linux-stable.git/drivers/firewire, branch v6.18.42

firewire: net: Fix fragmented datagram reassembly

2026-08-03T09:21:38+00:00

[ Upstream commit d52a13adbb8ccbab99cd3bad36804e87d8b5c052 ]

fwnet_frag_new() keeps a sorted list of received fragments for a partial
datagram. When a new fragment is adjacent to an existing fragment, the
code checks whether the new fragment also closes the gap to the next or
previous list entry.

Those neighbor lookups currently assume that the current fragment always
has a real next or previous fragment. At a list edge, the next or
previous entry is the list head, not a struct fwnet_fragment_info.

The gap checks also compare against the old edge of the current fragment
instead of the edge after adding the new fragment. As a result, a
fragment that bridges two existing ranges may leave two adjacent ranges
unmerged, so fwnet_pd_is_complete() can miss a complete datagram.

Check for the list head before looking up the neighboring fragment, and
compare the neighbor against the new fragment's far edge when deciding
whether to merge all three ranges.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: c76acec6d551 ("firewire: add IPv4 support")
Signed-off-by: Ruoyu Wang 
Link: https://lore.kernel.org/r/20260707150454.2265951-1-ruoyuw560@gmail.com
Signed-off-by: Takashi Sakamoto 
Signed-off-by: Sasha Levin

bonding: prevent potential infinite loop in bond_header_parse()

2026-03-25T10:10:41+00:00

[ Upstream commit b7405dcf7385445e10821777143f18c3ce20fa04 ]

bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.

Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.

Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Eric Dumazet 
Reviewed-by: Jiayuan Chen 
Tested-by: Jiayuan Chen 
Cc: Jay Vosburgh 
Cc: Andrew Lunn 
Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin

firewire: core: fix race condition against transaction list

2026-02-06T15:57:37+00:00

commit 20e01bba2ae4898ce65cdcacd1bd6bec5111abd9 upstream.

The list of transaction is enumerated without acquiring card lock when
processing AR response event. This causes a race condition bug when
processing AT request completion event concurrently.

This commit fixes the bug by put timer start for split transaction
expiration into the scope of lock. The value of jiffies in card structure
is referred before acquiring the lock.

Cc: stable@vger.kernel.org # v6.18
Fixes: b5725cfa4120 ("firewire: core: use spin lock specific to timer for split transaction")
Reported-by: Andreas Persson 
Closes: https://github.com/alsa-project/snd-firewire-ctl-services/issues/209
Tested-by: Andreas Persson 
Link: https://lore.kernel.org/r/20260127223413.22265-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto 
Signed-off-by: Greg Kroah-Hartman

firewire: nosy: Fix dma_free_coherent() size

2026-01-08T09:16:47+00:00

[ Upstream commit c48c0fd0e19684b6ecdb4108a429e3a4e73f5e21 ]

It looks like the buffer allocated and mapped in add_card() is done
with size RCV_BUFFER_SIZE which is 16 KB and 4KB.

Fixes: 286468210d83 ("firewire: new driver: nosy - IEEE 1394 traffic sniffer")
Co-developed-by: Thomas Fourier 
Signed-off-by: Thomas Fourier 
Co-developed-by: Christophe JAILLET 
Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/20251216165420.38355-2-fourier.thomas@gmail.com
Signed-off-by: Takashi Sakamoto 
Signed-off-by: Sasha Levin

firewire: core: fix to update generation field in topology map

2025-11-16T12:30:26+00:00

The generation field of topology map is updated after initialized by zero.
The updated value of generation field is always zero, and is against
specification.

This commit fixes the bug.

Fixes: 7d138cb269db ("firewire: core: use spin lock specific to topology map")
Link: https://lore.kernel.org/r/20251114144421.415278-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: core: Initialize topology_map.lock

2025-11-14T14:18:50+00:00

Lockdep barfs on the new uninitialized spinlock.
Initialize it.

protip: enable lockdep (CONFIG_PROVE_LOCKING=y) when
        doing locking changes

firewire_ohci 0000:02:01.1: added OHCI v1.10 device as card 0, 4 IR + 4 IT contexts, quirks 0x11
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 1042 Comm: irq/17-firewire Not tainted 6.17.0-rc2-cl-bisect2-00026-g7d138cb269db #136 PREEMPT
Hardware name: Dell Inc. Latitude E5400                  /0D695C, BIOS A19 06/13/2013
Call Trace:
 
 dump_stack_lvl+0x6d/0xa0
 register_lock_class+0x783/0x790
 ? find_held_lock+0x2b/0x80
 ? __mod_timer+0x110/0x320
 ? __mod_timer+0x110/0x320
 __lock_acquire+0x405/0x2600
 lock_acquire+0xca/0x2e0
 ? fw_core_handle_bus_reset+0x888/0xca0 [firewire_core]
 ? fw_core_handle_bus_reset+0x878/0xca0 [firewire_core]
 ? fw_core_handle_bus_reset+0x878/0xca0 [firewire_core]
 _raw_spin_lock+0x2e/0x40
 ? fw_core_handle_bus_reset+0x888/0xca0 [firewire_core]
 fw_core_handle_bus_reset+0x888/0xca0 [firewire_core]
 handle_selfid_complete_event+0x35c/0x7a0 [firewire_ohci]
 ? irq_thread+0x8d/0x280
 irq_thread_fn+0x18/0x50
 irq_thread+0x15a/0x280
 ? irq_check_status_bit+0x100/0x100
 ? lockdep_hardirqs_on+0x78/0x100
 ? irq_finalize_oneshot.part.0+0xc0/0xc0
 ? irq_forced_thread_fn+0x60/0x60
 kthread+0x114/0x200
 ? kthreads_online_cpu+0x110/0x110
 ret_from_fork+0x158/0x1e0
 ? kthreads_online_cpu+0x110/0x110
 ret_from_fork_asm+0x11/0x20
 

Reported-by: Erhard Furtner 
Fixes: 7d138cb269db ("firewire: core: use spin lock specific to topology map")
Signed-off-by: Ville Syrjälä 
Signed-off-by: Takashi Sakamoto

firewire: init_ohci1394_dma: add missing function parameter documentation

2025-10-24T23:29:56+00:00

Add missing kernel-doc parameter descriptions for five functions
in init_ohci1394_dma.c to fix documentation warnings when building
with W=1.

This patch addresses the following warnings:
- init_ohci1394_wait_for_busresets: missing @ohci description
- init_ohci1394_enable_physical_dma: missing @ohci description
- init_ohci1394_reset_and_init_dma: missing @ohci description
- init_ohci1394_controller: missing @num, @slot, @func descriptions
- setup_ohci1394_dma: missing @opt description

Tested with GCC 13.2.0 and W=1 flag. All documentation warnings
for these functions have been resolved.

Signed-off-by: Nirbhay Sharma 
Link: https://lore.kernel.org/r/20251024203219.101990-2-nirbhay.lkd@gmail.com
Signed-off-by: Takashi Sakamoto

firewire: core: fix __must_hold() annotation

2025-10-24T00:59:34+00:00

The variable name passed to __must_hold() annotation is invalid.

This commit fixes it.

Fixes: 420bd7068cbf ("firewire: core: use spin lock specific to transaction")
Link: https://lore.kernel.org/r/20251023104349.415310-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

Merge tag 'firewire-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

2025-10-01T19:52:43+00:00

Pull firewire updates from Takashi Sakamoto:
 "This update includes the following changes:

   - Removal of the deprecated debug parameter from firewire-ohci module

   - Replacement of the module-local workqueue in 1394 OHCI PCI driver
     with a companion IRQ thread

   - Refactoring of bus management code

   - Additional minor code cleanup

  The existing tracepoints serve as an alternative to the removed debug
  parameter. The use of IRQ thread is experimental, as it handles 1394
  OHCI SelfIDComplete event only. It may be replaced in the future
  releases with another approach; e.g. by providing workqueue from core
  functionality"

* tag 'firewire-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (43 commits)
  firewire: core: fix undefined reference error in ARM EABI
  Revert "firewire: core: disable bus management work temporarily during updating topology"
  Revert "firewire: core: shrink critical section of fw_card spinlock in bm_work"
  firewire: core: suppress overflow warning when computing jiffies from isochronous cycle
  firewire: core: minor code refactoring to delete useless local variable
  firewire: core; eliminate pick_me goto label
  firewire: core: code refactoring to split contention procedure for bus manager
  firewire: core: code refactoring for the case of generation mismatch
  firewire: core: use switch statement to evaluate transaction result to CSR_BUS_MANAGER_ID
  firewire: core: remove useless generation check
  firewire: core: use struct_size and flex_array_size in ioctl_add_descriptor
  firewire: core: shrink critical section of fw_card spinlock in bm_work
  firewire: core: disable bus management work temporarily during updating topology
  firewire: core: schedule bm_work item outside of spin lock
  firewire: core: annotate fw_destroy_nodes with must-hold-lock
  firewire: core: use spin lock specific to timer for split transaction
  firewire: core: use spin lock specific to transaction
  firewire: core: use spin lock specific to topology map
  firewire: core: maintain phy packet receivers locally in cdev layer
  firewire: core: use scoped_guard() to manage critical section to update topology
  ...

firewire: core: fix undefined reference error in ARM EABI

2025-09-28T01:20:30+00:00

For ARM EABI, GCC generates a reference to __aeabi_uldivmod when compiling
a division of 64-bit integer with 32-bit integer. This function is not
available in Linux kernel. In such cases, helper macros are defined in
include/linux/math64.h.

This commit replaces the division with div_u64().

Fixes: 8ec6a8ec23b9 ("firewire: core: suppress overflow warning when computing jiffies from isochronous cycle")
Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-kbuild-all/202509270428.FZaO2PPq-lkp@intel.com/
Link: https://lore.kernel.org/r/20250928011910.581475-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto