linux.git/drivers/gpib, branch v7.2-rc1 Linux kernel source tree Revert "gpib: cb7210: Fix region leak when request_irq fails" 2026-05-30T10:29:07+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-05-30T10:29:07+00:00 285ecb7d9e1b2401c2eccca4d0f26615f4d651eb This reverts commit 5ad28496055858166eb2268344c8fda2c26d3561. Turns out not to be correct. Link: https://lore.kernel.org/r/PpNUbGhrvT8I_KayoDvQYI2PYjmMw1QEkuVBDZz2PwBsVVgPkBXJarc2mBM0IhiH3AQG0GtgqEsDRXNj3yUKEDBaZa25u73pAjvcE6vfRsg=@protonmail.com Reported-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com> Cc: Mark Brown <broonie@kernel.org> Cc: Hongling Zeng <zhongling0719@126.com> Cc: Hongling Zeng <zenghongling@kylinos.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This reverts commit 5ad28496055858166eb2268344c8fda2c26d3561.

Turns out not to be correct.

Link: https://lore.kernel.org/r/PpNUbGhrvT8I_KayoDvQYI2PYjmMw1QEkuVBDZz2PwBsVVgPkBXJarc2mBM0IhiH3AQG0GtgqEsDRXNj3yUKEDBaZa25u73pAjvcE6vfRsg=@protonmail.com
Reported-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Hongling Zeng <zhongling0719@126.com>
Cc: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: cb7210: Fix region leak when request_irq fails 2026-05-23T11:47:34+00:00 Hongling Zeng zenghongling@kylinos.cn 2026-05-03T09:30:36+00:00 5ad28496055858166eb2268344c8fda2c26d3561 When request_irq() fails, the region allocated by request_region() is not released. Fix this by calling release_region() before returning. Smatch warning: drivers/gpib/cb7210/cb7210.c:1068 cb_isa_attach() warn: 'config->ibbase' from __request_region() not released on lines: 1064. Fixes: 82e3508046f9 ("staging: gpib: cb7210 console messaging cleanup") Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn> Link: https://patch.msgid.link/20260503093036.283546-1-zenghongling@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
When request_irq() fails, the region allocated by request_region()
is not released. Fix this by calling release_region() before returning.

  Smatch warning:
    drivers/gpib/cb7210/cb7210.c:1068 cb_isa_attach() warn: 'config->ibbase'
  from __request_region() not released on lines: 1064.

Fixes: 82e3508046f9 ("staging: gpib: cb7210 console messaging cleanup")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Link: https://patch.msgid.link/20260503093036.283546-1-zenghongling@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: fix double decrement of descriptor_busy in command_ioctl() 2026-05-23T11:47:34+00:00 Adam Crosser adam.crosser@praetorian.com 2026-04-24T12:37:47+00:00 c4faab452b3c1ada003d49c477609dd80523b9bf commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") introduced a descriptor_busy reference counter to pin struct gpib_descriptor across IO ioctl operations. In command_ioctl(), the error path inside the loop decrements descriptor_busy and breaks, but execution then falls through to the unconditional decrement after the loop, underflowing the counter to -1. This re-enables the use-after-free that the original fix was meant to prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on an actively-used descriptor and frees it. Remove the early decrement from the error path. The post-loop decrement already handles all exit paths, matching the correct pattern used in read_ioctl() and write_ioctl(). Fixes: d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers") Reported-by: Ruikai Peng <ruikai@pwno.io> Signed-off-by: Adam Crosser <adam.crosser@praetorian.com> Link: https://patch.msgid.link/20260424123750.855863-1-adam.r.crosser@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers")
introduced a descriptor_busy reference counter to pin struct
gpib_descriptor across IO ioctl operations.  In command_ioctl(), the
error path inside the loop decrements descriptor_busy and breaks, but
execution then falls through to the unconditional decrement after the
loop, underflowing the counter to -1.

This re-enables the use-after-free that the original fix was meant to
prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on
an actively-used descriptor and frees it.

Remove the early decrement from the error path.  The post-loop
decrement already handles all exit paths, matching the correct pattern
used in read_ioctl() and write_ioctl().

Fixes: d1857f8296dc ("gpib: fix use-after-free in IO ioctl handlers")
Reported-by: Ruikai Peng <ruikai@pwno.io>
Signed-off-by: Adam Crosser <adam.crosser@praetorian.com>
Link: https://patch.msgid.link/20260424123750.855863-1-adam.r.crosser@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: agilent_82357a: don't check a NULL serial string 2026-05-23T11:47:34+00:00 Joe Simmons-Talbott joest@redhat.com 2026-03-26T13:12:56+00:00 6be50f680a3b2e3c87ac5faf5eddf44bb3ad6558 The agilent_82357a driver uses the USB device serial string for device matching but does not verify that the string exists before passing it to strcmp(). Verify that the device has a serial number before accessing it to avoid triggering a NULL-pointer dereference with devices that don't provide a serial number (iSerialNumber = 0). Similar to commit aa79f996eb41 ("i2c: cp2615: fix serial string NULL-deref at probe"). Found by Claude:sonnet-4.5 Signed-off-by: Joe Simmons-Talbott <joest@redhat.com> Acked-by: Dave Penkler <dpenkler@gmail.com> Link: https://patch.msgid.link/20260326131256.1758014-1-joest@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The agilent_82357a driver uses the USB device serial string for device
matching but does not verify that the string exists before passing it
to strcmp().

Verify that the device has a serial number before accessing it to avoid
triggering a NULL-pointer dereference with devices that don't provide
a serial number (iSerialNumber = 0).

Similar to commit aa79f996eb41 ("i2c: cp2615: fix serial string
NULL-deref at probe").

Found by Claude:sonnet-4.5

Signed-off-by: Joe Simmons-Talbott <joest@redhat.com>
Acked-by: Dave Penkler <dpenkler@gmail.com>
Link: https://patch.msgid.link/20260326131256.1758014-1-joest@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: Suppress setting END on error from NI_USB dongle 2026-05-23T11:47:33+00:00 Dave Penkler dpenkler@gmail.com 2026-04-22T07:48:07+00:00 7c19b47f5a1839817e5ddc5ba589224fcfb6255d The NI USB adapter sets the END bit in the status word when an error occurs such as a read being interrupted by the setting of ATN. This happens for example when a device clear is received from the controller in charge during a read. The common driver changes the error return to 0 whenever the END bit is set in order to avoid errors such as timeout or interrupt to be reported after the full message has actually been read. The behaviour of the NI USB adapter in setting the END bit on errors was causing actual errors (-EINTR, -ETIMEDOUT) not to be reported. We avoid setting the END bit in the ni_usb_gpib driver when an error is reported in error_code of the status from the adaptor. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://patch.msgid.link/20260422074807.3194-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The NI USB adapter sets the END bit in the status word when an error
occurs such as a read being interrupted by the setting of ATN. This
happens for example when a device clear is received from the
controller in charge during a read.

The common driver changes the error return to 0 whenever the END bit
is set in order to avoid errors such as timeout or interrupt to be
reported after the full message has actually been read. The behaviour
of the NI USB adapter in setting the END bit on errors was causing
actual errors (-EINTR, -ETIMEDOUT) not to be reported.

We avoid setting the END bit in the ni_usb_gpib driver when an error
is reported in error_code of the status from the adaptor.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://patch.msgid.link/20260422074807.3194-1-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib; Add register and unregister calls 2026-05-23T11:47:33+00:00 Dave Penkler dpenkler@gmail.com 2026-04-11T17:25:11+00:00 4f2d31d243b465a5ee7750356e956bf479e5603f Register the driver for new 72130 based pci_xl board type with the common driver on module initialisation. Unregister the driver on registration error and module exit. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://patch.msgid.link/20260411172511.26546-7-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Register the driver for new 72130 based pci_xl board type with the
common driver on module initialisation.
Unregister the driver on registration error and module exit.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://patch.msgid.link/20260411172511.26546-7-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: Add attach routine for pci_xl board 2026-05-23T11:47:33+00:00 Dave Penkler dpenkler@gmail.com 2026-04-11T17:25:10+00:00 b9e4f6e9b256da27744d99b5ad81ae5b75e4861a Add new attach routine for 72130 based boards. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://patch.msgid.link/20260411172511.26546-6-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Add new attach routine for 72130 based boards.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://patch.msgid.link/20260411172511.26546-6-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: Add ines_pci_xl_interface 2026-05-23T11:47:33+00:00 Dave Penkler dpenkler@gmail.com 2026-04-11T17:25:09+00:00 1d0e413791b89e64b6bea976866863751e46f5ad Add new interface initialisation struct for 72130 based boards. It is basically the same as the ines_pci_interface apart from the name, attach and line_status fields. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://patch.msgid.link/20260411172511.26546-5-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Add new interface initialisation struct for 72130 based boards.

It is basically the same as the ines_pci_interface apart from the
name, attach and line_status fields.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://patch.msgid.link/20260411172511.26546-5-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: Don't use extended registers 2026-05-23T11:47:33+00:00 Dave Penkler dpenkler@gmail.com 2026-04-11T17:25:08+00:00 1b2bfb7ac25bca1b184a525bdac77ab51fabb295 When the chip type is 72310 then avoid accessing extended registers Apart from the BSR the 72310 supports only the standard NEC u7210 registers. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://patch.msgid.link/20260411172511.26546-4-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
When the chip type is 72310 then avoid accessing extended registers
Apart from the BSR the 72310 supports only the standard NEC u7210
registers.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://patch.msgid.link/20260411172511.26546-4-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gpib: Add ines 72130 line_status routine 2026-05-23T11:47:33+00:00 Dave Penkler dpenkler@gmail.com 2026-04-11T17:25:07+00:00 3be376ac8f020f0c9bed8e7aa2cc2757087b4352 The 72130 chip has a different bus statue register offset and layout. Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://patch.msgid.link/20260411172511.26546-3-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The 72130 chip has a different bus statue register offset
and layout.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Link: https://patch.msgid.link/20260411172511.26546-3-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>