linux-stable.git/drivers/misc, branch v7.2.6

misc: pci_endpoint_test: Check SUCCESS bit for doorbell status

2026-09-14T11:40:13+00:00

[ Upstream commit 37ddcce6904c20c6a7debe4751f6a82f218c3bae ]

The pci-epf driver sets STATUS_DOORBELL_ENABLE_SUCCESS as the final step of
pci_epf_test_enable_doorbell(), and STATUS_DOORBELL_DISABLE_SUCCESS as the
final step of pci_epf_test_disable_doorbell(). A missing SUCCESS bit
therefore unambiguously means that the operation did not complete, whereas
the FAIL bit is only set on an explicit failure path.

The host side test in pci_endpoint_test_doorbell() currently keys off
the FAIL bit. That covers explicit failures but misses two cases.

The first case is when the wait for the completion IRQ times out. No IRQ
arrives, the Endpoint never updates STATUS, and neither SUCCESS nor FAIL
is set. The enable path already handles this correctly because it also
fails when the wait times out without an IRQ. The disable path does not
have that extra guard and would wrongly treat the timeout as success.

The second is a buggy EPC that raises two IRQs in response to a single
DOORBELL_ENABLE command. The second wait_for_completion_timeout()
returns immediately with 'left' non zero, but the endpoint has not yet
written STATUS, so SUCCESS is clear and FAIL is also clear. The current
FAIL only check treats this as success.

So check the SUCCESS bit instead. That matches the Endpoint's contract
because SUCCESS is the last write on the success path, and it correctly
reports failure for both timeouts and the spurious IRQ case without
relying on the FAIL bit being set.

Fixes: eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case")
Signed-off-by: Niklas Cassel 
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam 
Link: https://patch.msgid.link/20260730122045.1382749-5-cassel@kernel.org
Signed-off-by: Sasha Levin

misc: sgi-gru: remove interrupt-context page-table walks

2026-09-14T11:40:03+00:00

[ Upstream commit 928a8e9f523df845fc496bcb9811013b67aabec5 ]

The GRU TLB miss handler walks a process's page tables without holding
page-table locks or a reference to the mapped page. It also uses a kernel
page-table accessor on user page tables and supports only PMD-level large
mappings on x86-64.

Remove the direct walker. Send interrupt faults directly to user polling
mode so the existing call-OS fallback retries them in process context.

Remove the mmap-lock failure statistic that can no longer be incremented.

Fixes: 142586409c8b ("GRU Driver: page faults & exceptions")
Signed-off-by: Muhammad Usama Anjum 
Link: https://patch.msgid.link/20260730111316.3672672-2-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()

2026-09-14T11:40:02+00:00

[ Upstream commit 210854a96ef18b09b45a2a59ff14ca06dfe5ad4d ]

The memory allocated for struct vmci_subscription (sub) is not freed
in the error path when have_new_id is false. Fix that by adding a
kfree() call, and moving the read of sub->id to a point before freeing.

Fixes: 1d990201f9bb ("VMCI: event handling implementation.")
Signed-off-by: Abdun Nihaal 
Acked-by: Vishnu Dasa 
Link: https://patch.msgid.link/20260722101215.76680-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: lan966x_pci: depopulate children on populate failure

2026-09-14T11:39:36+00:00

[ Upstream commit f6e2ed54db95286d9512b1cff38264e2f6299814 ]

lan966x_pci_probe() applies a device-tree overlay and then populates
platform children from the overlaid node. If
of_platform_default_populate() creates some children and then fails, the
current error path only unloads the overlay.

Depopulate the children before unloading the overlay on that failure
path, matching the remove path order.

Fixes: 185686beb464 ("misc: Add support for LAN966x PCI device")
Reviewed-by: Herve Codina 
Signed-off-by: Pengpeng Hou 
Link: https://patch.msgid.link/20260623015248.22721-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: ad525x_dpot: use driver core groups for sysfs files

2026-09-14T11:39:36+00:00

[ Upstream commit e3a8557e88eb26278eda60bf64f2ef33ce7de8bf ]

ad_dpot_probe() creates per-RDAC sysfs files manually and then
optionally creates the command sysfs group. This leaves probe responsible
for rolling back partial sysfs state and makes remove responsible for
matching every file that probe created.

Move the device attributes into driver core dev_groups for the I2C and
SPI drivers and use an is_visible() callback to expose only the
attributes supported by the probed device. With this shape, the driver
core creates the sysfs files only after probe succeeds and removes them
before the remove callback frees the driver data.

Fixes: 4eb174bee6f8 ("ad525x_dpot: new driver for AD525x digital potentiometers")
Signed-off-by: Pengpeng Hou 
Link: https://patch.msgid.link/20260623015643.36508-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: rtsx: add missing write register handling

2026-09-14T11:39:36+00:00

[ Upstream commit 655faba1ccf195e22a7a83146ef6015e3271233c ]

If an error occurs at the stage of working with registers in conjunction
with MCU_Block, it will not be processed.

The occurrence of errors at this stage may signal an impact on writes to
the device's PCI registers and is a more global problem than a
driver-level security problem, but adding a handler would be a good
practice.

Add a missing error handling.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: c0e5f4e73a71 ("misc: rtsx: Add support for RTS5261")
Signed-off-by: Gleb Markov 
Link: https://patch.msgid.link/20260629130920.1260-1-markov.gi@npc-ksb.ru
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: bcm-vk: Use acquire/release for msgq_inited

2026-09-14T11:39:36+00:00

[ Upstream commit 61b101c6a150057b6d512421ed108aed16e822ea ]

bcm_vk_sync_msgq() fills the message queue information and then sets
msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the
message queues and their cached queue information.

atomic_set()/atomic_read() do not order those accesses. A reader can see
msgq_inited set while still seeing stale queue information. Use release
when publishing the initialized queues and acquire when checking the gate.

Keep the clear in bcm_vk_blk_drv_access() as atomic_set(). It closes the
gate and does not publish queue state to readers.

Fixes: 111d746bb476 ("misc: bcm-vk: add VK messaging support")
Signed-off-by: Gui-Dong Han 
Link: https://patch.msgid.link/20260603021127.3285057-1-hanguidong02@gmail.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: pch_phub: Complete enum usage for device identification

2026-09-14T11:39:36+00:00

[ Upstream commit 077b4d1aa01a1b34c5b768b8c7a77c74b35b190b ]

Recently an enum was introduced to identify the different hardware
variants instead of magic constants. The respective commit however
missed to adapt one code location that still checks the old values.

As the values shifted by one this is a relevant fix.

Fixes: 7b1d4ad96ea4 ("misc: pch_phub: Introduce an enum for device indentification")
Signed-off-by: Uwe Kleine-König (The Capable Hub) 
Link: https://patch.msgid.link/8a97d9d5fb0a4abf7032324643e3e2337b1347bd.1779785111.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

mei: lb: fix incorrect type in assignment

2026-09-14T11:39:36+00:00

[ Upstream commit 0c419df9c190b80136cc774325f84238e430e905 ]

Fix the mix between __le32 and integer by casting
the MEI_LB2_CMD constant as __le32 while using it.

Fixes sparse waring:
drivers/misc/mei/mei_lb.c:284:32: sparse: sparse: restricted __le32 degrades to integer
drivers/misc/mei/mei_lb.c:330:40: sparse: sparse: incorrect type in assignment (different base types) @@     expected restricted __le32 [usertype] command_id @@     got int @@
drivers/misc/mei/mei_lb.c:330:40: sparse:     expected restricted __le32 [usertype] command_id
drivers/misc/mei/mei_lb.c:330:40: sparse:     got int

Fixes: 773a43b8627f ("mei: lb: add late binding version 2")
Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-kbuild-all/202605091533.79Zcv3CX-lkp@intel.com/
Signed-off-by: Alexander Usyskin 
Link: https://patch.msgid.link/20260709-fix_type_le-v3-1-478761151e05@intel.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: rtsx_usb: avoid USB I/O in runtime autosuspend

2026-09-14T11:39:26+00:00

[ Upstream commit 483c948324a3823871c004560a92545759d3253c ]

The runtime autosuspend callback currently queries card status and
clears OCP by issuing USB register accesses. This can run from the
USB runtime-PM path itself, which is the wrong place to start more
device I/O.

Keep a cached copy of the card-status bits from normal status reads
instead. During runtime autosuspend, use that cached value only to
preserve the existing Memory Stick autosuspend deferral.

Do not treat raw SD_CD as an autosuspend blocker, because tray-based
SD readers can assert SD_CD with an empty tray. A real SD card is
protected by the SD/MMC child runtime-PM usage once powered.

Also stop clearing OCP from the runtime autosuspend callback, so the
callback does not issue USB commands.

Fixes: bb400d2120bd ("mfd: rtsx_usb: Defer autosuspend while card exists")
Signed-off-by: Sean Rhodes 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Ulf Hansson 
Signed-off-by: Sasha Levin