summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-09-07hwmon: (asus-ec-sensors) Add B650E-IDylan Tackoor
Add support for ROG STRIX B650E-I GAMING WIFI. Signed-off-by: Dylan Tackoor <mynameisdylantackoor@gmail.com> Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20250728205133.15487-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-09-07hwmon: (asus-ec-sensors) Add STRIX B850-I GAMING WIFILucas Yunkyu Lee
Add support for the STRIX B850-I GAMING WIFI Signed-off-by: Lucas Yunkyu Lee <lucas@yklcs.com> Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20250728205133.15487-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-09-07hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based modelsAvadhut Naik
Add thermal info support for newer AMD Family 1Ah-based models. Signed-off-by: Avadhut Naik <avadhut.naik@amd.com> Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-09-07Merge tag 'i2c-for-6.17-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - i801: drop superfluous WDT entry for Birch - rtl9300: - fix channel number check in probe - check data length boundaries in xfer - drop broken SMBus quick operation * tag 'i2c-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: rtl9300: remove broken SMBus Quick operation support i2c: rtl9300: ensure data length is within supported range i2c: rtl9300: fix channel number bound check i2c: i801: Hide Intel Birch Stream SoC TCO WDT
2025-09-07Merge tag 'edac_urgent_for_v6.17_rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Remove a misplaced dma_free_coherent() call in altera_edac * tag 'edac_urgent_for_v6.17_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Delete an inappropriate dma_free_coherent() call
2025-09-07Merge tag 'riscv-for-linus-6.17-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - LTO fix for clang when building with CONFIG_CMODEL_MEDLOW - Fix for ACPI CPPC CSR read/write return values - Several fixes for incorrect access widths in thread_info.cpu reads - Fix an issue in __put_user_nocheck() that was causing the glibc tst-socket-timestamp test to fail - Initialize struct kexec_buf records in several kexec-related functions, which were generating UBSAN warnings - Two fixes for sparse warnings * tag 'riscv-for-linus-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix sparse warning about different address spaces riscv: Fix sparse warning in __get_user_error() riscv: kexec: Initialize kexec_buf struct riscv: use lw when reading int cpu in asm_per_cpu riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG riscv: uaccess: fix __put_user_nocheck for unaligned accesses riscv: use lw when reading int cpu in new_vmalloc_check ACPI: RISC-V: Fix FFH_CPPC_CSR error handling riscv: Only allow LTO with CMODEL_MEDANY
2025-09-07clk: samsung: exynos990: Add PERIC0 and PERIC1 clock supportDenzeel Oliva
Add clock controller support for Peripheral Connectivity 0 and 1 blocks. These provide clocks for USI, I2C and UART peripherals. Some clocks need to be marked as critical to prevent system hang when disabled. Signed-off-by: Denzeel Oliva <wachiturroxd150@gmail.com> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-09-07media: i2c: tc358743: add support for more infoframe typesHans Verkuil
Add support for SPD, AUDIO, DRM and HDMI InfoFrames. Also add support for ISRC1 and ISRC2 Packet Types and a programmable type for both Packet and InfoFrames. The tc358743 HDMI-to-CSI2 bridge is widely available, and it has quite flexible InfoFrame/Packet Type support, so this makes it a very nice device to capture such data. The ACP (Audio Content Protection) Packet capture data is chosen as the programmable type. ACP is typically only used for protected audio, which is quite rare, so instead it is reprogrammed to capture DRM InfoFrames by default. This can be changed by using the packet_type module option to anything you want, and you can change it on the fly as well. It will be updated whenever VIDIOC_LOG_STATUS is called (it's really a debug feature). Tested on my Raspberry Pi 5. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-09-07media: v4l2-core: v4l2-dv-timings: support DRM IFsHans Verkuil
Add support for DRM (Dynamic Range and Mastering) InfoFrames. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-09-07wifi: iwlwifi: Fix dentry reference leak in iwl_mld_add_link_debugfsMiaoqian Lin
The debugfs_lookup() function increases the dentry reference count. Add missing dput() call to release the reference when the "iwlmld" directory already exists. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Link: https://patch.msgid.link/20250902040955.2362472-1-linmq006@gmail.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07wifi: iwlwifi: mei: Remove unused flexible-array member in struct iwl_sap_hdrGustavo A. R. Silva
Remove unused fexible-array member and avoid 14 of the following type of warnings: drivers/net/wireless/intel/iwlwifi/mei/sap.h:318:28: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://patch.msgid.link/aK6-usANI1UPtFVo@kspp Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07wifi: iwlwifi: Remove redundant header filesLiao Yuanhong
The header file "fw/img.h" is already included on line 9. Remove the redundant include. Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI") Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07wifi: iwlwifi: Remove duplicated include in trans.cYang Li
The header files fw/api/tx.h is included twice in gen1_2/trans.c, so one inclusion of each can be removed. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22932 Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Link: https://patch.msgid.link/20250723070522.2195817-1-yang.lee@linux.alibaba.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-06power: supply: cw2015: Fix a alignment coding style issueAndy Yan
Fix the checkpatch warning: CHECK: Alignment should match open parenthesis Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code") Signed-off-by: Andy Yan <andyshrk@163.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06power: supply: Remove the use of dev_err_probe()Xichao Zhao
The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06crypto: hisilicon/hpre - Remove unused curve25519 kpp supportEric Biggers
Curve25519 is used only via the library API, not the crypto_kpp API. In preparation for removing the unused crypto_kpp API for Curve25519, remove the unused "hpre-curve25519" kpp algorithm. Cc: Longfang Liu <liulongfang@huawei.com> Cc: Zhiqi Song <songzhiqi1@huawei.com> Link: https://lore.kernel.org/r/20250906213523.84915-2-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06power: supply: use max() to improve codeQianfeng Rong
Use max() to reduce the code in cw_battery_get_property() and improve its readability. Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06power: supply: rt9467: Add properties for VBUS and IBUS readingChiYuan Huang
Since there's the existing ADC function, add properties 'VOLTAGE_NOW' and 'CURRENT_NOW' to report the current VBUS and IBUS value, respectively. Signed-off-by: ChiYuan Huang <cy_huang@richtek.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06power: supply: qcom_battmgr: add OOI chemistryChristopher Ruehl
The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this update the detection and return the appropriate type. Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06power: supply: 88pm860x: make fsm_state array static const, simplify usageColin Ian King
Don't populate the read-only array fsm_state on the stack at run time, instead make it static const, this reduces the object code size as the data is placed on the data segment and this removes the need to have code to set the array up on each call. Note that making the size of the strings to a more optimal 11 bytes long does not seem to reduce the overall size. Making the array an array of pointers to the strings increases the code size due to the dereferencing overhead. Simplify the array access with &fsm_state[info->state][0] with the simpler expression fsm_state[info->state] to clean up the code. Original: text data bss dec hex filename 22884 8272 64 31220 79f4 drivers/power/supply/88pm860x_charger.o Patched: text data bss dec hex filename 22695 8368 64 31127 7997 drivers/power/supply/88pm860x_charger.o Difference: text data bss dec -189 +96 0 -93 Reduction of 93 bytes total. gcc version 14.2.0 (x86-64) Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06power: supply: Remove error prints for devm_add_action_or_reset()Waqar Hameed
When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06power: supply: bq2415x: replace deprecated strcpy() with strscpy()Miguel García
strcpy() is deprecated for NUL-terminated strings. Replace it with strscpy() for revstr (local fixed-size buffer). Signed-off-by: Miguel García <miguelgarciaroman8@gmail.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06power: supply: gpio-charger: Clean up spacing for better readabilityDarshan R.
Fixed some minor style issues reported by checkpatch.pl. Mainly adjusted the spacing around operators and type casts to match the kernel coding conventions. For example: - Changed `gpios[ndescs-i-1]` to `gpios[ndescs - i - 1]` - Added space in `(u32*)` to make it `(u32 *)` - Cleaned up spacing in a `for` loop No functional changes — just making the code easier to read and consistent with the rest of the kernel. Signed-off-by: Darshan R. <rathod.darshan.0896@gmail.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06driver core: auxiliary bus: Optimize logic of auxiliary_match_id()Zijun Hu
auxiliary_match_id() repeatedly calculates variable @match_size in the for loop, however, the variable is fixed actually, so it is enough to only calculate the variable once. Besides, the function should return directly if name of the @auxdev does not include '.', but it still iterates over the ID table. Additionally, statement 'dev_name(&auxdev->dev)' is fixed, but may be evaluated more than 3 times. Optimize logic of the function by: - Move the logic calculating the variable out of the for loop - Return NULL directly if @p == NULL - Give the statement an dedicated local variable @auxdev_name Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250903-fix_auxbus-v2-1-3eae8374fd65@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06driver core: auxiliary bus: Drop dev_pm_domain_detach() callClaudiu Beznea
Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20250827100541.926350-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06driver core: Fix order of the kernel-doc parametersGil Fine
Fix the order of the kernel-doc parameters in device_find_child() and device_for_each_child*() functions to match the actual functions signature. No functional changes. Signed-off-by: Gil Fine <gil.fine@linux.intel.com> Link: https://lore.kernel.org/r/20250831194930.2063390-1-gil.fine@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06driver core: get_dev_from_fwnode(): document potential raceDanilo Krummrich
Commit 9a4681a485ee ("driver core: Export get_dev_from_fwnode()") made get_dev_from_fwnode() publicly available, but didn't document the guarantees a caller must uphold: get_dev_from_fwnode() obtains a reference count from the device pointer stored in a struct fwnode_handle. While having its own reference count, struct fwnode_handle does not keep a reference count of the device it has a pointer to. Consequently, a caller must guarantee that it is impossible that the last device reference is dropped and the device is released concurrently while calling get_dev_from_fwnode(), otherwise this is a potential UAF and hence a bug. Thus, document this potential race condition for get_dev_from_fwnode(). Cc: Ulf Hansson <ulf.hansson@linaro.org> Cc: Saravana Kannan <saravanak@google.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://lore.kernel.org/r/20250829205911.33142-1-dakr@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06drivers: base: fix "publically"->"publicly"Xichao Zhao
Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Link: https://lore.kernel.org/r/20250827114021.476668-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06mei: hook mei_device on class deviceAlexander Usyskin
mei_device lifetime was managed by devm procedure of parent device. But such memory is freed on device_del. Mei_device object is used by client object that may be alive after parent device is removed. It may lead to use-after-free if discrete graphics driver unloads mei_gsc auxiliary device while user-space holds open handle to mei character device. Connect mei_device structure lifteme to mei class device lifetime by adding mei_device free to class device remove callback. Move exising parent device pointer to separate field in mei_device to avoid misuse. Allocate character device dynamically and allow to control its own lifetime as it may outlive mei_device structure while character device closes after parent device is removed from the system. Leave power management on parent device as we overwrite pci runtime pm procedure and user-space is expecting it there. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201 Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://lore.kernel.org/r/20250826125617.1166546-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06cdx: Fix device node reference leak in cdx_msi_domain_initMiaoqian Lin
Add missing of_node_put() call to release the device node reference obtained via of_parse_phandle(). Fixes: 0e439ba38e61 ("cdx: add MSI support for CDX bus") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Acked-by: Nipun Gupta <nipun.gupta@amd.com> Link: https://lore.kernel.org/r/20250902084933.2418264-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06char: Use list_del_init() in misc_deregister() to reinitialize list pointerXion Wang
Currently, misc_deregister() uses list_del() to remove the device from the list. After list_del(), the list pointers are set to LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs, but does not reset the list head. If misc_deregister() is called more than once on the same device, list_empty() will not return true, and list_del() may be called again, leading to undefined behavior. Replace list_del() with list_del_init() to reinitialize the list head after deletion. This makes the code more robust against double deregistration and allows safe usage of list_empty() on the miscdevice after deregistration. [ Note, this seems to keep broken out-of-tree drivers from doing foolish things. While this does not matter for any in-kernel drivers, external drivers could use a bit of help to show them they shouldn't be doing stuff like re-registering misc devices - gregkh ] Signed-off-by: Xion Wang <xion.wang@mediatek.com> Link: https://lore.kernel.org/r/20250904063714.28925-2-xion.wang@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06misc: remove ineffective WARN_ON() check from misc_deregister()Xion Wang
The WARN_ON(list_empty(&misc->list)) in misc_deregister() does not catch any practical error conditions: - For statically allocated miscdevice structures, the list pointers are zero-initialized, so list_empty() returns false, not true. - After list_del(), the pointers are set to LIST_POISON1 and LIST_POISON2, so repeated deregistration also fails to trigger the check. Signed-off-by: Xion Wang <xion.wang@mediatek.com> Link: https://lore.kernel.org/r/20250827024201.21407-2-xion.wang@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06Input: mtk-pmic-keys - MT6359 has a specific release irqJulien Massot
Support for MT6359 PMIC keys has been added recently. However, the key release event is not properly handled: only key press events are generated, leaving key states stuck in "pressed". This patch ensures that both key press and key release events are properly emitted by handling the release logic correctly. Introduce a 'key_release_irq' member to the 'mtk_pmic_regs' to identify the devices that have a separate irq for the release event. Fixes: bc25e6bf032e ("Input: mtk-pmic-keys - add support for MT6359 PMIC keys") Signed-off-by: Julien Massot <julien.massot@collabora.com> Link: https://lore.kernel.org/r/20250905-radxa-nio-12-l-gpio-v3-1-40f11377fb55@collabora.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-09-07PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()Dan Carpenter
The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check that the pointer is valid. Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
2025-09-06drm/msm/adreno: Add speedbins for A663 GPUAkhil P Oommen
Add speedbin mappings for A663 GPU. Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/670096/ Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-09-06drm/msm: make sure to not queue up recovery more than onceAntonino Maniscalco
If two fault IRQs arrive in short succession recovery work will be queued up twice. When recovery runs a second time it may end up killing an unrelated context. Prevent this by masking off interrupts when triggering recovery. Signed-off-by: Antonino Maniscalco <antomani103@gmail.com> Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/670023/ Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-09-06drm/msm: adreno: a6xx: enable GMU bandwidth voting for x1e80100 GPUNeil Armstrong
The Adreno GPU Management Unit (GMU) can also scale DDR Bandwidth along the Frequency and Power Domain level, but by default we leave the OPP core scale the interconnect ddr path. Declare the Bus Control Modules (BCMs) and the corresponding parameters in the GPU info struct to allow the GMU to vote for the bandwidth. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/665778/ Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-09-06drm/msm: Drop unneeded NULL checkRob Clark
This is always set in msm_gpu_init(), and can never be NULL. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/664431/
2025-09-06drm/msm: Fix 32b size truncationRob Clark
Somehow we never noticed this when arm64 became a thing, many years ago. v2: also fix npages Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Tested-by: Connor Abbott <cwabbott0@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/669785/
2025-09-06drm/msm: Fix missing VM_BIND offset/range validationRob Clark
We need to reject the MAP op if offset+range is larger than the BO size. Reported-by: Connor Abbott <cwabbott0@gmail.com> Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Tested-by: Connor Abbott <cwabbott0@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/669781/
2025-09-06drm/msm: Fix obj leak in VM_BIND error pathRob Clark
If we fail a handle-lookup part way thru, we need to drop the already obtained obj references. Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Tested-by: Connor Abbott <cwabbott0@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/669784/
2025-09-06PM: core: Add two macros for walking device linksRafael J. Wysocki
Add separate macros for walking links to suppliers and consumers of a device to help device links users to avoid exposing the internals of struct dev_links_info in their code and possible coding mistakes related to that. Accordingly, use the new macros to replace open-coded device links list walks in the core power management code. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/1944671.tdWV9SEqCh@rafael.j.wysocki
2025-09-06PM: core: Annotate loops walking device links as _srcuRafael J. Wysocki
Since SRCU is used for the protection of device link lists, the loops over device link lists in multiple places in drivers/base/power/main.c and in pm_runtime_get_suppliers() should be annotated as _srcu rather than as _rcu which is the case currently. Change the annotations accordingly. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2393512.ElGaqSPkdT@rafael.j.wysocki
2025-09-06comedi: Add new driver for ADLink PCI-7250 seriesIan Abbott
The ADLink PCI-7250, LPCI-7250, and LPCIe-7250 are PCI/PCIe boards with 8 relay outputs and 8 isolated digital inputs. Add a new Comedi driver "adl_pci7250" to support them. It is possible to add up to three PCI-7251 plug-in modules to the PCI-7250, with 8 relay outputs and 8 isolated digital inputs per plug-in module. We cannot reliably detect whether the modules are fitted without changing their state. It is harmless to assume the modules are fitted; they just won't do anything, so the driver allows all 32 relay outputs to be written (and their initial state to be read), and all 32 digital inputs to be read. The LPCI-7250 and LPCIe-7250 are low-profile boards that do not support the plug-in modules, but except for a newer variant of the LPCIe-7250, they cannot be distinguished from the full-height boards by their PCI IDs. For the newer variant of the LPCIe-7250, we can assume that there are no plug-in modules fitted and limit the number of channels accordingly. This newer variant of the LPCIe-7250 uses memory-mapped registers, whereas all the other boards use port-mapped registers. I have tested the PCI-7250. The new variant of the LPCIe-7250 has been tested in an out-of-tree version of the Comedi drivers by someone else. Tested-by: Ian Abbott <abbotti@mev.co.uk> # PCI-7250 only Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20250821145914.10445-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06ibmasm: Replace kzalloc() + copy_from_user() with memdup_user_nul()Thorsten Blum
Replace kzalloc() followed by copy_from_user() with memdup_user_nul() to improve and simplify remote_settings_file_write(). No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250905103247.423840-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06drivers/misc/amd-sbi/Kconfig: select REGMAP_I2CMax Kellermann
Without CONFIG_REGMAP, rmi-i2c.c fails to build because struct regmap_config is not defined: drivers/misc/amd-sbi/rmi-i2c.c: In function ‘sbrmi_i2c_probe’: drivers/misc/amd-sbi/rmi-i2c.c:57:16: error: variable ‘sbrmi_i2c_regmap_config’ has initializer but incomplete type 57 | struct regmap_config sbrmi_i2c_regmap_config = { | ^~~~~~~~~~~~~ Additionally, CONFIG_REGMAP_I2C is needed for devm_regmap_init_i2c(): ld: drivers/misc/amd-sbi/rmi-i2c.o: in function `sbrmi_i2c_probe': drivers/misc/amd-sbi/rmi-i2c.c:69:(.text+0x1c0): undefined reference to `__devm_regmap_init_i2c' Fixes: 013f7e7131bd ("misc: amd-sbi: Use regmap subsystem") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann <max.kellermann@ionos.com> Tested-by: Akshay Gupta <Akshay.Gupta@amd.com> Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Link: https://lore.kernel.org/r/20250829091442.1112106-1-max.kellermann@ionos.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06pps: fix warning in pps_register_cdev when register device failWang Liang
Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case. Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") Signed-off-by: Wang Liang <wangliang74@huawei.com> Reviewed-By: Calvin Owens <calvin@wbinvd.org> Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06char/adi: Remove redundant less-than-zero check in adi_write()Thorsten Blum
The function parameter 'size_t count' is unsigned and cannot be less than zero. Remove the redundant condition. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250903202350.182446-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06misc: genwqe: Fix incorrect cmd field being reported in errorColin Ian King
There is a dev_err message that is reporting the value of cmd->asiv_length when it should be reporting cmd->asv_length instead. Fix this. Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06siox: bus-gpio: Remove the use of dev_err_probe()Xichao Zhao
The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Acked-by: Thorsten Scherer <t.scherer@eckelmann.de> Link: https://lore.kernel.org/r/20250819121749.613584-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>