kernel/linux.git/drivers, branch v6.6.142

pds_core: ensure null-termination for firmware version strings

2026-06-01T15:43:16+00:00

[ Upstream commit 3d4432d34c1992701289cbe12df9fd024f315998 ] The driver passes fw_version directly to devlink_info_version_stored_put() without ensuring null-termination. While current firmware null-terminates these strings, the driver should not rely on this behavior. Add explicit null-termination to prevent potential issues if firmware behavior changes. Fixes: 45d76f492938 ("pds_core: set up device and adminq") Signed-off-by: Nikhil P. Rao Link: https://patch.msgid.link/20260520205842.1486718-1-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

pds_core: add an error code check in pdsc_dl_info_get

2026-06-01T15:43:16+00:00

[ Upstream commit a1e4c334cbc9a80578c3784f8a3e7076bb19578d ] check the value of 'ret' after call 'devlink_info_version_stored_put'. Signed-off-by: Su Hui Reviewed-by: Shannon Nelson Link: https://lore.kernel.org/r/20231019083351.1526484-1-suhui@nfschina.com Signed-off-by: Jakub Kicinski Stable-dep-of: 3d4432d34c19 ("pds_core: ensure null-termination for firmware version strings") Signed-off-by: Sasha Levin

net: mana: validate rx_req_idx to prevent out-of-bounds array access

2026-06-01T15:43:16+00:00

[ Upstream commit b809d0409991b75a6cff846a5ac27c3062953f84 ] In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Signed-off-by: Aditya Garg Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/20260520051553.857120-1-gargaditya@linux.microsoft.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

gpio: cdev: check if uAPI v2 config attributes are correctly zeroed

2026-06-01T15:43:16+00:00

[ Upstream commit 3e6ccd790ed69bedd3d9626d01dd35cf9821c121 ] We check the padding of other uAPI v2 structures but not that of line config attributes. For used attributes: check if their padding is zeroed, for unused: check if the entire structure is zeroed. Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") Reviewed-by: Kent Gibson Link: https://patch.msgid.link/20260521-gpio-cdev-attr-padding-check-v3-1-ec3bcbe2e358@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski Signed-off-by: Sasha Levin

gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)

2026-06-01T15:43:15+00:00

[ Upstream commit e106b1dd38e723ec2bb2bf57ea9b2aff464b9423 ] Use the mem_is_zero() helper where possible. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20241110201706.16614-1-andy.shevchenko@gmail.com Signed-off-by: Bartosz Golaszewski Stable-dep-of: 3e6ccd790ed6 ("gpio: cdev: check if uAPI v2 config attributes are correctly zeroed") Signed-off-by: Sasha Levin

net: ag71xx: check error for platform_get_irq

2026-06-01T15:43:15+00:00

[ Upstream commit e7c70bf97e90d974cd575e4c90f8f9b07d056da3 ] Complete error handling for a failed platform_get_irq() call Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") Signed-off-by: Rosen Penev Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20260516212616.11758-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

Bluetooth: btmtk: fix urb->setup_packet leak in error paths

2026-06-01T15:43:15+00:00

[ Upstream commit dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd ] The setup_packet of control urb is not freed if usb_submit_urb fails or the submitted urb is killed. Add free in these two paths. Fixes: a1c49c434e150 ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices") Signed-off-by: Jiajia Liu Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin

Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c

2026-06-01T15:43:15+00:00

[ Upstream commit d019930b0049fc2648a6b279893d8ad330596e81 ] Move btusb_mtk_hci_wmt_sync from btusb.c to btmtk.c which holds vendor specific stuff and would make btusb.c clean. Add usb.h header to btmtksdio.c/btmtkuart.c for usb related element defined in btmtk.h Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz Stable-dep-of: dd1dda6b8d6e ("Bluetooth: btmtk: fix urb->setup_packet leak in error paths") Signed-off-by: Sasha Levin

Bluetooth: btmtk: rename btmediatek_data

2026-06-01T15:43:15+00:00

[ Upstream commit d3e6236053958a8f1c7c7a885d9cecdd383e4615 ] Rename btmediatek_data to have a consistent prefix throughout the driver. Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz Stable-dep-of: dd1dda6b8d6e ("Bluetooth: btmtk: fix urb->setup_packet leak in error paths") Signed-off-by: Sasha Levin

Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset

2026-06-01T15:43:15+00:00

[ Upstream commit 4c0c28f2bbec0c51395fd1f13c697da67483964b ] Extract the function btusb_mtk_subsys_reset from the btusb_mtk_reset for the future handling of resetting bluetooth controller without the USB reset. Co-developed-by: Sean Wang Signed-off-by: Sean Wang Signed-off-by: Hao Qin Signed-off-by: Luiz Augusto von Dentz Stable-dep-of: dd1dda6b8d6e ("Bluetooth: btmtk: fix urb->setup_packet leak in error paths") Signed-off-by: Sasha Levin