V4L2_EXPOSURE_MANUAL, 0, + V4L2_EXPOSURE_AUTO); +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true); ++ if (ctrls->auto_exp) ++ v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, ++ V4L2_EXPOSURE_MANUAL, true); + } + + ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, +@@ -2145,14 +2149,16 @@ static int alvium_ctrl_init(struct alviu + alvium->max_exp, + alvium->inc_exp, + alvium->dft_exp); +- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; ++ if (ctrls->exposure) ++ ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; + + /* Auto/manual gain */ + if (alvium->avail_ft.auto_gain) { + ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, + V4L2_CID_AUTOGAIN, + 0, 1, 1, 1); +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); ++ if (ctrls->auto_gain) ++ v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); + } + + if (alvium->avail_ft.gain) { +@@ -2162,7 +2168,8 @@ static int alvium_ctrl_init(struct alviu + alvium->max_gain, + alvium->inc_gain, + alvium->dft_gain); +- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; ++ if (ctrls->gain) ++ ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; + } + + if (alvium->avail_ft.sat) diff --git a/queue-6.18/media-imx219-fix-maximum-frame-length-in-lines.patch b/queue-6.18/media-imx219-fix-maximum-frame-length-in-lines.patch new file mode 100644 index 0000000000..04009e03de --- /dev/null +++ b/queue-6.18/media-imx219-fix-maximum-frame-length-in-lines.patch @@ -0,0 +1,33 @@ +From 2c4f1ba7354312ad2d6e34e70a518a51a9344715 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Sat, 21 Feb 2026 01:38:15 +0200 +Subject: media: imx219: Fix maximum frame length in lines + +From: Sakari Ailus + +commit 2c4f1ba7354312ad2d6e34e70a518a51a9344715 upstream. + +The driver used the maximum frame length in lines value of 0xffff, but the +maximum appears to be 0xfffe instead. Fix it. + +Fixes: 1283b3b8f82b ("media: i2c: Add driver for Sony IMX219 sensor") +Cc: stable@vger.kernel.org +Signed-off-by: Sakari Ailus +Reviewed-by: Dave Stevenson +Reviewed-by: Laurent Pinchart +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/imx219.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -71,7 +71,7 @@ + + /* V_TIMING internal */ + #define IMX219_REG_FRM_LENGTH_A CCI_REG16(0x0160) +-#define IMX219_FLL_MAX 0xffff ++#define IMX219_FLL_MAX 0xfffe + #define IMX219_VBLANK_MIN 32 + #define IMX219_REG_LINE_LENGTH_A CCI_REG16(0x0162) + #define IMX219_LLP_MIN 0x0d78 diff --git a/queue-6.18/media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch b/queue-6.18/media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch new file mode 100644 index 0000000000..cc01fcd198 --- /dev/null +++ b/queue-6.18/media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch @@ -0,0 +1,84 @@ +From 477620dccf3e9481ed6ae67cb5c747f25751c531 Mon Sep 17 00:00:00 2001 +From: Marco Nenciarini +Date: Wed, 1 Apr 2026 18:25:47 +0200 +Subject: media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges + +From: Marco Nenciarini + +commit 477620dccf3e9481ed6ae67cb5c747f25751c531 upstream. + +The get_hsfreq_by_mbps() function searches the freqranges[] table +backward (from highest to lowest index). Because adjacent frequency +bands overlap, a data rate that falls in the overlap region always +lands on the higher-indexed band. + +For data rates up to 1500 Mbps (index 42) every band uses +osc_freq_target 335. Starting at index 43 (1461-1640 Mbps) the +osc_freq_target drops to 208. A sensor running at 1498 Mbps sits in +the overlap between index 42 (1414-1588, osc 335) and index 43 +(1461-1640, osc 208). The backward search picks index 43, programming +the lower osc_freq_target of 208 instead of the optimal 335. + +This causes DDL lock instability and CSI-2 CRC errors on affected +configurations, such as the OmniVision OV08X40 sensor on Intel Arrow +Lake platforms (Dell Pro Max 16). + +Rewrite get_hsfreq_by_mbps() to select the optimal band: + +1. Among bands whose min/max range covers the data rate, prefer + the one with the higher osc_freq_target. +2. If osc_freq_target is equal, prefer the band whose default_mbps + is closest to the requested rate. + +Since the frequency ranges are monotonically increasing, the loop +exits early once min exceeds the requested rate. + +For 1498 Mbps this now correctly selects index 42 (osc_freq_target +335, range 1414-1588) instead of index 43 (osc_freq_target 208, +range 1461-1640). + +Fixes: 1e7eeb301696 ("media: intel/ipu6: add the CSI2 DPHY implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Marco Nenciarini +Signed-off-by: Sakari Ailus +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c | 24 +++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c +@@ -288,15 +288,27 @@ static const struct dwc_dphy_freq_range + + static u16 get_hsfreq_by_mbps(u32 mbps) + { +- unsigned int i = DPHY_FREQ_RANGE_NUM; ++ u16 best = DPHY_FREQ_RANGE_INVALID_INDEX; ++ unsigned int i; + +- while (i--) { +- if (freqranges[i].default_mbps == mbps || +- (mbps >= freqranges[i].min && mbps <= freqranges[i].max)) +- return i; ++ for (i = 0; i < DPHY_FREQ_RANGE_NUM; i++) { ++ if (mbps > freqranges[i].max) ++ continue; ++ ++ if (mbps < freqranges[i].min) ++ break; ++ ++ if (best == DPHY_FREQ_RANGE_INVALID_INDEX || ++ freqranges[i].osc_freq_target > ++ freqranges[best].osc_freq_target || ++ (freqranges[i].osc_freq_target == ++ freqranges[best].osc_freq_target && ++ abs((int)mbps - (int)freqranges[i].default_mbps) < ++ abs((int)mbps - (int)freqranges[best].default_mbps))) ++ best = i; + } + +- return DPHY_FREQ_RANGE_INVALID_INDEX; ++ return best; + } + + static int ipu6_isys_dwc_phy_config(struct ipu6_isys *isys, diff --git a/queue-6.18/media-iris-fix-use-irqf_no_autoen-when-requesting-the-irq.patch b/queue-6.18/media-iris-fix-use-irqf_no_autoen-when-requesting-the-irq.patch new file mode 100644 index 0000000000..58185e9d54 --- /dev/null +++ b/queue-6.18/media-iris-fix-use-irqf_no_autoen-when-requesting-the-irq.patch @@ -0,0 +1,45 @@ +From 45ac2230f929b9f0fae899c4a5c6bf763250fc13 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Fri, 29 May 2026 14:27:10 +0300 +Subject: media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ + +From: Dmitry Baryshkov + +commit 45ac2230f929b9f0fae899c4a5c6bf763250fc13 upstream. + +Requesting the IRQ and then immediately disabling it is fragile as it +leaves a window when the IRQ is still enabled although the underlying +device might be not completely setup for IRQ handling. Pass +IRQF_NO_AUTOEN instead of calling disable_irq_nosync(). + +Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks") +Reviewed-by: Konrad Dybcio +Reviewed-by: Dikshita Agarwal +Signed-off-by: Dmitry Baryshkov +[bod: Appended Fix to patch title for -stable clarity] +[bod: Added cc stable for backporting] +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_probe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_probe.c ++++ b/drivers/media/platform/qcom/iris/iris_probe.c +@@ -256,12 +256,12 @@ static int iris_probe(struct platform_de + core->iris_platform_data = of_device_get_match_data(core->dev); + + ret = devm_request_threaded_irq(core->dev, core->irq, iris_hfi_isr, +- iris_hfi_isr_handler, IRQF_TRIGGER_HIGH, "iris", core); ++ iris_hfi_isr_handler, ++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, ++ "iris", core); + if (ret) + return ret; + +- disable_irq_nosync(core->irq); +- + iris_init_ops(core); + core->iris_platform_data->init_hfi_command_ops(core); + core->iris_platform_data->init_hfi_response_ops(core); diff --git a/queue-6.18/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch b/queue-6.18/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch new file mode 100644 index 0000000000..b2ea218152 --- /dev/null +++ b/queue-6.18/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch @@ -0,0 +1,38 @@ +From 033ff0420e4c9c240ae5523fff39770298efa964 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Fri, 17 Apr 2026 14:53:30 +0800 +Subject: media: marvell-cam: fix missing pci_disable_device() on remove + +From: Guangshuo Li + +commit 033ff0420e4c9c240ae5523fff39770298efa964 upstream. + +During manual code audit, we found that cafe_pci_probe() enables the +PCI device with pci_enable_device(), and its probe error path properly +calls pci_disable_device() on failure. + +However, cafe_pci_remove() tears down the controller and frees the +driver data without disabling the PCI device, leaving the remove path +inconsistent with probe cleanup. + +Add the missing pci_disable_device() call to cafe_pci_remove(). + +Fixes: abfa3df36c01 ("[media] marvell-cam: Separate out the Marvell camera core") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/marvell/cafe-driver.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/marvell/cafe-driver.c ++++ b/drivers/media/platform/marvell/cafe-driver.c +@@ -609,6 +609,7 @@ static void cafe_pci_remove(struct pci_d + return; + } + cafe_shutdown(cam); ++ pci_disable_device(pdev); + kfree(cam); + } + diff --git a/queue-6.18/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch b/queue-6.18/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch new file mode 100644 index 0000000000..693b90124a --- /dev/null +++ b/queue-6.18/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch @@ -0,0 +1,70 @@ +From 940f161f734b25f175a95d2684c2021f6323693a Mon Sep 17 00:00:00 2001 +From: Anand Moon +Date: Wed, 20 May 2026 10:10:41 +0530 +Subject: media: meson: vdec: Fix memory leak in error path of vdec_open + +From: Anand Moon + +commit 940f161f734b25f175a95d2684c2021f6323693a upstream. + +The vdec_open() function previously jumped directly to +err_m2m_release when vdec_init_ctrls() failed, skipping +release of the m2m context. This caused a resource leak. + +Fix it by introducing a proper err_m2m_ctx_release label +that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before +releasing the m2m device. + +This was identified via kmemleak: +unreferenced object 0xffff0000205d6878 (size 8): + comm "v4l_id", pid 5289, jiffies 4294938580 + hex dump (first 8 bytes): + 40 d2 49 18 00 00 ff ff @.I..... + backtrace (crc d3204599): + kmemleak_alloc+0xc8/0xf0 + __kvmalloc_node_noprof+0x60c/0x850 + v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev] + vdec_open+0x1f4/0x788 [meson_vdec] + v4l2_open+0x144/0x460 [videodev] + chrdev_open+0x1ac/0x500 + do_dentry_open+0x3f0/0xfe8 + vfs_open+0x68/0x320 + do_open+0x2d8/0x9a8 + path_openat+0x1d0/0x4f0 + do_filp_open+0x190/0x380 + do_sys_openat2+0xf8/0x1b0 + __arm64_sys_openat+0x13c/0x1e8 + invoke_syscall+0xdc/0x268 + el0_svc_common.constprop.0+0x178/0x258 + do_el0_svc+0x4c/0x70 + +Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") +Cc: stable@vger.kernel.org +Signed-off-by: Anand Moon +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/meson/vdec/vdec.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/media/meson/vdec/vdec.c ++++ b/drivers/staging/media/meson/vdec/vdec.c +@@ -889,7 +889,7 @@ static int vdec_open(struct file *file) + + ret = vdec_init_ctrls(sess); + if (ret) +- goto err_m2m_release; ++ goto err_m2m_ctx_release; + + sess->pixfmt_cap = formats[0].pixfmts_cap[0]; + sess->fmt_out = &formats[0]; +@@ -913,6 +913,8 @@ static int vdec_open(struct file *file) + + return 0; + ++err_m2m_ctx_release: ++ v4l2_m2m_ctx_release(sess->m2m_ctx); + err_m2m_release: + v4l2_m2m_release(sess->m2m_dev); + err_free_sess: diff --git a/queue-6.18/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch b/queue-6.18/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch new file mode 100644 index 0000000000..c0d25c6b33 --- /dev/null +++ b/queue-6.18/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch @@ -0,0 +1,128 @@ +From 7201c17786a498497bca57752883b90914d405ac Mon Sep 17 00:00:00 2001 +From: Valery Borovsky +Date: Mon, 11 May 2026 20:12:07 +0300 +Subject: media: msi2500: Return queued buffers on start_streaming() failure + +From: Valery Borovsky + +commit 7201c17786a498497bca57752883b90914d405ac upstream. + +The vb2 framework hands buffers to the driver via buf_queue() before +calling start_streaming(). If start_streaming() returns an error +without first returning those buffers via vb2_buffer_done(), +vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued +buffers leak. + +msi2500_start_streaming() had five error paths that all hit this trap +and were further tangled by ret-overwriting between calls: + + - -ENODEV when the USB device was already disconnected + - -ERESTARTSYS when mutex_lock_interruptible() was interrupted + - msi2500_set_usb_adc() failure: ret was silently overwritten by + the next call (msi2500_isoc_init), so the error was lost entirely + - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but + the function then fell through to msi2500_ctrl_msg() and again + masked the original error by overwriting ret + - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all, + leaving isoc URBs submitted with no way for the driver to consume + them + +Consolidate the error paths into a small goto chain. Every failure +now stops the function, drains the queued-buffer list, and returns +the real error code. The ctrl_msg failure path also rolls back the +preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before +unlocking and draining. + +The cleanup helper takes a vb2_buffer_state argument so that the +start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as +expected by userspace on start_streaming failure) while stop_streaming +keeps its existing VB2_BUF_STATE_ERROR semantics. + +This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: +Return queued buffers on start_streaming() failure"). + +Fixes: 977e444f59ad ("[media] Mirics MSi3101 SDR Dongle driver") +Cc: stable@vger.kernel.org +Signed-off-by: Valery Borovsky +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/msi2500/msi2500.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/media/usb/msi2500/msi2500.c ++++ b/drivers/media/usb/msi2500/msi2500.c +@@ -541,7 +541,8 @@ static int msi2500_isoc_init(struct msi2 + } + + /* Must be called with vb_queue_lock hold */ +-static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev) ++static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev, ++ enum vb2_buffer_state state) + { + unsigned long flags; + +@@ -554,7 +555,7 @@ static void msi2500_cleanup_queued_bufs( + buf = list_entry(dev->queued_bufs.next, + struct msi2500_frame_buf, list); + list_del(&buf->list); +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, state); + } + spin_unlock_irqrestore(&dev->queued_bufs_lock, flags); + } +@@ -830,25 +831,40 @@ static int msi2500_start_streaming(struc + + dev_dbg(dev->dev, "\n"); + +- if (!dev->udev) +- return -ENODEV; ++ if (!dev->udev) { ++ ret = -ENODEV; ++ goto err_cleanup; ++ } + +- if (mutex_lock_interruptible(&dev->v4l2_lock)) +- return -ERESTARTSYS; ++ if (mutex_lock_interruptible(&dev->v4l2_lock)) { ++ ret = -ERESTARTSYS; ++ goto err_cleanup; ++ } + + /* wake-up tuner */ + v4l2_subdev_call(dev->v4l2_subdev, core, s_power, 1); + + ret = msi2500_set_usb_adc(dev); ++ if (ret) ++ goto err_unlock_cleanup; + + ret = msi2500_isoc_init(dev); + if (ret) +- msi2500_cleanup_queued_bufs(dev); ++ goto err_unlock_cleanup; + + ret = msi2500_ctrl_msg(dev, CMD_START_STREAMING, 0); ++ if (ret) ++ goto err_isoc_cleanup; + + mutex_unlock(&dev->v4l2_lock); ++ return 0; + ++err_isoc_cleanup: ++ msi2500_isoc_cleanup(dev); ++err_unlock_cleanup: ++ mutex_unlock(&dev->v4l2_lock); ++err_cleanup: ++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED); + return ret; + } + +@@ -863,7 +879,7 @@ static void msi2500_stop_streaming(struc + if (dev->udev) + msi2500_isoc_cleanup(dev); + +- msi2500_cleanup_queued_bufs(dev); ++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_ERROR); + + /* according to tests, at least 700us delay is required */ + msleep(20); diff --git a/queue-6.18/media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch b/queue-6.18/media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch new file mode 100644 index 0000000000..0e503daf14 --- /dev/null +++ b/queue-6.18/media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch @@ -0,0 +1,48 @@ +From 60ca00792bce46ec170c7ed101f376186d4cf8a9 Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 28 Mar 2026 18:17:49 +0000 +Subject: media: nuvoton: npcm-video: fix error handling in npcm_video_init() + +From: David Carlier + +commit 60ca00792bce46ec170c7ed101f376186d4cf8a9 upstream. + +npcm_video_init() has two error handling issues after +of_reserved_mem_device_init() is called: + +When dma_set_mask_and_coherent() fails, the function releases the +reserved memory but does not return, allowing execution to fall through +into npcm_video_ece_init() with a failed DMA configuration. + +When npcm_video_ece_init() fails, the function returns an error without +calling of_reserved_mem_device_release(), leaking the reserved memory +association. + +Fix both by adding the missing return after the DMA mask failure and +adding the missing of_reserved_mem_device_release() call on the ECE init +error path. + +Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nuvoton/npcm-video.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/platform/nuvoton/npcm-video.c ++++ b/drivers/media/platform/nuvoton/npcm-video.c +@@ -1720,10 +1720,12 @@ static int npcm_video_init(struct npcm_v + if (rc) { + dev_err(dev, "Failed to set DMA mask\n"); + of_reserved_mem_device_release(dev); ++ return rc; + } + + rc = npcm_video_ece_init(video); + if (rc) { ++ of_reserved_mem_device_release(dev); + dev_err(dev, "Failed to initialize ECE\n"); + return rc; + } diff --git a/queue-6.18/media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch b/queue-6.18/media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch new file mode 100644 index 0000000000..327cc74f0b --- /dev/null +++ b/queue-6.18/media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch @@ -0,0 +1,107 @@ +From 50cc0e547da50b887e63dfa1ad203cd5b735d01e Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 28 Mar 2026 18:18:09 +0000 +Subject: media: nuvoton: npcm-video: fix memory leaks in probe and remove + +From: David Carlier + +commit 50cc0e547da50b887e63dfa1ad203cd5b735d01e upstream. + +npcm_video_probe() allocates the npcm_video structure with kzalloc_obj() +but never frees it on any probe error path or in npcm_video_remove(), +leaking the allocation on every failed probe and every normal unbind. + +Additionally, when npcm_video_setup_video() fails, the reserved memory +association established by of_reserved_mem_device_init() in +npcm_video_init() is not released, leaking the rmem_assigned_device +entry on the global list. + +Fix both by adding kfree(video) to all probe error paths and to +npcm_video_remove(), and adding the missing +of_reserved_mem_device_release() call when npcm_video_setup_video() +fails. + +Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nuvoton/npcm-video.c | 32 ++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 9 deletions(-) + +--- a/drivers/media/platform/nuvoton/npcm-video.c ++++ b/drivers/media/platform/nuvoton/npcm-video.c +@@ -1750,42 +1750,55 @@ static int npcm_video_probe(struct platf + regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(regs)) { + dev_err(&pdev->dev, "Failed to parse VCD reg in DTS\n"); +- return PTR_ERR(regs); ++ rc = PTR_ERR(regs); ++ goto err_free; + } + + video->vcd_regmap = devm_regmap_init_mmio(&pdev->dev, regs, + &npcm_video_regmap_cfg); + if (IS_ERR(video->vcd_regmap)) { + dev_err(&pdev->dev, "Failed to initialize VCD regmap\n"); +- return PTR_ERR(video->vcd_regmap); ++ rc = PTR_ERR(video->vcd_regmap); ++ goto err_free; + } + + video->reset = devm_reset_control_get(&pdev->dev, NULL); + if (IS_ERR(video->reset)) { + dev_err(&pdev->dev, "Failed to get VCD reset control in DTS\n"); +- return PTR_ERR(video->reset); ++ rc = PTR_ERR(video->reset); ++ goto err_free; + } + + video->gcr_regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, + "nuvoton,sysgcr"); +- if (IS_ERR(video->gcr_regmap)) +- return PTR_ERR(video->gcr_regmap); ++ if (IS_ERR(video->gcr_regmap)) { ++ rc = PTR_ERR(video->gcr_regmap); ++ goto err_free; ++ } + + video->gfx_regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, + "nuvoton,sysgfxi"); +- if (IS_ERR(video->gfx_regmap)) +- return PTR_ERR(video->gfx_regmap); ++ if (IS_ERR(video->gfx_regmap)) { ++ rc = PTR_ERR(video->gfx_regmap); ++ goto err_free; ++ } + + rc = npcm_video_init(video); + if (rc) +- return rc; ++ goto err_free; + + rc = npcm_video_setup_video(video); + if (rc) +- return rc; ++ goto err_release_mem; + + dev_info(video->dev, "NPCM video driver probed\n"); + return 0; ++ ++err_release_mem: ++ of_reserved_mem_device_release(&pdev->dev); ++err_free: ++ kfree(video); ++ return rc; + } + + static void npcm_video_remove(struct platform_device *pdev) +@@ -1800,6 +1813,7 @@ static void npcm_video_remove(struct pla + v4l2_device_unregister(v4l2_dev); + if (video->ece.enable) + npcm_video_ece_stop(video); ++ kfree(video); + of_reserved_mem_device_release(dev); + } + diff --git a/queue-6.18/media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch b/queue-6.18/media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch new file mode 100644 index 0000000000..b717dee153 --- /dev/null +++ b/queue-6.18/media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch @@ -0,0 +1,61 @@ +From 567418eedd25b3d86d489807682030b4b98b73d9 Mon Sep 17 00:00:00 2001 +From: Xiaolei Wang +Date: Thu, 7 May 2026 12:13:16 +0800 +Subject: media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe + +From: Xiaolei Wang + +commit 567418eedd25b3d86d489807682030b4b98b73d9 upstream. + +Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call +v4l2_subdev_init_finalize() which allocates the subdev active state, +but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup() +calls v4l2_subdev_cleanup() to free it. + +This causes a memory leak on every rmmod, reported by kmemleak: + + unreferenced object 0xffff0000d06fc800 (size 192): + comm "(udev-worker)", pid 254, jiffies 4294913455 + backtrace (crc 36eeae58): + kmemleak_alloc+0x34/0x40 + __kvmalloc_node_noprof+0x5f8/0x7d8 + __v4l2_subdev_state_alloc+0x1fc/0x30c + __v4l2_subdev_init_finalize+0x178/0x368 + +Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup() +in both crossbar and pipe cleanup paths. + +Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") +Cc: stable@vger.kernel.org +Signed-off-by: Xiaolei Wang +Reviewed-by: Frank Li +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260507041318.491594-3-xiaolei.wang@windriver.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + + drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c +@@ -492,6 +492,7 @@ err_free: + + void mxc_isi_crossbar_cleanup(struct mxc_isi_crossbar *xbar) + { ++ v4l2_subdev_cleanup(&xbar->sd); + media_entity_cleanup(&xbar->sd.entity); + kfree(xbar->pads); + kfree(xbar->inputs); +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c +@@ -819,6 +819,7 @@ void mxc_isi_pipe_cleanup(struct mxc_isi + { + struct v4l2_subdev *sd = &pipe->sd; + ++ v4l2_subdev_cleanup(sd); + media_entity_cleanup(&sd->entity); + mutex_destroy(&pipe->lock); + } diff --git a/queue-6.18/series b/queue-6.18/series index 66902fb5b2..2db668e163 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -391,3 +391,32 @@ drm-amd-display-consolidate-dcn-vblank-flip-handling-onto-vupdate_no_lock.patch drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch drm-amd-display-force-pwm-backlight-on-lenovo-legion-5-15arh05.patch drm-amd-display-fix-backlight-max_brightness-to-match-exported-range.patch +drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch +drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch +drm-amd-display-fix-flip-done-timeouts-on-mode1-reset.patch +drm-vc4-shut-down-bo-cache-timer-before-teardown.patch +drm-amd-display-fix-missing-dce-check-in-dm_gpureset_toggle_interrupts.patch +drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch +drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch +drm-gpusvm-fix-mm-reference-leak-in-drm_gpusvm_range_evict.patch +drm-v3d-reach-the-gmp-through-the-hub-registers-on-v3d-7.x.patch +media-airspy-return-queued-buffers-on-start_streaming-failure.patch +media-amlogic-c3-add-validations-for-ae-and-awb-config.patch +media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch +media-cec-seco-unregister-adapter-on-ir-probe-failure.patch +media-cedrus-clean-up-media-device-on-probe-failure.patch +media-cedrus-fix-missing-cleanup-in-error-path.patch +media-cedrus-skip-invalid-h.264-reference-list-entries.patch +media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch +media-cx231xx-fix-devres-lifetime.patch +media-cx23885-add-ioremap-return-check-and-cleanup.patch +media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch +media-imx219-fix-maximum-frame-length-in-lines.patch +media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch +media-iris-fix-use-irqf_no_autoen-when-requesting-the-irq.patch +media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch +media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch +media-msi2500-return-queued-buffers-on-start_streaming-failure.patch +media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch +media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch +media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch