linux-stable.git/drivers/nvmem, branch master Linux kernel stable tree Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 2026-08-25T16:38:50+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-25T16:38:50+00:00 93e4b3076b5f2d853462b9777d083c77fc0b7b23 Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ... 
Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data 2026-07-31T12:15:54+00:00 Rosen Penev rosenp@gmail.com 2026-07-29T09:46:46+00:00 a67e2c323a47a2254ed3472b5e4c53abac20f116 The length check in brcm_nvram_parse() validated header->len against priv->nvmem_size (the full partition size) instead of priv->data_len (the actual allocated data buffer). A malformed flash partition with header->len between the two would pass the check, causing brcm_nvram_add_cells() to read and write priv->data[len - 1] beyond the heap allocation. Also add a minimum bound: len < sizeof(*header) could underflow the data[len - 1] access. Fix both bounds by rejecting len outside [sizeof(*header), priv->data_len]. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-14-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The length check in brcm_nvram_parse() validated header->len against
priv->nvmem_size (the full partition size) instead of priv->data_len
(the actual allocated data buffer). A malformed flash partition with
header->len between the two would pass the check, causing
brcm_nvram_add_cells() to read and write priv->data[len - 1] beyond
the heap allocation.

Also add a minimum bound: len < sizeof(*header) could underflow the
data[len - 1] access.

Fix both bounds by rejecting len outside [sizeof(*header), priv->data_len].

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-14-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nvmem: brcm_nvram: reject empty NVRAM partition 2026-07-31T12:15:53+00:00 Rosen Penev rosenp@gmail.com 2026-07-29T09:46:45+00:00 fde46579cf8872138b296349c2bd8a3cd3f132e2 If the partition is completely erased (all padding bytes), the trimming loop reduces data_len to 0. devm_kzalloc(dev, 0, GFP_KERNEL) returns ZERO_SIZE_PTR ((void *)16), which is non-NULL and bypasses the NULL check. The subsequent cast of priv->data to struct brcm_nvram_header * and dereference of header->magic causes a page fault on address 0x10. Reject data_len smaller than the header before allocating. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-13-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
If the partition is completely erased (all padding bytes), the trimming
loop reduces data_len to 0. devm_kzalloc(dev, 0, GFP_KERNEL) returns
ZERO_SIZE_PTR ((void *)16), which is non-NULL and bypasses the NULL
check. The subsequent cast of priv->data to struct brcm_nvram_header *
and dereference of header->magic causes a page fault on address 0x10.

Reject data_len smaller than the header before allocating.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-13-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nvmem: airoha: add ARM64 dependency 2026-07-31T12:15:53+00:00 Arnd Bergmann arnd@arndb.de 2026-07-29T09:46:44+00:00 1ae37d355114a94eb88c418e22e3e9a9e241b393 The driver already depends on HAVE_ARM_SMCCC and ARCH_AIROHA, but both are available for 32-bit and 64-bit targets. However, the smccc invocation fails on thumb2 builds with clang: drivers/nvmem/airoha-smc-efuses.c:38:2: error: write to reserved register 'R7' 38 | arm_smccc_1_1_invoke(AIROHA_SMC_EFUSE_FID, | ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) arch/arm/include/asm/opcodes.h:215:2: note: expanded from macro '__inst_arm_thumb32' 215 | __inst_thumb32(thumb_opcode) | ^ Since the driver is only used on the 64-bit an7581 soc, avoid this problem with a stricter dependency. Fixes: b7846af2e6ca ("nvmem: airoha: Add support for SMC eFUSE") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-12-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The driver already depends on HAVE_ARM_SMCCC and ARCH_AIROHA, but both
are available for 32-bit and 64-bit targets. However, the smccc invocation
fails on thumb2 builds with clang:

drivers/nvmem/airoha-smc-efuses.c:38:2: error: write to reserved register 'R7'
   38 |         arm_smccc_1_1_invoke(AIROHA_SMC_EFUSE_FID,
      |         ^
note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
arch/arm/include/asm/opcodes.h:215:2: note: expanded from macro '__inst_arm_thumb32'
  215 |         __inst_thumb32(thumb_opcode)
      |         ^

Since the driver is only used on the 64-bit an7581 soc, avoid this
problem with a stricter dependency.

Fixes: b7846af2e6ca ("nvmem: airoha: Add support for SMC eFUSE")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-12-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
eeprom: move nvmem EEPROM drivers to drivers/nvmem/ 2026-07-31T12:15:53+00:00 Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com 2026-07-29T09:46:43+00:00 cf09b7a05618bea99468b67fe80202efba1b48ad For historical reasons EEPROM drivers have lived under drivers/misc/eeprom/. Also for historical reasons changes to most of them would go through the char-misc tree while some would be queued through the I2C tree. Over the years some of them have also been converted to using nvmem - the dedicated subsystem for non-volatile memory - while get_maintainer.pl does not Cc the maintainer of nvmem on patches changing them. Move the EEPROM drivers using nvmem under drivers/nvmem/ for consistency of the review process and path upstream. Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-11-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
For historical reasons EEPROM drivers have lived under
drivers/misc/eeprom/. Also for historical reasons changes to most of
them would go through the char-misc tree while some would be queued
through the I2C tree. Over the years some of them have also been
converted to using nvmem - the dedicated subsystem for non-volatile
memory - while get_maintainer.pl does not Cc the maintainer of nvmem on
patches changing them.

Move the EEPROM drivers using nvmem under drivers/nvmem/ for
consistency of the review process and path upstream.

Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-11-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nvmem: simplify nvmem_sysfs_remove_compat() 2026-07-31T12:15:53+00:00 Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com 2026-07-29T09:46:40+00:00 b594cbb7e8cfc8e2faeebf6b7b11b4a6990fc732 There's no need for the config argument in nvmem_sysfs_remove_compat(). Once the compat attribute is registered, that information is carried in nvmem_device::flags. Rework the code to always query that field and drop the second argument. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-8-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
There's no need for the config argument in nvmem_sysfs_remove_compat().
Once the compat attribute is registered, that information is carried in
nvmem_device::flags. Rework the code to always query that field and drop
the second argument.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-8-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nvmem: split out the reg_read/write() callbacks out of struct nvmem_device 2026-07-31T12:15:53+00:00 Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com 2026-07-29T09:46:39+00:00 7f1dbd7a6e309dff4aed8d2b787c96c6901cfbe2 The reg_read/write() fields of struct nvmem_device point to memory owned by the nvmem provider. They must not be dereferenced after the provider is unregistered. Ahead of protecting against accesses to invalid memory with SRCU, move the callbacks into a separate structure the address of which is stored in nvmem_device. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-7-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The reg_read/write() fields of struct nvmem_device point to memory owned
by the nvmem provider. They must not be dereferenced after the provider
is unregistered. Ahead of protecting against accesses to invalid memory
with SRCU, move the callbacks into a separate structure the address of
which is stored in nvmem_device.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-7-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nvmem: remove unneeded __nvmem_device_put() 2026-07-31T12:15:53+00:00 Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com 2026-07-29T09:46:38+00:00 1f4b4165741b88bcbf506b1d9ed05f38a36a3a9f __nvmem_device_put() is wrapped by nvmem_device_put() but there's no extra functionality offered by the latter so just fold one into the other. There's still the corresponding __nvmem_device_get() so in order to keep things symmetrical: rename it to nvmem_device_match() to better reflect its functionality and not confuse users by its presence in the absence of the similarly prefixed put() counterpart. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
__nvmem_device_put() is wrapped by nvmem_device_put() but there's no
extra functionality offered by the latter so just fold one into the
other. There's still the corresponding __nvmem_device_get() so in order
to keep things symmetrical: rename it to nvmem_device_match() to better
reflect its functionality and not confuse users by its presence in the
absence of the similarly prefixed put() counterpart.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-6-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nvmem: simplify locking with guard() 2026-07-31T12:15:53+00:00 Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com 2026-07-29T09:46:37+00:00 2aa495438cc6c6deeb9da562128701ca17cce091 Use lock guards from cleanup.h to simplify locking. While at it: add the missing mutex.h include. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Use lock guards from cleanup.h to simplify locking. While at it: add the
missing mutex.h include.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nvmem: check the return value of gpiod_set_value_cansleep() 2026-07-31T12:15:53+00:00 Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com 2026-07-29T09:46:36+00:00 c9cde184269d5fd0854d9ffda3ea678888dc44b9 GPIO setters now return integer values and can indicate failures in lower abstraction layers. Check the return values of gpiod_set_value_cansleep() calls in nvmem core. Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094647.111468-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
GPIO setters now return integer values and can indicate failures in
lower abstraction layers. Check the return values of
gpiod_set_value_cansleep() calls in nvmem core.

Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-4-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>