summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-06-29iio: light: gp2ap002: fix runtime PM leak on read errorBiren Pandya1-1/+1
gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runtime_put_autosuspend() call at the "out" label, permanently leaking a runtime PM reference and preventing the device from autosuspending. Replace the direct return with a "goto out" to ensure the reference is properly dropped on the error path. Fixes: f6dbf83c17cb ("iio: light: gp2ap002: Take runtime PM reference on light read") Signed-off-by: Biren Pandya <birenpandya@gmail.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: pressure: mpl115: fix runtime PM leak on read errorBiren Pandya1-2/+2
mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync() before reading the processed pressure or raw temperature, but on the read error path it returns without calling pm_runtime_put_autosuspend(). Each failed read therefore leaks a runtime PM reference and prevents the device from autosuspending. Drop the reference before checking the return value so both the success and error paths are balanced. Fixes: 0c3a333524a3 ("iio: pressure: mpl115: Implementing low power mode by shutdown gpio") Signed-off-by: Biren Pandya <birenpandya@gmail.com> Assisted-by: Claude:claude-opus-4-8 coccinelle Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: accel: kxsd9: fix runtime PM imbalance on write_raw() errorBiren Pandya1-2/+3
kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the matching pm_runtime_put_autosuspend(). This leaks a runtime PM usage-counter reference on every such write, after which the device can no longer autosuspend. Set the error code and fall through to the existing put instead of returning early. Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM") Signed-off-by: Biren Pandya <birenpandya@gmail.com> Assisted-by: Claude:claude-opus-4-8 coccinelle Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: accel: bmc150: clamp the device-reported FIFO frame countBryam Vargas1-0/+2
__bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget: if (samples && count > samples) count = samples; which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]: bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address. Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected. Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: dac: mcp47feb02: Fix passing uninitialized vref1_uV for no Vref1 caseAriana Lazar1-15/+22
Ensure that if a device has Vref1 but reading the regulator returns an error, mcp47feb02_init_ctrl_regs() is not called with an uninitialized vref1_uV value. Also add a device_property_present() check for the Vref1 supply before reading the regulator. Fixes: dd154646d292 ("iio: dac: mcp47feb02: Fix Vref validation [1-999] case") Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/all/adiPnla0M5EzvgD-@stanley.mountain/ Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: adc: ti-ads1119: fix PM reference leak in buffer preenableGuangshuo Li1-1/+5
ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion. If i2c_smbus_write_byte() fails, the function returns the error directly and leaves the runtime PM usage counter elevated. The matching postdisable callback is not called when preenable fails, so the reference is leaked and the device may remain runtime-active indefinitely. Store the I2C transfer result in ret and drop the runtime PM reference on failure before returning the error. Fixes: a9306887eba41 ("iio: adc: ti-ads1119: Add driver") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: adc: ad7380: select REGMAPSamuel Moelius1-0/+1
The AD7380 driver uses generic regmap types and APIs. However, its Kconfig entry does not select REGMAP. As a result, AD7380 can be enabled from an allnoconfig-derived config with SPI_MASTER=y while REGMAP remains unset, causing ad7380.o to fail to build. Fixes: b095217c104b ("iio: adc: ad7380: new driver for AD7380 ADCs") Signed-off-by: Samuel Moelius <samuel.moelius@trailofbits.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29drm/xe/hw_engine: Fix double-free of managed BO in error pathShuicheng Lin1-3/+1
The error path in hw_engine_init() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. Fixes: 0e1a47fcabc8 ("drm/xe: Add a helper for DRM device-lifetime BO create") Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Zongyao Bai <zongyao.bai@intel.com> Link: https://patch.msgid.link/20260626210631.3887291-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-06-29drm/xe/userptr: Drop bogus static from finish in force_invalidateShuicheng Lin1-1/+1
The local "finish" pointer in xe_vma_userptr_force_invalidate() is unconditionally written before each read, so the static storage class serves no purpose. Worse, it makes the variable a process-wide shared slot: the function's per-VM asserts do not exclude concurrent callers on different VMs, so two such callers can race on the slot and take the wrong if (finish) branch. The function is gated by CONFIG_DRM_XE_USERPTR_INVAL_INJECT (developer/test option, default n), so production builds are unaffected. Drop the static. Fixes: 18c4e536959e ("drm/xe/userptr: Convert invalidation to two-pass MMU notifier") Assisted-by: Claude:claude-opus-4.7 Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Zongyao Bai <zongyao.bai@intel.com> Link: https://patch.msgid.link/20260625224452.3243231-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-06-29drm/xe/userptr: Hold notifier_lock for write on inject test pathShuicheng Lin2-10/+48
When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit() runs vma_check_userptr() with the svm notifier_lock taken for read. The test injection causes vma_check_userptr() to call xe_vma_userptr_force_invalidate(), which feeds into xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That flag tells drm_gpusvm_unmap_pages() the caller already holds notifier_lock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires: WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \ drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper] Call Trace: xe_vma_userptr_do_inval+0x40d/0xfd0 [xe] xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe] xe_vma_userptr_force_invalidate+0xde/0x290 [xe] vma_check_userptr.constprop.0+0x1c6/0x220 [xe] xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe] ... xe_vm_bind_ioctl+0x3a0a/0x4480 [xe] Acquire notifier_lock for write in pre-commit when the inject Kconfig is enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock(). Rename xe_svm_assert_held_read() to xe_svm_assert_held_read_or_inject_write() so it asserts the correct mode under each build configuration. Production builds (CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode behavior bit-for-bit. Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Assisted-by: Claude:claude-opus-4.7 Cc: Matthew Auld <matthew.auld@intel.com> Cc: Zongyao Bai <zongyao.bai@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260625215615.3016892-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-06-29pmdomain: mediatek: mtk-mfg: use clk_determine_rate_noop()Brian Masney1-21/+2
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Acked-by: Ulf Hansson <ulfh@kernel.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29pmdomain: mediatek: airoha: use clk_determine_rate_noop()Brian Masney1-7/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Acked-by: Ulf Hansson <ulfh@kernel.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29phy: mediatek: phy-mtk-hdmi-mt2701: use clk_determine_rate_noop()Brian Masney1-7/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Acked-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: sprd: use clk_determine_rate_noop()Brian Masney1-7/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: scpi: use clk_determine_rate_noop()Brian Masney1-13/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: samsung: acpm: use clk_determine_rate_noop()Brian Masney1-13/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: rp1: use clk_determine_rate_noop()Brian Masney1-7/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Reviewed-by: Andrea della Porta <andrea.porta@suse.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: renesas: rzg2l-cpg: use clk_determine_rate_noop()Brian Masney1-7/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: qcom: smd-rpm: use clk_determine_rate_noop()Brian Masney1-12/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: qcom: rpmh: use clk_determine_rate_noop()Brian Masney1-7/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: qcom: rpm: use clk_determine_rate_noop()Brian Masney1-13/+2
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: imx: scu: use clk_determine_rate_noop()Brian Masney1-20/+3
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Acked-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: hisilicon: hi3660-stub: use clk_determine_rate_noop()Brian Masney1-11/+1
Drop the driver-specific empty determine_rate() function and use the new shared clk_determine_rate_noop() helper. Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: add clk_determine_rate_noop()Brian Masney1-0/+18
Add a new helper clk_determine_rate_noop() that's for clocks where the rate rounding is handled by the firmware/hardware, or the clock is capable of any rate. The requested rate is passed through unchanged, and the actual rate will be learned via recalc_rate() after the rate is set. This shared helper will be used to get rid of the driver-specific empty determine rate implementations that are present in the tree. Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: imx: scu: drop redundant init.ops variable assignmentBrian Masney1-1/+0
The init.ops is assigned a default value, however right below it is an if, else if, and else where all of them also assign a value to init.ops. Drop the redundant init.ops assignment at the top. Fixes: 3b9ea606cda53 ("clk: imx: scu: add cpu frequency scaling support") Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: test: convert constants to use HZ_PER_MHZBrian Masney1-3/+4
Convert the DUMMY_CLOCK_* constants over to use HZ_PER_MHZ. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: add kernel docs for struct clk_coreBrian Masney1-0/+51
Document all of the members of struct clk_core. Reviewed-by: Maxime Ripard <mripard@kernel.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Tested-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: hisilicon: allow COMPILE_TEST buildsRosen Penev2-1/+15
The HiSilicon clock symbols already depend on ARCH_HISI or COMPILE_TEST, but the parent clock Makefile only descends into the hisilicon directory when ARCH_HISI is enabled. Add a hidden family gate selected by the HiSilicon clock and reset symbols, default it for ARCH_HISI, and use it for the parent Makefile descent. This keeps existing platform builds unchanged while allowing compile-test coverage. Tested with: make LLVM=1 ARCH=loongarch drivers/clk/hisilicon/ Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29hwmon: adm1275: Detect coefficient overflowMatti Vaittinen1-4/+14
Sashiko detected potential coefficient overflow if large shunt resistor is used. When going unnoticed it can cause "drastically incorrect telemetry scaling factors" as Sashiko put it. I am not convinced such "drastically incorrect telemetry scaling factors" could have gone unnoticed, so I suspect such large shunt resistors aren't really used. Well, it shouldn't hurt to detect the error and abort the probe before Really Wrong current / power -values are reported to user by the hwmon. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Link: https://lore.kernel.org/r/d9e3320dbd62e094ff89598cb3aac5b5e716f9e7.1782458224.git.mazziesaccount@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-29hwmon: adm1275: Prevent reading uninitialized stackMatti Vaittinen1-1/+1
While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quoting Sashiko: This is a pre-existing issue, but I noticed that just before this block in adm1275_probe(), there might be an out-of-bounds stack read: ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer); if (ret < 0) { ... } for (mid = adm1275_id; mid->name[0]; mid++) { if (!strncasecmp(mid->name, block_buffer, strlen(mid->name))) break; } Since i2c_smbus_read_block_data() reads up to 32 bytes into the uninitialized stack array block_buffer without appending a null terminator, strncasecmp() could read past the valid bytes returned in ret. For example, if the device returns a shorter string like "adm12", checking it against "adm1275" up to the length of "adm1275" will continue reading into uninitialized stack bounds. Prevent reading uninitialized memory by zeroing the stack array. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 87102808d039 ("hwmon: (pmbus/adm1275) Validate device ID") Link: https://lore.kernel.org/r/c8ad38e0cdb347261c6245de2b7965e747f28d22.1782458224.git.mazziesaccount@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-29firmware: imx: sm-misc: Add NULL check for kmalloc in syslog_showLi Jun1-0/+3
Add a proper NULL check for the kmalloc() return value in syslog_show(). If memory allocation fails, syslog would be NULL and passing it to misc_syslog() could lead to a NULL pointer dereference. Fixes: 80a4062e8821 ("firmware: imx: sm-misc: Dump syslog info") Signed-off-by: Li Jun <lijun01@kylinos.cn> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-29hwmon: (max6697) add missing 'select REGMAP_I2C' to KconfigJoshua Crofts1-0/+1
The Kconfig entry for the MAX6697 sensor doesn't contain a `select REGMAP_I2C` parameter, causing build failures if regmap isn't selected previously during the build process. Fixes: 3a2a8cc3fe24 ("hwmon: (max6697) Convert to use regmap") Cc: stable@vger.kernel.org Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com> Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-3-8104df929b1a@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-29hwmon: (ltc2992) add missing 'select REGMAP_I2C' to KconfigJoshua Crofts1-0/+1
The Kconfig entry for the LTC2992 sensor doesn't contain a `select REGMAP_I2C` parameter, causing build failures if regmap isn't selected previously during the build process. Fixes: b0bd407e94b0 ("hwmon: (ltc2992) Add support") Cc: stable@vger.kernel.org Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com> Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-2-8104df929b1a@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-29hwmon: (max1619) add missing 'select REGMAP' to KconfigJoshua Crofts1-0/+1
The Kconfig entry for the MAX1619 sensor doesn't contain a `select REGMAP` parameter, causing build failures if regmap isn't selected previously during the build process. Fixes: f8016132ce49 ("hwmon: (max1619) Convert to use regmap") Cc: stable@vger.kernel.org Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com> Link: https://lore.kernel.org/r/20260629-add-kconfig-deps-v1-1-8104df929b1a@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-29hwmon: (w83627hf) remove VID sysfs files on error and removePengpeng Hou1-0/+4
w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when VID information is available. The error path and remove callback only remove the common and optional attribute groups. Those groups do not contain cpu0_vid or vrm, so the files can remain after a later probe failure or after device removal while their callbacks still expect live driver data. Remove the standalone VID sysfs files from both the probe error path and the remove callback. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-29hwmon: (w83793) remove vrm sysfs file on probe failurePengpeng Hou1-0/+1
w83793_probe() creates the vrm sysfs file after creating the VID files when VID support is present. The normal remove path deletes vrm, but the probe error path only removes the sensor, SDA, VID, fan, PWM and temperature files. A later probe failure can therefore leave vrm behind after the driver data has been freed. Remove vrm in the probe error path next to the VID files, matching the normal remove path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-29vfio/pci: Expose latched module parameter policy in debugfsAlex Williamson1-0/+59
The nointxmask and disable_idle_d3 module parameters remain writable, but vfio-pci now latches their values into each device at init. Once a device is registered, changing the module parameter only affects future devices, leaving no direct way to confirm the effective policy for an existing device. Add a pci debugfs directory under the VFIO device debugfs root and report the per-device nointxmask and disable_idle_d3 values. These are read-only debugfs views and use the same Y/N bool output convention as the module parameters. Read-only vfio-pci parameters, such as disable_vga, are not exposed here because they cannot drift from the latched device value, therefore the existing module parameter exposure via sysfs is sufficient. Note that while only vfio-pci currently provides these options, the implementation is in vfio-pci-core and therefore properly reflects the device policy in the core, regardless of driver. Assisted-by: OpenAI Codex:gpt-5 Cc: Guixin Liu <kanie@linux.alibaba.com> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615191241.688297-7-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-06-29vfio: Remove device debugfs before releasing devresAlex Williamson2-1/+8
VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain. Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released. Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister. Fixes: 2202844e4468 ("vfio/migration: Add debugfs to live migration driver") Reported-by: Sashiko AI Review <sashiko-bot@kernel.org> Link: https://lore.kernel.org/r/20260615192725.6A2221F000E9@smtp.kernel.org Cc: stable@vger.kernel.org Cc: Longfang Liu <liulongfang@huawei.com> Assisted-by: OpenAI Codex:gpt-5 Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615204717.735302-1-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-06-29clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controllerMin zhang1-1/+1
Using devm_kmalloc() does not zero-initialize the allocated structure. Uninitialized members in struct hisi_reset_controller may contain garbage data, which can cause reset_controller_register() to fail unexpectedly. Replace devm_kmalloc() with devm_kzalloc() to ensure all structure fields are properly zero-initialized. Fixes: 97b7129cd2afb ("reset: hisilicon: change the definition of hisi_reset_init") Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Min zhang <zhangmin2026@yeah.net> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: add missing function short descriptions for kernel-docRandy Dunlap1-8/+8
Add short descriptions for 3 functions which are missing it. Modify the parameter name in comments to be @core instead of clk. Use corrected function names (with leading "__") in a few places. Warning: drivers/clk/clk.c:1899 missing initial short description on line: * __clk_recalc_accuracies Warning: drivers/clk/clk.c:1972 missing initial short description on line: * __clk_recalc_rates Warning: drivers/clk/clk.c:2244 missing initial short description on line: * __clk_speculate_rates This eliminates warnings in this file except for missing return value warnings, of which there are around 70. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: Use named initializers for arrays of i2c_device_dataUwe Kleine-König (The Capable Hub)11-35/+35
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct i2c_device_id that replaces .driver_data by an anonymous union. While touching all these arrays, unify usage of whitespace and commas. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # clk-versaclock5 Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29clk: si5341: Drop unused i2c driver_dataUwe Kleine-König (The Capable Hub)1-5/+5
The driver doesn't make use of the value that was explicitly assigned to the .driver_data member. Drop the assignment. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-06-29vfio/pci: Latch all module parameters per deviceAlex Williamson2-28/+28
The vfio-pci module parameters of disable_idle_d3, nointxmask, and disable_vga latch vfio-pci policy into vfio-pci-core globals each time the vfio-pci module is initialized. The disable_idle_d3 parameter has already migrated to a per-device flag in order to provide consistency for refcounted PM operations for the lifetime of the device registration. Pull the remaining vfio-pci module-parameter policy out of vfio-pci-core into per-device flags set at device initialization. This also restores the mutable aspect of the disable_idle_d3 and nointxmask module parameters for vfio-pci, with the caveat that the parameters are latched into the device at probe. A notable change for variant drivers is that their devices are no longer affected by vfio-pci module parameters and those drivers may need to adopt similar module parameters if any devices have a hidden dependency on vfio-pci setting non-default policy. Assisted-by: Claude:claude-opus-4-8 Acked-by: Chengwen Feng <fengchengwen@huawei.com> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615191241.688297-6-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-06-29vfio/mlx5: Fix racy bitfields and tighten struct layoutAlex Williamson1-6/+9
Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach across to another device (ex. reset) use dedicated storage units. Note mlx5_vhca_page_tracker.status is relocated to fill the alignment hole this split exposes. Bitfield justifications: migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe Dedicated storage units: mdev_detach: written in the VF attach/detach event notifier mlx5fv_vf_event() at runtime log_active: written in mlx5vf_start_page_tracker()/ mlx5vf_stop_page_tracker() during runtime dirty tracking deferred_reset: written in mlx5vf_state_mutex_unlock()/ mlx5vf_pci_aer_reset_done() during runtime reset handling is_err: set by tracker error handling and dirty-log polling at runtime object_changed: set by tracker event handling and cleared by dirty-log polling at runtime Fixes: 61a2f1460fd0 ("vfio/mlx5: Manage the VF attach/detach callback from the PF") Fixes: 79c3cf279926 ("vfio/mlx5: Init QP based resources for dirty tracking") Fixes: f886473071d6 ("vfio/mlx5: Add support for tracker object change event") Cc: Yishai Hadas <yishaih@nvidia.com> Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615191241.688297-5-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-06-29vfio/pci: Release the VGA arbiter client on register_device() failureAlex Williamson1-0/+1
The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout. Fixes: 4aeec3984ddc ("vfio/pci: Re-order vfio_pci_probe()") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615191241.688297-3-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-06-29vfio/pci: Latch disable_idle_d3 per deviceAlex Williamson1-9/+10
When disable_idle_d3 was introduced in vfio-pci, it directly manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot. Therefore the module parameter was made writable. Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect of the module parameter was nullified. The parameter value could still be changed through sysfs, but the vfio-pci driver latched the values into vfio-pci-core globals at module init. Loading the vfio-pci module, or unloading and reloading, with non-default or different values could change the globals relative to existing devices bound to vfio-pci variant drivers. Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM"), which marks the point where power states became refcounted. PM get and put operations need to be balanced, but the same module operations noted above can change the global variables relative to those devices already bound to vfio-pci variant drivers. This introduces a window where PM operations can now become unbalanced. To resolve this with a narrow footprint for stable backports, the disable_idle_d3 flag is latched into the vfio_pci_core_device at the time of initialization, such that the device always operates with a consistent value. NB. vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset to account for disable_idle_d3 becoming a per-device rather than global flag. When this flag is set, the additional get/put pair is harmless and allows continued use of the shared vfio_pci_dev_set_pm_runtime_get() helper. Fixes: 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260615191241.688297-2-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-06-29regmap: maple: Workaround for another false-positive compiler warningUwe Kleine-König (The Capable Hub)1-1/+1
Similar to the issue fixed in commit 542440fd7b30 ("regmap: maple: work around gcc-14.1 false-positive warning"), I see an uninitialized warning for upper_index and upper_last. Happens with arc-linux-gnu-gcc (Debian 15.3.0-1) 15.3.0 on an allmodconfig for ARCH=arc. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260626060427.2548578-2-u.kleine-koenig@baylibre.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-29iio: accel: stk8312: Update includes to match IWYUMiao Li1-2/+10
Update the list of included headers in stk8312.c using Include-What-You-Use (IWYU) tool, mainly to remove kernel.h and add missing headers such as array_size.h, bits.h, dev_printk.h, etc. Meanwhile, sort these headers in alphabetical order. Signed-off-by: Miao Li <limiao@kylinos.cn> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: chemical: scd30: Use devm_mutex_init() over non-devm mutex_init()Maxwell Doose1-1/+5
The current code uses mutex_init() instead of devm_mutex_init(), which is incorrect as the rest of the file uses the devm automatic resource management API. Fix this so that the mutex is set up in the same way as the rest of the device data structure. Signed-off-by: Maxwell Doose <m32285159@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: test: Use strscpy() to copy the test descriptionDavid Laight1-1/+1
The buffer length is known to be KUNIT_PARAM_DESC_SIZE Signed-off-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>