summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-05-19arm64: sysreg: Add layout for VNCR_EL2Marc Zyngier
Now that we're about to emulate VNCR_EL2, we need its full layout. Add it to the sysreg file. Reviewed-by: Oliver Upton <oliver.upton@linux.dev> Link: https://lore.kernel.org/r/20250514103501.2225951-2-maz@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-19crypto: ccp - Add missing tee info reg for teev2Mario Limonciello
The tee info reg for teev2 is the same as teev1. Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ccp - Add missing bootloader info reg for pspv5Mario Limonciello
The bootloader info reg for pspv5 is the same as pspv4. Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: sun8i-ce - move fallback ahash_request to the end of the structOvidiu Panait
'struct ahash_request' has a flexible array at the end, so it must be the last member in a struct, to avoid overwriting other struct members. Therefore, move 'fallback_req' to the end of the 'sun8i_ce_hash_reqctx' struct. Fixes: 56f6d5aee88d ("crypto: sun8i-ce - support hash algorithms") Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: octeontx2 - Use dynamic allocated memory region for lmtstBharat Bhushan
Current driver uses static LMTST region allocated by firmware. Firmware allocated memory for LMTST is available in PF/VF BAR2. Using this memory have performance impact as this is mapped as device memory. There is another option to allocate contiguous memory at run time and map this in LMT MAP table with the help of AF driver. With this patch dynamic allocated memory is used for LMTST. Also add myself as maintainer for crypto octeontx2 driver Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: octeontx2 - Initialize cptlfs device info onceBharat Bhushan
Function otx2_cptlf_set_dev_info() initializes common fields of cptlfs data-struct. This function is called every time a cptlf is initialized but this needs be done once for a cptlf block. So this initialization is moved to early device probe code to avoid redundant initialization. Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: xts - Only add ecb if it is not already thereHerbert Xu
Only add ecb to the cipher name if it isn't already ecb. Also use memcmp instead of strncmp since these strings are all stored in an array of length CRYPTO_MAX_ALG_NAME. Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: lrw - Only add ecb if it is not already thereHerbert Xu
Only add ecb to the cipher name if it isn't already ecb. Also use memcmp instead of strncmp since these strings are all stored in an array of length CRYPTO_MAX_ALG_NAME. Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher") Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202505151503.d8a6cf10-lkp@intel.com Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: testmgr - Add hash export format testingHerbert Xu
Ensure that the hash state can be exported to and imported from the generic algorithm. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: testmgr - Use ahash for generic tfmHerbert Xu
As shash is being phased out, use ahash for the generic tfm. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hmac - Add ahash supportHerbert Xu
Add ahash support to hmac so that drivers that can't do hmac in hardware do not have to implement duplicate copies of hmac. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: testmgr - Ignore EEXIST on shash allocationHerbert Xu
Soon hmac will support ahash. For compatibility hmac still supports shash so it is possible for two hmac algorithms to be registered at the same time. The shash algorithm will have the driver name "hmac-shash(XXX-driver)". Due to a quirk in the API, there is no way to locate the shash algorithm using the name "hmac(XXX-driver)". It has to be addressed as either "hmac(XXX)" or "hmac-shash(XXX-driver)". Looking it up with "hmac(XXX-driver)" will simply trigger the creation of another instance, and on the second instantiation this will fail with EEXIST. Catch the error EEXIST along with ENOENT since it is expected. If a real shash algorithm came this way, it would be addressed using the proper name "hmac-shash(XXX-driver)". Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: algapi - Add driver template support to crypto_inst_setnameHerbert Xu
Add support to crypto_inst_setname for having a driver template name that differs from the algorithm template name. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: shash - Set reqsize in shash_algHerbert Xu
Make reqsize static for shash algorithms. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hmac - Add export_core and import_coreHerbert Xu
Add export_import and import_core so that hmac can be used as a fallback by block-only drivers. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hmac - Zero shash desc in setkeyHerbert Xu
The shash desc needs to be zeroed after use in setkey as it is not finalised (finalisation automatically zeroes it). Also remove the final function as it's been superseded by finup. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ahash - Handle partial blocks in APIHerbert Xu
Provide an option to handle the partial blocks in the ahash API. Almost every hash algorithm has a block size and are only able to hash partial blocks on finalisation. As a first step disable virtual address support for algorithms with state sizes larger than HASH_MAX_STATESIZE. This is OK as virtual addresses are currently only used on synchronous fallbacks. This means ahash_do_req_chain only needs to handle synchronous fallbacks, removing the complexities of saving the request state. Also move the saved request state into the ahash_request object as nesting is no longer possible. Add a scatterlist to ahash_request to store the partial block. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hash - Add export_core and import_core hooksHerbert Xu
Add export_core and import_core hooks. These are intended to be used by algorithms which are wrappers around block-only algorithms, but are not themselves block-only, e.g., hmac. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hash - Move core export and import into internel/hash.hHerbert Xu
The core export and import functions are targeted at implementors so move them into internal/hash.h. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert Marvell CESA to DT schemaRob Herring (Arm)
Convert the Marvell CESA binding to DT schema format. The marvell-cesa.txt and mv_cesa.txt are duplicate bindings. The clock properties are quite varied for each platform hence the if/then schemas. The old binding was fairly accurate with reality. The original binding didn't mention there is 1 interrupt per CESA engine. Based on users, there's a maximum of 2 engines. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert img,hash-accelerator to DT schemaRob Herring (Arm)
Convert the Imagination Technologies hardware hash accelerator binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert hisilicon,hip0{6,7}-sec to DT schemaRob Herring (Arm)
Convert the HiSilicon HIP06/7 Security Accelerator binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert brcm,spum-crypto to DT schemaRob Herring (Arm)
Convert the Broadcom SPUM/SPU2 binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert axis,artpec6-crypto to DT schemaRob Herring (Arm)
Convert the Axis Crypto engine binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert amd,ccp-seattle-v1a to DT schemaRob Herring (Arm)
Convert the AMD Cryptographic Coprocessor binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Drop obsolete mediatek,eip97-cryptoRob Herring (Arm)
The mediatek,eip97-crypto binding is half abandoned. The driver was dropped in 2020 as the Mediatek platforms use InsideSecure block and the driver for it. All the platforms except MT7623 were updated. A patch to update it was submitted, but never addressed the review comments. Link: https://lore.kernel.org/all/20210303080923.16761-1-vic.wu@mediatek.com/ Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: fsl,sec-v4.0: Add fsl,sec-v6.0Rob Herring (Arm)
The fsl,sec-v6.0 binding is the same as the fsl,sec-v4.0 binding, so add it to the existing schema and drop the old .txt binding. The compatibles in the .txt binding don't match the 1 user. Follow the user for the schema. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: qat - enable reporting of error counters for GEN6 devicesSuman Kumar Chakraborty
Enable the reporting of error counters through sysfs for QAT GEN6 devices and update the ABI documentation. This enables the reporting of the following: - errors_correctable - hardware correctable errors that allow the system to recover without data loss. - errors_nonfatal: errors that can be isolated to specific in-flight requests. - errors_fatal: errors that cannot be contained to a request, requiring a Function Level Reset (FLR) upon occurrence. Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: qat - enable RAS support for GEN6 devicesSuman Kumar Chakraborty
Enable the reporting and handling of errors for QAT GEN6 devices. Errors are categorized as correctable, non-fatal, or fatal. Error handling involves reading the error source registers (ERRSOU0 to ERRSOU3) to determine the source of the error and then decoding the actual source reading specific registers. The action taken depends on the error type: - Correctable and Non-Fatal errors. These error are logged, cleared and the corresponding counter is incremented. - Fatal errors. These errors are logged, cleared and a Function Level Reset (FLR) is scheduled. This reports and handles the following errors: - Accelerator engine (AE) correctable errors - Accelerator engine (AE) uncorrectable errors - Chassis push-pull (CPP) errors - Host interface (HI) parity errors - Internal memory parity errors - Receive interface (RI) errors - Transmit interface (TI) errors - Interface for system-on-chip (SoC) fabric (IOSF) primary command parity errors - Shared RAM and slice module (SSM) errors Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ccp - Add support for PCI device 0x17D8John Allen
Add a new CCP/PSP PCI device ID. Signed-off-by: John Allen <john.allen@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: algif_hash - fix double free in hash_acceptIvan Pravdin
If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable@vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19padata: do not leak refcount in reorder_workDominik Grzegorzek
A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 Fixes: dd7d37ccf6b1 ("padata: avoid UAF for reorder_work") Cc: <stable@vger.kernel.org> Signed-off-by: Dominik Grzegorzek <dominik.grzegorzek@oracle.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-18bcachefs: fix extent_has_stripe_ptr()Kent Overstreet
This wasn't checking indirect extents. Fixes: https://github.com/koverstreet/bcachefs/issues/887 Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-05-19Merge tag 'drm-msm-next-2025-05-16' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/msm into drm-next Updates for v6.16 CI: - uprev mesa GPU: - ACD (Adaptive Clock Distribution) support for X1-85. This is required enable the higher frequencies. - Drop fictional `address_space_size`. For some older devices, the address space size is limited to 4GB to avoid potential 64b rollover math problems in the fw. For these, an `ADRENO_QUIRK_4GB_VA` quirk is added. For everyone else we get the address space size from the SMMU `ias` (input address sizes), which is usually 48b. - Improve robustness when GMU HFI responses time out - Fix crash when throttling GPU immediately during boot - Fix for rgb565_predicator on Adreno 7c3 - Remove `MODULE_FIRMWARE()`s for GPU, the GPU can load the firmware after probe and having partial set of fw (ie. sqe+gmu but not zap) causes problems MDSS: - Added SAR2130P support to MDSS driver DPU: - Changed to use single CTL path for flushing on DPU 5.x+ - Improved SSPP allocation code to allow sharing of SSPP between planes - Enabled SmartDMA on SM8150, SC8180X, SC8280XP, SM8550 - Added SAR2130P support - Disabled DSC support on MSM8937, MSM8917, MSM8953, SDM660 - Misc fixes DP: - Switch to use new helpers for DP Audio / HDMI codec handling - Fixed LTTPR handling DSI: - Added support for SA8775P - Added SAR2130P support MDP4: - Fixed LCDC / LVDS controller on HDMI: - Switched to use new helpers for ACR data - Fixed old standing issue of HPD not working in some cases Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rob Clark <robdclark@gmail.com> Link: https://lore.kernel.org/r/CAF6AEGv2Go+nseaEwRgeZbecet-h+Pf2oBKw1CobCF01xu2XVg@mail.gmail.com
2025-05-19Merge tag 'amd-drm-next-6.16-2025-05-16' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-next amdgpu: - Misc code cleanups - UserQ fixes - MALL reporting fix - DP AUX fixes - DCN 3.5 fixes - DP MST fixes - DC DMI quirks cleanup - RAS fixes - SR-IOV updates - GC 9.5 updates - Misc display fixes - VCN 4.0.5 powergating race fix - SMU 13.x updates - Paritioning fixes - VCN 5.0.1 SR-IOV updates - JPEG 5.0.1 SR-IOV updates amdkfd: - Fix spurious warning in interrupt code - XNACK fixes radeon: - CIK doorbell cleanup Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/r/20250516204609.2437472-1-alexander.deucher@amd.com
2025-05-19m68k: Replace memcpy() + manual NUL-termination with strscpy()Thorsten Blum
Use strscpy() to safely copy the command-line string instead of memcpy() followed by a manual NUL-termination. The source string is also NUL-terminated and meets the __must_be_cstr() requirement of strscpy(). No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2025-05-19m68k/kernel: replace strncpy() with strscpy()Mohammad Mahdi Anbaraki
Swapped out strncpy() for strscpy() in parse_uboot_commandline() while copying to commandp. strscpy() makes sure the string is properly null- terminated and gives a more useful return value so it's just a safer choice overall. Link: https://github.com/KSPP/linux/issues/90 Signed-off-by: Mohammad Mahdi Anbaraki <m.mahdianbaraki@gmail.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2025-05-19m68k: coldfire: gpio: use new line value setter callbacksBartosz Golaszewski
struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2025-05-19riscv: dts: sophgo: switch precise compatible for existed clock device for ↵Inochi Amaoto
CV18XX replace newly added precise compatible with old one for existed clock device of CV18XX series SoCs. Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Link: https://lore.kernel.org/r/20250504104553.1447819-4-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19riscv: dts: sophgo: Add initial device tree of Sophgo SRD3-10Inochi Amaoto
Sophgo SG2044 SRD3-10 board bases on Sophgo SG2044 SoC. This board includes 5 uart ports, 5 pcie x8 slots, 1 1G Ethernet port, 1 microSD slot. Add initial device tree of this board with uart support. Link: https://lore.kernel.org/r/20250413223507.46480-11-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19dt-bindings: riscv: sophgo: Add SG2044 compatible stringInochi Amaoto
Add compatible string for the Sophgo SG2044 SoC and the SRD3-10 board. Acked-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Chen Wang <unicorn_wang@outlook.com> Link: https://lore.kernel.org/r/20250413223507.46480-10-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19dt-bindings: interrupt-controller: Add Sophgo SG2044 PLICInochi Amaoto
The SG2044 implement a standard T-HEAD C900 PLIC, which is already supported by the kernel. Add compatible string for Sophgo SG2044 plic. Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20250413223507.46480-5-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19dt-bindings: interrupt-controller: Add Sophgo SG2044 CLINT mswiInochi Amaoto
As SG2044 also implements an enhanced ACLINT as SG2042, add necessary compatible string for SG2044 SoC. Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20250413223507.46480-4-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19riscv: dts: sopgho: use SOC_PERIPHERAL_IRQ to calculate interrupt numberInochi Amaoto
Since riscv and arm architecture use different interrupt definitions, use a macro SOC_PERIPHERAL_IRQ mask this difference. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Link: https://lore.kernel.org/r/20250430012654.235830-5-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19riscv: dts: sophgo: rename header file cv18xx.dtsi to cv180x.dtsiInochi Amaoto
As the cv18xx.dtsi serves as a common peripheral header for all riscv cv180x/cv181x/sg200x SoCs, it not cover the entire cv18xx series as there is cv182x and cv183x. So rename the header file to make it precise. Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Link: https://lore.kernel.org/r/20250430012654.235830-4-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19riscv: dts: sophgo: Move riscv cpu definition to a separate fileInochi Amaoto
As sg2000 and sg2002 can boot from an arm a53 core, it is not suitable to left the riscv cpu definition in the common peripheral header. Move the riscv related device into a separate header file, so the arm subsystem can reuse the common peripheral header. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Link: https://lore.kernel.org/r/20250430012654.235830-3-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19riscv: dts: sophgo: Move all soc specific device into soc dtsi fileInochi Amaoto
Although the cv1800b/cv1812h/sg2000/sg2002 share most peripherals, some basic peripherals, like clock, pinctrl, clint and plint, are not shared. These are caused by not only historical reason (plic, clint), but also the fact the device is not the same (clock, pinctrl). It is good to override device compatible when the SoC number is small, but now it is a burden for maintenance, and it is kind of annoyed to explain why using override. So it is time to move this out of the common peripheral header. Move all soc related peripheral device from common peripheral header to the soc specific header to get rid of most compatible override. Reviewed-by: Yixun Lan <dlan@gentoo.org> Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Link: https://lore.kernel.org/r/20250430012654.235830-2-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19riscv: sophgo: dts: Add spi controller for SG2042Zixian Zeng
Add spi controllers for SG2042. SG2042 uses the upstreamed Synopsys DW SPI IP. Signed-off-by: Zixian Zeng <sycamoremoon376@gmail.com> Link: https://lore.kernel.org/r/20250425-sfg-spi-v6-3-2dbe7bb46013@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-19riscv: dts: sophgo: sg2042: add pinctrl supportInochi Amaoto
Add pinctrl node and related pin configuration for SG2042 SoC. Link: https://lore.kernel.org/r/20250211051801.470800-9-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com> Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
2025-05-18smb: client: Fix use-after-free in cifs_fill_direntWang Zhaolong
There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning. ================================================================== BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs] Read of size 4 at addr ffff8880099b819c by task a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000 </TASK> Allocated by task 408: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_noprof+0x117/0x3d0 mempool_alloc_noprof+0xf2/0x2c0 cifs_buf_get+0x36/0x80 [cifs] allocate_buffers+0x1d2/0x330 [cifs] cifs_demultiplex_thread+0x22b/0x2690 [cifs] kthread+0x394/0x720 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 342979: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0x2b8/0x500 cifs_buf_release+0x3c/0x70 [cifs] cifs_readdir+0x1c97/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff8880099b8000 which belongs to the cache cifs_request of size 16588 The buggy address is located 412 bytes inside of freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== POC is available in the link [1]. The problem triggering process is as follows: Process 1 Process 2 ----------------------------------------------------------------- cifs_readdir /* file->private_data == NULL */ initiate_cifs_search cifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL); smb2_query_dir_first ->query_dir_first() SMB2_query_directory SMB2_query_directory_init cifs_send_recv smb2_parse_query_directory srch_inf->ntwrk_buf_start = (char *)rsp; srch_inf->srch_entries_start = (char *)rsp + ... srch_inf->last_entry = (char *)rsp + ... srch_inf->smallBuf = true; find_cifs_entry /* if (cfile->srch_inf.ntwrk_buf_start) */ cifs_small_buf_release(cfile->srch_inf // free cifs_readdir ->iterate_shared() /* file->private_data != NULL */ find_cifs_entry /* in while (...) loop */ smb2_query_dir_next ->query_dir_next() SMB2_query_directory SMB2_query_directory_init cifs_send_recv compound_send_recv smb_send_rqst __smb_send_rqst rc = -ERESTARTSYS; /* if (fatal_signal_pending()) */ goto out; return rc /* if (cfile->srch_inf.last_entry) */ cifs_save_resume_key() cifs_fill_dirent // UAF /* if (rc) */ return -ENOENT; Fix this by ensuring the return code is checked before using pointers from the srch_inf. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220131 [1] Fixes: a364bc0b37f1 ("[CIFS] fix saving of resume key before CIFSFindNext") Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> Signed-off-by: Steve French <stfrench@microsoft.com>
generated by cgit (git 2.34.1) at 2025-10-01 23:06:10 +0000