summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-07-26RDMA/core: Handle device name conflicts when changing net namespaceJiri Pirko2-21/+137
Prepare namespace moves for per-netns names. Check user-initiated moves for destination-name conflicts before disabling the device, keep same-netns moves as no-ops, and make teardown moves detach from the exiting namespace even if fallback naming fails. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-3-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Pass the net namespace to the device name lookupsJiri Pirko1-8/+18
Prepare for per-netns RDMA device names by passing the target net namespace through the name lookup and allocation helpers. Keep current global uniqueness behaviour. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-2-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-25Input: inexio - replace printk with dev_dbg and fix missing spaceBivash Kumar Singh1-1/+3
Replace printk(KERN_DEBUG) with dev_dbg() using the serio device, which is the correct logging style for driver code. Also fix missing space after comma in the function argument, and remove the redundant 'inexio.c:' filename prefix from the message. Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com> Link: https://patch.msgid.link/20260725130803.6763-1-bivashraj750@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-25Input: elo - fix coding style issues in elo_setup_10()Bivash Kumar Singh1-2/+2
Fix two checkpatch warnings in elo_setup_10(): - Add missing space around '-' operator in array index expression - Add missing 'const' qualifier to elo_types pointer array, since the array is never modified after initialization Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com> Link: https://patch.msgid.link/20260725113638.5147-1-bivashraj750@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-26hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller deviceIvaylo Dimitrov1-0/+6
The OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers now require a valid dma_mask to be present, otherwise the driver may crash or trigger warnings when attempting DMA mapping operations. Fix this by explicitly initializing the DMA mask for the SSI controller device and setting a 32-bit DMA mask, which matches the hardware capabilities. Cc: stable@vger.kernel.org Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference") Reported-by: Merlijn Wajer <merlijn@wizzup.org> Closes: https://lore.kernel.org/linux-omap/4ed95c71-2066-6b4c-ad1b-53ef02d79d53@wizzup.org/ Signed-off-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com> Link: https://patch.msgid.link/20260724130522.706480-1-ivo.g.dimitrov.75@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26HSI: omap_ssi: Remove redundant dev_err()Pan Chuang2-10/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() and devm_request_threaded_irq() automatically log detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260713132747.394970-3-panchuang@vivo.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26HSI: nokia-modem: Remove redundant dev_err()Pan Chuang1-4/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260713132747.394970-2-panchuang@vivo.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26hsi: omap_ssi: remove debugfs on port creation failurePengpeng Hou1-0/+3
ssi_probe() creates the controller debugfs tree before creating the SSI port child devices. If a port device cannot be created, the error path removes any children and tears down the controller, but leaves the debugfs tree behind. Remove the controller debugfs tree on the port creation failure path, matching the normal remove path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260616004348.97684-1-pengpeng@iscas.ac.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26Merge tag 'ib-psy-array-helpers-for-v7.3-signed' into psy-nextSebastian Reichel1-0/+153
Immutable branch for battery array helpers to be used by the USB-C state machine. Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26power: supply: Add helpers to get and put arrays of power supply handlesAmit Sunil Dhamne1-0/+153
Add power_supply_get_system_batteries() to allow drivers to obtain a list of registered battery type power supply references in the system. Also add power_supply_put_system_batteries() to perform cleanup after the former function is called. Signed-off-by: Amit Sunil Dhamne <amitsd@google.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260714-batt-status-v5-1-9de4aa900b69@google.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-25memory: jz4780-nemc: Use dev_err_probe() for clock errorMiles Krause1-4/+3
Use dev_err_probe() to simplify clock acquisition error handling and avoid logging probe deferral as an error. No functional change. Signed-off-by: Miles Krause <mileskrause5200@gmail.com> Link: https://patch.msgid.link/20260711-jz4780-nemc-dev-err-probe-v1-1-afb6f6a82752@gmail.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-07-25power: supply: bq257xx: Add support for BQ25792Alexey Charkov1-1/+527
Add support for TI BQ25792 integrated battery charger and buck-boost converter. It shares high-level logic of operation with the already supported BQ25703A, but has a different register map, bit definitions and some of the lower-level hardware states. Signed-off-by: Alexey Charkov <alchark@flipper.net> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/20260603-bq25792-v7-7-d487bed276d0@flipper.net Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-25power: supply: twl4030_charger: cancel workers via devmMaoyi Xie1-2/+10
bci is devm-allocated. Two workers (bci->work and bci->current_worker) dereference it. twl4030_bci_remove() disables charging and masks interrupts. It cancels neither worker. A worker pending at remove() can run after devm frees bci. The USB transceiver comes from devm_usb_get_phy_by_node(). devm unregisters its notifier only after remove() returns. A cancel_work_sync() in remove() can then race a notifier reschedule. devm_work_autocancel() and devm_delayed_work_autocancel() avoid that. They cancel the workers during devm release, before bci is freed. The current_worker is registered first, since devm will cancel in reverse order and bci->work can reschedule current_worker. Suggested-by: Sebastian Reichel <sre@kernel.org> Fixes: d6ccc442b1210 ("twl4030_charger: Make the driver atomic notifier safe") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260702172128.2001753-1-maoyixie.tju@gmail.com Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Link: https://patch.msgid.link/20260725072540.3092504-1-maoyixie.tju@gmail.com [Move comment about order into the commit message] Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-25Merge tag 'firewire-fixes-7.2-rc5' of ↵Linus Torvalds1-17/+20
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver failed to reassemble a complete datagram when it was stored across multiple buffer ranges in the list. Ruoyu Wang reported and fixed it" * tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: net: Fix fragmented datagram reassembly
2026-07-25Merge tag 'loongarch-fixes-7.2-1' of ↵Linus Torvalds1-3/+1
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - fix build warnings and errors - move jump_label_init() before parse_early_param() - retrieve CPU package ID from PPTT when available - fix some bugs kgdb, BPF JIT and laptop platform driver bugs * tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: platform/loongarch: laptop: Explicitly reset bl_powered state when suspend platform/loongarch: laptop: Stop setting acpi_device_class() LoongArch: BPF: Fix memory leak in bpf_jit_free() LoongArch: BPF: Zero-extend signed ALU32 div/mod results LoongArch: Fix oops during single-step debugging LoongArch: Fix address space mismatch in kexec command line lookup LoongArch: Retrieve CPU package ID from PPTT when available LoongArch: Move jump_label_init() before parse_early_param() LoongArch: Fix build errors due to wrong instructions for 32BIT LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT
2026-07-25pinctrl: mediatek: mt7986: register both platform drivers from a single initcallJustin Yeh1-9/+8
The MT7986 driver registers two separate platform drivers (mt7986a and mt7986b) and used to call arch_initcall() twice, once for each. This is fine while the driver is built-in, but a single translation unit can only provide one module_init(). Since arch_initcall() expands to module_init() when built as a module, having two of them would break the module build with a redefinition of init_module()/__inittest(). Fold both platform drivers into a single driver array and register them from one initcall using platform_register_drivers(), matching the shape of the other MediaTek pinctrl SoC drivers. platform_register_drivers() also rolls back the first registration if the second one fails. No functional change for built-in builds; this is a preparatory cleanup for enabling module builds. Signed-off-by: Justin Yeh <justin.yeh@mediatek.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: mediatek: allow common drivers to be built as modulesJustin Yeh26-3/+62
The MediaTek SoC pinctrl drivers link against the shared implementations in pinctrl-mtk-common.c (v1), pinctrl-moore.c and pinctrl-mtmips.c. These were built-in only: their Kconfig symbols were bool, they did not export their entry points and they carried no MODULE_LICENSE(). To let the individual SoC drivers be built as loadable modules (required for Android GKI + vendor_dlkm, where vendor drivers must live outside the GKI vmlinux), the shared code they depend on has to be modular too. Otherwise selecting a SoC driver as =m forces the common symbol to =y and the resulting module fails to link against the unexported common entry points. Convert PINCTRL_MTK, PINCTRL_MTK_MOORE and PINCTRL_MTK_MTMIPS to tristate, export the entry points used by the SoC drivers, and add MODULE_DESCRIPTION()/MODULE_LICENSE() to the three common files. The v2 common code (PINCTRL_MTK_V2) is already modular, but mtk_rmw() was never exported. It is called directly by SoC drivers such as mt7623, so export it as well to keep those drivers linking once they are modular. Rather than exporting these shared symbols into the global namespace, export them in the "MTK_PINCTRL" symbol namespace with EXPORT_SYMBOL_NS_GPL() so they are only visible to drivers that opt in. Each SoC driver that uses them therefore declares MODULE_IMPORT_NS("MTK_PINCTRL"). Signed-off-by: Justin Yeh <justin.yeh@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: mediatek: free EINT resources on unbindJustin Yeh1-1/+24
mtk_eint_do_init() creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. This was harmless while the drivers were built-in, but now that they can be built as modules and unbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data. The plain allocations in mtk_eint_do_init() already use the device-managed devm_*() helpers, so tear the remaining resources down the same way: register a devm action that detaches the chained handler, waits for any in-flight handler to finish, disposes of the per-line mappings and removes the IRQ domain. This mirrors the device-managed lifecycle adopted for the GPIO chip and keeps the whole EINT setup self-cleaning on unbind. Fixes: e46df235b4e6 ("pinctrl: mediatek: refactor EINT related code for all MediaTek pinctrl can fit") Signed-off-by: Justin Yeh <justin.yeh@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chipJustin Yeh3-15/+7
The gpio_chip is allocated with device-managed memory but registered with the non-managed gpiochip_add_data(). This was harmless while the drivers were built-in, but once they can be built as modules and unbound/rmmod'd, devm frees the gpio_chip's memory while it is still registered, causing a use-after-free. Register it with devm_gpiochip_add_data() so it shares the same device-managed lifecycle, which also lets the manual gpiochip_remove() error paths go away. Fixes: a6df410d420a ("pinctrl: mediatek: Add Pinctrl/GPIO driver for mt8135.") Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings") Fixes: e78d57b2f87c ("pinctrl: mediatek: add pinctrl-moore that implements the generic pinctrl dt-bindings") Signed-off-by: Justin Yeh <justin.yeh@mediatek.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: s32cc: fix unmet dependency for PINCTRL_S32CCJulian Braha1-1/+2
Currently, PINCTRL_S32G2 selects PINCTRL_S32CC which needs GPIOLIB, without selecting or depending on GPIOLIB. However, other similar options in this subsystem actually select GPIOLIB instead of depending, so I think we can do the same here. This unmet dependency was found by kconfirm, a static analysis tool for Kconfig. Fixes: 94cb9e8f2707 ("pinctrl: s32cc: implement GPIO functionality") Signed-off-by: Julian Braha <julianbraha@gmail.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: bm1880: add missing select GENERIC_PINCONFBenjamin Boortz1-0/+1
drivers/pinctrl/pinctrl-bm1880.c initialises its pinconf_ops with .is_generic = true, but that field is only present when CONFIG_GENERIC_PINCONF is enabled (guarded by #ifdef in pinconf.h). The Kconfig entry for PINCTRL_BM1880 never selects GENERIC_PINCONF, so any config that enables CONFIG_PINCTRL_BM1880=y without CONFIG_GENERIC_PINCONF=y fails to compile: drivers/pinctrl/pinctrl-bm1880.c:1288:10: error: 'const struct pinconf_ops' has no member named 'is_generic' Found by randconfig testing on arm64; tinyconfig reproducer below. Add the missing select to fix the build. Fixes: 49bd61ebce5f ("pinctrl: Add pinconf support for BM1880 SoC") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Boortz <bennib@mailbox.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl-amd: Don't clear S4 wake bits at probeMario Limonciello1-2/+1
commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") introduced a regression where Wake-on-LAN no longer works after suspend or shutdown on some AMD platforms. Firmware-programmed S4 wake bits for devices like PCIe NICs using PCI PME are cleared at probe, but nothing restores them. Unlike S0i3/S3 wake sources that use enable_irq_wake() -> amd_gpio_irq_set_wake(), PCIe PME does not use GPIO IRQ infrastructure and relies on firmware configuration. The original intent of commit 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") was to clear spurious wake bits left by firmware to prevent unwanted wakeups. However, S4 wake bits are used for hardware-level wake sources like WoL that bypass the kernel's IRQ wake API. Fix by preserving S4 wake bits at probe and only clearing S0i3/S3 bits: - Firmware-configured S4 wake sources (WoL) continue working - Kernel maintains control of S3/S0i3 wake policy via set_wake() - S3-only wake sources work correctly per commit f31f33dbb3ba ("pinctrl: amd: Take suspend type into consideration which pins are non-wake") The trade-off is that firmware-programmed spurious S4 wake bits remain set, but this is less problematic than breaking WoL. Fixes: 6bc3462a0f5e ("pinctrl: amd: Mask wake bits on probe again") Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: microchip-sgpio: add missing select REGMAP_MMIOBenjamin Boortz1-0/+1
The driver calls ocelot_regmap_from_resource() via <linux/mfd/ocelot.h>, which internally uses devm_regmap_init_mmio() and requires REGMAP_MMIO. The Kconfig entry does not select REGMAP_MMIO, causing a build failure when no other driver in the config happens to pull in REGMAP_MMIO: include/linux/mfd/ocelot.h:34:24: error: implicit declaration of function 'devm_regmap_init_mmio' Found by randconfig testing on arm64; tinyconfig reproducer below. Fixes: 2afbbab45c26 ("pinctrl: microchip-sgpio: update to support regmap") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Boortz <bennib@mailbox.org> Reviewed-by: Andy Shevchenko <andy@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: devicetree: don't free uninitialized dev_name on error pathKarl Mehltretter1-0/+4
dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps entries, including entries that have not been initialized. Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave dev_name for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfree_const(). Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN: BUG: KASAN: double-free in dt_free_map+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dt_free_map+0x34/0xa4 dt_free_map from dt_remember_or_free_map+0x184/0x198 dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0 Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure. Fixes: be4c60b563ed ("pinctrl: devicetree: Avoid taking direct reference to device name string") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: Remove redundant dev_err()/dev_err_probe()Pan Chuang3-8/+3
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: bcm: Remove redundant dev_err()Pan Chuang1-4/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-25pinctrl: airoha: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-24Input: iforce - validate input packet lengthsPengpeng Hou2-1/+13
iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. The status tail is a sequence of 16-bit effect addresses, but an incomplete final address is also consumed. A successful zero-length USB URB additionally reads the packet ID before the common parser is called. Reject the zero-length USB transfer, require the seven-byte joystick and wheel prefixes and the two-byte status prefix, and consume only complete status-tail addresses. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260720115018.75045-1-pengpeng@iscas.ac.cn Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-24Merge tag 'block-7.2-20260724' of ↵Linus Torvalds2-17/+31
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix a ublk recovery hang, where END_USER_RECOVERY without a successful START_USER_RECOVERY could be satisfied by a stale completion latch - Fix a stack out-of-bounds read in the CDROMVOLCTRL ioctl - MAINTAINERS email address update for Roger Pau Monne * tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: MAINTAINERS: update my email address cdrom: fix stack out-of-bounds read in CDROMVOLCTRL ublk: wait on ublk_dev_ready() instead of ub->completion
2026-07-24Input: psxpad-spi - set driver data before useLinmao Li1-0/+1
psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe. Fixes: 8be193c7b1f4 ("Input: add support for PlayStation 1/2 joypads connected via SPI") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260721055551.1714965-1-lilinmao@kylinos.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-24Merge branch 'ib-mfd-legacy-gpio-7.3' of ↵Dmitry Torokhov2-65/+183
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next Sync up with MFD tree to get updates to ROHM drivers.
2026-07-24Input: charlieplex_keypad - check gpiod_direction_output() return valueSurendra Singh Chouhan1-1/+3
charlieplex_keypad_scan_line() currently ignores the return value of gpiod_direction_output() when setting the active output line for scanning. If setting the GPIO direction fails (e.g. on I2C/SPI GPIO expanders or hardware errors), the function continues to sleep and read input values from an improperly configured GPIO line. Fix this by capturing the return value of gpiod_direction_output() and returning the error code immediately if it fails. Fixes: 2ca45e57ea02 ("Input: charlieplex_keypad - add GPIO charlieplex keypad") Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com> Link: https://patch.msgid.link/20260723022943.9337-1-kr494167@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-24Input: iqs5xx - validate firmware record destination spanPengpeng Hou1-1/+2
The firmware record parser checks that the record address starts within the programmable map, but does not check that the complete record data fits in that map. A record near the end of the map can therefore make the copy to pmap exceed its destination span. Check the record length against the remaining programmable map range before copying the record data. Fixes: 7b5bb55d0dad ("Input: add support for Azoteq IQS550/572/525") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-25power: supply: Add driver for TI BQ25630 chargerWaqar Hameed3-0/+1081
TI BQ25630 is a battery charger that is I2C controlled. Despite its model name, it is rather different from the other devices in the BQ256xx family; it has a completely different register layout and some other additional functionality (see the datasheet for more details [1]). The most "annoying" thing is that it has two different register lengths: 8-bit and 16-bit. Moreover, the 16-bit registers are further partitioned into either being little- or big-endian... Luckily, `regmap` has support for multiple `regmap_config`s (by setting unique names). Therefore, use three different `regmap_config`s for the corresponding registers. ADC functionality has been left out, due to it not having any real-world use-cases. The `enum power_supply_property` values are straightforward to map. Some properties are clamped (e.g. voltage/current ranges). Common `bq25630_read/write_limit()` functions for this are therefore suitable. Interrupts are sent whenever a state change is detected. Save the state status registers in `bq25630_data` and `memcmp()` this in order to decide if `power_supply_changed()` should be called or not. The actual state values are in (and fetched from) the other `power_supply_property`-mapped registers. [1] https://www.ti.com/lit/gpn/bq25630 Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/ca5228dc74705adf96f0af5363ccb65bb965640b.1782683551.git.waqar.hameed@axis.com [Set power-supply type to POWER_SUPPLY_TYPE_USB] Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-24veth: convert frag_list skbs before running XDPMatt Fleming1-2/+2
A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects. Fixes: 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") Cc: stable@vger.kernel.org Signed-off-by: Matt Fleming <mfleming@cloudflare.com> Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260722191925.2192070-1-matt@readmodwrite.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-25power: supply: bq25890: Fix power_supply reference leakMa Ke1-0/+12
bq25890_fw_probe() acquires a reference to a secondary charger using power_supply_get_by_name(), but the reference is not released on later probe failures or on driver detach. In particular, failures after bq25890_fw_probe() returns successfully, such as a failure in bq25890_hw_init(), also leak the reference. Register a device-managed cleanup action immediately after acquiring the secondary charger. This releases the reference on all subsequent probe failures and on driver detach. Found by code review. Signed-off-by: Ma Ke <make_ruc2021@163.com> Cc: stable@vger.kernel.org Fixes: d54bf877fd87 ("power: supply: bq25890: Add support for having a secondary charger IC") Link: https://patch.msgid.link/20260722044416.1623621-1-make_ruc2021@163.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-24Input: cs40l50-vibra - validate custom data from user spaceHyeongJun An1-2/+8
cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect straight from the ff_effect the user passed to EVIOCSFF, without requiring it to hold anything: work_data.custom_data = memdup_array_user(periodic->custom_data, periodic->custom_len, sizeof(s16)); work_data.custom_len = periodic->custom_len; The driver then reads two words out of that buffer: custom_data[0] as the waveform bank in cs40l50_effect_bank_set(), and custom_data[1] as the index within the bank in cs40l50_effect_index_set(). Neither read is covered by a length check, and custom_len is fully user controlled: - custom_len == 0 makes memdup_array_user() call memdup_user() with a length of zero, which returns ZERO_SIZE_PTR rather than an error, so custom_data[0] dereferences it. - custom_len == 1 allocates two bytes. A bank of ROM or RAM keeps effect->type out of the OWT case, and custom_data[1] is then read one word past the allocation. The bank value itself is also mishandled. It is masked with CS40L50_CUSTOM_DATA_MASK (0xffff) but stored in an s16, so a custom_data[0] of 0x8000 or above wraps to a negative value that passes the "bank_type >= CS40L50_WVFRM_BANK_NUM" test. cs40l50_effect_index_set() indexes vib->dsp.banks[] with it before the switch statement's default case gets a chance to reject it: base_index = vib->dsp.banks[effect->type].base_index; max_index = vib->dsp.banks[effect->type].max_index; Require the two words the driver reads to be present, and hold the masked bank in a u32 so the existing upper-bound test covers the whole range. The da7280 haptic driver already range checks custom_len this way. Fixes: c38fe1bb5d21 ("Input: cs40l50 - Add support for the CS40L50 haptic driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260718074032.1864861-1-sammiee5311@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-24dpll: use pin owner's dpll ref for pin-level attribute reportingIvan Vecera3-10/+78
Commit c191b319f208 ("dpll: allow registering FW-identified pin with a different DPLL") relaxed dpll_pin_register() to let fwnode-identified pins register with DPLLs from a different driver. This allows, for example, the ICE driver to register a zl3073x-created pin with its TXC DPLL using ice_dpll_txclk_ops, which lack frequency_get and phase_adjust_get callbacks. After such cross-driver registration, the pin's dpll_refs xarray contains refs from both drivers. dpll_cmd_pin_get_one() calls dpll_xa_ref_dpll_first() which returns the ref with the lowest DPLL id. When the foreign DPLL (e.g. ICE TXC) has a lower id than the owner DPLL (e.g. zl3073x), the foreign ops are used for reporting. Since those ops lack callbacks like frequency_get, pin-level attributes are silently omitted from the netlink response. For example, a zl3073x output pin that should report frequency and phase-adjust shows neither: Before: # dpll pin show id 45 pin id 45: module-name: zl3073x clock-id: 3427468959636104019 board-label: 156M25_NAC0_CLKREF_SYNC package-label: OUT3 type: synce-eth-port capabilities: 0x0 phase-adjust-min: -2147483648 phase-adjust-max: 2147483647 phase-adjust-gran: 800 parent-device: ... After: # dpll pin show id 19 pin id 19: module-name: zl3073x clock-id: 15964355450360090479 board-label: 156M25_NAC0_CLKREF_SYNC package-label: OUT3 type: synce-eth-port frequency: 156250000 Hz frequency-supported: 156250000 Hz capabilities: 0x0 phase-adjust-min: -2147483648 phase-adjust-max: 2147483647 phase-adjust-gran: 800 phase-adjust: 0 parent-device: ... Fix this by: 1. Adding dpll_pin_own_dpll_ref_first() helper that returns the first ref whose DPLL matches the pin's (module, clock_id) tuple -- i.e. the DPLL from the driver that created the pin and has the complete set of ops. Return NULL if no owner ref is found. 2. Using dpll_pin_own_dpll_ref_first() in dpll_cmd_pin_get_one() with a fallback to dpll_xa_ref_dpll_first() for pin-on-pin child pins whose dpll_refs all point to a different driver's DPLLs. 3. Using dpll_pin_own_dpll_ref_first() in SET operations (dpll_pin_freq_set, dpll_pin_esync_set, dpll_pin_ref_sync_state_set, dpll_pin_phase_adj_set) returning -ENODEV if no owner ref exists. Replacing the validation loops that rejected the entire operation when any ref's ops lacked the required callback -- instead validate only the owner refs so that foreign DPLLs with incomplete ops no longer block SET operations. 4. Guarding all SET and rollback xa_for_each loops against NULL set callbacks so that foreign refs without the operation are safely skipped instead of causing a NULL pointer dereference. Fixes: c191b319f208 ("dpll: allow registering FW-identified pin with a different DPLL") Signed-off-by: Ivan Vecera <ivecera@redhat.com> Acked-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260714125945.1823269-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-25power: supply: pf1550: enable charging when battery profile existsXu Rao1-1/+1
PF1550 starts in charger mode 1, where charging is disabled. The driver comment says that mode 2 should be selected for applications using a battery, but the condition is inverted: PF1550_CHG_BAT_ON is written only when power_supply_get_battery_info() fails. Consequently, a board with a valid monitored-battery profile is left in the default charger-off mode, while a board without battery information enables charging with fallback settings. Select mode 2 when battery information is available. Fixes: 4b6b6433a97d ("power: supply: pf1550: add battery charger support") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/097F0559A936ACCB+20260724095437.368905-1-raoxu@uniontech.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-25power: supply: pm8916_lbc: remove conditional return with no effectSang-Heon Jeon1-5/+1
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Link: https://patch.msgid.link/20260723184538.3888637-27-ekffu200098@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-25power: supply: rt9455: quiesce delayed work before teardownFan Wu1-4/+17
The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself. rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled: rt9455_remove() workqueue cancel pwr_rdy_work cancel max_charging_time_work batt_presence_work queues max_charging_time_work cancel batt_presence_work return devres frees rt9455_info max_charging_time_work dereferences rt9455_info The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455_hw_init() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455_info after it has been freed. Register rt9455_cancel_all_delayed_works() through devm_add_action_or_reset() right after devm_power_supply_register(). devres invokes the action in reverse registration order, after the managed IRQ has been freed and before rt9455_info is released, so the delayed works are drained in both rt9455_remove() and the probe error path. Cancel pwr_rdy_work and batt_presence_work before max_charging_time_work because both can queue the latter. This issue was found by an in-house static analysis tool. Fixes: e86d69dd786e ("power_supply: Add support for Richtek RT9455 battery charger") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260723225310.12663-1-fanwu01@zju.edu.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-25power: supply: hold extensions_sem when creating LED triggersSteffen Dirkwinkel1-4/+4
LED triggers were created in __power_supply_register without holding the extensions_sem lock. Since commit b04510c3af6d ("power: supply: leds: create triggers based on properties, not type") we call power_supply_has_property during trigger creation and access the extensions there. Move power_supply_create_triggers down into the lock scope used for power_supply_add_hwmon_sysfs for the same reason. Fixes: b04510c3af6d ("power: supply: leds: create triggers based on properties, not type") Reported-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Closes: https://lore.kernel.org/all/a95a2720-4092-4b49-bd9d-b700f1c2680d@intel.com/ Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com> Tested-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Link: https://patch.msgid.link/20260724-power-supply-triggers-lockdep-v1-1-9b451b1f1916@beckhoff.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-25power: reset: reboot-mode: Remove devres based allocationsShivendra Pratap1-11/+19
Devres APIs are intended for use in drivers, where the managed lifetime of resources is tied directly to the driver attach/detach cycle. To ensure correct lifetime handling, avoid using devres-based allocations in the reboot-mode and explicitly handle allocation and cleanup of resources. Fixes: cfaf0a90789a ("power: reset: reboot-mode: Expose sysfs for registered reboot_modes") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607191025.h6bQp891-lkp@intel.com/ Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Shivendra Pratap <shivendra.pratap@oss.qualcomm.com> Link: https://patch.msgid.link/20260724-arm-psci-system_reset2-vendor-reboots-v24-1-ed5125785ef6@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-24octeontx2-af: add support for custom L2 headerSatheesh Paul A2-0/+8
Add packet parsing support for custom L2 headers. Also add support to include a field from the custom header for flow tag generation. Introduce a new flow key type NIX_FLOW_KEY_TYPE_CH_LEN_90B which maps to the NPC_LT_LA_CUSTOM_L2_90B_ETHER layer type. This extracts a 2-byte field at a 24-byte offset in layer A to be used in flow tag generation. Signed-off-by: Satheesh Paul A <psatheesh@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Link: https://patch.msgid.link/20260715072035.617544-1-nshettyj@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24Merge branch 'for-7.3/cxl-fixes' into cxl-for-nextDave Jiang1-7/+3
cxl/region: Use __free(put_device) in find_pos_and_ways() cxl/region: Fix use-after-free in find_pos_and_ways() error path
2026-07-24cxl/region: Use __free(put_device) in find_pos_and_ways()Alison Schofield1-5/+2
Use __free(put_device) for the switch decoder reference returned by device_find_child() instead of releasing it with an open-coded put_device(). This matches the scoped device reference handling used elsewhere in the file. Suggested-by: Li Ming <ming.li@zohomail.com> Reviewed-by: Li Ming <ming.li@zohomail.com> Signed-off-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/550db1771b3d30277988d3e575f1a6893a26b0ae.1784931354.git.alison.schofield@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-07-24cxl/region: Fix use-after-free in find_pos_and_ways() error pathAlison Schofield1-4/+3
The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder can be freed before the error message accesses its name. Drop the reference after the error is reported. Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries") Reviewed-by: Li Ming <ming.li@zohomail.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/10deb519b543ef693ce23148b509a03fe1c07d0c.1784931354.git.alison.schofield@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-07-24PCI/AER: Move retrieval of FEP and TLP Log into helperLukas Wunner1-13/+22
When aer_get_device_error_info() gathers information on Uncorrectable Errors from a device, it reads the First Error Pointer and TLP Prefix/ Header Log and caches them in struct aer_err_info. Those two fields will also need to be read for Advisory Non-Fatal Errors (which are signaled as Correctable Errors). Move their retrieval into a new aer_get_uncor_info() helper for reuse by the imminent Advisory Non-Fatal Error support. No functional change intended. Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/0f2f037c7ccf099f0c253cbc4ad9be526c68c5af.1784905909.git.lukas@wunner.de
2026-07-24PCI/AER: Emit TLP Log only for unmasked errorsLukas Wunner1-2/+3
Per PCIe r7.0 sec 6.2.5, the prefix and header of an offending TLP is only recorded for unmasked Uncorrectable Errors. Yet when the AER driver determines whether a prefix and header has been logged, it does not take the Uncorrectable Error Mask Register into account. Fix it. Fixes: 6c2b374d7485 ("PCI-Express AER implemetation: AER core and aerdriver") Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: stable@vger.kernel.org # v2.6.19+ Link: https://patch.msgid.link/2e712b96ba5bfc729d78bfc23f7fb7d285aa3d6d.1784905909.git.lukas@wunner.de
2026-07-24PCI/AER: Deduplicate logging of Error Source IdentificationLukas Wunner1-9/+4
aer_print_source() already logs the Error Source Identification Register: AER: Multiple Correctable error message received from 0000:b7:02.0 However aer_print_error() subsequently identifies the Error Source once more by emitting an "Error of this Agent is reported first" message. The additional message was introduced by commit 0d465f23502e ("PCI: pcie, aer: fix report of multiple errors") because it deemed the message emitted by aer_print_source() confusing: When the Multiple ERR_COR Received or Multiple ERR_FATAL/NONFATAL Received bit in the Root Error Status Register is set, it doesn't mean that all errors originated from the device in the Error Source Identification Register. Rather, the errors may have come from multiple distinct devices. The commit sought to make that clearer. Achieve the commit's objective by rephrasing the message emitted by aer_print_source() and drop the additional message logged by aer_print_error() to reduce dmesg noisiness and simplify the code. While modifying the log message anyway, fix minor grammatical issues: Append a plural "s" to "message", add a missing closing brace to "(no details found" and capitalize "Error" to match the spec. Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/3a5d1624d6912db1bc8c4e89e7a6a72ac510f4dc.1784905909.git.lukas@wunner.de
generated by cgit (git 2.54.0.dirty) at 2026-09-30 21:24:37 +0000