All I2S instances are connected to different powertile form acp6.0
onwards, refactor dai driver to support all I2S instances for all acp
platforms.
Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
Link: https://patch.msgid.link/20240903113427.182997-3-venkataprasad.potturu@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The 2024 Lenovo Y9000P which use GT7868Q chip also needs a fixup.
The information of the chip is as follows:
I2C HID v1.00 Mouse [GXTP5100:00 27C6:01E0]
Signed-off-by: He Lugang <helugang@uniontech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
The codec can be used in conjunction with an audio-graph-card to provide
an endpoint for binding with the other side of the audio link.
Document the 'port' property that is used for this to prevent
dtbscheck errors like:
rockchip/rk3588-nanopc-t6-lts.dtb: codec@1b: Unevaluated properties are not allowed ('port' was unexpected)
from schema $id: http://devicetree.org/schemas/sound/realtek,rt5616.yaml#
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20240830203819.1972536-3-heiko@sntech.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Both devicetrees and driver implementation already use the specified mclk
in the field, so at least document the clock too, similarly to other
Realtek codec.
This has the nice additional effect of getting rid of dtbscheck warning.
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20240830203819.1972536-2-heiko@sntech.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Replace a comma between expression statements by a semicolon.
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Commit 8a0ec8c2d7 ("spi: Insert the missing pci_dev_put()before
return") added two uses of pci_dev_put() with an uninitialized dma_dev,
resulting in the following compiler warnings (or errors with
CONFIG_WERROR) when building with clang:
drivers/spi/spi-pxa2xx-pci.c:150:15: error: variable 'dma_dev' is uninitialized when used here [-Werror,-Wuninitialized]
150 | pci_dev_put(dma_dev);
| ^~~~~~~
drivers/spi/spi-pxa2xx-pci.c:228:15: error: variable 'dma_dev' is uninitialized when used here [-Werror,-Wuninitialized]
228 | pci_dev_put(dma_dev);
| ^~~~~~~
Commit 609d7ffdc4 ("spi: pxa2xx-pci: Balance reference count for PCI
DMA device") added a call to pci_dev_put() via
devm_add_action_or_reset() in case of failures, so the recent change was
incorrect for multiple reasons. Revert it altogether.
Fixes: 8a0ec8c2d7 ("spi: Insert the missing pci_dev_put()before return")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Closes: https://lore.kernel.org/CAMuHMdWNjo69_W6f+R9QJJOf8uF0htg2XazeS-yjugJv3UM+kg@mail.gmail.com/
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20240902-spi-revert-8a0ec8c2d736-v1-1-928b829fed2b@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Elan-ekth6a12nay requires reset to pull down time greater than 10ms,
so the configuration post_power_delay_ms is 10, and the chipset
initial time is required to be greater than 300ms,
so the post_gpio_reset_on_delay_ms is set to 300.
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Zhaoxiong Lv <lvzhaoxiong@huaqin.corp-partner.google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
The Elan ekth6a12nay touch screen chip same as Elan eKTH6915 controller
has a reset gpio. The difference is that they have different
post_power_delay_ms.
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Zhaoxiong Lv <lvzhaoxiong@huaqin.corp-partner.google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
When removing a resource from vmci_resource_table in
vmci_resource_remove(), the search is performed using the resource
handle by comparing context and resource fields.
It is possible though to create two resources with different types
but same handle (same context and resource fields).
When trying to remove one of the resources, vmci_resource_remove()
may not remove the intended one, but the object will still be freed
as in the case of the datagram type in vmci_datagram_destroy_handle().
vmci_resource_table will still hold a pointer to this freed resource
leading to a use-after-free vulnerability.
BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106
print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
__kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425
kasan_report+0x38/0x51 mm/kasan/report.c:442
vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182
ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline]
vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
__fput+0x261/0xa34 fs/file_table.c:282
task_work_run+0xf0/0x194 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187
exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
__syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline]
syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313
do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x6e/0x0
This change ensures the type is also checked when removing
the resource from vmci_resource_table in vmci_resource_remove().
Fixes: bc63dedb7d ("VMCI: resource object implementation.")
Cc: stable@vger.kernel.org
Reported-by: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez@oracle.com>
Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
devm_free_percpu() calls devres_release() with a pointer in percpu
address space. devres_release() expects pointers in the generic address
space, so address space needs to be stripped from the argument.
When strict percpu address space checks are enabled, then the current
direct cast from the percpu address space to the generic address space
fails the compilation on x86_64 with:
devres.c🔢32: error: cast to generic address space pointer from disjoint ‘__seg_gs’ address space pointer
Add intermediate casts to unsigned long to remove address space of
the pointer before casting it to the generic AS, as advised in [1]
and [2].
Side note: sparse still requires __force, although the documentation
[2] allows casts to unsigned long without __force attribute.
Found by GCC's named address space checks.
There were no changes in the resulting object file.
[1] https://gcc.gnu.org/onlinedocs/gcc/Named-Address-Spaces.html#x86-Named-Address-Spaces
[2] https://sparse.docs.kernel.org/en/latest/annotations.html#address-space-name
Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Link: https://lore.kernel.org/r/20240830083406.9695-1-ubizjak@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The following API cluster takes the same type parameter list, but do not
have consistent parameter check as shown below.
device_for_each_child(struct device *parent, ...) // check (!parent->p)
device_for_each_child_reverse(struct device *parent, ...) // same as above
device_find_child(struct device *parent, ...) // check (!parent)
Fixed by using consistent check (!parent || !parent->p) which covers
both existing checks for the cluster.
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20240824-const_dfc_prepare-v3-1-32127ea32bba@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Since commit d492cc2573 ("driver core: device.h: make struct
bus_type a const *"), the driver core can properly handle constant
struct bus_type, move the fsl_mc_bus_type variable to be a constant
structure as well, placing it into read-only memory which can not be
modified at runtime.
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu> # for
Link: https://lore.kernel.org/r/20240823062440.113628-1-kunwu.chan@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
These functions were never implenmented since introduction in
commit 8199d3a79c ("[PATCH] A new 10GB Ethernet Driver by Chelsio
Communications")
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Commit e2d14b42c2 ("cxgb4: Remove WOL get/set ethtool support") removed
t4_wol_magic_enable() and t4_wol_pat_enable() but leave declarations.
Commit 02d805dc5f ("cxgb4: use new fw interface to get the VIN and smt
index") leave behind cxgb4_tp_smt_idx().
cxgb4_dcb_set_caps() is never implemented and used since introduction in
commit 76bcb31efc ("cxgb4 : Add DCBx support codebase and dcbnl_ops").
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Commit 4d22de3e6c ("Add support for the latest 1G/10G Chelsio adapter,
T3.") declared but never implemented these.
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Set the driver default to enable asynchronous shutdown.
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Signed-off-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Tested-by: Keith Busch <kbusch@kernel.org>
Link: https://lore.kernel.org/r/20240822202805.6379-5-stuart.w.hayes@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add code to allow asynchronous shutdown of devices, ensuring that each
device is shut down before its parents & suppliers.
Only devices with drivers that have async_shutdown_enable enabled will be
shut down asynchronously.
This can dramatically reduce system shutdown/reboot time on systems that
have multiple devices that take many seconds to shut down (like certain
NVMe drives). On one system tested, the shutdown time went from 11 minutes
without this patch to 55 seconds with the patch.
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Signed-off-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Tested-by: Keith Busch <kbusch@kernel.org>
Link: https://lore.kernel.org/r/20240822202805.6379-4-stuart.w.hayes@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Make a separate function for the part of device_shutdown() that does the
shutown for a single device. This is in preparation for making device
shutdown asynchronous.
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Signed-off-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Tested-by: Keith Busch <kbusch@kernel.org>
Link: https://lore.kernel.org/r/20240822202805.6379-3-stuart.w.hayes@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Don't lock a parent device unless it is needed in device_shutdown. This
is in preparation for making device shutdown asynchronous, when it will
be needed to allow children of a common parent to shut down
simultaneously.
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Signed-off-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Tested-by: Keith Busch <kbusch@kernel.org>
Link: https://lore.kernel.org/r/20240822202805.6379-2-stuart.w.hayes@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The sctp selftest is very slow on debug kernels.
Its possible that the nf_queue listener program exits due to timeout
before first sctp packet is processed.
In this case socat hangs until script times out.
Fix this by removing the -t option where possible and kill the test
program once the file transfer/socat has exited.
-t sets SO_RCVTIMEO, its inteded for the 'ping' part of the selftest
where we want to make sure that packets get reinjected properly without
skipping a second queue request.
While at it, add a helper to compare the (binary) files instead of diff.
The 'diff' part was copied from a another sub-test that compares text.
Let helper dump file sizes on error so we can see the progress made.
Tested on an old 2010-ish box with a debug kernel and 100 iterations.
This is a followup to the earlier filesize reduction change.
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/netdev/20240829080109.GB30766@breakpoint.cc/
Fixes: 0a8b08c554 ("selftests: netfilter: nft_queue.sh: reduce test file size for debug build")
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20240830092254.8029-1-fw@strlen.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Since commit d492cc2573 ("driver core: device.h: make struct
bus_type a const *"), the driver core can properly handle constant
struct bus_type, move the platform_bus_type variable to be a constant
structure as well, placing it into read-only memory which can not be
modified at runtime.
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Link: https://lore.kernel.org/r/20240823075544.144426-1-kunwu.chan@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Device class has two namespace relevant fields which are usually
associated by the following usage:
struct class {
...
const struct kobj_ns_type_operations *ns_type;
const void *(*namespace)(const struct device *dev);
...
}
if (dev->class && dev->class->ns_type)
dev->class->namespace(dev);
(1) The usage looks weird since it checks @ns_type but calls namespace()
(2) The usage implies both fields have dependency but their dependency
is not currently enforced yet.
It is found for all existing class definitions that the other filed is
also assigned once one is assigned in current kernel tree.
Fixed by enforcing above existing dependency that both fields are required
for a device class to support namespace via parameter checks.
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20240822-class_fix-v1-1-2a6d38ba913a@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Do not write-protect the kernel read-only and __ro_after_init sections
earlier than before mark_rodata_ro() is called. This fixes a boot issue on
parisc which is triggered by commit 91a1d97ef4 ("jump_label,module: Don't
alloc static_key_mod for __ro_after_init keys"). That commit may modify
static key contents in the __ro_after_init section at bootup, so this
section needs to be writable at least until mark_rodata_ro() is called.
Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: matoro <matoro_mailinglist_kernel@matoro.tk>
Reported-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
Tested-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
Link: https://lore.kernel.org/linux-parisc/096cad5aada514255cd7b0b9dbafc768@matoro.tk/#r
Fixes: 91a1d97ef4 ("jump_label,module: Don't alloc static_key_mod for __ro_after_init keys")
Cc: stable@vger.kernel.org # v6.10+
Jinjie Ruan says:
====================
net: Simplified with scoped function
Simplify with scoped for each OF child loop, as well as dev_err_probe().
Changes in v4:
- Drop the fix patch and __free() patch.
- Rebased on the fix patch has been stripped out.
- Remove the extra parentheses.
- Ensure Signed-off-by: should always be last.
- Add Reviewed-by.
- Update the cover letter commit message.
Changes in v3:
- Sort the variables, longest first, shortest last.
- Add Reviewed-by.
Changes in v2:
- Subject prefix: next -> net-next.
- Split __free() from scoped for each OF child loop clean.
- Fix use of_node_put() instead of __free() for the 5th patch.
====================
Link: https://patch.msgid.link/20240830031325.2406672-1-ruanjinjie@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Use scoped for_each_available_child_of_node_scoped() when
iterating over device nodes to make code a bit simpler.
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Justin Chen <justin.chen@broadcom.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Avoids the need for manual cleanup of_node_put() in early exits
from the loop by using for_each_available_child_of_node_scoped().
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Use scoped for_each_available_child_of_node_scoped() when iterating
over device nodes to make code a bit simpler.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Use the dev_err_probe() helper to simplify code.
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Avoids the need for manual cleanup of_node_put() in early exits
from the loop by using for_each_available_child_of_node_scoped().
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Avoid need to manually handle of_node_put() by using
for_each_available_child_of_node_scoped(), which can simplfy code.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Avoid need to manually handle of_node_put() by using
for_each_child_of_node_scoped(), which can simplfy code.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Avoid need to manually handle of_node_put() by using
for_each_child_of_node_scoped(), which can simplfy code.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
There are several drivers/base APIs for finding a specific device, and
they currently use the following good type for the @match parameter:
int (*match)(struct device *dev, const void *data)
Since these operations do not modify the caller-provided @*data, this
type is worthy of a dedicated typedef:
typedef int (*device_match_t)(struct device *dev, const void *data)
Advantages of using device_match_t:
- Shorter API declarations and definitions
- Prevent further APIs from using a bad type for @match
So introduce device_match_t and apply it to the existing
(bus|class|driver|auxiliary)_find_device() APIs.
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20240813-dev_match_api-v3-1-6c6878a99b9f@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Most firmware names are hardcoded strings, or are constructed from fairly
constrained format strings where the dynamic parts are just some hex
numbers or such.
However, there are a couple codepaths in the kernel where firmware file
names contain string components that are passed through from a device or
semi-privileged userspace; the ones I could find (not counting interfaces
that require root privileges) are:
- lpfc_sli4_request_firmware_update() seems to construct the firmware
filename from "ModelName", a string that was previously parsed out of
some descriptor ("Vital Product Data") in lpfc_fill_vpd()
- nfp_net_fw_find() seems to construct a firmware filename from a model
name coming from nfp_hwinfo_lookup(pf->hwinfo, "nffw.partno"), which I
think parses some descriptor that was read from the device.
(But this case likely isn't exploitable because the format string looks
like "netronome/nic_%s", and there shouldn't be any *folders* starting
with "netronome/nic_". The previous case was different because there,
the "%s" is *at the start* of the format string.)
- module_flash_fw_schedule() is reachable from the
ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as
GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is
enough to pass the privilege check), and takes a userspace-provided
firmware name.
(But I think to reach this case, you need to have CAP_NET_ADMIN over a
network namespace that a special kind of ethernet device is mapped into,
so I think this is not a viable attack path in practice.)
Fix it by rejecting any firmware names containing ".." path components.
For what it's worth, I went looking and haven't found any USB device
drivers that use the firmware loader dangerously.
Cc: stable@vger.kernel.org
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Fixes: abb139e75c ("firmware: teach the kernel to load firmware files directly from the filesystem")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20240828-firmware-traversal-v3-1-c76529c63b5f@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
VPU for video decoding and the rk3128 sfc node can use the clock constant
now after the merge-window.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmbU3yIQHGhlaWtvQHNu
dGVjaC5kZQAKCRDzpnnJnNEdgcuBB/kBeNnJ266UlyAR4WHeG1Nx+vnf9iiMU8oi
x/effnB/zuO042YCGOCer5uOp2Z9/ZFkyOi/mQi5OnuotU/XHhVGCBCtt5ZBaczN
+e/Yhnq/b+mu9KgaKjZo3JNTtUcZ7xqhJPk7Tu8RiR7WucxtpAJ8IU7n64oxuxep
CjsULPLaU3DSRb8V1e0T0+CKLrfrM/ElNZjHPc2UDZUCd+nUp6dsilup65qQZAcQ
ADPbOsL5UcxJyDubIP67wLMS6V6UcnKDdZpR0z2+wxIBPZZ6VVHyGMj2MhnEZhKD
CxZb6Mg6pW1Ki/scZoAnWcK1ABsdPmUUwZ0csvfPD21Cbt7Ytw7b
=3S7y
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiK/NIGsWEZVxh/FrYKtH/8kJUicFAmbW550ACgkQYKtH/8kJ
UifuqQ//aGzIREkhrKhPPh4sPjZFb+teJrpAQ/j1x4Wl/ZRJgRqFnLCnGrRZF7YL
qhjpqC4dyC7y3iOHNiy/K+M6Lzkf9Uvamw0ymcVy20D8UWKq23E9An+T/MpbeXPz
jLKQduYmDB4DZ0tr4B82iyo4G8/ykbYAN5UPJl5jvMwTOtRKx6T0IupJPuX/pRJN
BIIxV5S4nVqDztNuilI3WXa2sPWVSGjeyRwnMCcARg+OPWFVHLvhD6D8sQHBDx6j
wHSZCOZ68ipnr1aTksQX2UH9J2fqIei3jthk5p+297Alh2z7H9AZ/PC8JCwGO3gL
C91ONK1cZYcsBMkdL7t8Z6vDy3WlOcudp4SmdUvuZ5tXFirzFPcVahHVJcwYoBdx
vUzBWVrF66D5ambdBFu1HpvhVRCMKNnw6uwkhCSdAvSiv3X5yoFsKTWE7QsT6vPX
2pD3spiSBpt/3MVXLhAVuHpbEs1FWD/O8GeWslYCXUkhgCei97mis7GhBUMpZzAu
4qwe8sKmWBxGLyNl1sA2SOwqyqjMUgwMiJO0g5xNlQizP/CladsHelEJKXk7IiGE
ZdZ3KL78NGmxcVPJ+9filRxb96N3C/JbnkzV3lgsgiKUWgz0u/bfgrT6n0LQXhCv
Ba3zOUZfihywKi0Tov6dB/SfaSC68xabaF0pYmmqICdFA60Fdy0=
=d6TH
-----END PGP SIGNATURE-----
Merge tag 'v6.12-rockchip-dts32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
spidev on the elgin-r1 got a real compatible, the rk3128 could enable its
VPU for video decoding and the rk3128 sfc node can use the clock constant
now after the merge-window.
* tag 'v6.12-rockchip-dts32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
ARM: dts: rockchip: Do not describe unexisting DAC device on rv1108-elgin-r1
ARM: dts: rockchip: Add vpu nodes for RK3128
ARM: dts: rockchip: use constant for HCLK_SFC on rk3128
Link: https://lore.kernel.org/r/3405397.RL5eaSpR8r@diego
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Taishan Pi RK3566, ODROID-M1S,NanoPC-T6 LTS, Cool Pi CM5 GenBook
Big number of improvements for NanoPC-T6,QNAP-TS433 and FastRhino R66S
With recent dtc changes making it into linux-next the Wolfvision Visualizer
overlay finally compiles without warnings. And smaller number of
improvements on a number of Radxa boards.
Interesting new additions on a soc-level are the hardware RNG on rk3568,
an additional sdmmc-controller (not supported before) on rk3328 and
v4l video codecs for the rk3588 (decoding of h.264 amongst others).
-----BEGIN PGP SIGNATURE-----
iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmbU4y4QHGhlaWtvQHNu
dGVjaC5kZQAKCRDzpnnJnNEdgXGsCACrCrqd90s6oE5y2dhmgyPdBHUmohhkE/m/
lq30aHjYROYlpNkFTVDezL9qaX74LkZ4vBMpd//189b2vp+vQOEOYN5Sjs2vrilY
f7Z1Wq38Czude4+AkOLMpnG/PExdtFO2AIjo4Zcg5i7NvC5eFd/59IyE4SoRzfEQ
f2AZ5iUPHrYjLgpUCoFBf9ydR4u2nZIrTEeVIij+1lGYfF9fHpoERpFBlIeUUzBB
C4e7AkAbty+O+OrXYM9v4vvWZMQzinAxCEBgt6I7bkj/JGIHOilPtk//7ejRIAlM
vRd6JwpRHyFAca9UBe+hmCf4o6q0PBgBnk3Pzu7v/2urf7hb9Egr
=66Iu
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiK/NIGsWEZVxh/FrYKtH/8kJUicFAmbW5zQACgkQYKtH/8kJ
UidcfA/+ON1rt9j7KwdvKOuGr20cBBoEPWaK0IocYzeLwrMwRQzlsOtftIdNB4tT
ANxZ6sxL3MEpj8g+WyittHC0yar4g/09sYq3I00y9PHHWeDp2w2aht3DqrstKBpu
l3cY1YtR1bZCrnNGhEBwJABIT3svhd/EBLfB+fNHFyxfVpufq0Bs0lIcIX0SjG10
TZxCGMFPrpg1X7XCZ/GIicPe+b1Yw5RFMKHorxLgK5GFTBozAV66S6oi2czVuQFQ
BtnOG1tjTGU7Udzfrr3a19wjIBwqigmovEh+/uUBp/VG27SQ7VBBymjUIeDkoAE5
oIBtC91EewTTbQ7wsjAY8CF+0E+O6T0wTQAgU3SDXf6LVXKA0MkxbqJ9tRrooETs
CNfHJ31VoyI4a2LqVaY7KyAUgAU3GglD+21beA0h7psnqWGKLeUM9rNCaNH1NWpV
KNHZSg5rLtVuLY6/kCCGbDj/HrrQ9FTtFHbLYGiXPZSvi2pbEsDUHwcYOPp10l0z
MAAsOrU+pFg5zoe53iZVF5fL2vMoSF9kvAlbqQfJUWwneft9fbwbLWl+b0/Jn0Un
xxSvix2Ip4f8pVE1nCmRlqHWp9nQDt7hj+K4AIu4vLoY/TT1JyIADqDk6IodMrjY
lKt/ckcOTeh5pSLuzxaI5RYYjAKBGhCxsSYGXpHZx0nz7TPD2jI=
=nwGo
-----END PGP SIGNATURE-----
Merge tag 'v6.12-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
New boards: Firefly PX30 Core SoM with JD4 baseboard, NanoPi 2S Plus,
Taishan Pi RK3566, ODROID-M1S,NanoPC-T6 LTS, Cool Pi CM5 GenBook
Big number of improvements for NanoPC-T6,QNAP-TS433 and FastRhino R66S
With recent dtc changes making it into linux-next the Wolfvision Visualizer
overlay finally compiles without warnings. And smaller number of
improvements on a number of Radxa boards.
Interesting new additions on a soc-level are the hardware RNG on rk3568,
an additional sdmmc-controller (not supported before) on rk3328 and
v4l video codecs for the rk3588 (decoding of h.264 amongst others).
* tag 'v6.12-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (62 commits)
arm64: dts: rockchip: drop unsupported regulator-property from NanoPC-T6
arm64: dts: rockchip: drop unsupported regulator property from NanoPC-T6
arm64: dts: rockchip: use correct fcs,suspend-voltage-selector on NanoPC-T6
arm64: dts: rockchip: add Mask Rom key on NanoPC-T6
arm64: dts: rockchip: enable USB-C on NanoPC-T6
arm64: dts: rockchip: enable GPU on NanoPC-T6
arm64: dts: rockchip: add IR-receiver to NanoPC-T6
arm64: dts: rockchip: add SPI flash on NanoPC-T6
arm64: dts: rockchip: add NanoPC-T6 LTS
arm64: dts: rockchip: move NanoPC-T6 parts to DTS
arm64: dts: rockchip: prepare NanoPC-T6 for LTS board
dt-bindings: arm: rockchip: Add NanoPC-T6 LTS
arm64: dts: rockchip: disable display subsystem only for Radxa E25
arm64: dts: rockchip: enable PCIe on M.2 E key for Radxa ROCK 5A
arm64: dts: rockchip: remove unnecessary properties for Radxa ROCK 5A
arm64: dts: rockchip: add dts for LCKFB Taishan Pi RK3566
dt-bindings: arm: rockchip: Add LCKFB Taishan Pi RK3566
dt-bindings: vendor-prefixes: Add Shenzhen JLC Technology Group LCKFB
arm64: dts: rockchip: Add Hardkernel ODROID-M1S
dt-bindings: arm: rockchip: Add Hardkernel ODROID-M1S
...
Link: https://lore.kernel.org/r/6322098.17fYzF0512@diego
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The call of of_get_child_by_name() will cause refcount incremented
for leds, if it succeeds, it should call of_node_put() to decrease
it, fix it.
Fixes: 01e5b728e9 ("net: phy: Add a binding for PHY LEDs")
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20240830022025.610844-1-ruanjinjie@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Rescind offer handling relies on rescind callbacks for some of the
resources cleanup, if they are registered. It does not unregister
vmbus device for the primary channel closure, when callback is
registered. Without it, next onoffer does not come, rescind flag
remains set and device goes to unusable state.
Add logic to unregister vmbus for the primary channel in rescind callback
to ensure channel removal and relid release, and to ensure that next
onoffer can be received and handled properly.
Cc: stable@vger.kernel.org
Fixes: ca3cda6fcf ("uio_hv_generic: add rescind support")
Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com>
Link: https://lore.kernel.org/r/20240829071312.1595-3-namjain@linux.microsoft.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For primary VM Bus channels, primary_channel pointer is always NULL. This
pointer is valid only for the secondary channels. Also, rescind callback
is meant for primary channels only.
Fix NULL pointer dereference by retrieving the device_obj from the parent
for the primary channel.
Cc: stable@vger.kernel.org
Fixes: ca3cda6fcf ("uio_hv_generic: add rescind support")
Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
Link: https://lore.kernel.org/r/20240829071312.1595-2-namjain@linux.microsoft.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sysfs_create_group() races with userspace. Use dev_groups instead which
prevents all the problems of sysfs_create_group().
Fixes: a194467676 ("misc: keba: Add basic KEBA CP500 system FPGA support")
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gerhard Engleder <eg@keba.com>
Link: https://lore.kernel.org/r/20240819192645.50171-1-gerhard@engleder-embedded.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
