kernel/linux.git/drivers/staging/nvec, branch v6.1.186

staging: nvec: fix use-after-free in nvec_rx_completed()

2026-07-24T13:54:44+00:00

[ Upstream commit 26813881181deb3a32fbb59eadb2599cbe8423f6 ] In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses") Reviewed-by: Dan Carpenter Signed-off-by: Alexandru Hossu Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

staging: nvec: Fix incorrect null termination of battery manufacturer

2025-08-15T10:04:56+00:00

[ Upstream commit a8934352ba01081c51d2df428e9d540aae0e88b5 ] The battery manufacturer string was incorrectly null terminated using bat_model instead of bat_manu. This could result in an unintended write to the wrong field and potentially incorrect behavior. fixe the issue by correctly null terminating the bat_manu string. Fixes: 32890b983086 ("Staging: initial version of the nvec driver") Signed-off-by: Alok Tiwari Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250719080755.3954373-1-alok.a.tiwari@oracle.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

Staging: nvec: Fix ending in '(' error

2022-02-08T09:46:01+00:00

This patch fixes the checkpatch.pl warning: CHECK: Lines should not end with a '(' 386: FILE: drivers/staging/nvec/nvec.c:386: + err = wait_for_completion_interruptible_timeout( Signed-off-by: Ayan Choudhary Link: https://lore.kernel.org/r/20220207133921.4287-1-ayanchoudhary1025@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: nvec: Fix a bunch of kernel-doc issues

2021-05-10T09:19:24+00:00

Fixes the following W=1 kernel build warning(s): drivers/staging/nvec/nvec.c:109: warning: Function parameter or member 'events' not described in 'nvec_register_notifier' drivers/staging/nvec/nvec.c:136: warning: Function parameter or member 'nb' not described in 'nvec_status_notifier' drivers/staging/nvec/nvec.c:136: warning: Function parameter or member 'event_type' not described in 'nvec_status_notifier' drivers/staging/nvec/nvec.c:136: warning: Function parameter or member 'data' not described in 'nvec_status_notifier' drivers/staging/nvec/nvec.c:358: warning: Function parameter or member 'ev' not described in 'nvec_event_mask' drivers/staging/nvec/nvec.c:358: warning: Function parameter or member 'mask' not described in 'nvec_event_mask' Cc: Marc Dietrich Cc: Greg Kroah-Hartman Cc: Philipp Zabel Cc: Kernel Team Cc: Pierre-Hugues Husson Cc: Ilya Petrov Cc: Andres Klode Cc: ac100@lists.launchpad.net Cc: linux-tegra@vger.kernel.org Cc: linux-staging@lists.linux.dev Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20210414181129.1628598-23-lee.jones@linaro.org Signed-off-by: Greg Kroah-Hartman

staging/nvec:: avoid Wempty-body warning

2021-03-22T16:05:15+00:00

This driver has a few disabled diagnostics, which can probably just get removed, or might still be helpful: drivers/staging/nvec/nvec_ps2.c: In function 'nvec_ps2_notifier': drivers/staging/nvec/nvec_ps2.c:94:77: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 94 | NVEC_PHD("unhandled mouse event: ", msg, msg[1] + 2); Changing the empty macro to the usual 'do {} while (0)' at least shuts up the compiler warnings. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20210322103545.704121-2-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman

staging: nvec: minor coding style fix

2021-02-12T08:49:43+00:00

Fix for the below coding style warning. Warning: Move const after static - use 'static const int' Signed-off-by: Fatih Yildirim Link: https://lore.kernel.org/r/20210212073423.20562-1-yildirim.fatih@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: nvec: Switch from strlcpy to strscpy

2021-02-04T16:16:06+00:00

strlcpy is marked as deprecated in Documentation/process/deprecated.rst, and there is no functional difference when the caller expects truncation (when not checking the return value). strscpy is relatively better as it also avoids scanning the whole source string. This silences the related checkpatch warnings from: 5dbdb2d87c29 ("checkpatch: prefer strscpy to strlcpy") Acked-by: Marc Dietrich Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20210131172838.146706-6-memxor@gmail.com Signed-off-by: Greg Kroah-Hartman

Staging: nvec: Removes repeated word typo in comment

2020-10-01T08:55:17+00:00

Fix a comment typo. Signed-off-by: Ryan Kosta Link: https://lore.kernel.org/r/20200927172855.9813-1-ryanpkosta@gmail.com Signed-off-by: Greg Kroah-Hartman

Staging: nvec: Replace HTTP links with HTTPS ones

2020-07-10T11:52:46+00:00

Rationale: Reduces attack surface on kernel devs opening the links for MITM as HTTPS traffic is much harder to manipulate. Deterministic algorithm: For each file: If not .svg: For each line: If doesn't contain `\bxmlns\b`: For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`: If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`: If both the HTTP and HTTPS versions return 200 OK and serve the same content: Replace HTTP with HTTPS. Signed-off-by: Alexander A. Klimov Link: https://lore.kernel.org/r/20200708183117.16563-1-grandmaster@al2klimov.de Signed-off-by: Greg Kroah-Hartman

staging: nvec: check return value

2019-12-19T18:23:29+00:00

In nvec_kbd_probe(), the return value of devm_input_allocate_device() should be checked before it is used. Signed-off-by: Xidong Wang Link: https://lore.kernel.org/r/1576648598-12257-1-git-send-email-wangxidong_97@163.com Acked-by: Marc Dietrich Signed-off-by: Greg Kroah-Hartman