Commit graph

1,399,042 commits

Author SHA1 Message Date
Mario Limonciello
72942d6538 crypto: ccp - Add missing tee info reg for teev2
The tee info reg for teev2 is the same as teev1.

Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:49 +08:00
Mario Limonciello
52e8ae868a crypto: ccp - Add missing bootloader info reg for pspv5
The bootloader info reg for pspv5 is the same as pspv4.

Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:49 +08:00
Ovidiu Panait
c822831b42 crypto: sun8i-ce - move fallback ahash_request to the end of the struct
'struct ahash_request' has a flexible array at the end, so it must be the
last member in a struct, to avoid overwriting other struct members.

Therefore, move 'fallback_req' to the end of the 'sun8i_ce_hash_reqctx'
struct.

Fixes: 56f6d5aee8 ("crypto: sun8i-ce - support hash algorithms")
Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:48 +08:00
Bharat Bhushan
d15cbe7137 crypto: octeontx2 - Use dynamic allocated memory region for lmtst
Current driver uses static LMTST region allocated by firmware.
Firmware allocated memory for LMTST is available in PF/VF BAR2.
Using this memory have performance impact as this is mapped as
device memory. There is another option to allocate contiguous
memory at run time and map this in LMT MAP table with the
help of AF driver. With this patch dynamic allocated memory
is used for LMTST.

Also add myself as maintainer for crypto octeontx2 driver

Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:48 +08:00
Bharat Bhushan
57b1e1c090 crypto: octeontx2 - Initialize cptlfs device info once
Function otx2_cptlf_set_dev_info() initializes common
fields of cptlfs data-struct. This function is called
every time a cptlf is initialized but this needs be done
once for a cptlf block. So this initialization is moved
to early device probe code to avoid redundant initialization.

Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
270b6f1345 crypto: xts - Only add ecb if it is not already there
Only add ecb to the cipher name if it isn't already ecb.

Also use memcmp instead of strncmp since these strings are all
stored in an array of length CRYPTO_MAX_ALG_NAME.

Fixes: f1c131b454 ("crypto: xts - Convert to skcipher")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
3d73909bdd crypto: lrw - Only add ecb if it is not already there
Only add ecb to the cipher name if it isn't already ecb.

Also use memcmp instead of strncmp since these strings are all
stored in an array of length CRYPTO_MAX_ALG_NAME.

Fixes: 700cb3f5fe ("crypto: lrw - Convert to skcipher")
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202505151503.d8a6cf10-lkp@intel.com
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
18c438b228 crypto: testmgr - Add hash export format testing
Ensure that the hash state can be exported to and imported from
the generic algorithm.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
c2a813545e crypto: testmgr - Use ahash for generic tfm
As shash is being phased out, use ahash for the generic tfm.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
c3103416d5 crypto: hmac - Add ahash support
Add ahash support to hmac so that drivers that can't do hmac in
hardware do not have to implement duplicate copies of hmac.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
8e69871836 crypto: testmgr - Ignore EEXIST on shash allocation
Soon hmac will support ahash.  For compatibility hmac still supports
shash so it is possible for two hmac algorithms to be registered at
the same time.  The shash algorithm will have the driver name
"hmac-shash(XXX-driver)".  Due to a quirk in the API, there is no way
to locate the shash algorithm using the name "hmac(XXX-driver)".  It
has to be addressed as either "hmac(XXX)" or "hmac-shash(XXX-driver)".

Looking it up with "hmac(XXX-driver)" will simply trigger the creation
of another instance, and on the second instantiation this will fail
with EEXIST.

Catch the error EEXIST along with ENOENT since it is expected.

If a real shash algorithm came this way, it would be addressed using
the proper name "hmac-shash(XXX-driver)".

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
91b6ff579d crypto: algapi - Add driver template support to crypto_inst_setname
Add support to crypto_inst_setname for having a driver template
name that differs from the algorithm template name.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:20 +08:00
Herbert Xu
32a9fd8f49 crypto: shash - Set reqsize in shash_alg
Make reqsize static for shash algorithms.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Herbert Xu
8cf4c341f1 crypto: hmac - Add export_core and import_core
Add export_import and import_core so that hmac can be used as a
fallback by block-only drivers.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Herbert Xu
a05a8bc570 crypto: hmac - Zero shash desc in setkey
The shash desc needs to be zeroed after use in setkey as it is
not finalised (finalisation automatically zeroes it).

Also remove the final function as it's been superseded by finup.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Herbert Xu
9d7a0ab1c7 crypto: ahash - Handle partial blocks in API
Provide an option to handle the partial blocks in the ahash API.
Almost every hash algorithm has a block size and are only able
to hash partial blocks on finalisation.

As a first step disable virtual address support for algorithms
with state sizes larger than HASH_MAX_STATESIZE.  This is OK as
virtual addresses are currently only used on synchronous fallbacks.

This means ahash_do_req_chain only needs to handle synchronous
fallbacks, removing the complexities of saving the request state.

Also move the saved request state into the ahash_request object
as nesting is no longer possible.

Add a scatterlist to ahash_request to store the partial block.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Herbert Xu
c6a12f394c crypto: hash - Add export_core and import_core hooks
Add export_core and import_core hooks.  These are intended to be
used by algorithms which are wrappers around block-only algorithms,
but are not themselves block-only, e.g., hmac.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Herbert Xu
cd5a4d5306 crypto: hash - Move core export and import into internel/hash.h
The core export and import functions are targeted at implementors
so move them into internal/hash.h.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
7d39f32c8c dt-bindings: crypto: Convert Marvell CESA to DT schema
Convert the Marvell CESA binding to DT schema format. The
marvell-cesa.txt and mv_cesa.txt are duplicate bindings.

The clock properties are quite varied for each platform hence the
if/then schemas. The old binding was fairly accurate with reality.

The original binding didn't mention there is 1 interrupt per CESA
engine. Based on users, there's a maximum of 2 engines.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
7eff621c46 dt-bindings: crypto: Convert img,hash-accelerator to DT schema
Convert the Imagination Technologies hardware hash accelerator binding
to DT schema format. It's a straight forward conversion.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
036454de0f dt-bindings: crypto: Convert hisilicon,hip0{6,7}-sec to DT schema
Convert the HiSilicon HIP06/7 Security Accelerator binding to DT schema
format. It's a straight forward conversion.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
b525ac4be3 dt-bindings: crypto: Convert brcm,spum-crypto to DT schema
Convert the Broadcom SPUM/SPU2 binding to DT schema format. It's a
straight forward conversion.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
bbd8265d45 dt-bindings: crypto: Convert axis,artpec6-crypto to DT schema
Convert the Axis Crypto engine binding to DT schema format. It's a
straight forward conversion.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
aa238d34d3 dt-bindings: crypto: Convert amd,ccp-seattle-v1a to DT schema
Convert the AMD Cryptographic Coprocessor binding to DT schema format.
It's a straight forward conversion.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
7996ace661 dt-bindings: crypto: Drop obsolete mediatek,eip97-crypto
The mediatek,eip97-crypto binding is half abandoned. The driver was
dropped in 2020 as the Mediatek platforms use InsideSecure block and
the driver for it. All the platforms except MT7623 were updated. A
patch to update it was submitted, but never addressed the review
comments.

Link: https://lore.kernel.org/all/20210303080923.16761-1-vic.wu@mediatek.com/
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Rob Herring (Arm)
7686133408 dt-bindings: crypto: fsl,sec-v4.0: Add fsl,sec-v6.0
The fsl,sec-v6.0 binding is the same as the fsl,sec-v4.0 binding, so add
it to the existing schema and drop the old .txt binding.

The compatibles in the .txt binding don't match the 1 user. Follow the
user for the schema.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Suman Kumar Chakraborty
662c62bb83 crypto: qat - enable reporting of error counters for GEN6 devices
Enable the reporting of error counters through sysfs for QAT GEN6
devices and update the ABI documentation.

This enables the reporting of the following:
   - errors_correctable - hardware correctable errors that allow the
     system to recover without data loss.
   - errors_nonfatal: errors that can be isolated to specific in-flight
     requests.
   - errors_fatal: errors that cannot be contained to a request,
     requiring a Function Level Reset (FLR) upon occurrence.

Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Suman Kumar Chakraborty
7f3401d0a5 crypto: qat - enable RAS support for GEN6 devices
Enable the reporting and handling of errors for QAT GEN6 devices.

Errors are categorized as correctable, non-fatal, or fatal. Error
handling involves reading the error source registers (ERRSOU0 to ERRSOU3)
to determine the source of the error and then decoding the actual source
reading specific registers.

The action taken depends on the error type:
   - Correctable and Non-Fatal errors. These error are logged, cleared and
     the corresponding counter is incremented.
   - Fatal errors. These errors are logged, cleared and a Function Level
     Reset (FLR) is scheduled.

This reports and handles the following errors:
   - Accelerator engine (AE) correctable errors
   - Accelerator engine (AE) uncorrectable errors
   - Chassis push-pull (CPP) errors
   - Host interface (HI) parity errors
   - Internal memory parity errors
   - Receive interface (RI) errors
   - Transmit interface (TI) errors
   - Interface for system-on-chip (SoC) fabric (IOSF) primary command
     parity errors
   - Shared RAM and slice module (SSM) errors

Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
John Allen
63935e2ee1 crypto: ccp - Add support for PCI device 0x17D8
Add a new CCP/PSP PCI device ID.

Signed-off-by: John Allen <john.allen@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:48:19 +08:00
Ivan Pravdin
b2df03ed40 crypto: algif_hash - fix double free in hash_accept
If accept(2) is called on socket type algif_hash with
MSG_MORE flag set and crypto_ahash_import fails,
sk2 is freed. However, it is also freed in af_alg_release,
leading to slab-use-after-free error.

Fixes: fe869cdb89 ("crypto: algif_hash - User-space interface for hash operations")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:44:16 +08:00
Dominik Grzegorzek
d6ebcde6d4 padata: do not leak refcount in reorder_work
A recent patch that addressed a UAF introduced a reference count leak:
the parallel_data refcount is incremented unconditionally, regardless
of the return value of queue_work(). If the work item is already queued,
the incremented refcount is never decremented.

Fix this by checking the return value of queue_work() and decrementing
the refcount when necessary.

Resolves:

Unreferenced object 0xffff9d9f421e3d80 (size 192):
  comm "cryptomgr_probe", pid 157, jiffies 4294694003
  hex dump (first 32 bytes):
    80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff  ...A............
    d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00  ..............#.
  backtrace (crc 838fb36):
    __kmalloc_cache_noprof+0x284/0x320
    padata_alloc_pd+0x20/0x1e0
    padata_alloc_shell+0x3b/0xa0
    0xffffffffc040a54d
    cryptomgr_probe+0x43/0xc0
    kthread+0xf6/0x1f0
    ret_from_fork+0x2f/0x50
    ret_from_fork_asm+0x1a/0x30

Fixes: dd7d37ccf6 ("padata: avoid UAF for reorder_work")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dominik Grzegorzek <dominik.grzegorzek@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19 13:44:16 +08:00
Kent Overstreet
494d458cfa bcachefs: fix extent_has_stripe_ptr()
This wasn't checking indirect extents.

Fixes: https://github.com/koverstreet/bcachefs/issues/887
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-05-18 22:35:33 -04:00
Dave Airlie
7c1a9408ce Merge tag 'drm-msm-next-2025-05-16' of https://gitlab.freedesktop.org/drm/msm into drm-next
Updates for v6.16

CI:
- uprev mesa

GPU:
- ACD (Adaptive Clock Distribution) support for X1-85.  This is required
  enable the higher frequencies.
- Drop fictional `address_space_size`.  For some older devices, the address
  space size is limited to 4GB to avoid potential 64b rollover math problems
  in the fw.  For these, an `ADRENO_QUIRK_4GB_VA` quirk is added.  For
  everyone else we get the address space size from the SMMU `ias` (input
  address sizes), which is usually 48b.
- Improve robustness when GMU HFI responses time out
- Fix crash when throttling GPU immediately during boot
- Fix for rgb565_predicator on Adreno 7c3
- Remove `MODULE_FIRMWARE()`s for GPU, the GPU can load the firmware after
  probe and having partial set of fw (ie. sqe+gmu but not zap) causes problems

MDSS:
- Added SAR2130P support to MDSS driver

DPU:
- Changed to use single CTL path for flushing on DPU 5.x+
- Improved SSPP allocation code to allow sharing of SSPP between planes
- Enabled SmartDMA on SM8150, SC8180X, SC8280XP, SM8550
- Added SAR2130P support
- Disabled DSC support on MSM8937, MSM8917, MSM8953, SDM660
- Misc fixes

DP:
- Switch to use new helpers for DP Audio / HDMI codec handling
- Fixed LTTPR handling

DSI:
- Added support for SA8775P
- Added SAR2130P support

MDP4:
- Fixed LCDC / LVDS controller on

HDMI:
- Switched to use new helpers for ACR data
- Fixed old standing issue of HPD not working in some cases

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <robdclark@gmail.com>
Link: https://lore.kernel.org/r/CAF6AEGv2Go+nseaEwRgeZbecet-h+Pf2oBKw1CobCF01xu2XVg@mail.gmail.com
2025-05-19 11:05:58 +10:00
Dave Airlie
72dc7c0585 amdgpu:
- Misc code cleanups
 - UserQ fixes
 - MALL reporting fix
 - DP AUX fixes
 - DCN 3.5 fixes
 - DP MST fixes
 - DC DMI quirks cleanup
 - RAS fixes
 - SR-IOV updates
 - GC 9.5 updates
 - Misc display fixes
 - VCN 4.0.5 powergating race fix
 - SMU 13.x updates
 - Paritioning fixes
 - VCN 5.0.1 SR-IOV updates
 - JPEG 5.0.1 SR-IOV updates
 
 amdkfd:
 - Fix spurious warning in interrupt code
 - XNACK fixes
 
 radeon:
 - CIK doorbell cleanup
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaCeihQAKCRC93/aFa7yZ
 2P47AP9VPY0RK9phyNoKxdtbRiGI3/duUdHRLUcph4WKVokaBwD/eCwpCxQ2DNN4
 zmV/NSZwSq/60lKgfOLk9+iMZvulJwQ=
 =lHeS
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-next-6.16-2025-05-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-next

amdgpu:
- Misc code cleanups
- UserQ fixes
- MALL reporting fix
- DP AUX fixes
- DCN 3.5 fixes
- DP MST fixes
- DC DMI quirks cleanup
- RAS fixes
- SR-IOV updates
- GC 9.5 updates
- Misc display fixes
- VCN 4.0.5 powergating race fix
- SMU 13.x updates
- Paritioning fixes
- VCN 5.0.1 SR-IOV updates
- JPEG 5.0.1 SR-IOV updates

amdkfd:
- Fix spurious warning in interrupt code
- XNACK fixes

radeon:
- CIK doorbell cleanup

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://lore.kernel.org/r/20250516204609.2437472-1-alexander.deucher@amd.com
2025-05-19 09:02:41 +10:00
Thorsten Blum
eb43efd062 m68k: Replace memcpy() + manual NUL-termination with strscpy()
Use strscpy() to safely copy the command-line string instead of memcpy()
followed by a manual NUL-termination.

The source string is also NUL-terminated and meets the __must_be_cstr()
requirement of strscpy().

No functional changes intended.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2025-05-19 08:54:30 +10:00
Mohammad Mahdi Anbaraki
245bb7b95a m68k/kernel: replace strncpy() with strscpy()
Swapped out strncpy() for strscpy() in parse_uboot_commandline() while
copying to commandp. strscpy() makes sure the string is properly null-
terminated and gives a more useful return value so it's just a safer
choice overall.

Link: https://github.com/KSPP/linux/issues/90
Signed-off-by: Mohammad Mahdi Anbaraki <m.mahdianbaraki@gmail.com>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2025-05-19 08:54:30 +10:00
Bartosz Golaszewski
0c4aba403f m68k: coldfire: gpio: use new line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2025-05-19 08:54:30 +10:00
Inochi Amaoto
108a767798 riscv: dts: sophgo: switch precise compatible for existed clock device for CV18XX
replace newly added precise compatible with old one for existed
clock device of CV18XX series SoCs.

Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20250504104553.1447819-4-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
ae5bac370e riscv: dts: sophgo: Add initial device tree of Sophgo SRD3-10
Sophgo SG2044 SRD3-10 board bases on Sophgo SG2044 SoC.
This board includes 5 uart ports, 5 pcie x8 slots, 1 1G Ethernet port,
1 microSD slot.

Add initial device tree of this board with uart support.

Link: https://lore.kernel.org/r/20250413223507.46480-11-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
22db96e4ab dt-bindings: riscv: sophgo: Add SG2044 compatible string
Add compatible string for the Sophgo SG2044 SoC and the SRD3-10
board.

Acked-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
Link: https://lore.kernel.org/r/20250413223507.46480-10-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
beb2072860 dt-bindings: interrupt-controller: Add Sophgo SG2044 PLIC
The SG2044 implement a standard T-HEAD C900 PLIC, which is
already supported by the kernel.

Add compatible string for Sophgo SG2044 plic.

Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20250413223507.46480-5-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
bced6beb16 dt-bindings: interrupt-controller: Add Sophgo SG2044 CLINT mswi
As SG2044 also implements an enhanced ACLINT as SG2042, add necessary
compatible string for SG2044 SoC.

Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20250413223507.46480-4-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
e595fa85db riscv: dts: sopgho: use SOC_PERIPHERAL_IRQ to calculate interrupt number
Since riscv and arm architecture use different interrupt definitions,
use a macro SOC_PERIPHERAL_IRQ mask this difference.

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20250430012654.235830-5-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
a0cd6d17f8 riscv: dts: sophgo: rename header file cv18xx.dtsi to cv180x.dtsi
As the cv18xx.dtsi serves as a common peripheral header for all
riscv cv180x/cv181x/sg200x SoCs, it not cover the entire cv18xx
series as there is cv182x and cv183x. So rename the header file
to make it precise.

Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20250430012654.235830-4-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
0212bd4fad riscv: dts: sophgo: Move riscv cpu definition to a separate file
As sg2000 and sg2002 can boot from an arm a53 core, it is not
suitable to left the riscv cpu definition in the common peripheral
header.

Move the riscv related device into a separate header file, so the
arm subsystem can reuse the common peripheral header.

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20250430012654.235830-3-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
33da812c45 riscv: dts: sophgo: Move all soc specific device into soc dtsi file
Although the cv1800b/cv1812h/sg2000/sg2002 share most peripherals,
some basic peripherals, like clock, pinctrl, clint and plint, are
not shared. These are caused by not only historical reason (plic,
clint), but also the fact the device is not the same (clock, pinctrl).

It is good to override device compatible when the SoC number is small,
but now it is a burden for maintenance, and it is kind of annoyed to
explain why using override. So it is time to move this out of the
common peripheral header.

Move all soc related peripheral device from common peripheral header
to the soc specific header to get rid of most compatible override.

Reviewed-by: Yixun Lan <dlan@gentoo.org>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20250430012654.235830-2-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Zixian Zeng
73ab31a8f3 riscv: sophgo: dts: Add spi controller for SG2042
Add spi controllers for SG2042.

SG2042 uses the upstreamed Synopsys DW SPI IP.

Signed-off-by: Zixian Zeng <sycamoremoon376@gmail.com>
Link: https://lore.kernel.org/r/20250425-sfg-spi-v6-3-2dbe7bb46013@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:26 +08:00
Inochi Amaoto
1cb666ec5a riscv: dts: sophgo: sg2042: add pinctrl support
Add pinctrl node and related pin configuration for SG2042 SoC.

Link: https://lore.kernel.org/r/20250211051801.470800-9-inochiama@gmail.com
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19 06:23:25 +08:00
Wang Zhaolong
a7a8fe56e9 smb: client: Fix use-after-free in cifs_fill_dirent
There is a race condition in the readdir concurrency process, which may
access the rsp buffer after it has been released, triggering the
following KASAN warning.

 ==================================================================
 BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]
 Read of size 4 at addr ffff8880099b819c by task a.out/342975

 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x53/0x70
  print_report+0xce/0x640
  kasan_report+0xb8/0xf0
  cifs_fill_dirent+0xb03/0xb60 [cifs]
  cifs_readdir+0x12cb/0x3190 [cifs]
  iterate_dir+0x1a1/0x520
  __x64_sys_getdents+0x134/0x220
  do_syscall_64+0x4b/0x110
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 RIP: 0033:0x7f996f64b9f9
 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89
 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
 f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8
 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e
 RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9
 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88
 R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000
  </TASK>

 Allocated by task 408:
  kasan_save_stack+0x20/0x40
  kasan_save_track+0x14/0x30
  __kasan_slab_alloc+0x6e/0x70
  kmem_cache_alloc_noprof+0x117/0x3d0
  mempool_alloc_noprof+0xf2/0x2c0
  cifs_buf_get+0x36/0x80 [cifs]
  allocate_buffers+0x1d2/0x330 [cifs]
  cifs_demultiplex_thread+0x22b/0x2690 [cifs]
  kthread+0x394/0x720
  ret_from_fork+0x34/0x70
  ret_from_fork_asm+0x1a/0x30

 Freed by task 342979:
  kasan_save_stack+0x20/0x40
  kasan_save_track+0x14/0x30
  kasan_save_free_info+0x3b/0x60
  __kasan_slab_free+0x37/0x50
  kmem_cache_free+0x2b8/0x500
  cifs_buf_release+0x3c/0x70 [cifs]
  cifs_readdir+0x1c97/0x3190 [cifs]
  iterate_dir+0x1a1/0x520
  __x64_sys_getdents64+0x134/0x220
  do_syscall_64+0x4b/0x110
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

 The buggy address belongs to the object at ffff8880099b8000
  which belongs to the cache cifs_request of size 16588
 The buggy address is located 412 bytes inside of
  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)

 The buggy address belongs to the physical page:
 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8
 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
 anon flags: 0x80000000000040(head|node=0|zone=1)
 page_type: f5(slab)
 raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
 raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
 head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
 head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
 head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff
 head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 >ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                             ^
  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================

POC is available in the link [1].

The problem triggering process is as follows:

Process 1                       Process 2
-----------------------------------------------------------------
cifs_readdir
  /* file->private_data == NULL */
  initiate_cifs_search
    cifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
    smb2_query_dir_first ->query_dir_first()
      SMB2_query_directory
        SMB2_query_directory_init
        cifs_send_recv
        smb2_parse_query_directory
          srch_inf->ntwrk_buf_start = (char *)rsp;
          srch_inf->srch_entries_start = (char *)rsp + ...
          srch_inf->last_entry = (char *)rsp + ...
          srch_inf->smallBuf = true;
  find_cifs_entry
    /* if (cfile->srch_inf.ntwrk_buf_start) */
    cifs_small_buf_release(cfile->srch_inf // free

                        cifs_readdir  ->iterate_shared()
                          /* file->private_data != NULL */
                          find_cifs_entry
                            /* in while (...) loop */
                            smb2_query_dir_next  ->query_dir_next()
                              SMB2_query_directory
                                SMB2_query_directory_init
                                cifs_send_recv
                                  compound_send_recv
                                    smb_send_rqst
                                    __smb_send_rqst
                                      rc = -ERESTARTSYS;
                                      /* if (fatal_signal_pending()) */
                                      goto out;
                                      return rc
                            /* if (cfile->srch_inf.last_entry) */
                            cifs_save_resume_key()
                              cifs_fill_dirent // UAF
                            /* if (rc) */
                            return -ENOENT;

Fix this by ensuring the return code is checked before using pointers
from the srch_inf.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220131 [1]
Fixes: a364bc0b37 ("[CIFS] fix saving of resume key before CIFSFindNext")
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-05-18 16:53:06 -05:00
Dongli Zhang
ac9dcca236 vhost-scsi: log event queue write descriptors
Log write descriptors for the event queue, leveraging vhost_get_vq_desc()
to retrieve the array of write descriptors to obtain the log buffer.

There is only one path for event queue.

Suggested-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <20250403063028.16045-9-dongli.zhang@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-05-18 17:25:24 -04:00