<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/media, branch v7.0.9</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>media: qcom: camss: Add missing clocks for VFE lite on sa8775p</title>
<updated>2026-05-17T15:16:27+00:00</updated>
<author>
<name>Wenmeng Liu</name>
<email>wenmeng.liu@oss.qualcomm.com</email>
</author>
<published>2026-03-13T10:13:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=24a3c0a61df98f640dd06e3ffa785ac7017ad5f8'/>
<id>24a3c0a61df98f640dd06e3ffa785ac7017ad5f8</id>
<content type='text'>
commit d31fac47b39f5e1ed85a587688ca70b793e421b4 upstream.

Add missing required clocks (cpas_ahb and camnoc_axi) for VFE lite
instances on sa8775p platform. These clocks are necessary for proper
VFE lite operation:

Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Fixes: e7b59e1d06fb ("media: qcom: camss: Add support for VFE 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d31fac47b39f5e1ed85a587688ca70b793e421b4 upstream.

Add missing required clocks (cpas_ahb and camnoc_axi) for VFE lite
instances on sa8775p platform. These clocks are necessary for proper
VFE lite operation:

Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Fixes: e7b59e1d06fb ("media: qcom: camss: Add support for VFE 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: iris: switch to hardware mode after firmware boot</title>
<updated>2026-05-17T15:16:27+00:00</updated>
<author>
<name>Vikash Garodia</name>
<email>vikash.garodia@oss.qualcomm.com</email>
</author>
<published>2026-03-13T13:19:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=6fb1a2768b9864dd329af644ee24d122b9b5e44b'/>
<id>6fb1a2768b9864dd329af644ee24d122b9b5e44b</id>
<content type='text'>
commit 95a337f92f0a602d4f935315bfbc8bf07f475e65 upstream.

Currently the driver switches the vcodec GDSC to hardware (HW) mode
before firmware load and boot sequence. GDSC can be powered off, keeping
in hw mode, thereby the vcodec registers programmed in TrustZone (TZ)
carry default (reset) values.
Move the transition to HW mode after firmware load and boot sequence.

The bug was exposed with driver configuring different stream ids to
different devices via iommu-map. With registers carrying reset values,
VPU would not generate desired stream-id, thereby leading to SMMU fault.

For vpu4, when GDSC is switched to HW mode, there is a need to perform
the reset operation. Without reset, there are occasional issues of
register corruption observed. Hence the vpu GDSC switch also involves
the reset.

Co-developed-by: Vishnu Reddy &lt;busanna.reddy@oss.qualcomm.com&gt;
Signed-off-by: Vishnu Reddy &lt;busanna.reddy@oss.qualcomm.com&gt;
Signed-off-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Dmitry Baryshkov &lt;dmitry.baryshkov@oss.qualcomm.com&gt;
[bod: occassional =&gt; occasional]
Fixes: dde659d37036 ("media: iris: Introduce vpu ops for vpu4 with necessary hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 95a337f92f0a602d4f935315bfbc8bf07f475e65 upstream.

Currently the driver switches the vcodec GDSC to hardware (HW) mode
before firmware load and boot sequence. GDSC can be powered off, keeping
in hw mode, thereby the vcodec registers programmed in TrustZone (TZ)
carry default (reset) values.
Move the transition to HW mode after firmware load and boot sequence.

The bug was exposed with driver configuring different stream ids to
different devices via iommu-map. With registers carrying reset values,
VPU would not generate desired stream-id, thereby leading to SMMU fault.

For vpu4, when GDSC is switched to HW mode, there is a need to perform
the reset operation. Without reset, there are occasional issues of
register corruption observed. Hence the vpu GDSC switch also involves
the reset.

Co-developed-by: Vishnu Reddy &lt;busanna.reddy@oss.qualcomm.com&gt;
Signed-off-by: Vishnu Reddy &lt;busanna.reddy@oss.qualcomm.com&gt;
Signed-off-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Dmitry Baryshkov &lt;dmitry.baryshkov@oss.qualcomm.com&gt;
[bod: occassional =&gt; occasional]
Fixes: dde659d37036 ("media: iris: Introduce vpu ops for vpu4 with necessary hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: iris: fix use-after-free of fmt_src during MBPF check</title>
<updated>2026-05-17T15:16:27+00:00</updated>
<author>
<name>Vishnu Reddy</name>
<email>busanna.reddy@oss.qualcomm.com</email>
</author>
<published>2026-03-05T13:28:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=494ffd1712a588e590e6b1e9f876a8c8b24a9180'/>
<id>494ffd1712a588e590e6b1e9f876a8c8b24a9180</id>
<content type='text'>
commit 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 upstream.

During concurrency testing, multiple instances can run in parallel, and
each instance uses its own inst-&gt;lock while the core-&gt;lock protects the
list of active instances. The race happens because these locks cover
different scopes, inst-&gt;lock protects only the internals of a single
instance, while the Macro Blocks Per Frame (MBPF) checker walks the
core list under core-&gt;lock and reads fields like fmt_src-&gt;width and
fmt_src-&gt;height. At the same time, iris_close() may free fmt_src and
fmt_dst under inst-&gt;lock while the instance is still present in the core
list. This allows a situation where the MBPF checker, still iterating
through the core list, reaches an instance whose fmt_src was already
freed by another thread and ends up dereferencing a dangling pointer,
resulting in a use-after-free. This happens because the MBPF checker
assumes that any instance in the core list is fully valid, but the
freeing of fmt_src and fmt_dst without removing the instance from the
core list is not correct.

The correct ordering is to defer freeing fmt_src and fmt_dst until after
the instance has been removed from the core list and all teardown under
the core lock has completed, ensuring that no dangling pointers are ever
exposed during MBPF checks.

Reviewed-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Signed-off-by: Vishnu Reddy &lt;busanna.reddy@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 upstream.

During concurrency testing, multiple instances can run in parallel, and
each instance uses its own inst-&gt;lock while the core-&gt;lock protects the
list of active instances. The race happens because these locks cover
different scopes, inst-&gt;lock protects only the internals of a single
instance, while the Macro Blocks Per Frame (MBPF) checker walks the
core list under core-&gt;lock and reads fields like fmt_src-&gt;width and
fmt_src-&gt;height. At the same time, iris_close() may free fmt_src and
fmt_dst under inst-&gt;lock while the instance is still present in the core
list. This allows a situation where the MBPF checker, still iterating
through the core list, reaches an instance whose fmt_src was already
freed by another thread and ends up dereferencing a dangling pointer,
resulting in a use-after-free. This happens because the MBPF checker
assumes that any instance in the core list is fully valid, but the
freeing of fmt_src and fmt_dst without removing the instance from the
core list is not correct.

The correct ordering is to defer freeing fmt_src and fmt_dst until after
the instance has been removed from the core list and all teardown under
the core lock has completed, ensuring that no dangling pointers are ever
exposed during MBPF checks.

Reviewed-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Signed-off-by: Vishnu Reddy &lt;busanna.reddy@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()</title>
<updated>2026-05-17T15:16:26+00:00</updated>
<author>
<name>Thomas Fourier</name>
<email>fourier.thomas@gmail.com</email>
</author>
<published>2026-02-13T09:13:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=c7c469127876201341c6353d6ef1b0da23485272'/>
<id>c7c469127876201341c6353d6ef1b0da23485272</id>
<content type='text'>
commit 4a49ae56b0e4268d48fd96babe0cc68596bc301a upstream.

The core-&gt;iface_q_table_vaddr buffer is alloc'd with size queue_size
but freed with sizeof(*q_tbl_hdr) which is different.

Change the dma_free_attrs() size.

Signed-off-by: Thomas Fourier &lt;fourier.thomas@gmail.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4a49ae56b0e4268d48fd96babe0cc68596bc301a upstream.

The core-&gt;iface_q_table_vaddr buffer is alloc'd with size queue_size
but freed with sizeof(*q_tbl_hdr) which is different.

Change the dma_free_attrs() size.

Signed-off-by: Thomas Fourier &lt;fourier.thomas@gmail.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: venus: fix QCOM_MDT_LOADER dependency</title>
<updated>2026-05-17T15:16:26+00:00</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2026-03-30T11:08:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=6ca2302d4c6c9b5307988a1ed6285d41b33b5b94'/>
<id>6ca2302d4c6c9b5307988a1ed6285d41b33b5b94</id>
<content type='text'>
commit aa23c94cc433b145d1ce93820ecdfe16d8940e28 upstream.

When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y,
the kernel fails to link:

x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot':
firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size'
firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load'
firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init'

The problem is the conditional 'select' statement. Change this to
make the driver built-in here regardless of CONFIG_ARCH_QCOM,
same as for the similar IRIS driver.

Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit aa23c94cc433b145d1ce93820ecdfe16d8940e28 upstream.

When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y,
the kernel fails to link:

x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot':
firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size'
firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load'
firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init'

The problem is the conditional 'select' statement. Change this to
make the driver built-in here regardless of CONFIG_ARCH_QCOM,
same as for the similar IRIS driver.

Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280</title>
<updated>2026-05-17T15:16:26+00:00</updated>
<author>
<name>Dmitry Baryshkov</name>
<email>dmitry.baryshkov@oss.qualcomm.com</email>
</author>
<published>2026-03-27T20:19:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=169185f94a81b006d870ecd9809bcfac04037aeb'/>
<id>169185f94a81b006d870ecd9809bcfac04037aeb</id>
<content type='text'>
commit 3e0b2053751657ed2924adfe3ff25b1450231e33 upstream.

Follow the commit bfe1326573ff ("venus: Fix for H265 decoding failure.")
and increase H265D_MAX_SLICE following firmware requirements on that
platform. Otherwise decoding of the H.265 streams fails with the
"insufficient scratch_1 buffer size" from the firmware.

Signed-off-by: Dmitry Baryshkov &lt;dmitry.baryshkov@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
[bod: Fixed commit log withthe =&gt; with the]
Fixes: e1f5d32608ec ("media: iris: Add internal buffer calculation for HEVC and VP9 decoders")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3e0b2053751657ed2924adfe3ff25b1450231e33 upstream.

Follow the commit bfe1326573ff ("venus: Fix for H265 decoding failure.")
and increase H265D_MAX_SLICE following firmware requirements on that
platform. Otherwise decoding of the H.265 streams fails with the
"insufficient scratch_1 buffer size" from the firmware.

Signed-off-by: Dmitry Baryshkov &lt;dmitry.baryshkov@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
[bod: Fixed commit log withthe =&gt; with the]
Fixes: e1f5d32608ec ("media: iris: Add internal buffer calculation for HEVC and VP9 decoders")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: qcom: camss: Fix csid IRQ offset for sa8775p</title>
<updated>2026-05-17T15:16:26+00:00</updated>
<author>
<name>Wenmeng Liu</name>
<email>wenmeng.liu@oss.qualcomm.com</email>
</author>
<published>2026-03-13T10:13:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=5afd433604ce282f0349808d03d6b0e74ec45eb0'/>
<id>5afd433604ce282f0349808d03d6b0e74ec45eb0</id>
<content type='text'>
commit dd1b373941079cc102cc18bc68884e18245f5912 upstream.

Fix BUF_DONE_IRQ_STATUS_RDI_OFFSET calculation for csid lite on
sa8775p platform. The offset should be 0 for csid lite on sa8775p,

Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit dd1b373941079cc102cc18bc68884e18245f5912 upstream.

Fix BUF_DONE_IRQ_STATUS_RDI_OFFSET calculation for csid lite on
sa8775p platform. The offset should be 0 for csid lite on sa8775p,

Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: qcom: camss: Fix csid clock configuration for sa8775p</title>
<updated>2026-05-17T15:16:26+00:00</updated>
<author>
<name>Wenmeng Liu</name>
<email>wenmeng.liu@oss.qualcomm.com</email>
</author>
<published>2026-03-13T10:13:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a98a8dd66ebfb59d74b50a63ed70a3d0b7297791'/>
<id>a98a8dd66ebfb59d74b50a63ed70a3d0b7297791</id>
<content type='text'>
commit fe56c674118aa46da1a3e65aa22ca709ebd7d812 upstream.

Fix the mismatch between clock list and clock rate table for CSID lite
instances. The current implementation has 5 clocks defined but only 2
are actually needed (vfe_lite_csid and vfe_lite_cphy_rx), while the
clock rate table doesn't match this configuration.

Update both clock list and rate table to maintain consistency:
- Remove unused clocks: cpas_vfe_lite, vfe_lite_ahb, vfe_lite
- Update clock rate table to match the remaining two clocks

Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fe56c674118aa46da1a3e65aa22ca709ebd7d812 upstream.

Fix the mismatch between clock list and clock rate table for CSID lite
instances. The current implementation has 5 clocks defined but only 2
are actually needed (vfe_lite_csid and vfe_lite_cphy_rx), while the
clock rate table doesn't match this configuration.

Update both clock list and rate table to maintain consistency:
- Remove unused clocks: cpas_vfe_lite, vfe_lite_ahb, vfe_lite
- Update clock rate table to match the remaining two clocks

Signed-off-by: Wenmeng Liu &lt;wenmeng.liu@oss.qualcomm.com&gt;
Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: iris: Fix use-after-free in iris_release_internal_buffers()</title>
<updated>2026-05-17T15:16:26+00:00</updated>
<author>
<name>Dikshita Agarwal</name>
<email>dikshita.agarwal@oss.qualcomm.com</email>
</author>
<published>2026-02-16T07:07:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=18c64439f249859b6140f7bf8bcf95c8ed841f28'/>
<id>18c64439f249859b6140f7bf8bcf95c8ed841f28</id>
<content type='text'>
commit f27cfdcfc916bb59297825805f4c3499f89f9e76 upstream.

The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy
internal buffers after FW releases") introduced a regression where
session_release_buf() may free the buffer. The caller,
iris_release_internal_buffers(), continued to access `buffer` after the
call, leading to a potential use-after-free.

Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
session_release_buf(), and reverting the flag if the call fails. This
ensures no dereference occurs after potential freeing.

Reported-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r
Signed-off-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit f27cfdcfc916bb59297825805f4c3499f89f9e76 upstream.

The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy
internal buffers after FW releases") introduced a regression where
session_release_buf() may free the buffer. The caller,
iris_release_internal_buffers(), continued to access `buffer` after the
call, leading to a potential use-after-free.

Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
session_release_buf(), and reverting the flag if the call fails. This
ensures no dereference occurs after potential freeing.

Reported-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r
Signed-off-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Vikash Garodia &lt;vikash.garodia@oss.qualcomm.com&gt;
Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>media: iris: fix QCOM_MDT_LOADER dependency</title>
<updated>2026-05-17T15:16:26+00:00</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2026-02-05T14:56:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=2ed65808d6d408114f27ca858616bfa04268eec3'/>
<id>2ed65808d6d408114f27ca858616bfa04268eec3</id>
<content type='text'>
commit a297c5165f91366cbc3490e630aabd1c0f70efb8 upstream.

When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y,
the kernel fails to link:

x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load':
iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size'
iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load'

The problem is the conditional 'select' statement. Change this to
make the driver built-in here regardless of CONFIG_ARCH_QCOM.

Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a297c5165f91366cbc3490e630aabd1c0f70efb8 upstream.

When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y,
the kernel fails to link:

x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load':
iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size'
iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load'

The problem is the conditional 'select' statement. Change this to
make the driver built-in here regardless of CONFIG_ARCH_QCOM.

Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Reviewed-by: Konrad Dybcio &lt;konrad.dybcio@oss.qualcomm.com&gt;
Reviewed-by: Dikshita Agarwal &lt;dikshita.agarwal@oss.qualcomm.com&gt;
Reviewed-by: Bryan O'Donoghue &lt;bryan.odonoghue@linaro.org&gt;
Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue &lt;bod@kernel.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil+cisco@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
