summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-07-17comedi: das6402: Add sanity check to interrupt handlerIan Abbott1-2/+8
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: aio_iiro_16: Add sanity check to interrupt handlerIan Abbott1-0/+3
The driver requests an interrupt handler for the device, after setting device registers to disable interrupt generation. The interrupt handler should not be called prematurely unless the user-configured I/O port base address and/or IRQ number are incorrect or the hardware is bad. For safety, check the dev->attached flag in the interrupt handler to ensure the device has been fully set up, avoiding a possible null pointer dereference of dev->read_subdev. Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/lkml/20260610115912.780131-1-jjy600901@snu.ac.kr/ Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr> Reported-by: Kyungwook Boo <bookyungwook@gmail.com> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260618102949.26607-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: ni_pcimio: set PCI-6220 dio_speed and ai_fifo_depth from NI specsShashwat Agrawal1-2/+3
The PCI-6220 board entry was missing .dio_speed, unlike the PXI-6220 and the other 622x boards in the table. Set it to 1000 ns to match those entries and the 1 MHz maximum DI/DO sample clock on Port 0 in the NI PCI/PXI-6220 specifications. Also update .ai_fifo_depth for PCI-6220 and PXI-6220 from 512 to 4095 samples, matching the documented AI input FIFO size and the rest of the 622x entries. Link: https://www.ni.com/docs/en-US/bundle/pci-pxi-6220-specs/page/specs.html Signed-off-by: Shashwat Agrawal <shashwatagrawal473@gmail.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260629135404.19835-1-shashwatagrawal473@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: speakup: unregister tty ldisc on later init failuresHaoxiang Li1-0/+1
The ldisc registration is intentionally non-fatal, since some synth drivers do not use tty/ldisc. However, once speakup_init() continues past the registration point and later fails, the init unwind path should mirror speakup_exit() and call spk_ttyio_unregister_ldisc(). Add the missing unregister call to the error path after synth_release(), matching the normal module exit cleanup order. Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Fixes: e23a9b439ce9 ("staging: speakup: safely register and unregister ldisc") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260531230804.254962-16-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: speakup_soft: fix comment style and repeated wordFrancisco Maestre1-1/+2
Fix comment style issues in speakup_soft.c: - Move the closing '*/' of the block comment to its own line, as required by the kernel coding style Signed-off-by: Francisco Maestre <francisco@maestretorreblanca.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-15-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix typo in a speakup messageBastien Nocera1-1/+1
s/read windo/read window/ Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-14-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix incorrect "index" pluralBastien Nocera1-1/+1
It's indexes or indices. Given that the constant is called "STAT_index_valid", "indexes" was the preferred plural. Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-13-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix spelling of "re-enable"Bastien Nocera2-3/+3
Detected using codespell. Signed-off-by: Bastien Nocera <hadess@hadess.net> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-12-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17Accessibility: speakup_soft: Fix double word in commentsBo Liu1-1/+1
Remove the repeated word "the" in comments. Signed-off-by: Bo Liu <liubo03@inspur.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-11-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: keyhelp: guard letter_offsets possible out-of-range indexingPavel Zhigulin1-5/+12
help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. Function names can be overridden with the following commands as root: modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound. Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-10-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: Use str_plural() to simplify the codeXichao Zhao1-2/+2
Use the string choice helper function str_plural() to simplify the code. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-9-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Standardize character attribute types to u16Jagadeesh Yalapalli8-53/+53
This change replaces non-portable `u_short` types with standardized `u16` throughout the speakup subsystem to ensure: 1. Consistent 16-bit width across all architectures. 2. Improved code portability and readability. 3. Elimination of platform-dependent type sizes. 4. Safe bitwise operations without sign-extension risks. Signed-off-by: Jagadeesh Yalapalli <jagadeesh.yalapalli@einfochips.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-8-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: Fix the wrong format specifierliujing1-1/+1
Make a minor change to eliminate a static checker warning. The type of '(unsigned int)kp[i]' is unsigned int, so the correct format specifier should be %u instead of %d. Signed-off-by: liujing <liujing@cmss.chinamobile.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-7-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup: genmap: remove redundant post-incrementbajing1-1/+0
In the while loop, the variable lc is unused and is reinitialized later, so this redundant operation should be removed. Signed-off-by: bajing <bajing@cmss.chinamobile.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-6-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility: speakup: Fix incorrect string length computation in ↵Christophe JAILLET1-3/+3
report_char_chartab_status() snprintf() returns the "number of characters which *would* be generated for the given input", not the size *really* generated. In order to avoid too large values for 'len' (and potential negative values for "sizeof(buf) - (len - 1)") use scnprintf() instead of snprintf(). Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260531230804.254962-5-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17speakup/utils: use "!P" instead of "P == 0"Xu Panda1-1/+1
comparing pointer to 0, use !P instead of it. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Xu Panda <xu.panda@zte.com.cn> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-4-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility/speakup/speakup_dtlk: Add header file macro definitionLi zeming1-0/+3
Add header file macro definition. Signed-off-by: Li zeming <zeming@nfschina.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-3-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17accessibility/speakup/speakup_acnt: Add header file macro definitionLi zeming1-0/+3
I think the header file could avoid redefinition errors. at compile time by adding macro definitions. Signed-off-by: Li zeming <zeming@nfschina.com> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://patch.msgid.link/20260531230804.254962-2-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17uio: make read-only const array porttypes staticColin Ian King1-1/+1
Don't populate the read-only const array porttypes on the stack at run time, instead make it static const char * const Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20260714185624.192829-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17uio: sercos3: add missing MODULE_DEVICE_TABLE()Pengpeng Hou1-0/+1
The driver has a match table for the pci bus wired into its driver structure, but the table is not exported with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE() entry so module alias information is generated for automatic module loading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the driver registration structure, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704152642.54769-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17uio: Fix stale info pointer in failed registration pathYuho Choi1-0/+5
After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device(). Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Link: https://patch.msgid.link/20260630192714.1867170-1-dbgh9129@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17parport: Consistently define pci_device_ids using named initializersUwe Kleine-König (The Capable Hub)2-227/+257
... and PCI device helpers. The various struct pci_device_id arrays were initialized mostly by list expressions. This isn't easily readable if you're not into PCI. Use PCI_DEVICE* helper macros and named initializers which is more explicit and thus easier to parse. Also skip explicit assignments of 0 (which the compiler then takes care of). The secret plan is to make struct pci_device_id::driver_data an anonymous union (similar to https://lore.kernel.org/all/cover.1776579304.git.u.kleine-koenig@baylibre.com/) and that requires named initializers. But it's also a nice cleanup on its own. This change doesn't introduce changes to the compiled pci_device_id arrays. Tested on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260429161453.4154681-2-u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: Improve style of pnp_device_id array terminatorsUwe Kleine-König (The Capable Hub)2-4/+4
To match how device-id array terminators look like for other device types drop `.id = ""` from it and let the compiler care for zeroing the entry. While touching these arrays, also align spacing to how these arrays are usually written. There are no changes in the compiled drivers, only the source looks nicer. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/f23c9d77836f3b14b1efc58e3969333e8addb1c1.1781078782.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: Initialize pci_device_ids using PCI_DEVICE macrosUwe Kleine-König (The Capable Hub)4-19/+23
The PCI_DEVICE macro and its variants allow to initialize the first four members of a struct pci_device_id in a bit more compact form and also with an easier to grasp semantic. Explicit zeros are not needed, the compiler fills these in automatically. So convert all array members to such a macro and drop unneeded zeros. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260629165426.3330888-2-u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: lpvo_usb_gpib: use memdup_user() instead of kmalloc() and copy_from_user()Mohammad Shahid1-8/+3
Use memdup_user() to replace the open-coded kmalloc() and copy_from_user() sequence. This simplifies the code while preserving the existing behavior. This issue was reported by memdup_user.cocci. Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com> Link: https://patch.msgid.link/20260705051701.142070-1-mdshahid03@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: lpvo_usb: fix path of the "debug" module parameter in commentZenghui Yu1-1/+1
The correct path of the "debug" module parameter should be /sys/module/lpvo_usb_gpib/parameters/debug. Fix it. Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260621074926.11252-1-zenghui.yu@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: use 'static inline' instead of 'extern inline'Arnd Bergmann2-7/+7
With GNU inline semantics, an 'extern inline' function is only included in the build if it can be inlined. When the compiler for some reason decides against inlining it, this causes a link failure, as observed in one function in the tnt4882_gpib driver: ld.lld: error: undefined symbol: mite_irq >>> referenced by tnt4882_gpib.c:974 (/home/arnd/arm-soc/drivers/gpib/tnt4882/tnt4882_gpib.c:974) >>> drivers/gpib/tnt4882/tnt4882_gpib.o:(ni_pci_attach) in archive vmlinux.a Change all of the 'extern inline' definitions in gpib to the regular 'static inline' to avoid this. Fixes: 0cd5b05551e0 ("staging: gpib: Add TNT4882 chip based GPIB driver") Fixes: 6c52d5e3cde2 ("staging: gpib: Add common include files for GPIB drivers") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260611131018.3662609-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: Move stuck SRQ update under lockGui-Dong Han2-13/+11
Move the stuck SRQ state update into autopoll_all_devices() and keep it under big_gpib_mutex. Except for initialization, keep the stuck_srq users under this mutex. autopoll_all_devices() is only called by autospoll_thread(), so there is no need to return to autospoll_thread() and set this state after dropping big_gpib_mutex. Without the mutex, a newly opened device can clear stuck_srq and have that clear overwritten by the previous autospoll result: autospoll: serial_poll_all() returns 0 and unlocks big_gpib_mutex open_dev_ioctl: open new device and clear stuck_srq with big_gpib_mutex held autospoll: set stuck_srq That leaves the board marked stuck again after the new device is opened. autospoll_wait_should_wake_up() then refuses to poll while stuck_srq is set, so later SRQ handling can be mistakenly suppressed. Without the mutex, atomic_set() and set_bit() only make individual updates atomic. They do not order the two updates or make stuck_srq and status visible as a consistent pair. Taking big_gpib_mutex serializes the state transition with the other runtime users. Keep the existing wakeup behavior unchanged and only move the stuck SRQ state update under the mutex. Fixes: 9dde4559e939 ("staging: gpib: Add GPIB common core driver") Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Link: https://patch.msgid.link/20260522073447.4117690-1-hanguidong02@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17tlclk: if sscanf() fails, fall back to 0, not random valueAlexander A. Klimov1-18/+18
If sscanf(IN, FMT, &OUT) fails, OUT may be unchanged. So if OUT was never initialized, it may be still uninitialized memory. To prevent such, initialize OUT=0 first. Fixes: 648bf4fb21f5 ("[PATCH] tlclk driver update") Fixes: 1a80ba882730 ("[PATCH] Telecom Clock Driver for MPCBL0010 ATCA computer blade") Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de> Link: https://patch.msgid.link/20260526061321.6123-4-grandmaster@al2klimov.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17gpib: fmh_gpib: Fix typoDominik Karol Piątkowski1-1/+1
Fix typo: Hueristically -> Heuristically Signed-off-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com> Link: https://patch.msgid.link/20260528172306.34050-1-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17intel_th: fix MSC output device reference leakGuangshuo Li2-10/+2
intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use. commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release(). However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead. For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open(). Consequently, every successful MSC output open leaks one device reference. Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files. Remove the now-unused intel_th_output_release() callback from intel_th_output_fops. Fixes: 95fc36a234da ("intel_th: fix device leak on output open()") Cc: stable <stable@kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260715070851.2077965-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: nsm: pin the module while the device is openXu Rao1-0/+1
misc_open() installs a misc driver's file operations with fops_get(), which pins file_operations::owner before replacing the file's f_op. The NSM misc device leaves nsm_dev_fops.owner unset, so opening /dev/nsm does not take a module reference on the nsm driver. If the driver is built as a module, an open file descriptor can therefore survive rmmod of the module that provides its ioctl callbacks. A later ioctl through that descriptor can call into unloaded module text. Set nsm_dev_fops.owner to THIS_MODULE so the misc core holds the module while any /dev/nsm file descriptor is open, matching the lifetime expectation for the installed file operations. Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver") Cc: stable <stable@kernel.org> Signed-off-by: Xu Rao <raoxu@uniontech.com> Link: https://patch.msgid.link/BE6951D13B5E5513+20260713055523.3193089-1-raoxu@uniontech.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17mei: bus: access mei_device under device_lock on cleanupAlexander Usyskin1-7/+9
Fix couple of problems in mei_cl_bus_dev_release(): mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus. Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus). This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too. Cc: stable <stable@kernel.org> Fixes: 35e8a426b16a ("mei: bus: Check for still connected devices in mei_cl_bus_dev_release()") Reviewed-by: Menachem Adin <menachem.adin@intel.com> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://patch.msgid.link/20260705151259.3054795-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: nsm: only unlock nsm_dev on post-lock error pathsRunyu Xiao1-1/+1
nsm_dev_ioctl() jumps to the common out label even when the initial copy_from_user() fails before nsm->lock has been taken. The error path then blindly unlocks a mutex that was never acquired. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the miscdevice ioctl entry and the pre-lock copy_from_user(&raw, argp, _IOC_SIZE(cmd)) failure path by issuing NSM_IOCTL_RAW with an invalid user pointer. That failure reaches the shared out label before mutex_lock(&nsm->lock). Lockdep reported: WARNING: bad unlock balance detected! exploit/193 is trying to release lock (&global_nsm.lock) at: nsm_dev_ioctl+0x5f/0xcf [vuln_msv] but there are no more locks to release! no locks held by exploit/193. Return immediately on the pre-lock copy_from_user() failure and keep the common unlock label for the post-lock paths only. Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver") Cc: stable <stable@kernel.org> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Reviewed-by: Alexander Graf <graf@amazon.com> Link: https://patch.msgid.link/20260617145350.513875-1-runyu.xiao@seu.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17comedi: comedi_parport: deal with premature interruptIan Abbott1-3/+10
Syzbot reported a general protection fault in `comedi_get_is_subdevice_running()`, which was called from the interrupt handler `parport_interrupt()` in the "comedi_parport" driver, but it does not currently have a C reproducer for the problem. It's probably due to a premature interrupt for one of two reasons: 1. The driver sets up the interrupt handler before the comedi subdevices used by the interrupt handler have been allocated, but does not disable the interrupt in the parallel port's CTRL register first. 2. The driver uses a user-supplied I/O port base address which Syzbot would have supplied, but it might not be backed by real parallel port hardware. Change the initialization order in the driver's comedi "attach" handler (`parport_attach()`) so that the hardware registers are initialized before the interrupt handler is requested. This should prevent premature interrupts occurring for real hardware. Also add a test to the interrupt handler to ensure the comedi device is fully attached and return early if it isn't. Fixes: 241ab6ad7108e ("Staging: comedi: add comedi_parport driver") Reported-by: syzbot+f24c3d5d316011bacc70@syzkaller.appspotmail.com Cc: stable <stable@kernel.org> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260527125104.96596-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17uio_hv_generic: Bind to FCopy device by defaultBen Hutchings1-1/+7
The Hyper-V kernel-mode fcopy driver was removed in 6.10 and the new fcopy daemon requires this uio driver to function. However, by default the driver does not bind to any devices, and must be configured through the sysfs "new_id" file. Since the FCopy device is now only usable through this driver, add its ID to the driver's ID table so that the daemon will work "out of the box". Signed-off-by: Ben Hutchings <benh@debian.org> Fixes: ec314f61e4fc ("Drivers: hv: Remove fcopy driver") Cc: stable <stable@kernel.org> Link: https://patch.msgid.link/ahQ6xuhSReidmN-3@decadent.org.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17dmaengine: Constify struct dma_descriptor_metadata_opsChristophe JAILLET2-2/+2
'struct dma_descriptor_metadata_ops' in not modified in these drivers. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 120635 21584 64 142283 22bcb drivers/dma/xilinx/xilinx_dma.o After: ===== text data bss dec hex filename 120699 21520 64 142283 22bcb drivers/dma/xilinx/xilinx_dma.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Link: https://patch.msgid.link/b0a22171f3ed68e156a2fa84383e99c23ec6b2ff.1784037977.git.christophe.jaillet@wanadoo.fr Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17dmaengine: validate dev and name in dma_request_chan()bui duc phuc1-1/+6
dma_request_chan() assumes both @dev and @name are valid, but neither is checked before use. dev is dereferenced immediately via dev_fwnode(), which accesses dev->of_node or dev->fwnode without checking for NULL. Likewise, if name is NULL and the OF/ACPI lookup does not succeed, the legacy filter-map path eventually passes it to strcmp(), resulting in a NULL pointer dereference. These are caller bugs rather than normal lookup failures, so add a WARN_ON() at function entry to catch invalid arguments early during development instead of crashing later. No functional change for valid callers. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260716052758.23465-1-phucduc.bui@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17Merge tag 'svc_fixes_for_v7.2' of ↵Greg Kroah-Hartman1-8/+11
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus Dinh writes: firmware: stratix10-svc: fixes for v7.2 - Fix a memory leak by explicitly using kfree() to match the list-managed lifetime - Fix FCS SMC call documentation - Add proper handling of a no response from the SDM - Fix teardown order of service driver * tag 'svc_fixes_for_v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs
2026-07-17staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()Moksh Panicker1-1/+8
rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - in_ie[cnt + 1] is read without checking cnt + 1 < in_len - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check - in_ie[cnt + 1] is used as length without verifying payload fits Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable <stable@kernel.org> Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com> Link: https://patch.msgid.link/20260625202911.26782-1-mokshpanicker.7@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: fix inverted HT40 secondary channel offsetMinJea Kim1-1/+1
rtw_get_chan_type() maps the driver's channel offset to nl80211 channel types the wrong way around. In this driver HAL_PRIME_CHNL_OFFSET_LOWER means the primary channel is the lower 20 MHz half of the 40 MHz pair, i.e. the secondary channel is above the primary one: rtw_get_center_ch() computes the center channel as "channel + 2" for OFFSET_LOWER, and bwmode_update_check() sets OFFSET_LOWER when the AP's HT operation IE announces SCA (secondary channel above). In nl80211 terms that is NL80211_CHAN_HT40PLUS, not HT40MINUS. Because of the inversion, cfg80211_rtw_get_channel() reports an HT40+ association as HT40-. For an HT40+ AP on a low channel (e.g. channel 3) the resulting chandef spans below the 2.4 GHz band edge and is invalid, so the regulatory core tears the connection down 60 seconds (REG_ENFORCE_GRACE_MS) after the AP's country IE triggers a regdomain change: reg_check_chans_work() considers the reported chandef unusable and calls cfg80211_leave(). The supplicant then reconnects, the country IE changes the regdomain again, and the cycle repeats, causing a disconnect/reconnect loop every ~65 seconds for as long as the link is up. Observed on a TECLAST X80 Power tablet (RTL8723BS) associated to an HT40+ AP on channel 3 with a KR country IE; a kprobe trace showed cfg80211_disconnect() being invoked from reg_check_chans_work(). With the mapping fixed, "iw dev wlan0 info" reports the correct "width: 40 MHz, center1: 2432 MHz" and the periodic disconnects stop. Fixes: 5402cc178c5d ("staging: rtl8723bs: add get_channel cfg80211 implementation") Cc: stable@vger.kernel.org Assisted-by: Claude-Code:claude-fable-5 bpftrace Signed-off-by: MinJea Kim <qndkdrnl@gmail.com> Link: https://patch.msgid.link/20260714131421.3980-1-qndkdrnl@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17dma: fsl_raid: use devm_platform_ioremap_resourceRosen Penev1-9/+5
Replace the open-coded platform_get_resource() plus devm_ioremap() sequence with devm_platform_ioremap_resource(), which fetches the resource, requests the region and maps it in one call. Switch the error check to IS_ERR()/PTR_ERR() and drop the now-unused struct resource pointer. The raideng node has a single reg region (0x320000, 0x10000); the job-queue/ring children are separate OF devices probed independently, so the region reservation added by devm_ioremap_resource() is exclusive and does not introduce overlap failures. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260716202949.677290-5-rosenp@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17dma: fsl_raid: keep MMIO bases as void __iomem and cast at accessRosen Penev2-11/+12
The fsl_re_ctrl and fsl_re_chan_cfg structures describe memory-mapped RAID Engine registers accessed only via ioread32be()/iowrite32be(), yet the pointers to them (re_regs in struct fsl_re_drv_private, and jrregs in struct fsl_re_chan) were not __iomem-qualified, so sparse emitted "different address spaces" warnings for every register access. Store both MMIO bases as a plain void __iomem * and derive jrregs with void __iomem * arithmetic from re_regs, rather than carrying typed register struct pointers through the driver. Each function that touches the registers introduces a local typed pointer (struct fsl_re_ctrl __iomem *ctrl) and uses ->field, which is the idiomatic kernel pattern and keeps the registers' __iomem qualification intact. Reported-by: kernel test robot <lkp@intel.com> Link: https://lore.kernel.org/oe-kbuild-all/202008111749.yy85rFMD%25lkp@intel.com/ Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260716202949.677290-4-rosenp@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17dma: fsl_raid: set final bit via fill_cfd_frame() argumentRosen Penev1-8/+8
The final-frame bit is now passed as the "final" argument of fill_cfd_frame() (as fsl_re_prep_dma_memcpy already did) and set in CPU order before the single cpu_to_be32() store, replacing the previous read-modify-write of the __be32 efrl32 field. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260716202949.677290-3-rosenp@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17dma: fsl_raid: convert descriptor stores to big-endianRosen Penev1-6/+7
The descriptor structs (fsl_re_cmpnd_frame / fsl_re_hw_desc) are in-memory but their fields are __be32, because the structures are handed to the device as big-endian. The driver stored CPU-endian u32 values into them directly, which is both wrong (the engine would see byte-swapped lengths/addresses) and flagged by sparse as a base-type mismatch. Wrap those stores in cpu_to_be32() so the values are little->big converted. Reported-by: kernel test robot <lkp@intel.com> Link: https://lore.kernel.org/oe-kbuild-all/202008111749.yy85rFMD%25lkp@intel.com/ Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260716202949.677290-2-rosenp@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17staging: rtl8723bs: Split multiple assignments in _rtw_open_pktfileAmin Madani1-2/+4
In _rtw_open_pktfile(), multiple variables are assigned on the same line. According to the Linux kernel coding style, multiple assignments on a single line should be avoided. Split them into separate lines to improve readability. Signed-off-by: Amin Madani <aminmadani112@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260716083822.2898-1-aminmadani112@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: sm750fb: remove unused set_all_eng_off fieldHungyu Lin3-35/+0
The set_all_eng_off field is only initialized to 0 and is never set by any caller. Remove the unused field together with the dead cleanup path guarded by it. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260716044613.2659-1-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Fix spacing around ternary operator in sdio_intf.cAmin Madani1-1/+1
Add spaces around '?' and ':' in the return statement in sdio_intf.c according to the Linux kernel coding style. Signed-off-by: Amin Madani <aminmadani112@gmail.com> Link: https://patch.msgid.link/20260715170606.96002-1-aminmadani112@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error pathsCong Nguyen1-5/+17
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path). Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed: - issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses. Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq(). Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Cong Nguyen <congnt264@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260715111710.295052-1-congnt264@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: rtw_mlme: make rtw_add_network() staticGongwei Li1-2/+1
Function rtw_add_network() used only in rtw_mlme.c file, so it should be declared static. Remove the redundant prototype and add static keyword to the definition. Signed-off-by: Gongwei Li <ligongwei@kylinos.cn> Link: https://patch.msgid.link/20260715085542.1648015-1-13875017792@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit (git 2.54.0.dirty) at 2026-09-30 06:23:40 +0000