Georgi writes:

This pull request contains the following interconnect updates for
the 7.3-rc1 merge window:

- New driver for Maili SoC
- Add support for QoS on the SC8280XP SoC
- Add support for QoS on the x1e80100 SoC
- Add EPSS L3 scaling support for Shikra SoC
- Add COMPILE_TEST support for some platforms
- Misc tiny improvements and fixes

Signed-off-by: Georgi Djakov <djakov@kernel.org>

* tag 'icc-7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc:
  interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
  interconnect: debugfs-client: add NULL check for platform_device_alloc
  interconnect: qcom: simplify allocation
  interconnect: qcom: add COMPILE_TEST
  interconnect: qcom: add Maili interconnect provider driver
  dt-bindings: interconnect: qcom: document the RPMh Network-On-Chip interconnect in Maili SoC
  interconnect: qcom: Add EPSS L3 scaling support for Shikra SoC
  dt-bindings: interconnect: qcom,osm-l3: Add EPSS L3 DT binding for Qualcomm Shikra SoC
  interconnect: qcom: x1e80100: enable QoS configuration
  dt-bindings: interconnect: qcom,x1e80100-rpmh: add clocks property to enable QoS
  interconnect: qcom: sc8280xp: Enable QoS configuration
  dt-bindings: interconnect: qcom,sc8280xp-rpmh: Add reg and clocks for QoS

* icc-misc
  interconnect: qcom: add COMPILE_TEST
  interconnect: qcom: simplify allocation
  interconnect: debugfs-client: add NULL check for platform_device_alloc
  interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

Signed-off-by: Georgi Djakov <djakov@kernel.org>

Add interconnect bindings and RPMh-based interconnect driver support for
the upcoming Qualcomm Maili SoC.

* icc-maili
  dt-bindings: interconnect: qcom: document the RPMh Network-On-Chip interconnect in Maili SoC
  interconnect: qcom: add Maili interconnect provider driver

Link: https://patch.msgid.link/20260622-maili_icc-v2-0-18b5ac08c04f@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

Add Epoch Subsystem (EPSS) L3 scaling support on Qualcomm Shikra SoC.
EPSS hardware on Shikra is similar to other SoCs but supports only twelve
L3 frequency entries (LUT). Reading the LUT beyond supported frequencies
can expose incorrect frequencies.
Introduce new compatible to represent this constrained variant of EPSS.

* icc-shikra
  dt-bindings: interconnect: qcom,osm-l3: Add EPSS L3 DT binding for Qualcomm Shikra SoC
  interconnect: qcom: Add EPSS L3 scaling support for Shikra SoC

Link: https://patch.msgid.link/20260603-shikra_epss_l3-v3-0-3c2e0b796e78@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

In of_icc_get_by_index() and icc_get(), if the dynamic allocation for
path->name fails via kasprintf(), the error handling path directly
calls kfree(path) to free the path object and returns an error.

However, prior to this point, path_find() calls path_init(), which
already links the path's requests into the req_list of the respective
interconnect nodes via hlist_add_head(). Directly invoking kfree(path)
leaves dangling pointers in the hlist. A subsequent call to icc_get()
or icc_set_bw() will traverse or modify these corrupted lists, triggering
a slab use afterfree.

KASAN report showing the vulnerability when reproducing via debugfs:

  BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc
  Write of size 8 at addr fff000000d43f748 by task sh/1
  ...
  Call trace:
   kasan_report+0xac/0xfc
   path_find+0x6f8/0xcfc
   icc_get+0x148/0x380
   icc_get_set+0xf8/0x2d0
  ...
  Freed by task 1:
   kfree+0x1a0/0x4a4
   icc_get+0x2cc/0x380
   icc_get_set+0xf8/0x2d0

Fix this by replacing kfree(path) with the proper teardown function,
icc_put(path), which safely removes the requests from the req_list using
hlist_del() and drops the provider usage references before freeing the
memory.

Additionally, in icc_get(), ensure that the icc_lock mutex is released
prior to calling icc_put(path) to avoid a deadlock, as icc_put()
internally acquires the same lock.

Fixes: 3791163602f7 ("interconnect: Handle memory allocation errors")
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Link: https://patch.msgid.link/20260416190840.1753468-1-visitorckw@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

platform_device_alloc() may return NULL when memory allocation fails.
Add proper error handling to prevent a potential NULL pointer
dereference when calling platform_device_add() with a NULL pointer.

Signed-off-by: Li Jun <lijun01@kylinos.cn>
Link: https://patch.msgid.link/20260602103120.2966458-1-lijun01@kylinos.cn
Signed-off-by: Georgi Djakov <djakov@kernel.org>

Use a flexible array member to reduce allocation by 1.

Add __counted_by for extra runtime analysis. Move counting variable
assignment after allocation before any array access.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260609222454.37352-1-rosenp@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

Allow non-ARM to build this.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20260608050542.6167-1-rosenp@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

Add driver for the Qualcomm interconnect buses found in Maili
based platforms. The topology consists of several NoCs that are
controlled by a remote processor that collects the aggregated
bandwidth for each master-slave pairs.

Co-developed-by: Odelu Kukatla <odelu.kukatla@oss.qualcomm.com>
Signed-off-by: Odelu Kukatla <odelu.kukatla@oss.qualcomm.com>
Signed-off-by: Raviteja Laggyshetty <raviteja.laggyshetty@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260622-maili_icc-v2-2-18b5ac08c04f@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

Add Epoch Subsystem (EPSS) L3 interconnect provider support on
Qualcomm Shikra SoC.

The EPSS L3 block on Shikra SoC is similar to existing Qualcomm EPSS/OSM
L3 providers, but supports only up to 12 frequency lookup table entries.
Reading beyond the supported LUT entries can expose incorrect frequencies.
Add shikra-specific EPSS descriptor shikra_epss_l3_perf_state that reuses
existing EPSS configuration with appropriate LUT entries limit.

Co-developed-by: Odelu Kukatla <odelu.kukatla@oss.qualcomm.com>
Signed-off-by: Odelu Kukatla <odelu.kukatla@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Raviteja Laggyshetty <raviteja.laggyshetty@oss.qualcomm.com>
Link: https://patch.msgid.link/20260603-shikra_epss_l3-v3-2-3c2e0b796e78@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>