Due to security concerns, remove the SGI GRU driver, which cannot be used
on anything newer than the long time unsupported UV2 platform.
Signed-off-by: Dimitri Sivanich <sivanich@hpe.com>
Acked-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Acked-By: Robin Holt <robinmholt@gmail.com>
Acked-by: Steve Wahl <steve.wahl@hpe.com>
Link: https://patch.msgid.link/amyzGw1-MVLpNH-d@hpe.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Working XP drivers require the GRU driver. The GRU driver is being
removed, so remove XP as well.
Signed-off-by: Dimitri Sivanich <sivanich@hpe.com>
Acked-by: Robin Holt <robinmholt@gmail.com>
Acked-by: Steve Wahl <steve.wahl@hpe.com>
Link: https://patch.msgid.link/amyxgPYeowzWt_8W@hpe.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The IBM Remote Supervisor Adapter (RSA) and RSA II were out-of-band
management PCI/ISA cards introduced in the early 2000s for ancient
IBM eServer xSeries machines. IBM deprecated the RSA family and
replaced it with the Integrated Management Module (IMM) around 2008.
IBM subsequently sold its x86 server business to Lenovo in 2014, and
modern systems use entirely different BMC architectures.
This hardware has been completely obsolete and out of production for
over 15 years. Surviving physical servers using this specific hardware
would be running ancient 32-bit processors vastly unsuited for modern
kernels.
A review of the recent git history shows that aside from mechanical
treewide VFS API updates, the only recent activities are out-of-bounds
fixes in command_file_write and MFA handling. These fixes address
userspace-triggered security vulnerabilities and fuzzer-discovered
MMIO bugs rather than functional issues reported by active hardware users.
Keeping this obsolete driver in the tree leaves an unnecessary attack
surface and acts as a "fuzzing honeypot", forcing core maintainers to
endlessly review CVEs and OOB fixes for dead hardware, while also paying
a maintenance tax to drag it through modern API refactorings.
Remove the driver entirely.
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260801070756.161698-1-25181214217@stu.xidian.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1. Improve (fix) ds2482 driver module autoloading, when probing from
Devicetree.
2. Convert HDQ One Wire devicetree bindings to DT schema format.
3. Fixes for handling incorrect data from potentially malicious
hardware, looking theoretical issues but still worth to fix.
Affected drivers: w1 core code, ds28e17 and ds2482.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmp0Ru0QHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1zZTEACQuFIiWT/wlL1GFi2BtnS+3QuWxWsbQPL8
64kQa3c3QZu+d/wjKeJxv3dgfPNx3xeFOuKnIrQQqhZ0DCdKb07rKeZvhTmbTU6U
4Fde1o9sSm8k2ZkPyF54aes6K28xoexoOC+cyZ54YAeXGlmN/YZXNPBsLQEBWeMU
OkUUbylj2umcz0S2jYRDhVQQWPNVjSyEKtrq7PZKhorPBVEq/E9MvIM+7Sk6xoZ4
RtXMknYPGpc4rQMZhUGt4Ytkj1zrPX/nATD6H/WBjls+5H2r7EXeqevbbT8N35V0
ZwC5SLmNUZxVhKDvO70VvyLVDYSpPkfxcF4Bhzwndb87wOf+ntG2tAokYzWPIeE/
bRC4cGBVD7MEHUaChaCRFbCFRupoHQzitIlcjYzsBuRO9ZxIT02ch+91lCyxStNh
t8upB1/yF18dfPdCn4elim2IqUNZlRTIjuQVZc9mVDI+KkOelToNgIfubIFjD2a8
OvMjrZuTo5hE9ci6W0AtMV7PNepit7XLFRHNzIh6Q2e9dCIl+6E/FUldRyEQGVwE
Ti2wBqU/v31VxfiXwXNy4kiiDMIEFPUuni+VU5UgMljdKwD5cf583G1WrV7i/arC
JU5YzpYD8H32b0P0OHjX9n7yiWjvnqZA2Ywbc3UCSRMjY65YLP4jxbHkcUnlM1fn
8BFwXlY9dw==
=qYor
-----END PGP SIGNATURE-----
Merge tag 'w1-drv-7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1 into char-misc-next
Krzysztof writes:
1-Wire bus drivers for v7.3
1. Improve (fix) ds2482 driver module autoloading, when probing from
Devicetree.
2. Convert HDQ One Wire devicetree bindings to DT schema format.
3. Fixes for handling incorrect data from potentially malicious
hardware, looking theoretical issues but still worth to fix.
Affected drivers: w1 core code, ds28e17 and ds2482.
* tag 'w1-drv-7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1:
w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
w1: validate slave string length before checking separator
w1: ds28e17: reject an oversize length on an I2C block read
dt-bindings: w1: Convert HDQ One Wire to DT schema
w1: ds2482: add OF device match table
- Michal replaces the open code by devm_clk_get_prepared() in xilinx
fpga driver
- Tien Fixes the incorrect usage of stratix10_svc_done() in altera
fpga driver
- Greg adds error handling for fpga dfl driver
- Pan removes redundant dev_err() in xilinx fpga driver
- Daisuke fixes a potential out-of-bounds read in altera fpga driver
- Ayananta fixes spelling in fpga dfl ABI doc
All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of our for-next branch).
Signed-off-by: Xu Yilun <yilun.xu@intel.com>
-----BEGIN PGP SIGNATURE-----
iIkEABYIADEWIQSgSJpClIeaArXyudb8twOBpKCM2gUCanGzHRMceWlsdW4ueHVA
aW50ZWwuY29tAAoJEPy3A4GkoIzad1AA/2Aj+fZVJ2GZyfkMwaQEdM+h1JyskKmn
xPgk/cWDL79CAP4hFk/hHIMjjhsGygZsG7KAKtj/35p4be70Ar3fhA8/BA==
=NebI
-----END PGP SIGNATURE-----
Merge tag 'fpga-for-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next
Xu writes:
FPGA Manager changes for 7.3-rc1
- Michal replaces the open code by devm_clk_get_prepared() in xilinx
fpga driver
- Tien Fixes the incorrect usage of stratix10_svc_done() in altera
fpga driver
- Greg adds error handling for fpga dfl driver
- Pan removes redundant dev_err() in xilinx fpga driver
- Daisuke fixes a potential out-of-bounds read in altera fpga driver
- Ayananta fixes spelling in fpga dfl ABI doc
All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of our for-next branch).
Signed-off-by: Xu Yilun <yilun.xu@intel.com>
* tag 'fpga-for-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga:
fpga: dfl: fix spelling in sysfs-platform-dfl-port ABI documentation
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
fpga: zynq-fpga: Remove redundant dev_err()
fpga: dfl: fme: add error handling
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
fpga: xilinx-pr-decoupler: Use devm_clk_get_prepared()
Remove superfluous dev_err() and dev_err_probe() calls from
stm32-timer-cnt, ti-eqep, and ti-ecap-capture now that
devm_request_irq() and devm_request_threaded_irq() automatically
log error messages on failure.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSNN83d4NIlKPjon7a1SFbKvhIjKwUCanKiQQAKCRC1SFbKvhIj
K4SwAPwLldZKV4ikbsdNAIDNwAsaVUkb+i44y7RhPNLa1maGigEAkmnWCsmDU4Yr
Bo+TvktP3DNP5CspnpHiNErlFCJ/KAs=
=WjXf
-----END PGP SIGNATURE-----
Merge tag 'counter-updates-for-7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-next
William writes:
Counter updates for 7.3
Remove superfluous dev_err() and dev_err_probe() calls from
stm32-timer-cnt, ti-eqep, and ti-ecap-capture now that
devm_request_irq() and devm_request_threaded_irq() automatically
log error messages on failure.
* tag 'counter-updates-for-7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter:
counter: ti-eqep: Remove redundant dev_err_probe()
counter: ti-ecap-capture: Remove redundant dev_err_probe()
counter: stm32-timer-cnt: Remove redundant dev_err()
Correct the spelling of "responding" which was incorrectly written
as "respoding" in the Document/ABI/testing/sysfs-platform-dfl-port
ABI testing file.
Issue identified using:
`codespell -D - -S "*.bin,*.o,*.a,*.so,*.ko,*.gz,*.png,*.jpg" Documentation/`
Signed-off-by: Ayananta Paul <ayanantapaul@gmail.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260727152634.5983-1-ayanantapaul@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
The trailing byte path in altera_cvp_send_block() dereferences a u32
pointer even when only 1-3 bytes remain in the input buffer. If the buffer
ends at a page or scatterlist boundary, this can read past the valid image
data and fault.
Copy the remaining bytes into a zero-initialized u32 before writing the
final word so only valid bytes are read from the input buffer.
Fixes: 34d1dc17ce ("fpga manager: Add Altera CvP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daisuke Matsuda <matsuda@preferred.jp>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260723081912.74082-1-dskmtsd@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
__issei_ham_process_ham_rsp() dispatches on hdr->cmd before the message
length is validated. The length comes from the firmware-owned DMA header
read in issei_dma_read(), which only bounds it from above, so firmware
sending a short bus message reaches the dispatch with less than
sizeof(struct ham_bus_message) bytes available.
For a zero-length message kmemdup() returns ZERO_SIZE_PTR, which passes
the NULL check in issei_dma_read(), and the dispatch dereferences it. A
length of one to three bytes gives a slab out-of-bounds read instead.
Reject bus messages shorter than the header before touching it, the way
the individual response handlers already validate their own length.
Fixes: 7bd4b9991d ("issei: implement main thread and ham messages")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260731025952.3505287-1-lilinmao@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
During review of a lifetime fix for this driver, it turned out that the
role-switch path has no upstream DT binding or in-tree user and has not
been tested in years.
Rather than keep carrying and fixing an effectively unused board-specific
driver, remove it. If this functionality is needed again later, it can be
reintroduced in drivers/phy/, where USB role-switch support lives today.
Link: https://lore.kernel.org/r/20260728065558.1532-1-getshell@seu.edu.cn
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://patch.msgid.link/20260729154523.1116-1-getshell@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When building for 32-bit platforms, for which 'size_t' is
'unsigned int', there are a couple of warnings around incorrect printk
specifiers:
In file included from drivers/misc/issei/hw_heci.c:7:
drivers/misc/issei/hw_heci.c: In function 'heci_write_hbuf':
drivers/misc/issei/hw_heci.c:374:37: error: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'unsigned int' [-Werror=format=]
374 | dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
drivers/misc/issei/hw_heci.c:374:79: note: format string is defined here
374 | dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
| ~~^
| |
| long unsigned int
| %u
drivers/misc/issei/hw_heci.c: In function 'heci_read_hbuf':
drivers/misc/issei/hw_heci.c:404:37: error: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'unsigned int' [-Werror=format=]
404 | dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
drivers/misc/issei/hw_heci.c:404:79: note: format string is defined here
404 | dev_err(&idev->dev, "Data size %zu not aligned to slot size %lu\n",
| ~~^
| |
| long unsigned int
| %u
cc1: all warnings being treated as errors
Use '%zu' for printing these values, the proper printk specifier for
'size_t'.
Fixes: 8bf5e84998 ("issei: add heci hardware module")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260721-issei-fix-size_t-specifier-v1-1-246155b42d48@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code
frees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This
leaves a dangling pointer in the array. Then cdx_destroy_res_attr()
frees the already-freed memory. Fix the double free by initializing
cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.
Fixes: aeda33ab81 ("cdx: create sysfs bin files for cdx resources")
Cc: stable@vger.kernel.org
Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
Acked-by: Nikhil Agarwal <Nikhil.agarwal@amd.com>
Acked-by: Nipun Gupta <nipun.gupta@amd.com>
Link: https://patch.msgid.link/20260724092712.2119149-1-ptsm@linux.microsoft.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace the open-coded of_address_to_resource() in get_of_data() and the
later ioremap() of the memory region with a single
devm_platform_get_and_ioremap_resource() call in probe(). This requests
the region and maps it once, instead of mapping it without a region
request, and removes the redundant second ioremap.
Similarly replace irq_of_parse_and_map() with platform_get_irq(), which
returns a negative errno on failure (including -EPROBE_DEFER) instead of
0.
Both substitutions are equivalent for a DT-backed platform device. The
remaining OF accessors are now covered by linux/of.h, so the unused
linux/of_address.h and linux/of_irq.h includes are dropped.
No functional change; the GPCM window is not claimed by any other driver
(fsl_lbc only of_iomap()s its own registers, and sibling eLBC-window
drivers use distinct windows), so the new region request cannot conflict.
Built for powerpc (allmodconfig + CONFIG_UIO_FSL_ELBC_GPCM) with LLVM=1;
drivers/uio/uio_fsl_elbc_gpcm.o compiles cleanly.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260722204827.510133-1-rosenp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
- Add a trailing comma for initializers unless the closing brace is on
the same line and for the list terminator;
- Use a single space in the list terminator;
- A space after an opening { and before a closing };
- Use the PCI_DEVICE* macro in two drivers for pci_device_id entry
which is usual for these arrays
- No explicit zeros in the list terminator;
None of these changes introduces changes to the compiled result.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Acked-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://patch.msgid.link/583653bc7b9ae19707bc28be69a20e66b8c3720a.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Update the various of_device_id arrays to conform to the most used and
generally recommended coding style. That is:
- No comma after the list terminator;
- A comma after an initializer if (and only if) the closing } is not
directly following;
- No explicit zeros in the list terminator;
- A space after an opening { and before a closing }, a single space in
the list terminator;
Adapt the few offenders accordingly.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>
Link: https://patch.msgid.link/fbf51b8f413c516977e2c8a81896221795df77e4.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Update the of_device_id array to conform to the most used and generally
recommended coding style. That is:
- No comma after the list terminator;
- A comma after an initializer if (and only if) the closing } is not
directly following;
- No explicit zeros in the list terminator;
- A space after an opening { and before a closing }, a single space in
the list terminator;
Adapt the driver's array accordingly.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/2c35ea101e5eb28334137d9341a8b1e564102ae5.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
While touching this array, also simplify the list terminator. This
change doesn't introduce differences to the compiled result.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/a451863ca59ab700b6e65b76a17a8b6eb1431e6b.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
The mentioned robustness is relevant for a planned change to struct
platform_device_id that replaces .driver_data by an anonymous union (though
this driver doesn't use .driver_data, so this patch isn't strictly
necessary for the plan, but still ok for consistency).
This patch doesn't modify the compiled array, only its representation
in source form benefits.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/9c4a5a5b086d4ce913e84dfa7d140a8b492d557b.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
While touching this array, add a space to the list terminator to make it
match the most common usage.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/c189ce8aeae288e9d8bcdfff150957c6f3e6e37d.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
The mentioned robustness is relevant for a planned change to struct
spi_device_id that replaces .driver_data by an anonymous union.
While touching all these arrays, unify usage of whitespace.
This patch doesn't modify the compiled arrays, only their representation
in source form benefits.
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/ad1f0b3efcc3d9d362b33753734cfb064c079cd3.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.
While touching all these arrays, unify usage of whitespace.
This patch doesn't modify the compiled arrays, only their representation
in source form benefits.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/5a4fb64166ab7e06adf94e5fa3d46bb5f6493324.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
While touching all these arrays, unify usage of whitespace.
This patch doesn't modify the compiled arrays, only their representation
in source form benefits.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/e9ad2fe1d850ffd64eb053cb03395e7ca6f848dc.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The driver explicitly sets the .driver_data member of struct
pci_device_id to zero without relying on that value. Drop this unused
assignment.
While touching this array, also convert it to use one of the PCI_DEVICE
macros that is usually used for these and drop the explicit 0 in the
list terminator. This patch doesn't modify the compiled array.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/0756a50095f65ada4b82a65a4f827bcd5f0e5d84.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The driver explicitly sets the .driver_data member of struct
acpi_device_id to zero without relying on that value. Drop this unused
assignments.
While touching this array simplify the list terminator and use a named
initalizer.
This patch doesn't modify the compiled array, only its representation in
source form benefits.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/98f1fb885b797f8b3ccf24980d8036d67eb3966d.1784299069.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
With no_console_suspend enabled, hvc console output can continue while
virtio_console is freezing. In that window, put_chars can still enqueue
buffers to the output virtqueue while virtcons_freeze is tearing queues
down, triggering a BUG_ON in virtqueue_detach_unused_buf_split:
BUG_ON(vq->vq.num_free != vq->split.vring.num)
Add a pm_freezing flag to ports_device. Set it via smp_store_release()
at the start of virtcons_freeze(); put_chars() and __send_to_port() drop
output while the flag is set, checked via smp_load_acquire().
The check in __send_to_port() is placed under outvq_lock, making it
atomic with remove_port_data() which also acquires outvq_lock. Once
remove_port_data() returns for a given port, no concurrent
__send_to_port() can add buffers before remove_vqs() tears down the vq.
After setting pm_freezing, acquire and release outvq_lock for each port
(protected by ports_lock to prevent list manipulation races) before
calling virtio_reset_device(). A TX thread that already passed the
pm_freezing check may still hold outvq_lock while spinning for host
acknowledgment; the drain loop ensures all such threads have completed
before the device is reset.
Clear pm_freezing in virtcons_restore() only after all port->out_vq
pointers have been reassigned to the newly allocated virtqueues,
preventing TX paths from dereferencing freed vqs during restore.
Link: https://sashiko.dev/#/patchset/20260519162242.7324-1-baver.bae%40gmail.com
Signed-off-by: Sungho Bae <baver.bae@lge.com>
Link: https://patch.msgid.link/20260603183757.21587-5-baver.bae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In virtcons_restore(), after virtio_device_ready() sets DRIVER_OK, the
device becomes active. If the control receive queue (c_ivq) is populated
immediately, the host can instantly deliver pending control messages
(e.g., VIRTIO_CONSOLE_PORT_REMOVE).
This triggers the control_work_handler(), which can modify the
portdev->ports list concurrently with the unprotected list_for_each_entry
loop in virtcons_restore(), leading to list corruption or Use-After-Free.
Fix this by deferring the population of the control receive queue
(fill_queue for c_ivq) until after the list iteration is complete. This
ensures the host cannot inject control messages during the vulnerable
window.
Signed-off-by: Sungho Bae <baver.bae@lge.com>
Link: https://patch.msgid.link/20260603183757.21587-4-baver.bae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When a port is hot-unplugged, unplug_port() nullifies port->portdev.
However, concurrent TX paths (__send_to_port, put_chars) could read a
stale pointer or encounter a NULL pointer dereference.
Add READ_ONCE(port->portdev) and NULL checks in the TX paths. In
__send_to_port(), move the out_vq assignment inside the outvq_lock and
check portdev under the lock. Correspondingly, update unplug_port() to
NULL out port->portdev while holding the outvq_lock to serialize with
__send_to_port().
In put_chars(), return count instead of 0 on unplug to prevent the hvc
layer from spinning in an infinite retry loop.
Signed-off-by: Sungho Bae <baver.bae@lge.com>
Link: https://patch.msgid.link/20260603183757.21587-3-baver.bae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Modify __send_to_port() to take ownership of a struct port_buffer *
instead of a void * raw buffer.
Previously, put_chars() would pass a raw kmemdup'd buffer and free it
immediately after __send_to_port() returned. This caused a potential
Use-After-Free and data corruption if the virtqueue was shared with
nonblocking writers, as virtqueue_get_buf() might return an older
completed buffer, causing the newly added buffer to be kfree'd while the
host is still DMAing from it.
By transferring ownership of the allocated port_buffer to __send_to_port(),
we ensure that the exact buffer returned by the host is the one that gets
freed, resolving the memory lifecycle mismatch.
Signed-off-by: Sungho Bae <baver.bae@lge.com>
Link: https://patch.msgid.link/20260603183757.21587-2-baver.bae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parse_inputs_from_commands() only caught CmdParsingError and IndexError
when dispatching to command parsers, but several parsers call
shlex.split() internally, which raises ValueError on malformed shell
quoting (e.g. an unterminated quote). This exception was not caught,
so a single malformed build command would abort SBOM generation
entirely, even with fail_on_unknown_build_command=False, defeating the
purpose of tolerant mode.
The issue was found while reviewing the exception handling around the
saved-command parser after running its existing tests. It can be
reproduced with:
parse_inputs_from_commands('gcc "unterminated',
fail_on_unknown_build_command=False)
Catch ValueError alongside CmdParsingError and IndexError so such
commands are logged as a warning/error and skipped instead of aborting
the whole run.
Add tests covering malformed shell quoting and a missing positional
argument.
Signed-off-by: Carlos Sampaio Ribeiro <otakurack@gmail.com>
Link: https://patch.msgid.link/20260719081859.1001-1-otakurack@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
- document enums with the "enum" keyword
- add a description for @dbr_size
- add missing descriptions to struct most_interface (some just need
a ':' to be good)
- add missing descriptions to struct most_component
- use Returns: syntax for function return values
- convert most_deregister_interface() to kernel-doc notation and fix
its parameter name
Repairs these warnings:
Warning: include/linux/most.h:17 This comment starts with '/**',
but isn't a kernel-doc comment.
* Interface type
Warning: include/linux/most.h:32 This comment starts with '/**',
but isn't a kernel-doc comment.
* Channel direction.
Warning: include/linux/most.h:40 This comment starts with '/**',
but isn't a kernel-doc comment.
* Channel data type.
Warning: include/linux/most.h:131 struct member 'dbr_size' not
described in 'most_channel_config'
Warning: include/linux/most.h:191 This comment starts with '/**',
but isn't a kernel-doc comment.
* Interface instance description.
Warning: include/linux/most.h:274 struct member 'mod' not described
in 'most_component'
Warning: include/linux/most.h:274 struct member 'cfg_complete' not
described in 'most_component'
Warning: include/linux/most.h:288 This comment starts with '/**',
but isn't a kernel-doc comment.
* Deregisters instance of the interface.
Warning: include/linux/most.h:292 No description found for return value
of 'most_register_interface'
Warning: include/linux/most.h:298 function parameter 'iface' not
described in 'most_deregister_interface'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260719051123.2458641-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
find_port_by_vq() returns a raw struct port pointer without taking a
reference on it, unlike find_port_by_devt_in_portdev() which does.
find_port_by_vq()'s only two callers, in_intr() and out_intr(), run as
virtqueue interrupt callbacks, entirely independent of and possibly
concurrently with unplug_port(), which itself runs from a workqueue when
the host sends a VIRTIO_CONSOLE_PORT_REMOVE control message.
unplug_port() removes the port from portdev->ports under ports_lock,
then later drops its last reference with kref_put(), freeing it via
remove_port(). find_port_by_vq() also walks portdev->ports under
ports_lock, so if it finds the port still on the list, the list removal,
and therefore the eventual kref_put(), has not happened yet, and taking
a reference at that point is always safe. Without doing so,
in_intr()/out_intr() can be left holding a pointer to a port that
unplug_port() frees on another core before they are done using it.
Both triggers are host-controlled as the host decides when to send the
PORT_REMOVE control message and when to kick the port's data vq. So a
malicious backend could race the two on purpose, without any guest side
cooperation. The freed object is a generic kmalloc allocation containing
a wait_queue_head_t, which in_intr()/out_intr() pass to
wake_up_interruptible() after touching the stale pointer.
wake_up_interruptible() invokes a function pointer read out of the wait
queue's entries. If the freed slab slot is reclaimed with attacker
influenced content before that call, then this is an arbitrary function
call primitive rather than just undefined behaviour.
Take a reference in find_port_by_vq() while still holding ports_lock,
matching find_port_by_devt_in_portdev(), and release it in in_intr() and
out_intr() once they are done with the port.
Signed-off-by: Hari Mishal <harimishal1@gmail.com>
Link: https://patch.msgid.link/20260717150622.23636-1-harimishal1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The process-context fault path always has a valid user CBR pointer. Inline
the one-use status helper and remove its obsolete NULL check.
No functional change.
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-4-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
After interrupt faults are sent directly to user polling mode, only the
process-context call path remains. Remove the atomic flag passed through
the fault-handling interfaces and the related dead code.
No functional change.
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-3-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The GRU TLB miss handler walks a process's page tables without holding
page-table locks or a reference to the mapped page. It also uses a kernel
page-table accessor on user page tables and supports only PMD-level large
mappings on x86-64.
Remove the direct walker. Send interrupt faults directly to user polling
mode so the existing call-OS fallback retries them in process context.
Remove the mmap-lock failure statistic that can no longer be incremented.
Fixes: 142586409c ("GRU Driver: page faults & exceptions")
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-2-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cover the timens conversion in ntsync_schedule(): with a negative
CLOCK_MONOTONIC offset, a 100 ms absolute wait must not return
immediately against the host clock.
Suggested-by: Maoyi Xie <maoyixie.tju@gmail.com>
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260723201301.11826-6-zfigura@codeweavers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The uAPI documentation used outdated or conceptual ioctl macro names
and listed ntsync_event_args / ntsync_wait_args fields in the wrong
order. Match include/uapi/linux/ntsync.h and note that absolute
MONOTONIC timeouts are interpreted in the caller's time namespace.
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260723201301.11826-5-zfigura@codeweavers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
setup_wait() already validates pad and flags but not owner, while
Documentation/userspace-api/ntsync.rst requires EINVAL when owner is
zero. Reject early before queueing waiters.
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260723201301.11826-4-zfigura@codeweavers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add coverage for documented EINVAL cases: zero owner on wait any/all,
non-zero pad, and objects from a different /dev/ntsync instance.
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260723201301.11826-3-zfigura@codeweavers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
wake_all used EXPECT_EQ(0, objs[3]) after NTSYNC_IOC_CREATE_EVENT.
The ioctl returns a non-negative file descriptor on success; check
EXPECT_LE(0, objs[3]) like the other CREATE_* paths. The incorrect
expectation was noted on list (Mar 2025) but is still present in
mainline.
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260723201301.11826-2-zfigura@codeweavers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The memory allocated for struct vmci_subscription (sub) is not freed
in the error path when have_new_id is false. Fix that by adding a
kfree() call, and moving the read of sub->id to a point before freeing.
Fixes: 1d990201f9 ("VMCI: event handling implementation.")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Vishnu Dasa <vishnu.dasa@broadcom.com>
Link: https://patch.msgid.link/20260722101215.76680-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To properly take the changes from commit bb66b1a345 ("rust_binder:
only print failure if error has source") into account, the
binder_debug! statement was moved inside the if {} block, and so there
must be one more level of indentation.
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260728061236.198267-1-aliceryhl@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Transaction configuration flags are currently represented as raw integers
and manipulated via bitwise operations. This lacks type safety, making
it possible to mix up different flag types without compile-time warnings.
Use kernel::impl_flags! to migrate the transaction flags to a
strongly-typed bitmask, enforcing compile-time safety.
Key changes:
- Define `TransactionFlags(u32)` and `TransactionFlag` with 4 variants.
- Change flags field type to `TransactionFlags` in structs.
- Add `is_oneway` helper on `TransactionFlags` to simplify checks.
- Update `can_replace` logic to use type-safe combined flag checks.
- Convert `flags` to `u32` for FFI boundaries and logging.
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
Link: https://patch.msgid.link/20260719-b4-rust_binder_impl_flags-v3-2-f8d0b3ea1b87@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Thread looper states are currently represented as raw integers and
manipulated via bitwise operations. This lacks type safety, making it
possible to mix up different flag types without compile-time warnings.
Use kernel::impl_flags! to migrate looper_flags to a strongly-typed
bitmask, enforcing compile-time safety.
Key changes:
- Define `LooperFlags(u32)` and `LooperFlag` enum with 7 variants.
- Change `InnerThread.looper_flags` type to `LooperFlags`.
- Update looper state transitions and checks to use type-safe methods.
- Convert `looper_flags` to `u32` for hex formatting in `debug_print`.
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
Link: https://patch.msgid.link/20260719-b4-rust_binder_impl_flags-v3-1-f8d0b3ea1b87@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The `// SAFETY:` comment in NodeDeath::set_cleared assumes that a
NodeDeath is never inserted into the death list of any Node other than
its owner. However, this invariant is not enforced by the safe function
Node::add_death, which inserts NodeDeath into the death list without
checking that death.node == self, leaving a risk for future code that
may miss this implicit invariant and cause undefined behavior.
Add an assertion to make this precondition explicit and catch potential
violations early.
Link: https://github.com/Rust-for-Linux/linux/issues/1237
Signed-off-by: Georgios Androutsopoulos <georgeandrout13@gmail.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260616170956.2580772-1-georgeandrout13@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
