linux-stable.git/drivers/fpga, branch v7.2.4

fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration

2026-09-07T15:36:53+00:00

commit c14a8b15c87b49efc3ef898cec8ac7c30336a080 upstream.

Fix incorrect stratix10_svc_done() usage during FPGA reconfiguration.

Do not call stratix10_svc_done() at the end of write_init() on success, so
the SVC session remains active through write() and write_complete(). Call
stratix10_svc_done() on failure in write_init() and write() so the shared
SVC mailbox is released when reconfiguration aborts, allowing coexistence
with other SVC clients such as soc64-hwmon.

Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
Cc: stable@vger.kernel.org # 5.1+
Signed-off-by: Tien Sung Ang 
Signed-off-by: Tze Yee Ng 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/8768ce3260489c9febdfce08e27d03f5f5ed9c33.1782801986.git.tze.yee.ng@altera.com
Signed-off-by: Xu Yilun 
Signed-off-by: Greg Kroah-Hartman

fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

2026-09-07T15:36:39+00:00

commit 9da70a43b5fea60d758137f7f0ccfe19356cb5bb upstream.

The trailing byte path in altera_cvp_send_block() dereferences a u32
pointer even when only 1-3 bytes remain in the input buffer. If the buffer
ends at a page or scatterlist boundary, this can read past the valid image
data and fault.

Copy the remaining bytes into a zero-initialized u32 before writing the
final word so only valid bytes are read from the input buffer.

Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daisuke Matsuda 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260723081912.74082-1-dskmtsd@gmail.com
Signed-off-by: Xu Yilun 
Signed-off-by: Greg Kroah-Hartman

fpga: dfl: fme: add error handling

2026-09-02T12:33:17+00:00

commit b5ba63e247075087ab8a6a087622c762dc4172e9 upstream.

Add error handling to devm_kasprint in fme_perf_pmu_register().

Assisted-by: gkh_clanker_2000
Fixes: 724142f8c42a ("fpga: dfl: fme: add performance reporting support")
Cc: stable@kernel.org
Cc: Xu Yilun 
Cc: Tom Rix 
Cc: Moritz Fischer 
Signed-off-by: Griffin Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman 
[ Yilun: Fix stable tag, add Fixes tag ]
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/2026070620-unwired-clay-f6cc@gregkh
Signed-off-by: Xu Yilun 
Signed-off-by: Greg Kroah-Hartman

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of  by the more specific
 where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich 
Acked-by: Takashi Sakamoto 
Acked-by: Bjorn Helgaas 
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub)

fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

2026-06-01T04:29:40+00:00

mpf_ops_parse_header() reads header_size from the bitstream at
MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression
*(buf + header_size - 1) reads one byte before the buffer start.

Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core
guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET.
The only real gap is the zero header_size case, which cannot be
resolved by providing a larger buffer, so return -EINVAL.

Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

2026-06-01T04:29:13+00:00

afu_ioctl_dma_map() accepts a 64-bit length from userspace via
DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value
is passed to afu_dma_pin_pages() where npages is derived as
length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes
int nr_pages, causing implicit truncation if length is very large.

Validate map.length at the ioctl entry point before calling
afu_dma_map_region(), rejecting values whose page count exceeds
INT_MAX.

Fixes: fa8dda1edef9 ("fpga: dfl: afu: add DFL_FPGA_PORT_DMA_MAP/UNMAP ioctls support")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260518190742.61426-3-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun

fpga: dfl: add bounds check in dfh_get_param_size()

2026-06-01T04:28:33+00:00

dfh_get_param_size() can return a parameter size larger than the feature
region because the loop bounds check is evaluated before incrementing
size. If the EOP (End of Parameters) bit is set in the same iteration,
the inflated size is returned without re-validation against max.

This can cause create_feature_instance() to call memcpy_fromio() with a
size exceeding the ioremap'd region when a malicious FPGA device provides
crafted DFHv1 parameter headers.

Add a bounds check after the size increment to ensure the accumulated
size never exceeds the feature boundary.

Fixes: 4747ab89b4a6 ("fpga: dfl: add basic support for DFHv1")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260518190742.61426-2-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun

fpga: lattice-sysconfig-spi: simplify with spi_get_device_match_data()

2026-05-11T15:28:28+00:00

Use spi_get_device_match_data() helper to simplify a bit the driver.

Signed-off-by: Andy Shevchenko 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260510090556.1582900-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Xu Yilun

fpga: lattice-sysconfig-spi: Don't use "proxy" headers

2026-05-11T15:28:18+00:00

Update header inclusions to follow IWYU (Include What You Use)
principle.

Signed-off-by: Andy Shevchenko 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260508082716.1156192-4-andriy.shevchenko@linux.intel.com
Signed-off-by: Xu Yilun

fpga: lattice-sysconfig-spi: Drop of_match_ptr() protection

2026-05-11T15:28:09+00:00

Limiting the scope of devicetree support to CONFIG_OF prevents use of this
driver with ACPI via PRP0001. Drop the dependency.

Signed-off-by: Andy Shevchenko 
Reviewed-by: Xu Yilun 
Link: https://lore.kernel.org/r/20260508082716.1156192-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Xu Yilun