summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-07-16comedi: pcl812: Fix bit shift out of boundsIan Abbott
When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & board->irq_bits) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Reported-by: syzbot+32de323b0addb9e114ff@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=32de323b0addb9e114ff Fixes: fcdb427bc7cf ("Staging: comedi: add pcl821 driver") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20250707133429.73202-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16comedi: das16m1: Fix bit shift out of boundsIan Abbott
When checking for a supported IRQ number, the following test is used: /* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Reported-by: syzbot+c52293513298e0fd9a94@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c52293513298e0fd9a94 Fixes: 729988507680 ("staging: comedi: das16m1: tidy up the irq support in das16m1_attach()") Tested-by: syzbot+c52293513298e0fd9a94@syzkaller.appspotmail.com Suggested-by: "Enju, Kohei" <enjuk@amazon.co.jp> Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20250707130908.70758-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16comedi: Fix some signed shift left operationsIan Abbott
Correct some left shifts of the signed integer constant 1 by some unsigned number less than 32. Change the constant to 1U to avoid shifting a 1 into the sign bit. The corrected functions are comedi_dio_insn_config(), comedi_dio_update_state(), and __comedi_device_postconfig(). Fixes: e523c6c86232 ("staging: comedi: drivers: introduce comedi_dio_insn_config()") Fixes: 05e60b13a36b ("staging: comedi: drivers: introduce comedi_dio_update_state()") Fixes: 09567cb4373e ("staging: comedi: initialize subdevice s->io_bits in postconfig") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20250707121555.65424-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too largeIan Abbott
The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large. Avoid that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable. Define the limit on the `n_insns` value in the `MAX_INSNS` macro. Set this to the same value as `MAX_SAMPLES` (65536), which is the maximum allowed sum of the values of the member `n` in the array of `struct comedi_insn`, and sensible comedi instructions will have an `n` of at least 1. Reported-by: syzbot+d6995b62e5ac7d79557a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d6995b62e5ac7d79557a Fixes: ed9eccbe8970 ("Staging: add comedi core") Tested-by: Ian Abbott <abbotti@mev.co.uk> Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20250704120405.83028-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16drm/i915: Refactor shmem_pwrite() to use kiocb and write_iterTaotao Chen
Refactors shmem_pwrite() to replace the ->write_begin/end logic with a write_iter-based implementation using kiocb and iov_iter. While kernel_write() was considered, it caused about 50% performance regression. vfs_write() is not exported for kernel use. Therefore, file->f_op->write_iter() is called directly with a synchronously initialized kiocb to preserve performance and remove write_begin usage. Performance results use gem_pwrite on Intel CPU i7-10700 (average of 10 runs): - ./gem_pwrite --run-subtest bench -s 16384 Before: 0.205s, After: 0.214s - ./gem_pwrite --run-subtest bench -s 524288 Before: 6.1021s, After: 4.8047s Part of a series refactoring address_space_operations write_begin and write_end callbacks to use struct kiocb for passing write context and flags. Signed-off-by: Taotao Chen <chentaotao@didiglobal.com> Link: https://lore.kernel.org/20250716093559.217344-3-chentaotao@didiglobal.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-07-16drm/i915: Use kernel_write() in shmem object createTaotao Chen
Replace the write_begin/write_end loop in i915_gem_object_create_shmem_from_data() with call to kernel_write(). This function initializes shmem-backed GEM objects. kernel_write() simplifies the code by removing manual folio handling. Part of a series refactoring address_space_operations write_begin and write_end callbacks to use struct kiocb for passing write context and flags. Signed-off-by: Taotao Chen <chentaotao@didiglobal.com> Link: https://lore.kernel.org/20250716093559.217344-2-chentaotao@didiglobal.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-07-16loop: use kiocb helpers to fix lockdep warningMing Lei
The lockdep tool can report a circular lock dependency warning in the loop driver's AIO read/write path: ``` [ 6540.587728] kworker/u96:5/72779 is trying to acquire lock: [ 6540.593856] ff110001b5968440 (sb_writers#9){.+.+}-{0:0}, at: loop_process_work+0x11a/0xf70 [loop] [ 6540.603786] [ 6540.603786] but task is already holding lock: [ 6540.610291] ff110001b5968440 (sb_writers#9){.+.+}-{0:0}, at: loop_process_work+0x11a/0xf70 [loop] [ 6540.620210] [ 6540.620210] other info that might help us debug this: [ 6540.627499] Possible unsafe locking scenario: [ 6540.627499] [ 6540.634110] CPU0 [ 6540.636841] ---- [ 6540.639574] lock(sb_writers#9); [ 6540.643281] lock(sb_writers#9); [ 6540.646988] [ 6540.646988] *** DEADLOCK *** ``` This patch fixes the issue by using the AIO-specific helpers `kiocb_start_write()` and `kiocb_end_write()`. These functions are designed to be used with a `kiocb` and manage write sequencing correctly for asynchronous I/O without introducing the problematic lock dependency. The `kiocb` is already part of the `loop_cmd` struct, so this change also simplifies the completion function `lo_rw_aio_do_completion()` by using the `iocb` from the `cmd` struct directly, instead of retrieving the loop device from the request queue. Fixes: 39d86db34e41 ("loop: add file_start_write() and file_end_write()") Cc: Changhui Zhong <czhong@redhat.com> Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/20250716114808.3159657-1-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-07-16nvmem: make nvmem_bus_type constantGreg Kroah-Hartman
Now that the driver core can properly handle constant struct bus_type, move the nvmem_bus_type variable to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Cc: Srinivas Kandagatla <srini@kernel.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250712181905.6738-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16nvmem: core: Fix typos in comments and MODULE_AUTHOR stringsAlok Tiwari
This patch fixes minor typo issues for nvmem-core.c: Corrects "form" to "from" in multiple function descriptions. Fixes missing closing angle brackets in MODULE_AUTHOR entries. These changes improve readability and formatting consistency. Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://lore.kernel.org/r/20250712181905.6738-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16nvmem: apple: drop default ARCH_APPLE in KconfigSven Peter
When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter <sven@kernel.org> Reviewed-by: Janne Grunau <j@jannau.net> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://lore.kernel.org/r/20250712181905.6738-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16fsi: make fsi_bus_type constantGreg Kroah-Hartman
Now that the driver core can properly handle constant struct bus_type, move the fsi_bus_type variable to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Cc: Ninad Palsule <ninad@linux.ibm.com> Cc: linux-fsi@lists.ozlabs.org Reviewed-by: Eddie James <eajames@linux.ibm.com> Link: https://lore.kernel.org/r/2025070100-overblown-busily-a04b@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16fsi: master-ast-cf: Use of_reserved_mem_region_to_resource for "memory-region"Rob Herring (Arm)
Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: "Rob Herring (Arm)" <robh@kernel.org> Reviewed-by: Eddie James <eajames@linux.ibm.com> Link: https://lore.kernel.org/r/20250703183439.2073555-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16misc: rtsx: usb: Ensure mmc child device is active when card is presentRicky Wu
When a card is present in the reader, the driver currently defers autosuspend by returning -EAGAIN during the suspend callback to trigger USB remote wakeup signaling. However, this does not guarantee that the mmc child device has been resumed, which may cause issues if it remains suspended while the card is accessible. This patch ensures that all child devices, including the mmc host controller, are explicitly resumed before returning -EAGAIN. This fixes a corner case introduced by earlier remote wakeup handling, improving reliability of runtime PM when a card is inserted. Fixes: 883a87ddf2f1 ("misc: rtsx_usb: Use USB remote wakeup signaling for card insertion detection") Cc: stable@vger.kernel.org Signed-off-by: Ricky Wu <ricky_wu@realtek.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20250711140143.2105224-1-ricky_wu@realtek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16eeprom: at25: convert to spi-mem APIAlexander Sverdlin
Replace the RAW SPI accesses with spi-mem API. The latter will fall back to RAW SPI accesses if spi-mem callbacks are not implemented by a controller driver. Notable advantages: - read function now allocates a bounce buffer for SPI DMA compatibility, similar to write function; - the driver can now be used in conjunction with SPI controller drivers providing spi-mem API only, e.g. spi-nxp-fspi. - during the initial probe the driver polls busy/ready status bit for 25ms instead of giving up instantly and hoping that the FW didn't write the EEPROM Notes: - mutex_lock() has been dropped from fm25_aux_read() because the latter is only being called in probe phase and therefore cannot race with at25_ee_read() or at25_ee_write() Quick 4KB block size test with CY15B102Q 256KB F-RAM over spi_omap2_mcspi driver (no spi-mem ops provided, fallback to raw SPI inside spi-mem): OP | throughput, KB/s | change --------+-----------------------+------- write | 1717.847 -> 1656.684 | -3.6% read | 1115.868 -> 1059.367 | -5.1% The lower throughtput probably comes from the 3 messages per SPI transfer inside spi-mem instead of hand-crafted 2 messages per transfer in the former at25 code. However, if the raw SPI access is not preserved, then the driver doesn't grow from the lines-of-code perspective and subjectively could be considered even a bit simpler. Higher performance impact on the read operation could be explained by the newly introduced bounce buffer in read operation. I didn't find any explanation or guarantee, why would a bounce buffer be not needed on the read side, so I assume it's a pure luck that nobody read EEPROM into some variable on stack on an architecture where kernel stack would be not DMA-able. Cc: Michael Walle <mwalle@kernel.org> Cc: Hui Wang <hui.wang@canonical.com> Link: https://lore.kernel.org/all/28ab8b72afee1af59b628f7389f0d7f5@kernel.org/ Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Link: https://lore.kernel.org/r/20250702222823.864803-1-alexander.sverdlin@siemens.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16vmci: Prevent the dispatching of uninitialized payloadsLizhi Xu
The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size payload_size, which causes the kernel data to leak to the user space. Before dispatching the datagram, and before setting the payload content, explicitly set the payload content to 0 to avoid data leakage caused by incomplete payload initialization. To avoid the oob check failure when executing __compiletime_lessthan() in memset(), directly use the address of the vmci_event_ctx instance ev to replace ev.msg.hdr, because their addresses are the same. Fixes: 28d6692cd8fb ("VMCI: context implementation.") Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95 Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> Link: https://lore.kernel.org/r/20250703075334.856445-1-lizhi.xu@windriver.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16eeprom: at25: fram: Detect and support inside-out chip variantsAlexander Sverdlin
Infineon seems to be confused with the order ID bytes should be presented by the FRAM chips and to be on the safe side they offer chips which are either JEDEC conform or the full opposite of the latter. Examples of the chips which present ID bytes in the reversed order are: CY15B102QN CY15B204QSN Let's support them nevertheless. Except reversing the ID bytes, they also have quite different density encoding even across EXCELON(tm) family. The patch has been tested with the above two chips. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Link: https://lore.kernel.org/r/20250702222927.864875-1-alexander.sverdlin@siemens.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16cdx: Fix missing GENERIC_MSI_IRQ on compile testKrzysztof Kozlowski
CDX_BUS driver uses msi_setup_device_data() which is selected by GENERIC_MSI_IRQ, thus compile testing without the latter failed: /usr/bin/ld: drivers/cdx/cdx.o: in function `cdx_probe': build/drivers/cdx/cdx.c:314: undefined reference to `msi_setup_device_data' Reported-by: Randy Dunlap <rdunlap@infradead.org> Closes: https://lore.kernel.org/all/b2c54a12-480c-448a-8b90-333cb03d9c14@infradead.org/ Fixes: 7f81907b7e3f ("cdx: Enable compile testing") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20250716064903.52397-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16misc: fastrpc: Use of_reserved_mem_region_to_resource() for "memory-region"Rob Herring (Arm)
Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The error handling is a bit different. "memory-region" is optional, so failed lookup is not an error. But then an error in of_reserved_mem_lookup() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: "Rob Herring (Arm)" <robh@kernel.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Srinivas Kandagatla <srini@kernel.org> Link: https://lore.kernel.org/r/20250703183455.2074215-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16mcb: use sysfs_emit_at() instead of scnprintf() in show functionsAbhinav Ananthu
This change improves clarity and ensures proper bounds checking in line with the preferred sysfs_emit() API usage for sysfs 'show' functions. The PAGE_SIZE check is now handled internally by the helper. No functional change intended. Signed-off-by: Abhinav Ananthu <abhinav.ogl@gmail.com> Signed-off-by: Johannes Thumshirn <jth@kernel.org> Reviewed-by: Johannes Thumshirn <jth@kernel.org> Link: https://lore.kernel.org/r/20250707074720.40051-2-jth@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16binder: encapsulate individual alloc test casesTiffany Yang
Each case tested by the binder allocator test is defined by 3 parameters: the end alignment type of each requested buffer allocation, whether those buffers share the front or back pages of the allotted address space, and the order in which those buffers should be released. The alignment type represents how a binder buffer may be laid out within or across page boundaries and relative to other buffers, and it's used along with whether the buffers cover part (sharing the front pages) of or all (sharing the back pages) of the vma to calculate the sizes passed into each test. binder_alloc_test_alloc recursively generates each possible arrangement of alignment types and then tests that the binder_alloc code tracks pages correctly when those buffers are allocated and then freed in every possible order at both ends of the address space. While they provide comprehensive coverage, they are poor candidates to be represented as KUnit test cases, which must be statically enumerated. For 5 buffers and 5 end alignment types, the test case array would have 750,000 entries. This change structures the recursive calls into meaningful test cases so that failures are easier to interpret. Signed-off-by: Tiffany Yang <ynaffit@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20250714185321.2417234-7-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16binder: Convert binder_alloc selftests to KUnitTiffany Yang
Convert the existing binder_alloc_selftest tests into KUnit tests. These tests allocate and free an exhaustive combination of buffers with various sizes and alignments. This change allows them to be run without blocking or otherwise interfering with other processes in binder. This test is refactored into more meaningful cases in the subsequent patch. Signed-off-by: Tiffany Yang <ynaffit@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20250714185321.2417234-6-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16binder: Scaffolding for binder_alloc KUnit testsTiffany Yang
Add setup and teardown for testing binder allocator code with KUnit. Include minimal test cases to verify that tests are initialized correctly. Tested-by: Rae Moar <rmoar@google.com> Signed-off-by: Tiffany Yang <ynaffit@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20250714185321.2417234-5-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16binder: Store lru freelist in binder_allocTiffany Yang
Store a pointer to the free pages list that the binder allocator should use for a process inside of struct binder_alloc. This change allows binder allocator code to be tested and debugged deterministically while a system is using binder; i.e., without interfering with other binder processes and independently of the shrinker. This is necessary to convert the current binder_alloc_selftest into a kunit test that does not rely on hijacking an existing binder_proc to run. A binder process's binder_alloc->freelist should not be changed after it is initialized. A sole exception is the process that runs the existing binder_alloc selftest. Its freelist can be temporarily replaced for the duration of the test because it runs as a single thread before any pages can be added to the global binder freelist, and the test frees every page it allocates before dropping the binder_selftest_lock. This exception allows the existing selftest to be used to check for regressions, but it will be dropped when the binder_alloc tests are converted to kunit in a subsequent patch in this series. Signed-off-by: Tiffany Yang <ynaffit@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20250714185321.2417234-3-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16binder: Fix selftest page indexingTiffany Yang
The binder allocator selftest was only checking the last page of buffers that ended on a page boundary. Correct the page indexing to account for buffers that are not page-aligned. Signed-off-by: Tiffany Yang <ynaffit@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20250714185321.2417234-2-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16binder: use guards for plain mutex- and spinlock-protected sectionsDmitry Antipov
Use 'guard(mutex)' and 'guard(spinlock)' for plain (i.e. non-scoped) mutex- and spinlock-protected sections, respectively, thus making locking a bit simpler. Briefly tested with 'stress-ng --binderfs'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20250626073054.7706-2-dmantipov@yandex.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16binder: use kstrdup() in binderfs_binder_device_create()Dmitry Antipov
In 'binderfs_binder_device_create()', use 'kstrdup()' to copy the newly created device's name, thus making the former a bit simpler. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: "Tiffany Y. Yang" <ynaffit@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20250626073054.7706-1-dmantipov@yandex.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16driver core: auxiliary bus: fix OF node leakJohan Hovold
Make sure to drop the OF node reference taken when creating an auxiliary device using auxiliary_device_create() when the device is later released. Fixes: eaa0d30216c1 ("driver core: auxiliary bus: add device creation helpers") Cc: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Jerome Brunet <jbrunet@baylibre.com> Link: https://lore.kernel.org/r/20250708084654.15145-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16drm/amdgpu: Reset the clear flag in buddy during resumeArunpravin Paneer Selvam
- Added a handler in DRM buddy manager to reset the cleared flag for the blocks in the freelist. - This is necessary because, upon resuming, the VRAM becomes cluttered with BIOS data, yet the VRAM backend manager believes that everything has been cleared. v2: - Add lock before accessing drm_buddy_clear_reset_blocks()(Matthew Auld) - Force merge the two dirty blocks.(Matthew Auld) - Add a new unit test case for this issue.(Matthew Auld) - Having this function being able to flip the state either way would be good. (Matthew Brost) v3(Matthew Auld): - Do merge step first to avoid the use of extra reset flag. Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Cc: stable@vger.kernel.org Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3812 Signed-off-by: Christian König <christian.koenig@amd.com> Link: https://lore.kernel.org/r/20250716075125.240637-2-Arunpravin.PaneerSelvam@amd.com
2025-07-16spi: gpio: Use explicit 'unsigned int' for parameter typesDarshan Rathod
The C standard allows 'unsigned' as a shorthand for 'unsigned int'. For improved code clarity and consistency with the prevailing kernel coding style, replace the shorthand with the more explicit 'unsigned int' type for function parameters. This is a purely stylistic cleanup and has no functional impact on the generated code. Signed-off-by: Darshan Rathod <darshanrathod475@gmail.com> Link: https://patch.msgid.link/20250716095906.21812-1-darshanrathod475@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-07-16regulator: rt6160: Add rt6166 vout min_uV setting for compatibleJeff Chang
1. remove unintentional GPL change 2. using switch case for Device ID probe check. Signed-off-by: Jeff Chang <jeff_chang@richtek.com> Link: https://patch.msgid.link/20250716021230.2660564-1-jeff_chang@richtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-07-16mmc: Merge branch fixes into nextUlf Hansson
Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-07-16mmc: loongson2: Unify the function prefixes for loongson2_mmc_pdataBinbin Zhou
The function prefixes for loongson2_mmc_pdata follow two naming conventions: SoC-based and DMA-based. First, DMA-based prefixes are the preferred choice, as they clearly highlight differences, such as prepare_dma; however, for functions related to SoC, such as reorder_cmd_data, it is agreed to use the smallest SoC name as the fallback prefix, such as ls2k0500. No functional change intended. Suggested-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://lore.kernel.org/r/20250716064421.3823418-1-zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-07-16mmc: loongson2: Fix error code in loongson2_mmc_resource_request()Dan Carpenter
There is a cut and paste bug so we accidentally return the wrong variable. It should be "ret" instead of PTR_ERR(host->clk). Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/847bf395-6d62-49c9-a39d-8e82c5b17bf7@sabinyo.mountain Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-07-16memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()Nathan Chancellor
A new warning in clang [1] points out that id_reg is uninitialized then passed to memstick_init_req() as a const pointer: drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, | ^~~~~~ Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") intentionally passed this variable uninitialized to avoid an -Wnonnull warning from a NULL value that was previously there because id_reg is never read from the call to memstick_init_req() in h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the warning, which is likely happening in the majority of builds using modern compilers that support '-ftrivial-auto-var-init=zero'. Cc: stable@vger.kernel.org Fixes: de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Closes: https://github.com/ClangBuiltLinux/linux/issues/2105 Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/r/20250715-memstick-fix-uninit-const-pointer-v1-1-f6753829c27a@kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-07-16ovpn: reset GSO metadata after decapsulationRalf Lici
The ovpn_netdev_write() function is responsible for injecting decapsulated and decrypted packets back into the local network stack. Prior to this patch, the skb could retain GSO metadata from the outer, encrypted tunnel packet. This original GSO metadata, relevant to the sender's transport context, becomes invalid and misleading for the tunnel/data path once the inner packet is exposed. Leaving this stale metadata intact causes internal GSO validation checks further down the kernel's network stack (validate_xmit_skb()) to fail, leading to packet drops. The reasons for these failures vary by protocol, for example: - for ICMP, no offload handler is registered; - for TCP and UDP, the respective offload handlers return errors when comparing skb->len to the outdated skb_shinfo(skb)->gso_size. By calling skb_gso_reset(skb) we ensure the inner packet is presented to gro_cells_receive() with a clean state, correctly indicating it is an individual packet from the perspective of the local stack. This change eliminates the "Driver has suspect GRO implementation, TCP performance may be compromised" warning and improves overall TCP performance by allowing GSO/GRO to function as intended on the decapsulated traffic. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Reported-by: Gert Doering <gert@greenie.muc.de> Closes: https://github.com/OpenVPN/ovpn-net-next/issues/4 Tested-by: Gert Doering <gert@greenie.muc.de> Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2025-07-16ovpn: reject unexpected netlink attributesAntonio Quartulli
Netlink ops do not expect all attributes to be always set, however this condition is not explicitly coded any where, leading the user to believe that all sent attributes are somewhat processed. Fix this behaviour by introducing explicit checks. For CMD_OVPN_PEER_GET and CMD_OVPN_KEY_GET directly open-code the needed condition in the related ops handlers. While for all other ops use attribute subsets in the ovpn.yaml spec file. Fixes: b7a63391aa98 ("ovpn: add basic netlink support") Reported-by: Ralf Lici <ralf@mandelbit.com> Closes: https://github.com/OpenVPN/ovpn-net-next/issues/19 Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2025-07-16ovpn: propagate socket mark to skb in UDPRalf Lici
OpenVPN allows users to configure a FW mark on sockets used to communicate with other peers. The mark is set by means of the `SO_MARK` Linux socket option. However, in the ovpn UDP code path, the socket's `sk_mark` value is currently ignored and it is not propagated to outgoing `skbs`. This commit ensures proper inheritance of the field by setting `skb->mark` to `sk->sk_mark` before handing the `skb` to the network stack for transmission. Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Ralf Lici <ralf@mandelbit.com> Link: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31877.html Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2025-07-16staging: greybus: gbphy: fix up const issue with the match callbackGreg Kroah-Hartman
gbphy_dev_match_id() should be taking a const pointer, as the pointer passed to it from the container_of() call was const to start with (it was accidentally cast away with the call.) Fix this all up by correctly marking the pointer types. Cc: Alex Elder <elder@kernel.org> Cc: greybus-dev@lists.linaro.org Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Reviewed-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/2025070115-reoccupy-showy-e2ad@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16gpio: loongson-64bit: Extend GPIO irq supportBinbin Zhou
Add the interrupt enable register offset (inten_offset) so that GPIO interrupts can be enabled normally on more models. According to the latest interface specifications, the definition of GPIO interrupts in ACPI is similar to that in FDT. The GPIO interrupts are listed one by one according to the GPIO number, and the corresponding interrupt number can be obtained directly through the GPIO number specified by the consumer. Signed-off-by: Xi Ruoyao <xry111@xry111.site> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://lore.kernel.org/r/20250714064542.2276247-1-zhoubinbin@loongson.cn [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-16tty: omit need_resched() before cond_resched()Mikulas Patocka
There's no need to call need_resched() because cond_resched() will do nothing if need_resched() returns false. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Link: https://lore.kernel.org/r/5a11ad09-5508-933c-f044-6a236bf00557@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16serial: 8250_ni: Reorder local variablesChaitanya Vadrevu
Reorder local variables in ni16550_probe to follow reverse Christmas tree style. Cc: Jason Smith <jason.smith@emerson.com> Cc: Gratian Crisan <gratian.crisan@emerson.com> Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@emerson.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Link: https://lore.kernel.org/r/20250711200418.1858682-3-chaitanya.vadrevu@emerson.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16serial: 8250_ni: Fix build warningChaitanya Vadrevu
Allocate memory on heap instead of stack to fix following warning that clang version 20.1.2 produces on W=1 build. drivers/tty/serial/8250/8250_ni.c:277:12: warning: stack frame size (1072) exceeds limit (1024) in 'ni16550_probe' [-Wframe-larger-than] 277 | static int ni16550_probe(struct platform_device *pdev) | ^ 1 warning generated. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202507030557.vIewJJQO-lkp@intel.com/ Cc: Jason Smith <jason.smith@emerson.com> Cc: Gratian Crisan <gratian.crisan@emerson.com> Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@emerson.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Link: https://lore.kernel.org/r/20250711200418.1858682-2-chaitanya.vadrevu@emerson.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16serial: sh-sci: Convert to DEFINE_SIMPLE_DEV_PM_OPS()Geert Uytterhoeven
Convert the Renesas SuperH SCI(F) serial port driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/a5628fe028362ae3f8729021a7864dd39f7869bf.1752086885.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-16gpio: viperboard: Unlock on error in vprbrd_gpiob_direction_output()Dan Carpenter
Unlock before returning if vprbrd_gpiob_setdir() fails. Fixes: 55e2d1eec110 ("gpio: viperboard: use new GPIO line value setter callbacks") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/9e72018c-e46e-4e55-83e4-503da4d022fc@sabinyo.mountain Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-16gpio: TODO: remove the task for the sysfs reworkBartosz Golaszewski
Remove the completed task tracking the rework of the sysfs interface and add a new task to track the removal of the legacy bits and pieces. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-10-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-16gpio: sysfs: allow disabling the legacy parts of the GPIO sysfs interfaceBartosz Golaszewski
Add a Kconfig switch allowing to disable the legacy parts of the GPIO sysfs interface. This means that even though we keep the /sys/class/gpio/ directory, it no longer contains the global export/unexport attribute pair (instead, the user should use the per-chip export/unpexport) nor the gpiochip$BASE entries. This option default to y if GPIO sysfs is enabled but we'll default it to n at some point in the future. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-9-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-16gpio: sysfs: export the GPIO directory locally in the gpiochip<id> directoryBartosz Golaszewski
As a way to allow the user-space to stop referring to GPIOs by their global numbers, introduce a parallel group of line attributes for exported GPIO that live inside the GPIO chip class device and are referred to by their HW offset within their parent chip. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-8-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-16gpio: sysfs: don't look up exported lines as class devicesBartosz Golaszewski
In preparation for adding a parallel, per-chip attribute group for exported GPIO lines, stop using class device APIs to refer to it in the code. When unregistering the chip, don't call class_find_device() but instead store exported lines in a linked list inside the GPIO chip data object and look it up there. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-7-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-16gpio: sysfs: don't use driver data in sysfs callbacks for line attributesBartosz Golaszewski
Currently each exported GPIO is represented in sysfs as a separate class device. This allows us to simply use dev_get_drvdata() to retrieve the pointer passed to device_create_with_groups() from sysfs ops callbacks. However, we're preparing to add a parallel set of per-line sysfs attributes that will live inside the associated gpiochip group. They are not registered as class devices and so have the parent device passed as argument to their callbacks (the GPIO chip class device). Put the attribute structs inside the GPIO descriptor data and dereference the relevant ones using container_of() in the callbacks. This way, we'll be able to reuse the same code for both the legacy and new GPIO attributes. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-6-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-16gpio: sysfs: rename the data variable in gpiod_(un)export()Bartosz Golaszewski
In preparation for future commits which will make use of descriptor AND GPIO-device data in the same functions rename the former from data to desc_data separately which will make future changes smaller and easier to read. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-5-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>