FAILED: patch "[PATCH] drm/tegra: fbdev: Remove offset into framebuffer memory" failed to apply to 6.18-stable tree

PATCH Applied [email protected] 2 participants 4 messages Jul 29 – Aug 7

Subsystems (4)

Stable branch DRM drivers Tegra architecture support DRM drivers for NVIDIA Tegra

lore

Share & tools

lore

[email protected]

author maintainer

2026-07-29 10:35 UTC #0 lore raw

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x a18b6e30ecd69096beda4a0c96d2570900c3879a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026072951-strategy-rage-af59@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From a18b6e30ecd69096beda4a0c96d2570900c3879a Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <[email protected]>
Date: Tue, 21 Apr 2026 09:29:06 +0200
Subject: [PATCH] drm/tegra: fbdev: Remove offset into framebuffer memory

The screen_buffer field in struct fb_info contains the kernel address of the first byte of framebuffer memory. Do not add the display offset. This offset only describes scrolling during scanout.

Signed-off-by Thomas Zimmermann <[email protected]>

Fixes de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")

Cc [email protected]

Cc <[email protected]> # v3.10+

Signed-off-by Thierry Reding <[email protected]>

Link https://patch.msgid.link/[email protected] open here

drivers/gpu/drm/tegra/fbdev.c +2 -6

index 19e39fa54bfa..793849199783 100644
@@ -76,7 +76,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
-	unsigned long offset;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;

@@ -115,9 +114,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 
 	drm_fb_helper_fill_info(info, helper, sizes);
 
-	offset = info->var.xoffset * bytes_per_pixel +
-		 info->var.yoffset * fb->pitches[0];
-
 	if (bo->pages) {
 		bo->vaddr = vmap(bo->pages, bo->num_pages, VM_MAP,
 				 pgprot_writecombine(PAGE_KERNEL));

@@ -129,9 +125,9 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	}
 
 	info->flags |= FBINFO_VIRTFB;
-	info->screen_buffer = bo->vaddr + offset;
+	info->screen_buffer = bo->vaddr;
 	info->screen_size = size;
-	info->fix.smem_start = (unsigned long)(bo->iova + offset);
+	info->fix.smem_start = (unsigned long)(bo->iova);
 	info->fix.smem_len = size;
 
 	return 0;

Sasha Levin

maintainer

2026-07-31 02:41 UTC #1 lore raw

PATCH 1/2 drm/fb-helper: Allocate and release fb_info in single place

From: Thomas Zimmermann <[email protected]>

[ Upstream commit 63c971af40365ee706c7e24f6a7900d693518f09 ]

Move the calls to drm_fb_helper_alloc_info() from drivers into a single place in fbdev helpers. Allocates struct fb_info for a new framebuffer device. Then call drm_fb_helper_single_fb_probe() to create an fbdev screen buffer. Also release the instance on errors by calling drm_fb_helper_release_info().

Simplifies the code and fixes the error cleanup for some of the drivers.

Regular release of the struct fb_info instance still happens in drm_fb_helper_fini() as before.

v2:
- remove error rollback in driver implementations (kernel test robot)
- initialize info in TTM implementation (kernel test robot)

Signed-off-by Thomas Zimmermann <[email protected]>

Acked-by Christian König <[email protected]> # radeon

Acked-by Dmitry Baryshkov <[email protected]> # msm

Acked-by Javier Martinez Canillas <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Stable-dep-of: a18b6e30ecd6 ("drm/tegra: fbdev: Remove offset into framebuffer memory")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/armada/armada_fbdev.c      | 12 +------
 drivers/gpu/drm/drm_fb_helper.c            | 39 +++++++---------------
 drivers/gpu/drm/drm_fbdev_dma.c            | 12 ++-----
 drivers/gpu/drm/drm_fbdev_shmem.c          | 12 ++-----
 drivers/gpu/drm/drm_fbdev_ttm.c            | 12 ++-----
 drivers/gpu/drm/exynos/exynos_drm_fbdev.c  |  9 +----
 drivers/gpu/drm/gma500/fbdev.c             | 12 +------
 drivers/gpu/drm/i915/display/intel_fbdev.c |  9 +----
 drivers/gpu/drm/msm/msm_fbdev.c            |  9 +----
 drivers/gpu/drm/omapdrm/omap_fbdev.c       |  9 +----
 drivers/gpu/drm/radeon/radeon_fbdev.c      | 13 +-------
 drivers/gpu/drm/tegra/fbdev.c              |  9 +----
 include/drm/drm_fb_helper.h                | 12 -------
 13 files changed, 26 insertions(+), 143 deletions(-)

drivers/gpu/drm/armada/armada_fbdev.c +1 ~~-11~~

index cb53cc91bafb..4a8c432e311e 100644
@@ -45,10 +45,10 @@ int armada_fbdev_driver_fbdev_probe(struct drm_fb_helper *fbh,
 				    struct drm_fb_helper_surface_size *sizes)
 {
 	struct drm_device *dev = fbh->dev;
+	struct fb_info *info = fbh->info;
 	struct drm_mode_fb_cmd2 mode;
 	struct armada_framebuffer *dfb;
 	struct armada_gem_object *obj;
-	struct fb_info *info;
 	int size, ret;
 	void *ptr;

@@ -92,12 +92,6 @@ int armada_fbdev_driver_fbdev_probe(struct drm_fb_helper *fbh,
 	if (IS_ERR(dfb))
 		return PTR_ERR(dfb);
 
-	info = drm_fb_helper_alloc_info(fbh);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_fballoc;
-	}
-
 	info->fbops = &armada_fb_ops;
 	info->fix.smem_start = obj->phys_addr;
 	info->fix.smem_len = obj->obj.size;

@@ -113,8 +107,4 @@ int armada_fbdev_driver_fbdev_probe(struct drm_fb_helper *fbh,
 		(unsigned long long)obj->phys_addr);
 
 	return 0;
-
- err_fballoc:
-	dfb->fb.funcs->destroy(&dfb->fb);
-	return ret;
 }

drivers/gpu/drm/drm_fb_helper.c +12 ~~-27~~

index 0b3ee008523d..18a00de2ec1f 100644
@@ -489,20 +489,7 @@ int drm_fb_helper_init(struct drm_device *dev,
 }
 EXPORT_SYMBOL(drm_fb_helper_init);
 
-/**
- * drm_fb_helper_alloc_info - allocate fb_info and some of its members
- * @fb_helper: driver-allocated fbdev helper
- *
- * A helper to alloc fb_info and the member cmap. Called by the driver
- * within the struct &drm_driver.fbdev_probe callback function. Drivers do
- * not need to release the allocated fb_info structure themselves, this is
- * automatically done when calling drm_fb_helper_fini().
- *
- * RETURNS:
- * fb_info pointer if things went okay, pointer containing error code
- * otherwise
- */
-struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
+static struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
 {
 	struct device *dev = fb_helper->dev->dev;
 	struct fb_info *info;

@@ -529,17 +516,8 @@ struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
 	framebuffer_release(info);
 	return ERR_PTR(ret);
 }
-EXPORT_SYMBOL(drm_fb_helper_alloc_info);
 
-/**
- * drm_fb_helper_release_info - release fb_info and its members
- * @fb_helper: driver-allocated fbdev helper
- *
- * A helper to release fb_info and the member cmap.  Drivers do not
- * need to release the allocated fb_info structure themselves, this is
- * automatically done when calling drm_fb_helper_fini().
- */
-void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
+static void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
 {
 	struct fb_info *info = fb_helper->info;

@@ -552,7 +530,6 @@ void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
 		fb_dealloc_cmap(&info->cmap);
 	framebuffer_release(info);
 }
-EXPORT_SYMBOL(drm_fb_helper_release_info);
 
 /**
  * drm_fb_helper_unregister_info - unregister fb_info framebuffer device

@@ -1813,6 +1790,11 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper)
 	height = dev->mode_config.max_height;
 
 	drm_client_modeset_probe(&fb_helper->client, width, height);
+
+	info = drm_fb_helper_alloc_info(fb_helper);
+	if (IS_ERR(info))
+		return PTR_ERR(info);
+
 	ret = drm_fb_helper_single_fb_probe(fb_helper);
 	if (ret < 0) {
 		if (ret == -EAGAIN) {

@@ -1821,13 +1803,12 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper)
 		}
 		mutex_unlock(&fb_helper->lock);
 
-		return ret;
+		goto err_drm_fb_helper_release_info;
 	}
 	drm_setup_crtcs_fb(fb_helper);
 
 	fb_helper->deferred_setup = false;
 
-	info = fb_helper->info;
 	info->var.pixclock = 0;
 
 	/* Need to drop locks to avoid recursive deadlock in

@@ -1850,6 +1831,10 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper)
 	mutex_unlock(&kernel_fb_helper_lock);
 
 	return 0;
+
+err_drm_fb_helper_release_info:
+	drm_fb_helper_release_info(fb_helper);
+	return ret;
 }
 
 /**

drivers/gpu/drm/drm_fbdev_dma.c +2 ~~-10~~

index 8bd626ef16c7..7b77c801a63a 100644
@@ -272,9 +272,9 @@ int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 {
 	struct drm_client_dev *client = &fb_helper->client;
 	struct drm_device *dev = fb_helper->dev;
+	struct fb_info *info = fb_helper->info;
 	struct drm_client_buffer *buffer;
 	struct drm_framebuffer *fb;
-	struct fb_info *info;
 	u32 format;
 	struct iosys_map map;
 	int ret;

@@ -304,12 +304,6 @@ int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	fb_helper->buffer = buffer;
 	fb_helper->fb = fb;
 
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_drm_client_buffer_vunmap;
-	}
-
 	drm_fb_helper_fill_info(info, fb_helper, sizes);
 
 	if (fb->funcs->dirty)

@@ -317,12 +311,10 @@ int drm_fbdev_dma_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	else
 		ret = drm_fbdev_dma_driver_fbdev_probe_tail(fb_helper, sizes);
 	if (ret)
-		goto err_drm_fb_helper_release_info;
+		goto err_drm_client_buffer_vunmap;
 
 	return 0;
 
-err_drm_fb_helper_release_info:
-	drm_fb_helper_release_info(fb_helper);
 err_drm_client_buffer_vunmap:
 	fb_helper->fb = NULL;
 	fb_helper->buffer = NULL;

drivers/gpu/drm/drm_fbdev_shmem.c +2 ~~-10~~

index 1e827bf8b815..77f350700818 100644
@@ -136,10 +136,10 @@ int drm_fbdev_shmem_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 {
 	struct drm_client_dev *client = &fb_helper->client;
 	struct drm_device *dev = fb_helper->dev;
+	struct fb_info *info = fb_helper->info;
 	struct drm_client_buffer *buffer;
 	struct drm_gem_shmem_object *shmem;
 	struct drm_framebuffer *fb;
-	struct fb_info *info;
 	u32 format;
 	struct iosys_map map;
 	int ret;

@@ -169,12 +169,6 @@ int drm_fbdev_shmem_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	fb_helper->buffer = buffer;
 	fb_helper->fb = fb;
 
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_drm_client_buffer_vunmap;
-	}
-
 	drm_fb_helper_fill_info(info, fb_helper, sizes);
 
 	info->fbops = &drm_fbdev_shmem_fb_ops;

@@ -195,12 +189,10 @@ int drm_fbdev_shmem_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	info->fbdefio = &fb_helper->fbdefio;
 	ret = fb_deferred_io_init(info);
 	if (ret)
-		goto err_drm_fb_helper_release_info;
+		goto err_drm_client_buffer_vunmap;
 
 	return 0;
 
-err_drm_fb_helper_release_info:
-	drm_fb_helper_release_info(fb_helper);
 err_drm_client_buffer_vunmap:
 	fb_helper->fb = NULL;
 	fb_helper->buffer = NULL;

drivers/gpu/drm/drm_fbdev_ttm.c +2 ~~-10~~

index 85feb55bba11..1ba258f3c854 100644
@@ -176,8 +176,8 @@ int drm_fbdev_ttm_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 {
 	struct drm_client_dev *client = &fb_helper->client;
 	struct drm_device *dev = fb_helper->dev;
+	struct fb_info *info = fb_helper->info;
 	struct drm_client_buffer *buffer;
-	struct fb_info *info;
 	size_t screen_size;
 	void *screen_buffer;
 	u32 format;

@@ -205,12 +205,6 @@ int drm_fbdev_ttm_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 		goto err_drm_client_framebuffer_delete;
 	}
 
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_vfree;
-	}
-
 	drm_fb_helper_fill_info(info, fb_helper, sizes);
 
 	info->fbops = &drm_fbdev_ttm_fb_ops;

@@ -227,12 +221,10 @@ int drm_fbdev_ttm_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	info->fbdefio = &fb_helper->fbdefio;
 	ret = fb_deferred_io_init(info);
 	if (ret)
-		goto err_drm_fb_helper_release_info;
+		goto err_vfree;
 
 	return 0;
 
-err_drm_fb_helper_release_info:
-	drm_fb_helper_release_info(fb_helper);
 err_vfree:
 	vfree(screen_buffer);
 err_drm_client_framebuffer_delete:

drivers/gpu/drm/exynos/exynos_drm_fbdev.c +1 -8

index 93de25b77e68..b0bd0697910e 100644
@@ -59,18 +59,11 @@ static int exynos_drm_fbdev_update(struct drm_fb_helper *helper,
 				   struct drm_fb_helper_surface_size *sizes,
 				   struct exynos_drm_gem *exynos_gem)
 {
-	struct fb_info *fbi;
+	struct fb_info *fbi = helper->info;
 	struct drm_framebuffer *fb = helper->fb;
 	unsigned int size = fb->width * fb->height * fb->format->cpp[0];
 	unsigned long offset;
 
-	fbi = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(fbi)) {
-		DRM_DEV_ERROR(to_dma_dev(helper->dev),
-			      "failed to allocate fb info.\n");
-		return PTR_ERR(fbi);
-	}
-
 	fbi->fbops = &exynos_drm_fb_ops;
 
 	drm_fb_helper_fill_info(fbi, helper, sizes);

drivers/gpu/drm/gma500/fbdev.c +1 ~~-11~~

index a6af21514cff..dacc118b1242 100644
@@ -111,7 +111,7 @@ int psb_fbdev_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	struct drm_device *dev = fb_helper->dev;
 	struct drm_psb_private *dev_priv = to_drm_psb_private(dev);
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
-	struct fb_info *info;
+	struct fb_info *info = fb_helper->info;
 	struct drm_framebuffer *fb;
 	struct drm_mode_fb_cmd2 mode_cmd = { };
 	int size;

@@ -170,12 +170,6 @@ int psb_fbdev_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	fb_helper->funcs = &psb_fbdev_fb_helper_funcs;
 	fb_helper->fb = fb;
 
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_drm_framebuffer_unregister_private;
-	}
-
 	info->fbops = &psb_fbdev_fb_ops;
 
 	/* Accessed stolen memory directly */

@@ -199,10 +193,6 @@ int psb_fbdev_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 
 	return 0;
 
-err_drm_framebuffer_unregister_private:
-	drm_framebuffer_unregister_private(fb);
-	drm_framebuffer_cleanup(fb);
-	kfree(fb);
 err_drm_gem_object_put:
 	drm_gem_object_put(obj);
 	return ret;

drivers/gpu/drm/i915/display/intel_fbdev.c +1 -8

index 7daf72b69bae..a42b0943ed95 100644
@@ -242,8 +242,8 @@ int intel_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	struct intel_display *display = to_intel_display(helper->dev);
 	struct intel_fbdev *ifbdev = to_intel_fbdev(helper);
 	struct intel_framebuffer *fb = ifbdev->fb;
+	struct fb_info *info = helper->info;
 	struct ref_tracker *wakeref;
-	struct fb_info *info;
 	struct i915_vma *vma;
 	unsigned long flags = 0;
 	bool prealloc = false;

@@ -296,13 +296,6 @@ int intel_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 		goto out_unlock;
 	}
 
-	info = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(info)) {
-		drm_err(display->drm, "Failed to allocate fb_info (%pe)\n", info);
-		ret = PTR_ERR(info);
-		goto out_unpin;
-	}
-
 	helper->funcs = &intel_fb_helper_funcs;
 	helper->fb = &fb->base;

drivers/gpu/drm/msm/msm_fbdev.c +1 -8

index b5969374d53f..d86c89d03f4b 100644
@@ -93,9 +93,9 @@ int msm_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 {
 	struct drm_device *dev = helper->dev;
 	struct msm_drm_private *priv = dev->dev_private;
+	struct fb_info *fbi = helper->info;
 	struct drm_framebuffer *fb = NULL;
 	struct drm_gem_object *bo;
-	struct fb_info *fbi = NULL;
 	uint64_t paddr;
 	uint32_t format;
 	int ret, pitch;

@@ -128,13 +128,6 @@ int msm_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 		goto fail;
 	}
 
-	fbi = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(fbi)) {
-		DRM_DEV_ERROR(dev->dev, "failed to allocate fb info\n");
-		ret = PTR_ERR(fbi);
-		goto fail;
-	}
-
 	DBG("fbi=%p, dev=%p", fbi, dev);
 
 	helper->funcs = &msm_fbdev_helper_funcs;

drivers/gpu/drm/omapdrm/omap_fbdev.c +1 -8

index 948af7ec1130..2b435c05bdb1 100644
@@ -155,9 +155,9 @@ int omap_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	struct drm_device *dev = helper->dev;
 	struct omap_drm_private *priv = dev->dev_private;
 	struct omap_fbdev *fbdev = priv->fbdev;
+	struct fb_info *fbi = helper->info;
 	struct drm_framebuffer *fb = NULL;
 	union omap_gem_size gsize;
-	struct fb_info *fbi = NULL;
 	struct drm_mode_fb_cmd2 mode_cmd = {0};
 	struct drm_gem_object *bo;
 	dma_addr_t dma_addr;

@@ -226,13 +226,6 @@ int omap_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 		goto fail;
 	}
 
-	fbi = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(fbi)) {
-		dev_err(dev->dev, "failed to allocate fb info\n");
-		ret = PTR_ERR(fbi);
-		goto fail;
-	}
-
 	DBG("fbi=%p, dev=%p", fbi, dev);
 
 	helper->funcs = &omap_fbdev_helper_funcs;

drivers/gpu/drm/radeon/radeon_fbdev.c +1 ~~-12~~

index dc81b0c2dbff..d5c621d48e20 100644
@@ -206,7 +206,7 @@ int radeon_fbdev_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	struct radeon_device *rdev = fb_helper->dev->dev_private;
 	const struct drm_format_info *format_info;
 	struct drm_mode_fb_cmd2 mode_cmd = { };
-	struct fb_info *info;
+	struct fb_info *info = fb_helper->info;
 	struct drm_gem_object *gobj;
 	struct radeon_bo *rbo;
 	struct drm_framebuffer *fb;

@@ -247,13 +247,6 @@ int radeon_fbdev_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 	fb_helper->funcs = &radeon_fbdev_fb_helper_funcs;
 	fb_helper->fb = fb;
 
-	/* okay we have an object now allocate the framebuffer */
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_drm_framebuffer_unregister_private;
-	}
-
 	info->fbops = &radeon_fbdev_fb_ops;
 
 	/* radeon resume is fragile and needs a vt switch to help it along */

@@ -279,10 +272,6 @@ int radeon_fbdev_driver_fbdev_probe(struct drm_fb_helper *fb_helper,
 
 	return 0;
 
-err_drm_framebuffer_unregister_private:
-	fb_helper->fb = NULL;
-	drm_framebuffer_unregister_private(fb);
-	drm_framebuffer_cleanup(fb);
 err_kfree:
 	kfree(fb);
 err_radeon_fbdev_destroy_pinned_object:

drivers/gpu/drm/tegra/fbdev.c +1 -8

index 1b70f5e164af..ba0971ec34b5 100644
@@ -75,10 +75,10 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	struct tegra_drm *tegra = helper->dev->dev_private;
 	struct drm_device *drm = helper->dev;
 	struct drm_mode_fb_cmd2 cmd = { 0 };
+	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
 	unsigned long offset;
-	struct fb_info *info;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;

@@ -99,13 +99,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	if (IS_ERR(bo))
 		return PTR_ERR(bo);
 
-	info = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(info)) {
-		dev_err(drm->dev, "failed to allocate framebuffer info\n");
-		drm_gem_object_put(&bo->gem);
-		return PTR_ERR(info);
-	}
-
 	fb = tegra_fb_alloc(drm,
 			    drm_get_format_info(drm, cmd.pixel_format, cmd.modifier[0]),
 			    &cmd, &bo, 1);

include/drm/drm_fb_helper.h +0 ~~-12~~

index c1d38d54a112..2faf8aaf98dc 100644
@@ -256,8 +256,6 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
 
 int drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper);
 
-struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper);
-void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper);
 void drm_fb_helper_unregister_info(struct drm_fb_helper *fb_helper);
 void drm_fb_helper_fill_info(struct fb_info *info,
 			     struct drm_fb_helper *fb_helper,

@@ -340,16 +338,6 @@ drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)
 	return 0;
 }
 
-static inline struct fb_info *
-drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
-{
-	return NULL;
-}
-
-static inline void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
-{
-}
-
 static inline void drm_fb_helper_unregister_info(struct drm_fb_helper *fb_helper)
 {
 }

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-07-31 02:41 UTC #2 lore raw

PATCH 2/2 drm/tegra: fbdev: Remove offset into framebuffer memory

From: Thomas Zimmermann <[email protected]>

[ Upstream commit a18b6e30ecd69096beda4a0c96d2570900c3879a ]

The screen_buffer field in struct fb_info contains the kernel address of the first byte of framebuffer memory. Do not add the display offset. This offset only describes scrolling during scanout.

Signed-off-by Thomas Zimmermann <[email protected]>

Fixes de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")

Cc [email protected]

Cc <[email protected]> # v3.10+

Signed-off-by Thierry Reding <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/tegra/fbdev.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

drivers/gpu/drm/tegra/fbdev.c +2 -6

index ba0971ec34b5..d4ef5d5e4264 100644
@@ -78,7 +78,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
-	unsigned long offset;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;

@@ -118,9 +117,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 
 	drm_fb_helper_fill_info(info, helper, sizes);
 
-	offset = info->var.xoffset * bytes_per_pixel +
-		 info->var.yoffset * fb->pitches[0];
-
 	if (bo->pages) {
 		bo->vaddr = vmap(bo->pages, bo->num_pages, VM_MAP,
 				 pgprot_writecombine(PAGE_KERNEL));

@@ -132,9 +128,9 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	}
 
 	info->flags |= FBINFO_VIRTFB;
-	info->screen_buffer = bo->vaddr + offset;
+	info->screen_buffer = bo->vaddr;
 	info->screen_size = size;
-	info->fix.smem_start = (unsigned long)(bo->iova + offset);
+	info->fix.smem_start = (unsigned long)(bo->iova);
 	info->fix.smem_len = size;
 
 	return 0;

Signature · 1 line

2.53.0

[email protected]

author maintainer Applied

2026-08-07 12:15 UTC #3 lore raw

Patch "drm/tegra: fbdev: Remove offset into framebuffer memory" has been added to the 6.18-stable tree

This is a note to let you know that I've just added the patch titled

drm/tegra: fbdev: Remove offset into framebuffer memory

to the 6.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From [email protected] Fri Jul 31 04:41:11 2026
From: Sasha Levin <[email protected]>
Date: Thu, 30 Jul 2026 22:41:01 -0400
Subject: drm/tegra: fbdev: Remove offset into framebuffer memory
To: [email protected]
Cc: Thomas Zimmermann <[email protected]>, [email protected], [email protected], Thierry Reding <[email protected]>, Sasha Levin <[email protected]>
Message-ID: <[email protected]>

From: Thomas Zimmermann <[email protected]>

[ Upstream commit a18b6e30ecd69096beda4a0c96d2570900c3879a ]

The screen_buffer field in struct fb_info contains the kernel address of the first byte of framebuffer memory. Do not add the display offset. This offset only describes scrolling during scanout.

Signed-off-by Thomas Zimmermann <[email protected]>

Fixes de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")

Cc [email protected]

Cc <[email protected]> # v3.10+

Signed-off-by Thierry Reding <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/tegra/fbdev.c |    8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

drivers/gpu/drm/tegra/fbdev.c +2 -6

@@ -78,7 +78,6 @@ int tegra_fbdev_driver_fbdev_probe(struc
 	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
-	unsigned long offset;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;

@@ -118,9 +117,6 @@ int tegra_fbdev_driver_fbdev_probe(struc
 
 	drm_fb_helper_fill_info(info, helper, sizes);
 
-	offset = info->var.xoffset * bytes_per_pixel +
-		 info->var.yoffset * fb->pitches[0];
-
 	if (bo->pages) {
 		bo->vaddr = vmap(bo->pages, bo->num_pages, VM_MAP,
 				 pgprot_writecombine(PAGE_KERNEL));

@@ -132,9 +128,9 @@ int tegra_fbdev_driver_fbdev_probe(struc
 	}
 
 	info->flags |= FBINFO_VIRTFB;
-	info->screen_buffer = bo->vaddr + offset;
+	info->screen_buffer = bo->vaddr;
 	info->screen_size = size;
-	info->fix.smem_start = (unsigned long)(bo->iova + offset);
+	info->fix.smem_start = (unsigned long)(bo->iova);
 	info->fix.smem_len = size;
 
 	return 0;

Patches currently in stable-queue which might be from [email protected] are

queue-6.18/net-dsa-mt7530-check-bus-read-errors-in-the-mdio-reg.patch queue-6.18/drm-xe-guc-fix-buffer-overflow-in-steered-register-list-allocation.patch queue-6.18/drm-xe-rtp-de-whitelist-oa-registers-for-all-hwe-s-f.patch queue-6.18/media-uapi-rkisp-correct-name-version-enum.patch queue-6.18/net-sxgbe-free-tx-rings-on-rx-allocation-failure.patch queue-6.18/rtase-fix-double-free-of-multi-frag-skb-on-dma-map-f.patch queue-6.18/usb-typec-ucsi-fix-race-condition-and-ordering-in-port-unregistration.patch queue-6.18/asoc-sdca-ensure-that-control-range-is-large-enough-.patch queue-6.18/ice-suppress-dpll-errors-during-reset-recovery.patch queue-6.18/drivers-hv-allocate-the-paravisor-synic-pages-when-r.patch queue-6.18/scsi-ufs-core-avoid-irq-thread-wakeup-during-active-.patch queue-6.18/drm-fb-helper-allocate-and-release-fb_info-in-single-place.patch queue-6.18/drm-xe-rtp-maintain-oa-whitelists-separately.patch queue-6.18/pinctrl-qcom-sc8280xp-add-missing-wakeup-entries-for.patch queue-6.18/forcedeth-fix-uaf-of-txrx_stats-in-nv_remove.patch queue-6.18/hid-logitech-dj-standardise-hid_report_enum-variable.patch queue-6.18/scsi-libsas-fix-ha-resume-deadlock-and-hisi_sas-disk.patch queue-6.18/selftest-af_unix-create-its-own-.gitignore.patch queue-6.18/netfilter-nft_payload-fix-mask-build-for-partial-fie.patch queue-6.18/ptp-netc-fix-potential-interrupt-storm-caused-by-inc.patch queue-6.18/bluetooth-iso-fix-timeout-vs-sync_timeout-typo-in-ch.patch queue-6.18/net-sxgbe-check-descriptor-ring-allocation-failures.patch queue-6.18/bluetooth-iso-fix-data-race-on-iso_pi-sk-in-socket-a.patch queue-6.18/ipvs-fix-the-checksum-validations.patch queue-6.18/net-handshake-drain-pending-requests-at-net-namespac.patch queue-6.18/media-qcom-camss-csid-340-fix-unused-variables.patch queue-6.18/phy-qcom-m31-eusb2-fix-return-value-of-init-call.patch queue-6.18/hwmon-ina2xx-fix-various-overflow-issues.patch queue-6.18/spi-spi-cadence-move-tx-fifo-full-busy-wait-into-fif.patch queue-6.18/powerpc-boot-fix-simpleboot-cpu-node-lookup-check.patch queue-6.18/ata-sata_mv-accept-1-or-2-resources-in-platform-prob.patch queue-6.18/arch-x86-mshyperv-discover-confidential-vmbus-availa.patch queue-6.18/drm-xe-rtp-generalize-whitelist_apply_to_hwe.patch queue-6.18/wifi-mac80211-validate-individual-twt-params-before-.patch queue-6.18/drivers-hv-rename-fields-for-synic-message-and-event.patch queue-6.18/mm-hugetlb-fix-swap-entry-corruption-when-clearing-u.patch queue-6.18/selftests-af_unix-add-tests-for-econnreset-and-eof-s.patch queue-6.18/dmaengine-idxd-fix-fdev-setup-failure-cleanup-in-idx.patch queue-6.18/asoc-max98090-fix-missing-is_err-before-ptr_err-on-m.patch queue-6.18/keys-trusted-dcp-fix-key_len-validation-and-calc_blo.patch queue-6.18/drm-xe-oa-de-whitelist-oa-registers-on-oa-stream-ope.patch queue-6.18/drm-xe-rtp-save-oa-nonpriv-registers-to-register-sav.patch queue-6.18/bluetooth-hci_sync-remove-unnecessary-hci_conn_get-i.patch queue-6.18/drm-mediatek-check-crtc-state-before-freeing.patch queue-6.18/bluetooth-iso-clear-iso_data-always-when-detaching-c.patch queue-6.18/bluetooth-iso-fix-leaking-sk-after-socket-release.patch queue-6.18/accel-qaic-use-sizeof-trans_hdr-for-transaction-leng.patch queue-6.18/pinctrl-amd-don-t-clear-s4-wake-bits-at-probe.patch queue-6.18/net-bridge-mrp-fix-option-tlv-length-in-mrp_test-fra.patch queue-6.18/iommu-arm-smmu-v3-iommufd-require-exactly-one-stream.patch queue-6.18/selftests-net-af_unix-test-listen-rejects-wrong-sock.patch queue-6.18/file-ensure-cleanup.patch queue-6.18/drm-xe-rtp-refactor-oag-mmio-trigger-register-whitel.patch queue-6.18/hwmon-ina2xx-add-support-for-ina234.patch queue-6.18/powerpc-boot-fix-treeboot-currituck-cpu-node-lookup-.patch queue-6.18/mshv-fix-level-triggered-check-on-uninitialized-data.patch queue-6.18/keys-make-keyring-key-chunk-byte-order-agree-with-ke.patch queue-6.18/drm-xe-rtp-toggle-deny-bit-to-de-whitelist-oa-regs.patch queue-6.18/hwmon-adt7470-fix-fans-stuck-in-manual-mode-on-i2c-e.patch queue-6.18/af_unix-fix-listen-succeeding-on-sockets-in-the-wron.patch queue-6.18/btrfs-raid56-fix-an-incorrect-csum-skip-during-scrub.patch queue-6.18/ata-ahci_ceva-fix-error-paths-in-ceva_ahci_platform_.patch queue-6.18/qede-sync-udp_tunnel-ports-outside-qede_lock-in-the-.patch queue-6.18/netfs-release-readahead-folios-on-iterator-preparati.patch queue-6.18/tracing-mmiotrace-reset-dropped_count-in-mmio_reset_.patch queue-6.18/netfilter-nf_conntrack_sip-widen-nat-rewrite-delta-t.patch queue-6.18/selftests-seccomp-fix-pointer-type-mismatch-build-er.patch queue-6.18/netfs-handle-single-writeback-rolling-buffer-allocat.patch queue-6.18/usb-typec-ucsi-split-connector-lock-classes.patch queue-6.18/net-udp_tunnel-fix-memory-leak-in-udp_tunnel_nic_unr.patch queue-6.18/bluetooth-iso-validate-sockaddr_iso-first-in-iso_soc.patch queue-6.18/net-libwx-fix-fdir-atr-queue-mismatch-for-software-v.patch queue-6.18/riscv-mm-fix-out-of-bounds-page-table-walk-during-me.patch queue-6.18/netfilter-nf_tables-make-nft_object-rhltable-per-tab.patch queue-6.18/mm-huge_memory-unlock-i_mmap_rwsem-before-releasing-.patch queue-6.18/netfs-clear-pg_private_2-on-copy-to-cache-append-fai.patch queue-6.18/drm-i915-dp-ignore-the-sink-s-dsc-max-frl-rate-witho.patch queue-6.18/bluetooth-l2cap-fix-uaf-in-l2cap_le_connect_rsp.patch queue-6.18/scsi-zfcp-fix-memory-leak-during-adapter-release-by-.patch queue-6.18/hwmon-ina2xx-make-it-easier-to-add-more-devices.patch queue-6.18/net-dsa-mt7530-error-out-on-failed-reads-in-mt7531-p.patch queue-6.18/scsi-libiscsi_tcp-bound-scsi-response-data-segment-t.patch queue-6.18/bluetooth-iso-fix-refcounting-of-iso_conn.patch queue-6.18/net-handshake-hand-off-the-pinned-file-reference-to-.patch queue-6.18/mshv-fix-sleeping-under-spinlock-in-mshv_portid_allo.patch queue-6.18/mshv-adjust-interrupt-control-structure-for-arm64.patch queue-6.18/bluetooth-hci_conn-hold-conn-reference-in-abort_conn.patch queue-6.18/ipvs-do-not-mangle-icmp-replies-for-non-first-fragme.patch queue-6.18/phy-zynqmp-fix-clock-error-handling-in-xpsgtr_phy_in.patch queue-6.18/asoc-max98095-fix-missing-is_err-before-ptr_err-on-m.patch queue-6.18/mshv-fix-duplicate-gsi-detection-for-gsi-0.patch queue-6.18/hid-logitech-dj-fix-wrong-detection-of-bad-dj_short-.patch queue-6.18/rds-tcp-hold-the-rcu-lock-across-ipv6_chk_addr-in-rd.patch queue-6.18/bluetooth-iso-fix-connected-closed-transition-on-shu.patch queue-6.18/drm-xe-rtp-ensure-locking-ref-counting-for-oa-whitel.patch queue-6.18/hwmon-lm90-only-report-alarms-if-driver-is-ready.patch queue-6.18/drm-xe-rtp-keep-track-of-non-oa-nonpriv-slots.patch queue-6.18/mshv-order-pt_vp_array-publish-against-irqfd-asserti.patch queue-6.18/bluetooth-iso-hold-sk-properly-in-iso_conn_ready.patch queue-6.18/wifi-brcmfmac-drain-bus_reset-work-on-device-removal.patch queue-6.18/hwmon-adt7470-fix-divide-by-zero-toctou-crash-in-fan.patch queue-6.18/spi-spi-nxp-fspi-add-per-soc-sdr-dtr-clock-rate-limi.patch queue-6.18/of-reserved_mem-prevent-oob-when-too-many-dynamic-re.patch queue-6.18/hwmon-adt7470-fix-temperature-alarm-logic-in-hwmon_t.patch queue-6.18/btrfs-zoned-reset-meta_write_pointer-on-zone-reset.patch queue-6.18/ksmbd-return-success-for-deferred-final-close.patch queue-6.18/fprobe-fix-module-reference-count-leak-on-error-in-r.patch queue-6.18/bluetooth-iso-ensure-no-dangling-hcon-references-in-.patch queue-6.18/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch queue-6.18/scsi-ufs-core-cancel-rtc-work-in-active-active-suspe.patch queue-6.18/hwmon-adt7470-fix-cache-updated-before-hardware-writ.patch queue-6.18/assoc_array-trim-the-final-shortcut-word-using-the-c.patch queue-6.18/ksmbd-fix-use-after-free-in-__close_file_table_ids.patch queue-6.18/netfilter-xt_hashlimit-validate-hashtable-supports-x.patch queue-6.18/scsi-target-iblock-fix-wrong-pr-ops-null-check-for-p.patch queue-6.18/hwmon-adt7470-fix-swapped-pwm3-and-pwm4-auto-mode-ma.patch queue-6.18/media-chips-media-wave5-support-cbp-profile.patch queue-6.18/idpf-fix-mailbox-irq-name-leak-on-request-failure.patch queue-6.18/xsk-use-a-smaller-new-lock-for-shared-pool-case.patch queue-6.18/btrfs-fix-leaking-btrfs_fs_state_remounting-flag.patch queue-6.18/netfilter-br_netfilter-reallocate-headroom-if-necess.patch queue-6.18/idpf-adjust-txq-ring-count-minimum.patch queue-6.18/pinctrl-qcom-unconditionally-mark-gpio-as-wakeup-ena.patch queue-6.18/gpio-sloppy-logic-analyzer-fix-memory-leak-in-gpio_l.patch queue-6.18/file-add-fd_-add-prepare.patch queue-6.18/keys-fix-out-of-bounds-read-in-keyring_get_key_chunk.patch queue-6.18/drm-amdgpu-fix-context-pstate-override-handling.patch queue-6.18/hwmon-sht3x-fix-unaligned-accesses.patch queue-6.18/mm-slab-prevent-unbounded-recursion-in-free-path-wit.patch queue-6.18/fs-proc-task_mmu-fix-pagemap_scan-written-state-for-.patch queue-6.18/hwmon-adt7470-use-cached-pwm-frequency-value.patch queue-6.18/hwmon-pmbus-fix-return-value-from-pmbus_update_byte_.patch queue-6.18/iomap-add-a-separate-bio_set-for-iomap_split_ioend.patch queue-6.18/mshv-fix-race-in-mshv_irqfd_deassign.patch queue-6.18/selftests-lkdtm-rename-stackleak_erasing-to-kstack_e.patch queue-6.18/phy-zynqmp-fix-runtime-pm-leak-on-probe-allocation-f.patch queue-6.18/kvm-arm64-reject-guest_memfd-memslots-when-the-vm-ha.patch queue-6.18/scsi-libiscsi-fix-stale-data-leak-into-the-scsi-sens.patch queue-6.18/asoc-tas2781-use-correct-calibration-data-for-sinega.patch queue-6.18/tracing-mmiotrace-add-null-check-for-mmio_trace_arra.patch queue-6.18/bluetooth-iso-lock-sk-in-iso_sock_getname.patch queue-6.18/drm-xe-rtp-add-ring_force_to_nonpriv_deny-to-oa-whit.patch queue-6.18/x86-boot-add-volatile-clobbers-and-zero-length-test-.patch queue-6.18/net-handshake-take-a-long-lived-file-reference-at-su.patch queue-6.18/spi-spi-cadence-supports-transmission-with-bits_per_.patch queue-6.18/kunit-tool-skip-stty-when-stdin-is-not-a-tty.patch queue-6.18/ipvs-fix-places-with-wrong-packet-offsets.patch queue-6.18/net-handshake-convert-handshake_nl_accept_doit-to-fd.patch queue-6.18/hwmon-adt7470-fix-pwm-auto-temp-state-array-and-boun.patch queue-6.18/drm-gpusvm-publish-dpagemap-early-to-avoid-device-ma.patch queue-6.18/hwmon-ina2xx-shift-ina234-shunt-and-current-register.patch queue-6.18/scsi-ufs-core-revert-delegate-the-interrupt-service-.patch queue-6.18/xsk-fix-buffer-leak-in-xsk_drop_skb-for-af_xdp-multi.patch queue-6.18/media-qcom-camss-fix-rdi-streaming-for-csid-340.patch queue-6.18/bluetooth-hci_sync-make-hci_cmd_sync_run_once-return.patch queue-6.18/hwmon-adt7470-fix-busy-loop-and-i2c-flooding-in-upda.patch queue-6.18/bluetooth-iso-avoid-deadlocks-in-iso_sock_timeout.patch queue-6.18/hwmon-nct6775-core-fix-number-of-temperature-registe.patch queue-6.18/hwmon-nct6775-core-prevent-access-to-unsupported-wei.patch queue-6.18/dmaengine-sun6i-dma-fix-reclaim-descriptors-while-te.patch queue-6.18/sched-deadline-use-revised-wakeup-rule-only-for-runn.patch queue-6.18/rds-fix-inet6_addr_lst-null-dereference-when-ipv6-is.patch queue-6.18/net-handshake-close-the-submit-side-sock_hold-race.patch queue-6.18/bluetooth-iso-fix-not-updating-bis-sender-source-add.patch queue-6.18/smb-client-fix-buffer-leaks-in-smb1-read-and-write.patch queue-6.18/scsi-target-clear-cmd_cnt-when-initial-counter-enrol.patch queue-6.18/lib-alloc_tag-introduce-mem_alloc_profiling_permanen.patch queue-6.18/bluetooth-hci-add-initial-support-for-past.patch queue-6.18/bluetooth-hci_sync-fix-hci_conn_del-use-in-hci_le_cr.patch queue-6.18/net-phylink-put-link_gpio-if-phylink_create-fails.patch queue-6.18/btrfs-zoned-fix-deadlock-between-metadata-writeback-.patch queue-6.18/drm-i915-hdmi-poll-for-200-msec-for-tmds_scrambler_s.patch queue-6.18/net-handshake-fix-null-ptr-deref-in-handshake_comple.patch queue-6.18/hwmon-nzxt-smart2-dma-align-output-buffer.patch queue-6.18/drm-amdgpu-respect-placement-requirements-in-amdgpu_gtt_mgr-functions.patch queue-6.18/powerpc-boot-fix-treeboot-akebono-cpu-node-lookup-ch.patch queue-6.18/hwmon-ltc4282-fix-reading-the-minimum-alarm-voltage.patch queue-6.18/thunderbolt-prevent-xdomain-delayed-work-use-after-f.patch queue-6.18/alsa-hda-realtek-add-quirk-for-hp-dragonfly-folio-g3.patch queue-6.18/octeontx2-pf-set-correct-sequence-for-carrier-off-an.patch queue-6.18/net-mpls-initialize-rtm_tos-in-mpls_getroute.patch queue-6.18/userfaultfd-prevent-registration-of-special-vmas.patch queue-6.18/netfilter-nf_conntrack_expect-restore-helper-propaga.patch queue-6.18/bluetooth-iso-lock-sk-in-iso_connect_ind.patch queue-6.18/bluetooth-btintel-validate-length-before-parsing-dia.patch queue-6.18/net-ethernet-mtk_eth_soc-pass-eth-to-mtk_handle_irq_.patch queue-6.18/riscv-drop-__init-from-vec_check_unaligned_access_sp.patch queue-6.18/drivers-hv-vmbus-replace-lockdep_hardirq_threaded-wi.patch queue-6.18/hid-logitech-dj-prevent-report_id_dj_short-related-u.patch queue-6.18/net-do-not-send-icmp-ndisc-redirects-when-peer-alloc.patch queue-6.18/xsk-drain-continuation-descs-after-overflow-in-xsk_b.patch queue-6.18/kunit-tool-terminate-kernel-under-test-on-sigint.patch queue-6.18/can-isotp-check-register_netdevice_notifier-error-in.patch