From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:55:43 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.1.179~36 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=8596f3c8901e9badd9c5082fb28069d3714d7aea;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch media-airspy-return-queued-buffers-on-start_streaming-failure.patch media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch media-cec-seco-unregister-adapter-on-ir-probe-failure.patch media-cedrus-clean-up-media-device-on-probe-failure.patch media-cedrus-fix-missing-cleanup-in-error-path.patch media-cedrus-skip-invalid-h.264-reference-list-entries.patch media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch media-cx231xx-fix-devres-lifetime.patch media-cx23885-add-ioremap-return-check-and-cleanup.patch media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch media-msi2500-return-queued-buffers-on-start_streaming-failure.patch media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch --- diff --git a/queue-6.12/drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch b/queue-6.12/drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch new file mode 100644 index 0000000000..c0e60bb52a --- /dev/null +++ b/queue-6.12/drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch @@ -0,0 +1,47 @@ +From 0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Wed, 8 Jul 2026 22:15:20 -0500 +Subject: drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge + +From: Mario Limonciello + +commit 0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2 upstream. + +AMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs have +PCI controllers that don't support PCIe dynamic speed switching, +causing system freezes during GPU initialization when enabled. + +Disable dynamic speed switching when this CPU is detected. + +Assisted-by: Claude:sonnet +Fixes: 466a7d115326 ("drm/amd: Use the first non-dGPU PCI device for BW limits") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5436 +Reviewed-by: Lijo Lazar +Link: https://patch.msgid.link/20260709031520.841611-1-mario.limonciello@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 9ceb4e034a327a04155f32f1cd1a5031dfa5fe02) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -1757,6 +1757,15 @@ static bool amdgpu_device_pcie_dynamic_s + + if (c->x86_vendor == X86_VENDOR_INTEL) + return false; ++ ++ /* ++ * AMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs don't ++ * support PCIe dynamic speed switching. ++ * https://gitlab.freedesktop.org/drm/amd/-/work_items/5436 ++ */ ++ if (c->x86_vendor == X86_VENDOR_AMD && c->x86 == 0x17 && ++ c->x86_model == 0x08) ++ return false; + #endif + return true; + } diff --git a/queue-6.12/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch b/queue-6.12/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch new file mode 100644 index 0000000000..91740fce8e --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch @@ -0,0 +1,70 @@ +From a2f895f3c852063258d62e9f74b081de07ca95df Mon Sep 17 00:00:00 2001 +From: Zhu Lingshan +Date: Wed, 1 Jul 2026 18:53:21 +0800 +Subject: drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhu Lingshan + +commit a2f895f3c852063258d62e9f74b081de07ca95df upstream. + +amdgpu_bo_create_reserved() only allocates a new BO when +*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is +NULL, it simply skips creation when *bo_ptr is non-NULL. +But it unconditionally reserves, pins, gart allocates +and maps the BO afterwards. + +When the same non-NULL BO pointer is passed in again, +for example firmware buffers that live in adev and are +re-loaded on every resume / cp_resume / start +under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases +pin_count unconditionally, however the matching teardown only unpins +once, so pin_count never drops to zero, so TTM is not able +to move, swap or evict a BO, causing BO leaks. + +This commit fixes this issue by only pinning the bo +once at creation, and repeated calls no longer +take additional pin references. + +Signed-off-by: Zhu Lingshan +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -273,10 +273,12 @@ int amdgpu_bo_create_reserved(struct amd + goto error_free; + } + +- r = amdgpu_bo_pin(*bo_ptr, domain); +- if (r) { +- dev_err(adev->dev, "(%d) kernel bo pin failed\n", r); +- goto error_unreserve; ++ if (free) { ++ r = amdgpu_bo_pin(*bo_ptr, domain); ++ if (r) { ++ dev_err(adev->dev, "(%d) kernel bo pin failed\n", r); ++ goto error_unreserve; ++ } + } + + r = amdgpu_ttm_alloc_gart(&(*bo_ptr)->tbo); +@@ -299,7 +301,8 @@ int amdgpu_bo_create_reserved(struct amd + return 0; + + error_unpin: +- amdgpu_bo_unpin(*bo_ptr); ++ if (free) ++ amdgpu_bo_unpin(*bo_ptr); + error_unreserve: + amdgpu_bo_unreserve(*bo_ptr); + diff --git a/queue-6.12/drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch b/queue-6.12/drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch new file mode 100644 index 0000000000..cb55a2160f --- /dev/null +++ b/queue-6.12/drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch @@ -0,0 +1,56 @@ +From 0c9e6367639548307d3f578f6943ce72c9d39087 Mon Sep 17 00:00:00 2001 +From: Linmao Li +Date: Tue, 21 Jul 2026 09:15:58 +0800 +Subject: drm/vc4: Prevent shader BO mappings from becoming writable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linmao Li + +commit 0c9e6367639548307d3f578f6943ce72c9d39087 upstream. + +vc4_gem_object_mmap() rejects a writable mapping of a validated shader +BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and +then turn it writable with mprotect(). + +Validated shader BOs must stay read-only: the validator checks the +instructions once and the GPU trusts them afterwards. A writable +mapping lets userspace rewrite the code after validation, bypassing the +validator. + +Clear VM_MAYWRITE on the read-only path so the mapping cannot be +upgraded, as i915 already does for its read-only objects. + +Fixes: 463873d57014 ("drm/vc4: Add an API for creating GPU shaders in GEM BOs.") +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Closes: https://lore.kernel.org/dri-devel/20260720085554.B0AF01F000E9@smtp.kernel.org/ +Signed-off-by: Linmao Li +Link: https://patch.msgid.link/20260721011558.1672477-1-lilinmao@kylinos.cn +Reviewed-by: Maíra Canal +Signed-off-by: Maíra Canal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_bo.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -733,9 +733,13 @@ static int vc4_gem_object_mmap(struct dr + { + struct vc4_bo *bo = to_vc4_bo(obj); + +- if (bo->validated_shader && (vma->vm_flags & VM_WRITE)) { +- DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n"); +- return -EINVAL; ++ if (bo->validated_shader) { ++ if (vma->vm_flags & VM_WRITE) { ++ DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n"); ++ return -EINVAL; ++ } ++ ++ vm_flags_clear(vma, VM_MAYWRITE); + } + + mutex_lock(&bo->madv_lock); diff --git a/queue-6.12/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch b/queue-6.12/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch new file mode 100644 index 0000000000..267438d859 --- /dev/null +++ b/queue-6.12/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch @@ -0,0 +1,69 @@ +From a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 Mon Sep 17 00:00:00 2001 +From: Ian Forbes +Date: Tue, 23 Jun 2026 14:33:14 -0500 +Subject: drm/vmwgfx: Validate vmw_surface_metadata::array_size + +From: Ian Forbes + +commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream. + +This field comes from userspace and should be validated against specific +limits depending on which Shader Model (SM) is available. + +Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata") +Reported-by: Zero Day Initiative +Cc: stable@vger.kernel.org +Signed-off-by: Ian Forbes +Reviewed-by: Maaz Mombasawala +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +@@ -96,7 +96,7 @@ static int vmw_gb_surface_unbind(struct + static int vmw_gb_surface_destroy(struct vmw_resource *res); + static int + vmw_gb_surface_define_internal(struct drm_device *dev, +- struct drm_vmw_gb_surface_create_ext_req *req, ++ const struct drm_vmw_gb_surface_create_ext_req *req, + struct drm_vmw_gb_surface_create_rep *rep, + struct drm_file *file_priv); + static int +@@ -1538,7 +1538,7 @@ int vmw_gb_surface_reference_ext_ioctl(s + */ + static int + vmw_gb_surface_define_internal(struct drm_device *dev, +- struct drm_vmw_gb_surface_create_ext_req *req, ++ const struct drm_vmw_gb_surface_create_ext_req *req, + struct drm_vmw_gb_surface_create_rep *rep, + struct drm_file *file_priv) + { +@@ -1556,9 +1556,21 @@ vmw_gb_surface_define_internal(struct dr + req->base.svga3d_flags); + + /* array_size must be null for non-GL3 host. */ +- if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) { +- VMW_DEBUG_USER("SM4 surface not supported.\n"); +- return -EINVAL; ++ if (req->base.array_size > 0) { ++ if (has_sm5_context(dev_priv)) { ++ if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) { ++ VMW_DEBUG_USER("Invalid Surface Array Size.\n"); ++ return -EINVAL; ++ } ++ } else if (has_sm4_context(dev_priv)) { ++ if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) { ++ VMW_DEBUG_USER("Invalid Surface Array Size.\n"); ++ return -EINVAL; ++ } ++ } else { ++ VMW_DEBUG_USER("SM4+ surface not supported.\n"); ++ return -EINVAL; ++ } + } + + if (!has_sm4_1_context(dev_priv)) { diff --git a/queue-6.12/media-airspy-return-queued-buffers-on-start_streaming-failure.patch b/queue-6.12/media-airspy-return-queued-buffers-on-start_streaming-failure.patch new file mode 100644 index 0000000000..af38a3125e --- /dev/null +++ b/queue-6.12/media-airspy-return-queued-buffers-on-start_streaming-failure.patch @@ -0,0 +1,52 @@ +From 04344d0b4929caa94c0df72f767752aa0935ef5d Mon Sep 17 00:00:00 2001 +From: Valery Borovsky +Date: Mon, 11 May 2026 20:12:06 +0300 +Subject: media: airspy: Return queued buffers on start_streaming() failure + +From: Valery Borovsky + +commit 04344d0b4929caa94c0df72f767752aa0935ef5d upstream. + +The vb2 framework hands buffers to the driver via buf_queue() before +calling start_streaming(). If start_streaming() returns an error +without first returning those buffers via vb2_buffer_done(), +vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued +buffers leak. + +airspy_start_streaming() returned -ENODEV early when the USB device had +been disconnected (s->udev == NULL) without returning any buffers that +buf_queue() had already accepted. Take v4l2_lock first and jump to the +existing err_clear_bit label, which already drains s->queued_bufs via +vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. + +This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: +Return queued buffers on start_streaming() failure"). + +Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver") +Cc: stable@vger.kernel.org +Signed-off-by: Valery Borovsky +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/airspy/airspy.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/airspy/airspy.c ++++ b/drivers/media/usb/airspy/airspy.c +@@ -522,11 +522,13 @@ static int airspy_start_streaming(struct + + dev_dbg(s->dev, "\n"); + +- if (!s->udev) +- return -ENODEV; +- + mutex_lock(&s->v4l2_lock); + ++ if (!s->udev) { ++ ret = -ENODEV; ++ goto err_clear_bit; ++ } ++ + s->sequence = 0; + + set_bit(POWER_ON, &s->flags); diff --git a/queue-6.12/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch b/queue-6.12/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch new file mode 100644 index 0000000000..fcfc10acd3 --- /dev/null +++ b/queue-6.12/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch @@ -0,0 +1,41 @@ +From 253c8ef7d57da0c74db251f385324faaa5ae2257 Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 28 Mar 2026 11:23:30 +0000 +Subject: media: aspeed: fix missing of_reserved_mem_device_release() on probe failure + +From: David Carlier + +commit 253c8ef7d57da0c74db251f385324faaa5ae2257 upstream. + +aspeed_video_init() calls of_reserved_mem_device_init() to associate +reserved memory regions with the device. When aspeed_video_setup_video() +subsequently fails in aspeed_video_probe(), the error path frees the +JPEG buffer and unprepares the clocks but does not release the reserved +memory association, leaking the rmem_assigned_device entry on the global +list. + +The normal remove path already calls of_reserved_mem_device_release() +correctly; only the probe error path was missing it. + +Add the missing of_reserved_mem_device_release() call to the +aspeed_video_setup_video() failure cleanup. + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/aspeed/aspeed-video.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/aspeed/aspeed-video.c ++++ b/drivers/media/platform/aspeed/aspeed-video.c +@@ -2186,6 +2186,7 @@ static int aspeed_video_probe(struct pla + rc = aspeed_video_setup_video(video); + if (rc) { + aspeed_video_free_buf(video, &video->jpeg); ++ of_reserved_mem_device_release(&pdev->dev); + clk_unprepare(video->vclk); + clk_unprepare(video->eclk); + return rc; diff --git a/queue-6.12/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch b/queue-6.12/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch new file mode 100644 index 0000000000..c19726177d --- /dev/null +++ b/queue-6.12/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch @@ -0,0 +1,49 @@ +From c3a78691be8245e52ced489f268e413f18061ac2 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Fri, 24 Apr 2026 23:36:01 +0900 +Subject: media: cec: seco: unregister adapter on IR probe failure + +From: Myeonghun Pak + +commit c3a78691be8245e52ced489f268e413f18061ac2 upstream. + +If secocec_ir_probe() fails after cec_register_adapter() succeeds, +probe returns an error and the driver remove callback is not called. +The current unwind path unregisters the notifier and then falls through +to cec_delete_adapter(), which violates the CEC adapter lifetime rules +after a successful registration. + +Add a registered-adapter unwind path that unregisters the notifier and +the adapter instead. + +Fixes: daef95769b3a ("media: seco-cec: add Consumer-IR support") +Cc: stable@vger.kernel.org +Signed-off-by: Myeonghun Pak +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/cec/platform/seco/seco-cec.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/media/cec/platform/seco/seco-cec.c ++++ b/drivers/media/cec/platform/seco/seco-cec.c +@@ -649,7 +649,7 @@ static int secocec_probe(struct platform + + ret = secocec_ir_probe(secocec); + if (ret) +- goto err_notifier; ++ goto err_unregister_adapter; + + platform_set_drvdata(pdev, secocec); + +@@ -657,6 +657,10 @@ static int secocec_probe(struct platform + + return ret; + ++err_unregister_adapter: ++ cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap); ++ cec_unregister_adapter(secocec->cec_adap); ++ goto err; + err_notifier: + cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap); + err_delete_adapter: diff --git a/queue-6.12/media-cedrus-clean-up-media-device-on-probe-failure.patch b/queue-6.12/media-cedrus-clean-up-media-device-on-probe-failure.patch new file mode 100644 index 0000000000..c8eb5e6e04 --- /dev/null +++ b/queue-6.12/media-cedrus-clean-up-media-device-on-probe-failure.patch @@ -0,0 +1,51 @@ +From 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Wed, 6 May 2026 21:41:16 +0900 +Subject: media: cedrus: clean up media device on probe failure + +From: Myeonghun Pak + +commit 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 upstream. + +cedrus_probe() initializes the media device before registering the video +device, the media controller, and the media device. If any of those later +steps fails, probe returns without calling media_device_cleanup(), so the +media device internals initialized by media_device_init() are left behind. + +Add a media-device cleanup label to the probe unwind path and route video +registration failures through it as well. + +Fixes: 50e761516f2b8c ("media: platform: Add Cedrus VPU decoder driver") +Cc: stable@vger.kernel.org +Reviewed-by: Paul Kocialkowski +Co-developed-by: Ijae Kim +Signed-off-by: Ijae Kim +Signed-off-by: Myeonghun Pak +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -509,7 +509,7 @@ static int cedrus_probe(struct platform_ + ret = video_register_device(vfd, VFL_TYPE_VIDEO, 0); + if (ret) { + v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); +- goto err_m2m; ++ goto err_media; + } + + v4l2_info(&dev->v4l2_dev, +@@ -535,7 +535,8 @@ err_m2m_mc: + v4l2_m2m_unregister_media_controller(dev->m2m_dev); + err_video: + video_unregister_device(&dev->vfd); +-err_m2m: ++err_media: ++ media_device_cleanup(&dev->mdev); + v4l2_m2m_release(dev->m2m_dev); + err_v4l2: + v4l2_device_unregister(&dev->v4l2_dev); diff --git a/queue-6.12/media-cedrus-fix-missing-cleanup-in-error-path.patch b/queue-6.12/media-cedrus-fix-missing-cleanup-in-error-path.patch new file mode 100644 index 0000000000..1c7488bc80 --- /dev/null +++ b/queue-6.12/media-cedrus-fix-missing-cleanup-in-error-path.patch @@ -0,0 +1,39 @@ +From d99732334aaf33b9f93926b70b6a11c2cef3de39 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Tue, 7 Apr 2026 01:14:02 +0300 +Subject: media: cedrus: Fix missing cleanup in error path + +From: Samuel Holland + +commit d99732334aaf33b9f93926b70b6a11c2cef3de39 upstream. + +According to the documentation struct v4l2_fh has to be cleaned up with +v4l2_fh_exit() before being freed. [1] +Currently there is no actual bug here, when v4l2_fh_exit() isn't called. +v4l2_fh_exit() in this case only destroys internal mutex. But it may +change in the future, when v4l2_fh_init/v4l2_fh_exit will be enhanced. + +1. https://docs.kernel.org/driver-api/media/v4l2-fh.html + +Signed-off-by: Samuel Holland +Signed-off-by: Andrey Skvortsov +Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver") +Cc: stable@vger.kernel.org +Acked-by: Paul Kocialkowski +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -392,6 +392,7 @@ static int cedrus_open(struct file *file + err_m2m_release: + v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + err_free: ++ v4l2_fh_exit(&ctx->fh); + kfree(ctx); + mutex_unlock(&dev->dev_mutex); + diff --git a/queue-6.12/media-cedrus-skip-invalid-h.264-reference-list-entries.patch b/queue-6.12/media-cedrus-skip-invalid-h.264-reference-list-entries.patch new file mode 100644 index 0000000000..4a7020d42d --- /dev/null +++ b/queue-6.12/media-cedrus-skip-invalid-h.264-reference-list-entries.patch @@ -0,0 +1,47 @@ +From 10358ea986c3c85516d1c8206486464f79d36e76 Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Tue, 24 Mar 2026 16:08:56 +0800 +Subject: media: cedrus: skip invalid H.264 reference list entries + +From: Pengpeng Hou + +commit 10358ea986c3c85516d1c8206486464f79d36e76 upstream. + +Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the +stateless slice control and later uses their indices to look up +decode->dpb[] in _cedrus_write_ref_list(). + +Rejecting such controls in cedrus_try_ctrl() would break existing +userspace, since stateless H.264 reference lists may legitimately carry +out-of-range indices for missing references. Instead, guard the actual +DPB lookup in Cedrus and skip entries whose indices do not fit the fixed +V4L2_H264_NUM_DPB_ENTRIES array. + +This keeps the fix local to the driver use site and avoids out-of-bounds +reads from malformed or unsupported reference list entries. + +Fixes: e000e1fa4bdbd ("media: uapi: h264: Update reference lists") +Cc: stable@vger.kernel.org +Signed-off-by: Pengpeng Hou +Reviewed-by: Nicolas Dufresne +Acked-by: Jernej Skrabec +Tested-by: Chen-Yu Tsai +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +@@ -210,6 +210,9 @@ static void _cedrus_write_ref_list(struc + u8 dpb_idx; + + dpb_idx = ref_list[i].index; ++ if (dpb_idx >= V4L2_H264_NUM_DPB_ENTRIES) ++ continue; ++ + dpb = &decode->dpb[dpb_idx]; + + if (!(dpb->flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE)) diff --git a/queue-6.12/media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch b/queue-6.12/media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch new file mode 100644 index 0000000000..88db577c8d --- /dev/null +++ b/queue-6.12/media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch @@ -0,0 +1,81 @@ +From b20157147089a9c16a38c7810e2fe6f2df8e3277 Mon Sep 17 00:00:00 2001 +From: Brandon Brnich +Date: Fri, 20 Mar 2026 13:05:26 -0500 +Subject: media: chips-media: wave5: Move src_buf Removal to finish_encode + +From: Brandon Brnich + +commit b20157147089a9c16a38c7810e2fe6f2df8e3277 upstream. + +During encoder processing, there is a case where the IRQ response could +return the buffer back to userspace via v4l2_m2m_buf_done call. In this +time, userspace could queue up this same buffer before start_encode removes +the index from the ready queue. This would then lead to a case where the +buffer in the ready queue could be a self loop due to the +WRITE_ONCE(prev->next, new) call in __list_add. + +When __list_del is finally called, the loop is already made so nothing +points back to ready queue list head and pointers are poisoned. + +A buffer should not be marked as DONE before the buffer is removed from +m2m ready queue. Move removal entirely to finish_encode. + +Fixes: 9707a6254a8a6 ("media: chips-media: wave5: Add the v4l2 layer") +Cc: stable@vger.kernel.org +Signed-off-by: Brandon Brnich +Tested-by: Jackson Lee +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 29 ++------------- + 1 file changed, 4 insertions(+), 25 deletions(-) + +--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c ++++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +@@ -233,13 +233,6 @@ static int start_encode(struct vpu_insta + } else { + dev_dbg(inst->dev->dev, "%s: wave5_vpu_enc_start_one_frame success\n", + __func__); +- /* +- * Remove the source buffer from the ready-queue now and finish +- * it in the videobuf2 framework once the index is returned by the +- * firmware in finish_encode +- */ +- if (src_buf) +- v4l2_m2m_src_buf_remove_by_idx(m2m_ctx, src_buf->vb2_buf.index); + } + + return 0; +@@ -266,27 +259,13 @@ static void wave5_vpu_enc_finish_encode( + __func__, enc_output_info.pic_type, enc_output_info.recon_frame_index, + enc_output_info.enc_src_idx, enc_output_info.enc_pic_byte, enc_output_info.pts); + +- /* +- * The source buffer will not be found in the ready-queue as it has been +- * dropped after sending of the encode firmware command, locate it in +- * the videobuf2 queue directly +- */ + if (enc_output_info.enc_src_idx >= 0) { +- struct vb2_buffer *vb = vb2_get_buffer(v4l2_m2m_get_src_vq(m2m_ctx), +- enc_output_info.enc_src_idx); +- if (vb->state != VB2_BUF_STATE_ACTIVE) +- dev_warn(inst->dev->dev, +- "%s: encoded buffer (%d) was not in ready queue %i.", +- __func__, enc_output_info.enc_src_idx, vb->state); +- else +- src_buf = to_vb2_v4l2_buffer(vb); +- +- if (src_buf) { ++ src_buf = v4l2_m2m_src_buf_remove_by_idx(m2m_ctx, enc_output_info.enc_src_idx); ++ if (!src_buf) { ++ dev_warn(inst->dev->dev, "%s: no source buffer found\n", __func__); ++ } else { + inst->timestamp = src_buf->vb2_buf.timestamp; + v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_DONE); +- } else { +- dev_warn(inst->dev->dev, "%s: no source buffer with index: %d found\n", +- __func__, enc_output_info.enc_src_idx); + } + } + diff --git a/queue-6.12/media-cx231xx-fix-devres-lifetime.patch b/queue-6.12/media-cx231xx-fix-devres-lifetime.patch new file mode 100644 index 0000000000..ec842f1a97 --- /dev/null +++ b/queue-6.12/media-cx231xx-fix-devres-lifetime.patch @@ -0,0 +1,79 @@ +From 7d6358ab02866e5b7ed8d3a00805297617bbb0ec Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 30 Mar 2026 11:37:27 +0200 +Subject: media: cx231xx: fix devres lifetime + +From: Johan Hovold + +commit 7d6358ab02866e5b7ed8d3a00805297617bbb0ec upstream. + +USB drivers bind to USB interfaces and any device managed resources +should have their lifetime tied to the interface rather than parent USB +device. This avoids issues like memory leaks when drivers are unbound +without their devices being physically disconnected (e.g. on probe +deferral or configuration changes). + +Fix the driver state lifetime so that it is released on driver unbind. + +Fixes: 184a82784d50 ("[media] cx231xx: use devm_ functions to allocate memory") +Cc: stable@vger.kernel.org # 3.17 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/media/usb/cx231xx/cx231xx-cards.c ++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c +@@ -1577,7 +1577,8 @@ static int cx231xx_init_v4l2(struct cx23 + dev->video_mode.end_point_addr, + dev->video_mode.num_alt); + +- dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->video_mode.num_alt, GFP_KERNEL); ++ dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->video_mode.num_alt, GFP_KERNEL); + if (dev->video_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1618,7 +1619,8 @@ static int cx231xx_init_v4l2(struct cx23 + dev->vbi_mode.num_alt); + + /* compute alternate max packet sizes for vbi */ +- dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->vbi_mode.num_alt, GFP_KERNEL); ++ dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->vbi_mode.num_alt, GFP_KERNEL); + if (dev->vbi_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1660,7 +1662,9 @@ static int cx231xx_init_v4l2(struct cx23 + "sliced CC EndPoint Addr 0x%x, Alternate settings: %i\n", + dev->sliced_cc_mode.end_point_addr, + dev->sliced_cc_mode.num_alt); +- dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->sliced_cc_mode.num_alt, GFP_KERNEL); ++ dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->sliced_cc_mode.num_alt, ++ GFP_KERNEL); + if (dev->sliced_cc_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1724,7 +1728,7 @@ static int cx231xx_usb_probe(struct usb_ + udev = usb_get_dev(interface_to_usbdev(interface)); + + /* allocate memory for our device state and initialize it */ +- dev = devm_kzalloc(&udev->dev, sizeof(*dev), GFP_KERNEL); ++ dev = devm_kzalloc(&interface->dev, sizeof(*dev), GFP_KERNEL); + if (dev == NULL) { + retval = -ENOMEM; + goto err_if; +@@ -1854,7 +1858,9 @@ static int cx231xx_usb_probe(struct usb_ + dev->ts1_mode.end_point_addr, + dev->ts1_mode.num_alt); + +- dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->ts1_mode.num_alt, GFP_KERNEL); ++ dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->ts1_mode.num_alt, ++ GFP_KERNEL); + if (dev->ts1_mode.alt_max_pkt_size == NULL) { + retval = -ENOMEM; + goto err_video_alt; diff --git a/queue-6.12/media-cx23885-add-ioremap-return-check-and-cleanup.patch b/queue-6.12/media-cx23885-add-ioremap-return-check-and-cleanup.patch new file mode 100644 index 0000000000..93e2d196b3 --- /dev/null +++ b/queue-6.12/media-cx23885-add-ioremap-return-check-and-cleanup.patch @@ -0,0 +1,58 @@ +From a0701e387b46e2481c05b47f1235b954bfc2af3e Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Fri, 20 Mar 2026 15:04:53 +0800 +Subject: media: cx23885: add ioremap return check and cleanup + +From: Wang Jun <1742789905@qq.com> + +commit a0701e387b46e2481c05b47f1235b954bfc2af3e upstream. + +Add a check for the return value of pci_ioremap_bar() +in cx23885_dev_setup(). +If ioremap for BAR0 fails, release the already allocated +PCI memory region, +decrement the device count, and return -ENODEV. + +This prevents a potential null pointer dereference and +ensures proper cleanup +on memory mapping failure. + +Fixes: d19770e5178a ("V4L/DVB (6150): Add CX23885/CX23887 PCIe bridge driver") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/cx23885/cx23885-core.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -990,8 +990,12 @@ static int cx23885_dev_setup(struct cx23 + } + + /* PCIe stuff */ +- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); ++ dev->lmmio = pci_ioremap_bar(dev->pci, 0); ++ if (!dev->lmmio) { ++ dev_err(&dev->pci->dev, "CORE %s: can't ioremap MMIO memory\n", ++ dev->name); ++ goto err_release_region; ++ } + + dev->bmmio = (u8 __iomem *)dev->lmmio; + +@@ -1096,6 +1100,12 @@ static int cx23885_dev_setup(struct cx23 + } + + return 0; ++ ++err_release_region: ++ release_mem_region(pci_resource_start(dev->pci, 0), ++ pci_resource_len(dev->pci, 0)); ++ cx23885_devcount--; ++ return -ENODEV; + } + + static void cx23885_dev_unregister(struct cx23885_dev *dev) diff --git a/queue-6.12/media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch b/queue-6.12/media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch new file mode 100644 index 0000000000..ae9d42ef6a --- /dev/null +++ b/queue-6.12/media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch @@ -0,0 +1,98 @@ +From 4f6f28ff24709710c08557c127b3e4c3fb1b4159 Mon Sep 17 00:00:00 2001 +From: Martin Hecht +Date: Fri, 8 May 2026 11:59:03 +0200 +Subject: media: i2c: alvium: fix critical pointer access in alvium_ctrl_init + +From: Martin Hecht + +commit 4f6f28ff24709710c08557c127b3e4c3fb1b4159 upstream. + +The current implementation of alvium_ctrl_init creates several controls in +function alvium_ctrl_init and uses the returned pointer without check. That +can cause write access over NULL-pointer for several controls. The reworked +code checks the pointers before adding flags. + +Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera") +Cc: stable@vger.kernel.org +Signed-off-by: Martin Hecht +Signed-off-by: Sakari Ailus +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/alvium-csi2.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/media/i2c/alvium-csi2.c ++++ b/drivers/media/i2c/alvium-csi2.c +@@ -2102,20 +2102,21 @@ static int alvium_ctrl_init(struct alviu + V4L2_CID_PIXEL_RATE, 0, + ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1, + ALVIUM_DEFAULT_PIXEL_RATE_MHZ); +- ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY; + + /* Link freq is fixed */ + ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops, + V4L2_CID_LINK_FREQ, + 0, 0, &alvium->link_freq); +- ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY; ++ if (ctrls->link_freq) ++ ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY; + + /* Auto/manual white balance */ + if (alvium->avail_ft.auto_whiteb) { + ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops, + V4L2_CID_AUTO_WHITE_BALANCE, + 0, 1, 1, 1); +- v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false); ++ if (ctrls->auto_wb) ++ v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false); + } + + ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops, +@@ -2124,6 +2125,7 @@ static int alvium_ctrl_init(struct alviu + alvium->max_bbalance, + alvium->inc_bbalance, + alvium->dft_bbalance); ++ + ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops, + V4L2_CID_RED_BALANCE, + alvium->min_rbalance, +@@ -2138,7 +2140,9 @@ static int alvium_ctrl_init(struct alviu + V4L2_CID_EXPOSURE_AUTO, + V4L2_EXPOSURE_MANUAL, 0, + V4L2_EXPOSURE_AUTO); +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true); ++ if (ctrls->auto_exp) ++ v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, ++ V4L2_EXPOSURE_MANUAL, true); + } + + ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, +@@ -2147,14 +2151,16 @@ static int alvium_ctrl_init(struct alviu + alvium->max_exp, + alvium->inc_exp, + alvium->dft_exp); +- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; ++ if (ctrls->exposure) ++ ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE; + + /* Auto/manual gain */ + if (alvium->avail_ft.auto_gain) { + ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, + V4L2_CID_AUTOGAIN, + 0, 1, 1, 1); +- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); ++ if (ctrls->auto_gain) ++ v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true); + } + + if (alvium->avail_ft.gain) { +@@ -2164,7 +2170,8 @@ static int alvium_ctrl_init(struct alviu + alvium->max_gain, + alvium->inc_gain, + alvium->dft_gain); +- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; ++ if (ctrls->gain) ++ ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE; + } + + if (alvium->avail_ft.sat) diff --git a/queue-6.12/media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch b/queue-6.12/media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch new file mode 100644 index 0000000000..cc01fcd198 --- /dev/null +++ b/queue-6.12/media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch @@ -0,0 +1,84 @@ +From 477620dccf3e9481ed6ae67cb5c747f25751c531 Mon Sep 17 00:00:00 2001 +From: Marco Nenciarini +Date: Wed, 1 Apr 2026 18:25:47 +0200 +Subject: media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges + +From: Marco Nenciarini + +commit 477620dccf3e9481ed6ae67cb5c747f25751c531 upstream. + +The get_hsfreq_by_mbps() function searches the freqranges[] table +backward (from highest to lowest index). Because adjacent frequency +bands overlap, a data rate that falls in the overlap region always +lands on the higher-indexed band. + +For data rates up to 1500 Mbps (index 42) every band uses +osc_freq_target 335. Starting at index 43 (1461-1640 Mbps) the +osc_freq_target drops to 208. A sensor running at 1498 Mbps sits in +the overlap between index 42 (1414-1588, osc 335) and index 43 +(1461-1640, osc 208). The backward search picks index 43, programming +the lower osc_freq_target of 208 instead of the optimal 335. + +This causes DDL lock instability and CSI-2 CRC errors on affected +configurations, such as the OmniVision OV08X40 sensor on Intel Arrow +Lake platforms (Dell Pro Max 16). + +Rewrite get_hsfreq_by_mbps() to select the optimal band: + +1. Among bands whose min/max range covers the data rate, prefer + the one with the higher osc_freq_target. +2. If osc_freq_target is equal, prefer the band whose default_mbps + is closest to the requested rate. + +Since the frequency ranges are monotonically increasing, the loop +exits early once min exceeds the requested rate. + +For 1498 Mbps this now correctly selects index 42 (osc_freq_target +335, range 1414-1588) instead of index 43 (osc_freq_target 208, +range 1461-1640). + +Fixes: 1e7eeb301696 ("media: intel/ipu6: add the CSI2 DPHY implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Marco Nenciarini +Signed-off-by: Sakari Ailus +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c | 24 +++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +--- a/drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c ++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c +@@ -288,15 +288,27 @@ static const struct dwc_dphy_freq_range + + static u16 get_hsfreq_by_mbps(u32 mbps) + { +- unsigned int i = DPHY_FREQ_RANGE_NUM; ++ u16 best = DPHY_FREQ_RANGE_INVALID_INDEX; ++ unsigned int i; + +- while (i--) { +- if (freqranges[i].default_mbps == mbps || +- (mbps >= freqranges[i].min && mbps <= freqranges[i].max)) +- return i; ++ for (i = 0; i < DPHY_FREQ_RANGE_NUM; i++) { ++ if (mbps > freqranges[i].max) ++ continue; ++ ++ if (mbps < freqranges[i].min) ++ break; ++ ++ if (best == DPHY_FREQ_RANGE_INVALID_INDEX || ++ freqranges[i].osc_freq_target > ++ freqranges[best].osc_freq_target || ++ (freqranges[i].osc_freq_target == ++ freqranges[best].osc_freq_target && ++ abs((int)mbps - (int)freqranges[i].default_mbps) < ++ abs((int)mbps - (int)freqranges[best].default_mbps))) ++ best = i; + } + +- return DPHY_FREQ_RANGE_INVALID_INDEX; ++ return best; + } + + static int ipu6_isys_dwc_phy_config(struct ipu6_isys *isys, diff --git a/queue-6.12/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch b/queue-6.12/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch new file mode 100644 index 0000000000..b2ea218152 --- /dev/null +++ b/queue-6.12/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch @@ -0,0 +1,38 @@ +From 033ff0420e4c9c240ae5523fff39770298efa964 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Fri, 17 Apr 2026 14:53:30 +0800 +Subject: media: marvell-cam: fix missing pci_disable_device() on remove + +From: Guangshuo Li + +commit 033ff0420e4c9c240ae5523fff39770298efa964 upstream. + +During manual code audit, we found that cafe_pci_probe() enables the +PCI device with pci_enable_device(), and its probe error path properly +calls pci_disable_device() on failure. + +However, cafe_pci_remove() tears down the controller and frees the +driver data without disabling the PCI device, leaving the remove path +inconsistent with probe cleanup. + +Add the missing pci_disable_device() call to cafe_pci_remove(). + +Fixes: abfa3df36c01 ("[media] marvell-cam: Separate out the Marvell camera core") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/marvell/cafe-driver.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/marvell/cafe-driver.c ++++ b/drivers/media/platform/marvell/cafe-driver.c +@@ -609,6 +609,7 @@ static void cafe_pci_remove(struct pci_d + return; + } + cafe_shutdown(cam); ++ pci_disable_device(pdev); + kfree(cam); + } + diff --git a/queue-6.12/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch b/queue-6.12/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch new file mode 100644 index 0000000000..fe50ff2877 --- /dev/null +++ b/queue-6.12/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch @@ -0,0 +1,70 @@ +From 940f161f734b25f175a95d2684c2021f6323693a Mon Sep 17 00:00:00 2001 +From: Anand Moon +Date: Wed, 20 May 2026 10:10:41 +0530 +Subject: media: meson: vdec: Fix memory leak in error path of vdec_open + +From: Anand Moon + +commit 940f161f734b25f175a95d2684c2021f6323693a upstream. + +The vdec_open() function previously jumped directly to +err_m2m_release when vdec_init_ctrls() failed, skipping +release of the m2m context. This caused a resource leak. + +Fix it by introducing a proper err_m2m_ctx_release label +that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before +releasing the m2m device. + +This was identified via kmemleak: +unreferenced object 0xffff0000205d6878 (size 8): + comm "v4l_id", pid 5289, jiffies 4294938580 + hex dump (first 8 bytes): + 40 d2 49 18 00 00 ff ff @.I..... + backtrace (crc d3204599): + kmemleak_alloc+0xc8/0xf0 + __kvmalloc_node_noprof+0x60c/0x850 + v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev] + vdec_open+0x1f4/0x788 [meson_vdec] + v4l2_open+0x144/0x460 [videodev] + chrdev_open+0x1ac/0x500 + do_dentry_open+0x3f0/0xfe8 + vfs_open+0x68/0x320 + do_open+0x2d8/0x9a8 + path_openat+0x1d0/0x4f0 + do_filp_open+0x190/0x380 + do_sys_openat2+0xf8/0x1b0 + __arm64_sys_openat+0x13c/0x1e8 + invoke_syscall+0xdc/0x268 + el0_svc_common.constprop.0+0x178/0x258 + do_el0_svc+0x4c/0x70 + +Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") +Cc: stable@vger.kernel.org +Signed-off-by: Anand Moon +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/meson/vdec/vdec.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/media/meson/vdec/vdec.c ++++ b/drivers/staging/media/meson/vdec/vdec.c +@@ -898,7 +898,7 @@ static int vdec_open(struct file *file) + + ret = vdec_init_ctrls(sess); + if (ret) +- goto err_m2m_release; ++ goto err_m2m_ctx_release; + + sess->pixfmt_cap = formats[0].pixfmts_cap[0]; + sess->fmt_out = &formats[0]; +@@ -923,6 +923,8 @@ static int vdec_open(struct file *file) + + return 0; + ++err_m2m_ctx_release: ++ v4l2_m2m_ctx_release(sess->m2m_ctx); + err_m2m_release: + v4l2_m2m_release(sess->m2m_dev); + err_free_sess: diff --git a/queue-6.12/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch b/queue-6.12/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch new file mode 100644 index 0000000000..c0d25c6b33 --- /dev/null +++ b/queue-6.12/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch @@ -0,0 +1,128 @@ +From 7201c17786a498497bca57752883b90914d405ac Mon Sep 17 00:00:00 2001 +From: Valery Borovsky +Date: Mon, 11 May 2026 20:12:07 +0300 +Subject: media: msi2500: Return queued buffers on start_streaming() failure + +From: Valery Borovsky + +commit 7201c17786a498497bca57752883b90914d405ac upstream. + +The vb2 framework hands buffers to the driver via buf_queue() before +calling start_streaming(). If start_streaming() returns an error +without first returning those buffers via vb2_buffer_done(), +vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued +buffers leak. + +msi2500_start_streaming() had five error paths that all hit this trap +and were further tangled by ret-overwriting between calls: + + - -ENODEV when the USB device was already disconnected + - -ERESTARTSYS when mutex_lock_interruptible() was interrupted + - msi2500_set_usb_adc() failure: ret was silently overwritten by + the next call (msi2500_isoc_init), so the error was lost entirely + - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but + the function then fell through to msi2500_ctrl_msg() and again + masked the original error by overwriting ret + - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all, + leaving isoc URBs submitted with no way for the driver to consume + them + +Consolidate the error paths into a small goto chain. Every failure +now stops the function, drains the queued-buffer list, and returns +the real error code. The ctrl_msg failure path also rolls back the +preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before +unlocking and draining. + +The cleanup helper takes a vb2_buffer_state argument so that the +start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as +expected by userspace on start_streaming failure) while stop_streaming +keeps its existing VB2_BUF_STATE_ERROR semantics. + +This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: +Return queued buffers on start_streaming() failure"). + +Fixes: 977e444f59ad ("[media] Mirics MSi3101 SDR Dongle driver") +Cc: stable@vger.kernel.org +Signed-off-by: Valery Borovsky +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/msi2500/msi2500.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/media/usb/msi2500/msi2500.c ++++ b/drivers/media/usb/msi2500/msi2500.c +@@ -541,7 +541,8 @@ static int msi2500_isoc_init(struct msi2 + } + + /* Must be called with vb_queue_lock hold */ +-static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev) ++static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev, ++ enum vb2_buffer_state state) + { + unsigned long flags; + +@@ -554,7 +555,7 @@ static void msi2500_cleanup_queued_bufs( + buf = list_entry(dev->queued_bufs.next, + struct msi2500_frame_buf, list); + list_del(&buf->list); +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, state); + } + spin_unlock_irqrestore(&dev->queued_bufs_lock, flags); + } +@@ -830,25 +831,40 @@ static int msi2500_start_streaming(struc + + dev_dbg(dev->dev, "\n"); + +- if (!dev->udev) +- return -ENODEV; ++ if (!dev->udev) { ++ ret = -ENODEV; ++ goto err_cleanup; ++ } + +- if (mutex_lock_interruptible(&dev->v4l2_lock)) +- return -ERESTARTSYS; ++ if (mutex_lock_interruptible(&dev->v4l2_lock)) { ++ ret = -ERESTARTSYS; ++ goto err_cleanup; ++ } + + /* wake-up tuner */ + v4l2_subdev_call(dev->v4l2_subdev, core, s_power, 1); + + ret = msi2500_set_usb_adc(dev); ++ if (ret) ++ goto err_unlock_cleanup; + + ret = msi2500_isoc_init(dev); + if (ret) +- msi2500_cleanup_queued_bufs(dev); ++ goto err_unlock_cleanup; + + ret = msi2500_ctrl_msg(dev, CMD_START_STREAMING, 0); ++ if (ret) ++ goto err_isoc_cleanup; + + mutex_unlock(&dev->v4l2_lock); ++ return 0; + ++err_isoc_cleanup: ++ msi2500_isoc_cleanup(dev); ++err_unlock_cleanup: ++ mutex_unlock(&dev->v4l2_lock); ++err_cleanup: ++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED); + return ret; + } + +@@ -863,7 +879,7 @@ static void msi2500_stop_streaming(struc + if (dev->udev) + msi2500_isoc_cleanup(dev); + +- msi2500_cleanup_queued_bufs(dev); ++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_ERROR); + + /* according to tests, at least 700us delay is required */ + msleep(20); diff --git a/queue-6.12/media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch b/queue-6.12/media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch new file mode 100644 index 0000000000..c5a9c1e3e7 --- /dev/null +++ b/queue-6.12/media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch @@ -0,0 +1,48 @@ +From 60ca00792bce46ec170c7ed101f376186d4cf8a9 Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 28 Mar 2026 18:17:49 +0000 +Subject: media: nuvoton: npcm-video: fix error handling in npcm_video_init() + +From: David Carlier + +commit 60ca00792bce46ec170c7ed101f376186d4cf8a9 upstream. + +npcm_video_init() has two error handling issues after +of_reserved_mem_device_init() is called: + +When dma_set_mask_and_coherent() fails, the function releases the +reserved memory but does not return, allowing execution to fall through +into npcm_video_ece_init() with a failed DMA configuration. + +When npcm_video_ece_init() fails, the function returns an error without +calling of_reserved_mem_device_release(), leaking the reserved memory +association. + +Fix both by adding the missing return after the DMA mask failure and +adding the missing of_reserved_mem_device_release() call on the ECE init +error path. + +Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nuvoton/npcm-video.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/platform/nuvoton/npcm-video.c ++++ b/drivers/media/platform/nuvoton/npcm-video.c +@@ -1719,10 +1719,12 @@ static int npcm_video_init(struct npcm_v + if (rc) { + dev_err(dev, "Failed to set DMA mask\n"); + of_reserved_mem_device_release(dev); ++ return rc; + } + + rc = npcm_video_ece_init(video); + if (rc) { ++ of_reserved_mem_device_release(dev); + dev_err(dev, "Failed to initialize ECE\n"); + return rc; + } diff --git a/queue-6.12/media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch b/queue-6.12/media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch new file mode 100644 index 0000000000..b04ebcaac4 --- /dev/null +++ b/queue-6.12/media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch @@ -0,0 +1,107 @@ +From 50cc0e547da50b887e63dfa1ad203cd5b735d01e Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 28 Mar 2026 18:18:09 +0000 +Subject: media: nuvoton: npcm-video: fix memory leaks in probe and remove + +From: David Carlier + +commit 50cc0e547da50b887e63dfa1ad203cd5b735d01e upstream. + +npcm_video_probe() allocates the npcm_video structure with kzalloc_obj() +but never frees it on any probe error path or in npcm_video_remove(), +leaking the allocation on every failed probe and every normal unbind. + +Additionally, when npcm_video_setup_video() fails, the reserved memory +association established by of_reserved_mem_device_init() in +npcm_video_init() is not released, leaking the rmem_assigned_device +entry on the global list. + +Fix both by adding kfree(video) to all probe error paths and to +npcm_video_remove(), and adding the missing +of_reserved_mem_device_release() call when npcm_video_setup_video() +fails. + +Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nuvoton/npcm-video.c | 32 ++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 9 deletions(-) + +--- a/drivers/media/platform/nuvoton/npcm-video.c ++++ b/drivers/media/platform/nuvoton/npcm-video.c +@@ -1749,42 +1749,55 @@ static int npcm_video_probe(struct platf + regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(regs)) { + dev_err(&pdev->dev, "Failed to parse VCD reg in DTS\n"); +- return PTR_ERR(regs); ++ rc = PTR_ERR(regs); ++ goto err_free; + } + + video->vcd_regmap = devm_regmap_init_mmio(&pdev->dev, regs, + &npcm_video_regmap_cfg); + if (IS_ERR(video->vcd_regmap)) { + dev_err(&pdev->dev, "Failed to initialize VCD regmap\n"); +- return PTR_ERR(video->vcd_regmap); ++ rc = PTR_ERR(video->vcd_regmap); ++ goto err_free; + } + + video->reset = devm_reset_control_get(&pdev->dev, NULL); + if (IS_ERR(video->reset)) { + dev_err(&pdev->dev, "Failed to get VCD reset control in DTS\n"); +- return PTR_ERR(video->reset); ++ rc = PTR_ERR(video->reset); ++ goto err_free; + } + + video->gcr_regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, + "nuvoton,sysgcr"); +- if (IS_ERR(video->gcr_regmap)) +- return PTR_ERR(video->gcr_regmap); ++ if (IS_ERR(video->gcr_regmap)) { ++ rc = PTR_ERR(video->gcr_regmap); ++ goto err_free; ++ } + + video->gfx_regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, + "nuvoton,sysgfxi"); +- if (IS_ERR(video->gfx_regmap)) +- return PTR_ERR(video->gfx_regmap); ++ if (IS_ERR(video->gfx_regmap)) { ++ rc = PTR_ERR(video->gfx_regmap); ++ goto err_free; ++ } + + rc = npcm_video_init(video); + if (rc) +- return rc; ++ goto err_free; + + rc = npcm_video_setup_video(video); + if (rc) +- return rc; ++ goto err_release_mem; + + dev_info(video->dev, "NPCM video driver probed\n"); + return 0; ++ ++err_release_mem: ++ of_reserved_mem_device_release(&pdev->dev); ++err_free: ++ kfree(video); ++ return rc; + } + + static void npcm_video_remove(struct platform_device *pdev) +@@ -1799,6 +1812,7 @@ static void npcm_video_remove(struct pla + v4l2_device_unregister(v4l2_dev); + if (video->ece.enable) + npcm_video_ece_stop(video); ++ kfree(video); + of_reserved_mem_device_release(dev); + } + diff --git a/queue-6.12/media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch b/queue-6.12/media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch new file mode 100644 index 0000000000..fdb022dea4 --- /dev/null +++ b/queue-6.12/media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch @@ -0,0 +1,61 @@ +From 567418eedd25b3d86d489807682030b4b98b73d9 Mon Sep 17 00:00:00 2001 +From: Xiaolei Wang +Date: Thu, 7 May 2026 12:13:16 +0800 +Subject: media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe + +From: Xiaolei Wang + +commit 567418eedd25b3d86d489807682030b4b98b73d9 upstream. + +Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call +v4l2_subdev_init_finalize() which allocates the subdev active state, +but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup() +calls v4l2_subdev_cleanup() to free it. + +This causes a memory leak on every rmmod, reported by kmemleak: + + unreferenced object 0xffff0000d06fc800 (size 192): + comm "(udev-worker)", pid 254, jiffies 4294913455 + backtrace (crc 36eeae58): + kmemleak_alloc+0x34/0x40 + __kvmalloc_node_noprof+0x5f8/0x7d8 + __v4l2_subdev_state_alloc+0x1fc/0x30c + __v4l2_subdev_init_finalize+0x178/0x368 + +Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup() +in both crossbar and pipe cleanup paths. + +Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") +Cc: stable@vger.kernel.org +Signed-off-by: Xiaolei Wang +Reviewed-by: Frank Li +Reviewed-by: Laurent Pinchart +Link: https://patch.msgid.link/20260507041318.491594-3-xiaolei.wang@windriver.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 1 + + drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c +@@ -494,6 +494,7 @@ err_free: + + void mxc_isi_crossbar_cleanup(struct mxc_isi_crossbar *xbar) + { ++ v4l2_subdev_cleanup(&xbar->sd); + media_entity_cleanup(&xbar->sd.entity); + kfree(xbar->pads); + kfree(xbar->inputs); +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c +@@ -819,6 +819,7 @@ void mxc_isi_pipe_cleanup(struct mxc_isi + { + struct v4l2_subdev *sd = &pipe->sd; + ++ v4l2_subdev_cleanup(sd); + media_entity_cleanup(&sd->entity); + mutex_destroy(&pipe->lock); + } diff --git a/queue-6.12/series b/queue-6.12/series index 83617ac271..5e0ddca2db 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -294,3 +294,24 @@ drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch drm-amd-display-set-new_stream-to-null-after-release.patch drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch +drm-amdgpu-disable-pcie-dynamic-speed-switching-on-ryzen-pinnacle-ridge.patch +drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch +drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch +drm-vc4-prevent-shader-bo-mappings-from-becoming-writable.patch +media-airspy-return-queued-buffers-on-start_streaming-failure.patch +media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch +media-cec-seco-unregister-adapter-on-ir-probe-failure.patch +media-cedrus-clean-up-media-device-on-probe-failure.patch +media-cedrus-fix-missing-cleanup-in-error-path.patch +media-cedrus-skip-invalid-h.264-reference-list-entries.patch +media-chips-media-wave5-move-src_buf-removal-to-finish_encode.patch +media-cx231xx-fix-devres-lifetime.patch +media-cx23885-add-ioremap-return-check-and-cleanup.patch +media-i2c-alvium-fix-critical-pointer-access-in-alvium_ctrl_init.patch +media-intel-ipu6-improve-dwc-phy-hsfreqrange-band-selection-for-overlapping-ranges.patch +media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch +media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch +media-msi2500-return-queued-buffers-on-start_streaming-failure.patch +media-nuvoton-npcm-video-fix-error-handling-in-npcm_video_init.patch +media-nuvoton-npcm-video-fix-memory-leaks-in-probe-and-remove.patch +media-nxp-imx8-isi-add-missing-v4l2_subdev_cleanup-in-crossbar-and-pipe.patch