Commit graph

1,461,726 commits

Author SHA1 Message Date
Antoniu Miclaus
dd72e6c3cd iio: light: bh1780: fix PM runtime leak on error path
Move pm_runtime_put_autosuspend() before the error check to ensure
the PM runtime reference count is always decremented after
pm_runtime_get_sync(), regardless of whether the read operation
succeeds or fails.

Fixes: 1f0477f183 ("iio: light: new driver for the ROHM BH1780")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:37 +00:00
Jean-Baptiste Maneyrol
ffd32db826 iio: imu: inv_icm42600: fix odr switch when turning buffer off
ODR switch is done in 2 steps when FIFO is on : change the ODR register
value and acknowledge change when reading the FIFO ODR change flag.
When we are switching odr and turning buffer off just afterward, we are
losing the FIFO ODR change flag and ODR switch is blocked.

Fix the issue by force applying any waiting ODR change when turning
buffer off.

Fixes: ec74ae9fd3 ("iio: imu: inv_icm42600: add accurate timestamping")
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:37 +00:00
Jean-Baptiste Maneyrol
c9f3a59313 iio: imu: inv_icm42600: fix odr switch to the same value
ODR switch is done in 2 steps when FIFO is on : change the ODR register
value and acknowledge change when reading the FIFO ODR change flag.
When we are switching to the same odr value, we end up waiting for a
FIFO ODR flag that is never happening.

Fix the issue by doing nothing and exiting properly when we are
switching to the same ODR value.

Fixes: ec74ae9fd3 ("iio: imu: inv_icm42600: add accurate timestamping")
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:37 +00:00
Marek Szyprowski
243307a0d1 wifi: brcmfmac: Fix potential kernel oops when probe fails
When probe of the sdio brcmfmac device fails for some reasons (i.e.
missing firmware), the sdiodev->bus is set to error instead of NULL, thus
the cleanup later in brcmf_sdio_remove() tries to free resources via
invalid bus pointer. This happens because sdiodev->bus is set 2 times:
first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix
this by chaning the brcmf_sdio_probe() function to return the error code
and set sdio->bus only there.

Fixes: 0ff0843310 ("wifi: brcmfmac: Add optional lpo clock enable support")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Arend van Spriel<arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260203102133.1478331-1-m.szyprowski@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-02-23 09:24:30 +01:00
Gabriel Almeida
08eea726f4 iio: light: zopt2201: use lock guards
Use guard() and scoped_guard() to handle the mutex lock instead of
manually locking and unlocking it.

Signed-off-by: Gabriel Almeida <gabrielsousa230@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Gabriel Almeida
f808d21ef7 iio: light: zopt2201: Reorder header includes
Reorder the header includes to follow the usual kernel ordering
conventions and improve readability.

Signed-off-by: Gabriel Almeida <gabrielsousa230@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Pranav Kharche
1261aea929 dt-bindings: iio: dac: Fix typo in ti,dac7612.yaml
Fix a typo in the description where "Is is" should be "It is".

Signed-off-by: Pranav Kharche <pranavkharche7@gmail.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Antoniu Miclaus
419a96f824 iio: adc: ad4080: add support for AD4082, AD4085 and AD4088
Add support for the AD4082, AD4085 and AD4088 SAR ADCs. These devices
share the same resolution as their base variants but differ in LVDS CNV
clock count maximum:
  - AD4082 (20-bit, like AD4080): lvds_cnv_clk_cnt_max 8 vs 7
  - AD4085 (16-bit, like AD4084): lvds_cnv_clk_cnt_max 8 vs 2
  - AD4088 (14-bit, like AD4087): lvds_cnv_clk_cnt_max 8 vs 1

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Antoniu Miclaus
6cfb965afe dt-bindings: iio: adc: adi,ad4080: add support for AD4082, AD4085 and AD4088
Add device tree binding support for AD4082, AD4085 and AD4088 SAR ADCs.
Add adi,ad4082, adi,ad4085 and adi,ad4088 to the compatible enum.

A fallback compatible string is not appropriate for these devices as they
differ in LVDS CNV clock count maximum from their base variants:
  - AD4082 (20-bit) vs AD4080: lvds_cnv_clk_cnt_max 8 vs 7
  - AD4085 (16-bit) vs AD4084: lvds_cnv_clk_cnt_max 8 vs 2
  - AD4088 (14-bit) vs AD4087: lvds_cnv_clk_cnt_max 8 vs 1

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Marcelo Schmitt
a10f6dd4ee iio: adc: ad4030: Use BIT macro to improve code readability
Use BIT macro to make the list of average modes more readable.

Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Marcelo Schmitt
3477334682 dt-bindings: iio: adc: adi,ad4030: Reference spi-peripheral-props
AD4030 and similar devices all connect to the system as SPI peripherals.
Reference spi-peripheral-props so common SPI peripheral can be used from
ad4030 dt-binding.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Antoniu Miclaus
65d887ff21 iio: dac: max5522: simplify probe with devm_regulator_get_enable_read_voltage()
Simplify probe by using devm_regulator_get_enable_read_voltage() to
get, enable and read the regulator voltage in a single call, caching
the value at probe time.

The reference voltage for this DAC is a fixed hardware configuration
that is not expected to change at runtime, so reading it once during
probe and caching the millivolt value is sufficient.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:24 +00:00
Antoniu Miclaus
93f60f6721 iio: magnetometer: si7210: simplify probe with devm_regulator_get_enable_read_voltage()
Simplify probe by using devm_regulator_get_enable_read_voltage() to
get, enable and read the regulator voltage in a single call, caching
the value at probe time.

This is a functional change as VDD voltage is now read once at probe
rather than dynamically on each temperature measurement. However, in
real deployments it is very rare for VDD to change after initial probe.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
Andy Shevchenko
0309e66abe iio: adc: ad7192: Revert "properly check spi_get_device_match_data()"
This reverts commit b7f99fa1b6.

The added code is currently a dead code. Moreover, the driver is not
designed to have any defaults effectively making driver data a mandatory
information to work with. Taking all together, revert unneeded change.

Discussion at #1 concluded in agreeing a new policy on this for IIO.

Link: https://lore.kernel.org/linux-iio/20260217080514.1288115-1-andriy.shevchenko@linux.intel.com/ #1
Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
Harshit Mogalapalli
d6ae9f202f iio: sca3000: simplify with spi_get_device_match_data()
Refactor each sca3000 variant with it's own chip_info struct, update the
sca3000_probe() to use spi_get_device_match_data().

Suggested-by: David Lechner <dlechner@baylibre.com>
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
Neel Bullywon
094d5d37d3 iio: magnetometer: bmc150_magn: minor formatting cleanup
Improve initializer list style for bmc150_magn_samp_freq_table by
moving the opening brace to its own line and using one entry per line
with proper indentation and spaces inside braces.

Add spaces inside braces for initializer lists in the preset table
for consistency.

Fix indentation of bmc150_magn_scan_masks array. No functional changes.

Signed-off-by: Neel Bullywon <neelb2403@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
Neel Bullywon
d1fa7b316b iio: magnetometer: bmc150_magn: replace msleep with fsleep
Replace msleep(5) with fsleep(5 * USEC_PER_MSEC) to allow the kernel
to select the most appropriate delay mechanism based on duration.
Using USEC_PER_MSEC makes the unit conversion explicit.

Signed-off-by: Neel Bullywon <neelb2403@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
Erikas Bitovtas
e3310a32e0 iio: light: vcnl4000: add support for Capella CM36686 and CM36672P
Add support for Capella's CM36686 and CM36672P sensors. Capella
CM36686 is an ambient light and proximity sensor that is fully
compatible with VCNL4040 and can be used as is.
CM36672P is partially compatible with VCNL4040 - it uses the same
register fields for proximity sensing, but the ambient light registers
are reserved. For CM36672P, we reuse vcnl4040_channels, but remove the
IIO_LIGHT channel and ambient light integration time.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Erikas Bitovtas <xerikasxx@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
Erikas Bitovtas
f48bfc823c dt-bindings: iio: light: vcnl4000: add Capella CM36686 and CM36672P
Capella CM36686 is an ambient light and proximity sensor developed by
Capella Microsystems, now a subsidiary of Vishay Intertechnology Inc. It
has an I2C address of 0x60 and is fully compatible with an existing
driver for VCNL4040. Capella CM36672P is a proximity-only sensor that
is partially compatible with CM36686 - they share the same register
fields for proximity sensing, but ambient light sensor register fields
in CM36672P are reserved. Add compatibles for cm36672p and cm36686,
with a fallback for cm36686 of vcnl4040.

Signed-off-by: Erikas Bitovtas <xerikasxx@gmail.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
David Lechner
196c9df178 iio: adc: ad7380: add support for multiple SPI lanes
Add support for multiple SPI lanes to increase throughput. The AD7380
family of ADCs have multiple SDO lines on the chip that can be used to
read each channel on a separate SPI lane. If wired up to a SPI
controller that supports it, the driver will now take advantage of this
feature. This allows reaching the maximum sample rate advertised in the
datasheet when combined with SPI offloading.

Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Marcelo Schmitt <marcelo.schmitt@analog.com>
Signed-off-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
David Lechner
63670c90f0 dt-bindings: iio: adc: adi,ad7380: add spi-rx-bus-width property
Add spi-rx-bus-width property to describe how many SDO lines are wired
up on the ADC. These chips are simultaneous sampling ADCs and have one
SDO line per channel, either 2 or 4 total depending on the part number.

Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:23 +00:00
Ethan Tidmore
5cf5654b19 iio: adc: ad4062: Add missing IS_ERR() check
In the function ad4062_sizeof_storagebits() iio_get_current_scan_type()
is called which can return an error pointer and is not checked for it.
Also the function ad4062_sizeof_storagebits() returns type size_t but,
is only used once and the variable assigned from it is type u8.

Add check for error pointer in ad4062_sizeof_storagebits() and change
return type to int so the error code can be properly propagated and then
checked.

Fixes: 23cc922803 ("iio: adc: ad4062: Add IIO Trigger support")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202512280539.AholFF7m-lkp@intel.com/
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Reviewed-by: Jorge Marques <jorge.marques@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Antoniu Miclaus
bc2cb23607 iio: frequency: adf4350: Return -ENOMEM on memory allocation failure
adf4350_parse_dt() returns NULL only when devm_kzalloc() fails. The
caller should return -ENOMEM in this case, not -EINVAL.

Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Antoniu Miclaus
25ac1dea21 iio: adc: pac1934: Return -ENOMEM on memory allocation failure
devm_kzalloc() returns NULL on allocation failure. The appropriate error
code for this condition is -ENOMEM, not -EINVAL.

Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Yasin Lee
8e901c49ff iio: proximity: hx9023s: support firmware-name property
Add an optional firmware-name property to specify the firmware file.
If not provided, the driver falls back to the default firmware name.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Yasin Lee <yasin.lee.x@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Yasin Lee
577fe2fdd4 dt-bindings: iio: proximity: hx9023s: support firmware-name property
The hx9023s requires a firmware blob containing board-specific
configuration data used to initialize its internal sensing engine.

Although the silicon is identical across platforms, different products
may use different electrode layouts, PCB routing, cover materials and
mechanical stack-ups. These physical differences require distinct
calibration parameters and register configuration tables in order for
the sensor to operate correctly.

The driver has always required firmware and historically assumed a
single default firmware file name suitable for the reference design.
However, this assumption does not hold for boards with different
physical sensor layouts.

The default firmware file name remains unchanged and continues to be
used for existing platforms. Allowing the firmware file name to be
specified via device tree enables selecting the appropriate
hardware-specific configuration when the board design differs.

This property does not change the existing ABI and is optional.

Signed-off-by: Yasin Lee <yasin.lee.x@gmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Tomas Melin
2e47110413 iio: adc: ad9467: check for backend capabilities
Add capability checks for operation with backends that do not necessarily
support full set of features, but are otherwise compatible with the device.
This ensures a fully functional device, but with limited capabilities.

Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Tomas Melin
89443dc784 iio: adc: ad9467: simplify device pointer in probe
Create alias for the device pointer to simplify referencing
and keeping syntax and column width shorter.

Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Tomas Melin
519ecb5f10 iio: adc: sd_adc_modulator: define supported iio-backend capabilities
This backend supports the added CAP_ENABLE capability.

Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:22 +00:00
Tomas Melin
9db3e8ddca iio: dac: adi-axi-dac: define supported iio-backend capabilities
Backends support the buffer/enable capabilities so advertise it
while registering in case a frontend makes checks for it.

Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:21 +00:00
Tomas Melin
ed3be723b0 iio: adc: adi-axi-adc: define supported iio-backend capabilities
axi-adc and axi-ad485x backend variants provide calibration support,
whereas the axi-ad408x does not. Set accordingly.

Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:21 +00:00
Tomas Melin
88440208c6 iio: industrialio-backend: support backend capabilities
Not all backends support the full set of capabilities provided by the
industrialio-backend framework. Capability bits can be used in frontends
and backends for checking for a certain feature set, or if using
related functions can be expected to fail.

Capability bits should be set by a compatible backend and provided when
registering the backend.

Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-02-23 08:24:21 +00:00
Johannes Berg
c854758abe wifi: radiotap: reject radiotap with unknown bits
The radiotap parser is currently only used with the radiotap
namespace (not with vendor namespaces), but if the undefined
field 18 is used, the alignment/size is unknown as well. In
this case, iterator->_next_ns_data isn't initialized (it's
only set for skipping vendor namespaces), and syzbot points
out that we later compare against this uninitialized value.

Fix this by moving the rejection of unknown radiotap fields
down to after the in-namespace lookup, so it will really use
iterator->_next_ns_data only for vendor namespaces, even in
case undefined fields are present.

Cc: stable@vger.kernel.org
Fixes: 33e5a2f776 ("wireless: update radiotap parser")
Reported-by: syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/69944a91.a70a0220.2c38d7.00fc.GAE@google.com
Link: https://patch.msgid.link/20260217120526.162647-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-02-23 09:23:44 +01:00
Daniil Dulov
767d23ade7 wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
There is a use-after-free error in cfg80211_shutdown_all_interfaces found
by syzkaller:

BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220
Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326
CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: events cfg80211_rfkill_block_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x116/0x1f0
 print_report+0xcd/0x630
 kasan_report+0xe0/0x110
 cfg80211_shutdown_all_interfaces+0x213/0x220
 cfg80211_rfkill_block_work+0x1e/0x30
 process_one_work+0x9cf/0x1b70
 worker_thread+0x6c8/0xf10
 kthread+0x3c5/0x780
 ret_from_fork+0x56d/0x700
 ret_from_fork_asm+0x1a/0x30
 </TASK>

The problem arises due to the rfkill_block work is not cancelled when wiphy
is being unregistered. In order to fix the issue cancel the corresponding
work in wiphy_unregister().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 1f87f7d3a3 ("cfg80211: add rfkill support")
Cc: stable@vger.kernel.org
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Link: https://patch.msgid.link/20260211082024.1967588-1-d.dulov@aladdin.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-02-23 09:21:55 +01:00
Johannes Berg
c8d7f21ead wifi: cfg80211: wext: fix IGTK key ID off-by-one
The IGTK key ID must be 4 or 5, but the code checks against
key ID + 1, so must check against 5/6 rather than 4/5. Fix
that.

Reported-by: Jouni Malinen <j@w1.fi>
Fixes: 08645126dd ("cfg80211: implement wext key handling")
Link: https://patch.msgid.link/20260209181220.362205-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-02-23 09:18:59 +01:00
Gwendal Grignou
286386820d platform/chrome: lightbar: Optimize command size
Enabling tracing with:
echo 1 > /sys/kernel/debug/tracing/events/cros_ec/cros_ec_request_start/enable

To monitor the command and response size. The defaults are 194 and 128 respectively:
cros_ec_request_start: version: 0, offset: 0, command: EC_CMD_LIGHTBAR_CMD, outsize: 194, insize: 128

Reduce the sizes to the expected subcommands.

Signed-off-by: Gwendal Grignou <gwendal@google.com>
Link: https://lore.kernel.org/r/20260204035036.697955-1-gwendal@google.com
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-02-23 15:34:17 +08:00
Stian Halseth
d5b5e8149a sparc: Fix page alignment in dma mapping
'phys' may include an offset within the page, while previously used
'base_paddr' was already page-aligned. This caused incorrect DMA mapping
in dma_4u_map_phys and dma_4v_map_phys.

Fix both functions by masking 'phys' with IO_PAGE_MASK, covering both
generic SPARC code and sun4v.

Fixes: 38c0d0ebf5 ("sparc: Use physical address DMA mapping")
Reported-by: Stian Halseth <stian@itx.no>
Closes: https://github.com/sparclinux/issues/issues/75
Suggested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Stian Halseth <stian@itx.no>
Tested-by: Nathaniel Roach <nroach44@nroach44.id.au>
Tested-by: Han Gao <gaohan@iscas.ac.cn> # on SPARC Enterprise T5220
[mszyprow: adjusted commit description a bit]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260218120056.3366-2-stian@itx.no
2026-02-23 08:33:51 +01:00
Jiri Pirko
47322c469d dma-mapping: avoid random addr value print out on error path
dma_addr is unitialized in dma_direct_map_phys() when swiotlb is forced
and DMA_ATTR_MMIO is set which leads to random value print out in
warning. Fix that by just returning DMA_MAPPING_ERROR.

Fixes: e53d29f957 ("dma-mapping: convert dma_direct_*map_page to be phys_addr_t based")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260209153809.250835-2-jiri@resnulli.us
2026-02-23 08:26:54 +01:00
Randy Dunlap
8167d7f674 soundwire: sdw.h: repair names and format of kernel-doc comments
Fix all kernel-doc warnings in sdw.h:

Warning: include/linux/soundwire/sdw.h:538 cannot understand function prototype: 'enum sdw_reg_bank'
Warning: include/linux/soundwire/sdw.h:779 struct member 'port_num' not described in 'sdw_transport_params'
Warning: include/linux/soundwire/sdw.h:792 struct member 'port_num' not described in 'sdw_enable_ch'
Warning: include/linux/soundwire/sdw.h:892 cannot understand function prototype: 'struct sdw_port_config'
Warning: include/linux/soundwire/sdw.h:906 cannot understand function prototype: 'struct sdw_stream_config'
Warning: include/linux/soundwire/sdw.h:925 cannot understand function prototype: 'enum sdw_stream_state'
Warning: include/linux/soundwire/sdw.h:942 cannot understand function prototype: 'struct sdw_stream_params'
Warning: include/linux/soundwire/sdw.h:960 cannot understand function prototype: 'struct sdw_stream_runtime'
Warning: include/linux/soundwire/sdw.h:1047 struct member 'bpt_stream_refcount' not described in 'sdw_bus'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260216054418.2766846-1-rdunlap@infradead.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-02-23 12:42:45 +05:30
Sanjay Yadav
df8c7892e0 drm/buddy: Move internal helpers to buddy.c
Move gpu_buddy_block_state(), gpu_buddy_block_is_allocated(),
and gpu_buddy_block_is_split() from gpu_buddy.h to gpu_buddy.c
as static functions since they have no external callers.

Remove gpu_get_buddy() as it was an unused exported wrapper
around the internal __get_buddy().

No functional changes.

v2:
- Rebased after DRM buddy allocator moved to drivers/gpu/
- Keep gpu_buddy_block_is_free() in header since it's now
  used by drm_buddy.c
- Updated commit message

Cc: Christian König <christian.koenig@amd.com>
Cc: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Suggested-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Link: https://patch.msgid.link/20260212092527.718455-6-sanjay.kumar.yadav@intel.com
2026-02-23 12:21:05 +05:30
Sanjay Yadav
5cab6d386b drm/buddy: Add kernel-doc for allocator structures and flags
Add missing kernel-doc for GPU buddy allocator flags,
gpu_buddy_block, and gpu_buddy. The documentation covers block
header fields, allocator roots, free trees, and allocation flags
such as RANGE, TOPDOWN, CONTIGUOUS, CLEAR, and TRIM_DISABLE.
Private members are marked with kernel-doc private markers
and documented with regular comments.

No functional changes.

v2:
- Corrected GPU_BUDDY_CLEAR_TREE and GPU_BUDDY_DIRTY_TREE index
  values (Arun)
- Rebased after DRM buddy allocator moved to drivers/gpu/
- Updated commit message

v3:
- Document reserved bits 8:6 in header layout (Arun)
- Fix checkpatch warning

Cc: Christian König <christian.koenig@amd.com>
Cc: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Suggested-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Link: https://patch.msgid.link/20260212092527.718455-5-sanjay.kumar.yadav@intel.com
2026-02-23 12:20:34 +05:30
Viresh Kumar
3d2398f44a OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp()
The commit ff9c512041 ("OPP: Use mutex locking guards")
unintentionally made the for loop run longer than required.

scoped_guard() is implemented as a for loop. The break statement now
breaks out out the scoped_guard() and not out of the outer for loop.
The outer loop always iterates to completion.

Fix it.

Fixes: ff9c512041 ("OPP: Use mutex locking guards")
Reported-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-02-23 11:05:59 +05:30
Manivannan Sadhasivam
e560083c04 OPP: debugfs: Use performance level if available to distinguish between rates
Some OPP tables have entries with same rate and different performance
level. For these entries, using only the rate as the debugfs directory name
causes below error:

debugfs: 'opp:5000000' already exists in 'soc@0-1c00000.pci'

Fix it by appending the performance level to the dir name if available.

Reported-by: Bjorn Andersson <andersson@kernel.org>
Closes: https://lore.kernel.org/linux-arm-msm/75lzykd37zdvrks5i2bb4zb2yzjtm25kv3hegmikndkbr772mz@w2ykff3ny45u/
Fixes: 05db35963e ("OPP: Add support to find OPP for a set of keys")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-02-23 10:25:46 +05:30
Thorsten Blum
de71627594 Input: adxl34x - drop redundant error variable in adxl34x_i2c_probe
Inline i2c_check_functionality(), which really returns a bool and not an
error code, and remove the local variable.  No functional changes.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260223000308.319335-1-thorsten.blum@linux.dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-02-22 19:52:22 -08:00
Nicholas Carlini
6b4f875aac ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value
from sp->max_recv_size and req->preferred_send_size to a signed
int before computing min_t(int, ...). A maliciously provided
preferred_send_size of 0x80000000 will return as smaller than
max_recv_size, and then be used to set the maximum allowed
alowed receive size for the next message.

By sending a second message with a large value (>1420 bytes)
the attacker can then achieve a heap buffer overflow.

This fix replaces min_t(int, ...) with min_t(u32)

Fixes: 0626e6641f ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Nicholas Carlini <nicholas@carlini.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-22 21:27:33 -06:00
Eric Biggers
c5794709bc ksmbd: Compare MACs in constant time
To prevent timing attacks, MAC comparisons need to be constant-time.
Replace the memcmp() with the correct function, crypto_memneq().

Fixes: e2f34481b2 ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-22 21:27:28 -06:00
Dirk Chen
76b4ec8efd ARM: dts: aspeed: anacapa: Add retimer EEPROMs
The Anacapa board features Atmel 24C2048 EEPROMs on i2c0 and i2c1, which
are used to store retimer configurations. Add the corresponding device
tree nodes to support these components.

Signed-off-by: Dirk Chen <dirkchen@amd.com>
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-02-23 12:02:22 +10:30
Andy Shevchenko
c2bcf62ca7
regcache: Split regcache_count_cacheable_registers() helper
The introduced helper allows to check for the non-cacheable configurations
earlier during initialisation.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260210161058.53093-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-02-22 23:54:25 +00:00
Andy Shevchenko
1fcf171178
regcache: Remove duplicate check in regcache_hw_init()
The regcache_hw_init() is never called without preliminary check
for num_reg_defaults_raw not being 0. Thus, remove duplicate in
the function.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260210161058.53093-2-andriy.shevchenko@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-02-22 23:54:23 +00:00
Danilo Krummrich
bfcaf4e8ae rust: io: macro_export io_define_read!() and io_define_write!()
Currently, the define_read!() and define_write!() I/O macros are crate
public. The only user outside of the I/O module is PCI (for the
configurations space I/O backend). Consequently, when CONFIG_PCI=n this
causes a compile time warning [1].

In order to fix this, rename the macros to io_define_read!() and
io_define_write!() and use #[macro_export] to export them.

This is better than making the crate public visibility conditional, as
eventually subsystems will have their own crate.

Also, I/O backends are valid to be implemented by drivers as well. For
instance, there are devices (such as GPUs) that run firmware which
allows to program other devices only accessible through the primary
device through indirect I/O.

Since the macros are now public, also add the corresponding
documentation.

Fixes: 121d87b28e ("rust: io: separate generic I/O helpers from MMIO implementation")
Reported-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Closes: https://lore.kernel.org/driver-core/CANiq72khOYkt6t5zwMvSiyZvWWHMZuNCMERXu=7K=_5tT-8Pgg@mail.gmail.com/ [1]
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Link: https://patch.msgid.link/20260216131534.65008-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-02-23 00:54:02 +01:00