summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-09-06driver core: auxiliary bus: Drop dev_pm_domain_detach() callClaudiu Beznea
Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20250827100541.926350-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06driver core: Fix order of the kernel-doc parametersGil Fine
Fix the order of the kernel-doc parameters in device_find_child() and device_for_each_child*() functions to match the actual functions signature. No functional changes. Signed-off-by: Gil Fine <gil.fine@linux.intel.com> Link: https://lore.kernel.org/r/20250831194930.2063390-1-gil.fine@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06driver core: get_dev_from_fwnode(): document potential raceDanilo Krummrich
Commit 9a4681a485ee ("driver core: Export get_dev_from_fwnode()") made get_dev_from_fwnode() publicly available, but didn't document the guarantees a caller must uphold: get_dev_from_fwnode() obtains a reference count from the device pointer stored in a struct fwnode_handle. While having its own reference count, struct fwnode_handle does not keep a reference count of the device it has a pointer to. Consequently, a caller must guarantee that it is impossible that the last device reference is dropped and the device is released concurrently while calling get_dev_from_fwnode(), otherwise this is a potential UAF and hence a bug. Thus, document this potential race condition for get_dev_from_fwnode(). Cc: Ulf Hansson <ulf.hansson@linaro.org> Cc: Saravana Kannan <saravanak@google.com> Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://lore.kernel.org/r/20250829205911.33142-1-dakr@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06drivers: base: fix "publically"->"publicly"Xichao Zhao
Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Link: https://lore.kernel.org/r/20250827114021.476668-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06mei: hook mei_device on class deviceAlexander Usyskin
mei_device lifetime was managed by devm procedure of parent device. But such memory is freed on device_del. Mei_device object is used by client object that may be alive after parent device is removed. It may lead to use-after-free if discrete graphics driver unloads mei_gsc auxiliary device while user-space holds open handle to mei character device. Connect mei_device structure lifteme to mei class device lifetime by adding mei_device free to class device remove callback. Move exising parent device pointer to separate field in mei_device to avoid misuse. Allocate character device dynamically and allow to control its own lifetime as it may outlive mei_device structure while character device closes after parent device is removed from the system. Leave power management on parent device as we overwrite pci runtime pm procedure and user-space is expecting it there. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201 Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://lore.kernel.org/r/20250826125617.1166546-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06cdx: Fix device node reference leak in cdx_msi_domain_initMiaoqian Lin
Add missing of_node_put() call to release the device node reference obtained via of_parse_phandle(). Fixes: 0e439ba38e61 ("cdx: add MSI support for CDX bus") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Acked-by: Nipun Gupta <nipun.gupta@amd.com> Link: https://lore.kernel.org/r/20250902084933.2418264-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06char: Use list_del_init() in misc_deregister() to reinitialize list pointerXion Wang
Currently, misc_deregister() uses list_del() to remove the device from the list. After list_del(), the list pointers are set to LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs, but does not reset the list head. If misc_deregister() is called more than once on the same device, list_empty() will not return true, and list_del() may be called again, leading to undefined behavior. Replace list_del() with list_del_init() to reinitialize the list head after deletion. This makes the code more robust against double deregistration and allows safe usage of list_empty() on the miscdevice after deregistration. [ Note, this seems to keep broken out-of-tree drivers from doing foolish things. While this does not matter for any in-kernel drivers, external drivers could use a bit of help to show them they shouldn't be doing stuff like re-registering misc devices - gregkh ] Signed-off-by: Xion Wang <xion.wang@mediatek.com> Link: https://lore.kernel.org/r/20250904063714.28925-2-xion.wang@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06misc: remove ineffective WARN_ON() check from misc_deregister()Xion Wang
The WARN_ON(list_empty(&misc->list)) in misc_deregister() does not catch any practical error conditions: - For statically allocated miscdevice structures, the list pointers are zero-initialized, so list_empty() returns false, not true. - After list_del(), the pointers are set to LIST_POISON1 and LIST_POISON2, so repeated deregistration also fails to trigger the check. Signed-off-by: Xion Wang <xion.wang@mediatek.com> Link: https://lore.kernel.org/r/20250827024201.21407-2-xion.wang@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06Input: mtk-pmic-keys - MT6359 has a specific release irqJulien Massot
Support for MT6359 PMIC keys has been added recently. However, the key release event is not properly handled: only key press events are generated, leaving key states stuck in "pressed". This patch ensures that both key press and key release events are properly emitted by handling the release logic correctly. Introduce a 'key_release_irq' member to the 'mtk_pmic_regs' to identify the devices that have a separate irq for the release event. Fixes: bc25e6bf032e ("Input: mtk-pmic-keys - add support for MT6359 PMIC keys") Signed-off-by: Julien Massot <julien.massot@collabora.com> Link: https://lore.kernel.org/r/20250905-radxa-nio-12-l-gpio-v3-1-40f11377fb55@collabora.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-09-07PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()Dan Carpenter
The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check that the pointer is valid. Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
2025-09-06drm/msm/adreno: Add speedbins for A663 GPUAkhil P Oommen
Add speedbin mappings for A663 GPU. Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/670096/ Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-09-06drm/msm: make sure to not queue up recovery more than onceAntonino Maniscalco
If two fault IRQs arrive in short succession recovery work will be queued up twice. When recovery runs a second time it may end up killing an unrelated context. Prevent this by masking off interrupts when triggering recovery. Signed-off-by: Antonino Maniscalco <antomani103@gmail.com> Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/670023/ Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-09-06drm/msm: adreno: a6xx: enable GMU bandwidth voting for x1e80100 GPUNeil Armstrong
The Adreno GPU Management Unit (GMU) can also scale DDR Bandwidth along the Frequency and Power Domain level, but by default we leave the OPP core scale the interconnect ddr path. Declare the Bus Control Modules (BCMs) and the corresponding parameters in the GPU info struct to allow the GMU to vote for the bandwidth. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/665778/ Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-09-06drm/msm: Drop unneeded NULL checkRob Clark
This is always set in msm_gpu_init(), and can never be NULL. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/664431/
2025-09-06drm/msm: Fix 32b size truncationRob Clark
Somehow we never noticed this when arm64 became a thing, many years ago. v2: also fix npages Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Tested-by: Connor Abbott <cwabbott0@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/669785/
2025-09-06drm/msm: Fix missing VM_BIND offset/range validationRob Clark
We need to reject the MAP op if offset+range is larger than the BO size. Reported-by: Connor Abbott <cwabbott0@gmail.com> Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Tested-by: Connor Abbott <cwabbott0@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/669781/
2025-09-06drm/msm: Fix obj leak in VM_BIND error pathRob Clark
If we fail a handle-lookup part way thru, we need to drop the already obtained obj references. Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Tested-by: Connor Abbott <cwabbott0@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/669784/
2025-09-06PM: core: Add two macros for walking device linksRafael J. Wysocki
Add separate macros for walking links to suppliers and consumers of a device to help device links users to avoid exposing the internals of struct dev_links_info in their code and possible coding mistakes related to that. Accordingly, use the new macros to replace open-coded device links list walks in the core power management code. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/1944671.tdWV9SEqCh@rafael.j.wysocki
2025-09-06PM: core: Annotate loops walking device links as _srcuRafael J. Wysocki
Since SRCU is used for the protection of device link lists, the loops over device link lists in multiple places in drivers/base/power/main.c and in pm_runtime_get_suppliers() should be annotated as _srcu rather than as _rcu which is the case currently. Change the annotations accordingly. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2393512.ElGaqSPkdT@rafael.j.wysocki
2025-09-06comedi: Add new driver for ADLink PCI-7250 seriesIan Abbott
The ADLink PCI-7250, LPCI-7250, and LPCIe-7250 are PCI/PCIe boards with 8 relay outputs and 8 isolated digital inputs. Add a new Comedi driver "adl_pci7250" to support them. It is possible to add up to three PCI-7251 plug-in modules to the PCI-7250, with 8 relay outputs and 8 isolated digital inputs per plug-in module. We cannot reliably detect whether the modules are fitted without changing their state. It is harmless to assume the modules are fitted; they just won't do anything, so the driver allows all 32 relay outputs to be written (and their initial state to be read), and all 32 digital inputs to be read. The LPCI-7250 and LPCIe-7250 are low-profile boards that do not support the plug-in modules, but except for a newer variant of the LPCIe-7250, they cannot be distinguished from the full-height boards by their PCI IDs. For the newer variant of the LPCIe-7250, we can assume that there are no plug-in modules fitted and limit the number of channels accordingly. This newer variant of the LPCIe-7250 uses memory-mapped registers, whereas all the other boards use port-mapped registers. I have tested the PCI-7250. The new variant of the LPCIe-7250 has been tested in an out-of-tree version of the Comedi drivers by someone else. Tested-by: Ian Abbott <abbotti@mev.co.uk> # PCI-7250 only Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20250821145914.10445-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06ibmasm: Replace kzalloc() + copy_from_user() with memdup_user_nul()Thorsten Blum
Replace kzalloc() followed by copy_from_user() with memdup_user_nul() to improve and simplify remote_settings_file_write(). No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250905103247.423840-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06drivers/misc/amd-sbi/Kconfig: select REGMAP_I2CMax Kellermann
Without CONFIG_REGMAP, rmi-i2c.c fails to build because struct regmap_config is not defined: drivers/misc/amd-sbi/rmi-i2c.c: In function ‘sbrmi_i2c_probe’: drivers/misc/amd-sbi/rmi-i2c.c:57:16: error: variable ‘sbrmi_i2c_regmap_config’ has initializer but incomplete type 57 | struct regmap_config sbrmi_i2c_regmap_config = { | ^~~~~~~~~~~~~ Additionally, CONFIG_REGMAP_I2C is needed for devm_regmap_init_i2c(): ld: drivers/misc/amd-sbi/rmi-i2c.o: in function `sbrmi_i2c_probe': drivers/misc/amd-sbi/rmi-i2c.c:69:(.text+0x1c0): undefined reference to `__devm_regmap_init_i2c' Fixes: 013f7e7131bd ("misc: amd-sbi: Use regmap subsystem") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann <max.kellermann@ionos.com> Tested-by: Akshay Gupta <Akshay.Gupta@amd.com> Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Link: https://lore.kernel.org/r/20250829091442.1112106-1-max.kellermann@ionos.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06pps: fix warning in pps_register_cdev when register device failWang Liang
Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case. Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/ Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") Signed-off-by: Wang Liang <wangliang74@huawei.com> Reviewed-By: Calvin Owens <calvin@wbinvd.org> Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06char/adi: Remove redundant less-than-zero check in adi_write()Thorsten Blum
The function parameter 'size_t count' is unsigned and cannot be less than zero. Remove the redundant condition. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250903202350.182446-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06misc: genwqe: Fix incorrect cmd field being reported in errorColin Ian King
There is a dev_err message that is reporting the value of cmd->asiv_length when it should be reporting cmd->asv_length instead. Fix this. Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06siox: bus-gpio: Remove the use of dev_err_probe()Xichao Zhao
The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Acked-by: Thorsten Scherer <t.scherer@eckelmann.de> Link: https://lore.kernel.org/r/20250819121749.613584-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06misc: ad525x_dpot: Use str_enabled_disabled() in sysfs_show_reg()Thorsten Blum
Remove hard-coded strings by using the str_enabled_disabled() helper function and silence the following Coccinelle/coccicheck warning reported by string_choices.cocci: opportunity for str_enabled_disabled(..) Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250820102734.760844-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06dw-xdata: Use str_write_read() in dw_xdata_start() and dw_xdata_perf()Thorsten Blum
Remove hard-coded strings by using the str_write_read() helper function and silence the following two Coccinelle/coccicheck warnings reported by string_choices.cocci: opportunity for str_write_read(write) opportunity for str_write_read(write) Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250820102108.760382-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06eeprom: at25: make FRAM device ID error message more preciseMarkus Heidelberg
The error description would be wrong in case the "size" Devicetree property is missing for an FRAM without device ID. Signed-off-by: Markus Heidelberg <m.heidelberg@cab.de> Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Link: https://lore.kernel.org/r/20250815095839.4219-4-m.heidelberg@cab.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06eeprom: at25: support Cypress FRAMs without device IDMarkus Heidelberg
Not all FRAM chips have a device ID and implement the corresponding read command. For such chips this led to the following error on module loading: at25 spi2.0: Error: no Cypress FRAM (id 00) The device ID contains the memory size, so devices without this ID are supported now by setting the size manually in Devicetree using the "size" property. Tested with FM25L16B and "size = <2048>;": at25 spi2.0: 2 KByte fm25 fram, pagesize 4096 According to Infineon/Cypress datasheets, these FRAMs have a device ID: FM25V01A FM25V02A FM25V05 FM25V10 FM25V20A FM25VN10 but these do not: FM25040B FM25640B FM25C160B FM25CL64B FM25L04B FM25L16B FM25W256 So all "FM25V*" FRAMs and only these have a device ID. The letter after "FM25" (V/C/L/W) only describes the voltage range, though. Link: https://lore.kernel.org/all/20250401133148.38330-1-m.heidelberg@cab.de/ Signed-off-by: Markus Heidelberg <m.heidelberg@cab.de> Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Link: https://lore.kernel.org/r/20250815095839.4219-3-m.heidelberg@cab.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06misc: eeprom/m24lr: Remove unneeded semicolonChen Ni
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com> Link: https://lore.kernel.org/r/20250821081804.3168680-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06uio_hv_generic: Let userspace take care of interrupt maskNaman Jain
Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, and the user-mode driver will miss an interrupt which will cause a hang. For eg- when the driver sets inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. So let’s assume that happens, the host puts a message into the ring buffer but does not interrupt. Subsequently, the user space code in the guest sets the inbound ring buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”. User space code then calls pread() to wait for an interrupt. Then one of two things happens: * The host never sends another message. So the pread() waits forever. * The host does send another message. But because there’s already a message in the ring buffer, it doesn’t generate an interrupt. This is the correct behavior, because the host should only send an interrupt when the inbound ring buffer transitions from empty to not-empty. Adding an additional message to a ring buffer that is not empty is not supposed to generate an interrupt on the guest. Since the guest is waiting in pread() and not removing messages from the ring buffer, the pread() waits forever. This could be easily reproduced in hv_fcopy_uio_daemon if we delay setting interrupt mask to 0. Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1, there’s a race condition. Once user space empties the inbound ring buffer, but before user space sets interrupt_mask to 0, the host could put another message in the ring buffer but it wouldn’t interrupt. Then the next pread() would hang. Fix these by removing all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable userspace control the interrupt mask by writing 0/1 to /dev/uioX. Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus") Suggested-by: John Starks <jostarks@microsoft.com> Signed-off-by: Naman Jain <namjain@linux.microsoft.com> Cc: stable@vger.kernel.org Reviewed-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Long Li <longli@microsoft.com> Reviewed-by: Tianyu Lan <tiala@microsoft.com> Tested-by: Tianyu Lan <tiala@microsoft.com> Link: https://lore.kernel.org/r/20250828044200.492030-1-namjain@linux.microsoft.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06uio: uio_pdrv_genirq: Remove dummy PM handlingGeert Uytterhoeven
Since commit 63d00be69348fda4 ("PM: runtime: Allow unassigned ->runtime_suspend|resume callbacks"), unassigned .runtime_{suspend,resume}() callbacks are treated the same as dummy callbacks that just return zero. As the Runtime PM callbacks were the only driver-specific PM handling, all PM handling can be removed. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/a5495b6068dd4e40ae7e0fb66b067fd5b5c210b2.1756999260.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06uio: uio_dmem_genirq: Remove dummy PM handlingGeert Uytterhoeven
Since commit 63d00be69348fda4 ("PM: runtime: Allow unassigned ->runtime_suspend|resume callbacks"), unassigned .runtime_{suspend,resume}() callbacks are treated the same as dummy callbacks that just return zero. As the Runtime PM callbacks were the only driver-specific PM handling, all PM handling can be removed. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/121921f66a2baa125ea62be9436e8b5b12a4ad4d.1756999182.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06uio: uio_pdrv_genirq: Remove MODULE_DEVICE_TABLEVivian Wang
The struct of_device_id list here is filled in at load time since commit 05c3e0bb5629 ("UIO: allow binding uio_pdrv_genirq.c to devices using command line option"). However, this does not work with MODULE_DEVICE_TABLE, which generates an alias at build time. In this case, it generates the aliases "of:N*T*" and "of:N*T*C*", which matches *any* OF device node, which is obviously not intended. It confuses userspace into loading this module for any OF device, and confuses anyone trying to resolve an OF modalias. Remove this broken MODULE_DEVICE_TABLE. Suggested-by: Emily <hello@emily.moe> Fixes: 05c3e0bb5629 ("UIO: allow binding uio_pdrv_genirq.c to devices using command line option") Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Link: https://lore.kernel.org/r/20250826-uio-no-modalias-v2-1-495afa9e8a5b@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06uio: Constify struct pci_device_idChristophe JAILLET
'struct pci_device_id' is not modified in these drivers. Constifying this structure moves some data to a read-only section, so increases overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 4073 1336 0 5409 1521 drivers/uio/uio_cif.o After: ===== text data bss dec hex filename 4233 1176 0 5409 1521 drivers/uio/uio_cif.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/114791f85f0f81531ca2169721eac4911dbe0865.1755629302.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: Hal_EfuseParseAntennaDiversity_8723B is emptyMichael Straube
The function Hal_EfuseParseAntennaDiversity_8723B is empty, remove it. Signed-off-by: Michael Straube <straube.linux@gmail.com> Tested-by: Philipp Hortmann <philipp.g.hortmann@gmail.com> # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove REG_EFUSE_ACCESS_8723 and EFUSE_ACCESS_ON_8723Michael Straube
The macros REG_EFUSE_ACCESS_8723 and EFUSE_ACCESS_ON_8723 are redundant, both are already defined in header files without the _8723 suffix. Remove them and use the marcos from the header files. rtl8723b_hal.h:138: #define EFUSE_ACCESS_ON 0x69 /* For RTL8723 only. */ hal_com_reg.h:35: #define REG_EFUSE_ACCESS 0x00CF /* Efuse access protection for RTL8723 */ Signed-off-by: Michael Straube <straube.linux@gmail.com> Tested-by: Philipp Hortmann <philipp.g.hortmann@gmail.com> # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bWrite from Hal_EfusePowerSwitchMichael Straube
The function Hal_EfusePowerSwitch is always called with bWrite set to false. Remove the pWrite parameter and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Tested-by: Philipp Hortmann <philipp.g.hortmann@gmail.com> # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove wrapper Efuse_PowerSwitchMichael Straube
The function Efuse_PowerSwitch is just a wrapper around Hal_EfusePowerSwitch. Remove the wrapper and use Hal_EfusePowerSwitch directly. Signed-off-by: Michael Straube <straube.linux@gmail.com> Tested-by: Philipp Hortmann <philipp.g.hortmann@gmail.com> # Trendbook Next 14 Link: https://lore.kernel.org/r/20250824095830.79233-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: octeon: Clean up dead code in ethernet-tx.cMohammed GUERMOUD
Remove multiple blocks of non-functional code disabled via '#if 0'. The removed code was a placeholder for incomplete hardware offload features, as indicated by `FIXME` comments. Remove this dead code to simplify the driver. Signed-off-by: Mohammed GUERMOUD <mohammed.guermoud@gmail.com> Link: https://lore.kernel.org/r/20250829170253.16737-1-mohammed.guermoud@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: fix fortify warnings by using struct_groupyingche
Fix fortify_memcpy_chk warnings in rtw_BIP_verify() and rtw_mgmt_xmitframe_coalesce() functions by using struct_group to access consecutive address fields. Changed memcpy calls to use &hdr->addrs instead of hdr->addr1 when copying 18 bytes (addr1 + addr2 + addr3). This resolves 'detected read beyond size of field' warnings by using the proper struct_group mechanism as suggested by the compiler. Signed-off-by: yingche <zxcv2569763104@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/20250829040906.895221-1-zxcv2569763104@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: gpib: use int type to store negative error codesQianfeng Rong
The "ret" variable is used to store the return from bb_write() returns either zero on success or negative error codes on failure. Storing the error codes in size_t which is an unsigned long, doesn't cause an issue at runtime but it's ugly as pants. Change "ret" from size_t to int type. No effect on runtime. Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/20250826123208.300145-1-rongqianfeng@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove include/recv_osdep.hMichael Straube
Move still needed function prototypes defined in the recv_osdep.h header to rtw_recv.h and remove the now obsolete recv_osdep.h. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-14-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove os_dep/recv_linux.cMichael Straube
After previous patches the file os_dep/recv_linux.c is empty now and we can remove it. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-13-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: rename rtw_os_recv_indicate_pktMichael Straube
Rename rtw_os_recv_indicate_pkt to rtw_recv_indicate_pkt as the _os_ indicates operating system dependent code which is unnecessary for in-tree linux kernel code. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-12-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: move rtw_os_recv_indicate_pkt to rtw_recv.cMichael Straube
Move the function rtw_os_recv_indicate_pkt from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-11-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: rename rtw_os_alloc_msdu_pktMichael Straube
Rename rtw_os_alloc_msdu_pkt to rtw_alloc_msdu_pkt as the _os_ indicates operating system dependent code which is unnecessary for in-tree linux kernel code. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-10-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: move rtw_os_alloc_msdu_pkt to rtw_recv.cMichael Straube
Move the function rtw_os_alloc_msdu_pkt from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-9-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: merge rtw_os_recvbuf_resource_free into rtl8723bs_recv.cMichael Straube
Merge rtw_os_recvbuf_resource_free into rtl8723bs_init_recv_priv and into rtl8723bs_free_recv_priv to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>