linux-stable.git/drivers, branch v6.17.4

irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume

2025-10-19T14:37:43+00:00

[ Upstream commit f75e07bf5226da640fa99a0594687c780d9bace4 ]

According to the PLIC specification[1], global interrupt sources are
assigned small unsigned integer identifiers beginning at the value 1.
An interrupt ID of 0 is reserved to mean "no interrupt".

The current plic_irq_resume() and plic_irq_suspend() functions incorrectly
start the loop from index 0, which accesses the register space for the
reserved interrupt ID 0.

Change the loop to start from index 1, skipping the reserved
interrupt ID 0 as per the PLIC specification.

This prevents potential undefined behavior when accessing the reserved
register space during suspend/resume cycles.

Fixes: e80f0b6a2cf3 ("irqchip/irq-sifive-plic: Add syscore callbacks for hibernation")
Co-developed-by: Jia Wang 
Signed-off-by: Jia Wang 
Co-developed-by: Charles Mirabile 
Signed-off-by: Charles Mirabile 
Signed-off-by: Lucas Zampieri 
Signed-off-by: Thomas Gleixner 
Link: https://github.com/riscv/riscv-plic-spec/releases/tag/1.0.0
Signed-off-by: Sasha Levin

ACPI: property: Do not pass NULL handles to acpi_attach_data()

2025-10-19T14:37:43+00:00

[ Upstream commit baf60d5cb8bc6b85511c5df5f0ad7620bb66d23c ]

In certain circumstances, the ACPI handle of a data-only node may be
NULL, in which case it does not make sense to attempt to attach that
node to an ACPI namespace object, so update the code to avoid attempts
to do so.

This prevents confusing and unuseful error messages from being printed.

Also document the fact that the ACPI handle of a data-only node may be
NULL and when that happens in a code comment.  In addition, make
acpi_add_nondev_subnodes() print a diagnostic message for each data-only
node with an unknown ACPI namespace scope.

Fixes: 1d52f10917a7 ("ACPI: property: Tie data nodes to acpi handles")
Cc: 6.0+  # 6.0+
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Sakari Ailus 
Tested-by: Sakari Ailus 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

ACPI: property: Add code comments explaining what is going on

2025-10-19T14:37:43+00:00

[ Upstream commit 737c3a09dcf69ba2814f3674947ccaec1861c985 ]

In some places in the ACPI device properties handling code, it is
unclear why the code is what it is.  Some assumptions are not documented
and some pieces of code are based on knowledge that is not mentioned
anywhere.

Add code comments explaining these things.

Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Sakari Ailus 
Tested-by: Sakari Ailus 
Stable-dep-of: baf60d5cb8bc ("ACPI: property: Do not pass NULL handles to acpi_attach_data()")
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

ACPI: property: Disregard references in data-only subnode lists

2025-10-19T14:37:43+00:00

[ Upstream commit d06118fe9b03426484980ed4c189a8c7b99fa631 ]

Data-only subnode links following the ACPI data subnode GUID in a _DSD
package are expected to point to named objects returning _DSD-equivalent
packages.  If a reference to such an object is used in the target field
of any of those links, that object will be evaluated in place (as a
named object) and its return data will be embedded in the outer _DSD
package.

For this reason, it is not expected to see a subnode link with the
target field containing a local reference (that would mean pointing
to a device or another object that cannot be evaluated in place and
therefore cannot return a _DSD-equivalent package).

Accordingly, simplify the code parsing data-only subnode links to
simply print a message when it encounters a local reference in the
target field of one of those links.

Moreover, since acpi_nondev_subnode_data_ok() would only have one
caller after the change above, fold it into that caller.

Link: https://lore.kernel.org/linux-acpi/CAJZ5v0jVeSrDO6hrZhKgRZrH=FpGD4vNUjFD8hV9WwN9TLHjzQ@mail.gmail.com/
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Sakari Ailus 
Tested-by: Sakari Ailus 
Stable-dep-of: baf60d5cb8bc ("ACPI: property: Do not pass NULL handles to acpi_attach_data()")
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

media: mc: Clear minor number before put device

2025-10-19T14:37:42+00:00

[ Upstream commit 8cfc8cec1b4da88a47c243a11f384baefd092a50 ]

The device minor should not be cleared after the device is released.

Fixes: 9e14868dc952 ("media: mc: Clear minor number reservation at unregistration time")
Cc: stable@vger.kernel.org
Reported-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=031d0cfd7c362817963f
Tested-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil 
[ moved clear_bit from media_devnode_release callback to media_devnode_unregister before put_device ]
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

ipmi: Fix handling of messages with provided receive message pointer

2025-10-19T14:37:42+00:00

commit e2c69490dda5d4c9f1bfbb2898989c8f3530e354 upstream.

Prior to commit b52da4054ee0 ("ipmi: Rework user message limit handling"),
i_ipmi_request() used to increase the user reference counter if the receive
message is provided by the caller of IPMI API functions. This is no longer
the case. However, ipmi_free_recv_msg() is still called and decreases the
reference counter. This results in the reference counter reaching zero,
the user data pointer is released, and all kinds of interesting crashes are
seen.

Fix the problem by increasing user reference counter if the receive message
has been provided by the caller.

Fixes: b52da4054ee0 ("ipmi: Rework user message limit handling")
Reported-by: Eric Dumazet 
Cc: Eric Dumazet 
Cc: Greg Thelen 
Signed-off-by: Guenter Roeck 
Message-ID: <20251006201857.3433837-1-linux@roeck-us.net>
Signed-off-by: Corey Minyard 
Signed-off-by: Greg Kroah-Hartman

ACPICA: Allow to skip Global Lock initialization

2025-10-19T14:37:42+00:00

commit feb8ae81b2378b75a99c81d315602ac8918ed382 upstream.

Introduce acpi_gbl_use_global_lock, which allows to skip the Global Lock
initialization. This is useful for systems without Global Lock (such as
loong_arch), so as to avoid error messages during boot phase:

 ACPI Error: Could not enable global_lock event (20240827/evxfevnt-182)
 ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)

Link: https://github.com/acpica/acpica/commit/463cb0fe
Signed-off-by: Huacai Chen 
Signed-off-by: Rafael J. Wysocki 
Cc: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

media: iris: Allow stop on firmware only if start was issued.

2025-10-19T14:37:40+00:00

commit 56a2d85ee8f9b994e5cd17039133218c57c5902b upstream.

For HFI Gen1, the instances substate is changed to LOAD_RESOURCES only
when a START command is issues to the firmware. If STOP is called
without a prior START, the firmware may reject the command and throw
some erros.
Handle this by adding a substate check before issuing STOP command to
the firmware.

Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops")
Cc: stable@vger.kernel.org
Reviewed-by: Vikash Garodia 
Tested-by: Vikash Garodia  # X1E80100
Tested-by: Neil Armstrong  # on SM8550-HDK
Tested-by: Neil Armstrong  # on SM8650-HDK
Signed-off-by: Dikshita Agarwal 
Tested-by: Bryan O'Donoghue  # x1e80100-crd
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: iris: Fix format check for CAPTURE plane in try_fmt

2025-10-19T14:37:40+00:00

commit 2dbd2645c07df8de04ee37b24f2395800513391e upstream.

Previously, the format validation relied on an array of supported
formats, which only listed formats for the OUTPUT plane. This caused
failures when validating formats for the CAPTURE plane.
Update the check to validate against the only supported format on the
CAPTURE plane, which is NV12.

Fixes: fde6161d91bb ("media: iris: Add HEVC and VP9 formats for decoder")
Cc: stable@vger.kernel.org
Reviewed-by: Vikash Garodia 
Tested-by: Vikash Garodia  # X1E80100
Tested-by: Neil Armstrong  # on SM8550-HDK
Tested-by: Neil Armstrong  # on SM8650-HDK
Signed-off-by: Dikshita Agarwal 
Tested-by: Bryan O'Donoghue  # x1e80100-crd
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: iris: Fix missing LAST flag handling during drain

2025-10-19T14:37:40+00:00

commit 8172f57746d68e5c3c743f725435d75c5a4db1ac upstream.

Improve drain handling by ensuring the LAST flag is attached to final
capture buffer when drain response is received from the firmware.

Previously, the driver failed to attach the V4L2_BUF_FLAG_LAST flag when
a drain response was received from the firmware, relying on userspace to
mark the next queued buffer as LAST. This update fixes the issue by
checking the pending drain status, attaching the LAST flag to the
capture buffer received from the firmware (with EOS attached), and
returning it to the V4L2 layer correctly.

Fixes: d09100763bed ("media: iris: add support for drain sequence")
Cc: stable@vger.kernel.org
Reviewed-by: Vikash Garodia 
Tested-by: Vikash Garodia  # X1E80100
Reviewed-by: Bryan O'Donoghue 
Tested-by: Neil Armstrong  # on SM8550-HDK
Tested-by: Neil Armstrong  # on SM8650-HDK
Signed-off-by: Dikshita Agarwal 
Tested-by: Bryan O'Donoghue  # x1e80100-crd
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman