| Age | Commit message (Collapse) | Author |
|---|
|
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Add __user annotation to buf, as it is passed as a user pointer in
pin_user_pages_fast(). Use an empty initializer for the sentinel
board-table entry to avoid initializing a function pointer with an
integer literal.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607131247.fpQ6eTc7-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
dlfb_parse_vendor_descriptor() walks key-length-value items inside the
DisplayLink vendor descriptor.
Require each item to contain its key, length and declared value bytes
before reading item-specific fields such as max_area.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
The driver has a match table for the pci bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
To te able to unregister stuff from isrs, the corresponding table was
copied. Nobody seems to unregister stuff that way, so it does not help.
But there are stack-allocated objects passed to these isrs giving chances
of UAF of these objects if irqs are unregistered while they are handled,
so better do not copy that table.
Suggested-by: sashiko-bot@kernel.org
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
tdfxfb_probe() enables the PCI device with pci_enable_device(), but
several failure paths after that point return without disabling it. The
framebuffer_alloc() failure path returns -ENOMEM directly, and the later
shared out_err path releases the framebuffer and returns -ENXIO without
balancing the PCI enable state.
The successful probe path has the same imbalance because tdfxfb_remove()
releases the framebuffer, mappings and regions, but never calls
pci_disable_device().
Use pcim_enable_device() so the PCI device is disabled automatically on
probe failure and driver detach.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
uvesafb_init() registers the v86d connector callback before registering
the platform driver. If platform_driver_register() fails, the function
returns the error directly and leaves the connector callback registered.
The later platform-device failure path already unregisters the callback.
Add the same cleanup before the final return when platform-driver
registration fails.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
https://gitlab.freedesktop.org/drm/rust/kernel into drm-next
DRM Rust changes for v7.3-rc1
- I/O (shared from driver-core tree via signed tag rust-io-7.3-rc1):
- Rework of I/O types: make I/O regions typed (with a
dynamically-sized Region type for the existing untyped case), create
view types representing subregions of a mapped I/O region, and add
io_project!() for safely creating subviews.
- Split Io into a base trait (IoBase) and an extension trait (Io) with
a blanket implementation, preventing implementers from overriding
provided methods that unsafe code relies on.
- Add a SysMem backend for shared system memory with volatile access,
and make Coherent implement Io via an I/O view type. Add copying
methods (memcpy_{from,to}io).
- Replace dma_read!/dma_write! with io_read!/io_write!; drop the old
macros.
- DRM:
- RegistrationGuard and RegistrationData:
- Rework DeviceContext typestates: rename Uninit to Normal, add an
Ioctl context, restrict AlwaysRefCounted to Normal for both Device
and GEM Object, and establish a Deref chain from Registered to
Normal.
- Introduce RegistrationGuard, a guard representing a
drm_dev_enter/exit SRCU critical section that proves the DRM
device is registered, which implies the parent bus device is still
bound.
- Add RegistrationData as a GAT on drm::Driver. The data does not
outlive driver unbind, so it can capture lifetime-annotated device
resources and references. Accessible through the guard via a
closure with HRTB lifetime.
- Wrap ioctl dispatch in RegistrationGuard (returning ENODEV if
unplugged) and pass registration data to handlers.
- Add Driver::ParentDevice associated type.
- Fix unbounded lifetimes in ioctl handler arguments.
- Fix a race in drm_dev_register() where a partial failure allowed
in-flight ioctls to proceed while the error path tore down
resources.
- GEM shmem: add DmaResvGuard helper, vmap functions, and sg_table()
accessor.
- GPUVM: require Send + Sync for the driver's associated data,
implement Send and Sync for GpuVaAlloc and GpuVmBo, add SmContext
lifetime bound, update DriverGpuVm for DeviceContext.
- Nova:
- nova-core / nova-drm cross-crate dependency:
- Build nova-core and nova-drm from drivers/gpu/Makefile for build
ordering, export nova-core Rust symbols for nova-drm. Workaround
until the build system supports Rust cross-crate dependencies
natively.
- GSP boot process consolidation:
- Introduce GspBootContext to bundle common boot parameters,
replacing per-argument threading. Separate context and GPU
lifetimes to support mutable borrows of GPU subdevices.
- Turn FWSEC execution into a HAL method, make FWSEC bootloader
usage a property of the TU102 HAL (GA102+ gets its own instance
with it disabled). Move firmware file selection to the GSP HAL.
- Store the Fsp instance in Gpu (lifetime tied to the GPU, not just
a single boot invocation). Move GSP state and unload bundle into a
pinned subobject for reliable teardown on partial init failure.
- Boot GSP with vGPU enabled:
- Add PRC (Product Reconfiguration Control) protocol to query device
configuration from the FSP. Read vGPU mode, detect and store vGPU
state.
- Set RMSetSriovMode registry entry and reserve the larger WPR2 heap
required when vGPU is enabled.
- Build SetRegistry entries dynamically.
- TLV firmware image format:
- Add a TLV (type-length-value) parser for the new firmware image
format. TLV files use unversioned filenames with a .tlv suffix,
start with "NVFW" magic, and contain tagged blocks with 4-byte
aligned payloads.
- Transition all firmware loading (booter, gsp, gen_bootloader, fsp)
to TLV images.
- Note: this requires a development firmware not in linux-firmware
[1]; this is temporary and serves the transition to r615.
- Hopper/Blackwell fixes and cleanups:
- Correct FRTS vidmem offset calculation, split FbLayout into FSP
and non-FSP versions, fix Blackwell flush address composition, use
absolute FBHUB0 flush registers on Blackwell, use correct sysmem
flush registers on Hopper.
- Harden FSP messaging: limit receive allocation size, catch bogus
queue pointers, ensure DMA allocation lifetimes for FMC boot and
LibOS, wait for RISC-V HALTED on unload.
- I/O projection adoption:
- Use io_project!() for PTE array, message queues, and Falcon DMA
transfer bounds checking.
- Misc:
- Keep unloading if FWSEC-SB fails during Turing/Ampere GSP reset.
- Don't declare booter firmware for FSP chipsets.
- Fix packed registry table size.
- Extract and display usable FB regions from GSP.
- Store bar and dev directly in Falcon, simplifying the API.
- Parse VBIOS structs via zerocopy.
- Convert to kernel bitfield macro, remove local one.
- Move register definitions into sub-modules.
- Add FSP and PRC protocol documentation.
- Tyr:
- Firmware loading and MCU boot:
- Add a generic slot manager for dynamically allocating limited
hardware slots to software seats, with lazy eviction under
contention.
- Add MMU support wrapping the slot manager for address-space slot
allocation, with MAIR-to-MEMATTR translation.
- Add GPU virtual memory (VM) support using drm_gpuvm with ARM64
LPAE Stage 1 page tables and 4KB/2MB page sizes.
- Add a kernel buffer object type for internal driver allocations.
- Add a parser for the Mali CSF firmware binary format.
- Add MCU booting: load, parse, and map firmware sections into VM,
then boot the MCU at probe().
- Cross-subsystem:
- Add faux::Device type with AsBusDevice support. Allow retrieving a
bound Device from a Registration.
- Add device lifetime to IoPageTable.
- Add Vec::zeroed method.
- Add firmware::request_into_buf() to load firmware into a
caller-provided buffer.
- Rename dma_handle to dma_address in the DMA abstraction.
- Change pci_sriov_get_totalvfs() return type to unsigned int; add
Rust helper.
[1] https://github.com/ttabi/linux-firmware-nova
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: "Danilo Krummrich" <dakr@kernel.org>
Link: https://patch.msgid.link/DKJQQUOS0PVO.3JPR3MYK4PDVZ@kernel.org
|
|
rust-next
Pull pin-init updates from Gary Guo:
"User-visible changes:
- Merge the '__pinned_init' and '__init' methods and make 'Init'
a marker trait.
- Introduce public APIs 'raw_init' and 'raw_try_init' to prevent users
from needing to invoke the internal '__pinned_init'/'__init' methods.
- Emit errors for duplicate '#[pin]' attributes.
- Link 'Zeroable::zeroed' and 'pin_init::zeroed' in documentation.
Other changes:
- Fix unwind safety issues.
- Clean up lint 'allow' and 'expect's.
- Overhaul '#[cfg]' handling to pave the way for tuple structs and
self-referential structs.
- Mark many functions as '#[inline]' for better codegen with '-C
opt-level=s' ('CC_OPTIMIZE_FOR_SIZE')."
* tag 'pin-init-v7.3' of https://github.com/Rust-for-Linux/linux:
rust: pin-init: add `#[inline]` to small functions
rust: pin-init: remove `__pinned_init` method for `cfg(kernel)`
rust: treewide: replace `__pinned_init` with `raw_[try_]init`
rust: pin-init: add `raw_init` and `raw_try_init` and recommend over `__init`
rust: pin-init: merge `__pinned_init` and `__init`
rust: pin-init: examples: use `Wrapper::pin_init` instead of manual reimplementation
rust: pin-init: mark `pin_init::zeroed` and `Zeroable::zeroed` as `#[inline]`
rust: pin-init: docs: link `Zeroable::zeroed` and `pin_init::zeroed` in documentation
rust: pin-init: internal: rework how `#[pin_data]` handles cfg
rust: pin-init: make `[pin_]chain` unwind safe
rust: pin-init: make `[pin_]init_array_from_fn` unwind safe
rust: pin-init: internal: generate brace in macro for init code blocks
rust: pin-init: internal: remove `allow` and `expect`s that don't fire
rust: pin-init: remove redundant clippy expects in doc tests
rust: pin-init: examples: fix incorrect drop
rust: pin-init: internal: error on duplicate `#[pin]` attribute
|
|
We need the driver-core fixes in here as well to build on top of.
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
|
|
Key slots are released through a kref and the existing release path
frees the AEAD transforms from an RCU callback. That is not safe for all
crypto implementations: crypto_free_aead can sleep, for example when an
async or hardware implementation has teardown work to complete.
Use queue_rcu_work for key-slot release. This keeps the RCU grace period
needed by lockless key-slot readers, but runs the actual crypto teardown
from workqueue context where sleeping is allowed. Once the rcu_work
callback runs, pre-existing RCU readers are gone, and the final kref put
already proves that no transform user remains, so the worker can release
the AEAD transforms and free the slot directly.
The previous patch drains ovpn_wq during module exit, so queued key-slot
teardown work cannot outlive module text.
Fixes: 8534731dbf2d ("ovpn: implement packet processing")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
|
|
ovpn queues several work items whose callbacks execute module text.
These works currently run on the global system workqueues, so module
exit has no driver-owned drain point that guarantees the callbacks have
fully returned before the module text can be freed.
Object references protect the objects used by the callbacks, but they do
not prove that a workqueue function has returned. In particular, a
worker can drop the final reference that unblocks device teardown while
it is still executing ovpn code.
Add a module-owned workqueue and queue all ovpn work items on it. During
module exit, unregister rtnl and netlink first, flush the workqueue so
ordinary ovpn workers finish, run the final RCU barrier, and destroy the
workqueue last. This keeps the workqueue available for cleanup work
queued from RCU callbacks, while ensuring no ovpn work item can outlive
the module text.
The per-device delayed keepalive work remains explicitly disabled during
netdev teardown (disable_delayed_work_sync in ndo_uninit), since
flush_workqueue does not flush delayed work that is still only pending
on its timer.
Fixes: 3ecfd9349f40 ("ovpn: implement keepalive mechanism")
Fixes: 11851cbd60ea ("ovpn: implement TCP transport")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
|
|
Replace devm_kasprintf() with dev_name() for the chip label. dev_name()
returns a stable pointer to the device name, so the separate allocation
and -ENOMEM check can be dropped.
Using dev_name() seems to be common for GPIO labels.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-9-rosenp@gmail.com
|
|
Shifting a 32-bit unsigned integer by 32 or more places is undefined
behavior in C. GPIO_MASK2 computes its shift amount as (gpio) * 2, and
for pins 16-31 in the OSRH/TSRH bank this yields shifts of 32-62.
While this happens to work on PowerPC because slw masks the shift count
to the low 5 bits, compilers performing value-range propagation may
assume the else branch is unreachable and optimize it away, or may
evaluate the shift as zero on other architectures via COMPILE_TEST.
Mask gpio to the 16-pin bank index so the shift stays within [0, 30].
The registers are banked (OSRL/TSRL for gpio 0-15, OSRH/TSRH for
gpio 16-31) with an identical 2-bit-per-pin layout from MSB to LSB,
so masking to the within-bank index preserves the intended behavior.
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-8-rosenp@gmail.com
|
|
Replace PPC-specific clrbits32()/setbits32() with local helpers using
ioread32be()/iowrite32be() which are equivalent on PPC since commit
894fa235eb4c ("powerpc: inline iomap accessors").
Add COMPILE_TEST as a result to increase compile coverage.
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-7-rosenp@gmail.com
|
|
Use gpio_generic_chip_init() to set up the PPC44x GPIO chip
instead of open-coding the basic get, set, locking and state handling.
Keep the PPC44x-specific direction callbacks because they still need to
program ODR and the OSR/TSR registers around the generic data and
direction registers.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-6-rosenp@gmail.com
|
|
Map the PPC44x GPIO register block through the platform device
resource instead of reparsing the firmware node directly.
The GPIO node now probes as a platform device, so use the
platform helper to keep resource handling aligned with the converted
driver model and to report mapping failures with the platform device
context.
Move ioremap up in order to avoid doing extra work in case of
-EPROBE_DEFER.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-5-rosenp@gmail.com
|
|
Replace the open-coded arch initcall registration with
module_platform_driver(). The initcall level changes from
arch_initcall to device_initcall, which is safe since the
driver no longer needs architecture-specific ordering.
Added MODULE info as a result, otherwise these warnings appear
ERROR: modpost: missing MODULE_LICENSE() in drivers/gpio/gpio-ppc4xx.o
WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpio/gpio-ppc4xx.o
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-4-rosenp@gmail.com
|
|
The kernel lost support for 4xx platforms and now only supports 44x.
Since this driver is being moved to drivers/gpio/ , take the opportunity
to modernize the name.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-3-rosenp@gmail.com
|
|
Move the ppc4xx gpio driver out of arch/powerpc/platforms/44x/ into
drivers/gpio/gpio-ppc44x.c. The driver has no architecture-specific
dependencies and follows the same pattern as other PowerPC GPIO
drivers already in drivers/gpio/ (e.g. gpio-mpc8xxx, gpio-mpc5200).
- Renamed Kconfig symbol from PPC4xx_GPIO to GPIO_PPC44X
- Updated ppc44x_defconfig and warp_defconfig to use the new symbol
- Marked the new option as tristate (was bool) since the driver
supports module build via module_platform_driver()
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260803223539.86303-2-rosenp@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik:
- Fix potential uninitialized memory reads and buffer overflows from
malformed zcrypt CCA and EP11 requests by properly validating lengths
and payloads
- Fix possible out of bounds accesses in zcrypt EP11 domain handling by
replacing fixed payload layout assumptions with parsing ASN.1 fields
with bounds checks
- Fix zcrypt CCA and EP11 request and reply buffer allocations missing
required 4-byte padding, and scrub the full allocation on release
- Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes
of memory by zeroing trailing alignment padding
* tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
s390/zcrypt: Improve EP11 CPRB length and overflow checks
s390/zcrypt: Improve CCA CPRB length and overflow checks
s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
arm64: tegra: Device tree changes for v7.3-rc1
This contains a new device tree for the Lenove ThinkEdge SE70 Edge
Client device as well as a number of fixes and cleanups for Tegra234 and
Tegra194. Tegra264 sees a number of additions to enable more features.
* tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (1469 commits)
arm64: tegra: Correct Tegra234 p3740 interrupt flags
arm64: tegra: Correct Tegra234 p3737 interrupt flags
arm64: tegra: Correct Tegra194 p2972 interrupt flags
arm64: tegra: Drop CPU masks from GICv3 PPI interrupts
arm64: tegra: Add Lenovo ThinkEdge SE70 device tree
arm64: tegra: Add pinctrl nodes for Tegra264
arm64: tegra: Fix CMDQV interrupt type on Tegra264
arm64: tegra: Properly sort devices on Tegra264
arm64: tegra: Add GTE nodes for Tegra264
arm64: tegra: Add Host1x and VIC on Tegra264
arm64: tegra: Populate CPU and L2 cache nodes on Tegra264
arm64: tegra: Enable GPCDMA in Tegra264 and add iommu-map
Linux 7.2-rc5
super: fix emergency thaw deadlock on frozen block devices
tracing: perf: Fix stale head for perf syscall tracing
ftrace: Add global mutex to serialize trace_parser access
tracing: Delay module ref count for "enable_event" trigger
tracing: Fix use-after-free freeing trigger private data
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
tracing: Fix context switch counter truncation
...
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt fixes from Greg KH:
"Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that
resolve some reported issues. Included in here are:
- new quirk for some broken USB devices
- thunderbolt device fixes for reported issues
- usb gadget driver fix
- usb atm driver fix
- xhci driver fixes.
- other minor USB driver fixes
All of these have been in linux-next this week with no reported
issues"
* tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
usb: quirks: Add ShanWan gamepad to quirk list
usb: hub: Split announce_device() to log device identity before enumeration
usb: core: Add quirk for 255-bytes initial config read
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
usb: gadget: f_ncm: Use unsigned int for ndp_index
usb: cdnsp: fix incorrect endian conversions for APB timeout register
thunderbolt: Initialize ->domain_released completion before it is being used
thunderbolt: icm: Preserve USB4 proxy data-valid bit
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
thunderbolt: Fix bandwidth group reservation indexing
thunderbolt: stream: Unmap buffers with mapped size
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty / serial / vt driver fixes from Greg KH:
"Here are some small serial and vt tty driver fixes for 7.2-rc7 that
resolve some reported problems. Included in here are:
- two vt core fixes
- amba-pl011 serial driver fixes
- 8250_of and 8250_dma driver fixes
- qcom-geni serial driver fix
- sc16is7xx serial driver fix
All of these have been in linux-next this week with no reported
issues"
* tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: amba-pl011: synchronize DMA teardown
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
serial: amba-pl011: fix indefinite RS485 post-send delay
vt: add permission check for KDSKBMETA ioctl
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
serial: qcom-geni: fix TX DMA buffer flush
serial: 8250_dma: Clear stale RX state on shutdown
serial: sc16is7xx: enable THRI before filling TX FIFO
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are some more small staging driver fixes, just for the rtl8723bs
driver, for some reported problems found with it now that people are
starting to actually test the thing with "bad" networks.
Nothing major, but good to have in the -final release. All of these
have been in linux-next for over a week with no reported problems"
* tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8723bs: validate monitor transmit frame lengths
staging: rtl8723bs: fix missing shared-key auth challenge length check
staging: rtl8723bs: fix OOB read in WMM_param_handler()
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char / misc and documentation fixes from Greg KH:
"Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems"
* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
docs: security-bugs: clarify some mandatory steps for AI reports
docs: coding-assistant: explain important steps when looking for bugs
docs: security-bugs: clarify what counts as a valid version
docs: threat-model: move fake devices out of "non production use"
docs: threat-model: clarify "security bug" vs "vulnerability"
counter: microchip-tcb-capture: Fix DT channel validation
mei: pull kvfree out of spinlock
rust_binder: do not query current thread for all ioctls
nvmem: layouts: Add fixed-layout driver
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into soc/dt
RISC-V SpacemiT DT changes for 7.3
For K3 SoC
- Enable SD card support
- Enable QSPI
- Fix reset delay of ETH PHY
- Fix PHY ID of ETH
- Symbolic PDAM ID
- Add SPI controller support
- Add USB and PHY support
- Add I2S nodes
For K1 SoC
- Symbolic PDAM ID
- Enable cpufreq support
- Fix max CPU core voltage
For boards of K3
- Pico-ITX
- Enable ALDPS on RTL8211F PHY
- Disable 125MHz clock on RTL8211F PHY
- Enable NOR flash
- Add EEPROM support
- CoM260
- Add EEPROM support
For boards of K1
- Milk-V Jupiter
- Enable CPU DVFS
- Banana Pi BPI-CM6
- Add initial support
- OrangePi R2S
- Enable PCIe
* tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: (33 commits)
riscv: dts: spacemit: Add cpu scaling for Milk-V Jupiter
riscv: dts: spacemit: k1-bananapi-cm6: fix maximum CPU core voltage
riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage
riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage
riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage
riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage
riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage
riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board
riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board
riscv: dts: spacemit: k3: add i2s0-i2s5 nodes
riscv: dts: spacemit: k3: add USB controller and USB phy support
riscv: dts: spacemit: enable PCIe on OrangePi R2S
riscv: dts: spacemit: k3-com260-ifx: add eeprom on i2c1
riscv: dts: spacemit: k3-com260: add eeprom on i2c2
riscv: dts: spacemit: add SPI controllers for K3
riscv: dts: spacemit: add K3 PDMA request numbers
riscv: dts: spacemit: Fix phy id check for the phy on com260 board
riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board
riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board
riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX
...
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
drivers/parisc/eisa_eeprom.c is a standalone module (it has MODULE_LICENSE()
and module_init()) but is missing the MODULE_DESCRIPTION() macro, so modpost
emits a warning about it. Add the missing description.
Signed-off-by: Jean Delu <jeandelu@tutamail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev fixes from Helge Deller:
"A few patches for the core fbdev layer which stabilize or fix
potential issues with text font rendering after screen rotation or
after user initiated font changes and locking fixes for sysfb during
modifications of the graphics mode database"
* tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
fbdev: bitblit: bound-check glyph index in bit_cursor()
fbdev: Fix out-of-bounds access when rotating console after font resize
fbdev: core: Fix pointer desynchronization in fb_io_read()
fbdev: serialize mode sysfs access with lock_fb_info()
fbdev: clear fb_info->mode before deleting a videomode
fbdev: bound mode sysfs output to the sysfs buffer
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- Fixes for information leaks and OOB accesses across several drivers,
including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra
- Improvements to the synaptics-rmi4 driver to properly handle F54
worker errors and prevent buffer overflows
- Input validation fixes in the hynitron_cstxxx touchscreen driver to
prevent issues with invalid finger IDs and touch counts
- Fixes for use-after-free and initialization bugs in the byd mouse and
psxpad-spi drivers
- New quirks for the atkbd driver to make keyboard work on HONOR and
Xiaomi laptops
- Support for the ZENAIM LEVERLESS controller in the xpad driver.
* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: evdev - sanitize event type index when fetching event masks
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: hynitron_cstxxx - validate touch count and finger IDs
Input: evdev - fix information leak in evdev_pass_values()
fixp-arith: convert comments to kernel-doc format
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: atkbd - skip deactivate for HONOR ZQC-P
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: iforce - validate input packet lengths
Input: psxpad-spi - set driver data before use
Input: cs40l50-vibra - validate custom data from user space
Input: xpad - add support for ZENAIM LEVERLESS
Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
Input: byd - synchronize timer deletion before freeing private data
|
|
renesas_i3c_daa() derives the number of newly assigned dynamic addresses
from cmd->rx_count, which the response ISR sets to the number of address
slots ENTDAA left unassigned. It starts out as zero, which already means
"every address was assigned", so a timed out transfer leaves that value
in place and it gets used as a result.
On a bus with no target connected the ENTDAA times out and the driver
registers RENESAS_I3C_MAX_DEVS devices that are not there, each costing
the core two seconds on a GETPID that can only time out:
i3c i3c-0: Failed to add I3C device at address 9, error -110
...
i3c i3c-0: Failed to add I3C device at address 16, error -110
Start from maxdevs instead: no address is assigned before ENTDAA runs,
and the existing rx_count >= maxdevs check then reports an empty bus.
Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller")
Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> # on RZ/G3S
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260731070150.2519825-1-tommaso.merciai.xr@bp.renesas.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Implement ->set_speed() so the I3C core can switch open-drain timing for
the first broadcast address per spec: I3C_OPEN_DRAIN_SLOW_SPEED programs
tHIGH_INIT (200 ns) before RSTDAA, and I3C_OPEN_DRAIN_NORMAL_SPEED restores
normal OD timing afterward. Cache the normal OD register value during bus
init and use a separate od_hcnt for the slow path so SDR extended timing
remains derived from the normal PP hcnt.
For AMD_I3C_OD_PP_TIMING, cache AMD_I3C_OD_TIMING as the normal OD
baseline and stop rewriting OD timing in send_ccc_cmd()/runtime resume so
I3C_OPEN_DRAIN_SLOW_SPEED is preserved through RSTDAA.
Use PM_RUNTIME_ACQUIRE_AUTOSUSPEND() in set_speed(). Compute od_hcnt with
DIV_ROUND_UP_ULL() for 32-bit safety and clamp it to U8_MAX to match the
8-bit I3C_OD_HCNT field.
Fixes I2C devices with spike filters not being detected on mixed buses.
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/d789219ca0418898a1ef2bf9295b4f96ca7b4209.1785484707.git.tze.yee.ng@altera.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Set master->ibi_wakeup during probe when the associated system device
advertises wakeup capability, allowing the I3C core to mark IBI-capable
I3C devices as wakeup capable.
Tweak the comment for i3c_hci_sysdev() to mention the new usage.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-15-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
The MIPI I3C HCI driver needs to identify the underlying system device
used for DMA mapping and PM operations. The logic for determining that
device is currently embedded in the DMA implementation.
Factor this code out into i3c_hci_sysdev() so it can be shared by other
parts of the driver and keep the device-selection logic in one place.
The explanatory comment moves with the code, reworked as kernel-doc now
that it documents a function rather than an inline block.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260807145638.168865-14-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Keep the PCI wakeup state aligned with the wakeup requirements of the
devices served by the controller(s).
The PCI function is the wakeup source for HCI instances exposed beneath
it. However, wakeup is only needed when at least one attached I3C device
is enabled as a wakeup source.
During suspend, check whether any HCI instance has a wakeup-enabled I3C
device and enable wakeup for the PCI function only in that case.
Otherwise leave PCI wakeup disabled.
Note, the suspend callback is used for both system and runtime suspend.
Although this change may update the PCI wakeup state during runtime
suspend, it does so only when the required wakeup state changes.
Moreover, PCI wakeup-capable devices already have PME wakeup armed for
runtime suspend, so changing the wakeup-enabled state does not affect
runtime PM wakeup behavior.
Note also, since the PCI wakeup state is derived from the wakeup
configuration of the attached I3C devices, the PCI device power/wakeup
sysfs attribute no longer provides independent wakeup control.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-13-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_request_ibi() does not verify that a device advertises IBI
support before attempting to set up IBI handling.
Add a check for I3C_BCR_IBI_REQ_CAP and fail with -EOPNOTSUPP when IBI
support is not reported by the device. This keeps IBI setup consistent
with other IBI-related functionality, such as exposing wakeup capability
only for IBI-capable devices.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-12-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Add i3c_master_has_wakeup_enabled_devs(), which iterates over the devices
on an I3C bus and reports whether any of them are enabled for system
wakeup and have IBI enabled.
Controller drivers can use this helper to determine whether wakeup
support must remain available while the system is suspended.
Acked-by : Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-11-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
An I3C device configured as a wakeup source can wake the system by
generating an In-Band Interrupt (IBI).
When an IBI is queued for processing, record a wakeup event for the
device if wakeup is enabled. Use a 100 ms processing interval to give
the I3C device driver time to process the IBI.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-10-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
An I3C controller acts as a bus controller for one or more I3C devices.
If the controller can wake the system in response to an In-Band
Interrupt (IBI), then any device on that bus that is capable of
generating IBIs can potentially be used as a wakeup source.
Add an ibi_wakeup flag to struct i3c_master_controller so controller
drivers can advertise support for IBI-based wakeup.
If set, mark IBI-capable I3C devices as wakeup capable when they are
registered, allowing wakeup management through the standard device
wakeup framework.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260807145638.168865-9-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_match() dereferences i3cdev->desc without holding the bus
normal-use lock. Since the descriptor pointer can be replaced
concurrently, the dereference can race with descriptor replacement and
result in a use-after-free.
Protect access to i3cdev->desc with the normal-use lock. While the lock
is held, the descriptor is guaranteed to remain valid, so the NULL check
is also unnecessary and can be removed.
This change depends on "i3c: master: Fix recursive locking during device
registration". Prior to that change, taking the normal-use lock in
i3c_device_match() could recurse on bus->lock during device
registration.
Fixes: 3456baa2110c ("i3c: master: match I3C device through DT and ACPI")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-8-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_uevent() dereferences i3cdev->desc without holding the bus
normal-use lock. Since the descriptor pointer can be replaced
concurrently, including when a uevent is generated from sysfs, this can
result in dereferencing a stale descriptor and lead to a use-after-free.
Use i3c_device_get_info() instead, which protects access to the
descriptor with the normal-use lock.
Commit 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling
i3c_device_get_info() to avoid deadlock") replaced the accessor with a
direct descriptor dereference because i3c_device_get_info() would
recursively acquire bus->lock during device registration.
This change depends on "i3c: master: Fix recursive locking during device
registration", which moves device registration out from under bus->lock
and removes the possibility of that deadlock. Without that change,
restoring the i3c_device_get_info() call would reintroduce the deadlock.
Fixes: 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock")
Cc: stable@vger.kernel.org # requires "i3c: master: Fix recursive locking during device registration"
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-7-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_get_info() takes the bus normal-use lock before accessing
dev->desc. Under that lock, the descriptor pointer is guaranteed to be
valid for the duration of the access.
Remove the unnecessary NULL check on dev->desc so the code more clearly
reflects the locking rules and expected descriptor lifetime.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-6-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
sysfs attribute callbacks for the master controller device dereference
master->this. However, master->this is freed in
i3c_master_detach_free_devs() before the master device itself is
released.
As a result, sysfs accesses can dereference a freed master->this
pointer, leading to a use-after-free.
Keep master->this alive until i3c_masterdev_release(), which is called
after the master device and its sysfs state are being torn down. Do not
free master->this as part of the normal device detach path.
On the error path in i3c_master_set_info(), reset master->this and
bus.cur_master to NULL before freeing the allocated device.
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-5-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_master_search_i3c_dev_duplicate() searches the bus for another I3C
device with the same PID as the reference device. The search can match
master->this, causing the controller itself to be returned as a
duplicate.
Since the controller is not a target device, it cannot be a duplicate of
one. Exclude master->this from matching so that the function only
returns real duplicate target devices.
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260807145638.168865-4-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_get_supported_xfer_mode()
i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the
master controller. However, dev->desc must not be dereferenced unless
bus->lock is held, and this function does not take that lock.
The function only needs access to the master controller associated with
the device's bus. Use dev->bus instead, which is always valid for the
lifetime of the device and does not require dereferencing dev->desc.
Fixes: 256a21743d91 ("i3c: Add HDR API support")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-3-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_master_register_new_i3c_devs() registers newly discovered devices
while holding i3c_bus_normaluse_lock(), a down_read(). device_register()
can immediately probe the device, and probe callbacks typically invoke
I3C helpers that take i3c_bus_normaluse_lock() again, leading to a
recursive acquisition of the same rwsem. rwsems do not support recursive
read locking and can deadlock when a writer is waiting. See the
"Recursive read locks" section of Documentation/locking/lockdep-design.rst.
For example, with Intel LPSS I3C, LOCKDEP generates a WARNING like:
# echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/unbind
# echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/bind
WARNING: possible recursive locking detected
kworker/5:1/94 is trying to acquire lock:
ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370
but task is already holding lock:
ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0
Fix this by separating device creation from device registration.
Populate desc->dev under the maintenance lock, collect the devices that
still need registration into a local list, then release the lock before
calling device_register(). Finally retake the lock and clean up any
devices that failed to register.
Use the maintenance lock rather than the normal-use lock while adding
device objects. A write-side maintenance lock prevents readers from
observing a partially initialized desc->dev during initial device
population, or desc->dev disappearing if registration fails.
The local list requires a list node, so add a list node member to struct
i3c_device.
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-2-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
bit_cursor() fetches the glyph under the cursor with
c = scr_readw(vc_pos);
src = vc_font.data + ((c & charmask) * w * height);
where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer
value comes directly from scr_readw() and may be larger than the current
font's glyph count.
Syzkaller triggers this via vcs_write(). The Call Trace shows
vcs_write() in vc_screen.c writing an arbitrary 16-bit value with
writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via
vcs_scr_writew() without checking charcount. The stored value is later
read in bit_cursor() in bitblit.c.
When the font is changed from a font with 512 glyphs to a font with
256 glyphs, the screen buffer can retain characters with the high
bit set from the previous mode, which could also produce the same
out-of-bounds access.
BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr ffff800086c57970
Call Trace:
soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365
fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427
hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883
update_region+0x100/0x18c drivers/tty/vt/vt.c:669
vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685
bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph
index to vc_font.charcount. Apply the same clamp in bit_cursor() after
extracting the attribute and masking, before indexing fontdata.
The fix completes the bounds checking started in commit 18c4ef4e765a
("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed
the cursor path.
This change should be safe because the clamp reuses the existing
contract from fbcon: charcount is maintained under console_lock in
con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when
switching from 512 to 256 glyphs. When stale screen data with high bits
remains after a font switch, or when vcs_write() stores an arbitrary
value, clamping the index to 0 prevents the out-of-bounds read without
changing cursor semantics — the same fallback bit_putcs uses.
Reported-by: syzbot+61b1db46218109869c14@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=61b1db46218109869c14
Link: https://lore.kernel.org/all/6a75205c.01d0871a.3a0d52.0032.GAE@google.com/
Fixes: 18c4ef4e765a ("fbdev: bitblit: bound-check glyph index in bit_putcs*")
Cc: stable@vger.kernel.org
Assisted-by: Hermes:muse-spark-1.2 syzkaller
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
