NXP LPC32xx ARM changes for v7.3 contain:
- Karl Mehltretter fixes a multiplatform kernel runtime execution by
limiting LPC32xx SoC specific init functions to be run on this
platform only,
- a stale method of populating DMA, SLC and MLC NAND controllers is
removed from platform code, this change was announced to happen by
the end of this year, all touched by the change controllers are
properly described in the platform device tree for years, and very
old board dtbs are recommended to be updated.
-----BEGIN PGP SIGNATURE-----
iQJBBAABCgArFiEETKMJMWSwX7CFTVIOqj3i2jwlOWUFAmpj0sYNHHZ6QG1sZWlh
LmNvbQAKCRCqPeLaPCU5Zf+cD/9xrU205ChyR4mSCTlUCxLcQI8kripeF96Zx7Q7
Xo+dKlTjzTQYW8omBWlYSvOVY4rZVMB1NzwVPmPHIkBm13xdV0ybMVWmenOY7UD0
cG4yDcgkQETsH4XJnPLCDFZHDG8HS+eiYCr7Mb2sAmNWcb2iGdoW7y5GxHtiZsJL
IgydEqu/dOZCVkgnjlr2rS3EjbKpqyI6zPQ2TPAAzWch93Yczwk1NIYKM32ws6u1
MQ6Mf7hHggDiV85G/hch7k+z6F4LC6UlOxBNEtUmziJ8kjNGq5IMu42jNLMsDlS4
IGstOpckU0rr8BwuJG+5BNc+xK4EYaPac4uj1RRr1Nqwd/KzSKXjeNfdrds9XRdm
U6DPFO8q6vADvOdn5SlFaiYKi/vvnUDq2rsl5DjP6cnRLkDzhdIlufWz4n6/zY42
cmEwNstH1+fiGDeQcrWiG1pI6allKFAfbsBhgd7rXGlmOGeta1MqSyf326E1y/TP
sqiR9yWDI/rgceOJ4pPsZM7rXmh6kGa+NiYY1paHMR/N0RDKXeh+yeNyPC8RHgfs
tcFZ/KcRrsKd3huMbCHBQqGgpvKEM3Gh616keb1zZryO2XoSVAPXSy53NXtP7//V
qx89yYz2gqEl8C8bR+KooFWpK6bhmZpu9cPljA/Pnr0nzZrWEMlp9TueQCp7tAPX
TFoXag==
=n2BM
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpnCA0ACgkQmmx57+YA
GNn6dw//YKJr1HFeXzPnQHCjULX/oEd20WVFdX/YAHfgz3sBpnGyrMOPsFn0kmHp
HGKtztBkNOo0oq+IoMoWnpfoIFsYHpW4JB3wFYh0PUZ7tAi5eBTHcTTBJMCIta1a
huBj4tF5xU5ORv90qRT2cNWTxHYbw4sKxjhuT7RihUC5m2MzelWBY52dCmsSdSTq
i/wC6m7h7U4eQa81FQK7Q63YvGpBYAuJdfGJKNrtt3BefG5Og3ks3otiOkMcA8hm
bbY1l+dijHLe3oMD8w1pdu3mejvA+AhI8V1PBTsGKfAB/axsNSY5S/pSLRtowU6B
ZLoz47tQgqQamkxX/qdFy0PjlC8Juq/IHG/Kb1nyyD4GRVL27Ya8F9IAUt93PIdc
9V5vQyE4hmcY2oqxpGyK2YZoLRLBlGhjkMTV2qT4F6ejCgpt+J4l62ITwv0RPvNf
cJrTR3UuZd5BlxIGLx2bCxTISCuzZQy9czHTfhI3SX3o4ywgyxxW4uO6W/E5rzH2
IBhq7g5II+WXoyEQ8XWRskFbOSzZIWCxTp2inDKumzKCYxqwXD/a4JyjvNjZv/T0
tnKbtogO0CTvF0gJZhw6JbpdNUlQrwDRnTJOG3P5Do1iHazbdoh4ybzGi0L1y+SL
GQym1LIpA6ClYz7X13X+tTTDzupdCHgSwkJYMFvSZ2xB/ttIf6U=
=CrQ8
-----END PGP SIGNATURE-----
Merge tag 'lpc32xx-arm-for-7.3' of https://github.com/vzapolskiy/linux-lpc32xx into soc/arm
ARM: nxp: lpc32xx: ARM changes for v7.3
NXP LPC32xx ARM changes for v7.3 contain:
- Karl Mehltretter fixes a multiplatform kernel runtime execution by
limiting LPC32xx SoC specific init functions to be run on this
platform only,
- a stale method of populating DMA, SLC and MLC NAND controllers is
removed from platform code, this change was announced to happen by
the end of this year, all touched by the change controllers are
properly described in the platform device tree for years, and very
old board dtbs are recommended to be updated.
* tag 'lpc32xx-arm-for-7.3' of https://github.com/vzapolskiy/linux-lpc32xx:
ARM: lpc32xx: remove a few manually populated OF devices
ARM: lpc32xx: only run SoC init on LPC32xx hardware
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
FOLL_LONGTERM pinning fails for some memory types, such as file-backed
guest memory. As a result, kvm_s390_adapter_map() returns -EINVAL and
irqfd adapter registration fails even though interrupt delivery could
still work via the existing non-atomic path.
When FOLL_LONGTERM pinning fails, verify that the page is accessible
using a short-term pin instead. If the short-term pin succeeds, unpin
the page and add a map entry with pinned=false to preserve MAP/UNMAP
symmetry. The non-atomic irqfd path already performs short-term pinning
for interrupt delivery, so this restores the previous behavior for
memory that cannot be pinned long-term.
get_map_info() is updated to return NULL for unpinned entries so that
the atomic irqfd fast path falls back to the non-atomic path.
kvm_s390_adapter_unmap() and kvm_s390_unmap_all_adapters() skip dirty
marking and unpin for unpinned entries.
Update Documentation/virt/kvm/devices/s390_flic.rst to reflect the
new MAP/UNMAP behavior.
Fixes: c9a5688380 ("KVM: s390: Add map/unmap ioctl and clean mappings post-guest")
Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Douglas Freimuth <freimuth@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
New HW no longer implements a separate class for latency-sensitive QPs and
advertises this by a new cap bit.
REG_UMR is the only QP that used this feature, so gate its usage of the
feature on this cap.
Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260726-deprecate-lat-qps-v2-2-5e0c2ee55046@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
New HW no longer implements a separate class for latency-sensitive QPs
and advertises this by a new cap bit.
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Introduce the qp_latency_sensitive_disable capability bit to indicate
that the device no longer implements a separate class for
latency-sensitive QPs, so drivers can stop programming the
latency_sensitive QPC field and skip allocating the dedicated
fast-path bfreg on such HW.
Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260726-deprecate-lat-qps-v2-1-5e0c2ee55046@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
set_user_buf_size() computes the QP buffer size by left-shifting the
user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers.
A sufficiently large rq.wqe_cnt causes signed integer overflow, which
is undefined behavior, and yields a small or negative buf_size, causing
ib_umem_get() to map a buffer smaller than the hardware will actually
write into.
Replace the shifts and addition with check_shl_overflow() and
check_add_overflow(), rejecting invalid user inputs.
Moreover, guard the identical shift computing qp->sq.offset in
_create_user_qp() before set_user_buf_size() is reached.
Fixes: e126ba97db ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260723-fix-qp-buf-size-overflow-v1-1-ccb05ee43a7b@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Decouple RoCE acceleration counters exposure from the roce_accl device
cap. The device cap is intended to protect the access to the roce_accl
register and was disabled on VFs for that purpose.
Reading the acceleration counters, however, does not involve that
register, the counters are read-only statistics that carry no
configuration risk. Gating their exposure on the capability therefore
needlessly hides useful diagnostic data on VFs.
Expose the counters on all functions regardless of the capability.
Signed-off-by: Michael Gur <michaelgur@nvidia.com>
Reviewed-by: Chiara Meiohas <cmeiohas@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Link: https://patch.msgid.link/20260723-expose-roce-accl-counters-v1-1-967618b550cd@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
resctrl fs commands are becoming more powerful with, for example, a user able
to use syntax like '*' to make broad configuration changes. Such commands that
span multiple domains may result in more than one message printed to the
last_cmd_status buffer with more planned.
Issue "[truncated]" when displaying the last_cmd_status buffer to communicate
if it overflowed. Upon encountering this, user space is expected to combine
details about the failure found in info/last_cmd_status with related resctrl
files to learn the accurate system state after the command failure.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Link: https://patch.msgid.link/eb3d1aaa41d1f2bf6b1bb26ceafd52f04912121d.1782857711.git.reinette.chatre@intel.com
fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() when the lzma_streams module parameter is
unset, then z_erofs_load_lzma_config() preallocates one image-supplied
dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU
systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed
decoder state until the erofs module is unloaded.
Impact: An EROFS image mounted by the system can pin up to 8 MiB of
vmalloc memory per LZMA stream, either as intended or unexpectedly.
Bound the default stream count by a new
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the
worst-case default preallocation is 128 MiB if the number of CPUs is no
less than 16 while preserving the existing per-image dictionary limit.
An explicit lzma_streams module parameter is still honoured as-is, so
administrators who deliberately size the pool are not affected.
Fixes: 622ceaddb7 ("erofs: lzma compression support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Previously, backing files for page cache sharing were set up with
f_path left as NULL (only f_inode was valid). It worked, but a recent
mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on
7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__do_sys_mincore+0xc0/0x2c0
...
Specify valid paths using valid disconnected dentries together with
erofs_ishare_mnt instead of leaving f_path empty, so they are more
like real backing files in a pseudo filesystem and standard
backing_file_open() can be used directly.
Fixes: e187bc02f8 ("mm: do file ownership checks with the proper mount idmap")
Acked-by: Hongbo Li <hongbohbli@tencent.com>
Signed-off-by: Gao Xiang <xiang@kernel.org>
User space expects last_cmd_status to contain additional information if any
resctrl command fails.
A resctrl command may be blocked on the rdtgroup_mutex waiting for another
command to finish and find that once the mutex is available that the resource
group has since been deleted.
In this scenario the command will fail while last_cmd_status contains either
"ok" if the last_cmd_status buffer is empty or an outdated error from
a previous command failure if last_cmd_status buffer has content.
Include clearing of last_cmd_status buffer as part of rdtgroup_kn_lock_live()
that is used to obtain access and needed locking to a resource group before
attempting a command on the group.
With the last_cmd_status buffer ready, provide an appropriate message to user
space if the resource group has been deleted.
No last_cmd_status treatment is needed for the remaining failure of
rdtgroup_kn_lock_live() encountering a non-existent resource group since that
could only occur during an attempt to obtain a resource group lock on a file
in info/ which is an invalid usage.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Link: https://patch.msgid.link/9982141ec6f3ec18e0c53d7feabb19651583cf0e.1782857711.git.reinette.chatre@intel.com
info/last_cmd_status is intended to contain more information if a write to
any resctrl file fails. Writes to max_threshold_occupancy did not receive
last_cmd_status support during initial last_cmd_status enabling. Add it now.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Link: https://patch.msgid.link/dfc60cf5324e15612db075b0987bd89c490fbad5.1782857711.git.reinette.chatre@intel.com
Add NOUVEAU_FIFO_ENGINE_NVDEC to the abi16 uAPI and accept it in
channel allocation, mapping it to the NVDEC engine runlist.
Skip the Turing copy-engine workaround object for NVDEC channels: the
copy engines are not part of the NVDEC runlist, so the workaround
object cannot be instantiated on such channels (and is not needed
there).
This is required for NVK to implement Vulkan Video H.264 decode on top
of the NVDEC engine:
https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/31867
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260725035912.1016464-1-daniel.almeida@collabora.com
When traversing internal block structures of a descriptor in
fw_core_add_descriptor(), each sub-block header specifies its own length
in the upper 16 bits of its header quadlet.
If a malformed or corrupted descriptor provides a sub-block length that
exceeds the remaining total length of the descriptor buffer, the parsing
loop advances past the allocated boundary of desc->data, leading to an
out-of-bounds read access.
Validate each sub-block's length against the remaining descriptor size
before advancing the offset pointer to ensure loop bounds safety.
Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
Link: https://lore.kernel.org/r/20260725155255.3054-3-sreekuttan2156239@gmail.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
In fw_core_add_descriptor(), incoming descriptor structures are processed
without checking whether the descriptor's specified length falls within
valid boundaries. An empty descriptor (length 0) or an oversized descriptor
exceeding the IEEE 1394 Config ROM capacity can lead to invalid processing.
Add bounds checking at the start of fw_core_add_descriptor() using the
in_range() helper macro to reject descriptors with length 0 or length
exceeding 256 quadlets (the standard maximum Configuration ROM size).
Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
Link: https://lore.kernel.org/r/20260725155255.3054-2-sreekuttan2156239@gmail.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
stm32_rng_probe() enables autosuspend and runtime PM before registering the
hwrng. If devm_hwrng_register() fails, probe returns with runtime PM left
enabled and autosuspend still selected.
The remove callback also only disables runtime PM and does not undo
pm_runtime_use_autosuspend().
Use devm_pm_runtime_enable() so runtime PM is unwound automatically on
probe failure and driver detach. Since the managed cleanup also disables
runtime PM,drop the remove callback.
Fixes: c6a97c42e3 ("hwrng: stm32 - add support for STM32 HW RNG")
Cc: stable@vger.kernel.org
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
hlf_q_num is set but never read; drop the field and its assignment.
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
sec_create_qp_ctx() reads ctx->type_supported to pick its callback, but
sec_skcipher_init() and sec_aead_init() set it after sec_ctx_base_init()
has already walked the qp_ctx loop, so the value is uninitialized when
first consumed. Set type_supported in sec_ctx_base_init() before the
loop; the alg init paths now just select req_op from it.
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Since commit 55b48e23f5 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Acked-by: Maxime Méré <maxime.mere@foss.st.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Since commit 55b48e23f5 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() and dev_err_probe() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Since commit 55b48e23f5 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Replace the open-coded omap_sham_get_res_of()/omap_sham_get_res_pdev()
helpers and the #ifdef CONFIG_OF machinery with the managed
devm_platform_get_and_ioremap_resource(), platform_get_irq() and
device_get_match_data() helpers. The omap_sham_pdata_omap2 fallback is
kept for the non-DT (legacy platform_device) case. This removes the
manual resource copy and ioremap, simplifying probe.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Replace the open-coded omap_aes_get_res_of()/omap_aes_get_res_pdev()
helpers and the #ifdef CONFIG_OF machinery with the managed
devm_platform_get_and_ioremap_resource(), platform_get_irq() and
device_get_match_data() helpers. The omap_aes_pdata_omap2 fallback is
kept for the non-DT (legacy platform_device) case, and the now-unused
err_res label is removed.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Replace the open-coded platform_get_resource() plus devm_ioremap()
sequence in the SEC_NUM_ADDR_REGIONS loop with
devm_platform_ioremap_resource(), which fetches the resource, requests
the region and maps it in one call. Switch the error check to
IS_ERR()/PTR_ERR() and drop the now-unused struct resource pointer.
The driver only maps indices 0 and 1 (SEC_COMMON, SEC_SAA). On hip07 the
corresponding reg regions (0xd0000000, 0xd2000000) are 0x10000 each and
disjoint, so the region reservation added by devm_ioremap_resource() is
exclusive and does not introduce overlap failures.
Built for arm64 (drivers/crypto/hisilicon/sec/sec_drv.o) with LLVM=1.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The Keem Bay OCS AES/SM4 driver has an OF match table wired to
.of_match_table, but does not export the table with MODULE_DEVICE_TABLE().
Although the match table lives in keembay-ocs-aes-core.o, that object is
part of the composite keembay-ocs-aes module. Add the missing
MODULE_DEVICE_TABLE(of, ...) entry so modpost can generate OF module alias
information for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by the
platform driver, and the missing module alias publication.
Fixes: 8857433245 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4")
Signed-off-by: Can Peng <pengcan@kylinos.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Document the crypto engine on the Qualcomm Shikra platform.
Signed-off-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Document shikra compatible for the True Random Number Generator.
Signed-off-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Couple of already merged SoCs(like sc7280, sm8750, kaanapali etc.)
describe ICE as single clock historically which are recently updated
with mandatory 2 clocks.
Keep only the known legacy compatibles flexible, and make strict
validation default(of power-domains and 2 clocks) for all other Soc
compatibles.
This ensures old DTs are valid while ensuring any new SoC (like hawi,
milos, eliza, nord, maili or any upcoming ones) must follow latest
requirements by default.
Signed-off-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
kmb_ocs_aes_probe() requests the device IRQ before initializing
irq_completion. Once the handler is registered it can run immediately,
and ocs_aes_irq_handler() unconditionally calls complete(). An
interrupt in this window would therefore use an uninitialized
completion.
Initialize the completion before requesting the IRQ, as the sibling
OCS HCU and ECC drivers already do.
Fixes: 8857433245 ("crypto: keembay - Add support for Keem Bay OCS AES/SM4")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The cifs.idmap key type stores its payload length in key->datalen, which
is limited to U16_MAX. Accepting a larger key payload truncates the
recorded length and can make later users interpret the payload using
inconsistent bounds.
Reject oversized preparsed payloads before allocating or copying them.
This keeps key->datalen consistent with the stored data for both inline
and separately allocated idmap payloads.
Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Both branches of the check return the same value, so the check has
no effect. Remove it and return the value directly.
This is the result of running the Coccinelle script from
scripts/coccinelle/misc/cond_return_no_effect.cocci.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CIFSSMBRead(), CIFSSMBWrite() and CIFSSMBWrite2() allocate a request
buffer before checking whether tcon->ses->server is NULL. If that
defensive check ever fails, the helper returns -ECONNABORTED without
releasing the request buffer.
Fix these leaks by releasing the allocated request buffer before
returning from these error paths. Use cifs_small_buf_release() for the
buffers allocated by small_smb_init() and cifs_buf_release() for the
buffer allocated by smb_init().
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings.
Runtime validation used a temporary fault-injection hook to force
tcon->ses->server to NULL after request-buffer initialization. On the
unfixed kernel, the harness observed two leaked small request buffers and
one leaked large request buffer, with directed kmemleak dumps confirming
the CIFS buffer allocation stacks. After the fix, no CIFS request-buffer
deltas remained.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Currently, cifs_get_swn_reg() allocates new registry entries using
GFP_ATOMIC. Since we lock a mutex here, this is clearly not an atomic
context. Use GFP_KERNEL instead.
Also, fix a minor grammatical error in the comment above the function.
Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
When evaluating shost->max_sectors, we currently check dma_dev->dma_mask is
non-NULL, as dma_max_mapping_size(dma_dev) could previously not handle
unset dma_dev->dma_mask - this is no longer the case.
Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260629085310.2298552-3-john.g.garry@oracle.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
For when a device is not DMA capable, the max mapping size would be 0, so
make dma_max_mapping_size() reflect that.
Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260629085310.2298552-2-john.g.garry@oracle.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
- Use the correct name for a struct in kernel-doc
- Add kernel-doc for missing struct members or correct the name
Warning: ./include/ufs/ufshcd.h:201 Excess struct member 'task_tag'
description in 'ufshcd_lrb'
Warning: ./include/ufs/ufshcd.h:220 expecting prototype for struct
ufs_query_resp. Prototype was for struct ufs_query_res instead
Warning: ./include/ufs/ufshcd.h:577 struct member 'suspend_on_no_request'
not described in 'ufs_clk_scaling'
Warning: ./include/ufs/ufshcd.h:1269 struct member 'nortt' not described
in 'ufs_hba'
Warning: ./include/ufs/ufshcd.h:1269 struct member 'trigger_eh_attr' not
described in 'ufs_hba'
Warning: ./include/ufs/ufshcd.h:1269 struct member 'timeout_attr' not
described in 'ufs_hba'
Warning: ./include/ufs/ufshcd.h:1269 struct member 'lsdb_sup' not
described in 'ufs_hba'
Warning: ./include/ufs/ufshcd.h:1269 struct member 'vcc_off_delay_us' not
described in 'ufs_hba'
Warning: ./include/ufs/ufshcd.h:1269 Excess struct member 'desc_size'
description in 'ufs_hba'
Warning: ./include/ufs/ufshcd.h:1269 Excess struct member 'res'
description in 'ufs_hba'
Warning: ./include/ufs/ufshcd.h:1309 struct member 'sq_tail_slot' not
described in 'ufs_hw_queue'
Warning: ./include/ufs/ufshcd.h:1309 Excess struct member 'sq_tp_slot'
description in 'ufs_hw_queue'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260720013759.2979593-1-rdunlap@infradead.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
