kernel/linux.git/drivers/staging/nvec, branch v6.6.150

staging: nvec: fix use-after-free in nvec_rx_completed()

2026-07-24T14:03:14+00:00

[ Upstream commit 26813881181deb3a32fbb59eadb2599cbe8423f6 ] In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses") Reviewed-by: Dan Carpenter Signed-off-by: Alexandru Hossu Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

staging: nvec: Fix incorrect null termination of battery manufacturer

2025-08-15T10:08:44+00:00

[ Upstream commit a8934352ba01081c51d2df428e9d540aae0e88b5 ] The battery manufacturer string was incorrectly null terminated using bat_model instead of bat_manu. This could result in an unintended write to the wrong field and potentially incorrect behavior. fixe the issue by correctly null terminating the bat_manu string. Fixes: 32890b983086 ("Staging: initial version of the nvec driver") Signed-off-by: Alok Tiwari Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250719080755.3954373-1-alok.a.tiwari@oracle.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

staging: nvec_ps2: Convert to platform remove callback returning void

2023-04-03T19:49:55+00:00

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230403154014.2564054-22-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman

staging: nvec_power: Convert to platform remove callback returning void

2023-04-03T19:49:55+00:00

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230403154014.2564054-21-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman

staging: nvec: nvec_kbd: Convert to platform remove callback returning void

2023-04-03T19:49:54+00:00

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230403154014.2564054-20-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman

staging: nvec: Convert to platform remove callback returning void

2023-04-03T19:49:54+00:00

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230403154014.2564054-19-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman

Staging: nvec: Remove macro definition to_nvec_led

2023-03-22T09:19:25+00:00

Remove definition 'to_nvec_led' because it is only used once. Rewrite the code directly in the calling function 'nvec_led_brightness_set'. Signed-off-by: Sumitra Sharma Link: https://lore.kernel.org/r/20230322054051.GA150453@sumitra.com Signed-off-by: Greg Kroah-Hartman

Staging: nvec: Fix ending in '(' error

2022-02-08T09:46:01+00:00

This patch fixes the checkpatch.pl warning: CHECK: Lines should not end with a '(' 386: FILE: drivers/staging/nvec/nvec.c:386: + err = wait_for_completion_interruptible_timeout( Signed-off-by: Ayan Choudhary Link: https://lore.kernel.org/r/20220207133921.4287-1-ayanchoudhary1025@gmail.com Signed-off-by: Greg Kroah-Hartman

staging: nvec: Fix a bunch of kernel-doc issues

2021-05-10T09:19:24+00:00

Fixes the following W=1 kernel build warning(s): drivers/staging/nvec/nvec.c:109: warning: Function parameter or member 'events' not described in 'nvec_register_notifier' drivers/staging/nvec/nvec.c:136: warning: Function parameter or member 'nb' not described in 'nvec_status_notifier' drivers/staging/nvec/nvec.c:136: warning: Function parameter or member 'event_type' not described in 'nvec_status_notifier' drivers/staging/nvec/nvec.c:136: warning: Function parameter or member 'data' not described in 'nvec_status_notifier' drivers/staging/nvec/nvec.c:358: warning: Function parameter or member 'ev' not described in 'nvec_event_mask' drivers/staging/nvec/nvec.c:358: warning: Function parameter or member 'mask' not described in 'nvec_event_mask' Cc: Marc Dietrich Cc: Greg Kroah-Hartman Cc: Philipp Zabel Cc: Kernel Team Cc: Pierre-Hugues Husson Cc: Ilya Petrov Cc: Andres Klode Cc: ac100@lists.launchpad.net Cc: linux-tegra@vger.kernel.org Cc: linux-staging@lists.linux.dev Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20210414181129.1628598-23-lee.jones@linaro.org Signed-off-by: Greg Kroah-Hartman

staging/nvec:: avoid Wempty-body warning

2021-03-22T16:05:15+00:00

This driver has a few disabled diagnostics, which can probably just get removed, or might still be helpful: drivers/staging/nvec/nvec_ps2.c: In function 'nvec_ps2_notifier': drivers/staging/nvec/nvec_ps2.c:94:77: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 94 | NVEC_PHD("unhandled mouse event: ", msg, msg[1] + 2); Changing the empty macro to the usual 'do {} while (0)' at least shuts up the compiler warnings. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20210322103545.704121-2-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman