FAILED: patch "[PATCH] drm/tegra: fbdev: Remove offset into framebuffer memory" failed to apply to 6.6-stable tree
[email protected]
maintainerThe patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x a18b6e30ecd69096beda4a0c96d2570900c3879a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026072952-backward-riveting-1863@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a18b6e30ecd69096beda4a0c96d2570900c3879a Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <[email protected]>
Date: Tue, 21 Apr 2026 09:29:06 +0200
Subject: [PATCH] drm/tegra: fbdev: Remove offset into framebuffer memory
The screen_buffer field in struct fb_info contains the kernel address of the first byte of framebuffer memory. Do not add the display offset. This offset only describes scrolling during scanout.
drivers/gpu/drm/tegra/fbdev.c +2 -6
@@ -76,7 +76,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,struct fb_info *info = helper->info;unsigned int bytes_per_pixel;struct drm_framebuffer *fb; -unsigned long offset;struct tegra_bo *bo;size_t size;int err;
@@ -115,9 +114,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,drm_fb_helper_fill_info (info, helper, sizes); - offset = info->var.xoffset * bytes_per_pixel + - info->var.yoffset * fb->pitches[0 ]; -if (bo->pages) { bo->vaddr =vmap (bo->pages, bo->num_pages,VM_MAP ,pgprot_writecombine (PAGE_KERNEL ));
@@ -129,9 +125,9 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper, } info->flags |=FBINFO_VIRTFB ; - info->screen_buffer = bo->vaddr + offset; + info->screen_buffer = bo->vaddr; info->screen_size = size; - info->fix.smem_start = (unsigned long )(bo->iova + offset); + info->fix.smem_start = (unsigned long )(bo->iova); info->fix.smem_len = size;return 0 ;
Sasha Levin
maintainerPATCH 1/2 drm/fb-helper: Allocate and release fb_info in single place
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 63c971af40365ee706c7e24f6a7900d693518f09 ]
Move the calls to drm_fb_helper_alloc_info() from drivers into a single place in fbdev helpers. Allocates struct fb_info for a new framebuffer device. Then call drm_fb_helper_single_fb_probe() to create an fbdev screen buffer. Also release the instance on errors by calling drm_fb_helper_release_info().
Simplifies the code and fixes the error cleanup for some of the drivers.
Regular release of the struct fb_info instance still happens in drm_fb_helper_fini() as before.
v2:
- remove error rollback in driver implementations (kernel test robot)
- initialize info in TTM implementation (kernel test robot)
Stable-dep-of: a18b6e30ecd6 ("drm/tegra: fbdev: Remove offset into framebuffer memory")
--- drivers/gpu/drm/armada/armada_fbdev.c | 12 +------ drivers/gpu/drm/drm_fb_helper.c | 41 ++++++++-------------- drivers/gpu/drm/drm_fbdev_dma.c | 12 +------ drivers/gpu/drm/drm_fbdev_generic.c | 12 ++----- drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 9 +---- drivers/gpu/drm/gma500/fbdev.c | 13 +------ drivers/gpu/drm/i915/display/intel_fbdev.c | 9 +---- drivers/gpu/drm/msm/msm_fbdev.c | 9 +---- drivers/gpu/drm/omapdrm/omap_fbdev.c | 9 +---- drivers/gpu/drm/radeon/radeon_fbdev.c | 13 +------ drivers/gpu/drm/tegra/fbdev.c | 9 +---- include/drm/drm_fb_helper.h | 12 ------- 12 files changed, 25 insertions(+), 135 deletions(-)
drivers/gpu/drm/armada/armada_fbdev.c +1 -11
@@ -43,10 +43,10 @@ static int armada_fbdev_create(struct drm_fb_helper *fbh, struct drm_fb_helper_surface_size *sizes) {struct drm_device *dev = fbh->dev; +struct fb_info *info = fbh->info;struct drm_mode_fb_cmd2 mode;struct armada_framebuffer *dfb;struct armada_gem_object *obj; -struct fb_info *info;int size, ret;void *ptr;
@@ -87,12 +87,6 @@ static int armada_fbdev_create(struct drm_fb_helper *fbh,if (IS_ERR (dfb))return PTR_ERR (dfb); - info =drm_fb_helper_alloc_info (fbh); -if (IS_ERR (info)) { - ret =PTR_ERR (info); - goto err_fballoc; - } - info->fbops = &armada_fb_ops; info->fix.smem_start = obj->phys_addr; info->fix.smem_len = obj->obj.size;
@@ -107,10 +101,6 @@ static int armada_fbdev_create(struct drm_fb_helper *fbh, (unsigned long long)obj->phys_addr);return 0 ; - - err_fballoc: - dfb->fb.funcs->destroy (&dfb->fb); -return ret; } static int armada_fb_probe(struct drm_fb_helper *fbh,
drivers/gpu/drm/drm_fb_helper.c +14 -27
83 lines not on this page · raw message
drivers/gpu/drm/drm_fbdev_dma.c +1 -11
@@ -78,10 +78,10 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper, {struct drm_client_dev *client = &fb_helper->client;struct drm_device *dev = fb_helper->dev; +struct fb_info *info = fb_helper->info;struct drm_client_buffer *buffer;struct drm_gem_dma_object *dma_obj;struct drm_framebuffer *fb; -struct fb_info *info;u32 format;struct iosys_map map;int ret;
@@ -114,12 +114,6 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper, fb_helper->buffer = buffer; fb_helper->fb = buffer->fb; - info =drm_fb_helper_alloc_info (fb_helper); -if (IS_ERR (info)) { - ret =PTR_ERR (info); - goto err_drm_client_buffer_vunmap; - } -drm_fb_helper_fill_info (info, fb_helper, sizes); info->fbops = &drm_fbdev_dma_fb_ops;
@@ -138,10 +132,6 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper,return 0 ; -err_drm_client_buffer_vunmap: - fb_helper->fb =NULL ; - fb_helper->buffer =NULL ; -drm_client_buffer_vunmap (buffer); err_drm_client_buffer_delete:drm_client_framebuffer_delete (buffer);return ret;
drivers/gpu/drm/drm_fbdev_generic.c +2 -10
@@ -73,8 +73,8 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper, {struct drm_client_dev *client = &fb_helper->client;struct drm_device *dev = fb_helper->dev; +struct fb_info *info = fb_helper->info;struct drm_client_buffer *buffer; -struct fb_info *info;size_t screen_size;void *screen_buffer;u32 format;
@@ -100,12 +100,6 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper, goto err_drm_client_framebuffer_delete; } - info =drm_fb_helper_alloc_info (fb_helper); -if (IS_ERR (info)) { - ret =PTR_ERR (info); - goto err_vfree; - } -drm_fb_helper_fill_info (info, fb_helper, sizes); info->fbops = &drm_fbdev_generic_fb_ops;
@@ -122,12 +116,10 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper, info->fbdefio = &fb_helper->fbdefio; ret =fb_deferred_io_init (info);if (ret) - goto err_drm_fb_helper_release_info; + goto err_vfree;return 0 ; -err_drm_fb_helper_release_info: -drm_fb_helper_release_info (fb_helper); err_vfree:vfree (screen_buffer); err_drm_client_framebuffer_delete:
drivers/gpu/drm/exynos/exynos_drm_fbdev.c +1 -8
@@ -60,18 +60,11 @@ static int exynos_drm_fbdev_update(struct drm_fb_helper *helper,struct drm_fb_helper_surface_size *sizes, struct exynos_drm_gem *exynos_gem) { - struct fb_info *fbi; + struct fb_info *fbi = helper->info;struct drm_framebuffer *fb = helper->fb;unsigned int size = fb->width * fb->height * fb->format->cpp[0 ];unsigned long offset; - fbi =drm_fb_helper_alloc_info (helper); -if (IS_ERR (fbi)) { -DRM_DEV_ERROR (to_dma_dev (helper->dev), -"failed to allocate fb info.\n" ); -return PTR_ERR (fbi); - } - fbi->fbops = &exynos_drm_fb_ops;drm_fb_helper_fill_info (fbi, helper, sizes);
drivers/gpu/drm/gma500/fbdev.c +1 -12
@@ -110,7 +110,7 @@ static int psb_fbdev_fb_probe(struct drm_fb_helper *fb_helper,struct drm_device *dev = fb_helper->dev;struct drm_psb_private *dev_priv =to_drm_psb_private (dev);struct pci_dev *pdev =to_pci_dev (dev->dev); -struct fb_info *info; +struct fb_info *info = fb_helper->info;struct drm_framebuffer *fb;struct drm_mode_fb_cmd2 mode_cmd = { };int size;
@@ -165,12 +165,6 @@ static int psb_fbdev_fb_probe(struct drm_fb_helper *fb_helper, fb_helper->fb = fb; - info =drm_fb_helper_alloc_info (fb_helper); -if (IS_ERR (info)) { - ret =PTR_ERR (info); - goto err_drm_framebuffer_unregister_private; - } - info->fbops = &psb_fbdev_fb_ops;/* Accessed stolen memory directly */
@@ -194,11 +188,6 @@ static int psb_fbdev_fb_probe(struct drm_fb_helper *fb_helper,return 0 ; -err_drm_framebuffer_unregister_private: -drm_framebuffer_unregister_private (fb); - fb->obj[0 ] =NULL ; -drm_framebuffer_cleanup (fb); -kfree (fb); err_drm_gem_object_put:drm_gem_object_put (obj);return ret;
drivers/gpu/drm/i915/display/intel_fbdev.c +1 -8
@@ -218,7 +218,7 @@ static int intelfb_create(struct drm_fb_helper *helper, .type = I915_GTT_VIEW_NORMAL, };intel_wakeref_t wakeref; -struct fb_info *info; +struct fb_info *info = helper->info;struct i915_vma *vma;unsigned long flags =0 ;bool prealloc = false;
@@ -271,13 +271,6 @@ static int intelfb_create(struct drm_fb_helper *helper, goto out_unlock; } - info =drm_fb_helper_alloc_info (helper); -if (IS_ERR (info)) { -drm_err (&dev_priv->drm,"Failed to allocate fb_info (%pe)\n" , info); - ret =PTR_ERR (info); - goto out_unpin; - } - ifbdev->helper.fb = &ifbdev->fb->base; info->fbops = &intelfb_ops;
drivers/gpu/drm/msm/msm_fbdev.c +1 -8
@@ -70,9 +70,9 @@ static int msm_fbdev_create(struct drm_fb_helper *helper, {struct drm_device *dev = helper->dev;struct msm_drm_private *priv = dev->dev_private; +struct fb_info *fbi = helper->info;struct drm_framebuffer *fb =NULL ;struct drm_gem_object *bo; -struct fb_info *fbi =NULL ;uint64_t paddr;uint32_t format;int ret, pitch;
@@ -105,13 +105,6 @@ static int msm_fbdev_create(struct drm_fb_helper *helper, goto fail; } - fbi =drm_fb_helper_alloc_info (helper); -if (IS_ERR (fbi)) { -DRM_DEV_ERROR (dev->dev,"failed to allocate fb info\n" ); - ret =PTR_ERR (fbi); - goto fail; - } -DBG ("fbi=%p, dev=%p" , fbi, dev); helper->fb = fb;
drivers/gpu/drm/omapdrm/omap_fbdev.c +1 -8
@@ -131,9 +131,9 @@ static int omap_fbdev_create(struct drm_fb_helper *helper,struct omap_fbdev *fbdev =to_omap_fbdev (helper);struct drm_device *dev = helper->dev;struct omap_drm_private *priv = dev->dev_private; +struct fb_info *fbi = helper->info;struct drm_framebuffer *fb =NULL ;union omap_gem_size gsize; -struct fb_info *fbi =NULL ;struct drm_mode_fb_cmd2 mode_cmd = {0 };struct drm_gem_object *bo;dma_addr_t dma_addr;
@@ -199,13 +199,6 @@ static int omap_fbdev_create(struct drm_fb_helper *helper, goto fail; } - fbi =drm_fb_helper_alloc_info (helper); -if (IS_ERR (fbi)) { -dev_err (dev->dev,"failed to allocate fb info\n" ); - ret =PTR_ERR (fbi); - goto fail; - } -DBG ("fbi=%p, dev=%p" , fbi, dev); helper->fb = fb;
drivers/gpu/drm/radeon/radeon_fbdev.c +1 -12
@@ -207,7 +207,7 @@ static int radeon_fbdev_fb_helper_fb_probe(struct drm_fb_helper *fb_helper, {struct radeon_device *rdev = fb_helper->dev->dev_private;struct drm_mode_fb_cmd2 mode_cmd = { }; -struct fb_info *info; +struct fb_info *info = fb_helper->info;struct drm_gem_object *gobj;struct radeon_bo *rbo;struct drm_framebuffer *fb;
@@ -245,13 +245,6 @@ static int radeon_fbdev_fb_helper_fb_probe(struct drm_fb_helper *fb_helper,/* setup helper */ fb_helper->fb = fb; -/* okay we have an object now allocate the framebuffer */ - info =drm_fb_helper_alloc_info (fb_helper); -if (IS_ERR (info)) { - ret =PTR_ERR (info); - goto err_drm_framebuffer_unregister_private; - } - info->fbops = &radeon_fbdev_fb_ops;/* radeon resume is fragile and needs a vt switch to help it along */
@@ -277,10 +270,6 @@ static int radeon_fbdev_fb_helper_fb_probe(struct drm_fb_helper *fb_helper,return 0 ; -err_drm_framebuffer_unregister_private: - fb_helper->fb =NULL ; -drm_framebuffer_unregister_private (fb); -drm_framebuffer_cleanup (fb); err_kfree:kfree (fb); err_radeon_fbdev_destroy_pinned_object:
drivers/gpu/drm/tegra/fbdev.c +1 -8
@@ -72,10 +72,10 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,struct tegra_drm *tegra = helper->dev->dev_private;struct drm_device *drm = helper->dev;struct drm_mode_fb_cmd2 cmd = {0 }; +struct fb_info *info = helper->info;unsigned int bytes_per_pixel;struct drm_framebuffer *fb;unsigned long offset; -struct fb_info *info;struct tegra_bo *bo;size_t size;int err;
@@ -96,13 +96,6 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,if (IS_ERR (bo))return PTR_ERR (bo); - info =drm_fb_helper_alloc_info (helper); -if (IS_ERR (info)) { -dev_err (drm->dev,"failed to allocate framebuffer info\n" ); -drm_gem_object_put (&bo->gem); -return PTR_ERR (info); - } - fb =tegra_fb_alloc (drm, &cmd, &bo,1 );if (IS_ERR (fb)) { err =PTR_ERR (fb);
include/drm/drm_fb_helper.h +0 -12
@@ -246,8 +246,6 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,int drm_fb_helper_restore_fbdev_mode_unlocked (struct drm_fb_helper *fb_helper); -struct fb_info *drm_fb_helper_alloc_info (struct drm_fb_helper *fb_helper); -void drm_fb_helper_release_info (struct drm_fb_helper *fb_helper);void drm_fb_helper_unregister_info (struct drm_fb_helper *fb_helper); void drm_fb_helper_fill_info(struct fb_info *info, struct drm_fb_helper *fb_helper,
@@ -330,16 +328,6 @@ drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)return 0 ; } -static inline struct fb_info * -drm_fb_helper_alloc_info (struct drm_fb_helper *fb_helper) -{ -return NULL ; -} - -static inline void drm_fb_helper_release_info (struct drm_fb_helper *fb_helper) -{ -} -static inline void drm_fb_helper_unregister_info (struct drm_fb_helper *fb_helper) { }
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 drm/tegra: fbdev: Remove offset into framebuffer memory
From: Thomas Zimmermann <[email protected]>
[ Upstream commit a18b6e30ecd69096beda4a0c96d2570900c3879a ]
The screen_buffer field in struct fb_info contains the kernel address of the first byte of framebuffer memory. Do not add the display offset. This offset only describes scrolling during scanout.
--- drivers/gpu/drm/tegra/fbdev.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/gpu/drm/tegra/fbdev.c +2 -6
@@ -75,7 +75,6 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,struct fb_info *info = helper->info;unsigned int bytes_per_pixel;struct drm_framebuffer *fb; -unsigned long offset;struct tegra_bo *bo;size_t size;int err;
@@ -112,9 +111,6 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,drm_fb_helper_fill_info (info, helper, sizes); - offset = info->var.xoffset * bytes_per_pixel + - info->var.yoffset * fb->pitches[0 ]; -if (bo->pages) { bo->vaddr =vmap (bo->pages, bo->num_pages,VM_MAP ,pgprot_writecombine (PAGE_KERNEL ));
@@ -126,9 +122,9 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper, } info->flags |=FBINFO_VIRTFB ; - info->screen_buffer = bo->vaddr + offset; + info->screen_buffer = bo->vaddr; info->screen_size = size; - info->fix.smem_start = (unsigned long )(bo->iova + offset); + info->fix.smem_start = (unsigned long )(bo->iova); info->fix.smem_len = size;return 0 ;
Signature · 1 line
2.53.0
Patch "drm/tegra: fbdev: Remove offset into framebuffer memory" has been added to the 6.6-stable tree
This is a note to let you know that I've just added the patch titled
drm/tegra: fbdev: Remove offset into framebuffer memory
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
From [email protected] Fri Jul 31 18:00:34 2026
From: Sasha Levin <[email protected]>
Date: Fri, 31 Jul 2026 11:50:20 -0400
Subject: drm/tegra: fbdev: Remove offset into framebuffer memory
To: [email protected]
Cc: Thomas Zimmermann <[email protected]>, [email protected], [email protected], Thierry Reding <[email protected]>, Sasha Levin <[email protected]>
Message-ID: <[email protected]>
From: Thomas Zimmermann <[email protected]>
[ Upstream commit a18b6e30ecd69096beda4a0c96d2570900c3879a ]
The screen_buffer field in struct fb_info contains the kernel address of the first byte of framebuffer memory. Do not add the display offset. This offset only describes scrolling during scanout.
--- drivers/gpu/drm/tegra/fbdev.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/gpu/drm/tegra/fbdev.c +2 -6
@@ -75,7 +75,6 @@ static int tegra_fbdev_probe(struct drm_struct fb_info *info = helper->info;unsigned int bytes_per_pixel;struct drm_framebuffer *fb; -unsigned long offset;struct tegra_bo *bo;size_t size;int err;
@@ -112,9 +111,6 @@ static int tegra_fbdev_probe(struct drm_drm_fb_helper_fill_info (info, helper, sizes); - offset = info->var.xoffset * bytes_per_pixel + - info->var.yoffset * fb->pitches[0 ]; -if (bo->pages) { bo->vaddr =vmap (bo->pages, bo->num_pages,VM_MAP ,pgprot_writecombine (PAGE_KERNEL ));
@@ -126,9 +122,9 @@ static int tegra_fbdev_probe(struct drm_ } info->flags |=FBINFO_VIRTFB ; - info->screen_buffer = bo->vaddr + offset; + info->screen_buffer = bo->vaddr; info->screen_size = size; - info->fix.smem_start = (unsigned long )(bo->iova + offset); + info->fix.smem_start = (unsigned long )(bo->iova); info->fix.smem_len = size;return 0 ;
Patches currently in stable-queue which might be from [email protected] are
queue-6.6/sysctl-treewide-constify-ctl_table_header-ctl_table_arg.patch queue-6.6/wifi-brcmfmac-set-f2-blocksize-to-256-for-bcm43752.patch queue-6.6/usb-gadget-f_tcm-synchronize-delayed-set_alt-with-teardown.patch queue-6.6/net-sxgbe-free-tx-rings-on-rx-allocation-failure.patch queue-6.6/usb-typec-ucsi-fix-race-condition-and-ordering-in-port-unregistration.patch queue-6.6/drm-fb-helper-allocate-and-release-fb_info-in-single-place.patch queue-6.6/pinctrl-qcom-sc8280xp-add-missing-wakeup-entries-for.patch queue-6.6/forcedeth-fix-uaf-of-txrx_stats-in-nv_remove.patch queue-6.6/hid-logitech-dj-standardise-hid_report_enum-variable.patch queue-6.6/scsi-libsas-fix-ha-resume-deadlock-and-hisi_sas-disk.patch queue-6.6/netfilter-nft_payload-fix-mask-build-for-partial-fie.patch queue-6.6/bluetooth-iso-fix-timeout-vs-sync_timeout-typo-in-ch.patch queue-6.6/net-sxgbe-check-descriptor-ring-allocation-failures.patch queue-6.6/ipvs-fix-the-checksum-validations.patch queue-6.6/mptcp-pm-avoid-code-duplication-to-lookup-endp.patch queue-6.6/spi-spi-cadence-move-tx-fifo-full-busy-wait-into-fif.patch queue-6.6/powerpc-boot-fix-simpleboot-cpu-node-lookup-check.patch queue-6.6/ata-sata_mv-accept-1-or-2-resources-in-platform-prob.patch queue-6.6/wifi-mac80211-validate-individual-twt-params-before-.patch queue-6.6/mm-hugetlb-fix-swap-entry-corruption-when-clearing-u.patch queue-6.6/dmaengine-idxd-fix-fdev-setup-failure-cleanup-in-idx.patch queue-6.6/asoc-max98090-fix-missing-is_err-before-ptr_err-on-m.patch queue-6.6/mptcp-pm-use-addr-entry-for-get_local_id.patch queue-6.6/sched-add-task_struct-faults_disabled_mapping.patch queue-6.6/libceph-add-doutc-and-_client-debug-macros-support.patch queue-6.6/gve-fix-rx-queue-stall-on-alloc-failure.patch queue-6.6/bluetooth-hci_sync-remove-unnecessary-hci_conn_get-i.patch queue-6.6/drm-mediatek-check-crtc-state-before-freeing.patch queue-6.6/usb-musb-omap2430-clean-up-probe-error-handling.patch queue-6.6/bluetooth-iso-clear-iso_data-always-when-detaching-c.patch queue-6.6/accel-qaic-use-sizeof-trans_hdr-for-transaction-leng.patch queue-6.6/pinctrl-amd-don-t-clear-s4-wake-bits-at-probe.patch queue-6.6/net-bridge-mrp-fix-option-tlv-length-in-mrp_test-fra.patch queue-6.6/gpio-pch-use-raw_spinlock_t-for-the-register-lock.patch queue-6.6/powerpc-boot-fix-treeboot-currituck-cpu-node-lookup-.patch queue-6.6/wifi-ath6kl-fix-use-after-free-in-aggr_reset_state.patch queue-6.6/wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-labelled-as-cypress-cyw.patch queue-6.6/keys-make-keyring-key-chunk-byte-order-agree-with-ke.patch queue-6.6/hwmon-adt7470-fix-fans-stuck-in-manual-mode-on-i2c-e.patch queue-6.6/ata-ahci_ceva-fix-error-paths-in-ceva_ahci_platform_.patch queue-6.6/qede-sync-udp_tunnel-ports-outside-qede_lock-in-the-.patch queue-6.6/tracing-mmiotrace-reset-dropped_count-in-mmio_reset_.patch queue-6.6/netfilter-nf_conntrack_sip-widen-nat-rewrite-delta-t.patch queue-6.6/usb-typec-ucsi-split-connector-lock-classes.patch queue-6.6/ahci-introduce-ahci_ignore_port-helper.patch queue-6.6/mm-huge_memory-unlock-i_mmap_rwsem-before-releasing-.patch queue-6.6/bluetooth-l2cap-fix-uaf-in-l2cap_le_connect_rsp.patch queue-6.6/scsi-zfcp-fix-memory-leak-during-adapter-release-by-.patch queue-6.6/mptcp-pm-userspace-fix-use-after-free-in-get_local_id.patch queue-6.6/net-dsa-mt7530-error-out-on-failed-reads-in-mt7531-p.patch queue-6.6/scsi-libiscsi_tcp-bound-scsi-response-data-segment-t.patch queue-6.6/bluetooth-hci_conn-hold-conn-reference-in-abort_conn.patch queue-6.6/ipvs-do-not-mangle-icmp-replies-for-non-first-fragme.patch queue-6.6/phy-zynqmp-fix-clock-error-handling-in-xpsgtr_phy_in.patch queue-6.6/asoc-max98095-fix-missing-is_err-before-ptr_err-on-m.patch queue-6.6/hid-logitech-dj-fix-wrong-detection-of-bad-dj_short-.patch queue-6.6/rds-tcp-hold-the-rcu-lock-across-ipv6_chk_addr-in-rd.patch queue-6.6/hwmon-lm90-only-report-alarms-if-driver-is-ready.patch queue-6.6/ceph-print-cluster-fsid-and-client-global_id-in-all-debug-logs.patch queue-6.6/media-v4l2-fwnode-fix-subdev-owner-overwritten-in-v4l2_async_register_subdev_sensor.patch queue-6.6/wifi-brcmfmac-drain-bus_reset-work-on-device-removal.patch queue-6.6/hwmon-adt7470-fix-divide-by-zero-toctou-crash-in-fan.patch queue-6.6/mptcp-add-mptcp_userspace_pm_lookup_addr-helper.patch queue-6.6/hwmon-adt7470-fix-temperature-alarm-logic-in-hwmon_t.patch queue-6.6/ksmbd-return-success-for-deferred-final-close.patch queue-6.6/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch queue-6.6/drm-renesas-move-rz-g2l-mipi-dsi-driver-to-rz-du.patch queue-6.6/scsi-ufs-core-cancel-rtc-work-in-active-active-suspe.patch queue-6.6/hwmon-adt7470-fix-cache-updated-before-hardware-writ.patch queue-6.6/assoc_array-trim-the-final-shortcut-word-using-the-c.patch queue-6.6/usb-musb-omap2430-do-not-put-borrowed-of_node-in-probe.patch queue-6.6/ksmbd-fix-use-after-free-in-__close_file_table_ids.patch queue-6.6/netfilter-xt_hashlimit-validate-hashtable-supports-x.patch queue-6.6/scsi-target-iblock-fix-wrong-pr-ops-null-check-for-p.patch queue-6.6/hwmon-adt7470-fix-swapped-pwm3-and-pwm4-auto-mode-ma.patch queue-6.6/media-i2c-imx219-access-height-from-active-format-in-imx219_set_ctrl.patch queue-6.6/usb-typec-ucsi-only-enable-supported-notifications.patch queue-6.6/drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch queue-6.6/ipv6-fib6-fix-null-deref-in-fib6_walk_continue-on-mu.patch queue-6.6/netfilter-br_netfilter-reallocate-headroom-if-necess.patch queue-6.6/keys-fix-out-of-bounds-read-in-keyring_get_key_chunk.patch queue-6.6/hwmon-adt7470-use-cached-pwm-frequency-value.patch queue-6.6/hwmon-pmbus-fix-return-value-from-pmbus_update_byte_.patch queue-6.6/phy-zynqmp-fix-runtime-pm-leak-on-probe-allocation-f.patch queue-6.6/scsi-libiscsi-fix-stale-data-leak-into-the-scsi-sens.patch queue-6.6/soc-qcom-ice-allow-explicit-votes-on-iface-clock-for.patch queue-6.6/spi-spi-cadence-supports-transmission-with-bits_per_.patch queue-6.6/sctp-close-udp-tunnel-sockets-during-netns-teardown.patch queue-6.6/ipvs-fix-places-with-wrong-packet-offsets.patch queue-6.6/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch queue-6.6/hwmon-adt7470-fix-pwm-auto-temp-state-array-and-boun.patch queue-6.6/bluetooth-hci_sync-make-hci_cmd_sync_run_once-return.patch queue-6.6/hwmon-adt7470-fix-busy-loop-and-i2c-flooding-in-upda.patch queue-6.6/rxrpc-fix-irq-disabled-in-local_bh_enable.patch queue-6.6/hwmon-nct6775-core-fix-number-of-temperature-registe.patch queue-6.6/hwmon-nct6775-core-prevent-access-to-unsupported-wei.patch queue-6.6/dmaengine-sun6i-dma-fix-reclaim-descriptors-while-te.patch queue-6.6/media-i2c-imx219-drop-imx219_vts_-macros.patch queue-6.6/rds-fix-inet6_addr_lst-null-dereference-when-ipv6-is.patch queue-6.6/media-i2c-imx219-rename-vts-to-frm_length.patch queue-6.6/smb-client-fix-buffer-leaks-in-smb1-read-and-write.patch queue-6.6/scsi-target-clear-cmd_cnt-when-initial-counter-enrol.patch queue-6.6/bluetooth-hci_sync-fix-hci_conn_del-use-in-hci_le_cr.patch queue-6.6/net-phylink-put-link_gpio-if-phylink_create-fails.patch queue-6.6/btrfs-zoned-fix-deadlock-between-metadata-writeback-.patch queue-6.6/media-imx219-fix-maximum-frame-length-in-lines.patch queue-6.6/media-i2c-imx219-group-functions-by-purpose.patch queue-6.6/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch queue-6.6/media-i2c-imx219-don-t-store-the-current-mode-in-the-imx219-structure.patch queue-6.6/hwmon-nzxt-smart2-dma-align-output-buffer.patch queue-6.6/rhashtable-clear-stale-iter-p-on-table-restart.patch queue-6.6/drm-amdgpu-respect-placement-requirements-in-amdgpu_gtt_mgr-functions.patch queue-6.6/powerpc-boot-fix-treeboot-akebono-cpu-node-lookup-ch.patch queue-6.6/media-v4l-async-set-owner-for-async-sub-devices.patch queue-6.6/thunderbolt-prevent-xdomain-delayed-work-use-after-f.patch queue-6.6/netfilter-nf_tables-clone-set-on-flush-only.patch queue-6.6/ata-libahci_platform-support-non-consecutive-port-nu.patch queue-6.6/octeontx2-pf-set-correct-sequence-for-carrier-off-an.patch queue-6.6/net-mpls-initialize-rtm_tos-in-mpls_getroute.patch queue-6.6/ceph-fix-refcount-leak-in-ceph_readdir.patch queue-6.6/netfilter-nf_conntrack_expect-restore-helper-propaga.patch queue-6.6/bluetooth-btintel-validate-length-before-parsing-dia.patch queue-6.6/firmware-stratix10-svc-fix-memory-leaks-and-list-cor.patch queue-6.6/hid-logitech-dj-prevent-report_id_dj_short-related-u.patch queue-6.6/sctp-avoid-auth_enable-sysctl-uaf-during-netns-teardown.patch queue-6.6/iommu-sva-move-x86-disable-check-before-allocation.patch queue-6.6/media-i2c-imx219-calculate-crop-rectangle-dynamically.patch queue-6.6/net-do-not-send-icmp-ndisc-redirects-when-peer-alloc.patch queue-6.6/phy-zynqmp-postpone-getting-clock-rate-until-actuall.patch queue-6.6/can-isotp-check-register_netdevice_notifier-error-in.patch