linux-stable.git/drivers/fpga/dfl.c, branch linux-rolling-stable

fpga: dfl: add bounds check in dfh_get_param_size()

2026-07-24T14:21:04+00:00

commit 9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a upstream.

dfh_get_param_size() can return a parameter size larger than the feature
region because the loop bounds check is evaluated before incrementing
size. If the EOP (End of Parameters) bit is set in the same iteration,
the inflated size is returned without re-validation against max.

This can cause create_feature_instance() to call memcpy_fromio() with a
size exceeding the ioremap'd region when a malicious FPGA device provides
crafted DFHv1 parameter headers.

Add a bounds check after the size increment to ensure the accumulated
size never exceeds the feature boundary.

Fixes: 4747ab89b4a6 ("fpga: dfl: add basic support for DFHv1")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260518190742.61426-2-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun 
Signed-off-by: Greg Kroah-Hartman

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-22T04:03:00+00:00

This converts some of the visually simpler cases that have been split
over multiple lines.  I only did the ones that are easy to verify the
resulting diff by having just that final GFP_KERNEL argument on the next
line.

Somebody should probably do a proper coccinelle script for this, but for
me the trivial script actually resulted in an assertion failure in the
middle of the script.  I probably had made it a bit _too_ trivial.

So after fighting that far a while I decided to just do some of the
syntactically simpler cases with variations of the previous 'sed'
scripts.

The more syntactically complex multi-line cases would mostly really want
whitespace cleanup anyway.

Signed-off-by: Linus Torvalds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using

    git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook

fpga: dfl: use subsys_initcall to allow built-in drivers to be added

2025-12-19T15:45:17+00:00

The dfl code adds a bus. If it is built-in and there is a built-in driver
as well, the dfl module_init may be called after the driver module_init,
leading to a failure to register the driver as the bus has not been added
yet.

Use subsys_initcall, which guarantees it will be called before the drivers
init code.

Without the fix, we see failures like this:

[    0.479475] Driver 'intel-m10-bmc' was unable to register with bus_type 'dfl' because the bus was not initialized.

Cc: stable@vger.kernel.org
Fixes: 9ba3a0aa09fe ("fpga: dfl: create a dfl bus type to support DFL devices")
Signed-off-by: Thadeu Lima de Souza Cascardo 
Link: https://lore.kernel.org/r/20251215-dfl_subsys-v1-1-21807bad6b10@igalia.com
Reviewed-by: Xu Yilun 
Signed-off-by: Xu Yilun

fpga: dfl: destroy/recreate feature platform device on port release/assign

2024-12-18T14:28:48+00:00

Now that the internal DFL APIs have been converted to consume DFL
enumeration info from a separate structure, dfl_feature_dev_data, which
lifetime is independent of the feature device, proceed to completely
destroy and recreate the feature platform device on port release and
assign, respectively. This resolves a longstanding issue in the use of
platform_device_add(), which states to "not call this routine more than
once for any device structure" and which used to print a kernel warning.

The function feature_dev_unregister() resets the device pointer in the
feature data to NULL to signal that the feature platform device has been
destroyed. This substitutes the previous device_is_registered() checks.

Signed-off-by: Xu Yilun 
Signed-off-by: Russ Weight 
Signed-off-by: Peter Colberg 
Reviewed-by: Matthew Gerlach 
Reviewed-by: Basheer Ahmed Muddebihal 
Acked-by: Xu Yilun 
Link: https://lore.kernel.org/r/20241120011035.230574-19-peter.colberg@intel.com
Signed-off-by: Xu Yilun

fpga: dfl: drop unneeded get_device() and put_device() of feature device

2024-12-18T14:28:48+00:00

The feature device data was originally stored as platform data, hence
the memory allocation was tied to the lifetime of the feature device.
Now that the feature device data is tied to the lifetime of the DFL PCIe
FPGA device instead, get_device() and put_device() are no longer needed.

Signed-off-by: Peter Colberg 
Reviewed-by: Matthew Gerlach 
Reviewed-by: Basheer Ahmed Muddebihal 
Acked-by: Xu Yilun 
Link: https://lore.kernel.org/r/20241120011035.230574-18-peter.colberg@intel.com
Signed-off-by: Xu Yilun

fpga: dfl: remove unneeded function build_info_create_dev()

2024-12-18T14:28:48+00:00

Remove the function build_info_create_dev(), which no longer serves its
original purpose now that the allocation of the platform device has been
moved to feature_dev_register().

Signed-off-by: Peter Colberg 
Reviewed-by: Matthew Gerlach 
Reviewed-by: Basheer Ahmed Muddebihal 
Acked-by: Xu Yilun 
Link: https://lore.kernel.org/r/20241120011035.230574-17-peter.colberg@intel.com
Signed-off-by: Xu Yilun

fpga: dfl: allocate platform device after feature device data

2024-12-18T14:28:48+00:00

Delay calling platform_device_alloc() from build_info_create_dev() to
feature_dev_register(), now that the feature device data contains all
necessary data to create the feature device. This completes the new
function feature_dev_register(), which will be reused in a subsequent
commit to fully recreate the feature device when assigning a port.

In the function feature_dev_unregister(), reset the device pointer in
the feature data to NULL to signal that the platform device has been
destroyed. This will substitute device_is_registered() in a subsequent
commit. Reset the device pointer of each sub feature for consistency.

Convert is_feature_dev_detected() to check whether binfo->type is not
DFL_ID_MAX for deciding whether a feature device was detected during
feature parsing, instead of checking binfo->feature_dev for non-NULL.

Signed-off-by: Peter Colberg 
Reviewed-by: Matthew Gerlach 
Reviewed-by: Basheer Ahmed Muddebihal 
Acked-by: Xu Yilun 
Link: https://lore.kernel.org/r/20241120011035.230574-16-peter.colberg@intel.com
Signed-off-by: Xu Yilun

fpga: dfl: store platform device id in feature device data

2024-12-18T14:28:48+00:00

Delay the feature device id allocation from build_info_create_dev() to
binfo_create_feature_dev_data() and store the id in the feature device
data before copying it to the device. This will allow reusing the same
id in a subsequent commit which completely destroys and recreates the
feature device when releasing and reassigning the corresponding port.

Instead of manually freeing the id when no longer needed, use a
device-managed resource with a custom action to automatically free
the id right before the feature device data is freed. The id registry
is guaranteed to be allocated when dfl_id_free_action() is invoked,
since the DFL PCIe device and its device-managed resources will be
destroyed before dfl_ids_destroy() is called in dfl_fpga_exit().

Signed-off-by: Peter Colberg 
Reviewed-by: Matthew Gerlach 
Reviewed-by: Basheer Ahmed Muddebihal 
Acked-by: Xu Yilun 
Link: https://lore.kernel.org/r/20241120011035.230574-15-peter.colberg@intel.com
Signed-off-by: Xu Yilun