From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:55:11 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.1.179~38 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=d357b3f755a2e2b5977e234abba504e7eed53fc4;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch media-airspy-return-queued-buffers-on-start_streaming-failure.patch media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch media-cec-seco-unregister-adapter-on-ir-probe-failure.patch media-cedrus-clean-up-media-device-on-probe-failure.patch media-cedrus-fix-missing-cleanup-in-error-path.patch media-cedrus-skip-invalid-h.264-reference-list-entries.patch media-cx231xx-fix-devres-lifetime.patch media-cx23885-add-ioremap-return-check-and-cleanup.patch media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch media-msi2500-return-queued-buffers-on-start_streaming-failure.patch --- diff --git a/queue-6.1/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch b/queue-6.1/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch new file mode 100644 index 0000000000..2508eed359 --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch @@ -0,0 +1,70 @@ +From a2f895f3c852063258d62e9f74b081de07ca95df Mon Sep 17 00:00:00 2001 +From: Zhu Lingshan +Date: Wed, 1 Jul 2026 18:53:21 +0800 +Subject: drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhu Lingshan + +commit a2f895f3c852063258d62e9f74b081de07ca95df upstream. + +amdgpu_bo_create_reserved() only allocates a new BO when +*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is +NULL, it simply skips creation when *bo_ptr is non-NULL. +But it unconditionally reserves, pins, gart allocates +and maps the BO afterwards. + +When the same non-NULL BO pointer is passed in again, +for example firmware buffers that live in adev and are +re-loaded on every resume / cp_resume / start +under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases +pin_count unconditionally, however the matching teardown only unpins +once, so pin_count never drops to zero, so TTM is not able +to move, swap or evict a BO, causing BO leaks. + +This commit fixes this issue by only pinning the bo +once at creation, and repeated calls no longer +take additional pin references. + +Signed-off-by: Zhu Lingshan +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -267,10 +267,12 @@ int amdgpu_bo_create_reserved(struct amd + goto error_free; + } + +- r = amdgpu_bo_pin(*bo_ptr, domain); +- if (r) { +- dev_err(adev->dev, "(%d) kernel bo pin failed\n", r); +- goto error_unreserve; ++ if (free) { ++ r = amdgpu_bo_pin(*bo_ptr, domain); ++ if (r) { ++ dev_err(adev->dev, "(%d) kernel bo pin failed\n", r); ++ goto error_unreserve; ++ } + } + + r = amdgpu_ttm_alloc_gart(&(*bo_ptr)->tbo); +@@ -293,7 +295,8 @@ int amdgpu_bo_create_reserved(struct amd + return 0; + + error_unpin: +- amdgpu_bo_unpin(*bo_ptr); ++ if (free) ++ amdgpu_bo_unpin(*bo_ptr); + error_unreserve: + amdgpu_bo_unreserve(*bo_ptr); + diff --git a/queue-6.1/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch b/queue-6.1/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch new file mode 100644 index 0000000000..16f8deb69b --- /dev/null +++ b/queue-6.1/drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch @@ -0,0 +1,69 @@ +From a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 Mon Sep 17 00:00:00 2001 +From: Ian Forbes +Date: Tue, 23 Jun 2026 14:33:14 -0500 +Subject: drm/vmwgfx: Validate vmw_surface_metadata::array_size + +From: Ian Forbes + +commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream. + +This field comes from userspace and should be validated against specific +limits depending on which Shader Model (SM) is available. + +Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata") +Reported-by: Zero Day Initiative +Cc: stable@vger.kernel.org +Signed-off-by: Ian Forbes +Reviewed-by: Maaz Mombasawala +Signed-off-by: Zack Rusin +Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +@@ -98,7 +98,7 @@ static int vmw_gb_surface_unbind(struct + static int vmw_gb_surface_destroy(struct vmw_resource *res); + static int + vmw_gb_surface_define_internal(struct drm_device *dev, +- struct drm_vmw_gb_surface_create_ext_req *req, ++ const struct drm_vmw_gb_surface_create_ext_req *req, + struct drm_vmw_gb_surface_create_rep *rep, + struct drm_file *file_priv); + static int +@@ -1406,7 +1406,7 @@ int vmw_gb_surface_reference_ext_ioctl(s + */ + static int + vmw_gb_surface_define_internal(struct drm_device *dev, +- struct drm_vmw_gb_surface_create_ext_req *req, ++ const struct drm_vmw_gb_surface_create_ext_req *req, + struct drm_vmw_gb_surface_create_rep *rep, + struct drm_file *file_priv) + { +@@ -1424,9 +1424,21 @@ vmw_gb_surface_define_internal(struct dr + req->base.svga3d_flags); + + /* array_size must be null for non-GL3 host. */ +- if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) { +- VMW_DEBUG_USER("SM4 surface not supported.\n"); +- return -EINVAL; ++ if (req->base.array_size > 0) { ++ if (has_sm5_context(dev_priv)) { ++ if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) { ++ VMW_DEBUG_USER("Invalid Surface Array Size.\n"); ++ return -EINVAL; ++ } ++ } else if (has_sm4_context(dev_priv)) { ++ if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) { ++ VMW_DEBUG_USER("Invalid Surface Array Size.\n"); ++ return -EINVAL; ++ } ++ } else { ++ VMW_DEBUG_USER("SM4+ surface not supported.\n"); ++ return -EINVAL; ++ } + } + + if (!has_sm4_1_context(dev_priv)) { diff --git a/queue-6.1/media-airspy-return-queued-buffers-on-start_streaming-failure.patch b/queue-6.1/media-airspy-return-queued-buffers-on-start_streaming-failure.patch new file mode 100644 index 0000000000..e89eebd93b --- /dev/null +++ b/queue-6.1/media-airspy-return-queued-buffers-on-start_streaming-failure.patch @@ -0,0 +1,52 @@ +From 04344d0b4929caa94c0df72f767752aa0935ef5d Mon Sep 17 00:00:00 2001 +From: Valery Borovsky +Date: Mon, 11 May 2026 20:12:06 +0300 +Subject: media: airspy: Return queued buffers on start_streaming() failure + +From: Valery Borovsky + +commit 04344d0b4929caa94c0df72f767752aa0935ef5d upstream. + +The vb2 framework hands buffers to the driver via buf_queue() before +calling start_streaming(). If start_streaming() returns an error +without first returning those buffers via vb2_buffer_done(), +vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued +buffers leak. + +airspy_start_streaming() returned -ENODEV early when the USB device had +been disconnected (s->udev == NULL) without returning any buffers that +buf_queue() had already accepted. Take v4l2_lock first and jump to the +existing err_clear_bit label, which already drains s->queued_bufs via +vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. + +This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: +Return queued buffers on start_streaming() failure"). + +Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver") +Cc: stable@vger.kernel.org +Signed-off-by: Valery Borovsky +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/airspy/airspy.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/airspy/airspy.c ++++ b/drivers/media/usb/airspy/airspy.c +@@ -521,11 +521,13 @@ static int airspy_start_streaming(struct + + dev_dbg(s->dev, "\n"); + +- if (!s->udev) +- return -ENODEV; +- + mutex_lock(&s->v4l2_lock); + ++ if (!s->udev) { ++ ret = -ENODEV; ++ goto err_clear_bit; ++ } ++ + s->sequence = 0; + + set_bit(POWER_ON, &s->flags); diff --git a/queue-6.1/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch b/queue-6.1/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch new file mode 100644 index 0000000000..50feb3b671 --- /dev/null +++ b/queue-6.1/media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch @@ -0,0 +1,41 @@ +From 253c8ef7d57da0c74db251f385324faaa5ae2257 Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Sat, 28 Mar 2026 11:23:30 +0000 +Subject: media: aspeed: fix missing of_reserved_mem_device_release() on probe failure + +From: David Carlier + +commit 253c8ef7d57da0c74db251f385324faaa5ae2257 upstream. + +aspeed_video_init() calls of_reserved_mem_device_init() to associate +reserved memory regions with the device. When aspeed_video_setup_video() +subsequently fails in aspeed_video_probe(), the error path frees the +JPEG buffer and unprepares the clocks but does not release the reserved +memory association, leaking the rmem_assigned_device entry on the global +list. + +The normal remove path already calls of_reserved_mem_device_release() +correctly; only the probe error path was missing it. + +Add the missing of_reserved_mem_device_release() call to the +aspeed_video_setup_video() failure cleanup. + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/aspeed/aspeed-video.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/aspeed/aspeed-video.c ++++ b/drivers/media/platform/aspeed/aspeed-video.c +@@ -1994,6 +1994,7 @@ static int aspeed_video_probe(struct pla + rc = aspeed_video_setup_video(video); + if (rc) { + aspeed_video_free_buf(video, &video->jpeg); ++ of_reserved_mem_device_release(&pdev->dev); + clk_unprepare(video->vclk); + clk_unprepare(video->eclk); + return rc; diff --git a/queue-6.1/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch b/queue-6.1/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch new file mode 100644 index 0000000000..c19726177d --- /dev/null +++ b/queue-6.1/media-cec-seco-unregister-adapter-on-ir-probe-failure.patch @@ -0,0 +1,49 @@ +From c3a78691be8245e52ced489f268e413f18061ac2 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Fri, 24 Apr 2026 23:36:01 +0900 +Subject: media: cec: seco: unregister adapter on IR probe failure + +From: Myeonghun Pak + +commit c3a78691be8245e52ced489f268e413f18061ac2 upstream. + +If secocec_ir_probe() fails after cec_register_adapter() succeeds, +probe returns an error and the driver remove callback is not called. +The current unwind path unregisters the notifier and then falls through +to cec_delete_adapter(), which violates the CEC adapter lifetime rules +after a successful registration. + +Add a registered-adapter unwind path that unregisters the notifier and +the adapter instead. + +Fixes: daef95769b3a ("media: seco-cec: add Consumer-IR support") +Cc: stable@vger.kernel.org +Signed-off-by: Myeonghun Pak +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/cec/platform/seco/seco-cec.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/media/cec/platform/seco/seco-cec.c ++++ b/drivers/media/cec/platform/seco/seco-cec.c +@@ -649,7 +649,7 @@ static int secocec_probe(struct platform + + ret = secocec_ir_probe(secocec); + if (ret) +- goto err_notifier; ++ goto err_unregister_adapter; + + platform_set_drvdata(pdev, secocec); + +@@ -657,6 +657,10 @@ static int secocec_probe(struct platform + + return ret; + ++err_unregister_adapter: ++ cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap); ++ cec_unregister_adapter(secocec->cec_adap); ++ goto err; + err_notifier: + cec_notifier_cec_adap_unregister(secocec->notifier, secocec->cec_adap); + err_delete_adapter: diff --git a/queue-6.1/media-cedrus-clean-up-media-device-on-probe-failure.patch b/queue-6.1/media-cedrus-clean-up-media-device-on-probe-failure.patch new file mode 100644 index 0000000000..7df7715b1b --- /dev/null +++ b/queue-6.1/media-cedrus-clean-up-media-device-on-probe-failure.patch @@ -0,0 +1,51 @@ +From 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 Mon Sep 17 00:00:00 2001 +From: Myeonghun Pak +Date: Wed, 6 May 2026 21:41:16 +0900 +Subject: media: cedrus: clean up media device on probe failure + +From: Myeonghun Pak + +commit 2c869b6969f3061cbbdab587f4c0a88bd7fc3cc9 upstream. + +cedrus_probe() initializes the media device before registering the video +device, the media controller, and the media device. If any of those later +steps fails, probe returns without calling media_device_cleanup(), so the +media device internals initialized by media_device_init() are left behind. + +Add a media-device cleanup label to the probe unwind path and route video +registration failures through it as well. + +Fixes: 50e761516f2b8c ("media: platform: Add Cedrus VPU decoder driver") +Cc: stable@vger.kernel.org +Reviewed-by: Paul Kocialkowski +Co-developed-by: Ijae Kim +Signed-off-by: Ijae Kim +Signed-off-by: Myeonghun Pak +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -503,7 +503,7 @@ static int cedrus_probe(struct platform_ + ret = video_register_device(vfd, VFL_TYPE_VIDEO, 0); + if (ret) { + v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); +- goto err_m2m; ++ goto err_media; + } + + v4l2_info(&dev->v4l2_dev, +@@ -529,7 +529,8 @@ err_m2m_mc: + v4l2_m2m_unregister_media_controller(dev->m2m_dev); + err_video: + video_unregister_device(&dev->vfd); +-err_m2m: ++err_media: ++ media_device_cleanup(&dev->mdev); + v4l2_m2m_release(dev->m2m_dev); + err_v4l2: + v4l2_device_unregister(&dev->v4l2_dev); diff --git a/queue-6.1/media-cedrus-fix-missing-cleanup-in-error-path.patch b/queue-6.1/media-cedrus-fix-missing-cleanup-in-error-path.patch new file mode 100644 index 0000000000..7cbc798adf --- /dev/null +++ b/queue-6.1/media-cedrus-fix-missing-cleanup-in-error-path.patch @@ -0,0 +1,39 @@ +From d99732334aaf33b9f93926b70b6a11c2cef3de39 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Tue, 7 Apr 2026 01:14:02 +0300 +Subject: media: cedrus: Fix missing cleanup in error path + +From: Samuel Holland + +commit d99732334aaf33b9f93926b70b6a11c2cef3de39 upstream. + +According to the documentation struct v4l2_fh has to be cleaned up with +v4l2_fh_exit() before being freed. [1] +Currently there is no actual bug here, when v4l2_fh_exit() isn't called. +v4l2_fh_exit() in this case only destroys internal mutex. But it may +change in the future, when v4l2_fh_init/v4l2_fh_exit will be enhanced. + +1. https://docs.kernel.org/driver-api/media/v4l2-fh.html + +Signed-off-by: Samuel Holland +Signed-off-by: Andrey Skvortsov +Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver") +Cc: stable@vger.kernel.org +Acked-by: Paul Kocialkowski +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -381,6 +381,7 @@ static int cedrus_open(struct file *file + err_ctrls: + v4l2_ctrl_handler_free(&ctx->hdl); + err_free: ++ v4l2_fh_exit(&ctx->fh); + kfree(ctx); + mutex_unlock(&dev->dev_mutex); + diff --git a/queue-6.1/media-cedrus-skip-invalid-h.264-reference-list-entries.patch b/queue-6.1/media-cedrus-skip-invalid-h.264-reference-list-entries.patch new file mode 100644 index 0000000000..def0b627f0 --- /dev/null +++ b/queue-6.1/media-cedrus-skip-invalid-h.264-reference-list-entries.patch @@ -0,0 +1,47 @@ +From 10358ea986c3c85516d1c8206486464f79d36e76 Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Tue, 24 Mar 2026 16:08:56 +0800 +Subject: media: cedrus: skip invalid H.264 reference list entries + +From: Pengpeng Hou + +commit 10358ea986c3c85516d1c8206486464f79d36e76 upstream. + +Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the +stateless slice control and later uses their indices to look up +decode->dpb[] in _cedrus_write_ref_list(). + +Rejecting such controls in cedrus_try_ctrl() would break existing +userspace, since stateless H.264 reference lists may legitimately carry +out-of-range indices for missing references. Instead, guard the actual +DPB lookup in Cedrus and skip entries whose indices do not fit the fixed +V4L2_H264_NUM_DPB_ENTRIES array. + +This keeps the fix local to the driver use site and avoids out-of-bounds +reads from malformed or unsupported reference list entries. + +Fixes: e000e1fa4bdbd ("media: uapi: h264: Update reference lists") +Cc: stable@vger.kernel.org +Signed-off-by: Pengpeng Hou +Reviewed-by: Nicolas Dufresne +Acked-by: Jernej Skrabec +Tested-by: Chen-Yu Tsai +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +@@ -190,6 +190,9 @@ static void _cedrus_write_ref_list(struc + u8 dpb_idx; + + dpb_idx = ref_list[i].index; ++ if (dpb_idx >= V4L2_H264_NUM_DPB_ENTRIES) ++ continue; ++ + dpb = &decode->dpb[dpb_idx]; + + if (!(dpb->flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE)) diff --git a/queue-6.1/media-cx231xx-fix-devres-lifetime.patch b/queue-6.1/media-cx231xx-fix-devres-lifetime.patch new file mode 100644 index 0000000000..ec842f1a97 --- /dev/null +++ b/queue-6.1/media-cx231xx-fix-devres-lifetime.patch @@ -0,0 +1,79 @@ +From 7d6358ab02866e5b7ed8d3a00805297617bbb0ec Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 30 Mar 2026 11:37:27 +0200 +Subject: media: cx231xx: fix devres lifetime + +From: Johan Hovold + +commit 7d6358ab02866e5b7ed8d3a00805297617bbb0ec upstream. + +USB drivers bind to USB interfaces and any device managed resources +should have their lifetime tied to the interface rather than parent USB +device. This avoids issues like memory leaks when drivers are unbound +without their devices being physically disconnected (e.g. on probe +deferral or configuration changes). + +Fix the driver state lifetime so that it is released on driver unbind. + +Fixes: 184a82784d50 ("[media] cx231xx: use devm_ functions to allocate memory") +Cc: stable@vger.kernel.org # 3.17 +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/cx231xx/cx231xx-cards.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/media/usb/cx231xx/cx231xx-cards.c ++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c +@@ -1577,7 +1577,8 @@ static int cx231xx_init_v4l2(struct cx23 + dev->video_mode.end_point_addr, + dev->video_mode.num_alt); + +- dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->video_mode.num_alt, GFP_KERNEL); ++ dev->video_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->video_mode.num_alt, GFP_KERNEL); + if (dev->video_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1618,7 +1619,8 @@ static int cx231xx_init_v4l2(struct cx23 + dev->vbi_mode.num_alt); + + /* compute alternate max packet sizes for vbi */ +- dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->vbi_mode.num_alt, GFP_KERNEL); ++ dev->vbi_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->vbi_mode.num_alt, GFP_KERNEL); + if (dev->vbi_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1660,7 +1662,9 @@ static int cx231xx_init_v4l2(struct cx23 + "sliced CC EndPoint Addr 0x%x, Alternate settings: %i\n", + dev->sliced_cc_mode.end_point_addr, + dev->sliced_cc_mode.num_alt); +- dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->sliced_cc_mode.num_alt, GFP_KERNEL); ++ dev->sliced_cc_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->sliced_cc_mode.num_alt, ++ GFP_KERNEL); + if (dev->sliced_cc_mode.alt_max_pkt_size == NULL) + return -ENOMEM; + +@@ -1724,7 +1728,7 @@ static int cx231xx_usb_probe(struct usb_ + udev = usb_get_dev(interface_to_usbdev(interface)); + + /* allocate memory for our device state and initialize it */ +- dev = devm_kzalloc(&udev->dev, sizeof(*dev), GFP_KERNEL); ++ dev = devm_kzalloc(&interface->dev, sizeof(*dev), GFP_KERNEL); + if (dev == NULL) { + retval = -ENOMEM; + goto err_if; +@@ -1854,7 +1858,9 @@ static int cx231xx_usb_probe(struct usb_ + dev->ts1_mode.end_point_addr, + dev->ts1_mode.num_alt); + +- dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&udev->dev, 32, dev->ts1_mode.num_alt, GFP_KERNEL); ++ dev->ts1_mode.alt_max_pkt_size = devm_kmalloc_array(&interface->dev, 32, ++ dev->ts1_mode.num_alt, ++ GFP_KERNEL); + if (dev->ts1_mode.alt_max_pkt_size == NULL) { + retval = -ENOMEM; + goto err_video_alt; diff --git a/queue-6.1/media-cx23885-add-ioremap-return-check-and-cleanup.patch b/queue-6.1/media-cx23885-add-ioremap-return-check-and-cleanup.patch new file mode 100644 index 0000000000..93e2d196b3 --- /dev/null +++ b/queue-6.1/media-cx23885-add-ioremap-return-check-and-cleanup.patch @@ -0,0 +1,58 @@ +From a0701e387b46e2481c05b47f1235b954bfc2af3e Mon Sep 17 00:00:00 2001 +From: Wang Jun <1742789905@qq.com> +Date: Fri, 20 Mar 2026 15:04:53 +0800 +Subject: media: cx23885: add ioremap return check and cleanup + +From: Wang Jun <1742789905@qq.com> + +commit a0701e387b46e2481c05b47f1235b954bfc2af3e upstream. + +Add a check for the return value of pci_ioremap_bar() +in cx23885_dev_setup(). +If ioremap for BAR0 fails, release the already allocated +PCI memory region, +decrement the device count, and return -ENODEV. + +This prevents a potential null pointer dereference and +ensures proper cleanup +on memory mapping failure. + +Fixes: d19770e5178a ("V4L/DVB (6150): Add CX23885/CX23887 PCIe bridge driver") +Cc: stable@vger.kernel.org +Signed-off-by: Wang Jun <1742789905@qq.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/cx23885/cx23885-core.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -990,8 +990,12 @@ static int cx23885_dev_setup(struct cx23 + } + + /* PCIe stuff */ +- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0), +- pci_resource_len(dev->pci, 0)); ++ dev->lmmio = pci_ioremap_bar(dev->pci, 0); ++ if (!dev->lmmio) { ++ dev_err(&dev->pci->dev, "CORE %s: can't ioremap MMIO memory\n", ++ dev->name); ++ goto err_release_region; ++ } + + dev->bmmio = (u8 __iomem *)dev->lmmio; + +@@ -1096,6 +1100,12 @@ static int cx23885_dev_setup(struct cx23 + } + + return 0; ++ ++err_release_region: ++ release_mem_region(pci_resource_start(dev->pci, 0), ++ pci_resource_len(dev->pci, 0)); ++ cx23885_devcount--; ++ return -ENODEV; + } + + static void cx23885_dev_unregister(struct cx23885_dev *dev) diff --git a/queue-6.1/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch b/queue-6.1/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch new file mode 100644 index 0000000000..8d08ad0f2a --- /dev/null +++ b/queue-6.1/media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch @@ -0,0 +1,38 @@ +From 033ff0420e4c9c240ae5523fff39770298efa964 Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Fri, 17 Apr 2026 14:53:30 +0800 +Subject: media: marvell-cam: fix missing pci_disable_device() on remove + +From: Guangshuo Li + +commit 033ff0420e4c9c240ae5523fff39770298efa964 upstream. + +During manual code audit, we found that cafe_pci_probe() enables the +PCI device with pci_enable_device(), and its probe error path properly +calls pci_disable_device() on failure. + +However, cafe_pci_remove() tears down the controller and frees the +driver data without disabling the PCI device, leaving the remove path +inconsistent with probe cleanup. + +Add the missing pci_disable_device() call to cafe_pci_remove(). + +Fixes: abfa3df36c01 ("[media] marvell-cam: Separate out the Marvell camera core") +Cc: stable@vger.kernel.org +Signed-off-by: Guangshuo Li +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/marvell/cafe-driver.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/marvell/cafe-driver.c ++++ b/drivers/media/platform/marvell/cafe-driver.c +@@ -601,6 +601,7 @@ static void cafe_pci_remove(struct pci_d + return; + } + cafe_shutdown(cam); ++ pci_disable_device(pdev); + kfree(cam); + } + diff --git a/queue-6.1/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch b/queue-6.1/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch new file mode 100644 index 0000000000..92c2d3f0d0 --- /dev/null +++ b/queue-6.1/media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch @@ -0,0 +1,70 @@ +From 940f161f734b25f175a95d2684c2021f6323693a Mon Sep 17 00:00:00 2001 +From: Anand Moon +Date: Wed, 20 May 2026 10:10:41 +0530 +Subject: media: meson: vdec: Fix memory leak in error path of vdec_open + +From: Anand Moon + +commit 940f161f734b25f175a95d2684c2021f6323693a upstream. + +The vdec_open() function previously jumped directly to +err_m2m_release when vdec_init_ctrls() failed, skipping +release of the m2m context. This caused a resource leak. + +Fix it by introducing a proper err_m2m_ctx_release label +that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before +releasing the m2m device. + +This was identified via kmemleak: +unreferenced object 0xffff0000205d6878 (size 8): + comm "v4l_id", pid 5289, jiffies 4294938580 + hex dump (first 8 bytes): + 40 d2 49 18 00 00 ff ff @.I..... + backtrace (crc d3204599): + kmemleak_alloc+0xc8/0xf0 + __kvmalloc_node_noprof+0x60c/0x850 + v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev] + vdec_open+0x1f4/0x788 [meson_vdec] + v4l2_open+0x144/0x460 [videodev] + chrdev_open+0x1ac/0x500 + do_dentry_open+0x3f0/0xfe8 + vfs_open+0x68/0x320 + do_open+0x2d8/0x9a8 + path_openat+0x1d0/0x4f0 + do_filp_open+0x190/0x380 + do_sys_openat2+0xf8/0x1b0 + __arm64_sys_openat+0x13c/0x1e8 + invoke_syscall+0xdc/0x268 + el0_svc_common.constprop.0+0x178/0x258 + do_el0_svc+0x4c/0x70 + +Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver") +Cc: stable@vger.kernel.org +Signed-off-by: Anand Moon +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/meson/vdec/vdec.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/media/meson/vdec/vdec.c ++++ b/drivers/staging/media/meson/vdec/vdec.c +@@ -897,7 +897,7 @@ static int vdec_open(struct file *file) + + ret = vdec_init_ctrls(sess); + if (ret) +- goto err_m2m_release; ++ goto err_m2m_ctx_release; + + sess->pixfmt_cap = formats[0].pixfmts_cap[0]; + sess->fmt_out = &formats[0]; +@@ -922,6 +922,8 @@ static int vdec_open(struct file *file) + + return 0; + ++err_m2m_ctx_release: ++ v4l2_m2m_ctx_release(sess->m2m_ctx); + err_m2m_release: + v4l2_m2m_release(sess->m2m_dev); + err_free_sess: diff --git a/queue-6.1/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch b/queue-6.1/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch new file mode 100644 index 0000000000..c0d25c6b33 --- /dev/null +++ b/queue-6.1/media-msi2500-return-queued-buffers-on-start_streaming-failure.patch @@ -0,0 +1,128 @@ +From 7201c17786a498497bca57752883b90914d405ac Mon Sep 17 00:00:00 2001 +From: Valery Borovsky +Date: Mon, 11 May 2026 20:12:07 +0300 +Subject: media: msi2500: Return queued buffers on start_streaming() failure + +From: Valery Borovsky + +commit 7201c17786a498497bca57752883b90914d405ac upstream. + +The vb2 framework hands buffers to the driver via buf_queue() before +calling start_streaming(). If start_streaming() returns an error +without first returning those buffers via vb2_buffer_done(), +vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued +buffers leak. + +msi2500_start_streaming() had five error paths that all hit this trap +and were further tangled by ret-overwriting between calls: + + - -ENODEV when the USB device was already disconnected + - -ERESTARTSYS when mutex_lock_interruptible() was interrupted + - msi2500_set_usb_adc() failure: ret was silently overwritten by + the next call (msi2500_isoc_init), so the error was lost entirely + - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but + the function then fell through to msi2500_ctrl_msg() and again + masked the original error by overwriting ret + - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all, + leaving isoc URBs submitted with no way for the driver to consume + them + +Consolidate the error paths into a small goto chain. Every failure +now stops the function, drains the queued-buffer list, and returns +the real error code. The ctrl_msg failure path also rolls back the +preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before +unlocking and draining. + +The cleanup helper takes a vb2_buffer_state argument so that the +start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as +expected by userspace on start_streaming failure) while stop_streaming +keeps its existing VB2_BUF_STATE_ERROR semantics. + +This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: +Return queued buffers on start_streaming() failure"). + +Fixes: 977e444f59ad ("[media] Mirics MSi3101 SDR Dongle driver") +Cc: stable@vger.kernel.org +Signed-off-by: Valery Borovsky +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/msi2500/msi2500.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/media/usb/msi2500/msi2500.c ++++ b/drivers/media/usb/msi2500/msi2500.c +@@ -541,7 +541,8 @@ static int msi2500_isoc_init(struct msi2 + } + + /* Must be called with vb_queue_lock hold */ +-static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev) ++static void msi2500_cleanup_queued_bufs(struct msi2500_dev *dev, ++ enum vb2_buffer_state state) + { + unsigned long flags; + +@@ -554,7 +555,7 @@ static void msi2500_cleanup_queued_bufs( + buf = list_entry(dev->queued_bufs.next, + struct msi2500_frame_buf, list); + list_del(&buf->list); +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, state); + } + spin_unlock_irqrestore(&dev->queued_bufs_lock, flags); + } +@@ -830,25 +831,40 @@ static int msi2500_start_streaming(struc + + dev_dbg(dev->dev, "\n"); + +- if (!dev->udev) +- return -ENODEV; ++ if (!dev->udev) { ++ ret = -ENODEV; ++ goto err_cleanup; ++ } + +- if (mutex_lock_interruptible(&dev->v4l2_lock)) +- return -ERESTARTSYS; ++ if (mutex_lock_interruptible(&dev->v4l2_lock)) { ++ ret = -ERESTARTSYS; ++ goto err_cleanup; ++ } + + /* wake-up tuner */ + v4l2_subdev_call(dev->v4l2_subdev, core, s_power, 1); + + ret = msi2500_set_usb_adc(dev); ++ if (ret) ++ goto err_unlock_cleanup; + + ret = msi2500_isoc_init(dev); + if (ret) +- msi2500_cleanup_queued_bufs(dev); ++ goto err_unlock_cleanup; + + ret = msi2500_ctrl_msg(dev, CMD_START_STREAMING, 0); ++ if (ret) ++ goto err_isoc_cleanup; + + mutex_unlock(&dev->v4l2_lock); ++ return 0; + ++err_isoc_cleanup: ++ msi2500_isoc_cleanup(dev); ++err_unlock_cleanup: ++ mutex_unlock(&dev->v4l2_lock); ++err_cleanup: ++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_QUEUED); + return ret; + } + +@@ -863,7 +879,7 @@ static void msi2500_stop_streaming(struc + if (dev->udev) + msi2500_isoc_cleanup(dev); + +- msi2500_cleanup_queued_bufs(dev); ++ msi2500_cleanup_queued_bufs(dev, VB2_BUF_STATE_ERROR); + + /* according to tests, at least 700us delay is required */ + msleep(20); diff --git a/queue-6.1/series b/queue-6.1/series index 1d82d7087b..ced0ba111b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -185,3 +185,16 @@ drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch +drm-amdgpu-fix-bo-pin-leaking-in-amdgpu_bo_create_reserved.patch +drm-vmwgfx-validate-vmw_surface_metadata-array_size.patch +media-airspy-return-queued-buffers-on-start_streaming-failure.patch +media-aspeed-fix-missing-of_reserved_mem_device_release-on-probe-failure.patch +media-cec-seco-unregister-adapter-on-ir-probe-failure.patch +media-cedrus-clean-up-media-device-on-probe-failure.patch +media-cedrus-fix-missing-cleanup-in-error-path.patch +media-cedrus-skip-invalid-h.264-reference-list-entries.patch +media-cx231xx-fix-devres-lifetime.patch +media-cx23885-add-ioremap-return-check-and-cleanup.patch +media-marvell-cam-fix-missing-pci_disable_device-on-remove.patch +media-meson-vdec-fix-memory-leak-in-error-path-of-vdec_open.patch +media-msi2500-return-queued-buffers-on-start_streaming-failure.patch