linux.git/drivers/char, branch v7.3-rc2

virtio_console: allocate the port_buffer with the caller's gfp

2026-09-05T17:28:39+00:00

put_chars() runs from the hvc console write path with preemption
disabled, so it asks alloc_buf() for GFP_ATOMIC. Only the data buffer
gets it: the struct port_buffer itself keeps the GFP_KERNEL default, so
the allocation can enter direct reclaim and sleep. A write to /dev/kmsg
on a CONFIG_DEBUG_ATOMIC_SLEEP kernel splats:

  BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:320
  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: virtme-ng-init
  preempt_count: 1, expected: 0
  Preemption disabled at:
  [] vprintk_emit+0x17d/0x510
  Call Trace:
   
   dump_stack_lvl+0x69/0xa0
   __might_resched+0x37a/0x4d0
   __kmalloc_cache_noprof+0x94/0x5f0
   put_chars+0x209/0x3e0
   hvc_console_print+0x234/0x640
   console_flush_all+0x4fc/0x950
   console_unlock+0xbf/0x1b0
   vprintk_emit+0x312/0x510
   devkmsg_emit+0xba/0x110
   devkmsg_write+0x21b/0x2e0
   vfs_write+0x4dc/0x9d0
   ksys_write+0x108/0x1e0
   do_syscall_64+0xfa/0x460
   

Pass gfp on to that allocation too.

Fixes: fc220d6be3c7 ("virtio_console: refactor __send_to_port() buffer ownership")
Signed-off-by: Breno Leitao 
Acked-by: Sungho Bae 
Tested-by: Florian Westphal 
Link: https://patch.msgid.link/20260810-serial-v1-1-abbe51602c13@debian.org
Signed-off-by: Greg Kroah-Hartman

Merge tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi

2026-08-28T23:32:12+00:00

Pull ipmi updates from Corey Minyard:
 "Several cleanup on error fixes and a missing RCU wait and proper
  validation on a received message in one place.

  The biggest change is the initialization of the driver can be done
  asynchronously on a work queue. That saves significant boot time"

* tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi:
  ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
  ipmi:msghandler: Cancel work cleanly on an error
  ipmi:si: Add async init to ipmi_si
  char: ipmi: use named initializers for acpi_device_id
  ipmi: Fix leak in __ipmi_bmc_register
  ipmi: Remove all sysfs files on registration failure
  ipmi: si: Fix NULL pointer dereference after failed registration
  ipmi: ipmb: validate write message length

Merge tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd

2026-08-28T16:36:27+00:00

Pull TPM updates from Jarkko Sakkinen:
 "The bulk of this is Ross Philipson's TPM enablement for Trenchboot.
  That exposes TPM constants, and decouple and improve robustness of
  tpm_buf a bit in order to implement a minimal early TPM driver.

  Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on
  Intel before jumping into kernel's entry point. They re-initalize TPM
  PCRs but leave up to the early boot code measure initrd, boot_params
  and Trenchboot associated metadata.

  The motivation here is just that we would want in future iterations of
  the series put our full focus to the x86 part of the review, and call
  it a day as per TPM changes. Further, even if Trenchboot turned out to
  be empty lottery the worst possible outcome for TPM driver is that
  things get cleaned up a bit"

* tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm-buf: Add TPM buffer support header for standalone reuse
  tpm-buf: Memory-safe allocations
  tpm-buf: Remove chip parameter from tpm_buf_append_handle()
  tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW
  tpm: Remove main TPM header from TPM event log header
  tpm: Move platform specific definitions to the new PTP header
  tpm: Move TPM common base definitions to the command header
  tpm: Move TPM2 specific definitions to the command header
  tpm: Move TPM1 specific definitions to the command header
  tpm: Initial step to reorganize TPM public headers
  tpm: st33zp24: Validate locality read result
  tpm: st33zp24: Return zero on status read failure
  tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null
  tpm: atmel: depend on X86
  tpm: Remove redundant dev_err()
  tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

2026-08-25T23:55:02+00:00

Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the
ipmi_interfaces list") dropped the synchronize_rcu() between unlinking
the command receivers from intf->cmd_rcvrs and freeing them, updating
only the comment that explains why the barrier is needed.

The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr()
walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows
rcvr->user from that lookup within the same read-side section. Without
the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a
reader still holds a pointer to it, causing a use-after-free.

The rework only made srcu unnecessary for the interfaces list; the
cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu()
before freeing the receivers.

Fixes: 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yifei Gao 
Message-ID: <20260825234630.1196170-1-gyf161023@gmail.com>
Signed-off-by: Corey Minyard

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25T16:38:50+00:00

Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...

tpm-buf: Add TPM buffer support header for standalone reuse

2026-08-25T15:13:37+00:00

Extract all the functions and definitions for TPM buffer handling
and separate them into their own header.

Signed-off-by: Ross Philipson 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen

tpm-buf: Memory-safe allocations

2026-08-25T15:13:36+00:00

Decouple kzalloc from buffer creation, so that a managed allocation can be
used:

	struct tpm_buf *buf __free(kfree) buf = kzalloc(TPM_BUFSIZE,
						GFP_KERNEL);
	if (!buf)
		return -ENOMEM;

	tpm_buf_init(buf, TPM_BUFSIZE);

Alternatively, other allocations are also possible (static data, stack,
etc) for example:

	u8 buf_data[512];
	struct tpm_buf *buf = (struct tpm_buf *)buf_data;
	tpm_buf_init(buf, sizeof(buf_data));

This is achieved by embedding buffer's header inside the allocated blob,
instead of having an outer wrapper.

Reviewed-by: Stefan Berger 
Signed-off-by: Jarkko Sakkinen 
Tested-by: Srish Srinivasan 
Message-ID: <20260522013555.1063716-1-jarkko@kernel.org>
Signed-off-by: Ross Philipson

tpm-buf: Remove chip parameter from tpm_buf_append_handle()

2026-08-25T15:13:36+00:00

Remove the TPM driver chip parameter from the function
tpm_buf_append_handle(). The chip parameter is only for error logging
which can be done with other facilities like WARN().

Message-ID: <20260125192526.782202-11-jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Ross Philipson

tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW

2026-08-25T15:13:36+00:00

Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW flags into
the TPM_BUF_INVALID flag, as their behavior is identical (the only
difference being the associated log messages).

Message-ID: <20260125192526.782202-11-jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen 
Reviewed-by: Jonathan McDowell 
Signed-off-by: Ross Philipson

tpm: Move platform specific definitions to the new PTP header

2026-08-25T15:13:35+00:00

These are definitions for TPM 2.0 interface and interactions with
the platform as defined in the TCG specification:

These definitions are located here in a separate file to avoid conflicts
with vendor specific TIS/FIFO definition (e.g. STMicroelectronics,
Infineon Technologies, etc). This allows the TCG defined TIS/FIFO
interface to be in a public header while the former chip specific
implementations contain their own definitions. TPM 1.x family chips
that adhere to the TCG specifications use the TIS/FIFO interface as
defined here.

TCG PC Client Platform TPM Profile (PTP) Specification
 - https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/

Co-developed-by: Daniel P. Smith 
Signed-off-by: Daniel P. Smith 
Co-developed-by: Alec Brown 
Signed-off-by: Alec Brown 
Signed-off-by: Ross Philipson 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen