summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-08-03ublk: initialize io_desc on daemon taskCaleb Sander Mateos
ublk_setup_iod() is currently called to populate struct ublksrv_io_desc on the thread submitting I/O to a ublk device. However, only the ublk server threads read the io_descs. This basically guarantees a cache miss on both threads for each ublk I/O. There's really no need to initialize the io_descs on the submitting thread. Move the ublk_setup_iod() call to ublk_dispatch_req() (for non-UBLK_F_BATCH_IO) and __ublk_batch_prep_dispatch() (for UBLK_F_BATCH_IO), which runs on the ublk server daemon thread before dispatching the I/O to userspace. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260803211441.2538144-5-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03ublk: split request validation from io_desc initCaleb Sander Mateos
In preparation for moving the struct ublksrv_io_desc initialization from the thread submitting ublk requests to the daemon thread receiving them, split the fallible part of ublk_setup_iod{,_zoned}() into new helper ublk_validate_req{,_zoned}(). Only ublk_setup_iod{,_zoned}() accesses the io_desc and cannot error out. Return a bool value from ublk_validate_req{,_zoned}() as the existing error code ublk_setup_iod{,_zoned}() returns is only checked against BLK_STS_OK. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260803211441.2538144-4-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03ublk: remove struct ublk_zoned_report_desc's operation fieldCaleb Sander Mateos
struct ublk_zoned_report_desc's operation field is only ever set to UBLK_IO_OP_REPORT_ZONES, so remove it. Replace its one load with the constant. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260803211441.2538144-3-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03ublk: consistently use u16 for queue and tag numbersCaleb Sander Mateos
The u16 nr_hw_queues and queue_depth fields of the ublk UAPI struct ublksrv_ctrl_dev_info constrain the number of queues and queue depth of each ublk device. However, the ublk driver is a bit inconsistent with the type it uses to represent these values, mixing u16 with int and unsigned int. Change all queue number, queue depth, q_id, and tag variables/fields to u16 to save some space. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260803211441.2538144-2-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03ublk: remove WARN_ON_ONCE() in ublk_unmap_io()Caleb Sander Mateos
io->res is set from struct ublksrv_io_cmd's result field, which is controlled by the ublk server process, without any validation. It's thus possible for userspace to trigger the io->res > rq_bytes warning. ublk_copy_user_pages() already limits the copy length to the request data length, so drop the warning. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Link: https://patch.msgid.link/20260729171041.45061-4-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03ublk: check for ublk_unmap_io() returning 0Caleb Sander Mateos
If the userspace ublk server passes an unmapped address as the data buffer for a completed ublk read, ublk_unmap_io() will return 0 indicating no bytes could be copied. Currently, this will result in calling blk_update_request() with nr_bytes=0, which doesn't seem supported. Fail the I/O with BLK_STS_IOERR in this case instead. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Link: https://patch.msgid.link/20260729171041.45061-3-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03ublk: check import_ubuf() return valueCaleb Sander Mateos
import_ubuf() can fail if the address range (provided by the userspace ublk server) is outside the allowed user address space. Return that 0 bytes were copied if import_ubuf() fails rather than passing an uninitialized struct iov_iter to ublk_copy_user_pages(). Fixes: 981f95a571e3 ("ublk: cleanup ublk_copy_user_pages") Reported-by: Ming Lei <tom.leiming@gmail.com> Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Link: https://patch.msgid.link/20260729171041.45061-2-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-03net: mana: force full-page RX buffers via ethtool private flagDipayaan Roy
On some ARM64 platforms with 4K PAGE_SIZE, page_pool fragment allocation in the RX refill path can cause 15-20% throughput regression under high connection counts (>16 TCP streams). Add an ethtool private flag "full-page-rx" that allows the user to force one RX buffer per page, bypassing the page_pool fragment path. This restores line-rate (180+ Gbps) performance on affected platforms. Usage: ethtool --set-priv-flags eth0 full-page-rx on There is no behavioral change by default. The flag must be explicitly enabled by the user or udev rule. The existing single-buffer-per-page logic for XDP and jumbo frames is consolidated into a new helper mana_use_single_rxbuf_per_page() which is now the single decision point for both the automatic and user-controlled paths. Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260729063347.3388035-3-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switchDipayaan Roy
Refactor mana_get_strings() and mana_get_sset_count() from if/else to switch statements in preparation for adding ethtool private flags support which requires handling ETH_SS_PRIV_FLAGS. No functional change. Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260729063347.3388035-2-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: ethtool: Address off-by-one when reading the coal rx-usecsMaxime Chevallier
When reading the rx-usecs coalescing parameters on a dwmac variant that uses the RIWT for RX interrupt coalescing, we convert the riwt value to usecs : - One riwt cycle is 256 clock ticks, we compute how many ticks in $riwt cycles - divide that by how many ticks in a microsecond, and we get the rx-usecs. The opposite computation is done when setting the rx-usecs param. Because of the 256 ratio, we're subjected to off-by-one errors in the value read-back, which can be reliably measured on i.mx8MP : $ ethtool -C eth1 rx-usecs 102 $ ethtool -c eth1 Coalesce parameters for eth1: [...] rx-usecs: 101 Let's be more explicit about the rounding for the riwt to usec computations by using DIV_ROUND_CLOSEST, which solves the off-by-one. This does change the boundaries of accepted rx-usecs parameters, as the previously accepted values were in the 16-246 us range, and now fall into the 15-245 range on imx8mp. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260802114015.214212-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: ethtool: Comment the magic numbers in RIWT computationMaxime Chevallier
Receive Interrupt Watchdog Timer is an RX interrupt coalescing mechanism used by some variants of dwmac. It allows waiting a bit before triggering the rx interrupts, allowing for batch processing. The RIWT is configured with a granularity of 256 stmmac clk ticks. Let's add a comment for that and wrap the raw "1000000" into USEC_PER_SEC, as we're computing "how many clock cycles in one microsec" with that step. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260802114015.214212-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03s390/qeth: validate user buffer length in SNMP and ARP query ioctlsHidayath Khan
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero value and pass both to a reply callback. The callback bounds-checks the copy with if ((udata_len - udata_offset) < len) Both fields are u32, so a udata_len smaller than udata_offset makes the subtraction wrap and the check pass, and the following memcpy() writes past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from kzalloc(), which the existing NULL check does not catch. Reject buffers smaller than udata_offset before allocating, so the callback subtraction can no longer underflow. Fixes: 4a71df50047f ("qeth: new qeth device driver") Cc: stable@vger.kernel.org Reviewed-by: Alexandra Winter <wintera@linux.ibm.com> Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260730142216.218309-1-hidayath@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03bnge: Fix NULL pointer dereference in aux device releaseAlok Tiwari
If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception Retrieve the parent bnge_dev from the auxiliary device's parent instead of auxr_dev, and free auxr_dev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices. Fixes: 8ac050ec3b1c ("bng_en: Add RoCE aux device support") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Link: https://patch.msgid.link/20260731192301.1427645-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03Input: evdev - fix information leak in evdev_pass_values()Dmitry Torokhov
In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where struct input_event contains explicit or implicit padding (such as the 32-bit __pad field on SPARC64), these padding bytes are left uninitialized. When this event structure is subsequently passed to the client buffer and later copied to userspace, the uninitialized padding bytes leak kernel stack memory, potentially exposing sensitive information. Similar issues exist in __evdev_queue_syn_dropped and __pass_event. Fix this by explicitly zeroing the entire event structure with memset() before populating its fields. This ensures all padding bytes are cleared before the data crosses the security boundary. Reported-by: sashiko-bot@kernel.org Cc: stable@vger.kernel.org Link: https://patch.msgid.link/ampGGKo4UMKru6f5@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-03net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()Yi Cong
When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`. Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure). Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function. Fixes: 16b1c4e01c89 ("net: usb: ax88179_178a: add TSO feature") Cc: stable@vger.kernel.org Signed-off-by: Yi Cong <yicong@kylinos.cn> Link: https://patch.msgid.link/20260729030436.3420477-1-cong.yi@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: phy: motorcomm: enable the reference clock for YT8521Jiaxing Hu
Commit 42310a24389c ("net: phy: motorcomm: Enable optional clock for YT8531") enables the SoC-provided reference clock for the YT8531 in its probe. The YT8521 has the same need on crystal-less boards but goes through yt8521_probe(), so enable it there too. The clock is optional, so crystal-clocked boards are unaffected. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Gavin Gao <attinagaoxu@gmail.com> Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Link: https://patch.msgid.link/20260731013807.1488843-1-gahing@gahingwoo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: Don't rely on the PHY for flow-control testingMaxime Chevallier
For flow-control testing in loopback mode, we don't need to ask what the PHY is currently using as pause/asym settings. The PHY is no longer involved in selftest, we rely strictly on MAC loopback. We therefore only need to know if the MAC supports Symmetric pause for the test, as we exercise both TX and RX pause support in the selftest. Remove phydev requirement for flowcontrol selftest as well as the AsymPause requirement. With that, we can also drop the linux/phy.h include. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://patch.msgid.link/20260728155728.1193169-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: Don't use PHY loopback for selftestsMaxime Chevallier
Stmmac selftests validate the internal behaviour of the various IPs, using local loopback. The current logic is relies on PHY-side local loopback if a PHY is attached, with a fallback to MAC loopback otherwise. However, PHY loopback is currently fragile especially for stmmac that may require RXC to be provided from the PHY. Some PHYs shutdown RXC while in loopback, while others will report carrier off when in local loopback. This also fails when using SFP setup with a module that embeds a PHY, that may also fail to enter loopback. MAC loopback is done at the GMII level on dwmac, allowing the internal to be just as meaningful as PHY-loopback testing. Let's simplify stmmac selftests by only relying on MAC-side local loopback, which makes the selftests runnable on a wider HW variety. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260728155728.1193169-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03Input: psmouse - use guard() for resource managementDmitry Torokhov
Replace manual serialization with guard(mutex) and guard(serio_pause_rx) where appropriate. This eliminates the need for explicit goto-based error paths. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-4-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-03Input: psmouse - modernize PNP ID parsingDmitry Torokhov
Rewrite psmouse_matches_pnp_id() to parse and match the space-separated PNP ID string directly in place without dynamic memory allocation. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-03Input: psmouse - clean up locking around disable_work_sync()Dmitry Torokhov
In the past, psmouse_disconnect() used cancel_work_sync(). Because cancel_work_sync() must be called with the psmouse_mutex dropped, and we needed to prevent psmouse_receive_byte() from re-queueing the work behind our back, the code transitioned the device to PSMOUSE_CMD_MODE while holding the mutex, then dropped the mutex and cancelled the work. When cancel_work_sync() was replaced with disable_work_sync() in this path, the mutex juggling remained. However, disable_work_sync() inherently prevents the work from being executed or re-queued, making the mutex juggling unnecessary. Clean this up by moving disable_work_sync() to the very top of psmouse_disconnect(), before we acquire psmouse_mutex. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-03Input: psmouse - fix use-after-free during protocol disconnectDmitry Torokhov
When a PS/2 mouse is disconnected or unbound, psmouse_disconnect() calls the protocol disconnect handler (psmouse->disconnect()). During this time, stray bytes arriving from the physical controller can still be passed to psmouse_handle_byte(), which will invoke psmouse->protocol_handler(). This creates an asynchronous race condition with vendor disconnect handlers (such as synaptics_disconnect()), which free vendor-specific private structures (psmouse->private). If a byte arrives while the structures are being freed, it leads to a use-after-free or NULL pointer dereference in the protocol handler. Fix this by explicitly setting psmouse->protocol_handler to NULL safely wrapped in scoped_guard(serio_pause_rx, serio) immediately before calling the vendor disconnect handler. We also add an unlikely check in psmouse_handle_byte() to safely drop incoming bytes if the protocol handler is NULL. Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260727050803.1269941-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-03net: phylink: allow PHYs to be attached in 802.3z inband modeRussell King (Oracle)
Now that we have proper decision making for inband mode support which makes it a "best efforts" feature based on the capabilities of the PHY and PCS, we can relax whether we expect and permit a PHY to be attached. This is especially true for the 2500BASE-X case which some PHYs use without inband on their host side interface for 2.5G speeds, but use inband for slower speeds switching to SGMII on their host side interface. We already have such a case for some qcom-ethqos setups, although qcom-ethqos overrides phylink's inband settings by accessing the PCS directly at the moment. This should allow qcom-ethqos to transition to defaulting to inband when 2500BASE-X or SGMII is specified in its DTS. Allow PHYs to be attached when inband mode has been specified, which will be necessary to allow inband mode to be used on qcom-ethqos. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260729074237.2624940-3-zxyan0222@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: Skip PHY attach if custom PCS is in useZxyan Zhu
When a platform provides a custom PCS via the pcs_init callback, the MAC's phylink_pcs is already configured. In this case, no traditional PHY device is needed. Without this, stmmac_init_phy() falls through to the no-phy-node path and errors out with "no phy found" when the DT has no phy-handle for such interfaces. Skip the PHY attach when priv->hw->phylink_pcs is set and phy_addr is invalid. Fixes: f0ef433fc264 ("net: stmmac: introduce pcs_init/pcs_exit stmmac operations") Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260729074237.2624940-2-zxyan0222@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03xsk: validate metadata when processing requestsStanislav Fomichev
The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. Validate the metadata in xsk_tx_metadata_request() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation. Fixes: ca4419f15abd ("xsk: Add launch time hardware offload support to XDP Tx metadata") Cc: Cen Zhang (Microsoft) <blbllhy@gmail.com> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260727161959.885642-7-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03xsk: pass TX metadata pointer by referenceStanislav Fomichev
Completion handling needs to know whether a timestamp was requested when the metadata was processed. Let xsk_tx_metadata_request() update the caller's metadata pointer so that decision can be carried forward without rereading user-controlled flags. This only changes the interface; behavior remains unchanged. Fixes: ca4419f15abd ("xsk: Add launch time hardware offload support to XDP Tx metadata") Cc: Cen Zhang (Microsoft) <blbllhy@gmail.com> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260727161959.885642-3-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03ppp: use netdev_from_priv()Qingfang Deng
Use the new netdev_from_priv() helper to access the net device from struct ppp. Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260730100654.745-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03netxen: unregister notifiers if PCI registration failsCan Peng
netxen_init_module() registers the netdevice and inetaddr notifiers before registering the PCI driver. If pci_register_driver() fails, the function returns the error directly and leaves both notifiers registered. That leaves notifier callbacks installed for a module that failed to load. Mirror the module exit path on this failure and unregister the notifiers before returning the error. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Signed-off-by: Can Peng <pengcan@kylinos.cn> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260728032046.121631-2-pengcan@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0Niklas Cassel
According to a user report, WDC WD141KFGX-68FH9N0 has problems with LPM. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220693 Signed-off-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-08-04power: supply: ucs1002: fix use-after-free on removeFan Wu
ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the health_poll delayed work, and the work reschedules itself while the chip reports a bad-health condition. devm frees the alert IRQ, which only synchronizes the handler; it does not cancel the delayed work, which can then run after devm frees the driver data and dereference it. Register health_poll with devm_delayed_work_autocancel() before the alert IRQ is requested. devm then frees the IRQ before cancelling the work, so the handler can no longer queue it and the work is cancelled before the driver data is freed. This issue was found by an in-house static analysis tool. Fixes: 81196e2e57fc ("power: supply: ucs1002: fix some health status issues") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Reviewed-by: Lucas Stach <l.stach@pengutronix.de> Link: https://patch.msgid.link/20260802051249.424015-1-fanwu01@zju.edu.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-04power: supply: lp8788-charger: fix use-after-free on removeFan Wu
lp8788_charger_remove() flushes charger_work before unregistering the IRQs. An IRQ thread can queue charger_work after flush_work() has returned. The work can then run after devres frees pchg and dereference it in lp8788_charger_event(). Unregister the IRQs first. free_irq() waits for any running threaded handler, so no handler can queue more work afterwards. Then use cancel_work_sync() to cancel pending work or wait for running work to finish. This issue was found by an in-house static analysis tool. Fixes: 98a276649358 ("power_supply: Add new lp8788 charger driver") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260802035442.421697-1-fanwu01@zju.edu.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-04power: supply: ab8500_fg: fix use-after-free on removeFan Wu
ab8500_fg_remove() destroys the driver workqueue while the threaded interrupt handlers are still armed; they are devm-managed and freed only after ->remove() returns, so a handler that fires in that window queues work on the freed workqueue. Tear the workqueue down through devm instead, registering its cleanup after the power supply and before the interrupt requests. devm then frees the interrupts first, so the handlers can no longer queue work, before disabling the delayed and plain work items and destroying the workqueue. Disabling the items, rather than cancelling them, keeps them disabled so no producer (including the power-supply external_power_changed callback) can requeue them. Found by an in-house static analysis tool. Fixes: 13151631b5bd ("ab8500-fg: A8500 fuel gauge driver") Cc: stable@vger.kernel.org # v6.10+ Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260802020316.417757-1-fanwu01@zju.edu.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-03iio: adc: ltc2378: Add support for LTC2338-18Marcelo Schmitt
LTC2338-18 is similar to LTC2378-18, differentiating from the already supported part mainly on the embedment of an internal voltage reference and addition of a resistor divider network connected to the input signal path. Extend the device driver, handling the internal reference and input signal attenuation, enabling it to also support LTC2338-18. Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: adc: ltc2378: Enable triggered buffer data captureMarcelo Schmitt
Enable users to run triggered data captures with LTC2378 and similar ADCs. Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: adc: ltc2378: Enable high-speed data captureMarcelo Schmitt
Make use of SPI transfer offloading to speed up data capture, enabling data acquisition at faster sample rates (up to 2 MSPS). Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCsMarcelo Schmitt
Support for LTC2378-20 and similar analog-to-digital converters. Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Marcelo Schmitt <marcelo.schmitt@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: magnetometer: ak8974: remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: light: tsl2583: remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helperSang-Heon Jeon
rcar_gyroadc_set_power() just calls pm_runtime_resume_and_get() or pm_runtime_put_autosuspend() depending on its bool argument. Call them directly and remove the helper. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helperSang-Heon Jeon
vcnl4000_set_pm_runtime_state() just calls pm_runtime_resume_and_get() or pm_runtime_put_autosuspend() depending on its bool argument. Call them directly and remove the helper. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helperSang-Heon Jeon
vcnl4035_set_pm_runtime_state() just calls pm_runtime_resume_and_get() or pm_runtime_put_autosuspend() depending on its bool argument. Call them directly and remove the helper. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: light: tsl2583: remove tsl2583_set_pm_runtime_busy() helperSang-Heon Jeon
tsl2583_set_pm_runtime_busy() just calls pm_runtime_resume_and_get() or pm_runtime_put_autosuspend() depending on its bool argument. Call them directly and remove the helper. No functional change. Suggested-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: light: isl29028: remove isl29028_set_pm_runtime_busy() helperSang-Heon Jeon
isl29028_set_pm_runtime_busy() just calls pm_runtime_resume_and_get() or pm_runtime_put_autosuspend() depending on its bool argument. Call them directly and remove the helper. No functional change. Suggested-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: light: tsl2583: return zero in write_raw() on successSang-Heon Jeon
tsl2583_write_raw() returns the value of pm_runtime_put_autosuspend(), which is 1 if the device is already runtime suspended. In that case write() on the sysfs attribute returns 1 instead of the number of bytes written. Make tsl2583_write_raw() always return zero on success. Fixes: 371894f5d1a0 ("iio: tsl2583: add runtime power management support") Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: light: isl29028: return zero in write_raw() on successSang-Heon Jeon
isl29028_write_raw() returns the value of pm_runtime_put_autosuspend(), which is 1 if the device is already runtime suspended. In that case write() on the sysfs attribute returns 1 instead of the number of bytes written. Make isl29028_write_raw() always return zero on success. Fixes: 2db5054ac28d ("staging: iio: isl29028: add runtime power management support") Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add Temp Support in icm42607Chris Morgan
Add functions for reading temperature sensor data. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add Gyroscope to icm42607Chris Morgan
Add gyroscope functions to the icm42607 driver. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add Accelerometer for icm42607Chris Morgan
Add icm42607 accelerometer sensor for icm42607. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add PM support for icm42607Chris Morgan
Add power management support for the ICM42607 device driver. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add SPI For icm42607Chris Morgan
Add SPI driver support for InvenSense ICM-42607 devices. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>