summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-17rust_binder: Implement BINDER_DEBUG_USER_ERROR for transaction parsing failuresJahnavi MN
This adds dynamic debug logs in `thread.rs` for: - File descriptor array (FDA) parent offset and parent buffer address alignment misalignments. - Memory copy, write, and translation failures during transaction serialization (including out-of-bounds pointer fixups). - Incoming transactions or replies that do not match the expected thread calling stack (such as out-of-order replies). Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-4-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_USER_ERROR for refcounting and death ↵Jahnavi MN
notifications This adds dynamic debug logs for: - Decrementing handle reference counts that are already zero. - Mismatched reference states (calling inc_ref_done with no active inc_refs, or using a weak reference as a strong reference). - Requesting or clearing death notifications on invalid references, already active notifications, or with mismatched cookies. Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-3-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Implement BINDER_DEBUG_USER_ERROR for freezer-related operationJahnavi MN
This adds dynamic debug logs for: - Requesting freeze notifications on invalid references, duplicate cookies, or already active registrations. - Completing freeze notifications that are not pending or not found. - Clearing freeze notifications on invalid references, inactive notifications, or cookie mismatches. Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-2-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17rust_binder: Add dynamic debug logging maskJahnavi MN
Implement a dynamic debug logging mask (`debug_mask`) for the `rust_binder` module to allow dynamic runtime configuration of log levels. This enables parity with the legacy C driver's debug mask. Since the Rust `module!` macro in the current kernel build does not yet support declaring module parameters directly in Rust, we define the `debug_mask` variable in Rust as an `Atomic<u32>` exported via FFI using `#[no_mangle]`, and link to it as `extern` in a C companion file to expose it to the kernel runtime. To verify the setup, instrument process lifecycle events (open, flush, and release) in `process.rs` under the new `BINDER_DEBUG_OPEN_CLOSE` logging mask. These entry-point events are chosen for initial validation because they represent the start of the Binder lifecycle and occur at low frequency, allowing simple runtime verification of the dynamic toggle without log noise. Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jahnavi MN <jahnavimn@google.com> Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-1-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17mei: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260717100533.601899-4-panchuang@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: Remove redundant dev_err()/dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() and devm_request_threaded_irq() automatically log detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260717100533.601899-3-panchuang@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: bcm-vk: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260717100533.601899-2-panchuang@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: Drop unused assignments from pnp_device_id arraysUwe Kleine-König (The Capable Hub)
Explicitly assigning .driver_data in drivers that don't use this member is silly and a bit irritating. Drop these. Also simplify the list terminator entry to be just empty to match what most other device_id tables do. There is no changed semantic, not even a change in the compiled result. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/c938b407cc16e9db2a59c67f390f073eeee6f1b3.1781016848.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17mei: lb: fix incorrect type in assignmentAlexander Usyskin
Fix the mix between __le32 and integer by casting the MEI_LB2_CMD constant as __le32 while using it. Fixes sparse waring: drivers/misc/mei/mei_lb.c:284:32: sparse: sparse: restricted __le32 degrades to integer drivers/misc/mei/mei_lb.c:330:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] command_id @@ got int @@ drivers/misc/mei/mei_lb.c:330:40: sparse: expected restricted __le32 [usertype] command_id drivers/misc/mei/mei_lb.c:330:40: sparse: got int Fixes: 773a43b8627f ("mei: lb: add late binding version 2") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605091533.79Zcv3CX-lkp@intel.com/ Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://patch.msgid.link/20260709-fix_type_le-v3-1-478761151e05@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: layouts: u-boot-env: check earlier for ethaddr lengthTomasz Maciej Nowak
Unfortunately the ethaddr value in U-Boot environment might be enclosed in single/double quotes or be something completely different. This can make it different than MAC_ADDR_STR_LEN, which results in EINVAL returned by ethaddr post process. Move the check for length earlier, to skip post processing, so nvmem could still present ethaddr value as a string if the value doesn't match MAC_ADDR_STR_LEN. Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-15-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: cleanup dead code in KconfigJulian Braha
There is already an 'if NVMEM' condition wrapping NVMEM_RCAR_EFUSE, making the 'depends on' statement a duplicate dependency (dead code). I propose leaving the outer 'if NVMEM...endif' and removing the individual 'depends on' statement. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha <julianbraha@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-14-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: qcom: Unify user-visible "Qualcomm" nameKrzysztof Kozlowski
Various names for Qualcomm as a company are used in user-visible config options: QCOM, Qualcomm and Qualcomm Technologies. Switch to unified "Qualcomm" so it will be easier for users to identify the options when for example running menuconfig. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-13-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: airoha: Add support for SMC eFUSEChristian Marangi
Add support for SMC eFUSE on AN7581 SoC. The SoC have 2 set of 2048 bits of eFUSE that are used to read calibration value for PCIe, Thermal, USB and other specific info of the SoC like revision and HW device present. eFuse value are taken by sending SMC command. ATF is responsible of validaing the data and rejecting reading protected data (like Private Key). In such case the SMC command will return non-zero value on a0 register. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-12-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: lan9662-otp: add support for LAN969xHoratiu Vultur
Microchip LAN969x provides OTP with the same control logic, only the size differs as LAN969x has 16KB of OTP instead of 8KB like on LAN966x. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Signed-off-by: Robert Marko <robert.marko@sartura.hr> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-9-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: nintendo-otp: Use of_device_get_match_data()Rosen Penev
Use of_device_get_match_data() to retrieve the devtype data instead of open-coding the OF match lookup and dereferencing match->data. This also replaces the deprecated of_device.h include with of.h. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: core: Default to read-only if wp-gpios presentMarek Vasut
In case the nvmem DT node contains "wp-gpios" DT property, the device currently defaults to read-write and the force_ro sysfs attribute reads 0. Switch to the default read-only, which is both safer, and aligned with eMMC HW BOOT partition force_ro sysfs attribute behavior, which also defaults to read-only. The adjustment of nvmem->read_only value to read-only in case wp-gpios DT property is present must be done only after the device_add() got called because device_add() does internally call nvmem_bin_attr_get_umode(), which configures the permissions of 'nvmem' bin attr based on the value of nvmem->read_only that is only parsed from DT property 'read-only', without any adjustment. This way, if DT property 'read-only' is present, the 'nvmem' attribute is always read-only. Otherwise, if the device is writeable, then 'nvmem' attribute is writeable, and nvmem->read_only defaults to read-only, but can be switched to read-write at runtime via the 'force_ro' attribute. The updated behavior can be tested as follows: Current content: " $ cat /sys/bus/nvmem/devices/logging7/force_ro 1 $ hexdump -C /sys/bus/nvmem/devices/logging7/nvmem 00000000 66 6f 6f 0a ff ff ff ff " Write into default-read-only device: " $ echo bar > /sys/bus/nvmem/devices/logging7/nvmem bash: echo: write error: Operation not permitted $ cat /sys/bus/nvmem/devices/logging7/force_ro 1 " Unlock and write into device: " $ echo 0 > /sys/bus/nvmem/devices/logging7/force_ro $ cat /sys/bus/nvmem/devices/logging7/force_ro 0 $ echo bar > /sys/bus/nvmem/devices/logging7/nvmem $ hexdump -C /sys/bus/nvmem/devices/logging7/nvmem 00000000 62 61 72 0a ff ff ff ff " Relock and write into device, fails because device is read-only again: " $ echo 1 > /sys/bus/nvmem/devices/logging7/force_ro $ echo baz > /sys/bus/nvmem/devices/logging7/nvmem bash: echo: write error: Operation not permitted $ hexdump -C /sys/bus/nvmem/devices/logging7/nvmem 00000000 62 61 72 0a ff ff ff ff " Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17nvmem: rockchip-otp: alloc clks with main structRosen Penev
Use a flexible array member to simplify allocation slightly. No need for a separate calloc. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260530205333.117458-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: quatech_daqp_cs: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the dev->read_dev pointer which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-12-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcmuio: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler pcmuio_interrupt() to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->subdevices by pcmuio_handle_asic_interrupt(). Also make use of the IRQ_HANDLED(x) macro for the normal return path of the interrupt handler. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-11-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcmmio: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-10-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcm818: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the dev->read_dev pointer which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-9-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcm816: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the devpriv->dma pointer which may be NULL if dev->attached is false. Move the dereference of the devpriv->dma pointer after dev->attached has been checked to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-8-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: pcm711: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing the dev->read_dev pointer which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-7-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: ni_atmio16d: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-6-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: ni_at_a2150: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device before it is fully set up. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing various pointers which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereferences. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-5-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: dt2811: Fix sanity check in interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, the interrupt handler checks the dev->attached flag to ensure the device is fully set up, but it currently does that after dereferencing dev->read_subdev, which may be NULL if dev->attached is false. Move the check to avoid the possible null pointer dereference. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-4-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: das6402: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: aio_iiro_16: Add sanity check to interrupt handlerIan Abbott
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: ni_pcimio: set PCI-6220 dio_speed and ai_fifo_depth from NI specsShashwat Agrawal
The PCI-6220 board entry was missing .dio_speed, unlike the PXI-6220 and the other 622x boards in the table. Set it to 1000 ns to match those entries and the 1 MHz maximum DI/DO sample clock on Port 0 in the NI PCI/PXI-6220 specifications. Also update .ai_fifo_depth for PCI-6220 and PXI-6220 from 512 to 4095 samples, matching the documented AI input FIFO size and the rest of the 622x entries. Link: https://www.ni.com/docs/en-US/bundle/pci-pxi-6220-specs/page/specs.html Signed-off-by: Shashwat Agrawal <shashwatagrawal473@gmail.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260629135404.19835-1-shashwatagrawal473@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: speakup: unregister tty ldisc on later init failuresHaoxiang Li
The ldisc registration is intentionally non-fatal, since some synth drivers do not use tty/ldisc. However, once speakup_init() continues past the registration point and later fails, the init unwind path should mirror speakup_exit() and call spk_ttyio_unregister_ldisc(). Add the missing unregister call to the error path after synth_release(), matching the normal module exit cleanup order. Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Fixes: e23a9b439ce9 ("staging: speakup: safely register and unregister ldisc") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260531230804.254962-16-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: speakup_soft: fix comment style and repeated wordFrancisco Maestre
Fix comment style issues in speakup_soft.c: - Move the closing '*/' of the block comment to its own line, as required by the kernel coding style Signed-off-by: Francisco Maestre <francisco@maestretorreblanca.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-15-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix typo in a speakup messageBastien Nocera
s/read windo/read window/ Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-14-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix incorrect "index" pluralBastien Nocera
It's indexes or indices. Given that the constant is called "STAT_index_valid", "indexes" was the preferred plural. Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-13-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix spelling of "re-enable"Bastien Nocera
Detected using codespell. Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-12-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17Accessibility: speakup_soft: Fix double word in commentsBo Liu
Remove the repeated word "the" in comments. Signed-off-by: Bo Liu <liubo03@inspur.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-11-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: keyhelp: guard letter_offsets possible out-of-range indexingPavel Zhigulin
help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. Function names can be overridden with the following commands as root: modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound. Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-10-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: Use str_plural() to simplify the codeXichao Zhao
Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-9-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Standardize character attribute types to u16Jagadeesh Yalapalli
This change replaces non-portable `u_short` types with standardized `u16` throughout the speakup subsystem to ensure: 1. Consistent 16-bit width across all architectures. 2. Improved code portability and readability. 3. Elimination of platform-dependent type sizes. 4. Safe bitwise operations without sign-extension risks. Signed-off-by: Jagadeesh Yalapalli <jagadeesh.yalapalli@einfochips.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-8-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix the wrong format specifierliujing
Make a minor change to eliminate a static checker warning. The type of '(unsigned int)kp[i]' is unsigned int, so the correct format specifier should be %u instead of %d. Signed-off-by: liujing <liujing@cmss.chinamobile.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-7-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: genmap: remove redundant post-incrementbajing
In the while loop, the variable lc is unused and is reinitialized later, so this redundant operation should be removed. Signed-off-by: bajing <bajing@cmss.chinamobile.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-6-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: speakup: Fix incorrect string length computation in ↵Christophe JAILLET
report_char_chartab_status() snprintf() returns the "number of characters which *would* be generated for the given input", not the size *really* generated. In order to avoid too large values for 'len' (and potential negative values for "sizeof(buf) - (len - 1)") use scnprintf() instead of snprintf(). Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260531230804.254962-5-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup/utils: use "!P" instead of "P == 0"Xu Panda
comparing pointer to 0, use !P instead of it. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Xu Panda <xu.panda@zte.com.cn> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-4-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility/speakup/speakup_dtlk: Add header file macro definitionLi zeming
Add header file macro definition. Signed-off-by: Li zeming <zeming@nfschina.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-3-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility/speakup/speakup_acnt: Add header file macro definitionLi zeming
I think the header file could avoid redefinition errors. at compile time by adding macro definitions. Signed-off-by: Li zeming <zeming@nfschina.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-2-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17uio: make read-only const array porttypes staticColin Ian King
Don't populate the read-only const array porttypes on the stack at run time, instead make it static const char * const Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20260714185624.192829-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17uio: sercos3: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has a match table for the pci bus wired into its driver structure, but the table is not exported with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE() entry so module alias information is generated for automatic module loading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the driver registration structure, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704152642.54769-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17uio: Fix stale info pointer in failed registration pathYuho Choi
After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device(). Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Link: https://patch.msgid.link/20260630192714.1867170-1-dbgh9129@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17parport: Consistently define pci_device_ids using named initializersUwe Kleine-König (The Capable Hub)
... and PCI device helpers. The various struct pci_device_id arrays were initialized mostly by list expressions. This isn't easily readable if you're not into PCI. Use PCI_DEVICE* helper macros and named initializers which is more explicit and thus easier to parse. Also skip explicit assignments of 0 (which the compiler then takes care of). The secret plan is to make struct pci_device_id::driver_data an anonymous union (similar to https://lore.kernel.org/all/cover.1776579304.git.u.kleine-koenig@baylibre.com/) and that requires named initializers. But it's also a nice cleanup on its own. This change doesn't introduce changes to the compiled pci_device_id arrays. Tested on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260429161453.4154681-2-u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: Improve style of pnp_device_id array terminatorsUwe Kleine-König (The Capable Hub)
To match how device-id array terminators look like for other device types drop `.id = ""` from it and let the compiler care for zeroing the entry. While touching these arrays, also align spacing to how these arrays are usually written. There are no changes in the compiled drivers, only the source looks nicer. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/f23c9d77836f3b14b1efc58e3969333e8addb1c1.1781078782.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: Initialize pci_device_ids using PCI_DEVICE macrosUwe Kleine-König (The Capable Hub)
The PCI_DEVICE macro and its variants allow to initialize the first four members of a struct pci_device_id in a bit more compact form and also with an easier to grasp semantic. Explicit zeros are not needed, the compiler fills these in automatically. So convert all array members to such a macro and drop unneeded zeros. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260629165426.3330888-2-u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>