linux-stable.git/drivers/platform, branch v6.18.4

platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora

2026-01-08T09:17:14+00:00

commit 7f3c2499da24551968640528fee9aed3bb4f0c3f upstream.

Add AWCC support for Alienware 16X Aurora laptops.

Cc: stable@vger.kernel.org
Signed-off-by: Kurt Borja 
Reviewed-by: Ilpo Järvinen 
Link: https://patch.msgid.link/20251205-area-51-v1-3-d2cb13530851@gmail.com
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Greg Kroah-Hartman

platform/x86: alienware-wmi-wmax: Add AWCC support for Alienware x16

2026-01-08T09:17:14+00:00

commit a584644a490d276907e56817694859eaac2a4199 upstream.

Add AWCC support for Alienware x16 laptops.

Cc: stable@vger.kernel.org
Signed-off-by: Kurt Borja 
Reviewed-by: Ilpo Järvinen 
Link: https://patch.msgid.link/20251205-area-51-v1-2-d2cb13530851@gmail.com
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Greg Kroah-Hartman

platform/x86: alienware-wmi-wmax: Add support for new Area-51 laptops

2026-01-08T09:17:14+00:00

commit 433f7744cb302ac22800dc0cd50494319ce64ba0 upstream.

Add AWCC support for new Alienware Area-51 laptops.

Cc: stable@vger.kernel.org
Signed-off-by: Kurt Borja 
Reviewed-by: Ilpo Järvinen 
Link: https://patch.msgid.link/20251205-area-51-v1-1-d2cb13530851@gmail.com
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Greg Kroah-Hartman

platform/x86: samsung-galaxybook: Fix problematic pointer cast

2026-01-08T09:17:14+00:00

commit d37cd54ebeac37a763fbf303ed25f8a6e98328ff upstream.

A user reported that reading the charge threshold on his device
results in very strange values (like 78497792) being returned.
The reason for this seems to be the fact that the driver casts
the int pointer to an u8 pointer, leaving the last 3 bytes of
the destination uninitialized. Fix this by using a temporary
variable instead.

Cc: stable@vger.kernel.org
Fixes: 56f529ce4370 ("platform/x86: samsung-galaxybook: Add samsung-galaxybook driver")
Reported-by: Gianni Ceccarelli 
Closes: https://lore.kernel.org/platform-driver-x86/20251228115556.14362d66@thenautilus.net/
Tested-by: Gianni Ceccarelli 
Signed-off-by: Armin Wolf 
Link: https://patch.msgid.link/20251228214217.35972-1-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen 
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Greg Kroah-Hartman

platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe

2026-01-08T09:16:48+00:00

[ Upstream commit 66e245db16f0175af656cd812b6dc1a5e1f7b80a ]

The PMT feature probe creates a child device with device_create().
If device creation fail, the code pass priv->dev (which is an ERR_PTR)
to dev_err_probe(), which is not a valid device pointer.

This patch change the dev_err_probe() call to use the parent auxiliary
device (&auxdev->dev) and update the error message to reference the
parent device name. It ensure correct error reporting and avoid
passing an invalid device pointer.

Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver")
Signed-off-by: Alok Tiwari 
Link: https://patch.msgid.link/20251224095133.115678-1-alok.a.tiwari@oracle.com
Reviewed-by: Ilpo Järvinen 
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Sasha Levin

platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing

2026-01-08T09:16:48+00:00

[ Upstream commit e44c42c830b7ab36e3a3a86321c619f24def5206 ]

The hp_populate_*_elements_from_package() functions in the hp-bioscfg
driver contain out-of-bounds array access vulnerabilities.

These functions parse ACPI packages into internal data structures using
a for loop with index variable 'elem' that iterates through
enum_obj/integer_obj/order_obj/password_obj/string_obj arrays.

When processing multi-element fields like PREREQUISITES and
ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array
elements using expressions like 'enum_obj[elem + reqs]' and
'enum_obj[elem + pos_values]' within nested loops.

The bug is that the bounds check only validated elem, but did not consider
the additional offset when accessing elem + reqs or elem + pos_values.

The fix changes the bounds check to validate the actual accessed index.

Reported-by: Yuhao Jiang 
Reported-by: Junrui Luo 
Fixes: e6c7b3e15559 ("platform/x86: hp-bioscfg: string-attributes")
Signed-off-by: Junrui Luo 
Link: https://patch.msgid.link/SYBPR01MB788173D7DD4EA2CB6383683DAFB0A@SYBPR01MB7881.ausprd01.prod.outlook.com
Reviewed-by: Ilpo Järvinen 
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Sasha Levin

platform/x86/intel/pmt: Fix kobject memory leak on init failure

2026-01-08T09:16:46+00:00

[ Upstream commit 00c22b1e84288bf0e17ab1e7e59d75237cf0d0dc ]

When kobject_init_and_add() fails in pmt_features_discovery(), the
function returns without calling kobject_put(). This violates the
kobject API contract where kobject_put() must be called even on
initialization failure to properly release allocated resources.

Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver")
Signed-off-by: Kaushlendra Kumar 
Link: https://patch.msgid.link/20251223084041.3832933-1-kaushlendra.kumar@intel.com
Reviewed-by: Ilpo Järvinen 
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Sasha Levin

platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic

2026-01-08T09:16:45+00:00

[ Upstream commit 15dd100349b8526cbdf2de0ce3e72e700eb6c208 ]

The ibm_rtl_init() function searches for the signature but has a pointer
arithmetic error. The loop counter suggests searching at 4-byte intervals
but the implementation only advances by 1 byte per iteration.

Fix by properly advancing the pointer by sizeof(unsigned int) bytes
each iteration.

Reported-by: Yuhao Jiang 
Reported-by: Junrui Luo 
Fixes: 35f0ce032b0f ("IBM Real-Time "SMI Free" mode driver -v7")
Signed-off-by: Junrui Luo 
Link: https://patch.msgid.link/SYBPR01MB78812D887A92DE3802D0D06EAFA9A@SYBPR01MB7881.ausprd01.prod.outlook.com
Reviewed-by: Ilpo Järvinen 
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Sasha Levin

platform/x86: msi-laptop: add missing sysfs_remove_group()

2026-01-08T09:16:45+00:00

[ Upstream commit 1461209cf813b6ee6d40f29b96b544587df6d2b1 ]

A sysfs group is created in msi_init() when old_ec_model is enabled, but
never removed. Remove the msipf_old_attribute_group in that case.

Fixes: 03696e51d75a ("msi-laptop: Disable brightness control for new EC")
Signed-off-by: Thomas Fourier 
Link: https://patch.msgid.link/20251217103617.27668-2-fourier.thomas@gmail.com
Reviewed-by: Ilpo Järvinen 
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Sasha Levin

platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names

2026-01-08T09:16:44+00:00

[ Upstream commit f13bce715d1600698310a4a7832f6a52499d5395 ]

Some event names have trailing whitespaces at the end which causes programming
of counters using the name for these specific events to fail and hence need to
be removed.

Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3")
Signed-off-by: Shravan Kumar Ramani 
Reviewed-by: David Thompson 
Link: https://patch.msgid.link/065cbae0717dcc1169681c4dbb1a6e050b8574b3.1766059953.git.shravankr@nvidia.com
Reviewed-by: Ilpo Järvinen 
Signed-off-by: Ilpo Järvinen 
Signed-off-by: Sasha Levin