linux.git/drivers/misc, branch v6.18

mei: fix error flow in probe

2025-11-03T01:02:04+00:00

Dismantle class device last in probe error flow to avoid accessing
freed memory like:

[   87.926774] WARNING: CPU: 9 PID: 518 at kernel/workqueue.c:4234
__flush_work+0x340/0x390
...
[   87.926912] Workqueue: async async_run_entry_fn
[   87.926918] RIP: e030:__flush_work+0x340/0x390
[   87.926923] Code: 26 9d 05 00 65 48 8b 15 26 3c ca 02 48 85 db 48 8b
04 24 48 89 54 24 58 0f 85 de fe ff ff e9 f6 fd ff ff 0f 0b e9 77 ff ff
ff <0f> 0b e9 70 ff ff ff 0f 0b e9 19 ff ff ff e8 7d 8b 0e 01 48 89 de
[   87.926931] RSP: e02b:ffffc900412ebc00 EFLAGS: 00010246
[   87.926936] RAX: 0000000000000000 RBX: ffff888103e55090 RCX: 0000000000000000
[   87.926941] RDX: 000fffffffe00000 RSI: 0000000000000001 RDI: ffffc900412ebc60
[   87.926945] RBP: ffff888103e55090 R08: ffffffffc1266ec8 R09: ffff8881109076e8
[   87.926949] R10: 0000000080040003 R11: 0000000000000000 R12: ffff888103e54000
[   87.926953] R13: ffffc900412ebc18 R14: 0000000000000001 R15: 0000000000000000
[   87.926962] FS:  0000000000000000(0000) GS:ffff888233238000(0000) knlGS:0000000000000000
[   87.926967] CS:  e030 DS: 0000 ES: 0000 CR0: 0000000080050033
[   87.926971] CR2: 00007e7923b32708 CR3: 00000001088df000 CR4: 0000000000050660
[   87.926977] Call Trace:
[   87.926981]  
[   87.926987]  ? __call_rcu_common.constprop.0+0x11e/0x310
[   87.926993]  cancel_work_sync+0x5e/0x80
[   87.926999]  mei_cancel_work+0x19/0x40 [mei]
[   87.927051]  mei_me_probe+0x273/0x2b0 [mei_me]
[   87.927060]  local_pci_probe+0x45/0x90
[   87.927066]  pci_call_probe+0x5b/0x180
[   87.927070]  pci_device_probe+0x95/0x140
[   87.927074]  ? driver_sysfs_add+0x57/0xc0
[   87.927079]  really_probe+0xde/0x340
[   87.927083]  ? pm_runtime_barrier+0x54/0x90
[   87.927087]  __driver_probe_device+0x78/0x110
[   87.927092]  driver_probe_device+0x1f/0xa0
[   87.927095]  __driver_attach_async_helper+0x5e/0xe0
[   87.927100]  async_run_entry_fn+0x34/0x130
[   87.927104]  process_one_work+0x18d/0x340
[   87.927108]  worker_thread+0x256/0x3a0
[   87.927111]  ? __pfx_worker_thread+0x10/0x10
[   87.927115]  kthread+0xfc/0x240
[   87.927120]  ? __pfx_kthread+0x10/0x10
[   87.927124]  ? __pfx_kthread+0x10/0x10
[   87.927127]  ret_from_fork+0xf5/0x110
[   87.927132]  ? __pfx_kthread+0x10/0x10
[   87.927136]  ret_from_fork_asm+0x1a/0x30
[   87.927141]  

Tested-by: Guenter Roeck 
Reported-by: Marek Marczykowski-Górecki 
Closes: https://lore.kernel.org/lkml/aQbYAXPADqfiXUYO@mail-itl/
Reported-by: Guenter Roeck 
Closes: https://lore.kernel.org/lkml/8deef7c4-ac75-4db8-91b7-02cf0e39e371@roeck-us.net/
Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device")
Signed-off-by: Alexander Usyskin 
Tested-by: Marek Marczykowski-Górecki 
Link: https://patch.msgid.link/20251102180836.1203314-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman

Merge tag 'char-misc-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2025-10-26T17:33:46+00:00

Pull char/misc driver fixes from Greg KH:
 "Here are some small char/misc/android driver fixes for 6.18-rc3 for
  reported issues. Included in here are:

   - rust binder fixes for reported issues

   - mei device id addition

   - mei driver fixes

   - comedi bugfix

   - most usb driver bugfixes

   - fastrpc memory leak fix

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  most: usb: hdm_probe: Fix calling put_device() before device initialization
  most: usb: Fix use-after-free in hdm_disconnect
  binder: remove "invalid inc weak" check
  mei: txe: fix initialization order
  comedi: fix divide-by-zero in comedi_buf_munge()
  mei: late_bind: Fix -Wincompatible-function-pointer-types-strict
  misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
  mei: me: add wildcat lake P DID
  misc: amd-sbi: Clarify that this is a BMC driver
  nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE
  binder: Fix missing kernel-doc entries in binder.c
  rust_binder: report freeze notification only when fully frozen
  rust_binder: don't delete FreezeListener if there are pending duplicates
  rust_binder: freeze_notif_done should resend if wrong state
  rust_binder: remove warning about orphan mappings
  rust_binder: clean `clippy::mem_replace_with_default` warning

Merge tag 'mm-hotfixes-stable-2025-10-22-12-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-23T00:57:35+00:00

Pull hotfixes from Andrew Morton:
 "17 hotfixes. 12 are cc:stable and 14 are for MM.

  There's a two-patch DAMON series from SeongJae Park which addresses a
  missed check and possible memory leak. Apart from that it's all
  singletons - please see the changelogs for details"

* tag 'mm-hotfixes-stable-2025-10-22-12-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  csky: abiv2: adapt to new folio flags field
  mm/damon/core: use damos_commit_quota_goal() for new goal commit
  mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme
  hugetlbfs: move lock assertions after early returns in huge_pmd_unshare()
  vmw_balloon: indicate success when effectively deflating during migration
  mm/damon/core: fix list_add_tail() call on damon_call()
  mm/mremap: correctly account old mapping after MREMAP_DONTUNMAP remap
  mm: prevent poison consumption when splitting THP
  ocfs2: clear extent cache after moving/defragmenting extents
  mm: don't spin in add_stack_record when gfp flags don't allow
  dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
  mm/damon/sysfs: dealloc commit test ctx always
  mm/damon/sysfs: catch commit test ctx alloc failure
  hung_task: fix warnings caused by unaligned lock pointers

mei: txe: fix initialization order

2025-10-22T06:03:57+00:00

The mei_register() should move before the mei_start() for hook
on class device to work.
Same change was implemented in mei-me, missed from mei-txe.

Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device")
Signed-off-by: Alexander Usyskin 
Link: https://patch.msgid.link/20251019073659.2646791-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman

mei: late_bind: Fix -Wincompatible-function-pointer-types-strict

2025-10-22T06:03:32+00:00

When building with -Wincompatible-function-pointer-types-strict, a
warning designed to catch kernel control flow integrity (kCFI) issues at
build time, there is an instance in the new mei late binding code
originating from the type parameter of mei_lb_push_payload():

  drivers/misc/mei/mei_lb.c:211:18: error: incompatible function pointer types initializing 'int (*)(struct device *, u32, u32, const void *, size_t)' (aka 'int (*)(struct device *, unsigned int, unsigned int, const void *, unsigned long)') with an expression of type 'int (struct device *, enum intel_lb_type, u32, const void *, size_t)' (aka 'int (struct device *, enum intel_lb_type, unsigned int, const void *, unsigned long)') [-Werror,-Wincompatible-function-pointer-types-strict]
    211 |         .push_payload = mei_lb_push_payload,
        |                         ^~~~~~~~~~~~~~~~~~~

While 'unsigned int' and 'enum intel_lb_type' are ABI compatible, hence
no regular warning from -Wincompatible-function-pointer-types, the
mismatch will trigger a kCFI violation when mei_lb_push_payload() is
called indirectly.

Update the type parameter of mei_lb_push_payload() to be 'u32' to match
the prototype in 'struct intel_lb_component_ops', clearing up the
warning and kCFI violation.

Fixes: 741eeabb7c78 ("mei: late_bind: add late binding component driver")
Signed-off-by: Nathan Chancellor 
Link: https://patch.msgid.link/20250920-drm-xe-fix-wifpts-v1-1-c89b5357c7ba@kernel.org
Signed-off-by: Greg Kroah-Hartman

misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup

2025-10-22T06:03:24+00:00

In fastrpc_map_lookup, dma_buf_get is called to obtain a reference to
the dma_buf for comparison purposes. However, this reference is never
released when the function returns, leading to a dma_buf memory leak.

Fix this by adding dma_buf_put before returning from the function,
ensuring that the temporarily acquired reference is properly released
regardless of whether a matching map is found.

Fixes: 9031626ade38 ("misc: fastrpc: Fix fastrpc_map_lookup operation")
Cc: stable@kernel.org
Signed-off-by: Junhao Xie 
Tested-by: Xilin Wu 
Rule: add
Link: https://lore.kernel.org/stable/48B368FB4C7007A7%2B20251017083906.3259343-1-bigfoot%40radxa.com
Link: https://patch.msgid.link/48B368FB4C7007A7+20251017083906.3259343-1-bigfoot@radxa.com
Signed-off-by: Greg Kroah-Hartman

mei: me: add wildcat lake P DID

2025-10-22T06:03:02+00:00

Add Wildcat Lake P device id.

Cc: stable@vger.kernel.org
Co-developed-by: Tomas Winkler 
Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Link: https://patch.msgid.link/20251016125912.2146136-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman

misc: amd-sbi: Clarify that this is a BMC driver

2025-10-22T06:02:57+00:00

Add a sentence to the driver description to clarify that the sbrmi-i2c
driver is intended to run on the BMC and not on the managed node. Add
platform dependencies accordingly.

Signed-off-by: Jean Delvare 
Link: https://lore.kernel.org/r/5c9f7100-0e59-4237-a252-43c3ee4802a2@amd.com
Link: https://patch.msgid.link/20251016155040.0e86c102@endymion
Signed-off-by: Greg Kroah-Hartman

vmw_balloon: indicate success when effectively deflating during migration

2025-10-21T22:46:17+00:00

When migrating a balloon page, we first deflate the old page to then
inflate the new page.

However, if inflating the new page succeeded, we effectively deflated the
old page, reducing the balloon size.

In that case, the migration actually worked: similar to migrating+
immediately deflating the new page.  The old page will be freed back to
the buddy.

Right now, the core will leave the page be marked as isolated (as we
returned an error).  When later trying to putback that page, we will run
into the WARN_ON_ONCE() in balloon_page_putback().

That handling was changed in commit 3544c4faccb8 ("mm/balloon_compaction:
stop using __ClearPageMovable()"); before that change, we would have
tolerated that way of handling it.

To fix it, let's just return 0 in that case, making the core effectively
just clear the "isolated" flag + freeing it back to the buddy as if the
migration succeeded.  Note that the new page will also get freed when the
core puts the last reference.

Note that this also makes it all be more consistent: we will no longer
unisolate the page in the balloon driver while keeping it marked as being
isolated in migration core.

This was found by code inspection.

Link: https://lkml.kernel.org/r/20251014124455.478345-1-david@redhat.com
Fixes: 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()")
Signed-off-by: David Hildenbrand 
Cc: Jerrin Shaji George 
Cc: Broadcom internal kernel review list 
Cc: Arnd Bergmann 
Cc: Greg Kroah-Hartman 
Cc: 
Signed-off-by: Andrew Morton

powerpc, ocxl: Fix extraction of struct xive_irq_data

2025-10-13T04:10:55+00:00

Commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt
controller drivers") changed xive_irq_data to be stashed to chip_data
instead of handler_data. However, multiple places are still attempting to
read xive_irq_data from handler_data and get a NULL pointer deference bug.

Update them to read xive_irq_data from chip_data.

Non-XIVE files which touch xive_irq_data seem quite strange to me,
especially the ocxl driver. I think there ought to be an alternative
platform-independent solution, instead of touching XIVE's data directly.
Therefore, I think this whole thing should be cleaned up. But perhaps I
just misunderstand something. In any case, this cleanup would not be
trivial; for now, just get things working again.

Fixes: cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers")
Reported-by: Ritesh Harjani (IBM) 
Closes: https://lore.kernel.org/linuxppc-dev/68e48df8.170a0220.4b4b0.217d@mx.google.com/
Signed-off-by: Nam Cao 
Reviewed-by: Ganesh Goudar 
Acked-by: Andrew Donnellan   # ocxl
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20251008081359.1382699-1-namcao@linutronix.de