kernel/linux.git/drivers/nvmem, branch v7.1

nvmem: core: fix use-after-free bugs in error paths

2026-06-05T15:18:58+00:00

Fix several instances of error paths in which we call __nvmem_device_put() - which may end up freeing the underlying memory and other resources - and then keep on using the nvmem structure. Always put the reference to the nvmem device as the last step before returning the error code. Cc: stable@vger.kernel.org Fixes: 7ae6478b304b ("nvmem: core: rework nvmem cell instance creation") Fixes: e888d445ac33 ("nvmem: resolve cells from DT at registration time") Signed-off-by: Bartosz Golaszewski Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204340.116743-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

nvmem: layouts: onie-tlv: fix hang on unknown types

2026-06-05T15:18:58+00:00

The EEPROM on my board has a vendor specific entry of type 0x41. When stumbling upon that, this driver hangs in an endless loop. Fix it by keep incrementing the offset on unknown entries, so the loop will eventually stop. Fixes: d3c0d12f6474 ("nvmem: layouts: onie-tlv: Add new layout driver") Cc: Stable@vger.kernel.org Signed-off-by: Andre Heider Reviewed-by: Miquel Raynal Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204340.116743-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

Merge tag 'v7.0-rc7' into char-misc-next

2026-04-06T07:04:53+00:00

We need the char/misc/iio/comedi fixes in here as well for testing Signed-off-by: Greg Kroah-Hartman

nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy

2026-04-02T14:44:40+00:00

Buffer size used in dma allocation and memcpy is wrong. It can lead to undersized DMA buffer access and possible memory corruption. use correct buffer size in dma_alloc_coherent and memcpy. Fixes: 737c0c8d07b5 ("nvmem: zynqmp_nvmem: Add support to access efuse") Cc: stable@vger.kernel.org Signed-off-by: Ivan Vera Signed-off-by: Harish Ediga Signed-off-by: Harsh Jain Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131645.3025781-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

nvmem: imx: assign nvmem_cell_info::raw_len

2026-04-02T14:44:40+00:00

Avoid getting error messages at startup like the following on i.MX6ULL: nvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4 nvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4 This shouldn't cause any functional change as this alignment would otherwise be done in nvmem_cell_info_to_nvmem_cell_entry_nodup(). Cc: stable@vger.kernel.org Fixes: 13bcd440f2ff ("nvmem: core: verify cell's raw_len") Signed-off-by: Christian Eggers Signed-off-by: Fabio Estevam Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131645.3025781-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

nvmem: rockchip-otp: Add support for RK3528

2026-04-02T14:15:56+00:00

Add support for the OTP controller in RK3528. The OTPC is similar to the OTPC in RK3562 and RK3568, exept for a missing phy clock and reset. Signed-off-by: Jonas Karlman Signed-off-by: Heiko Stuebner Tested-by: Willy Tarreau Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-10-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

nvmem: rockchip-otp: Add support for RK3562

2026-04-02T14:15:56+00:00

This adds the necessary data for handling otp on the rk3562. Signed-off-by: Finley Xiao Signed-off-by: Kever Yang Signed-off-by: Heiko Stuebner Tested-by: Willy Tarreau Reviewed-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Signed-off-by: Jonas Karlman Link: https://patch.msgid.link/20260327131751.3026030-9-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

nvmem: rockchip-otp: Add support for RK3568

2026-04-02T14:15:56+00:00

This adds the necessary data for handling otp the rk3568. Signed-off-by: Finley Xiao Signed-off-by: Kever Yang Signed-off-by: Heiko Stuebner Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-8-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

nvmem: rockchip-otp: Handle internal word_size in main reg_read op

2026-04-02T14:15:56+00:00

Rockchip SoCs RK3576 and RK3588 read data from the OTP using 32-bit words instead of normal 8-bit bytes. Similar RK3506, RK3528, RK3562 and RK3568 will read data from OTP using 16-bit words. The nvmem core stride and word_size cannot fully be used as cells is not always aligned. Continue to report a stride=1 and word_size=1 in nvmem_config and instead handle use of SoC specific word_size internally in the driver. Move current SoC specific word_size handling from the RK3588 read_reg operation to the main read_reg operation to help simplify the SoC specific read_reg operation and allow code reuse in a future RK3568 reg_read operation. Signed-off-by: Jonas Karlman Tested-by: Willy Tarreau Signed-off-by: Heiko Stuebner Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-7-srini@kernel.org Signed-off-by: Greg Kroah-Hartman

nvmem: qnap-mcu-eeprom: Fix struct assignments using commas instead of semicolons

2026-04-02T14:15:56+00:00

The nvcfg struct member assignments were incorrectly using commas instead of semicolons. Signed-off-by: Felix Gu Reviewed-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman