| Age | Commit message (Collapse) | Author | Files | Lines |
|
Add page table entry configurations to support higher sample rate
streams with multiple channels for ACP7.0 platforms.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Add acp70 revision id to support I2S TDM.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Modify max channels and max sample rate support in the dai driver for
acp7.0 platform.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Set i2s bclk and lrclk for acp7.0 platform.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Add I2S master clock generation support for acp7.0 platforms.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Update pcm hardware capabilities for acp7.0 platform.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Add slots selection and 32-channels TDM support for
acp6.3 platform.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Update pcm hardware capabilities based on acp revision id.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
All I2S instances are connected to different powertile form acp6.0
onwards, refactor dai driver to support all I2S instances for all acp
platforms.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Refactor TDM slots selection based on acp revision id.
Signed-off-by: Venkata Prasad Potturu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
The 2024 Lenovo Y9000P which use GT7868Q chip also needs a fixup.
The information of the chip is as follows:
I2C HID v1.00 Mouse [GXTP5100:00 27C6:01E0]
Signed-off-by: He Lugang <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
The codec can be used in conjunction with an audio-graph-card to provide
an endpoint for binding with the other side of the audio link.
Document the 'port' property that is used for this to prevent
dtbscheck errors like:
rockchip/rk3588-nanopc-t6-lts.dtb: codec@1b: Unevaluated properties are not allowed ('port' was unexpected)
from schema $id: http://devicetree.org/schemas/sound/realtek,rt5616.yaml#
Signed-off-by: Heiko Stuebner <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Both devicetrees and driver implementation already use the specified mclk
in the field, so at least document the clock too, similarly to other
Realtek codec.
This has the nice additional effect of getting rid of dtbscheck warning.
Signed-off-by: Heiko Stuebner <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Replace a comma between expression statements by a semicolon.
Signed-off-by: Chen Ni <[email protected]>
Acked-by: Basavaraj Natikar <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
Commit 8a0ec8c2d736 ("spi: Insert the missing pci_dev_put()before
return") added two uses of pci_dev_put() with an uninitialized dma_dev,
resulting in the following compiler warnings (or errors with
CONFIG_WERROR) when building with clang:
drivers/spi/spi-pxa2xx-pci.c:150:15: error: variable 'dma_dev' is uninitialized when used here [-Werror,-Wuninitialized]
150 | pci_dev_put(dma_dev);
| ^~~~~~~
drivers/spi/spi-pxa2xx-pci.c:228:15: error: variable 'dma_dev' is uninitialized when used here [-Werror,-Wuninitialized]
228 | pci_dev_put(dma_dev);
| ^~~~~~~
Commit 609d7ffdc421 ("spi: pxa2xx-pci: Balance reference count for PCI
DMA device") added a call to pci_dev_put() via
devm_add_action_or_reset() in case of failures, so the recent change was
incorrect for multiple reasons. Revert it altogether.
Fixes: 8a0ec8c2d736 ("spi: Insert the missing pci_dev_put()before return")
Reported-by: Geert Uytterhoeven <[email protected]>
Closes: https://lore.kernel.org/CAMuHMdWNjo69_W6f+R9QJJOf8uF0htg2XazeS-yjugJv3UM+kg@mail.gmail.com/
Signed-off-by: Nathan Chancellor <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
In this function, the assignment ret is unnecessary,
thus remove it.
Signed-off-by: tangbin <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
|
|
Elan-ekth6a12nay requires reset to pull down time greater than 10ms,
so the configuration post_power_delay_ms is 10, and the chipset
initial time is required to be greater than 300ms,
so the post_gpio_reset_on_delay_ms is set to 300.
Reviewed-by: Douglas Anderson <[email protected]>
Signed-off-by: Zhaoxiong Lv <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
The Elan ekth6a12nay touch screen chip same as Elan eKTH6915 controller
has a reset gpio. The difference is that they have different
post_power_delay_ms.
Acked-by: Rob Herring (Arm) <[email protected]>
Signed-off-by: Zhaoxiong Lv <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
|
|
When removing a resource from vmci_resource_table in
vmci_resource_remove(), the search is performed using the resource
handle by comparing context and resource fields.
It is possible though to create two resources with different types
but same handle (same context and resource fields).
When trying to remove one of the resources, vmci_resource_remove()
may not remove the intended one, but the object will still be freed
as in the case of the datagram type in vmci_datagram_destroy_handle().
vmci_resource_table will still hold a pointer to this freed resource
leading to a use-after-free vulnerability.
BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106
print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
__kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425
kasan_report+0x38/0x51 mm/kasan/report.c:442
vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182
ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline]
vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
__fput+0x261/0xa34 fs/file_table.c:282
task_work_run+0xf0/0x194 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187
exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
__syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline]
syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313
do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x6e/0x0
This change ensures the type is also checked when removing
the resource from vmci_resource_table in vmci_resource_remove().
Fixes: bc63dedb7d46 ("VMCI: resource object implementation.")
Cc: [email protected]
Reported-by: George Kennedy <[email protected]>
Signed-off-by: David Fernandez Gonzalez <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
devm_free_percpu() calls devres_release() with a pointer in percpu
address space. devres_release() expects pointers in the generic address
space, so address space needs to be stripped from the argument.
When strict percpu address space checks are enabled, then the current
direct cast from the percpu address space to the generic address space
fails the compilation on x86_64 with:
devres.c:1234:32: error: cast to generic address space pointer from disjoint ‘__seg_gs’ address space pointer
Add intermediate casts to unsigned long to remove address space of
the pointer before casting it to the generic AS, as advised in [1]
and [2].
Side note: sparse still requires __force, although the documentation
[2] allows casts to unsigned long without __force attribute.
Found by GCC's named address space checks.
There were no changes in the resulting object file.
[1] https://gcc.gnu.org/onlinedocs/gcc/Named-Address-Spaces.html#x86-Named-Address-Spaces
[2] https://sparse.docs.kernel.org/en/latest/annotations.html#address-space-name
Signed-off-by: Uros Bizjak <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Cc: Rafael J. Wysocki <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
device_(for_each|find)_child()
The following API cluster takes the same type parameter list, but do not
have consistent parameter check as shown below.
device_for_each_child(struct device *parent, ...) // check (!parent->p)
device_for_each_child_reverse(struct device *parent, ...) // same as above
device_find_child(struct device *parent, ...) // check (!parent)
Fixed by using consistent check (!parent || !parent->p) which covers
both existing checks for the cluster.
Signed-off-by: Zijun Hu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Since commit d492cc2573a0 ("driver core: device.h: make struct
bus_type a const *"), the driver core can properly handle constant
struct bus_type, move the fsl_mc_bus_type variable to be a constant
structure as well, placing it into read-only memory which can not be
modified at runtime.
Cc: Greg Kroah-Hartman <[email protected]>
Suggested-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Kunwu Chan <[email protected]>
Acked-by: Christophe Leroy <[email protected]> # for
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Yue Haibing says:
====================
cleanup chelsio driver declarations
v2: correct patch 3 commit citation
====================
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
|
|
These functions were never implenmented since introduction in
commit 8199d3a79c22 ("[PATCH] A new 10GB Ethernet Driver by Chelsio
Communications")
Signed-off-by: Yue Haibing <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Commit e2d14b42c25c ("cxgb4: Remove WOL get/set ethtool support") removed
t4_wol_magic_enable() and t4_wol_pat_enable() but leave declarations.
Commit 02d805dc5fe3 ("cxgb4: use new fw interface to get the VIN and smt
index") leave behind cxgb4_tp_smt_idx().
cxgb4_dcb_set_caps() is never implemented and used since introduction in
commit 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops").
Reviewed-by: Simon Horman <[email protected]>
Signed-off-by: Yue Haibing <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Commit 4d22de3e6cc4 ("Add support for the latest 1G/10G Chelsio adapter,
T3.") declared but never implemented these.
Reviewed-by: Simon Horman <[email protected]>
Signed-off-by: Yue Haibing <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Set the driver default to enable asynchronous shutdown.
Signed-off-by: Stuart Hayes <[email protected]>
Signed-off-by: David Jeffery <[email protected]>
Reviewed-by: Sagi Grimberg <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Reviewed-by: Keith Busch <[email protected]>
Tested-by: Keith Busch <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Add code to allow asynchronous shutdown of devices, ensuring that each
device is shut down before its parents & suppliers.
Only devices with drivers that have async_shutdown_enable enabled will be
shut down asynchronously.
This can dramatically reduce system shutdown/reboot time on systems that
have multiple devices that take many seconds to shut down (like certain
NVMe drives). On one system tested, the shutdown time went from 11 minutes
without this patch to 55 seconds with the patch.
Signed-off-by: Stuart Hayes <[email protected]>
Signed-off-by: David Jeffery <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Reviewed-by: Sagi Grimberg <[email protected]>
Reviewed-by: Keith Busch <[email protected]>
Tested-by: Keith Busch <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Make a separate function for the part of device_shutdown() that does the
shutown for a single device. This is in preparation for making device
shutdown asynchronous.
Signed-off-by: Stuart Hayes <[email protected]>
Signed-off-by: David Jeffery <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Reviewed-by: Sagi Grimberg <[email protected]>
Reviewed-by: Keith Busch <[email protected]>
Tested-by: Keith Busch <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Don't lock a parent device unless it is needed in device_shutdown. This
is in preparation for making device shutdown asynchronous, when it will
be needed to allow children of a common parent to shut down
simultaneously.
Signed-off-by: Stuart Hayes <[email protected]>
Signed-off-by: David Jeffery <[email protected]>
Reviewed-by: Sagi Grimberg <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Reviewed-by: Keith Busch <[email protected]>
Tested-by: Keith Busch <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
The sctp selftest is very slow on debug kernels.
Its possible that the nf_queue listener program exits due to timeout
before first sctp packet is processed.
In this case socat hangs until script times out.
Fix this by removing the -t option where possible and kill the test
program once the file transfer/socat has exited.
-t sets SO_RCVTIMEO, its inteded for the 'ping' part of the selftest
where we want to make sure that packets get reinjected properly without
skipping a second queue request.
While at it, add a helper to compare the (binary) files instead of diff.
The 'diff' part was copied from a another sub-test that compares text.
Let helper dump file sizes on error so we can see the progress made.
Tested on an old 2010-ish box with a debug kernel and 100 iterations.
This is a followup to the earlier filesize reduction change.
Reported-by: Jakub Kicinski <[email protected]>
Closes: https://lore.kernel.org/netdev/[email protected]/
Fixes: 0a8b08c554da ("selftests: netfilter: nft_queue.sh: reduce test file size for debug build")
Signed-off-by: Florian Westphal <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Since commit d492cc2573a0 ("driver core: device.h: make struct
bus_type a const *"), the driver core can properly handle constant
struct bus_type, move the platform_bus_type variable to be a constant
structure as well, placing it into read-only memory which can not be
modified at runtime.
Cc: Greg Kroah-Hartman <[email protected]>
Suggested-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Kunwu Chan <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Device class has two namespace relevant fields which are usually
associated by the following usage:
struct class {
...
const struct kobj_ns_type_operations *ns_type;
const void *(*namespace)(const struct device *dev);
...
}
if (dev->class && dev->class->ns_type)
dev->class->namespace(dev);
(1) The usage looks weird since it checks @ns_type but calls namespace()
(2) The usage implies both fields have dependency but their dependency
is not currently enforced yet.
It is found for all existing class definitions that the other filed is
also assigned once one is assigned in current kernel tree.
Fixed by enforcing above existing dependency that both fields are required
for a device class to support namespace via parameter checks.
Signed-off-by: Zijun Hu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Do not write-protect the kernel read-only and __ro_after_init sections
earlier than before mark_rodata_ro() is called. This fixes a boot issue on
parisc which is triggered by commit 91a1d97ef482 ("jump_label,module: Don't
alloc static_key_mod for __ro_after_init keys"). That commit may modify
static key contents in the __ro_after_init section at bootup, so this
section needs to be writable at least until mark_rodata_ro() is called.
Signed-off-by: Helge Deller <[email protected]>
Reported-by: matoro <[email protected]>
Reported-by: Christoph Biedl <[email protected]>
Tested-by: Christoph Biedl <[email protected]>
Link: https://lore.kernel.org/linux-parisc/[email protected]/#r
Fixes: 91a1d97ef482 ("jump_label,module: Don't alloc static_key_mod for __ro_after_init keys")
Cc: [email protected] # v6.10+
|
|
The original document doesn't explain the return value directly which
leads to confusing in error checking.
You can find the reason here:
Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Yuesong Li <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Jinjie Ruan says:
====================
net: Simplified with scoped function
Simplify with scoped for each OF child loop, as well as dev_err_probe().
Changes in v4:
- Drop the fix patch and __free() patch.
- Rebased on the fix patch has been stripped out.
- Remove the extra parentheses.
- Ensure Signed-off-by: should always be last.
- Add Reviewed-by.
- Update the cover letter commit message.
Changes in v3:
- Sort the variables, longest first, shortest last.
- Add Reviewed-by.
Changes in v2:
- Subject prefix: next -> net-next.
- Split __free() from scoped for each OF child loop clean.
- Fix use of_node_put() instead of __free() for the 5th patch.
====================
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Use scoped for_each_available_child_of_node_scoped() when
iterating over device nodes to make code a bit simpler.
Reviewed-by: Florian Fainelli <[email protected]>
Reviewed-by: Justin Chen <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Avoids the need for manual cleanup of_node_put() in early exits
from the loop by using for_each_available_child_of_node_scoped().
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Use scoped for_each_available_child_of_node_scoped() when iterating
over device nodes to make code a bit simpler.
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Use the dev_err_probe() helper to simplify code.
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Avoids the need for manual cleanup of_node_put() in early exits
from the loop by using for_each_available_child_of_node_scoped().
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Avoid need to manually handle of_node_put() by using
for_each_available_child_of_node_scoped(), which can simplfy code.
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Avoid need to manually handle of_node_put() by using
for_each_child_of_node_scoped(), which can simplfy code.
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Linus Walleij <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Avoid need to manually handle of_node_put() by using
for_each_child_of_node_scoped(), which can simplfy code.
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Paolo Abeni <[email protected]>
|
|
There are several drivers/base APIs for finding a specific device, and
they currently use the following good type for the @match parameter:
int (*match)(struct device *dev, const void *data)
Since these operations do not modify the caller-provided @*data, this
type is worthy of a dedicated typedef:
typedef int (*device_match_t)(struct device *dev, const void *data)
Advantages of using device_match_t:
- Shorter API declarations and definitions
- Prevent further APIs from using a bad type for @match
So introduce device_match_t and apply it to the existing
(bus|class|driver|auxiliary)_find_device() APIs.
Signed-off-by: Zijun Hu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Most firmware names are hardcoded strings, or are constructed from fairly
constrained format strings where the dynamic parts are just some hex
numbers or such.
However, there are a couple codepaths in the kernel where firmware file
names contain string components that are passed through from a device or
semi-privileged userspace; the ones I could find (not counting interfaces
that require root privileges) are:
- lpfc_sli4_request_firmware_update() seems to construct the firmware
filename from "ModelName", a string that was previously parsed out of
some descriptor ("Vital Product Data") in lpfc_fill_vpd()
- nfp_net_fw_find() seems to construct a firmware filename from a model
name coming from nfp_hwinfo_lookup(pf->hwinfo, "nffw.partno"), which I
think parses some descriptor that was read from the device.
(But this case likely isn't exploitable because the format string looks
like "netronome/nic_%s", and there shouldn't be any *folders* starting
with "netronome/nic_". The previous case was different because there,
the "%s" is *at the start* of the format string.)
- module_flash_fw_schedule() is reachable from the
ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as
GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is
enough to pass the privilege check), and takes a userspace-provided
firmware name.
(But I think to reach this case, you need to have CAP_NET_ADMIN over a
network namespace that a special kind of ethernet device is mapped into,
so I think this is not a viable attack path in practice.)
Fix it by rejecting any firmware names containing ".." path components.
For what it's worth, I went looking and haven't found any USB device
drivers that use the firmware loader dangerously.
Cc: [email protected]
Reviewed-by: Danilo Krummrich <[email protected]>
Fixes: abb139e75c2c ("firmware: teach the kernel to load firmware files directly from the filesystem")
Signed-off-by: Jann Horn <[email protected]>
Acked-by: Luis Chamberlain <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
spidev on the elgin-r1 got a real compatible, the rk3128 could enable its
VPU for video decoding and the rk3128 sfc node can use the clock constant
now after the merge-window.
* tag 'v6.12-rockchip-dts32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
ARM: dts: rockchip: Do not describe unexisting DAC device on rv1108-elgin-r1
ARM: dts: rockchip: Add vpu nodes for RK3128
ARM: dts: rockchip: use constant for HCLK_SFC on rk3128
Link: https://lore.kernel.org/r/3405397.RL5eaSpR8r@diego
Signed-off-by: Arnd Bergmann <[email protected]>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
New boards: Firefly PX30 Core SoM with JD4 baseboard, NanoPi 2S Plus,
Taishan Pi RK3566, ODROID-M1S,NanoPC-T6 LTS, Cool Pi CM5 GenBook
Big number of improvements for NanoPC-T6,QNAP-TS433 and FastRhino R66S
With recent dtc changes making it into linux-next the Wolfvision Visualizer
overlay finally compiles without warnings. And smaller number of
improvements on a number of Radxa boards.
Interesting new additions on a soc-level are the hardware RNG on rk3568,
an additional sdmmc-controller (not supported before) on rk3328 and
v4l video codecs for the rk3588 (decoding of h.264 amongst others).
* tag 'v6.12-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (62 commits)
arm64: dts: rockchip: drop unsupported regulator-property from NanoPC-T6
arm64: dts: rockchip: drop unsupported regulator property from NanoPC-T6
arm64: dts: rockchip: use correct fcs,suspend-voltage-selector on NanoPC-T6
arm64: dts: rockchip: add Mask Rom key on NanoPC-T6
arm64: dts: rockchip: enable USB-C on NanoPC-T6
arm64: dts: rockchip: enable GPU on NanoPC-T6
arm64: dts: rockchip: add IR-receiver to NanoPC-T6
arm64: dts: rockchip: add SPI flash on NanoPC-T6
arm64: dts: rockchip: add NanoPC-T6 LTS
arm64: dts: rockchip: move NanoPC-T6 parts to DTS
arm64: dts: rockchip: prepare NanoPC-T6 for LTS board
dt-bindings: arm: rockchip: Add NanoPC-T6 LTS
arm64: dts: rockchip: disable display subsystem only for Radxa E25
arm64: dts: rockchip: enable PCIe on M.2 E key for Radxa ROCK 5A
arm64: dts: rockchip: remove unnecessary properties for Radxa ROCK 5A
arm64: dts: rockchip: add dts for LCKFB Taishan Pi RK3566
dt-bindings: arm: rockchip: Add LCKFB Taishan Pi RK3566
dt-bindings: vendor-prefixes: Add Shenzhen JLC Technology Group LCKFB
arm64: dts: rockchip: Add Hardkernel ODROID-M1S
dt-bindings: arm: rockchip: Add Hardkernel ODROID-M1S
...
Link: https://lore.kernel.org/r/6322098.17fYzF0512@diego
Signed-off-by: Arnd Bergmann <[email protected]>
|
|
The call of of_get_child_by_name() will cause refcount incremented
for leds, if it succeeds, it should call of_node_put() to decrease
it, fix it.
Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs")
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
|
|
Rescind offer handling relies on rescind callbacks for some of the
resources cleanup, if they are registered. It does not unregister
vmbus device for the primary channel closure, when callback is
registered. Without it, next onoffer does not come, rescind flag
remains set and device goes to unusable state.
Add logic to unregister vmbus for the primary channel in rescind callback
to ensure channel removal and relid release, and to ensure that next
onoffer can be received and handled properly.
Cc: [email protected]
Fixes: ca3cda6fcf1e ("uio_hv_generic: add rescind support")
Signed-off-by: Naman Jain <[email protected]>
Reviewed-by: Saurabh Sengar <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|