FAILED: patch "[PATCH] drm/tegra: fbdev: Remove offset into framebuffer memory" failed to apply to 6.6-stable tree

FAILED: patch "[PATCH] drm/tegra: fbdev: Remove offset into framebuffer memory" failed to apply to 6.6-stable tree

[gregkh]

The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x a18b6e30ecd69096beda4a0c96d2570900c3879a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026072952-backward-riveting-1863@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From a18b6e30ecd69096beda4a0c96d2570900c3879a Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Tue, 21 Apr 2026 09:29:06 +0200
Subject: [PATCH] drm/tegra: fbdev: Remove offset into framebuffer memory

The screen_buffer field in struct fb_info contains the kernel address
of the first byte of framebuffer memory. Do not add the display offset.
This offset only describes scrolling during scanout.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")
Cc: dri-devel@lists.freedesktop.org
Cc: linux-tegra@vger.kernel.org
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260421073646.144712-3-tzimmermann@suse.de

diff --git a/drivers/gpu/drm/tegra/fbdev.c b/drivers/gpu/drm/tegra/fbdev.c
index 19e39fa54bfa..793849199783 100644
--- a/drivers/gpu/drm/tegra/fbdev.c
+++ b/drivers/gpu/drm/tegra/fbdev.c
@@ -76,7 +76,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
-	unsigned long offset;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;
@@ -115,9 +114,6 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 
 	drm_fb_helper_fill_info(info, helper, sizes);
 
-	offset = info->var.xoffset * bytes_per_pixel +
-		 info->var.yoffset * fb->pitches[0];
-
 	if (bo->pages) {
 		bo->vaddr = vmap(bo->pages, bo->num_pages, VM_MAP,
 				 pgprot_writecombine(PAGE_KERNEL));
@@ -129,9 +125,9 @@ int tegra_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
 	}
 
 	info->flags |= FBINFO_VIRTFB;
-	info->screen_buffer = bo->vaddr + offset;
+	info->screen_buffer = bo->vaddr;
 	info->screen_size = size;
-	info->fix.smem_start = (unsigned long)(bo->iova + offset);
+	info->fix.smem_start = (unsigned long)(bo->iova);
 	info->fix.smem_len = size;
 
 	return 0;

[PATCH 6.6.y 1/2] drm/fb-helper: Allocate and release fb_info in single place

[Sasha Levin]

From: Thomas Zimmermann <tzimmermann@suse.de>

[ Upstream commit 63c971af40365ee706c7e24f6a7900d693518f09 ]

Move the calls to drm_fb_helper_alloc_info() from drivers into a
single place in fbdev helpers. Allocates struct fb_info for a new
framebuffer device. Then call drm_fb_helper_single_fb_probe() to
create an fbdev screen buffer. Also release the instance on errors
by calling drm_fb_helper_release_info().

Simplifies the code and fixes the error cleanup for some of the
drivers.

Regular release of the struct fb_info instance still happens in
drm_fb_helper_fini() as before.

v2:
- remove error rollback in driver implementations (kernel test robot)
- initialize info in TTM implementation (kernel test robot)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Acked-by: Christian König <christian.koenig@amd.com> # radeon
Acked-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> # msm
Acked-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20251027081245.80262-1-tzimmermann@suse.de
Stable-dep-of: a18b6e30ecd6 ("drm/tegra: fbdev: Remove offset into framebuffer memory")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/armada/armada_fbdev.c      | 12 +------
 drivers/gpu/drm/drm_fb_helper.c            | 41 ++++++++--------------
 drivers/gpu/drm/drm_fbdev_dma.c            | 12 +------
 drivers/gpu/drm/drm_fbdev_generic.c        | 12 ++-----
 drivers/gpu/drm/exynos/exynos_drm_fbdev.c  |  9 +----
 drivers/gpu/drm/gma500/fbdev.c             | 13 +------
 drivers/gpu/drm/i915/display/intel_fbdev.c |  9 +----
 drivers/gpu/drm/msm/msm_fbdev.c            |  9 +----
 drivers/gpu/drm/omapdrm/omap_fbdev.c       |  9 +----
 drivers/gpu/drm/radeon/radeon_fbdev.c      | 13 +------
 drivers/gpu/drm/tegra/fbdev.c              |  9 +----
 include/drm/drm_fb_helper.h                | 12 -------
 12 files changed, 25 insertions(+), 135 deletions(-)

diff --git a/drivers/gpu/drm/armada/armada_fbdev.c b/drivers/gpu/drm/armada/armada_fbdev.c
index d223176912b6..e409029638b0 100644
--- a/drivers/gpu/drm/armada/armada_fbdev.c
+++ b/drivers/gpu/drm/armada/armada_fbdev.c
@@ -43,10 +43,10 @@ static int armada_fbdev_create(struct drm_fb_helper *fbh,
 	struct drm_fb_helper_surface_size *sizes)
 {
 	struct drm_device *dev = fbh->dev;
+	struct fb_info *info = fbh->info;
 	struct drm_mode_fb_cmd2 mode;
 	struct armada_framebuffer *dfb;
 	struct armada_gem_object *obj;
-	struct fb_info *info;
 	int size, ret;
 	void *ptr;
 
@@ -87,12 +87,6 @@ static int armada_fbdev_create(struct drm_fb_helper *fbh,
 	if (IS_ERR(dfb))
 		return PTR_ERR(dfb);
 
-	info = drm_fb_helper_alloc_info(fbh);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_fballoc;
-	}
-
 	info->fbops = &armada_fb_ops;
 	info->fix.smem_start = obj->phys_addr;
 	info->fix.smem_len = obj->obj.size;
@@ -107,10 +101,6 @@ static int armada_fbdev_create(struct drm_fb_helper *fbh,
 		(unsigned long long)obj->phys_addr);
 
 	return 0;
-
- err_fballoc:
-	dfb->fb.funcs->destroy(&dfb->fb);
-	return ret;
 }
 
 static int armada_fb_probe(struct drm_fb_helper *fbh,
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 9691c93f19a0..298a8974adad 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -499,20 +499,7 @@ int drm_fb_helper_init(struct drm_device *dev,
 }
 EXPORT_SYMBOL(drm_fb_helper_init);
 
-/**
- * drm_fb_helper_alloc_info - allocate fb_info and some of its members
- * @fb_helper: driver-allocated fbdev helper
- *
- * A helper to alloc fb_info and the member cmap. Called by the driver
- * within the fb_probe fb_helper callback function. Drivers do not
- * need to release the allocated fb_info structure themselves, this is
- * automatically done when calling drm_fb_helper_fini().
- *
- * RETURNS:
- * fb_info pointer if things went okay, pointer containing error code
- * otherwise
- */
-struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
+static struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
 {
 	struct device *dev = fb_helper->dev->dev;
 	struct fb_info *info;
@@ -538,17 +525,8 @@ struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
 	framebuffer_release(info);
 	return ERR_PTR(ret);
 }
-EXPORT_SYMBOL(drm_fb_helper_alloc_info);
 
-/**
- * drm_fb_helper_release_info - release fb_info and its members
- * @fb_helper: driver-allocated fbdev helper
- *
- * A helper to release fb_info and the member cmap.  Drivers do not
- * need to release the allocated fb_info structure themselves, this is
- * automatically done when calling drm_fb_helper_fini().
- */
-void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
+static void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
 {
 	struct fb_info *info = fb_helper->info;
 
@@ -561,7 +539,6 @@ void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
 		fb_dealloc_cmap(&info->cmap);
 	framebuffer_release(info);
 }
-EXPORT_SYMBOL(drm_fb_helper_release_info);
 
 /**
  * drm_fb_helper_unregister_info - unregister fb_info framebuffer device
@@ -1851,6 +1828,13 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper)
 	height = dev->mode_config.max_height;
 
 	drm_client_modeset_probe(&fb_helper->client, width, height);
+
+	info = drm_fb_helper_alloc_info(fb_helper);
+	if (IS_ERR(info)) {
+		mutex_unlock(&fb_helper->lock);
+		return PTR_ERR(info);
+	}
+
 	ret = drm_fb_helper_single_fb_probe(fb_helper);
 	if (ret < 0) {
 		if (ret == -EAGAIN) {
@@ -1859,13 +1843,12 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper)
 		}
 		mutex_unlock(&fb_helper->lock);
 
-		return ret;
+		goto err_drm_fb_helper_release_info;
 	}
 	drm_setup_crtcs_fb(fb_helper);
 
 	fb_helper->deferred_setup = false;
 
-	info = fb_helper->info;
 	info->var.pixclock = 0;
 
 	/* Need to drop locks to avoid recursive deadlock in
@@ -1888,6 +1871,10 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper)
 	mutex_unlock(&kernel_fb_helper_lock);
 
 	return 0;
+
+err_drm_fb_helper_release_info:
+	drm_fb_helper_release_info(fb_helper);
+	return ret;
 }
 
 /**
diff --git a/drivers/gpu/drm/drm_fbdev_dma.c b/drivers/gpu/drm/drm_fbdev_dma.c
index 13cd754af311..e1e3b30f77c1 100644
--- a/drivers/gpu/drm/drm_fbdev_dma.c
+++ b/drivers/gpu/drm/drm_fbdev_dma.c
@@ -78,10 +78,10 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper,
 {
 	struct drm_client_dev *client = &fb_helper->client;
 	struct drm_device *dev = fb_helper->dev;
+	struct fb_info *info = fb_helper->info;
 	struct drm_client_buffer *buffer;
 	struct drm_gem_dma_object *dma_obj;
 	struct drm_framebuffer *fb;
-	struct fb_info *info;
 	u32 format;
 	struct iosys_map map;
 	int ret;
@@ -114,12 +114,6 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper,
 	fb_helper->buffer = buffer;
 	fb_helper->fb = buffer->fb;
 
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_drm_client_buffer_vunmap;
-	}
-
 	drm_fb_helper_fill_info(info, fb_helper, sizes);
 
 	info->fbops = &drm_fbdev_dma_fb_ops;
@@ -138,10 +132,6 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper,
 
 	return 0;
 
-err_drm_client_buffer_vunmap:
-	fb_helper->fb = NULL;
-	fb_helper->buffer = NULL;
-	drm_client_buffer_vunmap(buffer);
 err_drm_client_buffer_delete:
 	drm_client_framebuffer_delete(buffer);
 	return ret;
diff --git a/drivers/gpu/drm/drm_fbdev_generic.c b/drivers/gpu/drm/drm_fbdev_generic.c
index b4659cd6285a..2f07490b4baf 100644
--- a/drivers/gpu/drm/drm_fbdev_generic.c
+++ b/drivers/gpu/drm/drm_fbdev_generic.c
@@ -73,8 +73,8 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper,
 {
 	struct drm_client_dev *client = &fb_helper->client;
 	struct drm_device *dev = fb_helper->dev;
+	struct fb_info *info = fb_helper->info;
 	struct drm_client_buffer *buffer;
-	struct fb_info *info;
 	size_t screen_size;
 	void *screen_buffer;
 	u32 format;
@@ -100,12 +100,6 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper,
 		goto err_drm_client_framebuffer_delete;
 	}
 
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_vfree;
-	}
-
 	drm_fb_helper_fill_info(info, fb_helper, sizes);
 
 	info->fbops = &drm_fbdev_generic_fb_ops;
@@ -122,12 +116,10 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper,
 	info->fbdefio = &fb_helper->fbdefio;
 	ret = fb_deferred_io_init(info);
 	if (ret)
-		goto err_drm_fb_helper_release_info;
+		goto err_vfree;
 
 	return 0;
 
-err_drm_fb_helper_release_info:
-	drm_fb_helper_release_info(fb_helper);
 err_vfree:
 	vfree(screen_buffer);
 err_drm_client_framebuffer_delete:
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index a379c8ca435a..b24516998755 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -60,18 +60,11 @@ static int exynos_drm_fbdev_update(struct drm_fb_helper *helper,
 				   struct drm_fb_helper_surface_size *sizes,
 				   struct exynos_drm_gem *exynos_gem)
 {
-	struct fb_info *fbi;
+	struct fb_info *fbi = helper->info;
 	struct drm_framebuffer *fb = helper->fb;
 	unsigned int size = fb->width * fb->height * fb->format->cpp[0];
 	unsigned long offset;
 
-	fbi = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(fbi)) {
-		DRM_DEV_ERROR(to_dma_dev(helper->dev),
-			      "failed to allocate fb info.\n");
-		return PTR_ERR(fbi);
-	}
-
 	fbi->fbops = &exynos_drm_fb_ops;
 
 	drm_fb_helper_fill_info(fbi, helper, sizes);
diff --git a/drivers/gpu/drm/gma500/fbdev.c b/drivers/gpu/drm/gma500/fbdev.c
index 8e3128298728..d80a18fde1aa 100644
--- a/drivers/gpu/drm/gma500/fbdev.c
+++ b/drivers/gpu/drm/gma500/fbdev.c
@@ -110,7 +110,7 @@ static int psb_fbdev_fb_probe(struct drm_fb_helper *fb_helper,
 	struct drm_device *dev = fb_helper->dev;
 	struct drm_psb_private *dev_priv = to_drm_psb_private(dev);
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
-	struct fb_info *info;
+	struct fb_info *info = fb_helper->info;
 	struct drm_framebuffer *fb;
 	struct drm_mode_fb_cmd2 mode_cmd = { };
 	int size;
@@ -165,12 +165,6 @@ static int psb_fbdev_fb_probe(struct drm_fb_helper *fb_helper,
 
 	fb_helper->fb = fb;
 
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_drm_framebuffer_unregister_private;
-	}
-
 	info->fbops = &psb_fbdev_fb_ops;
 
 	/* Accessed stolen memory directly */
@@ -194,11 +188,6 @@ static int psb_fbdev_fb_probe(struct drm_fb_helper *fb_helper,
 
 	return 0;
 
-err_drm_framebuffer_unregister_private:
-	drm_framebuffer_unregister_private(fb);
-	fb->obj[0] = NULL;
-	drm_framebuffer_cleanup(fb);
-	kfree(fb);
 err_drm_gem_object_put:
 	drm_gem_object_put(obj);
 	return ret;
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c
index 31d0d695d567..031e38e919df 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev.c
@@ -218,7 +218,7 @@ static int intelfb_create(struct drm_fb_helper *helper,
 		.type = I915_GTT_VIEW_NORMAL,
 	};
 	intel_wakeref_t wakeref;
-	struct fb_info *info;
+	struct fb_info *info = helper->info;
 	struct i915_vma *vma;
 	unsigned long flags = 0;
 	bool prealloc = false;
@@ -271,13 +271,6 @@ static int intelfb_create(struct drm_fb_helper *helper,
 		goto out_unlock;
 	}
 
-	info = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(info)) {
-		drm_err(&dev_priv->drm, "Failed to allocate fb_info (%pe)\n", info);
-		ret = PTR_ERR(info);
-		goto out_unpin;
-	}
-
 	ifbdev->helper.fb = &ifbdev->fb->base;
 
 	info->fbops = &intelfb_ops;
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index 030bedac632d..174a116fba2b 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -70,9 +70,9 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
 {
 	struct drm_device *dev = helper->dev;
 	struct msm_drm_private *priv = dev->dev_private;
+	struct fb_info *fbi = helper->info;
 	struct drm_framebuffer *fb = NULL;
 	struct drm_gem_object *bo;
-	struct fb_info *fbi = NULL;
 	uint64_t paddr;
 	uint32_t format;
 	int ret, pitch;
@@ -105,13 +105,6 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
 		goto fail;
 	}
 
-	fbi = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(fbi)) {
-		DRM_DEV_ERROR(dev->dev, "failed to allocate fb info\n");
-		ret = PTR_ERR(fbi);
-		goto fail;
-	}
-
 	DBG("fbi=%p, dev=%p", fbi, dev);
 
 	helper->fb = fb;
diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c
index 523be34682ca..483dc30d7840 100644
--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c
+++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c
@@ -131,9 +131,9 @@ static int omap_fbdev_create(struct drm_fb_helper *helper,
 	struct omap_fbdev *fbdev = to_omap_fbdev(helper);
 	struct drm_device *dev = helper->dev;
 	struct omap_drm_private *priv = dev->dev_private;
+	struct fb_info *fbi = helper->info;
 	struct drm_framebuffer *fb = NULL;
 	union omap_gem_size gsize;
-	struct fb_info *fbi = NULL;
 	struct drm_mode_fb_cmd2 mode_cmd = {0};
 	struct drm_gem_object *bo;
 	dma_addr_t dma_addr;
@@ -199,13 +199,6 @@ static int omap_fbdev_create(struct drm_fb_helper *helper,
 		goto fail;
 	}
 
-	fbi = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(fbi)) {
-		dev_err(dev->dev, "failed to allocate fb info\n");
-		ret = PTR_ERR(fbi);
-		goto fail;
-	}
-
 	DBG("fbi=%p, dev=%p", fbi, dev);
 
 	helper->fb = fb;
diff --git a/drivers/gpu/drm/radeon/radeon_fbdev.c b/drivers/gpu/drm/radeon/radeon_fbdev.c
index fb70de29545c..1101b5feb67d 100644
--- a/drivers/gpu/drm/radeon/radeon_fbdev.c
+++ b/drivers/gpu/drm/radeon/radeon_fbdev.c
@@ -207,7 +207,7 @@ static int radeon_fbdev_fb_helper_fb_probe(struct drm_fb_helper *fb_helper,
 {
 	struct radeon_device *rdev = fb_helper->dev->dev_private;
 	struct drm_mode_fb_cmd2 mode_cmd = { };
-	struct fb_info *info;
+	struct fb_info *info = fb_helper->info;
 	struct drm_gem_object *gobj;
 	struct radeon_bo *rbo;
 	struct drm_framebuffer *fb;
@@ -245,13 +245,6 @@ static int radeon_fbdev_fb_helper_fb_probe(struct drm_fb_helper *fb_helper,
 	/* setup helper */
 	fb_helper->fb = fb;
 
-	/* okay we have an object now allocate the framebuffer */
-	info = drm_fb_helper_alloc_info(fb_helper);
-	if (IS_ERR(info)) {
-		ret = PTR_ERR(info);
-		goto err_drm_framebuffer_unregister_private;
-	}
-
 	info->fbops = &radeon_fbdev_fb_ops;
 
 	/* radeon resume is fragile and needs a vt switch to help it along */
@@ -277,10 +270,6 @@ static int radeon_fbdev_fb_helper_fb_probe(struct drm_fb_helper *fb_helper,
 
 	return 0;
 
-err_drm_framebuffer_unregister_private:
-	fb_helper->fb = NULL;
-	drm_framebuffer_unregister_private(fb);
-	drm_framebuffer_cleanup(fb);
 err_kfree:
 	kfree(fb);
 err_radeon_fbdev_destroy_pinned_object:
diff --git a/drivers/gpu/drm/tegra/fbdev.c b/drivers/gpu/drm/tegra/fbdev.c
index db6eaac3d30e..43a504ad4f38 100644
--- a/drivers/gpu/drm/tegra/fbdev.c
+++ b/drivers/gpu/drm/tegra/fbdev.c
@@ -72,10 +72,10 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
 	struct tegra_drm *tegra = helper->dev->dev_private;
 	struct drm_device *drm = helper->dev;
 	struct drm_mode_fb_cmd2 cmd = { 0 };
+	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
 	unsigned long offset;
-	struct fb_info *info;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;
@@ -96,13 +96,6 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
 	if (IS_ERR(bo))
 		return PTR_ERR(bo);
 
-	info = drm_fb_helper_alloc_info(helper);
-	if (IS_ERR(info)) {
-		dev_err(drm->dev, "failed to allocate framebuffer info\n");
-		drm_gem_object_put(&bo->gem);
-		return PTR_ERR(info);
-	}
-
 	fb = tegra_fb_alloc(drm, &cmd, &bo, 1);
 	if (IS_ERR(fb)) {
 		err = PTR_ERR(fb);
diff --git a/include/drm/drm_fb_helper.h b/include/drm/drm_fb_helper.h
index 375737fd6c36..7bccce637aa8 100644
--- a/include/drm/drm_fb_helper.h
+++ b/include/drm/drm_fb_helper.h
@@ -246,8 +246,6 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
 
 int drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper);
 
-struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper);
-void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper);
 void drm_fb_helper_unregister_info(struct drm_fb_helper *fb_helper);
 void drm_fb_helper_fill_info(struct fb_info *info,
 			     struct drm_fb_helper *fb_helper,
@@ -330,16 +328,6 @@ drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)
 	return 0;
 }
 
-static inline struct fb_info *
-drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
-{
-	return NULL;
-}
-
-static inline void drm_fb_helper_release_info(struct drm_fb_helper *fb_helper)
-{
-}
-
 static inline void drm_fb_helper_unregister_info(struct drm_fb_helper *fb_helper)
 {
 }
-- 
2.53.0

[PATCH 6.6.y 2/2] drm/tegra: fbdev: Remove offset into framebuffer memory

[Sasha Levin]

From: Thomas Zimmermann <tzimmermann@suse.de>

[ Upstream commit a18b6e30ecd69096beda4a0c96d2570900c3879a ]

The screen_buffer field in struct fb_info contains the kernel address
of the first byte of framebuffer memory. Do not add the display offset.
This offset only describes scrolling during scanout.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")
Cc: dri-devel@lists.freedesktop.org
Cc: linux-tegra@vger.kernel.org
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260421073646.144712-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tegra/fbdev.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/tegra/fbdev.c b/drivers/gpu/drm/tegra/fbdev.c
index 43a504ad4f38..b7de5819029d 100644
--- a/drivers/gpu/drm/tegra/fbdev.c
+++ b/drivers/gpu/drm/tegra/fbdev.c
@@ -75,7 +75,6 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
 	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
-	unsigned long offset;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;
@@ -112,9 +111,6 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
 
 	drm_fb_helper_fill_info(info, helper, sizes);
 
-	offset = info->var.xoffset * bytes_per_pixel +
-		 info->var.yoffset * fb->pitches[0];
-
 	if (bo->pages) {
 		bo->vaddr = vmap(bo->pages, bo->num_pages, VM_MAP,
 				 pgprot_writecombine(PAGE_KERNEL));
@@ -126,9 +122,9 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
 	}
 
 	info->flags |= FBINFO_VIRTFB;
-	info->screen_buffer = bo->vaddr + offset;
+	info->screen_buffer = bo->vaddr;
 	info->screen_size = size;
-	info->fix.smem_start = (unsigned long)(bo->iova + offset);
+	info->fix.smem_start = (unsigned long)(bo->iova);
 	info->fix.smem_len = size;
 
 	return 0;
-- 
2.53.0

Patch "drm/tegra: fbdev: Remove offset into framebuffer memory" has been added to the 6.6-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    drm/tegra: fbdev: Remove offset into framebuffer memory

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From stable+bounces-294127-greg=kroah.com@vger.kernel.org Fri Jul 31 18:00:34 2026
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 31 Jul 2026 11:50:20 -0400
Subject: drm/tegra: fbdev: Remove offset into framebuffer memory
To: stable@vger.kernel.org
Cc: Thomas Zimmermann <tzimmermann@suse.de>, dri-devel@lists.freedesktop.org, linux-tegra@vger.kernel.org, Thierry Reding <treding@nvidia.com>, Sasha Levin <sashal@kernel.org>
Message-ID: <20260731155020.604703-2-sashal@kernel.org>

From: Thomas Zimmermann <tzimmermann@suse.de>

[ Upstream commit a18b6e30ecd69096beda4a0c96d2570900c3879a ]

The screen_buffer field in struct fb_info contains the kernel address
of the first byte of framebuffer memory. Do not add the display offset.
This offset only describes scrolling during scanout.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")
Cc: dri-devel@lists.freedesktop.org
Cc: linux-tegra@vger.kernel.org
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260421073646.144712-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/tegra/fbdev.c |    8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

--- a/drivers/gpu/drm/tegra/fbdev.c
+++ b/drivers/gpu/drm/tegra/fbdev.c
@@ -75,7 +75,6 @@ static int tegra_fbdev_probe(struct drm_
 	struct fb_info *info = helper->info;
 	unsigned int bytes_per_pixel;
 	struct drm_framebuffer *fb;
-	unsigned long offset;
 	struct tegra_bo *bo;
 	size_t size;
 	int err;
@@ -112,9 +111,6 @@ static int tegra_fbdev_probe(struct drm_
 
 	drm_fb_helper_fill_info(info, helper, sizes);
 
-	offset = info->var.xoffset * bytes_per_pixel +
-		 info->var.yoffset * fb->pitches[0];
-
 	if (bo->pages) {
 		bo->vaddr = vmap(bo->pages, bo->num_pages, VM_MAP,
 				 pgprot_writecombine(PAGE_KERNEL));
@@ -126,9 +122,9 @@ static int tegra_fbdev_probe(struct drm_
 	}
 
 	info->flags |= FBINFO_VIRTFB;
-	info->screen_buffer = bo->vaddr + offset;
+	info->screen_buffer = bo->vaddr;
 	info->screen_size = size;
-	info->fix.smem_start = (unsigned long)(bo->iova + offset);
+	info->fix.smem_start = (unsigned long)(bo->iova);
 	info->fix.smem_len = size;
 
 	return 0;


Patches currently in stable-queue which might be from sashal@kernel.org are

queue-6.6/sysctl-treewide-constify-ctl_table_header-ctl_table_arg.patch
queue-6.6/wifi-brcmfmac-set-f2-blocksize-to-256-for-bcm43752.patch
queue-6.6/usb-gadget-f_tcm-synchronize-delayed-set_alt-with-teardown.patch
queue-6.6/net-sxgbe-free-tx-rings-on-rx-allocation-failure.patch
queue-6.6/usb-typec-ucsi-fix-race-condition-and-ordering-in-port-unregistration.patch
queue-6.6/drm-fb-helper-allocate-and-release-fb_info-in-single-place.patch
queue-6.6/pinctrl-qcom-sc8280xp-add-missing-wakeup-entries-for.patch
queue-6.6/forcedeth-fix-uaf-of-txrx_stats-in-nv_remove.patch
queue-6.6/hid-logitech-dj-standardise-hid_report_enum-variable.patch
queue-6.6/scsi-libsas-fix-ha-resume-deadlock-and-hisi_sas-disk.patch
queue-6.6/netfilter-nft_payload-fix-mask-build-for-partial-fie.patch
queue-6.6/bluetooth-iso-fix-timeout-vs-sync_timeout-typo-in-ch.patch
queue-6.6/net-sxgbe-check-descriptor-ring-allocation-failures.patch
queue-6.6/ipvs-fix-the-checksum-validations.patch
queue-6.6/mptcp-pm-avoid-code-duplication-to-lookup-endp.patch
queue-6.6/spi-spi-cadence-move-tx-fifo-full-busy-wait-into-fif.patch
queue-6.6/powerpc-boot-fix-simpleboot-cpu-node-lookup-check.patch
queue-6.6/ata-sata_mv-accept-1-or-2-resources-in-platform-prob.patch
queue-6.6/wifi-mac80211-validate-individual-twt-params-before-.patch
queue-6.6/mm-hugetlb-fix-swap-entry-corruption-when-clearing-u.patch
queue-6.6/dmaengine-idxd-fix-fdev-setup-failure-cleanup-in-idx.patch
queue-6.6/asoc-max98090-fix-missing-is_err-before-ptr_err-on-m.patch
queue-6.6/mptcp-pm-use-addr-entry-for-get_local_id.patch
queue-6.6/sched-add-task_struct-faults_disabled_mapping.patch
queue-6.6/libceph-add-doutc-and-_client-debug-macros-support.patch
queue-6.6/gve-fix-rx-queue-stall-on-alloc-failure.patch
queue-6.6/bluetooth-hci_sync-remove-unnecessary-hci_conn_get-i.patch
queue-6.6/drm-mediatek-check-crtc-state-before-freeing.patch
queue-6.6/usb-musb-omap2430-clean-up-probe-error-handling.patch
queue-6.6/bluetooth-iso-clear-iso_data-always-when-detaching-c.patch
queue-6.6/accel-qaic-use-sizeof-trans_hdr-for-transaction-leng.patch
queue-6.6/pinctrl-amd-don-t-clear-s4-wake-bits-at-probe.patch
queue-6.6/net-bridge-mrp-fix-option-tlv-length-in-mrp_test-fra.patch
queue-6.6/gpio-pch-use-raw_spinlock_t-for-the-register-lock.patch
queue-6.6/powerpc-boot-fix-treeboot-currituck-cpu-node-lookup-.patch
queue-6.6/wifi-ath6kl-fix-use-after-free-in-aggr_reset_state.patch
queue-6.6/wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-labelled-as-cypress-cyw.patch
queue-6.6/keys-make-keyring-key-chunk-byte-order-agree-with-ke.patch
queue-6.6/hwmon-adt7470-fix-fans-stuck-in-manual-mode-on-i2c-e.patch
queue-6.6/ata-ahci_ceva-fix-error-paths-in-ceva_ahci_platform_.patch
queue-6.6/qede-sync-udp_tunnel-ports-outside-qede_lock-in-the-.patch
queue-6.6/tracing-mmiotrace-reset-dropped_count-in-mmio_reset_.patch
queue-6.6/netfilter-nf_conntrack_sip-widen-nat-rewrite-delta-t.patch
queue-6.6/usb-typec-ucsi-split-connector-lock-classes.patch
queue-6.6/ahci-introduce-ahci_ignore_port-helper.patch
queue-6.6/mm-huge_memory-unlock-i_mmap_rwsem-before-releasing-.patch
queue-6.6/bluetooth-l2cap-fix-uaf-in-l2cap_le_connect_rsp.patch
queue-6.6/scsi-zfcp-fix-memory-leak-during-adapter-release-by-.patch
queue-6.6/mptcp-pm-userspace-fix-use-after-free-in-get_local_id.patch
queue-6.6/net-dsa-mt7530-error-out-on-failed-reads-in-mt7531-p.patch
queue-6.6/scsi-libiscsi_tcp-bound-scsi-response-data-segment-t.patch
queue-6.6/bluetooth-hci_conn-hold-conn-reference-in-abort_conn.patch
queue-6.6/ipvs-do-not-mangle-icmp-replies-for-non-first-fragme.patch
queue-6.6/phy-zynqmp-fix-clock-error-handling-in-xpsgtr_phy_in.patch
queue-6.6/asoc-max98095-fix-missing-is_err-before-ptr_err-on-m.patch
queue-6.6/hid-logitech-dj-fix-wrong-detection-of-bad-dj_short-.patch
queue-6.6/rds-tcp-hold-the-rcu-lock-across-ipv6_chk_addr-in-rd.patch
queue-6.6/hwmon-lm90-only-report-alarms-if-driver-is-ready.patch
queue-6.6/ceph-print-cluster-fsid-and-client-global_id-in-all-debug-logs.patch
queue-6.6/media-v4l2-fwnode-fix-subdev-owner-overwritten-in-v4l2_async_register_subdev_sensor.patch
queue-6.6/wifi-brcmfmac-drain-bus_reset-work-on-device-removal.patch
queue-6.6/hwmon-adt7470-fix-divide-by-zero-toctou-crash-in-fan.patch
queue-6.6/mptcp-add-mptcp_userspace_pm_lookup_addr-helper.patch
queue-6.6/hwmon-adt7470-fix-temperature-alarm-logic-in-hwmon_t.patch
queue-6.6/ksmbd-return-success-for-deferred-final-close.patch
queue-6.6/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch
queue-6.6/drm-renesas-move-rz-g2l-mipi-dsi-driver-to-rz-du.patch
queue-6.6/scsi-ufs-core-cancel-rtc-work-in-active-active-suspe.patch
queue-6.6/hwmon-adt7470-fix-cache-updated-before-hardware-writ.patch
queue-6.6/assoc_array-trim-the-final-shortcut-word-using-the-c.patch
queue-6.6/usb-musb-omap2430-do-not-put-borrowed-of_node-in-probe.patch
queue-6.6/ksmbd-fix-use-after-free-in-__close_file_table_ids.patch
queue-6.6/netfilter-xt_hashlimit-validate-hashtable-supports-x.patch
queue-6.6/scsi-target-iblock-fix-wrong-pr-ops-null-check-for-p.patch
queue-6.6/hwmon-adt7470-fix-swapped-pwm3-and-pwm4-auto-mode-ma.patch
queue-6.6/media-i2c-imx219-access-height-from-active-format-in-imx219_set_ctrl.patch
queue-6.6/usb-typec-ucsi-only-enable-supported-notifications.patch
queue-6.6/drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch
queue-6.6/ipv6-fib6-fix-null-deref-in-fib6_walk_continue-on-mu.patch
queue-6.6/netfilter-br_netfilter-reallocate-headroom-if-necess.patch
queue-6.6/keys-fix-out-of-bounds-read-in-keyring_get_key_chunk.patch
queue-6.6/hwmon-adt7470-use-cached-pwm-frequency-value.patch
queue-6.6/hwmon-pmbus-fix-return-value-from-pmbus_update_byte_.patch
queue-6.6/phy-zynqmp-fix-runtime-pm-leak-on-probe-allocation-f.patch
queue-6.6/scsi-libiscsi-fix-stale-data-leak-into-the-scsi-sens.patch
queue-6.6/soc-qcom-ice-allow-explicit-votes-on-iface-clock-for.patch
queue-6.6/spi-spi-cadence-supports-transmission-with-bits_per_.patch
queue-6.6/sctp-close-udp-tunnel-sockets-during-netns-teardown.patch
queue-6.6/ipvs-fix-places-with-wrong-packet-offsets.patch
queue-6.6/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch
queue-6.6/hwmon-adt7470-fix-pwm-auto-temp-state-array-and-boun.patch
queue-6.6/bluetooth-hci_sync-make-hci_cmd_sync_run_once-return.patch
queue-6.6/hwmon-adt7470-fix-busy-loop-and-i2c-flooding-in-upda.patch
queue-6.6/rxrpc-fix-irq-disabled-in-local_bh_enable.patch
queue-6.6/hwmon-nct6775-core-fix-number-of-temperature-registe.patch
queue-6.6/hwmon-nct6775-core-prevent-access-to-unsupported-wei.patch
queue-6.6/dmaengine-sun6i-dma-fix-reclaim-descriptors-while-te.patch
queue-6.6/media-i2c-imx219-drop-imx219_vts_-macros.patch
queue-6.6/rds-fix-inet6_addr_lst-null-dereference-when-ipv6-is.patch
queue-6.6/media-i2c-imx219-rename-vts-to-frm_length.patch
queue-6.6/smb-client-fix-buffer-leaks-in-smb1-read-and-write.patch
queue-6.6/scsi-target-clear-cmd_cnt-when-initial-counter-enrol.patch
queue-6.6/bluetooth-hci_sync-fix-hci_conn_del-use-in-hci_le_cr.patch
queue-6.6/net-phylink-put-link_gpio-if-phylink_create-fails.patch
queue-6.6/btrfs-zoned-fix-deadlock-between-metadata-writeback-.patch
queue-6.6/media-imx219-fix-maximum-frame-length-in-lines.patch
queue-6.6/media-i2c-imx219-group-functions-by-purpose.patch
queue-6.6/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch
queue-6.6/media-i2c-imx219-don-t-store-the-current-mode-in-the-imx219-structure.patch
queue-6.6/hwmon-nzxt-smart2-dma-align-output-buffer.patch
queue-6.6/rhashtable-clear-stale-iter-p-on-table-restart.patch
queue-6.6/drm-amdgpu-respect-placement-requirements-in-amdgpu_gtt_mgr-functions.patch
queue-6.6/powerpc-boot-fix-treeboot-akebono-cpu-node-lookup-ch.patch
queue-6.6/media-v4l-async-set-owner-for-async-sub-devices.patch
queue-6.6/thunderbolt-prevent-xdomain-delayed-work-use-after-f.patch
queue-6.6/netfilter-nf_tables-clone-set-on-flush-only.patch
queue-6.6/ata-libahci_platform-support-non-consecutive-port-nu.patch
queue-6.6/octeontx2-pf-set-correct-sequence-for-carrier-off-an.patch
queue-6.6/net-mpls-initialize-rtm_tos-in-mpls_getroute.patch
queue-6.6/ceph-fix-refcount-leak-in-ceph_readdir.patch
queue-6.6/netfilter-nf_conntrack_expect-restore-helper-propaga.patch
queue-6.6/bluetooth-btintel-validate-length-before-parsing-dia.patch
queue-6.6/firmware-stratix10-svc-fix-memory-leaks-and-list-cor.patch
queue-6.6/hid-logitech-dj-prevent-report_id_dj_short-related-u.patch
queue-6.6/sctp-avoid-auth_enable-sysctl-uaf-during-netns-teardown.patch
queue-6.6/iommu-sva-move-x86-disable-check-before-allocation.patch
queue-6.6/media-i2c-imx219-calculate-crop-rectangle-dynamically.patch
queue-6.6/net-do-not-send-icmp-ndisc-redirects-when-peer-alloc.patch
queue-6.6/phy-zynqmp-postpone-getting-clock-rate-until-actuall.patch
queue-6.6/can-isotp-check-register_netdevice_notifier-error-in.patch