aboutsummaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-01-16Merge tag 'sound-6.19-rc6' of ↵Linus Torvalds1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became a bit larger than wished for, often seen as a bump at the middle, but almost all changes are small device-specific fixes, so the risk must be pretty low. - SoundWire fix for missing symbol export - Fixes for device-tree bindings - A fix for OOB access in USB-audio, spotted by fuzzer - Quirks for HD-audio, SoundWire, AMD ACP - A series of ASoC tlv320 and wsa codec fixes - Other misc fixes in PCM OSS error-handling, Cirrus scodec test, ASoC ops endianess, davinci, simple-card, and tegra" * tag 'sound-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (33 commits) ALSA: hda/tas2781: Add newly-released HP laptop ASoC: rt5640: Fix duplicate clock properties in DT binding ALSA: hda/realtek: Add quirk for HP Pavilion x360 to enable mute LED ASoC: tlv320adcx140: fix word length ASoC: tlv320adcx140: Propagate error codes during probe ASoC: tlv320adcx140: fix null pointer ASoC: tlv320adcx140: invert DRE_ENABLE ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type ASoC: sdw_utils: Call init callbacks on the correct codec DAI soundwire: Add missing EXPORT for sdw_slave_type ALSA: usb-audio: Prevent excessive number of frames ALSA: hda/cirrus_scodec_test: Fix test suite name ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip ALSA: hda/realtek: Add quirk for Asus Zephyrus G14 2025 using CS35L56, fix speakers ASoC: amd: yc: Fix microphone on ASUS M6500RE ASoC: tegra: Revert fix for uninitialized flat cache warning in tegra210_ahub ASoC: dt-bindings: rockchip-spdif: Allow "port" node ASoC: dt-bindings: realtek,rt5640: Allow 7 for realtek,jack-detect-source ASoC: dt-bindings: realtek,rt5640: Add missing properties/node ASoC: dt-bindings: realtek,rt5640: Document port node ...
2026-01-16iio: adc: ad9467: include two's complement in default modeTomas Melin1-8/+25
All supported drivers currently implicitly use two's complement mode. Make this clear by declaring two's complement in the default output mode. Calibration mode uses offset binary, so change the output mode only when running the calibration or other test mode. Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Tomas Melin <tomas.melin@vaisala.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16Merge tag 'amd-drm-fixes-6.19-2026-01-15' of ↵Simona Vetter18-50/+116
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-15: amdgpu: - GC 9 PTE mtype fix - Non-DC display kernel panic helper fix - Merge fix - GART vram access fix - Userq fixes - PSR debugging fix - HDMI fixes - Backlight fix - SMU 14 fix - TLB flush fixes amdkfd: - KFD node cleanup for eGPU disconnect - Memory leak fix - MES evict process fix Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260115205405.1890089-1-alexander.deucher@amd.com
2026-01-16clk: tegra: tegra124-emc: Fix potential memory leak in ↵Haoxiang Li1-1/+3
tegra124_clk_register_emc() If clk_register() fails, call kfree to release "tegra". Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-01-16Merge tag 'gpio-fixes-for-v6.19-rc6' of ↵Linus Torvalds2-3/+18
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Two more GPIO fixes addressing an issue uncovered by the shared GPIO management changes in v6.19: - implement the missing .get_direction() callback for gpio-davinci - remove redundant check in GPIO core which can also propagate an invalid errno to user-space" * tag 'gpio-fixes-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: remove redundant callback check gpio: davinci: implement .get_direction()
2026-01-16iio: pressure: mprls0025pa: add copyright linePetre Rodan1-0/+1
Add copyright line to the core driver. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: change measurement sequencePetre Rodan1-29/+3
Implement a measurement sequence that does not involve a one byte read of the status byte before reading the conversion. The sensor's conversions should be read either once the EoC interrupt has triggered or 5ms after the 0xaa command. See Options 1 and 2 respectively in Tables 16 (page 15) and 18 (page 18) of the datasheet. Note that Honeywell's example code also covered in the datasheet follows Option 2 for both i2c and SPI. The datasheet does not specify any of the retry parameters that are currently implemented in the driver. A simple 5+ms sleep as specified in Option 2 is enough for a valid measurement sequence. The change also gets rid of the code duplication tied to the verification of the status byte. This change only affects users that do not define the EoC interrupt in the device tree. Datasheet: https://prod-edam.honeywell.com/content/dam/honeywell-edam/sps/siot/en-us/products/sensors/pressure-sensors/board-mount-pressure-sensors/micropressure-mpr-series/documents/sps-siot-mpr-series-datasheet-32332628-ciid-172626.pdf?download=false Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: stricter checks for the status bytePetre Rodan1-6/+22
Make sure a valid conversion comes with a status byte that only has the MPR_ST_POWER bit set. Return -EBUSY if also MPR_ST_BUSY is set or -EIO otherwise. Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: move memset to corePetre Rodan2-1/+2
Move memset() from the bus specific code into core. Zeroing out the buffer is performed because the sensor has noticeable latch-up sensitivity and in some cases it clamps the MISO signal to GND in sync with SCLK [1]. A raw conversion of zero is out of bounds since valid values have to be between output_min and output_max (and the smallest output_min is 2.5% of 2^24 = 419430). The user is expected to discard out of bounds pressure values. Given the fact that we can't follow the behaviour of all SPI controllers when faced to this clamping of an output signal, a raw conversion of zero is used as an early warning in case the low level SPI API reacts unexpectedly. Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1588325/am3358-spi-tx-data-corruption [1] Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: introduce tx bufferPetre Rodan4-35/+6
Use a tx_buf that is part of the priv struct for transferring data to the sensor instead of relying on a devm_kzalloc()-ed array. Remove the .init operation in the process. Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: rename buffer variablePetre Rodan4-10/+10
For the reason of better naming consistency rename priv->buffer into priv->rx_buf since tx_buf will get introduced in the next patch. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: remove redundant declarationsPetre Rodan1-3/+0
Remove the iio_chan_spec and iio_dev structs which are already defined in the included iio.h header. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: cleanup includesPetre Rodan2-3/+7
Remove unused headers and add required headers as needed. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix pressure calculationPetre Rodan2-17/+11
A sign change is needed for proper calculation of the pressure. This is a minor fix since it only affects users that might have custom silicon from Honeywell that has honeywell,pmin-pascal != 0. Also due to the fact that raw pressure values can not be lower than output_min (400k-3.3M) there is no need to calculate a decimal for the offset. Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor") Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix scan_type structPetre Rodan1-2/+2
Fix the scan_type sign and realbits assignment. The pressure is a 24bit unsigned int between output_min and output_max. transfer function A: 10% to 90% of 2^24 transfer function B: 2.5% to 22.5% of 2^24 transfer function C: 20% to 80% of 2^24 [MPR_FUNCTION_A] = { .output_min = 1677722, .output_max = 15099494 } [MPR_FUNCTION_B] = { .output_min = 419430, .output_max = 3774874 } [MPR_FUNCTION_C] = { .output_min = 3355443, .output_max = 13421773 } Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor") Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix interrupt flagPetre Rodan1-4/+2
Interrupt falling/rising flags should only be defined in the device tree. Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor") Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix SPI CS delay violationPetre Rodan1-5/+14
Based on the sensor datasheet in chapter 7.6 SPI timing, Table 20, during the SPI transfer there is a minimum time interval requirement between the CS being asserted and the first clock edge (tHDSS). This minimum interval of 2.5us is being violated if two consecutive SPI transfers are queued up. Fixes: a0858f0cd28e ("iio: pressure: mprls0025pa add SPI driver") Datasheet: https://prod-edam.honeywell.com/content/dam/honeywell-edam/sps/siot/en-us/products/sensors/pressure-sensors/board-mount-pressure-sensors/micropressure-mpr-series/documents/sps-siot-mpr-series-datasheet-32332628-ciid-172626.pdf?download=false Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix spi_transfer struct initialisationPetre Rodan1-1/+1
Make sure that the spi_transfer struct is zeroed out before use. Fixes: a0858f0cd28e ("iio: pressure: mprls0025pa add SPI driver") Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on ↵Marc Kleine-Budde1-0/+7
usb_submit_urb() error In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup. However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty. To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message. Fixes: 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak") Reported-by: Jakub Kicinski <kuba@kernel.org> Closes: https://lore.kernel.org/all/20260110223836.3890248-1-kuba@kernel.org/ Link: https://patch.msgid.link/20260116-can_usb-fix-reanchor-v1-1-9d74e7289225@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: dev: alloc_candev_mqs(): add missing default CAN capabilitiesMarc Kleine-Budde1-0/+1
The idea behind series 6c1f5146b214 ("Merge patch series "can: raw: better approach to instantly reject unsupported CAN frames"") is to set the capabilities of a CAN device (CAN-CC, CAN-FD, CAN-XL, and listen only) [1] and, based on these capabilities, reject unsupported CAN frames in the CAN-RAW protocol [2]. This works perfectly for CAN devices configured in CAN-FD or CAN-XL mode. CAN devices with static CAN control modes define their capabilities via can_set_static_ctrlmode() -> can_set_cap_info(). CAN devices configured by the user space for CAN-FD or CAN-XL set their capabilities via can_changelink() -> can_ctrlmode_changelink() -> can_set_cap_info(). However, in commit 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv"), the capabilities of CAN devices are not initialized. This results in CAN-RAW rejecting all CAN frames on devices directly after ifup if the user space has not changed the CAN control mode. Fix this problem by setting the default capabilities to CAN-CC in alloc_candev_mqs() as soon as the CAN specific ml_priv is allocated. [1] commit 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv") [2] commit faba5860fcf9 ("can: raw: instantly reject disabled CAN frames") Fixes: 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv") Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Tested-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260116-can_add_missing_set_caps-v1-1-7525126d8b20@pengutronix.de [mkl: fix typo in subject] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16openrisc: Fix IPIs on simple multicore systemsStafford Horne2-5/+37
Commit c05671846451 ("openrisc: sleep instead of spin on secondary wait") fixed OpenRISC SMP Linux for QEMU. However, stability was never achieved on FPGA development boards. This is because the above patch has a step to unmask IPIs on non-boot cpu's but on hardware without power management, IPIs remain masked. This meant that IPI's were never actually working on the simple SMP systems we run on development boards. The systems booted but stability was very suspect. Add the ability to unmask IPI's on the non-boot cores. This is done by making the OMPIC IRQs proper percpu IRQs. We can then use the enabled_percpu_irq() to unmask IRQ on the non-boot cpus. Update the or1k PIC driver to use a flow handler that can switch between percpu and the configured level or edge flow handlers at runtime. This mechanism is inspired by that done in the J-Core AIC driver. Signed-off-by: Stafford Horne <shorne@gmail.com> Acked-by: Thomas Gleixner <tglx@kernel.org>
2026-01-16dax/hmem, e820, resource: Defer Soft Reserved insertion until hmem is readyDan Williams2-4/+4
Insert Soft Reserved memory into a dedicated soft_reserve_resource tree instead of the iomem_resource tree at boot. Delay publishing these ranges into the iomem hierarchy until ownership is resolved and the HMEM path is ready to consume them. Publishing Soft Reserved ranges into iomem too early conflicts with CXL hotplug and prevents region assembly when those ranges overlap CXL windows. Follow up patches will reinsert Soft Reserved ranges into iomem after CXL window publication is complete and HMEM is ready to claim the memory. This provides a cleaner handoff between EFI-defined memory ranges and CXL resource management without trimming or deleting resources later. In the meantime "Soft Reserved" resources will no longer appear in /proc/iomem, only their results. I.e. with "memmap=4G%4G+0xefffffff" Before: 100000000-1ffffffff : Soft Reserved 100000000-1ffffffff : dax1.0 100000000-1ffffffff : System RAM (kmem) After: 100000000-1ffffffff : dax1.0 100000000-1ffffffff : System RAM (kmem) The expectation is that this does not lead to a user visible regression because the dax1.0 device is created in both instances. Co-developed-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com> [Smita: incorporate feedback from x86 maintainer review] Signed-off-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com> Link: https://patch.msgid.link/20251120031925.87762-2-Smita.KoralahalliChannabasappa@amd.com [djbw: cleanups and clarifications] Link: https://lore.kernel.org/69443f707b025_1cee10022@dwillia2-mobl4.notmuch Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-01-16driver core: attribute_container: change return type to voidDaniel Gomez3-10/+4
attribute_container_register() has always returned 0 since its introduction in commit 06ff5a987e ("Add attribute container to generic device model") in the historical Linux tree [1]. Convert the return type to void and update all callers. This removes dead code where callers checked for errors that could never occur. Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git [1] Signed-off-by: Daniel Gomez <da.gomez@samsung.com> Link: https://patch.msgid.link/20251220-dev-attribute-container-linux-scsi-v1-1-d58fcd03bf21@samsung.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16devtmpfs: Replace simple_strtoul with kstrtoint in mount_paramThorsten Blum1-2/+1
Replace simple_strtoul() with the recommended kstrtoint() for parsing the 'devtmpfs.mount=' boot parameter. Unlike simple_strtoul(), which returns an unsigned long, kstrtoint() converts the string directly to int and avoids implicit casting. Check the return value of kstrtoint() and reject invalid values. This adds error handling while preserving behavior for existing values, and removes use of the deprecated simple_strtoul() helper. The current code silently sets 'mount_dev = 0' if parsing fails, instead of leaving the default value (IS_ENABLED(CONFIG_DEVTMPFS_MOUNT)) unchanged. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20251220125930.76836-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16devtmpfs: make 'devtmpfs_context_ops' staticBen Dooks1-1/+1
The 'devtmpfs_context_ops' object is not exported outside the devtmpfs.c file nor defined anywhere for use outside. Make this static to remove the following sparse warning: drivers/base/devtmpfs.c:88:30: warning: symbol 'devtmpfs_context_ops' was not declared. Should it be static? Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Link: https://patch.msgid.link/20260116150745.1330145-1-ben.dooks@codethink.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: dmm32at: serialize use of paged registersIan Abbott1-2/+30
Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to select the function of registers at offsets 12 to 15: 00 => 8254 timer/counter registers are accessible 01 => 8255 digital I/O registers are accessible 10 => Reserved 11 => Calibration registers are accessible The interrupt service routine (`dmm32at_isr()`) clobbers the bottom two bits of the register with value 00, which would interfere with access to the 8255 registers by the `dm32at_8255_io()` function (used for Comedi instruction handling on the digital I/O subdevice). Make use of the generic Comedi device spin-lock `dev->spinlock` (which is otherwise unused by this driver) to serialize access to the miscellaneous control register and paged registers. Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver") Cc: stable@vger.kernel.org Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260112162835.91688-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mei: trace: treat reg parameter as stringAlexander Usyskin1-9/+9
The commit afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") forbids to emit event with a plain char* without a wrapper. The reg parameter always passed as static string and wrapper is not strictly required, contrary to dev parameter. Use the string wrapper anyway to check sanity of the reg parameters, store it value independently and prevent internal kernel data leaks. Since some code refactoring has taken place, explicit backporting may be needed for kernels older than 6.10. Cc: stable@vger.kernel.org # v6.11+ Fixes: a0a927d06d79 ("mei: me: add io register tracing") Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://patch.msgid.link/20260111145125.1754912-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uio: pci_sva: correct '-ENODEV' check logicHaiyue Wang1-2/+2
The current '-ENODEV' check uses '&&', which can lead to a NULL pointer dereference when udev is NULL. Fix the condition to return -ENODEV if either udev or its pdev is NULL. Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c") Signed-off-by: Haiyue Wang <haiyuewa@163.com> Link: https://patch.msgid.link/20260109175448.34309-1-haiyuewa@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: ensure safe queue release with state managementChenghai Huang1-7/+21
Directly calling `put_queue` carries risks since it cannot guarantee that resources of `uacce_queue` have been fully released beforehand. So adding a `stop_queue` operation for the UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to the final resource release ensures safety. Queue states are defined as follows: - UACCE_Q_ZOMBIE: Initial state - UACCE_Q_INIT: After opening `uacce` - UACCE_Q_STARTED: After `start` is issued via `ioctl` When executing `poweroff -f` in virt while accelerator are still working, `uacce_fops_release` and `uacce_remove` may execute concurrently. This can cause `uacce_put_queue` within `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add state checks to prevent accessing freed pointers. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Yang Shen <shenyang39@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-5-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: implement mremap in uacce_vm_ops to return -EPERMYang Shen1-0/+6
The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users. The reason we need to explicitly disable mremap is that when the driver does not implement .mremap, it uses the default mremap method. This could lead to a risk scenario: An application might first mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). Since the default mremap copies the original vma's vm_private_data (i.e., q) to the new vma, both munmap operations would trigger vma_close, causing q->qfr to be freed twice(qfr will be set to null here, so repeated release is ok). Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Yang Shen <shenyang39@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-4-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: fix isolate sysfs check conditionChenghai Huang1-0/+6
uacce supports the device isolation feature. If the driver implements the isolate_err_threshold_read and isolate_err_threshold_write callback functions, uacce will create sysfs files now. Users can read and configure the isolation policy through sysfs. Currently, sysfs files are created as long as either isolate_err_threshold_read or isolate_err_threshold_write callback functions are present. However, accessing a non-existent callback function may cause the system to crash. Therefore, intercept the creation of sysfs if neither read nor write exists; create sysfs if either is supported, but intercept unsupported operations at the call site. Fixes: e3e289fbc0b5 ("uacce: supports device isolation feature") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-3-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: fix cdev handling in the cleanup pathWenkai Lin1-1/+7
When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-2-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: clean up of_slim_get_device()Johan Hovold1-16/+10
Clean up of_find_slim_device() by folding in the of_find_slim_device() helper. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-7-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix of_slim_get_device() kernel docJohan Hovold1-3/+5
Unlike slim_get_device() the of_slim_get_device() helper does not allocate and register any slimbus devices in case lookup fails. Update the of_slim_get_device() kernel doc to reflect this and add a comment about the helper taking a reference to the returned device. Fixes: e0772de8a48b ("slimbus: core: add of_slim_device_get() helper") Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: amend slim_get_device() kernel docJohan Hovold1-0/+3
Add a comment to clarify that slim_get_device() takes a reference to the embedded struct device of the returned slimbus device. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix device reference leak on report presentJohan Hovold1-0/+3
Slimbus devices can be allocated dynamically upon reception of report-present messages. Make sure to drop the reference taken when looking up already registered devices. Note that this requires taking an extra reference in case the device has not yet been registered and has to be allocated. Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support") Cc: stable@vger.kernel.org # 4.16 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix runtime PM imbalance on report presentJohan Hovold1-7/+9
Make sure to balance the runtime PM usage count in case slimbus device or address allocation fails on report present, which would otherwise prevent the controller from suspending. Fixes: 4b14e62ad3c9 ("slimbus: Add support for 'clock-pause' feature") Cc: stable@vger.kernel.org # 4.16 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix OF node leak on registration failureJohan Hovold1-1/+1
Make sure to drop the OF node reference taken when initialising and registering the slimbus device also on registration failure by releasing it in the destructor as expected. Fixes: 7588a511bdb4 ("slimbus: core: add support to device tree helper") Fixes: 01360857486c ("slimbus: core: Fix mismatch in of_node_get/put") Cc: Saravana Kannan <saravanak@google.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16intel_th: rename error labelJohan Hovold1-4/+4
Use a more a descriptive name for the error label that is used to put the reference to dev. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251208153524.68637-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16intel_th: fix device leak on output open()Johan Hovold1-3/+16
Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open(). Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices") Fixes: 6d5925b667e4 ("intel_th: Fix error handling in intel_th_output_open") Cc: stable@vger.kernel.org # 4.4: 6d5925b667e4 Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Ma Ke <make24@iscas.ac.cn> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251208153524.68637-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: Fix getting range information for subdevices 16 to 255Ian Abbott2-2/+2
The `COMEDI_RANGEINFO` ioctl does not work properly for subdevice indices above 15. Currently, the only in-tree COMEDI drivers that support more than 16 subdevices are the "8255" driver and the "comedi_bond" driver. Making the ioctl work for subdevice indices up to 255 is achievable. It needs minor changes to the handling of the `COMEDI_RANGEINFO` and `COMEDI_CHANINFO` ioctls that should be mostly harmless to user-space, apart from making them less broken. Details follow... The `COMEDI_RANGEINFO` ioctl command gets the list of supported ranges (usually with units of volts or milliamps) for a COMEDI subdevice or channel. (Only some subdevices have per-channel range tables, indicated by the `SDF_RANGETYPE` flag in the subdevice information.) It uses a `range_type` value and a user-space pointer, both supplied by user-space, but the `range_type` value should match what was obtained using the `COMEDI_CHANINFO` ioctl (if the subdevice has per-channel range tables) or `COMEDI_SUBDINFO` ioctl (if the subdevice uses a single range table for all channels). Bits 15 to 0 of the `range_type` value contain the length of the range table, which is the only part that user-space should care about (so it can use a suitably sized buffer to fetch the range table). Bits 23 to 16 store the channel index, which is assumed to be no more than 255 if the subdevice has per-channel range tables, and is set to 0 if the subdevice has a single range table. For `range_type` values produced by the `COMEDI_SUBDINFO` ioctl, bits 31 to 24 contain the subdevice index, which is assumed to be no more than 255. But for `range_type` values produced by the `COMEDI_CHANINFO` ioctl, bits 27 to 24 contain the subdevice index, which is assumed to be no more than 15, and bits 31 to 28 contain the COMEDI device's minor device number for some unknown reason lost in the mists of time. The `COMEDI_RANGEINFO` ioctl extract the length from bits 15 to 0 of the user-supplied `range_type` value, extracts the channel index from bits 23 to 16 (only used if the subdevice has per-channel range tables), extracts the subdevice index from bits 27 to 24, and ignores bits 31 to 28. So for subdevice indices 16 to 255, the `COMEDI_SUBDINFO` or `COMEDI_CHANINFO` ioctl will report a `range_type` value that doesn't work with the `COMEDI_RANGEINFO` ioctl. It will either get the range table for the subdevice index modulo 16, or will fail with `-EINVAL`. To fix this, always use bits 31 to 24 of the `range_type` value to hold the subdevice index (assumed to be no more than 255). This affects the `COMEDI_CHANINFO` and `COMEDI_RANGEINFO` ioctls. There should not be anything in user-space that depends on the old, broken usage, although it may now see different values in bits 31 to 28 of the `range_type` values reported by the `COMEDI_CHANINFO` ioctl for subdevices that have per-channel subdevices. User-space should not be trying to decode bits 31 to 16 of the `range_type` values anyway. Fixes: ed9eccbe8970 ("Staging: add comedi core") Cc: stable@vger.kernel.org #5.17+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251203162438.176841-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mux: mmio: Fix IS_ERR() vs NULL check in probe()Dan Carpenter1-4/+4
The devm_kmalloc() function never returns error pointers, it returns NULL on error. Fix the error checking. Fixes: 4863cb2b0f50 ("mux: mmio: Add suspend and resume support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/aSsIP7oKrhKfCUv3@stanley.mountain Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5msMatthew Schwartz1-1/+1
The existing 1ms delay in sd_power_on is insufficient and causes resume errors around 4% of the time. Increasing the delay to 5ms resolves this issue after testing 300 s2idle cycles. Fixes: 1f311c94aabd ("mmc: rtsx: add 74 Clocks in power on flow") Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260105060236.400366-3-matthew.schwartz@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mmc: rtsx: reset power state on suspendMatthew Schwartz2-0/+31
When rtsx_pci suspends, the card reader hardware powers off but the sdmmc driver's prev_power_state remains as MMC_POWER_ON. This causes sd_power_on to skip reinitialization on the next I/O request, leading to DMA transfer timeouts and errors on resume 20% of the time. Add a power_off slot callback so the PCR can notify the sdmmc driver during suspend. The sdmmc driver resets prev_power_state, and sd_request checks this to reinitialize the card before the next I/O. Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260105060236.400366-2-matthew.schwartz@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mmc: rtsx_pci: add quirk to disable MMC_CAP_AGGRESSIVE_PM for RTS525AMatthew Schwartz2-2/+5
Using MMC_CAP_AGGRESSIVE_PM on RTS525A card readers causes game performance issues when the card reader comes back from idle into active use. This can be observed in Hades II when loading new sections of the game or menu after the card reader puts itself into idle, and presents as a 1-2 second hang. Add EXTRA_CAPS_NO_AGGRESSIVE_PM quirk to allow cardreader drivers to opt-out of aggressive PM, and set it for RTS525A. Closes: https://lore.kernel.org/linux-mmc/ff9a7c20-f465-4afa-bf29-708d4a52974a@linux.dev/ Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260103204226.71752-1-matthew.schwartz@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16stm class: Kconfig: correct symbol nameRandy Dunlap1-2/+2
Drop the leading "CONFIG_" when referring to Kconfig symbols-- it is supplied by the kconfig software. This make the default values work as (apparently) expected. Fixes: a02509f301c6 ("stm class: Factor out default framing protocol") Fixes: d69d5e83110f ("stm class: Add MIPI SyS-T protocol support") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20251228190502.2480758-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16xilinx_hwicap: fifo_icap.c: fix all kernel-doc warningsRandy Dunlap1-8/+19
Modify comments in fifo_icap.c to prevent all kernel-doc warnings: Warning: fifo_icap.c:51 This comment starts with '/**', but isn't a kernel-doc comment. * HwIcap Device Interrupt Status/Enable Registers Warning: fifo_icap.c:106 No description found for return value of 'fifo_icap_fifo_read' Warning: fifo_icap.c:160 No description found for return value of 'fifo_icap_get_status' Warning: fifo_icap.c:171 No description found for return value of 'fifo_icap_busy' Warning: fifo_icap.c:184 No description found for return value of 'fifo_icap_write_fifo_vacancy' Warning: fifo_icap.c:196 No description found for return value of 'fifo_icap_read_fifo_occupancy' Warning: fifo_icap.c:207 bad line: Warning: fifo_icap.c:214 No description found for return value of 'fifo_icap_set_configuration' Warning: fifo_icap.c:290 function parameter 'frame_buffer' not described in 'fifo_icap_get_configuration' Warning: fifo_icap.c:290 function parameter 'num_words' not described in 'fifo_icap_get_configuration' Warning: fifo_icap.c:290 No description found for return value of 'fifo_icap_get_configuration' Warning: fifo_icap.c:357 expecting prototype for buffer_icap_reset(). Prototype was for fifo_icap_reset() instead Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/20251214191750.2173225-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16kgdbts: mark kgdbts_option_setup() with __init to free init memoryCan Peng1-1/+1
The kgdbts_option_setup() function is invoked only once early in boot via the __setup("kgdbts=", ...) mechanism to parse the kernel command-line option.After init is complete, it is never called again. Annotating it with __init places the function in the .init.text section, enabling the kernel to free its code memory during the init memory cleanup phase (free_initmem()). This reduces the kernel’s runtime memory footprint with no functional side effects. Signed-off-by: Can Peng <pengcan@kylinos.cn> Link: https://patch.msgid.link/20251208130525.2775885-1-pengcan@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: comedi_test: add a DIO subdeviceIan Abbott1-1/+49
The fake "comedi_test" device currently has two subdevices: an analog input subdevice, and an analog output subdevice. To make it a bit more useful for testing, add a third subdevice for digital I/O. The new DIO subdevice has 32 channels with each channel individually programmable as an input or an output. To add a bit of interaction, channels 0 to 15 are wired to channels 16 to 31 (0 to 16, 1 to 17, etc.), and the state of each wire can be read back on both of the channels connected to it. The outputs are modelled as NPN open collector outputs with a pull-up resistor on the wire, so the state of each wire (and the value read back from each channel connected to it) will be logic level 1 unless either channel is configured as an output at logic level 0. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251210124455.69131-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: don't use mutex for COMEDI_BUFINFO ioctlIan Abbott1-13/+68
The main mutex in a comedi device can get held for quite a while when processing comedi instructions, so for performance reasons, the "read", "write", and "poll" file operations do not use it; they use the `attach_lock` rwsemaphore to protect against the comedi device becoming detached at an inopportune moment. As an alternative to using the "read" and "write" operations, user-space can mmap the data buffer and use the `COMEDI_BUFINFO` ioctl to manage data transfer through the buffer. However, the "ioctl" file handler currently locks the main mutex for all ioctl commands. Make the handling of the `COMEDI_BUFINFO` an exception, using the `attach_lock` rwsemaphore during normal operation. However, before it calls `do_become_nonbusy()` at the end of acquisition, it does need to lock the main mutex, but it needs to unlock the `attach_lock` rwsemaphore first to avoid deadlock. After locking the main mutex, it needs to check that it is still in a suitable state to become non-busy, because things may have changed while unlocked. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251205131332.16672-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>