kernel/git/next/linux-next.git/drivers/rapidio/devices, branch master

rapidio: use dmaengine_get_dma_device() instead of chan->device->dev

2026-09-21T23:34:35+00:00

Replace direct dma_chan::device::dev access with the proper dmaengine_get_dma_device() for consumer API. chan->device->dev is not always the device used for DMA mapping. Some DMA engines support per-channel IOMMU mappings, so different channels may use different DMA devices. dmaengine_get_dma_device() returns the correct device for each channel. This also prepares for making the DMA engine provider data structures private. DMA consumers should not access DMA engine internals directly. Assisted-by: LLM Link: https://lore.kernel.org/20260917205016.1293317-1-Frank.Li@oss.nxp.com Signed-off-by: Frank Li Signed-off-by: Andrew Morton Cc: Alexandre Bounine Cc: Dan Carpenter Cc: Kees Cook Cc: Matt Porter Cc: Vinod Koul

rapidio: mport_cdev: fix use-after-free in mport_mm_close()

2026-09-21T23:34:30+00:00

A use-after-free vulnerability was identified in mport_mm_close() in drivers/rapidio/devices/rio_mport_cdev.c, identical to the pattern previously addressed in dma_req_free(). This is observable from userspace when an application creates an mmap mapping via the RapidIO character device and subsequently unmaps it (or terminates, triggering exit_mmap()). During munmap, mport_mm_close() is invoked and drops the mapping reference via kref_put(). If kref_put() drops the last reference, mport_release_mapping() is called, which frees the underlying rio_mport_mapping structure. The subsequent mutex_unlock() then dereferences map->md to unlock buf_mutex, leading to a use-after-free: mport_mm_close() -> mutex_lock(&map->md->buf_mutex); ... -> kref_put(&map->ref, mport_release_mapping); /* map is freed */ -> mutex_unlock(&map->md->buf_mutex); /* UAF: map used */ Fix this by caching map->md before kref_put() and using the cached pointer for mutex unlocking, ensuring that freed memory is not accessed. Link: https://lore.kernel.org/20260914042327.49798-1-james010kim@gmail.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: James Kim Signed-off-by: Andrew Morton Cc: Alexandre Bounine Cc: Dan Carpenter Cc: Greg Kroah-Hartman Cc: Matt Porter Cc:

rapidio: mport_cdev: fix use-after-free in dma_req_free()

2026-08-05T18:20:14+00:00

dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface. Link: https://lore.kernel.org/20260723235220.588424-1-james010kim@gmail.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: James Kim Reviewed-by: Dan Carpenter Cc: Alexandre Bounine Cc: Greg Kroah-Hartman Cc: Matt Porter Cc: Signed-off-by: Andrew Morton

rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

2026-05-29T04:24:45+00:00

With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found. Reset the "found" to false at the start of the iteration and move the variable inside the loop. Link: https://lore.kernel.org/af2WHMZiqMwdYveO@stanley.mountain Fixes: 48618fb4e522 ("RapidIO: add mport driver for Tsi721 bridge") Signed-off-by: Dan Carpenter Cc: Alexandre Bounine Cc: Chul Kim Cc: Matt Porter Signed-off-by: Andrew Morton

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

rapidio: remove some dead defines

2025-05-12T00:54:09+00:00

Patch series "rapidio deadcoding". A couple of rapidio deadcoding patches. The first of these is a repost and was originally posted almost a year ago https://lore.kernel.org/all/20240528002515.211366-1-linux@treblig.org/ but got no answer. Other than being rebased and a typo fixed, it's not changed. This patch (of 2): 'mport_dma_buf', 'rio_mport_dma_map' and 'MPORT_MAX_DMA_BUFS' were added in the original commit e8de370188d0 ("rapidio: add mport char device driver") but never used. 'rio_cm_work' was unused since the original commit b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver") but never used. Remove them. Link: https://lkml.kernel.org/r/20250419203012.429787-1-linux@treblig.org Link: https://lkml.kernel.org/r/20250419203012.429787-2-linux@treblig.org Signed-off-by: Dr. David Alan Gilbert Cc: Alexandre Bounine Cc: Matt Porter Signed-off-by: Andrew Morton

rapidio: fix an API misues when rio_add_net() fails

2025-03-06T05:36:19+00:00

rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue. Link: https://lkml.kernel.org/r/20250227073409.3696854-1-haoxiang_li2024@163.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: Haoxiang Li Reviewed-by: Dan Carpenter Cc: Alexandre Bounine Cc: Matt Porter Cc: Yang Yingliang Cc: Signed-off-by: Andrew Morton

rapidio/tsi721: fix kernel-doc warnings

2023-12-20T23:02:57+00:00

Correct kernel-doc comments in tsi721.c and tsi721_dma.c to prevent warnings from scripts/kernel-doc. tsi721_dma.c:293: warning: expecting prototype for tsi721_omsg_msix(). Prototype was for tsi721_bdma_msix() instead tsi721.c:215: warning: Function parameter or member 'data' not described in 'tsi721_cread_dma' tsi721.c:215: warning: Excess function parameter 'val' description in 'tsi721_cread_dma' tsi721.c:238: warning: Function parameter or member 'data' not described in 'tsi721_cwrite_dma' tsi721.c:238: warning: Excess function parameter 'val' description in 'tsi721_cwrite_dma' tsi721.c:2548: warning: Function parameter or member 'attr' not described in 'tsi721_query_mport' tsi721.c:2548: warning: Excess function parameter 'mbox' description in 'tsi721_query_mport' and 27 warnings like this one: tsi721.c:59: warning: No description found for return value of 'tsi721_lcread' Link: https://lkml.kernel.org/r/20231206175528.16386-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Matt Porter Cc: Alexandre Bounine Signed-off-by: Andrew Morton

rapidio: make all 'class' structures const

2023-10-05T11:51:35+00:00

Now that the driver core allows for struct class to be in read-only memory, making all 'class' structures to be declared at build time placing them into read-only memory, instead of having to be dynamically allocated at load time. Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230810195103.27069-1-ivan.orlov0322@gmail.com Signed-off-by: Greg Kroah-Hartman