summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-03-17dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMAMarek Vasut1-1/+22
The cyclic DMA calculation is currently entirely broken and reports residue only for the first segment. The problem is twofold. First, when the first descriptor finishes, it is moved from active_list to done_list, but it is never returned back into the active_list. The xilinx_dma_tx_status() expects the descriptor to be in the active_list to report any meaningful residue information, which never happens after the first descriptor finishes. Fix this up in xilinx_dma_start_transfer() and if the descriptor is cyclic, lift it from done_list and place it back into active_list list. Second, the segment .status fields of the descriptor remain dirty. Once the DMA did one pass on the descriptor, the .status fields are populated with data by the DMA, but the .status fields are not cleared before reuse during the next cyclic DMA round. The xilinx_dma_get_residue() recognizes that as if the descriptor was complete and had 0 residue, which is bogus. Reinitialize the status field before placing the descriptor back into the active_list. Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine") Signed-off-by: Marek Vasut <marex@nabladev.com> Link: https://patch.msgid.link/20260316221943.160375-1-marex@nabladev.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17dmaengine: xilinx: xilinx_dma: Fix dma_device directionsMarek Vasut1-1/+1
Unlike chan->direction , struct dma_device .directions field is a bitfield. Turn chan->direction into a bitfield to make it compatible with struct dma_device .directions . Fixes: 7e01511443c3 ("dmaengine: xilinx_dma: Set dma_device directions") Signed-off-by: Marek Vasut <marex@nabladev.com> Link: https://patch.msgid.link/20260316221728.160139-1-marex@nabladev.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17interconnect: qcom: qcs615: enable QoS configurationOdelu Kukatla1-0/+247
Enable QoS configuration for master ports with predefined priority and urgency forwarding. Signed-off-by: Odelu Kukatla <odelu.kukatla@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://msgid.link/20260311103548.1823044-3-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-17dmaengine: sh: rz-dmac: Add device_{pause,resume}() callbacksClaudiu Beznea1-3/+46
The RZ/G2L SCIFA driver uses dmaengine_prep_slave_sg() to enqueue DMA transfers and implements a timeout mechanism on RX to handle cases where a DMA transfer does not complete. The timeout is implemented using an hrtimer. In the hrtimer callback, dmaengine_tx_status() is called (along with dmaengine_pause()) to retrieve the transfer residue and handle incomplete DMA transfers. Add support for device_{pause, resume}() callbacks. Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://patch.msgid.link/20260316133252.240348-9-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17dmaengine: sh: rz-dmac: Add device_tx_status() callbackBiju Das1-1/+143
The RZ/G2L SCIFA driver uses dmaengine_prep_slave_sg() to enqueue DMA transfers and implements a timeout mechanism on RX to handle cases where a DMA transfer does not complete. The timeout is implemented using an hrtimer. In the hrtimer callback, dmaengine_tx_status() is called (along with dmaengine_pause()) to retrieve the transfer residue and handle incomplete DMA transfers. Add support for the device_tx_status() callback. Co-developed-by: Long Luu <long.luu.ur@renesas.com> Signed-off-by: Long Luu <long.luu.ur@renesas.com> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Co-developed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260316133252.240348-8-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17dmaengine: sh: rz-dmac: Use rz_lmdesc_setup() to invalidate descriptorsJohn Madieu1-8/+2
rz_lmdesc_setup() invalidates DMA descriptors more comprehensively. It resets the base, head, and tail pointers of the descriptor list and clears the descriptor headers and their NXLA pointers. Use rz_lmdesc_setup() instead of open-coding parts of its logic. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260316133252.240348-7-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17dmaengine: sh: rz-dmac: Drop unnecessary local_irq_save() callClaudiu Beznea1-5/+0
rz_dmac_enable_hw() calls local_irq_save()/local_irq_restore(), but this is not needed because the callers of rz_dmac_enable_hw() already protect the critical section using spin_lock_irqsave()/spin_lock_irqrestore(). Remove the local_irq_save()/local_irq_restore() calls. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://patch.msgid.link/20260316133252.240348-6-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17dmaengine: sh: rz-dmac: Drop goto instruction and labelClaudiu Beznea1-3/+1
There is no need to jump to the done label, so return immediately. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://patch.msgid.link/20260316133252.240348-5-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17dmaengine: sh: rz-dmac: Drop read of CHCTRL registerClaudiu Beznea1-3/+6
The CHCTRL register has 11 bits that can be updated by software. The documentation for all these bits states the following: - A read operation results in 0 being read - Writing zero does not affect the operation All bits in the CHCTRL register accessible by software are set and clear bits. The documentation for the CLREND bit of CHCTRL states: Setting this bit to 1 can clear the END bit of the CHSTAT_n/nS register. Also, the DMA transfer end interrupt is cleared. An attempt to read this bit results in 0 being read. 1: Clears the END bit. 0: Does not affect the operation. Since writing zero to any bit in this register does not affect controller operation and reads always return zero, there is no need to perform read-modify-write accesses to set the CLREND bit. Drop the read of the CHCTRL register. Also, since setting the CLREND bit does not interact with other functionalities exposed through this register and only clears the END interrupt, there is no need to lock around this operation. Add a comment to document this. Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://patch.msgid.link/20260316133252.240348-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17Merge branch 'fixes' into nextVinod Koul13-78/+137
This brings in the rz-dmac fixes which are in fixes
2026-03-17dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlockClaudiu Beznea1-5/+4
Both rz_dmac_disable_hw() and rz_dmac_irq_handle_channel() update the CHCTRL register. To avoid concurrency issues when configuring functionalities exposed by this registers, take the virtual channel lock. All other CHCTRL updates were already protected by the same lock. Previously, rz_dmac_disable_hw() disabled and re-enabled local IRQs, before accessing CHCTRL registers but this does not ensure race-free access. Remove the local IRQ disable/enable code as well. Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Cc: stable@vger.kernel.org Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://patch.msgid.link/20260316133252.240348-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17dmaengine: sh: rz-dmac: Protect the driver specific listsClaudiu Beznea1-25/+32
The driver lists (ld_free, ld_queue) are used in rz_dmac_free_chan_resources(), rz_dmac_terminate_all(), rz_dmac_issue_pending(), and rz_dmac_irq_handler_thread(), all under the virtual channel lock. Take the same lock in rz_dmac_prep_slave_sg() and rz_dmac_prep_dma_memcpy() as well to avoid concurrency issues, since these functions also check whether the lists are empty and update or remove list entries. Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://patch.msgid.link/20260316133252.240348-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17HID: multitouch: Check to ensure report responses match the requestLee Jones1-0/+7
It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes. Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early. Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-03-17irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe()Felix Gu1-0/+1
When riscv_acpi_get_gsi_info() fails, the mailbox channel previously requested via mbox_request_channel() is not freed. Add the missing mbox_free_channel() call to prevent the resource leak. Fixes: 4752b0cfbc37 ("irqchip/riscv-rpmi-sysmsi: Add ACPI support") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org Reviewed-by: Rahul Pathak <rahul@summations.net> Link: https://patch.msgid.link/20260315-sysmsi-v1-1-5f090c86c2ca@gmail.com
2026-03-17ovpn: consolidate crypto allocations in one chunkRalf Lici3-46/+135
Currently ovpn uses three separate dynamically allocated structures to set up cryptographic operations for both encryption and decryption. This adds overhead to performance-critical paths and contribute to memory fragmentation. This commit consolidates those allocations into a single temporary blob, similar to what esp_alloc_tmp() does. The resulting performance gain is +7.7% and +4.3% for UDP when using AES and ChaChaPoly respectively, and +4.3% for TCP. Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
2026-03-17ovpn: add support for asymmetric peer IDsRalf Lici6-10/+33
In order to support the multipeer architecture, upon connection setup each side of a tunnel advertises a unique ID that the other side must include in packets sent to them. Therefore when transmitting a packet, a peer inserts the recipient's advertised ID for that specific tunnel into the peer ID field. When receiving a packet, a peer expects to find its own unique receive ID for that specific tunnel in the peer ID field. Add support for the TX peer ID and embed it into transmitting packets. If no TX peer ID is specified, fallback to using the same peer ID both for RX and TX in order to be compatible with the non-multipeer compliant peers. Cc: horms@kernel.org Cc: donald.hunter@gmail.com Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
2026-03-17ovpn: notify userspace on client float eventRalf Lici3-0/+86
Send a netlink notification when a client updates its remote UDP endpoint. The notification includes the new IP address, port, and scope ID (for IPv6). Cc: linux-kselftest@vger.kernel.org Cc: horms@kernel.org Cc: shuah@kernel.org Cc: donald.hunter@gmail.com Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
2026-03-17ovpn: pktid: use bitops.h APIQingfang Deng2-8/+5
Use bitops.h for replay window to simplify code. Signed-off-by: Qingfang Deng <dqfext@gmail.com> [antonio@openvpn.net: extended commit message] Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
2026-03-17ovpn: use correct array size to parse nested attributes in ovpn_nl_key_swap_doitSabrina Dubroca1-1/+1
In ovpn_nl_key_swap_doit, the attributes array used to parse the OVPN_A_KEYCONF uses OVPN_A_PEER_MAX instead of OVPN_A_KEYCONF_MAX. Note that this does not cause any bug, since currently OVPN_A_KEYCONF_MAX < OVPN_A_PEER_MAX. The wrong constant was introduced by commit 203e2bf55990 ("ovpn: implement key add/get/del/swap via netlink") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-03-17bus: mhi: ep: Test for non-zero return value where applicableManivannan Sadhasivam2-8/+8
Instead of testing for negative error code, just test for non-zero return for cases where there is no positive return value. This helps to maintain code uniformity. No functional change. Reported-by: Bjorn Helgaas <helgaas@kernel.org> Closes: https://lore.kernel.org/linux-pci/20260227191510.GA3904799@bhelgaas Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20260302055021.8616-1-manivannan.sadhasivam@oss.qualcomm.com
2026-03-17bus: mhi: host: Use kzalloc_flexRosen Penev1-19/+3
Change kzalloc + kzalloc to just kzalloc with a flexible array member. Add __counted_by for extra runtime analysis when requested. Move counting assignment immediately after allocation as required by __counted_by. Move mhi_buf definition as a complete definition as needed for flex arrays. It's not a pointer anymore. Signed-off-by: Rosen Penev <rosenp@gmail.com> [mani: squashed https://lore.kernel.org/mhi/20260317-mhi-invalid-free-mhi-buffers-v1-1-8418a3ad604f@oss.qualcomm.com] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20260312045921.7663-1-rosenp@gmail.com
2026-03-17ppp: remove pch->chan NULL checks from tx pathQingfang Deng1-47/+21
Now that ppp_disconnect_channel() is called before pch->chan is set to NULL, a channel from ppp->channels list on the transmit path is guaranteed to have non-NULL pch->chan. Remove the pch->chan NULL checks from ppp_push(), ppp_mp_explode(), and ppp_fill_forward_path(), where a channel is obtained from the list. Remove the corresponding WRITE/READ_ONCE annotations as they no longer race. Signed-off-by: Qingfang Deng <dqfext@gmail.com> Link: https://patch.msgid.link/20260312093732.277254-2-dqfext@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17ppp: disconnect channel before nullifying pch->chanQingfang Deng1-1/+1
In ppp_unregister_channel(), pch->chan is set to NULL before calling ppp_disconnect_channel(), which removes the channel from ppp->channels list using list_del_rcu() + synchronize_net(). This creates an intermediate state where the channel is still connected (on the list) but already unregistered (pch->chan == NULL). Call ppp_disconnect_channel() before setting pch->chan to NULL. After the synchronize_net(), no new reader on the transmit path will hold a reference to the channel from the list. This eliminates the problematic state, and prepares for removing the pch->chan NULL checks from the transmit path in a subsequent patch. Signed-off-by: Qingfang Deng <dqfext@gmail.com> Link: https://patch.msgid.link/20260312093732.277254-1-dqfext@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17soundwire: intel_auxdevice: Add cs42l49 to wake_capable_listCharles Keepax1-0/+1
The Cirrus Logic cs42l49 codec can generate Jack events so add it to the wake-capable list. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260313155428.1934196-1-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17media: em28xx: remove tuner type from Hauppauge DVB DualHDBradford Love1-6/+1
This reverts a patch which was perhaps inadvertently added. This was changed during the 5.15-rc4 merge. The faulty commit appears lost in the pull request somehow, I cannot find it to check the explanation. commit c52e7b855b33 ("Merge tag 'v5.15-rc4' into media_tree") There was nothing wrong with this device and no reason to moodify the board profile. The DVB capabilities are added via dvb_module_probe. Additionally, the device contains *zero* analog inputs, so I'm not sure why one was added. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: em28xx: Add a variety of DualHD usb idBradford Love1-0/+12
Include possible vid:pid combination of DualHD models that are in the wild. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: au0828: Add new Hauppauge HVR1265 and ImpactVCB-eBradford Love5-0/+55
New HVR1265 and ImpactVCB-e devices are PCIe baords with USB controller and essentially embedded Hauppauge 950Q. HVR1265 - digital+analog TV, S-Video, and audio inputs ImpactVCB-e - Composite, S-Video, and audio inputs This also fixes AU8522_COMPOSITE_CH4, which was missing from video routing. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: saa7164: Fix REV2 firmware filenameBradford Love1-2/+2
The wrong firmware file is listed, leading to non functional devices on REV2 models. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: si2168: fw 4.0-11 loses warm state during sleepBradford Love1-2/+2
Ignoring version 4.0-11 firmware leads to non functional devices after sleep on all Hauppauge DVB devices containing the si2168 and firmware version 4.0-11. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: si2168: Fix i2c command timeout on embedded platformsBradford Love1-1/+3
On many embedded platforms i2c responses through USB are not returned as quickly, plus constantly banging on the i2c master receive essentially deadlocks the driver. Inserting a 3ms delay between i2c receive calls and extending the timeout fixes all tested platforms. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: cx231xx: Fix AGC levels for NTSC-MBradford Love1-4/+3
Windows uses the implemented command sequence to set AGC for NTSC-M. The previous Linux values work, mostly, but on some embedded platforms NTSC-M is very unstable. The Windows default values completely fix any signal stability issues and produce a clear image. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: xc5000: Add rf strength functionBradford Love1-1/+11
Without a rf strength function implemented, analog lock cannot be detected by standardized command line tools. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: cx25840: Fix NTSC-J, PAL-N, and SECAM standardsBradford Love1-2/+27
Formats did not correctly decode prior. Modifications are based off cx25840 datasheet. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: si2157: Analog format fixesBradford Love1-4/+11
Updates to support PAL-N and PAL-Nc Verifies PAL-I and PAL-DK standards are working Fixes and verifies SECAM-L now works Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: vimc: streamer: Apply sensor frame rate in streamer threadFaizel K B1-2/+31
Use the sensor's pre-calculated jiffies value to add appropriate delay between frames according to the configured timing value. The actual frame rate will vary depending on processing delays in other media pipeline components. Tested using yavta frame rate display with QCIF resolution: yavta <video-node> --capture=<no_of_frames> Signed-off-by: Faizel K B <faizel.kb@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: vimc: sensor: Add pixel_rate,vblank and hblank configurationFaizel K B2-0/+101
pixel_rate and hblank as read only parameter. vblank can be configured to match the desired frame rate. Default values are, pixel_rate - 160 MHz, hblank - 800. vblank defaults to an equivalent value of 30 fps for resolutions less than or equal to 1920x1080 and 10 fps for higher resolutions. For higher resolutions, modify pixel_rate in the driver code. fps = pixel_rate / ((width + hblank) * (height + vblank)) minimum vblank - 4, maximum vblank - 65535 The configured fps delay is pre-calculated into jiffies and stored in the sensor's hw structure for efficient access by the streamer thread. Signed-off-by: Faizel K B <faizel.kb@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: vimc: sensor: Move vimc_sensor_device to common headerFaizel K B2-26/+28
Move the vimc_sensor_device structure from vimc-sensor.c to vimc-common.h to make it accessible to the vimc-streamer component. Signed-off-by: Faizel K B <faizel.kb@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17staging: media: av7110: replace BUG() with error return in gpioirqArtem Lytkin1-1/+1
Replace BUG() with a return statement in the gpioirq tasklet handler. If saa7146_wait_for_debi_done() times out, crashing the kernel is disproportionate. The pr_err() already logs the failure, and returning early avoids accessing hardware in a potentially broken state. Signed-off-by: Artem Lytkin <iprintercanon@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: as102: fix to not free memory after the device is registered in ↵Jeongjun Park1-0/+2
as102_usb_probe() In as102_usb driver, the following race condition occurs: ``` CPU0 CPU1 as102_usb_probe() kzalloc(); // alloc as102_dev_t .... usb_register_dev(); fd = sys_open("/path/to/dev"); // open as102 fd .... usb_deregister_dev(); .... kfree(); // free as102_dev_t .... sys_close(fd); as102_release() // UAF!! as102_usb_release() kfree(); // DFB!! ``` When a USB character device registered with usb_register_dev() is later unregistered (via usb_deregister_dev() or disconnect), the device node is removed so new open() calls fail. However, file descriptors that are already open do not go away immediately: they remain valid until the last reference is dropped and the driver's .release() is invoked. In as102, as102_usb_probe() calls usb_register_dev() and then, on an error path, does usb_deregister_dev() and frees as102_dev_t right away. If userspace raced a successful open() before the deregistration, that open FD will later hit as102_release() --> as102_usb_release() and access or free as102_dev_t again, occur a race to use-after-free and double-free vuln. The fix is to never kfree(as102_dev_t) directly once usb_register_dev() has succeeded. After deregistration, defer freeing memory to .release(). In other words, let release() perform the last kfree when the final open FD is closed. Cc: <stable@vger.kernel.org> Reported-by: syzbot+47321e8fd5a4c84088db@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=47321e8fd5a4c84088db Fixes: cd19f7d3e39b ("[media] as102: fix leaks at failure paths in as102_usb_probe()") Signed-off-by: Jeongjun Park <aha310510@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17media: hackrf: fix to not free memory after the device is registered in ↵Jeongjun Park1-3/+4
hackrf_probe() In hackrf driver, the following race condition occurs: ``` CPU0 CPU1 hackrf_probe() kzalloc(); // alloc hackrf_dev .... v4l2_device_register(); .... fd = sys_open("/path/to/dev"); // open hackrf fd .... v4l2_device_unregister(); .... kfree(); // free hackrf_dev .... sys_ioctl(fd, ...); v4l2_ioctl(); video_is_registered() // UAF!! .... sys_close(fd); v4l2_release() // UAF!! hackrf_video_release() kfree(); // DFB!! ``` When a V4L2 or video device is unregistered, the device node is removed so new open() calls are blocked. However, file descriptors that are already open-and any in-flight I/O-do not terminate immediately; they remain valid until the last reference is dropped and the driver's release() is invoked. Therefore, freeing device memory on the error path after hackrf_probe() has registered dev it will lead to a race to use-after-free vuln, since those already-open handles haven't been released yet. And since release() free memory too, race to use-after-free and double-free vuln occur. To prevent this, if device is registered from probe(), it should be modified to free memory only through release() rather than calling kfree() directly. Cc: <stable@vger.kernel.org> Reported-by: syzbot+6ffd76b5405c006a46b7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6ffd76b5405c006a46b7 Reported-by: syzbot+f1b20958f93d2d250727@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f1b20958f93d2d250727 Fixes: 8bc4a9ed8504 ("[media] hackrf: add support for transmitter") Signed-off-by: Jeongjun Park <aha310510@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17net: dsa: mv88e6xxx: Add partial support for TCAM entriesCedric Jehasse9-2/+682
This patch adds partial Ternary Content Addressable Memory (TCAM) for the mv88e6390 and mv88e6393 family of switches. TCAM entries allow the switch to match the first 48 or 96 bytes of a frame and take actions on matched frames. This patch introduces a subset of the available TCAM functionality. Matching on ip addresses/protocol and trapping to the cpu. Eg. to trap traffic with destination ip 224.0.1.129 to the cpu: tc qdisc add dev p1 clsact tc filter add dev p1 ingress protocol ip flower skip_sw \ dst_ip 224.0.1.129 action trap Signed-off-by: Cedric Jehasse <cedric.jehasse@luminex.be> Link: https://patch.msgid.link/20260311-net-next-mv88e6xxx-tcam-v8-2-32dd5ba30002@luminex.be Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17mtd: cmdlinepart: use a flexible array memberRosen Penev1-2/+1
This is already allocated properly. It's just using an extra pointer. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-17drm/i915/gvt: Swap read and write checksJonathan Cavitt1-10/+8
The function intel_gvt_i2c_handle_aux_ch_write currently does not support the DP_AUX_I2C_WRITE operation. Notably, we check if op & 0x1 == DP_AUX_I2C_WRITE (one), and if it does not, assert that op & 0x1 == DP_AUX_I2C_READ (zero). This is unnecessary because if op & 0x1 != 1, then op & 0x1 == 0. But beyond that, it probably makes more sense to check for the condition that is implemented, rather than check for the condition that is not. Swap the conditions. We can also get rid of the unnecessary drm_WARN_ON while we're here. Suggested-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260204161945.8127-2-jonathan.cavitt@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17drm/i915/display: PORT_NONE is not validJonathan Cavitt1-1/+2
Static analysis issue: In assert_port_valid, add a check to ensure port != PORT_NONE, as that is not a valid port. The check must be explicit to prevent a bad bit shift operation in the general case via short-circuiting. It's not likely this will ever come up in a real use case, but it's at least worth guarding against. It would probably also be pertinent to modify the behavior of the port_name function to correctly print PORT_NONE in this case, as currently the port would be reported as 'port @' by the debugger. But that should be done separately, and given port_name is mostly just a debug printing helper function anyways, fixing it is a low priority. v2: - Conditional check was backwards. Fix it. (Jani) Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260123152121.7042-2-jonathan.cavitt@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_stateJouni Högander2-2/+4
PSR entry_setup_frames is currently computed directly into struct intel_dp:intel_psr:entry_setup_frames. This causes a problem if mode change gets rejected after PSR compute config: Psr_entry_setup_frames computed for this rejected state is in intel_dp:intel_psr:entry_setup_frame. Fix this by computing it into intel_crtc_state and copy the value into intel_dp:intel_psr:entry_setup_frames on PSR enable. Fixes: 2b981d57e480 ("drm/i915/display: Support PSR entry VSC packet to be transmitted one frame earlier") Cc: Mika Kahola <mika.kahola@intel.com> Cc: <stable@vger.kernel.org> # v6.8+ Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260312083710.1593781-3-jouni.hogander@intel.com (cherry picked from commit 8c229b4aa00262c13787982e998c61c0783285e0) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-17drm/i915/psr: Disable PSR on update_m_n and update_lrrJouni Högander1-0/+2
PSR/PR parameters might change based on update_m_n or update_lrr. Disable on update_m_n and update_lrr to ensure proper parameters are taken into use on next PSR enable in intel_psr_post_plane_update. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15771 Fixes: 2bc98c6f97af ("drm/i915/alpm: Compute ALPM parameters into crtc_state->alpm_state") Cc: <stable@vger.kernel.org> # v6.19+ Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260312083710.1593781-2-jouni.hogander@intel.com (cherry picked from commit 65852b56bfa929f99e28c96fd98b02058959da7f) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-17cpufreq: Add QCS8300 to cpufreq-dt-platdev blocklistFaruque Ansari1-0/+1
The Qualcomm QCS8300 platform uses the qcom-cpufreq-hw driver, so add it to the cpufreq-dt-platdev driver's blocklist. Signed-off-by: Faruque Ansari <faruque.ansari@oss.qualcomm.com> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-03-17Merge tag 'v7.0-rockchip-drvfixes1' of ↵Krzysztof Kozlowski1-0/+1
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Fixing a missing of_node_put() call. * tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: soc: rockchip: grf: Add missing of_node_put() when returning Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-03-17firmware: arm_scmi: Support loop control in quirk code snippetsGeert Uytterhoeven1-4/+4
Each SCMI firmware quirk contains a code snippet, which handles the quirk, and has full access to the surrounding context. When this context is (part of) a loop body, the code snippet may want to use loop control statements like "break" and "continue". Unfortunately the SCMI_QUIRK() macro implementation contains a dummy loop, taking precedence over any outer loops. Hence quirk code cannot use loop control statements, but has to resort to polluting the surrounding context with a label, and use goto. Fix this by replacing the "do { ... } while (0)" construct in the SCMI_QUIRK() implementation by "({ ... })". Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Message-Id: <51de914cddef8fa86c2e7dd5397e5df759c45464.1773675224.git.geert+renesas@glider.be> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-03-17Merge tag 'drm-intel-next-2026-03-16' of ↵Dave Airlie209-3825/+5045
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next [airlied: fixed conflict with xe tree] drm/i915 feature pull for v7.1: Features and functionality: - C10/C20/LT PHY PLL divider verification (Mika) - Use trans push mechanism to generate PSR frame change event on LNL+ (Jouni) - Account for DSC bubble overhead for horizontal slices (Ankit, Chaitanya) Refactoring and cleanups: - Refactor DP DSC slice config computation (Imre) - Use GVT versions of register helper macros for GVT MMIO table (Ankit) - C10/C20/LT PHY PLL computation refactoring (Mika) - VGA decode refactoring and related fixes/cleanups (Ville) - Move DSB buffer buffer implementation to display parent interface (Jani) - Move error interrupt capture to display irq snapshot (Jani) - Move pcode calls to display parent interface (Jani) - Reduce GVT dependency on display headers (Jani) - Compute config and mode valid refactoring for DSC (Ankit) - Stop using i915 core register headers in display (Uma) - Refactor DPT, move i915 parts to display parent interface (Jani) - Refactor gen2-4 overlay, move to display parent interface (Ville) - Refactor masked field register macro helpers, move to shared headers (Jani) - Convert a number of workaround checks to the new workaround framework (Luca) - Refactor and move frontbuffer calls to display parent interface (Jani) - Add VMA calls to display parent interface (Jani) - Refactor stolen memory allocation decisions (Vinod, Ville) - Clean up and unify workqueue usage (Marco Crivellari) - Preparation for UHBR DP tunnels (Imre) - Allow DSC passthrough modes during DP MST mode validation (Imre) - Move framebuffer bo interface to display parent interface (Jani) Fixes: - Plenty of DP SST HPD IRQ handling fixes (Imre) - DP AUX backlight and luminance control fixes (Suraj) - Respect VBT pipe joiner disable for eDP (Ankit) - Do not use CASF with joiner (Nemesa) - Clear C10/C20 PHY response read and error bit to avoid PHY hangs (Suraj) - Xe3p_LPD DMG clock gating, CDCLK, port sync workarounds (Suraj, Gustavo, Mitul) - Fix GVT error path (Michał) - Handle errors on DP DSC receiver cap reads (Suraj) - DSS clock gating workaround on MTL+ to avoid DSC corruption (Mika) - Skip state verification for LT PHY in TBT mode (Suraj) - Fix NULL pointer dereference on suspend when uc firmware not loaded (Rahul Bukte) - Fix an unlikely DMC state related NULL pointer dereference at probe (Imre) - Handle error returns from vga_get_uninterruptible() (Simon Richter) - Increase C10/C20/LT PHY timeouts to include SOC/OS turnaround (Arun) - Fix BIOS FB vs. stolen memory size check (Ville) - Fix LOBF to use computed guardband and set context latency (Ankit) - Handle modeset WW mutex lock failures due to contention properly (Imre) - Fix pipe BPP clamping due to HDR (Imre) - Fix stale state usage in DSC state computation (Imre) - Take HDCP 1.4 vs 2.x into account during link check (Suraj) - Fix forced link retrain handling in MST HPD IRQ handler (Imre) - Remove redundant warning on vcpi < 0 (Jonathan) Core changes: - iopoll: fix function parameter names in read_poll_timeout_atomic() (Randy Dunlap) Merges: - Backmerge drm-next for v7.0-rc1 (Jani) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/b14bb0f297b1750816cf5f342bde608e435655fa@intel.com
generated by cgit v1.2.3 (git 2.39.0) at 2026-06-06 09:47:31 +0300