kernel/linux.git/drivers/rapidio, branch v6.6.132

rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()

2026-03-04T12:21:13+00:00

[ Upstream commit 666183dcdd9ad3b8156a1df7f204f728f720380f ] When idtab allocation fails, net is not registered with rio_add_net() yet, so kfree(net) is sufficient to release the memory. Set mport->net to NULL to avoid dangling pointer. Link: https://lkml.kernel.org/r/20260121013508.195836-1-lihaoxiang@isrc.iscas.ac.cn Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Haoxiang Li Reviewed-by: Andrew Morton Cc: Alexandre Bounine Cc: Matt Porter Cc: Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin

drivers/rapidio/rio_cm.c: prevent possible heap overwrite

2025-06-27T10:08:58+00:00

commit 50695153d7ddde3b1696dbf0085be0033bf3ddb3 upstream. In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated. Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace. Reported-by: maher azz Cc: Matt Porter Cc: Alexandre Bounine Cc: Linus Torvalds Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman

rapidio: fix an API misues when rio_add_net() fails

2025-03-13T11:58:27+00:00

commit b2ef51c74b0171fde7eb69b6152d3d2f743ef269 upstream. rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue. Link: https://lkml.kernel.org/r/20250227073409.3696854-1-haoxiang_li2024@163.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: Haoxiang Li Reviewed-by: Dan Carpenter Cc: Alexandre Bounine Cc: Matt Porter Cc: Yang Yingliang Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman

rapidio: add check for rio_add_net() in rio_scan_alloc_net()

2025-03-13T11:58:27+00:00

commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang Signed-off-by: Haoxiang Li Cc: Alexandre Bounine Cc: Matt Porter Cc: Dan Carpenter Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman

Merge tag 'mm-nonmm-stable-2023-04-27-16-01' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2023-04-28T02:57:00+00:00

Pull non-MM updates from Andrew Morton: "Mainly singleton patches all over the place. Series of note are: - updates to scripts/gdb from Glenn Washburn - kexec cleanups from Bjorn Helgaas" * tag 'mm-nonmm-stable-2023-04-27-16-01' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (50 commits) mailmap: add entries for Paul Mackerras libgcc: add forward declarations for generic library routines mailmap: add entry for Oleksandr ocfs2: reduce ioctl stack usage fs/proc: add Kthread flag to /proc/$pid/status ia64: fix an addr to taddr in huge_pte_offset() checkpatch: introduce proper bindings license check epoll: rename global epmutex scripts/gdb: add GDB convenience functions $lx_dentry_name() and $lx_i_dentry() scripts/gdb: create linux/vfs.py for VFS related GDB helpers uapi/linux/const.h: prefer ISO-friendly __typeof__ delayacct: track delays from IRQ/SOFTIRQ scripts/gdb: timerlist: convert int chunks to str scripts/gdb: print interrupts scripts/gdb: raise error with reduced debugging information scripts/gdb: add a Radix Tree Parser lib/rbtree: use '+' instead of '|' for setting color. proc/stat: remove arch_idle_time() checkpatch: check for misuse of the link tags checkpatch: allow Closes tags with links ...

rapidio/tsi721: remove redundant pci_clear_master

2023-04-08T20:45:38+00:00

Remove pci_clear_master to simplify the code, the bus-mastering is also cleared in do_pci_disable_device, like this: ./drivers/pci/pci.c:2197 static void do_pci_disable_device(struct pci_dev *dev) { u16 pci_command; pci_read_config_word(dev, PCI_COMMAND, &pci_command); if (pci_command & PCI_COMMAND_MASTER) { pci_command &= ~PCI_COMMAND_MASTER; pci_write_config_word(dev, PCI_COMMAND, pci_command); } pcibios_disable_device(dev); }. And dev->is_busmaster is set to 0 in pci_disable_device. Link: https://lkml.kernel.org/r/20230323113711.10523-1-cai.huoqing@linux.dev Signed-off-by: Cai Huoqing Cc: Alexandre Bounine Cc: Matt Porter Cc: Tetsuo Handa Signed-off-by: Andrew Morton

driver core: class: remove struct class_interface * from callbacks

2023-04-03T19:42:52+00:00

The add_dev and remove_dev callbacks in struct class_interface currently pass in a pointer back to the class_interface structure that is calling them, but none of the callback implementations actually use this pointer as it is pointless (the structure is known, the driver passed it in in the first place if it is really needed again.) So clean this up and just remove the pointer from the callbacks and fix up all callback functions. Cc: Jean Delvare Cc: Guenter Roeck Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Kurt Schwemmer Cc: Jon Mason Cc: Dave Jiang Cc: Allen Hubbe Cc: Dominik Brodowski Cc: Matt Porter Cc: Alexandre Bounine Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: Doug Gilbert Cc: John Stultz Cc: Thomas Gleixner Cc: Stephen Boyd Cc: Hans de Goede Cc: Andrew Morton Cc: Wang Weiyang Cc: Yang Yingliang Cc: Jakob Koschel Cc: Cai Xinchen Acked-by: Rafael J. Wysocki Acked-by: Logan Gunthorpe Link: https://lore.kernel.org/r/2023040250-pushover-platter-509c@gregkh Signed-off-by: Greg Kroah-Hartman

driver core: bus: mark the struct bus_type for sysfs callbacks as constant

2023-03-23T12:20:40+00:00

struct bus_type should never be modified in a sysfs callback as there is nothing in the structure to modify, and frankly, the structure is almost never used in a sysfs callback, so mark it as constant to allow struct bus_type to be moved to read-only memory. Cc: "David S. Miller" Cc: "James E.J. Bottomley" Cc: "K. Y. Srinivasan" Cc: Alexander Gordeev Cc: Alexandre Bounine Cc: Alison Schofield Cc: Ben Widawsky Cc: Dexuan Cui Cc: Eric Dumazet Cc: Haiyang Zhang Cc: Hannes Reinecke Cc: Harald Freudenberger Cc: Heiko Carstens Cc: Hu Haowen Cc: Jakub Kicinski Cc: Jens Axboe Cc: Jonathan Corbet Cc: Laurentiu Tudor Cc: Matt Porter Cc: Michael Ellerman Cc: Paolo Abeni Cc: Stuart Yoder Cc: Vasily Gorbik Cc: Vishal Verma Cc: Yanteng Si Acked-by: Ilya Dryomov # rbd Acked-by: Ira Weiny # cxl Reviewed-by: Alex Shi Acked-by: Iwona Winiarska Acked-by: Dan Williams Acked-by: Bjorn Helgaas # pci Acked-by: Wei Liu Acked-by: Martin K. Petersen # scsi Link: https://lore.kernel.org/r/20230313182918.1312597-23-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

driver core: class: remove module * from class_create()

2023-03-17T14:16:33+00:00

The module pointer in class_create() never actually did anything, and it shouldn't have been requred to be set as a parameter even if it did something. So just remove it and fix up all callers of the function in the kernel tree at the same time. Cc: "Rafael J. Wysocki" Acked-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20230313181843.1207845-4-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

drivers: remove struct module * setting from struct class

2023-03-17T14:16:27+00:00

There is no need to manually set the owner of a struct class, as the registering function does it automatically, so remove all of the explicit settings from various drivers that did so as it is unneeded. This allows us to remove this pointer entirely from this structure going forward. Cc: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/20230313181843.1207845-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman