Pull char/misc/IIO/etc driver updates from Greg KH:
"Here is the big set of char, misc, iio, counter, fpga, and other small
driver subsystems for 7.3-rc1.
Overall, due to some driver removals we only added a bit more code
than removed, which was a nice change. Highlights in this merge
request are:
- Loads of IIO driver updates and additions
- binder driver updates (more on that below...)
- Removal of the SGI XP and GRU drivers as they are not used anymore
and turn out to be pretty insecure overall
- Removal of the obsolete ibmasm driver as it's not being used
anymore
- Coresight driver updates and additions
- Mei driver udpates
- Counter driver updates
- FPGA driver updates
- ICC driver updates
- lots and lots of other tiny driver updates to resolve reported
issues
All of these have been in linux-next for a while"
* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
iio: adc: pac1921: fix wrong channel used in trigger handler read
iio: light: gp2ap002: re-enable irq if runtime suspend fails
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
iio: light: apds9306: fix PM reference leak in apds9306_read_data()
iio: gyro: mpu3050: fix sign of raw angular velocity readings
iio: srf04: fix pm_runtime handling on probe error path
iio: adc: ad4080: configure backend data size
iio: adc: adi-axi-adc: add data size support for AD408X backend
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
iio: dac: ad5446: fix OF module device table
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
iio: light: opt4001: Reject integration times with a non-zero seconds part
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
iio: light: opt4001: Fix power down clearing bits of the wrong register
iio: light: opt4060: Fix incorrect register name in threshold read error message
iio: light: opt4060: Fix pointer type passed to div_u64_rem()
iio: light: opt4060: Reject integration times with a non-zero seconds part
iio: light: ltrf216a: fix runtime PM reference leak in error path
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
...
FSL SOC Changes for 7.3 Freescale QUICC Engine: - Use generic I/O helpers in interrupt controller for IO Ports - Move CONFIG_QE_GPIO out of powerpc - Fix DT scan for GPIO nodes - Convert IO ports interrupt controller to generic IRQ chip - Add support of IRQs in GPIO controller - Implement get_direction() in GPIO controller - Check platform_driver_register() in interrupt controller for IO Ports Data Path I/O: - Replace maintainer - Remove redundant dev_err() - Fix kernel-doc typos Freescale Management Complex: - Use strscpy() to copy strings into arrays - Remove redundant dev_err() - Drop unused assignment of acpi_device_id::driver_data Other changes: - Add kernel and device tree binding support for RCW override, completing the SerDes PHY driver functionality - Fix kernel-doc warnings and typos in DPAA header * tag 'soc_fsl-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux: (31 commits) bus: fsl-mc: drop unused assignment of acpi_device_id::driver_data soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() phy: lynx-10g: use RCW override procedure for dynamic protocol change soc: fsl: guts: implement the RCW override procedure dt-bindings: fsl: layerscape-dcfg: define DCFG_DCSR region soc: fsl: guts: make fsl_soc_data available after fsl_guts_init() soc: fsl: guts: make it easier to determine on which SoC we are running soc: fsl: guts: add a central fsl_guts_read() function soc: fsl: guts: add a global structure to hold state soc: fsl: guts: use a macro to encode the DCFG CCSR space soc: fsl: guts: perform fsl_guts_init() error teardown in reverse order of setup soc: fsl: dpio: fix kernel-doc typos soc: fsl: fix kernel-doc warnings and typos bus: fsl-mc: Remove redundant dev_err() soc: fsl: qe: Add support of IRQs in QE GPIO soc: fsl: qe: Rename irq variable to parent_irq soc: fsl: qe: Convert to generic IRQ chip soc: fsl: qe: Handle spurious interrupts soc: fsl: qe: Iterate over all pending interrupts in cascade handler soc: fsl: qe: Use generic_handle_domain_irq() ... Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Manivannan writes: MHI Host -------- - Add SAHARA channel support in the pci_generic driver for Foxconn products. This allows capturing crashdump (ramdump) using the in-kernel sahara client driver. - Add support for devices with no M3 state. Some devices do not support the M3 power state due to hardware issues. For those devices, MHI bus will now run the full host-side suspend/resume sequence but skip the device-side M3/M0 handshake, so any transfer queued by clients during suspend is deferred until resume. - Set 'mhi_cntrl->no_m3' flag in the pci_generic driver for the QDU100 device so that the MHI bus also skips the M3 transition during system suspend. Earlier, the flag was only used to disable runtime PM, but the system suspend path was still transitioning the device to M3. - Fix sys error transition latency by polling for the state transition in mhi_pm_sys_error_transition() instead of waiting up to 24 seconds for an interrupt from the device. Since a device that has been reset (e.g., via AT!RESET) is not guaranteed to raise one. - Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET in mhi_soc_reset() so that the reset actually reaches the device before the caller's post-reset delay begins. - Fix controller cleanup on EDL sysfs failure in mhi_register_controller(). The error path was leaving the device registered when sysfs_create_file() failed. MHI Endpoint ------------ - Add mhi_cntrl->flush_async() callback to drain the in-flight async DMA read/write operations issued through the MHI controller driver. This is used by the MHI EP stack before disconnect to avoid UAF where a late DMA completion could invoke a now-invalid xfer_cb(). - Implement the flush_async() callback in the PCI EPF MHI controller driver by waiting for the in-flight DMA operations to complete and then flushing the DMA workqueue. Since I'm the maintainer for this PCI EPF driver, I'm taking this patch through MHI tree due to dependency. - Flush the in-flight async transfers before notifying disconnect in mhi_ep_abort_transfer() to fix a UAF, where a success callback delivered after the -ENOTCONN notification could reference resources already freed by the client. - Fix device refcount leak in the error path of mhi_ep_create_device() when dev_set_name() or device_add() fails. Common ------ - Clean up kernel-doc warnings in include/linux/mhi.h. - Add Jeff Hugo as the Reviewer of MHI bus. * tag 'mhi-for-v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: PCI: epf-mhi: Implement mhi_cntrl->flush_async() to flush DMA read/write bus: mhi: ep: Flush async transfers before notifying disconnect in mhi_ep_abort_transfer() bus: mhi: ep: Add mhi_cntrl->flush_async() callback to flush the async read/write bus: mhi: Clean up some kernel-doc warnings bus: mhi: host: Fix controller cleanup on EDL sysfs failure bus: mhi: pci_generic: Add SAHARA channel support for Foxconn products bus: mhi: host: pci_generic: Set 'mhi_cntrl->no_m3' flag bus: mhi: host: Add support for devices with no M3 state bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET MAINTAINERS: Add Jeff Hugo as the Reviewer of MHI bus bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation bus: mhi: core: Fix sys error transition latency
This module sets the acpi_device_id::driver_data to 0 but the field is not actually used within the module, we can just drop it from the table. While we are at it - use a named initializer for the acpi_device_id::id field as well to make the code more readable. Signed-off-by: Pawel Zalewski (The Capable Hub) <pzalewski@thegoodpenguin.co.uk> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://lore.kernel.org/r/20260728-acpi-bus-v1-1-12ff25fdea9b@thegoodpenguin.co.uk Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20260710110930.462109-2-panchuang@vivo.com
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Qualcomm driver updates for v7.3 Add Maili platform bindings for SCM, IMEM, AOSS, and PMIC GLINK. Add Shikra IMEM, RPM SMD, LLCC, and UBWC support, including handling for firmware-configured LLCC ECC interrupts. Add the generic Peripheral Authentication Service with SCM and OP-TEE backends, and migrate the MSM DRM and IPA drivers to it. Add SCM SMC-call tracepoints and configurable minidump delivery through always-on SRAM. Correct SCM download-mode pointer ordering and improve download-mode probe diagnostics. Rework the UBWC configuration database and add Milos and Shikra configuration. Add protection-domain mappings for SA8775P and QCS8300, support newer ICE versions, Hawi subsystem statistics, and SDM850 identification. Simplify Qualcomm SoC Kconfig selection and architecture dependencies. Use managed resources in EBI2 and RPMh RSC probe paths to correct cleanup on failures. * tag 'qcom-drivers-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (44 commits) soc: qcom: llcc: Skip ECC interrupt setup on Shikra, pre-configured by DSF dt-bindings: sram: Document qcom,shikra-imem compatible net: ipa: Switch to generic PAS TZ APIs firmware: qcom: scm: Add minidump SRAM support firmware: qcom: scm: use dev_err_probe() for dload address failure firmware: qcom: scm: Fix missing smp_load_acquire() dt-bindings: firmware: qcom,scm: Add minidump SRAM property drm/msm: Switch to generic PAS TZ APIs bus: qcom-ebi2: use managed resources for clocks and children soc: qcom: rpmh-rsc: manage PM notifiers with devres firmware: qcom: scm: Allow QSEECOM on Honor Magicbook Art 14 firmware: qcom: scm: instrument SMC call path with tracepoints firmware: qcom: scm: add trace events for the SMC call interface soc: qcom: Avoid SCM and SPM for cpuidle drivers soc: qcom: Make important drivers default soc: qcom: Restrict drivers per ARM/ARM64 soc: qcom: Hide all drivers behind selectable menu MAINTAINERS: Add maintainer entry for Qualcomm PAS TZ service firmware: qcom: Add a PAS TEE service firmware: qcom_scm: Migrate to generic PAS service ... Signed-off-by: Arnd Bergmann <arnd@arndb.de>
drivers: omap updates for v7.3 - bus: ti-sysc: Fix /chosen node reference leak * tag 'omap-for-v7.3/drivers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: bus: ti-sysc: Fix /chosen node reference leak Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Replacing strcpy() with strscpy() ensures than overflow of the target buffer cannot happen. Signed-off-by: David Laight <david.laight.linux@gmail.com> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://lore.kernel.org/r/20260608095500.2567-1-david.laight.linux@gmail.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
mhi_ep_abort_transfer() notifies the client drivers about the channel disconnect using -ENOTCONN and only then flushes the ring workqueue to drain the in-flight transfers. But the async DMA transfers issued by the ring workers can still complete after the notification. And the completion handlers trigger the client xfer_cb() as long as it is set. So a transfer completing during the flush can deliver a success callback to the client even after it has been notified about the disconnect. This can lead to UAF (Use-After-Free) issues as the client can free its per-transfer resources in response to the -ENOTCONN notification and the trailing success callback would then reference the freed resources. So to fix this issue, disable all the channels first to prevent new transfers and then drain both the ring workqueue and the in-flight async transfers before notifying the disconnect. The completion and queue paths bail out once the channel state is not MHI_CH_STATE_RUNNING, so disabling the channels upfront makes sure that no new transfer sneaks in during the drain and all the pending completions are delivered while xfer_cb() is still valid. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
MHI EP stack makes use of the MHI controller drivers like MHI EPF to do
read/write to the host memory. And that driver is free to use mechanisms
like DMA to offload the read/write operations.
So if DMA is used for offload, then there is no guarantee that those DMA
operations would be completed by the time mhi_ep_remove() gets called. This
can lead to UAF (Use-After-Free) issues as the DMA callback can trigger
xfer_cb() even after mhi_ep_remove() has returned.
So to fix this issue, introduce the mhi_cntrl->flush_async() callback and
call it in mhi_ep_remove() to drain all the in-flight async transfers
before disconnecting the channels.
The completion handlers keep triggering xfer_cb() as long as it is set. So
flushing the transfers after notifying the client about the disconnect
(-ENOTCONN) would still let a success callback slip through afterwards and
lead to the same UAF. So disable the channels first to prevent new
transfers, then flush the in-flight transfers so that their completions are
delivered while xfer_cb() is still valid and only then notify the
disconnect and clear xfer_cb().
Fixes: 2547beb00ddb ("bus: mhi: ep: Add support for async DMA read operation")
Fixes: ee08acb58fe4 ("bus: mhi: ep: Add support for async DMA write operation")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable+noautosel@kernel.org # Needs dmaengine driver fix as well
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>