summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-17rust_binder: use pin_init::zeroed for file_operations initializationNicolás Antinori
All types in `bindings` implement `Zeroable` if they can. This enables using `pin_init::zeroed()` for `file_operations` initialization instead of relying on `unsafe { core::mem::MaybeUninit::zeroed().assume_init() }`. This change improves readability and removes an unnecessary unsafe block. Link: https://github.com/Rust-for-Linux/linux/issues/1189 Suggested-by: Benno Lossin <lossin@kernel.org> Signed-off-by: Nicolás Antinori <nico.antinori.7@gmail.com> Link: https://patch.msgid.link/20260702205803.552476-1-nico.antinori.7@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Update defer_work bitmaps to use kernel::impl_flags!Jahnavi MN
- Define `DeferWorks(u8)` and `DeferWork` enum using `bit_u8` offsets. - Change `ProcessInner.defer_work` type from `u8` to `DeferWorks`. - Update `Process::release()` and `Process::flush()` to check for empty states using `DeferWorks::empty()`. - Update the workqueue runner to inspect flags using `.contains()`. Signed-off-by: Jahnavi MN <jahnavimn@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260716-b4-rust_binder_impl_flags-v1-1-b4201d3f15b3@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: move (e)poll wait queue to ProcessAlice Ryhl
Most processes do not use Rust Binder with epoll, so avoid paying the synchronize_rcu() cost in drop for those that don't need it. For those that do, we also manage to replace synchronize_rcu() with kfree_rcu(), though we introduce an extra allocation. In case the last ref to an Arc<Thread> is dropped outside of deferred_release(), this also ensures that synchronize_rcu() is not called in destructor of Arc<Thread> in other places. Theoretically that could lead to jank by making other syscalls slow, which would be problematic. Signed-off-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Boqun Feng <boqun@kernel.org> Link: https://patch.msgid.link/20260707-upgrade-poll-v6-2-4b8fae7bf1d9@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: report netlink transactionsCarlos Llamas
The Android Binder driver supports a netlink API that reports transaction *failures* to a userspace daemon. This allows devices to monitor processes with many failed transactions so that it can e.g. kill misbehaving apps. One very important thing that this monitors is when many oneway messages are sent to a frozen process, so there is special handling to ensure this scenario is surfaced over netlink. Signed-off-by: Carlos Llamas <cmllamas@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Co-developed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260707-binder-netlink-v7-3-42b40e4b1ac8@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_DEAD_TRANSACTIONJahnavi MN
This adds dynamic debug logs for: - Releasing active transactions during thread stack unwinding. - Discarded transaction error codes when a thread exits. - Undelivered transaction acknowledgments (TRANSACTION_COMPLETE) upon thread exit. - Undelivered process death and freeze notifications when processes exit or die. - Undelivered transactions canceled due to target process death. We now store the process PID in `ThreadError`, `DeliverCode`, and `FreezeMessage` to ensure the correct PID is logged on cancellation. This is necessary because `cancel()` runs from background `kworkers`, which would otherwise print the wrong PID. Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-7-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_DEATH_NOTIFICATIONJahnavi MN
This adds dynamic debug logs for: - Memory allocation (OOM) failures when requesting death notifications - Registration and cancellation lifecycle events (BC_REQUEST / BC_CLEAR) - Delivery of death notification events to userspace (BR_DEAD_BINDER) Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-6-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_FAILED_TRANSACTIONJahnavi MN
This adds dynamic debug logs for: - Failed replies, target process deaths, and error code deliveries. - Detailed transaction failure diagnostics (including sender/receiver PIDs, TIDs, transaction IDs, buffer sizes, and error codes). Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-5-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_USER_ERROR for transaction parsing failuresJahnavi MN
This adds dynamic debug logs in `thread.rs` for: - File descriptor array (FDA) parent offset and parent buffer address alignment misalignments. - Memory copy, write, and translation failures during transaction serialization (including out-of-bounds pointer fixups). - Incoming transactions or replies that do not match the expected thread calling stack (such as out-of-order replies). Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-4-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_USER_ERROR for refcounting and death ↵Jahnavi MN
notifications This adds dynamic debug logs for: - Decrementing handle reference counts that are already zero. - Mismatched reference states (calling inc_ref_done with no active inc_refs, or using a weak reference as a strong reference). - Requesting or clearing death notifications on invalid references, already active notifications, or with mismatched cookies. Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-3-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_USER_ERROR for freezer-related operationJahnavi MN
This adds dynamic debug logs for: - Requesting freeze notifications on invalid references, duplicate cookies, or already active registrations. - Completing freeze notifications that are not pending or not found. - Clearing freeze notifications on invalid references, inactive notifications, or cookie mismatches. Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-2-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Add dynamic debug logging maskJahnavi MN
Implement a dynamic debug logging mask (`debug_mask`) for the `rust_binder` module to allow dynamic runtime configuration of log levels. This enables parity with the legacy C driver's debug mask. Since the Rust `module!` macro in the current kernel build does not yet support declaring module parameters directly in Rust, we define the `debug_mask` variable in Rust as an `Atomic<u32>` exported via FFI using `#[no_mangle]`, and link to it as `extern` in a C companion file to expose it to the kernel runtime. To verify the setup, instrument process lifecycle events (open, flush, and release) in `process.rs` under the new `BINDER_DEBUG_OPEN_CLOSE` logging mask. These entry-point events are chosen for initial validation because they represent the start of the Binder lifecycle and occur at low frequency, allowing simple runtime verification of the dynamic toggle without log noise. Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-1-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17mei: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260717100533.601899-4-panchuang@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: Remove redundant dev_err()/dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() and devm_request_threaded_irq() automatically log detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260717100533.601899-3-panchuang@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: bcm-vk: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260717100533.601899-2-panchuang@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: Drop unused assignments from pnp_device_id arraysUwe Kleine-König (The Capable Hub)
Explicitly assigning .driver_data in drivers that don't use this member is silly and a bit irritating. Drop these. Also simplify the list terminator entry to be just empty to match what most other device_id tables do. There is no changed semantic, not even a change in the compiled result. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/c938b407cc16e9db2a59c67f390f073eeee6f1b3.1781016848.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17mei: lb: fix incorrect type in assignmentAlexander Usyskin
Fix the mix between __le32 and integer by casting the MEI_LB2_CMD constant as __le32 while using it. Fixes sparse waring: drivers/misc/mei/mei_lb.c:284:32: sparse: sparse: restricted __le32 degrades to integer drivers/misc/mei/mei_lb.c:330:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] command_id @@ got int @@ drivers/misc/mei/mei_lb.c:330:40: sparse: expected restricted __le32 [usertype] command_id drivers/misc/mei/mei_lb.c:330:40: sparse: got int Fixes: 773a43b8627f ("mei: lb: add late binding version 2") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605091533.79Zcv3CX-lkp@intel.com/ Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://patch.msgid.link/20260709-fix_type_le-v3-1-478761151e05@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: layouts: u-boot-env: check earlier for ethaddr lengthTomasz Maciej Nowak
Unfortunately the ethaddr value in U-Boot environment might be enclosed in single/double quotes or be something completely different. This can make it different than MAC_ADDR_STR_LEN, which results in EINVAL returned by ethaddr post process. Move the check for length earlier, to skip post processing, so nvmem could still present ethaddr value as a string if the value doesn't match MAC_ADDR_STR_LEN. Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-15-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: cleanup dead code in KconfigJulian Braha
There is already an 'if NVMEM' condition wrapping NVMEM_RCAR_EFUSE, making the 'depends on' statement a duplicate dependency (dead code). I propose leaving the outer 'if NVMEM...endif' and removing the individual 'depends on' statement. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha <julianbraha@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-14-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: qcom: Unify user-visible "Qualcomm" nameKrzysztof Kozlowski
Various names for Qualcomm as a company are used in user-visible config options: QCOM, Qualcomm and Qualcomm Technologies. Switch to unified "Qualcomm" so it will be easier for users to identify the options when for example running menuconfig. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-13-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: airoha: Add support for SMC eFUSEChristian Marangi
Add support for SMC eFUSE on AN7581 SoC. The SoC have 2 set of 2048 bits of eFUSE that are used to read calibration value for PCIe, Thermal, USB and other specific info of the SoC like revision and HW device present. eFuse value are taken by sending SMC command. ATF is responsible of validaing the data and rejecting reading protected data (like Private Key). In such case the SMC command will return non-zero value on a0 register. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-12-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: lan9662-otp: add support for LAN969xHoratiu Vultur
Microchip LAN969x provides OTP with the same control logic, only the size differs as LAN969x has 16KB of OTP instead of 8KB like on LAN966x. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: Robert Marko <robert.marko@sartura.hr> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-9-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: nintendo-otp: Use of_device_get_match_data()Rosen Penev
Use of_device_get_match_data() to retrieve the devtype data instead of open-coding the OF match lookup and dereferencing match->data. This also replaces the deprecated of_device.h include with of.h. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: core: Default to read-only if wp-gpios presentMarek Vasut
In case the nvmem DT node contains "wp-gpios" DT property, the device currently defaults to read-write and the force_ro sysfs attribute reads 0. Switch to the default read-only, which is both safer, and aligned with eMMC HW BOOT partition force_ro sysfs attribute behavior, which also defaults to read-only. The adjustment of nvmem->read_only value to read-only in case wp-gpios DT property is present must be done only after the device_add() got called because device_add() does internally call nvmem_bin_attr_get_umode(), which configures the permissions of 'nvmem' bin attr based on the value of nvmem->read_only that is only parsed from DT property 'read-only', without any adjustment. This way, if DT property 'read-only' is present, the 'nvmem' attribute is always read-only. Otherwise, if the device is writeable, then 'nvmem' attribute is writeable, and nvmem->read_only defaults to read-only, but can be switched to read-write at runtime via the 'force_ro' attribute. The updated behavior can be tested as follows: Current content: " $ cat /sys/bus/nvmem/devices/logging7/force_ro 1 $ hexdump -C /sys/bus/nvmem/devices/logging7/nvmem 00000000 66 6f 6f 0a ff ff ff ff " Write into default-read-only device: " $ echo bar > /sys/bus/nvmem/devices/logging7/nvmem bash: echo: write error: Operation not permitted $ cat /sys/bus/nvmem/devices/logging7/force_ro 1 " Unlock and write into device: " $ echo 0 > /sys/bus/nvmem/devices/logging7/force_ro $ cat /sys/bus/nvmem/devices/logging7/force_ro 0 $ echo bar > /sys/bus/nvmem/devices/logging7/nvmem $ hexdump -C /sys/bus/nvmem/devices/logging7/nvmem 00000000 62 61 72 0a ff ff ff ff " Relock and write into device, fails because device is read-only again: " $ echo 1 > /sys/bus/nvmem/devices/logging7/force_ro $ echo baz > /sys/bus/nvmem/devices/logging7/nvmem bash: echo: write error: Operation not permitted $ hexdump -C /sys/bus/nvmem/devices/logging7/nvmem 00000000 62 61 72 0a ff ff ff ff " Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: rockchip-otp: alloc clks with main structRosen Penev
Use a flexible array member to simplify allocation slightly. No need for a separate calloc. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: quatech_daqp_cs: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the dev->read_dev pointer which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-12-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcmuio: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler pcmuio_interrupt() to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->subdevices by pcmuio_handle_asic_interrupt(). Also make use of the IRQ_HANDLED(x) macro for the normal return path of the interrupt handler. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-11-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcmmio: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-10-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcm818: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the dev->read_dev pointer which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-9-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcm816: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the devpriv->dma pointer which may be NULL if dev->attached is false. Move the dereference of the devpriv->dma pointer after dev->attached has been checked to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-8-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcm711: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the dev->read_dev pointer which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-7-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: ni_atmio16d: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-6-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: ni_at_a2150: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing various pointers which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereferences. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-5-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: dt2811: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing dev->read_subdev, which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-4-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: das6402: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: aio_iiro_16: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: ni_pcimio: set PCI-6220 dio_speed and ai_fifo_depth from NI specsShashwat Agrawal
The PCI-6220 board entry was missing .dio_speed, unlike the PXI-6220 and the other 622x boards in the table. Set it to 1000 ns to match those entries and the 1 MHz maximum DI/DO sample clock on Port 0 in the NI PCI/PXI-6220 specifications. Also update .ai_fifo_depth for PCI-6220 and PXI-6220 from 512 to 4095 samples, matching the documented AI input FIFO size and the rest of the 622x entries. Link: https://www.ni.com/docs/en-US/bundle/pci-pxi-6220-specs/page/specs.html Signed-off-by: Shashwat Agrawal <shashwatagrawal473@gmail.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260629135404.19835-1-shashwatagrawal473@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: speakup: unregister tty ldisc on later init failuresHaoxiang Li
The ldisc registration is intentionally non-fatal, since some synth drivers do not use tty/ldisc. However, once speakup_init() continues past the registration point and later fails, the init unwind path should mirror speakup_exit() and call spk_ttyio_unregister_ldisc(). Add the missing unregister call to the error path after synth_release(), matching the normal module exit cleanup order. Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Fixes: e23a9b439ce9 ("staging: speakup: safely register and unregister ldisc") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260531230804.254962-16-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: speakup_soft: fix comment style and repeated wordFrancisco Maestre
Fix comment style issues in speakup_soft.c: - Move the closing '*/' of the block comment to its own line, as required by the kernel coding style Signed-off-by: Francisco Maestre <francisco@maestretorreblanca.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-15-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix typo in a speakup messageBastien Nocera
s/read windo/read window/ Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-14-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix incorrect "index" pluralBastien Nocera
It's indexes or indices. Given that the constant is called "STAT_index_valid", "indexes" was the preferred plural. Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-13-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix spelling of "re-enable"Bastien Nocera
Detected using codespell. Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-12-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17Accessibility: speakup_soft: Fix double word in commentsBo Liu
Remove the repeated word "the" in comments. Signed-off-by: Bo Liu <liubo03@inspur.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-11-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: keyhelp: guard letter_offsets possible out-of-range indexingPavel Zhigulin
help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. Function names can be overridden with the following commands as root: modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound. Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-10-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: Use str_plural() to simplify the codeXichao Zhao
Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-9-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Standardize character attribute types to u16Jagadeesh Yalapalli
This change replaces non-portable `u_short` types with standardized `u16` throughout the speakup subsystem to ensure: 1. Consistent 16-bit width across all architectures. 2. Improved code portability and readability. 3. Elimination of platform-dependent type sizes. 4. Safe bitwise operations without sign-extension risks. Signed-off-by: Jagadeesh Yalapalli <jagadeesh.yalapalli@einfochips.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-8-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix the wrong format specifierliujing
Make a minor change to eliminate a static checker warning. The type of '(unsigned int)kp[i]' is unsigned int, so the correct format specifier should be %u instead of %d. Signed-off-by: liujing <liujing@cmss.chinamobile.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-7-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: genmap: remove redundant post-incrementbajing
In the while loop, the variable lc is unused and is reinitialized later, so this redundant operation should be removed. Signed-off-by: bajing <bajing@cmss.chinamobile.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-6-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: speakup: Fix incorrect string length computation in ↵Christophe JAILLET
report_char_chartab_status() snprintf() returns the "number of characters which *would* be generated for the given input", not the size *really* generated. In order to avoid too large values for 'len' (and potential negative values for "sizeof(buf) - (len - 1)") use scnprintf() instead of snprintf(). Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260531230804.254962-5-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup/utils: use "!P" instead of "P == 0"Xu Panda
comparing pointer to 0, use !P instead of it. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Xu Panda <xu.panda@zte.com.cn> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-4-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility/speakup/speakup_dtlk: Add header file macro definitionLi zeming
Add header file macro definition. Signed-off-by: Li zeming <zeming@nfschina.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-3-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-08 17:57:50 +0000