The controller is allocated with the non-managed spi_alloc_host() while
the interrupt is registered with devm_request_threaded_irq(). During
removal, spi_bitbang_stop() only unregisters the controller; the
subsequent spi_controller_put() then frees the controller together with
its embedded davinci_spi devdata, which is the IRQ handler's dev_id.
The devm_request_threaded_irq() release action (free_irq()), which
drains the handler, does not run until after .remove() returns. A late
or latched interrupt can therefore reach davinci_spi_irq() and
dereference already-freed memory.
Switch to devm_spi_alloc_host() so that the devres LIFO order releases
the controller only after free_irq() has drained the handler, and drop
the now-redundant spi_controller_put() from .remove(). The probe error
path is simplified to direct returns.
The clock is acquired with devm_clk_get_enabled(), which is registered
after the IRQ and thus released before it by the devres LIFO order.
Drain the interrupt explicitly with devm_free_irq() before disabling the
controller so that a late interrupt cannot access the registers of a
clock-gated controller.
This issue was found by an in-house static analysis tool.
Fixes: 5b3bb5963f ("spi: davinci: Use devm_*() functions")
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260719010014.3163356-2-fanwu01@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
The R-Car Gen4 PCIe controller can optionally use GIC ITS as an
MSI controller. This configuration is described in DT by setting
msi-parent DT property in the PCIe controller node. Document this
configuration.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260720015505.314957-1-marek.vasut+renesas@mailbox.org
iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual
address points inside the shared section. The returned pointer is later
used as a full firmware interface structure, so accepting an address near
the end of the shared section can still lead to out-of-bounds accesses.
Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges
that do not fit entirely in the shared section.
Fixes: 2718d91816 ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720114918.15973-1-osama.abdelkader@gmail.com
nvmet_param_mdts_store() accepts any integer that kstrtoint() can parse
and stores it directly into port->mdts. The value is only range-checked
later, when the port is enabled: nvmet_enable_port() silently resets
port->mdts to 0 if it is negative or greater than NVMET_MAX_MDTS.
As a result, writing e.g. "mdts=1000" succeeds and reading the attribute
back returns 1000, yet enabling the port quietly turns it into 0. This
is confusing and hides the invalid input from the user.
Validate the value against [0, NVMET_MAX_MDTS] in the store handler and
reject anything out of range with -EINVAL, so the error is reported at
write time and port->mdts never holds a value the port cannot use.
Fixes: 0a5a946486 ("nvmet: introduce new mdts configuration entry")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
quirks_param_set() reuses 'err', which param_set_copystring() left as 0,
as the return value of the whole function. When nvme_parse_quirk_entry()
fails to parse a field, the code jumps to out_free_qlist and returns that
stale 0, so a malformed quirks= parameter is silently accepted as valid.
Set err to -EINVAL before jumping out on a parse failure.
Fixes: 7bb8c40f5a ("nvme: add support for dynamic quirk configuration via module parameter")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the
rsp_iu mapping fails, the original code only recorded the error and fell
through: it left the already-mapped cmd_iu unmapped and still marked the
op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call
.exit_request() when .init_request() fails, the cmd_iu mapping is leaked
for every op whose rsp_iu mapping fails.
Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and
returns the error without marking the op idle, so it stays in the
FCPOP_STATE_UNINIT state set by the initial memset().
Fixes: e399441de9 ("nvme-fabrics: Add host support for FC transport")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS
(set by the successful nvmet_req_find_ns() call) when the kzalloc() for
the log buffer fails. It then jumps to the out label and completes the
request with a success status, so the host is told the command succeeded
while no data was transferred.
Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler,
so an allocation failure is reported as an internal error.
Fixes: 5fd075cdaf ("nvmet: implement rotational media information log")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnqlgQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1+MtD/9M66W36D7KaI9tnHLxVO+2h+VZV73Q9+jI
Siy6LaytoSX9Zz3jYYeLT8AFCm2ykbydGfIWOBw8lWKrc5tSlQhE/zFrl8fcigr6
7xvHbHPoUa/cv8yxDn0v0JPQtnbKyRz6+vNuYPSTGFsLCqavMEPlq3PGNz43j5rG
6TgbpE2HC1K0fhuYMkootj/O4QLVN0RbUbAjYmdbxY35/z5pPq/5lAvOZU9GdI9d
l+rICXNJy9ZMPw9u5HR8IEDiV9dH+Znwk7jkGxIzyDpSxi4FW9jrfui124aqFDCU
qc97cBzYZ1mf7FK1zkfT3KRZ/TaAxl49kxbOB4WzOxDDtZ866ciSN2OGtvMmFlzd
5jnHj7b7hnm5L1U59GPDZD940qNFydK/2cgS1x4bc0aPsT324NxV/m0TuzIro91Z
xwbllGGfHmEC5Rl1WthrrXZPBTkM23KJAdvA9d4M/yPv6tEMJsAkqwKcoiV+wPeQ
hhtuyH2bCw+UZZ7rxN0gAuT8hdj1bexuminZilixCBAZkNymV9njiueipNEL9Hb0
2bfTKE84plPjjQ8ijgoAZ/Sefv/6at51gEwYjWZnX66huzkp3w8pXj2MhkG7lgmv
DC5hWpOU/kFNCamePeQUeJ9hwbdPCy13NDkjmuh0s6Ouzy9DpuIxCmE4U8cID5MQ
x+Rh4YbWPQ==
=xeyD
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFiQACgkQmmx57+YA
GNlYKw/+KxY6PubRpNhKHivaGqFBFgD+GlPaJNRMkFgXYIiUz6CDwnFK0v9XozOr
UfwrfIDGBvdq0XrNJmiRPW68A4PhGV9MP7Tq3iwEFr/hjRCgjylGNe92znzTIHat
oJtB96EdAPd+Dgr5vuZ923yA9t3zGf1Ns5YqlLos7xGWDBzXuAKmQVbf7j7exLg5
FwjabWAwHsf3le13WYsEY4TleqHMYuspLnsIVSQXJwiX4Ex67ndKcwQdIECY7eYs
y7790ofY67mBa2y+JRiybCMCk6KbgBxtbDb1jL/GJ8zde4mpoX7hdJ8u6hMIdOMJ
5lpHL0m31nuKyzIsBAAKcdKJviNL09d8yy+RzU1/DT84kVxz6eFsxfj+NR6inHKE
ZsBZS7oJRoRpMxCLxvnE44PVFCnCuv517CqvDfvEyCMx2pKmUl3C2O1CgE5mIK2n
FqgbuTy4rQLw7pKR3HF+qEyhyHYiuARWftVuXPWf8NHCPNSb37x50HjC4FYJPcOq
rP9fKAlqxHd4CQ0WlUx1J0mmp5USmYj9xbc2aUS/g1bJ1GaWfSuT/a7wZuI57769
HIc2Mqv9G+3LaEd2UNCods7QXW3zZTK80qm8WyEm4PddSX/9K6R/gzCzl0CwMfCe
/qFewzZTL9SJ4F3MRiefc897g7+JMtrg5+xNbZyIInUGJQsR3sA=
=rMXV
-----END PGP SIGNATURE-----
Merge tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Samsung SoC drivers for v7.3
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
* tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
dt-bindings: samsung: exynos-pmu: Narrow allowed reboot modes
dt-bindings: samsung: exynos-pmu: Restrict children with unevaluatedProperties
dt-bindings: soc: samsung: exynos-sysreg: Add hsi0 for ExynosAutov920
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnrDcQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1xaMD/wPkFz7Vj8UDRDbMVjdk0VoYmawxFc83r0P
kwdrp7OxSwH7Js+HANgs8zYFYbIRSVFkkHyAi5aekTaXBzXohwdtiW4t3qHynmtX
wBvAF4xZLxLsII+OZU8wbTJw6ZWJscM6AloW1TZPVOiOJ6m7kKBztMkl7US/hwKR
3hbCMT5zXRz/MCniq1cH3hT3KUQLopcT6vclJrz+kaHfoQN6T6TE23teaciKOYUB
tvjQk1eWZ7gRUdqnvflZHTuSyx+VvVxrukIy8d7IljEGEsWDSoQmxfrNTCwRZwrB
OIqVj6+ZhygJKpb/LdxCNjvZqUCiaCr6vlMMhkQ08HHS+EW3tmqkCJuwkoODr2G0
l+EhL24rBJeIQGstRhNV43q4YstCZB5u0ZO7ixxFxdZ74PYDFFLlbxJZ/wyPLaYf
jala4+STTOyuy13eCf90OUPosgPWFGJyb2ouJlZJuquJv4XBzNF/ukguEMDLS0S8
JDOL9WIHIwNd7d2bDwbTS3zL5qvwhFpa2Z2LfjARnLXiZjClzhIR+HCe+lmLSSvr
4sANn7m1ouwKBtBO+WqLgf7tvEY+v5TVwNCHiIsI6t4yxetCp/HUN+1sHiD4hOs0
40IMvl3wM89ET0fLo1VWoN5lC06n0bdREsgstL2AFHcRAnHBaFcldtR3jW8AsyFh
hXvNH/iFdw==
=s70S
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFI4ACgkQmmx57+YA
GNmmRw//WkrjLuFY7GzUoqxrYJe4glU14C956miHhS45Nio+NUN2Aa8ArymsPyl4
vukxkI9Ej6oQGZI5m8CLHDPP7W7yUJ+z3JzCly1QuxkGD7wSUd6/ih7WfWWAPDfD
xUbuk3/h0wal6apCpCUaWEczfn68FTr33fVd24S4VdwA18nYnabXDI/0XXgItg7F
956KUPt7FxOm6XmQB6xrCW4ry2hm2gwo+isMxjDGoIQXaQWPhi6A2ahvpm8ECFvI
bQx8vJZKHz6P9erhPLMxtkTcghaVg2i8aUqQR7cOtGYLkL45XlyNoyRH3FaL34Mg
7neHNg4H/tynyWFt9WEARdpsunJySeUuYpZ5+po5DUXuMUlz0vS2FeOsJ05ocnpR
KRSblMjflHtwYJ4NbCSf8c10TF8bp8Os8JN7wGG7fI9cXbM3/Ih+bWRF275VQuIX
Ko6qCvv4UzcndseAb1NFIYnrKHhaNGb1TmP7bQA59BB43DSrjaUTug99+UVd2HXa
bnMrtxIsu8pRB7mmaiCMtqyoeH+dt8vb/7JGyf6x4Xyqgnme0kAQatMGwqKLXM3y
G06IJqTsbO++xlrkZy0hHriRTFQRC2wIKYd6jqoZ8XZg7k8KvVQYjLoLcDyIqhBc
2vuNtFSBOPiLPLPkA4aYJVwQsuTyfuQBH2LNBy4pOkoU0g+IxyE=
=YFm3
-----END PGP SIGNATURE-----
Merge tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Memory controller drivers for v7.3
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
* tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
memory: jz4780-nemc: Use dev_err_probe() for clock error
memory: tegra: Guard against NULL mc_regs in IRQ handler
memory: tegra: add multi-socket support to the memory interconnect
memory: stm32_omm: initialize ret in stm32_omm_set_amcr
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
panthor_fw_read_build_info() checks whether the metadata range fits in the
firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so
the addition can wrap and let an out-of-bounds range pass validation.
The function also reads the "git_sha: " prefix without first checking that
the metadata is long enough, and meta_size == 0 can underflow the NULL
terminator index.
Use subtraction-based bounds checking and reject metadata that is too short
to contain the expected prefix and trailing NULL byte.
Fixes: 2718d91816 ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720113212.11981-1-osama.abdelkader@gmail.com
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says:
I will post Card capsuling patch.
To makes its review easy, tidyup its drivers to reduce
un-related diff as preparation.
No functional change, but is preparation for cleanup driver.
Link: https://patch.msgid.link/87ldb5i0do.wl-kuninori.morimoto.gx@renesas.com
ams_delta_probe() will be updated when Card capsuling.
To makes its review easy, use &pdev->dev instead of card->dev.
These are same
card->dev = &pdev->dev;
No functional change, but is preparation for Card capsuling.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87h5lti0cu.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
struct snd_soc_card will be capsuled soon, its member will not be
able to access from non soc-card.c.
To reduce the difference during conversion, replace dev.
- card->dev, ...
+ dev, ...
No functional change, but is preparation for Card capsuling.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
Tested-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
Link: https://patch.msgid.link/87ik69i0d0.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Add device tree for the Anbernic RG Vita-Pro, based on the Rockchip
RK3576. All hardware is currently working except for the accelerometer,
the touchscreen, the battery monitor, and DisplayPort over USB-C. PWM
is also missing currently, and as a result the LEDs and panel backlight
are currently controlled via GPIO but will be changed to PWM once
supported.
The Anbernic RG Vita-Pro includes the following hardware:
- A 1080x1920 DSI display with touch.
- 21 buttons.
- 3 LEDs.
- 64GB eMMC, 2 SDMMC slots.
- RTL8852BE WiFi (with Bluetooth via UART)
- 1 USB 3.0 USB-C port in OTG mode.
- 3.5mm headphone jack with play button support.
- 5000mAH battery
The following hardware has incomplete driver support and is not yet
working:
- An Invensense icm42607p accelerometer.
- A Cellwise cw221x battery monitor.
- A Synaptics i2c touchscreen.
- DisplayPort over USB-C alt-mode.
- PWM controller.
- 2 Analog joysticks with LED controllers.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://patch.msgid.link/20260728203832.166402-5-macroalpha82@gmail.com
[dropped unused pmic pinconfig definitions, sorted nodes]
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Instead of defining the wait values for each driver, use common values
defined in the core pci.h header file. Note that while most drivers use
the usleep_range(), it looks like these were mostly cargo culted and
msleep() is a better choice given the fixed delay that the specification
calls for. Convert all drivers to msleep() and use the existing
definition.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Aksh Garg <a-garg7@ti.com>
Link: https://patch.msgid.link/20260716-tegra264-pcie-v8-3-23e51589229b@nvidia.com
Add compatible string for the Anbernic RG Vita-Pro.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260728203832.166402-4-macroalpha82@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
bui duc phuc <phucduc.bui@gmail.com> says:
This series improves probe error handling in the sunxi ASoC drivers.
It replaces suitable probe error paths with dev_err_probe() to
simplify the code and handle deferred probe errors consistently.
It also removes redundant error messages where the called helpers
already report failures, avoiding duplicate log messages.
Build tested only.
Link: https://patch.msgid.link/20260715095525.40668-1-phucduc.bui@gmail.com
Drop the redundant error message after devm_platform_ioremap_resource(),
which already reports failures, and use dev_err_probe() for regmap
initialization errors.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-7-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Drop the redundant error message after devm_platform_ioremap_resource(),
which already reports failures, and use dev_err_probe() for regmap
initialization errors.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-6-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-5-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-4-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The called functions already log failures where appropriate. Return the
original error directly and avoid duplicate error messages.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260715095525.40668-3-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260715095525.40668-2-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
ovpn_fill_info emits IFLA_OVPN_MODE inside IFLA_INFO_DATA, but
ovpn_link_ops does not provide a get_size callback. Consequently,
rtnetlink's size estimate for ovpn link messages does not include the
nested mode attribute.
Available skb tailroom may hide this mismatch. When the remaining space
is insufficient, however, ovpn_fill_info returns -EMSGSIZE and message
construction fails.
Add the callback and account for IFLA_OVPN_MODE.
Fixes: c2d950c467 ("ovpn: add basic interface creation/destruction/management routines")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Commit 7aa1aa6ece ("QE: Move QE from arch/powerpc to drivers/soc")
moved QE into drivers/soc including gpio.c but left CONFIG_QE_GPIO
in powerpc's Kconfig.
Move it to SoC as well as it is the only place it is used:
drivers/soc/fsl/qe/Makefile:obj-$(CONFIG_QE_GPIO) += gpio.o qe_ports_ic.o
include/soc/fsl/qe/qe.h:#ifdef CONFIG_QE_GPIO
include/soc/fsl/qe/qe.h:#endif /* CONFIG_QE_GPIO */
There is also a dependency in USB subsystem for CONFIG_USB_FHCI_HCD:
drivers/usb/host/Kconfig: depends on QE_GPIO && QUICC_ENGINE
Because that USB driver selects CONFIG_FSL_GTM which is specific to
powerpc, it has to depend on CONFIG_PPC.
Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://lore.kernel.org/r/9a7131d15a94e2017877e628f0e97f9aa2e0aae9.1785140877.git.chleroy@kernel.org
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
In register_fprobe(), get_ips_from_filter() resolves target function
addresses and increments module reference counts via try_module_get() for
symbols in kernel modules. If get_ips_from_filter() fails on the second
pass and returns an error, register_fprobe() returned directly without
releasing module references acquired up to that point.
Fix this by ensuring the cleanup loop executing module_put() runs even when
get_ips_from_filter() returns a negative error.
Link: https://lore.kernel.org/all/178528125360.101985.4144133640239273153.stgit@devnote2/
Fixes: d24fa977ee ("tracing: fprobe: Fix to lock module while registering fprobe")
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
On a non-range clear, curs.size is never set, so the segment test
(next - va_curs_start > curs->size) returns false for every level > 0
before the clear_pt short-circuit is reached. The clear then descends to
level 0 instead of forming a huge zero-leaf, wasting page tables and
risking -ENOMEM on unbind.
Move the null-VMA, purged-BO and clear_pt short-circuits above the
curs->size test. The bind path always sets curs.size, so it is unaffected.
v2
- Also set curs.size on the clear path so the cursor stays meaningful
during the walk. clear_pt is only reached with range == NULL, so assert
that invariant. (Matthew Brost)
Cc: Matthew Brost <matthew.brost@intel.com>
Fixes: 5b658b7e89 ("drm/xe: Clear scratch page on vm_bind")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260728055916.593707-2-himal.prasad.ghimiray@intel.com
Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
(cherry picked from commit 04eeeb45cb)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
The RT5640 GPIO1/IRQ pin can be configured either as GPIO1 or as the
codec interrupt output.
Some boards, such as the Firefly-RK3399, do not connect the codec
interrupt output. This causes the following binding validation warning:
'interrupts' is a required property
Make the interrupts property optional to support such hardware
configurations.
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260727185814.2599488-1-festevam@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Trace point pvr_job_submit_fw() is used to trace job submission to
the FW. Currently it is recorded when a command is written to the Client
circular buffer.
Move trace recording after writing command to the Kernel circular buffer to
better represent command submission to the FW.
Fixes: c1079aebb4 ("drm/imagination: Add support for trace points")
Signed-off-by: Brajesh Gupta <brajesh.gupta@imgtec.com>
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Link: https://patch.msgid.link/20260724-b4-tracepoint-fix-v3-1-8f8e5e8179d3@imgtec.com
Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
Matt was not very active reviewer in last years. Furthermore he
apparently left Google and his email doesn't work anymore. I didn't find
any working contact for him so at least for now delete the entry with
non-existent email.
Signed-off-by: Jan Kara <jack@suse.cz>
There is just one set of changes that the remaining IO expansion chips
on the TH1520-based LicheePi 4a board.
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQSy8G7QpEpV9aCf6Lbb7CzD2SixDAUCamfmlAAKCRDb7CzD2Six
DDehAQChtA/two2PhKC3UEHpwNYI0WGGenAJxWrmL4Pp5IKVYgD/azDUxAEJ7duG
ejz2YONec+NvXG+AZoKxmbKgPzOErgk=
=uG96
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqAaEACgkQmmx57+YA
GNkJzBAAw6jegV/2venCdwmOJt42vs4+FcDr2Veeyxs90xxZoQ98wTeI9+EUXtjl
uwXshVXtZbvjYecCLSeLAp+sLFHbItofRnAs0CrGrWNn/nwZG0tEW09XUXZVCqcd
YI3jqxCzlXJHeh6IfboTujlniYAePHR5BKqZWymmutyR5dG0+mJWERYqrRl9Gk47
6aCQvFLrLprmMWB4imzHwFpvb3yLdtODm5gdbBi2lZqCa/XRpZsHflyVzp5HAkkM
8xg5lXbzFg/QX9hEXtQkhE3bQGoqa6xF61glZRiU4aqedRENp1GAQ2jQfYMz16k6
W0euAJ/6ks3+fzzbn2QDPTVkWpV2zUxOmtJFWqgm9Q5b2Lrm6rvD+1HTXc7R/EP4
i7qmvqP9Jt8YSGk7+0KEo7nYZgE0sSIHPsBzfIYaOcaxKEwa7X4sXfBY7eH56b3u
UlC/7uxQyyCgU1NqZmF0M5Ya/arqaUSHYHgNbc5WzsRILiDcVX8MmTQMxfYLs40z
dLzgLMQu1XRIvr2s8dkP6VW72HmtvIJG/X1ObRGYMheIZJV8uuQaaQpdimqMd1Ve
qFWroZBj1wqWEA2IX0RousstrwdFPGyYKiK6H0uH0itF42Nm0H4M/Jm9pVaxrJX7
iwL95v7pEwtAz1IiR/KcUwo/FGlAFXzmwy63VojLv+yxmqoGLLE=
=c8kz
-----END PGP SIGNATURE-----
Merge tag 'thead-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt
T-HEAD device tree changes for v7.3
There is just one set of changes that the remaining IO expansion chips
on the TH1520-based LicheePi 4a board.
* tag 'thead-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux:
riscv: dts: thead: Add remaining Lichee Pi 4A IO expansions
riscv: dts: thead: Add IO labels for the IO expansion on I2C1
riscv: dts: thead: lpi4a: sort nodes
riscv: dts: thead: Add TH1520 I2C nodes
riscv: dts: thead: th1520: remove pclk for I2C1
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
intel_dp_hdmi_sink_max_frl() limits the sink's max FRL rate by its
DSC max FRL rate whenever the sink supports DSC 1.2.
However, the DSC max FRL rate (HF-VSDB DSC_Max_FRL_Rate) only applies
to compressed video transport, which requires a DSC 1.2 encoder in
the PCON (configured via intel_dp_pcon_dsc_configure()).
Without such an encoder the HDMI link always carries uncompressed
video, for which the regular Max_FRL_Rate is the correct limit.
Applying the DSC limit unconditionally trains the FRL link at a lower
rate than both the PCON and the sink support.
E.g. an LG OLED G4 (Max_FRL_Rate 48 Gbps, DSC_Max_FRL_Rate 24 Gbps)
behind a Synaptics VMM7100 PCON (PCON max FRL bw 48 Gbps, no DSC
encoder):
Sink max rate from EDID = 24 Gbps
FRL trained with : 24 Gbps
while Windows/macOS train the same hardware at 40/48 Gbps.
The too low FRL rate needlessly constrains the formats available to
the sink.
Only apply the sink's DSC max FRL rate if the PCON has a DSC 1.2
encoder, matching the gate in intel_dp_pcon_dsc_configure().
PCONs with a DSC encoder keep the current conservative behavior,
since the link is trained once and compressed transport may be used
for any subsequent mode.
With this the setup above trains at 48 Gbps.
Tested on PTL (xe) with the above PCON/sink combo.
Fixes: 10fec80b48 ("drm/i915/display: Configure PCON for DSC1.1 to DSC1.2 encoding")
Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Signed-off-by: Alexander Kaplan <alexander.kaplan@sms-medipool.de>
Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://patch.msgid.link/20260718105207.5565-3-alexander.kaplan@sms-medipool.de
(cherry picked from commit 71b57dd92f)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
When we fail to write out inode when adding new xattr block, we backed
out some changes (like quota modifications) but left others (like block
allocation or inode xattr block modification). Just leave the inode
intact in this case because we can hardly reach a consistent state and
defer fixing to e2fsck. Also remove outdated comment and special data
handling since sync_inode_metadata() does not write out any data.
Link: https://patch.msgid.link/20260728154724.3934977-2-jack@suse.cz
Signed-off-by: Jan Kara <jack@suse.cz>
Control-flow integrity is controlled through a WARL field in henvcfg.
Expose the feature only if the Zicfilp/Zicfiss is supported for VS-mode.
Allow the VMM to block access to the feature by disabling the ISA
extension in the guest.
Assisted-by: YuanSheng:claude-4.7-opus
Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Link: https://lore.kernel.org/r/20260713010302.303278-8-inochiama@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
isert_login_recv_done() records how many bytes the HCA actually placed in
the login buffer, but nothing compares that against the length the login
PDU's BHS declares. isert_rx_login_req() copies min(login_req_len,
MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then
reads the declared length back out of that buffer - for the first PDU in
iscsi_target_locate_portal(),
payload_length = ntoh24(login_req->dlength);
tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL);
and for the ones after it in iscsi_decode_text_input(), reached from
iscsi_target_do_login().
login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so
an initiator that declares more than it sends reads off the end of it,
before authentication and with the length under its control:
BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80
Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167
__asan_memcpy+0x23/0x60
kmemdup_nul+0x43/0x80
iscsi_target_locate_portal+0x48d/0x1180
iscsi_target_login_thread+0x19a9/0x3350
Allocated by task 167:
__kmalloc_cache_noprof+0x158/0x370
iscsi_target_login_thread+0x971/0x3350
which belongs to the cache kmalloc-8k of size 8192
allocated 8192-byte region
Falsifying the second login PDU instead reaches the other reader, on the
same buffer:
BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80
Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50
Workqueue: isert_login_wq iscsi_target_do_login_rx
__asan_memcpy+0x23/0x60
kmemdup_nul+0x43/0x80
iscsi_decode_text_input+0xc6/0x11c0
iscsi_target_do_login+0x261/0x1470
iscsi_target_do_login_rx+0x51d/0x7d0
iscsit over TCP is not exposed: iscsit_get_login_rx() validates the
declared length with iscsi_target_check_login_request() and then reads
exactly that many bytes off the socket, so the declared length governs
how much arrives rather than how much is copied out of an already-filled
buffer. isert does not call iscsi_target_check_login_request() at all.
Reject a login PDU whose declared DataSegmentLength exceeds what was
received, in both paths that reach isert_rx_login_req():
isert_get_login_rx() for the first login PDU and isert_login_recv_done()
for the ones after it. dlength <= login_req_len is allowed because the
received count can include up to three bytes of iSCSI padding.
Once the check is in place the copy out can no longer exceed the copy in:
the posted login SGE is ISER_RX_PAYLOAD_SIZE, so login_req_len cannot
exceed MAX_KEY_VALUE_PAIRS and the min() in isert_rx_login_req() is
login_req_len.
Like the existing short-PDU check added by 29e7b925ae, the reject in
isert_login_recv_done() returns without completing login_req_comp, so a
malformed subsequent PDU leaves the login to be torn down by the login
timer rather than failing immediately. The first-PDU path returns an
error and fails straight away.
Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an
initiator that sends the real key=value payload while declaring 8193 in
the BHS, on the first login PDU and on the second in separate runs. The
reported read size tracks the declared value exactly; 16384 and 61440
behave the same. Unpatched 3 of 3 runs report on each of the two paths,
patched 0 of 3 on both, run alternately in a single session, and a normal
login still completes on the patched build.
Fixes: b8d26b3be8 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver")
Suggested-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260726163931.971063-3-yhlee@isslab.korea.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
isert_recv_done() hands each received PDU to the opcode handlers without
ever looking at wc->byte_len, the number of bytes the HCA actually placed
in the receive descriptor. The handlers then copy that many bytes - the
data-segment length the initiator declared in the BHS
(ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) -
out of the fixed-size descriptor:
isert_handle_iscsi_dataout():
sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),
unsol_data_len);
isert_handle_scsi_cmd():
sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents,
isert_get_data(rx_desc), imm_data_len);
Because the declared length is never checked against wc->byte_len, an
initiator can declare a data segment larger than the bytes it actually
sent (and larger than the descriptor) and cause an out-of-bounds read of
the receive buffer.
Nothing upstream of isert closes this door:
- __iscsit_check_dataout_hdr() bounds the inbound payload against
conn_ops->MaxXmitDataSegmentLength (MXDSL) - a transmit parameter,
used here for the inbound check.
- iscsi_set_connection_parameters() sets
ops->MaxXmitDataSegmentLength = ops->TargetRecvDataSegmentLength;
and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in
iscsi_check_acceptor_state(), so the value the initiator declares is
adopted verbatim (type range 512..16777215). The initiator effectively
raises its own ceiling.
- isert never clamps the negotiated value to its own fixed receive
descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and
the descriptor size are unrelated.
The imm_data_len == data_len path is more than an over-read: it aliases
the receive descriptor via sg_set_buf() and passes it to the backend as
the data source for the SCSI WRITE, so an over-declared length causes heap
contents past the descriptor to be written through the backend to the
backing store. The backend is the victim of the oversized scatterlist
isert hands it, not the cause; no read-back of the written bytes was
demonstrated.
Trigger: after login completes (full feature phase), an initiator that has
declared a large TargetRecvDataSegmentLength and a FirstBurstLength that
permits unsolicited/immediate data sends a PDU whose declared data-segment
length exceeds what was received. With KASAN:
BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0
Read of size 4096 at addr ffff888109720800 by task kworker/1:0H/25
Workqueue: ib-comp-wq ib_cq_poll_work
Call Trace:
sg_copy_buffer+0x150/0x1c0
isert_recv_done+0xba6/0x2390
__ib_process_cq+0xe1/0x390
ib_cq_poll_work+0x46/0x150
isert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout()
(ib_isert.c:1160), inlined through isert_rx_opcode().
Validate wc->byte_len against the framing in isert_recv_done() before the
PDU reaches any handler, and reinstate the connection if it is short.
Because the test compares without subtracting the header length, it also
rejects PDUs shorter than the iSER and iSCSI headers, which would otherwise
be parsed out of stale descriptor contents. The login handler rejects PDUs
shorter than ISER_HEADERS_LEN (commit 29e7b925ae ("IB/isert: Reject login
PDUs shorter than ISER_HEADERS_LEN")) but does not bound the declared
length either; that is fixed in the next patch. The data handlers had no
length check at all.
isert reads the data segment from a fixed offset: isert_get_data()
returns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for
an AHS. The bytes the handlers touch are therefore exactly
[ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum
against wc->byte_len bounds precisely the region that is read. An AHS
term would only make the test stricter without bounding anything further,
and cannot cause a false reject: a PDU carrying an AHS is longer, not
shorter.
This is a memory-safety fix that verifies the bytes that were actually
received; it does not touch RFC 7145 length negotiation and is not the
MaxXmitDataSegmentLength negotiation redesign raised in the 2017 "[Query]
iSER-Target: QP errors observed on increasing MaxXmitDataSegmentLength"
discussion. That redesign is explicitly out of scope here.
The patched kernel rejects the malformed DataOut PDU and both
immediate-data variants with "PDU declares ... bytes were received" and
continues to pass normal traffic with no regression.
Reproduced with soft-RoCE (rdma_rxe) and a raw rdma_cm/ibv initiator; no
kernel-side test hooks were needed.
Fixes: b8d26b3be8 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver")
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Link: https://patch.msgid.link/20260726163931.971063-2-yhlee@isslab.korea.ac.kr
Signed-off-by: Leon Romanovsky <leon@kernel.org>
The extension Zicfiss/Zicfilp introduces a software-check exception
to the privilege architecture. Redirect this exception to VS mode
when VCPU enable Zicfiss/Zicfilp so the CFI violations in VU/VS could
be reported.
Also, update kvm_riscv_vcpu_trap_redirect() to forward the SPELP
state to the VS mode.
Assisted-by: YuanSheng:claude-4.7-opus
Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260713010302.303278-6-inochiama@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
The Samsung Galaxy Book5 Pro 360 (960QHA) has an upside-down mounted
OV02E10 sensor. The 180 degree rotation is reported in neither the SSDB
nor the _PLD for the sensor (both report a rotation of 0 degrees), so
the image is rendered upside-down in userspace.
Add a DMI quirk entry for this laptop so that the sensor fwnode gets a
"rotation" property of 180 and userspace (e.g. libcamera) can
compensate.
Tested on the Galaxy Book5 Pro 360: with the sensor reporting
V4L2_CID_CAMERA_SENSOR_ROTATION = 180 (verified with an equivalent
local sensor-driver quirk), libcamera renders the image upright.
Signed-off-by: Mihail Antsev <mihail.antcev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The link frequency, retrieved in cvs_csi_enable_streams(), is stored in
the icvs structure to then be used right after in csi_set_link_cfg(),
called only from the same function. Pass it as a function parameter
instead to improve readability.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Antti Laakso <antti.laakso@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
In mt9t112_probe(), the clock error check after devm_v4l2_sensor_clk_get()
calls PTR_ERR(priv->clk) unconditionally, before testing IS_ERR().
On a successful lookup, priv->clk is a valid pointer and calling PTR_ERR()
on it is incorrect API usage. While the comparison against -ENOENT happens
to be harmless in practice (valid kernel pointers never fall in the error
range), this is still a violation of the IS_ERR()/PTR_ERR() contract that
can mislead readers.
Restructure the check to guard PTR_ERR() inside IS_ERR(), using the
simpler != -ENOENT form to avoid an unnecessary else clause.
Signed-off-by: Uday Khare <udaykhare77@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The migration to CCI helpers made V4L2_CID_FLASH_DURATION write the
requested duration directly to OV9282_REG_STROBE_FRAME_SPAN, dropping
the conversion from microseconds to the register value.
This made flash strobes too long and produced overly bright frames.
Restore the missing calculation so flash duration is programmed
correctly again.
Fixes: 273f52f3cb ("media: i2c: ov9282: Convert to CCI register access helpers")
Cc: Xiaolei Wang <xiaolei.wang@windriver.com>
Cc: stable@vger.kernel.org
Signed-off-by: Richard Leitner <richard.leitner@linux.dev>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
isys_notifier_init() initialises a v4l2 async notifier and then, for
each CSI-2 port, adds a remote sensor subdev to the notifier's
waiting_list via v4l2_async_nf_add_fwnode_remote(), which allocates a
sensor_async_sd descriptor and takes a fwnode reference.
If parsing or adding a later port fails, the code jumps to the
"err_parse" label, which only drops the current endpoint fwnode
reference and returns, without calling v4l2_async_nf_cleanup(). Any
descriptors already added to the notifier for earlier ports are
therefore leaked, and the caller's error path does not clean up the
notifier either.
Call v4l2_async_nf_cleanup() on the error path, matching the cleanup
already performed when v4l2_async_nf_register() fails. This is safe as
the notifier is always initialised before the loop is entered.
Fixes: a516d36bdc ("media: staging/ipu7: add IPU7 input system device driver")
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
This one was fully static, so no need to fill it in the register
function manually.
Signed-off-by: Link Mauve <linkmauve@linkmauve.fr>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
