linux-stable.git/drivers/staging, branch linux-6.14.y Linux kernel stable tree staging: vchiq_arm: Create keep-alive thread during probe 2025-05-29T09:12:31+00:00 Stefan Wahren wahrenst@gmx.net 2025-03-09T12:50:13+00:00 c7a256e6cf51f9e9db32f2ad9ccdcc52d617c098 [ Upstream commit 86bc8821700665ad3962f3ef0d93667f59cf7031 ] Creating the keep-alive thread in vchiq_platform_init_state have the following advantages: - abort driver probe if kthread_create fails (more consistent behavior) - make resource release process easier Since vchiq_keepalive_thread_func is defined below vchiq_platform_init_state, the latter must be moved. Signed-off-by: Stefan Wahren <wahrenst@gmx.net> Link: https://lore.kernel.org/r/20250309125014.37166-5-wahrenst@gmx.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 86bc8821700665ad3962f3ef0d93667f59cf7031 ]

Creating the keep-alive thread in vchiq_platform_init_state have
the following advantages:
- abort driver probe if kthread_create fails (more consistent behavior)
- make resource release process easier

Since vchiq_keepalive_thread_func is defined below
vchiq_platform_init_state, the latter must be moved.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20250309125014.37166-5-wahrenst@gmx.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
staging: axis-fifo: Correct handling of tx_fifo_depth for size validation 2025-05-18T06:26:00+00:00 Gabriel Shahrouzi gshahrouzi@gmail.com 2025-04-19T01:29:37+00:00 dd6796c789c34a343808a0b2618d409ddc6a01cf commit 2ca34b508774aaa590fc3698a54204706ecca4ba upstream. Remove erroneous subtraction of 4 from the total FIFO depth read from device tree. The stored depth is for checking against total capacity, not initial vacancy. This prevented writes near the FIFO's full size. The check performed just before data transfer, which uses live reads of the TDFV register to determine current vacancy, correctly handles the initial Depth - 4 hardware state and subsequent FIFO fullness. Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core") Cc: stable@vger.kernel.org Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com> Link: https://lore.kernel.org/r/20250419012937.674924-1-gshahrouzi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 2ca34b508774aaa590fc3698a54204706ecca4ba upstream.

Remove erroneous subtraction of 4 from the total FIFO depth read from
device tree. The stored depth is for checking against total capacity,
not initial vacancy. This prevented writes near the FIFO's full size.

The check performed just before data transfer, which uses live reads of
the TDFV register to determine current vacancy, correctly handles the
initial Depth - 4 hardware state and subsequent FIFO fullness.

Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core")
Cc: stable@vger.kernel.org
Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com>
Link: https://lore.kernel.org/r/20250419012937.674924-1-gshahrouzi@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: axis-fifo: Remove hardware resets for user errors 2025-05-18T06:26:00+00:00 Gabriel Shahrouzi gshahrouzi@gmail.com 2025-04-19T00:43:06+00:00 51ceb8a2c7b0f1c727693301cf633da78df0200d commit c6e8d85fafa7193613db37da29c0e8d6e2515b13 upstream. The axis-fifo driver performs a full hardware reset (via reset_ip_core()) in several error paths within the read and write functions. This reset flushes both TX and RX FIFOs and resets the AXI-Stream links. Allow the user to handle the error without causing hardware disruption or data loss in other FIFO paths. Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core") Cc: stable@vger.kernel.org Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com> Link: https://lore.kernel.org/r/20250419004306.669605-1-gshahrouzi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit c6e8d85fafa7193613db37da29c0e8d6e2515b13 upstream.

The axis-fifo driver performs a full hardware reset (via
reset_ip_core()) in several error paths within the read and write
functions. This reset flushes both TX and RX FIFOs and resets the
AXI-Stream links.

Allow the user to handle the error without causing hardware disruption
or data loss in other FIFO paths.

Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core")
Cc: stable@vger.kernel.org
Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com>
Link: https://lore.kernel.org/r/20250419004306.669605-1-gshahrouzi@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: bcm2835-camera: Initialise dev in v4l2_dev 2025-05-18T06:26:00+00:00 Dave Stevenson dave.stevenson@raspberrypi.com 2025-04-23T10:47:15+00:00 b70bdd4923e8b8edbacde2af83ca337bb7005261 commit 98698ca0e58734bc5c1c24e5bbc7429f981cd186 upstream. Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to vchiq_mmal_init, however nothing iniitialised dev->v4l2_dev, so we got a NULL pointer dereference. Set dev->v4l2_dev.dev during bcm2835_mmal_probe. The device pointer could be passed into v4l2_device_register to set it, however that also has other effects that would need additional changes. Fixes: 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state") Cc: stable@vger.kernel.org Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Stefan Wahren <wahrenst@gmx.net> Link: https://lore.kernel.org/r/20250423-staging-bcm2835-v4l2-fix-v2-1-3227f0ba4700@raspberrypi.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 98698ca0e58734bc5c1c24e5bbc7429f981cd186 upstream.

Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to
vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to
vchiq_mmal_init, however nothing iniitialised dev->v4l2_dev, so we got
a NULL pointer dereference.

Set dev->v4l2_dev.dev during bcm2835_mmal_probe. The device pointer
could be passed into v4l2_device_register to set it, however that also
has other effects that would need additional changes.

Fixes: 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20250423-staging-bcm2835-v4l2-fix-v2-1-3227f0ba4700@raspberrypi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: iio: adc: ad7816: Correct conditional logic for store mode 2025-05-18T06:26:00+00:00 Gabriel Shahrouzi gshahrouzi@gmail.com 2025-04-14T15:40:49+00:00 9bad0f76286fcd16185d083cc916c1bcfa0b439d commit 2e922956277187655ed9bedf7b5c28906e51708f upstream. The mode setting logic in ad7816_store_mode was reversed due to incorrect handling of the strcmp return value. strcmp returns 0 on match, so the `if (strcmp(buf, "full"))` block executed when the input was not "full". This resulted in "full" setting the mode to AD7816_PD (power-down) and other inputs setting it to AD7816_FULL. Fix this by checking it against 0 to correctly check for "full" and "power-down", mapping them to AD7816_FULL and AD7816_PD respectively. Fixes: 7924425db04a ("staging: iio: adc: new driver for AD7816 devices") Cc: stable@vger.kernel.org Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com> Acked-by: Nuno Sá <nuno.sa@analog.com> Link: https://lore.kernel.org/stable/20250414152920.467505-1-gshahrouzi%40gmail.com Link: https://patch.msgid.link/20250414154050.469482-1-gshahrouzi@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 2e922956277187655ed9bedf7b5c28906e51708f upstream.

The mode setting logic in ad7816_store_mode was reversed due to
incorrect handling of the strcmp return value. strcmp returns 0 on
match, so the `if (strcmp(buf, "full"))` block executed when the
input was not "full".

This resulted in "full" setting the mode to AD7816_PD (power-down) and
other inputs setting it to AD7816_FULL.

Fix this by checking it against 0 to correctly check for "full" and
"power-down", mapping them to AD7816_FULL and AD7816_PD respectively.

Fixes: 7924425db04a ("staging: iio: adc: new driver for AD7816 devices")
Cc: stable@vger.kernel.org
Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com>
Acked-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/stable/20250414152920.467505-1-gshahrouzi%40gmail.com
Link: https://patch.msgid.link/20250414154050.469482-1-gshahrouzi@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: gpib: Use min for calculating transfer length 2025-05-02T06:01:59+00:00 Dave Penkler dpenkler@gmail.com 2025-01-20T14:50:30+00:00 cead428296d9156ed0be8b4758000a71f71dda9b [ Upstream commit 76d54fd5471b10ee993c217928a39d7351eaff5c ] In the accel read and write functions the transfer length was being calculated by an if statement setting it to the lesser of the remaining bytes to read/write and the fifo size. Replace both instances with min() which is clearer and more compact. Reported-by: kernel test robot <lkp@intel.com> Reported-by: Julia Lawall <julia.lawall@inria.fr> Closes: https://lore.kernel.org/r/202501182153.qHfL4Fbc-lkp@intel.com/ Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250120145030.29684-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 76d54fd5471b10ee993c217928a39d7351eaff5c ]

In the accel read and write functions the transfer length
was being calculated by an if statement setting it to
the lesser of the remaining bytes to read/write and the
fifo size.

Replace both instances with min() which is clearer and
more compact.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@inria.fr>
Closes: https://lore.kernel.org/r/202501182153.qHfL4Fbc-lkp@intel.com/
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250120145030.29684-1-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
staging: gpib: Fix Oops after disconnect in agilent usb 2025-04-10T12:44:43+00:00 Dave Penkler dpenkler@gmail.com 2025-02-22T20:45:15+00:00 50ef6e45bec79da4c5a01fad4dc23466ba255099 [ Upstream commit 8491e73a5223acb0a4b4d78c3f8b96aa9c5e774d ] If the agilent usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on disconnect. This problem was introduced by setting usb_dev from the bus_interface for dev_xxx messages. Previously bus_interface was checked for NULL only in the functions directly calling usb_fill_bulk_urb or usb_control_msg. Check for valid bus_interface on all interface entry points and return -ENODEV if it is NULL. Fixes: fbae7090f30c ("staging: gpib: Update messaging and usb_device refs in agilent_usb") Cc: stable <stable@kernel.org> Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250222204515.5104-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 8491e73a5223acb0a4b4d78c3f8b96aa9c5e774d ]

If the agilent usb dongle is disconnected subsequent calls to the
driver cause a NULL dereference Oops as the bus_interface
is set to NULL on disconnect.

This problem was introduced by setting usb_dev from the bus_interface
for dev_xxx messages.

Previously bus_interface was checked for NULL only in the functions
directly calling usb_fill_bulk_urb or usb_control_msg.

Check for valid bus_interface on all interface entry points
and return -ENODEV if it is NULL.

Fixes: fbae7090f30c ("staging: gpib: Update messaging and usb_device refs in agilent_usb")
Cc: stable <stable@kernel.org>
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250222204515.5104-1-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
staging: gpib: agilent usb console messaging cleanup 2025-04-10T12:44:43+00:00 Dave Penkler dpenkler@gmail.com 2025-02-14T11:46:53+00:00 1de197342e9d8d2e2f476dac6d82cb12e9e5ff8a [ Upstream commit 50a6ed0494bc082227c38f427b40731bca9bdf15 ] Enable module name to be printed in pr_xxx and dev_xxx Use DRV_NAME defined as KBUILD_MODNAME instead of hard coded string in usb_driver struct. Remove __func__ parameter in dev_dbg messages as this can be enabled with dynamic debug. Remove __func__ parameter in dev_err messages as they are not needed. The module name is sufficient. Change pr_info to dev_dbg where needed and remove the rest where possible. Remove test and error messages for buffer over run in write and read_registers as these are just trying to catch bugs in the driver. Remove agilent_82357a string prefix in error messages. Return -EIO for too many reads in read_registers instead of continuing after printing an error message. Change pr_warn to dev_warn. Remove warning on calls for unsupported functionality. Remove test and message for buffer overflow in agilent_82357_init and agilent_82357a_go_idle which are just checking for a driver bug. Use actual indeces in the array instead of i and then incrementing i so that the code is clear and there is no need to check for overflow or print a message. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250214114708.28947-3-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb") Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 50a6ed0494bc082227c38f427b40731bca9bdf15 ]

Enable module name to be printed in pr_xxx and dev_xxx
Use DRV_NAME defined as KBUILD_MODNAME instead of hard coded
string in usb_driver struct.

Remove __func__ parameter in dev_dbg messages as this can be
enabled with dynamic debug.

Remove __func__ parameter in dev_err messages as they are not
needed. The module name is sufficient.

Change pr_info to dev_dbg where needed and remove the rest
where possible.

Remove test and error messages for buffer over run in write and
read_registers as these are just trying to catch bugs in the driver.

Remove agilent_82357a string prefix in error messages.

Return -EIO for too many reads in read_registers instead of
continuing after printing an error message.

Change pr_warn to dev_warn.

Remove warning on calls for unsupported functionality.

Remove test and message for buffer overflow in agilent_82357_init
and agilent_82357a_go_idle which are just checking for a driver bug.
Use actual indeces in the array instead of i and then incrementing
i so that the code is clear and there is no need to check for
overflow or print a message.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250214114708.28947-3-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb")
Signed-off-by: Sasha Levin <sashal@kernel.org>
staging: gpib: Fix Oops after disconnect in ni_usb 2025-04-10T12:44:43+00:00 Dave Penkler dpenkler@gmail.com 2025-02-22T16:58:17+00:00 5dc98ba6f7304c188b267ef481281849638447bf [ Upstream commit a239c6e91b665f1837cf57b97fe638ef1baf2e78 ] If the usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on disconnect. This problem was introduced by setting usb_dev from the bus_interface for dev_xxx messages. Previously bus_interface was checked for NULL only in the the functions directly calling usb_fill_bulk_urb or usb_control_msg. Check for valid bus_interface on all interface entry points and return -ENODEV if it is NULL. Fixes: 4934b98bb243 ("staging: gpib: Update messaging and usb_device refs in ni_usb") Cc: stable <stable@kernel.org> Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250222165817.12856-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit a239c6e91b665f1837cf57b97fe638ef1baf2e78 ]

If the usb dongle is disconnected subsequent calls to the
driver cause a NULL dereference Oops as the bus_interface
is set to NULL on disconnect.

This problem was introduced by setting usb_dev from the bus_interface
for dev_xxx messages.

Previously bus_interface was checked for NULL only in the the functions
directly calling usb_fill_bulk_urb or usb_control_msg.

Check for valid bus_interface on all interface entry points
and return -ENODEV if it is NULL.

Fixes: 4934b98bb243 ("staging: gpib: Update messaging and usb_device refs in ni_usb")
Cc: stable <stable@kernel.org>
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250222165817.12856-1-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
staging: gpib: ni_usb console messaging cleanup 2025-04-10T12:44:42+00:00 Dave Penkler dpenkler@gmail.com 2025-02-14T11:47:05+00:00 0ccd208aacd016cf7467a3e8b645945b3f619de4 [ Upstream commit 18ce5b5d9167bffce02550a85c7c3316a05ea598 ] Enable module name to be printed in pr_xxx and dev_xxx Use DRV_NAME defined as KBUILD_MODNAME instead of hard coded string "ni_usb_gpib" in usb_driver struct. Remove __func__ parameter from pr_err and dev_err. Remove __func__ parameter from dev_dbg as this can be enabled by dynamic debug. Remove commented printk's and dev_err's. Remove kmalloc failed messages. Remove buffer over run bug dev_err message as this just checks for a bug in the driver which does not exist. Remove read/write length too long messages and return -EINVAL Change dev_info to dev_dbg where possible. Move attach message to the end of attach function. Remove buffer overrun message. Use actual array indeces instead of i and i++ to make code clear and check redundnant. Remove module init and exit pr_info's. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250214114708.28947-15-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: a239c6e91b66 ("staging: gpib: Fix Oops after disconnect in ni_usb") Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 18ce5b5d9167bffce02550a85c7c3316a05ea598 ]

Enable module name to be printed in pr_xxx and dev_xxx
Use DRV_NAME defined as KBUILD_MODNAME instead of hard coded
string "ni_usb_gpib" in usb_driver struct.

Remove __func__ parameter from pr_err and dev_err.

Remove __func__ parameter from dev_dbg as this can be
enabled by dynamic debug.

Remove commented printk's and dev_err's.

Remove kmalloc failed messages.

Remove buffer over run bug dev_err message as this just checks
for a bug in the driver which does not exist.

Remove read/write length too long messages and return -EINVAL

Change dev_info to dev_dbg where possible.

Move attach message to the end of attach function.

Remove buffer overrun message. Use actual array indeces
instead of i and i++ to make code clear and check redundnant.

Remove module init and exit pr_info's.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://lore.kernel.org/r/20250214114708.28947-15-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a239c6e91b66 ("staging: gpib: Fix Oops after disconnect in ni_usb")
Signed-off-by: Sasha Levin <sashal@kernel.org>