mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-13 07:31:07 +00:00
1,468,510 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
b643e495ae |
s390 updates for 7.2-rc7
- Fix potential uninitialized memory reads and buffer overflows from malformed zcrypt CCA and EP11 requests by properly validating lengths and payloads - Fix possible out of bounds accesses in zcrypt EP11 domain handling by replacing fixed payload layout assumptions with parsing ASN.1 fields with bounds checks - Fix zcrypt CCA and EP11 request and reply buffer allocations missing required 4-byte padding, and scrub the full allocation on release - Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes of memory by zeroing trailing alignment padding -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmp4YYUACgkQjYWKoQLX FBh1tgf/ZZMzYxWDawMfYg2SoE16aLEG6M+I8qa1EmpxCXwu2Evl17LdMtkZFL1C ClDux15JGBhbpYyHyXhlsnUMRSHKLatLF2LU4KR6g3q5JgFcNRUVzSH8uuE40en5 UspMeEG09NENUJGveyZ8tEbGmkbI1hxAzicD4nRMTuin8VpXWKvHaNeQYXhkuDtr 5nuCiRmJUgMrwAVgtTXkdWzMaR0QwLWwkkLXLhnQk6NWyz1EhYmXWT+YG2axu7/y KUWU5jEs1AutO7YUxgTzrvxjS4M5IbokSXNyTUlLUqmPzdbXVWrpuF0nFEorBCA3 TzA7NCaJAChYWFfg54zQYdd4ijnf2Q== =iulo -----END PGP SIGNATURE----- Merge tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix potential uninitialized memory reads and buffer overflows from malformed zcrypt CCA and EP11 requests by properly validating lengths and payloads - Fix possible out of bounds accesses in zcrypt EP11 domain handling by replacing fixed payload layout assumptions with parsing ASN.1 fields with bounds checks - Fix zcrypt CCA and EP11 request and reply buffer allocations missing required 4-byte padding, and scrub the full allocation on release - Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes of memory by zeroing trailing alignment padding * tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Pad trailing CCA or EP11 message with zeros s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing s390/zcrypt: Improve EP11 CPRB length and overflow checks s390/zcrypt: Improve CCA CPRB length and overflow checks s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code |
||
Rosen Penev
|
7a90520e8c |
ARM: dts: helios4: add SATA regulator supplies
The ahci-mvebu driver and libahci_platform request three supplies
on SATA controller and port nodes:
- ahci-supply (controller power)
- phy-supply (PHY power)
- target-supply (disk power per port)
Without them the regulator core prints notices at boot, e.g.:
supply ahci not found, using dummy regulator
supply phy not found, using dummy regulator
supply target not found, using dummy regulator
The SATA controller and PHY inside the Armada 388 SoC are powered
by the 3.3V I/O rail; the four disk bays are powered by the 5V HDD
rail. Wire the existing fixed regulators accordingly.
Fixes:
|
||
|
Rosen Penev
|
c23988f844 |
ARM: dts: helios4: add vcc-supply to GPIO expander
The pca953x driver requests a 'vcc' supply, producing:
pca953x 0-0020: supply vcc not found, using dummy regulator
The PCA9655 (PCA9555-compatible) expander is powered by the same
always-on 3.3V rail as the other I2C devices on the bus. Add
vcc-supply = <®_3p3v> to silence the warning.
Fixes:
|
||
|
Rosen Penev
|
ef65cf08bd |
ARM: dts: helios4: add vcc-supply to EEPROM
The at24 driver requests a 'vcc' supply for the EEPROM, producing
'supply vcc not found, using dummy regulator' at boot when the
property is missing.
The EEPROM sits on the Helios 4 and is powered by the
same always-on 3.3V rail used by other on-board I2C devices.
Add vcc-supply = <®_3p3v> to silence the warning.
Fixes:
|
||
Tomáš Macholda
|
0c2a8eed95 |
arm64: dts: turris-mox: fix usb3 phys
After commit |
||
Hui Su
|
91542863ab |
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
In test_ringbuffer()'s out_free cleanup loop, the check
`!rb_threads[cpu]` only catches NULL entries and misses entries that
hold an ERR_PTR.
rb_threads[] is static, so unassigned slots are NULL. But when
kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or
-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.
That entry is non-NULL, so the old `!ptr` check does not break, and the
cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()
then dereferences the bogus pointer, crashing the kernel during the
late_initcall self-test.
crash logs:
BUG: kernel NULL pointer dereference, address: 000000000000001c
Oops: 0002 [#1] SMP NOPTI
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)
RIP: 0010:kthread_stop+0x2e/0x220
RBX: fffffffffffffff4
CR2: 000000000000001c
Call Trace:
<TASK>
test_ringbuffer+0x1ec/0x650
do_one_initcall+0x6c/0x2c0
kernel_init_freeable+0x21d/0x420
kernel_init+0x15/0x1c0
ret_from_fork+0x21b/0x320
</TASK>
Kernel panic - not syncing: Fatal exception
Cc: stable@vger.kernel.org
Fixes:
|
||
Vincent Donnefort
|
6d014e44b6 |
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0.
This is an issue for a ring-buffer with subbufs bigger than PAGE_SIZE if
when freed: free_buffer_page() relies on this value. Align the value
with the actual allocation size (buffer::subbuf_order).
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Vincent Donnefort
|
bf98d7b0d5 |
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
allow it when resizing is disabled. A non-consuming reader is at risk of
use-after-free (rb_advance_iter()).
Return -EBUSY on resize_disabled, matching ring_buffer_resize()
behaviour.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Vincent Donnefort
|
7c727dfce6 |
ring-buffer: Prevent resizing of persistent ring buffer
Dynamically resizing a persistent ring buffer is not possible. Disable
the feature.
Cc: stable@vger.kernel.org
Fixes:
|
||
Josh Poimboeuf
|
8b8292d648 |
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
When a module's init text is freed, do_init_module() calls
ftrace_free_mem() with a half-open [start, end) range. However the
ftrace_cmp_recs() comparator treats the upper bound as inclusive, as all
its other users do, passing 'ip + size - 1'. So ftrace_free_mem() can
delete a record sitting exactly at 'end', which is outside the freed
range.
For a kernel without CFI or IBT, the first record of a function is at
the function start, which for the first function in a module is also the
base of its text allocation. As the module allocator packs its regions,
that address is often the 'end' passed by a neighboring module's
do_init_module(), causing the first function's ftrace location to get
disabled, preventing an attempt to livepatch it:
livepatch: failed to find location for function 'pcspkr_probe'
Convert the exclusive end to the inclusive 'end - 1' the comparator
expects, and return early for an empty range to avoid the subtraction
from underflowing when the init text size is zero.
Cc: stable@vger.kernel.org
Fixes:
|
||
Tengda Wu
|
f27bdc4307 |
ring-buffer: Use current_context for safe per-CPU buffer swap
The ring_buffer_swap_cpu() function currently checks the per-CPU
committing counter to determine if a buffer is actively being written to
before performing the swap. However, there exists a race window where
this check can be bypassed:
ring_buffer_lock_reserve
cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a
rb_reserve_next_event
rb_start_commit // inc committing
if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}
__rb_reserve_next
rb_move_tail
rb_end_commit(cpu_buffer); // dec committing => 0
/* interrupt hits here, successfully swaps! */
local_inc(&cpu_buffer->committing);
ring_buffer_unlock_commit
cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b
rb_commit
rb_end_commit
RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))
// triggers warning
The committing counter can temporarily drop to 0 during a single write
operation (within rb_move_tail), creating a window where swap can
succeed even though the write is still in progress. This leads to
inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().
Replace the committing counter check with current_context checks, which
are set at the entry of ring_buffer_lock_reserve() and remain valid
throughout the entire write operation, providing a reliable indicator of
buffer busy state during swap.
Cc: stable@vger.kernel.org
Fixes:
|
||
Alexandre Belloni
|
b981359d9e |
arm64: tegra: Device tree changes for v7.3-rc1
This contains a new device tree for the Lenove ThinkEdge SE70 Edge Client device as well as a number of fixes and cleanups for Tegra234 and Tegra194. Tegra264 sees a number of additions to enable more features. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcb8ACgkQ3SOs138+ s6EVRg//e3keeg7ehCUFVA8mDnGfxtIR5ErkU0I5LkCaQucREvHveHuNSayiNSM0 DQVcqv3n/egea4Nnon+eH4ddpa0fosFUm0tW1agLdvhn41nKhiTg/vNcPUwqNE+p qw43rl5ecChZslW8l8+4eln9sRoTnxBKKlydu5aKKVQtpLbn23uZTwtlSwMWcduO 0GjNOpvrjNyLWzGQ6lrO7uxRxrTHJPYm68Y/sVt38tZYHKC/Ksosy1/o0fKwJd4Q kMfk2lu1DxY6LGihNmNgpoITva0EaxtwDN1I4IO+dWLNq+feOrwCdTIaanycQPSw 29COUfEcpblWvkRxd6ffWLwsAEk1ydR49FaJLgaAddb0ImEJfEeiaz8roAMqW24Q QEEDtSwg8JeC4dhWSgOqPOin328hiz3gEG3qYkP/Bi9NgCq2a0eVRlWfBOkgPI8u isGcVm1yfb2cxdgC26QWivLtuTxDNeHp/rcyGAinWrzd5FJFMvd/tn76inOS33X1 U4shiIvnYDMh0j1VkvHa2ZvN1lqOTmbAGqHOF0iuCC2fhHuu6VW3/7j7wYgtv4gP Mp2dfVWEdj1Yp+iedS63XN+rFnEqMqw2733TkI1ThLzF3PXz0BO73QMvY+qAujlV 8eLPr5091lXQKYCKCLx8AGBpLtXOFHzS1BxR/tr+OPWAutGFoXA= =qSTk -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v7.3-rc1 This contains a new device tree for the Lenove ThinkEdge SE70 Edge Client device as well as a number of fixes and cleanups for Tegra234 and Tegra194. Tegra264 sees a number of additions to enable more features. * tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (1469 commits) arm64: tegra: Correct Tegra234 p3740 interrupt flags arm64: tegra: Correct Tegra234 p3737 interrupt flags arm64: tegra: Correct Tegra194 p2972 interrupt flags arm64: tegra: Drop CPU masks from GICv3 PPI interrupts arm64: tegra: Add Lenovo ThinkEdge SE70 device tree arm64: tegra: Add pinctrl nodes for Tegra264 arm64: tegra: Fix CMDQV interrupt type on Tegra264 arm64: tegra: Properly sort devices on Tegra264 arm64: tegra: Add GTE nodes for Tegra264 arm64: tegra: Add Host1x and VIC on Tegra264 arm64: tegra: Populate CPU and L2 cache nodes on Tegra264 arm64: tegra: Enable GPCDMA in Tegra264 and add iommu-map Linux 7.2-rc5 super: fix emergency thaw deadlock on frozen block devices tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tracing: Fix context switch counter truncation ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
36a0554941 |
dt-bindings: Changes for v7.3-rc1
This contains a few fixes for interrupt types and email addresses as well as the addition of a compatible string for the Lenovo ThinkEdge SE70 Edge Client. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcBUACgkQ3SOs138+ s6FsAg/+MbBZhYQm08PBRJAvwOuC+3Uny4nBxPDheAyqYmi0pa7a6Az36k1ub5B2 UgXrk32x+yfhGvmSkg/bKsiSvKo9SjKz0hUY4hWOMCeursbNDdv2BcYxLwx291wu KETB3obUsGRhn3yqcQA6b/8iJOBluDDpdkZh85AT++Ss+akspCt4LeCQnXDxdtK3 aEG0lb8Q63TC0uW0a0Qg5+xh9HH7hNZN8S0giWP0OCi0+V9JNyPWEfVAFdqLaQbH bcv1udPTKYhvXemNumerMzNXtxPJTBlOTJwugyCgv7rMGRsntk54UTDqc4w6yRen T9Zf3v9ScMQ+OXpdhicdFffeNC2tky9fruTE8Vjs7Oeif2AtaqYI8wMndyMKvQl5 h4Q1uwAJeX2Wjj+5DxLQ/ets4OGb0GvXw8xdELfQ1R35YKd97eHMXqpgdwFtb5PW UecGlSly515zL43a7z/ROF33aG4Cbr3DZJANRNfqlo5oDuHWyS53q+jNklq0nhid t29eMhaB9sh8NGOgs4hHY67vMwvYHDDAUDSp66AcQFVuPkJdf8Mrw8MSaXhcqqW+ Tkn2w/ilrYTn7ZXr1CPqmSHezlr77ky/cmusBoSp2NX1LVCQPkonQAOrj1Pzd6mI vTGy7U6zj6dbXw1yZTAtBzzBJY6WwTxHsKAxW98uvr7kupbC89Y= =q7gO -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt dt-bindings: Changes for v7.3-rc1 This contains a few fixes for interrupt types and email addresses as well as the addition of a compatible string for the Lenovo ThinkEdge SE70 Edge Client. * tag 'tegra-for-7.3-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: arm: tegra: Add lenovo,thinkedge-se70 compatible string dt-bindings: gpu: host1x: Fix email address dt-bindings: iommu: Fix interrupt type in example Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Linus Torvalds
|
06cf61899d |
- Fix MCE CMCI discovery initialization ordering bug
(Breno Leitao) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmp3hxkRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1iSyA/9EY/a7Ri29eYKrblSnPCAHyUIpo2oNNJM CVrC9TOPYPaPFQg7Py91B6+yry8aOtHVQpXygNVQJMgr8oz9QuQcfL6JumHXRYxX OV5+/S4Hba4dzhDeOEdethiz65Vp3rCm5Dl8D2/5g47CJp3JUM3WJ0GrJs6PWNST 446rTZXTVz8jVYNhFyGPJHqApMypMyqUnTS1zJsq+PEldzs+LV4YHaQ7PIvEl++w iA1yFdqvcStpeqfu/e0PwauiPH5tpwnde5ZxRjygCr9M7cWpL+wjhP4z5eGiSM1O Xgjr5tVfevbDC2LA5CZxdeFheSupUMxI/zfmYyCdCz3z22jEXMUghHUZvL+kY+cq ur6b9iFvC8R+Jwjp/pnTvqTS7xzcqXvMJFiaviiYXmeCLWu/Ah8e0v2ugmzUUxPp 5VHuhoVgyEr1eMPb2huzqozzTgqJEx5h3zOlo355IN0QjnKCMIGa8WrpkYQGTjW+ 5wl/PnPenMGl3FDHUq8IlvMlbQkbh/NLoy1EC6Kna9D46H0Cxu6NqHMu2uP6Flj7 sQxne+zdM/KLTPlPyHxtiQQCau9w0NYFsY9PtMgB/HyrjjjJiPKGL39j+kj1Yusa 2CSisQttseoNQA60Vh4o+jZ3MnnIijqPZnB4GokG2yRZ1v4GsmpacOs/VWqDrWnx sW2+z97qoZk= =YUDb -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Fix MCE CMCI discovery initialization ordering bug (Breno Leitao) * tag 'x86-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Set up the polling timer before CMCI discovery |
||
|
Linus Torvalds
|
d4eee3bdb8 |
- Fix race in futex_pivot_pending() during private hash resize
that can cause stuck tasks (Yao Kai) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmp3gQ8RHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1h0CQ//Wq3AnGGWisG9OAyn22xxlkh1lK4RqUeE uAYuLQmIAw481YjiVg7U0QTcyHrMrDHK5j902oc1Zd7Cyc+IqBaaZVPs63Vq0onh KAP19tbFz2w9D/mxyTkuxEekJ42w8a7bk5cHFL1rw0t/rSA51LixzbdW7DloC2vg So+quAtUcaXI8831ljnikN4OdNQOCLJCA9MemTpncIMuyL4BmhOXDRMwXneevg74 f6BOqrgbvKEgrBsVhWzGeDdq5ZHekmGVrHQeOxlDaQy/rZS+VE3VJwtMBwZvhn6X wU3CQdvkvDOeQvqXyfWxTbqhk7AJrIL5FKQrp5ZlhECw2WnPOUHwjAHQ8dKHaJEw wbv58RALcJ33s+PWy+0tYmOP4SPyICpQEmdp+SCaR0N4N/LtAScz05XAGnJ4S97+ t8LBmmJFmkxz4rDbTdawBV+sulDX/y+8xYu0/CZJhAyp1hEW9ajyMbRj5gVGOomT xKyyQAUTUUznStscc4hgTNVd1UAhuqUYlMNCJsEJOHNHvnq5qHT+ezPoZt5X5qd6 cDHCs5b+agQ/PIpW1vIiulCypelckAqvs+XdE0Pv3uPlNVjMLfZCTeyaOoXqIqI7 LpXkgR0UxkWmFf8vGncpPHjDCh3YqGgN66iE1qKohO1L9/uSxwwxEUOJIcPaOFtX C07TnEwMdK0= =3w7m -----END PGP SIGNATURE----- Merge tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fix from Ingo Molnar: - Fix race in futex_pivot_pending() during private hash resize that can cause stuck tasks (Yao Kai) * tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Fix race in futex_pivot_pending() during private hash resize |
||
|
Linus Torvalds
|
91a73db697 |
USB / Thunderbolt fixes for 7.2-rc7
Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that resolve some reported issues. Included in here are: - new quirk for some broken USB devices - thunderbolt device fixes for reported issues - usb gadget driver fix - usb atm driver fix - xhci driver fixes. - other minor USB driver fixes All of these have been in linux-next this week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iGwEABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandKCg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ymavgCgzIiJ6KRqYmikyHsPpfL6GNYtOLAAmOwaDTWL Zzvkgp8bIdQvqsPg6B0= =lR2e -----END PGP SIGNATURE----- Merge tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that resolve some reported issues. Included in here are: - new quirk for some broken USB devices - thunderbolt device fixes for reported issues - usb gadget driver fix - usb atm driver fix - xhci driver fixes. - other minor USB driver fixes All of these have been in linux-next this week with no reported issues" * tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask usb: quirks: Add ShanWan gamepad to quirk list usb: hub: Split announce_device() to log device identity before enumeration usb: core: Add quirk for 255-bytes initial config read usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg usb: gadget: f_ncm: Use unsigned int for ndp_index usb: cdnsp: fix incorrect endian conversions for APB timeout register thunderbolt: Initialize ->domain_released completion before it is being used thunderbolt: icm: Preserve USB4 proxy data-valid bit thunderbolt: Bound the DROM dual link port number before indexing sw->ports thunderbolt: Fix bandwidth group reservation indexing thunderbolt: stream: Unmap buffers with mapped size |
||
|
Linus Torvalds
|
e4836b67ba |
TTY / Serial / VT driver fixes for 7.2-rc7
Here are some small serial and vt tty driver fixes for 7.2-rc7 that resolve some reported problems. Included in here are: - 2 vt core fixes - amba-pl011 serial driver fixes - 8250_of and 8250_dma driver fixes - qcom-geni serial driver fix - sc16is7xx serial driver fix All of these have been in linux-next this week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandKkg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylnjQCeND+mnhXzo7wmT4E2vHER2FG8UEEAmwXRTNe6 QzKAPXT2BgHPFW7Gy8dk =UY5p -----END PGP SIGNATURE----- Merge tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial / vt driver fixes from Greg KH: "Here are some small serial and vt tty driver fixes for 7.2-rc7 that resolve some reported problems. Included in here are: - two vt core fixes - amba-pl011 serial driver fixes - 8250_of and 8250_dma driver fixes - qcom-geni serial driver fix - sc16is7xx serial driver fix All of these have been in linux-next this week with no reported issues" * tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: amba-pl011: synchronize DMA teardown serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ serial: amba-pl011: fix indefinite RS485 post-send delay vt: add permission check for KDSKBMETA ioctl vt: stabilize tty reference in kbd_keycode with tty_port_tty_get serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx serial: qcom-geni: fix TX DMA buffer flush serial: 8250_dma: Clear stale RX state on shutdown serial: sc16is7xx: enable THRI before filling TX FIFO |
||
|
Linus Torvalds
|
e663f6deac |
Staging driver fixes for 7.2-rc7
Here are some more small staging driver fixes, just for the rtl8723bs driver, for some reported problems found with it now that people are starting to actually test the thing with "bad" networks. Nothing major, but good to have in the -final release. All of these have been in linux-next for over a week with no reported problems. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandJYA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ykIxACfTuHhJxAk0r/QsXGjmp/u8s733lYAnjVl7Kdm v7Q+WL8+jJnxPW8jpWcy =l2iZ -----END PGP SIGNATURE----- Merge tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some more small staging driver fixes, just for the rtl8723bs driver, for some reported problems found with it now that people are starting to actually test the thing with "bad" networks. Nothing major, but good to have in the -final release. All of these have been in linux-next for over a week with no reported problems" * tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: validate monitor transmit frame lengths staging: rtl8723bs: fix missing shared-key auth challenge length check staging: rtl8723bs: fix OOB read in WMM_param_handler() staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() |
||
|
Linus Torvalds
|
5668ba2304 |
Char / Misc and documentation fixes for 7.2-rc7
Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCandLdw8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+yldzACZAVaM2/I0hIeTnoBqRFIZBcroUQYAoNk5zQSW
qYG0DWUf4LJwj9WPQWIS
=e+LJ
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char / misc and documentation fixes from Greg KH:
"Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems"
* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
docs: security-bugs: clarify some mandatory steps for AI reports
docs: coding-assistant: explain important steps when looking for bugs
docs: security-bugs: clarify what counts as a valid version
docs: threat-model: move fake devices out of "non production use"
docs: threat-model: clarify "security bug" vs "vulnerability"
counter: microchip-tcb-capture: Fix DT channel validation
mei: pull kvfree out of spinlock
rust_binder: do not query current thread for all ioctls
nvmem: layouts: Add fixed-layout driver
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
|
||
Lyude Paul
|
e35e770002 |
openrisc: Include <linux/cpumask.h> in smp.h
While OpenRISC currently doesn't fail to build upstream, it appears that
including <asm/smp.h> in the right headers is enough to break that -
primarily because OpenRISC's asm/smp.h header doesn't actually provide
any definition for struct cpumask. Which means the only reason we aren't
failing to build the kernel is because we've been lucky enough that
every spot including asm/smp.h already has definitions for struct
cpumask pulled in.
This became evident when trying to work on a patch series for adding
ref-counted interrupt enable/disable to the kernel, where introducing a
new interrupt_rc.h header suddenly introduced a build error on OpenRISC:
In file included from include/linux/interrupt_rc.h:17,
from include/linux/spinlock.h:60,
from include/linux/mmzone.h:8,
from include/linux/gfp.h:7,
from include/linux/mm.h:7,
from arch/openrisc/include/asm/pgalloc.h:20,
from arch/openrisc/include/asm/io.h:18,
from include/linux/io.h:12,
from drivers/irqchip/irq-ompic.c:61:
arch/openrisc/include/asm/smp.h:21:59: warning: 'struct cpumask'
declared inside parameter list will not be visible outside of this
definition or declaration
21 | extern void arch_send_call_function_ipi_mask(const struct cpumask *mask);
| ^~~~~~~
arch/openrisc/include/asm/smp.h:23:54: warning: 'struct cpumask'
declared inside parameter list will not be visible outside of this
definition or declaration
23 | extern void set_smp_cross_call(void (*)(const struct cpumask *, unsigned int));
| ^~~~~~~
drivers/irqchip/irq-ompic.c: In function 'ompic_of_init':
>> drivers/irqchip/irq-ompic.c:191:28: error: passing argument 1 of
'set_smp_cross_call' from incompatible pointer type
[-Werror=incompatible-pointer-types]
191 | set_smp_cross_call(ompic_raise_softirq);
| ^~~~~~~~~~~~~~~~~~~
| |
| void (*)(const struct cpumask *, unsigned int)
arch/openrisc/include/asm/smp.h:23:32: note: expected 'void (*)(const
struct cpumask *, unsigned int)' but argument is of type 'void
(*)(const struct cpumask *, unsigned int)'
23 | extern void set_smp_cross_call(void (*)(const struct cpumask *, unsigned int));
To fix this, let's take an example from the smp.h headers of other
architectures (x86, hexagon, arm64, probably more): just include
linux/cpumask.h at the top.
Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Stafford Horne <shorne@gmail.com>
Link: https://patch.msgid.link/20260804161447.84806-5-boqun@kernel.org
|
||
Boqun Feng
|
4ad87eee54 |
preempt: Introduce __preempt_count_{sub,add}_return()
In order to use preempt_count() to track the interrupt disable nesting
level, __preempt_count_{add,sub}_return() are introduced, as their names
suggest, these primitives return the new value of the preempt_count()
after changing it. The following example shows the usage of it in
local_interrupt_disable():
// increase the HARDIRQ_DISABLE bit
new_count = __preempt_count_add_return(HARDIRQ_DISABLE_OFFSET);
// if it's the first-time increment, then disable the interrupt
// at hardware level.
if ((new_count & HARDIRQ_DISABLE_MASK) == HARDIRQ_DISABLE_OFFSET) {
local_irq_save(flags);
raw_cpu_write(local_interrupt_disable_state, flags);
}
Having these primitives will avoid a read of preempt_count() after
changing preempt_count() on certain architectures.
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Heiko Carstens <hca@linux.ibm.com> # s390
Link: https://patch.msgid.link/20260804161447.84806-4-boqun@kernel.org
|
||
|
Boqun Feng
|
9634d860ac |
preempt: Introduce HARDIRQ_DISABLE_BITS
In order to support preempt_disable()-like interrupt disabling, that is, using part of preempt_count() to track interrupt disabling nesting level, change the preempt_count() layout to contain 8-bit HARDIRQ_DISABLE count. Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260121223933.1568682-2-lyude@redhat.com Link: https://patch.msgid.link/20260804161447.84806-3-boqun@kernel.org |
||
Joel Fernandes
|
b54aa0edf0 |
preempt: Track NMI nesting to separate per-CPU counter
Move NMI nesting tracking from the preempt_count bits to a separate per-CPU counter (nmi_nesting). This is to free up the NMI bits in the preempt_count, allowing those bits to be repurposed for other uses. Reduce NMI_BITS from 4 to 1, using it only to detect if we're in an NMI. The per-CPU counter currently caps nesting at 15. [boqun: Address Steven Rostedt's comment on the BUG_ON() condition] [boqun: Use preempt_count_set() in __nmi_exit() to avoid underflow] Suggested-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260121223933.1568682-3-lyude@redhat.com Link: https://patch.msgid.link/20260804161447.84806-2-boqun@kernel.org |
||
Michael Neuling
|
5d588c6848 |
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG // advance
orc.b t1, t1
bgeu t0, t4, 4f // boundary check AFTER load
where t4 = (s + count) & -SZREG. When s is aligned and count is a
multiple of SZREG, t4 equals s + count and the loop loads a full word
starting at exactly s + count. If s + count falls on a page boundary
with the next page unmapped, this faults.
Fix by computing the aligned boundary from the last valid byte
(s + count - 1) instead of s + count. This makes the loop stop at the
word containing the last valid byte rather than potentially loading the
word after it. The count == 0 case is already handled by the beqz
early exit.
Also add a pre-loop guard (bgeu t0, t4) for the case where all valid
bytes fit within the first word. With the adjusted boundary, t4 can
equal t0, and entering the loop with stale register state from the
first-word processing would produce incorrect results.
The final minu clamp ensures the result is still correct when the last
loaded word extends past s + count - 1 within the same aligned word.
Fixes:
|
||
|
Alexandre Belloni
|
2cd4d47c72 |
aspeed: First batch of ARM devicetree changes for 7.3
No significant changes this time around. Instead, several cleanups for Meta's San Miguel platform, along with some changes enabling dt-check-style. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanF5jhwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGmKM4BAIn485+eqqhirbu9AlZ1 vR71X3FozVRs9a5AJkl2ZLQaAPsE5mLKHPBv9b7tQNTjtweWg+ZzSW+dSwi6fvaT T5lTAA== =wBKd -----END PGP SIGNATURE----- Merge tag 'aspeed-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt aspeed: First batch of ARM devicetree changes for 7.3 No significant changes this time around. Instead, several cleanups for Meta's San Miguel platform, along with some changes enabling dt-check-style. * tag 'aspeed-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: Correct indentation ARM: dts: aspeed: sanmiguel: fix PDB HSC shunt resistor ARM: dts: aspeed: sanmiguel: Fix PWRGD_RMC_N active-low hog configuration ARM: dts: aspeed: sanmiguel: Fix FIO IOEXP interrupt pin Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
dcc9253b5f |
nuvoton: First batch of arm64 devicetree changes for 7.3
Similar to the 7.3 ARM PR for Nuvoton we have a couple of arm64 tidy-ups from Tomer. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanF2rxwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGm7RQBAITiQe5Y+lq06iGFVoCK uMGOoT2dJ8l7nb/vB+Wq7wcHAQCc+8HzdiIYwg4mAUdu9KBYTa45ENMmc7xCz2ro lgZQDQ== =X0Sh -----END PGP SIGNATURE----- Merge tag 'nuvoton-arm64-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt nuvoton: First batch of arm64 devicetree changes for 7.3 Similar to the 7.3 ARM PR for Nuvoton we have a couple of arm64 tidy-ups from Tomer. * tag 'nuvoton-arm64-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm64: dts: nuvoton: npcm845: Reorder timer0 and PECI nodes arm64: dts: nuvoton: npcm845: Drop redundant timer clock-names Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
ef59e07114 |
nuvoton: First batch of ARM devicetree changes for 7.3
This time around we have a couple of cleanups from Tomer that make way for improvements in the bindings. -----BEGIN PGP SIGNATURE----- iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanFyrBwcYW5kcmV3QGNv ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGmUpYA/RIAIMzFmJ7AAIGeVq6i Obc906cAt8/t5yazfSno0yT9AQCiNUJCJD28vD1PMglfSGyu+cvhjMI/va/SE021 8s9cDA== =kqlH -----END PGP SIGNATURE----- Merge tag 'nuvoton-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt nuvoton: First batch of ARM devicetree changes for 7.3 This time around we have a couple of cleanups from Tomer that make way for improvements in the bindings. * tag 'nuvoton-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm: dts: nuvoton: npcm7xx: Drop redundant FIU clock-names arm: dts: nuvoton: npcm7xx: Drop bogus FIU memory reg-names Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
ff1d40db21 |
Allwinner device tree changes for 7.3
Some changes for old chips/devices and some for recent ones. - A10 PMU interrupt number fixed - A100/A133 gained LRADC - enabled overlay support for sun8i-h2-plus pi boards - A523 family gained consumer IR receiver - H728-based X96QPRO+ gained SPDIF audio output - PinePhone's mpu6050 mount orientation fixed - style fixes New board added: - Baijie Helper A133 - NetCube Systems OpenNMC (dobermann) -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmpwvNYQHHdlbnNAa2Vy bmVsLm9yZwAKCRA4mlQhnA8kMC8qD/0R7T3AqT3n2HChF6NLv5mGqbJSxmTqG7FN FsJ9YuL+6ooeMRnktXypf1tagaVwZjz31U6LsCEPtmyxMZBrNXW0vE5iukvXVxG7 /F1Ar9vezQ1BVtd5qAdLbsWGQRfxsaTtk38sqYP+m1EObFKaxIKrf6VN8pX94uyM pJFXnIY0uEgHedEIzHphJYJP/y+r0WuvcI2ydpRU2u0yyBIj8JxY+pYvCeG8mw9x QXSZkDrz3ImdsHQqyMDN9lUEsgg/41DL9PyEcaiu0hv0Jiik0hQmX+NRZvo16LmO JZJjpPyVVxIxTGB15Bnh1z8dU+fPcmXxTOYJfDmYEI87Y81nUD1tG3UtyrOsirt2 aler/di3aAPUw9IysEyTU56vrAE2e76iCHhgO/Ba27Wi9HYjnRD4t+xSmLO5LXOv HlcRrzg5VPzlrXlabkuZQbJPfeqoZlwi08NCZxAo5mFeuDWuEDC5qnJzHezouicG DpAMchWZaTr+6wdFOUegZbGeNIp9LqK4Im/ySFmP2pGtBQ6avyLii9vlp52cc5Na banc4LgSigNFJVGKZ48DCk6q9ACfG8MTGLkT0wyRr5/1C4Aqrsd4LBptcsESk2Wv FbAneZj/nIs/Zke+Ek3tuVCx76KOt+2jxeTIp8gd7WWJGOWT+q2I5UBv2qTOvhfA 0Z/dB/ll4A== =S3xU -----END PGP SIGNATURE----- Merge tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 7.3 Some changes for old chips/devices and some for recent ones. - A10 PMU interrupt number fixed - A100/A133 gained LRADC - enabled overlay support for sun8i-h2-plus pi boards - A523 family gained consumer IR receiver - H728-based X96QPRO+ gained SPDIF audio output - PinePhone's mpu6050 mount orientation fixed - style fixes New board added: - Baijie Helper A133 - NetCube Systems OpenNMC (dobermann) * tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: Correct white-space style ARM: dts: allwinner: Correct white-space style arm64: dts: allwinner: a523: Enable SPDIF on X96QPRO+ arm64: dts: allwinner: a523: Add SPDIF output PH pin mux option arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix arm64: dts: allwinner: a523: enable IR on the Avaota A1 arm64: dts: allwinner: a523: enable IR receiver on the X96Q Pro+ arm64: dts: allwinner: a523: add IR receiver nodes media: dt-bindings: allwinner,sun4i-a10-ir: add A523 compatible ARM: dts: allwinner: a10: Fix PMU interrupt ARM: dts: allwinner: enable overlay support for sun8i-h2-plus pi boards ARM: dts: allwinner: add support for NetCube Systems OpenNMC (dobermann) riscv: dts: allwinner: d1s-t113: Add uart4 pinctrl required by NetCube Systems OpenNMC dt-bindings: arm: sunxi: Add NetCube Systems OpenNMC (dobermann) ARM: dts: allwinner: sun8i-h3: Correct indentation arm64: dts: allwinner: A133: add support for Baijie Helper A133 board arm64: dts: allwinner: a100: Add LRADC node dt-bindings: input: sun4i-lradc-keys: Add A100/A133 compatible dt-bindings: arm: sunxi: Add Baijie HelperBoard A133 compatible dt-bindings: vendor-prefixes: Add Shenzhen Baijie Technology Co., Ltd. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
52b1700b30 |
ARM: dts: OMAP updates for v7.3
- DT support for PRU-ICSS on AM3/4/5 - minor fixes & cleanups -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEe4dGDhaSf6n1v/EMWTcYmtP7xmUFAmpwuDQACgkQWTcYmtP7 xmXGtA//ROU+70rWugsXkpzQdwPpJDaB7SlGJTzdqX0Nic9BKFv2h2mu4VH+7qLp ydLVpY2t6eEgolAfNjUQ2MXNl3qK/QMiIjNGgURHlpAl90YeXlST2bOo7kXDMLgG 9mlOVZyN2Wx5FEUN66ezlvcnTXjQP8vC2kXT4ya+a7ZQ6PL28UwfisD16Fs98gGk m2IgRPPCmCn1o+A2rQ+H+DBwW7p/1oe7t9r2xcFusDmQXx4f8XoghwK0Z5t+qVkk cDDI7poHBAty+sR0jKY6qa62kXnybig/yZeGQrUIX1F+BOivs+Ko7gUiqMYyO5bl AFcsf0LDS+OLa1bhw1Mcua2/03cELYQSxKZQiSVAo9/Bel4tXaYn3WWzH3e2Lw1F 2n+OAGfLWHAz7bIj3VfaurG3JUYNFUWqD6oe7PniaGFDg6EinU9ibwYIFtVT9ZB2 Iug4/9TUzcLONnMjvgz2D5ooUcEx62aIYRPsT9AOX4SjOY+rM/+3Wtg8VZzPKClb deUTvUPLQg1bucWj2RRV0/x56Jae3k4MypZeiXtK5RT+YUrWeNcHzwAqAnhvKglr wpUw6KU39oXF5o7neUk07A41vRuPh6+TP1nebZlPhB/7yjgjyQg2xFT4Fr+A+v1y 43MAyEgZnxjNrF0UXrdTU3xvVx3b41Q1TXgflyAPwWV82+hHDaI= =PThB -----END PGP SIGNATURE----- Merge tag 'omap-for-v7.3/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt ARM: dts: OMAP updates for v7.3 - DT support for PRU-ICSS on AM3/4/5 - minor fixes & cleanups * tag 'omap-for-v7.3/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: ti/omap: embt2ws: use mulit-led for RGB LED ARM: dts: ti: omap: Correct indentation ARM: dts: ti: Fix typos in comments ARM: dts: ti: Add specific compatibles for SCM conf nodes arm: dts: ti: Add device tree support for PRU-ICSS on AM335x arm: dts: ti: Add device tree support for PRU-ICSS on AM437x arm: dts: ti: Add device tree support for PRU-ICSS on AM57xx ARM: dts: ti: var-som-om44: Add USB Ethernet controller node Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
0b02b8f941 |
RISC-V SpacemiT DT changes for 7.3
For K3 SoC - Enable SD card support - Enable QSPI - Fix reset delay of ETH PHY - Fix PHY ID of ETH - Symbolic PDAM ID - Add SPI controller support - Add USB and PHY support - Add I2S nodes For K1 SoC - Symbolic PDAM ID - Enable cpufreq support - Fix max CPU core voltage For boards of K3 - Pico-ITX - Enable ALDPS on RTL8211F PHY - Disable 125MHz clock on RTL8211F PHY - Enable NOR flash - Add EEPROM support - CoM260 - Add EEPROM support For boards of K1 - Milk-V Jupiter - Enable CPU DVFS - Banana Pi BPI-CM6 - Add initial support - OrangePi R2S - Enable PCIe -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQKvBAABCgCZFiEEtbq4ycMbcRVnAiPcMarqR1lNu+0FAmpupawbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCNUJBQjhDOUMzMUI3MTE1NjcwMjIz REMzMUFBRUE0NzU5NERCQkVEAAoJEDGq6kdZTbvtuDgP/0+IIPDo/U7U0IhT+dAx Mxr1fWX1M4h5nEmirD8Zsx8TSfvZrpZr5MvazjrHxZ5U2U4ntkqrcoByhIqEy6Dn wz3A8arOEe3BU1zXf4UAPAW0CZA3Bp9rEDgwbgsTfyelSLyeDqaMX8l/8XQLU8Sl f28L5p+5AQota4Cutl36yE/KP6cK+7SBSgXA2Rnb9SXzvwC9cQGuOUq71zUsS7jI FdpYcvyCbLFmUiq2XoeFAdGB04nYs28VWiFnHg7FNdrCqWH6pgi/zxd3QtlTxjd6 oIrp/NsBnx9WAyx9GDhckpqOLt+sA49BjMTArBHmytVBI0ku2kbueQXJIS2J2OEq Cj4jkMD36Mbk21UP/3OOohARxPYWDDsRQ6NzvAMqNnmFdGa2lTCGA2pBsXF6pzYA cgFoSQq3s37ArNWaFxeCgnAnzyUWtEUEA3wcp+04xh4s9a90khxuU/rpF+GuyZwp 5Bfppy9L9dI6BogmfAcMsVHcLd0UhDoC6nokx8QLCtrVKEnpvWHfAtWProzEINfX k9K+f+fLtvL4aWGevKfZZfbMwFRrDaARI03HqW/flUjLBVggoC2FFo63WOfEmvZr ldCmIWM2iDgr7gBTSy8FSX+3FNROyc2xDFhM189crVvK0+LCCMyqGhHFNnk6NYbU NRf7S+rwIN9yrBSUgrX6GCXs =WKqT -----END PGP SIGNATURE----- Merge tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into soc/dt RISC-V SpacemiT DT changes for 7.3 For K3 SoC - Enable SD card support - Enable QSPI - Fix reset delay of ETH PHY - Fix PHY ID of ETH - Symbolic PDAM ID - Add SPI controller support - Add USB and PHY support - Add I2S nodes For K1 SoC - Symbolic PDAM ID - Enable cpufreq support - Fix max CPU core voltage For boards of K3 - Pico-ITX - Enable ALDPS on RTL8211F PHY - Disable 125MHz clock on RTL8211F PHY - Enable NOR flash - Add EEPROM support - CoM260 - Add EEPROM support For boards of K1 - Milk-V Jupiter - Enable CPU DVFS - Banana Pi BPI-CM6 - Add initial support - OrangePi R2S - Enable PCIe * tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: (33 commits) riscv: dts: spacemit: Add cpu scaling for Milk-V Jupiter riscv: dts: spacemit: k1-bananapi-cm6: fix maximum CPU core voltage riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board riscv: dts: spacemit: k3: add i2s0-i2s5 nodes riscv: dts: spacemit: k3: add USB controller and USB phy support riscv: dts: spacemit: enable PCIe on OrangePi R2S riscv: dts: spacemit: k3-com260-ifx: add eeprom on i2c1 riscv: dts: spacemit: k3-com260: add eeprom on i2c2 riscv: dts: spacemit: add SPI controllers for K3 riscv: dts: spacemit: add K3 PDMA request numbers riscv: dts: spacemit: Fix phy id check for the phy on com260 board riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
476906f83c |
New boards: Graperain G3568, HINLINK H28K, LCKFB Taishan Pi 3M,
Orange Pi 5 Pro, Vicharak Axon, Vicharak Vaaman2, Youyeetoo YY3588 New peripherals: eDP support on RK3576 And of course a number of board-fixes, style-fixes and some newly enabled board-components. -----BEGIN PGP SIGNATURE----- iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmptHIQQHGhlaWtvQHNu dGVjaC5kZQAKCRDzpnnJnNEdgc0AB/9BaMz8DtfWjjLRIQTBoIHDCeflNPO/deS0 Gea4KkofOsLapsflB4WvVs9HAxJfX43LE4xFFqQn947wiFVDA7xV9Z1T9V3DkxiE 5GnvrjYbfDGBtYeAJZmYm3Lq2AA7HeIVAQhgOXEow+6MH5GmG3SRWg8aBplNQC0K pPvLc+AdFyQCLlVVf12iVOeViIZejIEXYGDuofa8euTEUjZxNSlqvxfX/YF5uE2K 1ycQX6MwNLA7x1Gx4GXCytgt+oKTtl42NAQLeIHYwJyinnMd2JY8RrDQBBozENZf YQVWUE53W7W/9OWsLptfjLN5Jya9iMVxMXcsGRvtNe44SyyGnCT3 =0Vz9 -----END PGP SIGNATURE----- Merge tag 'v7.3-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: Graperain G3568, HINLINK H28K, LCKFB Taishan Pi 3M, Orange Pi 5 Pro, Vicharak Axon, Vicharak Vaaman2, Youyeetoo YY3588 New peripherals: eDP support on RK3576 And of course a number of board-fixes, style-fixes and some newly enabled board-components. * tag 'v7.3-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (39 commits) arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property arm64: dts: rockchip: fix label of sys_led for nanopi-r4s arm64: dts: rockchip: Fix the rk3566-radxa-cm3 Wifi compatible arm64: dts: rockchip: Fix Gru WLAN sideband interrupt arm64: dts: rockchip: Add Vicharak Vaaman2 board dt-bindings: arm: rockchip: Add Vicharak Vaaman2 arm64: dts: rockchip: add Vicharak Axon board dt-bindings: arm: rockchip: add Vicharak Axon board arm64: dts: rockchip: Add LCKFB Taishan Pi 3M dt-bindings: arm: rockchip: Add LCKFB Taishan Pi 3M arm64: dts: rockchip: Add Orange Pi 5 Pro board support arm64: dts: rockchip: refactor items from Orange Pi 5/b to prep for Pro arm64: dts: rockchip: rename PLDO regulator labels to match schematic on rk3588s-orangepi-5 dt-bindings: arm: rockchip: Add Orange Pi 5 Pro arm64: dts: rockchip: Add devicetree for the Graperain G3568 v2 dt-bindings: arm: rockchip: Add Graperain G3568 series dt-bindings: vendor-prefixes: Add graperain Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" arm64: dts: rockchip: fix HDMI-RX signal detect GPIO on yy3588 arm64: dts: rockchip: Enable USB device mode on rk3588s-roc-pc ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
307b9caae6 |
Amlogic ARM64 DT for v7.3:
- Amlogic AXG fixups for PCIe and NAND - Overall indentation and whitespace fixups - Amlogic A9 Pinctrl & GPIO IRQ nodes - Clock measure nodes for Amlogic T7 & A1 -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPVPGJshWBf4d9CyLd9zb2sjISdEFAmppuD4ACgkQd9zb2sjI SdGFPxAAwLi5kwLl7ID9WgjCZ/Qqb3XIyfrnFiBJTXydFAmdxqRvzI1d3P0gwukp GXRb+ZegfeqXVXIrUt3X95SPAwx6ajPF7uxAYopxanHPvnhEp7cPZihKoAuJSUHl nuntgyU8048//MLRGizXX1VPL7NilW+uIQAe7ut4AVIvDVzHoSP818Aek7GoyS6D k6+txNZ+gCDIr7RhCXlHXbw2GRNyvi5oguoniSXgy+PhNT3p9k+4Vy7VJSHxzScD ZKaO+qQHsqtmmLDLYuOVKFTCL2unGtIJNpLHDyG6bvhTlFdebYS7Y6XSB8am34KN pPukfCwAxAkmh0JoYTawwwGuh90roqesmyQhMCybs9c1JBMx8f50vrzUosvy65sc M42lBcDfEDVe5bT4H0y83WC2MmDb2gdvkNf4C+c3RQJINVSy67RhpbPOP9L6pptq 3oWY1ZWrcWnpAZSEiWapkvqiHO7KnQw3UaUe+m5T/z/xiXKL212pXxc38O7bmfyC XZlcxtdwo42h6DpYV1sQPf/BbIA8Qr4r8RuE7X8qYkl9CKZvO7MP28TTDiuaUauJ zKOuSSu48qOmUc7LX0tt3P9OBaD7Mcwfqj7KFvgws+3yf5J+deLrW8TjaF6MyoIf bw0xUvX1+Co2mqRyHaF/CU+nGfPfxuH26nvZtcZmSMwnLC4KZPc= =q1K8 -----END PGP SIGNATURE----- Merge tag 'amlogic-arm64-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT for v7.3: - Amlogic AXG fixups for PCIe and NAND - Overall indentation and whitespace fixups - Amlogic A9 Pinctrl & GPIO IRQ nodes - Clock measure nodes for Amlogic T7 & A1 * tag 'amlogic-arm64-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe arm64: dts: amlogic: meson-axg: Disable pcie_phy node by default arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins arm64: dts: amlogic: meson-axg: Disable nfc node by default arm64: dts: amlogic: Correct indentation and whitespace arm64: dts: amlogic: add some device nodes for A9 arm64: dts: amlogic: t7: Add clk measure support arm64: dts: meson: a1: Add clk measure support Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
7855656ffb |
Qualcomm Arm64 DeviceTree updates for v7.3
Introduce DeviceTree support for the Shikra SoC, its GCC and RPM clock controllers, CQM, CQS, and IQS SoM platforms, and their evaluation boards. Document the Hawi and Maili SoCs. Add the Eliza CQS SoM and EVK platforms, the QCS8550 RB5 Gen 2, Vicharak Axon Mini, HONOR MagicBook Art 14, Microsoft Surface Pro 12, Xiaomi 12 Lite, Motorola Edge 30, Sony Xperia M2, and Motorola Moto G2 device trees. Extend Eliza support with USB, SD card, touchscreen, PMIC, interconnect, thermal, CPU and LLCC bandwidth-monitor, QUPv3, and ADSP GPR descriptions. Expand Glymur support with GPU, camera and EVA clock controllers, LPASS audio, CoreSight, PCIe, USB, IMEM and PIL memory regions, power domains, thermal cooling, and CRD peripherals. Add SoCCP, PMIC regulator, TRNG, and CPU-capacity descriptions. Add display, IPA, camera, USB, audio, crypto, TRNG, CoreSight, and thermal support to the Kaanapali, Milos, Hamoa, and related platforms. Add embedded controller support for Hamoa and Glymur boards. Improve networking-platform descriptions with IPQ PCIe port, PHY, clock, PWM, regulator, and interrupt updates. Update CTCU, display, Iris, audio, camera, PCIe, USB-C, power-domain, memory-region, and thermal descriptions across established Qualcomm platforms. Correct bindings and DeviceTree validation for Qualcomm compatible strings, legacy fallback compatibles, node naming and formatting, address ranges, clock specifiers, reserved memory, regulators, GPIOs, and peripheral wiring. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmprfucOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcVSexAAkUYQzdf+LbI2LXMUwhASxt0BcCGFUMnBzi1G B6QXIP/3H6ucb/QXhYAfghuSrd6SPWCmCueS+FiMJst+eEiuvSDPkPiGyMAWs3kM fuQbxSWc1VcAgVCbjABrCHSptmJRU+poRent3raLqgCQJ3oip78mnn3p3SEcv4rg HK4TyjF5EWjzZo6sQWYuS6F3zAeu5Az5ft83Qjd/87PnFYl3A5Y8ZJMleT1o9yi0 eqwBh2XlyMHVZB83Bm6kIRfDFQ+q6CjB/CNCjrjfdXQeKbkYNMnEF3NywIDckPDC L6O1kTuld3L25koRRfMeHq8bWpOTEWLq4UCqvpEVpj352eZPAgFYfd0zudVhjLQP CPmoq+5quRbltq7VxO2x7LWz6vzgrrRevC9n3Eyj6uBioCo+JpcMTns/zDGDrzm/ dl43YwGcOI0+U3m3GXJ9567T9zIEA8CzuOd3tHcmTxGmxMU2y313cwfHqgbqy6K6 NLzToYYPclB6aC44yqBPjOhkP653atqDc6qhhMCix7swoTEUqs780fH/G7X6ammY 9XgUM/pxB3dB37dqy8fBBha0TdQ6dQm25DAN2TULgKcolFzHo+O2vd4jR4KpU2eg 3L+pdMUZgF0bvrlqpR9Q8z2TYpIkL/Z5Tc/eEdI6WWF9YXF0TV+iI/7U6S/a+ZJi gfrBpeo= =ZLfL -----END PGP SIGNATURE----- Merge tag 'qcom-arm64-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v7.3 Introduce DeviceTree support for the Shikra SoC, its GCC and RPM clock controllers, CQM, CQS, and IQS SoM platforms, and their evaluation boards. Document the Hawi and Maili SoCs. Add the Eliza CQS SoM and EVK platforms, the QCS8550 RB5 Gen 2, Vicharak Axon Mini, HONOR MagicBook Art 14, Microsoft Surface Pro 12, Xiaomi 12 Lite, Motorola Edge 30, Sony Xperia M2, and Motorola Moto G2 device trees. Extend Eliza support with USB, SD card, touchscreen, PMIC, interconnect, thermal, CPU and LLCC bandwidth-monitor, QUPv3, and ADSP GPR descriptions. Expand Glymur support with GPU, camera and EVA clock controllers, LPASS audio, CoreSight, PCIe, USB, IMEM and PIL memory regions, power domains, thermal cooling, and CRD peripherals. Add SoCCP, PMIC regulator, TRNG, and CPU-capacity descriptions. Add display, IPA, camera, USB, audio, crypto, TRNG, CoreSight, and thermal support to the Kaanapali, Milos, Hamoa, and related platforms. Add embedded controller support for Hamoa and Glymur boards. Improve networking-platform descriptions with IPQ PCIe port, PHY, clock, PWM, regulator, and interrupt updates. Update CTCU, display, Iris, audio, camera, PCIe, USB-C, power-domain, memory-region, and thermal descriptions across established Qualcomm platforms. Correct bindings and DeviceTree validation for Qualcomm compatible strings, legacy fallback compatibles, node naming and formatting, address ranges, clock specifiers, reserved memory, regulators, GPIOs, and peripheral wiring. * tag 'qcom-arm64-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (244 commits) arm64: dts: qcom: eliza: Describe the ADSP GPR node arm64: dts: qcom: eliza-evk: Add support for USB and SD card dt-bindings: arm: qcom-soc: Allow WSA88xx speaker compatible dt-bindings: arm: qcom-soc: Validate nodes with fallbacks dt-bindings: arm: qcom-soc: Document more of existing legacy style compatibles dt-bindings: arm: qcom-soc: Include Eliza, Kaanapali and others in SoC names arm64: dts: qcom: eliza: Enable cpufreq cooling devices arm64: dts: qcom: glymur: add SoCCP DT node arm64: dts: qcom: glymur: fix SoCCP memory mappings arm64: dts: qcom: mahua: Add QREF regulator supplies to TCSR arm64: dts: qcom: glymur: Add QREF regulator supplies to TCSR arm64: dts: qcom: glymur: Add CX power domain to GCC arm64: dts: qcom: glymur: Drop fake PCIe phy 3B arm64: dts: qcom: glymur: add TRNG node arm64: dts: qcom: glymur: enable ETR and CTCU devices arm64: dts: qcom: glymur: Add PCIe port compatibles and ports arm64: dts: qcom: smb2370: Disable SMB2370_2 by default arm64: dts: qcom: eliza-mtp: Enable touchscreen arm64: dts: qcom: purwa-iot-som: enable video arm64: dts: qcom: purwa: Override Iris clocks and operating points ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
b8b3f6e974 |
arm64: dts: NXP device tree updates for v7.3
New boards and SOM support: - Variscite DART-MX8M-MINI, DART-MX8M-PLUS, VAR-SOM-MX8 QuadMax (with Sonata and Symphony carrier boards) - TQMa8MPxS (i.MX8MP) with LVDS overlays, TQMa9596LA on MBa95xxCA; TQMa91xx on MBa93xxCA - imx8mm-verdin: Toradex DSI displays (7"/10.1"), HDMI adapter, NAU8822 BTL audio, Cortex-M4F remoteproc and UART overlay i.MX8: - PCIe: add power supply properties to Root Port nodes. - imx8mp-evk add typec and usb3_phy1 tuning; imx8mq-evk add typec; - imx8mp-evk add flexcan2 overlay and CAN2/MICFIL board mux; imx8mp-frdm fix HDMI DDC pinctrl - imx8mp-var-som-symphony: add second Ethernet, CAN, PWM1, ECSPI2, capacitive touchscreen, HDMI, PCIe, USB, TPM, external RTC, input keys, header UARTs - imx8mq-evk: add DCSS node, uart3/bluetooth node - imx8qm: add SCU power key, lsio mu8/mu8b, spdif1, lpuart4 nodes; fix LPCG clock indices for ASRC0; add Variscite Symphony board support - imx8ulp: add I3C2, eDMA channel properties, LPUART6 (BT) and LPUART7, gpio-keys power button; correct SRAM node address/size; update rpmsg resource table address; rename 9x9-evk model string - imx8mp: enable MU2 for DSP communication (imx8mp-ab2) i.MX9: - PCIe: add Root Port nodes with correct outbound address space for imx94/imx943/imx95; add dma/intr/aer/pme interrupts for imx95 PCIe; remove 'supports-clkreq' from imx943-evk PCIe1 - imx95: switch USB3 controller to flattened model; add CM7/CM33S nodes for imx943/imx952/imx95-19x19-evk; add imx94 DMA channels (xspi); enable NETC block control and in-band SFP status (imx95-var-dart); add wm8904 DMICDAT1; add lpuart5 alias (imx95-toradex-smarc) - imx93: add LVDS Display Bridge support with DY1212W-4856 panel overlay for imx93-11x11-evk; add LVDS overlays for imx93-tqma9352 boards; update TMU compatible string; fix memory node for imx93-kontron - imx91: add WM8524 and PDM microphone sound cards, CAN overlay, audio board muxes (imx91-9x9-qsb); move ELE reserved memory into 512MB range; USB phy adjustments (imx91-tqma9131) Layerscape / S32G: - ls1028a/ls1046a/ls1088a/ls208xa/lx2160a/lx2162a: describe Lynx 10G SerDes blocks; refactor lx2160a PCIe and SerDes into separate dtsi files; transition to device-specific SerDes compatible strings - s32g: add GPR syscon region; describe GPIO and EIRQ in SIUL2 pinctrl Cleanup and warning fixes: - correct imx8/s32g3 indentation - imx8mp: add missing #sound-dai-cells to xcvr -----BEGIN PGP SIGNATURE----- iQHFBAABCgAvFiEEJS45w2QNr0ezLVaoNF3oRQ23YkwFAmprfTgRHGZyYW5rLmxp QG54cC5jb20ACgkQNF3oRQ23Ykyh7Av/bGjTZ/3yQiG8wIU27lJlvfErpZt7p+iL 4qcFX9rXx+XvWqn7tm45nWTFsgte4CcnbpL6iLL7u/QQNpks6sfVYUcJAESzFlSO CpW+iRu/XisAqmFIxi+Xvf63vfy8s0SfYFFRcnlBS9WzfJECzpOalCN1uKvAm+0o 8dAwTL4EWNIwPeDgX1ngdwhL4vzDYLCBjt4ct/pIWXVWamzyUebfoN2DvxEXm5+C PvP+uU3P7TYtmYNESmPHKMkMgqmUJH570Jb2f8xZdm8adp1CaT7xrqngCLAN3/Gv /I/r6b7PRL+WL7lSLnyRvrwoHwH1kCDH6/3a/jEFkRWnSSLoz6GiORPlvJHzu1Mf 43/3Tv4ffKVyVC1vD5mqS6hb3UyWQ4bkL17NJAZGTF5tRK9qK3lufUw8ZEgSlXFY V1HPf3bajl75ZQ07Ra38rdjYfqBFypr/lrnBng0lXlVIMtEvgF0qQe1pdjTgr4qt qf/BNnAScEJpHO4ETNvLZsyadmkf8K6w =0Nmj -----END PGP SIGNATURE----- Merge tag 'imx-dt64-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt arm64: dts: NXP device tree updates for v7.3 New boards and SOM support: - Variscite DART-MX8M-MINI, DART-MX8M-PLUS, VAR-SOM-MX8 QuadMax (with Sonata and Symphony carrier boards) - TQMa8MPxS (i.MX8MP) with LVDS overlays, TQMa9596LA on MBa95xxCA; TQMa91xx on MBa93xxCA - imx8mm-verdin: Toradex DSI displays (7"/10.1"), HDMI adapter, NAU8822 BTL audio, Cortex-M4F remoteproc and UART overlay i.MX8: - PCIe: add power supply properties to Root Port nodes. - imx8mp-evk add typec and usb3_phy1 tuning; imx8mq-evk add typec; - imx8mp-evk add flexcan2 overlay and CAN2/MICFIL board mux; imx8mp-frdm fix HDMI DDC pinctrl - imx8mp-var-som-symphony: add second Ethernet, CAN, PWM1, ECSPI2, capacitive touchscreen, HDMI, PCIe, USB, TPM, external RTC, input keys, header UARTs - imx8mq-evk: add DCSS node, uart3/bluetooth node - imx8qm: add SCU power key, lsio mu8/mu8b, spdif1, lpuart4 nodes; fix LPCG clock indices for ASRC0; add Variscite Symphony board support - imx8ulp: add I3C2, eDMA channel properties, LPUART6 (BT) and LPUART7, gpio-keys power button; correct SRAM node address/size; update rpmsg resource table address; rename 9x9-evk model string - imx8mp: enable MU2 for DSP communication (imx8mp-ab2) i.MX9: - PCIe: add Root Port nodes with correct outbound address space for imx94/imx943/imx95; add dma/intr/aer/pme interrupts for imx95 PCIe; remove 'supports-clkreq' from imx943-evk PCIe1 - imx95: switch USB3 controller to flattened model; add CM7/CM33S nodes for imx943/imx952/imx95-19x19-evk; add imx94 DMA channels (xspi); enable NETC block control and in-band SFP status (imx95-var-dart); add wm8904 DMICDAT1; add lpuart5 alias (imx95-toradex-smarc) - imx93: add LVDS Display Bridge support with DY1212W-4856 panel overlay for imx93-11x11-evk; add LVDS overlays for imx93-tqma9352 boards; update TMU compatible string; fix memory node for imx93-kontron - imx91: add WM8524 and PDM microphone sound cards, CAN overlay, audio board muxes (imx91-9x9-qsb); move ELE reserved memory into 512MB range; USB phy adjustments (imx91-tqma9131) Layerscape / S32G: - ls1028a/ls1046a/ls1088a/ls208xa/lx2160a/lx2162a: describe Lynx 10G SerDes blocks; refactor lx2160a PCIe and SerDes into separate dtsi files; transition to device-specific SerDes compatible strings - s32g: add GPR syscon region; describe GPIO and EIRQ in SIUL2 pinctrl Cleanup and warning fixes: - correct imx8/s32g3 indentation - imx8mp: add missing #sound-dai-cells to xcvr * tag 'imx-dt64-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: (131 commits) arm64: dts: imx95: Add dma, intr, aer and pme interrupts for PCIe arm64: dts: imx94-xspi: add the DMA channels arm64: dts: freescale: imx8mm-verdin: Add Cortex-M4F UART_4 overlay arm64: dts: freescale: imx8mm-verdin: Add Cortex-M4F remoteproc arm64: dts: freescale: imx8mm-verdin: Add Toradex Capacitive Touch Display 7" DSI arm64: dts: freescale: imx8mm-verdin: Add Toradex Capacitive Touch Display 10.1" DSI arm64: dts: freescale: imx8mm-verdin: Add Toradex DSI to LVDS adapter with 10.1" display arm64: dts: freescale: imx8mm-verdin: Add DSI to HDMI adapter overlay arm64: dts: freescale: imx8mm-verdin: Add NAU8822 Bridge Tied Load arm64: dts: imx95-var-dart-sonata: enable in-band status for SFP arm64: dts: imx8ulp-evk: Update rpmsg resource table address arm64: dts: imx943-evk: Add CM7 and CM33S nodes arm64: dts: imx952-evk: Add CM7 node and related memory nodes arm64: dts: imx95-19x19-evk: Add CM7 node and related memory nodes arm64: dts: imx8qm-var-som-symphony: enable expansion header UART arm64: dts: imx8ulp-9x9-evk: Rename model string to reflect die size arm64: dts: imx8ulp-evk: Change the values of some PCRs of ENET arm64: dts: imx8ulp-evk: Enable LPUART7 arm64: dts: imx8ulp-evk: Enable LPUART6 for Bluetooth arm64: dts: imx8ulp-evk: Add gpio-keys node for power button ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
82a2eeb8b8 |
ARM64: DT: HiSilicon ARM64 DT updates for v7.3
- Correct indentation - Drop unused clock-names and reset-names to fix warnings -----BEGIN PGP SIGNATURE----- iQJJBAABCAAzFiEEQeMYD8qOQTc1R/snC8hXbtmJZlwFAmpsURUVHHh1d2VpNUBo aXNpbGljb24uY29tAAoJEAvIV27ZiWZcPyUP/3Kd3kSy6+EVkjm4cg3Eii8rBhNs e76IQOOTgycIKCnm3vlfkKZnoGCqCqy7v1NXuRox+aZR5Y3mA1KI/wlx1uH4DMEA h8QEijmfAPkVhK3wr7h/0172IbqUdloITrQcuzHshGBJ+2kz1i786U+Zd6iPchAU zDE1MrTxRvBAKwqMspLAeiQgukXGoUCBcCkeSH/Ss80m5aH7eGeKYcMJ2l3LuPtD yWMEpeuPMxK3FZAnrXxQ/i/UnLa36d7PZQmZ6UeUxvbqPHpR7bfSfF34pdzTM41R reCtQ8l5YDiXqhpCOrmpXS78PRS6NUV3oyJwaJuLgu8p36fQU5cjUcR6exMztdIh SMpsXJ0il6f0ipg8zmbJRpEvD7JietasxAZ2JXUvhH4J9PIeT2TIcX75ChorTdc8 l/y4WbRB25aigWOrN1uftya/h4ltis69pX72l0xpFlIupYQSIq+fiD9b6Nez+IcU qya8/9mRJOp3Tl+x/u9VAd93EYPyR79K0B7thmbD4xm7zogf5VKTPWJAQmh/Glpn Of+qqyiX0RiWiB/5T3nQZyvcBF5qGNRVCIe4i1+DgmvTx3eqJmBGiF6EcFn+XEof Di1olMR7PMFzIoCBfGyNK0JWX8dV7fvipuyhsD6wTzH5qSOSaU7jnQEmIFablYV/ Bsxle9kg1UYknXnm =TjKC -----END PGP SIGNATURE----- Merge tag 'hisi-arm64-dt-for-7.3' of https://github.com/hisilicon/linux-hisi into soc/dt ARM64: DT: HiSilicon ARM64 DT updates for v7.3 - Correct indentation - Drop unused clock-names and reset-names to fix warnings * tag 'hisi-arm64-dt-for-7.3' of https://github.com/hisilicon/linux-hisi: arm64: dts: hisilicon: Correct indentation arm64: dts: hisilicon: hi3798cv200: Drop unused clock-names and reset-names Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
Takashi Iwai
|
885c22d259 |
ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
The recent "sticky mixer" sanity check in USB-audio driver caused a
regression on SteelSeries Arctis Nova 5 (1038:2232); because the
firmware doesn't handle GET_CUR requests, some mixers are effectively
disabled, leading to the too low / soft volumes:
usb 5-1.1: 9:0: sticky mixer values (-19712/0/256 => 0), disabling
usb 5-1.1: 10:0: sticky mixer values (-21248/0/256 => 0), disabling
Restore the functionality by ignoring GET_CUR errors intentionally
with MIXER_GET_CUR_BROKEN quirk.
Fixes:
|
||
|
Takashi Iwai
|
f8a80cfb68 |
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
The recent fix for UAF in ump_to_endpoint() caused another UAF because
it tries to dereference the UMP endpoint object, but this might be
executed at a delayed context where the endpoint has been already
released.
Add private_free to clear the associated data for avoiding the further
dereference for delayed releases.
Fixes:
|
||
Leon Hwang
|
48f2fd0d93 |
ftrace: Drop extra comma in trace_buffered_event_enable
Drop the extra comma in "scoped_guard()" to cleanup the code. Link: https://patch.msgid.link/20260730150411.88667-5-leon.hwang@linux.dev Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> |
||
|
Leon Hwang
|
092f8ec7db |
ftrace: Protect direct_functions in update_ftrace_direct_mod
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-4-leon.hwang@linux.dev
Fixes:
|
||
|
Leon Hwang
|
f26e5fa75f |
ftrace: Protect direct_functions in update_ftrace_direct_del
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-3-leon.hwang@linux.dev
Fixes:
|
||
|
Leon Hwang
|
63444b7617 |
ftrace: Protect direct_functions in ftrace_find_rec_direct
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-2-leon.hwang@linux.dev
Fixes:
|
||
|
Linus Torvalds
|
a7c7074b58 |
fbdev core fixes for 7.2-rc7:
A few patches for the core fbdev layer which stabilize or fix potential issues with text font rendering after screen rotation or after user initiated font changes and locking fixes for sysfb during modifications of the graphics mode database. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCanbPzgAKCRD3ErUQojoP XyrEAPwJgK7J9UvN1Ii0V9p175Z/3Mzwo6DF1Z4KW5ctYVTAsQD/TC91d1vqKtJ7 SHgY6jCLegC/DpLk4dqshBPrdO2pAgM= =Y1ZB -----END PGP SIGNATURE----- Merge tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "A few patches for the core fbdev layer which stabilize or fix potential issues with text font rendering after screen rotation or after user initiated font changes and locking fixes for sysfb during modifications of the graphics mode database" * tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: bitblit: bound-check glyph index in bit_cursor() fbdev: Fix out-of-bounds access when rotating console after font resize fbdev: core: Fix pointer desynchronization in fb_io_read() fbdev: serialize mode sysfs access with lock_fb_info() fbdev: clear fb_info->mode before deleting a videomode fbdev: bound mode sysfs output to the sysfs buffer |
||
Steven Rostedt
|
f0ece16ffc |
eventfs: Use children field for rcu head and add memory barriers
When an eventfs inode is freed, it sets ei->is_freed and then uses its
ei->list to add it to the srcu link list as the list field is a union with
the rcu list head. As the ei->list is used to iterate over an SRCU
protected list without taking the eventfs_mutex, there's nothing stopping
the iteration over that list to see the ei->rcu instead of the ei->list
and it will read a corrupt target.
To fix this, change the union of the rcu list head with the children list.
On freeing the eventfs inode, set the is_free and execute a smp_wmb()
before adding the eventfs inode to the SRCU list.
On iteration of the ei->children list, at the start, execute a smp_rmb()
and then read the is_freed of the ei to see if the children list is still
valid. If is_freed is set, then the ei_child read is not valid and the
loop should exit immediately.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808094215.4252430d@robin
Fixes:
|
||
Shuangpeng Bai
|
fd73b69170 |
eventfs: Fix use-after-free in eventfs_remove_rec()
eventfs_remove_rec() recursively removes the child at the current loop
position. After the recursive call returns, list_for_each_entry() advances
by reading list.next from the removed child.
If free_ei() drops the final reference, release_ei() reuses the list/rcu
union to queue an SRCU callback. The child may be freed before that read.
The eventfs_mutex serializes list updates, but it does not keep the removed
child alive or prevent the SRCU callback from running.
Use list_for_each_entry_safe() to save the next sibling before recursively
removing the current child.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Linus Torvalds
|
361efac9e9 |
Driver core fixes for 7.2-rc7
- Fix Rust build failure on s390 by gating ioremap() / iounmap() helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected doctests as well. - Add missing kernel-doc for show_const / store_const union members in struct device_attribute. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCancYdAAKCRBFlHeO1qrK LneZAQD9bhMwOb9C8t+fLXEYd6WR+1n932bmKTBSscZ1evnojwD+M4MqTWDBDgal Mc8wasHQsQc7pqVFFHtFEUIAZjRlpAc= =KHk2 -----END PGP SIGNATURE----- Merge tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix Rust build failure on s390 by gating ioremap() / iounmap() helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected doctests as well. - Add missing kernel-doc for show_const / store_const union members in struct device_attribute. * tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM driver core: add missing kernel-doc for union members |
||
|
Linus Torvalds
|
7d8c681eef |
Input updates for v7.2-rc6
- Fixes for information leaks and OOB accesses across several drivers, including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra - Improvements to the synaptics-rmi4 driver to properly handle F54 worker errors and prevent buffer overflows - Input validation fixes in the hynitron_cstxxx touchscreen driver to prevent issues with invalid finger IDs and touch counts - Fixes for use-after-free and initialization bugs in the byd mouse and psxpad-spi drivers - New quirks for the atkbd driver to make keyboard work on HONOR and Xiaomi laptops - Support for the ZENAIM LEVERLESS controller in the xpad driver. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCana8zQAKCRBAj56VGEWX nAIMAQCFKhBk3M4Q+625XmMMcb9AV+Bl0TTCxXBbdrA8bYJ+IQEA0C9AQXCmIGzC lwr7jlgTET8vN/NrEVD+WN9jNzFmZgA= =jcbm -----END PGP SIGNATURE----- Merge tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - Fixes for information leaks and OOB accesses across several drivers, including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra - Improvements to the synaptics-rmi4 driver to properly handle F54 worker errors and prevent buffer overflows - Input validation fixes in the hynitron_cstxxx touchscreen driver to prevent issues with invalid finger IDs and touch counts - Fixes for use-after-free and initialization bugs in the byd mouse and psxpad-spi drivers - New quirks for the atkbd driver to make keyboard work on HONOR and Xiaomi laptops - Support for the ZENAIM LEVERLESS controller in the xpad driver. * tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: evdev - sanitize event type index when fetching event masks Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Input: synaptics-rmi4 - block s_input when F54 queue is busy Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Input: synaptics-rmi4 - zero report size on F54 work error Input: synaptics-rmi4 - fix F55 transmitter electrode count typo Input: hynitron_cstxxx - validate touch count and finger IDs Input: evdev - fix information leak in evdev_pass_values() fixp-arith: convert comments to kernel-doc format Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Input: atkbd - skip deactivate for HONOR ZQC-P Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Input: iforce - validate input packet lengths Input: psxpad-spi - set driver data before use Input: cs40l50-vibra - validate custom data from user space Input: xpad - add support for ZENAIM LEVERLESS Input: edt-ft5x06 - ignore contacts with an out-of-range slot id Input: byd - synchronize timer deletion before freeing private data |
||
|
Linus Torvalds
|
afe80aebd3 |
powerpc fixes for 7.2 #4
- Couple of fixes for mem leak and underflow case Thanks to: George Wilson, R Nageswara Sastry -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmp2vToACgkQpnEsdPSH ZJTdSRAAyU2MKr444tK8kb/wFlZJ2kT2nHmLvotr7OrTPfb3A48cTcUYqzi3aJ5r hbethTk1diJa5fM+hbN5AJLA3DBNSknAEDJiyQKeE1knOr0Q1qn3NIQL6ROJaIe0 vTeOkJHzDzpU9dWnYbhoAxuNC+rQCicuNjB5WPd93LayI2kP1BN94uEb6GU5AMOz HLqH3j/9kWtFTt+x6pbIzSiOQy6+p3lbtjJS/FMsn2wqeqRyY2IehFBP27+dpjJX z2S20qnrS+8CuZ6tut/vSJIdIozRROwGXLTx1jRHXAGsfdWCp3W+drcY3lmwFRtK xq1x6z0c6+JJvaBPGtLDQCi7wURZ3DAlBHEA8PbfLYLogt4AuVBA0WFSI1Vlr4LX rTsuG/eV4GgjSEFEHRCa68+PuQ4imjNauyX2Ty+74rqzQwIgG4O0btnJFiCHZymt hZXBDbdCr17U1+2mQI5T//n67i+sKSpgM492ti+vpaYK8Ou0Ki1oOKnPiH6KyTXz QkvwfOTKrdrMVVUgI1jtM/19ewa/z/0OoBQBT8vmRY6qkbR0k6SCV6Na9tQVAxpw l6JNcFpYidvLuXJq5NhtxdyGFqh1a/WvNR7Q/LkVmpNXVauqiYTRe4HA7RtCmOv2 JGTpk1fzn2aq+pojDZnUV7EoVg+keO1EGhPAWEJ/KDEoMEcI/5o= =HV3X -----END PGP SIGNATURE----- Merge tag 'powerpc-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - A couple of fixes for a memory leak and a underflow case Thanks to George Wilson and R Nageswara Sastry * tag 'powerpc-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pseries: lparcfg - fix kbuf[] underflow powerpc/pseries: pci - logic bug powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak |
||
Peter Zijlstra
|
fcb8ada128 |
futex: Tell kmemleak we're not leaking __futex_queues
Kmemleak doesn't know about runtime_const stuff and figures we're leaking
__futex_queues. So add this little annotation to tell it all is well.
Fixes:
|
||
Rik van Riel
|
e033cbf397 |
fbdev: bitblit: bound-check glyph index in bit_cursor()
bit_cursor() fetches the glyph under the cursor with c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height); where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer value comes directly from scr_readw() and may be larger than the current font's glyph count. Syzkaller triggers this via vcs_write(). The Call Trace shows vcs_write() in vc_screen.c writing an arbitrary 16-bit value with writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via vcs_scr_writew() without checking charcount. The stored value is later read in bit_cursor() in bitblit.c. When the font is changed from a font with 512 glyphs to a font with 256 glyphs, the screen buffer can retain characters with the high bit set from the previous mode, which could also produce the same out-of-bounds access. BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr ffff800086c57970 Call Trace: soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365 fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427 hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883 update_region+0x100/0x18c drivers/tty/vt/vt.c:669 vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685 bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph index to vc_font.charcount. Apply the same clamp in bit_cursor() after extracting the attribute and masking, before indexing fontdata. The fix completes the bounds checking started in commit |
||
Zizhi Wo
|
ef7656e85f |
fbdev: Fix out-of-bounds access when rotating console after font resize
[BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in ccw_putcs+0x8bd/0xa80 Read of size 1 at addr ff11000110067100 by task bash/1209 CPU: 10 UID: 0 PID: 1209 Comm: bash Not tainted 7.2.0-rc3 #69 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 ? ccw_putcs+0x8bd/0xa80 ccw_putcs+0x8bd/0xa80 ? __pfx_ccw_putcs+0x10/0x10 fbcon_putcs+0x338/0x410 ? __pfx_ccw_putcs+0x10/0x10 do_update_region+0x21d/0x450 invert_screen+0x29d/0x5e0 ? __kmalloc_noprof+0x493/0x640 ? vc_do_resize+0x17c/0xe50 clear_selection+0x4c/0x60 vc_do_resize+0xaee/0xe50 fbcon_modechanged+0x2bd/0x640 rotate_all_store+0x298/0x380 ... reproduce: 1) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 1 and op.height = 1, then a TIOCL_SETSEL ioctl 2) echo 2 > /sys/devices/virtual/graphics/fbcon/rotate_all 3) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 8 and op.height = 1, then a TIOCL_SETSEL ioctl 4) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all [CAUSE] The root cause is that fbcon_modechanged() first sets the current rotate's corresponding ops. Subsequently, during vc_resize(), it may trigger clear_selection(), and in fbcon_putcs->ccw_putcs[rotate=3], this can result in an out-of-bounds access to "src". This happens because par->rotated.buf is reallocated in fbcon_rotate_font(): 1) When rotate=2, its size is (width + 7) / 8 * height 2) When rotate=3, its size is (height + 7) / 8 * width And the call to fbcon_rotate_font() occurs after clear_selection(). In other words, the fontbuffer is allocated using the size calculated from the previous rotation 2, but before reallocating it with the new size, con_putcs is already using the new rotation 3: rotate_all_store fbcon_rotate_all fbcon_set_all_vcs fbcon_modechanged set_blitting_type ... par->bitops = &ccw_fbcon_bitops vc_resize ... clear_selection highlight ... do_update_region fbcon_putcs ... image.dy = vyres - ((xx + count) * vc->vc_font.width) [1] // overflow! ccw_putcs_aligned // old buf size is still being used during the read! src = par->rotated.buf + (scr_readw(s--) & charmask) * cellsize fb_pad_aligned_buffer----[src KASAN!!!] [2] info->fbops->fb_imageblit(info, image) sys_imageblit fb_imageblit fb_address_forward // offset: image->dy * bits_per_line + image->dx * bpp unsigned int bits = (unsigned int)adr->bits + offset adr->address += (bits & ~(BITS_PER_LONG - 1u)) / BITS_PER_BYTE [3] fb_bitmap_imageblit ... fb_read_offset // page fault! [4] update_screen redraw_screen ... ccw_cursor soft_cursor memcpy(src, image->data, dsize)----[src KASAN again!!!] [5] fbcon_switch fbcon_rotate_font font_data_rotate dst = kmalloc_array(charcount, d_cellsize, GFP_KERNEL) // the new size is allocated only here! par->rotated.buf = buf [6] [FIX] A fairly obvious approach is to follow fbcon_switch(): in fbcon_modechanged(), call rotate_font() before vc_resize() so that a correctly sized buffer is allocated in time, as done in [6]. This fix is necessary, but it is not sufficient on its own. In [1] it causes an image.dy overflow (ccw_putcs: vyres = 768, image.dy = 4294967040), because vc_cols has not been updated in time at this point (it is likewise only updated after clear_selection()). This allows (xx + count) * width to exceed vyres, causing image.dy to overflow. Subsequently, address in [3] is incremented by an even larger amount, which triggers a page fault at [4]. Therefore, a second fix is required in combination with the first: move clear_selection() earlier, before set_blitting_type() in fbcon_set_all_vcs(), to prevent the out-of-bounds access. fbcon_rotate() has a similar problem, so add the same clear there. Since vc_is_sel() is not exported, the fbdev side is currently forced to call clear_selection() unconditionally, causing the global selection to be cleared prematurely. And this will not cause any other significant impact. Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Signed-off-by: Helge Deller <deller@gmx.de> |