summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-07ALSA: timer: Forcibly close timer instances at closingTakashi Iwai
When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all instances and just set NULL to each ti->timer, then releases the resources immediately. The problem is, however, when there are slave timer instances that are associated with a master instance linked to this timer: namely, those slave instances still point to the freed timer object although the master instance is unlinked, which may lead to user-after-free. The bug can be easily triggered particularly when a new userspace-driven timers (CONFIG_SND_UTIMER) is involved, since it can create and delete the timer object via a simple file open/close, while the other applications may keep accessing to that timer. This patch is an attempt to paper over the problem above: now instead of just unlinking, call snd_timer_close[_locked]() forcibly for each pending timer instance, so that all assigned slave timer instances are properly detached, too. Since snd_timer_close() might be called later by the driver that created that instance, the check of SNDRV_TIMER_IFLG_DEAD is added at the beginning, too. Reported-by: Kyle Zeng <kylebot@openai.com> Tested-by: Kyle Zeng <kylebot@openai.com> Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260606161145.1933447-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-07riscv: kexec: use min to simplify riscv_kexec_elf_loadThorsten Blum
Use min() to replace the open-coded version and assign the result directly to kbuf.bufsz. Drop the now-unused local size variable. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260602224725.1088385-3-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-07riscv: panic if IRQ handler stacks cannot be allocatedOsama Abdelkader
init_irq_stacks() and init_irq_scs() may fail when arch_alloc_vmap_stack or scs_alloc return NULL, call panic() in this case. Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Link: https://patch.msgid.link/20260404185522.21767-1-osama.abdelkader@gmail.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-07RISC-V: KVM: Fix skip of valid pages in kvm_riscv_gstage_unmap_rangeWu Fei
Same as kvm_riscv_gstage_wp_range, the possible valid pages should not be skipped if !found_leaf. Different from wp case, which can write-protect more than asked, unmap can't do that, no splitting is added right now but a warning is logged instead. Signed-off-by: Wu Fei <wu.fei9@sanechips.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260604230317.30501-3-atwufei@163.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-07RISC-V: KVM: Fix skip of valid pages in kvm_riscv_gstage_wp_rangeWu Fei
The current gstage range walker unconditionally advances by 'page_size' when a leaf PTE is not found, e.g. when the range to wp is [0xfffff01fc000, 0xfffff023c000) and page_size is 2MB, if found_leaf of 0xfffff01fc000 returns false, it skip the whole range, but it's possible to have valid entries in [0xfffff0200000, 0xfffff023c000). Signed-off-by: Wu Fei <wu.fei9@sanechips.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260604230317.30501-2-atwufei@163.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-06riscv: mm: Unconditionally sfence.vma for spurious faultVivian Wang
Svvptc does not guarantee that it's safe to just return here. Since we have already cleared our bit, if, theoretically, the bounded timeframe for the accessed page to become valid still hasn't happened after sret, we could fault again and actually crash. Hopefully, these spurious faults should be rare enough that this is an acceptable slowdown. Cc: stable@vger.kernel.org Fixes: 503638e0babf ("riscv: Stop emitting preventive sfence.vma for new vmalloc mappings") Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://patch.msgid.link/20260303-handle-kfence-protect-spurious-fault-v2-5-f80d8354d79d@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: mm: Use the bitmap API for new_valid_map_cpusVivian Wang
The bitmap was defined with incorrect size. Fix it by using the proper bitmap API in C code. The corresponding assembly code is still okay and remains unchanged. Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://patch.msgid.link/20260303-handle-kfence-protect-spurious-fault-v2-4-f80d8354d79d@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: mm: Rename new_vmalloc into new_valid_map_cpusVivian Wang
Since this mechanism is now used for the kfence pool, which comes from the linear mapping and not vmalloc, rename new_vmalloc into new_valid_map_cpus to avoid misleading readers. No functional change intended. Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://patch.msgid.link/20260303-handle-kfence-protect-spurious-fault-v2-3-f80d8354d79d@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()Vivian Wang
In kfence_protect_page(), which kfence_unprotect() calls, we cannot send IPIs to other CPUs to ask them to flush TLB. This may lead to those CPUs spuriously faulting on a recently allocated kfence object despite it being valid, leading to false positive use-after-free reports. Fix this by calling mark_new_valid_map() so that the page fault handling code path notices the spurious fault and flushes TLB then retries the access. Update the comment in handle_exception to indicate that new_valid_map_cpus_check also handles kfence_unprotect() spurious faults. Note that kfence_protect() has the same stale TLB entries problem, but that leads to false negatives, which is fine with kfence. Cc: stable@vger.kernel.org Reported-by: Yanko Kaneti <yaneti@declera.com> Fixes: b3431a8bb336 ("riscv: Fix IPIs usage in kfence_protect_page()") Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://patch.msgid.link/20260303-handle-kfence-protect-spurious-fault-v2-2-f80d8354d79d@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: mm: Extract helper mark_new_valid_map()Vivian Wang
In preparation of a future patch using the same mechanism for non-vmalloc addresses, extract the mark_new_valid_map() helper from flush_cache_vmap(). No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://patch.msgid.link/20260303-handle-kfence-protect-spurious-fault-v2-1-f80d8354d79d@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframeRui Qi
In the non-frame-pointer version of walk_stackframe, each value read from the stack is treated as a potential return address and has 0x4 subtracted before being used as the program counter. This was intended to convert the return address (the instruction after a call) back to the call site, but it is incorrect: 1. RISC-V has variable-length instructions due to the RVC (compressed instruction) extension. A call instruction can be either 4 bytes (regular) or 2 bytes (compressed, e.g. c.jal). Subtracting a fixed 0x4 assumes all call instructions are 4 bytes, which is wrong for compressed instructions. 2. Stack traces conventionally report return addresses, not call sites. Other architectures (ARM64, x86, ARM) do not subtract instruction size from return addresses in their stack unwinding code. 3. The frame-pointer version of walk_stackframe already dropped the -0x4 offset. Commit b785ec129bd9 ("riscv/ftrace: Add HAVE_FUNCTION_GRAPH_RET_ADDR_PTR support") replaced "pc = frame->ra - 0x4" with ftrace_graph_ret_addr(), and the commit message explicitly noted that "the original calculation, pc = frame->ra - 4, is buggy when the instruction at the return address happened to be a compressed inst." The non-FP version was simply overlooked. Remove the bogus -0x4 offset to match the FP version and the conventions used by other architectures. Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly") Signed-off-by: Rui Qi <qirui.001@bytedance.com> Link: https://patch.msgid.link/20260603115329.791603-2-qirui.001@bytedance.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: cacheinfo: Fix node reference leak in populate_cache_leavesZishun Yi
Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final of_node_put(np) correctly drops the reference to the current node. However, if the loop terminates naturally because np == NULL, calling of_node_put(np) is a no-op. This leaves the last valid node stored in prev without its reference dropped, resulting in a node reference leak. Fix this by changing the final `of_node_put(np)` to `of_node_put(prev)`. Fixes: 94f9bf118f1e ("RISC-V: Fix of_node_* refcount") Cc: stable@vger.kernel.org Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Zishun Yi <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260509074040.1747800-1-vulab@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: kexec_file: Constrain segment placement to direct mapHan Gao
When kexec_file_load places segments with buf_max=ULONG_MAX and top_down=true, they land at the highest available physical addresses. On RISC-V the size of the linear mapping is determined by the active VM mode: SV39 caps the direct map at roughly 128GB, while SV48/SV57 extend the range substantially further. When the installed physical memory exceeds the direct map size of the active mode, top-down placement puts DTB/initrd at physical addresses outside the linearly mapped region. The kexec'd kernel cannot reach them during early boot, triggering a page fault at memcmp in start_kernel. Fix by constraining buf_max to PFN_PHYS(max_low_pfn), which reflects the runtime direct map boundary for the active VM mode (SV39/SV48/ SV57). This keeps all kexec segments within the linearly mapped region while preserving the upstream top_down allocation strategy. Signed-off-by: Han Gao <gaohan@iscas.ac.cn> Link: https://patch.msgid.link/20260519170641.123517-1-gaohan@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: mm: Define DIRECT_MAP_PHYSMEM_ENDVivian Wang
On RISC-V, the actual mappable range of physical address space is dependent on the current MMU mode i.e. satp_mode (See Documentation/arch/riscv/vm-layout.rst). Define the DIRECT_MAP_PHYSMEM_END macro based on the existing virtual address space layout macros to expose this information to get_free_mem_region(). Otherwise, it returns a region that couldn't be mapped, which breaks ZONE_DEVICE. Cc: stable@vger.kernel.org # v6.13+ Tested-by: Han Gao <gaohan@iscas.ac.cn> # SG2044 Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://patch.msgid.link/20260309-riscv-sparsemem-vmemmap-limits-v1-2-f40efe18e3cd@iscas.ac.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: defconfig: Enable Eswin SoCsAnirudh Srinivasan
Enable support for Eswin SoCs in the default configuration, so that defconfig kernel/DTs are bootable on Hifive Premier P550 Board. Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://patch.msgid.link/20260603-eswin_defconfig-v1-1-8471691d3153@oss.tenstorrent.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: cpu_ops_sbi: No need to be bothered to check ret.errorHui Wang
If the ret.error equals to 0, the sbi_err_map_linux_errno() can also handle it, i.e. if ret.error is SBI_SUCCESS, it will return 0 immediately, so no need to be bothered to check ret.error here. Signed-off-by: Hui Wang <hui.wang@canonical.com> Link: https://patch.msgid.link/20260413123515.48423-2-hui.wang@canonical.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: cpu_ops: Change return value type of cpu_is_stopped() to boolHui Wang
In the original sbi_cpu_is_stopped(), if rc doesn't equal to the SBI_HSM_STATE_STOPPED, it will return rc to the caller directly. But there is a hidden problem, the rc could be SBI_HSM_STATE_STARTED, if so, this function will report cpu stopped while the cpu isn't really stopped. Furthermore, from the name of cpu_is_stopped(), it gives a sense the return value is a bool type, true means the cpu is stopped, conversely false means the cpu is not stopped. Here change the return value type to bool and change the callers accordingly. This could fix the above two issues. Fixes: f1e58583b9c7c ("RISC-V: Support cpu hotplug") Signed-off-by: Hui Wang <hui.wang@canonical.com> Link: https://patch.msgid.link/20260413123515.48423-1-hui.wang@canonical.com [pjw@kernel.org: cleaned up some of the pr_warn() messages] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: kexec_elf: Remove unused pr_fmt definitionHui Wang
Remove the pr_fmt macro as no pr_*() calls exist in this file. The prefix string "kexec_image: " is also not appropriate for kexec_elf.c, if pr_fmt is needed in the future, referring to kexec_image.c, a more appropriate prefix like "kexec_file(elf): " can be added at that time. Signed-off-by: Hui Wang <hui.wang@canonical.com> Link: https://patch.msgid.link/20260525115159.100177-1-hui.wang@canonical.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: ftrace: select HAVE_BUILDTIME_MCOUNT_SORTChen Pei
RISC-V already satisfies all prerequisites for build-time mcount sorting: the sorttable host tool handles EM_RISCV in its machine-type dispatch, and the __mcount_loc section entries are stored as direct virtual addresses in the final vmlinux binary, so no relocation processing is required during the sort step. Select HAVE_BUILDTIME_MCOUNT_SORT so that BUILDTIME_MCOUNT_SORT is automatically enabled when DYNAMIC_FTRACE is configured. This allows sorttable to sort the __mcount_loc section at link time, making the run-time ftrace initialisation path skip the software sort and reducing kernel startup overhead. Verified with CONFIG_FTRACE_SORT_STARTUP_TEST=y, which confirms that the section produced by the build is already in ascending order: [ 0.000000] ftrace section at ffffffff81015a60 sorted properly Signed-off-by: Chen Pei <cp0613@linux.alibaba.com> Tested-by: Guo Ren <guoren@kernel.org> Link: https://patch.msgid.link/20260409114736.907-1-cp0613@linux.alibaba.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: dead code cleanup in kconfig for RISCV_PROBE_VECTOR_UNALIGNED_ACCESSJulian Braha
The same Kconfig statement 'depends on RISCV_ISA_V' appears twice for RISCV_PROBE_VECTOR_UNALIGNED_ACCESS. The first instance is in its choice menu, "Vector unaligned Accesses Support", making the second instance in its specific Kconfig definition dead code. I propose removing this second instance. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha <julianbraha@gmail.com> Reviewed-by: Jesse Taube <mr.bossman075@gmail.com> Link: https://patch.msgid.link/20260329203249.563434-1-julianbraha@gmail.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: replace select with dependency for visible RELOCATABLEJulian Braha
RANDOMIZE_BASE currently selects RELOCATABLE even though RELOCATABLE is visible to users. Some other architectures, like x86, use 'depends on' for RELOCATABLE in their definition of RANDOMIZE_BASE, so let's do the same here. This select-visible Kconfig misusage was detected by Kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha <julianbraha@gmail.com> Link: https://patch.msgid.link/20260503040331.71875-1-julianbraha@gmail.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-07KVM: selftests: Add a hugetlb memslot alignment test modeJinyu Tang
kvm_page_table_test can already exercise hugetlb-backed guest memory, but it always creates the test memslot with GPA alignment matching the hugetlb backing size. That misses the case where a valid hugetlb memslot is later moved so that the memslot GPA and HVA no longer have the same offset within the backing huge page. Add a -u option that moves the test memslot GPA by one guest page after creating the hugetlb memslot. The memslot is created through the normal helper first, so the backing allocation remains valid and hugetlb aligned. Moving the memslot then creates a deliberate HVA/GPA offset mismatch before the guest mapping is installed. This mode is useful for checking that architecture MMUs do not install a block mapping when the block would map the wrong host pages or cover memory outside the memslot. The option is restricted to hugetlb-backed test memory because it's specifically about hugetlb block mapping eligibility. Signed-off-by: Jinyu Tang <tjytimi@163.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260604142602.3582602-3-tjytimi@163.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-07docs: memfd_preservation: fix rendering of ABI documentationPratyush Yadav (Google)
The "memfd Live Update ABI" section in include/linux/kho/abi/memfd.h currently does not render in the exported documentation. This is because it should not include the "DOC:" in its reference. Drop it to ensure correct rendering. Tested by running make htmldocs. Fixes: 15fc11bb2cb6 ("docs: add documentation for memfd preservation via LUO") Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Tested-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260605160645.3650271-1-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-07KVM: riscv: Check hugetlb block mappings against memslot boundsJinyu Tang
RISC-V KVM has used the hugetlb VMA size directly as the G-stage mapping size since stage-2 page table support was added. That is safe only if the block covered by the fault is fully contained in the memslot and the userspace address has the same offset as the GPA within that block. The THP path already checks those constraints before installing a PMD block mapping. The hugetlb path did not, so an unaligned memslot could make KVM install a PMD or PUD sized G-stage block that covers memory outside the slot or maps the wrong host pages. Pass the target mapping size into fault_supports_gstage_huge_mapping(). The same helper can be used for both THP PMD mappings and hugetlb PMD/PUD mappings. Select hugetlb mapping sizes through the same memslot-boundary check, falling back from PUD to PMD to PAGE_SIZE. When a smaller hugetlb mapping size is selected, fault the GFN aligned to that selected size instead of the original VMA size. Also keep hugetlb mappings out of transparent_hugepage_adjust(). Once the hugetlb path has chosen PAGE_SIZE, promoting it again through the THP helper would miss the hugetlb fallback decision. Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming") Signed-off-by: Jinyu Tang <tjytimi@163.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260604142602.3582602-2-tjytimi@163.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-06Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsingDmitry Torokhov
The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc() by iterating through the extra descriptor data. However, it does not verify that the bLength of each descriptor is at least 2. A malicious device could provide a descriptor with bLength = 0, leading to an infinite loop in the driver. Add a check to ensure bLength is at least 2 before proceeding with parsing. Fixes: 628329d52474 (Input: add IMS Passenger Control Unit driver) Cc: stable@vger.kernel.org Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - add response length checksDmitry Torokhov
The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add checks for the expected response length before accessing the buffers. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix DMA mapping violation in line setupDmitry Torokhov
In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the struct ims_pcu allocation, which violates DMA mapping rules regarding cacheline alignment. Use a heap-allocated buffer for the line coding data instead. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug loggingDmitry Torokhov
The debug logging in ims_pcu_irq() unconditionally prints data from pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read. Fix this by printing from the correct buffer associated with the URB. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - validate control endpoint typeDmitry Torokhov
The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior. Verify that the control endpoint is an interrupt IN endpoint. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix race condition in reset_device sysfs callbackDmitry Torokhov
The ims_pcu_reset_device() sysfs callback calls ims_pcu_execute_command() without acquiring pcu->cmd_mutex. This can lead to data races and corruption of the shared command buffer if triggered concurrently with other commands. Acquire pcu->cmd_mutex before calling ims_pcu_execute_command(). Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix firmware leak in async updateDmitry Torokhov
The firmware object was not being released if validation failed. Use __free(firmware) to ensure the firmware is always released. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix type confusion in CDC union descriptor parsingDmitry Torokhov
The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to the driver overwriting the private data of another interface. Validate that the control interface found in the descriptor is indeed the one we are probing. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix use-after-free and double-free in disconnectDmitry Torokhov
ims_pcu_disconnect() only intended to perform cleanup when the primary (control) interface is unbound. However, it currently relies on the interface class to distinguish between control and data interfaces. A malicious device could present a data interface with the same class as the control interface, leading to premature cleanup and potential use-after-free or double-free. Switch to verifying that the interface being disconnected is indeed the control interface. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - release data interface on disconnectDmitry Torokhov
During probe the driver claims the data interface, but it never releases it. Release it in disconnect to avoid leaving it permanently claimed. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - fix logic error in packet resetDmitry Torokhov
ims_pcu_reset_packet() incorrectly sets have_stx to true, which implies that the start-of-packet delimiter has already been received. This causes the protocol parser to skip waiting for the next STX byte and potentially process garbage data. Correctly set have_stx to false when resetting the packet state. Fixes: 875115b82c29 ("Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()") Cc: stable@vger.kernel.org Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06Input: ims-pcu - only expose sysfs attributes on control interfaceDmitry Torokhov
When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well. However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes. Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface. Fixes: 204d18a7a0c6 ("Input: ims-pcu - use driver core to instantiate device attributes") Reported-by: Sashiko bot <sashiko-bot@kernel.org> Assisted-by: Gemini:gemini-3.1-pro Cc: stable@vger.kernel.org Link: https://patch.msgid.link/ahp23lj4_vXIeUBl@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06riscv: Implement _THIS_IP_ using inline asmMarco Elver
Both GCC [1] and Clang [2] consider the generic version of _THIS_IP_ to be broken: #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; }) In particular, the address of a label is only expected to be used with a computed goto. While the generic version more or less works today, it is known to be brittle and may break with current and future optimizations. For example, Clang -O2 always returns 1 when this function is inlined: static inline unsigned long get_ip(void) { return ({ __label__ __here; __here: (unsigned long)&&__here; }); } Fix it by overriding _THIS_IP_ in <asm/linkage.h> (which is included by <linux/instruction_pointer.h>) using an architecture-specific inline asm version. Additionally, avoiding taking the address of a label prevents compilers from emitting spurious indirect branch targets (e.g. ENDBR or BTI) under control-flow integrity schemes. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=120071 [1] Link: https://github.com/llvm/llvm-project/issues/138272 [2] Signed-off-by: Marco Elver <elver@google.com> Link: https://patch.msgid.link/20260521000436.3931067-1-elver@google.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: module: Use generic cmp_int() instead of custom cmp_3way()Florian Schmaus
The module-sections.c file defines a custom cmp_3way() macro to perform 3-way comparisons during relocation sorting. Instead of maintaining our own implementation, use the generic cmp_int() macro provided by the already included <linux/sort.h>. This removes redundant code and relies on standard kernel interfaces. Signed-off-by: Florian Schmaus <florian.schmaus@codasip.com> Link: https://patch.msgid.link/20260512063231.708256-1-florian.schmaus@codasip.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: Fix ftrace_graph_ret_addr() to use the correct task pointerRui Qi
The walk_stackframe() function is used to unwind the stack of a given task. When function graph tracing is enabled, ftrace_graph_ret_addr() is called to resolve the original return address if it was modified by the tracer. The current code incorrectly passes 'current' instead of 'task' to ftrace_graph_ret_addr(). This causes incorrect return address resolution when unwinding a stack of a different task (e.g., when the task is blocked in __switch_to). Fix this by passing 'task' instead of 'current' to match the behavior of other architectures (arm64, loongarch, powerpc, s390, x86). Signed-off-by: Rui Qi <qirui.001@bytedance.com> Link: https://patch.msgid.link/20260408092915.46408-1-qirui.001@bytedance.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: Implement ARCH_HAS_CC_CAN_LINKThomas Weißschuh
The generic CC_CAN_LINK detection relies on -m32/-m64 compiler flags. These are not supported by riscv compilers. Use architecture-specific logic using -mabi instead. Prefer the 'd' ABI variant when possible as todays toolchains are most likely to provide a libc for that one. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20260316-cc-can-link-riscv-v4-1-64c072b456dd@linutronix.de Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06selftests/riscv: fix compiler output flag spacing in all MakefilesZong Li
Standardize the compiler output flag format across all RISC-V selftests by adding a space between '-o' and '$@'. Although '-o$@' is perfectly valid for GCC/Clang to parse, changing it to '-o $@' with a space aligns with the GNU official documentation conventions, improves readability by visually separating the flag from the target variable, and ensures consistency with other architectures. Currently, RISC-V selftests use '-o$@' (without space) in 13 instances across 6 Makefiles, while all other architectures consistently use '-o $@' (with space). This inconsistency makes RISC-V an outlier in the kernel's selftest infrastructure. Signed-off-by: Zong Li <zong.li@sifive.com> Link: https://patch.msgid.link/20260511032917.3542802-1-zong.li@sifive.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: propagate insert_resource result from add_resourceThorsten Blum
Currently, add_resource() returns 1 on success, even though its callers only check for negative values. Instead, propagate the insert_resource() result from add_resource() to align with standard kernel return-value conventions (0 on success, negative errno on failure). Use %pR to print the full resource range while at it. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260512172034.328405-4-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: use sysfs_emit in cpu_show_ghostwriteThorsten Blum
Replace sprintf() with sysfs_emit() in cpu_show_ghostwrite(), which is preferred for formatting sysfs output because it provides safer bounds checking. While the current code only emits fixed strings that fit easily within PAGE_SIZE, use sysfs_emit() to follow secure coding best practices. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260510165420.109453-3-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: pi: replace strlcat with strscpy in get_early_cmdlineThorsten Blum
Use the return value of strscpy() instead of calling strlen(fdt_cmdline) again and return early on string truncation. Drop the explicit size argument since early_cmdline has a fixed length, which strscpy() determines using sizeof() when the argument is omitted. Replace strlcat() with strscpy() to append CONFIG_CMDLINE. Also remove the unnecessary fdt_cmdline NULL initialization. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260504154924.141566-3-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: ptdump: Replace unbounded sprintf() in dump_prot()Thorsten Blum
Replace the unbounded sprintf("%s", ...) with the faster and safer strscpy(). Replace all other sprintf() calls with the safer snprintf(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260127110543.436242-1-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv/purgatory: add asm/purgatory.hThorsten Blum
Add arch/riscv/include/asm/purgatory.h and provide the purgatory() prototype via the architecture header, mirroring the x86 layout. Remove the workaround from arch/riscv/purgatory/purgatory.c. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260509073850.44595-4-thorsten.blum@linux.dev [pjw@kernel.org: drop superfluous extern in header file] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv/purgatory: return bool from verify_sha256_digestThorsten Blum
Change the function's return type from int to bool and return the result of memcmp() directly to simplify the code. While at it, cast ->start to 'const u8 *' to better match the expected type. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260509073850.44595-3-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: cfi: reject unknown flags in PR_SET_CFIRichard Patel
prctl(PR_SET_CFI,PR_CFI_BRANCH_LANDING_PADS) silently ignored unknown control values. Only PR_CFI_{ENABLE,DISABLE,LOCK} should be permitted. This changes the behavior of the uABI (fails previously accepted bits with EINVAL). Fixes: 08ee1559052b ("prctl: cfi: change the branch landing pad prctl()s to be more descriptive") Signed-off-by: Richard Patel <ripatel@wii.dev> Link: https://patch.msgid.link/20260518183918.322545-1-ripatel@wii.dev [pjw@kernel.org: change the patch description to note that although this is a uABI change, it does not break the uABI] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv: Fix fast_unaligned_access_speed_key not getting initializedNam Cao
The static key fast_unaligned_access_speed_key is supposed to be initialized after check_unaligned_access_all_cpus() has been completed. However, check_unaligned_access_all_cpus() has been moved to late_initcall while setting fast_unaligned_access_speed_key still happens at arch_initcall_sync, thus the static key does not get properly initialized. fast_unaligned_access_speed_key can still be initialized in CPU hotplug events, but that cannot be relied on. Move fast_unaligned_access_speed_key's initialization into check_unaligned_access_all_cpus() to fix this issue. This also prevent someone from moving one initcall while forgetting the other in the future. Fixes: 6455c6c11827 ("riscv: Clean up & optimize unaligned scalar access probe") Reported-by: Michael Neuling <mikey@neuling.org> Closes: https://lore.kernel.org/linux-riscv/CAEjGV6y0=bSLp_wrS0uHFj1S2TCRtz4GKzaU5O-L1VV-EL7Nnw@mail.gmail.com/ Signed-off-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260407120639.4006031-1-namcao@linutronix.de Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-06riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFIAndreas Schwab
Fixes a warning while dumping core: [54983.546369][ C7] WARNING: [!note_name] fs/binfmt_elf.c:1771 at elf_core_dump+0x910/0xf68, CPU#7: abort01/31982 Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files") Signed-off-by: Andreas Schwab <schwab@suse.de> Link: https://patch.msgid.link/87y0hcxuh5.fsf@igel.home Signed-off-by: Paul Walmsley <pjw@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-05 19:36:05 +0000